Security update for the Linux Kernel SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:2077-1 Final 1 1 2022-06-14T18:28:39Z current 2022-06-14T18:28:39Z 2022-06-14T18:28:39Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for the Linux Kernel The SUSE Linux Enterprise 12 SP2 kernel was updated. The following security bugs were fixed: - CVE-2022-28390: Fixed a double free in drivers/net/can/usb/ems_usb.c vulnerability in the Linux kernel (bnc#1198031). - CVE-2022-28388: Fixed a double free in drivers/net/can/usb/usb_8dev.c vulnerability in the Linux kernel (bnc#1198032). - CVE-2018-20784: Fixed a denial of service (infinite loop in update_blocked_averages) by mishandled leaf cfs_rq in kernel/sched/fair.c (bnc#1126703). - CVE-2018-7755: Fixed an issue in the fd_locked_ioctl function in drivers/block/floppy.c. The floppy driver will copy a kernel pointer to user memory in response to the FDGETPRM ioctl. An attacker can send the FDGETPRM ioctl and use the obtained kernel pointer to discover the location of kernel code and data and bypass kernel security protections such as KASLR (bnc#1084513). - CVE-2020-10769: Fixed a buffer over-read flaw in the IPsec Cryptographic algorithm's module. This flaw allowed a local attacker with user privileges to cause a denial of service. (bnc#1173265) - CVE-2021-28688: Fixed XSA-365 that includes initialization of pointers such that subsequent cleanup code wouldn't use uninitialized or stale values. This initialization went too far and may under certain conditions also overwrite pointers which are in need of cleaning up. The lack of cleanup would result in leaking persistent grants. The leak in turn would prevent fully cleaning up after a respective guest has died, leaving around zombie domains (bnc#1183646). - CVE-2022-21127: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650) - CVE-2022-21123: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650) - CVE-2022-21125: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650) - CVE-2022-21180: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650) - CVE-2022-21166: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650) - CVE-2022-1975: Fixed a bug that allows an attacker to crash the linux kernel by simulating nfc device from user-space. (bsc#1200143) - CVE-2022-1974: Fixed an use-after-free that could causes kernel crash by simulating an nfc device from user-space. (bsc#1200144) - CVE-2019-19377: Fixed an user-after-free that could be triggered when an attacker mounts a crafted btrfs filesystem image. (bnc#1158266) - CVE-2022-1184: Fixed an use-after-free and memory errors in ext4 when mounting and operating on a corrupted image. (bsc#1198577) - CVE-2017-13695: Fixed a bug that caused a stack dump allowing local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism via a crafted ACPI table. (bnc#1055710) - CVE-2022-1729: Fixed a sys_perf_event_open() race condition against self (bsc#1199507). - CVE-2022-21499: Reinforce the kernel lockdown feature, until now it's been trivial to break out of it with kgdb or kdb. (bsc#1199426) - CVE-2022-1652: Fixed a statically allocated error counter inside the floppy kernel module (bsc#1199063). - CVE-2022-1734: Fixed a r/w use-after-free when non synchronized between cleanup routine and firmware download routine. (bnc#1199605) - CVE-2022-30594: Fixed restriction bypass on setting the PT_SUSPEND_SECCOMP flag (bnc#1199505). - CVE-2021-33061: Fixed insufficient control flow management for the Intel(R) 82599 Ethernet Controllers and Adapters that may have allowed an authenticated user to potentially enable denial of service via local access (bnc#1196426). - CVE-2022-1516: Fixed null-ptr-deref caused by x25_disconnect (bsc#1199012). - CVE-2021-20321: Fixed a race condition accessing file object in the OverlayFS subsystem in the way users do rename in specific way with OverlayFS. A local user could have used this flaw to crash the system (bnc#1191647). - CVE-2022-1419: Fixed a concurrency use-after-free in vgem_gem_dumb_create (bsc#1198742). - CVE-2021-38208: Fixed a denial of service (NULL pointer dereference and BUG) by making a getsockname call after a certain type of failure of a bind call (bnc#1187055). - CVE-2022-1353: Fixed access controll to kernel memory in the pfkey_register function in net/key/af_key.c. (bnc#1198516) - CVE-2021-20292: Fixed object validation prior to performing operations on the object in nouveau_sgdma_create_ttm in Nouveau DRM subsystem (bnc#1183723). - CVE-2022-1011: Fixed an use-after-free vulnerability which could allow a local attacker to retireve (partial) /etc/shadow hashes or any other data from filesystem when he can mount a FUSE filesystems. (bnc#1197343) The following non-security bugs were fixed: - btrfs: tree-checker: fix incorrect printk format (bsc#1200249). - powerpc/pseries: extract host bridge from pci_bus prior to bus removal (bsc#1182171 ltc#190900 bsc#1198660 ltc#197803). - powerpc/pseries: Fix use after free in remove_phb_dynamic() (bsc#1065729 bsc#1198660 ltc#197803). - x86/speculation: Fix redundant MDS mitigation message (bsc#1199650). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2022-2077,SUSE-SLE-SERVER-12-SP2-BCL-2022-2077 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20222077-1/ Link for SUSE-SU-2022:2077-1 https://lists.suse.com/pipermail/sle-security-updates/2022-June/011285.html E-Mail link for SUSE-SU-2022:2077-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1055710 SUSE Bug 1055710 https://bugzilla.suse.com/1065729 SUSE Bug 1065729 https://bugzilla.suse.com/1084513 SUSE Bug 1084513 https://bugzilla.suse.com/1087082 SUSE Bug 1087082 https://bugzilla.suse.com/1126703 SUSE Bug 1126703 https://bugzilla.suse.com/1158266 SUSE Bug 1158266 https://bugzilla.suse.com/1173265 SUSE Bug 1173265 https://bugzilla.suse.com/1182171 SUSE Bug 1182171 https://bugzilla.suse.com/1183646 SUSE Bug 1183646 https://bugzilla.suse.com/1183723 SUSE Bug 1183723 https://bugzilla.suse.com/1187055 SUSE Bug 1187055 https://bugzilla.suse.com/1191647 SUSE Bug 1191647 https://bugzilla.suse.com/1196426 SUSE Bug 1196426 https://bugzilla.suse.com/1197343 SUSE Bug 1197343 https://bugzilla.suse.com/1198031 SUSE Bug 1198031 https://bugzilla.suse.com/1198032 SUSE Bug 1198032 https://bugzilla.suse.com/1198516 SUSE Bug 1198516 https://bugzilla.suse.com/1198577 SUSE Bug 1198577 https://bugzilla.suse.com/1198660 SUSE Bug 1198660 https://bugzilla.suse.com/1198687 SUSE Bug 1198687 https://bugzilla.suse.com/1198742 SUSE Bug 1198742 https://bugzilla.suse.com/1199012 SUSE Bug 1199012 https://bugzilla.suse.com/1199063 SUSE Bug 1199063 https://bugzilla.suse.com/1199426 SUSE Bug 1199426 https://bugzilla.suse.com/1199505 SUSE Bug 1199505 https://bugzilla.suse.com/1199507 SUSE Bug 1199507 https://bugzilla.suse.com/1199605 SUSE Bug 1199605 https://bugzilla.suse.com/1199650 SUSE Bug 1199650 https://bugzilla.suse.com/1200143 SUSE Bug 1200143 https://bugzilla.suse.com/1200144 SUSE Bug 1200144 https://bugzilla.suse.com/1200249 SUSE Bug 1200249 https://www.suse.com/security/cve/CVE-2017-13695/ SUSE CVE CVE-2017-13695 page https://www.suse.com/security/cve/CVE-2018-20784/ SUSE CVE CVE-2018-20784 page https://www.suse.com/security/cve/CVE-2018-7755/ SUSE CVE CVE-2018-7755 page https://www.suse.com/security/cve/CVE-2019-19377/ SUSE CVE CVE-2019-19377 page https://www.suse.com/security/cve/CVE-2020-10769/ SUSE CVE CVE-2020-10769 page https://www.suse.com/security/cve/CVE-2021-20292/ SUSE CVE CVE-2021-20292 page https://www.suse.com/security/cve/CVE-2021-20321/ SUSE CVE CVE-2021-20321 page https://www.suse.com/security/cve/CVE-2021-28688/ SUSE CVE CVE-2021-28688 page https://www.suse.com/security/cve/CVE-2021-33061/ SUSE CVE CVE-2021-33061 page https://www.suse.com/security/cve/CVE-2021-38208/ SUSE CVE CVE-2021-38208 page https://www.suse.com/security/cve/CVE-2022-1011/ SUSE CVE CVE-2022-1011 page https://www.suse.com/security/cve/CVE-2022-1184/ SUSE CVE CVE-2022-1184 page https://www.suse.com/security/cve/CVE-2022-1353/ SUSE CVE CVE-2022-1353 page https://www.suse.com/security/cve/CVE-2022-1419/ SUSE CVE CVE-2022-1419 page https://www.suse.com/security/cve/CVE-2022-1516/ SUSE CVE CVE-2022-1516 page https://www.suse.com/security/cve/CVE-2022-1652/ SUSE CVE CVE-2022-1652 page https://www.suse.com/security/cve/CVE-2022-1729/ SUSE CVE CVE-2022-1729 page https://www.suse.com/security/cve/CVE-2022-1734/ SUSE CVE CVE-2022-1734 page https://www.suse.com/security/cve/CVE-2022-1974/ SUSE CVE CVE-2022-1974 page https://www.suse.com/security/cve/CVE-2022-1975/ SUSE CVE CVE-2022-1975 page https://www.suse.com/security/cve/CVE-2022-21123/ SUSE CVE CVE-2022-21123 page https://www.suse.com/security/cve/CVE-2022-21125/ SUSE CVE CVE-2022-21125 page https://www.suse.com/security/cve/CVE-2022-21127/ SUSE CVE CVE-2022-21127 page https://www.suse.com/security/cve/CVE-2022-21166/ SUSE CVE CVE-2022-21166 page https://www.suse.com/security/cve/CVE-2022-21180/ SUSE CVE CVE-2022-21180 page https://www.suse.com/security/cve/CVE-2022-21499/ SUSE CVE CVE-2022-21499 page https://www.suse.com/security/cve/CVE-2022-28388/ SUSE CVE CVE-2022-28388 page https://www.suse.com/security/cve/CVE-2022-28390/ SUSE CVE CVE-2022-28390 page https://www.suse.com/security/cve/CVE-2022-30594/ SUSE CVE CVE-2022-30594 page SUSE Linux Enterprise Server 12 SP2-BCL cluster-md-kmp-debug-4.4.121-92.175.2 cluster-md-kmp-default-4.4.121-92.175.2 cluster-md-kmp-vanilla-4.4.121-92.175.2 cluster-network-kmp-debug-4.4.121-92.175.2 cluster-network-kmp-default-4.4.121-92.175.2 cluster-network-kmp-vanilla-4.4.121-92.175.2 dlm-kmp-debug-4.4.121-92.175.2 dlm-kmp-default-4.4.121-92.175.2 dlm-kmp-vanilla-4.4.121-92.175.2 gfs2-kmp-debug-4.4.121-92.175.2 gfs2-kmp-default-4.4.121-92.175.2 gfs2-kmp-vanilla-4.4.121-92.175.2 kernel-debug-4.4.121-92.175.2 kernel-debug-base-4.4.121-92.175.2 kernel-debug-devel-4.4.121-92.175.2 kernel-debug-extra-4.4.121-92.175.2 kernel-debug-kgraft-4.4.121-92.175.2 kernel-default-4.4.121-92.175.2 kernel-default-base-4.4.121-92.175.2 kernel-default-devel-4.4.121-92.175.2 kernel-default-extra-4.4.121-92.175.2 kernel-default-kgraft-4.4.121-92.175.2 kernel-default-man-4.4.121-92.175.2 kernel-devel-4.4.121-92.175.2 kernel-docs-4.4.121-92.175.2 kernel-docs-html-4.4.121-92.175.2 kernel-docs-pdf-4.4.121-92.175.2 kernel-macros-4.4.121-92.175.2 kernel-obs-build-4.4.121-92.175.2 kernel-obs-qa-4.4.121-92.175.2 kernel-source-4.4.121-92.175.2 kernel-source-vanilla-4.4.121-92.175.2 kernel-syms-4.4.121-92.175.2 kernel-vanilla-4.4.121-92.175.2 kernel-vanilla-base-4.4.121-92.175.2 kernel-vanilla-devel-4.4.121-92.175.2 kernel-zfcpdump-4.4.121-92.175.2 ocfs2-kmp-debug-4.4.121-92.175.2 ocfs2-kmp-default-4.4.121-92.175.2 ocfs2-kmp-vanilla-4.4.121-92.175.2 kernel-default-4.4.121-92.175.2 as a component of SUSE Linux Enterprise Server 12 SP2-BCL kernel-default-base-4.4.121-92.175.2 as a component of SUSE Linux Enterprise Server 12 SP2-BCL kernel-default-devel-4.4.121-92.175.2 as a component of SUSE Linux Enterprise Server 12 SP2-BCL kernel-devel-4.4.121-92.175.2 as a component of SUSE Linux Enterprise Server 12 SP2-BCL kernel-macros-4.4.121-92.175.2 as a component of SUSE Linux Enterprise Server 12 SP2-BCL kernel-source-4.4.121-92.175.2 as a component of SUSE Linux Enterprise Server 12 SP2-BCL kernel-syms-4.4.121-92.175.2 as a component of SUSE Linux Enterprise Server 12 SP2-BCL The acpi_ns_evaluate() function in drivers/acpi/acpica/nseval.c in the Linux kernel through 4.12.9 does not flush the operand cache and causes a kernel stack dump, which allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism (in the kernel through 4.9) via a crafted ACPI table. CVE-2017-13695 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-base-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-devel-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-devel-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-macros-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-source-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-syms-4.4.121-92.175.2 important 2.1 AV:L/AC:L/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222077-1/ https://www.suse.com/security/cve/CVE-2017-13695.html CVE-2017-13695 https://bugzilla.suse.com/1055710 SUSE Bug 1055710 https://bugzilla.suse.com/1087082 SUSE Bug 1087082 In the Linux kernel before 4.20.2, kernel/sched/fair.c mishandles leaf cfs_rq's, which allows attackers to cause a denial of service (infinite loop in update_blocked_averages) or possibly have unspecified other impact by inducing a high load. CVE-2018-20784 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-base-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-devel-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-devel-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-macros-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-source-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-syms-4.4.121-92.175.2 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222077-1/ https://www.suse.com/security/cve/CVE-2018-20784.html CVE-2018-20784 https://bugzilla.suse.com/1126703 SUSE Bug 1126703 An issue was discovered in the fd_locked_ioctl function in drivers/block/floppy.c in the Linux kernel through 4.15.7. The floppy driver will copy a kernel pointer to user memory in response to the FDGETPRM ioctl. An attacker can send the FDGETPRM ioctl and use the obtained kernel pointer to discover the location of kernel code and data and bypass kernel security protections such as KASLR. CVE-2018-7755 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-base-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-devel-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-devel-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-macros-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-source-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-syms-4.4.121-92.175.2 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222077-1/ https://www.suse.com/security/cve/CVE-2018-7755.html CVE-2018-7755 https://bugzilla.suse.com/1084513 SUSE Bug 1084513 In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image, performing some operations, and unmounting can lead to a use-after-free in btrfs_queue_work in fs/btrfs/async-thread.c. CVE-2019-19377 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-base-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-devel-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-devel-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-macros-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-source-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-syms-4.4.121-92.175.2 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222077-1/ https://www.suse.com/security/cve/CVE-2019-19377.html CVE-2019-19377 https://bugzilla.suse.com/1158266 SUSE Bug 1158266 https://bugzilla.suse.com/1162338 SUSE Bug 1162338 https://bugzilla.suse.com/1162369 SUSE Bug 1162369 https://bugzilla.suse.com/1173871 SUSE Bug 1173871 https://bugzilla.suse.com/1211495 SUSE Bug 1211495 A buffer over-read flaw was found in RH kernel versions before 5.0 in crypto_authenc_extractkeys in crypto/authenc.c in the IPsec Cryptographic algorithm's module, authenc. When a payload longer than 4 bytes, and is not following 4-byte alignment boundary guidelines, it causes a buffer over-read threat, leading to a system crash. This flaw allows a local attacker with user privileges to cause a denial of service. CVE-2020-10769 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-base-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-devel-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-devel-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-macros-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-source-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-syms-4.4.121-92.175.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222077-1/ https://www.suse.com/security/cve/CVE-2020-10769.html CVE-2020-10769 https://bugzilla.suse.com/1173265 SUSE Bug 1173265 There is a flaw reported in the Linux kernel in versions before 5.9 in drivers/gpu/drm/nouveau/nouveau_sgdma.c in nouveau_sgdma_create_ttm in Nouveau DRM subsystem. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker with a local account with a root privilege, can leverage this vulnerability to escalate privileges and execute code in the context of the kernel. CVE-2021-20292 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-base-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-devel-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-devel-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-macros-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-source-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-syms-4.4.121-92.175.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222077-1/ https://www.suse.com/security/cve/CVE-2021-20292.html CVE-2021-20292 https://bugzilla.suse.com/1183723 SUSE Bug 1183723 A race condition accessing file object in the Linux kernel OverlayFS subsystem was found in the way users do rename in specific way with OverlayFS. A local user could use this flaw to crash the system. CVE-2021-20321 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-base-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-devel-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-devel-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-macros-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-source-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-syms-4.4.121-92.175.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222077-1/ https://www.suse.com/security/cve/CVE-2021-20321.html CVE-2021-20321 https://bugzilla.suse.com/1191647 SUSE Bug 1191647 The fix for XSA-365 includes initialization of pointers such that subsequent cleanup code wouldn't use uninitialized or stale values. This initialization went too far and may under certain conditions also overwrite pointers which are in need of cleaning up. The lack of cleanup would result in leaking persistent grants. The leak in turn would prevent fully cleaning up after a respective guest has died, leaving around zombie domains. All Linux versions having the fix for XSA-365 applied are vulnerable. XSA-365 was classified to affect versions back to at least 3.11. CVE-2021-28688 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-base-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-devel-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-devel-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-macros-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-source-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-syms-4.4.121-92.175.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222077-1/ https://www.suse.com/security/cve/CVE-2021-28688.html CVE-2021-28688 https://bugzilla.suse.com/1183646 SUSE Bug 1183646 Insufficient control flow management for the Intel(R) 82599 Ethernet Controllers and Adapters may allow an authenticated user to potentially enable denial of service via local access. CVE-2021-33061 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-base-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-devel-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-devel-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-macros-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-source-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-syms-4.4.121-92.175.2 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222077-1/ https://www.suse.com/security/cve/CVE-2021-33061.html CVE-2021-33061 https://bugzilla.suse.com/1196426 SUSE Bug 1196426 net/nfc/llcp_sock.c in the Linux kernel before 5.12.10 allows local unprivileged users to cause a denial of service (NULL pointer dereference and BUG) by making a getsockname call after a certain type of failure of a bind call. CVE-2021-38208 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-base-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-devel-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-devel-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-macros-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-source-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-syms-4.4.121-92.175.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222077-1/ https://www.suse.com/security/cve/CVE-2021-38208.html CVE-2021-38208 https://bugzilla.suse.com/1187055 SUSE Bug 1187055 A use-after-free flaw was found in the Linux kernel’s FUSE filesystem in the way a user triggers write(). This flaw allows a local user to gain unauthorized access to data from the FUSE filesystem, resulting in privilege escalation. CVE-2022-1011 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-base-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-devel-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-devel-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-macros-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-source-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-syms-4.4.121-92.175.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222077-1/ https://www.suse.com/security/cve/CVE-2022-1011.html CVE-2022-1011 https://bugzilla.suse.com/1197343 SUSE Bug 1197343 https://bugzilla.suse.com/1197344 SUSE Bug 1197344 https://bugzilla.suse.com/1198687 SUSE Bug 1198687 https://bugzilla.suse.com/1204132 SUSE Bug 1204132 https://bugzilla.suse.com/1212322 SUSE Bug 1212322 A use-after-free flaw was found in fs/ext4/namei.c:dx_insert_block() in the Linux kernel’s filesystem sub-component. This flaw allows a local attacker with a user privilege to cause a denial of service. CVE-2022-1184 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-base-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-devel-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-devel-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-macros-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-source-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-syms-4.4.121-92.175.2 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222077-1/ https://www.suse.com/security/cve/CVE-2022-1184.html CVE-2022-1184 https://bugzilla.suse.com/1198577 SUSE Bug 1198577 https://bugzilla.suse.com/1210859 SUSE Bug 1210859 A vulnerability was found in the pfkey_register function in net/key/af_key.c in the Linux kernel. This flaw allows a local, unprivileged user to gain access to kernel memory, leading to a system crash or a leak of internal kernel information. CVE-2022-1353 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-base-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-devel-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-devel-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-macros-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-source-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-syms-4.4.121-92.175.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222077-1/ https://www.suse.com/security/cve/CVE-2022-1353.html CVE-2022-1353 https://bugzilla.suse.com/1198516 SUSE Bug 1198516 https://bugzilla.suse.com/1212293 SUSE Bug 1212293 The root cause of this vulnerability is that the ioctl$DRM_IOCTL_MODE_DESTROY_DUMB can decrease refcount of *drm_vgem_gem_object *(created in *vgem_gem_dumb_create*) concurrently, and *vgem_gem_dumb_create *will access the freed drm_vgem_gem_object. CVE-2022-1419 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-base-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-devel-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-devel-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-macros-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-source-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-syms-4.4.121-92.175.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222077-1/ https://www.suse.com/security/cve/CVE-2022-1419.html CVE-2022-1419 https://bugzilla.suse.com/1198742 SUSE Bug 1198742 https://bugzilla.suse.com/1201655 SUSE Bug 1201655 https://bugzilla.suse.com/1203034 SUSE Bug 1203034 A NULL pointer dereference flaw was found in the Linux kernel’s X.25 set of standardized network protocols functionality in the way a user terminates their session using a simulated Ethernet card and continued usage of this connection. This flaw allows a local user to crash the system. CVE-2022-1516 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-base-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-devel-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-devel-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-macros-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-source-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-syms-4.4.121-92.175.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222077-1/ https://www.suse.com/security/cve/CVE-2022-1516.html CVE-2022-1516 https://bugzilla.suse.com/1199012 SUSE Bug 1199012 Linux Kernel could allow a local attacker to execute arbitrary code on the system, caused by a concurrency use-after-free flaw in the bad_flp_intr function. By executing a specially-crafted program, an attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service condition on the system. CVE-2022-1652 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-base-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-devel-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-devel-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-macros-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-source-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-syms-4.4.121-92.175.2 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222077-1/ https://www.suse.com/security/cve/CVE-2022-1652.html CVE-2022-1652 https://bugzilla.suse.com/1199063 SUSE Bug 1199063 https://bugzilla.suse.com/1200057 SUSE Bug 1200057 https://bugzilla.suse.com/1200751 SUSE Bug 1200751 https://bugzilla.suse.com/1201832 SUSE Bug 1201832 https://bugzilla.suse.com/1204132 SUSE Bug 1204132 https://bugzilla.suse.com/1212307 SUSE Bug 1212307 A race condition was found the Linux kernel in perf_event_open() which can be exploited by an unprivileged user to gain root privileges. The bug allows to build several exploit primitives such as kernel address information leak, arbitrary execution, etc. CVE-2022-1729 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-base-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-devel-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-devel-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-macros-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-source-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-syms-4.4.121-92.175.2 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222077-1/ https://www.suse.com/security/cve/CVE-2022-1729.html CVE-2022-1729 https://bugzilla.suse.com/1199507 SUSE Bug 1199507 https://bugzilla.suse.com/1199697 SUSE Bug 1199697 https://bugzilla.suse.com/1201832 SUSE Bug 1201832 A flaw in Linux Kernel found in nfcmrvl_nci_unregister_dev() in drivers/nfc/nfcmrvl/main.c can lead to use after free both read or write when non synchronized between cleanup routine and firmware download routine. CVE-2022-1734 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-base-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-devel-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-devel-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-macros-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-source-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-syms-4.4.121-92.175.2 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222077-1/ https://www.suse.com/security/cve/CVE-2022-1734.html CVE-2022-1734 https://bugzilla.suse.com/1199605 SUSE Bug 1199605 https://bugzilla.suse.com/1199606 SUSE Bug 1199606 https://bugzilla.suse.com/1201832 SUSE Bug 1201832 A use-after-free flaw was found in the Linux kernel's NFC core functionality due to a race condition between kobject creation and delete. This vulnerability allows a local attacker with CAP_NET_ADMIN privilege to leak kernel information. CVE-2022-1974 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-base-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-devel-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-devel-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-macros-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-source-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-syms-4.4.121-92.175.2 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222077-1/ https://www.suse.com/security/cve/CVE-2022-1974.html CVE-2022-1974 https://bugzilla.suse.com/1200144 SUSE Bug 1200144 https://bugzilla.suse.com/1200265 SUSE Bug 1200265 There is a sleep-in-atomic bug in /net/nfc/netlink.c that allows an attacker to crash the Linux kernel by simulating a nfc device from user-space. CVE-2022-1975 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-base-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-devel-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-devel-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-macros-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-source-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-syms-4.4.121-92.175.2 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222077-1/ https://www.suse.com/security/cve/CVE-2022-1975.html CVE-2022-1975 https://bugzilla.suse.com/1200143 SUSE Bug 1200143 Incomplete cleanup of multi-core shared buffers for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. CVE-2022-21123 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-base-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-devel-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-devel-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-macros-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-source-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-syms-4.4.121-92.175.2 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222077-1/ https://www.suse.com/security/cve/CVE-2022-21123.html CVE-2022-21123 https://bugzilla.suse.com/1199650 SUSE Bug 1199650 https://bugzilla.suse.com/1200549 SUSE Bug 1200549 https://bugzilla.suse.com/1209075 SUSE Bug 1209075 Incomplete cleanup of microarchitectural fill buffers on some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. CVE-2022-21125 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-base-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-devel-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-devel-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-macros-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-source-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-syms-4.4.121-92.175.2 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222077-1/ https://www.suse.com/security/cve/CVE-2022-21125.html CVE-2022-21125 https://bugzilla.suse.com/1199650 SUSE Bug 1199650 https://bugzilla.suse.com/1200549 SUSE Bug 1200549 https://bugzilla.suse.com/1209074 SUSE Bug 1209074 Incomplete cleanup in specific special register read operations for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. CVE-2022-21127 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-base-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-devel-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-devel-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-macros-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-source-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-syms-4.4.121-92.175.2 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222077-1/ https://www.suse.com/security/cve/CVE-2022-21127.html CVE-2022-21127 https://bugzilla.suse.com/1199650 SUSE Bug 1199650 https://bugzilla.suse.com/1200549 SUSE Bug 1200549 Incomplete cleanup in specific special register write operations for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. CVE-2022-21166 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-base-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-devel-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-devel-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-macros-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-source-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-syms-4.4.121-92.175.2 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222077-1/ https://www.suse.com/security/cve/CVE-2022-21166.html CVE-2022-21166 https://bugzilla.suse.com/1199650 SUSE Bug 1199650 https://bugzilla.suse.com/1200549 SUSE Bug 1200549 https://bugzilla.suse.com/1209073 SUSE Bug 1209073 Improper input validation for some Intel(R) Processors may allow an authenticated user to potentially cause a denial of service via local access. CVE-2022-21180 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-base-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-devel-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-devel-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-macros-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-source-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-syms-4.4.121-92.175.2 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222077-1/ https://www.suse.com/security/cve/CVE-2022-21180.html CVE-2022-21180 https://bugzilla.suse.com/1199650 SUSE Bug 1199650 https://bugzilla.suse.com/1200549 SUSE Bug 1200549 https://bugzilla.suse.com/1212313 SUSE Bug 1212313 KGDB and KDB allow read and write access to kernel memory, and thus should be restricted during lockdown. An attacker with access to a serial port could trigger the debugger so it is important that the debugger respect the lockdown mode when/if it is triggered. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). CVE-2022-21499 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-base-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-devel-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-devel-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-macros-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-source-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-syms-4.4.121-92.175.2 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222077-1/ https://www.suse.com/security/cve/CVE-2022-21499.html CVE-2022-21499 https://bugzilla.suse.com/1199426 SUSE Bug 1199426 https://bugzilla.suse.com/1200059 SUSE Bug 1200059 https://bugzilla.suse.com/1203034 SUSE Bug 1203034 https://bugzilla.suse.com/1204132 SUSE Bug 1204132 https://bugzilla.suse.com/1212315 SUSE Bug 1212315 usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c in the Linux kernel through 5.17.1 has a double free. CVE-2022-28388 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-base-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-devel-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-devel-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-macros-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-source-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-syms-4.4.121-92.175.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222077-1/ https://www.suse.com/security/cve/CVE-2022-28388.html CVE-2022-28388 https://bugzilla.suse.com/1198032 SUSE Bug 1198032 ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c in the Linux kernel through 5.17.1 has a double free. CVE-2022-28390 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-base-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-devel-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-devel-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-macros-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-source-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-syms-4.4.121-92.175.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222077-1/ https://www.suse.com/security/cve/CVE-2022-28390.html CVE-2022-28390 https://bugzilla.suse.com/1198031 SUSE Bug 1198031 https://bugzilla.suse.com/1201517 SUSE Bug 1201517 https://bugzilla.suse.com/1207969 SUSE Bug 1207969 The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows attackers to bypass intended restrictions on setting the PT_SUSPEND_SECCOMP flag. CVE-2022-30594 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-base-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-devel-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-devel-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-macros-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-source-4.4.121-92.175.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-syms-4.4.121-92.175.2 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222077-1/ https://www.suse.com/security/cve/CVE-2022-30594.html CVE-2022-30594 https://bugzilla.suse.com/1199505 SUSE Bug 1199505 https://bugzilla.suse.com/1199602 SUSE Bug 1199602 https://bugzilla.suse.com/1201549 SUSE Bug 1201549 https://bugzilla.suse.com/1204132 SUSE Bug 1204132