Security update for the Linux Kernel SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:4561-1 Final 1 1 2022-12-19T12:23:28Z current 2022-12-19T12:23:28Z 2022-12-19T12:23:28Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for the Linux Kernel The SUSE Linux Enterprise 12 SP2 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2022-3635: Fixed a use-after-free in the tst_timer() of the file drivers/atm/idt77252.c (bsc#1204631). - CVE-2022-3424: Fixed use-after-free in gru_set_context_option(), gru_fault() and gru_handle_user_call_os() that could lead to kernel panic (bsc#1204166). - CVE-2022-41850: Fixed a race condition in roccat_report_event() in drivers/hid/hid-roccat.c (bsc#1203960). - CVE-2022-45934: Fixed a integer wraparound via L2CAP_CONF_REQ packets in l2cap_config_req in net/bluetooth/l2cap_core.c (bsc#1205796). - CVE-2022-3628: Fixed potential buffer overflow in brcmf_fweh_event_worker() in wifi/brcmfmac (bsc#1204868). - CVE-2022-3567: Fixed a to race condition in inet6_stream_ops()/inet6_dgram_ops() (bsc#1204414). - CVE-2022-41858: Fixed a denial of service in sl_tx_timeout() in drivers/net/slip (bsc#1205671). - CVE-2022-43945: Fixed a buffer overflow in the NFSD implementation (bsc#1205128). - CVE-2022-4095: Fixed a use-after-free in rtl8712 driver (bsc#1205514). - CVE-2022-3903: Fixed a denial of service with the Infrared Transceiver USB driver (bsc#1205220). - CVE-2022-2964: Fixed memory corruption issues in ax88179_178a devices (bsc#1202686). - CVE-2021-4037: Fixed function logic vulnerability that allowed local users to create files for the XFS file-system with an unintended group ownership and with group execution and SGID permission bits set (bsc#1198702). - CVE-2022-43750: Fixed vulnerability in usbmon that allowed a user-space client to corrupt the monitor's internal memory (bsc#1204653). - CVE-2020-26541: Enforce the secure boot forbidden signature database (aka dbx) protection mechanism (bsc#1177282). - CVE-2022-3542: Fixed memory leak in bnx2x_tpa_stop() in drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c (bsc#1204402). - CVE-2022-3629: Fixed memory leak in vsock_connect() in net/vmw_vsock/af_vsock.c (bsc#1204635). - CVE-2022-3646: Fixed memory leak in nilfs_attach_log_writer() in fs/nilfs2/segment.c (bsc#1204646). - CVE-2022-3649: Fixed use-after-free in nilfs_new_inode() in fs/nilfs2/inode.c (bsc#1204647). - CVE-2022-3621: Fixed null pointer dereference in nilfs_bmap_lookup_at_level() in fs/nilfs2/inode.c (bsc#1204574). - CVE-2022-3594: Fixed excessive data logging in intr_callback() in drivers/net/usb/r8152.c (bsc#1204479). - CVE-2022-3586: Fixed use-after-free in socket buffer (SKB) that could allow a local unprivileged user to cause a denial of service (bsc#1204439). - CVE-2022-3565: Fixed use-after-free in del_timer() in drivers/isdn/mISDN/l1oip_core.c (bsc#1204431). - CVE-2022-3524: Fixed memory leak in ipv6_renew_options() in the IPv6 handler (bsc#1204354). - CVE-2022-2663: Fixed an issue which allowed a firewall to be bypassed when users are using unencrypted IRC with nf_conntrack_irc configured (bsc#1202097). - CVE-2022-40768: Fixed information leak in the scsi driver which allowed local users to obtain sensitive information from kernel memory (bsc#1203514). - CVE-2022-42703: Fixed use-after-free in mm/rmap.c related to leaf anon_vma double reuse (bsc#1204168). - CVE-2022-3169: Fixed an denial of service though request to NVME_IOCTL_RESET and NVME_IOCTL_SUBSYS_RESET (bsc#1203290). - CVE-2022-40307: Fixed a race condition that could had been exploited to trigger a use-after-free in the efi firmware capsule-loader.c (bsc#1203322). - CVE-2022-41848: Fixed a race condition in drivers/char/pcmcia/synclink_cs.c mgslpc_ioctl and mgslpc_detach (bsc#1203987). The following non-security bugs were fixed: - x86/build/64: Force the linker to use 2MB page size (bnc#1012382, bsc#1206091). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2022-4561,SUSE-SLE-SERVER-12-SP2-BCL-2022-4561 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20224561-1/ Link for SUSE-SU-2022:4561-1 https://lists.suse.com/pipermail/sle-security-updates/2022-December/013272.html E-Mail link for SUSE-SU-2022:4561-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1012382 SUSE Bug 1012382 https://bugzilla.suse.com/1129898 SUSE Bug 1129898 https://bugzilla.suse.com/1177282 SUSE Bug 1177282 https://bugzilla.suse.com/1196018 SUSE Bug 1196018 https://bugzilla.suse.com/1198702 SUSE Bug 1198702 https://bugzilla.suse.com/1202097 SUSE Bug 1202097 https://bugzilla.suse.com/1202686 SUSE Bug 1202686 https://bugzilla.suse.com/1203008 SUSE Bug 1203008 https://bugzilla.suse.com/1203290 SUSE Bug 1203290 https://bugzilla.suse.com/1203322 SUSE Bug 1203322 https://bugzilla.suse.com/1203514 SUSE Bug 1203514 https://bugzilla.suse.com/1203960 SUSE Bug 1203960 https://bugzilla.suse.com/1203987 SUSE Bug 1203987 https://bugzilla.suse.com/1204166 SUSE Bug 1204166 https://bugzilla.suse.com/1204168 SUSE Bug 1204168 https://bugzilla.suse.com/1204170 SUSE Bug 1204170 https://bugzilla.suse.com/1204354 SUSE Bug 1204354 https://bugzilla.suse.com/1204402 SUSE Bug 1204402 https://bugzilla.suse.com/1204414 SUSE Bug 1204414 https://bugzilla.suse.com/1204431 SUSE Bug 1204431 https://bugzilla.suse.com/1204432 SUSE Bug 1204432 https://bugzilla.suse.com/1204439 SUSE Bug 1204439 https://bugzilla.suse.com/1204479 SUSE Bug 1204479 https://bugzilla.suse.com/1204574 SUSE Bug 1204574 https://bugzilla.suse.com/1204576 SUSE Bug 1204576 https://bugzilla.suse.com/1204631 SUSE Bug 1204631 https://bugzilla.suse.com/1204635 SUSE Bug 1204635 https://bugzilla.suse.com/1204636 SUSE Bug 1204636 https://bugzilla.suse.com/1204646 SUSE Bug 1204646 https://bugzilla.suse.com/1204647 SUSE Bug 1204647 https://bugzilla.suse.com/1204653 SUSE Bug 1204653 https://bugzilla.suse.com/1204868 SUSE Bug 1204868 https://bugzilla.suse.com/1205128 SUSE Bug 1205128 https://bugzilla.suse.com/1205130 SUSE Bug 1205130 https://bugzilla.suse.com/1205220 SUSE Bug 1205220 https://bugzilla.suse.com/1205514 SUSE Bug 1205514 https://bugzilla.suse.com/1205671 SUSE Bug 1205671 https://bugzilla.suse.com/1205796 SUSE Bug 1205796 https://bugzilla.suse.com/1206091 SUSE Bug 1206091 https://www.suse.com/security/cve/CVE-2019-3874/ SUSE CVE CVE-2019-3874 page https://www.suse.com/security/cve/CVE-2020-26541/ SUSE CVE CVE-2020-26541 page https://www.suse.com/security/cve/CVE-2021-4037/ SUSE CVE CVE-2021-4037 page https://www.suse.com/security/cve/CVE-2022-2663/ SUSE CVE CVE-2022-2663 page https://www.suse.com/security/cve/CVE-2022-28748/ SUSE CVE CVE-2022-28748 page https://www.suse.com/security/cve/CVE-2022-2964/ SUSE CVE CVE-2022-2964 page https://www.suse.com/security/cve/CVE-2022-3169/ SUSE CVE CVE-2022-3169 page https://www.suse.com/security/cve/CVE-2022-3424/ SUSE CVE CVE-2022-3424 page https://www.suse.com/security/cve/CVE-2022-3524/ SUSE CVE CVE-2022-3524 page https://www.suse.com/security/cve/CVE-2022-3542/ SUSE CVE CVE-2022-3542 page https://www.suse.com/security/cve/CVE-2022-3565/ SUSE CVE CVE-2022-3565 page https://www.suse.com/security/cve/CVE-2022-3567/ SUSE CVE CVE-2022-3567 page https://www.suse.com/security/cve/CVE-2022-3586/ SUSE CVE CVE-2022-3586 page https://www.suse.com/security/cve/CVE-2022-3594/ SUSE CVE CVE-2022-3594 page https://www.suse.com/security/cve/CVE-2022-3621/ SUSE CVE CVE-2022-3621 page https://www.suse.com/security/cve/CVE-2022-3628/ SUSE CVE CVE-2022-3628 page https://www.suse.com/security/cve/CVE-2022-3629/ SUSE CVE CVE-2022-3629 page https://www.suse.com/security/cve/CVE-2022-3635/ SUSE CVE CVE-2022-3635 page https://www.suse.com/security/cve/CVE-2022-3646/ SUSE CVE CVE-2022-3646 page https://www.suse.com/security/cve/CVE-2022-3649/ SUSE CVE CVE-2022-3649 page https://www.suse.com/security/cve/CVE-2022-3903/ SUSE CVE CVE-2022-3903 page https://www.suse.com/security/cve/CVE-2022-40307/ SUSE CVE CVE-2022-40307 page https://www.suse.com/security/cve/CVE-2022-40768/ SUSE CVE CVE-2022-40768 page https://www.suse.com/security/cve/CVE-2022-4095/ SUSE CVE CVE-2022-4095 page https://www.suse.com/security/cve/CVE-2022-41848/ SUSE CVE CVE-2022-41848 page https://www.suse.com/security/cve/CVE-2022-41850/ SUSE CVE CVE-2022-41850 page https://www.suse.com/security/cve/CVE-2022-41858/ SUSE CVE CVE-2022-41858 page https://www.suse.com/security/cve/CVE-2022-42703/ SUSE CVE CVE-2022-42703 page https://www.suse.com/security/cve/CVE-2022-43750/ SUSE CVE CVE-2022-43750 page https://www.suse.com/security/cve/CVE-2022-43945/ SUSE CVE CVE-2022-43945 page https://www.suse.com/security/cve/CVE-2022-45934/ SUSE CVE CVE-2022-45934 page SUSE Linux Enterprise Server 12 SP2-BCL cluster-md-kmp-debug-4.4.121-92.196.1 cluster-md-kmp-default-4.4.121-92.196.2 cluster-md-kmp-vanilla-4.4.121-92.196.2 cluster-network-kmp-debug-4.4.121-92.196.1 cluster-network-kmp-default-4.4.121-92.196.2 cluster-network-kmp-vanilla-4.4.121-92.196.2 dlm-kmp-debug-4.4.121-92.196.1 dlm-kmp-default-4.4.121-92.196.2 dlm-kmp-vanilla-4.4.121-92.196.2 gfs2-kmp-debug-4.4.121-92.196.1 gfs2-kmp-default-4.4.121-92.196.2 gfs2-kmp-vanilla-4.4.121-92.196.2 kernel-debug-4.4.121-92.196.1 kernel-debug-base-4.4.121-92.196.1 kernel-debug-devel-4.4.121-92.196.1 kernel-debug-extra-4.4.121-92.196.1 kernel-debug-kgraft-4.4.121-92.196.1 kernel-default-4.4.121-92.196.2 kernel-default-base-4.4.121-92.196.2 kernel-default-devel-4.4.121-92.196.2 kernel-default-extra-4.4.121-92.196.2 kernel-default-kgraft-4.4.121-92.196.2 kernel-default-man-4.4.121-92.196.2 kernel-devel-4.4.121-92.196.2 kernel-docs-4.4.121-92.196.2 kernel-docs-html-4.4.121-92.196.2 kernel-docs-pdf-4.4.121-92.196.2 kernel-macros-4.4.121-92.196.2 kernel-obs-build-4.4.121-92.196.2 kernel-obs-qa-4.4.121-92.196.2 kernel-source-4.4.121-92.196.2 kernel-source-vanilla-4.4.121-92.196.2 kernel-syms-4.4.121-92.196.2 kernel-vanilla-4.4.121-92.196.2 kernel-vanilla-base-4.4.121-92.196.2 kernel-vanilla-devel-4.4.121-92.196.2 kernel-zfcpdump-4.4.121-92.196.2 ocfs2-kmp-debug-4.4.121-92.196.1 ocfs2-kmp-default-4.4.121-92.196.2 ocfs2-kmp-vanilla-4.4.121-92.196.2 kernel-default-4.4.121-92.196.2 as a component of SUSE Linux Enterprise Server 12 SP2-BCL kernel-default-base-4.4.121-92.196.2 as a component of SUSE Linux Enterprise Server 12 SP2-BCL kernel-default-devel-4.4.121-92.196.2 as a component of SUSE Linux Enterprise Server 12 SP2-BCL kernel-devel-4.4.121-92.196.2 as a component of SUSE Linux Enterprise Server 12 SP2-BCL kernel-macros-4.4.121-92.196.2 as a component of SUSE Linux Enterprise Server 12 SP2-BCL kernel-source-4.4.121-92.196.2 as a component of SUSE Linux Enterprise Server 12 SP2-BCL kernel-syms-4.4.121-92.196.2 as a component of SUSE Linux Enterprise Server 12 SP2-BCL The SCTP socket buffer used by a userspace application is not accounted by the cgroups subsystem. An attacker can use this flaw to cause a denial of service attack. Kernel 3.10.x and 4.18.x branches are believed to be vulnerable. CVE-2019-3874 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-base-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-devel-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-devel-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-macros-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-source-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-syms-4.4.121-92.196.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20224561-1/ https://www.suse.com/security/cve/CVE-2019-3874.html CVE-2019-3874 https://bugzilla.suse.com/1129898 SUSE Bug 1129898 The Linux kernel through 5.8.13 does not properly enforce the Secure Boot Forbidden Signature Database (aka dbx) protection mechanism. This affects certs/blacklist.c and certs/system_keyring.c. CVE-2020-26541 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-base-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-devel-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-devel-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-macros-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-source-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-syms-4.4.121-92.196.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20224561-1/ https://www.suse.com/security/cve/CVE-2020-26541.html CVE-2020-26541 https://bugzilla.suse.com/1177282 SUSE Bug 1177282 A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that allows local users to create files for the XFS file-system with an unintended group ownership and with group execution and SGID permission bits set, in a scenario where a directory is SGID and belongs to a certain group and is writable by a user who is not a member of this group. This can lead to excessive permissions granted in case when they should not. This vulnerability is similar to the previous CVE-2018-13405 and adds the missed fix for the XFS. CVE-2021-4037 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-base-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-devel-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-devel-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-macros-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-source-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-syms-4.4.121-92.196.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20224561-1/ https://www.suse.com/security/cve/CVE-2021-4037.html CVE-2021-4037 https://bugzilla.suse.com/1198702 SUSE Bug 1198702 An issue was found in the Linux kernel in nf_conntrack_irc where the message handling can be confused and incorrectly matches the message. A firewall may be able to be bypassed when users are using unencrypted IRC with nf_conntrack_irc configured. CVE-2022-2663 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-base-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-devel-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-devel-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-macros-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-source-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-syms-4.4.121-92.196.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20224561-1/ https://www.suse.com/security/cve/CVE-2022-2663.html CVE-2022-2663 https://bugzilla.suse.com/1202097 SUSE Bug 1202097 https://bugzilla.suse.com/1212299 SUSE Bug 1212299 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-2964. Reason: This candidate is a reservation duplicate of CVE-2022-2964. Notes: All CVE users should reference CVE-2022-2964 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. CVE-2022-28748 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-base-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-devel-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-devel-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-macros-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-source-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-syms-4.4.121-92.196.2 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20224561-1/ https://www.suse.com/security/cve/CVE-2022-28748.html CVE-2022-28748 https://bugzilla.suse.com/1196018 SUSE Bug 1196018 A flaw was found in the Linux kernel’s driver for the ASIX AX88179_178A-based USB 2.0/3.0 Gigabit Ethernet Devices. The vulnerability contains multiple out-of-bounds reads and possible out-of-bounds writes. CVE-2022-2964 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-base-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-devel-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-devel-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-macros-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-source-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-syms-4.4.121-92.196.2 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20224561-1/ https://www.suse.com/security/cve/CVE-2022-2964.html CVE-2022-2964 https://bugzilla.suse.com/1202686 SUSE Bug 1202686 https://bugzilla.suse.com/1203008 SUSE Bug 1203008 https://bugzilla.suse.com/1208044 SUSE Bug 1208044 A flaw was found in the Linux kernel. A denial of service flaw may occur if there is a consecutive request of the NVME_IOCTL_RESET and the NVME_IOCTL_SUBSYS_RESET through the device file of the driver, resulting in a PCIe link disconnect. CVE-2022-3169 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-base-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-devel-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-devel-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-macros-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-source-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-syms-4.4.121-92.196.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20224561-1/ https://www.suse.com/security/cve/CVE-2022-3169.html CVE-2022-3169 https://bugzilla.suse.com/1203290 SUSE Bug 1203290 A use-after-free flaw was found in the Linux kernel’s SGI GRU driver in the way the first gru_file_unlocked_ioctl function is called by the user, where a fail pass occurs in the gru_check_chiplet_assignment function. This flaw allows a local user to crash or potentially escalate their privileges on the system. CVE-2022-3424 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-base-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-devel-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-devel-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-macros-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-source-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-syms-4.4.121-92.196.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20224561-1/ https://www.suse.com/security/cve/CVE-2022-3424.html CVE-2022-3424 https://bugzilla.suse.com/1204166 SUSE Bug 1204166 https://bugzilla.suse.com/1204167 SUSE Bug 1204167 https://bugzilla.suse.com/1208044 SUSE Bug 1208044 https://bugzilla.suse.com/1212309 SUSE Bug 1212309 A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this vulnerability is the function ipv6_renew_options of the component IPv6 Handler. The manipulation leads to memory leak. The attack can be launched remotely. It is recommended to apply a patch to fix this issue. The identifier VDB-211021 was assigned to this vulnerability. CVE-2022-3524 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-base-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-devel-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-devel-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-macros-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-source-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-syms-4.4.121-92.196.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20224561-1/ https://www.suse.com/security/cve/CVE-2022-3524.html CVE-2022-3524 https://bugzilla.suse.com/1204354 SUSE Bug 1204354 https://bugzilla.suse.com/1212320 SUSE Bug 1212320 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none. CVE-2022-3542 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-base-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-devel-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-devel-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-macros-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-source-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-syms-4.4.121-92.196.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20224561-1/ https://www.suse.com/security/cve/CVE-2022-3542.html CVE-2022-3542 https://bugzilla.suse.com/1204402 SUSE Bug 1204402 A vulnerability, which was classified as critical, has been found in Linux Kernel. Affected by this issue is the function del_timer of the file drivers/isdn/mISDN/l1oip_core.c of the component Bluetooth. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211088. CVE-2022-3565 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-base-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-devel-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-devel-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-macros-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-source-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-syms-4.4.121-92.196.2 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20224561-1/ https://www.suse.com/security/cve/CVE-2022-3565.html CVE-2022-3565 https://bugzilla.suse.com/1204431 SUSE Bug 1204431 https://bugzilla.suse.com/1204432 SUSE Bug 1204432 https://bugzilla.suse.com/1208044 SUSE Bug 1208044 https://bugzilla.suse.com/1212323 SUSE Bug 1212323 A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects the function inet6_stream_ops/inet6_dgram_ops of the component IPv6 Handler. The manipulation leads to race condition. It is recommended to apply a patch to fix this issue. VDB-211090 is the identifier assigned to this vulnerability. CVE-2022-3567 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-base-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-devel-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-devel-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-macros-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-source-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-syms-4.4.121-92.196.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20224561-1/ https://www.suse.com/security/cve/CVE-2022-3567.html CVE-2022-3567 https://bugzilla.suse.com/1204414 SUSE Bug 1204414 A flaw was found in the Linux kernel’s networking code. A use-after-free was found in the way the sch_sfb enqueue function used the socket buffer (SKB) cb field after the same SKB had been enqueued (and freed) into a child qdisc. This flaw allows a local, unprivileged user to crash the system, causing a denial of service. CVE-2022-3586 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-base-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-devel-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-devel-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-macros-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-source-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-syms-4.4.121-92.196.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20224561-1/ https://www.suse.com/security/cve/CVE-2022-3586.html CVE-2022-3586 https://bugzilla.suse.com/1204439 SUSE Bug 1204439 https://bugzilla.suse.com/1204576 SUSE Bug 1204576 https://bugzilla.suse.com/1208044 SUSE Bug 1208044 https://bugzilla.suse.com/1209225 SUSE Bug 1209225 https://bugzilla.suse.com/1212294 SUSE Bug 1212294 A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this vulnerability is the function intr_callback of the file drivers/net/usb/r8152.c of the component BPF. The manipulation leads to logging of excessive data. The attack can be launched remotely. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211363. CVE-2022-3594 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-base-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-devel-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-devel-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-macros-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-source-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-syms-4.4.121-92.196.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20224561-1/ https://www.suse.com/security/cve/CVE-2022-3594.html CVE-2022-3594 https://bugzilla.suse.com/1204479 SUSE Bug 1204479 A vulnerability was found in Linux Kernel. It has been classified as problematic. Affected is the function nilfs_bmap_lookup_at_level of the file fs/nilfs2/inode.c of the component nilfs2. The manipulation leads to null pointer dereference. It is possible to launch the attack remotely. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211920. CVE-2022-3621 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-base-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-devel-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-devel-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-macros-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-source-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-syms-4.4.121-92.196.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20224561-1/ https://www.suse.com/security/cve/CVE-2022-3621.html CVE-2022-3621 https://bugzilla.suse.com/1204574 SUSE Bug 1204574 https://bugzilla.suse.com/1212295 SUSE Bug 1212295 A buffer overflow flaw was found in the Linux kernel Broadcom Full MAC Wi-Fi driver. This issue occurs when a user connects to a malicious USB device. This can allow a local user to crash the system or escalate their privileges. CVE-2022-3628 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-base-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-devel-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-devel-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-macros-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-source-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-syms-4.4.121-92.196.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20224561-1/ https://www.suse.com/security/cve/CVE-2022-3628.html CVE-2022-3628 https://bugzilla.suse.com/1204868 SUSE Bug 1204868 A vulnerability was found in Linux Kernel. It has been declared as problematic. This vulnerability affects the function vsock_connect of the file net/vmw_vsock/af_vsock.c. The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. VDB-211930 is the identifier assigned to this vulnerability. CVE-2022-3629 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-base-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-devel-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-devel-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-macros-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-source-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-syms-4.4.121-92.196.2 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20224561-1/ https://www.suse.com/security/cve/CVE-2022-3629.html CVE-2022-3629 https://bugzilla.suse.com/1204635 SUSE Bug 1204635 A vulnerability, which was classified as critical, has been found in Linux Kernel. Affected by this issue is the function tst_timer of the file drivers/atm/idt77252.c of the component IPsec. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. VDB-211934 is the identifier assigned to this vulnerability. CVE-2022-3635 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-base-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-devel-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-devel-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-macros-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-source-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-syms-4.4.121-92.196.2 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20224561-1/ https://www.suse.com/security/cve/CVE-2022-3635.html CVE-2022-3635 https://bugzilla.suse.com/1204631 SUSE Bug 1204631 https://bugzilla.suse.com/1204636 SUSE Bug 1204636 https://bugzilla.suse.com/1208044 SUSE Bug 1208044 https://bugzilla.suse.com/1212289 SUSE Bug 1212289 A vulnerability, which was classified as problematic, has been found in Linux Kernel. This issue affects the function nilfs_attach_log_writer of the file fs/nilfs2/segment.c of the component BPF. The manipulation leads to memory leak. The attack may be initiated remotely. It is recommended to apply a patch to fix this issue. The identifier VDB-211961 was assigned to this vulnerability. CVE-2022-3646 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-base-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-devel-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-devel-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-macros-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-source-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-syms-4.4.121-92.196.2 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20224561-1/ https://www.suse.com/security/cve/CVE-2022-3646.html CVE-2022-3646 https://bugzilla.suse.com/1204646 SUSE Bug 1204646 A vulnerability was found in Linux Kernel. It has been classified as problematic. Affected is the function nilfs_new_inode of the file fs/nilfs2/inode.c of the component BPF. The manipulation leads to use after free. It is possible to launch the attack remotely. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211992. CVE-2022-3649 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-base-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-devel-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-devel-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-macros-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-source-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-syms-4.4.121-92.196.2 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20224561-1/ https://www.suse.com/security/cve/CVE-2022-3649.html CVE-2022-3649 https://bugzilla.suse.com/1204647 SUSE Bug 1204647 https://bugzilla.suse.com/1212318 SUSE Bug 1212318 An incorrect read request flaw was found in the Infrared Transceiver USB driver in the Linux kernel. This issue occurs when a user attaches a malicious USB device. A local user could use this flaw to starve the resources, causing denial of service or potentially crashing the system. CVE-2022-3903 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-base-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-devel-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-devel-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-macros-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-source-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-syms-4.4.121-92.196.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20224561-1/ https://www.suse.com/security/cve/CVE-2022-3903.html CVE-2022-3903 https://bugzilla.suse.com/1205220 SUSE Bug 1205220 https://bugzilla.suse.com/1212297 SUSE Bug 1212297 An issue was discovered in the Linux kernel through 5.19.8. drivers/firmware/efi/capsule-loader.c has a race condition with a resultant use-after-free. CVE-2022-40307 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-base-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-devel-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-devel-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-macros-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-source-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-syms-4.4.121-92.196.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20224561-1/ https://www.suse.com/security/cve/CVE-2022-40307.html CVE-2022-40307 https://bugzilla.suse.com/1203322 SUSE Bug 1203322 drivers/scsi/stex.c in the Linux kernel through 5.19.9 allows local users to obtain sensitive information from kernel memory because stex_queuecommand_lck lacks a memset for the PASSTHRU_CMD case. CVE-2022-40768 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-base-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-devel-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-devel-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-macros-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-source-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-syms-4.4.121-92.196.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20224561-1/ https://www.suse.com/security/cve/CVE-2022-40768.html CVE-2022-40768 https://bugzilla.suse.com/1203514 SUSE Bug 1203514 A use-after-free flaw was found in Linux kernel before 5.19.2. This issue occurs in cmd_hdl_filter in drivers/staging/rtl8712/rtl8712_cmd.c, allowing an attacker to launch a local denial of service attack and gain escalation of privileges. CVE-2022-4095 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-base-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-devel-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-devel-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-macros-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-source-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-syms-4.4.121-92.196.2 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20224561-1/ https://www.suse.com/security/cve/CVE-2022-4095.html CVE-2022-4095 https://bugzilla.suse.com/1205514 SUSE Bug 1205514 https://bugzilla.suse.com/1205594 SUSE Bug 1205594 https://bugzilla.suse.com/1208030 SUSE Bug 1208030 https://bugzilla.suse.com/1208085 SUSE Bug 1208085 https://bugzilla.suse.com/1212319 SUSE Bug 1212319 drivers/char/pcmcia/synclink_cs.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free if a physically proximate attacker removes a PCMCIA device while calling ioctl, aka a race condition between mgslpc_ioctl and mgslpc_detach. CVE-2022-41848 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-base-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-devel-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-devel-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-macros-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-source-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-syms-4.4.121-92.196.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20224561-1/ https://www.suse.com/security/cve/CVE-2022-41848.html CVE-2022-41848 https://bugzilla.suse.com/1203987 SUSE Bug 1203987 https://bugzilla.suse.com/1211484 SUSE Bug 1211484 https://bugzilla.suse.com/1212317 SUSE Bug 1212317 roccat_report_event in drivers/hid/hid-roccat.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free in certain situations where a report is received while copying a report->value is in progress. CVE-2022-41850 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-base-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-devel-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-devel-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-macros-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-source-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-syms-4.4.121-92.196.2 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20224561-1/ https://www.suse.com/security/cve/CVE-2022-41850.html CVE-2022-41850 https://bugzilla.suse.com/1203960 SUSE Bug 1203960 https://bugzilla.suse.com/1212314 SUSE Bug 1212314 A flaw was found in the Linux kernel. A NULL pointer dereference may occur while a slip driver is in progress to detach in sl_tx_timeout in drivers/net/slip/slip.c. This issue could allow an attacker to crash the system or leak internal kernel information. CVE-2022-41858 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-base-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-devel-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-devel-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-macros-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-source-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-syms-4.4.121-92.196.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20224561-1/ https://www.suse.com/security/cve/CVE-2022-41858.html CVE-2022-41858 https://bugzilla.suse.com/1205671 SUSE Bug 1205671 https://bugzilla.suse.com/1211484 SUSE Bug 1211484 https://bugzilla.suse.com/1212300 SUSE Bug 1212300 mm/rmap.c in the Linux kernel before 5.19.7 has a use-after-free related to leaf anon_vma double reuse. CVE-2022-42703 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-base-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-devel-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-devel-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-macros-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-source-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-syms-4.4.121-92.196.2 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20224561-1/ https://www.suse.com/security/cve/CVE-2022-42703.html CVE-2022-42703 https://bugzilla.suse.com/1204168 SUSE Bug 1204168 https://bugzilla.suse.com/1204170 SUSE Bug 1204170 https://bugzilla.suse.com/1206463 SUSE Bug 1206463 https://bugzilla.suse.com/1208044 SUSE Bug 1208044 https://bugzilla.suse.com/1209225 SUSE Bug 1209225 drivers/usb/mon/mon_bin.c in usbmon in the Linux kernel before 5.19.15 and 6.x before 6.0.1 allows a user-space client to corrupt the monitor's internal memory. CVE-2022-43750 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-base-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-devel-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-devel-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-macros-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-source-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-syms-4.4.121-92.196.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20224561-1/ https://www.suse.com/security/cve/CVE-2022-43750.html CVE-2022-43750 https://bugzilla.suse.com/1204653 SUSE Bug 1204653 https://bugzilla.suse.com/1211484 SUSE Bug 1211484 The Linux kernel NFSD implementation prior to versions 5.19.17 and 6.0.2 are vulnerable to buffer overflow. NFSD tracks the number of pages held by each NFSD thread by combining the receive and send buffers of a remote procedure call (RPC) into a single array of pages. A client can force the send buffer to shrink by sending an RPC message over TCP with garbage data added at the end of the message. The RPC message with garbage data is still correctly formed according to the specification and is passed forward to handlers. Vulnerable code in NFSD is not expecting the oversized request and writes beyond the allocated buffer space. CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-43945 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-base-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-devel-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-devel-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-macros-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-source-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-syms-4.4.121-92.196.2 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20224561-1/ https://www.suse.com/security/cve/CVE-2022-43945.html CVE-2022-43945 https://bugzilla.suse.com/1205128 SUSE Bug 1205128 https://bugzilla.suse.com/1205130 SUSE Bug 1205130 https://bugzilla.suse.com/1208030 SUSE Bug 1208030 https://bugzilla.suse.com/1208085 SUSE Bug 1208085 https://bugzilla.suse.com/1209225 SUSE Bug 1209225 https://bugzilla.suse.com/1210124 SUSE Bug 1210124 An issue was discovered in the Linux kernel through 6.0.10. l2cap_config_req in net/bluetooth/l2cap_core.c has an integer wraparound via L2CAP_CONF_REQ packets. CVE-2022-45934 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-base-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-devel-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-devel-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-macros-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-source-4.4.121-92.196.2 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-syms-4.4.121-92.196.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20224561-1/ https://www.suse.com/security/cve/CVE-2022-45934.html CVE-2022-45934 https://bugzilla.suse.com/1205796 SUSE Bug 1205796 https://bugzilla.suse.com/1212292 SUSE Bug 1212292