File _patchinfo of Package patchinfo.24975

<patchinfo incident="24975">
  <issue id="1066618" tracker="bnc">VUL-0: CVE-2017-16525: kernel: The usb_serial_console_disconnect function allows local users to cause DoS</issue>
  <issue id="1146519" tracker="bnc">VUL-0: CVE-2019-15211: kernel-source: use-after-free in drivers/media/v4l2-core/v4l2-dev.c</issue>
  <issue id="1194013" tracker="bnc">VUL-0: CVE-2021-4157: kernel-source-azure,kernel-source-rt,kernel-source: Buffer overwrite in decode_nfs_fh function</issue>
  <issue id="1196901" tracker="bnc">VUL-0: CVE-2022-23960,CVE-2022-0001,CVE-2022-0002,CVE-2021-26341,CVE-2021-26401: xen: Multiple speculative security issues (XSA-398)</issue>
  <issue id="1199487" tracker="bnc">VUL-0: CVE-2022-1679: kernel-source,kernel-source-rt,kernel-source-azure: kernel: Use-After-Free in ath9k_htc_probe_device() could cause an escalation of privileges</issue>
  <issue id="1199657" tracker="bnc">VUL-0: EMBARGOED: CVE-2022-29900 CVE-2022-29901: kernel: RETBLEED speculative issue</issue>
  <issue id="1200571" tracker="bnc">execve() incorrectly handles empty argv array</issue>
  <issue id="1200604" tracker="bnc">VUL-0: CVE-2022-20141: kernel-source-azure,kernel-source,kernel-source-rt: use after free in ip_check_mc_rcu()</issue>
  <issue id="1200605" tracker="bnc">VUL-0: CVE-2022-20141: kernel live patch: use after free in ip_check_mc_rcu()</issue>
  <issue id="1200619" tracker="bnc">VUL-0: CVE-2022-20132: kernel-source-rt,kernel-source-azure,kernel-source: several potential out of bounds reads via malicious HID device</issue>
  <issue id="1201050" tracker="bnc">VUL-0: CVE-2021-26341: kernel: straight line speculation on x86</issue>
  <issue id="1201080" tracker="bnc">VUL-0: CVE-2022-1679: kernel live patch: kernel: Use-After-Free in ath9k_htc_probe_device() could cause an escalation of privileges</issue>
  <issue id="2022-29900" tracker="cve" />
  <issue id="2022-29901" tracker="cve" />
  <issue id="2021-26341" tracker="cve" />
  <issue id="2022-1679" tracker="cve" />
  <issue id="2022-20132" tracker="cve" />
  <issue id="2022-20141" tracker="cve" />
  <issue id="2017-16525" tracker="cve" />
  <issue id="2021-4157" tracker="cve" />
  <issue id="1200692" tracker="bnc">VUL-0: CVE-2022-33981: kernel-source-rt,kernel-source-azure,kernel-source: use-after-free in floppy driver</issue>
  <issue id="2022-33981" tracker="cve" />
  <category>security</category>
  <rating>important</rating>
  <packager>osalvador</packager>
  <reboot_needed/>
  <description>The SUSE Linux Enterprise 12 SP2 kernel was updated to receive various security and bugfixes.


The following security bugs were fixed:

- CVE-2022-29900, CVE-2022-29901: Fixed the RETBLEED attack, a new Spectre like Branch Target Buffer attack, that can leak arbitrary kernel information (bsc#1199657).
- CVE-2022-1679: Fixed a use-after-free in the Atheros wireless driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages (bsc#1199487).
- CVE-2022-20132: Fixed out of bounds read due to improper input validation in lg_probe and related functions of hid-lg.c (bsc#1200619).
- CVE-2022-33981: Fixed use-after-free in floppy driver (bsc#1200692)
- CVE-2022-20141: Fixed a possible use after free due to improper locking in ip_check_mc_rcu() (bsc#1200604).
- CVE-2021-4157: Fixed an out of memory bounds write flaw in the NFS subsystem, related to the replication of files with NFS. A user could potentially crash the system or escalate privileges on the system (bsc#1194013).
- CVE-2021-26341: Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage (bsc#1201050).
- CVE-2017-16525: Fixed a use-after-free after failed setup in usb/serial/console (bsc#1066618).

The following non-security bugs were fixed:

- exec: Force single empty string when argv is empty (bsc#1200571).
</description>
<summary>Security update for the Linux Kernel</summary>
</patchinfo>