rpm package
suse/kernel-docs&distro=SUSE Linux Enterprise Server 15 SP3-LTSS
pkg:rpm/suse/kernel-docs&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP3-LTSS
Vulnerabilities (1,483)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2021-47097 | — | < 5.3.18-150300.59.158.1 | 5.3.18-150300.59.158.1 | Mar 4, 2024 | In the Linux kernel, the following vulnerability has been resolved: Input: elantech - fix stack out of bound access in elantech_change_report_id() The array param[] in elantech_change_report_id() must be at least 3 bytes, because elantech_read_reg_params() is calling ps2_comman | ||
| CVE-2021-47095 | — | < 5.3.18-150300.59.158.1 | 5.3.18-150300.59.158.1 | Mar 4, 2024 | In the Linux kernel, the following vulnerability has been resolved: ipmi: ssif: initialize ssif_info->client early During probe ssif_info->client is dereferenced in error path. However, it is set when some of the error checking has already been done. This causes following kerne | ||
| CVE-2021-47087 | — | < 5.3.18-150300.59.158.1 | 5.3.18-150300.59.158.1 | Mar 4, 2024 | In the Linux kernel, the following vulnerability has been resolved: tee: optee: Fix incorrect page free bug Pointer to the allocated pages (struct page *page) has already progressed towards the end of allocation. It is incorrect to perform __free_pages(page, order) using this p | ||
| CVE-2021-47083 | — | < 5.3.18-150300.59.153.2 | 5.3.18-150300.59.153.2 | Mar 4, 2024 | In the Linux kernel, the following vulnerability has been resolved: pinctrl: mediatek: fix global-out-of-bounds issue When eint virtual eint number is greater than gpio number, it maybe produce 'desc[eint_n]' size globle-out-of-bounds issue. | ||
| CVE-2021-47082 | — | < 5.3.18-150300.59.158.1 | 5.3.18-150300.59.158.1 | Mar 4, 2024 | In the Linux kernel, the following vulnerability has been resolved: tun: avoid double free in tun_free_netdev Avoid double free in tun_free_netdev() by moving the dev->tstats and tun->security allocs to a new ndo_init routine (tun_net_init()) that will be called by register_net | ||
| CVE-2024-26622 | — | < 5.3.18-150300.59.153.2 | 5.3.18-150300.59.153.2 | Mar 4, 2024 | In the Linux kernel, the following vulnerability has been resolved: tomoyo: fix UAF write bug in tomoyo_write_control() Since tomoyo_write_control() updates head->write_buf when write() of long lines is requested, we need to fetch head->write_buf after head->io_sem is held. Ot | ||
| CVE-2023-52581 | — | < 5.3.18-150300.59.164.1 | 5.3.18-150300.59.164.1 | Mar 2, 2024 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix memleak when more than 255 elements expired When more than 255 elements expired we're supposed to switch to a new gc container structure. This never happens: u8 type will wrap before | ||
| CVE-2023-52574 | — | < 5.3.18-150300.59.153.2 | 5.3.18-150300.59.153.2 | Mar 2, 2024 | In the Linux kernel, the following vulnerability has been resolved: team: fix null-ptr-deref when team device type is changed Get a null-ptr-deref bug as follows with reproducer [1]. BUG: kernel NULL pointer dereference, address: 0000000000000228 ... RIP: 0010:vlan_dev_hard_he | ||
| CVE-2023-52572 | — | < 5.3.18-150300.59.158.1 | 5.3.18-150300.59.158.1 | Mar 2, 2024 | In the Linux kernel, the following vulnerability has been resolved: cifs: Fix UAF in cifs_demultiplex_thread() There is a UAF when xfstests on cifs: BUG: KASAN: use-after-free in smb2_is_network_name_deleted+0x27/0x160 Read of size 4 at addr ffff88810103fc08 by task cifsd/ | ||
| CVE-2023-52569 | — | < 5.3.18-150300.59.153.2 | 5.3.18-150300.59.153.2 | Mar 2, 2024 | In the Linux kernel, the following vulnerability has been resolved: btrfs: remove BUG() after failure to insert delayed dir index item Instead of calling BUG() when we fail to insert a delayed dir index item into the delayed node's tree, we can just release all the resources we | ||
| CVE-2023-52532 | — | < 5.3.18-150300.59.153.2 | 5.3.18-150300.59.153.2 | Mar 2, 2024 | In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix TX CQE error handling For an unknown TX CQE error type (probably from a newer hardware), still free the SKB, update the queue tail, etc., otherwise the accounting will be wrong. Also, TX errors | ||
| CVE-2023-52531 | — | < 5.3.18-150300.59.153.2 | 5.3.18-150300.59.153.2 | Mar 2, 2024 | In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: Fix a memory corruption issue A few lines above, space is kzalloc()'ed for: sizeof(struct iwl_nvm_data) + sizeof(struct ieee80211_channel) + sizeof(struct ieee80211_rate) 'mvm->nvm_data' | ||
| CVE-2023-52530 | — | < 5.3.18-150300.59.153.2 | 5.3.18-150300.59.153.2 | Mar 2, 2024 | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix potential key use-after-free When ieee80211_key_link() is called by ieee80211_gtk_rekey_add() but returns 0 due to KRACK protection (identical key reinstall), ieee80211_gtk_rekey_add() will | ||
| CVE-2023-52524 | — | < 5.3.18-150300.59.185.1 | 5.3.18-150300.59.185.1 | Mar 2, 2024 | In the Linux kernel, the following vulnerability has been resolved: net: nfc: llcp: Add lock when modifying device list The device list needs its associated lock held when modifying it, or the list could become corrupted, as syzbot discovered. | ||
| CVE-2023-52509 | — | < 5.3.18-150300.59.158.1 | 5.3.18-150300.59.158.1 | Mar 2, 2024 | In the Linux kernel, the following vulnerability has been resolved: ravb: Fix use-after-free issue in ravb_tx_timeout_work() The ravb_stop() should call cancel_work_sync(). Otherwise, ravb_tx_timeout_work() is possible to use the freed priv after ravb_remove() was called like b | ||
| CVE-2023-52508 | — | < 5.3.18-150300.59.158.1 | 5.3.18-150300.59.158.1 | Mar 2, 2024 | In the Linux kernel, the following vulnerability has been resolved: nvme-fc: Prevent null pointer dereference in nvme_fc_io_getuuid() The nvme_fc_fcp_op structure describing an AEN operation is initialized with a null request structure pointer. An FC LLDD may make a call to nvm | ||
| CVE-2023-52502 | — | < 5.3.18-150300.59.153.2 | 5.3.18-150300.59.153.2 | Mar 2, 2024 | In the Linux kernel, the following vulnerability has been resolved: net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn() Sili Luo reported a race in nfc_llcp_sock_get(), leading to UAF. Getting a reference on the socket found in a lookup while holding a lock s | ||
| CVE-2023-52500 | — | < 5.3.18-150300.59.158.1 | 5.3.18-150300.59.158.1 | Mar 2, 2024 | In the Linux kernel, the following vulnerability has been resolved: scsi: pm80xx: Avoid leaking tags when processing OPC_INB_SET_CONTROLLER_CONFIG command Tags allocated for OPC_INB_SET_CONTROLLER_CONFIG command need to be freed when we receive the response. | ||
| CVE-2022-48627 | — | < 5.3.18-150300.59.153.2 | 5.3.18-150300.59.153.2 | Mar 2, 2024 | In the Linux kernel, the following vulnerability has been resolved: vt: fix memory overlapping when deleting chars in the buffer A memory overlapping copy occurs when deleting a long line. This memory overlapping copy can cause data corruption when scr_memcpyw is optimized to m | ||
| CVE-2021-47078 | — | < 5.3.18-150300.59.153.2 | 5.3.18-150300.59.153.2 | Mar 1, 2024 | In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Clear all QP fields if creation failed rxe_qp_do_cleanup() relies on valid pointer values in QP for the properly created ones, but in case rxe_qp_from_init() failed it was filled with garbage and caus |
- CVE-2021-47097Mar 4, 2024affected < 5.3.18-150300.59.158.1fixed 5.3.18-150300.59.158.1
In the Linux kernel, the following vulnerability has been resolved: Input: elantech - fix stack out of bound access in elantech_change_report_id() The array param[] in elantech_change_report_id() must be at least 3 bytes, because elantech_read_reg_params() is calling ps2_comman
- CVE-2021-47095Mar 4, 2024affected < 5.3.18-150300.59.158.1fixed 5.3.18-150300.59.158.1
In the Linux kernel, the following vulnerability has been resolved: ipmi: ssif: initialize ssif_info->client early During probe ssif_info->client is dereferenced in error path. However, it is set when some of the error checking has already been done. This causes following kerne
- CVE-2021-47087Mar 4, 2024affected < 5.3.18-150300.59.158.1fixed 5.3.18-150300.59.158.1
In the Linux kernel, the following vulnerability has been resolved: tee: optee: Fix incorrect page free bug Pointer to the allocated pages (struct page *page) has already progressed towards the end of allocation. It is incorrect to perform __free_pages(page, order) using this p
- CVE-2021-47083Mar 4, 2024affected < 5.3.18-150300.59.153.2fixed 5.3.18-150300.59.153.2
In the Linux kernel, the following vulnerability has been resolved: pinctrl: mediatek: fix global-out-of-bounds issue When eint virtual eint number is greater than gpio number, it maybe produce 'desc[eint_n]' size globle-out-of-bounds issue.
- CVE-2021-47082Mar 4, 2024affected < 5.3.18-150300.59.158.1fixed 5.3.18-150300.59.158.1
In the Linux kernel, the following vulnerability has been resolved: tun: avoid double free in tun_free_netdev Avoid double free in tun_free_netdev() by moving the dev->tstats and tun->security allocs to a new ndo_init routine (tun_net_init()) that will be called by register_net
- CVE-2024-26622Mar 4, 2024affected < 5.3.18-150300.59.153.2fixed 5.3.18-150300.59.153.2
In the Linux kernel, the following vulnerability has been resolved: tomoyo: fix UAF write bug in tomoyo_write_control() Since tomoyo_write_control() updates head->write_buf when write() of long lines is requested, we need to fetch head->write_buf after head->io_sem is held. Ot
- CVE-2023-52581Mar 2, 2024affected < 5.3.18-150300.59.164.1fixed 5.3.18-150300.59.164.1
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix memleak when more than 255 elements expired When more than 255 elements expired we're supposed to switch to a new gc container structure. This never happens: u8 type will wrap before
- CVE-2023-52574Mar 2, 2024affected < 5.3.18-150300.59.153.2fixed 5.3.18-150300.59.153.2
In the Linux kernel, the following vulnerability has been resolved: team: fix null-ptr-deref when team device type is changed Get a null-ptr-deref bug as follows with reproducer [1]. BUG: kernel NULL pointer dereference, address: 0000000000000228 ... RIP: 0010:vlan_dev_hard_he
- CVE-2023-52572Mar 2, 2024affected < 5.3.18-150300.59.158.1fixed 5.3.18-150300.59.158.1
In the Linux kernel, the following vulnerability has been resolved: cifs: Fix UAF in cifs_demultiplex_thread() There is a UAF when xfstests on cifs: BUG: KASAN: use-after-free in smb2_is_network_name_deleted+0x27/0x160 Read of size 4 at addr ffff88810103fc08 by task cifsd/
- CVE-2023-52569Mar 2, 2024affected < 5.3.18-150300.59.153.2fixed 5.3.18-150300.59.153.2
In the Linux kernel, the following vulnerability has been resolved: btrfs: remove BUG() after failure to insert delayed dir index item Instead of calling BUG() when we fail to insert a delayed dir index item into the delayed node's tree, we can just release all the resources we
- CVE-2023-52532Mar 2, 2024affected < 5.3.18-150300.59.153.2fixed 5.3.18-150300.59.153.2
In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix TX CQE error handling For an unknown TX CQE error type (probably from a newer hardware), still free the SKB, update the queue tail, etc., otherwise the accounting will be wrong. Also, TX errors
- CVE-2023-52531Mar 2, 2024affected < 5.3.18-150300.59.153.2fixed 5.3.18-150300.59.153.2
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: Fix a memory corruption issue A few lines above, space is kzalloc()'ed for: sizeof(struct iwl_nvm_data) + sizeof(struct ieee80211_channel) + sizeof(struct ieee80211_rate) 'mvm->nvm_data'
- CVE-2023-52530Mar 2, 2024affected < 5.3.18-150300.59.153.2fixed 5.3.18-150300.59.153.2
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix potential key use-after-free When ieee80211_key_link() is called by ieee80211_gtk_rekey_add() but returns 0 due to KRACK protection (identical key reinstall), ieee80211_gtk_rekey_add() will
- CVE-2023-52524Mar 2, 2024affected < 5.3.18-150300.59.185.1fixed 5.3.18-150300.59.185.1
In the Linux kernel, the following vulnerability has been resolved: net: nfc: llcp: Add lock when modifying device list The device list needs its associated lock held when modifying it, or the list could become corrupted, as syzbot discovered.
- CVE-2023-52509Mar 2, 2024affected < 5.3.18-150300.59.158.1fixed 5.3.18-150300.59.158.1
In the Linux kernel, the following vulnerability has been resolved: ravb: Fix use-after-free issue in ravb_tx_timeout_work() The ravb_stop() should call cancel_work_sync(). Otherwise, ravb_tx_timeout_work() is possible to use the freed priv after ravb_remove() was called like b
- CVE-2023-52508Mar 2, 2024affected < 5.3.18-150300.59.158.1fixed 5.3.18-150300.59.158.1
In the Linux kernel, the following vulnerability has been resolved: nvme-fc: Prevent null pointer dereference in nvme_fc_io_getuuid() The nvme_fc_fcp_op structure describing an AEN operation is initialized with a null request structure pointer. An FC LLDD may make a call to nvm
- CVE-2023-52502Mar 2, 2024affected < 5.3.18-150300.59.153.2fixed 5.3.18-150300.59.153.2
In the Linux kernel, the following vulnerability has been resolved: net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn() Sili Luo reported a race in nfc_llcp_sock_get(), leading to UAF. Getting a reference on the socket found in a lookup while holding a lock s
- CVE-2023-52500Mar 2, 2024affected < 5.3.18-150300.59.158.1fixed 5.3.18-150300.59.158.1
In the Linux kernel, the following vulnerability has been resolved: scsi: pm80xx: Avoid leaking tags when processing OPC_INB_SET_CONTROLLER_CONFIG command Tags allocated for OPC_INB_SET_CONTROLLER_CONFIG command need to be freed when we receive the response.
- CVE-2022-48627Mar 2, 2024affected < 5.3.18-150300.59.153.2fixed 5.3.18-150300.59.153.2
In the Linux kernel, the following vulnerability has been resolved: vt: fix memory overlapping when deleting chars in the buffer A memory overlapping copy occurs when deleting a long line. This memory overlapping copy can cause data corruption when scr_memcpyw is optimized to m
- CVE-2021-47078Mar 1, 2024affected < 5.3.18-150300.59.153.2fixed 5.3.18-150300.59.153.2
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Clear all QP fields if creation failed rxe_qp_do_cleanup() relies on valid pointer values in QP for the properly created ones, but in case rxe_qp_from_init() failed it was filled with garbage and caus
Page 55 of 75