CVE-2022-21505

In the linux kernel, if IMA appraisal is used with the "ima_appraise=log" boot param, lockdown can be defeated with kexec on any machine when Secure Boot is disabled or unavailable. IMA prevents setting "ima_appraise=log" from the boot param when Secure Boot is enabled, but this does not cover cases where lockdown is used without Secure Boot. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity, Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• use-after-free in l2cap_connect and l2cap_le_connect_req in net/bluetooth/l2cap_core.c (CVE-2022-42896)
• net/ulp: use-after-free in listening ULP sockets (CVE-2023-0461)
• hw: cpu: AMD CPUs may transiently execute beyond unconditional direct branch (CVE-2021-26341)
• malicious data for FBIOPUT_VSCREENINFO ioctl may cause OOB write memory (CVE-2021-33655)
• possible race condition in drivers/tty/tty_buffers.c (CVE-2022-1462)
• KVM: NULL pointer dereference in kvm_mmu_invpcid_gva (CVE-2022-1789)
• use-after-free in free_pipe_info() could lead to privilege escalation (CVE-2022-1882)
• KVM: nVMX: missing IBPB when exiting from nested guest can lead to Spectre v2 attacks (CVE-2022-2196)
• netfilter: nf_conntrack_irc message handling issue (CVE-2022-2663)
• race condition in xfrm_probe_algs can lead to OOB read/write (CVE-2022-3028)
• out-of-bounds read in fib_nh_match of the file net/ipv4/fib_semantics.c (CVE-2022-3435)
• race condition in hugetlb_no_page() in mm/hugetlb.c (CVE-2022-3522)
• memory leak in ipv6_renew_options() (CVE-2022-3524)
• data races around icsk->icsk_af_ops in do_ipv6_setsockopt (CVE-2022-3566)
• data races around sk->sk_prot (CVE-2022-3567)
• memory leak in l2cap_recv_acldata of the file net/bluetooth/l2cap_core.c (CVE-2022-3619)
• denial of service in follow_page_pte in mm/gup.c due to poisoned pte entry (CVE-2022-3623)
• use-after-free after failed devlink reload in devlink_param_get (CVE-2022-3625)
• USB-accessible buffer overflow in brcmfmac (CVE-2022-3628)
• use after free flaw in l2cap_conn_del in net/bluetooth/l2cap_core.c (CVE-2022-3640)
• Double-free in split_2MB_gtt_entry when function intel_gvt_dma_map_guest_page failed (CVE-2022-3707)
• mptcp: NULL pointer dereference in subflow traversal at disconnect time (CVE-2022-4128)
• l2tp: missing lock when clearing sk_user_data can lead to NULL pointer dereference (CVE-2022-4129)
• igmp: use-after-free in ip_check_mc_rcu when opening and closing inet sockets (CVE-2022-20141)
• lockdown bypass using IMA (CVE-2022-21505)
• double free in usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c (CVE-2022-28388)
• network backend may cause Linux netfront to use freed SKBs (XSA-405) (CVE-2022-33743)
• unmap_mapping_range() race with munmap() on VM_PFNMAP mappings leads to stale TLB entry (CVE-2022-39188)
• TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED leading to guest malfunctioning (CVE-2022-39189)
• u8 overflow problem in cfg80211_update_notlisted_nontrans() (CVE-2022-41674)
• use-after-free related to leaf anon_vma double reuse (CVE-2022-42703)
• use-after-free in bss_ref_get in net/wireless/scan.c (CVE-2022-42720)
• BSS list corruption in cfg80211_add_nontrans_list in net/wireless/scan.c (CVE-2022-42721)
• Denial of service in beacon protection for P2P-device (CVE-2022-42722)
• memory corruption in usbmon driver (CVE-2022-43750)
• NULL pointer dereference in traffic control subsystem (CVE-2022-47929)
• NULL pointer dereference in rawv6_push_pending_frames (CVE-2023-0394)
• use-after-free due to race condition in qdisc_graft() (CVE-2023-0590)
• use-after-free caused by invalid pointer hostname in fs/cifs/connect.c (CVE-2023-1195)
• denial of service in tipc_conn_close (CVE-2023-1382)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• use-after-free in l2cap_connect and l2cap_le_connect_req in net/bluetooth/l2cap_core.c (CVE-2022-42896)
• net/ulp: use-after-free in listening ULP sockets (CVE-2023-0461)
• cpu: AMD CPUs may transiently execute beyond unconditional direct branch (CVE-2021-26341)
• malicious data for FBIOPUT_VSCREENINFO ioctl may cause OOB write memory (CVE-2021-33655)
• possible race condition in drivers/tty/tty_buffers.c (CVE-2022-1462)
• KVM: NULL pointer dereference in kvm_mmu_invpcid_gva (CVE-2022-1789)
• use-after-free in free_pipe_info() could lead to privilege escalation (CVE-2022-1882)
• KVM: nVMX: missing IBPB when exiting from nested guest can lead to Spectre v2 attacks (CVE-2022-2196)
• netfilter: nf_conntrack_irc message handling issue (CVE-2022-2663)
• race condition in xfrm_probe_algs can lead to OOB read/write (CVE-2022-3028)
• out-of-bounds read in fib_nh_match of the file net/ipv4/fib_semantics.c (CVE-2022-3435)
• race condition in hugetlb_no_page() in mm/hugetlb.c (CVE-2022-3522)
• memory leak in ipv6_renew_options() (CVE-2022-3524)
• data races around icsk->icsk_af_ops in do_ipv6_setsockopt (CVE-2022-3566)
• data races around sk->sk_prot (CVE-2022-3567)
• memory leak in l2cap_recv_acldata of the file net/bluetooth/l2cap_core.c (CVE-2022-3619)
• denial of service in follow_page_pte in mm/gup.c due to poisoned pte entry (CVE-2022-3623)
• use-after-free after failed devlink reload in devlink_param_get (CVE-2022-3625)
• USB-accessible buffer overflow in brcmfmac (CVE-2022-3628)
• use after free flaw in l2cap_conn_del in net/bluetooth/l2cap_core.c (CVE-2022-3640)
• Double-free in split_2MB_gtt_entry when function intel_gvt_dma_map_guest_page failed (CVE-2022-3707)
• mptcp: NULL pointer dereference in subflow traversal at disconnect time (CVE-2022-4128)
• l2tp: missing lock when clearing sk_user_data can lead to NULL pointer dereference (CVE-2022-4129)
• igmp: use-after-free in ip_check_mc_rcu when opening and closing inet sockets (CVE-2022-20141)
• lockdown bypass using IMA (CVE-2022-21505)
• double free in usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c (CVE-2022-28388)
• network backend may cause Linux netfront to use freed SKBs (XSA-405) (CVE-2022-33743)
• unmap_mapping_range() race with munmap() on VM_PFNMAP mappings leads to stale TLB entry (CVE-2022-39188)
• TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED leading to guest malfunctioning (CVE-2022-39189)
• u8 overflow problem in cfg80211_update_notlisted_nontrans() (CVE-2022-41674)
• use-after-free related to leaf anon_vma double reuse (CVE-2022-42703)
• use-after-free in bss_ref_get in net/wireless/scan.c (CVE-2022-42720)
• BSS list corruption in cfg80211_add_nontrans_list in net/wireless/scan.c (CVE-2022-42721)
• Denial of service in beacon protection for P2P-device (CVE-2022-42722)
• memory corruption in usbmon driver (CVE-2022-43750)
• NULL pointer dereference in traffic control subsystem (CVE-2022-47929)
• NULL pointer dereference in rawv6_push_pending_frames (CVE-2023-0394)
• use-after-free due to race condition in qdisc_graft() (CVE-2023-0590)
• use-after-free caused by invalid pointer hostname in fs/cifs/connect.c (CVE-2023-1195)
• denial of service in tipc_conn_close (CVE-2023-1382)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

This kernel update is based on upstream 5.15.58 and fixes at least the following security issues:

Kernel lockdown bypass when UEFI secure boot is disabled / unavailable and IMA appraisal is enabled (CVE-2022-21505).

Aliases in the branch predictor may cause some AMD processors to predict the wrong branch type potentially leading to information disclosure (CVE-2022-23825).

Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution under certain microarchitecture-dependent conditions (CVE-2022-29900, RetBleed).

Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can hijack return instructions to achieve arbitrary speculative code execution under certain microarchitecture-dependent conditions (CVE-2022-29901).

The Linux kernel before 5.18.13 lacks a certain clear operation for the block starting symbol (.bss). This allows Xen PV guest OS users to cause a denial of service or gain privileges (CVE-2022-36123).

An issue was discovered in the Linux kernel through 5.18.14. xfrm_expand_policies in net/xfrm/xfrm_policy.c can cause a refcount to be dropped twice (CVE-2022-36879).

nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote attackers to cause a denial of service (panic) because, in the case of an nf_queue verdict with a one-byte nfta_payload attribute, an skb_pull can encounter a negative skb->len (CVE-2022-36946).

Other fixes in this update:

• fs: sendfile handles O_NONBLOCK of out_fd
• hugetlb: fix memoryleak in hugetlb_mcopy_atomic_pte
• mm: fix page leak with multiple threads mapping the same page
• x86/bugs: Do not enable IBPB at firmware entry when IBPB is not available
• x86/speculation: Make all RETbleed mitigations 64-bit only

For other upstream fixes, see the referenced changelogs.

This kernel-linus update is based on upstream 5.15.58 and fixes at least the following security issues:

Kernel lockdown bypass when UEFI secure boot is disabled / unavailable and IMA appraisal is enabled (CVE-2022-21505).

Aliases in the branch predictor may cause some AMD processors to predict the wrong branch type potentially leading to information disclosure (CVE-2022-23825).

Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution under certain microarchitecture-dependent conditions (CVE-2022-29900, RetBleed).

Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can hijack return instructions to achieve arbitrary speculative code execution under certain microarchitecture-dependent conditions (CVE-2022-29901).

The Linux kernel before 5.18.13 lacks a certain clear operation for the block starting symbol (.bss). This allows Xen PV guest OS users to cause a denial of service or gain privileges (CVE-2022-36123).

An issue was discovered in the Linux kernel through 5.18.14. xfrm_expand_policies in net/xfrm/xfrm_policy.c can cause a refcount to be dropped twice (CVE-2022-36879).

For other upstream fixes, see the referenced changelogs.

The SUSE Linux Enterprise 15 SP4 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-33655: Fixed out of bounds write with ioctl FBIOPUT_VSCREENINFO (bnc#1201635).
• CVE-2022-1462: Fixed an out-of-bounds read flaw in the TeleTYpe subsystem (bnc#1198829).
• CVE-2022-21505: Fixed kexec lockdown bypass with IMA policy (bsc#1201458).
• CVE-2022-29581: Fixed improper update of Reference Count in net/sched that could cause root privilege escalation (bnc#1199665).
• CVE-2022-32250: Fixed an use-after-free bug in the netfilter subsystem. This flaw allowed a local attacker with user access to cause a privilege escalation issue (bnc#1200015, bnc#1200494).

The following non-security bugs were fixed:

• 9p: Fix refcounting during full path walks for fid lookups (git-fixes).
• 9p: fix fid refcount leak in v9fs_vfs_atomic_open_dotl (git-fixes).
• 9p: fix fid refcount leak in v9fs_vfs_get_link (git-fixes).
• ACPI: CPPC: Only probe for _CPC if CPPC v2 is acked (git-fixes).
• ACPI: video: Fix acpi_video_handles_brightness_key_presses() (git-fixes).
• ALSA: hda - Add fixup for Dell Latitidue E5430 (git-fixes).
• ALSA: hda/conexant: Apply quirk for another HP ProDesk 600 G3 model (git-fixes).
• ALSA: hda/realtek - Enable the headset-mic on a Xiaomi's laptop (git-fixes).
• ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc221 (git-fixes).
• ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc671 (git-fixes).
• ALSA: hda/realtek: Add quirk for Clevo L140PU (git-fixes).
• ALSA: hda/realtek: Fix headset mic for Acer SF313-51 (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for HP machines (git-fixes).
• ALSA: usb-audio: Add quirk for Fiero SC-01 (fw v1.0.0) (git-fixes).
• ALSA: usb-audio: Add quirk for Fiero SC-01 (git-fixes).
• ALSA: usb-audio: Add quirks for MacroSilicon MS2100/MS2106 devices (git-fixes).
• ALSA: usb-audio: Workarounds for Behringer UMC 204/404 HD (git-fixes).
• ARM: 9209/1: Spectre-BHB: avoid pr_info() every time a CPU comes out of idle (git-fixes).
• ARM: 9210/1: Mark the FDT_FIXED sections as shareable (git-fixes).
• ARM: 9213/1: Print message about disabled Spectre workarounds only once (git-fixes).
• ARM: 9214/1: alignment: advance IT state after emulating Thumb instruction (git-fixes).
• ARM: 9216/1: Fix MAX_DMA_ADDRESS overflow (git-fixes).
• ARM: dts: at91: sama5d2: Fix typo in i2s1 node (git-fixes).
• ARM: dts: imx6qdl-ts7970: Fix ngpio typo and count (git-fixes).
• ARM: dts: stm32: use the correct clock source for CEC on stm32mp151 (git-fixes).
• ARM: dts: sunxi: Fix SPI NOR campatible on Orange Pi Zero (git-fixes).
• ASoC: Intel: Skylake: Correct the handling of fmt_config flexible array (git-fixes).
• ASoC: Intel: Skylake: Correct the ssp rate discovery in skl_get_ssp_clks() (git-fixes).
• ASoC: Intel: bytcr_wm5102: Fix GPIO related probe-ordering problem (git-fixes).
• ASoC: Intel: sof_sdw: handle errors on card registration (git-fixes).
• ASoC: Realtek/Maxim SoundWire codecs: disable pm_runtime on remove (git-fixes).
• ASoC: Remove unused hw_write_t type (git-fixes).
• ASoC: SOF: Intel: hda-loader: Clarify the cl_dsp_init() flow (git-fixes).
• ASoC: codecs: rt700/rt711/rt711-sdca: initialize workqueues in probe (git-fixes).
• ASoC: codecs: rt700/rt711/rt711-sdca: resume bus/codec in .set_jack_detect (git-fixes).
• ASoC: cs47l15: Fix event generation for low power mux control (git-fixes).
• ASoC: dapm: Initialise kcontrol data for mux/demux controls (git-fixes).
• ASoC: madera: Fix event generation for OUT1 demux (git-fixes).
• ASoC: madera: Fix event generation for rate controls (git-fixes).
• ASoC: ops: Fix off by one in range control validation (git-fixes).
• ASoC: rt5682: Avoid the unexpected IRQ event during going to suspend (git-fixes).
• ASoC: rt5682: Fix deadlock on resume (git-fixes).
• ASoC: rt5682: Re-detect the combo jack after resuming (git-fixes).
• ASoC: rt5682: fix an incorrect NULL check…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-36946: Fixed an incorrect packet trucation operation which could lead to denial of service (bnc#1201940).
• CVE-2022-29581: Fixed improper update of reference count in net/sched that could cause root privilege escalation (bnc#1199665).
• CVE-2022-20166: Fixed several possible memory safety issues due to unsafe operations (bsc#1200598).
• CVE-2020-36558: Fixed a race condition involving VT_RESIZEX which could lead to a NULL pointer dereference and general protection fault (bnc#1200910).
• CVE-2020-36557: Fixed a race condition between the VT_DISALLOCATE ioctl and closing/opening of TTYs that could lead to a use-after-free (bnc#1201429).
• CVE-2021-33655: Fixed an out of bounds write by ioctl cmd FBIOPUT_VSCREENINFO (bnc#1201635).
• CVE-2021-33656: Fixed an out of bounds write related to ioctl cmd PIO_FONT (bnc#1201636).
• CVE-2022-21505: Fixed a kernel lockdown bypass via IMA policy (bsc#1201458).
• CVE-2022-1462: Fixed an out-of-bounds read flaw in the TTY subsystem (bnc#1198829).
• CVE-2022-1116: Fixed an integer overflow vulnerability in io_uring which allowed a local attacker to escalate privileges to root (bnc#1199647).- CVE-2022-2318: Fixed a use-after-free vulnerability in the timer handler in Rose subsystem that allowed unprivileged attackers to crash the system (bsc#1201251).
• CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742: Fixed multiple potential data leaks with Block and Network devices when using untrusted backends (bsc#1200762).

The following non-security bugs were fixed:

• Fixed a system crash related to the recent RETBLEED mitigation (bsc#1201644, bsc#1201664, bsc#1201672, bsc#1201673, bsc#1201676).
• qla2xxx: drop patch which prevented nvme port discovery (bsc#1200651 bsc#1200644 bsc#1201954 bsc#1201958).
• kvm: emulate: do not adjust size of fastop and setcc subroutines (bsc#1201930).
• bpf, cpumap: Remove rcpu pointer from cpu_map_build_skb signature (bsc#1199364).
• bpf: enable BPF type format (BTF) (jsc#SLE-24559).
• nfs: avoid NULL pointer dereference when there is unflushed data (bsc#1201196).
• hv_netvsc: Add (more) validation for untrusted Hyper-V values (bsc#1199364).
• hv_netvsc: Add comment of netvsc_xdp_xmit() (bsc#1199364).
• hv_netvsc: Add support for XDP_REDIRECT (bsc#1199364).
• hv_netvsc: Copy packets sent by Hyper-V out of the receive buffer (bsc#1199364).
• hv_netvsc: Fix validation in netvsc_linkstatus_callback() (bsc#1199364).
• kvm/emulate: Fix SETcc emulation function offsets with SLS (bsc#1201930).
• lkdtm: Disable return thunks in rodata.c (bsc#1178134).
• net, xdp: Introduce __xdp_build_skb_from_frame utility routine (bsc#1199364).
• net, xdp: Introduce xdp_build_skb_from_frame utility routine (bsc#1199364).
• nvme: consider also host_iface when checking ip options (bsc#1199670).
• powerpc/mobility: wait for memory transfer to complete (bsc#1201846 ltc#198761).
• powerpc/pseries/mobility: set NMI watchdog factor during an LPM (bsc#1201846 ltc#198761).
• powerpc/watchdog: introduce a NMI watchdog's factor (bsc#1201846 ltc#198761).
• scsi: lpfc: Copyright updates for 14.2.0.5 patches (bsc#1201956).
• scsi: lpfc: Fix attempted FA-PWWN usage after feature disable (bsc#1201956).
• scsi: lpfc: Fix lost NVMe paths during LIF bounce stress test (bsc#1201956 bsc#1200521).
• scsi: lpfc: Fix possible memory leak when failing to issue CMF WQE (bsc#1201956).
• scsi: lpfc: Fix uninitialized cqe field in lpfc_nvme_cancel_iocb() (bsc#1201956).
• scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed user input (bsc#1201956).
• scsi: lpfc: Refactor lpfc_nvmet_prep_abort_wqe() into lpfc_sli_prep_abort_xri() (bsc#1201956).
• scsi: lpfc: Remove Menlo/Hornet related code (bsc#1201956).
• scsi: lpfc: Remove extra atomic_inc on cmd_pending in queuecommand after VMID (bsc#1201956).
• scsi: lpfc: Revert RSCN_MEMENTO workaround for…

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-33655: Fixed out of bounds write with ioctl FBIOPUT_VSCREENINFO (bnc#1201635).
• CVE-2022-2585: Fixed use-after-free in POSIX CPU timer (bnc#1202094).
• CVE-2022-21505: Fixed kexec lockdown bypass with IMA policy (bsc#1201458).
• CVE-2022-26373: Fixed CPU info leak via post-barrier RSB predictions (bsc#1201726).
• CVE-2022-29581: Fixed improper update of Reference Count in net/sched that could cause root privilege escalation (bnc#1199665).

The following non-security bugs were fixed:

• ACPI: CPPC: Only probe for _CPC if CPPC v2 is acked (git-fixes).
• ACPI: video: Fix acpi_video_handles_brightness_key_presses() (git-fixes).
• ALSA: hda - Add fixup for Dell Latitidue E5430 (git-fixes).
• ALSA: hda/conexant: Apply quirk for another HP ProDesk 600 G3 model (git-fixes).
• ALSA: hda/realtek - Enable the headset-mic on a Xiaomi's laptop (git-fixes).
• ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc221 (git-fixes).
• ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc671 (git-fixes).
• ALSA: hda/realtek: Add quirk for Clevo L140PU (git-fixes).
• ALSA: hda/realtek: Fix headset mic for Acer SF313-51 (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for HP machines (git-fixes).
• ALSA: usb-audio: Add quirk for Fiero SC-01 (fw v1.0.0) (git-fixes).
• ALSA: usb-audio: Add quirk for Fiero SC-01 (git-fixes).
• ALSA: usb-audio: Add quirks for MacroSilicon MS2100/MS2106 devices (git-fixes).
• ALSA: usb-audio: Workarounds for Behringer UMC 204/404 HD (git-fixes).
• ARM: 9209/1: Spectre-BHB: avoid pr_info() every time a CPU comes out of idle (git-fixes).
• ARM: 9210/1: Mark the FDT_FIXED sections as shareable (git-fixes).
• ARM: 9213/1: Print message about disabled Spectre workarounds only once (git-fixes).
• ARM: 9214/1: alignment: advance IT state after emulating Thumb instruction (git-fixes).
• ARM: dts: at91: sama5d2: Fix typo in i2s1 node (git-fixes).
• ARM: dts: imx6qdl-ts7970: Fix ngpio typo and count (git-fixes).
• ARM: dts: stm32: use the correct clock source for CEC on stm32mp151 (git-fixes).
• ARM: dts: sunxi: Fix SPI NOR campatible on Orange Pi Zero (git-fixes).
• ASoC: Intel: Skylake: Correct the handling of fmt_config flexible array (git-fixes).
• ASoC: Intel: Skylake: Correct the ssp rate discovery in skl_get_ssp_clks() (git-fixes).
• ASoC: Intel: bytcr_wm5102: Fix GPIO related probe-ordering problem (git-fixes).
• ASoC: Intel: sof_sdw: handle errors on card registration (git-fixes).
• ASoC: Realtek/Maxim SoundWire codecs: disable pm_runtime on remove (git-fixes).
• ASoC: Remove unused hw_write_t type (git-fixes).
• ASoC: SOF: Intel: hda-loader: Clarify the cl_dsp_init() flow (git-fixes).
• ASoC: codecs: rt700/rt711/rt711-sdca: initialize workqueues in probe (git-fixes).
• ASoC: codecs: rt700/rt711/rt711-sdca: resume bus/codec in .set_jack_detect (git-fixes).
• ASoC: cs47l15: Fix event generation for low power mux control (git-fixes).
• ASoC: dapm: Initialise kcontrol data for mux/demux controls (git-fixes).
• ASoC: madera: Fix event generation for OUT1 demux (git-fixes).
• ASoC: madera: Fix event generation for rate controls (git-fixes).
• ASoC: ops: Fix off by one in range control validation (git-fixes).
• ASoC: rt5682: Avoid the unexpected IRQ event during going to suspend (git-fixes).
• ASoC: rt5682: Fix deadlock on resume (git-fixes).
• ASoC: rt5682: Re-detect the combo jack after resuming (git-fixes).
• ASoC: rt5682: fix an incorrect NULL check on list iterator (git-fixes).
• ASoC: rt5682: move clk related code to rt5682_i2c_probe (git-fixes).
• ASoC: rt7*-sdw: harden jack_detect_handler (git-fixes).
• ASoC: rt711-sdca-sdw: fix calibrate mutex initialization (git-fixes).
• ASoC: rt711-sdca: Add endianness flag in snd_soc_component_driver (git-fixes).
• ASoC: rt711-sdca: fix kernel NULL pointer dereference when IO error (git-fixes).…

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-36557: Fixed a race condition between the VT_DISALLOCATE ioctl and closing/opening of ttys could lead to a use-after-free (bnc#1201429).
• CVE-2020-36558: Fixed a race condition involving VT_RESIZEX which could lead to a NULL pointer dereference and general protection fault (bnc#1200910).
• CVE-2021-4157: Fixed an out of memory bounds write flaw in the NFS subsystem, related to the replication of files with NFS. A user could potentially crash the system or escalate privileges on the system (bsc#1194013).
• CVE-2021-26341: Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage (bsc#1201050).
• CVE-2021-33655: Fixed memory out of bounds write by ioctl cmd FBIOPUT_VSCREENINFO (bnc#1201635).
• CVE-2021-33656: Fixed memory out of bounds write related to ioctl cmd PIO_FONT (bnc#1201636).
• CVE-2022-1116: Fixed a integer overflow vulnerability in io_uring which allowed a local attacker to cause memory corruption and escalate privileges to root (bnc#1199647).
• CVE-2022-1462: Fixed an out-of-bounds read flaw in the TeleTYpe subsystem. This flaw allowed a local user to crash the system or read unauthorized random data from memory. (bnc#1198829)
• CVE-2022-1679: Fixed a use-after-free in the Atheros wireless driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages (bsc#1199487).
• CVE-2022-2318: Fixed a use-after-free vulnerabilities in the timer handler in net/rose/rose_timer.c that allow attackers to crash the system without any privileges (bsc#1201251).
• CVE-2022-20132: Fixed out of bounds read due to improper input validation in lg_probe and related functions of hid-lg.c (bsc#1200619).
• CVE-2022-20141: Fixed a possible use after free due to improper locking in ip_check_mc_rcu() (bsc#1200604).
• CVE-2022-20154: Fixed a use after free due to a race condition in lock_sock_nested of sock.c. This could lead to local escalation of privilege with System execution privileges needed (bsc#1200599).
• CVE-2022-21505: Fixed kexec lockdown bypass with ima policy (bsc#1201458).
• CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742: Fixed multiple potential data leaks with Block and Network devices when using untrusted backends (bsc#1200762).
• CVE-2022-29900, CVE-2022-29901: Fixed the RETBLEED attack, a new Spectre like Branch Target Buffer attack, that can leak arbitrary kernel information (bsc#1199657).
• CVE-2022-33981: Fixed use-after-free in floppy driver (bsc#1200692)
• CVE-2022-36946: Fixed incorrect packet truncation in nfqnl_mangle() that could lead to remote DoS (bnc#1201940).

The following non-security bugs were fixed:

• bcache: avoid unnecessary soft lockup in kworker update_writeback_rate() (bsc#1197362).
• blk-mq: Fix wrong wakeup batch configuration which will cause hang (bsc#1200263).
• blk-mq: clear active_queues before clearing BLK_MQ_F_TAG_QUEUE_SHARED (bsc#1200263).
• blk-mq: fix tag_get wait task can't be awakened (bsc#1200263).
• dma-direct: Fix potential NULL pointer dereference (bsc#1196472 ltc#192278).
• dma-mapping: Allow mixing bypass and mapped DMA operation (bsc#1196472 ltc#192278).
• dma-mapping: add a dma_ops_bypass flag to struct device (bsc#1196472 ltc#192278).
• dma-mapping: move the remaining DMA API calls out of line (bsc#1196472 ltc#192278).
• dma: kABI: Add back removed exports (bsc#1196472 ltc#192278).
• exec: Force single empty string when argv is empty (bsc#1200571).
• fsnotify: invalidate dcache before IN_DELETE event (bsc#1195478 bsc#1200905).
• kvm: emulate: Fix SETcc emulation function offsets with SLS (bsc#1201930).
• kvm: emulate: do not adjust size of fastop and setcc subroutines (bsc#1201930).
• powerpc/dma: Fallback to dma_ops when persistent memory present (bsc#1196472 ltc#192278).
• powerpc/pseries/iommu: Create defines for…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-36516: Fixed TCP session data injection vulnerability via the mixed IPID assignment method (bnc#1196616).
• CVE-2020-36557: Fixed race condition between the VT_DISALLOCATE ioctl and closing/opening of ttys that could lead to a use-after-free (bnc#1201429).
• CVE-2020-36558: Fixed race condition involving VT_RESIZEX that could lead to a NULL pointer dereference and general protection fault (bnc#1200910).
• CVE-2021-33655: Fixed out of bounds write with ioctl FBIOPUT_VSCREENINFO (bnc#1201635).
• CVE-2021-33656: Fixed out of bounds write with ioctl PIO_FONT (bnc#1201636).
• CVE-2022-1116: Fixed a integer overflow vulnerability in io_uring which allowed a local attacker to cause memory corruption and escalate privileges to root (bnc#1199647).
• CVE-2022-1462: Fixed an out-of-bounds read flaw in the TeleTYpe subsystem (bnc#1198829).
• CVE-2022-2318: Fixed a use-after-free vulnerabilities in the timer handler in net/rose/rose_timer.c that allow attackers to crash the system without any privileges (bsc#1201251).
• CVE-2022-2639: Fixed integer underflow that could lead to out-of-bounds write in reserve_sfa_size() (bsc#1202154).
• CVE-2022-20166: Fixed possible out of bounds write due to sprintf unsafety that could cause local escalation of privilege (bnc#1200598)
• CVE-2022-21505: Fixed kexec lockdown bypass with IMA policy (bsc#1201458).
• CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742: Fixed multiple potential data leaks with Block and Network devices when using untrusted backends (bsc#1200762).
• CVE-2022-29581: Fixed improper update of Reference Count in net/sched that could cause root privilege escalation (bnc#1199665).
• CVE-2022-32250: Fixed user-after-free in net/netfilter/nf_tables_api.c that could allow local privilege escalation (bnc#1200015).
• CVE-2022-36946: Fixed incorrect packet truncation in nfqnl_mangle() that could lead to remote DoS (bnc#1201940).

The following non-security bugs were fixed:

• ACPI: APEI: Better fix to avoid spamming the console with old error logs (git-fixes).
• ACPI: CPPC: Do not prevent CPPC from working in the future (git-fixes).
• ACPI: video: Shortening quirk list by identifying Clevo by board_name only (git-fixes).
• ALSA: hda - Add fixup for Dell Latitidue E5430 (git-fixes).
• ALSA: hda/conexant: Apply quirk for another HP ProDesk 600 G3 model (git-fixes).
• ALSA: hda/realtek - Enable the headset-mic on a Xiaomi's laptop (git-fixes).
• ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc221 (git-fixes).
• ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc671 (git-fixes).
• ASoC: Intel: Skylake: Correct the handling of fmt_config flexible array (git-fixes).
• ASoC: Intel: Skylake: Correct the ssp rate discovery in skl_get_ssp_clks() (git-fixes).
• ASoC: Remove unused hw_write_t type (git-fixes).
• ASoC: cs47l15: Fix event generation for low power mux control (git-fixes).
• ASoC: madera: Fix event generation for OUT1 demux (git-fixes).
• ASoC: madera: Fix event generation for rate controls (git-fixes).
• ASoC: ops: Fix off by one in range control validation (git-fixes).
• ASoC: sgtl5000: Fix noise on shutdown/remove (git-fixes).
• ASoC: wm5110: Fix DRE control (git-fixes).
• Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put (git-fixes).
• Bluetooth: hci_intel: Add check for platform_driver_register (git-fixes).
• FDDI: defxx: Bail out gracefully with unassigned PCI resource for CSR (git-fixes).
• FDDI: defxx: Make MMIO the configuration default except for EISA (git-fixes).
• Fixed a system crash related to the recent RETBLEED mitigation (bsc#1201644, bsc#1201664, bsc#1201672, bsc#1201673, bsc#1201676).
• Fixed battery detection problem on macbooks (bnc#1201206).
• HID: cp2112: prevent a buffer overflow in cp2112_xfer() (git-fixes).
• KVM/emulate: Fix SETcc emulation function offsets…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-36516: Fixed TCP session data injection vulnerability via the mixed IPID assignment method (bnc#1196616).
• CVE-2020-36557: Fixed race condition between the VT_DISALLOCATE ioctl and closing/opening of ttys that could lead to a use-after-free (bnc#1201429).
• CVE-2020-36558: Fixed race condition involving VT_RESIZEX that could lead to a NULL pointer dereference and general protection fault (bnc#1200910).
• CVE-2021-33655: Fixed out of bounds write with ioctl FBIOPUT_VSCREENINFO (bnc#1201635).
• CVE-2021-33656: Fixed out of bounds write with ioctl PIO_FONT (bnc#1201636).
• CVE-2022-1116: Fixed a integer overflow vulnerability in io_uring which allowed a local attacker to cause memory corruption and escalate privileges to root (bnc#1199647).
• CVE-2022-1462: Fixed an out-of-bounds read flaw in the TeleTYpe subsystem (bnc#1198829).
• CVE-2022-2318: Fixed a use-after-free vulnerabilities in the timer handler in net/rose/rose_timer.c that allow attackers to crash the system without any privileges (bsc#1201251).
• CVE-2022-2639: Fixed integer underflow that could lead to out-of-bounds write in reserve_sfa_size() (bsc#1202154).
• CVE-2022-20166: Fixed possible out of bounds write due to sprintf unsafety that could cause local escalation of privilege (bnc#1200598)
• CVE-2022-21505: Fixed kexec lockdown bypass with IMA policy (bsc#1201458).
• CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742: Fixed multiple potential data leaks with Block and Network devices when using untrusted backends (bsc#1200762).
• CVE-2022-29581: Fixed improper update of Reference Count in net/sched that could cause root privilege escalation (bnc#1199665).
• CVE-2022-32250: Fixed user-after-free in net/netfilter/nf_tables_api.c that could allow local privilege escalation (bnc#1200015).
• CVE-2022-36946: Fixed incorrect packet truncation in nfqnl_mangle() that could lead to remote DoS (bnc#1201940).

The following non-security bugs were fixed:

• ACPI: APEI: Better fix to avoid spamming the console with old error logs (git-fixes).
• ACPI: CPPC: Do not prevent CPPC from working in the future (git-fixes).
• ACPI: video: Shortening quirk list by identifying Clevo by board_name only (git-fixes).
• ALSA: hda - Add fixup for Dell Latitidue E5430 (git-fixes).
• ALSA: hda/conexant: Apply quirk for another HP ProDesk 600 G3 model (git-fixes).
• ALSA: hda/realtek - Enable the headset-mic on a Xiaomi's laptop (git-fixes).
• ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc221 (git-fixes).
• ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc671 (git-fixes).
• ASoC: Intel: Skylake: Correct the handling of fmt_config flexible array (git-fixes).
• ASoC: Intel: Skylake: Correct the ssp rate discovery in skl_get_ssp_clks() (git-fixes).
• ASoC: Remove unused hw_write_t type (git-fixes).
• ASoC: cs47l15: Fix event generation for low power mux control (git-fixes).
• ASoC: madera: Fix event generation for OUT1 demux (git-fixes).
• ASoC: madera: Fix event generation for rate controls (git-fixes).
• ASoC: ops: Fix off by one in range control validation (git-fixes).
• ASoC: sgtl5000: Fix noise on shutdown/remove (git-fixes).
• ASoC: wm5110: Fix DRE control (git-fixes).
• Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put (git-fixes).
• Bluetooth: hci_intel: Add check for platform_driver_register (git-fixes).
• FDDI: defxx: Bail out gracefully with unassigned PCI resource for CSR (git-fixes).
• FDDI: defxx: Make MMIO the configuration default except for EISA (git-fixes).
• Fixed a system crash related to the recent RETBLEED mitigation (bsc#1201644, bsc#1201664, bsc#1201672, bsc#1201673, bsc#1201676).
• Fixed battery detection problem on macbooks (bnc#1201206).
• HID: cp2112: prevent a buffer overflow in cp2112_xfer() (git-fixes).
• KVM/emulate: Fix SETcc emulation function offsets…

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-2639: Fixed integer underflow that could lead to out-of-bounds write in reserve_sfa_size() (bsc#1202154).
• CVE-2020-36516: Fixed TCP session data injection vulnerability via the mixed IPID assignment method (bnc#1196616).
• CVE-2022-36946: Fixed an incorrect packet trucation operation which could lead to denial of service (bnc#1201940).
• CVE-2022-29581: Fixed improper update of Reference Count in net/sched that could cause root privilege escalation (bnc#1199665).
• CVE-2022-20166: Fixed several possible memory safety issues due to unsafe operations (bsc#1200598).
• CVE-2020-36558: Fixed a race condition involving VT_RESIZEX which could lead to a NULL pointer dereference and general protection fault (bnc#1200910).
• CVE-2020-36557: Fixed a race condition between the VT_DISALLOCATE ioctl and closing/opening of TTYs could lead to a use-after-free (bnc#1201429).
• CVE-2022-21505: Fixed kexec lockdown bypass with IMA policy (bsc#1201458).
• CVE-2021-33656: Fixed memory out of bounds write related to ioctl cmd PIO_FONT (bnc#1201636).
• CVE-2021-33655: Fixed out of bounds write with ioctl FBIOPUT_VSCREENINFO (bnc#1201635).
• CVE-2022-1462: Fixed an out-of-bounds read flaw in the TTY subsystem (bnc#1198829).
• CVE-2022-1116: Fixed a integer overflow vulnerability in io_uring which allowed a local attacker to cause memory corruption and escalate privileges to root (bnc#1199647).
• CVE-2022-2318: Fixed a use-after-free vulnerability in the timer handler in Rose subsystem that allowed unprivileged attackers to crash the system (bsc#1201251).
• CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742: Fixed multiple potential data leaks with Block and Network devices when using untrusted backends (bsc#1200762).

The following non-security bugs were fixed:

• Fix bsc#1201644, bsc#1201664, bsc#1201672, bsc#1201673, bsc#1201676 All are reports of the same problem - the IBRS_* regs push/popping was wrong but it needs 1b331eeea7b8 ('x86/entry: Remove skip_r11rcx') too.
• ACPI: APEI: Better fix to avoid spamming the console with old error logs (git-fixes).
• ACPI: CPPC: Do not prevent CPPC from working in the future (git-fixes).
• ACPI: video: Shortening quirk list by identifying Clevo by board_name only (git-fixes).
• ALSA: hda - Add fixup for Dell Latitidue E5430 (git-fixes).
• ALSA: hda/conexant: Apply quirk for another HP ProDesk 600 G3 model (git-fixes).
• ALSA: hda/realtek - Enable the headset-mic on a Xiaomi's laptop (git-fixes).
• ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc221 (git-fixes).
• ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc671 (git-fixes).
• ASoC: Intel: Skylake: Correct the handling of fmt_config flexible array (git-fixes).
• ASoC: Intel: Skylake: Correct the ssp rate discovery in skl_get_ssp_clks() (git-fixes).
• ASoC: Remove unused hw_write_t type (git-fixes).
• ASoC: cs47l15: Fix event generation for low power mux control (git-fixes).
• ASoC: madera: Fix event generation for OUT1 demux (git-fixes).
• ASoC: madera: Fix event generation for rate controls (git-fixes).
• ASoC: ops: Fix off by one in range control validation (git-fixes).
• ASoC: sgtl5000: Fix noise on shutdown/remove (git-fixes).
• ASoC: wm5110: Fix DRE control (git-fixes).
• Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put (git-fixes).
• Bluetooth: hci_intel: Add check for platform_driver_register (git-fixes).
• Fixed a regression where smart batteries would not be detected on Mac (bsc#1201206).
• Fixed an issue where qla2xxx would prevent nvme port discovery (bsc#1200651 bsc#1200644 bsc#1201954 bsc#1201958).
• FDDI: defxx: Bail out gracefully with unassigned PCI resource for CSR (git-fixes).
• FDDI: defxx: Make MMIO the configuration default except for EISA (git-fixes).
• Fix 1201644, 1201664, 1201672, 1201673, 1201676 All are reports of the…

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-2639: Fixed integer underflow that could lead to out-of-bounds write in reserve_sfa_size() (bsc#1202154).
• CVE-2020-36516: Fixed TCP session data injection vulnerability via the mixed IPID assignment method (bnc#1196616).
• CVE-2022-36946: Fixed an incorrect packet trucation operation which could lead to denial of service (bnc#1201940).
• CVE-2022-29581: Fixed improper update of Reference Count in net/sched that could cause root privilege escalation (bnc#1199665).
• CVE-2022-20166: Fixed several possible memory safety issues due to unsafe operations (bsc#1200598).
• CVE-2020-36558: Fixed a race condition involving VT_RESIZEX which could lead to a NULL pointer dereference and general protection fault (bnc#1200910).
• CVE-2020-36557: Fixed a race condition between the VT_DISALLOCATE ioctl and closing/opening of TTYs could lead to a use-after-free (bnc#1201429).
• CVE-2022-21505: Fixed kexec lockdown bypass with IMA policy (bsc#1201458).
• CVE-2021-33656: Fixed memory out of bounds write related to ioctl cmd PIO_FONT (bnc#1201636).
• CVE-2021-33655: Fixed out of bounds write with ioctl FBIOPUT_VSCREENINFO (bnc#1201635).
• CVE-2022-1462: Fixed an out-of-bounds read flaw in the TTY subsystem (bnc#1198829).
• CVE-2022-1116: Fixed a integer overflow vulnerability in io_uring which allowed a local attacker to cause memory corruption and escalate privileges to root (bnc#1199647).
• CVE-2022-2318: Fixed a use-after-free vulnerability in the timer handler in Rose subsystem that allowed unprivileged attackers to crash the system (bsc#1201251).
• CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742: Fixed multiple potential data leaks with Block and Network devices when using untrusted backends (bsc#1200762).

The following non-security bugs were fixed:

• Fix bsc#1201644, bsc#1201664, bsc#1201672, bsc#1201673, bsc#1201676 All are reports of the same problem - the IBRS_* regs push/popping was wrong but it needs 1b331eeea7b8 ('x86/entry: Remove skip_r11rcx') too.
• ACPI: APEI: Better fix to avoid spamming the console with old error logs (git-fixes).
• ACPI: CPPC: Do not prevent CPPC from working in the future (git-fixes).
• ACPI: video: Shortening quirk list by identifying Clevo by board_name only (git-fixes).
• ALSA: hda - Add fixup for Dell Latitidue E5430 (git-fixes).
• ALSA: hda/conexant: Apply quirk for another HP ProDesk 600 G3 model (git-fixes).
• ALSA: hda/realtek - Enable the headset-mic on a Xiaomi's laptop (git-fixes).
• ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc221 (git-fixes).
• ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc671 (git-fixes).
• ASoC: Intel: Skylake: Correct the handling of fmt_config flexible array (git-fixes).
• ASoC: Intel: Skylake: Correct the ssp rate discovery in skl_get_ssp_clks() (git-fixes).
• ASoC: Remove unused hw_write_t type (git-fixes).
• ASoC: cs47l15: Fix event generation for low power mux control (git-fixes).
• ASoC: madera: Fix event generation for OUT1 demux (git-fixes).
• ASoC: madera: Fix event generation for rate controls (git-fixes).
• ASoC: ops: Fix off by one in range control validation (git-fixes).
• ASoC: sgtl5000: Fix noise on shutdown/remove (git-fixes).
• ASoC: wm5110: Fix DRE control (git-fixes).
• Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put (git-fixes).
• Bluetooth: hci_intel: Add check for platform_driver_register (git-fixes).
• Fixed a regression where smart batteries would not be detected on Mac (bsc#1201206).
• Fixed an issue where qla2xxx would prevent nvme port discovery (bsc#1200651 bsc#1200644 bsc#1201954 bsc#1201958).
• FDDI: defxx: Bail out gracefully with unassigned PCI resource for CSR (git-fixes).
• FDDI: defxx: Make MMIO the configuration default except for EISA (git-fixes).
• Fix 1201644, 1201664, 1201672, 1201673, 1201676 All are reports of the…

It was discovered that the Traffic-Control Index (TCINDEX) implementation in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-1281)

It was discovered that the Integrity Measurement Architecture (IMA) implementation in the Linux kernel did not properly enforce policy in certain conditions. A privileged attacker could use this to bypass Kernel lockdown restrictions. (CVE-2022-21505)

It was discovered that the infrared transceiver USB driver did not properly handle USB control messages. A local attacker with physical access could plug in a specially crafted USB device to cause a denial of service (memory exhaustion). (CVE-2022-3903)

It was discovered that a race condition existed in the SMSC UFX USB driver implementation in the Linux kernel, leading to a use-after-free vulnerability. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-41849)

Gerald Lee discovered that the USB Gadget file system implementation in the Linux kernel contained a race condition, leading to a use-after-free vulnerability in some situations. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-4382)

It was discovered that a memory leak existed in the SCTP protocol implementation in the Linux kernel. A local attacker could use this to cause a denial of service (memory exhaustion). (CVE-2023-1074)

Mingi Cho discovered that the netfilter subsystem in the Linux kernel did not properly initialize a data structure, leading to a null pointer dereference vulnerability. An attacker could use this to cause a denial of service (system crash). (CVE-2023-1095)

It was discovered that the RNDIS USB driver in the Linux kernel contained an integer overflow vulnerability. A local attacker with physical access could plug in a malicious USB device to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-23559)

It was discovered that the NTFS file system implementation in the Linux kernel did not properly validate attributes in certain situations, leading to an out-of-bounds read vulnerability. A local attacker could possibly use this to expose sensitive information (kernel memory). (CVE-2023-26607)

Duoming Zhou discovered that a race condition existed in the infrared receiver/transceiver driver in the Linux kernel, leading to a use-after- free vulnerability. A privileged attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-1118)