rpm package
suse/kernel-default&distro=SUSE Linux Enterprise Live Patching 15 SP4
pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Live%20Patching%2015%20SP4
Vulnerabilities (2,888)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2022-1734 | — | < 5.14.21-150400.24.11.1 | 5.14.21-150400.24.11.1 | May 18, 2022 | A flaw in Linux Kernel found in nfcmrvl_nci_unregister_dev() in drivers/nfc/nfcmrvl/main.c can lead to use after free both read or write when non synchronized between cleanup routine and firmware download routine. | ||
| CVE-2022-29581 | — | < 5.14.21-150400.24.18.1 | 5.14.21-150400.24.18.1 | May 17, 2022 | Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to cause privilege escalation to root. This issue affects: Linux Kernel versions prior to 5.18; version 4.14 and later versions. | ||
| CVE-2022-1679 | — | < 5.14.21-150400.24.11.1 | 5.14.21-150400.24.11.1 | May 16, 2022 | A use-after-free flaw was found in the Linux kernel’s Atheros wireless adapter driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages. This flaw allows a local user to crash or potentially escalate their privileges on the system. | ||
| CVE-2021-33135 | — | < 5.14.21-150400.24.21.2 | 5.14.21-150400.24.21.2 | May 12, 2022 | Uncontrolled resource consumption in the Linux kernel drivers for Intel(R) SGX may allow an authenticated user to potentially enable denial of service via local access. | ||
| CVE-2022-30594 | — | < 5.14.21-150400.24.11.1 | 5.14.21-150400.24.11.1 | May 12, 2022 | The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows attackers to bypass intended restrictions on setting the PT_SUSPEND_SECCOMP flag. | ||
| CVE-2022-1048 | — | < 5.14.21-150400.24.158.1 | 5.14.21-150400.24.158.1 | Apr 29, 2022 | A use-after-free flaw was found in the Linux kernel’s sound subsystem in the way a user triggers concurrent calls of PCM hw_params. The hw_free ioctls or similar race condition happens inside ALSA PCM for other ioctls. This flaw allows a local user to crash or potentially escalat | ||
| CVE-2022-29582 | — | < 5.14.21-150400.24.11.1 | 5.14.21-150400.24.11.1 | Apr 22, 2022 | In the Linux kernel before 5.17.3, fs/io_uring.c has a use-after-free due to a race condition in io_uring timeouts. This can be triggered by a local user who has no access to any user namespace; however, the race condition perhaps can only be exploited infrequently. | ||
| CVE-2022-28356 | — | < 5.14.21-150400.24.21.2 | 5.14.21-150400.24.21.2 | Apr 2, 2022 | In the Linux kernel before 5.17.1, a refcount leak bug was found in net/llc/af_llc.c. | ||
| CVE-2022-0995 | — | < 5.14.21-150400.24.158.1 | 5.14.21-150400.24.158.1 | Mar 25, 2022 | An out-of-bounds (OOB) memory write flaw was found in the Linux kernel’s watch_queue event notification subsystem. This flaw can overwrite parts of the kernel state, potentially allowing a local user to gain privileged access or cause a denial of service on the system. | ||
| CVE-2022-0494 | — | < 5.14.21-150400.24.11.1 | 5.14.21-150400.24.11.1 | Mar 25, 2022 | A kernel information leak flaw was identified in the scsi_ioctl function in drivers/scsi/scsi_ioctl.c in the Linux kernel. This flaw allows a local attacker with a special user privilege (CAP_SYS_ADMIN or CAP_SYS_RAWIO) to create issues with confidentiality. | ||
| CVE-2021-4148 | — | < 5.14.21-150400.24.122.2 | 5.14.21-150400.24.122.2 | Mar 23, 2022 | A vulnerability was found in the Linux kernel's block_invalidatepage in fs/buffer.c in the filesystem. A missing sanity check may allow a local attacker with user privilege to cause a denial of service (DOS) problem. | ||
| CVE-2022-0854 | — | < 5.14.21-150400.24.128.1 | 5.14.21-150400.24.128.1 | Mar 23, 2022 | A memory leak flaw was found in the Linux kernel’s DMA subsystem, in the way a user calls DMA_FROM_DEVICE. This flaw allows a local user to read random memory from the kernel space. | ||
| CVE-2021-39698 | — | < 5.14.21-150400.24.122.2 | 5.14.21-150400.24.122.2 | Mar 16, 2022 | In aio_poll_complete_work of aio.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android ke | ||
| CVE-2021-26341 | — | < 5.14.21-150400.24.11.1 | 5.14.21-150400.24.11.1 | Mar 11, 2022 | Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage. | ||
| CVE-2022-26490 | — | < 5.14.21-150400.24.11.1 | 5.14.21-150400.24.11.1 | Mar 6, 2022 | st21nfca_connectivity_event_received in drivers/nfc/st21nfca/se.c in the Linux kernel through 5.16.12 has EVT_TRANSACTION buffer overflows because of untrusted length parameters. | ||
| CVE-2020-36516 | — | < 5.14.21-150400.24.21.2 | 5.14.21-150400.24.21.2 | Feb 26, 2022 | An issue was discovered in the Linux kernel through 5.16.11. The mixed IPID assignment method with the hash-based IPID assignment policy allows an off-path attacker to inject data into a victim's TCP session or terminate that session. | ||
| CVE-2022-0617 | — | < 5.14.21-150400.24.11.1 | 5.14.21-150400.24.11.1 | Feb 16, 2022 | A flaw null pointer dereference in the Linux kernel UDF file system functionality was found in the way user triggers udf_file_write_iter function for the malicious UDF image. A local user could use this flaw to crash the system. Actual from Linux kernel 4.2-rc1 till 5.17-rc2. | ||
| CVE-2021-44879 | — | < 5.14.21-150400.24.11.1 | 5.14.21-150400.24.11.1 | Feb 13, 2022 | In gc_data_segment in fs/f2fs/gc.c in the Linux kernel before 5.16.3, special files are not considered, leading to a move_data_page NULL pointer dereference. | ||
| CVE-2021-45402 | — | < 5.14.21-150400.24.11.1 | 5.14.21-150400.24.11.1 | Feb 11, 2022 | The check_alu_op() function in kernel/bpf/verifier.c in the Linux kernel through v5.16-rc5 did not properly update bounds while handling the mov32 instruction, which allows local users to obtain potentially sensitive address information, aka a "pointer leak." | ||
| CVE-2021-33061 | — | < 5.14.21-150400.24.11.1 | 5.14.21-150400.24.11.1 | Feb 9, 2022 | Insufficient control flow management for the Intel(R) 82599 Ethernet Controllers and Adapters may allow an authenticated user to potentially enable denial of service via local access. |
- CVE-2022-1734May 18, 2022affected < 5.14.21-150400.24.11.1fixed 5.14.21-150400.24.11.1
A flaw in Linux Kernel found in nfcmrvl_nci_unregister_dev() in drivers/nfc/nfcmrvl/main.c can lead to use after free both read or write when non synchronized between cleanup routine and firmware download routine.
- CVE-2022-29581May 17, 2022affected < 5.14.21-150400.24.18.1fixed 5.14.21-150400.24.18.1
Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to cause privilege escalation to root. This issue affects: Linux Kernel versions prior to 5.18; version 4.14 and later versions.
- CVE-2022-1679May 16, 2022affected < 5.14.21-150400.24.11.1fixed 5.14.21-150400.24.11.1
A use-after-free flaw was found in the Linux kernel’s Atheros wireless adapter driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages. This flaw allows a local user to crash or potentially escalate their privileges on the system.
- CVE-2021-33135May 12, 2022affected < 5.14.21-150400.24.21.2fixed 5.14.21-150400.24.21.2
Uncontrolled resource consumption in the Linux kernel drivers for Intel(R) SGX may allow an authenticated user to potentially enable denial of service via local access.
- CVE-2022-30594May 12, 2022affected < 5.14.21-150400.24.11.1fixed 5.14.21-150400.24.11.1
The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows attackers to bypass intended restrictions on setting the PT_SUSPEND_SECCOMP flag.
- CVE-2022-1048Apr 29, 2022affected < 5.14.21-150400.24.158.1fixed 5.14.21-150400.24.158.1
A use-after-free flaw was found in the Linux kernel’s sound subsystem in the way a user triggers concurrent calls of PCM hw_params. The hw_free ioctls or similar race condition happens inside ALSA PCM for other ioctls. This flaw allows a local user to crash or potentially escalat
- CVE-2022-29582Apr 22, 2022affected < 5.14.21-150400.24.11.1fixed 5.14.21-150400.24.11.1
In the Linux kernel before 5.17.3, fs/io_uring.c has a use-after-free due to a race condition in io_uring timeouts. This can be triggered by a local user who has no access to any user namespace; however, the race condition perhaps can only be exploited infrequently.
- CVE-2022-28356Apr 2, 2022affected < 5.14.21-150400.24.21.2fixed 5.14.21-150400.24.21.2
In the Linux kernel before 5.17.1, a refcount leak bug was found in net/llc/af_llc.c.
- CVE-2022-0995Mar 25, 2022affected < 5.14.21-150400.24.158.1fixed 5.14.21-150400.24.158.1
An out-of-bounds (OOB) memory write flaw was found in the Linux kernel’s watch_queue event notification subsystem. This flaw can overwrite parts of the kernel state, potentially allowing a local user to gain privileged access or cause a denial of service on the system.
- CVE-2022-0494Mar 25, 2022affected < 5.14.21-150400.24.11.1fixed 5.14.21-150400.24.11.1
A kernel information leak flaw was identified in the scsi_ioctl function in drivers/scsi/scsi_ioctl.c in the Linux kernel. This flaw allows a local attacker with a special user privilege (CAP_SYS_ADMIN or CAP_SYS_RAWIO) to create issues with confidentiality.
- CVE-2021-4148Mar 23, 2022affected < 5.14.21-150400.24.122.2fixed 5.14.21-150400.24.122.2
A vulnerability was found in the Linux kernel's block_invalidatepage in fs/buffer.c in the filesystem. A missing sanity check may allow a local attacker with user privilege to cause a denial of service (DOS) problem.
- CVE-2022-0854Mar 23, 2022affected < 5.14.21-150400.24.128.1fixed 5.14.21-150400.24.128.1
A memory leak flaw was found in the Linux kernel’s DMA subsystem, in the way a user calls DMA_FROM_DEVICE. This flaw allows a local user to read random memory from the kernel space.
- CVE-2021-39698Mar 16, 2022affected < 5.14.21-150400.24.122.2fixed 5.14.21-150400.24.122.2
In aio_poll_complete_work of aio.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android ke
- CVE-2021-26341Mar 11, 2022affected < 5.14.21-150400.24.11.1fixed 5.14.21-150400.24.11.1
Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage.
- CVE-2022-26490Mar 6, 2022affected < 5.14.21-150400.24.11.1fixed 5.14.21-150400.24.11.1
st21nfca_connectivity_event_received in drivers/nfc/st21nfca/se.c in the Linux kernel through 5.16.12 has EVT_TRANSACTION buffer overflows because of untrusted length parameters.
- CVE-2020-36516Feb 26, 2022affected < 5.14.21-150400.24.21.2fixed 5.14.21-150400.24.21.2
An issue was discovered in the Linux kernel through 5.16.11. The mixed IPID assignment method with the hash-based IPID assignment policy allows an off-path attacker to inject data into a victim's TCP session or terminate that session.
- CVE-2022-0617Feb 16, 2022affected < 5.14.21-150400.24.11.1fixed 5.14.21-150400.24.11.1
A flaw null pointer dereference in the Linux kernel UDF file system functionality was found in the way user triggers udf_file_write_iter function for the malicious UDF image. A local user could use this flaw to crash the system. Actual from Linux kernel 4.2-rc1 till 5.17-rc2.
- CVE-2021-44879Feb 13, 2022affected < 5.14.21-150400.24.11.1fixed 5.14.21-150400.24.11.1
In gc_data_segment in fs/f2fs/gc.c in the Linux kernel before 5.16.3, special files are not considered, leading to a move_data_page NULL pointer dereference.
- CVE-2021-45402Feb 11, 2022affected < 5.14.21-150400.24.11.1fixed 5.14.21-150400.24.11.1
The check_alu_op() function in kernel/bpf/verifier.c in the Linux kernel through v5.16-rc5 did not properly update bounds while handling the mov32 instruction, which allows local users to obtain potentially sensitive address information, aka a "pointer leak."
- CVE-2021-33061Feb 9, 2022affected < 5.14.21-150400.24.11.1fixed 5.14.21-150400.24.11.1
Insufficient control flow management for the Intel(R) 82599 Ethernet Controllers and Adapters may allow an authenticated user to potentially enable denial of service via local access.
Page 144 of 145