CVE-2021-22600

A double free bug in packet_set_ring() in net/packet/af_packet.c can be exploited by a local user through crafted syscalls to escalate privileges or deny service. We recommend upgrading kernel past the effected versions or rebuilding past ec6af094ea28f0f2dda1a6a33b14cd57e36a9755

A double free bug in packet_set_ring() in net/packet/af_packet.c can be exploited by a local user through crafted syscalls to escalate privileges or deny service. We recommend upgrading kernel past the effected versions or rebuilding past ec6af094ea28f0f2dda1a6a33b14cd57e36a9755

The Linux Kernel, the operating system core itself.

Security Fix(es):

A double free bug in packet_set_ring() in net/packet/af_packet.c can be exploited by a local user through crafted syscalls to escalate privileges or deny service. We recommend upgrading kernel past the effected versions or rebuilding past ec6af094ea28f0f2dda1a6a33b14cd57e36a9755(CVE-2021-22600)

A use-after-free flaw was found in the Linux kernel’s vmw_execbuf_copy_fence_user function in drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c in vmwgfx. This flaw allows a local attacker with user privileges to cause a privilege escalation problem.(CVE-2022-22942)

A double free bug in packet_set_ring() in net/packet/af_packet.c can be exploited by a local user through crafted syscalls to escalate privileges or deny service. We recommend upgrading kernel past the effected versions or rebuilding past ec6af094ea28f0f2dda1a6a33b14cd57e36a9755

In packet_set_ring of af_packet.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

The SUSE Linux Enterprise 15 SP3 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-0435: Fixed remote stack overflow in net/tipc module that validate domain record count on input (bsc#1195254).
• CVE-2022-0330: Fixed flush TLBs before releasing backing store (bsc#1194880).
• CVE-2022-0286: Fixed null pointer dereference in bond_ipsec_add_sa() that may have lead to local denial of service (bnc#1195371).
• CVE-2022-22942: Fixed stale file descriptors on failed usercopy (bsc#1195065).
• CVE-2021-45095: Fixed refcount leak in pep_sock_accept in net/phonet/pep.c (bnc#1193867).
• CVE-2021-44733: Fixed a use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem, that could have occured because of a race condition in tee_shm_get_from_id during an attempt to free a shared memory object (bnc#1193767).
• CVE-2021-39657: Fixed out of bounds read due to a missing bounds check in ufshcd_eh_device_reset_handler of ufshcd.c. This could lead to local information disclosure with System execution privileges needed (bnc#1193864).
• CVE-2021-39648: Fixed possible disclosure of kernel heap memory due to a race condition in gadget_dev_desc_UDC_show of configfs.c. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation (bnc#1193861).
• CVE-2021-22600: Fixed double free bug in packet_set_ring() in net/packet/af_packet.c that could have been exploited by a local user through crafted syscalls to escalate privileges or deny service (bnc#1195184).
• CVE-2020-28097: Fixed out-of-bounds read in vgacon subsystem that mishandled software scrollback (bnc#1187723).
• CVE-2021-4159: Fixed kernel ptr leak vulnerability via BPF in coerce_reg_to_size (bsc#1194227).

The following security references were added to already fixed issues:

• CVE-2021-39685: Fixed USB gadget buffer overflow caused by too large endpoint 0 requests (bsc#1193802).

The following non-security bugs were fixed:

• ACPI: battery: Add the ThinkPad 'Not Charging' quirk (git-fixes).
• ACPICA: Executer: Fix the REFCLASS_REFOF case in acpi_ex_opcode_1A_0T_1R() (git-fixes).
• ACPICA: Fix wrong interpretation of PCC address (git-fixes).
• ACPICA: Hardware: Do not flush CPU cache when entering S4 and S5 (git-fixes).
• ACPICA: Utilities: Avoid deleting the same object twice in a row (git-fixes).
• ACPICA: actypes.h: Expand the ACPI_ACCESS_ definitions (git-fixes).
• ALSA: seq: Set upper limit of processed events (git-fixes).
• ASoC: mediatek: mt8173: fix device_node leak (git-fixes).
• Bluetooth: Fix debugfs entry leak in hci_register_dev() (git-fixes).
• Documentation: fix firewire.rst ABI file path error (git-fixes).
• HID: apple: Do not reset quirks when the Fn key is not found (git-fixes).
• HID: quirks: Allow inverting the absolute X/Y values (git-fixes).
• HID: uhid: Fix worker destroying device without any protection (git-fixes).
• HID: wacom: Reset expected and received contact counts at the same time (git-fixes).
• PCI: Add function 1 DMA alias quirk for Marvell 88SE9125 SATA controller (git-fixes).
• RDMA/core: Clean up cq pool mechanism (jsc#SLE-15176).
• RDMA/rxe: Remove the unnecessary variable (jsc#SLE-15176).
• ar5523: Fix null-ptr-deref with unexpected WDCMSG_TARGET_START reply (git-fixes).
• arm64: Kconfig: add a choice for endianness (jsc#SLE-23432).
• asix: fix wrong return value in asix_check_host_enable() (git-fixes).
• ata: pata_platform: Fix a NULL pointer dereference in __pata_platform_probe() (git-fixes).
• ath10k: Fix tx hanging (git-fixes).
• ath9k: Fix out-of-bound memcpy in ath9k_hif_usb_rx_stream (git-fixes).
• batman-adv: allow netlink usage in unprivileged containers (git-fixes).
• btrfs: tree-checker: Add EXTENT_ITEM and METADATA_ITEM check (bsc#1195009).
• btrfs: tree-checker: annotate all error branches as unlikely (bsc#1195009).
• btrfs: tree-checker: check for BTRFS_BLOCK_FLAG_FULL_BACKREF being set…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-0435: Fixed remote stack overflow in net/tipc module that validate domain record count on input (bsc#1195254).
• CVE-2022-0330: Fixed flush TLBs before releasing backing store (bsc#1194880).
• CVE-2022-0286: Fixed null pointer dereference in bond_ipsec_add_sa() that may have lead to local denial of service (bnc#1195371).
• CVE-2022-22942: Fixed stale file descriptors on failed usercopy (bsc#1195065).
• CVE-2021-45095: Fixed refcount leak in pep_sock_accept in net/phonet/pep.c (bnc#1193867).
• CVE-2021-44733: Fixed a use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem, that could have occured because of a race condition in tee_shm_get_from_id during an attempt to free a shared memory object (bnc#1193767).
• CVE-2021-39685: Fixed USB gadget buffer overflow caused by too large endpoint 0 requests (bsc#1193802).
• CVE-2021-39657: Fixed out of bounds read due to a missing bounds check in ufshcd_eh_device_reset_handler of ufshcd.c. This could lead to local information disclosure with System execution privileges needed (bnc#1193864).
• CVE-2021-39648: Fixed possible disclosure of kernel heap memory due to a race condition in gadget_dev_desc_UDC_show of configfs.c. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation (bnc#1193861).
• CVE-2021-22600: Fixed double free bug in packet_set_ring() in net/packet/af_packet.c that could have been exploited by a local user through crafted syscalls to escalate privileges or deny service (bnc#1195184).
• CVE-2020-28097: Fixed out-of-bounds read in vgacon subsystem that mishandled software scrollback (bnc#1187723).

The following non-security bugs were fixed:

• ACPI: battery: Add the ThinkPad 'Not Charging' quirk (git-fixes).
• ACPICA: Executer: Fix the REFCLASS_REFOF case in acpi_ex_opcode_1A_0T_1R() (git-fixes).
• ACPICA: Fix wrong interpretation of PCC address (git-fixes).
• ACPICA: Hardware: Do not flush CPU cache when entering S4 and S5 (git-fixes).
• ACPICA: Utilities: Avoid deleting the same object twice in a row (git-fixes).
• ACPICA: actypes.h: Expand the ACPI_ACCESS_ definitions (git-fixes).
• ALSA: seq: Set upper limit of processed events (git-fixes).
• ALSA: usb-audio: Correct quirk for VF0770 (git-fixes).
• ALSA: usb-audio: initialize variables that could ignore errors (git-fixes).
• ASoC: cpcap: Check for NULL pointer after calling of_get_child_by_name (git-fixes).
• ASoC: fsl: Add missing error handling in pcm030_fabric_probe (git-fixes).
• ASoC: max9759: fix underflow in speaker_gain_control_put() (git-fixes).
• ASoC: mediatek: mt8173: fix device_node leak (git-fixes).
• ASoC: xilinx: xlnx_formatter_pcm: Make buffer bytes multiple of period bytes (git-fixes).
• Bluetooth: Fix debugfs entry leak in hci_register_dev() (git-fixes).
• Bluetooth: refactor malicious adv data check (git-fixes).
• Documentation: fix firewire.rst ABI file path error (git-fixes).
• HID: apple: Do not reset quirks when the Fn key is not found (git-fixes).
• HID: quirks: Allow inverting the absolute X/Y values (git-fixes).
• HID: uhid: Fix worker destroying device without any protection (git-fixes).
• HID: wacom: Reset expected and received contact counts at the same time (git-fixes).
• IB/cm: Avoid a loop when device has 255 ports (git-fixes)
• IB/hfi1: Fix error return code in parse_platform_config() (git-fixes)
• IB/hfi1: Use kzalloc() for mmu_rb_handler allocation (git-fixes)
• IB/isert: Fix a use after free in isert_connect_request (git-fixes)
• IB/mlx4: Separate tunnel and wire bufs parameters (git-fixes)
• IB/mlx5: Add missing error code (git-fixes)
• IB/mlx5: Add mutex destroy call to cap_mask_mutex mutex (git-fixes)
• IB/mlx5: Fix error unwinding when set_has_smi_cap fails (git-fixes)
• IB/mlx5: Return appropriate error code instead of ENOMEM (git-fixes)…

In packet_set_ring of af_packet.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

The SUSE Linux Enterprise 15 SP3 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-0435: Fixed remote stack overflow in net/tipc module that validate domain record count on input (bsc#1195254).
• CVE-2022-0330: Fixed flush TLBs before releasing backing store (bsc#1194880).
• CVE-2022-0286: Fixed null pointer dereference in bond_ipsec_add_sa() that may have lead to local denial of service (bnc#1195371).
• CVE-2022-22942: Fixed stale file descriptors on failed usercopy (bsc#1195065).
• CVE-2021-45095: Fixed refcount leak in pep_sock_accept in net/phonet/pep.c (bnc#1193867).
• CVE-2021-44733: Fixed a use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem, that could have occured because of a race condition in tee_shm_get_from_id during an attempt to free a shared memory object (bnc#1193767).
• CVE-2021-39657: Fixed out of bounds read due to a missing bounds check in ufshcd_eh_device_reset_handler of ufshcd.c. This could lead to local information disclosure with System execution privileges needed (bnc#1193864).
• CVE-2021-39648: Fixed possible disclosure of kernel heap memory due to a race condition in gadget_dev_desc_UDC_show of configfs.c. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation (bnc#1193861).
• CVE-2021-22600: Fixed double free bug in packet_set_ring() in net/packet/af_packet.c that could have been exploited by a local user through crafted syscalls to escalate privileges or deny service (bnc#1195184).
• CVE-2020-28097: Fixed out-of-bounds read in vgacon subsystem that mishandled software scrollback (bnc#1187723).
• CVE-2021-4159: Fixed kernel ptr leak vulnerability via BPF in coerce_reg_to_size (bsc#1194227).

The following security references were added to already fixed issues:

• CVE-2021-39685: Fixed USB gadget buffer overflow caused by too large endpoint 0 requests (bsc#1193802).

The following non-security bugs were fixed:

• ACPI: battery: Add the ThinkPad 'Not Charging' quirk (git-fixes).
• ACPICA: Executer: Fix the REFCLASS_REFOF case in acpi_ex_opcode_1A_0T_1R() (git-fixes).
• ACPICA: Fix wrong interpretation of PCC address (git-fixes).
• ACPICA: Hardware: Do not flush CPU cache when entering S4 and S5 (git-fixes).
• ACPICA: Utilities: Avoid deleting the same object twice in a row (git-fixes).
• ACPICA: actypes.h: Expand the ACPI_ACCESS_ definitions (git-fixes).
• ALSA: seq: Set upper limit of processed events (git-fixes).
• ASoC: mediatek: mt8173: fix device_node leak (git-fixes).
• Bluetooth: Fix debugfs entry leak in hci_register_dev() (git-fixes).
• Documentation: fix firewire.rst ABI file path error (git-fixes).
• HID: apple: Do not reset quirks when the Fn key is not found (git-fixes).
• HID: quirks: Allow inverting the absolute X/Y values (git-fixes).
• HID: uhid: Fix worker destroying device without any protection (git-fixes).
• HID: wacom: Reset expected and received contact counts at the same time (git-fixes).
• PCI: Add function 1 DMA alias quirk for Marvell 88SE9125 SATA controller (git-fixes).
• RDMA/core: Clean up cq pool mechanism (jsc#SLE-15176).
• RDMA/rxe: Remove the unnecessary variable (jsc#SLE-15176).
• ar5523: Fix null-ptr-deref with unexpected WDCMSG_TARGET_START reply (git-fixes).
• arm64: Kconfig: add a choice for endianness (jsc#SLE-23432).
• asix: fix wrong return value in asix_check_host_enable() (git-fixes).
• ata: pata_platform: Fix a NULL pointer dereference in __pata_platform_probe() (git-fixes).
• ath10k: Fix tx hanging (git-fixes).
• ath9k: Fix out-of-bound memcpy in ath9k_hif_usb_rx_stream (git-fixes).
• batman-adv: allow netlink usage in unprivileged containers (git-fixes).
• btrfs: tree-checker: Add EXTENT_ITEM and METADATA_ITEM check (bsc#1195009).
• btrfs: tree-checker: annotate all error branches as unlikely (bsc#1195009).
• btrfs: tree-checker: check for BTRFS_BLOCK_FLAG_FULL_BACKREF being set…

The SUSE Linux Enterprise 15 SP2 LTSS kernel was updated receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-0435: Fixed remote stack overflow in net/tipc module that validate domain record count on input (bsc#1195254).
• CVE-2021-45095: Fixed refcount leak in pep_sock_accept in net/phonet/pep.c (bnc#1193867).
• CVE-2022-22942: Fixed stale file descriptors on failed usercopy (bsc#1195065).
• CVE-2021-22600: Fixed double free bug in packet_set_ring() in net/packet/af_packet.c that could have been exploited by a local user through crafted syscalls to escalate privileges or deny service (bnc#1195184).
• CVE-2021-39657: Fixed out of bounds read due to a missing bounds check in ufshcd_eh_device_reset_handler of ufshcd.c. This could lead to local information disclosure with System execution privileges needed (bnc#1193864).
• CVE-2021-39648: Fixed possible disclosure of kernel heap memory due to a race condition in gadget_dev_desc_UDC_show of configfs.c. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation (bnc#1193861).
• CVE-2022-0330: Fixed flush TLBs before releasing backing store (bsc#1194880).

The following non-security bugs were fixed:

• bpf: Verifer, adjust_scalar_min_max_vals to always call update_reg_bounds() (bsc#1194227).
• btrfs: tree-checker: Add EXTENT_ITEM and METADATA_ITEM check (bsc#1195009).
• btrfs: tree-checker: annotate all error branches as unlikely (bsc#1195009).
• btrfs: tree-checker: check for BTRFS_BLOCK_FLAG_FULL_BACKREF being set improperly (bsc#1195009).
• hv_netvsc: Set needed_headroom according to VF (bsc#1193506).
• net, xdp: Introduce xdp_init_buff utility routine (bsc#1193506).
• net, xdp: Introduce xdp_prepare_buff utility routine (bsc#1193506).
• net: allow retransmitting a TCP packet if original is still in queue (bsc#1188605 bsc#1187428).
• net: mana: Add RX fencing (bsc#1193506).
• net: mana: Add XDP support (bsc#1193506).
• net: sch_generic: aviod concurrent reset and enqueue op for lockless qdisc (bsc#1183405).
• net: sched: add barrier to ensure correct ordering for lockless qdisc (bsc#1183405).
• net: sched: avoid unnecessary seqcount operation for lockless qdisc (bsc#1183405).
• net: sched: fix packet stuck problem for lockless qdisc (bsc#1183405).
• net: sched: fix tx action reschedule issue with stopped queue (bsc#1183405).
• net: sched: fix tx action rescheduling issue during deactivation (bsc#1183405).
• net: sched: replaced invalid qdisc tree flush helper in qdisc_replace (bsc#1183405).
• net_sched: avoid resetting active qdisc for multiple times (bsc#1183405).
• net_sched: get rid of unnecessary dev_qdisc_reset() (bsc#1183405).
• net_sched: use qdisc_reset() in qdisc_destroy() (bsc#1183405).
• nvme: add 'iopolicy' module parameter (bsc#1177599 bsc#1193096).
• xfrm: fix MTU regression (bsc#1185377, bsc#1194048).

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-0435: Fixed remote stack overflow in net/tipc module that validate domain record count on input (bsc#1195254).
• CVE-2022-0330: Fixed flush TLBs before releasing backing store (bsc#1194880).
• CVE-2022-0286: Fixed null pointer dereference in bond_ipsec_add_sa() that may have lead to local denial of service (bnc#1195371).
• CVE-2022-22942: Fixed stale file descriptors on failed usercopy (bsc#1195065).
• CVE-2021-45095: Fixed refcount leak in pep_sock_accept in net/phonet/pep.c (bnc#1193867).
• CVE-2021-44733: Fixed a use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem, that could have occured because of a race condition in tee_shm_get_from_id during an attempt to free a shared memory object (bnc#1193767).
• CVE-2021-39685: Fixed USB gadget buffer overflow caused by too large endpoint 0 requests (bsc#1193802).
• CVE-2021-39657: Fixed out of bounds read due to a missing bounds check in ufshcd_eh_device_reset_handler of ufshcd.c. This could lead to local information disclosure with System execution privileges needed (bnc#1193864).
• CVE-2021-39648: Fixed possible disclosure of kernel heap memory due to a race condition in gadget_dev_desc_UDC_show of configfs.c. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation (bnc#1193861).
• CVE-2021-22600: Fixed double free bug in packet_set_ring() in net/packet/af_packet.c that could have been exploited by a local user through crafted syscalls to escalate privileges or deny service (bnc#1195184).
• CVE-2020-28097: Fixed out-of-bounds read in vgacon subsystem that mishandled software scrollback (bnc#1187723).

The following non-security bugs were fixed:

• ACPI: battery: Add the ThinkPad 'Not Charging' quirk (git-fixes).
• ACPICA: Executer: Fix the REFCLASS_REFOF case in acpi_ex_opcode_1A_0T_1R() (git-fixes).
• ACPICA: Fix wrong interpretation of PCC address (git-fixes).
• ACPICA: Hardware: Do not flush CPU cache when entering S4 and S5 (git-fixes).
• ACPICA: Utilities: Avoid deleting the same object twice in a row (git-fixes).
• ACPICA: actypes.h: Expand the ACPI_ACCESS_ definitions (git-fixes).
• ALSA: seq: Set upper limit of processed events (git-fixes).
• ALSA: usb-audio: Correct quirk for VF0770 (git-fixes).
• ALSA: usb-audio: initialize variables that could ignore errors (git-fixes).
• ASoC: cpcap: Check for NULL pointer after calling of_get_child_by_name (git-fixes).
• ASoC: fsl: Add missing error handling in pcm030_fabric_probe (git-fixes).
• ASoC: max9759: fix underflow in speaker_gain_control_put() (git-fixes).
• ASoC: mediatek: mt8173: fix device_node leak (git-fixes).
• ASoC: xilinx: xlnx_formatter_pcm: Make buffer bytes multiple of period bytes (git-fixes).
• Bluetooth: Fix debugfs entry leak in hci_register_dev() (git-fixes).
• Bluetooth: refactor malicious adv data check (git-fixes).
• Documentation: fix firewire.rst ABI file path error (git-fixes).
• HID: apple: Do not reset quirks when the Fn key is not found (git-fixes).
• HID: quirks: Allow inverting the absolute X/Y values (git-fixes).
• HID: uhid: Fix worker destroying device without any protection (git-fixes).
• HID: wacom: Reset expected and received contact counts at the same time (git-fixes).
• IB/cm: Avoid a loop when device has 255 ports (git-fixes)
• IB/hfi1: Fix error return code in parse_platform_config() (git-fixes)
• IB/hfi1: Use kzalloc() for mmu_rb_handler allocation (git-fixes)
• IB/isert: Fix a use after free in isert_connect_request (git-fixes)
• IB/mlx4: Separate tunnel and wire bufs parameters (git-fixes)
• IB/mlx5: Add missing error code (git-fixes)
• IB/mlx5: Add mutex destroy call to cap_mask_mutex mutex (git-fixes)
• IB/mlx5: Fix error unwinding when set_has_smi_cap fails (git-fixes)
• IB/mlx5: Return appropriate error code instead of ENOMEM (git-fixes)…

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-0435: Fixed remote stack overflow in net/tipc module that validate domain record count on input (bsc#1195254).
• CVE-2022-0286: Fixed null pointer dereference in bond_ipsec_add_sa() that may have lead to local denial of service (bnc#1195371).
• CVE-2020-28097: Fixed out-of-bounds read in vgacon subsystem that mishandled software scrollback (bnc#1187723).
• CVE-2021-45095: Fixed refcount leak in pep_sock_accept in net/phonet/pep.c (bnc#1193867).
• CVE-2022-22942: Fixed stale file descriptors on failed usercopy (bsc#1195065).
• CVE-2021-22600: Fixed double free bug in packet_set_ring() in net/packet/af_packet.c that could have been exploited by a local user through crafted syscalls to escalate privileges or deny service (bnc#1195184).
• CVE-2021-39657: Fixed out of bounds read due to a missing bounds check in ufshcd_eh_device_reset_handler of ufshcd.c. This could lead to local information disclosure with System execution privileges needed (bnc#1193864).
• CVE-2021-39648: Fixed possible disclosure of kernel heap memory due to a race condition in gadget_dev_desc_UDC_show of configfs.c. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation (bnc#1193861).
• CVE-2021-39685: Fixed USB gadget buffer overflow caused by too large endpoint 0 requests (bsc#1193802).
• CVE-2022-0330: Fixed flush TLBs before releasing backing store (bsc#1194880).

The following non-security bugs were fixed:

• ACPI: battery: Add the ThinkPad 'Not Charging' quirk (git-fixes).
• ACPICA: Executer: Fix the REFCLASS_REFOF case in acpi_ex_opcode_1A_0T_1R() (git-fixes).
• ACPICA: Fix wrong interpretation of PCC address (git-fixes).
• ACPICA: Hardware: Do not flush CPU cache when entering S4 and S5 (git-fixes).
• ACPICA: Utilities: Avoid deleting the same object twice in a row (git-fixes).
• ACPICA: actypes.h: Expand the ACPI_ACCESS_ definitions (git-fixes).
• ALSA: seq: Set upper limit of processed events (git-fixes).
• ALSA: usb-audio: Correct quirk for VF0770 (git-fixes).
• ALSA: usb-audio: initialize variables that could ignore errors (git-fixes).
• ASoC: cpcap: Check for NULL pointer after calling of_get_child_by_name (git-fixes).
• ASoC: fsl: Add missing error handling in pcm030_fabric_probe (git-fixes).
• ASoC: max9759: fix underflow in speaker_gain_control_put() (git-fixes).
• ASoC: mediatek: mt8173: fix device_node leak (git-fixes).
• ASoC: xilinx: xlnx_formatter_pcm: Make buffer bytes multiple of period bytes (git-fixes).
• Bluetooth: Fix debugfs entry leak in hci_register_dev() (git-fixes).
• Bluetooth: refactor malicious adv data check (git-fixes).
• Documentation: fix firewire.rst ABI file path error (git-fixes).
• HID: apple: Do not reset quirks when the Fn key is not found (git-fixes).
• HID: quirks: Allow inverting the absolute X/Y values (git-fixes).
• HID: uhid: Fix worker destroying device without any protection (git-fixes).
• HID: wacom: Reset expected and received contact counts at the same time (git-fixes).
• IB/cm: Avoid a loop when device has 255 ports (git-fixes)
• IB/hfi1: Fix error return code in parse_platform_config() (git-fixes)
• IB/hfi1: Use kzalloc() for mmu_rb_handler allocation (git-fixes)
• IB/isert: Fix a use after free in isert_connect_request (git-fixes)
• IB/mlx4: Separate tunnel and wire bufs parameters (git-fixes)
• IB/mlx5: Add missing error code (git-fixes)
• IB/mlx5: Add mutex destroy call to cap_mask_mutex mutex (git-fixes)
• IB/mlx5: Fix error unwinding when set_has_smi_cap fails (git-fixes)
• IB/mlx5: Return appropriate error code instead of ENOMEM (git-fixes)
• IB/umad: Return EIO in case of when device disassociated (git-fixes)
• IB/umad: Return EPOLLERR in case of when device disassociated (git-fixes)
• Input: wm97xx: Simplify resource management (git-fixes).
• NFS: Ensure the…

The SUSE Linux Enterprise 15 SP2 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-0435: Fixed remote stack overflow in net/tipc module that validate domain record count on input (bsc#1195254).
• CVE-2021-45095: Fixed refcount leak in pep_sock_accept in net/phonet/pep.c (bnc#1193867).
• CVE-2022-22942: Fixed stale file descriptors on failed usercopy (bsc#1195065).
• CVE-2021-22600: Fixed double free bug in packet_set_ring() in net/packet/af_packet.c that could have been exploited by a local user through crafted syscalls to escalate privileges or deny service (bnc#1195184).
• CVE-2021-39657: Fixed out of bounds read due to a missing bounds check in ufshcd_eh_device_reset_handler of ufshcd.c. This could lead to local information disclosure with System execution privileges needed (bnc#1193864).
• CVE-2021-39648: Fixed possible disclosure of kernel heap memory due to a race condition in gadget_dev_desc_UDC_show of configfs.c. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation (bnc#1193861).
• CVE-2022-0330: Fixed flush TLBs before releasing backing store (bsc#1194880).

The following non-security bugs were fixed:

• bpf: Verifer, adjust_scalar_min_max_vals to always call update_reg_bounds() (bsc#1194227).
• btrfs: tree-checker: Add EXTENT_ITEM and METADATA_ITEM check (bsc#1195009).
• btrfs: tree-checker: annotate all error branches as unlikely (bsc#1195009).
• btrfs: tree-checker: check for BTRFS_BLOCK_FLAG_FULL_BACKREF being set improperly (bsc#1195009).
• hv_netvsc: Set needed_headroom according to VF (bsc#1193506).
• net, xdp: Introduce xdp_init_buff utility routine (bsc#1193506).
• net, xdp: Introduce xdp_prepare_buff utility routine (bsc#1193506).
• net: allow retransmitting a TCP packet if original is still in queue (bsc#1188605 bsc#1187428).
• net: mana: Add RX fencing (bsc#1193506).
• net: mana: Add XDP support (bsc#1193506).
• net: sch_generic: aviod concurrent reset and enqueue op for lockless qdisc (bsc#1183405).
• net: sched: add barrier to ensure correct ordering for lockless qdisc (bsc#1183405).
• net: sched: avoid unnecessary seqcount operation for lockless qdisc (bsc#1183405).
• net: sched: fix packet stuck problem for lockless qdisc (bsc#1183405).
• net: sched: fix tx action reschedule issue with stopped queue (bsc#1183405).
• net: sched: fix tx action rescheduling issue during deactivation (bsc#1183405).
• net: sched: replaced invalid qdisc tree flush helper in qdisc_replace (bsc#1183405).
• net_sched: avoid resetting active qdisc for multiple times (bsc#1183405).
• net_sched: get rid of unnecessary dev_qdisc_reset() (bsc#1183405).
• net_sched: use qdisc_reset() in qdisc_destroy() (bsc#1183405).
• nvme: add 'iopolicy' module parameter (bsc#1177599 bsc#1193096).
• xfrm: fix MTU regression (bsc#1185377, bsc#1194048).

This update for the Linux Kernel 5.3.18-57 fixes several issues.

The following security issues were fixed:

• CVE-2022-0516: Fixed KVM s390 return error on SIDA memop on normal guest (bsc#1195947).
• CVE-2021-0920: Fixed a local privilege escalation due to an use after free bug in unix_gc (bsc#1194463).
• CVE-2021-22600: Fixed double free bug in packet_set_ring() in net/packet/af_packet.c that could have been exploited by a local user through crafted syscalls to escalate privileges or deny service (bsc#1195307).

This update for the Linux Kernel 5.3.18-59_10 fixes several issues.

The following security issues were fixed:

• CVE-2022-0516: Fixed KVM s390 return error on SIDA memop on normal guest (bsc#1195947).
• CVE-2021-0920: Fixed a local privilege escalation due to an use after free bug in unix_gc (bsc#1194463).
• CVE-2021-22600: Fixed double free bug in packet_set_ring() in net/packet/af_packet.c that could have been exploited by a local user through crafted syscalls to escalate privileges or deny service (bsc#1195307).

It was discovered that the Packet network protocol implementation in the Linux kernel contained a double-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-22600)

Luo Likang discovered that the FireDTV Firewire driver in the Linux kernel did not properly perform bounds checking in some situations. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-42739)

It was discovered that the rlimit tracking for user namespaces in the Linux kernel did not properly perform reference counting, leading to a use-after- free vulnerability. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2022-24122)

It was discovered that the BPF verifier in the Linux kernel did not properly restrict pointer types in certain situations. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-23222)

Jeremy Cline discovered a use-after-free in the nouveau graphics driver of the Linux kernel during device removal. A privileged or physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2020-27820)

It was discovered that the Packet network protocol implementation in the Linux kernel contained a double-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-22600)

Jürgen Groß discovered that the Xen subsystem within the Linux kernel did not adequately limit the number of events driver domains (unprivileged PV backends) could send to other guest VMs. An attacker in a driver domain could use this to cause a denial of service in other guest VMs. (CVE-2021-28713)

Jürgen Groß discovered that the Xen network backend driver in the Linux kernel did not adequately limit the amount of queued packets when a guest did not process them. An attacker in a guest VM can use this to cause a denial of service (excessive kernel memory consumption) in the network backend domain. (CVE-2021-28714, CVE-2021-28715)

Szymon Heidrich discovered that the USB Gadget subsystem in the Linux kernel did not properly restrict the size of control requests for certain gadget types, leading to possible out of bounds reads or writes. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-39685)

It was discovered that the eBPF implementation in the Linux kernel contained a race condition around read-only maps. A privileged attacker could use this to modify read-only maps. (CVE-2021-4001)

Jann Horn discovered a race condition in the Unix domain socket implementation in the Linux kernel that could result in a read-after-free. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-4083)

It was discovered that the simulated networking device driver for the Linux kernel did not properly initialize memory in certain situations. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2021-4135)

Kirill Tkhai discovered that the XFS file system implementation in the Linux kernel did not calculate size correctly when pre-allocating space in some situations. A local attacker could use this to expose sensitive information. (CVE-2021-4155)

Eric Biederman discovered that the cgroup process migration implementation in the Linux kernel did not perform permission checks correctly in some situations. A local attacker could possibly use this to gain administrative privileges. (CVE-2021-4197)

Brendan Dolan-Gavitt discovered that the aQuantia AQtion Ethernet device driver in the Linux kernel did not properly validate meta-data coming from the device. A local attacker who can control an emulated device can use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-43975)

It was discovered that the ARM Trusted Execution Environment (TEE) subsystem in the Linux kernel contained a race condition leading to a use- after-free vulnerability. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2021-44733)

It was discovered that the Phone Network protocol (PhoNet) implementation in the Linux kernel did not properly perform reference counting in some error conditions. A local…

It was discovered that the Packet network protocol implementation in the Linux kernel contained a double-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-22600)

Szymon Heidrich discovered that the USB Gadget subsystem in the Linux kernel did not properly restrict the size of control requests for certain gadget types, leading to possible out of bounds reads or writes. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-39685)

Jann Horn discovered a race condition in the Unix domain socket implementation in the Linux kernel that could result in a read-after-free. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-4083)

Kirill Tkhai discovered that the XFS file system implementation in the Linux kernel did not calculate size correctly when pre-allocating space in some situations. A local attacker could use this to expose sensitive information. (CVE-2021-4155)

Lin Ma discovered that the NFC Controller Interface (NCI) implementation in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-4202)

Brendan Dolan-Gavitt discovered that the aQuantia AQtion Ethernet device driver in the Linux kernel did not properly validate meta-data coming from the device. A local attacker who can control an emulated device can use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-43975)

Sushma Venkatesh Reddy discovered that the Intel i915 graphics driver in the Linux kernel did not perform a GPU TLB flush in some situations. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2022-0330)

It was discovered that the VMware Virtual GPU driver in the Linux kernel did not properly handle certain failure conditions, leading to a stale entry in the file descriptor table. A local attacker could use this to expose sensitive information or possibly gain administrative privileges. (CVE-2022-22942)

It was discovered that the Packet network protocol implementation in the Linux kernel contained a double-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-22600)

Szymon Heidrich discovered that the USB Gadget subsystem in the Linux kernel did not properly restrict the size of control requests for certain gadget types, leading to possible out of bounds reads or writes. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-39685)

Jann Horn discovered a race condition in the Unix domain socket implementation in the Linux kernel that could result in a read-after-free. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-4083)

Kirill Tkhai discovered that the XFS file system implementation in the Linux kernel did not calculate size correctly when pre-allocating space in some situations. A local attacker could use this to expose sensitive information. (CVE-2021-4155)

Lin Ma discovered that the NFC Controller Interface (NCI) implementation in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-4202)

Brendan Dolan-Gavitt discovered that the aQuantia AQtion Ethernet device driver in the Linux kernel did not properly validate meta-data coming from the device. A local attacker who can control an emulated device can use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-43975)

Sushma Venkatesh Reddy discovered that the Intel i915 graphics driver in the Linux kernel did not perform a GPU TLB flush in some situations. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2022-0330)

It was discovered that the VMware Virtual GPU driver in the Linux kernel did not properly handle certain failure conditions, leading to a stale entry in the file descriptor table. A local attacker could use this to expose sensitive information or possibly gain administrative privileges. (CVE-2022-22942)

It was discovered that the Packet network protocol implementation in the Linux kernel contained a double-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-22600)

Jann Horn discovered a race condition in the Unix domain socket implementation in the Linux kernel that could result in a read-after-free. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-4083)

Kirill Tkhai discovered that the XFS file system implementation in the Linux kernel did not calculate size correctly when pre-allocating space in some situations. A local attacker could use this to expose sensitive information. (CVE-2021-4155)

Sushma Venkatesh Reddy discovered that the Intel i915 graphics driver in the Linux kernel did not perform a GPU TLB flush in some situations. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2022-0330)

It was discovered that the VMware Virtual GPU driver in the Linux kernel did not properly handle certain failure conditions, leading to a stale entry in the file descriptor table. A local attacker could use this to expose sensitive information or possibly gain administrative privileges. (CVE-2022-22942)

It was discovered that the Packet network protocol implementation in the Linux kernel contained a double-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-22600)

Jann Horn discovered a race condition in the Unix domain socket implementation in the Linux kernel that could result in a read-after-free. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-4083)

Kirill Tkhai discovered that the XFS file system implementation in the Linux kernel did not calculate size correctly when pre-allocating space in some situations. A local attacker could use this to expose sensitive information. (CVE-2021-4155)

Sushma Venkatesh Reddy discovered that the Intel i915 graphics driver in the Linux kernel did not perform a GPU TLB flush in some situations. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2022-0330)

It was discovered that the VMware Virtual GPU driver in the Linux kernel did not properly handle certain failure conditions, leading to a stale entry in the file descriptor table. A local attacker could use this to expose sensitive information or possibly gain administrative privileges. (CVE-2022-22942)

It was discovered that the Packet network protocol implementation in the Linux kernel contained a double-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-22600)

Jürgen Groß discovered that the Xen subsystem within the Linux kernel did not adequately limit the number of events driver domains (unprivileged PV backends) could send to other guest VMs. An attacker in a driver domain could use this to cause a denial of service in other guest VMs. (CVE-2021-28711, CVE-2021-28712, CVE-2021-28713)

Jürgen Groß discovered that the Xen network backend driver in the Linux kernel did not adequately limit the amount of queued packets when a guest did not process them. An attacker in a guest VM can use this to cause a denial of service (excessive kernel memory consumption) in the network backend domain. (CVE-2021-28714, CVE-2021-28715)

Szymon Heidrich discovered that the USB Gadget subsystem in the Linux kernel did not properly restrict the size of control requests for certain gadget types, leading to possible out of bounds reads or writes. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-39685)

Jann Horn discovered a race condition in the Unix domain socket implementation in the Linux kernel that could result in a read-after-free. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-4083)

Kirill Tkhai discovered that the XFS file system implementation in the Linux kernel did not calculate size correctly when pre-allocating space in some situations. A local attacker could use this to expose sensitive information. (CVE-2021-4155)

Lin Ma discovered that the NFC Controller Interface (NCI) implementation in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-4202)

Sushma Venkatesh Reddy discovered that the Intel i915 graphics driver in the Linux kernel did not perform a GPU TLB flush in some situations. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2022-0330)

It was discovered that the VMware Virtual GPU driver in the Linux kernel did not properly handle certain failure conditions, leading to a stale entry in the file descriptor table. A local attacker could use this to expose sensitive information or possibly gain administrative privileges. (CVE-2022-22942)