Security update for the Linux Kernel SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2024:1983-1 Final 1 1 2024-06-11T10:56:58Z current 2024-06-11T10:56:58Z 2024-06-11T10:56:58Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for the Linux Kernel The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security bugfixes. The following security bugs were fixed: - CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138). - CVE-2022-48686: Fix UAF when detecting digest errors (bsc#1223948). - CVE-2021-47074: Fixed memory leak in nvme_loop_create_ctrl() (bsc#1220854). - CVE-2021-47378: Destroy cm id before destroy qp to avoid use after free (bsc#1225201). - CVE-2022-48697: Fix a use-after-free (bsc#1223922). - CVE-2024-26846: Do not wait in vain when unloading module (bsc#1223023). - CVE-2021-47496: Fix flipped sign in tls_err_abort() calls (bsc#1225354) - CVE-2023-42755: Check user supplied offsets (bsc#1215702). - CVE-2023-52664: Eliminate double free in error handling logic (bsc#1224747). - CVE-2023-52796: Add ipvlan_route_v6_outbound() helper (bsc#1224930). - CVE-2021-47246: Fix page reclaim for dead peer hairpin (bsc#1224831). - CVE-2023-52732: Blocklist the kclient when receiving corrupted snap trace (bsc#1225222). - CVE-2024-35936: Add missing mutex_unlock in btrfs_relocate_sys_chunks() (bsc#1224644) - CVE-2021-47548: Fixed a possible array out-of-bounds (bsc#1225506) - CVE-2024-36029: Pervent access to suspended controller (bsc#1225708) - CVE-2024-26625: Call sock_orphan() at release time (bsc#1221086) - CVE-2021-47352: Add validation for used length (bsc#1225124). - CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass() (bsc#1224621) - CVE-2021-47431: Fix gart.bo pin_count leak (bsc#1225390). - CVE-2024-35935: Handle path ref underflow in header iterate_inode_ref() (bsc#1224645) - CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223084). - CVE-2021-47423: Fix file release memory leak (bsc#1225366). - CVE-2022-48710: Fix a possible null pointer dereference (bsc#1225230). - CVE-2021-47497: Fixed shift-out-of-bound (UBSAN) with byte size cells (bsc#1225355). - CVE-2024-35932: Do not check if plane->state->fb == state->fb (bsc#1224650). - CVE-2021-47500: Fixed trigger reference couting (bsc#1225360). - CVE-2024-35809: Drain runtime-idle callbacks before driver removal (bsc#1224738). - CVE-2021-47383: Fiedx out-of-bound vmalloc access in imageblit (bsc#1225208). - CVE-2021-47511: Fixed negative period/buffer sizes (bsc#1225411). - CVE-2021-47509: Limit the period size to 16MB (bsc#1225409). - CVE-2024-35877: Fixed VM_PAT handling in COW mappings (bsc#1224525). - CVE-2024-35982: Avoid infinite loop trying to resize local TT (bsc#1224566) - CVE-2024-35969: Fixed race condition between ipv6_get_ifaddr and ipv6_del_addr (bsc#1224580). - CVE-2021-47277: Avoid speculation-based attacks from out-of-range memslot accesses (bsc#1224960). - CVE-2024-35791: Flush pages under kvm->lock to fix UAF in svm_register_enc_region() (bsc#1224725). - CVE-2021-47401: Fix stack information leak (bsc#1225242). - CVE-2023-52867: Fix possible buffer overflow (bsc#1225009). - CVE-2023-52821: Fix a possible null pointer dereference (bsc#1225022). - CVE-2021-47265: Verify port when creating flow rule (bsc#1224957) - CVE-2021-47362: Update intermediate power state for SI (bsc#1225153). - CVE-2021-47361: Fix error handling in mcb_alloc_bus() (bsc#1225151). - CVE-2023-52864: Fix opening of char device (bsc#1225132). - CVE-2022-48708: Fix potential NULL dereference (bsc#1224942). - CVE-2024-35944: Fixed memcpy() run-time warning in dg_dispatch_as_host() (bsc#1224648). - CVE-2021-47238: Fix memory leak in ip_mc_add1_src (bsc#1224847) - CVE-2023-52730: Fix possible resource leaks in some error paths (bsc#1224956). - CVE-2021-47355: Fix possible use-after-free in nicstar_cleanup() (bsc#1225141). - CVE-2021-47245: Fix out of bounds when parsing TCP options (bsc#1224838) - CVE-2024-35878: Prevent NULL pointer dereference in vsnprintf() (bsc#1224671). - CVE-2023-52747: Restore allocated resources on failed copyout (bsc#1224931) - CVE-2021-47249: Fix memory leak in rds_recvmsg (bsc#1224880) - CVE-2021-47397: Break out if skb_header_pointer returns NULL in sctp_rcv_ootb (bsc#1225082) - CVE-2021-47250: Fix memory leak in netlbl_cipsov4_add_std (bsc#1224827) - CVE-2024-35849: Fix information leak in btrfs_ioctl_logical_to_ino() (bsc#1224733). - CVE-2024-27436: Stop parsing channels bits when all channels are found (bsc#1224803). - CVE-2021-47281: Fix race of snd_seq_timer_open() (bsc#1224983). - CVE-2024-35789: Clear fast rx for non-4addr sta VLAN changes (bsc#1224749). - CVE-2024-35830: Register v4l2 async device only after successful setup (bsc#1224680). - CVE-2021-47334: Fix two use after free in ibmasm_init_one (bsc#1225112). - CVE-2021-47357: Fix possible use-after-free in ia_module_exit() (bsc#1225144). - CVE-2023-52875: Add check for mtk_alloc_clk_data (bsc#1225096). - CVE-2023-52865: Add check for mtk_alloc_clk_data (bsc#1225086). - CVE-2024-35887: Fix use-after-free bugs caused by ax25_ds_del_timer (bzg#1224663) - CVE-2021-47483: Fixed possible double-free in regcache_rbtree_exit() (bsc#1224907). - CVE-2024-26957: Fix reference counting on zcrypt card objects (bsc#1223666). - CVE-2023-52691: Fix a double-free in si_dpm_init (bsc#1224607). - CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1224174). - CVE-2023-52586: Fixed mutex lock in control vblank irq (bsc#1221081). - CVE-2024-27062: Fixed nouveau lock inside client object tree (bsc#1223834). - CVE-2024-26984: Fix instmem race condition around ptr stores (bsc#1223633) - CVE-2021-46933: Fixed possible underflow in ffs_data_clear() (bsc#1220487). - CVE-2024-27396: Fixed Use-After-Free in gtp_dellink (bsc#1224096). - CVE-2023-52655: Check packet for fixup for true limit (bsc#1217169). - CVE-2024-26900: Fixed kmemleak of rdev->serial (bsc#1223046). - CVE-2024-27401: Fixed user_length taken into account when fetching packet contents (bsc#1224181). - CVE-2024-26775: Fixed potential deadlock at set_capacity (bsc#1222627). - CVE-2024-26958: Fixed UAF in direct writes (bsc#1223653). - CVE-2022-48704: Add a force flush to delay work when radeon (bsc#1223932) - CVE-2021-47206: Check return value after calling platform_get_resource() (bsc#1222894). - CVE-2024-26915: Reset IH OVERFLOW_CLEAR bit (bsc#1223207) - CVE-2024-26996: Fix UAF ncm object at re-bind after usb ep transport error (bsc#1223752). - CVE-2024-26874: Fix a null pointer crash in mtk_drm_crtc_finish_page_flip (bsc#1223048) - CVE-2022-48702: Fix out of bounds access in snd_emu10k1_pcm_channel_alloc() (bsc#1223923). - CVE-2022-48672: Fix off-by-one error in unflatten_dt_nodes() (bsc#1223931). - CVE-2021-47113: Abort btrfs rename_exchange if we fail to insert the second ref (bsc#1221543). - CVE-2024-26791: Fixed properly validate device names in btrfs (bsc#1222793) - CVE-2021-47131: Fixed a use-after-free after the TLS device goes down and up (bsc#1221545). - CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets (bsc#1220513). - CVE-2024-0639: Fixed a denial-of-service vulnerability due to a deadlock found in sctp_auto_asconf_init in net/sctp/socket.c (bsc#1218917). - CVE-2024-27008: Fix out of bounds access (bsc#1223802). - CVE-2024-26876: Fixed crash on irq during probe (bsc#1223119). - CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335). The following non-security bugs were fixed: - af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress (bsc#1223384). - af_unix: Do not use atomic ops for unix_sk(sk)->inflight (bsc#1223384). - af_unix: Replace BUG_ON() with WARN_ON_ONCE() (bsc#1223384). - ASoC: tracing: Export SND_SOC_DAPM_DIR_OUT to its value (git-fixes). - assoc_array: Fix BUG_ON during garbage collect. - autofs: fix a leak in autofs_expire_indirect() (git-fixes) - Bluetooth: btusb: Some Qualcomm Bluetooth adapters stop working (git-fixes). - btrfs: avoid null pointer dereference on fs_info when calling btrfs_crit (git-fixes) - btrfs: check if root is readonly while setting security xattr (git-fixes) - btrfs: defrag: use btrfs_mod_outstanding_extents in cluster_pages_for_defrag (git-fixes) - btrfs: do not get an EINTR during drop_snapshot for reloc (git-fixes) - btrfs: do not stop integrity writeback too early (git-fixes) - btrfs: Explicitly handle btrfs_update_root failure (git-fixes) - btrfs: fail mount when sb flag is not in BTRFS_SUPER_FLAG_SUPP (git-fixes) - btrfs: fix btrfs_prev_leaf() to not return the same key twice (git-fixes) - btrfs: fix deadlock when writing out space cache (git-fixes) - Btrfs: fix incorrect {node,sector}size endianness from BTRFS_IOC_FS_INFO (git-fixes) - btrfs: fix lockdep splat and potential deadlock after failure running delayed items (git-fixes) - btrfs: fix lost error handling when looking up extended ref on log replay (git-fixes) - btrfs: Fix NULL pointer exception in find_bio_stripe (git-fixes) - btrfs: Fix out of bounds access in btrfs_search_slot (git-fixes) - btrfs: fix race when deleting quota root from the dirty cow roots list (git-fixes) - btrfs: fix range_end calculation in extent_write_locked_range (git-fixes) - btrfs: fix return value mixup in btrfs_get_extent (git-fixes) - btrfs: fix unaligned access in readdir (git-fixes) - btrfs: limit device extents to the device size (git-fixes) - btrfs: prevent to set invalid default subvolid (git-fixes) - btrfs: record delayed inode root in transaction (git-fixes) - btrfs: scrub: reject unsupported scrub flags (git-fixes) - btrfs: send: ensure send_fd is writable (git-fixes) - btrfs: send: in case of IO error log it (git-fixes) - btrfs: send: limit number of clones and allocated memory size (git-fixes) - btrfs: sysfs: use NOFS for device creation (git-fixes) Adjustment: add #include - btrfs: tree-checker: add missing return after error in root_item (git-fixes) - btrfs: tree-checker: add missing returns after data_ref alignment checks (git-fixes) - btrfs: tree-checker: do not error out if extent ref hash does not match (git-fixes) - btrfs: tree-checker: fix inline ref size in error messages (git-fixes) - btrfs: tree-checker: Fix misleading group system information (git-fixes) - btrfs: undo writable superblocke when sprouting fails (git-fixes) - btrfs: validate qgroup inherit for SNAP_CREATE_V2 ioctl (git-fixes) - ecryptfs: fix a memory leak bug in ecryptfs_init_messaging() (git-fixes) - ecryptfs: fix a memory leak bug in parse_tag_1_packet() (git-fixes) - ecryptfs: fix kernel panic with null dev_name (git-fixes) - ecryptfs: Fix typo in message (git-fixes) - ep_create_wakeup_source(): dentry name can change under you (git-fixes) - exportfs_decode_fh(): negative pinned may become positive without the parent locked (git-fixes) - fs/proc/proc_sysctl.c: fix the default values of i_uid/i_gid on /proc/sys inodes (git-fixes) - fscrypt: clean up some BUG_ON()s in block encryption/decryption (git-fixes) - ila: do not generate empty messages in ila_xlat_nl_cmd_get_mapping() (git-fixes). - ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data() (git-fixes). - kprobes: Fix possible use-after-free issue on kprobe registration (git-fixes). - KVM: s390: Check kvm pointer when testing KVM_CAP_S390_HPAGE_1M (git-fixes bsc#1225059). - l2tp: pass correct message length to ip6_append_data (git-fixes). - lib/mpi: use kcalloc in mpi_resize (git-fixes). - list: fix a data-race around ep->rdllist (git-fixes). - net: 9p: avoid freeing uninit memory in p9pdu_vreadf (git-fixes). - net: tcp: fix unexcepted socket die when snd_wnd is 0 (git-fixes). - net: usb: ax88179_178a: stop lying about skb->truesize (git-fixes). - net: usb: smsc95xx: stop lying about skb->truesize (git-fixes). - net: usb: sr9700: stop lying about skb->truesize (git-fixes). - net: vmxnet3: Fix NULL pointer dereference in vmxnet3_rq_rx_complete() (bsc#1223360). - net/smc: fix fallback failed while sendmsg with fastopen (git-fixes). - net/tls: Remove the context from the list in tls_device_down (bsc#1221545). - netfilter: nf_queue: augment nfqa_cfg_policy (git-fixes). - netfilter: nft_compat: explicitly reject ERROR and standard target (git-fixes). - netfilter: x_tables: set module owner for icmp(6) matches (git-fixes). - nfc: change order inside nfc_se_io error path (git-fixes). - powerpc/pseries/lparcfg: drop error message from guest name lookup (bsc#1187716 ltc#193451 git-fixes). - ppdev: Add an error check in register_device (git-fixes). - printk: Disable passing console lock owner completely during panic() (bsc#1197894). - printk: Update @console_may_schedule in console_trylock_spinning() (bsc#1223969). - rds: avoid unenecessary cong_update in loop transport (git-fixes). - rds: ib: Fix missing call to rds_ib_dev_put in rds_ib_setup_qp (git-fixes). - ring-buffer: Clean ring_buffer_poll_wait() error return (git-fixes). - ring-buffer: Fix a race between readers and resize checks (bsc#1222893). - rxrpc: Do not put crypto buffers on the stack (git-fixes). - rxrpc: Fix a memory leak in rxkad_verify_response() (git-fixes). - rxrpc: Provide a different lockdep key for call->user_mutex for kernel calls (git-fixes). - rxrpc: The mutex lock returned by rxrpc_accept_call() needs releasing (git-fixes). - rxrpc: Work around usercopy check (git-fixes). - s390/cpum_cf: make crypto counters upward compatible across machine types (bsc#1224347). - s390/pci: fix max size calculation in zpci_memcpy_toio() (git-fixes bsc#1225062). - tcp: tcp_make_synack() can be called from process context (git-fixes). - tls: Fix context leak on tls_device_down (bsc#1221545). - tracing: Fix blocked reader of snapshot buffer (git-fixes). - tracing: hide unused ftrace_event_id_fops (git-fixes). - tracing: Use .flush() call to wake up readers (git-fixes). - tracing: Use strncpy instead of memcpy when copying comm in trace.c (git-fixes). - tty/sysrq: replace smp_processor_id() with get_cpu() (bsc#1223540). - usb: aqc111: stop lying about skb->truesize (git-fixes). - wifi: cfg80211: avoid leaking stack data into trace (git-fixes). - wifi: radiotap: fix kernel-doc notation warnings (git-fixes). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2024-1983,SUSE-SLE-RT-12-SP5-2024-1983 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ Link for SUSE-SU-2024:1983-1 https://lists.suse.com/pipermail/sle-updates/2024-June/035554.html E-Mail link for SUSE-SU-2024:1983-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1065729 SUSE Bug 1065729 https://bugzilla.suse.com/1101816 SUSE Bug 1101816 https://bugzilla.suse.com/1141539 SUSE Bug 1141539 https://bugzilla.suse.com/1181674 SUSE Bug 1181674 https://bugzilla.suse.com/1185902 SUSE Bug 1185902 https://bugzilla.suse.com/1187716 SUSE Bug 1187716 https://bugzilla.suse.com/1188616 SUSE Bug 1188616 https://bugzilla.suse.com/1190317 SUSE Bug 1190317 https://bugzilla.suse.com/1190795 SUSE Bug 1190795 https://bugzilla.suse.com/1191452 SUSE Bug 1191452 https://bugzilla.suse.com/1194591 SUSE Bug 1194591 https://bugzilla.suse.com/1197760 SUSE Bug 1197760 https://bugzilla.suse.com/1197894 SUSE Bug 1197894 https://bugzilla.suse.com/1203935 SUSE Bug 1203935 https://bugzilla.suse.com/1206213 SUSE Bug 1206213 https://bugzilla.suse.com/1206646 SUSE Bug 1206646 https://bugzilla.suse.com/1207186 SUSE Bug 1207186 https://bugzilla.suse.com/1209657 SUSE Bug 1209657 https://bugzilla.suse.com/1210335 SUSE Bug 1210335 https://bugzilla.suse.com/1215702 SUSE Bug 1215702 https://bugzilla.suse.com/1216702 SUSE Bug 1216702 https://bugzilla.suse.com/1217169 SUSE Bug 1217169 https://bugzilla.suse.com/1217519 SUSE Bug 1217519 https://bugzilla.suse.com/1218917 SUSE Bug 1218917 https://bugzilla.suse.com/1220487 SUSE Bug 1220487 https://bugzilla.suse.com/1220513 SUSE Bug 1220513 https://bugzilla.suse.com/1220854 SUSE Bug 1220854 https://bugzilla.suse.com/1220928 SUSE Bug 1220928 https://bugzilla.suse.com/1221044 SUSE Bug 1221044 https://bugzilla.suse.com/1221081 SUSE Bug 1221081 https://bugzilla.suse.com/1221086 SUSE Bug 1221086 https://bugzilla.suse.com/1221543 SUSE Bug 1221543 https://bugzilla.suse.com/1221545 SUSE Bug 1221545 https://bugzilla.suse.com/1221816 SUSE Bug 1221816 https://bugzilla.suse.com/1221977 SUSE Bug 1221977 https://bugzilla.suse.com/1221994 SUSE Bug 1221994 https://bugzilla.suse.com/1222559 SUSE Bug 1222559 https://bugzilla.suse.com/1222619 SUSE Bug 1222619 https://bugzilla.suse.com/1222627 SUSE Bug 1222627 https://bugzilla.suse.com/1222667 SUSE Bug 1222667 https://bugzilla.suse.com/1222671 SUSE Bug 1222671 https://bugzilla.suse.com/1222793 SUSE Bug 1222793 https://bugzilla.suse.com/1222893 SUSE Bug 1222893 https://bugzilla.suse.com/1222894 SUSE Bug 1222894 https://bugzilla.suse.com/1223023 SUSE Bug 1223023 https://bugzilla.suse.com/1223046 SUSE Bug 1223046 https://bugzilla.suse.com/1223048 SUSE Bug 1223048 https://bugzilla.suse.com/1223084 SUSE Bug 1223084 https://bugzilla.suse.com/1223119 SUSE Bug 1223119 https://bugzilla.suse.com/1223138 SUSE Bug 1223138 https://bugzilla.suse.com/1223207 SUSE Bug 1223207 https://bugzilla.suse.com/1223360 SUSE Bug 1223360 https://bugzilla.suse.com/1223384 SUSE Bug 1223384 https://bugzilla.suse.com/1223432 SUSE Bug 1223432 https://bugzilla.suse.com/1223509 SUSE Bug 1223509 https://bugzilla.suse.com/1223512 SUSE Bug 1223512 https://bugzilla.suse.com/1223539 SUSE Bug 1223539 https://bugzilla.suse.com/1223540 SUSE Bug 1223540 https://bugzilla.suse.com/1223626 SUSE Bug 1223626 https://bugzilla.suse.com/1223627 SUSE Bug 1223627 https://bugzilla.suse.com/1223633 SUSE Bug 1223633 https://bugzilla.suse.com/1223653 SUSE Bug 1223653 https://bugzilla.suse.com/1223666 SUSE Bug 1223666 https://bugzilla.suse.com/1223671 SUSE Bug 1223671 https://bugzilla.suse.com/1223712 SUSE Bug 1223712 https://bugzilla.suse.com/1223715 SUSE Bug 1223715 https://bugzilla.suse.com/1223738 SUSE Bug 1223738 https://bugzilla.suse.com/1223744 SUSE Bug 1223744 https://bugzilla.suse.com/1223752 SUSE Bug 1223752 https://bugzilla.suse.com/1223802 SUSE Bug 1223802 https://bugzilla.suse.com/1223819 SUSE Bug 1223819 https://bugzilla.suse.com/1223834 SUSE Bug 1223834 https://bugzilla.suse.com/1223922 SUSE Bug 1223922 https://bugzilla.suse.com/1223923 SUSE Bug 1223923 https://bugzilla.suse.com/1223931 SUSE Bug 1223931 https://bugzilla.suse.com/1223932 SUSE Bug 1223932 https://bugzilla.suse.com/1223948 SUSE Bug 1223948 https://bugzilla.suse.com/1223969 SUSE Bug 1223969 https://bugzilla.suse.com/1224096 SUSE Bug 1224096 https://bugzilla.suse.com/1224174 SUSE Bug 1224174 https://bugzilla.suse.com/1224181 SUSE Bug 1224181 https://bugzilla.suse.com/1224347 SUSE Bug 1224347 https://bugzilla.suse.com/1224482 SUSE Bug 1224482 https://bugzilla.suse.com/1224511 SUSE Bug 1224511 https://bugzilla.suse.com/1224525 SUSE Bug 1224525 https://bugzilla.suse.com/1224566 SUSE Bug 1224566 https://bugzilla.suse.com/1224580 SUSE Bug 1224580 https://bugzilla.suse.com/1224592 SUSE Bug 1224592 https://bugzilla.suse.com/1224601 SUSE Bug 1224601 https://bugzilla.suse.com/1224607 SUSE Bug 1224607 https://bugzilla.suse.com/1224621 SUSE Bug 1224621 https://bugzilla.suse.com/1224644 SUSE Bug 1224644 https://bugzilla.suse.com/1224645 SUSE Bug 1224645 https://bugzilla.suse.com/1224648 SUSE Bug 1224648 https://bugzilla.suse.com/1224650 SUSE Bug 1224650 https://bugzilla.suse.com/1224663 SUSE Bug 1224663 https://bugzilla.suse.com/1224671 SUSE Bug 1224671 https://bugzilla.suse.com/1224676 SUSE Bug 1224676 https://bugzilla.suse.com/1224680 SUSE Bug 1224680 https://bugzilla.suse.com/1224682 SUSE Bug 1224682 https://bugzilla.suse.com/1224725 SUSE Bug 1224725 https://bugzilla.suse.com/1224728 SUSE Bug 1224728 https://bugzilla.suse.com/1224733 SUSE Bug 1224733 https://bugzilla.suse.com/1224738 SUSE Bug 1224738 https://bugzilla.suse.com/1224747 SUSE Bug 1224747 https://bugzilla.suse.com/1224749 SUSE Bug 1224749 https://bugzilla.suse.com/1224759 SUSE Bug 1224759 https://bugzilla.suse.com/1224803 SUSE Bug 1224803 https://bugzilla.suse.com/1224827 SUSE Bug 1224827 https://bugzilla.suse.com/1224830 SUSE Bug 1224830 https://bugzilla.suse.com/1224831 SUSE Bug 1224831 https://bugzilla.suse.com/1224834 SUSE Bug 1224834 https://bugzilla.suse.com/1224838 SUSE Bug 1224838 https://bugzilla.suse.com/1224841 SUSE Bug 1224841 https://bugzilla.suse.com/1224844 SUSE Bug 1224844 https://bugzilla.suse.com/1224846 SUSE Bug 1224846 https://bugzilla.suse.com/1224847 SUSE Bug 1224847 https://bugzilla.suse.com/1224849 SUSE Bug 1224849 https://bugzilla.suse.com/1224854 SUSE Bug 1224854 https://bugzilla.suse.com/1224859 SUSE Bug 1224859 https://bugzilla.suse.com/1224867 SUSE Bug 1224867 https://bugzilla.suse.com/1224880 SUSE Bug 1224880 https://bugzilla.suse.com/1224882 SUSE Bug 1224882 https://bugzilla.suse.com/1224888 SUSE Bug 1224888 https://bugzilla.suse.com/1224889 SUSE Bug 1224889 https://bugzilla.suse.com/1224892 SUSE Bug 1224892 https://bugzilla.suse.com/1224893 SUSE Bug 1224893 https://bugzilla.suse.com/1224899 SUSE Bug 1224899 https://bugzilla.suse.com/1224904 SUSE Bug 1224904 https://bugzilla.suse.com/1224907 SUSE Bug 1224907 https://bugzilla.suse.com/1224916 SUSE Bug 1224916 https://bugzilla.suse.com/1224917 SUSE Bug 1224917 https://bugzilla.suse.com/1224922 SUSE Bug 1224922 https://bugzilla.suse.com/1224926 SUSE Bug 1224926 https://bugzilla.suse.com/1224930 SUSE Bug 1224930 https://bugzilla.suse.com/1224931 SUSE Bug 1224931 https://bugzilla.suse.com/1224942 SUSE Bug 1224942 https://bugzilla.suse.com/1224954 SUSE Bug 1224954 https://bugzilla.suse.com/1224956 SUSE Bug 1224956 https://bugzilla.suse.com/1224957 SUSE Bug 1224957 https://bugzilla.suse.com/1224959 SUSE Bug 1224959 https://bugzilla.suse.com/1224960 SUSE Bug 1224960 https://bugzilla.suse.com/1224961 SUSE Bug 1224961 https://bugzilla.suse.com/1224963 SUSE Bug 1224963 https://bugzilla.suse.com/1224966 SUSE Bug 1224966 https://bugzilla.suse.com/1224968 SUSE Bug 1224968 https://bugzilla.suse.com/1224981 SUSE Bug 1224981 https://bugzilla.suse.com/1224982 SUSE Bug 1224982 https://bugzilla.suse.com/1224983 SUSE Bug 1224983 https://bugzilla.suse.com/1224987 SUSE Bug 1224987 https://bugzilla.suse.com/1224990 SUSE Bug 1224990 https://bugzilla.suse.com/1224996 SUSE Bug 1224996 https://bugzilla.suse.com/1225008 SUSE Bug 1225008 https://bugzilla.suse.com/1225009 SUSE Bug 1225009 https://bugzilla.suse.com/1225010 SUSE Bug 1225010 https://bugzilla.suse.com/1225022 SUSE Bug 1225022 https://bugzilla.suse.com/1225026 SUSE Bug 1225026 https://bugzilla.suse.com/1225030 SUSE Bug 1225030 https://bugzilla.suse.com/1225054 SUSE Bug 1225054 https://bugzilla.suse.com/1225058 SUSE Bug 1225058 https://bugzilla.suse.com/1225059 SUSE Bug 1225059 https://bugzilla.suse.com/1225060 SUSE Bug 1225060 https://bugzilla.suse.com/1225062 SUSE Bug 1225062 https://bugzilla.suse.com/1225082 SUSE Bug 1225082 https://bugzilla.suse.com/1225084 SUSE Bug 1225084 https://bugzilla.suse.com/1225086 SUSE Bug 1225086 https://bugzilla.suse.com/1225092 SUSE Bug 1225092 https://bugzilla.suse.com/1225096 SUSE Bug 1225096 https://bugzilla.suse.com/1225112 SUSE Bug 1225112 https://bugzilla.suse.com/1225124 SUSE Bug 1225124 https://bugzilla.suse.com/1225128 SUSE Bug 1225128 https://bugzilla.suse.com/1225132 SUSE Bug 1225132 https://bugzilla.suse.com/1225141 SUSE Bug 1225141 https://bugzilla.suse.com/1225143 SUSE Bug 1225143 https://bugzilla.suse.com/1225144 SUSE Bug 1225144 https://bugzilla.suse.com/1225151 SUSE Bug 1225151 https://bugzilla.suse.com/1225153 SUSE Bug 1225153 https://bugzilla.suse.com/1225155 SUSE Bug 1225155 https://bugzilla.suse.com/1225157 SUSE Bug 1225157 https://bugzilla.suse.com/1225164 SUSE Bug 1225164 https://bugzilla.suse.com/1225177 SUSE Bug 1225177 https://bugzilla.suse.com/1225189 SUSE Bug 1225189 https://bugzilla.suse.com/1225192 SUSE Bug 1225192 https://bugzilla.suse.com/1225193 SUSE Bug 1225193 https://bugzilla.suse.com/1225198 SUSE Bug 1225198 https://bugzilla.suse.com/1225201 SUSE Bug 1225201 https://bugzilla.suse.com/1225207 SUSE Bug 1225207 https://bugzilla.suse.com/1225208 SUSE Bug 1225208 https://bugzilla.suse.com/1225222 SUSE Bug 1225222 https://bugzilla.suse.com/1225230 SUSE Bug 1225230 https://bugzilla.suse.com/1225242 SUSE Bug 1225242 https://bugzilla.suse.com/1225244 SUSE Bug 1225244 https://bugzilla.suse.com/1225247 SUSE Bug 1225247 https://bugzilla.suse.com/1225251 SUSE Bug 1225251 https://bugzilla.suse.com/1225252 SUSE Bug 1225252 https://bugzilla.suse.com/1225256 SUSE Bug 1225256 https://bugzilla.suse.com/1225303 SUSE Bug 1225303 https://bugzilla.suse.com/1225318 SUSE Bug 1225318 https://bugzilla.suse.com/1225322 SUSE Bug 1225322 https://bugzilla.suse.com/1225329 SUSE Bug 1225329 https://bugzilla.suse.com/1225330 SUSE Bug 1225330 https://bugzilla.suse.com/1225336 SUSE Bug 1225336 https://bugzilla.suse.com/1225347 SUSE Bug 1225347 https://bugzilla.suse.com/1225351 SUSE Bug 1225351 https://bugzilla.suse.com/1225354 SUSE Bug 1225354 https://bugzilla.suse.com/1225355 SUSE Bug 1225355 https://bugzilla.suse.com/1225360 SUSE Bug 1225360 https://bugzilla.suse.com/1225366 SUSE Bug 1225366 https://bugzilla.suse.com/1225367 SUSE Bug 1225367 https://bugzilla.suse.com/1225384 SUSE Bug 1225384 https://bugzilla.suse.com/1225390 SUSE Bug 1225390 https://bugzilla.suse.com/1225404 SUSE Bug 1225404 https://bugzilla.suse.com/1225409 SUSE Bug 1225409 https://bugzilla.suse.com/1225411 SUSE Bug 1225411 https://bugzilla.suse.com/1225438 SUSE Bug 1225438 https://bugzilla.suse.com/1225453 SUSE Bug 1225453 https://bugzilla.suse.com/1225479 SUSE Bug 1225479 https://bugzilla.suse.com/1225482 SUSE Bug 1225482 https://bugzilla.suse.com/1225506 SUSE Bug 1225506 https://bugzilla.suse.com/1225549 SUSE Bug 1225549 https://bugzilla.suse.com/1225560 SUSE Bug 1225560 https://bugzilla.suse.com/1225572 SUSE Bug 1225572 https://bugzilla.suse.com/1225640 SUSE Bug 1225640 https://bugzilla.suse.com/1225708 SUSE Bug 1225708 https://bugzilla.suse.com/1225764 SUSE Bug 1225764 https://www.suse.com/security/cve/CVE-2021-46933/ SUSE CVE CVE-2021-46933 page https://www.suse.com/security/cve/CVE-2021-46955/ SUSE CVE CVE-2021-46955 page https://www.suse.com/security/cve/CVE-2021-47074/ SUSE CVE CVE-2021-47074 page https://www.suse.com/security/cve/CVE-2021-47113/ SUSE CVE CVE-2021-47113 page https://www.suse.com/security/cve/CVE-2021-47131/ SUSE CVE CVE-2021-47131 page https://www.suse.com/security/cve/CVE-2021-47162/ SUSE CVE CVE-2021-47162 page https://www.suse.com/security/cve/CVE-2021-47171/ SUSE CVE CVE-2021-47171 page https://www.suse.com/security/cve/CVE-2021-47188/ SUSE CVE CVE-2021-47188 page https://www.suse.com/security/cve/CVE-2021-47206/ SUSE CVE CVE-2021-47206 page https://www.suse.com/security/cve/CVE-2021-47220/ SUSE CVE CVE-2021-47220 page https://www.suse.com/security/cve/CVE-2021-47229/ SUSE CVE CVE-2021-47229 page https://www.suse.com/security/cve/CVE-2021-47231/ SUSE CVE CVE-2021-47231 page https://www.suse.com/security/cve/CVE-2021-47235/ SUSE CVE CVE-2021-47235 page https://www.suse.com/security/cve/CVE-2021-47236/ SUSE CVE CVE-2021-47236 page https://www.suse.com/security/cve/CVE-2021-47237/ SUSE CVE CVE-2021-47237 page https://www.suse.com/security/cve/CVE-2021-47238/ SUSE CVE CVE-2021-47238 page https://www.suse.com/security/cve/CVE-2021-47239/ SUSE CVE CVE-2021-47239 page https://www.suse.com/security/cve/CVE-2021-47245/ SUSE CVE CVE-2021-47245 page https://www.suse.com/security/cve/CVE-2021-47246/ SUSE CVE CVE-2021-47246 page https://www.suse.com/security/cve/CVE-2021-47248/ SUSE CVE CVE-2021-47248 page https://www.suse.com/security/cve/CVE-2021-47249/ SUSE CVE CVE-2021-47249 page https://www.suse.com/security/cve/CVE-2021-47250/ SUSE CVE CVE-2021-47250 page https://www.suse.com/security/cve/CVE-2021-47252/ SUSE CVE CVE-2021-47252 page https://www.suse.com/security/cve/CVE-2021-47254/ SUSE CVE CVE-2021-47254 page https://www.suse.com/security/cve/CVE-2021-47258/ SUSE CVE CVE-2021-47258 page https://www.suse.com/security/cve/CVE-2021-47260/ SUSE CVE CVE-2021-47260 page https://www.suse.com/security/cve/CVE-2021-47261/ SUSE CVE CVE-2021-47261 page https://www.suse.com/security/cve/CVE-2021-47265/ SUSE CVE CVE-2021-47265 page https://www.suse.com/security/cve/CVE-2021-47269/ SUSE CVE CVE-2021-47269 page https://www.suse.com/security/cve/CVE-2021-47274/ SUSE CVE CVE-2021-47274 page https://www.suse.com/security/cve/CVE-2021-47276/ SUSE CVE CVE-2021-47276 page https://www.suse.com/security/cve/CVE-2021-47277/ SUSE CVE CVE-2021-47277 page https://www.suse.com/security/cve/CVE-2021-47280/ SUSE CVE CVE-2021-47280 page https://www.suse.com/security/cve/CVE-2021-47281/ SUSE CVE CVE-2021-47281 page https://www.suse.com/security/cve/CVE-2021-47284/ SUSE CVE CVE-2021-47284 page https://www.suse.com/security/cve/CVE-2021-47285/ SUSE CVE CVE-2021-47285 page https://www.suse.com/security/cve/CVE-2021-47288/ SUSE CVE CVE-2021-47288 page https://www.suse.com/security/cve/CVE-2021-47301/ SUSE CVE CVE-2021-47301 page https://www.suse.com/security/cve/CVE-2021-47302/ SUSE CVE CVE-2021-47302 page https://www.suse.com/security/cve/CVE-2021-47305/ SUSE CVE CVE-2021-47305 page https://www.suse.com/security/cve/CVE-2021-47307/ SUSE CVE CVE-2021-47307 page https://www.suse.com/security/cve/CVE-2021-47308/ SUSE CVE CVE-2021-47308 page https://www.suse.com/security/cve/CVE-2021-47310/ SUSE CVE CVE-2021-47310 page https://www.suse.com/security/cve/CVE-2021-47311/ SUSE CVE CVE-2021-47311 page https://www.suse.com/security/cve/CVE-2021-47314/ SUSE CVE CVE-2021-47314 page https://www.suse.com/security/cve/CVE-2021-47315/ SUSE CVE CVE-2021-47315 page https://www.suse.com/security/cve/CVE-2021-47319/ SUSE CVE CVE-2021-47319 page https://www.suse.com/security/cve/CVE-2021-47320/ SUSE CVE CVE-2021-47320 page https://www.suse.com/security/cve/CVE-2021-47321/ SUSE CVE CVE-2021-47321 page https://www.suse.com/security/cve/CVE-2021-47323/ SUSE CVE CVE-2021-47323 page https://www.suse.com/security/cve/CVE-2021-47324/ SUSE CVE CVE-2021-47324 page https://www.suse.com/security/cve/CVE-2021-47330/ SUSE CVE CVE-2021-47330 page https://www.suse.com/security/cve/CVE-2021-47334/ SUSE CVE CVE-2021-47334 page https://www.suse.com/security/cve/CVE-2021-47337/ SUSE CVE CVE-2021-47337 page https://www.suse.com/security/cve/CVE-2021-47343/ SUSE CVE CVE-2021-47343 page https://www.suse.com/security/cve/CVE-2021-47344/ SUSE CVE CVE-2021-47344 page https://www.suse.com/security/cve/CVE-2021-47345/ SUSE CVE CVE-2021-47345 page https://www.suse.com/security/cve/CVE-2021-47347/ SUSE CVE CVE-2021-47347 page https://www.suse.com/security/cve/CVE-2021-47352/ SUSE CVE CVE-2021-47352 page https://www.suse.com/security/cve/CVE-2021-47353/ SUSE CVE CVE-2021-47353 page https://www.suse.com/security/cve/CVE-2021-47355/ SUSE CVE CVE-2021-47355 page https://www.suse.com/security/cve/CVE-2021-47356/ SUSE CVE CVE-2021-47356 page https://www.suse.com/security/cve/CVE-2021-47357/ SUSE CVE CVE-2021-47357 page https://www.suse.com/security/cve/CVE-2021-47361/ SUSE CVE CVE-2021-47361 page https://www.suse.com/security/cve/CVE-2021-47362/ SUSE CVE CVE-2021-47362 page https://www.suse.com/security/cve/CVE-2021-47369/ SUSE CVE CVE-2021-47369 page https://www.suse.com/security/cve/CVE-2021-47375/ SUSE CVE CVE-2021-47375 page https://www.suse.com/security/cve/CVE-2021-47378/ SUSE CVE CVE-2021-47378 page https://www.suse.com/security/cve/CVE-2021-47382/ SUSE CVE CVE-2021-47382 page https://www.suse.com/security/cve/CVE-2021-47383/ SUSE CVE CVE-2021-47383 page https://www.suse.com/security/cve/CVE-2021-47391/ SUSE CVE CVE-2021-47391 page https://www.suse.com/security/cve/CVE-2021-47397/ SUSE CVE CVE-2021-47397 page https://www.suse.com/security/cve/CVE-2021-47400/ SUSE CVE CVE-2021-47400 page https://www.suse.com/security/cve/CVE-2021-47401/ SUSE CVE CVE-2021-47401 page https://www.suse.com/security/cve/CVE-2021-47404/ SUSE CVE CVE-2021-47404 page https://www.suse.com/security/cve/CVE-2021-47409/ SUSE CVE CVE-2021-47409 page https://www.suse.com/security/cve/CVE-2021-47416/ SUSE CVE CVE-2021-47416 page https://www.suse.com/security/cve/CVE-2021-47423/ SUSE CVE CVE-2021-47423 page https://www.suse.com/security/cve/CVE-2021-47424/ SUSE CVE CVE-2021-47424 page https://www.suse.com/security/cve/CVE-2021-47431/ SUSE CVE CVE-2021-47431 page https://www.suse.com/security/cve/CVE-2021-47435/ SUSE CVE CVE-2021-47435 page https://www.suse.com/security/cve/CVE-2021-47436/ SUSE CVE CVE-2021-47436 page https://www.suse.com/security/cve/CVE-2021-47456/ SUSE CVE CVE-2021-47456 page https://www.suse.com/security/cve/CVE-2021-47458/ SUSE CVE CVE-2021-47458 page https://www.suse.com/security/cve/CVE-2021-47460/ SUSE CVE CVE-2021-47460 page https://www.suse.com/security/cve/CVE-2021-47469/ SUSE CVE CVE-2021-47469 page https://www.suse.com/security/cve/CVE-2021-47472/ SUSE CVE CVE-2021-47472 page https://www.suse.com/security/cve/CVE-2021-47473/ SUSE CVE CVE-2021-47473 page https://www.suse.com/security/cve/CVE-2021-47478/ SUSE CVE CVE-2021-47478 page https://www.suse.com/security/cve/CVE-2021-47480/ SUSE CVE CVE-2021-47480 page https://www.suse.com/security/cve/CVE-2021-47483/ SUSE CVE CVE-2021-47483 page https://www.suse.com/security/cve/CVE-2021-47485/ SUSE CVE CVE-2021-47485 page https://www.suse.com/security/cve/CVE-2021-47495/ SUSE CVE CVE-2021-47495 page https://www.suse.com/security/cve/CVE-2021-47496/ SUSE CVE CVE-2021-47496 page https://www.suse.com/security/cve/CVE-2021-47497/ SUSE CVE CVE-2021-47497 page https://www.suse.com/security/cve/CVE-2021-47500/ SUSE CVE CVE-2021-47500 page https://www.suse.com/security/cve/CVE-2021-47506/ SUSE CVE CVE-2021-47506 page https://www.suse.com/security/cve/CVE-2021-47509/ SUSE CVE CVE-2021-47509 page https://www.suse.com/security/cve/CVE-2021-47511/ SUSE CVE CVE-2021-47511 page https://www.suse.com/security/cve/CVE-2021-47523/ SUSE CVE CVE-2021-47523 page https://www.suse.com/security/cve/CVE-2021-47541/ SUSE CVE CVE-2021-47541 page https://www.suse.com/security/cve/CVE-2021-47548/ SUSE CVE CVE-2021-47548 page https://www.suse.com/security/cve/CVE-2021-47565/ SUSE CVE CVE-2021-47565 page https://www.suse.com/security/cve/CVE-2022-48636/ SUSE CVE CVE-2022-48636 page https://www.suse.com/security/cve/CVE-2022-48650/ SUSE CVE CVE-2022-48650 page https://www.suse.com/security/cve/CVE-2022-48672/ SUSE CVE CVE-2022-48672 page https://www.suse.com/security/cve/CVE-2022-48686/ SUSE CVE CVE-2022-48686 page https://www.suse.com/security/cve/CVE-2022-48697/ SUSE CVE CVE-2022-48697 page https://www.suse.com/security/cve/CVE-2022-48702/ SUSE CVE CVE-2022-48702 page https://www.suse.com/security/cve/CVE-2022-48704/ SUSE CVE CVE-2022-48704 page https://www.suse.com/security/cve/CVE-2022-48708/ SUSE CVE CVE-2022-48708 page https://www.suse.com/security/cve/CVE-2022-48710/ SUSE CVE CVE-2022-48710 page https://www.suse.com/security/cve/CVE-2023-0160/ SUSE CVE CVE-2023-0160 page https://www.suse.com/security/cve/CVE-2023-1829/ SUSE CVE CVE-2023-1829 page https://www.suse.com/security/cve/CVE-2023-42755/ SUSE CVE CVE-2023-42755 page https://www.suse.com/security/cve/CVE-2023-47233/ SUSE CVE CVE-2023-47233 page https://www.suse.com/security/cve/CVE-2023-52527/ SUSE CVE CVE-2023-52527 page https://www.suse.com/security/cve/CVE-2023-52586/ SUSE CVE CVE-2023-52586 page https://www.suse.com/security/cve/CVE-2023-52591/ SUSE CVE CVE-2023-52591 page https://www.suse.com/security/cve/CVE-2023-52646/ SUSE CVE CVE-2023-52646 page https://www.suse.com/security/cve/CVE-2023-52653/ SUSE CVE CVE-2023-52653 page https://www.suse.com/security/cve/CVE-2023-52655/ SUSE CVE CVE-2023-52655 page https://www.suse.com/security/cve/CVE-2023-52664/ SUSE CVE CVE-2023-52664 page https://www.suse.com/security/cve/CVE-2023-52685/ SUSE CVE CVE-2023-52685 page https://www.suse.com/security/cve/CVE-2023-52686/ SUSE CVE CVE-2023-52686 page https://www.suse.com/security/cve/CVE-2023-52691/ SUSE CVE CVE-2023-52691 page https://www.suse.com/security/cve/CVE-2023-52696/ SUSE CVE CVE-2023-52696 page https://www.suse.com/security/cve/CVE-2023-52698/ SUSE CVE CVE-2023-52698 page https://www.suse.com/security/cve/CVE-2023-52703/ SUSE CVE CVE-2023-52703 page https://www.suse.com/security/cve/CVE-2023-52730/ SUSE CVE CVE-2023-52730 page https://www.suse.com/security/cve/CVE-2023-52732/ SUSE CVE CVE-2023-52732 page https://www.suse.com/security/cve/CVE-2023-52741/ SUSE CVE CVE-2023-52741 page https://www.suse.com/security/cve/CVE-2023-52742/ SUSE CVE CVE-2023-52742 page https://www.suse.com/security/cve/CVE-2023-52747/ SUSE CVE CVE-2023-52747 page https://www.suse.com/security/cve/CVE-2023-52759/ SUSE CVE CVE-2023-52759 page https://www.suse.com/security/cve/CVE-2023-52774/ SUSE CVE CVE-2023-52774 page https://www.suse.com/security/cve/CVE-2023-52781/ SUSE CVE CVE-2023-52781 page https://www.suse.com/security/cve/CVE-2023-52796/ SUSE CVE CVE-2023-52796 page https://www.suse.com/security/cve/CVE-2023-52803/ SUSE CVE CVE-2023-52803 page https://www.suse.com/security/cve/CVE-2023-52821/ SUSE CVE CVE-2023-52821 page https://www.suse.com/security/cve/CVE-2023-52864/ SUSE CVE CVE-2023-52864 page https://www.suse.com/security/cve/CVE-2023-52865/ SUSE CVE CVE-2023-52865 page https://www.suse.com/security/cve/CVE-2023-52867/ SUSE CVE CVE-2023-52867 page https://www.suse.com/security/cve/CVE-2023-52875/ SUSE CVE CVE-2023-52875 page https://www.suse.com/security/cve/CVE-2023-52880/ SUSE CVE CVE-2023-52880 page https://www.suse.com/security/cve/CVE-2024-0639/ SUSE CVE CVE-2024-0639 page https://www.suse.com/security/cve/CVE-2024-26625/ SUSE CVE CVE-2024-26625 page https://www.suse.com/security/cve/CVE-2024-26739/ SUSE CVE CVE-2024-26739 page https://www.suse.com/security/cve/CVE-2024-26752/ SUSE CVE CVE-2024-26752 page https://www.suse.com/security/cve/CVE-2024-26775/ SUSE CVE CVE-2024-26775 page https://www.suse.com/security/cve/CVE-2024-26791/ SUSE CVE CVE-2024-26791 page https://www.suse.com/security/cve/CVE-2024-26828/ SUSE CVE CVE-2024-26828 page https://www.suse.com/security/cve/CVE-2024-26846/ SUSE CVE CVE-2024-26846 page https://www.suse.com/security/cve/CVE-2024-26874/ SUSE CVE CVE-2024-26874 page https://www.suse.com/security/cve/CVE-2024-26876/ SUSE CVE CVE-2024-26876 page https://www.suse.com/security/cve/CVE-2024-26900/ SUSE CVE CVE-2024-26900 page https://www.suse.com/security/cve/CVE-2024-26915/ SUSE CVE CVE-2024-26915 page https://www.suse.com/security/cve/CVE-2024-26920/ SUSE CVE CVE-2024-26920 page https://www.suse.com/security/cve/CVE-2024-26921/ SUSE CVE CVE-2024-26921 page https://www.suse.com/security/cve/CVE-2024-26929/ SUSE CVE CVE-2024-26929 page https://www.suse.com/security/cve/CVE-2024-26930/ SUSE CVE CVE-2024-26930 page https://www.suse.com/security/cve/CVE-2024-26931/ SUSE CVE CVE-2024-26931 page https://www.suse.com/security/cve/CVE-2024-26934/ SUSE CVE CVE-2024-26934 page https://www.suse.com/security/cve/CVE-2024-26957/ SUSE CVE CVE-2024-26957 page https://www.suse.com/security/cve/CVE-2024-26958/ SUSE CVE CVE-2024-26958 page https://www.suse.com/security/cve/CVE-2024-26984/ SUSE CVE CVE-2024-26984 page https://www.suse.com/security/cve/CVE-2024-26996/ SUSE CVE CVE-2024-26996 page https://www.suse.com/security/cve/CVE-2024-27008/ SUSE CVE CVE-2024-27008 page https://www.suse.com/security/cve/CVE-2024-27054/ SUSE CVE CVE-2024-27054 page https://www.suse.com/security/cve/CVE-2024-27059/ SUSE CVE CVE-2024-27059 page https://www.suse.com/security/cve/CVE-2024-27062/ SUSE CVE CVE-2024-27062 page https://www.suse.com/security/cve/CVE-2024-27388/ SUSE CVE CVE-2024-27388 page https://www.suse.com/security/cve/CVE-2024-27396/ SUSE CVE CVE-2024-27396 page https://www.suse.com/security/cve/CVE-2024-27398/ SUSE CVE CVE-2024-27398 page https://www.suse.com/security/cve/CVE-2024-27401/ SUSE CVE CVE-2024-27401 page https://www.suse.com/security/cve/CVE-2024-27419/ SUSE CVE CVE-2024-27419 page https://www.suse.com/security/cve/CVE-2024-27436/ SUSE CVE CVE-2024-27436 page https://www.suse.com/security/cve/CVE-2024-35789/ SUSE CVE CVE-2024-35789 page https://www.suse.com/security/cve/CVE-2024-35791/ SUSE CVE CVE-2024-35791 page https://www.suse.com/security/cve/CVE-2024-35809/ SUSE CVE CVE-2024-35809 page https://www.suse.com/security/cve/CVE-2024-35811/ SUSE CVE CVE-2024-35811 page https://www.suse.com/security/cve/CVE-2024-35830/ SUSE CVE CVE-2024-35830 page https://www.suse.com/security/cve/CVE-2024-35849/ SUSE CVE CVE-2024-35849 page https://www.suse.com/security/cve/CVE-2024-35877/ SUSE CVE CVE-2024-35877 page https://www.suse.com/security/cve/CVE-2024-35878/ SUSE CVE CVE-2024-35878 page https://www.suse.com/security/cve/CVE-2024-35887/ SUSE CVE CVE-2024-35887 page https://www.suse.com/security/cve/CVE-2024-35895/ SUSE CVE CVE-2024-35895 page https://www.suse.com/security/cve/CVE-2024-35914/ SUSE CVE CVE-2024-35914 page https://www.suse.com/security/cve/CVE-2024-35932/ SUSE CVE CVE-2024-35932 page https://www.suse.com/security/cve/CVE-2024-35935/ SUSE CVE CVE-2024-35935 page https://www.suse.com/security/cve/CVE-2024-35936/ SUSE CVE CVE-2024-35936 page https://www.suse.com/security/cve/CVE-2024-35944/ SUSE CVE CVE-2024-35944 page https://www.suse.com/security/cve/CVE-2024-35955/ SUSE CVE CVE-2024-35955 page https://www.suse.com/security/cve/CVE-2024-35969/ SUSE CVE CVE-2024-35969 page https://www.suse.com/security/cve/CVE-2024-35982/ SUSE CVE CVE-2024-35982 page https://www.suse.com/security/cve/CVE-2024-35984/ SUSE CVE CVE-2024-35984 page https://www.suse.com/security/cve/CVE-2024-36015/ SUSE CVE CVE-2024-36015 page https://www.suse.com/security/cve/CVE-2024-36029/ SUSE CVE CVE-2024-36029 page https://www.suse.com/security/cve/CVE-2024-36954/ SUSE CVE CVE-2024-36954 page SUSE Linux Enterprise Real Time 12 SP5 cluster-md-kmp-rt-4.12.14-10.188.1 cluster-md-kmp-rt_debug-4.12.14-10.188.1 dlm-kmp-rt-4.12.14-10.188.1 dlm-kmp-rt_debug-4.12.14-10.188.1 gfs2-kmp-rt-4.12.14-10.188.1 gfs2-kmp-rt_debug-4.12.14-10.188.1 kernel-devel-rt-4.12.14-10.188.1 kernel-rt-4.12.14-10.188.1 kernel-rt-base-4.12.14-10.188.1 kernel-rt-devel-4.12.14-10.188.1 kernel-rt-extra-4.12.14-10.188.1 kernel-rt-kgraft-devel-4.12.14-10.188.1 kernel-rt_debug-4.12.14-10.188.1 kernel-rt_debug-base-4.12.14-10.188.1 kernel-rt_debug-devel-4.12.14-10.188.1 kernel-rt_debug-extra-4.12.14-10.188.1 kernel-rt_debug-kgraft-devel-4.12.14-10.188.1 kernel-source-rt-4.12.14-10.188.1 kernel-syms-rt-4.12.14-10.188.1 kselftests-kmp-rt-4.12.14-10.188.1 kselftests-kmp-rt_debug-4.12.14-10.188.1 ocfs2-kmp-rt-4.12.14-10.188.1 ocfs2-kmp-rt_debug-4.12.14-10.188.1 cluster-md-kmp-rt-4.12.14-10.188.1 as a component of SUSE Linux Enterprise Real Time 12 SP5 dlm-kmp-rt-4.12.14-10.188.1 as a component of SUSE Linux Enterprise Real Time 12 SP5 gfs2-kmp-rt-4.12.14-10.188.1 as a component of SUSE Linux Enterprise Real Time 12 SP5 kernel-devel-rt-4.12.14-10.188.1 as a component of SUSE Linux Enterprise Real Time 12 SP5 kernel-rt-4.12.14-10.188.1 as a component of SUSE Linux Enterprise Real Time 12 SP5 kernel-rt-base-4.12.14-10.188.1 as a component of SUSE Linux Enterprise Real Time 12 SP5 kernel-rt-devel-4.12.14-10.188.1 as a component of SUSE Linux Enterprise Real Time 12 SP5 kernel-rt_debug-4.12.14-10.188.1 as a component of SUSE Linux Enterprise Real Time 12 SP5 kernel-rt_debug-devel-4.12.14-10.188.1 as a component of SUSE Linux Enterprise Real Time 12 SP5 kernel-source-rt-4.12.14-10.188.1 as a component of SUSE Linux Enterprise Real Time 12 SP5 kernel-syms-rt-4.12.14-10.188.1 as a component of SUSE Linux Enterprise Real Time 12 SP5 ocfs2-kmp-rt-4.12.14-10.188.1 as a component of SUSE Linux Enterprise Real Time 12 SP5 In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear. ffs_data_clear is indirectly called from both ffs_fs_kill_sb and ffs_ep0_release, so it ends up being called twice when userland closes ep0 and then unmounts f_fs. If userland provided an eventfd along with function's USB descriptors, it ends up calling eventfd_ctx_put as many times, causing a refcount underflow. NULL-ify ffs_eventfd to prevent these extraneous eventfd_ctx_put calls. Also, set epfiles to NULL right after de-allocating it, for readability. For completeness, ffs_data_clear actually ends up being called thrice, the last call being before the whole ffs structure gets freed, so when this specific sequence happens there is a second underflow happening (but not being reported): /sys/kernel/debug/tracing# modprobe usb_f_fs /sys/kernel/debug/tracing# echo ffs_data_clear > set_ftrace_filter /sys/kernel/debug/tracing# echo function > current_tracer /sys/kernel/debug/tracing# echo 1 > tracing_on (setup gadget, run and kill function userland process, teardown gadget) /sys/kernel/debug/tracing# echo 0 > tracing_on /sys/kernel/debug/tracing# cat trace smartcard-openp-436 [000] ..... 1946.208786: ffs_data_clear <-ffs_data_closed smartcard-openp-431 [000] ..... 1946.279147: ffs_data_clear <-ffs_data_closed smartcard-openp-431 [000] .n... 1946.905512: ffs_data_clear <-ffs_data_put Warning output corresponding to above trace: [ 1946.284139] WARNING: CPU: 0 PID: 431 at lib/refcount.c:28 refcount_warn_saturate+0x110/0x15c [ 1946.293094] refcount_t: underflow; use-after-free. [ 1946.298164] Modules linked in: usb_f_ncm(E) u_ether(E) usb_f_fs(E) hci_uart(E) btqca(E) btrtl(E) btbcm(E) btintel(E) bluetooth(E) nls_ascii(E) nls_cp437(E) vfat(E) fat(E) bcm2835_v4l2(CE) bcm2835_mmal_vchiq(CE) videobuf2_vmalloc(E) videobuf2_memops(E) sha512_generic(E) videobuf2_v4l2(E) sha512_arm(E) videobuf2_common(E) videodev(E) cpufreq_dt(E) snd_bcm2835(CE) brcmfmac(E) mc(E) vc4(E) ctr(E) brcmutil(E) snd_soc_core(E) snd_pcm_dmaengine(E) drbg(E) snd_pcm(E) snd_timer(E) snd(E) soundcore(E) drm_kms_helper(E) cec(E) ansi_cprng(E) rc_core(E) syscopyarea(E) raspberrypi_cpufreq(E) sysfillrect(E) sysimgblt(E) cfg80211(E) max17040_battery(OE) raspberrypi_hwmon(E) fb_sys_fops(E) regmap_i2c(E) ecdh_generic(E) rfkill(E) ecc(E) bcm2835_rng(E) rng_core(E) vchiq(CE) leds_gpio(E) libcomposite(E) fuse(E) configfs(E) ip_tables(E) x_tables(E) autofs4(E) ext4(E) crc16(E) mbcache(E) jbd2(E) crc32c_generic(E) sdhci_iproc(E) sdhci_pltfm(E) sdhci(E) [ 1946.399633] CPU: 0 PID: 431 Comm: smartcard-openp Tainted: G C OE 5.15.0-1-rpi #1 Debian 5.15.3-1 [ 1946.417950] Hardware name: BCM2835 [ 1946.425442] Backtrace: [ 1946.432048] [<c08d60a0>] (dump_backtrace) from [<c08d62ec>] (show_stack+0x20/0x24) [ 1946.448226] r7:00000009 r6:0000001c r5:c04a948c r4:c0a64e2c [ 1946.458412] [<c08d62cc>] (show_stack) from [<c08d9ae0>] (dump_stack+0x28/0x30) [ 1946.470380] [<c08d9ab8>] (dump_stack) from [<c0123500>] (__warn+0xe8/0x154) [ 1946.482067] r5:c04a948c r4:c0a71dc8 [ 1946.490184] [<c0123418>] (__warn) from [<c08d6948>] (warn_slowpath_fmt+0xa0/0xe4) [ 1946.506758] r7:00000009 r6:0000001c r5:c0a71dc8 r4:c0a71e04 [ 1946.517070] [<c08d68ac>] (warn_slowpath_fmt) from [<c04a948c>] (refcount_warn_saturate+0x110/0x15c) [ 1946.535309] r8:c0100224 r7:c0dfcb84 r6:ffffffff r5:c3b84c00 r4:c24a17c0 [ 1946.546708] [<c04a937c>] (refcount_warn_saturate) from [<c0380134>] (eventfd_ctx_put+0x48/0x74) [ 1946.564476] [<c03800ec>] (eventfd_ctx_put) from [<bf5464e8>] (ffs_data_clear+0xd0/0x118 [usb_f_fs]) [ 1946.582664] r5:c3b84c00 r4:c2695b00 [ 1946.590668] [<bf546418>] (ffs_data_clear [usb_f_fs]) from [<bf547cc0>] (ffs_data_closed+0x9c/0x150 [usb_f_fs]) [ 1946.609608] r5:bf54d014 r4:c2695b00 [ 1946.617522] [<bf547c24>] (ffs_data_closed [usb_f_fs]) from [<bf547da0>] (ffs_fs_kill_sb+0x2c/0x30 [usb_f_fs]) [ 1946.636217] r7:c0dfcb ---truncated--- CVE-2021-46933 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-46933.html CVE-2021-46933 https://bugzilla.suse.com/1220487 SUSE Bug 1220487 In the Linux kernel, the following vulnerability has been resolved: openvswitch: fix stack OOB read while fragmenting IPv4 packets running openvswitch on kernels built with KASAN, it's possible to see the following splat while testing fragmentation of IPv4 packets: BUG: KASAN: stack-out-of-bounds in ip_do_fragment+0x1b03/0x1f60 Read of size 1 at addr ffff888112fc713c by task handler2/1367 CPU: 0 PID: 1367 Comm: handler2 Not tainted 5.12.0-rc6+ #418 Hardware name: Red Hat KVM, BIOS 1.11.1-4.module+el8.1.0+4066+0f1aadab 04/01/2014 Call Trace: dump_stack+0x92/0xc1 print_address_description.constprop.7+0x1a/0x150 kasan_report.cold.13+0x7f/0x111 ip_do_fragment+0x1b03/0x1f60 ovs_fragment+0x5bf/0x840 [openvswitch] do_execute_actions+0x1bd5/0x2400 [openvswitch] ovs_execute_actions+0xc8/0x3d0 [openvswitch] ovs_packet_cmd_execute+0xa39/0x1150 [openvswitch] genl_family_rcv_msg_doit.isra.15+0x227/0x2d0 genl_rcv_msg+0x287/0x490 netlink_rcv_skb+0x120/0x380 genl_rcv+0x24/0x40 netlink_unicast+0x439/0x630 netlink_sendmsg+0x719/0xbf0 sock_sendmsg+0xe2/0x110 ____sys_sendmsg+0x5ba/0x890 ___sys_sendmsg+0xe9/0x160 __sys_sendmsg+0xd3/0x170 do_syscall_64+0x33/0x40 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f957079db07 Code: c3 66 90 41 54 41 89 d4 55 48 89 f5 53 89 fb 48 83 ec 10 e8 eb ec ff ff 44 89 e2 48 89 ee 89 df 41 89 c0 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 48 89 44 24 08 e8 24 ed ff ff 48 RSP: 002b:00007f956ce35a50 EFLAGS: 00000293 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 0000000000000019 RCX: 00007f957079db07 RDX: 0000000000000000 RSI: 00007f956ce35ae0 RDI: 0000000000000019 RBP: 00007f956ce35ae0 R08: 0000000000000000 R09: 00007f9558006730 R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 R13: 00007f956ce37308 R14: 00007f956ce35f80 R15: 00007f956ce35ae0 The buggy address belongs to the page: page:00000000af2a1d93 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x112fc7 flags: 0x17ffffc0000000() raw: 0017ffffc0000000 0000000000000000 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected addr ffff888112fc713c is located in stack of task handler2/1367 at offset 180 in frame: ovs_fragment+0x0/0x840 [openvswitch] this frame has 2 objects: [32, 144) 'ovs_dst' [192, 424) 'ovs_rt' Memory state around the buggy address: ffff888112fc7000: f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff888112fc7080: 00 f1 f1 f1 f1 00 00 00 00 00 00 00 00 00 00 00 >ffff888112fc7100: 00 00 00 f2 f2 f2 f2 f2 f2 00 00 00 00 00 00 00 ^ ffff888112fc7180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff888112fc7200: 00 00 00 00 00 00 f2 f2 f2 00 00 00 00 00 00 00 for IPv4 packets, ovs_fragment() uses a temporary struct dst_entry. Then, in the following call graph: ip_do_fragment() ip_skb_dst_mtu() ip_dst_mtu_maybe_forward() ip_mtu_locked() the pointer to struct dst_entry is used as pointer to struct rtable: this turns the access to struct members like rt_mtu_locked into an OOB read in the stack. Fix this changing the temporary variable used for IPv4 packets in ovs_fragment(), similarly to what is done for IPv6 few lines below. CVE-2021-46955 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-46955.html CVE-2021-46955 https://bugzilla.suse.com/1220513 SUSE Bug 1220513 https://bugzilla.suse.com/1220537 SUSE Bug 1220537 In the Linux kernel, the following vulnerability has been resolved: nvme-loop: fix memory leak in nvme_loop_create_ctrl() When creating loop ctrl in nvme_loop_create_ctrl(), if nvme_init_ctrl() fails, the loop ctrl should be freed before jumping to the "out" label. CVE-2021-47074 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47074.html CVE-2021-47074 https://bugzilla.suse.com/1220854 SUSE Bug 1220854 In the Linux kernel, the following vulnerability has been resolved: btrfs: abort in rename_exchange if we fail to insert the second ref Error injection stress uncovered a problem where we'd leave a dangling inode ref if we failed during a rename_exchange. This happens because we insert the inode ref for one side of the rename, and then for the other side. If this second inode ref insert fails we'll leave the first one dangling and leave a corrupt file system behind. Fix this by aborting if we did the insert for the first inode ref. CVE-2021-47113 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47113.html CVE-2021-47113 https://bugzilla.suse.com/1221543 SUSE Bug 1221543 In the Linux kernel, the following vulnerability has been resolved: net/tls: Fix use-after-free after the TLS device goes down and up When a netdev with active TLS offload goes down, tls_device_down is called to stop the offload and tear down the TLS context. However, the socket stays alive, and it still points to the TLS context, which is now deallocated. If a netdev goes up, while the connection is still active, and the data flow resumes after a number of TCP retransmissions, it will lead to a use-after-free of the TLS context. This commit addresses this bug by keeping the context alive until its normal destruction, and implements the necessary fallbacks, so that the connection can resume in software (non-offloaded) kTLS mode. On the TX side tls_sw_fallback is used to encrypt all packets. The RX side already has all the necessary fallbacks, because receiving non-decrypted packets is supported. The thing needed on the RX side is to block resync requests, which are normally produced after receiving non-decrypted packets. The necessary synchronization is implemented for a graceful teardown: first the fallbacks are deployed, then the driver resources are released (it used to be possible to have a tls_dev_resync after tls_dev_del). A new flag called TLS_RX_DEV_DEGRADED is added to indicate the fallback mode. It's used to skip the RX resync logic completely, as it becomes useless, and some objects may be released (for example, resync_async, which is allocated and freed by the driver). CVE-2021-47131 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47131.html CVE-2021-47131 https://bugzilla.suse.com/1221545 SUSE Bug 1221545 https://bugzilla.suse.com/1222402 SUSE Bug 1222402 In the Linux kernel, the following vulnerability has been resolved: tipc: skb_linearize the head skb when reassembling msgs It's not a good idea to append the frag skb to a skb's frag_list if the frag_list already has skbs from elsewhere, such as this skb was created by pskb_copy() where the frag_list was cloned (all the skbs in it were skb_get'ed) and shared by multiple skbs. However, the new appended frag skb should have been only seen by the current skb. Otherwise, it will cause use after free crashes as this appended frag skb are seen by multiple skbs but it only got skb_get called once. The same thing happens with a skb updated by pskb_may_pull() with a skb_cloned skb. Li Shuang has reported quite a few crashes caused by this when doing testing over macvlan devices: [] kernel BUG at net/core/skbuff.c:1970! [] Call Trace: [] skb_clone+0x4d/0xb0 [] macvlan_broadcast+0xd8/0x160 [macvlan] [] macvlan_process_broadcast+0x148/0x150 [macvlan] [] process_one_work+0x1a7/0x360 [] worker_thread+0x30/0x390 [] kernel BUG at mm/usercopy.c:102! [] Call Trace: [] __check_heap_object+0xd3/0x100 [] __check_object_size+0xff/0x16b [] simple_copy_to_iter+0x1c/0x30 [] __skb_datagram_iter+0x7d/0x310 [] __skb_datagram_iter+0x2a5/0x310 [] skb_copy_datagram_iter+0x3b/0x90 [] tipc_recvmsg+0x14a/0x3a0 [tipc] [] ____sys_recvmsg+0x91/0x150 [] ___sys_recvmsg+0x7b/0xc0 [] kernel BUG at mm/slub.c:305! [] Call Trace: [] <IRQ> [] kmem_cache_free+0x3ff/0x400 [] __netif_receive_skb_core+0x12c/0xc40 [] ? kmem_cache_alloc+0x12e/0x270 [] netif_receive_skb_internal+0x3d/0xb0 [] ? get_rx_page_info+0x8e/0xa0 [be2net] [] be_poll+0x6ef/0xd00 [be2net] [] ? irq_exit+0x4f/0x100 [] net_rx_action+0x149/0x3b0 ... This patch is to fix it by linearizing the head skb if it has frag_list set in tipc_buf_append(). Note that we choose to do this before calling skb_unshare(), as __skb_linearize() will avoid skb_copy(). Also, we can not just drop the frag_list either as the early time. CVE-2021-47162 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47162.html CVE-2021-47162 https://bugzilla.suse.com/1221977 SUSE Bug 1221977 In the Linux kernel, the following vulnerability has been resolved: net: usb: fix memory leak in smsc75xx_bind Syzbot reported memory leak in smsc75xx_bind(). The problem was is non-freed memory in case of errors after memory allocation. backtrace: [<ffffffff84245b62>] kmalloc include/linux/slab.h:556 [inline] [<ffffffff84245b62>] kzalloc include/linux/slab.h:686 [inline] [<ffffffff84245b62>] smsc75xx_bind+0x7a/0x334 drivers/net/usb/smsc75xx.c:1460 [<ffffffff82b5b2e6>] usbnet_probe+0x3b6/0xc30 drivers/net/usb/usbnet.c:1728 CVE-2021-47171 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47171.html CVE-2021-47171 https://bugzilla.suse.com/1221994 SUSE Bug 1221994 In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Improve SCSI abort handling The following has been observed on a test setup: WARNING: CPU: 4 PID: 250 at drivers/scsi/ufs/ufshcd.c:2737 ufshcd_queuecommand+0x468/0x65c Call trace: ufshcd_queuecommand+0x468/0x65c scsi_send_eh_cmnd+0x224/0x6a0 scsi_eh_test_devices+0x248/0x418 scsi_eh_ready_devs+0xc34/0xe58 scsi_error_handler+0x204/0x80c kthread+0x150/0x1b4 ret_from_fork+0x10/0x30 That warning is triggered by the following statement: WARN_ON(lrbp->cmd); Fix this warning by clearing lrbp->cmd from the abort handler. CVE-2021-47188 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47188.html CVE-2021-47188 https://bugzilla.suse.com/1222671 SUSE Bug 1222671 In the Linux kernel, the following vulnerability has been resolved: usb: host: ohci-tmio: check return value after calling platform_get_resource() It will cause null-ptr-deref if platform_get_resource() returns NULL, we need check the return value. CVE-2021-47206 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47206.html CVE-2021-47206 https://bugzilla.suse.com/1222894 SUSE Bug 1222894 ** REJECT ** This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. CVE-2021-47220 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47220.html CVE-2021-47220 https://bugzilla.suse.com/1224859 SUSE Bug 1224859 In the Linux kernel, the following vulnerability has been resolved: PCI: aardvark: Fix kernel panic during PIO transfer Trying to start a new PIO transfer by writing value 0 in PIO_START register when previous transfer has not yet completed (which is indicated by value 1 in PIO_START) causes an External Abort on CPU, which results in kernel panic: SError Interrupt on CPU0, code 0xbf000002 -- SError Kernel panic - not syncing: Asynchronous SError Interrupt To prevent kernel panic, it is required to reject a new PIO transfer when previous one has not finished yet. If previous PIO transfer is not finished yet, the kernel may issue a new PIO request only if the previous PIO transfer timed out. In the past the root cause of this issue was incorrectly identified (as it often happens during link retraining or after link down event) and special hack was implemented in Trusted Firmware to catch all SError events in EL3, to ignore errors with code 0xbf000002 and not forwarding any other errors to kernel and instead throw panic from EL3 Trusted Firmware handler. Links to discussion and patches about this issue: https://git.trustedfirmware.org/TF-A/trusted-firmware-a.git/commit/?id=3c7dcdac5c50 https://lore.kernel.org/linux-pci/20190316161243.29517-1-repk@triplefau.lt/ https://lore.kernel.org/linux-pci/971be151d24312cc533989a64bd454b4@www.loen.fr/ https://review.trustedfirmware.org/c/TF-A/trusted-firmware-a/+/1541 But the real cause was the fact that during link retraining or after link down event the PIO transfer may take longer time, up to the 1.44s until it times out. This increased probability that a new PIO transfer would be issued by kernel while previous one has not finished yet. After applying this change into the kernel, it is possible to revert the mentioned TF-A hack and SError events do not have to be caught in TF-A EL3. CVE-2021-47229 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47229.html CVE-2021-47229 https://bugzilla.suse.com/1224854 SUSE Bug 1224854 In the Linux kernel, the following vulnerability has been resolved: can: mcba_usb: fix memory leak in mcba_usb Syzbot reported memory leak in SocketCAN driver for Microchip CAN BUS Analyzer Tool. The problem was in unfreed usb_coherent. In mcba_usb_start() 20 coherent buffers are allocated and there is nothing, that frees them: 1) In callback function the urb is resubmitted and that's all 2) In disconnect function urbs are simply killed, but URB_FREE_BUFFER is not set (see mcba_usb_start) and this flag cannot be used with coherent buffers. Fail log: | [ 1354.053291][ T8413] mcba_usb 1-1:0.0 can0: device disconnected | [ 1367.059384][ T8420] kmemleak: 20 new suspected memory leaks (see /sys/kernel/debug/kmem) So, all allocated buffers should be freed with usb_free_coherent() explicitly NOTE: The same pattern for allocating and freeing coherent buffers is used in drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c CVE-2021-47231 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47231.html CVE-2021-47231 https://bugzilla.suse.com/1224849 SUSE Bug 1224849 In the Linux kernel, the following vulnerability has been resolved: net: ethernet: fix potential use-after-free in ec_bhf_remove static void ec_bhf_remove(struct pci_dev *dev) { ... struct ec_bhf_priv *priv = netdev_priv(net_dev); unregister_netdev(net_dev); free_netdev(net_dev); pci_iounmap(dev, priv->dma_io); pci_iounmap(dev, priv->io); ... } priv is netdev private data, but it is used after free_netdev(). It can cause use-after-free when accessing priv pointer. So, fix it by moving free_netdev() after pci_iounmap() calls. CVE-2021-47235 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47235.html CVE-2021-47235 https://bugzilla.suse.com/1224844 SUSE Bug 1224844 In the Linux kernel, the following vulnerability has been resolved: net: cdc_eem: fix tx fixup skb leak when usbnet transmit a skb, eem fixup it in eem_tx_fixup(), if skb_copy_expand() failed, it return NULL, usbnet_start_xmit() will have no chance to free original skb. fix it by free orginal skb in eem_tx_fixup() first, then check skb clone status, if failed, return NULL to usbnet. CVE-2021-47236 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47236.html CVE-2021-47236 https://bugzilla.suse.com/1224841 SUSE Bug 1224841 In the Linux kernel, the following vulnerability has been resolved: net: hamradio: fix memory leak in mkiss_close My local syzbot instance hit memory leak in mkiss_open()[1]. The problem was in missing free_netdev() in mkiss_close(). In mkiss_open() netdevice is allocated and then registered, but in mkiss_close() netdevice was only unregistered, but not freed. Fail log: BUG: memory leak unreferenced object 0xffff8880281ba000 (size 4096): comm "syz-executor.1", pid 11443, jiffies 4295046091 (age 17.660s) hex dump (first 32 bytes): 61 78 30 00 00 00 00 00 00 00 00 00 00 00 00 00 ax0............. 00 27 fa 2a 80 88 ff ff 00 00 00 00 00 00 00 00 .'.*............ backtrace: [<ffffffff81a27201>] kvmalloc_node+0x61/0xf0 [<ffffffff8706e7e8>] alloc_netdev_mqs+0x98/0xe80 [<ffffffff84e64192>] mkiss_open+0xb2/0x6f0 [1] [<ffffffff842355db>] tty_ldisc_open+0x9b/0x110 [<ffffffff84236488>] tty_set_ldisc+0x2e8/0x670 [<ffffffff8421f7f3>] tty_ioctl+0xda3/0x1440 [<ffffffff81c9f273>] __x64_sys_ioctl+0x193/0x200 [<ffffffff8911263a>] do_syscall_64+0x3a/0xb0 [<ffffffff89200068>] entry_SYSCALL_64_after_hwframe+0x44/0xae BUG: memory leak unreferenced object 0xffff8880141a9a00 (size 96): comm "syz-executor.1", pid 11443, jiffies 4295046091 (age 17.660s) hex dump (first 32 bytes): e8 a2 1b 28 80 88 ff ff e8 a2 1b 28 80 88 ff ff ...(.......(.... 98 92 9c aa b0 40 02 00 00 00 00 00 00 00 00 00 .....@.......... backtrace: [<ffffffff8709f68b>] __hw_addr_create_ex+0x5b/0x310 [<ffffffff8709fb38>] __hw_addr_add_ex+0x1f8/0x2b0 [<ffffffff870a0c7b>] dev_addr_init+0x10b/0x1f0 [<ffffffff8706e88b>] alloc_netdev_mqs+0x13b/0xe80 [<ffffffff84e64192>] mkiss_open+0xb2/0x6f0 [1] [<ffffffff842355db>] tty_ldisc_open+0x9b/0x110 [<ffffffff84236488>] tty_set_ldisc+0x2e8/0x670 [<ffffffff8421f7f3>] tty_ioctl+0xda3/0x1440 [<ffffffff81c9f273>] __x64_sys_ioctl+0x193/0x200 [<ffffffff8911263a>] do_syscall_64+0x3a/0xb0 [<ffffffff89200068>] entry_SYSCALL_64_after_hwframe+0x44/0xae BUG: memory leak unreferenced object 0xffff8880219bfc00 (size 512): comm "syz-executor.1", pid 11443, jiffies 4295046091 (age 17.660s) hex dump (first 32 bytes): 00 a0 1b 28 80 88 ff ff 80 8f b1 8d ff ff ff ff ...(............ 80 8f b1 8d ff ff ff ff 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffff81a27201>] kvmalloc_node+0x61/0xf0 [<ffffffff8706eec7>] alloc_netdev_mqs+0x777/0xe80 [<ffffffff84e64192>] mkiss_open+0xb2/0x6f0 [1] [<ffffffff842355db>] tty_ldisc_open+0x9b/0x110 [<ffffffff84236488>] tty_set_ldisc+0x2e8/0x670 [<ffffffff8421f7f3>] tty_ioctl+0xda3/0x1440 [<ffffffff81c9f273>] __x64_sys_ioctl+0x193/0x200 [<ffffffff8911263a>] do_syscall_64+0x3a/0xb0 [<ffffffff89200068>] entry_SYSCALL_64_after_hwframe+0x44/0xae BUG: memory leak unreferenced object 0xffff888029b2b200 (size 256): comm "syz-executor.1", pid 11443, jiffies 4295046091 (age 17.660s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffff81a27201>] kvmalloc_node+0x61/0xf0 [<ffffffff8706f062>] alloc_netdev_mqs+0x912/0xe80 [<ffffffff84e64192>] mkiss_open+0xb2/0x6f0 [1] [<ffffffff842355db>] tty_ldisc_open+0x9b/0x110 [<ffffffff84236488>] tty_set_ldisc+0x2e8/0x670 [<ffffffff8421f7f3>] tty_ioctl+0xda3/0x1440 [<ffffffff81c9f273>] __x64_sys_ioctl+0x193/0x200 [<ffffffff8911263a>] do_syscall_64+0x3a/0xb0 [<ffffffff89200068>] entry_SYSCALL_64_after_hwframe+0x44/0xae CVE-2021-47237 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47237.html CVE-2021-47237 https://bugzilla.suse.com/1224830 SUSE Bug 1224830 In the Linux kernel, the following vulnerability has been resolved: net: ipv4: fix memory leak in ip_mc_add1_src BUG: memory leak unreferenced object 0xffff888101bc4c00 (size 32): comm "syz-executor527", pid 360, jiffies 4294807421 (age 19.329s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 01 00 00 00 00 00 00 00 ac 14 14 bb 00 00 02 00 ................ backtrace: [<00000000f17c5244>] kmalloc include/linux/slab.h:558 [inline] [<00000000f17c5244>] kzalloc include/linux/slab.h:688 [inline] [<00000000f17c5244>] ip_mc_add1_src net/ipv4/igmp.c:1971 [inline] [<00000000f17c5244>] ip_mc_add_src+0x95f/0xdb0 net/ipv4/igmp.c:2095 [<000000001cb99709>] ip_mc_source+0x84c/0xea0 net/ipv4/igmp.c:2416 [<0000000052cf19ed>] do_ip_setsockopt net/ipv4/ip_sockglue.c:1294 [inline] [<0000000052cf19ed>] ip_setsockopt+0x114b/0x30c0 net/ipv4/ip_sockglue.c:1423 [<00000000477edfbc>] raw_setsockopt+0x13d/0x170 net/ipv4/raw.c:857 [<00000000e75ca9bb>] __sys_setsockopt+0x158/0x270 net/socket.c:2117 [<00000000bdb993a8>] __do_sys_setsockopt net/socket.c:2128 [inline] [<00000000bdb993a8>] __se_sys_setsockopt net/socket.c:2125 [inline] [<00000000bdb993a8>] __x64_sys_setsockopt+0xba/0x150 net/socket.c:2125 [<000000006a1ffdbd>] do_syscall_64+0x40/0x80 arch/x86/entry/common.c:47 [<00000000b11467c4>] entry_SYSCALL_64_after_hwframe+0x44/0xae In commit 24803f38a5c0 ("igmp: do not remove igmp souce list info when set link down"), the ip_mc_clear_src() in ip_mc_destroy_dev() was removed, because it was also called in igmpv3_clear_delrec(). Rough callgraph: inetdev_destroy -> ip_mc_destroy_dev -> igmpv3_clear_delrec -> ip_mc_clear_src -> RCU_INIT_POINTER(dev->ip_ptr, NULL) However, ip_mc_clear_src() called in igmpv3_clear_delrec() doesn't release in_dev->mc_list->sources. And RCU_INIT_POINTER() assigns the NULL to dev->ip_ptr. As a result, in_dev cannot be obtained through inetdev_by_index() and then in_dev->mc_list->sources cannot be released by ip_mc_del1_src() in the sock_close. Rough call sequence goes like: sock_close -> __sock_release -> inet_release -> ip_mc_drop_socket -> inetdev_by_index -> ip_mc_leave_src -> ip_mc_del_src -> ip_mc_del1_src So we still need to call ip_mc_clear_src() in ip_mc_destroy_dev() to free in_dev->mc_list->sources. CVE-2021-47238 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47238.html CVE-2021-47238 https://bugzilla.suse.com/1224847 SUSE Bug 1224847 In the Linux kernel, the following vulnerability has been resolved: net: usb: fix possible use-after-free in smsc75xx_bind The commit 46a8b29c6306 ("net: usb: fix memory leak in smsc75xx_bind") fails to clean up the work scheduled in smsc75xx_reset-> smsc75xx_set_multicast, which leads to use-after-free if the work is scheduled to start after the deallocation. In addition, this patch also removes a dangling pointer - dev->data[0]. This patch calls cancel_work_sync to cancel the scheduled work and set the dangling pointer to NULL. CVE-2021-47239 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47239.html CVE-2021-47239 https://bugzilla.suse.com/1224846 SUSE Bug 1224846 In the Linux kernel, the following vulnerability has been resolved: netfilter: synproxy: Fix out of bounds when parsing TCP options The TCP option parser in synproxy (synproxy_parse_options) could read one byte out of bounds. When the length is 1, the execution flow gets into the loop, reads one byte of the opcode, and if the opcode is neither TCPOPT_EOL nor TCPOPT_NOP, it reads one more byte, which exceeds the length of 1. This fix is inspired by commit 9609dad263f8 ("ipv4: tcp_input: fix stack out of bounds when parsing TCP options."). v2 changes: Added an early return when length < 0 to avoid calling skb_header_pointer with negative length. CVE-2021-47245 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47245.html CVE-2021-47245 https://bugzilla.suse.com/1224838 SUSE Bug 1224838 In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix page reclaim for dead peer hairpin When adding a hairpin flow, a firmware-side send queue is created for the peer net device, which claims some host memory pages for its internal ring buffer. If the peer net device is removed/unbound before the hairpin flow is deleted, then the send queue is not destroyed which leads to a stack trace on pci device remove: [ 748.005230] mlx5_core 0000:08:00.2: wait_func:1094:(pid 12985): MANAGE_PAGES(0x108) timeout. Will cause a leak of a command resource [ 748.005231] mlx5_core 0000:08:00.2: reclaim_pages:514:(pid 12985): failed reclaiming pages: err -110 [ 748.001835] mlx5_core 0000:08:00.2: mlx5_reclaim_root_pages:653:(pid 12985): failed reclaiming pages (-110) for func id 0x0 [ 748.002171] ------------[ cut here ]------------ [ 748.001177] FW pages counter is 4 after reclaiming all pages [ 748.001186] WARNING: CPU: 1 PID: 12985 at drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c:685 mlx5_reclaim_startup_pages+0x34b/0x460 [mlx5_core] [ +0.002771] Modules linked in: cls_flower mlx5_ib mlx5_core ptp pps_core act_mirred sch_ingress openvswitch nsh xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink xt_addrtype iptable_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 br_netfilter rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi rdma_cm ib_umad ib_ipoib iw_cm ib_cm ib_uverbs ib_core overlay fuse [last unloaded: pps_core] [ 748.007225] CPU: 1 PID: 12985 Comm: tee Not tainted 5.12.0+ #1 [ 748.001376] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 [ 748.002315] RIP: 0010:mlx5_reclaim_startup_pages+0x34b/0x460 [mlx5_core] [ 748.001679] Code: 28 00 00 00 0f 85 22 01 00 00 48 81 c4 b0 00 00 00 31 c0 5b 5d 41 5c 41 5d 41 5e 41 5f c3 48 c7 c7 40 cc 19 a1 e8 9f 71 0e e2 <0f> 0b e9 30 ff ff ff 48 c7 c7 a0 cc 19 a1 e8 8c 71 0e e2 0f 0b e9 [ 748.003781] RSP: 0018:ffff88815220faf8 EFLAGS: 00010286 [ 748.001149] RAX: 0000000000000000 RBX: ffff8881b4900280 RCX: 0000000000000000 [ 748.001445] RDX: 0000000000000027 RSI: 0000000000000004 RDI: ffffed102a441f51 [ 748.001614] RBP: 00000000000032b9 R08: 0000000000000001 R09: ffffed1054a15ee8 [ 748.001446] R10: ffff8882a50af73b R11: ffffed1054a15ee7 R12: fffffbfff07c1e30 [ 748.001447] R13: dffffc0000000000 R14: ffff8881b492cba8 R15: 0000000000000000 [ 748.001429] FS: 00007f58bd08b580(0000) GS:ffff8882a5080000(0000) knlGS:0000000000000000 [ 748.001695] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 748.001309] CR2: 000055a026351740 CR3: 00000001d3b48006 CR4: 0000000000370ea0 [ 748.001506] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 748.001483] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 748.001654] Call Trace: [ 748.000576] ? mlx5_satisfy_startup_pages+0x290/0x290 [mlx5_core] [ 748.001416] ? mlx5_cmd_teardown_hca+0xa2/0xd0 [mlx5_core] [ 748.001354] ? mlx5_cmd_init_hca+0x280/0x280 [mlx5_core] [ 748.001203] mlx5_function_teardown+0x30/0x60 [mlx5_core] [ 748.001275] mlx5_uninit_one+0xa7/0xc0 [mlx5_core] [ 748.001200] remove_one+0x5f/0xc0 [mlx5_core] [ 748.001075] pci_device_remove+0x9f/0x1d0 [ 748.000833] device_release_driver_internal+0x1e0/0x490 [ 748.001207] unbind_store+0x19f/0x200 [ 748.000942] ? sysfs_file_ops+0x170/0x170 [ 748.001000] kernfs_fop_write_iter+0x2bc/0x450 [ 748.000970] new_sync_write+0x373/0x610 [ 748.001124] ? new_sync_read+0x600/0x600 [ 748.001057] ? lock_acquire+0x4d6/0x700 [ 748.000908] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 748.001126] ? fd_install+0x1c9/0x4d0 [ 748.000951] vfs_write+0x4d0/0x800 [ 748.000804] ksys_write+0xf9/0x1d0 [ 748.000868] ? __x64_sys_read+0xb0/0xb0 [ 748.000811] ? filp_open+0x50/0x50 [ 748.000919] ? syscall_enter_from_user_mode+0x1d/0x50 [ 748.001223] do_syscall_64+0x3f/0x80 [ 748.000892] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 748.00 ---truncated--- CVE-2021-47246 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47246.html CVE-2021-47246 https://bugzilla.suse.com/1224831 SUSE Bug 1224831 In the Linux kernel, the following vulnerability has been resolved: udp: fix race between close() and udp_abort() Kaustubh reported and diagnosed a panic in udp_lib_lookup(). The root cause is udp_abort() racing with close(). Both racing functions acquire the socket lock, but udp{v6}_destroy_sock() release it before performing destructive actions. We can't easily extend the socket lock scope to avoid the race, instead use the SOCK_DEAD flag to prevent udp_abort from doing any action when the critical race happens. Diagnosed-and-tested-by: Kaustubh Pandey <kapandey@codeaurora.org> CVE-2021-47248 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47248.html CVE-2021-47248 https://bugzilla.suse.com/1224867 SUSE Bug 1224867 In the Linux kernel, the following vulnerability has been resolved: net: rds: fix memory leak in rds_recvmsg Syzbot reported memory leak in rds. The problem was in unputted refcount in case of error. int rds_recvmsg(struct socket *sock, struct msghdr *msg, size_t size, int msg_flags) { ... if (!rds_next_incoming(rs, &inc)) { ... } After this "if" inc refcount incremented and if (rds_cmsg_recv(inc, msg, rs)) { ret = -EFAULT; goto out; } ... out: return ret; } in case of rds_cmsg_recv() fail the refcount won't be decremented. And it's easy to see from ftrace log, that rds_inc_addref() don't have rds_inc_put() pair in rds_recvmsg() after rds_cmsg_recv() 1) | rds_recvmsg() { 1) 3.721 us | rds_inc_addref(); 1) 3.853 us | rds_message_inc_copy_to_user(); 1) + 10.395 us | rds_cmsg_recv(); 1) + 34.260 us | } CVE-2021-47249 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47249.html CVE-2021-47249 https://bugzilla.suse.com/1224880 SUSE Bug 1224880 In the Linux kernel, the following vulnerability has been resolved: net: ipv4: fix memory leak in netlbl_cipsov4_add_std Reported by syzkaller: BUG: memory leak unreferenced object 0xffff888105df7000 (size 64): comm "syz-executor842", pid 360, jiffies 4294824824 (age 22.546s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<00000000e67ed558>] kmalloc include/linux/slab.h:590 [inline] [<00000000e67ed558>] kzalloc include/linux/slab.h:720 [inline] [<00000000e67ed558>] netlbl_cipsov4_add_std net/netlabel/netlabel_cipso_v4.c:145 [inline] [<00000000e67ed558>] netlbl_cipsov4_add+0x390/0x2340 net/netlabel/netlabel_cipso_v4.c:416 [<0000000006040154>] genl_family_rcv_msg_doit.isra.0+0x20e/0x320 net/netlink/genetlink.c:739 [<00000000204d7a1c>] genl_family_rcv_msg net/netlink/genetlink.c:783 [inline] [<00000000204d7a1c>] genl_rcv_msg+0x2bf/0x4f0 net/netlink/genetlink.c:800 [<00000000c0d6a995>] netlink_rcv_skb+0x134/0x3d0 net/netlink/af_netlink.c:2504 [<00000000d78b9d2c>] genl_rcv+0x24/0x40 net/netlink/genetlink.c:811 [<000000009733081b>] netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline] [<000000009733081b>] netlink_unicast+0x4a0/0x6a0 net/netlink/af_netlink.c:1340 [<00000000d5fd43b8>] netlink_sendmsg+0x789/0xc70 net/netlink/af_netlink.c:1929 [<000000000a2d1e40>] sock_sendmsg_nosec net/socket.c:654 [inline] [<000000000a2d1e40>] sock_sendmsg+0x139/0x170 net/socket.c:674 [<00000000321d1969>] ____sys_sendmsg+0x658/0x7d0 net/socket.c:2350 [<00000000964e16bc>] ___sys_sendmsg+0xf8/0x170 net/socket.c:2404 [<000000001615e288>] __sys_sendmsg+0xd3/0x190 net/socket.c:2433 [<000000004ee8b6a5>] do_syscall_64+0x37/0x90 arch/x86/entry/common.c:47 [<00000000171c7cee>] entry_SYSCALL_64_after_hwframe+0x44/0xae The memory of doi_def->map.std pointing is allocated in netlbl_cipsov4_add_std, but no place has freed it. It should be freed in cipso_v4_doi_free which frees the cipso DOI resource. CVE-2021-47250 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47250.html CVE-2021-47250 https://bugzilla.suse.com/1224827 SUSE Bug 1224827 In the Linux kernel, the following vulnerability has been resolved: batman-adv: Avoid WARN_ON timing related checks The soft/batadv interface for a queued OGM can be changed during the time the OGM was queued for transmission and when the OGM is actually transmitted by the worker. But WARN_ON must be used to denote kernel bugs and not to print simple warnings. A warning can simply be printed using pr_warn. CVE-2021-47252 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47252.html CVE-2021-47252 https://bugzilla.suse.com/1224882 SUSE Bug 1224882 In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix use-after-free in gfs2_glock_shrink_scan The GLF_LRU flag is checked under lru_lock in gfs2_glock_remove_from_lru() to remove the glock from the lru list in __gfs2_glock_put(). On the shrink scan path, the same flag is cleared under lru_lock but because of cond_resched_lock(&lru_lock) in gfs2_dispose_glock_lru(), progress on the put side can be made without deleting the glock from the lru list. Keep GLF_LRU across the race window opened by cond_resched_lock(&lru_lock) to ensure correct behavior on both sides - clear GLF_LRU after list_del under lru_lock. CVE-2021-47254 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47254.html CVE-2021-47254 https://bugzilla.suse.com/1224888 SUSE Bug 1224888 https://bugzilla.suse.com/1227559 SUSE Bug 1227559 In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fix error handling of scsi_host_alloc() After device is initialized via device_initialize(), or its name is set via dev_set_name(), the device has to be freed via put_device(). Otherwise device name will be leaked because it is allocated dynamically in dev_set_name(). Fix the leak by replacing kfree() with put_device(). Since scsi_host_dev_release() properly handles IDA and kthread removal, remove special-casing these from the error handling as well. CVE-2021-47258 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47258.html CVE-2021-47258 https://bugzilla.suse.com/1224899 SUSE Bug 1224899 In the Linux kernel, the following vulnerability has been resolved: NFS: Fix a potential NULL dereference in nfs_get_client() None of the callers are expecting NULL returns from nfs_get_client() so this code will lead to an Oops. It's better to return an error pointer. I expect that this is dead code so hopefully no one is affected. CVE-2021-47260 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47260.html CVE-2021-47260 https://bugzilla.suse.com/1224834 SUSE Bug 1224834 In the Linux kernel, the following vulnerability has been resolved: IB/mlx5: Fix initializing CQ fragments buffer The function init_cq_frag_buf() can be called to initialize the current CQ fragments buffer cq->buf, or the temporary cq->resize_buf that is filled during CQ resize operation. However, the offending commit started to use function get_cqe() for getting the CQEs, the issue with this change is that get_cqe() always returns CQEs from cq->buf, which leads us to initialize the wrong buffer, and in case of enlarging the CQ we try to access elements beyond the size of the current cq->buf and eventually hit a kernel panic. [exception RIP: init_cq_frag_buf+103] [ffff9f799ddcbcd8] mlx5_ib_resize_cq at ffffffffc0835d60 [mlx5_ib] [ffff9f799ddcbdb0] ib_resize_cq at ffffffffc05270df [ib_core] [ffff9f799ddcbdc0] llt_rdma_setup_qp at ffffffffc0a6a712 [llt] [ffff9f799ddcbe10] llt_rdma_cc_event_action at ffffffffc0a6b411 [llt] [ffff9f799ddcbe98] llt_rdma_client_conn_thread at ffffffffc0a6bb75 [llt] [ffff9f799ddcbec8] kthread at ffffffffa66c5da1 [ffff9f799ddcbf50] ret_from_fork_nospec_begin at ffffffffa6d95ddd Fix it by getting the needed CQE by calling mlx5_frag_buf_get_wqe() that takes the correct source buffer as a parameter. CVE-2021-47261 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47261.html CVE-2021-47261 https://bugzilla.suse.com/1224954 SUSE Bug 1224954 https://bugzilla.suse.com/1227751 SUSE Bug 1227751 In the Linux kernel, the following vulnerability has been resolved: RDMA: Verify port when creating flow rule Validate port value provided by the user and with that remove no longer needed validation by the driver. The missing check in the mlx5_ib driver could cause to the below oops. Call trace: _create_flow_rule+0x2d4/0xf28 [mlx5_ib] mlx5_ib_create_flow+0x2d0/0x5b0 [mlx5_ib] ib_uverbs_ex_create_flow+0x4cc/0x624 [ib_uverbs] ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0xd4/0x150 [ib_uverbs] ib_uverbs_cmd_verbs.isra.7+0xb28/0xc50 [ib_uverbs] ib_uverbs_ioctl+0x158/0x1d0 [ib_uverbs] do_vfs_ioctl+0xd0/0xaf0 ksys_ioctl+0x84/0xb4 __arm64_sys_ioctl+0x28/0xc4 el0_svc_common.constprop.3+0xa4/0x254 el0_svc_handler+0x84/0xa0 el0_svc+0x10/0x26c Code: b9401260 f9615681 51000400 8b001c20 (f9403c1a) CVE-2021-47265 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47265.html CVE-2021-47265 https://bugzilla.suse.com/1224957 SUSE Bug 1224957 In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: ep0: fix NULL pointer exception There is no validation of the index from dwc3_wIndex_to_dep() and we might be referring a non-existing ep and trigger a NULL pointer exception. In certain configurations we might use fewer eps and the index might wrongly indicate a larger ep index than existing. By adding this validation from the patch we can actually report a wrong index back to the caller. In our usecase we are using a composite device on an older kernel, but upstream might use this fix also. Unfortunately, I cannot describe the hardware for others to reproduce the issue as it is a proprietary implementation. [ 82.958261] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000a4 [ 82.966891] Mem abort info: [ 82.969663] ESR = 0x96000006 [ 82.972703] Exception class = DABT (current EL), IL = 32 bits [ 82.978603] SET = 0, FnV = 0 [ 82.981642] EA = 0, S1PTW = 0 [ 82.984765] Data abort info: [ 82.987631] ISV = 0, ISS = 0x00000006 [ 82.991449] CM = 0, WnR = 0 [ 82.994409] user pgtable: 4k pages, 39-bit VAs, pgdp = 00000000c6210ccc [ 83.000999] [00000000000000a4] pgd=0000000053aa5003, pud=0000000053aa5003, pmd=0000000000000000 [ 83.009685] Internal error: Oops: 96000006 [#1] PREEMPT SMP [ 83.026433] Process irq/62-dwc3 (pid: 303, stack limit = 0x000000003985154c) [ 83.033470] CPU: 0 PID: 303 Comm: irq/62-dwc3 Not tainted 4.19.124 #1 [ 83.044836] pstate: 60000085 (nZCv daIf -PAN -UAO) [ 83.049628] pc : dwc3_ep0_handle_feature+0x414/0x43c [ 83.054558] lr : dwc3_ep0_interrupt+0x3b4/0xc94 ... [ 83.141788] Call trace: [ 83.144227] dwc3_ep0_handle_feature+0x414/0x43c [ 83.148823] dwc3_ep0_interrupt+0x3b4/0xc94 [ 83.181546] ---[ end trace aac6b5267d84c32f ]--- CVE-2021-47269 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47269.html CVE-2021-47269 https://bugzilla.suse.com/1224996 SUSE Bug 1224996 In the Linux kernel, the following vulnerability has been resolved: tracing: Correct the length check which causes memory corruption We've suffered from severe kernel crashes due to memory corruption on our production environment, like, Call Trace: [1640542.554277] general protection fault: 0000 [#1] SMP PTI [1640542.554856] CPU: 17 PID: 26996 Comm: python Kdump: loaded Tainted:G [1640542.556629] RIP: 0010:kmem_cache_alloc+0x90/0x190 [1640542.559074] RSP: 0018:ffffb16faa597df8 EFLAGS: 00010286 [1640542.559587] RAX: 0000000000000000 RBX: 0000000000400200 RCX: 0000000006e931bf [1640542.560323] RDX: 0000000006e931be RSI: 0000000000400200 RDI: ffff9a45ff004300 [1640542.560996] RBP: 0000000000400200 R08: 0000000000023420 R09: 0000000000000000 [1640542.561670] R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff9a20608d [1640542.562366] R13: ffff9a45ff004300 R14: ffff9a45ff004300 R15: 696c662f65636976 [1640542.563128] FS: 00007f45d7c6f740(0000) GS:ffff9a45ff840000(0000) knlGS:0000000000000000 [1640542.563937] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [1640542.564557] CR2: 00007f45d71311a0 CR3: 000000189d63e004 CR4: 00000000003606e0 [1640542.565279] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [1640542.566069] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [1640542.566742] Call Trace: [1640542.567009] anon_vma_clone+0x5d/0x170 [1640542.567417] __split_vma+0x91/0x1a0 [1640542.567777] do_munmap+0x2c6/0x320 [1640542.568128] vm_munmap+0x54/0x70 [1640542.569990] __x64_sys_munmap+0x22/0x30 [1640542.572005] do_syscall_64+0x5b/0x1b0 [1640542.573724] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [1640542.575642] RIP: 0033:0x7f45d6e61e27 James Wang has reproduced it stably on the latest 4.19 LTS. After some debugging, we finally proved that it's due to ftrace buffer out-of-bound access using a debug tool as follows: [ 86.775200] BUG: Out-of-bounds write at addr 0xffff88aefe8b7000 [ 86.780806] no_context+0xdf/0x3c0 [ 86.784327] __do_page_fault+0x252/0x470 [ 86.788367] do_page_fault+0x32/0x140 [ 86.792145] page_fault+0x1e/0x30 [ 86.795576] strncpy_from_unsafe+0x66/0xb0 [ 86.799789] fetch_memory_string+0x25/0x40 [ 86.804002] fetch_deref_string+0x51/0x60 [ 86.808134] kprobe_trace_func+0x32d/0x3a0 [ 86.812347] kprobe_dispatcher+0x45/0x50 [ 86.816385] kprobe_ftrace_handler+0x90/0xf0 [ 86.820779] ftrace_ops_assist_func+0xa1/0x140 [ 86.825340] 0xffffffffc00750bf [ 86.828603] do_sys_open+0x5/0x1f0 [ 86.832124] do_syscall_64+0x5b/0x1b0 [ 86.835900] entry_SYSCALL_64_after_hwframe+0x44/0xa9 commit b220c049d519 ("tracing: Check length before giving out the filter buffer") adds length check to protect trace data overflow introduced in 0fc1b09ff1ff, seems that this fix can't prevent overflow entirely, the length check should also take the sizeof entry->array[0] into account, since this array[0] is filled the length of trace data and occupy addtional space and risk overflow. CVE-2021-47274 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47274.html CVE-2021-47274 https://bugzilla.suse.com/1224990 SUSE Bug 1224990 In the Linux kernel, the following vulnerability has been resolved: ftrace: Do not blindly read the ip address in ftrace_bug() It was reported that a bug on arm64 caused a bad ip address to be used for updating into a nop in ftrace_init(), but the error path (rightfully) returned -EINVAL and not -EFAULT, as the bug caused more than one error to occur. But because -EINVAL was returned, the ftrace_bug() tried to report what was at the location of the ip address, and read it directly. This caused the machine to panic, as the ip was not pointing to a valid memory address. Instead, read the ip address with copy_from_kernel_nofault() to safely access the memory, and if it faults, report that the address faulted, otherwise report what was in that location. CVE-2021-47276 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47276.html CVE-2021-47276 https://bugzilla.suse.com/1224966 SUSE Bug 1224966 In the Linux kernel, the following vulnerability has been resolved: kvm: avoid speculation-based attacks from out-of-range memslot accesses KVM's mechanism for accessing guest memory translates a guest physical address (gpa) to a host virtual address using the right-shifted gpa (also known as gfn) and a struct kvm_memory_slot. The translation is performed in __gfn_to_hva_memslot using the following formula: hva = slot->userspace_addr + (gfn - slot->base_gfn) * PAGE_SIZE It is expected that gfn falls within the boundaries of the guest's physical memory. However, a guest can access invalid physical addresses in such a way that the gfn is invalid. __gfn_to_hva_memslot is called from kvm_vcpu_gfn_to_hva_prot, which first retrieves a memslot through __gfn_to_memslot. While __gfn_to_memslot does check that the gfn falls within the boundaries of the guest's physical memory or not, a CPU can speculate the result of the check and continue execution speculatively using an illegal gfn. The speculation can result in calculating an out-of-bounds hva. If the resulting host virtual address is used to load another guest physical address, this is effectively a Spectre gadget consisting of two consecutive reads, the second of which is data dependent on the first. Right now it's not clear if there are any cases in which this is exploitable. One interesting case was reported by the original author of this patch, and involves visiting guest page tables on x86. Right now these are not vulnerable because the hva read goes through get_user(), which contains an LFENCE speculation barrier. However, there are patches in progress for x86 uaccess.h to mask kernel addresses instead of using LFENCE; once these land, a guest could use speculation to read from the VMM's ring 3 address space. Other architectures such as ARM already use the address masking method, and would be susceptible to this same kind of data-dependent access gadgets. Therefore, this patch proactively protects from these attacks by masking out-of-bounds gfns in __gfn_to_hva_memslot, which blocks speculation of invalid hvas. Sean Christopherson noted that this patch does not cover kvm_read_guest_offset_cached. This however is limited to a few bytes past the end of the cache, and therefore it is unlikely to be useful in the context of building a chain of data dependent accesses. CVE-2021-47277 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47277.html CVE-2021-47277 https://bugzilla.suse.com/1224960 SUSE Bug 1224960 In the Linux kernel, the following vulnerability has been resolved: drm: Fix use-after-free read in drm_getunique() There is a time-of-check-to-time-of-use error in drm_getunique() due to retrieving file_priv->master prior to locking the device's master mutex. An example can be seen in the crash report of the use-after-free error found by Syzbot: https://syzkaller.appspot.com/bug?id=148d2f1dfac64af52ffd27b661981a540724f803 In the report, the master pointer was used after being freed. This is because another process had acquired the device's master mutex in drm_setmaster_ioctl(), then overwrote fpriv->master in drm_new_set_master(). The old value of fpriv->master was subsequently freed before the mutex was unlocked. To fix this, we lock the device's master mutex before retrieving the pointer from from fpriv->master. This patch passes the Syzbot reproducer test. CVE-2021-47280 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47280.html CVE-2021-47280 https://bugzilla.suse.com/1224982 SUSE Bug 1224982 In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Fix race of snd_seq_timer_open() The timer instance per queue is exclusive, and snd_seq_timer_open() should have managed the concurrent accesses. It looks as if it's checking the already existing timer instance at the beginning, but it's not right, because there is no protection, hence any later concurrent call of snd_seq_timer_open() may override the timer instance easily. This may result in UAF, as the leftover timer instance can keep running while the queue itself gets closed, as spotted by syzkaller recently. For avoiding the race, add a proper check at the assignment of tmr->timeri again, and return -EBUSY if it's been already registered. CVE-2021-47281 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47281.html CVE-2021-47281 https://bugzilla.suse.com/1224983 SUSE Bug 1224983 In the Linux kernel, the following vulnerability has been resolved: isdn: mISDN: netjet: Fix crash in nj_probe: 'nj_setup' in netjet.c might fail with -EIO and in this case 'card->irq' is initialized and is bigger than zero. A subsequent call to 'nj_release' will free the irq that has not been requested. Fix this bug by deleting the previous assignment to 'card->irq' and just keep the assignment before 'request_irq'. The KASAN's log reveals it: [ 3.354615 ] WARNING: CPU: 0 PID: 1 at kernel/irq/manage.c:1826 free_irq+0x100/0x480 [ 3.355112 ] Modules linked in: [ 3.355310 ] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.13.0-rc1-00144-g25a1298726e #13 [ 3.355816 ] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 [ 3.356552 ] RIP: 0010:free_irq+0x100/0x480 [ 3.356820 ] Code: 6e 08 74 6f 4d 89 f4 e8 5e ac 09 00 4d 8b 74 24 18 4d 85 f6 75 e3 e8 4f ac 09 00 8b 75 c8 48 c7 c7 78 c1 2e 85 e8 e0 cf f5 ff <0f> 0b 48 8b 75 c0 4c 89 ff e8 72 33 0b 03 48 8b 43 40 4c 8b a0 80 [ 3.358012 ] RSP: 0000:ffffc90000017b48 EFLAGS: 00010082 [ 3.358357 ] RAX: 0000000000000000 RBX: ffff888104dc8000 RCX: 0000000000000000 [ 3.358814 ] RDX: ffff8881003c8000 RSI: ffffffff8124a9e6 RDI: 00000000ffffffff [ 3.359272 ] RBP: ffffc90000017b88 R08: 0000000000000000 R09: 0000000000000000 [ 3.359732 ] R10: ffffc900000179f0 R11: 0000000000001d04 R12: 0000000000000000 [ 3.360195 ] R13: ffff888107dc6000 R14: ffff888107dc6928 R15: ffff888104dc80a8 [ 3.360652 ] FS: 0000000000000000(0000) GS:ffff88817bc00000(0000) knlGS:0000000000000000 [ 3.361170 ] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 3.361538 ] CR2: 0000000000000000 CR3: 000000000582e000 CR4: 00000000000006f0 [ 3.362003 ] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 3.362175 ] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 3.362175 ] Call Trace: [ 3.362175 ] nj_release+0x51/0x1e0 [ 3.362175 ] nj_probe+0x450/0x950 [ 3.362175 ] ? pci_device_remove+0x110/0x110 [ 3.362175 ] local_pci_probe+0x45/0xa0 [ 3.362175 ] pci_device_probe+0x12b/0x1d0 [ 3.362175 ] really_probe+0x2a9/0x610 [ 3.362175 ] driver_probe_device+0x90/0x1d0 [ 3.362175 ] ? mutex_lock_nested+0x1b/0x20 [ 3.362175 ] device_driver_attach+0x68/0x70 [ 3.362175 ] __driver_attach+0x124/0x1b0 [ 3.362175 ] ? device_driver_attach+0x70/0x70 [ 3.362175 ] bus_for_each_dev+0xbb/0x110 [ 3.362175 ] ? rdinit_setup+0x45/0x45 [ 3.362175 ] driver_attach+0x27/0x30 [ 3.362175 ] bus_add_driver+0x1eb/0x2a0 [ 3.362175 ] driver_register+0xa9/0x180 [ 3.362175 ] __pci_register_driver+0x82/0x90 [ 3.362175 ] ? w6692_init+0x38/0x38 [ 3.362175 ] nj_init+0x36/0x38 [ 3.362175 ] do_one_initcall+0x7f/0x3d0 [ 3.362175 ] ? rdinit_setup+0x45/0x45 [ 3.362175 ] ? rcu_read_lock_sched_held+0x4f/0x80 [ 3.362175 ] kernel_init_freeable+0x2aa/0x301 [ 3.362175 ] ? rest_init+0x2c0/0x2c0 [ 3.362175 ] kernel_init+0x18/0x190 [ 3.362175 ] ? rest_init+0x2c0/0x2c0 [ 3.362175 ] ? rest_init+0x2c0/0x2c0 [ 3.362175 ] ret_from_fork+0x1f/0x30 [ 3.362175 ] Kernel panic - not syncing: panic_on_warn set ... [ 3.362175 ] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.13.0-rc1-00144-g25a1298726e #13 [ 3.362175 ] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 [ 3.362175 ] Call Trace: [ 3.362175 ] dump_stack+0xba/0xf5 [ 3.362175 ] ? free_irq+0x100/0x480 [ 3.362175 ] panic+0x15a/0x3f2 [ 3.362175 ] ? __warn+0xf2/0x150 [ 3.362175 ] ? free_irq+0x100/0x480 [ 3.362175 ] __warn+0x108/0x150 [ 3.362175 ] ? free_irq+0x100/0x480 [ 3.362175 ] report_bug+0x119/0x1c0 [ 3.362175 ] handle_bug+0x3b/0x80 [ 3.362175 ] exc_invalid_op+0x18/0x70 [ 3.362175 ] asm_exc_invalid_op+0x12/0x20 [ 3.362175 ] RIP: 0010:free_irq+0x100 ---truncated--- CVE-2021-47284 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47284.html CVE-2021-47284 https://bugzilla.suse.com/1224987 SUSE Bug 1224987 ** REJECT ** This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. CVE-2021-47285 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47285.html CVE-2021-47285 https://bugzilla.suse.com/1224981 SUSE Bug 1224981 In the Linux kernel, the following vulnerability has been resolved: media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf() Fix an 11-year old bug in ngene_command_config_free_buf() while addressing the following warnings caught with -Warray-bounds: arch/alpha/include/asm/string.h:22:16: warning: '__builtin_memcpy' offset [12, 16] from the object at 'com' is out of the bounds of referenced subobject 'config' with type 'unsigned char' at offset 10 [-Warray-bounds] arch/x86/include/asm/string_32.h:182:25: warning: '__builtin_memcpy' offset [12, 16] from the object at 'com' is out of the bounds of referenced subobject 'config' with type 'unsigned char' at offset 10 [-Warray-bounds] The problem is that the original code is trying to copy 6 bytes of data into a one-byte size member _config_ of the wrong structue FW_CONFIGURE_BUFFERS, in a single call to memcpy(). This causes a legitimate compiler warning because memcpy() overruns the length of &com.cmd.ConfigureBuffers.config. It seems that the right structure is FW_CONFIGURE_FREE_BUFFERS, instead, because it contains 6 more members apart from the header _hdr_. Also, the name of the function ngene_command_config_free_buf() suggests that the actual intention is to ConfigureFreeBuffers, instead of ConfigureBuffers (which takes place in the function ngene_command_config_buf(), above). Fix this by enclosing those 6 members of struct FW_CONFIGURE_FREE_BUFFERS into new struct config, and use &com.cmd.ConfigureFreeBuffers.config as the destination address, instead of &com.cmd.ConfigureBuffers.config, when calling memcpy(). This also helps with the ongoing efforts to globally enable -Warray-bounds and get us closer to being able to tighten the FORTIFY_SOURCE routines on memcpy(). CVE-2021-47288 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47288.html CVE-2021-47288 https://bugzilla.suse.com/1224889 SUSE Bug 1224889 In the Linux kernel, the following vulnerability has been resolved: igb: Fix use-after-free error during reset Cleans the next descriptor to watch (next_to_watch) when cleaning the TX ring. Failure to do so can cause invalid memory accesses. If igb_poll() runs while the controller is reset this can lead to the driver try to free a skb that was already freed. (The crash is harder to reproduce with the igb driver, but the same potential problem exists as the code is identical to igc) CVE-2021-47301 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47301.html CVE-2021-47301 https://bugzilla.suse.com/1224916 SUSE Bug 1224916 In the Linux kernel, the following vulnerability has been resolved: igc: Fix use-after-free error during reset Cleans the next descriptor to watch (next_to_watch) when cleaning the TX ring. Failure to do so can cause invalid memory accesses. If igc_poll() runs while the controller is being reset this can lead to the driver try to free a skb that was already freed. Log message: [ 101.525242] refcount_t: underflow; use-after-free. [ 101.525251] WARNING: CPU: 1 PID: 646 at lib/refcount.c:28 refcount_warn_saturate+0xab/0xf0 [ 101.525259] Modules linked in: sch_etf(E) sch_mqprio(E) rfkill(E) intel_rapl_msr(E) intel_rapl_common(E) x86_pkg_temp_thermal(E) intel_powerclamp(E) coretemp(E) binfmt_misc(E) kvm_intel(E) kvm(E) irqbypass(E) crc32_pclmul(E) ghash_clmulni_intel(E) aesni_intel(E) mei_wdt(E) libaes(E) crypto_simd(E) cryptd(E) glue_helper(E) snd_hda_codec_hdmi(E) rapl(E) intel_cstate(E) snd_hda_intel(E) snd_intel_dspcfg(E) sg(E) soundwire_intel(E) intel_uncore(E) at24(E) soundwire_generic_allocation(E) iTCO_wdt(E) soundwire_cadence(E) intel_pmc_bxt(E) serio_raw(E) snd_hda_codec(E) iTCO_vendor_support(E) watchdog(E) snd_hda_core(E) snd_hwdep(E) snd_soc_core(E) snd_compress(E) snd_pcsp(E) soundwire_bus(E) snd_pcm(E) evdev(E) snd_timer(E) mei_me(E) snd(E) soundcore(E) mei(E) configfs(E) ip_tables(E) x_tables(E) autofs4(E) ext4(E) crc32c_generic(E) crc16(E) mbcache(E) jbd2(E) sd_mod(E) t10_pi(E) crc_t10dif(E) crct10dif_generic(E) i915(E) ahci(E) libahci(E) ehci_pci(E) igb(E) xhci_pci(E) ehci_hcd(E) [ 101.525303] drm_kms_helper(E) dca(E) xhci_hcd(E) libata(E) crct10dif_pclmul(E) cec(E) crct10dif_common(E) tsn(E) igc(E) e1000e(E) ptp(E) i2c_i801(E) crc32c_intel(E) psmouse(E) i2c_algo_bit(E) i2c_smbus(E) scsi_mod(E) lpc_ich(E) pps_core(E) usbcore(E) drm(E) button(E) video(E) [ 101.525318] CPU: 1 PID: 646 Comm: irq/37-enp7s0-T Tainted: G E 5.10.30-rt37-tsn1-rt-ipipe #ipipe [ 101.525320] Hardware name: SIEMENS AG SIMATIC IPC427D/A5E31233588, BIOS V17.02.09 03/31/2017 [ 101.525322] RIP: 0010:refcount_warn_saturate+0xab/0xf0 [ 101.525325] Code: 05 31 48 44 01 01 e8 f0 c6 42 00 0f 0b c3 80 3d 1f 48 44 01 00 75 90 48 c7 c7 78 a8 f3 a6 c6 05 0f 48 44 01 01 e8 d1 c6 42 00 <0f> 0b c3 80 3d fe 47 44 01 00 0f 85 6d ff ff ff 48 c7 c7 d0 a8 f3 [ 101.525327] RSP: 0018:ffffbdedc0917cb8 EFLAGS: 00010286 [ 101.525329] RAX: 0000000000000000 RBX: ffff98fd6becbf40 RCX: 0000000000000001 [ 101.525330] RDX: 0000000000000001 RSI: ffffffffa6f2700c RDI: 00000000ffffffff [ 101.525332] RBP: ffff98fd6becc14c R08: ffffffffa7463d00 R09: ffffbdedc0917c50 [ 101.525333] R10: ffffffffa74c3578 R11: 0000000000000034 R12: 00000000ffffff00 [ 101.525335] R13: ffff98fd6b0b1000 R14: 0000000000000039 R15: ffff98fd6be35c40 [ 101.525337] FS: 0000000000000000(0000) GS:ffff98fd6e240000(0000) knlGS:0000000000000000 [ 101.525339] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 101.525341] CR2: 00007f34135a3a70 CR3: 0000000150210003 CR4: 00000000001706e0 [ 101.525343] Call Trace: [ 101.525346] sock_wfree+0x9c/0xa0 [ 101.525353] unix_destruct_scm+0x7b/0xa0 [ 101.525358] skb_release_head_state+0x40/0x90 [ 101.525362] skb_release_all+0xe/0x30 [ 101.525364] napi_consume_skb+0x57/0x160 [ 101.525367] igc_poll+0xb7/0xc80 [igc] [ 101.525376] ? sched_clock+0x5/0x10 [ 101.525381] ? sched_clock_cpu+0xe/0x100 [ 101.525385] net_rx_action+0x14c/0x410 [ 101.525388] __do_softirq+0xe9/0x2f4 [ 101.525391] __local_bh_enable_ip+0xe3/0x110 [ 101.525395] ? irq_finalize_oneshot.part.47+0xe0/0xe0 [ 101.525398] irq_forced_thread_fn+0x6a/0x80 [ 101.525401] irq_thread+0xe8/0x180 [ 101.525403] ? wake_threads_waitq+0x30/0x30 [ 101.525406] ? irq_thread_check_affinity+0xd0/0xd0 [ 101.525408] kthread+0x183/0x1a0 [ 101.525412] ? kthread_park+0x80/0x80 [ 101.525415] ret_from_fork+0x22/0x30 CVE-2021-47302 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47302.html CVE-2021-47302 https://bugzilla.suse.com/1224917 SUSE Bug 1224917 In the Linux kernel, the following vulnerability has been resolved: dma-buf/sync_file: Don't leak fences on merge failure Each add_fence() call does a dma_fence_get() on the relevant fence. In the error path, we weren't calling dma_fence_put() so all those fences got leaked. Also, in the krealloc_array failure case, we weren't freeing the fences array. Instead, ensure that i and fences are always zero-initialized and dma_fence_put() all the fences and kfree(fences) on every error path. CVE-2021-47305 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47305.html CVE-2021-47305 https://bugzilla.suse.com/1224968 SUSE Bug 1224968 In the Linux kernel, the following vulnerability has been resolved: cifs: prevent NULL deref in cifs_compose_mount_options() The optional @ref parameter might contain an NULL node_name, so prevent dereferencing it in cifs_compose_mount_options(). Addresses-Coverity: 1476408 ("Explicit null dereferenced") CVE-2021-47307 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47307.html CVE-2021-47307 https://bugzilla.suse.com/1224961 SUSE Bug 1224961 In the Linux kernel, the following vulnerability has been resolved: scsi: libfc: Fix array index out of bound exception Fix array index out of bound exception in fc_rport_prli_resp(). CVE-2021-47308 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47308.html CVE-2021-47308 https://bugzilla.suse.com/1224963 SUSE Bug 1224963 In the Linux kernel, the following vulnerability has been resolved: net: ti: fix UAF in tlan_remove_one priv is netdev private data and it cannot be used after free_netdev() call. Using priv after free_netdev() can cause UAF bug. Fix it by moving free_netdev() at the end of the function. CVE-2021-47310 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47310.html CVE-2021-47310 https://bugzilla.suse.com/1224959 SUSE Bug 1224959 In the Linux kernel, the following vulnerability has been resolved: net: qcom/emac: fix UAF in emac_remove adpt is netdev private data and it cannot be used after free_netdev() call. Using adpt after free_netdev() can cause UAF bug. Fix it by moving free_netdev() at the end of the function. CVE-2021-47311 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47311.html CVE-2021-47311 https://bugzilla.suse.com/1225010 SUSE Bug 1225010 https://bugzilla.suse.com/1227752 SUSE Bug 1227752 In the Linux kernel, the following vulnerability has been resolved: memory: fsl_ifc: fix leak of private memory on probe failure On probe error the driver should free the memory allocated for private structure. Fix this by using resource-managed allocation. CVE-2021-47314 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47314.html CVE-2021-47314 https://bugzilla.suse.com/1224893 SUSE Bug 1224893 In the Linux kernel, the following vulnerability has been resolved: memory: fsl_ifc: fix leak of IO mapping on probe failure On probe error the driver should unmap the IO memory. Smatch reports: drivers/memory/fsl_ifc.c:298 fsl_ifc_ctrl_probe() warn: 'fsl_ifc_ctrl_dev->gregs' not released on lines: 298. CVE-2021-47315 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47315.html CVE-2021-47315 https://bugzilla.suse.com/1224892 SUSE Bug 1224892 In the Linux kernel, the following vulnerability has been resolved: virtio-blk: Fix memory leak among suspend/resume procedure The vblk->vqs should be freed before we call init_vqs() in virtblk_restore(). CVE-2021-47319 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47319.html CVE-2021-47319 https://bugzilla.suse.com/1225054 SUSE Bug 1225054 In the Linux kernel, the following vulnerability has been resolved: nfs: fix acl memory leak of posix_acl_create() When looking into another nfs xfstests report, I found acl and default_acl in nfs3_proc_create() and nfs3_proc_mknod() error paths are possibly leaked. Fix them in advance. CVE-2021-47320 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47320.html CVE-2021-47320 https://bugzilla.suse.com/1225058 SUSE Bug 1225058 In the Linux kernel, the following vulnerability has been resolved: watchdog: Fix possible use-after-free by calling del_timer_sync() This driver's remove path calls del_timer(). However, that function does not wait until the timer handler finishes. This means that the timer handler may still be running after the driver's remove function has finished, which would result in a use-after-free. Fix by calling del_timer_sync(), which makes sure the timer handler has finished, and unable to re-schedule itself. CVE-2021-47321 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47321.html CVE-2021-47321 https://bugzilla.suse.com/1225060 SUSE Bug 1225060 In the Linux kernel, the following vulnerability has been resolved: watchdog: sc520_wdt: Fix possible use-after-free in wdt_turnoff() This module's remove path calls del_timer(). However, that function does not wait until the timer handler finishes. This means that the timer handler may still be running after the driver's remove function has finished, which would result in a use-after-free. Fix by calling del_timer_sync(), which makes sure the timer handler has finished, and unable to re-schedule itself. CVE-2021-47323 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47323.html CVE-2021-47323 https://bugzilla.suse.com/1225026 SUSE Bug 1225026 https://bugzilla.suse.com/1227557 SUSE Bug 1227557 In the Linux kernel, the following vulnerability has been resolved: watchdog: Fix possible use-after-free in wdt_startup() This module's remove path calls del_timer(). However, that function does not wait until the timer handler finishes. This means that the timer handler may still be running after the driver's remove function has finished, which would result in a use-after-free. Fix by calling del_timer_sync(), which makes sure the timer handler has finished, and unable to re-schedule itself. CVE-2021-47324 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47324.html CVE-2021-47324 https://bugzilla.suse.com/1225030 SUSE Bug 1225030 https://bugzilla.suse.com/1225038 SUSE Bug 1225038 In the Linux kernel, the following vulnerability has been resolved: tty: serial: 8250: serial_cs: Fix a memory leak in error handling path In the probe function, if the final 'serial_config()' fails, 'info' is leaking. Add a resource handling path to free this memory. CVE-2021-47330 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47330.html CVE-2021-47330 https://bugzilla.suse.com/1225084 SUSE Bug 1225084 In the Linux kernel, the following vulnerability has been resolved: misc/libmasm/module: Fix two use after free in ibmasm_init_one In ibmasm_init_one, it calls ibmasm_init_remote_input_dev(). Inside ibmasm_init_remote_input_dev, mouse_dev and keybd_dev are allocated by input_allocate_device(), and assigned to sp->remote.mouse_dev and sp->remote.keybd_dev respectively. In the err_free_devices error branch of ibmasm_init_one, mouse_dev and keybd_dev are freed by input_free_device(), and return error. Then the execution runs into error_send_message error branch of ibmasm_init_one, where ibmasm_free_remote_input_dev(sp) is called to unregister the freed sp->remote.mouse_dev and sp->remote.keybd_dev. My patch add a "error_init_remote" label to handle the error of ibmasm_init_remote_input_dev(), to avoid the uaf bugs. CVE-2021-47334 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47334.html CVE-2021-47334 https://bugzilla.suse.com/1225112 SUSE Bug 1225112 In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fix bad pointer dereference when ehandler kthread is invalid Commit 66a834d09293 ("scsi: core: Fix error handling of scsi_host_alloc()") changed the allocation logic to call put_device() to perform host cleanup with the assumption that IDA removal and stopping the kthread would properly be performed in scsi_host_dev_release(). However, in the unlikely case that the error handler thread fails to spawn, shost->ehandler is set to ERR_PTR(-ENOMEM). The error handler cleanup code in scsi_host_dev_release() will call kthread_stop() if shost->ehandler != NULL which will always be the case whether the kthread was successfully spawned or not. In the case that it failed to spawn this has the nasty side effect of trying to dereference an invalid pointer when kthread_stop() is called. The following splat provides an example of this behavior in the wild: scsi host11: error handler thread failed to spawn, error = -4 Kernel attempted to read user page (10c) - exploit attempt? (uid: 0) BUG: Kernel NULL pointer dereference on read at 0x0000010c Faulting instruction address: 0xc00000000818e9a8 Oops: Kernel access of bad area, sig: 11 [#1] LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries Modules linked in: ibmvscsi(+) scsi_transport_srp dm_multipath dm_mirror dm_region hash dm_log dm_mod fuse overlay squashfs loop CPU: 12 PID: 274 Comm: systemd-udevd Not tainted 5.13.0-rc7 #1 NIP: c00000000818e9a8 LR: c0000000089846e8 CTR: 0000000000007ee8 REGS: c000000037d12ea0 TRAP: 0300 Not tainted (5.13.0-rc7) MSR: 800000000280b033 &lt;SF,VEC,VSX,EE,FP,ME,IR,DR,RI,LE&gt; CR: 28228228 XER: 20040001 CFAR: c0000000089846e4 DAR: 000000000000010c DSISR: 40000000 IRQMASK: 0 GPR00: c0000000089846e8 c000000037d13140 c000000009cc1100 fffffffffffffffc GPR04: 0000000000000001 0000000000000000 0000000000000000 c000000037dc0000 GPR08: 0000000000000000 c000000037dc0000 0000000000000001 00000000fffff7ff GPR12: 0000000000008000 c00000000a049000 c000000037d13d00 000000011134d5a0 GPR16: 0000000000001740 c0080000190d0000 c0080000190d1740 c000000009129288 GPR20: c000000037d13bc0 0000000000000001 c000000037d13bc0 c0080000190b7898 GPR24: c0080000190b7708 0000000000000000 c000000033bb2c48 0000000000000000 GPR28: c000000046b28280 0000000000000000 000000000000010c fffffffffffffffc NIP [c00000000818e9a8] kthread_stop+0x38/0x230 LR [c0000000089846e8] scsi_host_dev_release+0x98/0x160 Call Trace: [c000000033bb2c48] 0xc000000033bb2c48 (unreliable) [c0000000089846e8] scsi_host_dev_release+0x98/0x160 [c00000000891e960] device_release+0x60/0x100 [c0000000087e55c4] kobject_release+0x84/0x210 [c00000000891ec78] put_device+0x28/0x40 [c000000008984ea4] scsi_host_alloc+0x314/0x430 [c0080000190b38bc] ibmvscsi_probe+0x54/0xad0 [ibmvscsi] [c000000008110104] vio_bus_probe+0xa4/0x4b0 [c00000000892a860] really_probe+0x140/0x680 [c00000000892aefc] driver_probe_device+0x15c/0x200 [c00000000892b63c] device_driver_attach+0xcc/0xe0 [c00000000892b740] __driver_attach+0xf0/0x200 [c000000008926f28] bus_for_each_dev+0xa8/0x130 [c000000008929ce4] driver_attach+0x34/0x50 [c000000008928fc0] bus_add_driver+0x1b0/0x300 [c00000000892c798] driver_register+0x98/0x1a0 [c00000000810eb60] __vio_register_driver+0x80/0xe0 [c0080000190b4a30] ibmvscsi_module_init+0x9c/0xdc [ibmvscsi] [c0000000080121d0] do_one_initcall+0x60/0x2d0 [c000000008261abc] do_init_module+0x7c/0x320 [c000000008265700] load_module+0x2350/0x25b0 [c000000008265cb4] __do_sys_finit_module+0xd4/0x160 [c000000008031110] system_call_exception+0x150/0x2d0 [c00000000800d35c] system_call_common+0xec/0x278 Fix this be nulling shost->ehandler when the kthread fails to spawn. CVE-2021-47337 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47337.html CVE-2021-47337 https://bugzilla.suse.com/1224926 SUSE Bug 1224926 In the Linux kernel, the following vulnerability has been resolved: dm btree remove: assign new_root only when removal succeeds remove_raw() in dm_btree_remove() may fail due to IO read error (e.g. read the content of origin block fails during shadowing), and the value of shadow_spine::root is uninitialized, but the uninitialized value is still assign to new_root in the end of dm_btree_remove(). For dm-thin, the value of pmd->details_root or pmd->root will become an uninitialized value, so if trying to read details_info tree again out-of-bound memory may occur as showed below: general protection fault, probably for non-canonical address 0x3fdcb14c8d7520 CPU: 4 PID: 515 Comm: dmsetup Not tainted 5.13.0-rc6 Hardware name: QEMU Standard PC RIP: 0010:metadata_ll_load_ie+0x14/0x30 Call Trace: sm_metadata_count_is_more_than_one+0xb9/0xe0 dm_tm_shadow_block+0x52/0x1c0 shadow_step+0x59/0xf0 remove_raw+0xb2/0x170 dm_btree_remove+0xf4/0x1c0 dm_pool_delete_thin_device+0xc3/0x140 pool_message+0x218/0x2b0 target_message+0x251/0x290 ctl_ioctl+0x1c4/0x4d0 dm_ctl_ioctl+0xe/0x20 __x64_sys_ioctl+0x7b/0xb0 do_syscall_64+0x40/0xb0 entry_SYSCALL_64_after_hwframe+0x44/0xae Fixing it by only assign new_root when removal succeeds CVE-2021-47343 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47343.html CVE-2021-47343 https://bugzilla.suse.com/1225155 SUSE Bug 1225155 In the Linux kernel, the following vulnerability has been resolved: media: zr364xx: fix memory leak in zr364xx_start_readpipe syzbot reported memory leak in zr364xx driver. The problem was in non-freed urb in case of usb_submit_urb() fail. backtrace: [<ffffffff82baedf6>] kmalloc include/linux/slab.h:561 [inline] [<ffffffff82baedf6>] usb_alloc_urb+0x66/0xe0 drivers/usb/core/urb.c:74 [<ffffffff82f7cce8>] zr364xx_start_readpipe+0x78/0x130 drivers/media/usb/zr364xx/zr364xx.c:1022 [<ffffffff84251dfc>] zr364xx_board_init drivers/media/usb/zr364xx/zr364xx.c:1383 [inline] [<ffffffff84251dfc>] zr364xx_probe+0x6a3/0x851 drivers/media/usb/zr364xx/zr364xx.c:1516 [<ffffffff82bb6507>] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396 [<ffffffff826018a9>] really_probe+0x159/0x500 drivers/base/dd.c:576 CVE-2021-47344 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47344.html CVE-2021-47344 https://bugzilla.suse.com/1224922 SUSE Bug 1224922 In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: Fix rdma_resolve_route() memory leak Fix a memory leak when "mda_resolve_route() is called more than once on the same "rdma_cm_id". This is possible if cma_query_handler() triggers the RDMA_CM_EVENT_ROUTE_ERROR flow which puts the state machine back and allows rdma_resolve_route() to be called again. CVE-2021-47345 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47345.html CVE-2021-47345 https://bugzilla.suse.com/1225157 SUSE Bug 1225157 In the Linux kernel, the following vulnerability has been resolved: wl1251: Fix possible buffer overflow in wl1251_cmd_scan Function wl1251_cmd_scan calls memcpy without checking the length. Harden by checking the length is within the maximum allowed size. CVE-2021-47347 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47347.html CVE-2021-47347 https://bugzilla.suse.com/1225177 SUSE Bug 1225177 https://bugzilla.suse.com/1225305 SUSE Bug 1225305 In the Linux kernel, the following vulnerability has been resolved: virtio-net: Add validation for used length This adds validation for used length (might come from an untrusted device) to avoid data corruption or loss. CVE-2021-47352 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47352.html CVE-2021-47352 https://bugzilla.suse.com/1225124 SUSE Bug 1225124 In the Linux kernel, the following vulnerability has been resolved: udf: Fix NULL pointer dereference in udf_symlink function In function udf_symlink, epos.bh is assigned with the value returned by udf_tgetblk. The function udf_tgetblk is defined in udf/misc.c and returns the value of sb_getblk function that could be NULL. Then, epos.bh is used without any check, causing a possible NULL pointer dereference when sb_getblk fails. This fix adds a check to validate the value of epos.bh. CVE-2021-47353 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47353.html CVE-2021-47353 https://bugzilla.suse.com/1225128 SUSE Bug 1225128 In the Linux kernel, the following vulnerability has been resolved: atm: nicstar: Fix possible use-after-free in nicstar_cleanup() This module's remove path calls del_timer(). However, that function does not wait until the timer handler finishes. This means that the timer handler may still be running after the driver's remove function has finished, which would result in a use-after-free. Fix by calling del_timer_sync(), which makes sure the timer handler has finished, and unable to re-schedule itself. CVE-2021-47355 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47355.html CVE-2021-47355 https://bugzilla.suse.com/1225141 SUSE Bug 1225141 In the Linux kernel, the following vulnerability has been resolved: mISDN: fix possible use-after-free in HFC_cleanup() This module's remove path calls del_timer(). However, that function does not wait until the timer handler finishes. This means that the timer handler may still be running after the driver's remove function has finished, which would result in a use-after-free. Fix by calling del_timer_sync(), which makes sure the timer handler has finished, and unable to re-schedule itself. CVE-2021-47356 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47356.html CVE-2021-47356 https://bugzilla.suse.com/1225143 SUSE Bug 1225143 In the Linux kernel, the following vulnerability has been resolved: atm: iphase: fix possible use-after-free in ia_module_exit() This module's remove path calls del_timer(). However, that function does not wait until the timer handler finishes. This means that the timer handler may still be running after the driver's remove function has finished, which would result in a use-after-free. Fix by calling del_timer_sync(), which makes sure the timer handler has finished, and unable to re-schedule itself. CVE-2021-47357 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47357.html CVE-2021-47357 https://bugzilla.suse.com/1225144 SUSE Bug 1225144 In the Linux kernel, the following vulnerability has been resolved: mcb: fix error handling in mcb_alloc_bus() There are two bugs: 1) If ida_simple_get() fails then this code calls put_device(carrier) but we haven't yet called get_device(carrier) and probably that leads to a use after free. 2) After device_initialize() then we need to use put_device() to release the bus. This will free the internal resources tied to the device and call mcb_free_bus() which will free the rest. CVE-2021-47361 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47361.html CVE-2021-47361 https://bugzilla.suse.com/1225151 SUSE Bug 1225151 In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: Update intermediate power state for SI Update the current state as boot state during dpm initialization. During the subsequent initialization, set_power_state gets called to transition to the final power state. set_power_state refers to values from the current state and without current state populated, it could result in NULL pointer dereference. For ex: on platforms where PCI speed change is supported through ACPI ATCS method, the link speed of current state needs to be queried before deciding on changing to final power state's link speed. The logic to query ATCS-support was broken on certain platforms. The issue became visible when broken ATCS-support logic got fixed with commit f9b7f3703ff9 ("drm/amdgpu/acpi: make ATPX/ATCS structures global (v2)"). Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1698 CVE-2021-47362 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47362.html CVE-2021-47362 https://bugzilla.suse.com/1225153 SUSE Bug 1225153 In the Linux kernel, the following vulnerability has been resolved: s390/qeth: fix NULL deref in qeth_clear_working_pool_list() When qeth_set_online() calls qeth_clear_working_pool_list() to roll back after an error exit from qeth_hardsetup_card(), we are at risk of accessing card->qdio.in_q before it was allocated by qeth_alloc_qdio_queues() via qeth_mpc_initialize(). qeth_clear_working_pool_list() then dereferences NULL, and by writing to queue->bufs[i].pool_entry scribbles all over the CPU's lowcore. Resulting in a crash when those lowcore areas are used next (eg. on the next machine-check interrupt). Such a scenario would typically happen when the device is first set online and its queues aren't allocated yet. An early IO error or certain misconfigs (eg. mismatched transport mode, bad portno) then cause us to error out from qeth_hardsetup_card() with card->qdio.in_q still being NULL. Fix it by checking the pointer for NULL before accessing it. Note that we also have (rare) paths inside qeth_mpc_initialize() where a configuration change can cause us to free the existing queues, expecting that subsequent code will allocate them again. If we then error out before that re-allocation happens, the same bug occurs. Root-caused-by: Heiko Carstens <hca@linux.ibm.com> CVE-2021-47369 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47369.html CVE-2021-47369 https://bugzilla.suse.com/1225164 SUSE Bug 1225164 https://bugzilla.suse.com/1227324 SUSE Bug 1227324 In the Linux kernel, the following vulnerability has been resolved: blktrace: Fix uaf in blk_trace access after removing by sysfs There is an use-after-free problem triggered by following process: P1(sda) P2(sdb) echo 0 > /sys/block/sdb/trace/enable blk_trace_remove_queue synchronize_rcu blk_trace_free relay_close rcu_read_lock __blk_add_trace trace_note_tsk (Iterate running_trace_list) relay_close_buf relay_destroy_buf kfree(buf) trace_note(sdb's bt) relay_reserve buf->offset <- nullptr deference (use-after-free) !!! rcu_read_unlock [ 502.714379] BUG: kernel NULL pointer dereference, address: 0000000000000010 [ 502.715260] #PF: supervisor read access in kernel mode [ 502.715903] #PF: error_code(0x0000) - not-present page [ 502.716546] PGD 103984067 P4D 103984067 PUD 17592b067 PMD 0 [ 502.717252] Oops: 0000 [#1] SMP [ 502.720308] RIP: 0010:trace_note.isra.0+0x86/0x360 [ 502.732872] Call Trace: [ 502.733193] __blk_add_trace.cold+0x137/0x1a3 [ 502.733734] blk_add_trace_rq+0x7b/0xd0 [ 502.734207] blk_add_trace_rq_issue+0x54/0xa0 [ 502.734755] blk_mq_start_request+0xde/0x1b0 [ 502.735287] scsi_queue_rq+0x528/0x1140 ... [ 502.742704] sg_new_write.isra.0+0x16e/0x3e0 [ 502.747501] sg_ioctl+0x466/0x1100 Reproduce method: ioctl(/dev/sda, BLKTRACESETUP, blk_user_trace_setup[buf_size=127]) ioctl(/dev/sda, BLKTRACESTART) ioctl(/dev/sdb, BLKTRACESETUP, blk_user_trace_setup[buf_size=127]) ioctl(/dev/sdb, BLKTRACESTART) echo 0 > /sys/block/sdb/trace/enable & // Add delay(mdelay/msleep) before kernel enters blk_trace_free() ioctl$SG_IO(/dev/sda, SG_IO, ...) // Enters trace_note_tsk() after blk_trace_free() returned // Use mdelay in rcu region rather than msleep(which may schedule out) Remove blk_trace from running_list before calling blk_trace_free() by sysfs if blk_trace is at Blktrace_running state. CVE-2021-47375 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47375.html CVE-2021-47375 https://bugzilla.suse.com/1225193 SUSE Bug 1225193 https://bugzilla.suse.com/1225194 SUSE Bug 1225194 In the Linux kernel, the following vulnerability has been resolved: nvme-rdma: destroy cm id before destroy qp to avoid use after free We should always destroy cm_id before destroy qp to avoid to get cma event after qp was destroyed, which may lead to use after free. In RDMA connection establishment error flow, don't destroy qp in cm event handler.Just report cm_error to upper level, qp will be destroy in nvme_rdma_alloc_queue() after destroy cm id. CVE-2021-47378 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47378.html CVE-2021-47378 https://bugzilla.suse.com/1225201 SUSE Bug 1225201 https://bugzilla.suse.com/1225202 SUSE Bug 1225202 In the Linux kernel, the following vulnerability has been resolved: s390/qeth: fix deadlock during failing recovery Commit 0b9902c1fcc5 ("s390/qeth: fix deadlock during recovery") removed taking discipline_mutex inside qeth_do_reset(), fixing potential deadlocks. An error path was missed though, that still takes discipline_mutex and thus has the original deadlock potential. Intermittent deadlocks were seen when a qeth channel path is configured offline, causing a race between qeth_do_reset and ccwgroup_remove. Call qeth_set_offline() directly in the qeth_do_reset() error case and then a new variant of ccwgroup_set_offline(), without taking discipline_mutex. CVE-2021-47382 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47382.html CVE-2021-47382 https://bugzilla.suse.com/1225207 SUSE Bug 1225207 In the Linux kernel, the following vulnerability has been resolved: tty: Fix out-of-bound vmalloc access in imageblit This issue happens when a userspace program does an ioctl FBIOPUT_VSCREENINFO passing the fb_var_screeninfo struct containing only the fields xres, yres, and bits_per_pixel with values. If this struct is the same as the previous ioctl, the vc_resize() detects it and doesn't call the resize_screen(), leaving the fb_var_screeninfo incomplete. And this leads to the updatescrollmode() calculates a wrong value to fbcon_display->vrows, which makes the real_y() return a wrong value of y, and that value, eventually, causes the imageblit to access an out-of-bound address value. To solve this issue I made the resize_screen() be called even if the screen does not need any resizing, so it will "fix and fill" the fb_var_screeninfo independently. CVE-2021-47383 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47383.html CVE-2021-47383 https://bugzilla.suse.com/1225208 SUSE Bug 1225208 https://bugzilla.suse.com/1225211 SUSE Bug 1225211 In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests The FSM can run in a circle allowing rdma_resolve_ip() to be called twice on the same id_priv. While this cannot happen without going through the work, it violates the invariant that the same address resolution background request cannot be active twice. CPU 1 CPU 2 rdma_resolve_addr(): RDMA_CM_IDLE -> RDMA_CM_ADDR_QUERY rdma_resolve_ip(addr_handler) #1 process_one_req(): for #1 addr_handler(): RDMA_CM_ADDR_QUERY -> RDMA_CM_ADDR_BOUND mutex_unlock(&id_priv->handler_mutex); [.. handler still running ..] rdma_resolve_addr(): RDMA_CM_ADDR_BOUND -> RDMA_CM_ADDR_QUERY rdma_resolve_ip(addr_handler) !! two requests are now on the req_list rdma_destroy_id(): destroy_id_handler_unlock(): _destroy_id(): cma_cancel_operation(): rdma_addr_cancel() // process_one_req() self removes it spin_lock_bh(&lock); cancel_delayed_work(&req->work); if (!list_empty(&req->list)) == true ! rdma_addr_cancel() returns after process_on_req #1 is done kfree(id_priv) process_one_req(): for #2 addr_handler(): mutex_lock(&id_priv->handler_mutex); !! Use after free on id_priv rdma_addr_cancel() expects there to be one req on the list and only cancels the first one. The self-removal behavior of the work only happens after the handler has returned. This yields a situations where the req_list can have two reqs for the same "handle" but rdma_addr_cancel() only cancels the first one. The second req remains active beyond rdma_destroy_id() and will use-after-free id_priv once it inevitably triggers. Fix this by remembering if the id_priv has called rdma_resolve_ip() and always cancel before calling it again. This ensures the req_list never gets more than one item in it and doesn't cost anything in the normal flow that never uses this strange error path. CVE-2021-47391 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47391.html CVE-2021-47391 https://bugzilla.suse.com/1225318 SUSE Bug 1225318 https://bugzilla.suse.com/1225319 SUSE Bug 1225319 In the Linux kernel, the following vulnerability has been resolved: sctp: break out if skb_header_pointer returns NULL in sctp_rcv_ootb We should always check if skb_header_pointer's return is NULL before using it, otherwise it may cause null-ptr-deref, as syzbot reported: KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:sctp_rcv_ootb net/sctp/input.c:705 [inline] RIP: 0010:sctp_rcv+0x1d84/0x3220 net/sctp/input.c:196 Call Trace: <IRQ> sctp6_rcv+0x38/0x60 net/sctp/ipv6.c:1109 ip6_protocol_deliver_rcu+0x2e9/0x1ca0 net/ipv6/ip6_input.c:422 ip6_input_finish+0x62/0x170 net/ipv6/ip6_input.c:463 NF_HOOK include/linux/netfilter.h:307 [inline] NF_HOOK include/linux/netfilter.h:301 [inline] ip6_input+0x9c/0xd0 net/ipv6/ip6_input.c:472 dst_input include/net/dst.h:460 [inline] ip6_rcv_finish net/ipv6/ip6_input.c:76 [inline] NF_HOOK include/linux/netfilter.h:307 [inline] NF_HOOK include/linux/netfilter.h:301 [inline] ipv6_rcv+0x28c/0x3c0 net/ipv6/ip6_input.c:297 CVE-2021-47397 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47397.html CVE-2021-47397 https://bugzilla.suse.com/1225082 SUSE Bug 1225082 In the Linux kernel, the following vulnerability has been resolved: net: hns3: do not allow call hns3_nic_net_open repeatedly hns3_nic_net_open() is not allowed to called repeatly, but there is no checking for this. When doing device reset and setup tc concurrently, there is a small oppotunity to call hns3_nic_net_open repeatedly, and cause kernel bug by calling napi_enable twice. The calltrace information is like below: [ 3078.222780] ------------[ cut here ]------------ [ 3078.230255] kernel BUG at net/core/dev.c:6991! [ 3078.236224] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP [ 3078.243431] Modules linked in: hns3 hclgevf hclge hnae3 vfio_iommu_type1 vfio_pci vfio_virqfd vfio pv680_mii(O) [ 3078.258880] CPU: 0 PID: 295 Comm: kworker/u8:5 Tainted: G O 5.14.0-rc4+ #1 [ 3078.269102] Hardware name: , BIOS KpxxxFPGA 1P B600 V181 08/12/2021 [ 3078.276801] Workqueue: hclge hclge_service_task [hclge] [ 3078.288774] pstate: 60400009 (nZCv daif +PAN -UAO -TCO BTYPE=--) [ 3078.296168] pc : napi_enable+0x80/0x84 tc qdisc sho[w 3d0e7v8 .e3t0h218 79] lr : hns3_nic_net_open+0x138/0x510 [hns3] [ 3078.314771] sp : ffff8000108abb20 [ 3078.319099] x29: ffff8000108abb20 x28: 0000000000000000 x27: ffff0820a8490300 [ 3078.329121] x26: 0000000000000001 x25: ffff08209cfc6200 x24: 0000000000000000 [ 3078.339044] x23: ffff0820a8490300 x22: ffff08209cd76000 x21: ffff0820abfe3880 [ 3078.349018] x20: 0000000000000000 x19: ffff08209cd76900 x18: 0000000000000000 [ 3078.358620] x17: 0000000000000000 x16: ffffc816e1727a50 x15: 0000ffff8f4ff930 [ 3078.368895] x14: 0000000000000000 x13: 0000000000000000 x12: 0000259e9dbeb6b4 [ 3078.377987] x11: 0096a8f7e764eb40 x10: 634615ad28d3eab5 x9 : ffffc816ad8885b8 [ 3078.387091] x8 : ffff08209cfc6fb8 x7 : ffff0820ac0da058 x6 : ffff0820a8490344 [ 3078.396356] x5 : 0000000000000140 x4 : 0000000000000003 x3 : ffff08209cd76938 [ 3078.405365] x2 : 0000000000000000 x1 : 0000000000000010 x0 : ffff0820abfe38a0 [ 3078.414657] Call trace: [ 3078.418517] napi_enable+0x80/0x84 [ 3078.424626] hns3_reset_notify_up_enet+0x78/0xd0 [hns3] [ 3078.433469] hns3_reset_notify+0x64/0x80 [hns3] [ 3078.441430] hclge_notify_client+0x68/0xb0 [hclge] [ 3078.450511] hclge_reset_rebuild+0x524/0x884 [hclge] [ 3078.458879] hclge_reset_service_task+0x3c4/0x680 [hclge] [ 3078.467470] hclge_service_task+0xb0/0xb54 [hclge] [ 3078.475675] process_one_work+0x1dc/0x48c [ 3078.481888] worker_thread+0x15c/0x464 [ 3078.487104] kthread+0x160/0x170 [ 3078.492479] ret_from_fork+0x10/0x18 [ 3078.498785] Code: c8027c81 35ffffa2 d50323bf d65f03c0 (d4210000) [ 3078.506889] ---[ end trace 8ebe0340a1b0fb44 ]--- Once hns3_nic_net_open() is excute success, the flag HNS3_NIC_STATE_DOWN will be cleared. So add checking for this flag, directly return when HNS3_NIC_STATE_DOWN is no set. CVE-2021-47400 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47400.html CVE-2021-47400 https://bugzilla.suse.com/1225329 SUSE Bug 1225329 In the Linux kernel, the following vulnerability has been resolved: ipack: ipoctal: fix stack information leak The tty driver name is used also after registering the driver and must specifically not be allocated on the stack to avoid leaking information to user space (or triggering an oops). Drivers should not try to encode topology information in the tty device name but this one snuck in through staging without anyone noticing and another driver has since copied this malpractice. Fixing the ABI is a separate issue, but this at least plugs the security hole. CVE-2021-47401 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47401.html CVE-2021-47401 https://bugzilla.suse.com/1225242 SUSE Bug 1225242 In the Linux kernel, the following vulnerability has been resolved: HID: betop: fix slab-out-of-bounds Write in betop_probe Syzbot reported slab-out-of-bounds Write bug in hid-betopff driver. The problem is the driver assumes the device must have an input report but some malicious devices violate this assumption. So this patch checks hid_device's input is non empty before it's been used. CVE-2021-47404 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47404.html CVE-2021-47404 https://bugzilla.suse.com/1225303 SUSE Bug 1225303 In the Linux kernel, the following vulnerability has been resolved: usb: dwc2: check return value after calling platform_get_resource() It will cause null-ptr-deref if platform_get_resource() returns NULL, we need check the return value. CVE-2021-47409 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47409.html CVE-2021-47409 https://bugzilla.suse.com/1225330 SUSE Bug 1225330 In the Linux kernel, the following vulnerability has been resolved: phy: mdio: fix memory leak Syzbot reported memory leak in MDIO bus interface, the problem was in wrong state logic. MDIOBUS_ALLOCATED indicates 2 states: 1. Bus is only allocated 2. Bus allocated and __mdiobus_register() fails, but device_register() was called In case of device_register() has been called we should call put_device() to correctly free the memory allocated for this device, but mdiobus_free() calls just kfree(dev) in case of MDIOBUS_ALLOCATED state To avoid this behaviour we need to set bus->state to MDIOBUS_UNREGISTERED _before_ calling device_register(), because put_device() should be called even in case of device_register() failure. CVE-2021-47416 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47416.html CVE-2021-47416 https://bugzilla.suse.com/1225189 SUSE Bug 1225189 https://bugzilla.suse.com/1225336 SUSE Bug 1225336 In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/debugfs: fix file release memory leak When using single_open() for opening, single_release() should be called, otherwise the 'op' allocated in single_open() will be leaked. CVE-2021-47423 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47423.html CVE-2021-47423 https://bugzilla.suse.com/1225366 SUSE Bug 1225366 In the Linux kernel, the following vulnerability has been resolved: i40e: Fix freeing of uninitialized misc IRQ vector When VSI set up failed in i40e_probe() as part of PF switch set up driver was trying to free misc IRQ vectors in i40e_clear_interrupt_scheme and produced a kernel Oops: Trying to free already-free IRQ 266 WARNING: CPU: 0 PID: 5 at kernel/irq/manage.c:1731 __free_irq+0x9a/0x300 Workqueue: events work_for_cpu_fn RIP: 0010:__free_irq+0x9a/0x300 Call Trace: ? synchronize_irq+0x3a/0xa0 free_irq+0x2e/0x60 i40e_clear_interrupt_scheme+0x53/0x190 [i40e] i40e_probe.part.108+0x134b/0x1a40 [i40e] ? kmem_cache_alloc+0x158/0x1c0 ? acpi_ut_update_ref_count.part.1+0x8e/0x345 ? acpi_ut_update_object_reference+0x15e/0x1e2 ? strstr+0x21/0x70 ? irq_get_irq_data+0xa/0x20 ? mp_check_pin_attr+0x13/0xc0 ? irq_get_irq_data+0xa/0x20 ? mp_map_pin_to_irq+0xd3/0x2f0 ? acpi_register_gsi_ioapic+0x93/0x170 ? pci_conf1_read+0xa4/0x100 ? pci_bus_read_config_word+0x49/0x70 ? do_pci_enable_device+0xcc/0x100 local_pci_probe+0x41/0x90 work_for_cpu_fn+0x16/0x20 process_one_work+0x1a7/0x360 worker_thread+0x1cf/0x390 ? create_worker+0x1a0/0x1a0 kthread+0x112/0x130 ? kthread_flush_work_fn+0x10/0x10 ret_from_fork+0x1f/0x40 The problem is that at that point misc IRQ vectors were not allocated yet and we get a call trace that driver is trying to free already free IRQ vectors. Add a check in i40e_clear_interrupt_scheme for __I40E_MISC_IRQ_REQUESTED PF state before calling i40e_free_misc_vector. This state is set only if misc IRQ vectors were properly initialized. CVE-2021-47424 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47424.html CVE-2021-47424 https://bugzilla.suse.com/1225367 SUSE Bug 1225367 In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix gart.bo pin_count leak gmc_v{9,10}_0_gart_disable() isn't called matched with correspoding gart_enbale function in SRIOV case. This will lead to gart.bo pin_count leak on driver unload. CVE-2021-47431 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47431.html CVE-2021-47431 https://bugzilla.suse.com/1225390 SUSE Bug 1225390 In the Linux kernel, the following vulnerability has been resolved: dm: fix mempool NULL pointer race when completing IO dm_io_dec_pending() calls end_io_acct() first and will then dec md in-flight pending count. But if a task is swapping DM table at same time this can result in a crash due to mempool->elements being NULL: task1 task2 do_resume ->do_suspend ->dm_wait_for_completion bio_endio ->clone_endio ->dm_io_dec_pending ->end_io_acct ->wakeup task1 ->dm_swap_table ->__bind ->__bind_mempools ->bioset_exit ->mempool_exit ->free_io [ 67.330330] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 ...... [ 67.330494] pstate: 80400085 (Nzcv daIf +PAN -UAO) [ 67.330510] pc : mempool_free+0x70/0xa0 [ 67.330515] lr : mempool_free+0x4c/0xa0 [ 67.330520] sp : ffffff8008013b20 [ 67.330524] x29: ffffff8008013b20 x28: 0000000000000004 [ 67.330530] x27: ffffffa8c2ff40a0 x26: 00000000ffff1cc8 [ 67.330535] x25: 0000000000000000 x24: ffffffdada34c800 [ 67.330541] x23: 0000000000000000 x22: ffffffdada34c800 [ 67.330547] x21: 00000000ffff1cc8 x20: ffffffd9a1304d80 [ 67.330552] x19: ffffffdada34c970 x18: 000000b312625d9c [ 67.330558] x17: 00000000002dcfbf x16: 00000000000006dd [ 67.330563] x15: 000000000093b41e x14: 0000000000000010 [ 67.330569] x13: 0000000000007f7a x12: 0000000034155555 [ 67.330574] x11: 0000000000000001 x10: 0000000000000001 [ 67.330579] x9 : 0000000000000000 x8 : 0000000000000000 [ 67.330585] x7 : 0000000000000000 x6 : ffffff80148b5c1a [ 67.330590] x5 : ffffff8008013ae0 x4 : 0000000000000001 [ 67.330596] x3 : ffffff80080139c8 x2 : ffffff801083bab8 [ 67.330601] x1 : 0000000000000000 x0 : ffffffdada34c970 [ 67.330609] Call trace: [ 67.330616] mempool_free+0x70/0xa0 [ 67.330627] bio_put+0xf8/0x110 [ 67.330638] dec_pending+0x13c/0x230 [ 67.330644] clone_endio+0x90/0x180 [ 67.330649] bio_endio+0x198/0x1b8 [ 67.330655] dec_pending+0x190/0x230 [ 67.330660] clone_endio+0x90/0x180 [ 67.330665] bio_endio+0x198/0x1b8 [ 67.330673] blk_update_request+0x214/0x428 [ 67.330683] scsi_end_request+0x2c/0x300 [ 67.330688] scsi_io_completion+0xa0/0x710 [ 67.330695] scsi_finish_command+0xd8/0x110 [ 67.330700] scsi_softirq_done+0x114/0x148 [ 67.330708] blk_done_softirq+0x74/0xd0 [ 67.330716] __do_softirq+0x18c/0x374 [ 67.330724] irq_exit+0xb4/0xb8 [ 67.330732] __handle_domain_irq+0x84/0xc0 [ 67.330737] gic_handle_irq+0x148/0x1b0 [ 67.330744] el1_irq+0xe8/0x190 [ 67.330753] lpm_cpuidle_enter+0x4f8/0x538 [ 67.330759] cpuidle_enter_state+0x1fc/0x398 [ 67.330764] cpuidle_enter+0x18/0x20 [ 67.330772] do_idle+0x1b4/0x290 [ 67.330778] cpu_startup_entry+0x20/0x28 [ 67.330786] secondary_start_kernel+0x160/0x170 Fix this by: 1) Establishing pointers to 'struct dm_io' members in dm_io_dec_pending() so that they may be passed into end_io_acct() _after_ free_io() is called. 2) Moving end_io_acct() after free_io(). CVE-2021-47435 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47435.html CVE-2021-47435 https://bugzilla.suse.com/1225247 SUSE Bug 1225247 In the Linux kernel, the following vulnerability has been resolved: usb: musb: dsps: Fix the probe error path Commit 7c75bde329d7 ("usb: musb: musb_dsps: request_irq() after initializing musb") has inverted the calls to dsps_setup_optional_vbus_irq() and dsps_create_musb_pdev() without updating correctly the error path. dsps_create_musb_pdev() allocates and registers a new platform device which must be unregistered and freed with platform_device_unregister(), and this is missing upon dsps_setup_optional_vbus_irq() error. While on the master branch it seems not to trigger any issue, I observed a kernel crash because of a NULL pointer dereference with a v5.10.70 stable kernel where the patch mentioned above was backported. With this kernel version, -EPROBE_DEFER is returned the first time dsps_setup_optional_vbus_irq() is called which triggers the probe to error out without unregistering the platform device. Unfortunately, on the Beagle Bone Black Wireless, the platform device still living in the system is being used by the USB Ethernet gadget driver, which during the boot phase triggers the crash. My limited knowledge of the musb world prevents me to revert this commit which was sent to silence a robot warning which, as far as I understand, does not make sense. The goal of this patch was to prevent an IRQ to fire before the platform device being registered. I think this cannot ever happen due to the fact that enabling the interrupts is done by the ->enable() callback of the platform musb device, and this platform device must be already registered in order for the core or any other user to use this callback. Hence, I decided to fix the error path, which might prevent future errors on mainline kernels while also fixing older ones. CVE-2021-47436 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47436.html CVE-2021-47436 https://bugzilla.suse.com/1225244 SUSE Bug 1225244 In the Linux kernel, the following vulnerability has been resolved: can: peak_pci: peak_pci_remove(): fix UAF When remove the module peek_pci, referencing 'chan' again after releasing 'dev' will cause UAF. Fix this by releasing 'dev' later. The following log reveals it: [ 35.961814 ] BUG: KASAN: use-after-free in peak_pci_remove+0x16f/0x270 [peak_pci] [ 35.963414 ] Read of size 8 at addr ffff888136998ee8 by task modprobe/5537 [ 35.965513 ] Call Trace: [ 35.965718 ] dump_stack_lvl+0xa8/0xd1 [ 35.966028 ] print_address_description+0x87/0x3b0 [ 35.966420 ] kasan_report+0x172/0x1c0 [ 35.966725 ] ? peak_pci_remove+0x16f/0x270 [peak_pci] [ 35.967137 ] ? trace_irq_enable_rcuidle+0x10/0x170 [ 35.967529 ] ? peak_pci_remove+0x16f/0x270 [peak_pci] [ 35.967945 ] __asan_report_load8_noabort+0x14/0x20 [ 35.968346 ] peak_pci_remove+0x16f/0x270 [peak_pci] [ 35.968752 ] pci_device_remove+0xa9/0x250 CVE-2021-47456 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47456.html CVE-2021-47456 https://bugzilla.suse.com/1225256 SUSE Bug 1225256 In the Linux kernel, the following vulnerability has been resolved: ocfs2: mount fails with buffer overflow in strlen Starting with kernel 5.11 built with CONFIG_FORTIFY_SOURCE mouting an ocfs2 filesystem with either o2cb or pcmk cluster stack fails with the trace below. Problem seems to be that strings for cluster stack and cluster name are not guaranteed to be null terminated in the disk representation, while strlcpy assumes that the source string is always null terminated. This causes a read outside of the source string triggering the buffer overflow detection. detected buffer overflow in strlen ------------[ cut here ]------------ kernel BUG at lib/string.c:1149! invalid opcode: 0000 [#1] SMP PTI CPU: 1 PID: 910 Comm: mount.ocfs2 Not tainted 5.14.0-1-amd64 #1 Debian 5.14.6-2 RIP: 0010:fortify_panic+0xf/0x11 ... Call Trace: ocfs2_initialize_super.isra.0.cold+0xc/0x18 [ocfs2] ocfs2_fill_super+0x359/0x19b0 [ocfs2] mount_bdev+0x185/0x1b0 legacy_get_tree+0x27/0x40 vfs_get_tree+0x25/0xb0 path_mount+0x454/0xa20 __x64_sys_mount+0x103/0x140 do_syscall_64+0x3b/0xc0 entry_SYSCALL_64_after_hwframe+0x44/0xae CVE-2021-47458 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47458.html CVE-2021-47458 https://bugzilla.suse.com/1225252 SUSE Bug 1225252 In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix data corruption after conversion from inline format Commit 6dbf7bb55598 ("fs: Don't invalidate page buffers in block_write_full_page()") uncovered a latent bug in ocfs2 conversion from inline inode format to a normal inode format. The code in ocfs2_convert_inline_data_to_extents() attempts to zero out the whole cluster allocated for file data by grabbing, zeroing, and dirtying all pages covering this cluster. However these pages are beyond i_size, thus writeback code generally ignores these dirty pages and no blocks were ever actually zeroed on the disk. This oversight was fixed by commit 693c241a5f6a ("ocfs2: No need to zero pages past i_size.") for standard ocfs2 write path, inline conversion path was apparently forgotten; the commit log also has a reasoning why the zeroing actually is not needed. After commit 6dbf7bb55598, things became worse as writeback code stopped invalidating buffers on pages beyond i_size and thus these pages end up with clean PageDirty bit but with buffers attached to these pages being still dirty. So when a file is converted from inline format, then writeback triggers, and then the file is grown so that these pages become valid, the invalid dirtiness state is preserved, mark_buffer_dirty() does nothing on these pages (buffers are already dirty) but page is never written back because it is clean. So data written to these pages is lost once pages are reclaimed. Simple reproducer for the problem is: xfs_io -f -c "pwrite 0 2000" -c "pwrite 2000 2000" -c "fsync" \ -c "pwrite 4000 2000" ocfs2_file After unmounting and mounting the fs again, you can observe that end of 'ocfs2_file' has lost its contents. Fix the problem by not doing the pointless zeroing during conversion from inline format similarly as in the standard write path. [akpm@linux-foundation.org: fix whitespace, per Joseph] CVE-2021-47460 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47460.html CVE-2021-47460 https://bugzilla.suse.com/1225251 SUSE Bug 1225251 ** REJECT ** This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. CVE-2021-47469 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47469.html CVE-2021-47469 https://bugzilla.suse.com/1225347 SUSE Bug 1225347 ** REJECT ** This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. CVE-2021-47472 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47472.html CVE-2021-47472 https://bugzilla.suse.com/1225189 SUSE Bug 1225189 In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix a memory leak in an error path of qla2x00_process_els() Commit 8c0eb596baa5 ("[SCSI] qla2xxx: Fix a memory leak in an error path of qla2x00_process_els()"), intended to change: bsg_job->request->msgcode == FC_BSG_HST_ELS_NOLOGIN bsg_job->request->msgcode != FC_BSG_RPT_ELS but changed it to: bsg_job->request->msgcode == FC_BSG_RPT_ELS instead. Change the == to a != to avoid leaking the fcport structure or freeing unallocated memory. CVE-2021-47473 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47473.html CVE-2021-47473 https://bugzilla.suse.com/1225192 SUSE Bug 1225192 In the Linux kernel, the following vulnerability has been resolved: isofs: Fix out of bound access for corrupted isofs image When isofs image is suitably corrupted isofs_read_inode() can read data beyond the end of buffer. Sanity-check the directory entry length before using it. CVE-2021-47478 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47478.html CVE-2021-47478 https://bugzilla.suse.com/1225198 SUSE Bug 1225198 In the Linux kernel, the following vulnerability has been resolved: scsi: core: Put LLD module refcnt after SCSI device is released SCSI host release is triggered when SCSI device is freed. We have to make sure that the low-level device driver module won't be unloaded before SCSI host instance is released because shost->hostt is required in the release handler. Make sure to put LLD module refcnt after SCSI device is released. Fixes a kernel panic of 'BUG: unable to handle page fault for address' reported by Changhui and Yi. CVE-2021-47480 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47480.html CVE-2021-47480 https://bugzilla.suse.com/1225322 SUSE Bug 1225322 In the Linux kernel, the following vulnerability has been resolved: regmap: Fix possible double-free in regcache_rbtree_exit() In regcache_rbtree_insert_to_block(), when 'present' realloc failed, the 'blk' which is supposed to assign to 'rbnode->block' will be freed, so 'rbnode->block' points a freed memory, in the error handling path of regcache_rbtree_init(), 'rbnode->block' will be freed again in regcache_rbtree_exit(), KASAN will report double-free as follows: BUG: KASAN: double-free or invalid-free in kfree+0xce/0x390 Call Trace: slab_free_freelist_hook+0x10d/0x240 kfree+0xce/0x390 regcache_rbtree_exit+0x15d/0x1a0 regcache_rbtree_init+0x224/0x2c0 regcache_init+0x88d/0x1310 __regmap_init+0x3151/0x4a80 __devm_regmap_init+0x7d/0x100 madera_spi_probe+0x10f/0x333 [madera_spi] spi_probe+0x183/0x210 really_probe+0x285/0xc30 To fix this, moving up the assignment of rbnode->block to immediately after the reallocation has succeeded so that the data structure stays valid even if the second reallocation fails. CVE-2021-47483 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47483.html CVE-2021-47483 https://bugzilla.suse.com/1224907 SUSE Bug 1224907 https://bugzilla.suse.com/1224908 SUSE Bug 1224908 In the Linux kernel, the following vulnerability has been resolved: IB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields Overflowing either addrlimit or bytes_togo can allow userspace to trigger a buffer overflow of kernel memory. Check for overflows in all the places doing math on user controlled buffers. CVE-2021-47485 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47485.html CVE-2021-47485 https://bugzilla.suse.com/1224904 SUSE Bug 1224904 In the Linux kernel, the following vulnerability has been resolved: usbnet: sanity check for maxpacket maxpacket of 0 makes no sense and oopses as we need to divide by it. Give up. V2: fixed typo in log and stylistic issues CVE-2021-47495 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47495.html CVE-2021-47495 https://bugzilla.suse.com/1225351 SUSE Bug 1225351 In the Linux kernel, the following vulnerability has been resolved: net/tls: Fix flipped sign in tls_err_abort() calls sk->sk_err appears to expect a positive value, a convention that ktls doesn't always follow and that leads to memory corruption in other code. For instance, [kworker] tls_encrypt_done(..., err=<negative error from crypto request>) tls_err_abort(.., err) sk->sk_err = err; [task] splice_from_pipe_feed ... tls_sw_do_sendpage if (sk->sk_err) { ret = -sk->sk_err; // ret is positive splice_from_pipe_feed (continued) ret = actor(...) // ret is still positive and interpreted as bytes // written, resulting in underflow of buf->len and // sd->len, leading to huge buf->offset and bogus // addresses computed in later calls to actor() Fix all tls_err_abort() callers to pass a negative error code consistently and centralize the error-prone sign flip there, throwing in a warning to catch future misuse and uninlining the function so it really does only warn once. CVE-2021-47496 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47496.html CVE-2021-47496 https://bugzilla.suse.com/1225354 SUSE Bug 1225354 https://bugzilla.suse.com/1227656 SUSE Bug 1227656 In the Linux kernel, the following vulnerability has been resolved: nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells If a cell has 'nbits' equal to a multiple of BITS_PER_BYTE the logic *p &= GENMASK((cell->nbits%BITS_PER_BYTE) - 1, 0); will become undefined behavior because nbits modulo BITS_PER_BYTE is 0, and we subtract one from that making a large number that is then shifted more than the number of bits that fit into an unsigned long. UBSAN reports this problem: UBSAN: shift-out-of-bounds in drivers/nvmem/core.c:1386:8 shift exponent 64 is too large for 64-bit type 'unsigned long' CPU: 6 PID: 7 Comm: kworker/u16:0 Not tainted 5.15.0-rc3+ #9 Hardware name: Google Lazor (rev3+) with KB Backlight (DT) Workqueue: events_unbound deferred_probe_work_func Call trace: dump_backtrace+0x0/0x170 show_stack+0x24/0x30 dump_stack_lvl+0x64/0x7c dump_stack+0x18/0x38 ubsan_epilogue+0x10/0x54 __ubsan_handle_shift_out_of_bounds+0x180/0x194 __nvmem_cell_read+0x1ec/0x21c nvmem_cell_read+0x58/0x94 nvmem_cell_read_variable_common+0x4c/0xb0 nvmem_cell_read_variable_le_u32+0x40/0x100 a6xx_gpu_init+0x170/0x2f4 adreno_bind+0x174/0x284 component_bind_all+0xf0/0x264 msm_drm_bind+0x1d8/0x7a0 try_to_bring_up_master+0x164/0x1ac __component_add+0xbc/0x13c component_add+0x20/0x2c dp_display_probe+0x340/0x384 platform_probe+0xc0/0x100 really_probe+0x110/0x304 __driver_probe_device+0xb8/0x120 driver_probe_device+0x4c/0xfc __device_attach_driver+0xb0/0x128 bus_for_each_drv+0x90/0xdc __device_attach+0xc8/0x174 device_initial_probe+0x20/0x2c bus_probe_device+0x40/0xa4 deferred_probe_work_func+0x7c/0xb8 process_one_work+0x128/0x21c process_scheduled_works+0x40/0x54 worker_thread+0x1ec/0x2a8 kthread+0x138/0x158 ret_from_fork+0x10/0x20 Fix it by making sure there are any bits to mask out. CVE-2021-47497 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47497.html CVE-2021-47497 https://bugzilla.suse.com/1225355 SUSE Bug 1225355 https://bugzilla.suse.com/1227655 SUSE Bug 1227655 In the Linux kernel, the following vulnerability has been resolved: iio: mma8452: Fix trigger reference couting The mma8452 driver directly assigns a trigger to the struct iio_dev. The IIO core when done using this trigger will call `iio_trigger_put()` to drop the reference count by 1. Without the matching `iio_trigger_get()` in the driver the reference count can reach 0 too early, the trigger gets freed while still in use and a use-after-free occurs. Fix this by getting a reference to the trigger before assigning it to the IIO device. CVE-2021-47500 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47500.html CVE-2021-47500 https://bugzilla.suse.com/1225360 SUSE Bug 1225360 https://bugzilla.suse.com/1227698 SUSE Bug 1227698 In the Linux kernel, the following vulnerability has been resolved: nfsd: fix use-after-free due to delegation race A delegation break could arrive as soon as we've called vfs_setlease. A delegation break runs a callback which immediately (in nfsd4_cb_recall_prepare) adds the delegation to del_recall_lru. If we then exit nfs4_set_delegation without hashing the delegation, it will be freed as soon as the callback is done with it, without ever being removed from del_recall_lru. Symptoms show up later as use-after-free or list corruption warnings, usually in the laundromat thread. I suspect aba2072f4523 "nfsd: grant read delegations to clients holding writes" made this bug easier to hit, but I looked as far back as v3.0 and it looks to me it already had the same problem. So I'm not sure where the bug was introduced; it may have been there from the beginning. CVE-2021-47506 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47506.html CVE-2021-47506 https://bugzilla.suse.com/1225404 SUSE Bug 1225404 https://bugzilla.suse.com/1227497 SUSE Bug 1227497 In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: oss: Limit the period size to 16MB Set the practical limit to the period size (the fragment shift in OSS) instead of a full 31bit; a too large value could lead to the exhaust of memory as we allocate temporary buffers of the period size, too. As of this patch, we set to 16MB limit, which should cover all use cases. CVE-2021-47509 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47509.html CVE-2021-47509 https://bugzilla.suse.com/1225409 SUSE Bug 1225409 In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: oss: Fix negative period/buffer sizes The period size calculation in OSS layer may receive a negative value as an error, but the code there assumes only the positive values and handle them with size_t. Due to that, a too big value may be passed to the lower layers. This patch changes the code to handle with ssize_t and adds the proper error checks appropriately. CVE-2021-47511 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47511.html CVE-2021-47511 https://bugzilla.suse.com/1225411 SUSE Bug 1225411 https://bugzilla.suse.com/1227700 SUSE Bug 1227700 In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Fix leak of rcvhdrtail_dummy_kvaddr This buffer is currently allocated in hfi1_init(): if (reinit) ret = init_after_reset(dd); else ret = loadtime_init(dd); if (ret) goto done; /* allocate dummy tail memory for all receive contexts */ dd->rcvhdrtail_dummy_kvaddr = dma_alloc_coherent(&dd->pcidev->dev, sizeof(u64), &dd->rcvhdrtail_dummy_dma, GFP_KERNEL); if (!dd->rcvhdrtail_dummy_kvaddr) { dd_dev_err(dd, "cannot allocate dummy tail memory\n"); ret = -ENOMEM; goto done; } The reinit triggered path will overwrite the old allocation and leak it. Fix by moving the allocation to hfi1_alloc_devdata() and the deallocation to hfi1_free_devdata(). CVE-2021-47523 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47523.html CVE-2021-47523 https://bugzilla.suse.com/1225438 SUSE Bug 1225438 In the Linux kernel, the following vulnerability has been resolved: net/mlx4_en: Fix an use-after-free bug in mlx4_en_try_alloc_resources() In mlx4_en_try_alloc_resources(), mlx4_en_copy_priv() is called and tmp->tx_cq will be freed on the error path of mlx4_en_copy_priv(). After that mlx4_en_alloc_resources() is called and there is a dereference of &tmp->tx_cq[t][i] in mlx4_en_alloc_resources(), which could lead to a use after free problem on failure of mlx4_en_copy_priv(). Fix this bug by adding a check of mlx4_en_copy_priv() This bug was found by a static analyzer. The analysis employs differential checking to identify inconsistent security operations (e.g., checks or kfrees) between two code paths and confirms that the inconsistent operations are not recovered in the current function or the callers, so they constitute bugs. Note that, as a bug found by static analysis, it can be a false positive or hard to trigger. Multiple researchers have cross-reviewed the bug. Builds with CONFIG_MLX4_EN=m show no new warnings, and our static analyzer no longer warns about this code. CVE-2021-47541 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47541.html CVE-2021-47541 https://bugzilla.suse.com/1225453 SUSE Bug 1225453 https://bugzilla.suse.com/1225454 SUSE Bug 1225454 In the Linux kernel, the following vulnerability has been resolved: ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port() The if statement: if (port >= DSAF_GE_NUM) return; limits the value of port less than DSAF_GE_NUM (i.e., 8). However, if the value of port is 6 or 7, an array overflow could occur: port_rst_off = dsaf_dev->mac_cb[port]->port_rst_off; because the length of dsaf_dev->mac_cb is DSAF_MAX_PORT_NUM (i.e., 6). To fix this possible array overflow, we first check port and if it is greater than or equal to DSAF_MAX_PORT_NUM, the function returns. CVE-2021-47548 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47548.html CVE-2021-47548 https://bugzilla.suse.com/1225506 SUSE Bug 1225506 In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Fix kernel panic during drive powercycle test While looping over shost's sdev list it is possible that one of the drives is getting removed and its sas_target object is freed but its sdev object remains intact. Consequently, a kernel panic can occur while the driver is trying to access the sas_address field of sas_target object without also checking the sas_target object for NULL. CVE-2021-47565 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2021-47565.html CVE-2021-47565 https://bugzilla.suse.com/1225384 SUSE Bug 1225384 In the Linux kernel, the following vulnerability has been resolved: s390/dasd: fix Oops in dasd_alias_get_start_dev due to missing pavgroup Fix Oops in dasd_alias_get_start_dev() function caused by the pavgroup pointer being NULL. The pavgroup pointer is checked on the entrance of the function but without the lcu->lock being held. Therefore there is a race window between dasd_alias_get_start_dev() and _lcu_update() which sets pavgroup to NULL with the lcu->lock held. Fix by checking the pavgroup pointer with lcu->lock held. CVE-2022-48636 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2022-48636.html CVE-2022-48636 https://bugzilla.suse.com/1223512 SUSE Bug 1223512 In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix memory leak in __qlt_24xx_handle_abts() Commit 8f394da36a36 ("scsi: qla2xxx: Drop TARGET_SCF_LOOKUP_LUN_FROM_TAG") made the __qlt_24xx_handle_abts() function return early if tcm_qla2xxx_find_cmd_by_tag() didn't find a command, but it missed to clean up the allocated memory for the management command. CVE-2022-48650 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2022-48650.html CVE-2022-48650 https://bugzilla.suse.com/1223509 SUSE Bug 1223509 In the Linux kernel, the following vulnerability has been resolved: of: fdt: fix off-by-one error in unflatten_dt_nodes() Commit 78c44d910d3e ("drivers/of: Fix depth when unflattening devicetree") forgot to fix up the depth check in the loop body in unflatten_dt_nodes() which makes it possible to overflow the nps[] buffer... Found by Linux Verification Center (linuxtesting.org) with the SVACE static analysis tool. CVE-2022-48672 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2022-48672.html CVE-2022-48672 https://bugzilla.suse.com/1223931 SUSE Bug 1223931 In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix UAF when detecting digest errors We should also bail from the io_work loop when we set rd_enabled to true, so we don't attempt to read data from the socket when the TCP stream is already out-of-sync or corrupted. CVE-2022-48686 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2022-48686.html CVE-2022-48686 https://bugzilla.suse.com/1223948 SUSE Bug 1223948 https://bugzilla.suse.com/1226337 SUSE Bug 1226337 In the Linux kernel, the following vulnerability has been resolved: nvmet: fix a use-after-free Fix the following use-after-free complaint triggered by blktests nvme/004: BUG: KASAN: user-memory-access in blk_mq_complete_request_remote+0xac/0x350 Read of size 4 at addr 0000607bd1835943 by task kworker/13:1/460 Workqueue: nvmet-wq nvme_loop_execute_work [nvme_loop] Call Trace: show_stack+0x52/0x58 dump_stack_lvl+0x49/0x5e print_report.cold+0x36/0x1e2 kasan_report+0xb9/0xf0 __asan_load4+0x6b/0x80 blk_mq_complete_request_remote+0xac/0x350 nvme_loop_queue_response+0x1df/0x275 [nvme_loop] __nvmet_req_complete+0x132/0x4f0 [nvmet] nvmet_req_complete+0x15/0x40 [nvmet] nvmet_execute_io_connect+0x18a/0x1f0 [nvmet] nvme_loop_execute_work+0x20/0x30 [nvme_loop] process_one_work+0x56e/0xa70 worker_thread+0x2d1/0x640 kthread+0x183/0x1c0 ret_from_fork+0x1f/0x30 CVE-2022-48697 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2022-48697.html CVE-2022-48697 https://bugzilla.suse.com/1223922 SUSE Bug 1223922 In the Linux kernel, the following vulnerability has been resolved: ALSA: emu10k1: Fix out of bounds access in snd_emu10k1_pcm_channel_alloc() The voice allocator sometimes begins allocating from near the end of the array and then wraps around, however snd_emu10k1_pcm_channel_alloc() accesses the newly allocated voices as if it never wrapped around. This results in out of bounds access if the first voice has a high enough index so that first_voice + requested_voice_count > NUM_G (64). The more voices are requested, the more likely it is for this to occur. This was initially discovered using PipeWire, however it can be reproduced by calling aplay multiple times with 16 channels: aplay -r 48000 -D plughw:CARD=Live,DEV=3 -c 16 /dev/zero UBSAN: array-index-out-of-bounds in sound/pci/emu10k1/emupcm.c:127:40 index 65 is out of range for type 'snd_emu10k1_voice [64]' CPU: 1 PID: 31977 Comm: aplay Tainted: G W IOE 6.0.0-rc2-emu10k1+ #7 Hardware name: ASUSTEK COMPUTER INC P5W DH Deluxe/P5W DH Deluxe, BIOS 3002 07/22/2010 Call Trace: <TASK> dump_stack_lvl+0x49/0x63 dump_stack+0x10/0x16 ubsan_epilogue+0x9/0x3f __ubsan_handle_out_of_bounds.cold+0x44/0x49 snd_emu10k1_playback_hw_params+0x3bc/0x420 [snd_emu10k1] snd_pcm_hw_params+0x29f/0x600 [snd_pcm] snd_pcm_common_ioctl+0x188/0x1410 [snd_pcm] ? exit_to_user_mode_prepare+0x35/0x170 ? do_syscall_64+0x69/0x90 ? syscall_exit_to_user_mode+0x26/0x50 ? do_syscall_64+0x69/0x90 ? exit_to_user_mode_prepare+0x35/0x170 snd_pcm_ioctl+0x27/0x40 [snd_pcm] __x64_sys_ioctl+0x95/0xd0 do_syscall_64+0x5c/0x90 ? do_syscall_64+0x69/0x90 ? do_syscall_64+0x69/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd CVE-2022-48702 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2022-48702.html CVE-2022-48702 https://bugzilla.suse.com/1223923 SUSE Bug 1223923 In the Linux kernel, the following vulnerability has been resolved: drm/radeon: add a force flush to delay work when radeon Although radeon card fence and wait for gpu to finish processing current batch rings, there is still a corner case that radeon lockup work queue may not be fully flushed, and meanwhile the radeon_suspend_kms() function has called pci_set_power_state() to put device in D3hot state. Per PCI spec rev 4.0 on 5.3.1.4.1 D3hot State. > Configuration and Message requests are the only TLPs accepted by a Function in > the D3hot state. All other received Requests must be handled as Unsupported Requests, > and all received Completions may optionally be handled as Unexpected Completions. This issue will happen in following logs: Unable to handle kernel paging request at virtual address 00008800e0008010 CPU 0 kworker/0:3(131): Oops 0 pc = [<ffffffff811bea5c>] ra = [<ffffffff81240844>] ps = 0000 Tainted: G W pc is at si_gpu_check_soft_reset+0x3c/0x240 ra is at si_dma_is_lockup+0x34/0xd0 v0 = 0000000000000000 t0 = fff08800e0008010 t1 = 0000000000010000 t2 = 0000000000008010 t3 = fff00007e3c00000 t4 = fff00007e3c00258 t5 = 000000000000ffff t6 = 0000000000000001 t7 = fff00007ef078000 s0 = fff00007e3c016e8 s1 = fff00007e3c00000 s2 = fff00007e3c00018 s3 = fff00007e3c00000 s4 = fff00007fff59d80 s5 = 0000000000000000 s6 = fff00007ef07bd98 a0 = fff00007e3c00000 a1 = fff00007e3c016e8 a2 = 0000000000000008 a3 = 0000000000000001 a4 = 8f5c28f5c28f5c29 a5 = ffffffff810f4338 t8 = 0000000000000275 t9 = ffffffff809b66f8 t10 = ff6769c5d964b800 t11= 000000000000b886 pv = ffffffff811bea20 at = 0000000000000000 gp = ffffffff81d89690 sp = 00000000aa814126 Disabling lock debugging due to kernel taint Trace: [<ffffffff81240844>] si_dma_is_lockup+0x34/0xd0 [<ffffffff81119610>] radeon_fence_check_lockup+0xd0/0x290 [<ffffffff80977010>] process_one_work+0x280/0x550 [<ffffffff80977350>] worker_thread+0x70/0x7c0 [<ffffffff80977410>] worker_thread+0x130/0x7c0 [<ffffffff80982040>] kthread+0x200/0x210 [<ffffffff809772e0>] worker_thread+0x0/0x7c0 [<ffffffff80981f8c>] kthread+0x14c/0x210 [<ffffffff80911658>] ret_from_kernel_thread+0x18/0x20 [<ffffffff80981e40>] kthread+0x0/0x210 Code: ad3e0008 43f0074a ad7e0018 ad9e0020 8c3001e8 40230101 <88210000> 4821ed21 So force lockup work queue flush to fix this problem. CVE-2022-48704 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2022-48704.html CVE-2022-48704 https://bugzilla.suse.com/1223932 SUSE Bug 1223932 In the Linux kernel, the following vulnerability has been resolved: pinctrl: single: fix potential NULL dereference Added checking of pointer "function" in pcs_set_mux(). pinmux_generic_get_function() can return NULL and the pointer "function" was dereferenced without checking against NULL. Found by Linux Verification Center (linuxtesting.org) with SVACE. CVE-2022-48708 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2022-48708.html CVE-2022-48708 https://bugzilla.suse.com/1224942 SUSE Bug 1224942 In the Linux kernel, the following vulnerability has been resolved: drm/radeon: fix a possible null pointer dereference In radeon_fp_native_mode(), the return value of drm_mode_duplicate() is assigned to mode, which will lead to a NULL pointer dereference on failure of drm_mode_duplicate(). Add a check to avoid npd. The failure status of drm_cvt_mode() on the other path is checked too. CVE-2022-48710 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2022-48710.html CVE-2022-48710 https://bugzilla.suse.com/1225230 SUSE Bug 1225230 A deadlock flaw was found in the Linux kernel's BPF subsystem. This flaw allows a local user to potentially crash the system. CVE-2023-0160 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2023-0160.html CVE-2023-0160 https://bugzilla.suse.com/1209657 SUSE Bug 1209657 A use-after-free vulnerability in the Linux Kernel traffic control index filter (tcindex) can be exploited to achieve local privilege escalation. The tcindex_delete function which does not properly deactivate filters in case of a perfect hashes while deleting the underlying structure which can later lead to double freeing the structure. A local attacker user can use this vulnerability to elevate its privileges to root. We recommend upgrading past commit 8c710f75256bb3cf05ac7b1672c82b92c43f3d28. CVE-2023-1829 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2023-1829.html CVE-2023-1829 https://bugzilla.suse.com/1210335 SUSE Bug 1210335 https://bugzilla.suse.com/1210619 SUSE Bug 1210619 https://bugzilla.suse.com/1217444 SUSE Bug 1217444 https://bugzilla.suse.com/1217531 SUSE Bug 1217531 https://bugzilla.suse.com/1220886 SUSE Bug 1220886 https://bugzilla.suse.com/1228311 SUSE Bug 1228311 A flaw was found in the IPv4 Resource Reservation Protocol (RSVP) classifier in the Linux kernel. The xprt pointer may go beyond the linear part of the skb, leading to an out-of-bounds read in the `rsvp_classify` function. This issue may allow a local user to crash the system and cause a denial of service. CVE-2023-42755 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2023-42755.html CVE-2023-42755 https://bugzilla.suse.com/1215702 SUSE Bug 1215702 The brcm80211 component in the Linux kernel through 6.5.10 has a brcmf_cfg80211_detach use-after-free in the device unplugging (disconnect the USB by hotplug) code. For physically proximate attackers with local access, this "could be exploited in a real world scenario." This is related to brcmf_cfg80211_escan_timeout_worker in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c. CVE-2023-47233 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2023-47233.html CVE-2023-47233 https://bugzilla.suse.com/1216702 SUSE Bug 1216702 https://bugzilla.suse.com/1224592 SUSE Bug 1224592 In the Linux kernel, the following vulnerability has been resolved: ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data() Including the transhdrlen in length is a problem when the packet is partially filled (e.g. something like send(MSG_MORE) happened previously) when appending to an IPv4 or IPv6 packet as we don't want to repeat the transport header or account for it twice. This can happen under some circumstances, such as splicing into an L2TP socket. The symptom observed is a warning in __ip6_append_data(): WARNING: CPU: 1 PID: 5042 at net/ipv6/ip6_output.c:1800 __ip6_append_data.isra.0+0x1be8/0x47f0 net/ipv6/ip6_output.c:1800 that occurs when MSG_SPLICE_PAGES is used to append more data to an already partially occupied skbuff. The warning occurs when 'copy' is larger than the amount of data in the message iterator. This is because the requested length includes the transport header length when it shouldn't. This can be triggered by, for example: sfd = socket(AF_INET6, SOCK_DGRAM, IPPROTO_L2TP); bind(sfd, ...); // ::1 connect(sfd, ...); // ::1 port 7 send(sfd, buffer, 4100, MSG_MORE); sendfile(sfd, dfd, NULL, 1024); Fix this by only adding transhdrlen into the length if the write queue is empty in l2tp_ip6_sendmsg(), analogously to how UDP does things. l2tp_ip_sendmsg() looks like it won't suffer from this problem as it builds the UDP packet itself. CVE-2023-52527 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2023-52527.html CVE-2023-52527 https://bugzilla.suse.com/1220928 SUSE Bug 1220928 In the Linux kernel, the following vulnerability has been resolved: drm/msm/dpu: Add mutex lock in control vblank irq Add a mutex lock to control vblank irq to synchronize vblank enable/disable operations happening from different threads to prevent race conditions while registering/unregistering the vblank irq callback. v4: -Removed vblank_ctl_lock from dpu_encoder_virt, so it is only a parameter of dpu_encoder_phys. -Switch from atomic refcnt to a simple int counter as mutex has now been added v3: Mistakenly did not change wording in last version. It is done now. v2: Slightly changed wording of commit message Patchwork: https://patchwork.freedesktop.org/patch/571854/ CVE-2023-52586 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2023-52586.html CVE-2023-52586 https://bugzilla.suse.com/1221081 SUSE Bug 1221081 In the Linux kernel, the following vulnerability has been resolved: reiserfs: Avoid touching renamed directory if parent does not change The VFS will not be locking moved directory if its parent does not change. Change reiserfs rename code to avoid touching renamed directory if its parent does not change as without locking that can corrupt the filesystem. CVE-2023-52591 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2023-52591.html CVE-2023-52591 https://bugzilla.suse.com/1221044 SUSE Bug 1221044 https://bugzilla.suse.com/1221578 SUSE Bug 1221578 https://bugzilla.suse.com/1221598 SUSE Bug 1221598 In the Linux kernel, the following vulnerability has been resolved: aio: fix mremap after fork null-deref Commit e4a0d3e720e7 ("aio: Make it possible to remap aio ring") introduced a null-deref if mremap is called on an old aio mapping after fork as mm->ioctx_table will be set to NULL. [jmoyer@redhat.com: fix 80 column issue] CVE-2023-52646 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2023-52646.html CVE-2023-52646 https://bugzilla.suse.com/1223432 SUSE Bug 1223432 In the Linux kernel, the following vulnerability has been resolved: SUNRPC: fix a memleak in gss_import_v2_context The ctx->mech_used.data allocated by kmemdup is not freed in neither gss_import_v2_context nor it only caller gss_krb5_import_sec_context, which frees ctx on error. Thus, this patch reform the last call of gss_import_v2_context to the gss_krb5_import_ctx_v2, preventing the memleak while keepping the return formation. CVE-2023-52653 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2023-52653.html CVE-2023-52653 https://bugzilla.suse.com/1223712 SUSE Bug 1223712 In the Linux kernel, the following vulnerability has been resolved: usb: aqc111: check packet for fixup for true limit If a device sends a packet that is inbetween 0 and sizeof(u64) the value passed to skb_trim() as length will wrap around ending up as some very large value. The driver will then proceed to parse the header located at that position, which will either oops or process some random value. The fix is to check against sizeof(u64) rather than 0, which the driver currently does. The issue exists since the introduction of the driver. CVE-2023-52655 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2023-52655.html CVE-2023-52655 https://bugzilla.suse.com/1217169 SUSE Bug 1217169 In the Linux kernel, the following vulnerability has been resolved: net: atlantic: eliminate double free in error handling logic Driver has a logic leak in ring data allocation/free, where aq_ring_free could be called multiple times on same ring, if system is under stress and got memory allocation error. Ring pointer was used as an indicator of failure, but this is not correct since only ring data is allocated/deallocated. Ring itself is an array member. Changing ring allocation functions to return error code directly. This simplifies error handling and eliminates aq_ring_free on higher layer. CVE-2023-52664 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2023-52664.html CVE-2023-52664 https://bugzilla.suse.com/1224747 SUSE Bug 1224747 ** REJECT ** This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. CVE-2023-52685 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2023-52685.html CVE-2023-52685 https://bugzilla.suse.com/1224728 SUSE Bug 1224728 In the Linux kernel, the following vulnerability has been resolved: powerpc/powernv: Add a null pointer check in opal_event_init() kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure. CVE-2023-52686 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2023-52686.html CVE-2023-52686 https://bugzilla.suse.com/1224682 SUSE Bug 1224682 In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: fix a double-free in si_dpm_init When the allocation of adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries fails, amdgpu_free_extended_power_table is called to free some fields of adev. However, when the control flow returns to si_dpm_sw_init, it goes to label dpm_failed and calls si_dpm_fini, which calls amdgpu_free_extended_power_table again and free those fields again. Thus a double-free is triggered. CVE-2023-52691 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2023-52691.html CVE-2023-52691 https://bugzilla.suse.com/1224607 SUSE Bug 1224607 In the Linux kernel, the following vulnerability has been resolved: powerpc/powernv: Add a null pointer check in opal_powercap_init() kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure. CVE-2023-52696 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2023-52696.html CVE-2023-52696 https://bugzilla.suse.com/1224601 SUSE Bug 1224601 In the Linux kernel, the following vulnerability has been resolved: calipso: fix memory leak in netlbl_calipso_add_pass() If IPv6 support is disabled at boot (ipv6.disable=1), the calipso_init() -> netlbl_calipso_ops_register() function isn't called, and the netlbl_calipso_ops_get() function always returns NULL. In this case, the netlbl_calipso_add_pass() function allocates memory for the doi_def variable but doesn't free it with the calipso_doi_free(). BUG: memory leak unreferenced object 0xffff888011d68180 (size 64): comm "syz-executor.1", pid 10746, jiffies 4295410986 (age 17.928s) hex dump (first 32 bytes): 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<...>] kmalloc include/linux/slab.h:552 [inline] [<...>] netlbl_calipso_add_pass net/netlabel/netlabel_calipso.c:76 [inline] [<...>] netlbl_calipso_add+0x22e/0x4f0 net/netlabel/netlabel_calipso.c:111 [<...>] genl_family_rcv_msg_doit+0x22f/0x330 net/netlink/genetlink.c:739 [<...>] genl_family_rcv_msg net/netlink/genetlink.c:783 [inline] [<...>] genl_rcv_msg+0x341/0x5a0 net/netlink/genetlink.c:800 [<...>] netlink_rcv_skb+0x14d/0x440 net/netlink/af_netlink.c:2515 [<...>] genl_rcv+0x29/0x40 net/netlink/genetlink.c:811 [<...>] netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline] [<...>] netlink_unicast+0x54b/0x800 net/netlink/af_netlink.c:1339 [<...>] netlink_sendmsg+0x90a/0xdf0 net/netlink/af_netlink.c:1934 [<...>] sock_sendmsg_nosec net/socket.c:651 [inline] [<...>] sock_sendmsg+0x157/0x190 net/socket.c:671 [<...>] ____sys_sendmsg+0x712/0x870 net/socket.c:2342 [<...>] ___sys_sendmsg+0xf8/0x170 net/socket.c:2396 [<...>] __sys_sendmsg+0xea/0x1b0 net/socket.c:2429 [<...>] do_syscall_64+0x30/0x40 arch/x86/entry/common.c:46 [<...>] entry_SYSCALL_64_after_hwframe+0x61/0xc6 Found by InfoTeCS on behalf of Linux Verification Center (linuxtesting.org) with Syzkaller [PM: merged via the LSM tree at Jakub Kicinski request] CVE-2023-52698 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2023-52698.html CVE-2023-52698 https://bugzilla.suse.com/1224621 SUSE Bug 1224621 In the Linux kernel, the following vulnerability has been resolved: net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path syzbot reported that act_len in kalmia_send_init_packet() is uninitialized when passing it to the first usb_bulk_msg error path. Jiri Pirko noted that it's pointless to pass it in the error path, and that the value that would be printed in the second error path would be the value of act_len from the first call to usb_bulk_msg.[1] With this in mind, let's just not pass act_len to the usb_bulk_msg error paths. 1: https://lore.kernel.org/lkml/Y9pY61y1nwTuzMOa@nanopsycho/ CVE-2023-52703 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2023-52703.html CVE-2023-52703 https://bugzilla.suse.com/1225549 SUSE Bug 1225549 In the Linux kernel, the following vulnerability has been resolved: mmc: sdio: fix possible resource leaks in some error paths If sdio_add_func() or sdio_init_func() fails, sdio_remove_func() can not release the resources, because the sdio function is not presented in these two cases, it won't call of_node_put() or put_device(). To fix these leaks, make sdio_func_present() only control whether device_del() needs to be called or not, then always call of_node_put() and put_device(). In error case in sdio_init_func(), the reference of 'card->dev' is not get, to avoid redundant put in sdio_free_func_cis(), move the get_device() to sdio_alloc_func() and put_device() to sdio_release_func(), it can keep the get/put function be balanced. Without this patch, while doing fault inject test, it can get the following leak reports, after this fix, the leak is gone. unreferenced object 0xffff888112514000 (size 2048): comm "kworker/3:2", pid 65, jiffies 4294741614 (age 124.774s) hex dump (first 32 bytes): 00 e0 6f 12 81 88 ff ff 60 58 8d 06 81 88 ff ff ..o.....`X...... 10 40 51 12 81 88 ff ff 10 40 51 12 81 88 ff ff .@Q......@Q..... backtrace: [<000000009e5931da>] kmalloc_trace+0x21/0x110 [<000000002f839ccb>] mmc_alloc_card+0x38/0xb0 [mmc_core] [<0000000004adcbf6>] mmc_sdio_init_card+0xde/0x170 [mmc_core] [<000000007538fea0>] mmc_attach_sdio+0xcb/0x1b0 [mmc_core] [<00000000d4fdeba7>] mmc_rescan+0x54a/0x640 [mmc_core] unreferenced object 0xffff888112511000 (size 2048): comm "kworker/3:2", pid 65, jiffies 4294741623 (age 124.766s) hex dump (first 32 bytes): 00 40 51 12 81 88 ff ff e0 58 8d 06 81 88 ff ff .@Q......X...... 10 10 51 12 81 88 ff ff 10 10 51 12 81 88 ff ff ..Q.......Q..... backtrace: [<000000009e5931da>] kmalloc_trace+0x21/0x110 [<00000000fcbe706c>] sdio_alloc_func+0x35/0x100 [mmc_core] [<00000000c68f4b50>] mmc_attach_sdio.cold.18+0xb1/0x395 [mmc_core] [<00000000d4fdeba7>] mmc_rescan+0x54a/0x640 [mmc_core] CVE-2023-52730 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2023-52730.html CVE-2023-52730 https://bugzilla.suse.com/1224956 SUSE Bug 1224956 In the Linux kernel, the following vulnerability has been resolved: ceph: blocklist the kclient when receiving corrupted snap trace When received corrupted snap trace we don't know what exactly has happened in MDS side. And we shouldn't continue IOs and metadatas access to MDS, which may corrupt or get incorrect contents. This patch will just block all the further IO/MDS requests immediately and then evict the kclient itself. The reason why we still need to evict the kclient just after blocking all the further IOs is that the MDS could revoke the caps faster. CVE-2023-52732 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2023-52732.html CVE-2023-52732 https://bugzilla.suse.com/1225222 SUSE Bug 1225222 In the Linux kernel, the following vulnerability has been resolved: cifs: Fix use-after-free in rdata->read_into_pages() When the network status is unstable, use-after-free may occur when read data from the server. BUG: KASAN: use-after-free in readpages_fill_pages+0x14c/0x7e0 Call Trace: <TASK> dump_stack_lvl+0x38/0x4c print_report+0x16f/0x4a6 kasan_report+0xb7/0x130 readpages_fill_pages+0x14c/0x7e0 cifs_readv_receive+0x46d/0xa40 cifs_demultiplex_thread+0x121c/0x1490 kthread+0x16b/0x1a0 ret_from_fork+0x2c/0x50 </TASK> Allocated by task 2535: kasan_save_stack+0x22/0x50 kasan_set_track+0x25/0x30 __kasan_kmalloc+0x82/0x90 cifs_readdata_direct_alloc+0x2c/0x110 cifs_readdata_alloc+0x2d/0x60 cifs_readahead+0x393/0xfe0 read_pages+0x12f/0x470 page_cache_ra_unbounded+0x1b1/0x240 filemap_get_pages+0x1c8/0x9a0 filemap_read+0x1c0/0x540 cifs_strict_readv+0x21b/0x240 vfs_read+0x395/0x4b0 ksys_read+0xb8/0x150 do_syscall_64+0x3f/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc Freed by task 79: kasan_save_stack+0x22/0x50 kasan_set_track+0x25/0x30 kasan_save_free_info+0x2e/0x50 __kasan_slab_free+0x10e/0x1a0 __kmem_cache_free+0x7a/0x1a0 cifs_readdata_release+0x49/0x60 process_one_work+0x46c/0x760 worker_thread+0x2a4/0x6f0 kthread+0x16b/0x1a0 ret_from_fork+0x2c/0x50 Last potentially related work creation: kasan_save_stack+0x22/0x50 __kasan_record_aux_stack+0x95/0xb0 insert_work+0x2b/0x130 __queue_work+0x1fe/0x660 queue_work_on+0x4b/0x60 smb2_readv_callback+0x396/0x800 cifs_abort_connection+0x474/0x6a0 cifs_reconnect+0x5cb/0xa50 cifs_readv_from_socket.cold+0x22/0x6c cifs_read_page_from_socket+0xc1/0x100 readpages_fill_pages.cold+0x2f/0x46 cifs_readv_receive+0x46d/0xa40 cifs_demultiplex_thread+0x121c/0x1490 kthread+0x16b/0x1a0 ret_from_fork+0x2c/0x50 The following function calls will cause UAF of the rdata pointer. readpages_fill_pages cifs_read_page_from_socket cifs_readv_from_socket cifs_reconnect __cifs_reconnect cifs_abort_connection mid->callback() --> smb2_readv_callback queue_work(&rdata->work) # if the worker completes first, # the rdata is freed cifs_readv_complete kref_put cifs_readdata_release kfree(rdata) return rdata->... # UAF in readpages_fill_pages() Similarly, this problem also occurs in the uncache_fill_pages(). Fix this by adjusts the order of condition judgment in the return statement. CVE-2023-52741 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2023-52741.html CVE-2023-52741 https://bugzilla.suse.com/1225479 SUSE Bug 1225479 In the Linux kernel, the following vulnerability has been resolved: net: USB: Fix wrong-direction WARNING in plusb.c The syzbot fuzzer detected a bug in the plusb network driver: A zero-length control-OUT transfer was treated as a read instead of a write. In modern kernels this error provokes a WARNING: usb 1-1: BOGUS control dir, pipe 80000280 doesn't match bRequestType c0 WARNING: CPU: 0 PID: 4645 at drivers/usb/core/urb.c:411 usb_submit_urb+0x14a7/0x1880 drivers/usb/core/urb.c:411 Modules linked in: CPU: 1 PID: 4645 Comm: dhcpcd Not tainted 6.2.0-rc6-syzkaller-00050-g9f266ccaa2f5 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023 RIP: 0010:usb_submit_urb+0x14a7/0x1880 drivers/usb/core/urb.c:411 ... Call Trace: <TASK> usb_start_wait_urb+0x101/0x4b0 drivers/usb/core/message.c:58 usb_internal_control_msg drivers/usb/core/message.c:102 [inline] usb_control_msg+0x320/0x4a0 drivers/usb/core/message.c:153 __usbnet_read_cmd+0xb9/0x390 drivers/net/usb/usbnet.c:2010 usbnet_read_cmd+0x96/0xf0 drivers/net/usb/usbnet.c:2068 pl_vendor_req drivers/net/usb/plusb.c:60 [inline] pl_set_QuickLink_features drivers/net/usb/plusb.c:75 [inline] pl_reset+0x2f/0xf0 drivers/net/usb/plusb.c:85 usbnet_open+0xcc/0x5d0 drivers/net/usb/usbnet.c:889 __dev_open+0x297/0x4d0 net/core/dev.c:1417 __dev_change_flags+0x587/0x750 net/core/dev.c:8530 dev_change_flags+0x97/0x170 net/core/dev.c:8602 devinet_ioctl+0x15a2/0x1d70 net/ipv4/devinet.c:1147 inet_ioctl+0x33f/0x380 net/ipv4/af_inet.c:979 sock_do_ioctl+0xcc/0x230 net/socket.c:1169 sock_ioctl+0x1f8/0x680 net/socket.c:1286 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __x64_sys_ioctl+0x197/0x210 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd The fix is to call usbnet_write_cmd() instead of usbnet_read_cmd() and remove the USB_DIR_IN flag. CVE-2023-52742 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2023-52742.html CVE-2023-52742 https://bugzilla.suse.com/1225482 SUSE Bug 1225482 In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Restore allocated resources on failed copyout Fix a resource leak if an error occurs. CVE-2023-52747 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2023-52747.html CVE-2023-52747 https://bugzilla.suse.com/1224931 SUSE Bug 1224931 ** REJECT ** This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. CVE-2023-52759 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2023-52759.html CVE-2023-52759 https://bugzilla.suse.com/1225560 SUSE Bug 1225560 In the Linux kernel, the following vulnerability has been resolved: s390/dasd: protect device queue against concurrent access In dasd_profile_start() the amount of requests on the device queue are counted. The access to the device queue is unprotected against concurrent access. With a lot of parallel I/O, especially with alias devices enabled, the device queue can change while dasd_profile_start() is accessing the queue. In the worst case this leads to a kernel panic due to incorrect pointer accesses. Fix this by taking the device lock before accessing the queue and counting the requests. Additionally the check for a valid profile data pointer can be done earlier to avoid unnecessary locking in a hot path. CVE-2023-52774 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2023-52774.html CVE-2023-52774 https://bugzilla.suse.com/1225572 SUSE Bug 1225572 In the Linux kernel, the following vulnerability has been resolved: usb: config: fix iteration issue in 'usb_get_bos_descriptor()' The BOS descriptor defines a root descriptor and is the base descriptor for accessing a family of related descriptors. Function 'usb_get_bos_descriptor()' encounters an iteration issue when skipping the 'USB_DT_DEVICE_CAPABILITY' descriptor type. This results in the same descriptor being read repeatedly. To address this issue, a 'goto' statement is introduced to ensure that the pointer and the amount read is updated correctly. This ensures that the function iterates to the next descriptor instead of reading the same descriptor repeatedly. CVE-2023-52781 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2023-52781.html CVE-2023-52781 https://bugzilla.suse.com/1225092 SUSE Bug 1225092 In the Linux kernel, the following vulnerability has been resolved: ipvlan: add ipvlan_route_v6_outbound() helper Inspired by syzbot reports using a stack of multiple ipvlan devices. Reduce stack size needed in ipvlan_process_v6_outbound() by moving the flowi6 struct used for the route lookup in an non inlined helper. ipvlan_route_v6_outbound() needs 120 bytes on the stack, immediately reclaimed. Also make sure ipvlan_process_v4_outbound() is not inlined. We might also have to lower MAX_NEST_DEV, because only syzbot uses setups with more than four stacked devices. BUG: TASK stack guard page was hit at ffffc9000e803ff8 (stack is ffffc9000e804000..ffffc9000e808000) stack guard page: 0000 [#1] SMP KASAN CPU: 0 PID: 13442 Comm: syz-executor.4 Not tainted 6.1.52-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023 RIP: 0010:kasan_check_range+0x4/0x2a0 mm/kasan/generic.c:188 Code: 48 01 c6 48 89 c7 e8 db 4e c1 03 31 c0 5d c3 cc 0f 0b eb 02 0f 0b b8 ea ff ff ff 5d c3 cc 00 00 cc cc 00 00 cc cc 55 48 89 e5 <41> 57 41 56 41 55 41 54 53 b0 01 48 85 f6 0f 84 a4 01 00 00 48 89 RSP: 0018:ffffc9000e804000 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff817e5bf2 RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff887c6568 RBP: ffffc9000e804000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: dffffc0000000001 R12: 1ffff92001d0080c R13: dffffc0000000000 R14: ffffffff87e6b100 R15: 0000000000000000 FS: 00007fd0c55826c0(0000) GS:ffff8881f6800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffc9000e803ff8 CR3: 0000000170ef7000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <#DF> </#DF> <TASK> [<ffffffff81f281d1>] __kasan_check_read+0x11/0x20 mm/kasan/shadow.c:31 [<ffffffff817e5bf2>] instrument_atomic_read include/linux/instrumented.h:72 [inline] [<ffffffff817e5bf2>] _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline] [<ffffffff817e5bf2>] cpumask_test_cpu include/linux/cpumask.h:506 [inline] [<ffffffff817e5bf2>] cpu_online include/linux/cpumask.h:1092 [inline] [<ffffffff817e5bf2>] trace_lock_acquire include/trace/events/lock.h:24 [inline] [<ffffffff817e5bf2>] lock_acquire+0xe2/0x590 kernel/locking/lockdep.c:5632 [<ffffffff8563221e>] rcu_lock_acquire+0x2e/0x40 include/linux/rcupdate.h:306 [<ffffffff8561464d>] rcu_read_lock include/linux/rcupdate.h:747 [inline] [<ffffffff8561464d>] ip6_pol_route+0x15d/0x1440 net/ipv6/route.c:2221 [<ffffffff85618120>] ip6_pol_route_output+0x50/0x80 net/ipv6/route.c:2606 [<ffffffff856f65b5>] pol_lookup_func include/net/ip6_fib.h:584 [inline] [<ffffffff856f65b5>] fib6_rule_lookup+0x265/0x620 net/ipv6/fib6_rules.c:116 [<ffffffff85618009>] ip6_route_output_flags_noref+0x2d9/0x3a0 net/ipv6/route.c:2638 [<ffffffff8561821a>] ip6_route_output_flags+0xca/0x340 net/ipv6/route.c:2651 [<ffffffff838bd5a3>] ip6_route_output include/net/ip6_route.h:100 [inline] [<ffffffff838bd5a3>] ipvlan_process_v6_outbound drivers/net/ipvlan/ipvlan_core.c:473 [inline] [<ffffffff838bd5a3>] ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:529 [inline] [<ffffffff838bd5a3>] ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:602 [inline] [<ffffffff838bd5a3>] ipvlan_queue_xmit+0xc33/0x1be0 drivers/net/ipvlan/ipvlan_core.c:677 [<ffffffff838c2909>] ipvlan_start_xmit+0x49/0x100 drivers/net/ipvlan/ipvlan_main.c:229 [<ffffffff84d03900>] netdev_start_xmit include/linux/netdevice.h:4966 [inline] [<ffffffff84d03900>] xmit_one net/core/dev.c:3644 [inline] [<ffffffff84d03900>] dev_hard_start_xmit+0x320/0x980 net/core/dev.c:3660 [<ffffffff84d080e2>] __dev_queue_xmit+0x16b2/0x3370 net/core/dev.c:4324 [<ffffffff855ce4cd>] dev_queue_xmit include/linux/netdevice.h:3067 [inline] [<ffffffff855ce4cd>] neigh_hh_output include/net/neighbour.h:529 [inline] [<f ---truncated--- CVE-2023-52796 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2023-52796.html CVE-2023-52796 https://bugzilla.suse.com/1224930 SUSE Bug 1224930 In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix RPC client cleaned up the freed pipefs dentries RPC client pipefs dentries cleanup is in separated rpc_remove_pipedir() workqueue,which takes care about pipefs superblock locking. In some special scenarios, when kernel frees the pipefs sb of the current client and immediately alloctes a new pipefs sb, rpc_remove_pipedir function would misjudge the existence of pipefs sb which is not the one it used to hold. As a result, the rpc_remove_pipedir would clean the released freed pipefs dentries. To fix this issue, rpc_remove_pipedir should check whether the current pipefs sb is consistent with the original pipefs sb. This error can be catched by KASAN: ========================================================= [ 250.497700] BUG: KASAN: slab-use-after-free in dget_parent+0x195/0x200 [ 250.498315] Read of size 4 at addr ffff88800a2ab804 by task kworker/0:18/106503 [ 250.500549] Workqueue: events rpc_free_client_work [ 250.501001] Call Trace: [ 250.502880] kasan_report+0xb6/0xf0 [ 250.503209] ? dget_parent+0x195/0x200 [ 250.503561] dget_parent+0x195/0x200 [ 250.503897] ? __pfx_rpc_clntdir_depopulate+0x10/0x10 [ 250.504384] rpc_rmdir_depopulate+0x1b/0x90 [ 250.504781] rpc_remove_client_dir+0xf5/0x150 [ 250.505195] rpc_free_client_work+0xe4/0x230 [ 250.505598] process_one_work+0x8ee/0x13b0 ... [ 22.039056] Allocated by task 244: [ 22.039390] kasan_save_stack+0x22/0x50 [ 22.039758] kasan_set_track+0x25/0x30 [ 22.040109] __kasan_slab_alloc+0x59/0x70 [ 22.040487] kmem_cache_alloc_lru+0xf0/0x240 [ 22.040889] __d_alloc+0x31/0x8e0 [ 22.041207] d_alloc+0x44/0x1f0 [ 22.041514] __rpc_lookup_create_exclusive+0x11c/0x140 [ 22.041987] rpc_mkdir_populate.constprop.0+0x5f/0x110 [ 22.042459] rpc_create_client_dir+0x34/0x150 [ 22.042874] rpc_setup_pipedir_sb+0x102/0x1c0 [ 22.043284] rpc_client_register+0x136/0x4e0 [ 22.043689] rpc_new_client+0x911/0x1020 [ 22.044057] rpc_create_xprt+0xcb/0x370 [ 22.044417] rpc_create+0x36b/0x6c0 ... [ 22.049524] Freed by task 0: [ 22.049803] kasan_save_stack+0x22/0x50 [ 22.050165] kasan_set_track+0x25/0x30 [ 22.050520] kasan_save_free_info+0x2b/0x50 [ 22.050921] __kasan_slab_free+0x10e/0x1a0 [ 22.051306] kmem_cache_free+0xa5/0x390 [ 22.051667] rcu_core+0x62c/0x1930 [ 22.051995] __do_softirq+0x165/0x52a [ 22.052347] [ 22.052503] Last potentially related work creation: [ 22.052952] kasan_save_stack+0x22/0x50 [ 22.053313] __kasan_record_aux_stack+0x8e/0xa0 [ 22.053739] __call_rcu_common.constprop.0+0x6b/0x8b0 [ 22.054209] dentry_free+0xb2/0x140 [ 22.054540] __dentry_kill+0x3be/0x540 [ 22.054900] shrink_dentry_list+0x199/0x510 [ 22.055293] shrink_dcache_parent+0x190/0x240 [ 22.055703] do_one_tree+0x11/0x40 [ 22.056028] shrink_dcache_for_umount+0x61/0x140 [ 22.056461] generic_shutdown_super+0x70/0x590 [ 22.056879] kill_anon_super+0x3a/0x60 [ 22.057234] rpc_kill_sb+0x121/0x200 CVE-2023-52803 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2023-52803.html CVE-2023-52803 https://bugzilla.suse.com/1225008 SUSE Bug 1225008 In the Linux kernel, the following vulnerability has been resolved: drm/panel: fix a possible null pointer dereference In versatile_panel_get_modes(), the return value of drm_mode_duplicate() is assigned to mode, which will lead to a NULL pointer dereference on failure of drm_mode_duplicate(). Add a check to avoid npd. CVE-2023-52821 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2023-52821.html CVE-2023-52821 https://bugzilla.suse.com/1225022 SUSE Bug 1225022 In the Linux kernel, the following vulnerability has been resolved: platform/x86: wmi: Fix opening of char device Since commit fa1f68db6ca7 ("drivers: misc: pass miscdevice pointer via file private data"), the miscdevice stores a pointer to itself inside filp->private_data, which means that private_data will not be NULL when wmi_char_open() is called. This might cause memory corruption should wmi_char_open() be unable to find its driver, something which can happen when the associated WMI device is deleted in wmi_free_devices(). Fix the problem by using the miscdevice pointer to retrieve the WMI device data associated with a char device using container_of(). This also avoids wmi_char_open() picking a wrong WMI device bound to a driver with the same name as the original driver. CVE-2023-52864 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2023-52864.html CVE-2023-52864 https://bugzilla.suse.com/1225132 SUSE Bug 1225132 In the Linux kernel, the following vulnerability has been resolved: clk: mediatek: clk-mt6797: Add check for mtk_alloc_clk_data Add the check for the return value of mtk_alloc_clk_data() in order to avoid NULL pointer dereference. CVE-2023-52865 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2023-52865.html CVE-2023-52865 https://bugzilla.suse.com/1225086 SUSE Bug 1225086 In the Linux kernel, the following vulnerability has been resolved: drm/radeon: possible buffer overflow Buffer 'afmt_status' of size 6 could overflow, since index 'afmt_idx' is checked after access. CVE-2023-52867 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2023-52867.html CVE-2023-52867 https://bugzilla.suse.com/1225009 SUSE Bug 1225009 In the Linux kernel, the following vulnerability has been resolved: clk: mediatek: clk-mt2701: Add check for mtk_alloc_clk_data Add the check for the return value of mtk_alloc_clk_data() in order to avoid NULL pointer dereference. CVE-2023-52875 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2023-52875.html CVE-2023-52875 https://bugzilla.suse.com/1225096 SUSE Bug 1225096 In the Linux kernel, the following vulnerability has been resolved: tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc Any unprivileged user can attach N_GSM0710 ldisc, but it requires CAP_NET_ADMIN to create a GSM network anyway. Require initial namespace CAP_NET_ADMIN to do that. CVE-2023-52880 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2023-52880.html CVE-2023-52880 https://bugzilla.suse.com/1222619 SUSE Bug 1222619 A denial of service vulnerability due to a deadlock was found in sctp_auto_asconf_init in net/sctp/socket.c in the Linux kernel's SCTP subsystem. This flaw allows guests with local user privileges to trigger a deadlock and potentially crash the system. CVE-2024-0639 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2024-0639.html CVE-2024-0639 https://bugzilla.suse.com/1218917 SUSE Bug 1218917 In the Linux kernel, the following vulnerability has been resolved: llc: call sock_orphan() at release time syzbot reported an interesting trace [1] caused by a stale sk->sk_wq pointer in a closed llc socket. In commit ff7b11aa481f ("net: socket: set sock->sk to NULL after calling proto_ops::release()") Eric Biggers hinted that some protocols are missing a sock_orphan(), we need to perform a full audit. In net-next, I plan to clear sock->sk from sock_orphan() and amend Eric patch to add a warning. [1] BUG: KASAN: slab-use-after-free in list_empty include/linux/list.h:373 [inline] BUG: KASAN: slab-use-after-free in waitqueue_active include/linux/wait.h:127 [inline] BUG: KASAN: slab-use-after-free in sock_def_write_space_wfree net/core/sock.c:3384 [inline] BUG: KASAN: slab-use-after-free in sock_wfree+0x9a8/0x9d0 net/core/sock.c:2468 Read of size 8 at addr ffff88802f4fc880 by task ksoftirqd/1/27 CPU: 1 PID: 27 Comm: ksoftirqd/1 Not tainted 6.8.0-rc1-syzkaller-00049-g6098d87eaf31 #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:377 [inline] print_report+0xc4/0x620 mm/kasan/report.c:488 kasan_report+0xda/0x110 mm/kasan/report.c:601 list_empty include/linux/list.h:373 [inline] waitqueue_active include/linux/wait.h:127 [inline] sock_def_write_space_wfree net/core/sock.c:3384 [inline] sock_wfree+0x9a8/0x9d0 net/core/sock.c:2468 skb_release_head_state+0xa3/0x2b0 net/core/skbuff.c:1080 skb_release_all net/core/skbuff.c:1092 [inline] napi_consume_skb+0x119/0x2b0 net/core/skbuff.c:1404 e1000_unmap_and_free_tx_resource+0x144/0x200 drivers/net/ethernet/intel/e1000/e1000_main.c:1970 e1000_clean_tx_irq drivers/net/ethernet/intel/e1000/e1000_main.c:3860 [inline] e1000_clean+0x4a1/0x26e0 drivers/net/ethernet/intel/e1000/e1000_main.c:3801 __napi_poll.constprop.0+0xb4/0x540 net/core/dev.c:6576 napi_poll net/core/dev.c:6645 [inline] net_rx_action+0x956/0xe90 net/core/dev.c:6778 __do_softirq+0x21a/0x8de kernel/softirq.c:553 run_ksoftirqd kernel/softirq.c:921 [inline] run_ksoftirqd+0x31/0x60 kernel/softirq.c:913 smpboot_thread_fn+0x660/0xa10 kernel/smpboot.c:164 kthread+0x2c6/0x3a0 kernel/kthread.c:388 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242 </TASK> Allocated by task 5167: kasan_save_stack+0x33/0x50 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 unpoison_slab_object mm/kasan/common.c:314 [inline] __kasan_slab_alloc+0x81/0x90 mm/kasan/common.c:340 kasan_slab_alloc include/linux/kasan.h:201 [inline] slab_post_alloc_hook mm/slub.c:3813 [inline] slab_alloc_node mm/slub.c:3860 [inline] kmem_cache_alloc_lru+0x142/0x6f0 mm/slub.c:3879 alloc_inode_sb include/linux/fs.h:3019 [inline] sock_alloc_inode+0x25/0x1c0 net/socket.c:308 alloc_inode+0x5d/0x220 fs/inode.c:260 new_inode_pseudo+0x16/0x80 fs/inode.c:1005 sock_alloc+0x40/0x270 net/socket.c:634 __sock_create+0xbc/0x800 net/socket.c:1535 sock_create net/socket.c:1622 [inline] __sys_socket_create net/socket.c:1659 [inline] __sys_socket+0x14c/0x260 net/socket.c:1706 __do_sys_socket net/socket.c:1720 [inline] __se_sys_socket net/socket.c:1718 [inline] __x64_sys_socket+0x72/0xb0 net/socket.c:1718 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xd3/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b Freed by task 0: kasan_save_stack+0x33/0x50 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 kasan_save_free_info+0x3f/0x60 mm/kasan/generic.c:640 poison_slab_object mm/kasan/common.c:241 [inline] __kasan_slab_free+0x121/0x1b0 mm/kasan/common.c:257 kasan_slab_free include/linux/kasan.h:184 [inline] slab_free_hook mm/slub.c:2121 [inlin ---truncated--- CVE-2024-26625 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2024-26625.html CVE-2024-26625 https://bugzilla.suse.com/1221086 SUSE Bug 1221086 In the Linux kernel, the following vulnerability has been resolved: net/sched: act_mirred: don't override retval if we already lost the skb If we're redirecting the skb, and haven't called tcf_mirred_forward(), yet, we need to tell the core to drop the skb by setting the retcode to SHOT. If we have called tcf_mirred_forward(), however, the skb is out of our hands and returning SHOT will lead to UaF. Move the retval override to the error path which actually need it. CVE-2024-26739 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2024-26739.html CVE-2024-26739 https://bugzilla.suse.com/1222559 SUSE Bug 1222559 In the Linux kernel, the following vulnerability has been resolved: l2tp: pass correct message length to ip6_append_data l2tp_ip6_sendmsg needs to avoid accounting for the transport header twice when splicing more data into an already partially-occupied skbuff. To manage this, we check whether the skbuff contains data using skb_queue_empty when deciding how much data to append using ip6_append_data. However, the code which performed the calculation was incorrect: ulen = len + skb_queue_empty(&sk->sk_write_queue) ? transhdrlen : 0; ...due to C operator precedence, this ends up setting ulen to transhdrlen for messages with a non-zero length, which results in corrupted packets on the wire. Add parentheses to correct the calculation in line with the original intent. CVE-2024-26752 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2024-26752.html CVE-2024-26752 https://bugzilla.suse.com/1222667 SUSE Bug 1222667 https://bugzilla.suse.com/1223292 SUSE Bug 1223292 In the Linux kernel, the following vulnerability has been resolved: aoe: avoid potential deadlock at set_capacity Move set_capacity() outside of the section procected by (&d->lock). To avoid possible interrupt unsafe locking scenario: CPU0 CPU1 ---- ---- [1] lock(&bdev->bd_size_lock); local_irq_disable(); [2] lock(&d->lock); [3] lock(&bdev->bd_size_lock); <Interrupt> [4] lock(&d->lock); *** DEADLOCK *** Where [1](&bdev->bd_size_lock) hold by zram_add()->set_capacity(). [2]lock(&d->lock) hold by aoeblk_gdalloc(). And aoeblk_gdalloc() is trying to acquire [3](&bdev->bd_size_lock) at set_capacity() call. In this situation an attempt to acquire [4]lock(&d->lock) from aoecmd_cfg_rsp() will lead to deadlock. So the simplest solution is breaking lock dependency [2](&d->lock) -> [3](&bdev->bd_size_lock) by moving set_capacity() outside. CVE-2024-26775 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2024-26775.html CVE-2024-26775 https://bugzilla.suse.com/1222627 SUSE Bug 1222627 In the Linux kernel, the following vulnerability has been resolved: btrfs: dev-replace: properly validate device names There's a syzbot report that device name buffers passed to device replace are not properly checked for string termination which could lead to a read out of bounds in getname_kernel(). Add a helper that validates both source and target device name buffers. For devid as the source initialize the buffer to empty string in case something tries to read it later. This was originally analyzed and fixed in a different way by Edward Adam Davis (see links). CVE-2024-26791 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2024-26791.html CVE-2024-26791 https://bugzilla.suse.com/1222793 SUSE Bug 1222793 In the Linux kernel, the following vulnerability has been resolved: cifs: fix underflow in parse_server_interfaces() In this loop, we step through the buffer and after each item we check if the size_left is greater than the minimum size we need. However, the problem is that "bytes_left" is type ssize_t while sizeof() is type size_t. That means that because of type promotion, the comparison is done as an unsigned and if we have negative bytes left the loop continues instead of ending. CVE-2024-26828 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2024-26828.html CVE-2024-26828 https://bugzilla.suse.com/1223084 SUSE Bug 1223084 https://bugzilla.suse.com/1223363 SUSE Bug 1223363 In the Linux kernel, the following vulnerability has been resolved: nvme-fc: do not wait in vain when unloading module The module exit path has race between deleting all controllers and freeing 'left over IDs'. To prevent double free a synchronization between nvme_delete_ctrl and ida_destroy has been added by the initial commit. There is some logic around trying to prevent from hanging forever in wait_for_completion, though it does not handling all cases. E.g. blktests is able to reproduce the situation where the module unload hangs forever. If we completely rely on the cleanup code executed from the nvme_delete_ctrl path, all IDs will be freed eventually. This makes calling ida_destroy unnecessary. We only have to ensure that all nvme_delete_ctrl code has been executed before we leave nvme_fc_exit_module. This is done by flushing the nvme_delete_wq workqueue. While at it, remove the unused nvme_fc_wq workqueue too. CVE-2024-26846 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2024-26846.html CVE-2024-26846 https://bugzilla.suse.com/1223023 SUSE Bug 1223023 In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Fix a null pointer crash in mtk_drm_crtc_finish_page_flip It's possible that mtk_crtc->event is NULL in mtk_drm_crtc_finish_page_flip(). pending_needs_vblank value is set by mtk_crtc->event, but in mtk_drm_crtc_atomic_flush(), it's is not guarded by the same lock in mtk_drm_finish_page_flip(), thus a race condition happens. Consider the following case: CPU1 CPU2 step 1: mtk_drm_crtc_atomic_begin() mtk_crtc->event is not null, step 1: mtk_drm_crtc_atomic_flush: mtk_drm_crtc_update_config( !!mtk_crtc->event) step 2: mtk_crtc_ddp_irq -> mtk_drm_finish_page_flip: lock mtk_crtc->event set to null, pending_needs_vblank set to false unlock pending_needs_vblank set to true, step 2: mtk_crtc_ddp_irq -> mtk_drm_finish_page_flip called again, pending_needs_vblank is still true //null pointer Instead of guarding the entire mtk_drm_crtc_atomic_flush(), it's more efficient to just check if mtk_crtc->event is null before use. CVE-2024-26874 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2024-26874.html CVE-2024-26874 https://bugzilla.suse.com/1223048 SUSE Bug 1223048 In the Linux kernel, the following vulnerability has been resolved: drm/bridge: adv7511: fix crash on irq during probe Moved IRQ registration down to end of adv7511_probe(). If an IRQ already is pending during adv7511_probe (before adv7511_cec_init) then cec_received_msg_ts could crash using uninitialized data: Unable to handle kernel read from unreadable memory at virtual address 00000000000003d5 Internal error: Oops: 96000004 [#1] PREEMPT_RT SMP Call trace: cec_received_msg_ts+0x48/0x990 [cec] adv7511_cec_irq_process+0x1cc/0x308 [adv7511] adv7511_irq_process+0xd8/0x120 [adv7511] adv7511_irq_handler+0x1c/0x30 [adv7511] irq_thread_fn+0x30/0xa0 irq_thread+0x14c/0x238 kthread+0x190/0x1a8 CVE-2024-26876 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2024-26876.html CVE-2024-26876 https://bugzilla.suse.com/1223119 SUSE Bug 1223119 In the Linux kernel, the following vulnerability has been resolved: md: fix kmemleak of rdev->serial If kobject_add() is fail in bind_rdev_to_array(), 'rdev->serial' will be alloc not be freed, and kmemleak occurs. unreferenced object 0xffff88815a350000 (size 49152): comm "mdadm", pid 789, jiffies 4294716910 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc f773277a): [<0000000058b0a453>] kmemleak_alloc+0x61/0xe0 [<00000000366adf14>] __kmalloc_large_node+0x15e/0x270 [<000000002e82961b>] __kmalloc_node.cold+0x11/0x7f [<00000000f206d60a>] kvmalloc_node+0x74/0x150 [<0000000034bf3363>] rdev_init_serial+0x67/0x170 [<0000000010e08fe9>] mddev_create_serial_pool+0x62/0x220 [<00000000c3837bf0>] bind_rdev_to_array+0x2af/0x630 [<0000000073c28560>] md_add_new_disk+0x400/0x9f0 [<00000000770e30ff>] md_ioctl+0x15bf/0x1c10 [<000000006cfab718>] blkdev_ioctl+0x191/0x3f0 [<0000000085086a11>] vfs_ioctl+0x22/0x60 [<0000000018b656fe>] __x64_sys_ioctl+0xba/0xe0 [<00000000e54e675e>] do_syscall_64+0x71/0x150 [<000000008b0ad622>] entry_SYSCALL_64_after_hwframe+0x6c/0x74 CVE-2024-26900 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2024-26900.html CVE-2024-26900 https://bugzilla.suse.com/1223046 SUSE Bug 1223046 In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Reset IH OVERFLOW_CLEAR bit Allows us to detect subsequent IH ring buffer overflows as well. CVE-2024-26915 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2024-26915.html CVE-2024-26915 https://bugzilla.suse.com/1223207 SUSE Bug 1223207 In the Linux kernel, the following vulnerability has been resolved: tracing/trigger: Fix to return error if failed to alloc snapshot Fix register_snapshot_trigger() to return error code if it failed to allocate a snapshot instead of 0 (success). Unless that, it will register snapshot trigger without an error. CVE-2024-26920 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2024-26920.html CVE-2024-26920 https://bugzilla.suse.com/1228237 SUSE Bug 1228237 In the Linux kernel, the following vulnerability has been resolved: inet: inet_defrag: prevent sk release while still in use ip_local_out() and other functions can pass skb->sk as function argument. If the skb is a fragment and reassembly happens before such function call returns, the sk must not be released. This affects skb fragments reassembled via netfilter or similar modules, e.g. openvswitch or ct_act.c, when run as part of tx pipeline. Eric Dumazet made an initial analysis of this bug. Quoting Eric: Calling ip_defrag() in output path is also implying skb_orphan(), which is buggy because output path relies on sk not disappearing. A relevant old patch about the issue was : 8282f27449bf ("inet: frag: Always orphan skbs inside ip_defrag()") [..] net/ipv4/ip_output.c depends on skb->sk being set, and probably to an inet socket, not an arbitrary one. If we orphan the packet in ipvlan, then downstream things like FQ packet scheduler will not work properly. We need to change ip_defrag() to only use skb_orphan() when really needed, ie whenever frag_list is going to be used. Eric suggested to stash sk in fragment queue and made an initial patch. However there is a problem with this: If skb is refragmented again right after, ip_do_fragment() will copy head->sk to the new fragments, and sets up destructor to sock_wfree. IOW, we have no choice but to fix up sk_wmem accouting to reflect the fully reassembled skb, else wmem will underflow. This change moves the orphan down into the core, to last possible moment. As ip_defrag_offset is aliased with sk_buff->sk member, we must move the offset into the FRAG_CB, else skb->sk gets clobbered. This allows to delay the orphaning long enough to learn if the skb has to be queued or if the skb is completing the reasm queue. In the former case, things work as before, skb is orphaned. This is safe because skb gets queued/stolen and won't continue past reasm engine. In the latter case, we will steal the skb->sk reference, reattach it to the head skb, and fix up wmem accouting when inet_frag inflates truesize. CVE-2024-26921 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2024-26921.html CVE-2024-26921 https://bugzilla.suse.com/1223138 SUSE Bug 1223138 https://bugzilla.suse.com/1223139 SUSE Bug 1223139 ** REJECT ** This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. CVE-2024-26929 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2024-26929.html CVE-2024-26929 https://bugzilla.suse.com/1223715 SUSE Bug 1223715 https://bugzilla.suse.com/1223716 SUSE Bug 1223716 In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix double free of the ha->vp_map pointer Coverity scan reported potential risk of double free of the pointer ha->vp_map. ha->vp_map was freed in qla2x00_mem_alloc(), and again freed in function qla2x00_mem_free(ha). Assign NULL to vp_map and kfree take care of NULL. CVE-2024-26930 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2024-26930.html CVE-2024-26930 https://bugzilla.suse.com/1223626 SUSE Bug 1223626 https://bugzilla.suse.com/1223681 SUSE Bug 1223681 In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix command flush on cable pull System crash due to command failed to flush back to SCSI layer. BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 PGD 0 P4D 0 Oops: 0000 [#1] SMP NOPTI CPU: 27 PID: 793455 Comm: kworker/u130:6 Kdump: loaded Tainted: G OE --------- - - 4.18.0-372.9.1.el8.x86_64 #1 Hardware name: HPE ProLiant DL360 Gen10/ProLiant DL360 Gen10, BIOS U32 09/03/2021 Workqueue: nvme-wq nvme_fc_connect_ctrl_work [nvme_fc] RIP: 0010:__wake_up_common+0x4c/0x190 Code: 24 10 4d 85 c9 74 0a 41 f6 01 04 0f 85 9d 00 00 00 48 8b 43 08 48 83 c3 08 4c 8d 48 e8 49 8d 41 18 48 39 c3 0f 84 f0 00 00 00 <49> 8b 41 18 89 54 24 08 31 ed 4c 8d 70 e8 45 8b 29 41 f6 c5 04 75 RSP: 0018:ffff95f3e0cb7cd0 EFLAGS: 00010086 RAX: 0000000000000000 RBX: ffff8b08d3b26328 RCX: 0000000000000000 RDX: 0000000000000001 RSI: 0000000000000003 RDI: ffff8b08d3b26320 RBP: 0000000000000001 R08: 0000000000000000 R09: ffffffffffffffe8 R10: 0000000000000000 R11: ffff95f3e0cb7a60 R12: ffff95f3e0cb7d20 R13: 0000000000000003 R14: 0000000000000000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8b2fdf6c0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 0000002f1e410002 CR4: 00000000007706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: __wake_up_common_lock+0x7c/0xc0 qla_nvme_ls_req+0x355/0x4c0 [qla2xxx] qla2xxx [0000:12:00.1]-f084:3: qlt_free_session_done: se_sess 0000000000000000 / sess ffff8ae1407ca000 from port 21:32:00:02:ac:07:ee:b8 loop_id 0x02 s_id 01:02:00 logout 1 keep 0 els_logo 0 ? __nvme_fc_send_ls_req+0x260/0x380 [nvme_fc] qla2xxx [0000:12:00.1]-207d:3: FCPort 21:32:00:02:ac:07:ee:b8 state transitioned from ONLINE to LOST - portid=010200. ? nvme_fc_send_ls_req.constprop.42+0x1a/0x45 [nvme_fc] qla2xxx [0000:12:00.1]-2109:3: qla2x00_schedule_rport_del 21320002ac07eeb8. rport ffff8ae598122000 roles 1 ? nvme_fc_connect_ctrl_work.cold.63+0x1e3/0xa7d [nvme_fc] qla2xxx [0000:12:00.1]-f084:3: qlt_free_session_done: se_sess 0000000000000000 / sess ffff8ae14801e000 from port 21:32:01:02:ad:f7:ee:b8 loop_id 0x04 s_id 01:02:01 logout 1 keep 0 els_logo 0 ? __switch_to+0x10c/0x450 ? process_one_work+0x1a7/0x360 qla2xxx [0000:12:00.1]-207d:3: FCPort 21:32:01:02:ad:f7:ee:b8 state transitioned from ONLINE to LOST - portid=010201. ? worker_thread+0x1ce/0x390 ? create_worker+0x1a0/0x1a0 qla2xxx [0000:12:00.1]-2109:3: qla2x00_schedule_rport_del 21320102adf7eeb8. rport ffff8ae3b2312800 roles 70 ? kthread+0x10a/0x120 qla2xxx [0000:12:00.1]-2112:3: qla_nvme_unregister_remote_port: unregister remoteport on ffff8ae14801e000 21320102adf7eeb8 ? set_kthread_struct+0x40/0x40 qla2xxx [0000:12:00.1]-2110:3: remoteport_delete of ffff8ae14801e000 21320102adf7eeb8 completed. ? ret_from_fork+0x1f/0x40 qla2xxx [0000:12:00.1]-f086:3: qlt_free_session_done: waiting for sess ffff8ae14801e000 logout The system was under memory stress where driver was not able to allocate an SRB to carry out error recovery of cable pull. The failure to flush causes upper layer to start modifying scsi_cmnd. When the system frees up some memory, the subsequent cable pull trigger another command flush. At this point the driver access a null pointer when attempting to DMA unmap the SGL. Add a check to make sure commands are flush back on session tear down to prevent the null pointer access. CVE-2024-26931 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2024-26931.html CVE-2024-26931 https://bugzilla.suse.com/1223627 SUSE Bug 1223627 In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix deadlock in usb_deauthorize_interface() Among the attribute file callback routines in drivers/usb/core/sysfs.c, the interface_authorized_store() function is the only one which acquires a device lock on an ancestor device: It calls usb_deauthorize_interface(), which locks the interface's parent USB device. The will lead to deadlock if another process already owns that lock and tries to remove the interface, whether through a configuration change or because the device has been disconnected. As part of the removal procedure, device_del() waits for all ongoing sysfs attribute callbacks to complete. But usb_deauthorize_interface() can't complete until the device lock has been released, and the lock won't be released until the removal has finished. The mechanism provided by sysfs to prevent this kind of deadlock is to use the sysfs_break_active_protection() function, which tells sysfs not to wait for the attribute callback. Reported-and-tested by: Yue Sun <samsun1006219@gmail.com> Reported by: xingwei lee <xrivendell7@gmail.com> CVE-2024-26934 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2024-26934.html CVE-2024-26934 https://bugzilla.suse.com/1223671 SUSE Bug 1223671 In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: fix reference counting on zcrypt card objects Tests with hot-plugging crytpo cards on KVM guests with debug kernel build revealed an use after free for the load field of the struct zcrypt_card. The reason was an incorrect reference handling of the zcrypt card object which could lead to a free of the zcrypt card object while it was still in use. This is an example of the slab message: kernel: 0x00000000885a7512-0x00000000885a7513 @offset=1298. First byte 0x68 instead of 0x6b kernel: Allocated in zcrypt_card_alloc+0x36/0x70 [zcrypt] age=18046 cpu=3 pid=43 kernel: kmalloc_trace+0x3f2/0x470 kernel: zcrypt_card_alloc+0x36/0x70 [zcrypt] kernel: zcrypt_cex4_card_probe+0x26/0x380 [zcrypt_cex4] kernel: ap_device_probe+0x15c/0x290 kernel: really_probe+0xd2/0x468 kernel: driver_probe_device+0x40/0xf0 kernel: __device_attach_driver+0xc0/0x140 kernel: bus_for_each_drv+0x8c/0xd0 kernel: __device_attach+0x114/0x198 kernel: bus_probe_device+0xb4/0xc8 kernel: device_add+0x4d2/0x6e0 kernel: ap_scan_adapter+0x3d0/0x7c0 kernel: ap_scan_bus+0x5a/0x3b0 kernel: ap_scan_bus_wq_callback+0x40/0x60 kernel: process_one_work+0x26e/0x620 kernel: worker_thread+0x21c/0x440 kernel: Freed in zcrypt_card_put+0x54/0x80 [zcrypt] age=9024 cpu=3 pid=43 kernel: kfree+0x37e/0x418 kernel: zcrypt_card_put+0x54/0x80 [zcrypt] kernel: ap_device_remove+0x4c/0xe0 kernel: device_release_driver_internal+0x1c4/0x270 kernel: bus_remove_device+0x100/0x188 kernel: device_del+0x164/0x3c0 kernel: device_unregister+0x30/0x90 kernel: ap_scan_adapter+0xc8/0x7c0 kernel: ap_scan_bus+0x5a/0x3b0 kernel: ap_scan_bus_wq_callback+0x40/0x60 kernel: process_one_work+0x26e/0x620 kernel: worker_thread+0x21c/0x440 kernel: kthread+0x150/0x168 kernel: __ret_from_fork+0x3c/0x58 kernel: ret_from_fork+0xa/0x30 kernel: Slab 0x00000372022169c0 objects=20 used=18 fp=0x00000000885a7c88 flags=0x3ffff00000000a00(workingset|slab|node=0|zone=1|lastcpupid=0x1ffff) kernel: Object 0x00000000885a74b8 @offset=1208 fp=0x00000000885a7c88 kernel: Redzone 00000000885a74b0: bb bb bb bb bb bb bb bb ........ kernel: Object 00000000885a74b8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk kernel: Object 00000000885a74c8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk kernel: Object 00000000885a74d8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk kernel: Object 00000000885a74e8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk kernel: Object 00000000885a74f8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk kernel: Object 00000000885a7508: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 68 4b 6b 6b 6b a5 kkkkkkkkkkhKkkk. kernel: Redzone 00000000885a7518: bb bb bb bb bb bb bb bb ........ kernel: Padding 00000000885a756c: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZZZZZ kernel: CPU: 0 PID: 387 Comm: systemd-udevd Not tainted 6.8.0-HF #2 kernel: Hardware name: IBM 3931 A01 704 (KVM/Linux) kernel: Call Trace: kernel: [<00000000ca5ab5b8>] dump_stack_lvl+0x90/0x120 kernel: [<00000000c99d78bc>] check_bytes_and_report+0x114/0x140 kernel: [<00000000c99d53cc>] check_object+0x334/0x3f8 kernel: [<00000000c99d820c>] alloc_debug_processing+0xc4/0x1f8 kernel: [<00000000c99d852e>] get_partial_node.part.0+0x1ee/0x3e0 kernel: [<00000000c99d94ec>] ___slab_alloc+0xaf4/0x13c8 kernel: [<00000000c99d9e38>] __slab_alloc.constprop.0+0x78/0xb8 kernel: [<00000000c99dc8dc>] __kmalloc+0x434/0x590 kernel: [<00000000c9b4c0ce>] ext4_htree_store_dirent+0x4e/0x1c0 kernel: [<00000000c9b908a2>] htree_dirblock_to_tree+0x17a/0x3f0 kernel: ---truncated--- CVE-2024-26957 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2024-26957.html CVE-2024-26957 https://bugzilla.suse.com/1223666 SUSE Bug 1223666 In the Linux kernel, the following vulnerability has been resolved: nfs: fix UAF in direct writes In production we have been hitting the following warning consistently ------------[ cut here ]------------ refcount_t: underflow; use-after-free. WARNING: CPU: 17 PID: 1800359 at lib/refcount.c:28 refcount_warn_saturate+0x9c/0xe0 Workqueue: nfsiod nfs_direct_write_schedule_work [nfs] RIP: 0010:refcount_warn_saturate+0x9c/0xe0 PKRU: 55555554 Call Trace: <TASK> ? __warn+0x9f/0x130 ? refcount_warn_saturate+0x9c/0xe0 ? report_bug+0xcc/0x150 ? handle_bug+0x3d/0x70 ? exc_invalid_op+0x16/0x40 ? asm_exc_invalid_op+0x16/0x20 ? refcount_warn_saturate+0x9c/0xe0 nfs_direct_write_schedule_work+0x237/0x250 [nfs] process_one_work+0x12f/0x4a0 worker_thread+0x14e/0x3b0 ? ZSTD_getCParams_internal+0x220/0x220 kthread+0xdc/0x120 ? __btf_name_valid+0xa0/0xa0 ret_from_fork+0x1f/0x30 This is because we're completing the nfs_direct_request twice in a row. The source of this is when we have our commit requests to submit, we process them and send them off, and then in the completion path for the commit requests we have if (nfs_commit_end(cinfo.mds)) nfs_direct_write_complete(dreq); However since we're submitting asynchronous requests we sometimes have one that completes before we submit the next one, so we end up calling complete on the nfs_direct_request twice. The only other place we use nfs_generic_commit_list() is in __nfs_commit_inode, which wraps this call in a nfs_commit_begin(); nfs_commit_end(); Which is a common pattern for this style of completion handling, one that is also repeated in the direct code with get_dreq()/put_dreq() calls around where we process events as well as in the completion paths. Fix this by using the same pattern for the commit requests. Before with my 200 node rocksdb stress running this warning would pop every 10ish minutes. With my patch the stress test has been running for several hours without popping. CVE-2024-26958 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2024-26958.html CVE-2024-26958 https://bugzilla.suse.com/1223653 SUSE Bug 1223653 In the Linux kernel, the following vulnerability has been resolved: nouveau: fix instmem race condition around ptr stores Running a lot of VK CTS in parallel against nouveau, once every few hours you might see something like this crash. BUG: kernel NULL pointer dereference, address: 0000000000000008 PGD 8000000114e6e067 P4D 8000000114e6e067 PUD 109046067 PMD 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 7 PID: 53891 Comm: deqp-vk Not tainted 6.8.0-rc6+ #27 Hardware name: Gigabyte Technology Co., Ltd. Z390 I AORUS PRO WIFI/Z390 I AORUS PRO WIFI-CF, BIOS F8 11/05/2021 RIP: 0010:gp100_vmm_pgt_mem+0xe3/0x180 [nouveau] Code: c7 48 01 c8 49 89 45 58 85 d2 0f 84 95 00 00 00 41 0f b7 46 12 49 8b 7e 08 89 da 42 8d 2c f8 48 8b 47 08 41 83 c7 01 48 89 ee <48> 8b 40 08 ff d0 0f 1f 00 49 8b 7e 08 48 89 d9 48 8d 75 04 48 c1 RSP: 0000:ffffac20c5857838 EFLAGS: 00010202 RAX: 0000000000000000 RBX: 00000000004d8001 RCX: 0000000000000001 RDX: 00000000004d8001 RSI: 00000000000006d8 RDI: ffffa07afe332180 RBP: 00000000000006d8 R08: ffffac20c5857ad0 R09: 0000000000ffff10 R10: 0000000000000001 R11: ffffa07af27e2de0 R12: 000000000000001c R13: ffffac20c5857ad0 R14: ffffa07a96fe9040 R15: 000000000000001c FS: 00007fe395eed7c0(0000) GS:ffffa07e2c980000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000008 CR3: 000000011febe001 CR4: 00000000003706f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: ... ? gp100_vmm_pgt_mem+0xe3/0x180 [nouveau] ? gp100_vmm_pgt_mem+0x37/0x180 [nouveau] nvkm_vmm_iter+0x351/0xa20 [nouveau] ? __pfx_nvkm_vmm_ref_ptes+0x10/0x10 [nouveau] ? __pfx_gp100_vmm_pgt_mem+0x10/0x10 [nouveau] ? __pfx_gp100_vmm_pgt_mem+0x10/0x10 [nouveau] ? __lock_acquire+0x3ed/0x2170 ? __pfx_gp100_vmm_pgt_mem+0x10/0x10 [nouveau] nvkm_vmm_ptes_get_map+0xc2/0x100 [nouveau] ? __pfx_nvkm_vmm_ref_ptes+0x10/0x10 [nouveau] ? __pfx_gp100_vmm_pgt_mem+0x10/0x10 [nouveau] nvkm_vmm_map_locked+0x224/0x3a0 [nouveau] Adding any sort of useful debug usually makes it go away, so I hand wrote the function in a line, and debugged the asm. Every so often pt->memory->ptrs is NULL. This ptrs ptr is set in the nv50_instobj_acquire called from nvkm_kmap. If Thread A and Thread B both get to nv50_instobj_acquire around the same time, and Thread A hits the refcount_set line, and in lockstep thread B succeeds at refcount_inc_not_zero, there is a chance the ptrs value won't have been stored since refcount_set is unordered. Force a memory barrier here, I picked smp_mb, since we want it on all CPUs and it's write followed by a read. v2: use paired smp_rmb/smp_wmb. CVE-2024-26984 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2024-26984.html CVE-2024-26984 https://bugzilla.suse.com/1223633 SUSE Bug 1223633 In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_ncm: Fix UAF ncm object at re-bind after usb ep transport error When ncm function is working and then stop usb0 interface for link down, eth_stop() is called. At this piont, accidentally if usb transport error should happen in usb_ep_enable(), 'in_ep' and/or 'out_ep' may not be enabled. After that, ncm_disable() is called to disable for ncm unbind but gether_disconnect() is never called since 'in_ep' is not enabled. As the result, ncm object is released in ncm unbind but 'dev->port_usb' associated to 'ncm->port' is not NULL. And when ncm bind again to recover netdev, ncm object is reallocated but usb0 interface is already associated to previous released ncm object. Therefore, once usb0 interface is up and eth_start_xmit() is called, released ncm object is dereferrenced and it might cause use-after-free memory. [function unlink via configfs] usb0: eth_stop dev->port_usb=ffffff9b179c3200 --> error happens in usb_ep_enable(). NCM: ncm_disable: ncm=ffffff9b179c3200 --> no gether_disconnect() since ncm->port.in_ep->enabled is false. NCM: ncm_unbind: ncm unbind ncm=ffffff9b179c3200 NCM: ncm_free: ncm free ncm=ffffff9b179c3200 <-- released ncm [function link via configfs] NCM: ncm_alloc: ncm alloc ncm=ffffff9ac4f8a000 NCM: ncm_bind: ncm bind ncm=ffffff9ac4f8a000 NCM: ncm_set_alt: ncm=ffffff9ac4f8a000 alt=0 usb0: eth_open dev->port_usb=ffffff9b179c3200 <-- previous released ncm usb0: eth_start dev->port_usb=ffffff9b179c3200 <-- eth_start_xmit() --> dev->wrap() Unable to handle kernel paging request at virtual address dead00000000014f This patch addresses the issue by checking if 'ncm->netdev' is not NULL at ncm_disable() to call gether_disconnect() to deassociate 'dev->port_usb'. It's more reasonable to check 'ncm->netdev' to call gether_connect/disconnect rather than check 'ncm->port.in_ep->enabled' since it might not be enabled but the gether connection might be established. CVE-2024-26996 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2024-26996.html CVE-2024-26996 https://bugzilla.suse.com/1223752 SUSE Bug 1223752 In the Linux kernel, the following vulnerability has been resolved: drm: nv04: Fix out of bounds access When Output Resource (dcb->or) value is assigned in fabricate_dcb_output(), there may be out of bounds access to dac_users array in case dcb->or is zero because ffs(dcb->or) is used as index there. The 'or' argument of fabricate_dcb_output() must be interpreted as a number of bit to set, not value. Utilize macros from 'enum nouveau_or' in calls instead of hardcoding. Found by Linux Verification Center (linuxtesting.org) with SVACE. CVE-2024-27008 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2024-27008.html CVE-2024-27008 https://bugzilla.suse.com/1223802 SUSE Bug 1223802 In the Linux kernel, the following vulnerability has been resolved: s390/dasd: fix double module refcount decrement Once the discipline is associated with the device, deleting the device takes care of decrementing the module's refcount. Doing it manually on this error path causes refcount to artificially decrease on each error while it should just stay the same. CVE-2024-27054 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2024-27054.html CVE-2024-27054 https://bugzilla.suse.com/1223819 SUSE Bug 1223819 In the Linux kernel, the following vulnerability has been resolved: USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command The isd200 sub-driver in usb-storage uses the HEADS and SECTORS values in the ATA ID information to calculate cylinder and head values when creating a CDB for READ or WRITE commands. The calculation involves division and modulus operations, which will cause a crash if either of these values is 0. While this never happens with a genuine device, it could happen with a flawed or subversive emulation, as reported by the syzbot fuzzer. Protect against this possibility by refusing to bind to the device if either the ATA_ID_HEADS or ATA_ID_SECTORS value in the device's ID information is 0. This requires isd200_Initialization() to return a negative error code when initialization fails; currently it always returns 0 (even when there is an error). CVE-2024-27059 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2024-27059.html CVE-2024-27059 https://bugzilla.suse.com/1223738 SUSE Bug 1223738 In the Linux kernel, the following vulnerability has been resolved: nouveau: lock the client object tree. It appears the client object tree has no locking unless I've missed something else. Fix races around adding/removing client objects, mostly vram bar mappings. 4562.099306] general protection fault, probably for non-canonical address 0x6677ed422bceb80c: 0000 [#1] PREEMPT SMP PTI [ 4562.099314] CPU: 2 PID: 23171 Comm: deqp-vk Not tainted 6.8.0-rc6+ #27 [ 4562.099324] Hardware name: Gigabyte Technology Co., Ltd. Z390 I AORUS PRO WIFI/Z390 I AORUS PRO WIFI-CF, BIOS F8 11/05/2021 [ 4562.099330] RIP: 0010:nvkm_object_search+0x1d/0x70 [nouveau] [ 4562.099503] Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 0f 1f 44 00 00 48 89 f8 48 85 f6 74 39 48 8b 87 a0 00 00 00 48 85 c0 74 12 <48> 8b 48 f8 48 39 ce 73 15 48 8b 40 10 48 85 c0 75 ee 48 c7 c0 fe [ 4562.099506] RSP: 0000:ffffa94cc420bbf8 EFLAGS: 00010206 [ 4562.099512] RAX: 6677ed422bceb814 RBX: ffff98108791f400 RCX: ffff9810f26b8f58 [ 4562.099517] RDX: 0000000000000000 RSI: ffff9810f26b9158 RDI: ffff98108791f400 [ 4562.099519] RBP: ffff9810f26b9158 R08: 0000000000000000 R09: 0000000000000000 [ 4562.099521] R10: ffffa94cc420bc48 R11: 0000000000000001 R12: ffff9810f02a7cc0 [ 4562.099526] R13: 0000000000000000 R14: 00000000000000ff R15: 0000000000000007 [ 4562.099528] FS: 00007f629c5017c0(0000) GS:ffff98142c700000(0000) knlGS:0000000000000000 [ 4562.099534] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 4562.099536] CR2: 00007f629a882000 CR3: 000000017019e004 CR4: 00000000003706f0 [ 4562.099541] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 4562.099542] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 4562.099544] Call Trace: [ 4562.099555] <TASK> [ 4562.099573] ? die_addr+0x36/0x90 [ 4562.099583] ? exc_general_protection+0x246/0x4a0 [ 4562.099593] ? asm_exc_general_protection+0x26/0x30 [ 4562.099600] ? nvkm_object_search+0x1d/0x70 [nouveau] [ 4562.099730] nvkm_ioctl+0xa1/0x250 [nouveau] [ 4562.099861] nvif_object_map_handle+0xc8/0x180 [nouveau] [ 4562.099986] nouveau_ttm_io_mem_reserve+0x122/0x270 [nouveau] [ 4562.100156] ? dma_resv_test_signaled+0x26/0xb0 [ 4562.100163] ttm_bo_vm_fault_reserved+0x97/0x3c0 [ttm] [ 4562.100182] ? __mutex_unlock_slowpath+0x2a/0x270 [ 4562.100189] nouveau_ttm_fault+0x69/0xb0 [nouveau] [ 4562.100356] __do_fault+0x32/0x150 [ 4562.100362] do_fault+0x7c/0x560 [ 4562.100369] __handle_mm_fault+0x800/0xc10 [ 4562.100382] handle_mm_fault+0x17c/0x3e0 [ 4562.100388] do_user_addr_fault+0x208/0x860 [ 4562.100395] exc_page_fault+0x7f/0x200 [ 4562.100402] asm_exc_page_fault+0x26/0x30 [ 4562.100412] RIP: 0033:0x9b9870 [ 4562.100419] Code: 85 a8 f7 ff ff 8b 8d 80 f7 ff ff 89 08 e9 18 f2 ff ff 0f 1f 84 00 00 00 00 00 44 89 32 e9 90 fa ff ff 0f 1f 84 00 00 00 00 00 <44> 89 32 e9 f8 f1 ff ff 0f 1f 84 00 00 00 00 00 66 44 89 32 e9 e7 [ 4562.100422] RSP: 002b:00007fff9ba2dc70 EFLAGS: 00010246 [ 4562.100426] RAX: 0000000000000004 RBX: 000000000dd65e10 RCX: 000000fff0000000 [ 4562.100428] RDX: 00007f629a882000 RSI: 00007f629a882000 RDI: 0000000000000066 [ 4562.100432] RBP: 00007fff9ba2e570 R08: 0000000000000000 R09: 0000000123ddf000 [ 4562.100434] R10: 0000000000000001 R11: 0000000000000246 R12: 000000007fffffff [ 4562.100436] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 4562.100446] </TASK> [ 4562.100448] Modules linked in: nf_conntrack_netbios_ns nf_conntrack_broadcast nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables libcrc32c nfnetlink cmac bnep sunrpc iwlmvm intel_rapl_msr intel_rapl_common snd_sof_pci_intel_cnl x86_pkg_temp_thermal intel_powerclamp snd_sof_intel_hda_common mac80211 coretemp snd_soc_acpi_intel_match kvm_intel snd_soc_acpi snd_soc_hdac_hda snd_sof_pci snd_sof_xtensa_dsp snd_sof_intel_hda_mlink ---truncated--- CVE-2024-27062 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2024-27062.html CVE-2024-27062 https://bugzilla.suse.com/1223834 SUSE Bug 1223834 In the Linux kernel, the following vulnerability has been resolved: SUNRPC: fix some memleaks in gssx_dec_option_array The creds and oa->data need to be freed in the error-handling paths after their allocation. So this patch add these deallocations in the corresponding paths. CVE-2024-27388 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2024-27388.html CVE-2024-27388 https://bugzilla.suse.com/1223744 SUSE Bug 1223744 In the Linux kernel, the following vulnerability has been resolved: net: gtp: Fix Use-After-Free in gtp_dellink Since call_rcu, which is called in the hlist_for_each_entry_rcu traversal of gtp_dellink, is not part of the RCU read critical section, it is possible that the RCU grace period will pass during the traversal and the key will be free. To prevent this, it should be changed to hlist_for_each_entry_safe. CVE-2024-27396 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2024-27396.html CVE-2024-27396 https://bugzilla.suse.com/1224096 SUSE Bug 1224096 In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout When the sco connection is established and then, the sco socket is releasing, timeout_work will be scheduled to judge whether the sco disconnection is timeout. The sock will be deallocated later, but it is dereferenced again in sco_sock_timeout. As a result, the use-after-free bugs will happen. The root cause is shown below: Cleanup Thread | Worker Thread sco_sock_release | sco_sock_close | __sco_sock_close | sco_sock_set_timer | schedule_delayed_work | sco_sock_kill | (wait a time) sock_put(sk) //FREE | sco_sock_timeout | sock_hold(sk) //USE The KASAN report triggered by POC is shown below: [ 95.890016] ================================================================== [ 95.890496] BUG: KASAN: slab-use-after-free in sco_sock_timeout+0x5e/0x1c0 [ 95.890755] Write of size 4 at addr ffff88800c388080 by task kworker/0:0/7 ... [ 95.890755] Workqueue: events sco_sock_timeout [ 95.890755] Call Trace: [ 95.890755] <TASK> [ 95.890755] dump_stack_lvl+0x45/0x110 [ 95.890755] print_address_description+0x78/0x390 [ 95.890755] print_report+0x11b/0x250 [ 95.890755] ? __virt_addr_valid+0xbe/0xf0 [ 95.890755] ? sco_sock_timeout+0x5e/0x1c0 [ 95.890755] kasan_report+0x139/0x170 [ 95.890755] ? update_load_avg+0xe5/0x9f0 [ 95.890755] ? sco_sock_timeout+0x5e/0x1c0 [ 95.890755] kasan_check_range+0x2c3/0x2e0 [ 95.890755] sco_sock_timeout+0x5e/0x1c0 [ 95.890755] process_one_work+0x561/0xc50 [ 95.890755] worker_thread+0xab2/0x13c0 [ 95.890755] ? pr_cont_work+0x490/0x490 [ 95.890755] kthread+0x279/0x300 [ 95.890755] ? pr_cont_work+0x490/0x490 [ 95.890755] ? kthread_blkcg+0xa0/0xa0 [ 95.890755] ret_from_fork+0x34/0x60 [ 95.890755] ? kthread_blkcg+0xa0/0xa0 [ 95.890755] ret_from_fork_asm+0x11/0x20 [ 95.890755] </TASK> [ 95.890755] [ 95.890755] Allocated by task 506: [ 95.890755] kasan_save_track+0x3f/0x70 [ 95.890755] __kasan_kmalloc+0x86/0x90 [ 95.890755] __kmalloc+0x17f/0x360 [ 95.890755] sk_prot_alloc+0xe1/0x1a0 [ 95.890755] sk_alloc+0x31/0x4e0 [ 95.890755] bt_sock_alloc+0x2b/0x2a0 [ 95.890755] sco_sock_create+0xad/0x320 [ 95.890755] bt_sock_create+0x145/0x320 [ 95.890755] __sock_create+0x2e1/0x650 [ 95.890755] __sys_socket+0xd0/0x280 [ 95.890755] __x64_sys_socket+0x75/0x80 [ 95.890755] do_syscall_64+0xc4/0x1b0 [ 95.890755] entry_SYSCALL_64_after_hwframe+0x67/0x6f [ 95.890755] [ 95.890755] Freed by task 506: [ 95.890755] kasan_save_track+0x3f/0x70 [ 95.890755] kasan_save_free_info+0x40/0x50 [ 95.890755] poison_slab_object+0x118/0x180 [ 95.890755] __kasan_slab_free+0x12/0x30 [ 95.890755] kfree+0xb2/0x240 [ 95.890755] __sk_destruct+0x317/0x410 [ 95.890755] sco_sock_release+0x232/0x280 [ 95.890755] sock_close+0xb2/0x210 [ 95.890755] __fput+0x37f/0x770 [ 95.890755] task_work_run+0x1ae/0x210 [ 95.890755] get_signal+0xe17/0xf70 [ 95.890755] arch_do_signal_or_restart+0x3f/0x520 [ 95.890755] syscall_exit_to_user_mode+0x55/0x120 [ 95.890755] do_syscall_64+0xd1/0x1b0 [ 95.890755] entry_SYSCALL_64_after_hwframe+0x67/0x6f [ 95.890755] [ 95.890755] The buggy address belongs to the object at ffff88800c388000 [ 95.890755] which belongs to the cache kmalloc-1k of size 1024 [ 95.890755] The buggy address is located 128 bytes inside of [ 95.890755] freed 1024-byte region [ffff88800c388000, ffff88800c388400) [ 95.890755] [ 95.890755] The buggy address belongs to the physical page: [ 95.890755] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800c38a800 pfn:0xc388 [ 95.890755] head: order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 95.890755] ano ---truncated--- CVE-2024-27398 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2024-27398.html CVE-2024-27398 https://bugzilla.suse.com/1224174 SUSE Bug 1224174 https://bugzilla.suse.com/1225013 SUSE Bug 1225013 In the Linux kernel, the following vulnerability has been resolved: firewire: nosy: ensure user_length is taken into account when fetching packet contents Ensure that packet_buffer_get respects the user_length provided. If the length of the head packet exceeds the user_length, packet_buffer_get will now return 0 to signify to the user that no data were read and a larger buffer size is required. Helps prevent user space overflows. CVE-2024-27401 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2024-27401.html CVE-2024-27401 https://bugzilla.suse.com/1224181 SUSE Bug 1224181 In the Linux kernel, the following vulnerability has been resolved: netrom: Fix data-races around sysctl_net_busy_read We need to protect the reader reading the sysctl value because the value can be changed concurrently. CVE-2024-27419 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2024-27419.html CVE-2024-27419 https://bugzilla.suse.com/1224759 SUSE Bug 1224759 In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Stop parsing channels bits when all channels are found. If a usb audio device sets more bits than the amount of channels it could write outside of the map array. CVE-2024-27436 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2024-27436.html CVE-2024-27436 https://bugzilla.suse.com/1224803 SUSE Bug 1224803 In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes When moving a station out of a VLAN and deleting the VLAN afterwards, the fast_rx entry still holds a pointer to the VLAN's netdev, which can cause use-after-free bugs. Fix this by immediately calling ieee80211_check_fast_rx after the VLAN change. CVE-2024-35789 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2024-35789.html CVE-2024-35789 https://bugzilla.suse.com/1224749 SUSE Bug 1224749 https://bugzilla.suse.com/1227320 SUSE Bug 1227320 In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region() Do the cache flush of converted pages in svm_register_enc_region() before dropping kvm->lock to fix use-after-free issues where region and/or its array of pages could be freed by a different task, e.g. if userspace has __unregister_enc_region_locked() already queued up for the region. Note, the "obvious" alternative of using local variables doesn't fully resolve the bug, as region->pages is also dynamically allocated. I.e. the region structure itself would be fine, but region->pages could be freed. Flushing multiple pages under kvm->lock is unfortunate, but the entire flow is a rare slow path, and the manual flush is only needed on CPUs that lack coherency for encrypted memory. CVE-2024-35791 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2024-35791.html CVE-2024-35791 https://bugzilla.suse.com/1224725 SUSE Bug 1224725 In the Linux kernel, the following vulnerability has been resolved: PCI/PM: Drain runtime-idle callbacks before driver removal A race condition between the .runtime_idle() callback and the .remove() callback in the rtsx_pcr PCI driver leads to a kernel crash due to an unhandled page fault [1]. The problem is that rtsx_pci_runtime_idle() is not expected to be running after pm_runtime_get_sync() has been called, but the latter doesn't really guarantee that. It only guarantees that the suspend and resume callbacks will not be running when it returns. However, if a .runtime_idle() callback is already running when pm_runtime_get_sync() is called, the latter will notice that the runtime PM status of the device is RPM_ACTIVE and it will return right away without waiting for the former to complete. In fact, it cannot wait for .runtime_idle() to complete because it may be called from that callback (it arguably does not make much sense to do that, but it is not strictly prohibited). Thus in general, whoever is providing a .runtime_idle() callback needs to protect it from running in parallel with whatever code runs after pm_runtime_get_sync(). [Note that .runtime_idle() will not start after pm_runtime_get_sync() has returned, but it may continue running then if it has started earlier.] One way to address that race condition is to call pm_runtime_barrier() after pm_runtime_get_sync() (not before it, because a nonzero value of the runtime PM usage counter is necessary to prevent runtime PM callbacks from being invoked) to wait for the .runtime_idle() callback to complete should it be running at that point. A suitable place for doing that is in pci_device_remove() which calls pm_runtime_get_sync() before removing the driver, so it may as well call pm_runtime_barrier() subsequently, which will prevent the race in question from occurring, not just in the rtsx_pcr driver, but in any PCI drivers providing .runtime_idle() callbacks. CVE-2024-35809 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2024-35809.html CVE-2024-35809 https://bugzilla.suse.com/1224738 SUSE Bug 1224738 In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach This is the candidate patch of CVE-2023-47233 : https://nvd.nist.gov/vuln/detail/CVE-2023-47233 In brcm80211 driver,it starts with the following invoking chain to start init a timeout worker: ->brcmf_usb_probe ->brcmf_usb_probe_cb ->brcmf_attach ->brcmf_bus_started ->brcmf_cfg80211_attach ->wl_init_priv ->brcmf_init_escan ->INIT_WORK(&cfg->escan_timeout_work, brcmf_cfg80211_escan_timeout_worker); If we disconnect the USB by hotplug, it will call brcmf_usb_disconnect to make cleanup. The invoking chain is : brcmf_usb_disconnect ->brcmf_usb_disconnect_cb ->brcmf_detach ->brcmf_cfg80211_detach ->kfree(cfg); While the timeout woker may still be running. This will cause a use-after-free bug on cfg in brcmf_cfg80211_escan_timeout_worker. Fix it by deleting the timer and canceling the worker in brcmf_cfg80211_detach. [arend.vanspriel@broadcom.com: keep timer delete as is and cancel work just before free] CVE-2024-35811 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2024-35811.html CVE-2024-35811 https://bugzilla.suse.com/1224592 SUSE Bug 1224592 In the Linux kernel, the following vulnerability has been resolved: media: tc358743: register v4l2 async device only after successful setup Ensure the device has been setup correctly before registering the v4l2 async device, thus allowing userspace to access. CVE-2024-35830 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2024-35830.html CVE-2024-35830 https://bugzilla.suse.com/1224680 SUSE Bug 1224680 In the Linux kernel, the following vulnerability has been resolved: btrfs: fix information leak in btrfs_ioctl_logical_to_ino() Syzbot reported the following information leak for in btrfs_ioctl_logical_to_ino(): BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline] BUG: KMSAN: kernel-infoleak in _copy_to_user+0xbc/0x110 lib/usercopy.c:40 instrument_copy_to_user include/linux/instrumented.h:114 [inline] _copy_to_user+0xbc/0x110 lib/usercopy.c:40 copy_to_user include/linux/uaccess.h:191 [inline] btrfs_ioctl_logical_to_ino+0x440/0x750 fs/btrfs/ioctl.c:3499 btrfs_ioctl+0x714/0x1260 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:904 [inline] __se_sys_ioctl+0x261/0x450 fs/ioctl.c:890 __x64_sys_ioctl+0x96/0xe0 fs/ioctl.c:890 x64_sys_call+0x1883/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:17 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was created at: __kmalloc_large_node+0x231/0x370 mm/slub.c:3921 __do_kmalloc_node mm/slub.c:3954 [inline] __kmalloc_node+0xb07/0x1060 mm/slub.c:3973 kmalloc_node include/linux/slab.h:648 [inline] kvmalloc_node+0xc0/0x2d0 mm/util.c:634 kvmalloc include/linux/slab.h:766 [inline] init_data_container+0x49/0x1e0 fs/btrfs/backref.c:2779 btrfs_ioctl_logical_to_ino+0x17c/0x750 fs/btrfs/ioctl.c:3480 btrfs_ioctl+0x714/0x1260 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:904 [inline] __se_sys_ioctl+0x261/0x450 fs/ioctl.c:890 __x64_sys_ioctl+0x96/0xe0 fs/ioctl.c:890 x64_sys_call+0x1883/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:17 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Bytes 40-65535 of 65536 are uninitialized Memory access of size 65536 starts at ffff888045a40000 This happens, because we're copying a 'struct btrfs_data_container' back to user-space. This btrfs_data_container is allocated in 'init_data_container()' via kvmalloc(), which does not zero-fill the memory. Fix this by using kvzalloc() which zeroes out the memory on allocation. CVE-2024-35849 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2024-35849.html CVE-2024-35849 https://bugzilla.suse.com/1224733 SUSE Bug 1224733 In the Linux kernel, the following vulnerability has been resolved: x86/mm/pat: fix VM_PAT handling in COW mappings PAT handling won't do the right thing in COW mappings: the first PTE (or, in fact, all PTEs) can be replaced during write faults to point at anon folios. Reliably recovering the correct PFN and cachemode using follow_phys() from PTEs will not work in COW mappings. Using follow_phys(), we might just get the address+protection of the anon folio (which is very wrong), or fail on swap/nonswap entries, failing follow_phys() and triggering a WARN_ON_ONCE() in untrack_pfn() and track_pfn_copy(), not properly calling free_pfn_range(). In free_pfn_range(), we either wouldn't call memtype_free() or would call it with the wrong range, possibly leaking memory. To fix that, let's update follow_phys() to refuse returning anon folios, and fallback to using the stored PFN inside vma->vm_pgoff for COW mappings if we run into that. We will now properly handle untrack_pfn() with COW mappings, where we don't need the cachemode. We'll have to fail fork()->track_pfn_copy() if the first page was replaced by an anon folio, though: we'd have to store the cachemode in the VMA to make this work, likely growing the VMA size. For now, lets keep it simple and let track_pfn_copy() just fail in that case: it would have failed in the past with swap/nonswap entries already, and it would have done the wrong thing with anon folios. Simple reproducer to trigger the WARN_ON_ONCE() in untrack_pfn(): <--- C reproducer ---> #include <stdio.h> #include <sys/mman.h> #include <unistd.h> #include <liburing.h> int main(void) { struct io_uring_params p = {}; int ring_fd; size_t size; char *map; ring_fd = io_uring_setup(1, &p); if (ring_fd < 0) { perror("io_uring_setup"); return 1; } size = p.sq_off.array + p.sq_entries * sizeof(unsigned); /* Map the submission queue ring MAP_PRIVATE */ map = mmap(0, size, PROT_READ | PROT_WRITE, MAP_PRIVATE, ring_fd, IORING_OFF_SQ_RING); if (map == MAP_FAILED) { perror("mmap"); return 1; } /* We have at least one page. Let's COW it. */ *map = 0; pause(); return 0; } <--- C reproducer ---> On a system with 16 GiB RAM and swap configured: # ./iouring & # memhog 16G # killall iouring [ 301.552930] ------------[ cut here ]------------ [ 301.553285] WARNING: CPU: 7 PID: 1402 at arch/x86/mm/pat/memtype.c:1060 untrack_pfn+0xf4/0x100 [ 301.553989] Modules linked in: binfmt_misc nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_g [ 301.558232] CPU: 7 PID: 1402 Comm: iouring Not tainted 6.7.5-100.fc38.x86_64 #1 [ 301.558772] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebu4 [ 301.559569] RIP: 0010:untrack_pfn+0xf4/0x100 [ 301.559893] Code: 75 c4 eb cf 48 8b 43 10 8b a8 e8 00 00 00 3b 6b 28 74 b8 48 8b 7b 30 e8 ea 1a f7 000 [ 301.561189] RSP: 0018:ffffba2c0377fab8 EFLAGS: 00010282 [ 301.561590] RAX: 00000000ffffffea RBX: ffff9208c8ce9cc0 RCX: 000000010455e047 [ 301.562105] RDX: 07fffffff0eb1e0a RSI: 0000000000000000 RDI: ffff9208c391d200 [ 301.562628] RBP: 0000000000000000 R08: ffffba2c0377fab8 R09: 0000000000000000 [ 301.563145] R10: ffff9208d2292d50 R11: 0000000000000002 R12: 00007fea890e0000 [ 301.563669] R13: 0000000000000000 R14: ffffba2c0377fc08 R15: 0000000000000000 [ 301.564186] FS: 0000000000000000(0000) GS:ffff920c2fbc0000(0000) knlGS:0000000000000000 [ 301.564773] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 301.565197] CR2: 00007fea88ee8a20 CR3: 00000001033a8000 CR4: 0000000000750ef0 [ 301.565725] PKRU: 55555554 [ 301.565944] Call Trace: [ 301.566148] <TASK> [ 301.566325] ? untrack_pfn+0xf4/0x100 [ 301.566618] ? __warn+0x81/0x130 [ 301.566876] ? untrack_pfn+0xf4/0x100 [ 3 ---truncated--- CVE-2024-35877 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2024-35877.html CVE-2024-35877 https://bugzilla.suse.com/1224525 SUSE Bug 1224525 In the Linux kernel, the following vulnerability has been resolved: of: module: prevent NULL pointer dereference in vsnprintf() In of_modalias(), we can get passed the str and len parameters which would cause a kernel oops in vsnprintf() since it only allows passing a NULL ptr when the length is also 0. Also, we need to filter out the negative values of the len parameter as these will result in a really huge buffer since snprintf() takes size_t parameter while ours is ssize_t... Found by Linux Verification Center (linuxtesting.org) with the Svace static analysis tool. CVE-2024-35878 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2024-35878.html CVE-2024-35878 https://bugzilla.suse.com/1224671 SUSE Bug 1224671 In the Linux kernel, the following vulnerability has been resolved: ax25: fix use-after-free bugs caused by ax25_ds_del_timer When the ax25 device is detaching, the ax25_dev_device_down() calls ax25_ds_del_timer() to cleanup the slave_timer. When the timer handler is running, the ax25_ds_del_timer() that calls del_timer() in it will return directly. As a result, the use-after-free bugs could happen, one of the scenarios is shown below: (Thread 1) | (Thread 2) | ax25_ds_timeout() ax25_dev_device_down() | ax25_ds_del_timer() | del_timer() | ax25_dev_put() //FREE | | ax25_dev-> //USE In order to mitigate bugs, when the device is detaching, use timer_shutdown_sync() to stop the timer. CVE-2024-35887 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2024-35887.html CVE-2024-35887 https://bugzilla.suse.com/1224663 SUSE Bug 1224663 In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Prevent lock inversion deadlock in map delete elem syzkaller started using corpuses where a BPF tracing program deletes elements from a sockmap/sockhash map. Because BPF tracing programs can be invoked from any interrupt context, locks taken during a map_delete_elem operation must be hardirq-safe. Otherwise a deadlock due to lock inversion is possible, as reported by lockdep: CPU0 CPU1 ---- ---- lock(&htab->buckets[i].lock); local_irq_disable(); lock(&host->lock); lock(&htab->buckets[i].lock); <Interrupt> lock(&host->lock); Locks in sockmap are hardirq-unsafe by design. We expects elements to be deleted from sockmap/sockhash only in task (normal) context with interrupts enabled, or in softirq context. Detect when map_delete_elem operation is invoked from a context which is _not_ hardirq-unsafe, that is interrupts are disabled, and bail out with an error. Note that map updates are not affected by this issue. BPF verifier does not allow updating sockmap/sockhash from a BPF tracing program today. CVE-2024-35895 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2024-35895.html CVE-2024-35895 https://bugzilla.suse.com/1224511 SUSE Bug 1224511 In the Linux kernel, the following vulnerability has been resolved: nfsd: Fix error cleanup path in nfsd_rename() Commit a8b0026847b8 ("rename(): avoid a deadlock in the case of parents having no common ancestor") added an error bail out path. However this path does not drop the remount protection that has been acquired. Fix the cleanup path to properly drop the remount protection. CVE-2024-35914 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2024-35914.html CVE-2024-35914 https://bugzilla.suse.com/1224482 SUSE Bug 1224482 In the Linux kernel, the following vulnerability has been resolved: drm/vc4: don't check if plane->state->fb == state->fb Currently, when using non-blocking commits, we can see the following kernel warning: [ 110.908514] ------------[ cut here ]------------ [ 110.908529] refcount_t: underflow; use-after-free. [ 110.908620] WARNING: CPU: 0 PID: 1866 at lib/refcount.c:87 refcount_dec_not_one+0xb8/0xc0 [ 110.908664] Modules linked in: rfcomm snd_seq_dummy snd_hrtimer snd_seq snd_seq_device cmac algif_hash aes_arm64 aes_generic algif_skcipher af_alg bnep hid_logitech_hidpp vc4 brcmfmac hci_uart btbcm brcmutil bluetooth snd_soc_hdmi_codec cfg80211 cec drm_display_helper drm_dma_helper drm_kms_helper snd_soc_core snd_compress snd_pcm_dmaengine fb_sys_fops sysimgblt syscopyarea sysfillrect raspberrypi_hwmon ecdh_generic ecc rfkill libaes i2c_bcm2835 binfmt_misc joydev snd_bcm2835(C) bcm2835_codec(C) bcm2835_isp(C) v4l2_mem2mem videobuf2_dma_contig snd_pcm bcm2835_v4l2(C) raspberrypi_gpiomem bcm2835_mmal_vchiq(C) videobuf2_v4l2 snd_timer videobuf2_vmalloc videobuf2_memops videobuf2_common snd videodev vc_sm_cma(C) mc hid_logitech_dj uio_pdrv_genirq uio i2c_dev drm fuse dm_mod drm_panel_orientation_quirks backlight ip_tables x_tables ipv6 [ 110.909086] CPU: 0 PID: 1866 Comm: kodi.bin Tainted: G C 6.1.66-v8+ #32 [ 110.909104] Hardware name: Raspberry Pi 3 Model B Rev 1.2 (DT) [ 110.909114] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 110.909132] pc : refcount_dec_not_one+0xb8/0xc0 [ 110.909152] lr : refcount_dec_not_one+0xb4/0xc0 [ 110.909170] sp : ffffffc00913b9c0 [ 110.909177] x29: ffffffc00913b9c0 x28: 000000556969bbb0 x27: 000000556990df60 [ 110.909205] x26: 0000000000000002 x25: 0000000000000004 x24: ffffff8004448480 [ 110.909230] x23: ffffff800570b500 x22: ffffff802e03a7bc x21: ffffffecfca68c78 [ 110.909257] x20: ffffff8002b42000 x19: ffffff802e03a600 x18: 0000000000000000 [ 110.909283] x17: 0000000000000011 x16: ffffffffffffffff x15: 0000000000000004 [ 110.909308] x14: 0000000000000fff x13: ffffffed577e47e0 x12: 0000000000000003 [ 110.909333] x11: 0000000000000000 x10: 0000000000000027 x9 : c912d0d083728c00 [ 110.909359] x8 : c912d0d083728c00 x7 : 65646e75203a745f x6 : 746e756f63666572 [ 110.909384] x5 : ffffffed579f62ee x4 : ffffffed579eb01e x3 : 0000000000000000 [ 110.909409] x2 : 0000000000000000 x1 : ffffffc00913b750 x0 : 0000000000000001 [ 110.909434] Call trace: [ 110.909441] refcount_dec_not_one+0xb8/0xc0 [ 110.909461] vc4_bo_dec_usecnt+0x4c/0x1b0 [vc4] [ 110.909903] vc4_cleanup_fb+0x44/0x50 [vc4] [ 110.910315] drm_atomic_helper_cleanup_planes+0x88/0xa4 [drm_kms_helper] [ 110.910669] vc4_atomic_commit_tail+0x390/0x9dc [vc4] [ 110.911079] commit_tail+0xb0/0x164 [drm_kms_helper] [ 110.911397] drm_atomic_helper_commit+0x1d0/0x1f0 [drm_kms_helper] [ 110.911716] drm_atomic_commit+0xb0/0xdc [drm] [ 110.912569] drm_mode_atomic_ioctl+0x348/0x4b8 [drm] [ 110.913330] drm_ioctl_kernel+0xec/0x15c [drm] [ 110.914091] drm_ioctl+0x24c/0x3b0 [drm] [ 110.914850] __arm64_sys_ioctl+0x9c/0xd4 [ 110.914873] invoke_syscall+0x4c/0x114 [ 110.914897] el0_svc_common+0xd0/0x118 [ 110.914917] do_el0_svc+0x38/0xd0 [ 110.914936] el0_svc+0x30/0x8c [ 110.914958] el0t_64_sync_handler+0x84/0xf0 [ 110.914979] el0t_64_sync+0x18c/0x190 [ 110.914996] ---[ end trace 0000000000000000 ]--- This happens because, although `prepare_fb` and `cleanup_fb` are perfectly balanced, we cannot guarantee consistency in the check plane->state->fb == state->fb. This means that sometimes we can increase the refcount in `prepare_fb` and don't decrease it in `cleanup_fb`. The opposite can also be true. In fact, the struct drm_plane .state shouldn't be accessed directly but instead, the `drm_atomic_get_new_plane_state()` helper function should be used. So, we could stick to this check, but using `drm_atomic_get_new_plane_state()`. But actually, this check is not re ---truncated--- CVE-2024-35932 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2024-35932.html CVE-2024-35932 https://bugzilla.suse.com/1224650 SUSE Bug 1224650 In the Linux kernel, the following vulnerability has been resolved: btrfs: send: handle path ref underflow in header iterate_inode_ref() Change BUG_ON to proper error handling if building the path buffer fails. The pointers are not printed so we don't accidentally leak kernel addresses. CVE-2024-35935 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2024-35935.html CVE-2024-35935 https://bugzilla.suse.com/1224645 SUSE Bug 1224645 In the Linux kernel, the following vulnerability has been resolved: btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks() The unhandled case in btrfs_relocate_sys_chunks() loop is a corruption, as it could be caused only by two impossible conditions: - at first the search key is set up to look for a chunk tree item, with offset -1, this is an inexact search and the key->offset will contain the correct offset upon a successful search, a valid chunk tree item cannot have an offset -1 - after first successful search, the found_key corresponds to a chunk item, the offset is decremented by 1 before the next loop, it's impossible to find a chunk item there due to alignment and size constraints CVE-2024-35936 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2024-35936.html CVE-2024-35936 https://bugzilla.suse.com/1224644 SUSE Bug 1224644 In the Linux kernel, the following vulnerability has been resolved: VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host() Syzkaller hit 'WARNING in dg_dispatch_as_host' bug. memcpy: detected field-spanning write (size 56) of single field "&dg_info->msg" at drivers/misc/vmw_vmci/vmci_datagram.c:237 (size 24) WARNING: CPU: 0 PID: 1555 at drivers/misc/vmw_vmci/vmci_datagram.c:237 dg_dispatch_as_host+0x88e/0xa60 drivers/misc/vmw_vmci/vmci_datagram.c:237 Some code commentry, based on my understanding: 544 #define VMCI_DG_SIZE(_dg) (VMCI_DG_HEADERSIZE + (size_t)(_dg)->payload_size) /// This is 24 + payload_size memcpy(&dg_info->msg, dg, dg_size); Destination = dg_info->msg ---> this is a 24 byte structure(struct vmci_datagram) Source = dg --> this is a 24 byte structure (struct vmci_datagram) Size = dg_size = 24 + payload_size {payload_size = 56-24 =32} -- Syzkaller managed to set payload_size to 32. 35 struct delayed_datagram_info { 36 struct datagram_entry *entry; 37 struct work_struct work; 38 bool in_dg_host_queue; 39 /* msg and msg_payload must be together. */ 40 struct vmci_datagram msg; 41 u8 msg_payload[]; 42 }; So those extra bytes of payload are copied into msg_payload[], a run time warning is seen while fuzzing with Syzkaller. One possible way to fix the warning is to split the memcpy() into two parts -- one -- direct assignment of msg and second taking care of payload. Gustavo quoted: "Under FORTIFY_SOURCE we should not copy data across multiple members in a structure." CVE-2024-35944 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2024-35944.html CVE-2024-35944 https://bugzilla.suse.com/1224648 SUSE Bug 1224648 In the Linux kernel, the following vulnerability has been resolved: kprobes: Fix possible use-after-free issue on kprobe registration When unloading a module, its state is changing MODULE_STATE_LIVE -> MODULE_STATE_GOING -> MODULE_STATE_UNFORMED. Each change will take a time. `is_module_text_address()` and `__module_text_address()` works with MODULE_STATE_LIVE and MODULE_STATE_GOING. If we use `is_module_text_address()` and `__module_text_address()` separately, there is a chance that the first one is succeeded but the next one is failed because module->state becomes MODULE_STATE_UNFORMED between those operations. In `check_kprobe_address_safe()`, if the second `__module_text_address()` is failed, that is ignored because it expected a kernel_text address. But it may have failed simply because module->state has been changed to MODULE_STATE_UNFORMED. In this case, arm_kprobe() will try to modify non-exist module text address (use-after-free). To fix this problem, we should not use separated `is_module_text_address()` and `__module_text_address()`, but use only `__module_text_address()` once and do `try_module_get(module)` which is only available with MODULE_STATE_LIVE. CVE-2024-35955 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2024-35955.html CVE-2024-35955 https://bugzilla.suse.com/1224676 SUSE Bug 1224676 In the Linux kernel, the following vulnerability has been resolved: ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr Although ipv6_get_ifaddr walks inet6_addr_lst under the RCU lock, it still means hlist_for_each_entry_rcu can return an item that got removed from the list. The memory itself of such item is not freed thanks to RCU but nothing guarantees the actual content of the memory is sane. In particular, the reference count can be zero. This can happen if ipv6_del_addr is called in parallel. ipv6_del_addr removes the entry from inet6_addr_lst (hlist_del_init_rcu(&ifp->addr_lst)) and drops all references (__in6_ifa_put(ifp) + in6_ifa_put(ifp)). With bad enough timing, this can happen: 1. In ipv6_get_ifaddr, hlist_for_each_entry_rcu returns an entry. 2. Then, the whole ipv6_del_addr is executed for the given entry. The reference count drops to zero and kfree_rcu is scheduled. 3. ipv6_get_ifaddr continues and tries to increments the reference count (in6_ifa_hold). 4. The rcu is unlocked and the entry is freed. 5. The freed entry is returned. Prevent increasing of the reference count in such case. The name in6_ifa_hold_safe is chosen to mimic the existing fib6_info_hold_safe. [ 41.506330] refcount_t: addition on 0; use-after-free. [ 41.506760] WARNING: CPU: 0 PID: 595 at lib/refcount.c:25 refcount_warn_saturate+0xa5/0x130 [ 41.507413] Modules linked in: veth bridge stp llc [ 41.507821] CPU: 0 PID: 595 Comm: python3 Not tainted 6.9.0-rc2.main-00208-g49563be82afa #14 [ 41.508479] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) [ 41.509163] RIP: 0010:refcount_warn_saturate+0xa5/0x130 [ 41.509586] Code: ad ff 90 0f 0b 90 90 c3 cc cc cc cc 80 3d c0 30 ad 01 00 75 a0 c6 05 b7 30 ad 01 01 90 48 c7 c7 38 cc 7a 8c e8 cc 18 ad ff 90 <0f> 0b 90 90 c3 cc cc cc cc 80 3d 98 30 ad 01 00 0f 85 75 ff ff ff [ 41.510956] RSP: 0018:ffffbda3c026baf0 EFLAGS: 00010282 [ 41.511368] RAX: 0000000000000000 RBX: ffff9e9c46914800 RCX: 0000000000000000 [ 41.511910] RDX: ffff9e9c7ec29c00 RSI: ffff9e9c7ec1c900 RDI: ffff9e9c7ec1c900 [ 41.512445] RBP: ffff9e9c43660c9c R08: 0000000000009ffb R09: 00000000ffffdfff [ 41.512998] R10: 00000000ffffdfff R11: ffffffff8ca58a40 R12: ffff9e9c4339a000 [ 41.513534] R13: 0000000000000001 R14: ffff9e9c438a0000 R15: ffffbda3c026bb48 [ 41.514086] FS: 00007fbc4cda1740(0000) GS:ffff9e9c7ec00000(0000) knlGS:0000000000000000 [ 41.514726] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 41.515176] CR2: 000056233b337d88 CR3: 000000000376e006 CR4: 0000000000370ef0 [ 41.515713] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 41.516252] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 41.516799] Call Trace: [ 41.517037] <TASK> [ 41.517249] ? __warn+0x7b/0x120 [ 41.517535] ? refcount_warn_saturate+0xa5/0x130 [ 41.517923] ? report_bug+0x164/0x190 [ 41.518240] ? handle_bug+0x3d/0x70 [ 41.518541] ? exc_invalid_op+0x17/0x70 [ 41.520972] ? asm_exc_invalid_op+0x1a/0x20 [ 41.521325] ? refcount_warn_saturate+0xa5/0x130 [ 41.521708] ipv6_get_ifaddr+0xda/0xe0 [ 41.522035] inet6_rtm_getaddr+0x342/0x3f0 [ 41.522376] ? __pfx_inet6_rtm_getaddr+0x10/0x10 [ 41.522758] rtnetlink_rcv_msg+0x334/0x3d0 [ 41.523102] ? netlink_unicast+0x30f/0x390 [ 41.523445] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 41.523832] netlink_rcv_skb+0x53/0x100 [ 41.524157] netlink_unicast+0x23b/0x390 [ 41.524484] netlink_sendmsg+0x1f2/0x440 [ 41.524826] __sys_sendto+0x1d8/0x1f0 [ 41.525145] __x64_sys_sendto+0x1f/0x30 [ 41.525467] do_syscall_64+0xa5/0x1b0 [ 41.525794] entry_SYSCALL_64_after_hwframe+0x72/0x7a [ 41.526213] RIP: 0033:0x7fbc4cfcea9a [ 41.526528] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 7e c3 0f 1f 44 00 00 41 54 48 83 ec 30 44 89 [ 41.527942] RSP: 002b:00007f ---truncated--- CVE-2024-35969 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2024-35969.html CVE-2024-35969 https://bugzilla.suse.com/1224580 SUSE Bug 1224580 In the Linux kernel, the following vulnerability has been resolved: batman-adv: Avoid infinite loop trying to resize local TT If the MTU of one of an attached interface becomes too small to transmit the local translation table then it must be resized to fit inside all fragments (when enabled) or a single packet. But if the MTU becomes too low to transmit even the header + the VLAN specific part then the resizing of the local TT will never succeed. This can for example happen when the usable space is 110 bytes and 11 VLANs are on top of batman-adv. In this case, at least 116 byte would be needed. There will just be an endless spam of batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (110) in the log but the function will never finish. Problem here is that the timeout will be halved all the time and will then stagnate at 0 and therefore never be able to reduce the table even more. There are other scenarios possible with a similar result. The number of BATADV_TT_CLIENT_NOPURGE entries in the local TT can for example be too high to fit inside a packet. Such a scenario can therefore happen also with only a single VLAN + 7 non-purgable addresses - requiring at least 120 bytes. While this should be handled proactively when: * interface with too low MTU is added * VLAN is added * non-purgeable local mac is added * MTU of an attached interface is reduced * fragmentation setting gets disabled (which most likely requires dropping attached interfaces) not all of these scenarios can be prevented because batman-adv is only consuming events without the the possibility to prevent these actions (non-purgable MAC address added, MTU of an attached interface is reduced). It is therefore necessary to also make sure that the code is able to handle also the situations when there were already incompatible system configuration are present. CVE-2024-35982 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2024-35982.html CVE-2024-35982 https://bugzilla.suse.com/1224566 SUSE Bug 1224566 In the Linux kernel, the following vulnerability has been resolved: i2c: smbus: fix NULL function pointer dereference Baruch reported an OOPS when using the designware controller as target only. Target-only modes break the assumption of one transfer function always being available. Fix this by always checking the pointer in __i2c_transfer. [wsa: dropped the simplification in core-smbus to avoid theoretical regressions] CVE-2024-35984 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2024-35984.html CVE-2024-35984 https://bugzilla.suse.com/1224567 SUSE Bug 1224567 In the Linux kernel, the following vulnerability has been resolved: ppdev: Add an error check in register_device In register_device, the return value of ida_simple_get is unchecked, in witch ida_simple_get will use an invalid index value. To address this issue, index should be checked after ida_simple_get. When the index value is abnormal, a warning message should be printed, the port should be dropped, and the value should be recorded. CVE-2024-36015 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2024-36015.html CVE-2024-36015 https://bugzilla.suse.com/1225640 SUSE Bug 1225640 In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-msm: pervent access to suspended controller Generic sdhci code registers LED device and uses host->runtime_suspended flag to protect access to it. The sdhci-msm driver doesn't set this flag, which causes a crash when LED is accessed while controller is runtime suspended. Fix this by setting the flag correctly. CVE-2024-36029 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2024-36029.html CVE-2024-36029 https://bugzilla.suse.com/1225708 SUSE Bug 1225708 In the Linux kernel, the following vulnerability has been resolved: tipc: fix a possible memleak in tipc_buf_append __skb_linearize() doesn't free the skb when it fails, so move '*buf = NULL' after __skb_linearize(), so that the skb can be freed on the err path. CVE-2024-36954 SUSE Linux Enterprise Real Time 12 SP5:cluster-md-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:dlm-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:gfs2-kmp-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-devel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-base-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-rt_debug-devel-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-source-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:kernel-syms-rt-4.12.14-10.188.1 SUSE Linux Enterprise Real Time 12 SP5:ocfs2-kmp-rt-4.12.14-10.188.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241983-1/ https://www.suse.com/security/cve/CVE-2024-36954.html CVE-2024-36954 https://bugzilla.suse.com/1225764 SUSE Bug 1225764