File _patchinfo of Package patchinfo.24973

Overview Repositories Revisions Requests Users Attributes Meta

File _patchinfo of Package patchinfo.24973

<patchinfo incident="24973">
  <issue id="1194013" tracker="bnc">VUL-0: CVE-2021-4157: kernel-source-azure,kernel-source-rt,kernel-source: Buffer overwrite in decode_nfs_fh function</issue>
  <issue id="1195775" tracker="bnc">apparmor fails to build with 5.16.7</issue>
  <issue id="1196901" tracker="bnc">VUL-0: CVE-2022-23960,CVE-2022-0001,CVE-2022-0002,CVE-2021-26341,CVE-2021-26401: xen: Multiple speculative security issues (XSA-398)</issue>
  <issue id="1197362" tracker="bnc">L3: RIP: 0010:update_writeback_rate+0x1d0/0x310 [bcache]</issue>
  <issue id="1199487" tracker="bnc">VUL-0: CVE-2022-1679: kernel-source,kernel-source-rt,kernel-source-azure: kernel: Use-After-Free in ath9k_htc_probe_device() could cause an escalation of privileges</issue>
  <issue id="1199489" tracker="bnc">vmxnet3: update to latest ToT</issue>
  <issue id="1199657" tracker="bnc">VUL-0: EMBARGOED: CVE-2022-29900 CVE-2022-29901: kernel: RETBLEED speculative issue</issue>
  <issue id="1200263" tracker="bnc">Partner-L3: I/O request allocation is stuck for more than 120 seconds</issue>
  <issue id="1200442" tracker="bnc">kernel-install-tools should be recommended by all kernel-source flavors</issue>
  <issue id="1200571" tracker="bnc">execve() incorrectly handles empty argv array</issue>
  <issue id="1200599" tracker="bnc">VUL-0: CVE-2022-20154: kernel-source,kernel-source-rt,kernel-source-azure: race condition leading to use-after-free in lock_sock_nested</issue>
  <issue id="1200604" tracker="bnc">VUL-0: CVE-2022-20141: kernel-source-azure,kernel-source,kernel-source-rt: use after free in ip_check_mc_rcu()</issue>
  <issue id="1200605" tracker="bnc">VUL-0: CVE-2022-20141: kernel live patch: use after free in ip_check_mc_rcu()</issue>
  <issue id="1200608" tracker="bnc">VUL-0: CVE-2022-20154: kernel live patch: race condition leading to use-after-free in lock_sock_nested</issue>
  <issue id="1200619" tracker="bnc">VUL-0: CVE-2022-20132: kernel-source-rt,kernel-source-azure,kernel-source: several potential out of bounds reads via malicious HID device</issue>
  <issue id="1201050" tracker="bnc">VUL-0: CVE-2021-26341: kernel: straight line speculation on x86</issue>
  <issue id="1201080" tracker="bnc">VUL-0: CVE-2022-1679: kernel live patch: kernel: Use-After-Free in ath9k_htc_probe_device() could cause an escalation of privileges</issue>
  <issue id="2022-29900" tracker="cve" />
  <issue id="2022-29901" tracker="cve" />
  <issue id="2021-26341" tracker="cve" />
  <issue id="2022-20154" tracker="cve" />
  <issue id="2022-1679" tracker="cve" />
  <issue id="2021-4157" tracker="cve" />
  <issue id="2022-20132" tracker="cve" />
  <issue id="2022-20141" tracker="cve" />
  <issue id="1200692" tracker="bnc">VUL-0: CVE-2022-33981: kernel-source-rt,kernel-source-azure,kernel-source: use-after-free in floppy driver</issue>
  <issue id="2022-33981" tracker="cve" />
  <category>security</category>
  <rating>important</rating>
  <packager>alix82</packager>
  <reboot_needed/>
<retracted/>
  <description>The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security and bugfixes.

NOTE: This update was retracted due to regressions with the RETBLEED security fixes on Intel x86.

The following security bugs were fixed:

- CVE-2022-29900, CVE-2022-29901: Fixed the RETBLEED attack, a new Spectre like Branch Target Buffer attack, that can leak arbitrary kernel information (bsc#1199657).
- CVE-2022-1679: Fixed a use-after-free in the Atheros wireless driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages (bsc#1199487).
- CVE-2022-20132: Fixed out of bounds read due to improper input validation in lg_probe and related functions of hid-lg.c (bsc#1200619).
- CVE-2022-33981: Fixed use-after-free in floppy driver (bsc#1200692)
- CVE-2022-20141: Fixed a possible use after free due to improper locking in ip_check_mc_rcu() (bsc#1200604).
- CVE-2021-4157: Fixed an out of memory bounds write flaw in the NFS subsystem, related to the replication of files with NFS. A user could potentially crash the system or escalate privileges on the system (bsc#1194013).
- CVE-2022-20154: Fixed a use after free due to a race condition in lock_sock_nested of sock.c. This could lead to local escalation of privilege with System execution privileges needed (bsc#1200599).
- CVE-2021-26341: Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage (bsc#1201050).

The following non-security bugs were fixed:

- bcache: avoid unnecessary soft lockup in kworker update_writeback_rate() (bsc#1197362).
- blk-mq: Fix wrong wakeup batch configuration which will cause hang (bsc#1200263).
- blk-mq: clear active_queues before clearing BLK_MQ_F_TAG_QUEUE_SHARED (bsc#1200263).
- blk-mq: fix tag_get wait task can't be awakened (bsc#1200263).
- exec: Force single empty string when argv is empty (bsc#1200571).
- vmxnet3: fix minimum vectors alloc issue (bsc#1199489).
</description>
<summary>Security update for the Linux Kernel</summary>
</patchinfo>

Places

File _patchinfo of Package patchinfo.24973

Places