CVE-2023-1095

In nf_tables_updtable, if nf_tables_table_enable returns an error, nft_trans_destroy is called to free the transaction object. nft_trans_destroy() calls list_del(), but the transaction was never placed on a list -- the list head is all zeroes, this results in a NULL pointer dereference.

The Linux Kernel, the operating system core itself.

Security Fix(es):

A flaw found in the Linux Kernel. The missing check causes a type confusion when issuing a list_entry() on an empty report_list. The problem is caused by the assumption that the device must have valid report_list. While this will be true for all normal HID devices, a suitably malicious device can violate the assumption.

References: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=b12fece4c64857e5fab4290bf01b2e0317a88456 https://www.openwall.com/lists/oss-security/2023/01/17/3(CVE-2023-1073)

In nf_tables_updtable, if nf_tables_table_enable returns an error, nft_trans_destroy is called to free the transaction object. nft_trans_destroy() calls list_del(), but the transaction was never placed on a list -- the list head is all zeroes, this results in a NULL pointer dereference.(CVE-2023-1095)

The Linux Kernel, the operating system core itself.

Security Fix(es):

A flaw found in the Linux Kernel. The missing check causes a type confusion when issuing a list_entry() on an empty report_list. The problem is caused by the assumption that the device must have valid report_list. While this will be true for all normal HID devices, a suitably malicious device can violate the assumption.

References: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=b12fece4c64857e5fab4290bf01b2e0317a88456 https://www.openwall.com/lists/oss-security/2023/01/17/3(CVE-2023-1073)

In nf_tables_updtable, if nf_tables_table_enable returns an error, nft_trans_destroy is called to free the transaction object. nft_trans_destroy() calls list_del(), but the transaction was never placed on a list -- the list head is all zeroes, this results in a NULL pointer dereference.(CVE-2023-1095)

The Linux Kernel, the operating system core itself.

Security Fix(es):

A memory corruption flaw was found in the Linux kernel’s human interface device (HID) subsystem in how a user inserts a malicious USB device. This flaw allows a local user to crash or potentially escalate their privileges on the system.(CVE-2023-1073)

A memory leak flaw was found in the Linux kernel's Stream Control Transmission Protocol. This issue may occur when a user starts a malicious networking service and someone connects to this service. This could allow a local user to starve resources, causing a denial of service.(CVE-2023-1074)

In nf_tables_updtable, if nf_tables_table_enable returns an error, nft_trans_destroy is called to free the transaction object. nft_trans_destroy() calls list_del(), but the transaction was never placed on a list -- the list head is all zeroes, this results in a NULL pointer dereference.(CVE-2023-1095)

A use-after-free flaw was found in r592_remove in drivers/memstick/host/r592.c in media access in the Linux Kernel. This flaw allows a local attacker to crash the system at device disconnect, possibly leading to a kernel information leak.(CVE-2023-3141)

An out of bounds (OOB) memory access flaw was found in the Linux kernel in relay_file_read_start_pos in kernel/relay.c in the relayfs. This flaw could allow a local attacker to crash the system or leak kernel internal information.(CVE-2023-3268)

An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in rkvdec_remove in drivers/staging/media/rkvdec/rkvdec.c.(CVE-2023-35829)

In nf_tables_updtable, if nf_tables_table_enable returns an error, nft_trans_destroy is called to free the transaction object. nft_trans_destroy() calls list_del(), but the transaction was never placed on a list -- the list head is all zeroes, this results in a NULL pointer dereference.

• CVE-2022-1198
  • drivers: hamradio: 6pack: fix UAF bug caused by mod_timer()
• Bionic update: upstream stable patchset 2022-03-04 (LP: #1963717) // CVE-2020-36516
  • ipv4: avoid using shared IP generator for connected sockets
• CVE-2022-36879
  • xfrm: xfrm_policy: fix a possible double xfrm_pols_put() in xfrm_bundle_lookup()
• CVE-2022-3061
  • video: fbdev: i740fb: Error out if 'pixclock' equals zero
• CVE-2022-1516
  • net/x25: Fix null-ptr-deref caused by x25_disconnect
• CVE-2022-1205
  • ax25: Fix NULL pointer dereferences in ax25 timers
  • ax25: Fix UAF bugs in ax25 timers
• CVE-2022-2318
  • net: rose: fix UAF bugs caused by timer handler
• CVE-2022-1195
  • hamradio: defer 6pack kfree after unregister_netdev
  • hamradio: defer ax25 kfree after unregister_netdev
  • hamradio: improve the incomplete fix to avoid NPD
• CVE-2022-0494
  • block-map: add __GFP_ZERO flag for alloc_page in function bio_copy_kern
• CVE-2021-26401
  • x86/speculation: Use generic retpoline by default on AMD
• Bionic update: upstream stable patchset 2022-10-18 (LP: #1993349) // CVE-2022-39188
  • mm: Fix TLB flush for not-first PFNMAP mappings in unmap_region()
• Bionic update: upstream stable patchset 2022-10-06 (LP: #1992112) // CVE-2022-39188
  • mm: Force TLB flush for PFNMAP mappings before unlink_file_vma()
• CVE-2022-45934
  • Bluetooth: L2CAP: Fix u8 overflow
• Bionic update: upstream stable patchset 2022-06-21 (LP: #1979355) // CVE-2022-2991
  • lightnvm: disable the subsystem
• Bionic update: upstream stable patchset 2021-11-02 (LP: #1949512) // CVE-2021-4203
  • af_unix: fix races in sk_peer_pid and sk_peer_cred accesses
• Bionic update: upstream stable patchset 2022-04-26 (LP: #1970479) // CVE-2021-3772
  • sctp: fix the processing for INIT chunk
  • sctp: fix the processing for INIT_ACK chunk
• Bionic update: upstream stable patchset 2021-12-03 (LP: #1953202) // CVE-2021-3772
  • sctp: use init_tag from inithdr for ABORT chunk
  • sctp: fix the processing for COOKIE_ECHO chunk
  • sctp: add vtag check in sctp_sf_violation
  • sctp: add vtag check in sctp_sf_do_8_5_1_E_sa
  • sctp: add vtag check in sctp_sf_ootb
• CVE-2022-3303
  • ALSA: pcm: oss: Fix race at SNDCTL_DSP_SYNC
• Bionic update: upstream stable patchset 2022-09-21 (LP: #1990434) // CVE-2022-1462
  • tty: extract tty_flip_buffer_commit() from tty_flip_buffer_push()
  • tty: use new tty_insert_flip_string_and_push_buffer() in pty_write()
• CVE-2022-1462
  • tty: fix deadlock caused by calling printk() under tty_port->lock
• Bionic update: upstream stable patchset 2020-11-10 (LP: #1903768) // CVE-2022-1462
  • pty: do tty_flip_buffer_push without port->lock in pty_write
• Bionic update: upstream stable patchset 2019-02-08 (LP: #1815234) // CVE-2022-1462
  • tty: Fix data race in tty_insert_flip_string_fixed_flag
• Bionic update: upstream stable patchset 2022-10-18 (LP: #1993349) // CVE-2022-4662
  • USB: core: Prevent nested device-reset calls
• Bionic update: upstream stable patchset 2022-03-04 (LP: #1963717) // CVE-2022-0617
  • udf: Restore i_lenAlloc when inode expansion fails
  • udf: Fix NULL ptr deref when converting from inline format
• Bionic update: upstream stable patchset 2022-04-26 (LP: #1970479) // CVE-2022-1016
  • netfilter: nf_tables: initialize registers in nft_do_chain()
• Bionic update: upstream stable patchset 2022-05-17 (LP: #1973831) // CVE-2022-2380
  • video: fbdev: sm712fb: Fix crash in smtcfb_read()
• Bionic update: upstream stable patchset 2022-05-17 (LP: #1973831) // CVE-2022-3111
  • power: supply: wm8350-power: Add missing free in free_charger_irq
• CVE-2022-3628
  • wifi: brcmfmac: Fix potential buffer overflow in brcmf_fweh_event_worker()
• Bionic update:…

• CVE-2022-1198
  • drivers: hamradio: 6pack: fix UAF bug caused by mod_timer()
• Bionic update: upstream stable patchset 2022-03-04 (LP: #1963717) // CVE-2020-36516
  • ipv4: avoid using shared IP generator for connected sockets
• CVE-2022-36879
  • xfrm: xfrm_policy: fix a possible double xfrm_pols_put() in xfrm_bundle_lookup()
• CVE-2022-3061
  • video: fbdev: i740fb: Error out if 'pixclock' equals zero
• CVE-2022-1516
  • net/x25: Fix null-ptr-deref caused by x25_disconnect
• CVE-2022-1205
  • ax25: Fix NULL pointer dereferences in ax25 timers
  • ax25: Fix UAF bugs in ax25 timers
• CVE-2022-2318
  • net: rose: fix UAF bugs caused by timer handler
• CVE-2022-1195
  • hamradio: defer 6pack kfree after unregister_netdev
  • hamradio: defer ax25 kfree after unregister_netdev
  • hamradio: improve the incomplete fix to avoid NPD
• CVE-2022-0494
  • block-map: add __GFP_ZERO flag for alloc_page in function bio_copy_kern
• CVE-2021-26401
  • x86/speculation: Use generic retpoline by default on AMD
• Bionic update: upstream stable patchset 2022-10-18 (LP: #1993349) // CVE-2022-39188
  • mm: Fix TLB flush for not-first PFNMAP mappings in unmap_region()
• Bionic update: upstream stable patchset 2022-10-06 (LP: #1992112) // CVE-2022-39188
  • mm: Force TLB flush for PFNMAP mappings before unlink_file_vma()
• CVE-2022-45934
  • Bluetooth: L2CAP: Fix u8 overflow
• Bionic update: upstream stable patchset 2022-06-21 (LP: #1979355) // CVE-2022-2991
  • lightnvm: disable the subsystem
• Bionic update: upstream stable patchset 2021-11-02 (LP: #1949512) // CVE-2021-4203
  • af_unix: fix races in sk_peer_pid and sk_peer_cred accesses
• Bionic update: upstream stable patchset 2022-04-26 (LP: #1970479) // CVE-2021-3772
  • sctp: fix the processing for INIT chunk
  • sctp: fix the processing for INIT_ACK chunk
• Bionic update: upstream stable patchset 2021-12-03 (LP: #1953202) // CVE-2021-3772
  • sctp: use init_tag from inithdr for ABORT chunk
  • sctp: fix the processing for COOKIE_ECHO chunk
  • sctp: add vtag check in sctp_sf_violation
  • sctp: add vtag check in sctp_sf_do_8_5_1_E_sa
  • sctp: add vtag check in sctp_sf_ootb
• CVE-2022-3303
  • ALSA: pcm: oss: Fix race at SNDCTL_DSP_SYNC
• Bionic update: upstream stable patchset 2022-09-21 (LP: #1990434) // CVE-2022-1462
  • tty: extract tty_flip_buffer_commit() from tty_flip_buffer_push()
  • tty: use new tty_insert_flip_string_and_push_buffer() in pty_write()
• CVE-2022-1462
  • tty: fix deadlock caused by calling printk() under tty_port->lock
• Bionic update: upstream stable patchset 2020-11-10 (LP: #1903768) // CVE-2022-1462
  • pty: do tty_flip_buffer_push without port->lock in pty_write
• Bionic update: upstream stable patchset 2019-02-08 (LP: #1815234) // CVE-2022-1462
  • tty: Fix data race in tty_insert_flip_string_fixed_flag
• Bionic update: upstream stable patchset 2022-10-18 (LP: #1993349) // CVE-2022-4662
  • USB: core: Prevent nested device-reset calls
• Bionic update: upstream stable patchset 2022-03-04 (LP: #1963717) // CVE-2022-0617
  • udf: Restore i_lenAlloc when inode expansion fails
  • udf: Fix NULL ptr deref when converting from inline format
• Bionic update: upstream stable patchset 2022-04-26 (LP: #1970479) // CVE-2022-1016
  • netfilter: nf_tables: initialize registers in nft_do_chain()
• Bionic update: upstream stable patchset 2022-05-17 (LP: #1973831) // CVE-2022-2380
  • video: fbdev: sm712fb: Fix crash in smtcfb_read()
• Bionic update: upstream stable patchset 2022-05-17 (LP: #1973831) // CVE-2022-3111
  • power: supply: wm8350-power: Add missing free in free_charger_irq
• CVE-2022-3628
  • wifi: brcmfmac: Fix potential buffer overflow in brcmf_fweh_event_worker()
• Bionic update:…

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-3606: Fixed a null pointer dereference inside the function find_prog_by_sec_insn of the file tools/lib/bpf/libbpf.c of the component BPF (bsc#1204502).
• CVE-2022-36280: Fixed out-of-bounds memory access vulnerability found in vmwgfx driver (bsc#1203332).
• CVE-2022-38096: Fixed NULL-ptr deref in vmw_cmd_dx_define_query() (bsc#1203331).
• CVE-2022-47929: Fixed a NULL pointer dereference bug in the traffic control subsystem (bsc#1207237).
• CVE-2023-0045: Fixed missing Flush IBP in ib_prctl_set (bsc#1207773).
• CVE-2023-0179: Fixed incorrect arithmetics when fetching VLAN header bits (bsc#1207034).
• CVE-2023-0266: Fixed a use-after-free vulnerability inside the ALSA PCM package. SNDRV_CTL_IOCTL_ELEM_{READ|WRITE}32 was missing locks that could have been used in a use-after-free that could have resulted in a priviledge escalation to gain ring0 access from the system user (bsc#1207134).
• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2023-0597: Fixed lack of randomization of per-cpu entry area in x86/mm (bsc#1207845).
• CVE-2023-1076: Fixed incorrect initialization of socket ui in tap_open() (bsc#1208599).
• CVE-2023-1095: Fixed fix null deref due to zeroed list head in nf_tables (bsc#1208777).
• CVE-2023-1118: Fixed a use-after-free bugs caused by ene_tx_irqsim() in media/rc (bsc#1208837).
• CVE-2023-1195: Fixed a use-after-free caused by invalid pointer hostname in cifs (bsc#1208971).
• CVE-2023-22995: Fixed lacks of certain platform_device_put and kfree in drivers/usb/dwc3/dwc3-qcom.c (bsc#1208741).
• CVE-2023-22998: Fixed NULL vs IS_ERR checking in virtio_gpu_object_shmem_init (bsc#1208776).
• CVE-2023-23000: Fixed return value of tegra_xusb_find_port_node function phy/tegra (bsc#1208816).
• CVE-2023-23004: Fixed NULL vs IS_ERR() checking in malidp (bsc#1208843).
• CVE-2023-23006: Fixed NULL vs IS_ERR checking in dr_domain_init_resources (bsc#1208845).
• CVE-2023-23559: Fixed integer overflow in rndis_wlan that leads to a buffer overflow (bsc#1207051).
• CVE-2023-25012: Fixed a use-after-eree in bigben_set_led() in hid (bsc#1207560).
• CVE-2023-26545: Fixed double free in net/mpls/af_mpls.c upon an allocation failure (bsc#1208700).

The following non-security bugs were fixed:

• add support for enabling livepatching related packages on -RT (jsc#PED-1706)
• add suse-kernel-rpm-scriptlets to kmp buildreqs (boo#1205149)
• bcache: fix set_at_max_writeback_rate() for multiple attached devices (git-fixes).
• blktrace: Fix output non-blktrace event when blk_classic option enabled (git-fixes).
• blktrace: ensure our debugfs dir exists (git-fixes).
• ceph: avoid putting the realm twice when decoding snaps fails (bsc#1207198).
• ceph: do not update snapshot context when there is no new snapshot (bsc#1207218).
• config.conf: Drop armv7l, Leap 15.3 is EOL.
• constraints: increase disk space for all architectures References: bsc#1203693 aarch64 is already suffering. SLE15-SP5 x86_64 stats show that it is very close to the limit.
• delete config/armv7hl/default.
• delete config/armv7hl/lpae.
• dm btree: add a defensive bounds check to insert_at() (git-fixes).
• dm cache: Fix ABBA deadlock between shrink_slab and dm_cache_metadata_abort (git-fixes).
• dm cache: Fix UAF in destroy() (git-fixes).
• dm cache: set needs_check flag after aborting metadata (git-fixes).
• dm clone: Fix UAF in clone_dtr() (git-fixes).
• dm integrity: Fix UAF in dm_integrity_dtr() (git-fixes).
• dm integrity: fix flush with external metadata device (git-fixes).
• dm integrity: flush the journal on suspend (git-fixes).
• dm integrity: select CRYPTO_SKCIPHER (git-fixes).
• dm ioctl: fix misbehavior if list_versions races with module loading (git-fixes).
• dm ioctl: prevent potential spectre v1 gadget (git-fixes).
• dm space map common: add bounds check to sm_ll_lookup_bitmap()…

The SUSE Linux Enterprise 15 SP4 Azure kernel was updated to receive various security and bugfixes.

• CVE-2022-3523: Fixed use after free related to device private page handling (bsc#1204363).
• CVE-2022-36280: Fixed out-of-bounds memory access vulnerability found in vmwgfx driver (bsc#1203332).
• CVE-2022-38096: Fixed NULL-ptr deref in vmw_cmd_dx_define_query() (bsc#1203331).
• CVE-2023-0045: Fixed missing Flush IBP in ib_prctl_set (bsc#1207773).
• CVE-2023-0122: Fixed a NULL pointer dereference vulnerability in nvmet_setup_auth(), that allowed an attacker to perform a Pre-Auth Denial of Service (DoS) attack on a remote machine (bsc#1207050).
• CVE-2023-0461: Fixed use-after-free in icsk_ulp_data (bsc#1208787).
• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2023-0597: Fixed lack of randomization of per-cpu entry area in x86/mm (bsc#1207845).
• CVE-2023-1075: Fixed a type confusion in tls_is_tx_ready (bsc#1208598).
• CVE-2023-1076: Fixed incorrect UID assigned to tun/tap sockets (bsc#1208599).
• CVE-2023-1078: Fixed a heap out-of-bounds write in rds_rm_zerocopy_callback (bsc#1208601).
• CVE-2023-1095: Fixed a NULL pointer dereference in nf_tables due to zeroed list head (bsc#1208777).
• CVE-2023-1118: Fixed a use-after-free bugs caused by ene_tx_irqsim() in media/rc (bsc#1208837).
• CVE-2023-22995: Fixed lacks of certain platform_device_put and kfree in drivers/usb/dwc3/dwc3-qcom.c (bsc#1208741).
• CVE-2023-22998: Fixed misinterpretatino of the irtio_gpu_object_shmem_init() return value (bsc#1208776).
• CVE-2023-23000: Fixed return value of tegra_xusb_find_port_node function (bsc#1208816).
• CVE-2023-23001: Fixed misinterpretion of the regulator_get return value (bsc# 1208829).
• CVE-2023-23004: Fixed misinterpretatino of the get_sg_table return value in arm/malidp_planes.c (bsc#1208843).
• CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207036).
• CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (bsc#1207125).
• CVE-2023-23559: Fixed integer overflow in rndis_wlan that leads to a buffer overflow (bsc#1207051).
• CVE-2023-25012: Fixed a use-after-free in bigben_set_led() (bsc#1207560).
• CVE-2023-26545: Fixed double free in net/mpls/af_mpls.c upon an allocation failure (bsc#1208700).
• CVE-2023-28328: Fixed a denial of service issue in az6027 driver in drivers/media/usb/dev-usb/az6027.c (bsc#1209291).

The following non-security bugs were fixed:

• NFSv4.1 provide mount option to toggle trunking discovery (git-fixes).
• acpi / x86: Add support for LPS0 callback handler (git-fixes).
• acpi: Do not build ACPICA with '-Os' (git-fixes).
• acpi: NFIT: fix a potential deadlock during NFIT teardown (git-fixes).
• acpi: PM: s2idle: Add support for upcoming AMD uPEP HID AMDI008 (bsc#1206224).
• acpi: PM: s2idle: Use LPS0 idle if ACPI_FADT_LOW_POWER_S0 is unset (bsc#1206224).
• acpi: battery: Fix missing NUL-termination with large strings (git-fixes).
• acpi: resource: Add helper function acpi_dev_get_memory_resources() (git-fixes).
• acpi: video: Fix Lenovo Ideapad Z570 DMI match (git-fixes).
• acpi: x86: s2idle: Add a quirk for ASUS ROG Zephyrus G14 (bsc#1206224).
• acpi: x86: s2idle: Add a quirk for ASUS TUF Gaming A17 FA707RE (bsc#1206224).
• acpi: x86: s2idle: Add a quirk for ASUSTeK COMPUTER INC. ROG Flow X13 (bsc#1206224).
• acpi: x86: s2idle: Add a quirk for Lenovo Slim 7 Pro 14ARH7 (bsc#1206224).
• acpi: x86: s2idle: Add another ID to s2idle_dmi_table (bsc#1206224).
• acpi: x86: s2idle: Add module parameter to prefer Microsoft GUID (bsc#1206224).
• acpi: x86: s2idle: Fix a NULL pointer dereference (bsc#1206224).
• acpi: x86: s2idle: Force AMD GUID/_REV 2 on HP Elitebook 865 (bsc#1206224).
• acpi: x86: s2idle: If a new AMD _HID is missing assume Rembrandt (bsc#1206224).
• acpi: x86: s2idle: Move…

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security and bugfixes.

• CVE-2022-3523: Fixed use after free related to device private page handling (bsc#1204363).
• CVE-2022-38096: Fixed NULL-ptr deref in vmw_cmd_dx_define_query() (bsc#1203331).
• CVE-2023-0461: Fixed use-after-free in icsk_ulp_data (bsc#1208787).
• CVE-2023-0597: Fixed lack of randomization of per-cpu entry area in x86/mm (bsc#1207845).
• CVE-2023-1075: Fixed a type confusion in tls_is_tx_ready (bsc#1208598).
• CVE-2023-1076: Fixed incorrect UID assigned to tun/tap sockets (bsc#1208599).
• CVE-2023-1078: Fixed a heap out-of-bounds write in rds_rm_zerocopy_callback (bsc#1208601).
• CVE-2023-1095: Fixed a NULL pointer dereference in nf_tables due to zeroed list head (bsc#1208777).
• CVE-2023-1118: Fixed a use-after-free bugs caused by ene_tx_irqsim() in media/rc (bsc#1208837).
• CVE-2023-22995: Fixed lacks of certain platform_device_put and kfree in drivers/usb/dwc3/dwc3-qcom.c (bsc#1208741).
• CVE-2023-22998: Fixed misinterpretation of the irtio_gpu_object_shmem_init() return value (bsc#1208776).
• CVE-2023-23000: Fixed return value of tegra_xusb_find_port_node function phy/tegra (bsc#1208816).
• CVE-2023-23004: Fixed misinterpretation of the get_sg_table return value in arm/malidp_planes.c (bsc#1208843).
• CVE-2023-23559: Fixed integer overflow in rndis_wlan that leads to a buffer overflow (bsc#1207051).
• CVE-2023-25012: Fixed a use-After-Free in bigben_set_led() in hid (bsc#1207560).
• CVE-2023-26545: Fixed double free in net/mpls/af_mpls.c upon an allocation failure (bsc#1208700).
• CVE-2023-28328: Fixed a denial of service issue in az6027 driver in drivers/media/usb/dev-usb/az6027.c (bsc#1209291).

The following non-security bugs were fixed:

• [xen] fix 'direction' argument of iov_iter_kvec() (git-fixes).
• acpi: Do not build ACPICA with '-Os' (git-fixes).
• acpi: NFIT: fix a potential deadlock during NFIT teardown (git-fixes).
• acpi: battery: Fix missing NUL-termination with large strings (git-fixes).
• acpi: resource: Add helper function acpi_dev_get_memory_resources() (git-fixes).
• acpi: video: Fix Lenovo Ideapad Z570 DMI match (git-fixes).
• acpica: Drop port I/O validation for some regions (git-fixes).
• acpica: nsrepair: handle cases without a return value correctly (git-fixes).
• alsa: hda/ca0132: minor fix for allocation size (git-fixes).
• alsa: hda/conexant: add a new hda codec SN6180 (git-fixes).
• alsa: hda/realtek - fixed wrong gpio assigned (git-fixes).
• alsa: hda/realtek: Add quirk for HP EliteDesk 800 G6 Tower PC (git-fixes).
• alsa: hda: Do not unset preset when cleaning up codec (git-fixes).
• alsa: hda: Match only Intel devices with CONTROLLER_IN_GPU() (git-fixes).
• alsa: ice1712: Delete unreachable code in aureon_add_controls() (git-fixes).
• alsa: ice1712: Do not left ice->gpio_mutex locked in aureon_add_controls() (git-fixes).
• applicom: Fix PCI device refcount leak in applicom_init() (git-fixes).
• arm64: Treat ESR_ELx as a 64-bit register (git-fixes)
• arm64: atomics: remove LL/SC trampolines (git-fixes)
• arm64: cacheinfo: Fix incorrect assignment of signed error value to (git-fixes)
• arm64: cmpxchg_double*: hazard against entire exchange variable (git-fixes)
• arm64: dts: amlogic: meson-axg: fix SCPI clock dvfs node name (git-fixes).
• arm64: dts: amlogic: meson-gx-libretech-pc: fix update button name (git-fixes).
• arm64: dts: amlogic: meson-gx: add missing SCPI sensors compatible (git-fixes).
• arm64: dts: amlogic: meson-gx: add missing unit address to rng node name (git-fixes).
• arm64: dts: amlogic: meson-gx: fix SCPI clock dvfs node name (git-fixes).
• arm64: dts: amlogic: meson-gxbb-kii-pro: fix led node name (git-fixes).
• arm64: dts: amlogic: meson-gxl-s905d-phicomm-n1: fix led node name (git-fixes).
• arm64: dts: amlogic: meson-gxl-s905d-sml5442tw: drop invalid clock-names property (git-fixes).
• arm64: dts: amlogic: meson-gxl: add missing unit address to eth-phy-mux node name…

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security and bugfixes.

• CVE-2022-3523: Fixed a use after free related to device private page handling (bsc#1204363).
• CVE-2022-36280: Fixed out-of-bounds memory access vulnerability found in vmwgfx driver (bsc#1203332).
• CVE-2022-38096: Fixed NULL-ptr deref in vmw_cmd_dx_define_query() (bsc#1203331).
• CVE-2023-0045: Fixed missing Flush IBP in ib_prctl_set (bsc#1207773).
• CVE-2023-0461: Fixed use-after-free in icsk_ulp_data (bsc#1208787).
• CVE-2023-0597: Fixed lack of randomization of per-cpu entry area in x86/mm (bsc#1207845).
• CVE-2023-1075: Fixed a type confusion in tls_is_tx_ready (bsc#1208598).
• CVE-2023-1076: Fixed incorrect UID assigned to tun/tap sockets (bsc#1208599).
• CVE-2023-1078: Fixed a heap out-of-bounds write in rds_rm_zerocopy_callback (bsc#1208601).
• CVE-2023-1095: Fixed a NULL pointer dereference in nf_tables due to zeroed list head (bsc#1208777).
• CVE-2023-1118: Fixed a use-after-free bugs caused by ene_tx_irqsim() in media/rc (bsc#1208837).
• CVE-2023-22995: Fixed lacks of certain platform_device_put and kfree in drivers/usb/dwc3/dwc3-qcom.c (bsc#1208741).
• CVE-2023-22998: Fixed NULL vs IS_ERR checking in virtio_gpu_object_shmem_init (bsc#1208776).
• CVE-2023-23000: Fixed return value of tegra_xusb_find_port_node function phy/tegra (bsc#1208816).
• CVE-2023-23004: Fixed misinterpretation of get_sg_table return value (bsc#1208843).
• CVE-2023-23559: Fixed integer overflow in rndis_wlan that leads to a buffer overflow (bsc#1207051).
• CVE-2023-25012: Fixed a use-after-free in bigben_set_led() (bsc#1207560).
• CVE-2023-26545: Fixed double free in net/mpls/af_mpls.c upon an allocation failure (bsc#1208700).
• CVE-2023-28328: Fixed a denial of service issue in az6027 driver in drivers/media/usb/dev-usb/az6027.c (bsc#1209291).

The following non-security bugs were fixed:

• [infiniband] READ is 'data destination', not source... (git-fixes)
• [xen] fix 'direction' argument of iov_iter_kvec() (git-fixes).
• acpi/x86: Add support for LPS0 callback handler (git-fixes).
• acpi: Do not build ACPICA with '-Os' (git-fixes).
• acpi: NFIT: fix a potential deadlock during NFIT teardown (git-fixes).
• acpi: PM: s2idle: Add support for upcoming AMD uPEP HID AMDI008 (bsc#1206224).
• acpi: PM: s2idle: Use LPS0 idle if ACPI_FADT_LOW_POWER_S0 is unset (bsc#1206224).
• acpi: battery: Fix missing NUL-termination with large strings (git-fixes).
• acpi: resource: Add helper function acpi_dev_get_memory_resources() (git-fixes).
• acpi: video: Fix Lenovo Ideapad Z570 DMI match (git-fixes).
• acpi: x86: s2idle: Add a quirk for ASUS ROG Zephyrus G14 (bsc#1206224).
• acpi: x86: s2idle: Add a quirk for ASUS TUF Gaming A17 FA707RE (bsc#1206224).
• acpi: x86: s2idle: Add a quirk for ASUSTeK COMPUTER INC. ROG Flow X13 (bsc#1206224).
• acpi: x86: s2idle: Add a quirk for Lenovo Slim 7 Pro 14ARH7 (bsc#1206224).
• acpi: x86: s2idle: Add another ID to s2idle_dmi_table (bsc#1206224).
• acpi: x86: s2idle: Add module parameter to prefer Microsoft GUID (bsc#1206224).
• acpi: x86: s2idle: Fix a NULL pointer dereference (bsc#1206224).
• acpi: x86: s2idle: Force AMD GUID/_REV 2 on HP Elitebook 865 (bsc#1206224).
• acpi: x86: s2idle: If a new AMD _HID is missing assume Rembrandt (bsc#1206224).
• acpi: x86: s2idle: Move _HID handling for AMD systems into structures (bsc#1206224).
• acpi: x86: s2idle: Stop using AMD specific codepath for Rembrandt+ (bsc#1206224).
• acpica: Drop port I/O validation for some regions (git-fixes).
• acpica: nsrepair: handle cases without a return value correctly (git-fixes).
• add cherry-picked id for nouveau patch
• alsa: emux: Avoid potential array out-of-bound in snd_emux_xg_control() (git-fixes).
• alsa: hda/ca0132: minor fix for allocation size (git-fixes).
• alsa: hda/conexant: add a new hda codec SN6180 (git-fixes).
• alsa: hda/realtek - fixed wrong gpio assigned (git-fixes).
• alsa: hda/realtek: Add Positivo N14KP6-TG (git-fixes). -…

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2017-5753: Fixed spectre V1 vulnerability on netlink (bsc#1209547).
• CVE-2017-5753: Fixed spectre vulnerability in prlimit (bsc#1209256).
• CVE-2021-3923: Fixed stack information leak vulnerability that could lead to kernel protection bypass in infiniband RDMA (bsc#1209778).
• CVE-2022-4744: Fixed double-free that could lead to DoS or privilege escalation in TUN/TAP device driver functionality (bsc#1209635).
• CVE-2023-0394: Fixed a null pointer dereference flaw in the network subcomponent in the Linux kernel which could lead to system crash (bsc#1207168).
• CVE-2023-0461: Fixed use-after-free in icsk_ulp_data (bsc#1208787).
• CVE-2023-1075: Fixed a type confusion in tls_is_tx_ready (bsc#1208598).
• CVE-2023-1076: Fixed incorrect UID assigned to tun/tap sockets (bsc#1208599).
• CVE-2023-1078: Fixed a heap out-of-bounds write in rds_rm_zerocopy_callback (bsc#1208601).
• CVE-2023-1095: Fixed a NULL pointer dereference in nf_tables due to zeroed list head (bsc#1208777).
• CVE-2023-1281: Fixed use after free that could lead to privilege escalation in tcindex (bsc#1209634).
• CVE-2023-1382: Fixed denial of service in tipc_conn_close (bsc#1209288).
• CVE-2023-1390: Fixed remote DoS vulnerability in tipc_link_xmit() (bsc#1209289).
• CVE-2023-1513: Fixed an uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak (bsc#1209532).
• CVE-2023-1582: Fixed soft lockup in __page_mapcount (bsc#1209636).
• CVE-2023-23004: Fixed misinterpretation of get_sg_table return value (bsc#1208843).
• CVE-2023-25012: Fixed a use-after-free in bigben_set_led() (bsc#1207560).
• CVE-2023-28327: Fixed DoS in in_skb in unix_diag_get_exact() (bsc#1209290).
• CVE-2023-28328: Fixed a denial of service issue in az6027 driver in drivers/media/usb/dev-usb/az6027.c (bsc#1209291).
• CVE-2023-28464: Fixed user-after-free that could lead to privilege escalation in hci_conn_cleanup in net/bluetooth/hci_conn.c (bsc#1209052).
• CVE-2023-28466: Fixed race condition that could lead to use-after-free or NULL pointer dereference in do_tls_getsockopt in net/tls/tls_main.c (bsc#1209366).
• CVE-2023-28772: Fixed buffer overflow in seq_buf_putmem_hex in lib/seq_buf.c (bsc#1209549).

The following non-security bugs were fixed:

• Do not sign the vanilla kernel (bsc#1209008).
• PCI: hv: Add a per-bus mutex state_lock (bsc#1207185).
• PCI: hv: Fix a race condition in hv_irq_unmask() that can cause panic (bsc#1207185).
• PCI: hv: Remove the useless hv_pcichild_state from struct hv_pci_dev (bsc#1207185).
• PCI: hv: fix a race condition bug in hv_pci_query_relations() (bsc#1207185).
• Revert 'PCI: hv: Fix a timing issue which causes kdump to fail occasionally' (bsc#1209785).
• ipv6: raw: Deduct extension header length in rawv6_push_pending_frames (bsc#1207168).
• kernel-module-subpackage: Fix expansion with -b parameter (bsc#1208179).

The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2017-5753: Fixed spectre V1 vulnerability on netlink (bsc#1209547).
• CVE-2017-5753: Fixed spectre vulnerability in prlimit (bsc#1209256).
• CVE-2021-3923: Fixed stack information leak vulnerability that could lead to kernel protection bypass in infiniband RDMA (bsc#1209778).
• CVE-2022-20567: Fixed use after free that could lead to a local privilege escalation in pppol2tp_create of l2tp_ppp.c (bsc#1208850).
• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2023-1076: Fixed incorrect UID assigned to tun/tap sockets (bsc#1208599).
• CVE-2023-1095: Fixed a NULL pointer dereference in nf_tables due to zeroed list head (bsc#1208777).
• CVE-2023-1281: Fixed use after free that could lead to privilege escalation in tcindex (bsc#1209634).
• CVE-2023-1390: Fixed remote DoS vulnerability in tipc_link_xmit() (bsc#1209289).
• CVE-2023-1513: Fixed an uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak (bsc#1209532).
• CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207036).
• CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (bsc#1207125).
• CVE-2023-28328: Fixed a denial of service issue in az6027 driver in drivers/media/usb/dev-usb/az6027.c (bsc#1209291).
• CVE-2023-28464: Fixed user-after-free that could lead to privilege escalation in hci_conn_cleanup in net/bluetooth/hci_conn.c (bsc#1209052).
• CVE-2023-28772: Fixed buffer overflow in seq_buf_putmem_hex in lib/seq_buf.c (bsc#1209549).

The following non-security bugs were fixed:

• ARM: 8702/1: head-common.S: Clear lr before jumping to start_kernel() (git-fixes)
• Bluetooth: btusb: Add VID:PID 13d3:3529 for Realtek RTL8821CE (git-fixes).
• Bluetooth: btusb: do not call kfree_skb() under spin_lock_irqsave() (git-fixes).
• Input: atmel_mxt_ts - fix double free in mxt_read_info_block (git-fixes).
• KVM: arm64: Hide system instruction access to Trace registers (git-fixes)
• NFSv4: Fix hangs when recovering open state after a server reboot (git-fixes).
• PCI/MSI: Enforce MSI entry updates to be visible (git-fixes).
• PCI/MSI: Enforce that MSI-X table entry is masked for update (git-fixes).
• PCI/MSI: Mask all unused MSI-X entries (git-fixes).
• PCI/MSI: Skip masking MSI-X on Xen PV (git-fixes).
• PCI/PM: Always return devices to D0 when thawing (git-fixes).
• PCI/PM: Avoid using device_may_wakeup() for runtime PM (git-fixes).
• PCI: Add ACS quirk for Intel Root Complex Integrated Endpoints (git-fixes).
• PCI: Add ACS quirk for iProc PAXB (git-fixes).
• PCI: Avoid FLR for AMD Matisse HD Audio & USB 3.0 (git-fixes).
• PCI: Avoid FLR for AMD Starship USB 3.0 (git-fixes).
• PCI: Make ACS quirk implementations more uniform (git-fixes).
• PCI: PM: Avoid forcing PCI_D0 for wakeup reasons inconsistently (git-fixes).
• PCI: PM: Avoid skipping bus-level PM on platforms without ACPI (git-fixes).
• PCI: Unify ACS quirk desired vs provided checking (git-fixes).
• PCI: Use pci_update_current_state() in pci_enable_device_flags() (git-fixes).
• PCI: aardvark: Do not blindly enable ASPM L0s and do not write to read-only register (git-fixes).
• PCI: aardvark: Do not rely on jiffies while holding spinlock (git-fixes).
• PCI: aardvark: Do not touch PCIe registers if no card connected (git-fixes).
• PCI: aardvark: Fix a leaked reference by adding missing of_node_put() (git-fixes).
• PCI: aardvark: Fix checking for PIO Non-posted Request (git-fixes).
• PCI: aardvark: Fix kernel panic during PIO transfer (git-fixes).
• PCI: aardvark: Improve link training (git-fixes).
• PCI: aardvark: Indicate error in 'val' when config read fails (git-fixes).
• PCI: aardvark: Introduce an…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2017-5753: Fixed spectre V1 vulnerability on netlink (bsc#1209547).
• CVE-2017-5753: Fixed spectre vulnerability in prlimit (bsc#1209256).
• CVE-2021-3923: Fixed stack information leak vulnerability that could lead to kernel protection bypass in infiniband RDMA (bsc#1209778).
• CVE-2022-20567: Fixed use after free that could lead to a local privilege escalation in pppol2tp_create of l2tp_ppp.c (bsc#1208850).
• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2023-1076: Fixed incorrect UID assigned to tun/tap sockets (bsc#1208599).
• CVE-2023-1095: Fixed a NULL pointer dereference in nf_tables due to zeroed list head (bsc#1208777).
• CVE-2023-1281: Fixed use after free that could lead to privilege escalation in tcindex (bsc#1209634).
• CVE-2023-1390: Fixed remote DoS vulnerability in tipc_link_xmit() (bsc#1209289).
• CVE-2023-1513: Fixed an uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak (bsc#1209532).
• CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207036).
• CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (bsc#1207125).
• CVE-2023-28328: Fixed a denial of service issue in az6027 driver in drivers/media/usb/dev-usb/az6027.c (bsc#1209291).
• CVE-2023-28464: Fixed user-after-free that could lead to privilege escalation in hci_conn_cleanup in net/bluetooth/hci_conn.c (bsc#1209052).
• CVE-2023-28772: Fixed buffer overflow in seq_buf_putmem_hex in lib/seq_buf.c (bsc#1209549).

The following non-security bugs were fixed:

• Bluetooth: btusb: Add VID:PID 13d3:3529 for Realtek RTL8821CE (git-fixes).
• Bluetooth: btusb: do not call kfree_skb() under spin_lock_irqsave() (git-fixes).
• Do not sign the vanilla kernel (bsc#1209008).
• Input: atmel_mxt_ts - fix double free in mxt_read_info_block (git-fixes).
• KVM: arm64: Hide system instruction access to Trace registers (git-fixes)
• NFSv4: Fix hangs when recovering open state after a server reboot (git-fixes). [iivanov] Fix Patch-mainline to v6.3-rc5
• PCI/MSI: Enforce MSI entry updates to be visible (git-fixes).
• PCI/MSI: Enforce that MSI-X table entry is masked for update (git-fixes).
• PCI/MSI: Mask all unused MSI-X entries (git-fixes).
• PCI/MSI: Skip masking MSI-X on Xen PV (git-fixes).
• PCI/PM: Always return devices to D0 when thawing (git-fixes).
• PCI/PM: Avoid using device_may_wakeup() for runtime PM (git-fixes).
• PCI: Add ACS quirk for Intel Root Complex Integrated Endpoints (git-fixes).
• PCI: Add ACS quirk for iProc PAXB (git-fixes).
• PCI: Avoid FLR for AMD Matisse HD Audio & USB 3.0 (git-fixes).
• PCI: Avoid FLR for AMD Starship USB 3.0 (git-fixes).
• PCI: Make ACS quirk implementations more uniform (git-fixes).
• PCI: PM: Avoid forcing PCI_D0 for wakeup reasons inconsistently (git-fixes).
• PCI: PM: Avoid skipping bus-level PM on platforms without ACPI (git-fixes).
• PCI: Unify ACS quirk desired vs provided checking (git-fixes).
• PCI: Use pci_update_current_state() in pci_enable_device_flags() (git-fixes).
• PCI: aardvark: Do not blindly enable ASPM L0s and do not write to read-only register (git-fixes).
• PCI: aardvark: Do not rely on jiffies while holding spinlock (git-fixes).
• PCI: aardvark: Do not touch PCIe registers if no card connected (git-fixes).
• PCI: aardvark: Fix a leaked reference by adding missing of_node_put() (git-fixes).
• PCI: aardvark: Fix checking for PIO Non-posted Request (git-fixes).
• PCI: aardvark: Fix kernel panic during PIO transfer (git-fixes).
• PCI: aardvark: Improve link training (git-fixes).
• PCI: aardvark: Indicate error in 'val' when config read fails (git-fixes).
• PCI: aardvark: Introduce an…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2017-5753: Fixed spectre V1 vulnerability on netlink (bsc#1209547).
• CVE-2017-5753: Fixed spectre vulnerability in prlimit (bsc#1209256).
• CVE-2021-3923: Fixed stack information leak vulnerability that could lead to kernel protection bypass in infiniband RDMA (bsc#1209778).
• CVE-2022-4744: Fixed double-free that could lead to DoS or privilege escalation in TUN/TAP device driver functionality (bsc#1209635).
• CVE-2023-0394: Fixed a null pointer dereference flaw in the network subcomponent in the Linux kernel which could lead to system crash (bsc#1207168).
• CVE-2023-0461: Fixed use-after-free in icsk_ulp_data (bsc#1208787).
• CVE-2023-1075: Fixed a type confusion in tls_is_tx_ready (bsc#1208598).
• CVE-2023-1076: Fixed incorrect UID assigned to tun/tap sockets (bsc#1208599).
• CVE-2023-1078: Fixed a heap out-of-bounds write in rds_rm_zerocopy_callback (bsc#1208601).
• CVE-2023-1095: Fixed a NULL pointer dereference in nf_tables due to zeroed list head (bsc#1208777).
• CVE-2023-1281: Fixed use after free that could lead to privilege escalation in tcindex (bsc#1209634).
• CVE-2023-1382: Fixed denial of service in tipc_conn_close (bsc#1209288).
• CVE-2023-1390: Fixed remote DoS vulnerability in tipc_link_xmit() (bsc#1209289).
• CVE-2023-1513: Fixed an uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak (bsc#1209532).
• CVE-2023-1582: Fixed soft lockup in __page_mapcount (bsc#1209636).
• CVE-2023-23004: Fixed misinterpretation of get_sg_table return value (bsc#1208843).
• CVE-2023-25012: Fixed a use-after-free in bigben_set_led() (bsc#1207560).
• CVE-2023-28327: Fixed DoS in in_skb in unix_diag_get_exact() (bsc#1209290).
• CVE-2023-28328: Fixed a denial of service issue in az6027 driver in drivers/media/usb/dev-usb/az6027.c (bsc#1209291).
• CVE-2023-28464: Fixed user-after-free that could lead to privilege escalation in hci_conn_cleanup in net/bluetooth/hci_conn.c (bsc#1209052).
• CVE-2023-28466: Fixed race condition that could lead to use-after-free or NULL pointer dereference in do_tls_getsockopt in net/tls/tls_main.c (bsc#1209366).
• CVE-2023-28772: Fixed buffer overflow in seq_buf_putmem_hex in lib/seq_buf.c (bsc#1209549).

The following non-security bugs were fixed:

• Do not sign the vanilla kernel (bsc#1209008).
• PCI: hv: Add a per-bus mutex state_lock (bsc#1209785).
• PCI: hv: Fix a race condition in hv_irq_unmask() that can cause panic (bsc#1209785).
• PCI: hv: Remove the useless hv_pcichild_state from struct hv_pci_dev (bsc#1209785).
• PCI: hv: fix a race condition bug in hv_pci_query_relations() (bsc#1209785).
• Revert 'PCI: hv: Fix a timing issue which causes kdump to fail occasionally' (bsc#1209785).
• ipv6: raw: Deduct extension header length in rawv6_push_pending_frames (bsc#1207168).
• kernel-module-subpackage: Fix expansion with -b parameter (bsc#1208179).
• net: ena: optimize data access in fast-path code (bsc#1208137).

The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2017-5753: Fixed spectre V1 vulnerability on netlink (bsc#1209547).
• CVE-2017-5753: Fixed spectre vulnerability in prlimit (bsc#1209256).
• CVE-2021-3923: Fixed stack information leak vulnerability that could lead to kernel protection bypass in infiniband RDMA (bsc#1209778).
• CVE-2021-4203: Fixed use-after-free read flaw that was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race with listen() (bsc#1194535).
• CVE-2022-20567: Fixed use after free that could lead to a local privilege escalation in pppol2tp_create of l2tp_ppp.c (bsc#1208850).
• CVE-2023-0394: Fixed a null pointer dereference flaw in the network subcomponent in the Linux kernel which could lead to system crash (bsc#1207168).
• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2023-1076: Fixed incorrect UID assigned to tun/tap sockets (bsc#1208599).
• CVE-2023-1095: Fixed a NULL pointer dereference in nf_tables due to zeroed list head (bsc#1208777).
• CVE-2023-1281: Fixed use after free that could lead to privilege escalation in tcindex (bsc#1209634).
• CVE-2023-1390: Fixed remote DoS vulnerability in tipc_link_xmit() (bsc#1209289).
• CVE-2023-1513: Fixed an uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak (bsc#1209532).
• CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207036).
• CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (bsc#1207125).
• CVE-2023-28328: Fixed a denial of service issue in az6027 driver in drivers/media/usb/dev-usb/az6027.c (bsc#1209291).
• CVE-2023-28464: Fixed user-after-free that could lead to privilege escalation in hci_conn_cleanup in net/bluetooth/hci_conn.c (bsc#1209052).
• CVE-2023-28772: Fixed buffer overflow in seq_buf_putmem_hex in lib/seq_buf.c (bsc#1209549).

The following non-security bugs were fixed:

• Do not sign the vanilla kernel (bsc#1209008).
• PCI: hv: Add a per-bus mutex state_lock (bsc#1208811).
• PCI: hv: Fix a race condition in hv_irq_unmask() that can cause panic (bsc#1208811).
• PCI: hv: Remove the useless hv_pcichild_state from struct hv_pci_dev (bsc#1208811).
• PCI: hv: fix a race condition bug in hv_pci_query_relations() (bsc#1208811).
• Revert 'PCI: hv: Fix a timing issue which causes kdump to fail occasionally' (bsc#1208811).
• cifs: fix double free in dfs mounts (bsc#1209845).
• cifs: fix nodfs mount option (bsc#1209845).
• cifs: handle reconnect of tcon when there is no cached dfs referral (bsc#1209845).
• cifs: missing null pointer check in cifs_mount (bsc#1209845).
• cifs: serialize all mount attempts (bsc#1209845).
• cred: allow get_cred() and put_cred() to be given NULL (bsc#1209887).
• ibmvnic: Process crqs after enabling interrupts (bsc#1192273 ltc#194629).
• ibmvnic: do not stop queue in xmit (bsc#1192273 ltc#194629).
• ipv6: raw: Deduct extension header length in rawv6_push_pending_frames (bsc#1207168).
• kernel-module-subpackage: Fix expansion with -b parameter (bsc#1208179).

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-1611: Fixed an use-after-free flaw in btrfs_search_slot (bsc#1209687).
• CVE-2020-36691: Fixed an issue which could allow attackers to cause a denial of service via a nested Netlink policy with a back reference (bsc#1209613).
• CVE-2023-28772: Fixed buffer overflow in seq_buf_putmem_hex in lib/seq_buf.c (bsc#1209549).
• CVE-2023-1513: Fixed an uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak (bsc#1209532).
• CVE-2023-28464: Fixed user-after-free that could lead to privilege escalation in hci_conn_cleanup in net/bluetooth/hci_conn.c (bsc#1209052).
• CVE-2021-3923: Fixed stack information leak vulnerability that could lead to kernel protection bypass in infiniband RDMA (bsc#1209778).
• CVE-2023-1390: Fixed remote DoS vulnerability in tipc_link_xmit() (bsc#1209289).
• CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue led by a type confusion (bsc#1207125).
• CVE-2023-1281: Fixed use after free that could lead to privilege escalation in tcindex (bsc#1209634).
• CVE-2017-5753: Fixed spectre V1 vulnerability on netlink (bsc#1209547).
• CVE-2017-5753: Fixed spectre vulnerability in prlimit (bsc#1209256).
• CVE-2023-28328: Fixed a denial of service issue in az6027 driver in drivers/media/usb/dev-usb/az6027.c (bsc#1209291).
• CVE-2022-20567: Fixed use after free that could lead to a local privilege escalation in pppol2tp_create of l2tp_ppp.c (bsc#1208850).
• CVE-2023-1076: Fixed incorrect UID assigned to tun/tap sockets (bsc#1208599).
• CVE-2023-1095: Fixed a NULL pointer dereference in nf_tables due to zeroed list head (bsc#1208777).

The following non-security bugs were fixed:

• applicom: Fix PCI device refcount leak in applicom_init() (git-fixes).
• ARM: 8702/1: head-common.S: Clear lr before jumping to start_kernel() (git-fixes)
• arm64: cmpxchg_double*: hazard against entire exchange variable (git-fixes)
• arm64: cpu_ops: fix a leaked reference by adding missing of_node_put (git-fixes)
• arm64: Discard .note.GNU-stack section (bsc#1203693 bsc#1209798).
• arm64: Do not forget syscall when starting a new thread. (git-fixes)
• arm64: Fix compiler warning from pte_unmap() with (git-fixes)
• arm64: fix oops in concurrently setting insn_emulation sysctls (git-fixes)
• arm64: kaslr: Reserve size of ARM64_MEMSTART_ALIGN in linear region (git-fixes)
• arm64: kprobe: make page to RO mode when allocate it (git-fixes)
• arm64: kpti: ensure patched kernel text is fetched from PoU (git-fixes)
• arm64: Mark __stack_chk_guard as __ro_after_init (git-fixes)
• arm64: psci: Avoid printing in cpu_psci_cpu_die() (git-fixes)
• arm64: psci: Reduce the waiting time for cpu_psci_cpu_kill() (git-fixes)
• arm64: unwind: Prohibit probing on return_address() (git-fixes)
• arm64: Use test_tsk_thread_flag() for checking TIF_SINGLESTEP (git-fixes)
• arm64/alternatives: do not patch up internal branches (git-fixes)
• arm64/alternatives: move length validation inside the subsection (git-fixes)
• arm64/alternatives: use subsections for replacement sequences (git-fixes)
• arm64/cpufeature: Fix field sign for DIT hwcap detection (git-fixes)
• arm64/mm: fix variable 'pud' set but not used (git-fixes)
• arm64/mm: return cpu_all_mask when node is NUMA_NO_NODE (git-fixes)
• arm64/vdso: Discard .note.gnu.property sections in vDSO (git-fixes)
• Bluetooth: btusb: Add VID:PID 13d3:3529 for Realtek RTL8821CE (git-fixes).
• Bluetooth: btusb: do not call kfree_skb() under spin_lock_irqsave() (git-fixes).
• crypto: arm64 - Fix unused variable compilation warnings of (git-fixes)
• dt-bindings: reset: meson8b: fix duplicate reset IDs (git-fixes).
• ftrace: Fix invalid address access in lookup_rec() when index is 0 (git-fixes).
• ima: Fix function name error in comment (git-fixes).
• Input: atmel_mxt_ts - fix double free in mxt_read_info_block…

The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-2483: Fixed a use after free bug in emac_remove due caused by a race condition (bsc#1211037).
• CVE-2023-2124: Fixed an out of bound access in the XFS subsystem that could have lead to denial-of-service or potentially privilege escalation (bsc#1210498).
• CVE-2023-1670: Fixed a use after free in the Xircom 16-bit PCMCIA Ethernet driver. A local user could use this flaw to crash the system or potentially escalate their privileges on the system (bsc#1209871).
• CVE-2017-5753: Fixed spectre V1 vulnerability on netlink (bsc#1209547).
• CVE-2017-5753: Fixed spectre vulnerability in prlimit (bsc#1209256).
• CVE-2020-36691: Fixed a denial of service (unbounded recursion) vulnerability via a nested Netlink policy with a back reference (bsc#1209613 bsc#1209777).
• CVE-2023-0394: Fixed a null pointer dereference flaw in the network subcomponent in the Linux kernel which could lead to system crash (bsc#1207168).
• CVE-2021-3923: Fixed stack information leak vulnerability that could lead to kernel protection bypass in infiniband RDMA (bsc#1209778).
• CVE-2021-4203: Fixed use-after-free read flaw that was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race with listen() (bsc#1194535).
• CVE-2022-20567: Fixed use after free that could lead to a local privilege escalation in pppol2tp_create of l2tp_ppp.c (bsc#1208850).
• CVE-2022-43945: Fixed a buffer overflow in the NFSD implementation (bsc#1205128).
• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2023-0597: Fixed lack of randomization of per-cpu entry area in x86/mm (bsc#1207845).
• CVE-2023-1076: Fixed incorrect UID assigned to tun/tap sockets (bsc#1208599).
• CVE-2023-1095: Fixed a NULL pointer dereference in nf_tables due to zeroed list head (bsc#1208777).
• CVE-2023-1118: Fixed a use-after-free bugs caused by ene_tx_irqsim() in media/rc (bsc#1208837).
• CVE-2023-1390: Fixed remote DoS vulnerability in tipc_link_xmit() (bsc#1209289).
• CVE-2023-1513: Fixed an uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak (bsc#1209532).
• CVE-2023-1611: Fixed an use-after-free flaw in btrfs_search_slot (bsc#1209687).
• CVE-2023-1855: Fixed an use-after-free flaw in xgene_hwmon_remove (bsc#1210202).
• CVE-2023-1989: Fixed an use-after-free flaw in btsdio_remove (bsc#1210336).
• CVE-2023-1990: Fixed an use-after-free flaw in ndlc_remove (bsc#1210337).
• CVE-2023-1998: Fixed an use-after-free flaw during login when accessing the shost ipaddress (bsc#1210506).
• CVE-2023-2162: Fixed an use-after-free flaw in iscsi_sw_tcp_session_create (bsc#1210647).
• CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207036).
• CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (bsc#1207125).
• CVE-2023-28328: Fixed a denial of service issue in az6027 driver in drivers/media/usb/dev-usb/az6027.c (bsc#1209291).
• CVE-2023-28464: Fixed user-after-free that could lead to privilege escalation in hci_conn_cleanup in net/uetooth/hci_conn.c (bsc#1209052).
• CVE-2023-28772: Fixed buffer overflow in seq_buf_putmem_hex in lib/seq_buf.c (bsc#1209549).
• CVE-2023-30772: Fixed race condition and resultant use-after-free in da9150_charger_remove (bsc#1210329).

The following non-security bugs were fixed:

• Do not sign the vanilla kernel (bsc#1209008).
• Fix kABI breakage (bsc#1208333)
• PCI: hv: Add a per-bus mutex state_lock (bsc#1207185).
• PCI: hv: Fix a race condition bug in hv_pci_query_relations() (bsc#1207185).
• PCI: hv: Fix a race condition in hv_irq_unmask() that can cause panic (bsc#1207185).
• PCI: hv: Remove the useless hv_pcichild_state from struct…

The SUSE Linux Enterprise 15 SP5 AZURE kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-3161: Fixed shift-out-of-bounds in fbcon_set_font() (bsc#1212154).
• CVE-2023-21102: Fixed possible bypass of shadow stack protection in __efi_rt_asm_wrapper of efi-rt-wrapper.S (bsc#1212155).
• CVE-2023-3141: Fixed a use-after-free flaw in r592_remove in drivers/memstick/host/r592.c, that allowed local attackers to crash the system at device disconnect (bsc#1212129).
• CVE-2023-1077: Fixed a type confusion in pick_next_rt_entity(), that could cause memory corruption (bsc#1208600).
• CVE-2023-28410: Fixed improper restriction of operations within the bounds of a memory buffer in some Intel(R) i915 Graphics drivers that may have allowed an authenticated user to potentially enable escalation of privilege via local access (bsc#1211263).
• CVE-2023-2156: Fixed a flaw in the networking subsystem within the handling of the RPL protocol (bsc#1211131).
• CVE-2023-1382: Fixed denial of service in tipc_conn_close (bsc#1209288).
• CVE-2023-33951: Fixed a race condition that could have led to an information disclosure inside the vmwgfx driver (bsc#1211593).
• CVE-2023-33952: Fixed a double free that could have led to a local privilege escalation inside the vmwgfx driver (bsc#1211595).
• CVE-2023-3006: Fixed a known cache speculation vulnerability, known as Branch History Injection (BHI) or Spectre-BHB, for the new hw AmpereOne (bsc#1211855).
• CVE-2023-2269: Fixed a denial-of-service problem due to a possible recursive locking scenario, resulting in a deadlock in table_clear in drivers/md/dm-ioctl.c (bsc#1210806).
• CVE-2023-1079: Fixed a use-after-free problem that could have been triggered in asus_kbd_backlight_set when plugging/disconnecting a malicious USB device (bsc#1208604).
• CVE-2023-2162: Fixed an use-after-free flaw in iscsi_sw_tcp_session_create (bsc#1210647).
• CVE-2023-21106: Fixed possible memory corruption due to double free in adreno_set_param of adreno_gpu.c (bsc#1211654).
• CVE-2023-33288: Fixed a use-after-free in bq24190_remove in drivers/power/supply/bq24190_charger.c (bsc#1211590).
• CVE-2022-45886: Fixed a .disconnect versus dvb_device_open race condition in dvb_net.c that lead to a use-after-free (bsc#1205760).
• CVE-2022-45885: Fixed a race condition in dvb_frontend.c that could cause a use-after-free when a device is disconnected (bsc#1205758).
• CVE-2022-45887: Fixed a memory leak in ttusb_dec.c caused by the lack of a dvb_frontend_detach call (bsc#1205762).
• CVE-2022-45919: Fixed a use-after-free in dvb_ca_en50221.c that could occur if there is a disconnect after an open, because of the lack of a wait_event (bsc#1205803).
• CVE-2022-45884: Fixed a use-after-free in dvbdev.c, related to dvb_register_device dynamically allocating fops (bsc#1205756).
• CVE-2023-31084: Fixed a blocking issue in drivers/media/dvb-core/dvb_frontend.c (bsc#1210783).
• CVE-2023-2002: Fixed a flaw that allowed an attacker to unauthorized execution of management commands, compromising the confidentiality, integrity, and availability of Bluetooth communication (bsc#1210533).
• CVE-2023-31436: Fixed an out-of-bounds write in qfq_change_class() because lmax can exceed QFQ_MIN_LMAX (bsc#1210940).
• CVE-2023-30456: Fixed an issue in arch/x86/kvm/vmx/nested.c with nVMX on x86_64 lacks consistency checks for CR0 and CR4 (bsc#1210294).
• CVE-2022-4269: Fixed a flaw was found inside the Traffic Control (TC) subsystem (bsc#1206024).
• CVE-2023-32233: Fixed a use-after-free in Netfilter nf_tables when processing batch requests (bsc#1211043).
• CVE-2023-1380: Fixed a slab-out-of-bound read problem in brcmf_get_assoc_ies() (bsc#1209287).
• CVE-2023-2513: Fixed a use-after-free vulnerability in the ext4 filesystem (bsc#1211105).
• CVE-2023-2483: Fixed a use after free bug in emac_remove caused by a race condition (bsc#1211037).
• CVE-2023-2124: Fixed an out-of-bound access in the XFS subsystem…

The SUSE Linux Enterprise 12 SP2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2017-5753: Fixed spectre vulnerability in prlimit (bsc#1209256).
• CVE-2022-3566: Fixed race condition in the TCP Handler (bsc#1204405).
• CVE-2022-45884: Fixed a use-after-free in dvbdev.c, related to dvb_register_device dynamically allocating fops (bsc#1205756).
• CVE-2022-45885: Fixed a race condition in dvb_frontend.c that could cause a use-after-free when a device is disconnected (bsc#1205758).
• CVE-2022-45886: Fixed a .disconnect versus dvb_device_open race condition in dvb_net.c that lead to a use-after-free (bsc#1205760).
• CVE-2022-45887: Fixed a memory leak in ttusb_dec.c caused by the lack of a dvb_frontend_detach call (bsc#1205762).
• CVE-2022-45919: Fixed a use-after-free in dvb_ca_en50221.c that could occur if there is a disconnect after an open, because of the lack of a wait_event (bsc#1205803).
• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2023-1077: Fixed a type confusion in pick_next_rt_entity(), that could cause memory corruption (bsc#1208600).
• CVE-2023-1095: Fixed a NULL pointer dereference in nf_tables due to zeroed list head (bsc#1208777).
• CVE-2023-1118: Fixed a use-after-free bugs caused by ene_tx_irqsim() in media/rc (bsc#1208837).
• CVE-2023-1249: Fixed a use-after-free flaw in the core dump subsystem that allowed a local user to crash the system (bsc#1209039).
• CVE-2023-1380: Fixed a slab-out-of-bound read problem in brcmf_get_assoc_ies() (bsc#1209287).
• CVE-2023-1390: Fixed remote DoS vulnerability in tipc_link_xmit() (bsc#1209289).
• CVE-2023-1513: Fixed an uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak (bsc#1209532).
• CVE-2023-1611: Fixed an use-after-free flaw in btrfs_search_slot (bsc#1209687).
• CVE-2023-1670: Fixed a use after free in the Xircom 16-bit PCMCIA Ethernet driver. A local user could use this flaw to crash the system or potentially escalate their privileges on the system (bsc#1209871).
• CVE-2023-1989: Fixed a use after free in btsdio_remove (bsc#1210336).
• CVE-2023-1990: Fixed a use after free in ndlc_remove (bsc#1210337).
• CVE-2023-1998: Fixed a use after free during login when accessing the shost ipaddress (bsc#1210506).
• CVE-2023-2124: Fixed an out-of-bound access in the XFS subsystem that could have lead to denial-of-service or potentially privilege escalation (bsc#1210498).
• CVE-2023-2162: Fixed an use-after-free flaw in iscsi_sw_tcp_session_create (bsc#1210647).
• CVE-2023-2194: Fixed an out-of-bounds write vulnerability in the SLIMpro I2C device driver (bsc#1210715).
• CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207036).
• CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (bsc#1207125).
• CVE-2023-2513: Fixed a use-after-free vulnerability in the ext4 filesystem (bsc#1211105).
• CVE-2023-28328: Fixed a denial of service issue in az6027 driver in drivers/media/usb/dev-usb/az6027.c (bsc#1209291).
• CVE-2023-28464: Fixed user-after-free that could lead to privilege escalation in hci_conn_cleanup in net/uetooth/hci_conn.c (bsc#1209052).
• CVE-2023-28772: Fixed buffer overflow in seq_buf_putmem_hex in lib/seq_buf.c (bsc#1209549).
• CVE-2023-30772: Fixed race condition and resultant use-after-free in da9150_charger_remove (bsc#1210329).
• CVE-2023-3090: Fixed a heap out-of-bounds write in the ipvlan network driver (bsc#1212842).
• CVE-2023-3141: Fixed a use-after-free flaw in r592_remove in drivers/memstick/host/r592.c, that allowed local attackers to crash the system at device disconnect (bsc#1212129).
• CVE-2023-31436: Fixed an out-of-bounds write in qfq_change_class() because lmax can exceed QFQ_MIN_LMAX (bsc#1210940). -…

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-24588: Fixed a bug that could allow an adversary to abuse devices that support receiving non-SSP A-MSDU frames to inject arbitrary network packets (bsc#1185861).
• CVE-2022-2196: Fixed a regression related to KVM that allowed for speculative execution attacks (bsc#1206992).
• CVE-2022-3523: Fixed a use after free related to device private page handling (bsc#1204363).
• CVE-2022-36280: Fixed out-of-bounds memory access vulnerability found in vmwgfx driver (bsc#1203332).
• CVE-2022-38096: Fixed NULL-ptr deref in vmw_cmd_dx_define_query() (bsc#1203331).
• CVE-2022-4269: Fixed a flaw was found inside the Traffic Control (TC) subsystem (bsc#1206024).
• CVE-2022-45884: Fixed a use-after-free in dvbdev.c, related to dvb_register_device dynamically allocating fops (bsc#1205756).
• CVE-2022-45885: Fixed a race condition in dvb_frontend.c that could cause a use-after-free when a device is disconnected (bsc#1205758).
• CVE-2022-45886: Fixed a .disconnect versus dvb_device_open race condition in dvb_net.c that lead to a use-after-free (bsc#1205760).
• CVE-2022-45887: Fixed a memory leak in ttusb_dec.c caused by the lack of a dvb_frontend_detach call (bsc#1205762).
• CVE-2022-45919: Fixed a use-after-free in dvb_ca_en50221.c that could occur if there is a disconnect after an open, because of the lack of a wait_event (bsc#1205803).
• CVE-2022-4744: Fixed double-free that could lead to DoS or privilege escalation in TUN/TAP device driver functionality (bsc#1209635).
• CVE-2023-0045: Fixed missing Flush IBP in ib_prctl_set (bsc#1207773).
• CVE-2023-0122: Fixed a NULL pointer dereference vulnerability in nvmet_setup_auth(), that allowed an attacker to perform a Pre-Auth Denial of Service (DoS) attack on a remote machine (bsc#1207050).
• CVE-2023-0179: Fixed incorrect arithmetics when fetching VLAN header bits (bsc#1207034).
• CVE-2023-0386: A flaw was found where unauthorized access to the execution of the setuid file with capabilities was found in the OverlayFS subsystem, when a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allowed a local user to escalate their privileges on the system (bsc#1209615).
• CVE-2023-0394: Fixed a null pointer dereference in the network subcomponent. This flaw could cause system crashes (bsc#1207168).
• CVE-2023-0461: Fixed use-after-free in icsk_ulp_data (bsc#1208787).
• CVE-2023-0469: Fixed a use-after-free flaw in io_uring/filetable.c in io_install_fixed_file in the io_uring subcomponent (bsc#1207521).
• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2023-0597: Fixed lack of randomization of per-cpu entry area in x86/mm (bsc#1207845).
• CVE-2023-1075: Fixed a type confusion in tls_is_tx_ready (bsc#1208598).
• CVE-2023-1076: Fixed incorrect UID assigned to tun/tap sockets (bsc#1208599).
• CVE-2023-1077: Fixed a type confusion in pick_next_rt_entity(), that could cause memory corruption (bsc#1208600).
• CVE-2023-1078: Fixed a heap out-of-bounds write in rds_rm_zerocopy_callback (bsc#1208601).
• CVE-2023-1079: Fixed a use-after-free problem that could have been triggered in asus_kbd_backlight_set when plugging/disconnecting a malicious USB device (bsc#1208604).
• CVE-2023-1095: Fixed a NULL pointer dereference in nf_tables due to zeroed list head (bsc#1208777).
• CVE-2023-1118: Fixed a use-after-free bugs caused by ene_tx_irqsim() in media/rc (bsc#1208837).
• CVE-2023-1249: Fixed a use-after-free flaw in the core dump subsystem that allowed a local user to crash the system (bsc#1209039).
• CVE-2023-1382: Fixed denial of service in tipc_conn_close (bsc#1209288).
• CVE-2023-1513: Fixed an uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak (bsc#1209532).
• CVE-2023-1582: Fixed soft lockup in __page_mapcount (bsc#1209636). -…

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-36280: Fixed out-of-bounds memory access vulnerability found in vmwgfx driver (bsc#1203332).
• CVE-2022-38096: Fixed NULL-ptr deref in vmw_cmd_dx_define_query() (bsc#1203331).
• CVE-2022-4269: Fixed a flaw was found inside the Traffic Control (TC) subsystem (bsc#1206024).
• CVE-2022-45884: Fixed a use-after-free in dvbdev.c, related to dvb_register_device dynamically allocating fops (bsc#1205756).
• CVE-2022-45885: Fixed a race condition in dvb_frontend.c that could cause a use-after-free when a device is disconnected (bsc#1205758).
• CVE-2022-45886: Fixed a .disconnect versus dvb_device_open race condition in dvb_net.c that lead to a use-after-free (bsc#1205760).
• CVE-2022-45887: Fixed a memory leak in ttusb_dec.c caused by the lack of a dvb_frontend_detach call (bsc#1205762).
• CVE-2022-45919: Fixed a use-after-free in dvb_ca_en50221.c that could occur if there is a disconnect after an open, because of the lack of a wait_event (bsc#1205803).
• CVE-2022-4744: Fixed double-free that could lead to DoS or privilege escalation in TUN/TAP device driver functionality (bsc#1209635).
• CVE-2023-0045: Fixed missing Flush IBP in ib_prctl_set (bsc#1207773).
• CVE-2023-0122: Fixed a NULL pointer dereference vulnerability in nvmet_setup_auth(), that allowed an attacker to perform a Pre-Auth Denial of Service (DoS) attack on a remote machine (bsc#1207050).
• CVE-2023-0179: Fixed incorrect arithmetics when fetching VLAN header bits (bsc#1207034).
• CVE-2023-0394: Fixed a null pointer dereference in the network subcomponent. This flaw could cause system crashes (bsc#1207168).
• CVE-2023-0461: Fixed use-after-free in icsk_ulp_data (bsc#1208787).
• CVE-2023-0469: Fixed a use-after-free flaw in io_uring/filetable.c in io_install_fixed_file in the io_uring subcomponent (bsc#1207521).
• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2023-0597: Fixed lack of randomization of per-cpu entry area in x86/mm (bsc#1207845).
• CVE-2023-1075: Fixed a type confusion in tls_is_tx_ready (bsc#1208598).
• CVE-2023-1076: Fixed incorrect UID assigned to tun/tap sockets (bsc#1208599).
• CVE-2023-1077: Fixed a type confusion in pick_next_rt_entity(), that could cause memory corruption (bsc#1208600).
• CVE-2023-1079: Fixed a use-after-free problem that could have been triggered in asus_kbd_backlight_set when plugging/disconnecting a malicious USB device (bsc#1208604).
• CVE-2023-1095: Fixed a NULL pointer dereference in nf_tables due to zeroed list head (bsc#1208777).
• CVE-2023-1118: Fixed a use-after-free bugs caused by ene_tx_irqsim() in media/rc (bsc#1208837).
• CVE-2023-1249: Fixed a use-after-free flaw in the core dump subsystem that allowed a local user to crash the system (bsc#1209039).
• CVE-2023-1382: Fixed denial of service in tipc_conn_close (bsc#1209288).
• CVE-2023-1513: Fixed an uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak (bsc#1209532).
• CVE-2023-1582: Fixed soft lockup in __page_mapcount (bsc#1209636).
• CVE-2023-1583: Fixed a NULL pointer dereference in io_file_bitmap_get in io_uring/filetable.c (bsc#1209637).
• CVE-2023-1611: Fixed an use-after-free flaw in btrfs_search_slot (bsc#1209687).
• CVE-2023-1637: Fixed vulnerability that could lead to unauthorized access to CPU memory after resuming CPU from suspend-to-RAM (bsc#1209779).
• CVE-2023-1652: Fixed use-after-free that could lead to DoS and information leak in nfsd4_ssc_setup_dul in fs/nfsd/nfs4proc.c (bsc#1209788).
• CVE-2023-1670: Fixed a use after free in the Xircom 16-bit PCMCIA Ethernet driver. A local user could use this flaw to crash the system or potentially escalate their privileges on the system (bsc#1209871).
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).
• CVE-2023-1838:…

Xuewei Feng, Chuanpu Fu, Qi Li, Kun Sun, and Ke Xu discovered that the TCP implementation in the Linux kernel did not properly handle IPID assignment. A remote attacker could use this to cause a denial of service (connection termination) or inject forged data. (CVE-2020-36516)

Ke Sun, Alyssa Milburn, Henrique Kawakami, Emma Benoit, Igor Chervatyuk, Lisa Aichele, and Thais Moreira Hamasaki discovered that the Spectre Variant 2 mitigations for AMD processors on Linux were insufficient in some situations. A local attacker could possibly use this to expose sensitive information. (CVE-2021-26401)

Jürgen Groß discovered that the Xen subsystem within the Linux kernel did not adequately limit the number of events driver domains (unprivileged PV backends) could send to other guest VMs. An attacker in a driver domain could use this to cause a denial of service in other guest VMs. (CVE-2021-28712, CVE-2021-28713)

Wolfgang Frisch discovered that the ext4 file system implementation in the Linux kernel contained an integer overflow when handling metadata inode extents. An attacker could use this to construct a malicious ext4 file system image that, when mounted, could cause a denial of service (system crash). (CVE-2021-3428)

It was discovered that the IEEE 802.15.4 wireless network subsystem in the Linux kernel did not properly handle certain error conditions, leading to a null pointer dereference vulnerability. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2021-3659)

It was discovered that the System V IPC implementation in the Linux kernel did not properly handle large shared memory counts. A local attacker could use this to cause a denial of service (memory exhaustion). (CVE-2021-3669)

Alois Wohlschlager discovered that the overlay file system in the Linux kernel did not restrict private clones in some situations. An attacker could use this to expose sensitive information. (CVE-2021-3732)

It was discovered that the SCTP protocol implementation in the Linux kernel did not properly verify VTAGs in some situations. A remote attacker could possibly use this to cause a denial of service (connection disassociation). (CVE-2021-3772)

It was discovered that the btrfs file system implementation in the Linux kernel did not properly handle locking in certain error conditions. A local attacker could use this to cause a denial of service (kernel deadlock). (CVE-2021-4149)

Jann Horn discovered that the socket subsystem in the Linux kernel contained a race condition when handling listen() and connect() operations, leading to a read-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2021-4203)

It was discovered that the file system quotas implementation in the Linux kernel did not properly validate the quota block number. An attacker could use this to construct a malicious file system image that, when mounted and operated on, could cause a denial of service (system crash). (CVE-2021-45868)

Zhihua Yao discovered that the MOXART SD/MMC driver in the Linux kernel did not properly handle device removal, leading to a use-after-free vulnerability. A physically proximate attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-0487)

It was discovered that the block layer subsystem in the Linux kernel did not properly initialize memory in some situations. A privileged local attacker could use this to expose sensitive information (kernel memory). (CVE-2022-0494)

It was discovered that the UDF file system implementation in the Linux kernel could attempt to dereference a null pointer in some situations. An attacker could use this to construct a malicious UDF image that, when mounted and operated on, could cause a denial of service (system crash). (CVE-2022-0617)

David Bouman discovered that the netfilter subsystem in the Linux kernel did not initialize memory in some…

Xuewei Feng, Chuanpu Fu, Qi Li, Kun Sun, and Ke Xu discovered that the TCP implementation in the Linux kernel did not properly handle IPID assignment. A remote attacker could use this to cause a denial of service (connection termination) or inject forged data. (CVE-2020-36516)

Ke Sun, Alyssa Milburn, Henrique Kawakami, Emma Benoit, Igor Chervatyuk, Lisa Aichele, and Thais Moreira Hamasaki discovered that the Spectre Variant 2 mitigations for AMD processors on Linux were insufficient in some situations. A local attacker could possibly use this to expose sensitive information. (CVE-2021-26401)

Jürgen Groß discovered that the Xen subsystem within the Linux kernel did not adequately limit the number of events driver domains (unprivileged PV backends) could send to other guest VMs. An attacker in a driver domain could use this to cause a denial of service in other guest VMs. (CVE-2021-28712, CVE-2021-28713)

Wolfgang Frisch discovered that the ext4 file system implementation in the Linux kernel contained an integer overflow when handling metadata inode extents. An attacker could use this to construct a malicious ext4 file system image that, when mounted, could cause a denial of service (system crash). (CVE-2021-3428)

It was discovered that the IEEE 802.15.4 wireless network subsystem in the Linux kernel did not properly handle certain error conditions, leading to a null pointer dereference vulnerability. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2021-3659)

It was discovered that the System V IPC implementation in the Linux kernel did not properly handle large shared memory counts. A local attacker could use this to cause a denial of service (memory exhaustion). (CVE-2021-3669)

Alois Wohlschlager discovered that the overlay file system in the Linux kernel did not restrict private clones in some situations. An attacker could use this to expose sensitive information. (CVE-2021-3732)

It was discovered that the SCTP protocol implementation in the Linux kernel did not properly verify VTAGs in some situations. A remote attacker could possibly use this to cause a denial of service (connection disassociation). (CVE-2021-3772)

It was discovered that the btrfs file system implementation in the Linux kernel did not properly handle locking in certain error conditions. A local attacker could use this to cause a denial of service (kernel deadlock). (CVE-2021-4149)

Jann Horn discovered that the socket subsystem in the Linux kernel contained a race condition when handling listen() and connect() operations, leading to a read-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2021-4203)

It was discovered that the file system quotas implementation in the Linux kernel did not properly validate the quota block number. An attacker could use this to construct a malicious file system image that, when mounted and operated on, could cause a denial of service (system crash). (CVE-2021-45868)

Zhihua Yao discovered that the MOXART SD/MMC driver in the Linux kernel did not properly handle device removal, leading to a use-after-free vulnerability. A physically proximate attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-0487)

It was discovered that the block layer subsystem in the Linux kernel did not properly initialize memory in some situations. A privileged local attacker could use this to expose sensitive information (kernel memory). (CVE-2022-0494)

It was discovered that the UDF file system implementation in the Linux kernel could attempt to dereference a null pointer in some situations. An attacker could use this to construct a malicious UDF image that, when mounted and operated on, could cause a denial of service (system crash). (CVE-2022-0617)

David Bouman discovered that the netfilter subsystem in the Linux kernel did not initialize memory in some…

Xuewei Feng, Chuanpu Fu, Qi Li, Kun Sun, and Ke Xu discovered that the TCP implementation in the Linux kernel did not properly handle IPID assignment. A remote attacker could use this to cause a denial of service (connection termination) or inject forged data. (CVE-2020-36516)

Ke Sun, Alyssa Milburn, Henrique Kawakami, Emma Benoit, Igor Chervatyuk, Lisa Aichele, and Thais Moreira Hamasaki discovered that the Spectre Variant 2 mitigations for AMD processors on Linux were insufficient in some situations. A local attacker could possibly use this to expose sensitive information. (CVE-2021-26401)

Jürgen Groß discovered that the Xen subsystem within the Linux kernel did not adequately limit the number of events driver domains (unprivileged PV backends) could send to other guest VMs. An attacker in a driver domain could use this to cause a denial of service in other guest VMs. (CVE-2021-28711, CVE-2021-28712, CVE-2021-28713)

Wolfgang Frisch discovered that the ext4 file system implementation in the Linux kernel contained an integer overflow when handling metadata inode extents. An attacker could use this to construct a malicious ext4 file system image that, when mounted, could cause a denial of service (system crash). (CVE-2021-3428)

It was discovered that the IEEE 802.15.4 wireless network subsystem in the Linux kernel did not properly handle certain error conditions, leading to a null pointer dereference vulnerability. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2021-3659)

It was discovered that the System V IPC implementation in the Linux kernel did not properly handle large shared memory counts. A local attacker could use this to cause a denial of service (memory exhaustion). (CVE-2021-3669)

Alois Wohlschlager discovered that the overlay file system in the Linux kernel did not restrict private clones in some situations. An attacker could use this to expose sensitive information. (CVE-2021-3732)

It was discovered that the SCTP protocol implementation in the Linux kernel did not properly verify VTAGs in some situations. A remote attacker could possibly use this to cause a denial of service (connection disassociation). (CVE-2021-3772)

It was discovered that the btrfs file system implementation in the Linux kernel did not properly handle locking in certain error conditions. A local attacker could use this to cause a denial of service (kernel deadlock). (CVE-2021-4149)

Jann Horn discovered that the socket subsystem in the Linux kernel contained a race condition when handling listen() and connect() operations, leading to a read-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2021-4203)

It was discovered that the file system quotas implementation in the Linux kernel did not properly validate the quota block number. An attacker could use this to construct a malicious file system image that, when mounted and operated on, could cause a denial of service (system crash). (CVE-2021-45868)

Zhihua Yao discovered that the MOXART SD/MMC driver in the Linux kernel did not properly handle device removal, leading to a use-after-free vulnerability. A physically proximate attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-0487)

It was discovered that the block layer subsystem in the Linux kernel did not properly initialize memory in some situations. A privileged local attacker could use this to expose sensitive information (kernel memory). (CVE-2022-0494)

It was discovered that the UDF file system implementation in the Linux kernel could attempt to dereference a null pointer in some situations. An attacker could use this to construct a malicious UDF image that, when mounted and operated on, could cause a denial of service (system crash). (CVE-2022-0617)

David Bouman discovered that the netfilter subsystem in the Linux kernel did not initialize memory in…

It was discovered that the Traffic-Control Index (TCINDEX) implementation in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-1281)

It was discovered that the Integrity Measurement Architecture (IMA) implementation in the Linux kernel did not properly enforce policy in certain conditions. A privileged attacker could use this to bypass Kernel lockdown restrictions. (CVE-2022-21505)

It was discovered that the infrared transceiver USB driver did not properly handle USB control messages. A local attacker with physical access could plug in a specially crafted USB device to cause a denial of service (memory exhaustion). (CVE-2022-3903)

It was discovered that a race condition existed in the SMSC UFX USB driver implementation in the Linux kernel, leading to a use-after-free vulnerability. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-41849)

Gerald Lee discovered that the USB Gadget file system implementation in the Linux kernel contained a race condition, leading to a use-after-free vulnerability in some situations. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-4382)

It was discovered that a memory leak existed in the SCTP protocol implementation in the Linux kernel. A local attacker could use this to cause a denial of service (memory exhaustion). (CVE-2023-1074)

Mingi Cho discovered that the netfilter subsystem in the Linux kernel did not properly initialize a data structure, leading to a null pointer dereference vulnerability. An attacker could use this to cause a denial of service (system crash). (CVE-2023-1095)

It was discovered that the RNDIS USB driver in the Linux kernel contained an integer overflow vulnerability. A local attacker with physical access could plug in a malicious USB device to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-23559)

It was discovered that the NTFS file system implementation in the Linux kernel did not properly validate attributes in certain situations, leading to an out-of-bounds read vulnerability. A local attacker could possibly use this to expose sensitive information (kernel memory). (CVE-2023-26607)

Duoming Zhou discovered that a race condition existed in the infrared receiver/transceiver driver in the Linux kernel, leading to a use-after- free vulnerability. A privileged attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-1118)