File _patchinfo of Package patchinfo.23156

<patchinfo incident="23156">
  <issue id="1190717" tracker="bnc">Kernel NULL pointer dereference when adding traffic control queueing discipline</issue>
  <issue id="1146312" tracker="bnc">VUL-0: CVE-2016-10905: kernel-source: use-after-free is caused by the functions gfs2_clear_rgrpd and read_rindex_entry</issue>
  <issue id="1191580" tracker="bnc">VUL-0: EMBARGOED: CVE-2022-0001, CVE-2022-0002: kernel: BHB speculation issues</issue>
  <issue id="1193731" tracker="bnc">VUL-0: CVE-2021-0920: kernel-source-rt, kernel-source-azure, kernel-source: Use After Free in unix_gc() which could result in a local privilege escalation</issue>
  <issue id="1194463" tracker="bnc">VUL-0: CVE-2021-0920: kernel live patch: Use After Free in unix_gc() which could result in a local privilege escalation</issue>
  <issue id="1195543" tracker="bnc">VUL-0: CVE-2022-0492: kernel-source: cgroups v1 release_agent missing capabilities check</issue>
  <issue id="1195612" tracker="bnc">VUL-0: CVE-2022-24448: kernel-source,kernel-source-rt,kernel-source-azure: nfs_atomic_open() returns uninitialized data instead of ENOTDIR</issue>
  <issue id="1195908" tracker="bnc">VUL-0: CVE-2022-0492: kernel live patch: cgroups v1 release_agent missing capabilities check</issue>
  <issue id="1195939" tracker="bnc">L3: [EAR - NOT FOR USA Citizens] PTF request to fix CVE-2021-0920 on LTSS 12SP2 - ATAE ref:_00D1igLOd._5001iqDBb9:ref</issue>
  <issue id="1196079" tracker="bnc">VUL-0: CVE-2022-0617: kernel-source,kernel-source-rt,kernel-source-azure: udf: Null pointer dereference can be triggered when writing to an ICB inode</issue>
  <issue id="1196612" tracker="bnc">L3: [EAR - NOT FOR USA Citizens]  PTF request to fix kernel for CVE-2022-0492 for sles12sp2 ref:_00D1igLOd._5001iqBMTa:ref</issue>
  <issue id="2022-0001" tracker="cve" />
  <issue id="2022-0002" tracker="cve" />
  <issue id="2022-0617" tracker="cve" />
  <issue id="2022-0492" tracker="cve" />
  <issue id="2022-24448" tracker="cve" />
  <issue id="2016-10905" tracker="cve" />
  <issue id="2021-0920" tracker="cve" />
  <category>security</category>
  <rating>important</rating>
  <packager>osalvador</packager>
  <reboot_needed/>
  <description>The SUSE Linux Enterprise 12 SP2 kernel was updated to receive various security and bugfixes.


Transient execution side-channel attacks attacking the Branch History Buffer (BHB),
named "Branch Target Injection" and "Intra-Mode Branch History Injection" are now mitigated.

The following security bugs were fixed:

- CVE-2022-0001: Fixed Branch History Injection vulnerability (bsc#1191580).
- CVE-2022-0002: Fixed Intra-Mode Branch Target Injection vulnerability (bsc#1191580).
- CVE-2022-0617: Fixed a null pointer dereference in UDF file system functionality. A local user could crash the system by triggering udf_file_write_iter() via a malicious UDF image. (bsc#1196079)
- CVE-2022-0492: Fixed a privilege escalation related to cgroups v1 release_agent feature, which allowed bypassing namespace isolation unexpectedly (bsc#1195543).
- CVE-2022-24448: Fixed an issue in fs/nfs/dir.c. If an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should have occured, but the server instead returned uninitialized data in the file descriptor (bsc#1195612).
- CVE-2021-0920: Fixed a local privilege escalation due to a use-after-free bug in unix_gc (bsc#1193731).
- CVE-2016-10905: Fixed a use-after-free is gfs2_clear_rgrpd() and read_rindex_entry() (bsc#1146312).

The following non-security bug was fixed:

- net: sched: sch_teql: fix null-pointer dereference (bsc#1190717).
</description>
<summary>Security update for the Linux Kernel</summary>
</patchinfo>