rpm package
suse/kernel-default-base&distro=SUSE Linux Enterprise Micro 5.0
pkg:rpm/suse/kernel-default-base&distro=SUSE%20Linux%20Enterprise%20Micro%205.0
Vulnerabilities (174)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2021-3428 | — | < 5.3.18-24.61.1.9.26.4 | 5.3.18-24.61.1.9.26.4 | Mar 4, 2022 | A flaw was found in the Linux kernel. A denial of service problem is identified if an extent tree is corrupted in a crafted ext4 filesystem in fs/ext4/extents.c in ext4_es_cache_extent. Fabricating an integer overflow, A local attacker with a special user privilege may cause a sy | ||
| CVE-2021-3744 | — | < 5.3.18-24.86.2.9.40.2 | 5.3.18-24.86.2.9.40.2 | Mar 4, 2022 | A memory leak flaw was found in the Linux kernel in the ccp_run_aes_gcm_cmd() function in drivers/crypto/ccp/ccp-ops.c, which allows attackers to cause a denial of service (memory consumption). This vulnerability is similar with the older CVE-2019-18808. | ||
| CVE-2021-3743 | — | < 5.3.18-24.83.2.9.38.3 | 5.3.18-24.83.2.9.38.3 | Mar 4, 2022 | An out-of-bounds (OOB) memory read flaw was found in the Qualcomm IPC router protocol in the Linux kernel. A missing sanity check allows a local attacker to gain access to out-of-bounds memory, leading to a system crash or a leak of internal kernel information. The highest threat | ||
| CVE-2021-3640 | — | < 5.3.18-24.83.2.9.38.3 | 5.3.18-24.83.2.9.38.3 | Mar 3, 2022 | A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel HCI subsystem was found in the way user calls ioct UFFDIO_REGISTER or other way triggers race condition of the call sco_conn_del() together with the call sco_sock_sendmsg() with the expected controllable fau | ||
| CVE-2021-4002 | — | < 5.3.18-24.99.1.9.46.1 | 5.3.18-24.99.1.9.46.1 | Mar 3, 2022 | A memory leak flaw in the Linux kernel's hugetlbfs memory usage was found in the way the user maps some regions of memory twice using shmget() which are aligned to PUD alignment with the fault of some of the memory pages. A local user could use this flaw to get unauthorized acces | ||
| CVE-2021-3609 | — | < 5.3.18-24.75.3.9.34.3 | 5.3.18-24.75.3.9.34.3 | Mar 3, 2022 | .A flaw was found in the CAN BCM networking protocol in the Linux kernel, where a local attacker can abuse a flaw in the CAN subsystem to corrupt memory, crash the system or escalate privileges. This race condition in net/can/bcm.c in the Linux kernel allows for local privilege e | ||
| CVE-2022-0492 | — | < 5.3.18-24.107.1.9.50.2 | 5.3.18-24.107.1.9.50.2 | Mar 3, 2022 | A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpecte | ||
| CVE-2021-3715 | — | < 5.3.18-24.93.1.9.42.5 | 5.3.18-24.93.1.9.42.5 | Mar 2, 2022 | A flaw was found in the "Routing decision" classifier in the Linux kernel's Traffic Control networking subsystem in the way it handled changing of classification filters, leading to a use-after-free condition. This flaw allows unprivileged local users to escalate their privileges | ||
| CVE-2021-3772 | — | < 5.3.18-24.93.1.9.42.5 | 5.3.18-24.93.1.9.42.5 | Mar 2, 2022 | A flaw was found in the Linux SCTP stack. A blind attacker may be able to kill an existing SCTP association through invalid chunks if the attacker knows the IP-addresses and port numbers being used and the attacker can send packets with spoofed IP addresses. | ||
| CVE-2022-25375 | — | < 5.3.18-24.107.1.9.50.2 | 5.3.18-24.107.1.9.50.2 | Feb 20, 2022 | An issue was discovered in drivers/usb/gadget/function/rndis.c in the Linux kernel before 5.16.10. The RNDIS USB gadget lacks validation of the size of the RNDIS_MSG_SET command. Attackers can obtain sensitive information from kernel memory. | ||
| CVE-2021-20322 | — | < 5.3.18-24.96.1.9.44.1 | 5.3.18-24.96.1.9.44.1 | Feb 18, 2022 | A flaw in the processing of received ICMP errors (ICMP fragment needed and ICMP redirect) in the Linux kernel functionality was found to allow the ability to quickly scan open UDP ports. This flaw allows an off-path remote user to effectively bypass the source port UDP randomizat | ||
| CVE-2021-3752 | — | < 5.3.18-24.86.2.9.40.2 | 5.3.18-24.86.2.9.40.2 | Feb 16, 2022 | A use-after-free flaw was found in the Linux kernel’s Bluetooth subsystem in the way user calls connect to the socket and disconnect simultaneously due to a race condition. This flaw allows a user to crash the system or escalate their privileges. The highest threat from this vuln | ||
| CVE-2021-3760 | — | < 5.3.18-24.93.1.9.42.5 | 5.3.18-24.93.1.9.42.5 | Feb 16, 2022 | A flaw was found in the Linux kernel. A use-after-free vulnerability in the NFC stack can lead to a threat to confidentiality, integrity, and system availability. | ||
| CVE-2022-0617 | — | < 5.3.18-24.107.1.9.50.2 | 5.3.18-24.107.1.9.50.2 | Feb 16, 2022 | A flaw null pointer dereference in the Linux kernel UDF file system functionality was found in the way user triggers udf_file_write_iter function for the malicious UDF image. A local user could use this flaw to crash the system. Actual from Linux kernel 4.2-rc1 till 5.17-rc2. | ||
| CVE-2022-25258 | — | < 5.3.18-24.107.1.9.50.2 | 5.3.18-24.107.1.9.50.2 | Feb 16, 2022 | An issue was discovered in drivers/usb/gadget/composite.c in the Linux kernel before 5.16.10. The USB Gadget subsystem lacks certain validation of interface OS descriptor requests (ones with a large array index and ones associated with NULL function pointer retrieval). Memory cor | ||
| CVE-2021-3753 | — | < 5.3.18-24.83.2.9.38.3 | 5.3.18-24.83.2.9.38.3 | Feb 16, 2022 | A race problem was seen in the vt_k_ioctl in drivers/tty/vt/vt_ioctl.c in the Linux kernel, which may cause an out of bounds read in vt as the write access to vc_mode is not protected by lock-in vt_ioctl (KDSETMDE). The highest threat from this vulnerability is to data confidenti | ||
| CVE-2021-44879 | — | < 5.3.18-24.107.1.9.50.2 | 5.3.18-24.107.1.9.50.2 | Feb 13, 2022 | In gc_data_segment in fs/f2fs/gc.c in the Linux kernel before 5.16.3, special files are not considered, leading to a move_data_page NULL pointer dereference. | ||
| CVE-2022-0185 | — | KEV | < 5.3.18-24.99.1.9.46.1 | 5.3.18-24.99.1.9.46.1 | Feb 11, 2022 | A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functionality of the Linux kernel verified the supplied parameters length. An unprivileged (in case of unprivileged user namespaces enabled, otherwise needs namespaced | |
| CVE-2022-24958 | — | < 5.3.18-24.107.1.9.50.2 | 5.3.18-24.107.1.9.50.2 | Feb 11, 2022 | drivers/usb/gadget/legacy/inode.c in the Linux kernel through 5.16.8 mishandles dev->buf release. | ||
| CVE-2022-24959 | — | < 5.3.18-24.107.1.9.50.2 | 5.3.18-24.107.1.9.50.2 | Feb 11, 2022 | An issue was discovered in the Linux kernel before 5.16.5. There is a memory leak in yam_siocdevprivate in drivers/net/hamradio/yam.c. |
- CVE-2021-3428Mar 4, 2022affected < 5.3.18-24.61.1.9.26.4fixed 5.3.18-24.61.1.9.26.4
A flaw was found in the Linux kernel. A denial of service problem is identified if an extent tree is corrupted in a crafted ext4 filesystem in fs/ext4/extents.c in ext4_es_cache_extent. Fabricating an integer overflow, A local attacker with a special user privilege may cause a sy
- CVE-2021-3744Mar 4, 2022affected < 5.3.18-24.86.2.9.40.2fixed 5.3.18-24.86.2.9.40.2
A memory leak flaw was found in the Linux kernel in the ccp_run_aes_gcm_cmd() function in drivers/crypto/ccp/ccp-ops.c, which allows attackers to cause a denial of service (memory consumption). This vulnerability is similar with the older CVE-2019-18808.
- CVE-2021-3743Mar 4, 2022affected < 5.3.18-24.83.2.9.38.3fixed 5.3.18-24.83.2.9.38.3
An out-of-bounds (OOB) memory read flaw was found in the Qualcomm IPC router protocol in the Linux kernel. A missing sanity check allows a local attacker to gain access to out-of-bounds memory, leading to a system crash or a leak of internal kernel information. The highest threat
- CVE-2021-3640Mar 3, 2022affected < 5.3.18-24.83.2.9.38.3fixed 5.3.18-24.83.2.9.38.3
A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel HCI subsystem was found in the way user calls ioct UFFDIO_REGISTER or other way triggers race condition of the call sco_conn_del() together with the call sco_sock_sendmsg() with the expected controllable fau
- CVE-2021-4002Mar 3, 2022affected < 5.3.18-24.99.1.9.46.1fixed 5.3.18-24.99.1.9.46.1
A memory leak flaw in the Linux kernel's hugetlbfs memory usage was found in the way the user maps some regions of memory twice using shmget() which are aligned to PUD alignment with the fault of some of the memory pages. A local user could use this flaw to get unauthorized acces
- CVE-2021-3609Mar 3, 2022affected < 5.3.18-24.75.3.9.34.3fixed 5.3.18-24.75.3.9.34.3
.A flaw was found in the CAN BCM networking protocol in the Linux kernel, where a local attacker can abuse a flaw in the CAN subsystem to corrupt memory, crash the system or escalate privileges. This race condition in net/can/bcm.c in the Linux kernel allows for local privilege e
- CVE-2022-0492Mar 3, 2022affected < 5.3.18-24.107.1.9.50.2fixed 5.3.18-24.107.1.9.50.2
A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpecte
- CVE-2021-3715Mar 2, 2022affected < 5.3.18-24.93.1.9.42.5fixed 5.3.18-24.93.1.9.42.5
A flaw was found in the "Routing decision" classifier in the Linux kernel's Traffic Control networking subsystem in the way it handled changing of classification filters, leading to a use-after-free condition. This flaw allows unprivileged local users to escalate their privileges
- CVE-2021-3772Mar 2, 2022affected < 5.3.18-24.93.1.9.42.5fixed 5.3.18-24.93.1.9.42.5
A flaw was found in the Linux SCTP stack. A blind attacker may be able to kill an existing SCTP association through invalid chunks if the attacker knows the IP-addresses and port numbers being used and the attacker can send packets with spoofed IP addresses.
- CVE-2022-25375Feb 20, 2022affected < 5.3.18-24.107.1.9.50.2fixed 5.3.18-24.107.1.9.50.2
An issue was discovered in drivers/usb/gadget/function/rndis.c in the Linux kernel before 5.16.10. The RNDIS USB gadget lacks validation of the size of the RNDIS_MSG_SET command. Attackers can obtain sensitive information from kernel memory.
- CVE-2021-20322Feb 18, 2022affected < 5.3.18-24.96.1.9.44.1fixed 5.3.18-24.96.1.9.44.1
A flaw in the processing of received ICMP errors (ICMP fragment needed and ICMP redirect) in the Linux kernel functionality was found to allow the ability to quickly scan open UDP ports. This flaw allows an off-path remote user to effectively bypass the source port UDP randomizat
- CVE-2021-3752Feb 16, 2022affected < 5.3.18-24.86.2.9.40.2fixed 5.3.18-24.86.2.9.40.2
A use-after-free flaw was found in the Linux kernel’s Bluetooth subsystem in the way user calls connect to the socket and disconnect simultaneously due to a race condition. This flaw allows a user to crash the system or escalate their privileges. The highest threat from this vuln
- CVE-2021-3760Feb 16, 2022affected < 5.3.18-24.93.1.9.42.5fixed 5.3.18-24.93.1.9.42.5
A flaw was found in the Linux kernel. A use-after-free vulnerability in the NFC stack can lead to a threat to confidentiality, integrity, and system availability.
- CVE-2022-0617Feb 16, 2022affected < 5.3.18-24.107.1.9.50.2fixed 5.3.18-24.107.1.9.50.2
A flaw null pointer dereference in the Linux kernel UDF file system functionality was found in the way user triggers udf_file_write_iter function for the malicious UDF image. A local user could use this flaw to crash the system. Actual from Linux kernel 4.2-rc1 till 5.17-rc2.
- CVE-2022-25258Feb 16, 2022affected < 5.3.18-24.107.1.9.50.2fixed 5.3.18-24.107.1.9.50.2
An issue was discovered in drivers/usb/gadget/composite.c in the Linux kernel before 5.16.10. The USB Gadget subsystem lacks certain validation of interface OS descriptor requests (ones with a large array index and ones associated with NULL function pointer retrieval). Memory cor
- CVE-2021-3753Feb 16, 2022affected < 5.3.18-24.83.2.9.38.3fixed 5.3.18-24.83.2.9.38.3
A race problem was seen in the vt_k_ioctl in drivers/tty/vt/vt_ioctl.c in the Linux kernel, which may cause an out of bounds read in vt as the write access to vc_mode is not protected by lock-in vt_ioctl (KDSETMDE). The highest threat from this vulnerability is to data confidenti
- CVE-2021-44879Feb 13, 2022affected < 5.3.18-24.107.1.9.50.2fixed 5.3.18-24.107.1.9.50.2
In gc_data_segment in fs/f2fs/gc.c in the Linux kernel before 5.16.3, special files are not considered, leading to a move_data_page NULL pointer dereference.
- affected < 5.3.18-24.99.1.9.46.1fixed 5.3.18-24.99.1.9.46.1
A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functionality of the Linux kernel verified the supplied parameters length. An unprivileged (in case of unprivileged user namespaces enabled, otherwise needs namespaced
- CVE-2022-24958Feb 11, 2022affected < 5.3.18-24.107.1.9.50.2fixed 5.3.18-24.107.1.9.50.2
drivers/usb/gadget/legacy/inode.c in the Linux kernel through 5.16.8 mishandles dev->buf release.
- CVE-2022-24959Feb 11, 2022affected < 5.3.18-24.107.1.9.50.2fixed 5.3.18-24.107.1.9.50.2
An issue was discovered in the Linux kernel before 5.16.5. There is a memory leak in yam_siocdevprivate in drivers/net/hamradio/yam.c.
Page 3 of 9