File _patchinfo of Package patchinfo.24575

<patchinfo incident="24575">
  <issue id="1055710" tracker="bnc">VUL-1: CVE-2017-13695: kernel-source:  ACPI operand cache leak in nseval.c</issue>
  <issue id="1065729" tracker="bnc">[trackerbug] 4.12 powerpc base kernel fixes</issue>
  <issue id="1084513" tracker="bnc">VUL-1: CVE-2018-7755: kernel: An issue in the fd_locked_ioctl function in drivers/block/floppy.c will copy a kernel pointer to user memory</issue>
  <issue id="1087082" tracker="bnc">VUL-0: CVE-2018-3639:  V4 - Speculative Store Bypass aka "Memory Disambiguation"</issue>
  <issue id="1126703" tracker="bnc">VUL-0: CVE-2018-20784: kernel-source: kernel/sched/fair.c mishandles leaf cfs_rq's, which allows attackers to cause a denial of service (infinite loop in update_blocked_averages) or possibly have unspecifi</issue>
  <issue id="1158266" tracker="bnc">VUL-0: CVE-2019-19377: kernel-source: mounting a crafted btrfs filesystem image can lead to a use-after-free in btrfs_queue_work in fs/btrfs/async-thread.c</issue>
  <issue id="1173265" tracker="bnc">VUL-0: CVE-2020-10769: kernel-source: buffer over-read in IPsec authenc crypto_authenc_extractkeys() when a payload longer than 4 bytes is not aligned</issue>
  <issue id="1182171" tracker="bnc">SLES 15 SP3 Beta3 - ISST-LTE:950::System crashed while DLPAR of multiple I/O Slots</issue>
  <issue id="1183646" tracker="bnc">VUL-0: CVE-2021-28688: kernel-source: blkback driver may leak persistent grants (XSA-371)</issue>
  <issue id="1183723" tracker="bnc">VUL-1: CVE-2021-20292: kernel-source-azure,kernel-source-rt,kernel-source: DRM Memory Management Double Free Privilege Escalation Vulnerability</issue>
  <issue id="1187055" tracker="bnc">VUL-0: CVE-2021-38208: kernel-source,kernel-source-rt,kernel-soure-azure: nfc: Null pointer dereference in llcp_sock_getname</issue>
  <issue id="1191647" tracker="bnc">VUL-0: CVE-2021-20321: kernel-source,kernel-source-rt,kernel-source-azure: kernel: In Overlayfs missing a check for a negative dentry before calling vfs_rename()</issue>
  <issue id="1196426" tracker="bnc">VUL-0: CVE-2021-33061: kernel-source-azure,kernel-source-rt,kernel-source: Insufficient control flow management for the Intel(R) 82599 Ethernet Controllers and Adapters results in denial of service</issue>
  <issue id="1197343" tracker="bnc">VUL-0: CVE-2022-1011: kernel-source-azure,kernel-source-rt,kernel-source: FUSE allows UAF reads of write() buffers, allowing theft of (partial) /etc/shadow hashes</issue>
  <issue id="1198031" tracker="bnc">VUL-1: CVE-2022-28390: kernel-source: double free in ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c</issue>
  <issue id="1198032" tracker="bnc">VUL-1: CVE-2022-28388: kernel-source: double free in usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c</issue>
  <issue id="1198516" tracker="bnc">VUL-0: CVE-2022-1353: kernel-source: information leak issue in pfkey_register in net/key/af_key.c</issue>
  <issue id="1198577" tracker="bnc">VUL-0: CVE-2022-1184: kernel: use-after-free and memory errors in ext4 when mounting and operating on a corrupted image</issue>
  <issue id="1198660" tracker="bnc">Request SUSE to pick up this kernel upstream patch in SLES 15 3, SLES 15 SP 2 and SLES 12 SP 5 releases to fix a potential drmgr add/remove crash issue</issue>
  <issue id="1198687" tracker="bnc">[EAR - NOT FOR USA Citizens] PTF requests fo kernel fixing CVE-2022-1011 in SLES11 SP3 LTSS– Core</issue>
  <issue id="1198742" tracker="bnc">VUL-0: CVE-2022-1419: kernel: A concurrency use-after-free in vgem_gem_dumb_create</issue>
  <issue id="1199012" tracker="bnc">VUL-0: CVE-2022-1516: kernel-source-rt,kernel-source,kernel-source-azure: null-ptr-deref caused by x25_disconnect</issue>
  <issue id="1199063" tracker="bnc">VUL-0: CVE-2022-1652: kernel-source,kernel-source-rt,kernel-source-azure: We found a concurrency use-after-free in bad_flp_intr for latest kernel version</issue>
  <issue id="1199426" tracker="bnc">VUL-0: CVE-2022-21499: kernel-source,kernel-source-rt,kernel-source-azure: break out of lockdown with kgdb</issue>
  <issue id="1199505" tracker="bnc">VUL-0: CVE-2022-30594: kernel-source,kernel-source-azure,kernel-source-rt: mishandled seccomp permissions</issue>
  <issue id="1199507" tracker="bnc">VUL-0: CVE-2022-1729: kernel-source: kernel/core: race condition in perf_event_open leads to privilege escalation</issue>
  <issue id="1199605" tracker="bnc">VUL-0: CVE-2022-1734: kernel-source,kernel-source-azure,kernel-source-rt: Use-After-Free in NFC driver in nfcmrvl_nci_unregister_dev when simulating NFC device from user-space</issue>
  <issue id="1199650" tracker="bnc">VUL-0: EMBARGOED: CVE-2022-21166, CVE-2022-21127, CVE-2022-21123, CVE-2022-21125, CVE-2022-21180: kernel: stale MMIO data transient information leaks (INTEL-TA-00615)</issue>
  <issue id="1200143" tracker="bnc">VUL-0: CVE-2022-1975: kernel-source,kernel-source-azure,kernel-source-rt: sleep in atomic bug when firmware download timeout</issue>
  <issue id="1200144" tracker="bnc">VUL-0: CVE-2022-1974: kernel-source-rt,kernel-source,kernel-source-azure: use-after-free in /net/nfc/core.c causes kernel crash by simulating nfc device from user-space</issue>
  <issue id="1200249" tracker="bnc">SLE15-SP3/armv7l/lpae: NEW WARNINGS (4c788136)</issue>
  <issue id="2022-21166" tracker="cve" />
  <issue id="2022-21127" tracker="cve" />
  <issue id="2022-21123" tracker="cve" />
  <issue id="2022-21125" tracker="cve" />
  <issue id="2022-21180" tracker="cve" />
  <issue id="2022-1975" tracker="cve" />
  <issue id="2022-1974" tracker="cve" />
  <issue id="2019-19377" tracker="cve" />
  <issue id="2022-1729" tracker="cve" />
  <issue id="2022-1184" tracker="cve" />
  <issue id="2022-21499" tracker="cve" />
  <issue id="2017-13695" tracker="cve" />
  <issue id="2022-1652" tracker="cve" />
  <issue id="2022-1734" tracker="cve" />
  <issue id="2022-30594" tracker="cve" />
  <issue id="2021-28688" tracker="cve" />
  <issue id="2020-10769" tracker="cve" />
  <issue id="2021-33061" tracker="cve" />
  <issue id="2022-1516" tracker="cve" />
  <issue id="2021-20321" tracker="cve" />
  <issue id="2018-7755" tracker="cve" />
  <issue id="2022-1419" tracker="cve" />
  <issue id="2021-38208" tracker="cve" />
  <issue id="2022-1353" tracker="cve" />
  <issue id="2018-20784" tracker="cve" />
  <issue id="2021-20292" tracker="cve" />
  <issue id="2022-1011" tracker="cve" />
  <issue id="2022-28388" tracker="cve" />
  <issue id="2022-28390" tracker="cve" />
  <category>security</category>
  <rating>important</rating>
  <packager>osalvador</packager>
  <reboot_needed/>
  <description>
The SUSE Linux Enterprise 12 SP2 kernel was updated.

The following security bugs were fixed:

- CVE-2022-28390: Fixed a double free in drivers/net/can/usb/ems_usb.c vulnerability in the Linux kernel (bnc#1198031).
- CVE-2022-28388: Fixed a double free in drivers/net/can/usb/usb_8dev.c vulnerability in the Linux kernel (bnc#1198032).
- CVE-2018-20784: Fixed a denial of service (infinite loop in update_blocked_averages) by mishandled leaf cfs_rq in kernel/sched/fair.c (bnc#1126703).
- CVE-2018-7755: Fixed an issue in the fd_locked_ioctl function in drivers/block/floppy.c. The floppy driver will copy a kernel pointer to user memory in response to the FDGETPRM ioctl. An attacker can send the FDGETPRM ioctl and use the obtained kernel pointer to discover the location of kernel code and data and bypass kernel security protections such as KASLR (bnc#1084513).
- CVE-2020-10769: Fixed a buffer over-read flaw in the IPsec Cryptographic algorithm's module. This flaw allowed a local attacker with user privileges to cause a denial of service. (bnc#1173265)
- CVE-2021-28688: Fixed XSA-365 that includes initialization of pointers such that subsequent cleanup code wouldn't use uninitialized or stale values. This initialization went too far and may under certain conditions also overwrite pointers which are in need of cleaning up. The lack of cleanup would result in leaking persistent grants. The leak in turn would prevent fully cleaning up after a respective guest has died, leaving around zombie domains (bnc#1183646).
- CVE-2022-21127: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
- CVE-2022-21123: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
- CVE-2022-21125: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
- CVE-2022-21180: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
- CVE-2022-21166: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
- CVE-2022-1975: Fixed a bug that allows an attacker to crash the linux kernel by simulating nfc device from user-space. (bsc#1200143)
- CVE-2022-1974: Fixed an use-after-free that could causes kernel crash by simulating an nfc device from user-space. (bsc#1200144)
- CVE-2019-19377: Fixed an user-after-free that could be triggered when an attacker mounts a crafted btrfs filesystem image. (bnc#1158266)
- CVE-2022-1184: Fixed an use-after-free and memory errors in ext4 when mounting and operating on a corrupted image. (bsc#1198577)
- CVE-2017-13695: Fixed a bug that caused a stack dump allowing local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism via a crafted ACPI table. (bnc#1055710)
- CVE-2022-1729: Fixed a sys_perf_event_open() race condition against self (bsc#1199507).
- CVE-2022-21499: Reinforce the kernel lockdown feature, until now it's been trivial to break out of it with kgdb or kdb. (bsc#1199426)
- CVE-2022-1652: Fixed a statically allocated error counter inside the floppy kernel module (bsc#1199063).
- CVE-2022-1734: Fixed a r/w use-after-free when non synchronized between cleanup routine and firmware download routine. (bnc#1199605)
- CVE-2022-30594: Fixed restriction bypass on setting the PT_SUSPEND_SECCOMP flag (bnc#1199505).
- CVE-2021-33061: Fixed insufficient control flow management for the Intel(R) 82599 Ethernet Controllers and Adapters that may have allowed an authenticated user to potentially enable denial of service via local access (bnc#1196426).
- CVE-2022-1516: Fixed null-ptr-deref caused by x25_disconnect (bsc#1199012).
- CVE-2021-20321: Fixed a race condition accessing file object in the OverlayFS subsystem in the way users do rename in specific way with OverlayFS. A local user could have used this flaw to crash the system (bnc#1191647).
- CVE-2022-1419: Fixed a concurrency use-after-free in vgem_gem_dumb_create (bsc#1198742).
- CVE-2021-38208: Fixed a denial of service (NULL pointer dereference and BUG) by making a getsockname call after a certain type of failure of a bind call (bnc#1187055).
- CVE-2022-1353: Fixed access controll to kernel memory in the pfkey_register function in net/key/af_key.c. (bnc#1198516)
- CVE-2021-20292: Fixed object validation prior to performing operations on the object in nouveau_sgdma_create_ttm in Nouveau DRM subsystem (bnc#1183723).
- CVE-2022-1011: Fixed an use-after-free vulnerability which could allow a local attacker to retireve (partial) /etc/shadow hashes or any other data from filesystem when he can mount a FUSE filesystems. (bnc#1197343)

The following non-security bugs were fixed:

- btrfs: tree-checker: fix incorrect printk format (bsc#1200249).
- powerpc/pseries: extract host bridge from pci_bus prior to bus removal (bsc#1182171 ltc#190900 bsc#1198660 ltc#197803).
- powerpc/pseries: Fix use after free in remove_phb_dynamic() (bsc#1065729 bsc#1198660 ltc#197803).
- x86/speculation: Fix redundant MDS mitigation message (bsc#1199650).
</description>
<summary>Security update for the Linux Kernel</summary>
</patchinfo>