SUSE-SU-2022:4614-1

The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-4378: Fixed stack overflow in _doproc_dointvec (bsc#1206207).
• CVE-2022-3635: Fixed a use-after-free in the tst_timer() of the file drivers/atm/idt77252.c (bsc#1204631).
• CVE-2022-41850: Fixed a race condition in roccatreportevent() in drivers/hid/hid-roccat.c (bsc#1203960).
• CVE-2022-45934: Fixed a integer wraparound via L2CAPCONFREQ packets in l2capconfigreq in net/bluetooth/l2cap_core.c (bsc#1205796).
• CVE-2022-3628: Fixed potential buffer overflow in brcmffwehevent_worker() in wifi/brcmfmac (bsc#1204868).
• CVE-2022-3567: Fixed a to race condition in inet6streamops()/inet6dgramops() (bsc#1204414).
• CVE-2022-41858: Fixed a denial of service in sltxtimeout() in drivers/net/slip (bsc#1205671).
• CVE-2022-43945: Fixed a buffer overflow in the NFSD implementation (bsc#1205128).
• CVE-2022-4095: Fixed a use-after-free in rtl8712 driver (bsc#1205514).
• CVE-2022-3903: Fixed a denial of service with the Infrared Transceiver USB driver (bsc#1205220).
• CVE-2022-42895: Fixed an information leak in the net/bluetooth/l2capcore.c's l2capparseconfreq() which can be used to leak kernel pointers remotely (bsc#1205705).
• CVE-2022-42896: Fixed a use-after-free vulnerability in the net/bluetooth/l2capcore.c's l2capconnect() and l2capleconnect_req() which may have allowed code execution and leaking kernel memory (respectively) remotely via Bluetooth (bsc#1205709).
• CVE-2022-2602: Fixed a local privilege escalation vulnerability involving Unix socket Garbage Collection and io_uring (bsc#1204228).
• CVE-2022-4139: Fixed an issue with the i915 driver that allowed the GPU to access any physical memory (bsc#1205700).
• CVE-2022-4129: Fixed a denial of service with the Layer 2 Tunneling Protocol (L2TP). A missing lock when clearing skuserdata can lead to a race condition and NULL pointer dereference. (bsc#1205711)
• CVE-2022-3707: Fixed a double free in the Intel GVT-g graphics driver (bsc#1204780).
• CVE-2022-2964: Fixed memory corruption issues in ax88179_178a devices (bsc#1202686).
• CVE-2021-4037: Fixed function logic vulnerability that allowed local users to create files for the XFS file-system with an unintended group ownership and with group execution and SGID permission bits set (bsc#1198702).
• CVE-2022-43750: Fixed vulnerability in usbmon that allowed a user-space client to corrupt the monitor's internal memory (bsc#1204653).
• CVE-2022-3542: Fixed memory leak in bnx2xtpastop() in drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c (bsc#1204402).
• CVE-2022-3629: Fixed memory leak in vsockconnect() in net/vmwvsock/af_vsock.c (bsc#1204635).
• CVE-2022-3646: Fixed memory leak in nilfsattachlog_writer() in fs/nilfs2/segment.c (bsc#1204646).
• CVE-2022-3649: Fixed use-after-free in nilfsnewinode() in fs/nilfs2/inode.c (bsc#1204647).
• CVE-2022-3621: Fixed null pointer dereference in nilfsbmaplookupatlevel() in fs/nilfs2/inode.c (bsc#1204574).
• CVE-2022-3594: Fixed excessive data logging in intr_callback() in drivers/net/usb/r8152.c (bsc#1204479).
• CVE-2022-3586: Fixed use-after-free in socket buffer (SKB) that could allow a local unprivileged user to cause a denial of service (bsc#1204439).
• CVE-2022-3565: Fixed use-after-free in deltimer() in drivers/isdn/mISDN/l1oipcore.c (bsc#1204431).
• CVE-2022-3524: Fixed memory leak in ipv6renewoptions() in the IPv6 handler (bsc#1204354).
• CVE-2022-40768: Fixed information leak in the scsi driver which allowed local users to obtain sensitive information from kernel memory (bsc#1203514).
• CVE-2022-42703: Fixed use-after-free in mm/rmap.c related to leaf anon_vma double reuse (bsc#1204168).
• CVE-2022-3169: Fixed an denial of service though request to NVMEIOCTLRESET and NVMEIOCTLSUBSYS_RESET (bsc#1203290).
• CVE-2022-40307: Fixed a race condition that could had been exploited to trigger a use-after-free in the efi firmware capsule-loader.c (bsc#1203322).
• CVE-2022-3176: Fixed a use-after-free in iouring related to signalfdpoll() and binder_poll() (bsc#1203391).
• CVE-2022-3625: Fixed a user-after-free vulnerability in devlinkparamset/devlinkparamget of the file net/core/devlink.c (bsc#1204637).
• CVE-2022-3535: Fixed a memory leak in mvpp2dbgfsportinit of the file drivers/net/ethernet/marvell/mvpp2/mvpp2debugfs.c (bsc#1204417).
• CVE-2022-3545: Fixed a use-after-free in areacacheget() of the file drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c (bsc#1204415).
• CVE-2022-39189: Fixed an issue were an unprivileged guest users can compromise the guest kernel because TLB flush operations were mishandled in certain KVMVCPUPREEMPTED situations (bsc#1203066).
• CVE-2022-3577: Fixed an out-of-bounds memory write in bigben_probe of drivers/hid/hid-bigbenff.c (bsc#1204470).
• CVE-2022-3521: Fixed a race condition in kcmtxwork() of the file net/kcm/kcmsock.c (bsc#1204355).
• CVE-2022-2153: Fixed a NULL pointer dereference in the KVM subsystem, when attempting to set a SynIC IRQ (bsc#1200788).
• CVE-2022-2978: Fixed a use-after-free in the NILFS file system (bsc#1202700).

The following non-security bugs were fixed:

• Drivers: hv: vmbus: Add VMbus IMC device to unsupported list (git-fixes).
• Drivers: hv: vmbus: Add vmbus_requestor data structure for VMBus hardening (bsc#1204017).
• Drivers: hv: vmbus: Allow cleanup of VMBUSCONNECTCPU if disconnected (bsc#1204017).
• Drivers: hv: vmbus: Always handle the VMBus messages on CPU0 (bsc#1204017).
• Drivers: hv: vmbus: Do not bind the offer&rescind works to a specific CPU (bsc#1204017).
• Drivers: hv: vmbus: Drop error message when 'No request id available' (bsc#1204017).
• Drivers: hv: vmbus: Fix handling of messages with transaction ID of zero (bsc#1204017).
• Drivers: hv: vmbus: Fix potential crash on module unload (git-fixes).
• Drivers: hv: vmbus: Introduce vmbusrequestaddr_match() (bsc#1204017).
• Drivers: hv: vmbus: Introduce vmbussendpacketgetid() (bsc#1204017).
• Drivers: hv: vmbus: Introduce {lock,unlock}_requestor() (bsc#1204017).
• Drivers: hv: vmbus: Move _vmbusopen() (bsc#1204017).
• Drivers: hv: vmbus: Prevent load re-ordering when reading ring buffer (git-fixes).
• Drivers: hv: vmbus: Replace smpstoremb() with virtstoremb() (bsc#1204017).
• Drivers: hv: vmbus: Replace the per-CPU channel lists with a global array of channels (bsc#1204017).
• Drivers: hv: vmbus: Use a spin lock for synchronizing channel scheduling vs. channel removal (bsc#1204017).
• Drivers: hv: vmbus: fix double free in the error path of vmbusaddchannel_work() (git-fixes).
• Drivers: hv: vmbus: fix possible memory leak in vmbusdeviceregister() (git-fixes).
• PCI: hv: Add check for hypervinitialized in inithvpcidrv() (bsc#1204446).
• PCI: hv: Add hibernation support (bsc#1204446).
• PCI: hv: Add validation for untrusted Hyper-V values (bsc#1204017).
• PCI: hv: Drop msi_controller structure (bsc#1204446).
• PCI: hv: Fix NUMA node assignment when kernel boots with custom NUMA topology (bsc#1199365).
• PCI: hv: Fix a race condition when removing the device (bsc#1204446).
• PCI: hv: Fix hibernation in case interrupts are not re-created (bsc#1204446).
• PCI: hv: Fix hvarchirq_unmask() for multi-MSI (bsc#1200845).
• PCI: hv: Fix interrupt mapping for multi-MSI (bsc#1200845).
• PCI: hv: Fix multi-MSI to allow more than one MSI vector (bsc#1200845).
• PCI: hv: Fix sleep while in non-sleep context when removing child devices from the bus (bsc#1204446).
• PCI: hv: Fix synchronization between channel callback and hvcomposemsi_msg() (bsc#1204017, bsc#1203860).
• PCI: hv: Fix synchronization between channel callback and hvpcibus_exit() (bsc#1204017).
• PCI: hv: Fix the definition of vector in hvcomposemsi_msg() (bsc#1200845).
• PCI: hv: Make the code arch neutral by adding arch specific interfaces (bsc#1200845).
• PCI: hv: Only reuse existing IRTE allocation for Multi-MSI (bsc#1200845).
• PCI: hv: Prepare hvcomposemsi_msg() for the VMBus-channel-interrupt-to-vCPU reassignment functionality (bsc#1204017).
• PCI: hv: Remove bus device removal unused refcount/functions (bsc#1204446).
• PCI: hv: Remove unnecessary use of %hx (bsc#1204446).
• PCI: hv: Reuse existing IRTE allocation in composemsimsg() (bsc#1200845).
• PCI: hv: Support for create interrupt v3 (bsc#1204446).
• PCI: hv: Use PCIERRORRESPONSE to identify config read errors (bsc#1204446).
• PCI: hv: Use struct_size() helper (bsc#1204446).
• PCI: hv: Use vmbus_requestor to generate transaction IDs for VMbus hardening (bsc#1204017).
• exfat: Return ENAMETOOLONG consistently for oversized paths (bsc#1204053 bsc#1201725).
• hvnetvsc: Add check for kvmallocarray (git-fixes).
• hv_netvsc: Add error handling while switching data path (bsc#1204850).
• hv_netvsc: Add the support of hibernation (bsc#1204017).
• hv_netvsc: Add validation for untrusted Hyper-V values (bsc#1204017).
• hv_netvsc: Cache the current data path to avoid duplicate call and message (bsc#1204017).
• hv_netvsc: Check VF datapath when sending traffic to VF (bsc#1204017).
• hv_netvsc: Fix hibernation for mlx5 VF driver (bsc#1204850).
• hv_netvsc: Fix potential dereference of NULL pointer (bsc#1204017).
• hv_netvsc: Fix race between VF offering and VF association message from host (bsc#1204850).
• hvnetvsc: Print value of invalid ID in netvscsend{completion,txcomplete}() (bsc#1204017).
• hvnetvsc: Process NETDEVGOING_DOWN on VF hot remove (bsc#1204850).
• hvnetvsc: Remove unnecessary roundup for recvcompletioncnt (bsc#1204017).
• hvnetvsc: Reset the RSC count if NVSPSTATFAIL in netvscreceive() (bsc#1204017).
• hv_netvsc: Switch the data path at the right time during hibernation (bsc#1204850).
• hvnetvsc: Use vmbusrequestor to generate transaction IDs for VMBus hardening (bsc#1204017).
• hvnetvsc: Wait for completion on request SWITCHDATA_PATH (bsc#1204017).
• hvnetvsc: use netifisbondmaster() instead of open code (git-fixes).
• mm/hugetlb: fix races when looking up a CONT-PTE/PMD size hugetlb page (bsc#1204575).
• net: hyperv: remove use of bpfopt (git-fixes).
• net: mana: Add rmb after checking owner bits (git-fixes).
• net: netvsc: remove break after return (git-fixes).
• scsi: storvsc: Drop DIDTARGETFAILURE use (git-fixes).
• scsi: storvsc: Fix maxoutstandingreqperchannel for Win8 and newer (bsc#1204017).
• scsi: storvsc: Fix validation for unsolicited incoming packets (bsc#1204017).
• scsi: storvsc: Remove WQMEMRECLAIM from storvscerrorwq (git-fixes).
• scsi: storvsc: Resolve data race in storvsc_probe() (bsc#1204017).
• scsi: storvsc: Use blkmqunique_tag() to generate requestIDs (bsc#1204017).
• scsi: storvsc: Use vmbus_requestor to generate transaction IDs for VMBus hardening (bsc#1204017).
• scsi: storvsc: Validate length of incoming packet in storvsconchannel_callback() (bsc#1204017).
• x86/cpu: Restore AMD's DE_CFG MSR after resume (bsc#1205473).
• x86/hyperv: Output host build info as normal Windows version number (git-fixes).
• xfs: reserve data and rt quota at the same time (bsc#1203496).