rpm package
opensuse/kernel-default&distro=openSUSE Leap 15.3
pkg:rpm/opensuse/kernel-default&distro=openSUSE%20Leap%2015.3
Vulnerabilities (340)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2021-4155 | — | < 5.3.18-150300.59.93.1 | 5.3.18-150300.59.93.1 | Aug 24, 2022 | A data leak flaw was found in the way XFS_IOC_ALLOCSP IOCTL in the XFS filesystem allowed for size increase of files with unaligned size. A local attacker could use this flaw to leak data on the XFS filesystem otherwise not accessible to them. | ||
| CVE-2022-2978 | — | < 5.3.18-150300.59.101.1 | 5.3.18-150300.59.101.1 | Aug 24, 2022 | A flaw use after free in the Linux kernel NILFS file system was found in the way user triggers function security_inode_alloc to fail with following call to function nilfs_mdt_destroy. A local user could use this flaw to crash the system or potentially escalate their privileges on | ||
| CVE-2021-4037 | — | < 5.3.18-150300.59.101.1 | 5.3.18-150300.59.101.1 | Aug 24, 2022 | A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that allows local users to create files for the XFS file-system with an unintended group ownership and with group execution and SGID permission bits set, in a scenario where a direct | ||
| CVE-2021-3764 | — | < 5.3.18-59.27.1 | 5.3.18-59.27.1 | Aug 23, 2022 | A memory leak flaw was found in the Linux kernel's ccp_run_aes_gcm_cmd() function that allows an attacker to cause a denial of service. The vulnerability is similar to the older CVE-2019-18808. The highest threat from this vulnerability is to system availability. | ||
| CVE-2021-3759 | — | < 5.3.18-59.24.1 | 5.3.18-59.24.1 | Aug 23, 2022 | A memory overflow vulnerability was found in the Linux kernel’s ipc functionality of the memcg subsystem, in the way a user calls the semget function multiple times, creating semaphores. This flaw allows a local user to starve the resources, causing a denial of service. The highe | ||
| CVE-2021-3659 | — | < 5.3.18-59.19.1 | 5.3.18-59.19.1 | Aug 22, 2022 | A NULL pointer dereference flaw was found in the Linux kernel’s IEEE 802.15.4 wireless networking subsystem in the way the user closes the LR-WPAN connection. This flaw allows a local user to crash the system. The highest threat from this vulnerability is to system availability. | ||
| CVE-2022-26373 | — | < 5.3.18-150300.59.93.1 | 5.3.18-150300.59.93.1 | Aug 18, 2022 | Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access. | ||
| CVE-2022-2503 | — | < 4.12.14-150100.197.126.1 | 4.12.14-150100.197.126.1 | Aug 12, 2022 | Dm-verity is used for extending root-of-trust to root filesystems. LoadPin builds on this property to restrict module/firmware loads to just the trusted root filesystem. Device-mapper table reloads currently allow users with root privileges to switch out the target with an equiva | ||
| CVE-2022-20368 | — | < 5.3.18-150300.59.93.1 | 5.3.18-150300.59.93.1 | Aug 11, 2022 | Product: AndroidVersions: Android kernelAndroid ID: A-224546354References: Upstream kernel | ||
| CVE-2022-20369 | — | < 5.3.18-150300.59.93.1 | 5.3.18-150300.59.93.1 | Aug 11, 2022 | In v4l2_m2m_querybuf of v4l2-mem2mem.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: An | ||
| CVE-2022-1158 | — | < 5.3.18-150300.59.68.1 | 5.3.18-150300.59.68.1 | Aug 5, 2022 | A flaw was found in KVM. When updating a guest's page table entry, vm_pgoff was improperly used as the offset to get the page's pfn. As vaddr and vm_pgoff are controllable by user-mode processes, this flaw allows unprivileged local users on the host to write outside the userspace | ||
| CVE-2022-1012 | — | < 5.3.18-150300.59.87.1 | 5.3.18-150300.59.87.1 | Aug 5, 2022 | A memory leak problem was found in the TCP source port generation algorithm in net/ipv4/tcp.c due to the small table perturb size. This flaw may allow an attacker to information leak and may cause a denial of service problem. | ||
| CVE-2022-36879 | — | < 5.3.18-150300.59.93.1 | 5.3.18-150300.59.93.1 | Jul 27, 2022 | An issue was discovered in the Linux kernel through 5.18.14. xfrm_expand_policies in net/xfrm/xfrm_policy.c can cause a refcount to be dropped twice. | ||
| CVE-2022-36946 | — | < 4.12.14-150100.197.120.1 | 4.12.14-150100.197.120.1 | Jul 27, 2022 | nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote attackers to cause a denial of service (panic) because, in the case of an nf_queue verdict with a one-byte nfta_payload attribute, an skb_pull can encounter a negative skb->len. | ||
| CVE-2020-36557 | — | < 4.12.14-150100.197.120.1 | 4.12.14-150100.197.120.1 | Jul 21, 2022 | A race condition in the Linux kernel before 5.6.2 between the VT_DISALLOCATE ioctl and closing/opening of ttys could lead to a use-after-free. | ||
| CVE-2020-36558 | — | < 4.12.14-150100.197.120.1 | 4.12.14-150100.197.120.1 | Jul 21, 2022 | A race condition in the Linux kernel before 5.5.7 involving VT_RESIZEX could lead to a NULL pointer dereference and general protection fault. | ||
| CVE-2021-33655 | — | < 4.12.14-150100.197.120.1 | 4.12.14-150100.197.120.1 | Jul 18, 2022 | When sending malicous data to kernel by ioctl cmd FBIOPUT_VSCREENINFO,kernel will write memory out of bounds. | ||
| CVE-2021-33656 | — | < 4.12.14-150100.197.120.1 | 4.12.14-150100.197.120.1 | Jul 18, 2022 | When setting font with malicous data by ioctl cmd PIO_FONT,kernel will write memory out of bounds. | ||
| CVE-2021-4135 | — | < 5.3.18-150300.59.43.1 | 5.3.18-150300.59.43.1 | Jul 14, 2022 | A memory leak vulnerability was found in the Linux kernel's eBPF for the Simulated networking device driver in the way user uses BPF for the device such that function nsim_map_alloc_elem being called. A local user could use this flaw to get unauthorized access to some data. | ||
| CVE-2022-29900 | — | < 4.12.14-150100.197.117.1 | 4.12.14-150100.197.117.1 | Jul 12, 2022 | Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution under certain microarchitecture-dependent conditions. |
- CVE-2021-4155Aug 24, 2022affected < 5.3.18-150300.59.93.1fixed 5.3.18-150300.59.93.1
A data leak flaw was found in the way XFS_IOC_ALLOCSP IOCTL in the XFS filesystem allowed for size increase of files with unaligned size. A local attacker could use this flaw to leak data on the XFS filesystem otherwise not accessible to them.
- CVE-2022-2978Aug 24, 2022affected < 5.3.18-150300.59.101.1fixed 5.3.18-150300.59.101.1
A flaw use after free in the Linux kernel NILFS file system was found in the way user triggers function security_inode_alloc to fail with following call to function nilfs_mdt_destroy. A local user could use this flaw to crash the system or potentially escalate their privileges on
- CVE-2021-4037Aug 24, 2022affected < 5.3.18-150300.59.101.1fixed 5.3.18-150300.59.101.1
A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that allows local users to create files for the XFS file-system with an unintended group ownership and with group execution and SGID permission bits set, in a scenario where a direct
- CVE-2021-3764Aug 23, 2022affected < 5.3.18-59.27.1fixed 5.3.18-59.27.1
A memory leak flaw was found in the Linux kernel's ccp_run_aes_gcm_cmd() function that allows an attacker to cause a denial of service. The vulnerability is similar to the older CVE-2019-18808. The highest threat from this vulnerability is to system availability.
- CVE-2021-3759Aug 23, 2022affected < 5.3.18-59.24.1fixed 5.3.18-59.24.1
A memory overflow vulnerability was found in the Linux kernel’s ipc functionality of the memcg subsystem, in the way a user calls the semget function multiple times, creating semaphores. This flaw allows a local user to starve the resources, causing a denial of service. The highe
- CVE-2021-3659Aug 22, 2022affected < 5.3.18-59.19.1fixed 5.3.18-59.19.1
A NULL pointer dereference flaw was found in the Linux kernel’s IEEE 802.15.4 wireless networking subsystem in the way the user closes the LR-WPAN connection. This flaw allows a local user to crash the system. The highest threat from this vulnerability is to system availability.
- CVE-2022-26373Aug 18, 2022affected < 5.3.18-150300.59.93.1fixed 5.3.18-150300.59.93.1
Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access.
- CVE-2022-2503Aug 12, 2022affected < 4.12.14-150100.197.126.1fixed 4.12.14-150100.197.126.1
Dm-verity is used for extending root-of-trust to root filesystems. LoadPin builds on this property to restrict module/firmware loads to just the trusted root filesystem. Device-mapper table reloads currently allow users with root privileges to switch out the target with an equiva
- CVE-2022-20368Aug 11, 2022affected < 5.3.18-150300.59.93.1fixed 5.3.18-150300.59.93.1
Product: AndroidVersions: Android kernelAndroid ID: A-224546354References: Upstream kernel
- CVE-2022-20369Aug 11, 2022affected < 5.3.18-150300.59.93.1fixed 5.3.18-150300.59.93.1
In v4l2_m2m_querybuf of v4l2-mem2mem.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: An
- CVE-2022-1158Aug 5, 2022affected < 5.3.18-150300.59.68.1fixed 5.3.18-150300.59.68.1
A flaw was found in KVM. When updating a guest's page table entry, vm_pgoff was improperly used as the offset to get the page's pfn. As vaddr and vm_pgoff are controllable by user-mode processes, this flaw allows unprivileged local users on the host to write outside the userspace
- CVE-2022-1012Aug 5, 2022affected < 5.3.18-150300.59.87.1fixed 5.3.18-150300.59.87.1
A memory leak problem was found in the TCP source port generation algorithm in net/ipv4/tcp.c due to the small table perturb size. This flaw may allow an attacker to information leak and may cause a denial of service problem.
- CVE-2022-36879Jul 27, 2022affected < 5.3.18-150300.59.93.1fixed 5.3.18-150300.59.93.1
An issue was discovered in the Linux kernel through 5.18.14. xfrm_expand_policies in net/xfrm/xfrm_policy.c can cause a refcount to be dropped twice.
- CVE-2022-36946Jul 27, 2022affected < 4.12.14-150100.197.120.1fixed 4.12.14-150100.197.120.1
nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote attackers to cause a denial of service (panic) because, in the case of an nf_queue verdict with a one-byte nfta_payload attribute, an skb_pull can encounter a negative skb->len.
- CVE-2020-36557Jul 21, 2022affected < 4.12.14-150100.197.120.1fixed 4.12.14-150100.197.120.1
A race condition in the Linux kernel before 5.6.2 between the VT_DISALLOCATE ioctl and closing/opening of ttys could lead to a use-after-free.
- CVE-2020-36558Jul 21, 2022affected < 4.12.14-150100.197.120.1fixed 4.12.14-150100.197.120.1
A race condition in the Linux kernel before 5.5.7 involving VT_RESIZEX could lead to a NULL pointer dereference and general protection fault.
- CVE-2021-33655Jul 18, 2022affected < 4.12.14-150100.197.120.1fixed 4.12.14-150100.197.120.1
When sending malicous data to kernel by ioctl cmd FBIOPUT_VSCREENINFO,kernel will write memory out of bounds.
- CVE-2021-33656Jul 18, 2022affected < 4.12.14-150100.197.120.1fixed 4.12.14-150100.197.120.1
When setting font with malicous data by ioctl cmd PIO_FONT,kernel will write memory out of bounds.
- CVE-2021-4135Jul 14, 2022affected < 5.3.18-150300.59.43.1fixed 5.3.18-150300.59.43.1
A memory leak vulnerability was found in the Linux kernel's eBPF for the Simulated networking device driver in the way user uses BPF for the device such that function nsim_map_alloc_elem being called. A local user could use this flaw to get unauthorized access to some data.
- CVE-2022-29900Jul 12, 2022affected < 4.12.14-150100.197.117.1fixed 4.12.14-150100.197.117.1
Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution under certain microarchitecture-dependent conditions.
Page 5 of 17