🛡️ SUSE-SU-2024:2381-1 — kernel-rt (CVE-2021-47103 +142 more)

Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47103: net: sock: preserve kabi for sock (bsc#1221010).
• CVE-2021-47191: Fix out-of-bound read in resp_readcap16() (bsc#1222866).
• CVE-2021-47267: usb: fix various gadget panics on 10gbps cabling (bsc#1224993).
• CVE-2021-47270: usb: fix various gadgets null ptr deref on 10gbps cabling (bsc#1224997).
• CVE-2021-47293: net/sched: act_skbmod: Skip non-Ethernet packets (bsc#1224978).
• CVE-2021-47294: netrom: Decrease sock refcount when sock timers expire (bsc#1224977).
• CVE-2021-47297: net: fix uninit-value in caif_seqpkt_sendmsg (bsc#1224976).
• CVE-2021-47309: net: validate lwtstate->data before returning from skb_tunnel_info() (bsc#1224967).
• CVE-2021-47354: drm/sched: Avoid data corruptions (bsc#1225140)
• CVE-2021-47372: net: macb: fix use after free on rmmod (bsc#1225184).
• CVE-2021-47379: blk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd (bsc#1225203).
• CVE-2021-47407: KVM: x86: Handle SRCU initialization failure during page track init (bsc#1225306).
• CVE-2021-47418: net_sched: fix NULL deref in fifo_set_limit() (bsc#1225337).
• CVE-2021-47434: xhci: Fix commad ring abort, write all 64 bits to CRCR register (bsc#1225232).
• CVE-2021-47445: drm/msm: Fix null pointer dereference on pointer edp (bsc#1225261)
• CVE-2021-47518: nfc: fix potential NULL pointer deref in nfc_genl_dump_ses_done (bsc#1225372).
• CVE-2021-47544: tcp: fix page frag corruption on page fault (bsc#1225463).
• CVE-2021-47566: Fix clearing user buffer by properly using clear_user() (bsc#1225514).
• CVE-2021-47571: staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect() (bsc#1225518).
• CVE-2021-47587: net: systemport: Add global locking for descriptor lifecycle (bsc#1226567).
• CVE-2021-47602: mac80211: track only QoS data frames for admission control (bsc#1226554).
• CVE-2021-47609: firmware: arm_scpi: Fix string overflow in SCPI genpd driver (bsc#1226562)
• CVE-2022-48732: drm/nouveau: fix off by one in BIOS boundary checking (bsc#1226716)
• CVE-2022-48733: btrfs: fix use-after-free after failure to create a snapshot (bsc#1226718).
• CVE-2022-48740: selinux: fix double free of cond_list on error paths (bsc#1226699).
• CVE-2022-48743: net: amd-xgbe: Fix skb data length underflow (bsc#1226705).
• CVE-2022-48756: drm/msm/dsi: invalid parameter check in msm_dsi_phy_enable (bsc#1226698)
• CVE-2022-48759: rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev (bsc#1226711).
• CVE-2022-48761: usb: xhci-plat: fix crash when suspend if remote wake enable (bsc#1226701).
• CVE-2022-48772: media: lgdt3306a: Add a check against null-pointer-def (bsc#1226976).
• CVE-2023-24023: Bluetooth: Add more enc key size check (bsc#1218148).
• CVE-2023-52622: ext4: avoid online resizing failures due to oversized flex bg (bsc#1222080).
• CVE-2023-52675: powerpc/imc-pmu: Add a null pointer check in update_events_in_group() (bsc#1224504).
• CVE-2023-52737: btrfs: lock the inode in shared mode before starting fiemap (bsc#1225484).
• CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225487).
• CVE-2023-52754: media: imon: fix access to invalid resource for the second interface (bsc#1225490).
• CVE-2023-52757: Fixed potential deadlock when releasing mids (bsc#1225548).
• CVE-2023-52762: virtio-blk: fix implicit overflow on virtio_max_dma_size (bsc#1225573).
• CVE-2023-52764: media: gspca: cpia1: shift-out-of-bounds in set_flicker (bsc#1225571).
• CVE-2023-52784: bonding: stop the device in bond_setup_by_slave() (bsc#1224946).
• CVE-2023-52832: wifi: mac80211: do not return unset power in ieee80211_get_tx_power() (bsc#1225577).
• CVE-2023-52834: atl1c: Work around the DMA RX overflow issue (bsc#1225599).
• CVE-2023-52835: perf/core: Bail out early if the request AUX area is out of bound (bsc#1225602).
• CVE-2023-52843: llc: verify mac len before reading mac header (bsc#1224951).
• CVE-2023-52845: tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING (bsc#1225585).
• CVE-2023-52855: usb: dwc2: fix possible NULL pointer dereference caused by driver concurrency (bsc#1225583).
• CVE-2023-52881: tcp: do not accept ACK of bytes we never sent (bsc#1225611).
• CVE-2024-26633: ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim() (bsc#1221647).
• CVE-2024-26641: ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv() (bsc#1221654).
• CVE-2024-26679: Fixed read sk->sk_family once in inet_recv_error() (bsc#1222385).
• CVE-2024-26687: Fixed xen/events close evtchn after mapping cleanup (bsc#1222435).
• CVE-2024-26720: mm: Avoid overflows in dirty throttling logic (bsc#1222364).
• CVE-2024-26813: vfio/platform: Create persistent IRQ handlers (bsc#1222809).
• CVE-2024-26863: hsr: Fix uninit-value access in hsr_get_node() (bsc#1223021).
• CVE-2024-26894: ACPI: processor_idle: