CVE-2021-47086

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

i2c: xiic: fix reference leak when pm_runtime_get_sync fails

The PM reference count is not expected to be incremented on return in xiic_xfer and xiic_i2c_remove.

However, pm_runtime_get_sync will increment the PM reference count even failed. Forgetting to putting operation will result in a reference leak here.

Replace it with pm_runtime_resume_and_get to keep usage counter balanced.(CVE-2020-36778)

In the Linux kernel, the following vulnerability has been resolved:

i2c: imx-lpi2c: fix reference leak when pm_runtime_get_sync fails

The PM reference count is not expected to be incremented on return in lpi2c_imx_master_enable.

However, pm_runtime_get_sync will increment the PM reference count even failed. Forgetting to putting operation will result in a reference leak here.

Replace it with pm_runtime_resume_and_get to keep usage counter balanced.(CVE-2020-36782)

In the Linux kernel, the following vulnerability has been resolved:

HID: usbhid: fix info leak in hid_submit_ctrl

In hid_submit_ctrl(), the way of calculating the report length doesn't take into account that report->size can be zero. When running the syzkaller reproducer, a report of size 0 causes hid_submit_ctrl) to calculate transfer_buffer_length as 16384. When this urb is passed to the usb core layer, KMSAN reports an info leak of 16384 bytes.

To fix this, first modify hid_report_len() to account for the zero report size case by using DIV_ROUND_UP for the division. Then, call it from hid_submit_ctrl().(CVE-2021-46906)

In the Linux kernel, the following vulnerability has been resolved:

ARM: footbridge: fix PCI interrupt mapping

Since commit 30fdfb929e82 ("PCI: Add a call to pci_assign_irq() in pci_device_probe()"), the PCI code will call the IRQ mapping function whenever a PCI driver is probed. If these are marked as __init, this causes an oops if a PCI driver is loaded or bound after the kernel has initialised.(CVE-2021-46909)

In the Linux kernel, the following vulnerability has been resolved:

usb: dwc3: core: Do core softreset when switch mode

According to the programming guide, to switch mode for DRD controller, the driver needs to do the following.

To switch from device to host:

1. Reset controller with GCTL.CoreSoftReset
2. Set GCTL.PrtCapDir(host mode)
3. Reset the host with USBCMD.HCRESET
4. Then follow up with the initializing host registers sequence

To switch from host to device:

1. Reset controller with GCTL.CoreSoftReset
2. Set GCTL.PrtCapDir(device mode)
3. Reset the device with DCTL.CSftRst
4. Then follow up with the initializing registers sequence

Currently we're missing step 1) to do GCTL.CoreSoftReset and step 3) of switching from host to device. John Stult reported a lockup issue seen with HiKey960 platform without these steps[1]. Similar issue is observed with Ferry's testing platform[2].

So, apply the required steps along with some fixes to Yu Chen's and John Stultz's version. The main fixes to their versions are the missing wait for clocks synchronization before clearing GCTL.CoreSoftReset and only apply DCTL.CSftRst when switching from host to device.

[1] https://lore.kernel.org/linux-usb/[email protected]/ [2] https://lore.kernel.org/linux-usb/[email protected]/(CVE-2021-46941)

In the Linux kernel, the following vulnerability has been resolved:

openvswitch: fix stack OOB read while fragmenting IPv4 packets

running openvswitch on kernels built with KASAN, it's possible to see the following splat while testing fragmentation of IPv4 packets:

BUG: KASAN: stack-out-of-bounds in ip_do_fragment+0x1b03/0x1f60 Read of size 1 at addr ffff888112fc713c by task handler2/1367

CPU: 0 PID: 1367 Comm: handler2 Not tainted 5.12.0-rc6+…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

media: dvbdev: Fix memory leak in dvb_media_device_free()

dvb_media_device_free() is leaking memory. Free dvbdev->adapter->conn before setting it to NULL, as documented in include/media/media-device.h: "The media_entity instance itself must be freed explicitly by the driver if required."(CVE-2020-36777)

In the Linux kernel, the following vulnerability has been resolved:

i2c: sprd: fix reference leak when pm_runtime_get_sync fails

The PM reference count is not expected to be incremented on return in sprd_i2c_master_xfer() and sprd_i2c_remove().

However, pm_runtime_get_sync will increment the PM reference count even failed. Forgetting to putting operation will result in a reference leak here.

Replace it with pm_runtime_resume_and_get to keep usage counter balanced.(CVE-2020-36780)

In the Linux kernel, the following vulnerability has been resolved:

i2c: cadence: fix reference leak when pm_runtime_get_sync fails

The PM reference count is not expected to be incremented on return in functions cdns_i2c_master_xfer and cdns_reg_slave.

However, pm_runtime_get_sync will increment pm usage counter even failed. Forgetting to putting operation will result in a reference leak here.

Replace it with pm_runtime_resume_and_get to keep usage counter balanced.(CVE-2020-36784)

In the Linux kernel, the following vulnerability has been resolved:

net: hso: fix null-ptr-deref during tty device unregistration

Multiple ttys try to claim the same the minor number causing a double unregistration of the same device. The first unregistration succeeds but the next one results in a null-ptr-deref.

The get_free_serial_index() function returns an available minor number but doesn't assign it immediately. The assignment is done by the caller later. But before this assignment, calls to get_free_serial_index() would return the same minor number.

Fix this by modifying get_free_serial_index to assign the minor number immediately after one is found to be and rename it to obtain_minor() to better reflect what it does. Similary, rename set_serial_by_index() to release_minor() and modify it to free up the minor number of the given hso_serial. Every obtain_minor() should have corresponding release_minor() call.(CVE-2021-46904)

In the Linux kernel, the following vulnerability has been resolved:

NFC: st21nfca: Fix memory leak in device probe and remove

'phy->pending_skb' is alloced when device probe, but forgot to free in the error handling path and remove path, this cause memory leak as follows:

unreferenced object 0xffff88800bc06800 (size 512): comm "8", pid 11775, jiffies 4295159829 (age 9.032s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<00000000d66c09ce>] __kmalloc_node_track_caller+0x1ed/0x450 [<00000000c93382b3>] kmalloc_reserve+0x37/0xd0 [<000000005fea522c>] __alloc_skb+0x124/0x380 [<0000000019f29f9a>] st21nfca_hci_i2c_probe+0x170/0x8f2

Fix it by freeing 'pending_skb' in error and remove.(CVE-2021-46924)

In the Linux kernel, the following vulnerability has been resolved:

ALSA: hda: intel-sdw-acpi: harden detection of controller

The existing code currently sets a pointer to an ACPI handle before checking that it's actually a SoundWire controller. This can lead to issues where the graph walk continues and eventually fails, but the pointer was set already.

This patch changes the logic so that the information provided to the caller is set when a controller is found.(CVE-2021-46926)

In the Linux kernel, the following vulnerability has been resolved:

parisc: Clear stale IIR value on instruction access rights…

In the Linux kernel, the following vulnerability has been resolved: phonet/pep: refuse to enable an unbound pipe This ioctl() implicitly assumed that the socket was already bound to a valid local socket name, i.e. Phonet object. If the socket was not bound, two separate problems would occur: 1) We'd send an pipe enablement request with an invalid source object. 2) Later socket calls could BUG on the socket unexpectedly being connected yet not bound to a valid object.

• CVE-url: https://ubuntu.com/security/CVE-2021-47466
  • mm, slub: fix potential memoryleak in kmem_cache_open()
• CVE-url: https://ubuntu.com/security/CVE-2024-36968
  • Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init()
• Bionic update: upstream stable patchset 2021-06-23 (LP: #1933375) // CVE- url: https://ubuntu.com/security/CVE-2021-47118
  • pid: take a reference when initializing cad_pid
• Bionic update: upstream stable patchset 2022-01-25 (LP: #1959033) // CVE- url: https://ubuntu.com/security/CVE-2021-47086
  • phonet/pep: refuse to enable an unbound pipe
• CVE-url: https://ubuntu.com/security/CVE-2023-52507
  • nfc: nci: assert requested protocol is valid
• CVE-url: https://ubuntu.com/security/CVE-2024-44944
  • netfilter: ctnetlink: use helper function to calculate expect ID
• CVE-url: https://ubuntu.com/security/CVE-2024-35861
  • smb: client: fix potential UAF in cifs_debug_files_proc_show()
  • smb: client: fix potential UAF in cifs_signal_cifsd_for_reconnect()
• CVE-url: https://ubuntu.com/security/CVE-2024-35863
  • smb: client: fix potential UAF in smb2_is_valid_oplock_break()
• CVE-url: https://ubuntu.com/security/CVE-2024-35864
  • smb: client: fix potential UAF in smb2_is_valid_lease_break()
• CVE-url: https://ubuntu.com/security/CVE-2024-35867
  • smb: client: fix potential UAF in cifs_stats_proc_show()
• CVE-url: https://ubuntu.com/security/CVE-2024-35868
  • smb: client: fix potential UAF in cifs_stats_proc_write()
• CVE-url: https://ubuntu.com/security/CVE-2024-35896
  • netfilter: validate user input for expected length
• Bionic update: upstream stable patchset 2022-10-18 (LP: #1993349) // CVE- url: https://ubuntu.com/security/CVE-2022-48695
  • scsi: mpt3sas: Fix use-after-free warning
• Bionic update: upstream stable patchset 2021-08-03 (LP: #1938824) // CVE- url: https://ubuntu.com/security/CVE-2021-47321
  • watchdog: Fix possible use-after-free by calling del_timer_sync()
• Bionic update: upstream stable patchset 2021-08-13 (LP: #1939913) // CVE- url: https://ubuntu.com/security/CVE-2021-47310
  • net: ti: fix UAF in tlan_remove_one
• CVE-url: https://ubuntu.com/security/CVE-2024-27010
  • net/sched: Fix mirred deadlock on device recursion
• Bionic update: upstream stable patchset 2021-08-03 (LP: #1938824) // CVE- url: https://ubuntu.com/security/CVE-2021-47353
  • udf: Fix NULL pointer dereference in udf_symlink function
• CVE-url: https://ubuntu.com/security/CVE-2024-26961
  • mac802154: fix llsec key resources release in mac802154_llsec_key_del
• CVE-url: https://ubuntu.com/security/CVE-2024-26958
  • NFS: Allow multiple commit requests in flight per file
  • NFS: Fix up commit deadlocks
  • nfs: fix UAF in direct writes
• CVE-url: https://ubuntu.com/security/CVE-2024-50115
  • KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory
• CVE-url: https://ubuntu.com/security/CVE-2024-50148
  • Bluetooth: bnep: fix wild-memory-access in proto_unregister
• CVE-url: https://ubuntu.com/security/CVE-2024-40910
  • ax25: Fix refcount imbalance on inbound connections
• CVE-url: https://ubuntu.com/security/CVE-2024-53057
  • net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT
• CVE-url: https://ubuntu.com/security/CVE-2024-36952
  • scsi: lpfc: Move NPIV's transport unregistration to after resource clean up
• CVE-url: https://ubuntu.com/security/CVE-2024-50142
  • xfrm: validate new SA's prefixlen using SA family when sel.family is unset
• CVE-url: https://ubuntu.com/security/CVE-2024-50256
  • netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6()
• CVE-url: https://ubuntu.com/security/CVE-2021-47501
  • i40e: Fix NULL pointer dereference in i40e_dbg_dump_desc
• CVE-url: https://ubuntu.com/security/CVE-2023-52574
  • team: fix null-ptr-deref when team device type is…

• CVE-url: https://ubuntu.com/security/CVE-2021-47466
  • mm, slub: fix potential memoryleak in kmem_cache_open()
• CVE-url: https://ubuntu.com/security/CVE-2024-36968
  • Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init()
• Bionic update: upstream stable patchset 2021-06-23 (LP: #1933375) // CVE- url: https://ubuntu.com/security/CVE-2021-47118
  • pid: take a reference when initializing cad_pid
• Bionic update: upstream stable patchset 2022-01-25 (LP: #1959033) // CVE- url: https://ubuntu.com/security/CVE-2021-47086
  • phonet/pep: refuse to enable an unbound pipe
• CVE-url: https://ubuntu.com/security/CVE-2023-52507
  • nfc: nci: assert requested protocol is valid
• CVE-url: https://ubuntu.com/security/CVE-2024-44944
  • netfilter: ctnetlink: use helper function to calculate expect ID
• CVE-url: https://ubuntu.com/security/CVE-2024-35861
  • smb: client: fix potential UAF in cifs_debug_files_proc_show()
  • smb: client: fix potential UAF in cifs_signal_cifsd_for_reconnect()
• CVE-url: https://ubuntu.com/security/CVE-2024-35863
  • smb: client: fix potential UAF in smb2_is_valid_oplock_break()
• CVE-url: https://ubuntu.com/security/CVE-2024-35864
  • smb: client: fix potential UAF in smb2_is_valid_lease_break()
• CVE-url: https://ubuntu.com/security/CVE-2024-35867
  • smb: client: fix potential UAF in cifs_stats_proc_show()
• CVE-url: https://ubuntu.com/security/CVE-2024-35868
  • smb: client: fix potential UAF in cifs_stats_proc_write()
• CVE-url: https://ubuntu.com/security/CVE-2024-35896
  • netfilter: validate user input for expected length
• Bionic update: upstream stable patchset 2022-10-18 (LP: #1993349) // CVE- url: https://ubuntu.com/security/CVE-2022-48695
  • scsi: mpt3sas: Fix use-after-free warning
• Bionic update: upstream stable patchset 2021-08-03 (LP: #1938824) // CVE- url: https://ubuntu.com/security/CVE-2021-47321
  • watchdog: Fix possible use-after-free by calling del_timer_sync()
• Bionic update: upstream stable patchset 2021-08-13 (LP: #1939913) // CVE- url: https://ubuntu.com/security/CVE-2021-47310
  • net: ti: fix UAF in tlan_remove_one
• CVE-url: https://ubuntu.com/security/CVE-2024-27010
  • net/sched: Fix mirred deadlock on device recursion
• Bionic update: upstream stable patchset 2021-08-03 (LP: #1938824) // CVE- url: https://ubuntu.com/security/CVE-2021-47353
  • udf: Fix NULL pointer dereference in udf_symlink function
• CVE-url: https://ubuntu.com/security/CVE-2024-26961
  • mac802154: fix llsec key resources release in mac802154_llsec_key_del
• CVE-url: https://ubuntu.com/security/CVE-2024-26958
  • NFS: Allow multiple commit requests in flight per file
  • NFS: Fix up commit deadlocks
  • nfs: fix UAF in direct writes
• CVE-url: https://ubuntu.com/security/CVE-2024-50115
  • KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory
• CVE-url: https://ubuntu.com/security/CVE-2024-50148
  • Bluetooth: bnep: fix wild-memory-access in proto_unregister
• CVE-url: https://ubuntu.com/security/CVE-2024-40910
  • ax25: Fix refcount imbalance on inbound connections
• CVE-url: https://ubuntu.com/security/CVE-2024-53057
  • net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT
• CVE-url: https://ubuntu.com/security/CVE-2024-36952
  • scsi: lpfc: Move NPIV's transport unregistration to after resource clean up
• CVE-url: https://ubuntu.com/security/CVE-2024-50142
  • xfrm: validate new SA's prefixlen using SA family when sel.family is unset
• CVE-url: https://ubuntu.com/security/CVE-2024-50256
  • netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6()
• CVE-url: https://ubuntu.com/security/CVE-2021-47501
  • i40e: Fix NULL pointer dereference in i40e_dbg_dump_desc
• CVE-url: https://ubuntu.com/security/CVE-2023-52574
  • team: fix null-ptr-deref when team device type is…

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47086: phonet/pep: refuse to enable an unbound pipe (bsc#1220952).
• CVE-2021-47103: net: sock: preserve kabi for sock (bsc#1221010).
• CVE-2021-47186: tipc: check for null after calling kmemdup (bsc#1222702).
• CVE-2021-47546: Kabi fix for ipv6: fix memory leak in fib6_rule_suppress (bsc#1225504).
• CVE-2021-47547: net: tulip: de4x5: fix the problem that the array 'lp->phy' may be out of bound (bsc#1225505).
• CVE-2021-47588: sit: do not call ipip6_dev_free() from sit_init_net() (bsc#1226568).
• CVE-2021-47590: mptcp: fix deadlock in __mptcp_push_pending() (bsc#1226565).
• CVE-2021-47591: mptcp: remove tcp ulp setsockopt support (bsc#1226570).
• CVE-2021-47593: mptcp: clear 'kern' flag from fallback sockets (bsc#1226551).
• CVE-2021-47598: sch_cake: do not call cake_destroy() from cake_init() (bsc#1226574).
• CVE-2021-47599: btrfs: use latest_dev in btrfs_show_devname (bsc#1226571)
• CVE-2021-47606: net: netlink: af_netlink: Prevent empty skb by adding a check on len (bsc#1226555).
• CVE-2021-47623: powerpc/fixmap: Fix VM debug warning on unmap (bsc#1227919).
• CVE-2022-48785: ipv6: mcast: use rcu-safe version of ipv6_get_lladdr() (bsc#1227927)
• CVE-2022-48810: ipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure path (bsc#1227936).
• CVE-2022-48850: net-sysfs: add check for netdevice being present to speed_show (bsc#1228071)
• CVE-2022-48855: sctp: fix kernel-infoleak for SCTP sockets (bsc#1228003).
• CVE-2023-52435: net: prevent mss overflow in skb_segment() (bsc#1220138).
• CVE-2023-52573: net: rds: Fix possible NULL-pointer dereference (bsc#1220869)
• CVE-2023-52580: net/core: Fix ETH_P_1588 flow dissector (bsc#1220876).
• CVE-2023-52751: smb: client: fix use-after-free in smb2_query_info_compound() (bsc#1225489).
• CVE-2023-52775: net/smc: avoid data corruption caused by decline (bsc#1225088).
• CVE-2023-52812: drm/amd: check num of link levels when update pcie param (bsc#1225564).
• CVE-2023-52857: drm/mediatek: Fix coverity issue with unintentional integer overflow (bsc#1225581).
• CVE-2023-52863: hwmon: (axi-fan-control) Fix possible NULL pointer dereference (bsc#1225586).
• CVE-2024-26585: Fixed race between tx work scheduling and socket close (bsc#1220187).
• CVE-2024-26615: net/smc: fix illegal rmb_desc access in SMC-D connection dump (bsc#1220942).
• CVE-2024-26633: ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim() (bsc#1221647).
• CVE-2024-26635: llc: Drop support for ETH_P_TR_802_2 (bsc#1221656).
• CVE-2024-26636: llc: make llc_ui_sendmsg() more robust against bonding changes (bsc#1221659).
• CVE-2024-26641: ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv() (bsc#1221654).
• CVE-2024-26661: drm/amd/display: Add NULL test for 'timing generator' in (bsc#1222323)
• CVE-2024-26663: tipc: Check the bearer type before calling tipc_udp_nl_bearer_add() (bsc#1222326).
• CVE-2024-26665: tunnels: fix out of bounds access when building IPv6 PMTU error (bsc#1222328).
• CVE-2024-26802: stmmac: Clear variable when destroying workqueue (bsc#1222799).
• CVE-2024-26863: hsr: Fix uninit-value access in hsr_get_node() (bsc#1223021).
• CVE-2024-26961: mac802154: fix llsec key resources release in mac802154_llsec_key_del (bsc#1223652).
• CVE-2024-27015: netfilter: flowtable: incorrect pppoe tuple (bsc#1223806).
• CVE-2024-27019: netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() (bsc#1223813)
• CVE-2024-27020: netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (bsc#1223815)
• CVE-2024-27025: nbd: null check for nla_nest_start (bsc#1223778)
• CVE-2024-27065: netfilter: nf_tables: do not compare internal table flags on updates (bsc#1223836).
• CVE-2024-27402: phonet/pep: fix racy skb_queue_empty() use (bsc#1224414).
• CVE-2024-27437: vfio/pci: Disable auto-enable of exclusive INTx IRQ…

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47086: phonet/pep: refuse to enable an unbound pipe (bsc#1220952).
• CVE-2021-47089: kfence: fix memory leak when cat kfence objects (bsc#1220958).
• CVE-2021-47103: net: sock: preserve kabi for sock (bsc#1221010).
• CVE-2021-47186: tipc: check for null after calling kmemdup (bsc#1222702).
• CVE-2021-47432: lib/generic-radix-tree.c: Do not overflow in peek() (bsc#1225391).
• CVE-2021-47515: seg6: fix the iif in the IPv6 socket control block (bsc#1225426).
• CVE-2021-47538: rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer() (bsc#1225448).
• CVE-2021-47539: rxrpc: Fix rxrpc_peer leak in rxrpc_look_up_bundle() (bsc#1225452).
• CVE-2021-47546: ipv6: fix memory leak in fib6_rule_suppress (bsc#1225504).
• CVE-2021-47547: net: tulip: de4x5: fix the problem that the array 'lp->phy' may be out of bound (bsc#1225505).
• CVE-2021-47555: net: vlan: fix underflow for the real_dev refcnt (bsc#1225467).
• CVE-2021-47566: Fix clearing user buffer by properly using clear_user() (bsc#1225514).
• CVE-2021-47571: staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect() (bsc#1225518).
• CVE-2021-47572: net: nexthop: fix null pointer dereference when IPv6 is not enabled (bsc#1225389).
• CVE-2021-47588: sit: do not call ipip6_dev_free() from sit_init_net() (bsc#1226568).
• CVE-2021-47590: mptcp: fix deadlock in __mptcp_push_pending() (bsc#1226565).
• CVE-2021-47591: mptcp: remove tcp ulp setsockopt support (bsc#1226570).
• CVE-2021-47593: mptcp: clear 'kern' flag from fallback sockets (bsc#1226551).
• CVE-2021-47598: sch_cake: do not call cake_destroy() from cake_init() (bsc#1226574).
• CVE-2021-47599: btrfs: use latest_dev in btrfs_show_devname (bsc#1226571).
• CVE-2021-47606: net: netlink: af_netlink: Prevent empty skb by adding a check on len. (bsc#1226555).
• CVE-2021-47623: powerpc/fixmap: Fix VM debug warning on unmap (bsc#1227919).
• CVE-2022-48716: ASoC: codecs: wcd938x: fix incorrect used of portid (bsc#1226678).
• CVE-2022-48785: ipv6: mcast: use rcu-safe version of ipv6_get_lladdr() (bsc#1227927)
• CVE-2022-48810: ipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure path (bsc#1227936).
• CVE-2022-48850: net-sysfs: add check for netdevice being present to speed_show (bsc#1228071).
• CVE-2022-48855: sctp: fix kernel-infoleak for SCTP sockets (bsc#1228003).
• CVE-2023-24023: Bluetooth: Add more enc key size check (bsc#1218148).
• CVE-2023-52435: net: prevent mss overflow in skb_segment() (bsc#1220138).
• CVE-2023-52573: net: rds: Fix possible NULL-pointer dereference (bsc#1220869).
• CVE-2023-52580: net/core: Fix ETH_P_1588 flow dissector (bsc#1220876).
• CVE-2023-52622: ext4: avoid online resizing failures due to oversized flex bg (bsc#1222080).
• CVE-2023-52658: Revert 'net/mlx5: Block entering switchdev mode with ns inconsistency' (bsc#1224719).
• CVE-2023-52667: net/mlx5e: fix a potential double-free in fs_any_create_groups (bsc#1224603).
• CVE-2023-52670: rpmsg: virtio: Free driver_override when rpmsg_remove() (bsc#1224696).
• CVE-2023-52672: pipe: wakeup wr_wait after setting max_usage (bsc#1224614).
• CVE-2023-52675: powerpc/imc-pmu: Add a null pointer check in update_events_in_group() (bsc#1224504).
• CVE-2023-52735: bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself (bsc#1225475).
• CVE-2023-52737: btrfs: lock the inode in shared mode before starting fiemap (bsc#1225484).
• CVE-2023-52751: smb: client: fix use-after-free in smb2_query_info_compound() (bsc#1225489).
• CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225487).
• CVE-2023-52762: virtio-blk: fix implicit overflow on virtio_max_dma_size (bsc#1225573).
• CVE-2023-52775: net/smc: avoid data corruption caused by decline (bsc#1225088).
• CVE-2023-52784: bonding: stop the device in bond_setup_by_slave() (bsc#1224946).
• CVE-2023-52787: blk-mq: make…

The SUSE Linux Enterprise 15 SP5 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47086: phonet/pep: refuse to enable an unbound pipe (bsc#1220952).
• CVE-2021-47103: net: sock: preserve kabi for sock (bsc#1221010).
• CVE-2021-47186: ipc: check for null after calling kmemdup (bsc#1222702).
• CVE-2021-47546: Kabi fix for ipv6: fix memory leak in fib6_rule_suppress (bsc#1225504).
• CVE-2021-47547: net: tulip: de4x5: fix the problem that the array 'lp->phy' may be out of bound (bsc#1225505).
• CVE-2021-47588: sit: do not call ipip6_dev_free() from sit_init_net() (bsc#1226568).
• CVE-2021-47590: mptcp: fix deadlock in __mptcp_push_pending() (bsc#1226565).
• CVE-2021-47591: mptcp: remove tcp ulp setsockopt support (bsc#1226570).
• CVE-2021-47593: mptcp: clear 'kern' flag from fallback sockets (bsc#1226551).
• CVE-2021-47598: sch_cake: do not call cake_destroy() from cake_init() (bsc#1226574).
• CVE-2021-47599: btrfs: use latest_dev in btrfs_show_devname (bsc#1226571)
• CVE-2021-47606: net: netlink: af_netlink: Prevent empty skb by adding a check on len (bsc#1226555).
• CVE-2021-47623: powerpc/fixmap: Fix VM debug warning on unmap (bsc#1227919).
• CVE-2022-48785: ipv6: mcast: use rcu-safe version of ipv6_get_lladdr() (bsc#1227927)
• CVE-2022-48810: ipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure path (bsc#1227936).
• CVE-2022-48850: net-sysfs: add check for netdevice being present to speed_show (bsc#1228071)
• CVE-2022-48855: sctp: fix kernel-infoleak for SCTP sockets (bsc#1228003).
• CVE-2023-52435: net: prevent mss overflow in skb_segment() (bsc#1220138).
• CVE-2023-52573: net: rds: Fix possible NULL-pointer dereference (bsc#1220869)
• CVE-2023-52580: net/core: Fix ETH_P_1588 flow dissector (bsc#1220876).
• CVE-2023-52751: smb: client: fix use-after-free in smb2_query_info_compound() (bsc#1225489).
• CVE-2023-52775: net/smc: avoid data corruption caused by decline (bsc#1225088).
• CVE-2023-52812: drm/amd: check num of link levels when update pcie param (bsc#1225564).
• CVE-2023-52857: drm/mediatek: Fix coverity issue with unintentional integer overflow (bsc#1225581).
• CVE-2023-52863: hwmon: (axi-fan-control) Fix possible NULL pointer dereference (bsc#1225586).
• CVE-2024-26585: Fixed race between tx work scheduling and socket close (bsc#1220187).
• CVE-2024-26615: net/smc: fix illegal rmb_desc access in SMC-D connection dump (bsc#1220942).
• CVE-2024-26633: ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim() (bsc#1221647).
• CVE-2024-26635: llc: Drop support for ETH_P_TR_802_2 (bsc#1221656).
• CVE-2024-26636: llc: make llc_ui_sendmsg() more robust against bonding changes (bsc#1221659).
• CVE-2024-26641: ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv() (bsc#1221654).
• CVE-2024-26661: drm/amd/display: Add NULL test for 'timing generator' in (bsc#1222323)
• CVE-2024-26663: tipc: Check the bearer type before calling tipc_udp_nl_bearer_add() (bsc#1222326).
• CVE-2024-26665: tunnels: fix out of bounds access when building IPv6 PMTU error (bsc#1222328).
• CVE-2024-26802: stmmac: Clear variable when destroying workqueue (bsc#1222799).
• CVE-2024-26863: hsr: Fix uninit-value access in hsr_get_node() (bsc#1223021).
• CVE-2024-26961: mac802154: fix llsec key resources release in mac802154_llsec_key_del (bsc#1223652).
• CVE-2024-27015: netfilter: flowtable: incorrect pppoe tuple (bsc#1223806).
• CVE-2024-27019: netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() (bsc#1223813)
• CVE-2024-27020: netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (bsc#1223815)
• CVE-2024-27025: nbd: null check for nla_nest_start (bsc#1223778)
• CVE-2024-27065: netfilter: nf_tables: do not compare internal table flags on updates (bsc#1223836).
• CVE-2024-27402: phonet/pep: fix racy skb_queue_empty() use (bsc#1224414).
• CVE-2024-27437: vfio/pci: Disable auto-enable of exclusive INTx IRQ…

Andy Nguyen discovered that the Bluetooth L2CAP implementation in the Linux kernel contained a type-confusion error. A physically proximate remote attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-12351)

Andy Nguyen discovered that the Bluetooth A2MP implementation in the Linux kernel did not properly initialize memory in some situations. A physically proximate remote attacker could use this to expose sensitive information (kernel memory). (CVE-2020-12352)

Andy Nguyen discovered that the Bluetooth HCI event packet parser in the Linux kernel did not properly handle event advertisements of certain sizes, leading to a heap-based buffer overflow. A physically proximate remote attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-24490)

Ziming Zhang discovered that the VMware Virtual GPU DRM driver in the Linux kernel contained an integer overflow vulnerability. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-36402)

Zheng Wang discovered a use-after-free in the Renesas Ethernet AVB driver in the Linux kernel during device removal. A privileged attacker could use this to cause a denial of service (system crash). (CVE-2023-35827)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• GPU drivers;
• I2C subsystem;
• Network drivers;
• Pin controllers subsystem;
• TTY drivers;
• USB Mass Storage drivers;
• Framebuffer layer;
• Ext4 file system;
• File systems infrastructure;
• Bluetooth subsystem;
• Kernel init infrastructure;
• DMA mapping infrastructure;
• Memory management;
• 9P file system network protocol;
• IPv4 networking;
• IPv6 networking;
• Logical Link layer;
• MAC80211 subsystem;
• Netfilter;
• NFC subsystem;
• Phonet protocol;
• Network traffic control;
• Wireless networking; (CVE-2024-44947, CVE-2023-52594, CVE-2024-35886, CVE-2024-38633, CVE-2023-52509, CVE-2024-26625, CVE-2024-36946, CVE-2024-45021, CVE-2024-36270, CVE-2021-47118, CVE-2024-43884, CVE-2024-36941, CVE-2024-38619, CVE-2021-47501, CVE-2024-49967, CVE-2024-42090, CVE-2024-40912, CVE-2024-36968, CVE-2024-53057, CVE-2023-52507, CVE-2024-42101, CVE-2021-47086, CVE-2024-42153, CVE-2024-40959, CVE-2024-26777, CVE-2024-44944, CVE-2024-43856, CVE-2024-39301)

Ziming Zhang discovered that the VMware Virtual GPU DRM driver in the Linux kernel contained an integer overflow vulnerability. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-36402)

Zheng Wang discovered a use-after-free in the Renesas Ethernet AVB driver in the Linux kernel during device removal. A privileged attacker could use this to cause a denial of service (system crash). (CVE-2023-35827)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• GPU drivers;
• I2C subsystem;
• Network drivers;
• Pin controllers subsystem;
• TTY drivers;
• USB Mass Storage drivers;
• Framebuffer layer;
• Ext4 file system;
• File systems infrastructure;
• Bluetooth subsystem;
• Kernel init infrastructure;
• DMA mapping infrastructure;
• Memory management;
• 9P file system network protocol;
• IPv4 networking;
• IPv6 networking;
• Logical Link layer;
• MAC80211 subsystem;
• Netfilter;
• NFC subsystem;
• Phonet protocol;
• Network traffic control;
• Wireless networking; (CVE-2024-44944, CVE-2023-52507, CVE-2024-42101, CVE-2021-47118, CVE-2024-36941, CVE-2024-38633, CVE-2021-47086, CVE-2024-26625, CVE-2024-39301, CVE-2024-42090, CVE-2024-53057, CVE-2024-26777, CVE-2024-36946, CVE-2024-42153, CVE-2024-40912, CVE-2024-36968, CVE-2024-43856, CVE-2024-49967, CVE-2024-43884, CVE-2023-52509, CVE-2023-52594, CVE-2024-36270, CVE-2024-44947, CVE-2024-45021, CVE-2024-35886, CVE-2024-40959, CVE-2021-47501, CVE-2024-38619)