CVE-2020-26541

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: use-after-free in net/bluetooth/hci_event.c when destroying an hci_chan (CVE-2021-33034)

• kernel: security bypass in certs/blacklist.c and certs/system_keyring.c (CVE-2020-26541)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• [ESXi][Rocky Linux-8] VMXNET3 v4 causes invalid checksums of inner packets of VXLAN tunnel (BZ#1960702)

• fnic crash from invalid request pointer (BZ#1961705)

• GFS2: Failed FS thaw call makes the entire snapshot failed. (BZ#1961849)

• dm writecache: fix performance degradation in ssd mode (BZ#1962241)

• Kernel BUG with act_ct and IP fragments (BZ#1963940)

• core: backports from upstream (BZ#1963952)

• Hibernate resume on Rocky Linux fails in Amazon EC2 C5.18xlarge instance (BZ#1964930)

• [SanityOnly] panic caused by i40e_msix_clean_rings (BZ#1964962)

• tc reclassification limit is too low for OVN (BZ#1965148)

• tc action ct nat src addr does not work while used with ct nat dst addr together (BZ#1965150)

• CNB: Rebase/update TC subsystem for Rocky Linux 8.5 (BZ#1965457)

• sctp: crash due to use after free of sctp_transport structure (BZ#1965632)

The Linux kernel through 5.8.13 does not properly enforce the Secure Boot Forbidden Signature Database (aka dbx) protection mechanism. This affects certs/blacklist.c and certs/system_keyring.c.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: use-after-free in net/bluetooth/hci_event.c when destroying an hci_chan (CVE-2021-33034)

• kernel: security bypass in certs/blacklist.c and certs/system_keyring.c (CVE-2020-26541)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• [ESXi][AlmaLinux-8] VMXNET3 v4 causes invalid checksums of inner packets of VXLAN tunnel (BZ#1960702)

• fnic crash from invalid request pointer (BZ#1961705)

• GFS2: Failed FS thaw call makes the entire snapshot failed. (BZ#1961849)

• dm writecache: fix performance degradation in ssd mode (BZ#1962241)

• Kernel BUG with act_ct and IP fragments (BZ#1963940)

• core: backports from upstream (BZ#1963952)

• Hibernate resume on AlmaLinux fails in Amazon EC2 C5.18xlarge instance (BZ#1964930)

• [SanityOnly] panic caused by i40e_msix_clean_rings (BZ#1964962)

• tc reclassification limit is too low for OVN (BZ#1965148)

• tc action ct nat src addr does not work while used with ct nat dst addr together (BZ#1965150)

• CNB: Rebase/update TC subsystem for AlmaLinux 8.5 (BZ#1965457)

• sctp: crash due to use after free of sctp_transport structure (BZ#1965632)

This kernel update is based on upstream 5.10.48 and fixes at least the following security issues:

The Linux kernel through 5.8.13 does not properly enforce the Secure Boot Forbidden Signature Database (aka dbx) protection mechanism. This affects certs/blacklist.c and certs/system_keyring.c (CVE-2020-26541).

An issue was discovered in Linux: KVM through Improper handling of VM_IO| VM_PFNMAP vmas in KVM can bypass RO checks and can lead to pages being freed while still accessible by the VMM and guest. This allows users with the ability to start and control a VM to read/write random pages of memory and can result in local privilege escalation (CVE-2021-22543).

kernel/module.c in the Linux kernel before 5.12.14 mishandles Signature Verification. Without CONFIG_MODULE_SIG, verification that a kernel module is signed, for loading via init_module, does not occur for a module.sig_enforce=1 command-line argument (CVE-2021-35039).

Other fixes in this update:

• ahci: Add support for Dell S140 and later controllers
• ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook 830 G8
• ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 445/450/630 G8
• drm/amdgpu: fix bad address translation for sienna_cichlid
• drm/sched: Avoid data corruptions
• net: ip: avoid OOM kills with large UDP sends over loopback
• iwlwifi: Add support for ax201 in Samsung Galaxy Book Flex2 Alpha
• virtio_net: Remove BUG() to avoid machine dead

For other upstream fixes, see the referenced changelogs.

This kernel-linus update is based on upstream 5.10.48 and fixes at least the following security issues:

The Linux kernel through 5.8.13 does not properly enforce the Secure Boot Forbidden Signature Database (aka dbx) protection mechanism. This affects certs/blacklist.c and certs/system_keyring.c (CVE-2020-26541).

An issue was discovered in Linux: KVM through Improper handling of VM_IO| VM_PFNMAP vmas in KVM can bypass RO checks and can lead to pages being freed while still accessible by the VMM and guest. This allows users with the ability to start and control a VM to read/write random pages of memory and can result in local privilege escalation (CVE-2021-22543).

kernel/module.c in the Linux kernel before 5.12.14 mishandles Signature Verification. Without CONFIG_MODULE_SIG, verification that a kernel module is signed, for loading via init_module, does not occur for a module.sig_enforce=1 command-line argument (CVE-2021-35039).

For other upstream fixes, see the referenced changelogs.

The SUSE Linux Enterprise 15 SP3 kernel was updated.

The following security bugs were fixed:

• CVE-2022-1966: Fixed an use-after-free bug in the netfilter subsystem. This flaw allowed a local attacker with user access to cause a privilege escalation issue. (bnc#1200015)
• CVE-2022-1975: Fixed a sleep-in-atomic bug that allows attacker to crash linux kernel by simulating nfc device from user-space. (bsc#1200143)
• CVE-2022-1974: Fixed an use-after-free that could causes kernel crash by simulating an nfc device from user-space. (bsc#1200144)
• CVE-2020-26541: Enforce the secure boot forbidden signature database (aka dbx) protection mechanism. (bnc#1177282)

The following non-security bugs were fixed:

• ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default (git-fixes).
• ACPI: sysfs: Fix BERT error region memory mapping (git-fixes).
• ACPI: sysfs: Make sparse happy about address space in use (git-fixes).
• ALSA: hda/conexant - Fix loopback issue with CX20632 (git-fixes).
• ALSA: usb-audio: Optimize TEAC clock quirk (git-fixes).
• ALSA: usb-audio: Set up (implicit) sync for Saffire 6 (git-fixes).
• ALSA: usb-audio: Skip generic sync EP parse for secondary EP (git-fixes).
• ALSA: usb-audio: Workaround for clock setup on TEAC devices (git-fixes).
• ASoC: dapm: Do not fold register value changes into notifications (git-fixes).
• ASoC: max98357a: remove dependency on GPIOLIB (git-fixes).
• ASoC: rt5645: Fix errorenous cleanup order (git-fixes).
• ASoC: tscs454: Add endianness flag in snd_soc_component_driver (git-fixes).
• ata: libata-transport: fix {dma|pio|xfer}_mode sysfs files (git-fixes).
• ath9k: fix QCA9561 PA bias level (git-fixes).
• b43: Fix assigning negative value to unsigned variable (git-fixes).
• b43legacy: Fix assigning negative value to unsigned variable (git-fixes).
• blk-mq: fix tag_get wait task can't be awakened (bsc#1200263).
• blk-mq: Fix wrong wakeup batch configuration which will cause hang (bsc#1200263).
• block: fix bio_clone_blkg_association() to associate with proper blkcg_gq (bsc#1200259).
• btrfs: tree-checker: fix incorrect printk format (bsc#1200249).
• cfg80211: set custom regdomain after wiphy registration (git-fixes).
• clocksource/drivers/oxnas-rps: Fix irq_of_parse_and_map() return value (git-fixes).
• clocksource/drivers/sp804: Avoid error on multiple instances (git-fixes).
• dma-buf: fix use of DMA_BUF_SET_NAME_{A,B} in userspace (git-fixes).
• dmaengine: zynqmp_dma: In struct zynqmp_dma_chan fix desc_size data type (git-fixes).
• drivers: i2c: thunderx: Allow driver to work with ACPI defined TWSI controllers (git-fixes).
• drivers: staging: rtl8192e: Fix deadlock in rtllib_beacons_stop() (git-fixes).
• drivers: staging: rtl8192u: Fix deadlock in ieee80211_beacons_stop() (git-fixes).
• drivers: tty: serial: Fix deadlock in sa1100_set_termios() (git-fixes).
• drivers: usb: host: Fix deadlock in oxu_bus_suspend() (git-fixes).
• drm: imx: fix compiler warning with gcc-12 (git-fixes).
• drm: msm: fix error check return value of irq_of_parse_and_map() (git-fixes).
• drm/amdgpu/cs: make commands with 0 chunks illegal behaviour (git-fixes).
• drm/amdgpu/smu10: fix SoC/fclk units in auto mode (git-fixes).
• drm/amdgpu/ucode: Remove firmware load type check in amdgpu_ucode_free_bo (git-fixes).
• drm/atomic: Force bridge self-refresh-exit on CRTC switch (git-fixes).
• drm/bridge: analogix_dp: Support PSR-exit to disable transition (git-fixes).
• drm/i915: Fix -Wstringop-overflow warning in call to intel_read_wm_latency() (git-fixes).
• drm/i915: fix i915_globals_exit() section mismatch error (git-fixes).
• drm/komeda: return early if drm_universal_plane_init() fails (git-fixes).
• drm/msm/dsi: fix address for second DSI PHY on SDM660 (git-fixes).
• drm/plane: Move range check for format_count earlier (git-fixes).
• drm/radeon: fix a possible null pointer dereference (git-fixes).
• drm/virtio: fix NULL pointer dereference in virtio_gpu_conn_get_modes (git-fixes).
• efi: Add missing…

The SUSE Linux Enterprise 15 SP3 kernel was updated.

The following security bugs were fixed:

• CVE-2022-1972: Fixed a buffer overflow in nftable that could lead to privilege escalation. (bsc#1200019)
• CVE-2019-19377: Fixed an user-after-free that could be triggered when an attacker mounts a crafted btrfs filesystem image. (bnc#1158266)
• CVE-2022-1729: Fixed a sys_perf_event_open() race condition against self (bsc#1199507).
• CVE-2022-1184: Fixed an use-after-free and memory errors in ext4 when mounting and operating on a corrupted image. (bsc#1198577)
• CVE-2022-1652: Fixed a statically allocated error counter inside the floppy kernel module (bsc#1199063).
• CVE-2022-20008: Fixed bug that allows to read kernel heap memory due to uninitialized data in mmc_blk_read_single of block.c. (bnc#1199564)
• CVE-2022-30594: Fixed restriction bypass on setting the PT_SUSPEND_SECCOMP flag (bnc#1199505).
• CVE-2022-0168: Fixed a NULL pointer dereference in smb2_ioctl_query_info. (bsc#1197472)
• CVE-2021-33061: Fixed insufficient control flow management for the Intel(R) 82599 Ethernet Controllers and Adapters that may have allowed an authenticated user to potentially enable denial of service via local access (bnc#1196426).
• CVE-2022-20141: Fixwed an use after free due to improper locking. This bug could lead to local escalation of privilege when opening and closing inet sockets with no additional execution privileges needed. (bnc#1200604)
• CVE-2022-21123: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21125: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21180: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21166: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21127: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-1975: Fixed a sleep-in-atomic bug that allows attacker to crash linux kernel by simulating nfc device from user-space. (bsc#1200143)
• CVE-2022-1974: Fixed an use-after-free that could causes kernel crash by simulating an nfc device from user-space. (bsc#1200144)
• CVE-2020-26541: Enforce the secure boot forbidden signature database (aka dbx) protection mechanism. (bnc#1177282)
• CVE-2022-32250: Fixed an use-after-free bug in the netfilter subsystem. This flaw allowed a local attacker with user access to cause a privilege escalation issue. (bnc#1200015)

The following non-security bugs were fixed:

• ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default (git-fixes).
• ACPI: property: Release subnode properties with data nodes (git-fixes).
• ACPI: sysfs: Fix BERT error region memory mapping (git-fixes).
• ACPI: sysfs: Make sparse happy about address space in use (git-fixes).
• ALSA: ctxfi: Add SB046x PCI ID (git-fixes).
• ALSA: fireworks: fix wrong return count shorter than expected by 4 bytes (git-fixes).
• ALSA: hda - fix unused Realtek function when PM is not enabled (git-fixes).
• ALSA: hda/conexant - Fix loopback issue with CX20632 (git-fixes).
• ALSA: hda/realtek - Add new type for ALC245 (git-fixes).
• ALSA: hda/realtek - Fix microphone noise on ASUS TUF B550M-PLUS (git-fixes).
• ALSA: hda/realtek: Enable 4-speaker output for Dell XPS 15 9520 laptop (git-fixes).
• ALSA: hda/realtek: Enable headset mic on Lenovo P360 (git-fixes).
• ALSA: pcm: Check for null pointer of pointer substream before dereferencing it (git-fixes).
• ALSA: usb-audio: Add missing ep_idx in fixed EP quirks (git-fixes).
• ALSA: usb-audio: Clear MIDI port active flag after draining (git-fixes). -…

The SUSE Linux Enterprise 15 SP2 kernel was updated.

The following security bugs were fixed:

• CVE-2022-0168: Fixed a NULL pointer dereference in smb2_ioctl_query_info. (bsc#1197472)
• CVE-2022-1966: Fixed an use-after-free bug in the netfilter subsystem. This flaw allowed a local attacker with user access to cause a privilege escalation issue. (bnc#1200015)
• CVE-2022-28893: Ensuring that sockets are in the intended state inside the SUNRPC subsystem (bnc#1198330).
• CVE-2022-1158: Fixed KVM x86/mmu compare-and-exchange of gPTE via the user address (bsc#1197660).
• CVE-2022-21127: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21123: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21125: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21180: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21166: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-1975: Fixed a bug that allows an attacker to crash the linux kernel by simulating nfc device from user-space. (bsc#1200143)
• CVE-2022-1974: Fixed an use-after-free that could causes kernel crash by simulating an nfc device from user-space. (bsc#1200144)
• CVE-2020-26541: Enforce the secure boot forbidden signature database (aka dbx) protection mechanism. (bnc#1177282)
• CVE-2019-19377: Fixed an user-after-free that could be triggered when an attacker mounts a crafted btrfs filesystem image. (bnc#1158266)
• CVE-2022-1729: Fixed a sys_perf_event_open() race condition against self (bsc#1199507).
• CVE-2022-1184: Fixed an use-after-free and memory errors in ext4 when mounting and operating on a corrupted image. (bsc#1198577)
• CVE-2022-1652: Fixed a statically allocated error counter inside the floppy kernel module (bsc#1199063).
• CVE-2022-1734: Fixed a r/w use-after-free when non synchronized between cleanup routine and firmware download routine. (bnc#1199605)
• CVE-2022-30594: Fixed restriction bypass on setting the PT_SUSPEND_SECCOMP flag (bnc#1199505).
• CVE-2021-33061: Fixed insufficient control flow management for the Intel(R) 82599 Ethernet Controllers and Adapters that may have allowed an authenticated user to potentially enable denial of service via local access (bnc#1196426).
• CVE-2022-1516: Fixed null-ptr-deref caused by x25_disconnect (bsc#1199012).
• CVE-2021-20321: Fixed a race condition accessing file object in the OverlayFS subsystem in the way users do rename in specific way with OverlayFS. A local user could have used this flaw to crash the system (bnc#1191647).
• CVE-2022-1353: Fixed access controll to kernel memory in the pfkey_register function in net/key/af_key.c. (bnc#1198516)
• CVE-2022-1011: Fixed an use-after-free vulnerability which could allow a local attacker to retireve (partial) /etc/shadow hashes or any other data from filesystem when he can mount a FUSE filesystems. (bnc#1197343)

The following non-security bugs were fixed:

• btrfs: tree-checker: fix incorrect printk format (bsc#1200249).
• cifs: fix bad fids sent over wire (bsc#1197157).
• direct-io: clean up error paths of do_blockdev_direct_IO (bsc#1197656).
• direct-io: defer alignment check until after the EOF check (bsc#1197656).
• direct-io: do not force writeback for reads beyond EOF (bsc#1197656).
• net: ena: A typo fix in the file ena_com.h (bsc#1198778).
• net: ena: Add capabilities field with support for ENI stats capability (bsc#1198778).
• net: ena: Add debug prints for invalid req_id resets (bsc#1198778).
• net: ena: add device distinct log prefix…

The SUSE Linux Enterprise 15 SP1 kernel was updated.

The following security bugs were fixed:

• CVE-2022-21127: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21123: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21125: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21180: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21166: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2019-19377: Fixed an user-after-free that could be triggered when an attacker mounts a crafted btrfs filesystem image. (bnc#1158266)
• CVE-2022-1184: Fixed an use-after-free and memory errors in ext4 when mounting and operating on a corrupted image. (bsc#1198577)
• CVE-2017-13695: Fixed a bug that caused a stack dump allowing local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism via a crafted ACPI table. (bnc#1055710)
• CVE-2022-1729: Fixed a sys_perf_event_open() race condition against self (bsc#1199507).
• CVE-2022-1652: Fixed a statically allocated error counter inside the floppy kernel module (bsc#1199063).
• CVE-2021-39711: In bpf_prog_test_run_skb of test_run.c, there is a possible out of bounds read due to Incorrect Size Value. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation (bnc#1197219).
• CVE-2022-30594: Fixed restriction bypass on setting the PT_SUSPEND_SECCOMP flag (bnc#1199505).
• CVE-2021-33061: Fixed insufficient control flow management for the Intel(R) 82599 Ethernet Controllers and Adapters that may have allowed an authenticated user to potentially enable denial of service via local access (bnc#1196426).
• CVE-2022-1516: Fixed null-ptr-deref caused by x25_disconnect (bsc#1199012).
• CVE-2021-20321: Fixed a race condition accessing file object in the OverlayFS subsystem in the way users do rename in specific way with OverlayFS. A local user could have used this flaw to crash the system (bnc#1191647).
• CVE-2019-20811: Fixed issue in rx_queue_add_kobject() and netdev_queue_add_kobject() in net/core/net-sysfs.c, where a reference count is mishandled (bnc#1172456).
• CVE-2022-28748: Fixed memory lead over the network by ax88179_178a devices (bsc#1196018).
• CVE-2018-7755: Fixed an issue in the fd_locked_ioctl function in drivers/block/floppy.c. The floppy driver will copy a kernel pointer to user memory in response to the FDGETPRM ioctl. An attacker can send the FDGETPRM ioctl and use the obtained kernel pointer to discover the location of kernel code and data and bypass kernel security protections such as KASLR (bnc#1084513).
• CVE-2022-22942: Fixed stale file descriptors on failed usercopy (bsc#1195065).
• CVE-2022-1419: Fixed a concurrency use-after-free in vgem_gem_dumb_create (bsc#1198742).
• CVE-2021-43389: Fixed an array-index-out-of-bounds flaw in the detach_capi_ctr function in drivers/isdn/capi/kcapi.c (bnc#1191958).
• CVE-2021-38208: Fixed a denial of service (NULL pointer dereference and BUG) by making a getsockname call after a certain type of failure of a bind call (bnc#1187055).
• CVE-2022-1353: Fixed access controll to kernel memory in the pfkey_register function in net/key/af_key.c (bnc#1198516).
• CVE-2021-20292: Fixed object validation prior to performing operations on the object in nouveau_sgdma_create_ttm in Nouveau DRM subsystem (bnc#1183723).
• CVE-2022-1011: Fixed an use-after-free vulnerability which could allow a local attacker to retireve…

The SUSE Linux Enterprise 15 SP3 kernel was updated.

The following security bugs were fixed:

• CVE-2022-1012: Fixed a small table perturb size in the TCP source port generation algorithm which could leads to information leak. (bsc#1199482).
• CVE-2022-20141: Fixed an use after free due to improper locking. This bug could lead to local escalation of privilege when opening and closing inet sockets with no additional execution privileges needed. (bnc#1200604)
• CVE-2022-32250: Fixed an use-after-free bug in the netfilter subsystem. This flaw allowed a local attacker with user access to cause a privilege escalation issue. (bnc#1200015)
• CVE-2022-1975: Fixed a sleep-in-atomic bug that allows attacker to crash linux kernel by simulating nfc device from user-space. (bsc#1200143)
• CVE-2022-1974: Fixed an use-after-free that could causes kernel crash by simulating an nfc device from user-space. (bsc#1200144)
• CVE-2020-26541: Enforce the secure boot forbidden signature database (aka dbx) protection mechanism. (bnc#1177282)

The following non-security bugs were fixed:

• ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default (git-fixes).
• ACPI: sysfs: Fix BERT error region memory mapping (git-fixes).
• ACPI: sysfs: Make sparse happy about address space in use (git-fixes).
• ALSA: hda/conexant - Fix loopback issue with CX20632 (git-fixes).
• ALSA: usb-audio: Optimize TEAC clock quirk (git-fixes).
• ALSA: usb-audio: Set up (implicit) sync for Saffire 6 (git-fixes).
• ALSA: usb-audio: Skip generic sync EP parse for secondary EP (git-fixes).
• ALSA: usb-audio: Workaround for clock setup on TEAC devices (git-fixes).
• arm64: dts: rockchip: Move drive-impedance-ohm to emmc phy on rk3399 (git-fixes)
• ASoC: dapm: Do not fold register value changes into notifications (git-fixes).
• ASoC: max98357a: remove dependency on GPIOLIB (git-fixes).
• ASoC: rt5645: Fix errorenous cleanup order (git-fixes).
• ASoC: tscs454: Add endianness flag in snd_soc_component_driver (git-fixes).
• ata: libata-transport: fix {dma|pio|xfer}_mode sysfs files (git-fixes).
• ath9k: fix QCA9561 PA bias level (git-fixes).
• b43: Fix assigning negative value to unsigned variable (git-fixes).
• b43legacy: Fix assigning negative value to unsigned variable (git-fixes).
• blk-mq: fix tag_get wait task can't be awakened (bsc#1200263).
• blk-mq: Fix wrong wakeup batch configuration which will cause hang (bsc#1200263).
• block: fix bio_clone_blkg_association() to associate with proper blkcg_gq (bsc#1200259).
• btrfs: tree-checker: fix incorrect printk format (bsc#1200249).
• certs/blacklist_hashes.c: fix const confusion in certs blacklist (git-fixes).
• cfg80211: set custom regdomain after wiphy registration (git-fixes).
• clocksource/drivers/oxnas-rps: Fix irq_of_parse_and_map() return value (git-fixes).
• clocksource/drivers/sp804: Avoid error on multiple instances (git-fixes).
• dma-buf: fix use of DMA_BUF_SET_NAME_{A,B} in userspace (git-fixes).
• dmaengine: zynqmp_dma: In struct zynqmp_dma_chan fix desc_size data type (git-fixes).
• drivers: i2c: thunderx: Allow driver to work with ACPI defined TWSI controllers (git-fixes).
• drivers: staging: rtl8192e: Fix deadlock in rtllib_beacons_stop() (git-fixes).
• drivers: staging: rtl8192u: Fix deadlock in ieee80211_beacons_stop() (git-fixes).
• drivers: tty: serial: Fix deadlock in sa1100_set_termios() (git-fixes).
• drivers: usb: host: Fix deadlock in oxu_bus_suspend() (git-fixes).
• drm: imx: fix compiler warning with gcc-12 (git-fixes).
• drm: msm: fix error check return value of irq_of_parse_and_map() (git-fixes).
• drm/amdgpu/cs: make commands with 0 chunks illegal behaviour (git-fixes).
• drm/amdgpu/smu10: fix SoC/fclk units in auto mode (git-fixes).
• drm/amdgpu/ucode: Remove firmware load type check in amdgpu_ucode_free_bo (git-fixes).
• drm/atomic: Force bridge self-refresh-exit on CRTC switch (git-fixes).
• drm/bridge: analogix_dp: Support PSR-exit to disable transition (git-fixes).
• drm/i915: Fix…

The SUSE Linux Enterprise 15 SP3 kernel was updated.

The following security bugs were fixed:

• CVE-2022-1966: Fixed an use-after-free bug in the netfilter subsystem. This flaw allowed a local attacker with user access to cause a privilege escalation issue. (bnc#1200015)
• CVE-2022-1975: Fixed a sleep-in-atomic bug that allows attacker to crash linux kernel by simulating nfc device from user-space. (bsc#1200143)
• CVE-2022-1974: Fixed an use-after-free that could causes kernel crash by simulating an nfc device from user-space. (bsc#1200144)
• CVE-2020-26541: Enforce the secure boot forbidden signature database (aka dbx) protection mechanism. (bnc#1177282)

The following non-security bugs were fixed:

• ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default (git-fixes).
• ACPI: sysfs: Fix BERT error region memory mapping (git-fixes).
• ACPI: sysfs: Make sparse happy about address space in use (git-fixes).
• ALSA: hda/conexant - Fix loopback issue with CX20632 (git-fixes).
• ALSA: usb-audio: Optimize TEAC clock quirk (git-fixes).
• ALSA: usb-audio: Set up (implicit) sync for Saffire 6 (git-fixes).
• ALSA: usb-audio: Skip generic sync EP parse for secondary EP (git-fixes).
• ALSA: usb-audio: Workaround for clock setup on TEAC devices (git-fixes).
• ASoC: dapm: Do not fold register value changes into notifications (git-fixes).
• ASoC: max98357a: remove dependency on GPIOLIB (git-fixes).
• ASoC: rt5645: Fix errorenous cleanup order (git-fixes).
• ASoC: tscs454: Add endianness flag in snd_soc_component_driver (git-fixes).
• ata: libata-transport: fix {dma|pio|xfer}_mode sysfs files (git-fixes).
• ath9k: fix QCA9561 PA bias level (git-fixes).
• b43: Fix assigning negative value to unsigned variable (git-fixes).
• b43legacy: Fix assigning negative value to unsigned variable (git-fixes).
• blk-mq: fix tag_get wait task can't be awakened (bsc#1200263).
• blk-mq: Fix wrong wakeup batch configuration which will cause hang (bsc#1200263).
• block: fix bio_clone_blkg_association() to associate with proper blkcg_gq (bsc#1200259).
• btrfs: tree-checker: fix incorrect printk format (bsc#1200249).
• cfg80211: set custom regdomain after wiphy registration (git-fixes).
• clocksource/drivers/oxnas-rps: Fix irq_of_parse_and_map() return value (git-fixes).
• clocksource/drivers/sp804: Avoid error on multiple instances (git-fixes).
• dma-buf: fix use of DMA_BUF_SET_NAME_{A,B} in userspace (git-fixes).
• dmaengine: zynqmp_dma: In struct zynqmp_dma_chan fix desc_size data type (git-fixes).
• drivers: i2c: thunderx: Allow driver to work with ACPI defined TWSI controllers (git-fixes).
• drivers: staging: rtl8192e: Fix deadlock in rtllib_beacons_stop() (git-fixes).
• drivers: staging: rtl8192u: Fix deadlock in ieee80211_beacons_stop() (git-fixes).
• drivers: tty: serial: Fix deadlock in sa1100_set_termios() (git-fixes).
• drivers: usb: host: Fix deadlock in oxu_bus_suspend() (git-fixes).
• drm: imx: fix compiler warning with gcc-12 (git-fixes).
• drm: msm: fix error check return value of irq_of_parse_and_map() (git-fixes).
• drm/amdgpu/cs: make commands with 0 chunks illegal behaviour (git-fixes).
• drm/amdgpu/smu10: fix SoC/fclk units in auto mode (git-fixes).
• drm/amdgpu/ucode: Remove firmware load type check in amdgpu_ucode_free_bo (git-fixes).
• drm/atomic: Force bridge self-refresh-exit on CRTC switch (git-fixes).
• drm/bridge: analogix_dp: Support PSR-exit to disable transition (git-fixes).
• drm/i915: Fix -Wstringop-overflow warning in call to intel_read_wm_latency() (git-fixes).
• drm/i915: fix i915_globals_exit() section mismatch error (git-fixes).
• drm/komeda: return early if drm_universal_plane_init() fails (git-fixes).
• drm/msm/dsi: fix address for second DSI PHY on SDM660 (git-fixes).
• drm/plane: Move range check for format_count earlier (git-fixes).
• drm/radeon: fix a possible null pointer dereference (git-fixes).
• drm/virtio: fix NULL pointer dereference in virtio_gpu_conn_get_modes (git-fixes).
• efi: Add missing…

The SUSE Linux Enterprise 15 SP3 kernel was updated.

The following security bugs were fixed:

• CVE-2022-1972: Fixed a buffer overflow in nftable that could lead to privilege escalation. (bsc#1200019)
• CVE-2019-19377: Fixed an user-after-free that could be triggered when an attacker mounts a crafted btrfs filesystem image. (bnc#1158266)
• CVE-2022-1729: Fixed a sys_perf_event_open() race condition against self (bsc#1199507).
• CVE-2022-1184: Fixed an use-after-free and memory errors in ext4 when mounting and operating on a corrupted image. (bsc#1198577)
• CVE-2022-1652: Fixed a statically allocated error counter inside the floppy kernel module (bsc#1199063).
• CVE-2022-20008: Fixed bug that allows to read kernel heap memory due to uninitialized data in mmc_blk_read_single of block.c. (bnc#1199564)
• CVE-2022-30594: Fixed restriction bypass on setting the PT_SUSPEND_SECCOMP flag (bnc#1199505).
• CVE-2022-0168: Fixed a NULL pointer dereference in smb2_ioctl_query_info. (bsc#1197472)
• CVE-2021-33061: Fixed insufficient control flow management for the Intel(R) 82599 Ethernet Controllers and Adapters that may have allowed an authenticated user to potentially enable denial of service via local access (bnc#1196426).
• CVE-2022-20141: Fixwed an use after free due to improper locking. This bug could lead to local escalation of privilege when opening and closing inet sockets with no additional execution privileges needed. (bnc#1200604)
• CVE-2022-21123: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21125: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21180: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21166: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21127: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-1975: Fixed a sleep-in-atomic bug that allows attacker to crash linux kernel by simulating nfc device from user-space. (bsc#1200143)
• CVE-2022-1974: Fixed an use-after-free that could causes kernel crash by simulating an nfc device from user-space. (bsc#1200144)
• CVE-2020-26541: Enforce the secure boot forbidden signature database (aka dbx) protection mechanism. (bnc#1177282)
• CVE-2022-32250: Fixed an use-after-free bug in the netfilter subsystem. This flaw allowed a local attacker with user access to cause a privilege escalation issue. (bnc#1200015)

The following non-security bugs were fixed:

• ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default (git-fixes).
• ACPI: property: Release subnode properties with data nodes (git-fixes).
• ACPI: sysfs: Fix BERT error region memory mapping (git-fixes).
• ACPI: sysfs: Make sparse happy about address space in use (git-fixes).
• ALSA: ctxfi: Add SB046x PCI ID (git-fixes).
• ALSA: fireworks: fix wrong return count shorter than expected by 4 bytes (git-fixes).
• ALSA: hda - fix unused Realtek function when PM is not enabled (git-fixes).
• ALSA: hda/conexant - Fix loopback issue with CX20632 (git-fixes).
• ALSA: hda/realtek - Add new type for ALC245 (git-fixes).
• ALSA: hda/realtek - Fix microphone noise on ASUS TUF B550M-PLUS (git-fixes).
• ALSA: hda/realtek: Enable 4-speaker output for Dell XPS 15 9520 laptop (git-fixes).
• ALSA: hda/realtek: Enable headset mic on Lenovo P360 (git-fixes).
• ALSA: pcm: Check for null pointer of pointer substream before dereferencing it (git-fixes).
• ALSA: usb-audio: Add missing ep_idx in fixed EP quirks (git-fixes).
• ALSA: usb-audio: Clear MIDI port active flag after draining (git-fixes). -…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-29900, CVE-2022-29901: Fixed the RETBLEED attack, a new Spectre like Branch Target Buffer attack, that can leak arbitrary kernel information (bsc#1199657).
• CVE-2022-1679: Fixed a use-after-free in the Atheros wireless driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages (bsc#1199487).
• CVE-2022-20132: Fixed out of bounds read due to improper input validation in lg_probe and related functions of hid-lg.c (bsc#1200619).
• CVE-2022-1012: Fixed information leak caused by small table perturb size in the TCP source port generation algorithm (bsc#1199482).
• CVE-2022-33981: Fixed use-after-free in floppy driver (bsc#1200692)
• CVE-2022-20141: Fixed a possible use after free due to improper locking in ip_check_mc_rcu() (bsc#1200604).
• CVE-2021-4157: Fixed an out of memory bounds write flaw in the NFS subsystem, related to the replication of files with NFS. A user could potentially crash the system or escalate privileges on the system (bsc#1194013).
• CVE-2022-20154: Fixed a use after free due to a race condition in lock_sock_nested of sock.c. This could lead to local escalation of privilege with System execution privileges needed (bsc#1200599).
• CVE-2020-26541: Enforce the secure boot forbidden signature database (aka dbx) protection mechanism. (bsc#1177282)
• CVE-2022-2318: Fixed a use-after-free vulnerabilities in the timer handler in net/rose/rose_timer.c that allow attackers to crash the system without any privileges (bsc#1201251).
• CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742: Fixed multiple potential data leaks with Block and Network devices when using untrusted backends (bsc#1200762).

The following non-security bugs were fixed:

• audit: fix a race condition with the auditd tracking code (bsc#1197170).
• block: bio-integrity: Advance seed correctly for larger interval sizes (git-fixes).
• bnxt_en: Remove the setting of dev_port (git-fixes).
• bonding: fix bond_neigh_init() (git-fixes).
• dm crypt: Avoid percpu_counter spinlock contention in crypt_page_alloc() (git-fixes).
• drbd: fix duplicate array initializer (git-fixes).
• drbd: remove assign_p_sizes_qlim (git-fixes).
• drbd: use bdev_alignment_offset instead of queue_alignment_offset (git-fixes).
• drbd: use bdev based limit helpers in drbd_send_sizes (git-fixes).
• exec: Force single empty string when argv is empty (bsc#1200571).
• ext4: fix bug_on ext4_mb_use_inode_pa (bsc#1200810).
• ext4: fix bug_on in __es_tree_search (bsc#1200809).
• ext4: fix bug_on in ext4_writepages (bsc#1200872).
• ext4: fix overhead calculation to account for the reserved gdt blocks (bsc#1200869).
• ext4: fix race condition between ext4_write and ext4_convert_inline_data (bsc#1200807).
• ext4: fix symlink file size not match to file content (bsc#1200868).
• ext4: fix use-after-free in ext4_rename_dir_prepare (bsc#1200871).
• ext4: force overhead calculation if the s_overhead_cluster makes no sense (bsc#1200870).
• ext4: limit length to bitmap_maxbytes - blocksize in punch_hole (bsc#1200806).
• ext4: make variable 'count' signed (bsc#1200820).
• fs-writeback: writeback_sb_inodes Recalculate 'wrote' according skipped pages (bsc#1200873).
• i915_vma: Rename vma_lookup to i915_vma_lookup (git-fixes).
• ibmvnic: Properly dispose of all skbs during a failover (bsc#1200925).
• init: Initialize noop_backing_dev_info early (bsc#1200822).
• inotify: show inotify mask flags in proc fdinfo (bsc#1200600).
• Input: bcm5974 - set missing URB_NO_TRANSFER_DMA_MAP urb flag (git-fixes).
• Input: elan_i2c - fix regulator enable count imbalance after suspend/resume (git-fixes).
• Input: elan_i2c - move regulator_[en|dis]able() out of elan_[en|dis]able_power() (git-fixes).
• Input: omap4-keypad - fix pm_runtime_get_sync() error checking (git-fixes).
• iomap: iomap_write_failed fix (bsc#1200829). -…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-29900, CVE-2022-29901: Fixed the RETBLEED attack, a new Spectre like Branch Target Buffer attack, that can leak arbitrary kernel information (bsc#1199657).
• CVE-2022-1679: Fixed a use-after-free in the Atheros wireless driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages (bsc#1199487).
• CVE-2022-20132: Fixed out of bounds read due to improper input validation in lg_probe and related functions of hid-lg.c (bsc#1200619).
• CVE-2022-1012: Fixed information leak caused by small table perturb size in the TCP source port generation algorithm (bsc#1199482).
• CVE-2022-33981: Fixed use-after-free in floppy driver (bsc#1200692)
• CVE-2022-20141: Fixed a possible use after free due to improper locking in ip_check_mc_rcu() (bsc#1200604).
• CVE-2021-4157: Fixed an out of memory bounds write flaw in the NFS subsystem, related to the replication of files with NFS. A user could potentially crash the system or escalate privileges on the system (bsc#1194013).
• CVE-2022-20154: Fixed a use after free due to a race condition in lock_sock_nested of sock.c. This could lead to local escalation of privilege with System execution privileges needed (bsc#1200599).
• CVE-2020-26541: Enforce the secure boot forbidden signature database (aka dbx) protection mechanism. (bsc#1177282)
• CVE-2022-2318: Fixed a use-after-free vulnerabilities in the timer handler in net/rose/rose_timer.c that allow attackers to crash the system without any privileges (bsc#1201251).
• CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742: Fixed multiple potential data leaks with Block and Network devices when using untrusted backends (bsc#1200762).

The following non-security bugs were fixed:

• add mainline tag for a pci-hyperv change
• audit: fix a race condition with the auditd tracking code (bsc#1197170).
• block: bio-integrity: Advance seed correctly for larger interval sizes (git-fixes).
• bnxt_en: Remove the setting of dev_port (git-fixes).
• bonding: fix bond_neigh_init() (git-fixes).
• dm crypt: Avoid percpu_counter spinlock contention in crypt_page_alloc() (git-fixes).
• drbd: fix duplicate array initializer (git-fixes).
• drbd: remove assign_p_sizes_qlim (git-fixes).
• drbd: use bdev_alignment_offset instead of queue_alignment_offset (git-fixes).
• drbd: use bdev based limit helpers in drbd_send_sizes (git-fixes).
• exec: Force single empty string when argv is empty (bsc#1200571).
• ext4: fix bug_on ext4_mb_use_inode_pa (bsc#1200810).
• ext4: fix bug_on in __es_tree_search (bsc#1200809).
• ext4: fix bug_on in ext4_writepages (bsc#1200872).
• ext4: fix overhead calculation to account for the reserved gdt blocks (bsc#1200869).
• ext4: fix race condition between ext4_write and ext4_convert_inline_data (bsc#1200807).
• ext4: fix symlink file size not match to file content (bsc#1200868).
• ext4: fix use-after-free in ext4_rename_dir_prepare (bsc#1200871).
• ext4: force overhead calculation if the s_overhead_cluster makes no sense (bsc#1200870).
• ext4: limit length to bitmap_maxbytes - blocksize in punch_hole (bsc#1200806).
• ext4: make variable 'count' signed (bsc#1200820).
• fs-writeback: writeback_sb_inodes Recalculate 'wrote' according skipped pages (bsc#1200873).
• i915_vma: Rename vma_lookup to i915_vma_lookup (git-fixes).
• ibmvnic: Properly dispose of all skbs during a failover (bsc#1200925).
• init: Initialize noop_backing_dev_info early (bsc#1200822).
• inotify: show inotify mask flags in proc fdinfo (bsc#1200600).
• Input: bcm5974 - set missing URB_NO_TRANSFER_DMA_MAP urb flag (git-fixes).
• Input: elan_i2c - fix regulator enable count imbalance after suspend/resume (git-fixes).
• Input: elan_i2c - move regulator_[en|dis]able() out of elan_[en|dis]able_power() (git-fixes).
• Input: omap4-keypad - fix pm_runtime_get_sync() error checking (git-fixes). -…

The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-29900, CVE-2022-29901: Fixed the RETBLEED attack, a new Spectre like Branch Target Buffer attack, that can leak arbitrary kernel information (bsc#1199657).
• CVE-2022-1679: Fixed a use-after-free in the Atheros wireless driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages (bsc#1199487).
• CVE-2022-20132: Fixed out of bounds read due to improper input validation in lg_probe and related functions of hid-lg.c (bsc#1200619).
• CVE-2022-33981: Fixed use-after-free in floppy driver (bsc#1200692)
• CVE-2022-20141: Fixed a possible use after free due to improper locking in ip_check_mc_rcu() (bsc#1200604).
• CVE-2021-4157: Fixed an out of memory bounds write flaw in the NFS subsystem, related to the replication of files with NFS. A user could potentially crash the system or escalate privileges on the system (bsc#1194013).
• CVE-2022-20154: Fixed a use after free due to a race condition in lock_sock_nested of sock.c. This could lead to local escalation of privilege with System execution privileges needed (bsc#1200599).
• CVE-2022-2318: Fixed a use-after-free vulnerabilities in the timer handler in net/rose/rose_timer.c that allow attackers to crash the system without any privileges (bsc#1201251).
• CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742: Fixed multiple potential data leaks with Block and Network devices when using untrusted backends (bsc#1200762).
• CVE-2021-26341: Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage (bsc#1201050).
• CVE-2020-26541: Enforce the secure boot forbidden signature database (aka dbx) protection mechanism. (bsc#1177282)
• CVE-2022-1974: Fixed an use-after-free that could causes kernel crash by simulating an nfc device from user-space (bsc#1200144).
• CVE-2022-1975: Fixed a bug that allows an attacker to crash the linux kernel by simulating nfc device from user-space (bsc#1200143).
• CVE-2022-1729: Fixed a sys_perf_event_open() race condition against self (bsc#1199507).
• CVE-2022-1184: Fixed a use-after-free and memory errors in ext4 when mounting and operating on a corrupted image (bsc#1198577).
• CVE-2022-21499: Lock down kgdb to prohibit secure-boot bypass (bsc#1199426).
• CVE-2019-19377: Fixed a user-after-free that could be triggered when an attacker mounts a crafted btrfs filesystem image (bsc#1158266).

The following non-security bugs were fixed:

• btrfs: tree-checker: fix incorrect printk format (bsc#1200249).
• exec: Force single empty string when argv is empty (bsc#1200571).

The SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-29900, CVE-2022-29901: Fixed the RETBLEED attack, a new Spectre like Branch Target Buffer attack, that can leak arbitrary kernel information (bsc#1199657).
• CVE-2022-1679: Fixed a use-after-free in the Atheros wireless driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages (bsc#1199487).
• CVE-2022-20132: Fixed out of bounds read due to improper input validation in lg_probe and related functions of hid-lg.c (bsc#1200619).
• CVE-2022-33981: Fixed use-after-free in floppy driver (bsc#1200692)
• CVE-2022-20141: Fixed a possible use after free due to improper locking in ip_check_mc_rcu() (bsc#1200604).
• CVE-2021-4157: Fixed an out of memory bounds write flaw in the NFS subsystem, related to the replication of files with NFS. A user could potentially crash the system or escalate privileges on the system (bsc#1194013).
• CVE-2022-20154: Fixed a use after free due to a race condition in lock_sock_nested of sock.c. This could lead to local escalation of privilege with System execution privileges needed (bsc#1200599).
• CVE-2022-2318: Fixed a use-after-free vulnerabilities in the timer handler in net/rose/rose_timer.c that allow attackers to crash the system without any privileges (bsc#1201251).
• CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742: Fixed multiple potential data leaks with Block and Network devices when using untrusted backends (bsc#1200762).
• CVE-2021-26341: Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage (bsc#1201050).
• CVE-2020-26541: Enforce the secure boot forbidden signature database (aka dbx) protection mechanism. (bsc#1177282)

The following non-security bugs were fixed:

• exec: Force single empty string when argv is empty (bsc#1200571).

The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-29900, CVE-2022-29901: Fixed the RETBLEED attack, a new Spectre like Branch Target Buffer attack, that can leak arbitrary kernel information (bsc#1199657).
• CVE-2022-1679: Fixed a use-after-free in the Atheros wireless driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages (bsc#1199487).
• CVE-2022-20132: Fixed out of bounds read due to improper input validation in lg_probe and related functions of hid-lg.c (bsc#1200619).
• CVE-2022-1012: Fixed information leak caused by small table perturb size in the TCP source port generation algorithm (bsc#1199482).
• CVE-2022-20141: Fixed a possible use after free due to improper locking in ip_check_mc_rcu() (bsc#1200604).
• CVE-2021-4157: Fixed an out of memory bounds write flaw in the NFS subsystem, related to the replication of files with NFS. A user could potentially crash the system or escalate privileges on the system (bsc#1194013).
• CVE-2022-20154: Fixed a use after free due to a race condition in lock_sock_nested of sock.c. This could lead to local escalation of privilege with System execution privileges needed (bsc#1200599).
• CVE-2020-26541: Enforce the secure boot forbidden signature database (aka dbx) protection mechanism. (bsc#1177282)
• CVE-2022-2318: Fixed a use-after-free vulnerabilities in the timer handler in net/rose/rose_timer.c that allow attackers to crash the system without any privileges (bsc#1201251).
• CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742: Fixed multiple potential data leaks with Block and Network devices when using untrusted backends (bsc#1200762).
• CVE-2022-21166: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via Spectre like attacks (bsc#1199650).
• CVE-2022-21123: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via Spectre like attacks (bsc#1199650).
• CVE-2022-21125: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via Spectre like attacks (bsc#1199650).
• CVE-2022-21127: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via Spectre like attacks (bsc#1199650).
• CVE-2022-21180: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via Spectre like attacks (bsc#1199650).
• CVE-2021-26341: Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage (bsc#1201050).
• CVE-2022-1966: Fixed an use-after-free bug in the netfilter subsystem. This flaw allowed a local attacker with user access to cause a privilege escalation issue. (bnc#1200015)
• CVE-2022-1975: Fixed a sleep-in-atomic bug that allows attacker to crash linux kernel by simulating nfc device from user-space. (bsc#1200143)
• CVE-2022-1974: Fixed an use-after-free that could causes kernel crash by simulating an nfc device from user-space. (bsc#1200144)
• CVE-2019-19377: Fixed an user-after-free that could be triggered when an attacker mounts a crafted btrfs filesystem image. (bnc#1158266)
• CVE-2022-1729: Fixed a sys_perf_event_open() race condition against self (bsc#1199507).
• CVE-2022-1184: Fixed an use-after-free and memory errors in ext4 when mounting and operating on a corrupted image. (bsc#1198577)
• CVE-2022-21499: Reinforce the kernel lockdown feature, until now it's been trivial to break out of it with kgdb or kdb. (bsc#1199426)
• CVE-2022-1836: Fixed a bug in the floppy submodule disabling FDRAWCMD by default. (bsc#1198866)
• CVE-2022-1652: Fixed a statically allocated error counter inside the floppy kernel module (bsc#1199063).
• CVE-2022-1734: Fixed a r/w use-after-free when non synchronized between cleanup routine and…

The SUSE Linux Enterprise 12 SP2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-3635: Fixed a use-after-free in the tst_timer() of the file drivers/atm/idt77252.c (bsc#1204631).
• CVE-2022-3424: Fixed use-after-free in gru_set_context_option(), gru_fault() and gru_handle_user_call_os() that could lead to kernel panic (bsc#1204166).
• CVE-2022-41850: Fixed a race condition in roccat_report_event() in drivers/hid/hid-roccat.c (bsc#1203960).
• CVE-2022-45934: Fixed a integer wraparound via L2CAP_CONF_REQ packets in l2cap_config_req in net/bluetooth/l2cap_core.c (bsc#1205796).
• CVE-2022-3628: Fixed potential buffer overflow in brcmf_fweh_event_worker() in wifi/brcmfmac (bsc#1204868).
• CVE-2022-3567: Fixed a to race condition in inet6_stream_ops()/inet6_dgram_ops() (bsc#1204414).
• CVE-2022-41858: Fixed a denial of service in sl_tx_timeout() in drivers/net/slip (bsc#1205671).
• CVE-2022-43945: Fixed a buffer overflow in the NFSD implementation (bsc#1205128).
• CVE-2022-4095: Fixed a use-after-free in rtl8712 driver (bsc#1205514).
• CVE-2022-3903: Fixed a denial of service with the Infrared Transceiver USB driver (bsc#1205220).
• CVE-2022-2964: Fixed memory corruption issues in ax88179_178a devices (bsc#1202686).
• CVE-2021-4037: Fixed function logic vulnerability that allowed local users to create files for the XFS file-system with an unintended group ownership and with group execution and SGID permission bits set (bsc#1198702).
• CVE-2022-43750: Fixed vulnerability in usbmon that allowed a user-space client to corrupt the monitor's internal memory (bsc#1204653).
• CVE-2020-26541: Enforce the secure boot forbidden signature database (aka dbx) protection mechanism (bsc#1177282).
• CVE-2022-3542: Fixed memory leak in bnx2x_tpa_stop() in drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c (bsc#1204402).
• CVE-2022-3629: Fixed memory leak in vsock_connect() in net/vmw_vsock/af_vsock.c (bsc#1204635).
• CVE-2022-3646: Fixed memory leak in nilfs_attach_log_writer() in fs/nilfs2/segment.c (bsc#1204646).
• CVE-2022-3649: Fixed use-after-free in nilfs_new_inode() in fs/nilfs2/inode.c (bsc#1204647).
• CVE-2022-3621: Fixed null pointer dereference in nilfs_bmap_lookup_at_level() in fs/nilfs2/inode.c (bsc#1204574).
• CVE-2022-3594: Fixed excessive data logging in intr_callback() in drivers/net/usb/r8152.c (bsc#1204479).
• CVE-2022-3586: Fixed use-after-free in socket buffer (SKB) that could allow a local unprivileged user to cause a denial of service (bsc#1204439).
• CVE-2022-3565: Fixed use-after-free in del_timer() in drivers/isdn/mISDN/l1oip_core.c (bsc#1204431).
• CVE-2022-3524: Fixed memory leak in ipv6_renew_options() in the IPv6 handler (bsc#1204354).
• CVE-2022-2663: Fixed an issue which allowed a firewall to be bypassed when users are using unencrypted IRC with nf_conntrack_irc configured (bsc#1202097).
• CVE-2022-40768: Fixed information leak in the scsi driver which allowed local users to obtain sensitive information from kernel memory (bsc#1203514).
• CVE-2022-42703: Fixed use-after-free in mm/rmap.c related to leaf anon_vma double reuse (bsc#1204168).
• CVE-2022-3169: Fixed an denial of service though request to NVME_IOCTL_RESET and NVME_IOCTL_SUBSYS_RESET (bsc#1203290).
• CVE-2022-40307: Fixed a race condition that could had been exploited to trigger a use-after-free in the efi firmware capsule-loader.c (bsc#1203322).
• CVE-2022-41848: Fixed a race condition in drivers/char/pcmcia/synclink_cs.c mgslpc_ioctl and mgslpc_detach (bsc#1203987).

The following non-security bugs were fixed:

• x86/build/64: Force the linker to use 2MB page size (bnc#1012382, bsc#1206091).

The SUSE Linux Enterprise 12 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-3635: Fixed a use-after-free in the tst_timer() of the file drivers/atm/idt77252.c (bsc#1204631).
• CVE-2022-3424: Fixed use-after-free in gru_set_context_option(), gru_fault() and gru_handle_user_call_os() that could lead to kernel panic (bsc#1204166).
• CVE-2022-41850: Fixed a race condition in roccat_report_event() in drivers/hid/hid-roccat.c (bsc#1203960).
• CVE-2022-45934: Fixed a integer wraparound via L2CAP_CONF_REQ packets in l2cap_config_req in net/bluetooth/l2cap_core.c (bsc#1205796).
• CVE-2022-3628: Fixed potential buffer overflow in brcmf_fweh_event_worker() in wifi/brcmfmac (bsc#1204868).
• CVE-2022-3567: Fixed a to race condition in inet6_stream_ops()/inet6_dgram_ops() (bsc#1204414).
• CVE-2022-41858: Fixed a denial of service in sl_tx_timeout() in drivers/net/slip (bsc#1205671).
• CVE-2022-43945: Fixed a buffer overflow in the NFSD implementation (bsc#1205128).
• CVE-2022-4095: Fixed a use-after-free in rtl8712 driver (bsc#1205514).
• CVE-2022-3903: Fixed a denial of service with the Infrared Transceiver USB driver (bsc#1205220).
• CVE-2022-2964: Fixed memory corruption issues in ax88179_178a devices (bsc#1202686).
• CVE-2021-4037: Fixed function logic vulnerability that allowed local users to create files for the XFS file-system with an unintended group ownership and with group execution and SGID permission bits set (bsc#1198702).
• CVE-2022-43750: Fixed vulnerability in usbmon that allowed a user-space client to corrupt the monitor's internal memory (bsc#1204653).
• CVE-2020-26541: Enforce the secure boot forbidden signature database (aka dbx) protection mechanism (bsc#1177282).
• CVE-2022-3542: Fixed memory leak in bnx2x_tpa_stop() in drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c (bsc#1204402).
• CVE-2022-3629: Fixed memory leak in vsock_connect() in net/vmw_vsock/af_vsock.c (bsc#1204635).
• CVE-2022-3646: Fixed memory leak in nilfs_attach_log_writer() in fs/nilfs2/segment.c (bsc#1204646).
• CVE-2022-3649: Fixed use-after-free in nilfs_new_inode() in fs/nilfs2/inode.c (bsc#1204647).
• CVE-2022-3621: Fixed null pointer dereference in nilfs_bmap_lookup_at_level() in fs/nilfs2/inode.c (bsc#1204574).
• CVE-2022-3594: Fixed excessive data logging in intr_callback() in drivers/net/usb/r8152.c (bsc#1204479).
• CVE-2022-3586: Fixed use-after-free in socket buffer (SKB) that could allow a local unprivileged user to cause a denial of service (bsc#1204439).
• CVE-2022-3565: Fixed use-after-free in del_timer() in drivers/isdn/mISDN/l1oip_core.c (bsc#1204431).
• CVE-2022-3524: Fixed memory leak in ipv6_renew_options() in the IPv6 handler (bsc#1204354).
• CVE-2022-2663: Fixed an issue which allowed a firewall to be bypassed when users are using unencrypted IRC with nf_conntrack_irc configured (bsc#1202097).
• CVE-2022-40768: Fixed information leak in the scsi driver which allowed local users to obtain sensitive information from kernel memory (bsc#1203514).
• CVE-2022-42703: Fixed use-after-free in mm/rmap.c related to leaf anon_vma double reuse (bsc#1204168).
• CVE-2022-3169: Fixed an denial of service though request to NVME_IOCTL_RESET and NVME_IOCTL_SUBSYS_RESET (bsc#1203290).
• CVE-2022-40307: Fixed a race condition that could had been exploited to trigger a use-after-free in the efi firmware capsule-loader.c (bsc#1203322).
• CVE-2022-41848: Fixed a race condition in drivers/char/pcmcia/synclink_cs.c mgslpc_ioctl and mgslpc_detach (bsc#1203987).

The following non-security bugs were fixed:

• net: mana: Add rmb after checking owner bits (git-fixes).
• net: mana: Add the Linux MANA PF driver (bug#1201309, jsc#PED-529).
• x86/hyperv: Output host build info as normal Windows version number (git-fixes).
• x86/hyperv: Set pv_info.name to 'Hyper-V' (git-fixes).

Maxim Levitsky and Paolo Bonzini discovered that the KVM hypervisor implementation for AMD processors in the Linux kernel allowed a guest VM to disable restrictions on VMLOAD/VMSAVE in a nested guest. An attacker in a guest VM could use this to read or write portions of the host's physical memory. (CVE-2021-3656)

Maxim Levitsky discovered that the KVM hypervisor implementation for AMD processors in the Linux kernel did not properly prevent a guest VM from enabling AVIC in nested guest VMs. An attacker in a guest VM could use this to write to portions of the host's physical memory. (CVE-2021-3653)

It was discovered that the Linux kernel did not properly enforce certain types of entries in the Secure Boot Forbidden Signature Database (aka dbx) protection mechanism. An attacker could use this to bypass UEFI Secure Boot restrictions. (CVE-2020-26541)

It was discovered that the KVM hypervisor implementation in the Linux kernel did not properly perform reference counting in some situations, leading to a use-after-free vulnerability. An attacker who could start and control a VM could possibly use this to expose sensitive information or execute arbitrary code. (CVE-2021-22543)

Norbert Slusarek discovered that the CAN broadcast manger (bcm) protocol implementation in the Linux kernel did not properly initialize memory in some situations. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2021-34693)

Murray McAllister discovered that the joystick device interface in the Linux kernel did not properly validate data passed via an ioctl(). A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code on systems with a joystick device registered. (CVE-2021-3612)

It was discovered that the KVM hypervisor implementation in the Linux kernel did not properly compute the access permissions for shadow pages in some situations. A local attacker could use this to cause a denial of service. (CVE-2021-38198)

It was discovered that the perf subsystem in the Linux kernel for the PowerPC architecture contained a null pointer dereference in some situations. An attacker could use this to cause a denial of service (system crash). (CVE-2021-38200)

Ben Greear discovered that the mac80211 subsystem in the Linux kernel contained a null pointer dereference in some situations. A physically proximate attacker could possibly use this to cause a denial of service (system crash). (CVE-2021-38206)

It was discovered that the Xilinx LL TEMAC device driver in the Linux kernel did not properly calculate the number of buffers to be used in certain situations. A remote attacker could use this to cause a denial of service (system crash). (CVE-2021-38207)

Valentina Palmiotti discovered that the io_uring subsystem in the Linux kernel could be coerced to free adjacent memory. A local attacker could use this to execute arbitrary code. (CVE-2021-41073)

It was discovered that the Linux kernel did not properly enforce certain types of entries in the Secure Boot Forbidden Signature Database (aka dbx) protection mechanism. An attacker could use this to bypass UEFI Secure Boot restrictions. (CVE-2020-26541)

It was discovered that the KVM hypervisor implementation in the Linux kernel did not properly perform reference counting in some situations, leading to a use-after-free vulnerability. An attacker who could start and control a VM could possibly use this to expose sensitive information or execute arbitrary code. (CVE-2021-22543)

Murray McAllister discovered that the joystick device interface in the Linux kernel did not properly validate data passed via an ioctl(). A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code on systems with a joystick device registered. (CVE-2021-3612)

It was discovered that the Virtio console implementation in the Linux kernel did not properly validate input lengths in some situations. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2021-38160)

Michael Wakabayashi discovered that the NFSv4 client implementation in the Linux kernel did not properly order connection setup operations. An attacker controlling a remote NFS server could use this to cause a denial of service on the client. (CVE-2021-38199)

It was discovered that the f2fs file system in the Linux kernel did not properly validate metadata in some situations. An attacker could use this to construct a malicious f2fs image that, when mounted and operated on, could cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-19449)

It was discovered that the Linux kernel did not properly enforce certain types of entries in the Secure Boot Forbidden Signature Database (aka dbx) protection mechanism. An attacker could use this to bypass UEFI Secure Boot restrictions. (CVE-2020-26541)

It was discovered that the KVM hypervisor implementation for AMD processors in the Linux kernel did not ensure enough processing time was given to perform cleanups of large SEV VMs. A local attacker could use this to cause a denial of service (soft lockup). (CVE-2020-36311)

It was discovered that the KVM hypervisor implementation in the Linux kernel did not properly perform reference counting in some situations, leading to a use-after-free vulnerability. An attacker who could start and control a VM could possibly use this to expose sensitive information or execute arbitrary code. (CVE-2021-22543)

Murray McAllister discovered that the joystick device interface in the Linux kernel did not properly validate data passed via an ioctl(). A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code on systems with a joystick device registered. (CVE-2021-3612)

It was discovered that the Linux kernel did not properly account for the memory usage of certain IPC objects. A local attacker could use this to cause a denial of service (memory exhaustion). (CVE-2021-3759)

Michael Wakabayashi discovered that the NFSv4 client implementation in the Linux kernel did not properly order connection setup operations. An attacker controlling a remote NFS server could use this to cause a denial of service on the client. (CVE-2021-38199)

It was discovered that the Xilinx LL TEMAC device driver in the Linux kernel did not properly calculate the number of buffers to be used in certain situations. A remote attacker could use this to cause a denial of service (system crash). (CVE-2021-38207)

It was discovered that the ext4 file system in the Linux kernel contained a race condition when writing xattrs to an inode. A local attacker could use this to cause a denial of service or possibly gain administrative privileges. (CVE-2021-40490)

Nadav Amit discovered that the hugetlb implementation in the Linux kernel did not perform TLB flushes under certain conditions. A local attacker could use this to leak or alter data from other processes that use huge pages. (CVE-2021-4002)

It was discovered that the Linux kernel did not properly enforce certain types of entries in the Secure Boot Forbidden Signature Database (aka dbx) protection mechanism. An attacker could use this to bypass UEFI Secure Boot restrictions. (CVE-2020-26541)

It was discovered that a race condition existed in the overlay file system implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash). (CVE-2021-20321)

It was discovered that the NFC subsystem in the Linux kernel contained a use-after-free vulnerability in its NFC Controller Interface (NCI) implementation. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2021-3760)

It was discovered that an integer overflow could be triggered in the eBPF implementation in the Linux kernel when preallocating objects for stack maps. A privileged local attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2021-41864)

It was discovered that the KVM implementation for POWER8 processors in the Linux kernel did not properly keep track if a wakeup event could be resolved by a guest. An attacker in a guest VM could possibly use this to cause a denial of service (host OS crash). (CVE-2021-43056)

It was discovered that the ISDN CAPI implementation in the Linux kernel contained a race condition in certain situations that could trigger an array out-of-bounds bug. A privileged local attacker could possibly use this to cause a denial of service or execute arbitrary code. (CVE-2021-43389)