Security update for the Linux Kernel SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2022:0768-1 Final 1 1 2022-03-09T09:09:29Z current 2022-03-09T09:09:29Z 2022-03-09T09:09:29Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for the Linux Kernel The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes. Transient execution side-channel attacks attacking the Branch History Buffer (BHB), named 'Branch Target Injection' and 'Intra-Mode Branch History Injection' are now mitigated. The following security bugs were fixed: - CVE-2022-0001: Fixed Branch History Injection vulnerability (bsc#1191580). - CVE-2022-0002: Fixed Intra-Mode Branch Target Injection vulnerability (bsc#1191580). - CVE-2022-0847: Fixed a vulnerability were a local attackers could overwrite data in arbitrary (read-only) files (bsc#1196584). - CVE-2022-0617: Fixed a null pointer dereference in UDF file system functionality. A local user could crash the system by triggering udf_file_write_iter() via a malicious UDF image. (bsc#1196079) - CVE-2022-0644: Fixed a denial of service by a local user. A assertion failure could be triggered in kernel_read_file_from_fd() (bsc#1196155). - CVE-2021-44879: In gc_data_segment() in fs/f2fs/gc.c, special files were not considered, which lead to a move_data_page NULL pointer dereference (bsc#1195987). - CVE-2022-24959: Fixed a memory leak in yam_siocdevprivate() in drivers/net/hamradio/yam.c (bsc#1195897). - CVE-2022-0487: A use-after-free vulnerability was found in rtsx_usb_ms_drv_remove() in drivers/memstick/host/rtsx_usb_ms.c (bsc#1194516). - CVE-2022-0492: Fixed a privilege escalation related to cgroups v1 release_agent feature, which allowed bypassing namespace isolation unexpectedly (bsc#1195543). - CVE-2022-24448: Fixed an issue in fs/nfs/dir.c. If an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should have occured, but the server instead returned uninitialized data in the file descriptor (bsc#1195612). The following non-security bugs were fixed: - crypto: af_alg - get_page upon reassignment to TX SGL (bsc#1195840). - lib/iov_iter: initialize 'flags' in new pipe_buffer (bsc#1196584). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-SLE-15.3-2022-768,openSUSE-SLE-15.4-2022-768 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MWGLT5YBYSSX5MP2JBKT3N3QV2IWMC5F/ E-Mail link for openSUSE-SU-2022:0768-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1185973 SUSE Bug 1185973 https://bugzilla.suse.com/1191580 SUSE Bug 1191580 https://bugzilla.suse.com/1194516 SUSE Bug 1194516 https://bugzilla.suse.com/1195536 SUSE Bug 1195536 https://bugzilla.suse.com/1195543 SUSE Bug 1195543 https://bugzilla.suse.com/1195612 SUSE Bug 1195612 https://bugzilla.suse.com/1195840 SUSE Bug 1195840 https://bugzilla.suse.com/1195897 SUSE Bug 1195897 https://bugzilla.suse.com/1195908 SUSE Bug 1195908 https://bugzilla.suse.com/1195949 SUSE Bug 1195949 https://bugzilla.suse.com/1195987 SUSE Bug 1195987 https://bugzilla.suse.com/1196079 SUSE Bug 1196079 https://bugzilla.suse.com/1196155 SUSE Bug 1196155 https://bugzilla.suse.com/1196584 SUSE Bug 1196584 https://bugzilla.suse.com/1196612 SUSE Bug 1196612 https://www.suse.com/security/cve/CVE-2021-44879/ SUSE CVE CVE-2021-44879 page https://www.suse.com/security/cve/CVE-2022-0001/ SUSE CVE CVE-2022-0001 page https://www.suse.com/security/cve/CVE-2022-0002/ SUSE CVE CVE-2022-0002 page https://www.suse.com/security/cve/CVE-2022-0487/ SUSE CVE CVE-2022-0487 page https://www.suse.com/security/cve/CVE-2022-0492/ SUSE CVE CVE-2022-0492 page https://www.suse.com/security/cve/CVE-2022-0617/ SUSE CVE CVE-2022-0617 page https://www.suse.com/security/cve/CVE-2022-0644/ SUSE CVE CVE-2022-0644 page https://www.suse.com/security/cve/CVE-2022-0847/ SUSE CVE CVE-2022-0847 page https://www.suse.com/security/cve/CVE-2022-24448/ SUSE CVE CVE-2022-24448 page https://www.suse.com/security/cve/CVE-2022-24959/ SUSE CVE CVE-2022-24959 page openSUSE Leap 15.3 kernel-debug-base-4.12.14-197.108.1 kernel-default-man-4.12.14-197.108.1 kernel-kvmsmall-base-4.12.14-197.108.1 kernel-vanilla-4.12.14-197.108.1 kernel-vanilla-base-4.12.14-197.108.1 kernel-vanilla-devel-4.12.14-197.108.1 kernel-vanilla-livepatch-devel-4.12.14-197.108.1 kernel-zfcpdump-man-4.12.14-197.108.1 kernel-debug-base-4.12.14-197.108.1 as a component of openSUSE Leap 15.3 kernel-default-man-4.12.14-197.108.1 as a component of openSUSE Leap 15.3 kernel-kvmsmall-base-4.12.14-197.108.1 as a component of openSUSE Leap 15.3 kernel-vanilla-4.12.14-197.108.1 as a component of openSUSE Leap 15.3 kernel-vanilla-base-4.12.14-197.108.1 as a component of openSUSE Leap 15.3 kernel-vanilla-devel-4.12.14-197.108.1 as a component of openSUSE Leap 15.3 kernel-vanilla-livepatch-devel-4.12.14-197.108.1 as a component of openSUSE Leap 15.3 kernel-zfcpdump-man-4.12.14-197.108.1 as a component of openSUSE Leap 15.3 In gc_data_segment in fs/f2fs/gc.c in the Linux kernel before 5.16.3, special files are not considered, leading to a move_data_page NULL pointer dereference. CVE-2021-44879 openSUSE Leap 15.3:kernel-debug-base-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-default-man-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-kvmsmall-base-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-vanilla-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-vanilla-base-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-vanilla-devel-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-vanilla-livepatch-devel-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-zfcpdump-man-4.12.14-197.108.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MWGLT5YBYSSX5MP2JBKT3N3QV2IWMC5F/ https://www.suse.com/security/cve/CVE-2021-44879.html CVE-2021-44879 https://bugzilla.suse.com/1195987 SUSE Bug 1195987 Non-transparent sharing of branch predictor selectors between contexts in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access. CVE-2022-0001 openSUSE Leap 15.3:kernel-debug-base-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-default-man-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-kvmsmall-base-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-vanilla-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-vanilla-base-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-vanilla-devel-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-vanilla-livepatch-devel-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-zfcpdump-man-4.12.14-197.108.1 moderate 2.1 AV:L/AC:L/Au:N/C:P/I:N/A:N 5.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MWGLT5YBYSSX5MP2JBKT3N3QV2IWMC5F/ https://www.suse.com/security/cve/CVE-2022-0001.html CVE-2022-0001 https://bugzilla.suse.com/1191580 SUSE Bug 1191580 https://bugzilla.suse.com/1196901 SUSE Bug 1196901 Non-transparent sharing of branch predictor within a context in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access. CVE-2022-0002 openSUSE Leap 15.3:kernel-debug-base-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-default-man-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-kvmsmall-base-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-vanilla-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-vanilla-base-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-vanilla-devel-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-vanilla-livepatch-devel-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-zfcpdump-man-4.12.14-197.108.1 moderate 2.1 AV:L/AC:L/Au:N/C:P/I:N/A:N 5.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MWGLT5YBYSSX5MP2JBKT3N3QV2IWMC5F/ https://www.suse.com/security/cve/CVE-2022-0002.html CVE-2022-0002 https://bugzilla.suse.com/1191580 SUSE Bug 1191580 https://bugzilla.suse.com/1196901 SUSE Bug 1196901 A use-after-free vulnerability was found in rtsx_usb_ms_drv_remove in drivers/memstick/host/rtsx_usb_ms.c in memstick in the Linux kernel. In this flaw, a local attacker with a user privilege may impact system Confidentiality. This flaw affects kernel versions prior to 5.14 rc1. CVE-2022-0487 openSUSE Leap 15.3:kernel-debug-base-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-default-man-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-kvmsmall-base-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-vanilla-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-vanilla-base-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-vanilla-devel-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-vanilla-livepatch-devel-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-zfcpdump-man-4.12.14-197.108.1 moderate 2.1 AV:L/AC:L/Au:N/C:P/I:N/A:N 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MWGLT5YBYSSX5MP2JBKT3N3QV2IWMC5F/ https://www.suse.com/security/cve/CVE-2022-0487.html CVE-2022-0487 https://bugzilla.suse.com/1194516 SUSE Bug 1194516 https://bugzilla.suse.com/1195949 SUSE Bug 1195949 https://bugzilla.suse.com/1198615 SUSE Bug 1198615 A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly. CVE-2022-0492 openSUSE Leap 15.3:kernel-debug-base-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-default-man-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-kvmsmall-base-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-vanilla-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-vanilla-base-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-vanilla-devel-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-vanilla-livepatch-devel-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-zfcpdump-man-4.12.14-197.108.1 moderate 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MWGLT5YBYSSX5MP2JBKT3N3QV2IWMC5F/ https://www.suse.com/security/cve/CVE-2022-0492.html CVE-2022-0492 https://bugzilla.suse.com/1195543 SUSE Bug 1195543 https://bugzilla.suse.com/1195908 SUSE Bug 1195908 https://bugzilla.suse.com/1196612 SUSE Bug 1196612 https://bugzilla.suse.com/1196776 SUSE Bug 1196776 https://bugzilla.suse.com/1198615 SUSE Bug 1198615 https://bugzilla.suse.com/1199255 SUSE Bug 1199255 https://bugzilla.suse.com/1199615 SUSE Bug 1199615 https://bugzilla.suse.com/1200084 SUSE Bug 1200084 A flaw null pointer dereference in the Linux kernel UDF file system functionality was found in the way user triggers udf_file_write_iter function for the malicious UDF image. A local user could use this flaw to crash the system. Actual from Linux kernel 4.2-rc1 till 5.17-rc2. CVE-2022-0617 openSUSE Leap 15.3:kernel-debug-base-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-default-man-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-kvmsmall-base-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-vanilla-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-vanilla-base-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-vanilla-devel-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-vanilla-livepatch-devel-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-zfcpdump-man-4.12.14-197.108.1 moderate 4.9 AV:L/AC:L/Au:N/C:N/I:N/A:C 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MWGLT5YBYSSX5MP2JBKT3N3QV2IWMC5F/ https://www.suse.com/security/cve/CVE-2022-0617.html CVE-2022-0617 https://bugzilla.suse.com/1196079 SUSE Bug 1196079 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none. CVE-2022-0644 openSUSE Leap 15.3:kernel-debug-base-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-default-man-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-kvmsmall-base-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-vanilla-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-vanilla-base-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-vanilla-devel-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-vanilla-livepatch-devel-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-zfcpdump-man-4.12.14-197.108.1 moderate 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MWGLT5YBYSSX5MP2JBKT3N3QV2IWMC5F/ https://www.suse.com/security/cve/CVE-2022-0644.html CVE-2022-0644 https://bugzilla.suse.com/1196155 SUSE Bug 1196155 A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache backed by read only files and as such escalate their privileges on the system. CVE-2022-0847 openSUSE Leap 15.3:kernel-debug-base-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-default-man-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-kvmsmall-base-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-vanilla-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-vanilla-base-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-vanilla-devel-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-vanilla-livepatch-devel-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-zfcpdump-man-4.12.14-197.108.1 important 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MWGLT5YBYSSX5MP2JBKT3N3QV2IWMC5F/ https://www.suse.com/security/cve/CVE-2022-0847.html CVE-2022-0847 https://bugzilla.suse.com/1196584 SUSE Bug 1196584 https://bugzilla.suse.com/1196601 SUSE Bug 1196601 An issue was discovered in fs/nfs/dir.c in the Linux kernel before 5.16.5. If an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should occur, but the server instead returns uninitialized data in the file descriptor. CVE-2022-24448 openSUSE Leap 15.3:kernel-debug-base-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-default-man-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-kvmsmall-base-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-vanilla-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-vanilla-base-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-vanilla-devel-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-vanilla-livepatch-devel-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-zfcpdump-man-4.12.14-197.108.1 moderate 1.9 AV:L/AC:M/Au:N/C:P/I:N/A:N 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MWGLT5YBYSSX5MP2JBKT3N3QV2IWMC5F/ https://www.suse.com/security/cve/CVE-2022-24448.html CVE-2022-24448 https://bugzilla.suse.com/1195612 SUSE Bug 1195612 An issue was discovered in the Linux kernel before 5.16.5. There is a memory leak in yam_siocdevprivate in drivers/net/hamradio/yam.c. CVE-2022-24959 openSUSE Leap 15.3:kernel-debug-base-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-default-man-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-kvmsmall-base-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-vanilla-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-vanilla-base-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-vanilla-devel-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-vanilla-livepatch-devel-4.12.14-197.108.1 openSUSE Leap 15.3:kernel-zfcpdump-man-4.12.14-197.108.1 moderate 2.1 AV:L/AC:L/Au:N/C:N/I:N/A:P 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MWGLT5YBYSSX5MP2JBKT3N3QV2IWMC5F/ https://www.suse.com/security/cve/CVE-2022-24959.html CVE-2022-24959 https://bugzilla.suse.com/1195897 SUSE Bug 1195897