CVE-2022-4378

A stack overflow flaw was found in the Linux kernel's SYSCTL subsystem in how a user changes certain kernel parameters and variables. This flaw allows a local user to crash or potentially escalate their privileges on the system.

Security Fix(es):

A use-after-free flaw was found in Linux kernel before 5.19.2. This issue occurs in cmd_hdl_filter in drivers/staging/rtl8712/rtl8712_cmd.c, allowing an attacker to launch a local denial of service attack and gain escalation of privileges.(CVE-2022-4095)

There are null-ptr-deref vulnerabilities in drivers/net/slip of linux that allow attacker to crash linux kernel by simulating slip network card from user-space of linux.

[Root cause]

When a slip driver is detaching, the slip_close() will act to cleanup necessary resources and sl->tty is set to NULL in slip_close(). Meanwhile, the packet we transmit is blocked, sl_tx_timeout() will be called. Although slip_close() and sl_tx_timeout() use sl->lock to synchronize, we don`t judge whether sl->tty equals to NULL in sl_tx_timeout() and the null pointer dereference bug will happen.

(Thread 1) | (Thread 2) | slip_close() | spin_lock_bh(&sl->lock) | ... ... | sl->tty = NULL //(1) sl_tx_timeout() | spin_unlock_bh(&sl->lock) spin_lock(&sl->lock); | ... | ... tty_chars_in_buffer(sl->tty)| if (tty->ops->..) //(2) | ... | synchronize_rcu()

We set NULL to sl->tty in position (1) and dereference sl->tty in position (2).

------------------------------------------(CVE-2022-41858)

A flaw was found in the Linux kernel's Layer 2 Tunneling Protocol (L2TP). A missing lock when clearing sk_user_data can lead to a race condition and NULL pointer dereference. A local user could use this flaw to potentially crash the system causing a denial of service.(CVE-2022-4129)

In (TBD) of (TBD), there is a possible way to corrupt kernel memory due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-220738351References: Upstream kernel(CVE-2022-20568)

In l2cap_chan_put of l2cap_core, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-165329981References: Upstream kernel(CVE-2022-20566)

Guests can trigger NIC interface reset/abort/crash via netback It is possible for a guest to trigger a NIC interface reset/abort/crash in a Linux based network backend by sending certain kinds of packets. It appears to be an (unwritten?) assumption in the rest of the Linux network stack that packet protocol headers are all contained within the linear section of the SKB and some NICs behave badly if this is not the case. This has been reported to occur with Cisco (enic) and Broadcom NetXtrem II BCM5780 (bnx2x) though it may be an issue with other NICs/drivers as well. In case the frontend is sending requests with split headers, netback will forward those violating above mentioned assumption to the networking core, resulting in said misbehavior.(CVE-2022-3643)

In verity_target of dm-verity-target.c, there is a possible way to modify read-only files due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-234475629References: Upstream kernel(CVE-2022-20572)

A stack overflow flaw was found in the Linux kernel's SYSCTL subsystem in how a user changes certain kernel parameters and variables. This flaw allows a local user to crash or potentially escalate their privileges on the system.(CVE-2022-4378)

In drivers/media/dvb-core/dmxdev.c in the Linux kernel through 5.19.10, there is a use-after-free caused by refcount races, affecting dvb_demux_open and dvb_dmxdev_release.(CVE-2022-41218)

Guests can trigger deadlock in Linux netback driver…

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: stack overflow in do_proc_dointvec and proc_skip_spaces (CVE-2022-4378)

• ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF (CVE-2023-0266)

• kernel: FUSE filesystem low-privileged user privileges escalation (CVE-2023-0386)

• kernel: net: CPU soft lockup in TC mirred egress-to-ingress action (CVE-2022-4269)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• kernel panic on reboot due to a bug in mei_wdt module (BZ#2139770)

• Rocky Linux8: Practically limit "Dummy wait" workaround to old Intel systems (BZ#2142170)

• AMDSERVER 8.7: amdpstate driver incorrectly designed to load as default for Genoa (BZ#2151275)

• Rocky Linux-8.8: Update RDMA core to Linux v6.0 (BZ#2161750)

• Kernel panic observed during VxFS module unload (BZ#2162763)

• Client not able to connect to rhel server: SYN is answered by chalange ACK and RST is ignored (BZ#2165587)

• Rocky Linux8.4: s390/kexec: fix ipl report address for kdump (BZ#2166296)

• kvm-unit-test reports unhandled exception on AMD (BZ#2166362)

• Windows Server 2019 guest randomly pauses with "KVM: entry failed, hardware error 0x80000021" (BZ#2166368)

• Unable to get QinQ working with ConnectX-4 Lx in SR-IOV scenario (BZ#2166665)

• panic in fib6_rule_suppress+0x22 with custom xdp prog involved in (BZ#2167602)

• net/mlx5e: Fix use-after-free when reverting termination table (BZ#2167640)

• Rocky Linux 8.7: EEH injection failed to recover on Mellanox adapter. (BZ#2167645)

• mlx5: lag and sriov fixes (BZ#2167647)

• Rocky Linux8.4: dasd: fix no record found for raw_track_access (BZ#2167776)

• GSS: Set of fixes in ceph kernel module to prevent OCS node kernel crash - blocklist the kclient when receiving corrupted snap trace (BZ#2168896)

• Azure Rocky Linux8 scsi: storvsc: Fix swiotlb bounce buffer leak in confidential VM (BZ#2170228)

• fast_isolate_freepages scans out of target zone (BZ#2170576)

• Backport Request for locking/rwsem commits (BZ#2170939)

• ipv6 traffic stop when an sriov vf have ipv6 address (BZ#2172550)

• Hyper-V Rocky Linux8.8: Update MANA driver (BZ#2173103)

Enhancement(s):

• Intel 8.8 FEAT SPR CPU: AMX: Improve the init_fpstate setup code (BZ#2168384)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: use-after-free caused by l2cap_reassemble_sdu() in net/bluetooth/l2cap_core.c (CVE-2022-3564)

• kernel: stack overflow in do_proc_dointvec and proc_skip_spaces (CVE-2022-4378)

• kernel: use-after-free in __nfs42_ssc_open() in fs/nfs/nfs4file.c leading to remote Denial of Service attack (CVE-2022-4379)

• kernel: Netfilter integer overflow vulnerability in nft_payload_copy_vlan (CVE-2023-0179)

• kernel: an out-of-bounds vulnerability in i2c-ismt driver (CVE-2022-2873)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Rocky Linux SIG Cloud 9.0: LTP Test failure and crash at fork14 on Sapphire Rapids Platinum 8280+ (BZ#2133083)

• Rocky Linux SIG Cloud 9.1 Extending NMI watchdog's timer during LPM (BZ#2140085)

• AMDSERVER 9.1: amdpstate driver incorrectly designed to load as default for Genoa (BZ#2151274)

• qla2xxx NVMe-FC: WARNING: CPU: 0 PID: 124072 at drivers/scsi/qla2xxx/qla_init.c:70 qla2xxx_rel_done_warning+0x25/0x30 [qla2xxx] (BZ#2152178)

• Regression: Kernel panic on Lenovo T480 with AH40 USB-C docking station (BZ#2153277)

• Scheduler Update (rhel9.2) (BZ#2153792)

• Rocky Linux SIG Cloud9.1, Nx_Gzip: nr_total_credits is not decremented when processing units are reduced by dlpar in shared mode. (FW1030 / DLPAR) (BZ#2154305)

• MSFT, MANA, NET Patch Rocky Linux SIG Cloud-9: Fix race on per-CQ variable napi_iperf panic fix (BZ#2155145)

• Azure vPCI Rocky Linux SIG Cloud-9 add the support of multi-MSI (BZ#2155459)

• Azure Rocky Linux SIG Cloud-9: VM Deployment Failures Patch Request (BZ#2155930)

• The 'date' command shows wrong time in nested KVM s390x guest (BZ#2158815)

• Rocky Linux SIG Cloud-9.2: Update NVMe driver to sync with upstream v6.0 (BZ#2161344)

• CEE cephfs: Rocky Linux SIG Cloud9 cephfs client crashing with RIP: 0010:netfs_rreq_unlock+0xef/0x380 [netfs] (BZ#2161418)

• block layer: update with upstream v6.0 (BZ#2162535)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: stack overflow in do_proc_dointvec and proc_skip_spaces (CVE-2022-4378)

• ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF (CVE-2023-0266)

• kernel: FUSE filesystem low-privileged user privileges escalation (CVE-2023-0386)

• kernel: net: CPU soft lockup in TC mirred egress-to-ingress action (CVE-2022-4269)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• kernel panic on reboot due to a bug in mei_wdt module (BZ#2139770)

• Rocky Linux SIG Cloud8: Practically limit "Dummy wait" workaround to old Intel systems (BZ#2142170)

• AMDSERVER 8.7: amdpstate driver incorrectly designed to load as default for Genoa (BZ#2151275)

• Rocky Linux SIG Cloud-8.8: Update RDMA core to Linux v6.0 (BZ#2161750)

• Kernel panic observed during VxFS module unload (BZ#2162763)

• Client not able to connect to rhel server: SYN is answered by chalange ACK and RST is ignored (BZ#2165587)

• Rocky Linux SIG Cloud8.4: s390/kexec: fix ipl report address for kdump (BZ#2166296)

• kvm-unit-test reports unhandled exception on AMD (BZ#2166362)

• Windows Server 2019 guest randomly pauses with "KVM: entry failed, hardware error 0x80000021" (BZ#2166368)

• Unable to get QinQ working with ConnectX-4 Lx in SR-IOV scenario (BZ#2166665)

• panic in fib6_rule_suppress+0x22 with custom xdp prog involved in (BZ#2167602)

• net/mlx5e: Fix use-after-free when reverting termination table (BZ#2167640)

• Rocky Linux SIG Cloud 8.7: EEH injection failed to recover on Mellanox adapter. (BZ#2167645)

• mlx5: lag and sriov fixes (BZ#2167647)

• Rocky Linux SIG Cloud8.4: dasd: fix no record found for raw_track_access (BZ#2167776)

• GSS: Set of fixes in ceph kernel module to prevent OCS node kernel crash - blocklist the kclient when receiving corrupted snap trace (BZ#2168896)

• Azure Rocky Linux SIG Cloud8 scsi: storvsc: Fix swiotlb bounce buffer leak in confidential VM (BZ#2170228)

• fast_isolate_freepages scans out of target zone (BZ#2170576)

• Backport Request for locking/rwsem commits (BZ#2170939)

• ipv6 traffic stop when an sriov vf have ipv6 address (BZ#2172550)

• Hyper-V Rocky Linux SIG Cloud8.8: Update MANA driver (BZ#2173103)

Enhancement(s):

• Intel 8.8 FEAT SPR CPU: AMX: Improve the init_fpstate setup code (BZ#2168384)

A stack overflow flaw was found in the Linux kernel's SYSCTL subsystem in how a user changes certain kernel parameters and variables. This flaw allows a local user to crash or potentially escalate their privileges on the system.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: use-after-free caused by l2cap_reassemble_sdu() in net/bluetooth/l2cap_core.c (CVE-2022-3564)
• kernel: stack overflow in do_proc_dointvec and proc_skip_spaces (CVE-2022-4378)
• kernel: use-after-free in __nfs42_ssc_open() in fs/nfs/nfs4file.c leading to remote Denial of Service attack (CVE-2022-4379)
• kernel: Netfilter integer overflow vulnerability in nft_payload_copy_vlan (CVE-2023-0179)
• kernel: an out-of-bounds vulnerability in i2c-ismt driver (CVE-2022-2873)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• AlmaLinux 9.0: LTP Test failure and crash at fork14 on Sapphire Rapids Platinum 8280+ (BZ#2133083)
• AlmaLinux 9.1 Extending NMI watchdog's timer during LPM (BZ#2140085)
• AMDSERVER 9.1: amdpstate driver incorrectly designed to load as default for Genoa (BZ#2151274)
• qla2xxx NVMe-FC: WARNING: CPU: 0 PID: 124072 at drivers/scsi/qla2xxx/qla_init.c:70 qla2xxx_rel_done_warning+0x25/0x30 [qla2xxx] (BZ#2152178)
• Regression: Kernel panic on Lenovo T480 with AH40 USB-C docking station (BZ#2153277)
• Scheduler Update (almalinux9.2) (BZ#2153792)
• AlmaLinux9.1, Nx_Gzip: nr_total_credits is not decremented when processing units are reduced by dlpar in shared mode. (FW1030 / DLPAR) (BZ#2154305)
• MSFT, MANA, NET Patch AlmaLinux-9: Fix race on per-CQ variable napi_iperf panic fix (BZ#2155145)
• Azure vPCI AlmaLinux-9 add the support of multi-MSI (BZ#2155459)
• Azure AlmaLinux-9: VM Deployment Failures Patch Request (BZ#2155930)
• The 'date' command shows wrong time in nested KVM s390x guest (BZ#2158815)
• AlmaLinux-9.2: Update NVMe driver to sync with upstream v6.0 (BZ#2161344)
• CEE cephfs: AlmaLinux9 cephfs client crashing with RIP: 0010:netfs_rreq_unlock+0xef/0x380 [netfs] (BZ#2161418)
• block layer: update with upstream v6.0 (BZ#2162535)

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: use-after-free caused by l2cap_reassemble_sdu() in net/bluetooth/l2cap_core.c (CVE-2022-3564)
• kernel: stack overflow in do_proc_dointvec and proc_skip_spaces (CVE-2022-4378)
• kernel: use-after-free in __nfs42_ssc_open() in fs/nfs/nfs4file.c leading to remote Denial of Service attack (CVE-2022-4379)
• kernel: Netfilter integer overflow vulnerability in nft_payload_copy_vlan (CVE-2023-0179)
• kernel: an out-of-bounds vulnerability in i2c-ismt driver (CVE-2022-2873)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• kernel-rt: update RT source tree to the latest AlmaLinux-9.1.z2 Batch (BZ#2160463)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: stack overflow in do_proc_dointvec and proc_skip_spaces (CVE-2022-4378)
• ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF (CVE-2023-0266)
• kernel: FUSE filesystem low-privileged user privileges escalation (CVE-2023-0386)
• kernel: net: CPU soft lockup in TC mirred egress-to-ingress action (CVE-2022-4269)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• kernel panic on reboot due to a bug in mei_wdt module (BZ#2139770)
• AlmaLinux8: Practically limit "Dummy wait" workaround to old Intel systems (BZ#2142170)
• AMDSERVER 8.7: amdpstate driver incorrectly designed to load as default for Genoa (BZ#2151275)
• AlmaLinux-8.8: Update RDMA core to Linux v6.0 (BZ#2161750)
• Kernel panic observed during VxFS module unload (BZ#2162763)
• Client not able to connect to almalinux server: SYN is answered by chalange ACK and RST is ignored (BZ#2165587)
• AlmaLinux8.4: s390/kexec: fix ipl report address for kdump (BZ#2166296)
• kvm-unit-test reports unhandled exception on AMD (BZ#2166362)
• Windows Server 2019 guest randomly pauses with "KVM: entry failed, hardware error 0x80000021" (BZ#2166368)
• Unable to get QinQ working with ConnectX-4 Lx in SR-IOV scenario (BZ#2166665)
• panic in fib6_rule_suppress+0x22 with custom xdp prog involved in (BZ#2167602)
• net/mlx5e: Fix use-after-free when reverting termination table (BZ#2167640)
• AlmaLinux 8.7: EEH injection failed to recover on Mellanox adapter. (BZ#2167645)
• mlx5: lag and sriov fixes (BZ#2167647)
• AlmaLinux8.4: dasd: fix no record found for raw_track_access (BZ#2167776)
• GSS: Set of fixes in ceph kernel module to prevent OCS node kernel crash - blocklist the kclient when receiving corrupted snap trace (BZ#2168896)
• Azure AlmaLinux8 scsi: storvsc: Fix swiotlb bounce buffer leak in confidential VM (BZ#2170228)
• fast_isolate_freepages scans out of target zone (BZ#2170576)
• Backport Request for locking/rwsem commits (BZ#2170939)
• ipv6 traffic stop when an sriov vf have ipv6 address (BZ#2172550)
• Hyper-V AlmaLinux8.8: Update MANA driver (BZ#2173103)

Enhancement(s):

• Intel 8.8 FEAT SPR CPU: AMX: Improve the init_fpstate setup code (BZ#2168384)

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: stack overflow in do_proc_dointvec and proc_skip_spaces (CVE-2022-4378)
• ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF (CVE-2023-0266)
• kernel: FUSE filesystem low-privileged user privileges escalation (CVE-2023-0386)
• kernel: net: CPU soft lockup in TC mirred egress-to-ingress action (CVE-2022-4269)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Lazy irq_work does not raise softirq on PREEMPT_RT [almalinux-8] (BZ#2172163)
• The latest AlmaLinux 8.7.z3 kernel changes need to be merged into the RT source tree to keep source parity between the two kernels. (BZ#2172278)

• mISDN: fix use-after-free bugs in l1oip timer handlers {CVE-2022-3565}
• media: rc: Fix use-after-free bugs caused by ene_tx_irqsim() {CVE-2023-1118}
• Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work {CVE-2023-1989}
• proc: proc_skip_spaces() shouldn't think it is working on C strings {CVE-2022-4378}
• proc: avoid integer type confusion in get_proc_long {CVE-2022-4378}
• floppy: use a statically allocated error counter {CVE-2022-1652}
• af_key: add __GFP_ZERO flag for compose_sadb_supported in function pfkey_register {CVE-2022-1353}
• usb: mon: make mmapped memory read only {CVE-2022-43750}

• mISDN: fix use-after-free bugs in l1oip timer handlers {CVE-2022-3565}
• media: rc: Fix use-after-free bugs caused by ene_tx_irqsim() {CVE-2023-1118}
• Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work {CVE-2023-1989}
• proc: proc_skip_spaces() shouldn't think it is working on C strings {CVE-2022-4378}
• proc: avoid integer type confusion in get_proc_long {CVE-2022-4378}
• floppy: use a statically allocated error counter {CVE-2022-1652}
• af_key: add __GFP_ZERO flag for compose_sadb_supported in function pfkey_register {CVE-2022-1353}
• usb: mon: make mmapped memory read only {CVE-2022-43750}

• mISDN: fix use-after-free bugs in l1oip timer handlers {CVE-2022-3565}
• media: rc: Fix use-after-free bugs caused by ene_tx_irqsim() {CVE-2023-1118}
• Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work {CVE-2023-1989}
• proc: proc_skip_spaces() shouldn't think it is working on C strings {CVE-2022-4378}
• proc: avoid integer type confusion in get_proc_long {CVE-2022-4378}
• floppy: use a statically allocated error counter {CVE-2022-1652}
• af_key: add __GFP_ZERO flag for compose_sadb_supported in function pfkey_register {CVE-2022-1353}
• usb: mon: make mmapped memory read only {CVE-2022-43750}

• mISDN: fix use-after-free bugs in l1oip timer handlers {CVE-2022-3565}
• media: rc: Fix use-after-free bugs caused by ene_tx_irqsim() {CVE-2023-1118}
• Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work {CVE-2023-1989}
• proc: proc_skip_spaces() shouldn't think it is working on C strings {CVE-2022-4378}
• proc: avoid integer type confusion in get_proc_long {CVE-2022-4378}
• floppy: use a statically allocated error counter {CVE-2022-1652}
• af_key: add __GFP_ZERO flag for compose_sadb_supported in function pfkey_register {CVE-2022-1353}
• usb: mon: make mmapped memory read only {CVE-2022-43750}

• ALSA: pcm: Fix races among concurrent prealloc proc writes {CVE-2022-1048}
• ALSA: pcm: Fix races among concurrent prepare and hw_params/hw_free calls {CVE-2022-1048}
• ALSA: pcm: Fix races among concurrent read/write and buffer changes {CVE-2022-1048}
• ALSA: pcm: Fix races among concurrent hw_params and hw_free calls {CVE-2022-1048}
• x86/elf: Disable automatic READ_IMPLIES_EXEC on 64-bit {CVE-2022-25265}
• x86/elf: Split READ_IMPLIES_EXEC from executable PT_GNU_STACK {CVE-2022-25265}
• x86/elf: Add table to document READ_IMPLIES_EXEC {CVE-2022-25265}
• drm/i915: fix TLB invalidation for Gen12 video and compute engines {CVE-2022-4139}
• drm/i915: Flush TLBs before releasing backing store {CVE-2022-0330}
• xfs: fix up non-directory creation in SGID directories {CVE-2021-4037}
• tcp: Fix data races around icsk->icsk_af_ops. {CVE-2022-3566}
• ipv6: Fix data races around sk->sk_prot. {CVE-2022-3567}
• ipv6: annotate some data-races around sk->sk_prot {CVE-2022-3567}
• ipv6: use indirect call wrappers for {tcp, udpv6}_{recv, send}msg() {CVE-2022-3567}
• netfilter: nf_tables: deactivate anonymous set from preparation phase {CVE-2023-32233}
• netfilter: nf_tables: bogus EBUSY when deleting set after flush
• media: dmxdev: fix UAF when dvb_register_device() fails {CVE-2022-41218}
• l2tp: Don't sleep and disable BH under writer-side sk_callback_lock {CVE-2022-4129}
• l2tp: Serialize access to sk_user_data with sk_callback_lock {CVE-2022-4129}
• net: fix a concurrency bug in l2tp_tunnel_register() {CVE-2022-4129}
• Bluetooth: L2CAP: Fix memory leak in vhci_write {CVE-2022-3619}
• Bluetooth: L2CAP: Fix handling fragmented length
• wifi: brcmfmac: Fix potential buffer overflow in brcmf_fweh_event_worker() {CVE-2022-3628}
• wifi: cfg80211: avoid nontransmitted BSS list corruption {CVE-2022-42721}
• cfg80211: scan: fix RCU in cfg80211_add_nontrans_list()
• wifi: cfg80211: fix BSS refcounting bugs {CVE-2022-42720}
• cfg80211: hold bss_lock while updating nontrans_list
• ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF {CVE-2023-0266}
• ALSA: control: Drop superfluous snd_power_wait() calls
• ALSA: control: Track in-flight control read/write/tlv accesses
• ALSA: control - introduce snd_ctl_notify_one() helper
• Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu {CVE-2022-3564}
• netfilter: nf_conntrack_irc: Tighten matching on DCC message {CVE-2022-2663}
• netfilter: nf_conntrack_irc: Fix forged IP logic {CVE-2022-2663}
• KVM: x86: Avoid theoretical NULL pointer dereference in kvm_irq_delivery_to_apic_fast() {CVE-2022-2153}
• KVM: Add infrastructure and macro to mark VM as bugged
• KVM: x86/mmu: fix NULL pointer dereference on guest INVPCID {CVE-2022-1789}
• tcp/udp: Fix memory leak in ipv6_renew_options(). {CVE-2022-3524}
• proc: proc_skip_spaces() shouldn't think it is working on C strings {CVE-2022-4378}
• proc: avoid integer type confusion in get_proc_long {CVE-2022-4378}
• wifi: mac80211: fix crash in beacon protection for P2P-device {CVE-2022-42722}
• net: sched: cbq: dont intepret cls results when asked to drop {CVE-2023-23454}
• ipv6: raw: Deduct extension header length in rawv6_push_pending_frames {CVE-2023-0394}
• net: sched: disallow noqueue for qdisc classes {CVE-2022-47929}
• wifi: cfg80211: fix u8 overflow in cfg80211_update_notlisted_nontrans() {CVE-2022-41674}
• af_key: Do not call xfrm_probe_algs in parallel {CVE-2022-3028}
• dm verity: set DM_TARGET_IMMUTABLE feature flag {CVE-2022-20572}

• ALSA: pcm: Fix races among concurrent prealloc proc writes {CVE-2022-1048}
• ALSA: pcm: Fix races among concurrent prepare and hw_params/hw_free calls {CVE-2022-1048}
• ALSA: pcm: Fix races among concurrent read/write and buffer changes {CVE-2022-1048}
• ALSA: pcm: Fix races among concurrent hw_params and hw_free calls {CVE-2022-1048}
• x86/elf: Disable automatic READ_IMPLIES_EXEC on 64-bit {CVE-2022-25265}
• x86/elf: Split READ_IMPLIES_EXEC from executable PT_GNU_STACK {CVE-2022-25265}
• x86/elf: Add table to document READ_IMPLIES_EXEC {CVE-2022-25265}
• KVM: SEV-ES: fix another issue with string I/O VMGEXITs {CVE-2021-4093}
• KVM: SEV-ES: go over the sev_pio_data buffer in multiple passes if needed {CVE-2021-4093}
• KVM: SEV-ES: keep INS functions together {CVE-2021-4093}
• KVM: x86: remove unnecessary arguments from complete_emulator_pio_in {CVE-2021-4093}
• KVM: x86: split the two parts of emulator_pio_in {CVE-2021-4093}
• KVM: x86: leave vcpu->arch.pio.count alone in emulator_pio_in_out {CVE-2021-4093}
• KVM: SEV-ES: clean up kvm_sev_es_ins/outs {CVE-2021-4093}
• KVM: SEV-ES: rename guest_ins_data to sev_pio_data {CVE-2021-4093}
• KVM: SEV-ES: fix length of string I/O {CVE-2021-4093}
• drm/i915: fix TLB invalidation for Gen12 video and compute engines {CVE-2022-4139}
• drm/i915: Flush TLBs before releasing backing store {CVE-2022-0330}
• xfs: fix up non-directory creation in SGID directories {CVE-2021-4037}
• tcp: Fix data races around icsk->icsk_af_ops. {CVE-2022-3566}
• ipv6: Fix data races around sk->sk_prot. {CVE-2022-3567}
• ipv6: annotate some data-races around sk->sk_prot {CVE-2022-3567}
• ipv6: use indirect call wrappers for {tcp, udpv6}_{recv, send}msg() {CVE-2022-3567}
• netfilter: nf_tables: deactivate anonymous set from preparation phase {CVE-2023-32233}
• netfilter: nf_tables: bogus EBUSY when deleting set after flush
• media: dmxdev: fix UAF when dvb_register_device() fails {CVE-2022-41218}
• l2tp: Don't sleep and disable BH under writer-side sk_callback_lock {CVE-2022-4129}
• l2tp: Serialize access to sk_user_data with sk_callback_lock {CVE-2022-4129}
• net: fix a concurrency bug in l2tp_tunnel_register() {CVE-2022-4129}
• Bluetooth: L2CAP: Fix memory leak in vhci_write {CVE-2022-3619}
• Bluetooth: L2CAP: Fix handling fragmented length
• wifi: brcmfmac: Fix potential buffer overflow in brcmf_fweh_event_worker() {CVE-2022-3628}
• wifi: cfg80211: avoid nontransmitted BSS list corruption {CVE-2022-42721}
• cfg80211: scan: fix RCU in cfg80211_add_nontrans_list()
• wifi: cfg80211: fix BSS refcounting bugs {CVE-2022-42720}
• cfg80211: hold bss_lock while updating nontrans_list
• ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF {CVE-2023-0266}
• ALSA: control: Drop superfluous snd_power_wait() calls
• ALSA: control: Track in-flight control read/write/tlv accesses
• Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu {CVE-2022-3564}
• netfilter: nf_conntrack_irc: Tighten matching on DCC message {CVE-2022-2663}
• netfilter: nf_conntrack_irc: Fix forged IP logic {CVE-2022-2663}
• KVM: x86: Avoid theoretical NULL pointer dereference in kvm_irq_delivery_to_apic_fast() {CVE-2022-2153}
• KVM: Add infrastructure and macro to mark VM as bugged
• KVM: x86/mmu: fix NULL pointer dereference on guest INVPCID {CVE-2022-1789}
• tcp/udp: Fix memory leak in ipv6_renew_options(). {CVE-2022-3524}
• proc: proc_skip_spaces() shouldn't think it is working on C strings {CVE-2022-4378}
• proc: avoid integer type confusion in get_proc_long {CVE-2022-4378}
• wifi: mac80211: fix crash in beacon protection for P2P-device {CVE-2022-42722}
• net: sched: cbq: dont intepret cls results when asked to drop {CVE-2023-23454}
• ipv6: raw: Deduct extension header length in rawv6_push_pending_frames {CVE-2023-0394}
• net: sched: disallow noqueue for qdisc classes {CVE-2022-47929}
• wifi: cfg80211: fix u8 overflow in cfg80211_update_notlisted_nontrans() {CVE-2022-41674}
• af_key: Do not call xfrm_probe_algs in…

Kyle Zeng discovered that the sysctl implementation in the Linux kernel contained a stack-based buffer overflow. A local attacker could use this to cause a denial of service (system crash) or execute arbitrary code.(CVE-2022-4378)

Tamás Koczka discovered that the Bluetooth L2CAP handshake implementation in the Linux kernel contained multiple use-after-free vulnerabilities. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-2022-42896)

It was discovered that the NFSD implementation in the Linux kernel did not properly handle some RPC messages, leading to a buffer overflow. A remote attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-2022-43945)

This kernel update is based on upstream 5.15.82 and fixes atleast the following security issues:

A flaw was found in the Linux kernel. A denial of service flaw may occur if there is a consecutive request of the NVME_IOCTL_RESET and the NVME_IOCTL_SUBSYS_RESET through the device file of the driver, resulting in a PCIe link disconnect (CVE-2022-3169).

A flaw was found in the KVM's AMD nested virtualization (SVM). A malicious L1 guest could purposely fail to intercept the shutdown of a cooperative nested guest (L2), possibly leading to a page fault and kernel panic in the host (L0) (CVE-2022-3344).

A vulnerability has been found in Linux Kernel function kcm_tx_work of the file net/kcm/kcmsock.c of the component kcm. The manipulation leads to race condition (CVE-2022-3521).

Guests can trigger NIC interface reset/abort/crash via netback. It is possible for a guest to trigger a NIC interface reset/abort/crash in a Linux based network backend by sending certain kinds of packets. It appears to be an (unwritten?) assumption in the rest of the Linux network stack that packet protocol headers are all contained within the linear section of the SKB and some NICs behave badly if this is not the case. This has been reported to occur with Cisco (enic) and Broadcom NetXtrem II BCM5780 (bnx2x) though it may be an issue with other NICs/drivers as well. In case the frontend is sending requests with split headers, netback will forward those violating above mentioned assumption to the networking core, resulting in said misbehavior (CVE-2022-3643, XSA-423).

An incorrect TLB flush issue was found in the Linux kernel’s GPU i915 kernel driver, potentially leading to random memory corruption or data leaks. This flaw could allow a local user to crash the system or escalate their privileges on the system (CVE-2022-4139).

A stack overflow flaw was found in the Linux kernel's SYSCTL subsystem in how a user changes certain kernel parameters and variables. This flaw allows a local user to crash or potentially escalate their privileges on the system (CVE-2022-4378).

The patch for XSA-392 introduced another issue which might result in a deadlock when trying to free the SKB of a packet dropped due to the XSA-392 handling (CVE-2022-42328, XSA-424). Additionally when dropping packages for other reasons the same deadlock could occur in case of netpoll being active for the interface the xen-netback driver is connected to (CVE-2022-42329, XSA-424).

A race condition in the x86 KVM subsystem in the Linux kernel allows guest OS users to cause a denial of service (host OS crash or host OS memory corruption) when nested virtualisation and the TDP MMU are enabled (CVE-2022-45869).

For other upstream fixes in this update, see the referenced changelogs.