🛡️ SUSE-SU-2022:1686-1 — kernel-default (CVE-2022-28748 +12 more)

Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-28748: Fixed memory lead over the network by ax88179_178a devices (bsc#1196018).
• CVE-2022-28356: Fixed a refcount leak bug found in net/llc/af_llc.c (bnc#1197391).
• CVE-2022-1516: Fixed null-ptr-deref caused by x25_disconnect (bsc#1199012).
• CVE-2022-1419: Fixed a concurrency use-after-free in vgem_gem_dumb_create (bsc#1198742).
• CVE-2022-1353: Fixed access controll to kernel memory in the pfkey_register function in net/key/af_key.c (bnc#1198516).
• CVE-2022-1280: Fixed a use-after-free vulnerability in drm_lease_held in drivers/gpu/drm/drm_lease.c (bnc#1197914).
• CVE-2022-1011: Fixed a use-after-free flaw inside the FUSE filesystem in the way a user triggers write(). This flaw allowed a local user to gain unauthorized access to data from the FUSE filesystem, resulting in privilege escalation (bnc#1197343).
• CVE-2021-43389: Fixed an array-index-out-of-bounds flaw in the detach_capi_ctr function in drivers/isdn/capi/kcapi.c (bnc#1191958).
• CVE-2021-38208: Fixed a denial of service (NULL pointer dereference and BUG) by making a getsockname call after a certain type of failure of a bind call (bnc#1187055).
• CVE-2021-20321: Fixed a race condition accessing file object in the OverlayFS subsystem in the way users do rename in specific way with OverlayFS. A local user could have used this flaw to crash the system (bnc#1191647).
• CVE-2021-20292: Fixed object validation prior to performing operations on the object in nouveau_sgdma_create_ttm in Nouveau DRM subsystem (bnc#1183723).
• CVE-2019-20811: Fixed issue in rx_queue_add_kobject() and netdev_queue_add_kobject() in net/core/net-sysfs.c, where a reference count is mishandled (bnc#1172456).
• CVE-2018-7755: Fixed an issue in the fd_locked_ioctl function in drivers/block/floppy.c. The floppy driver will copy a kernel pointer to user memory in response to the FDGETPRM ioctl. An attacker can send the FDGETPRM ioctl and use the obtained kernel pointer to discover the location of kernel code and data and bypass kernel security protections such as KASLR (bnc#1084513).

The following non-security bugs were fixed:

• IB/qib: Fix memory leak in qib_user_sdma_queue_pkts() (git-fixes)
• NFSD: prevent underflow in nfssvc_decode_writeargs() (git-fixes).
• NFSv4: recover from pre-mature loss of openstateid (bsc#1196247).
• NFSv4: Do not try to CLOSE if the stateid 'other' field has changed (bsc#1196247).
• NFSv4: Fix a regression in nfs_set_open_stateid_locked() (bsc#1196247).
• NFSv4: Handle NFS4ERR_OLD_STATEID in CLOSE/OPEN_DOWNGRADE (bsc#1196247).
• NFSv4: Wait for stateid updates after CLOSE/OPEN_DOWNGRADE (bsc#1196247).
• NFSv4: fix open failure with O_ACCMODE flag (git-fixes).
• PCI/switchtec: Read all 64 bits of part_event_bitmap (git-fixes).
• PCI: Add device even if driver attach failed (git-fixes).
• PCI: Fix overflow in command-line resource alignment requests (git-fixes).
• PCI: iproc: Fix out-of-bound array accesses (git-fixes).
• PCI: iproc: Set affinity mask on MSI interrupts (git-fixes).
• PCI: qcom: Change duplicate PCI reset to phy reset (git-fixes).
• PCI: qcom: Make sure PCIe is reset before init for rev 2.1.0 (git-fixes).
• RDMA/rxe: Missing unlock on error in get_srq_wqe() (git-fixes)
• RDMA/rxe: Restore setting tot_len in the IPv4 header (git-fixes)
• RDMA/rxe: Use the correct size of wqe when processing SRQ (git-fixes)
• SUNRPC: Handle low memory situations in call_status() (git-fixes).
• USB: Fix 'slab-out-of-bounds Write' bug in usb_hcd_poll_rh_status (git-fixes).
• USB: core: Fix bug in resuming hub's handling of wakeup requests (git-fixes).
• USB: serial: cp210x: add NCR Retail IO box id (git-fixes).
• USB: serial: pl2303: add IBM device IDs (git-fixes).
• USB: serial: simple: add Nokia phone driver (git-fixes).
• USB: usb-storage: Fix use of bitfields for hardware data in ene_ub6250.c (git-fixes).
• arm64: cmpxchg: Use 'K' instead of 'L' for ll/sc immediate constraint (git-fixes)
• arm64: compat: Provide definition for COMPAT_SIGMINSTKSZ (git-fixes)
• arm64: drop linker script hack to hide __efistub_ symbols (git-fixes)
• arm64: fix for bad_mode() handler to always result in panic (git-fixes)
• arm64: hibernate: Clean the __hyp_text to PoC after resume (git-fixes)
• arm64: hyp-stub: Forbid kprobing of the hyp-stub (git-fixes)
• arm64: kaslr: ensure randomized quantities are clean also when kaslr (git-fixes)
• arm64: kaslr: ensure randomized quantities are clean to the PoC (git-fixes)
• arm64: kprobe: Always blacklist the KVM world-switch code (git-fixes)
• arm64: only advance singlestep for user instruction traps (git-fixes)
• arm64: relocatable: fix inconsistencies in linker script and options (git-fixes)
• ath10k: fix max antenna gain unit (git-fixes).
• ath6kl: fix control-message timeout (git-fixes).
• ath6kl: fix division by zero in send path (git-fixes