suse/kernel-docs&distro=SUSE Linux Enterprise Server for SAP Applications 15

Vulnerabilities (387)

• CVE-2022-36946HigJul 27, 2022
  affected < 4.12.14-150000.150.98.2fixed 4.12.14-150000.150.98.2

  nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote attackers to cause a denial of service (panic) because, in the case of an nf_queue verdict with a one-byte nfta_payload attribute, an skb_pull can encounter a negative skb->len.

• CVE-2022-36879MedJul 27, 2022
  affected < 4.12.14-150000.150.101.1fixed 4.12.14-150000.150.101.1

  An issue was discovered in the Linux kernel through 5.18.14. xfrm_expand_policies in net/xfrm/xfrm_policy.c can cause a refcount to be dropped twice.

• CVE-2020-36558MedJul 21, 2022
  affected < 4.12.14-150000.150.98.2fixed 4.12.14-150000.150.98.2

  A race condition in the Linux kernel before 5.5.7 involving VT_RESIZEX could lead to a NULL pointer dereference and general protection fault.

• CVE-2020-36557MedJul 21, 2022
  affected < 4.12.14-150000.150.98.2fixed 4.12.14-150000.150.98.2

  A race condition in the Linux kernel before 5.6.2 between the VT_DISALLOCATE ioctl and closing/opening of ttys could lead to a use-after-free.

• CVE-2021-33656MedJul 18, 2022
  affected < 4.12.14-150000.150.98.2fixed 4.12.14-150000.150.98.2

  When setting font with malicous data by ioctl cmd PIO_FONT,kernel will write memory out of bounds.

• CVE-2021-33655MedJul 18, 2022
  affected < 4.12.14-150000.150.98.2fixed 4.12.14-150000.150.98.2

  When sending malicous data to kernel by ioctl cmd FBIOPUT_VSCREENINFO,kernel will write memory out of bounds.

• CVE-2022-29901MedJul 12, 2022
  affected < 4.12.14-150000.150.95.1fixed 4.12.14-150000.150.95.1

  Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can hijack return instructions to achieve arbitrary speculative code exe

• CVE-2022-29900MedJul 12, 2022
  affected < 4.12.14-150000.150.95.1fixed 4.12.14-150000.150.95.1

  Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution under certain microarchitecture-dependent conditions.

• CVE-2022-2318MedJul 6, 2022
  affected < 4.12.14-150000.150.95.1fixed 4.12.14-150000.150.95.1

  There are use-after-free vulnerabilities caused by timer handler in net/rose/rose_timer.c of linux that allow attackers to crash linux kernel without any privileges.

• CVE-2022-33742HigJul 5, 2022
  affected < 4.12.14-150000.150.95.1fixed 4.12.14-150000.150.95.1

  Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device frontends don't zero memory regions before sharing them with the backend (CVE-202

• CVE-2022-33741HigJul 5, 2022
  affected < 4.12.14-150000.150.95.1fixed 4.12.14-150000.150.95.1

  Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device frontends don't zero memory regions before sharing them with the backend (CVE-202

• CVE-2022-33740HigJul 5, 2022
  affected < 4.12.14-150000.150.95.1fixed 4.12.14-150000.150.95.1

  Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device frontends don't zero memory regions before sharing them with the backend (CVE-202

• CVE-2022-26365HigJul 5, 2022
  affected < 4.12.14-150000.150.95.1fixed 4.12.14-150000.150.95.1

  Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device frontends don't zero memory regions before sharing them with the backend (CVE-202

• CVE-2022-33981LowJun 18, 2022
  affected < 4.12.14-150000.150.95.1fixed 4.12.14-150000.150.95.1

  drivers/block/floppy.c in the Linux kernel before 5.17.6 is vulnerable to a denial of service, because of a concurrency use-after-free flaw after deallocating raw_cmd in the raw_cmd_ioctl function.

• CVE-2022-21180MedJun 15, 2022
  affected < 4.12.14-150000.150.92.2fixed 4.12.14-150000.150.92.2

  Improper input validation for some Intel(R) Processors may allow an authenticated user to potentially cause a denial of service via local access.

• CVE-2022-21166MedJun 15, 2022
  affected < 4.12.14-150000.150.92.2fixed 4.12.14-150000.150.92.2

  Incomplete cleanup in specific special register write operations for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.

• CVE-2022-21127MedJun 15, 2022
  affected < 4.12.14-150000.150.92.2fixed 4.12.14-150000.150.92.2

  Incomplete cleanup in specific special register read operations for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.

• CVE-2022-21125MedJun 15, 2022
  affected < 4.12.14-150000.150.92.2fixed 4.12.14-150000.150.92.2

  Incomplete cleanup of microarchitectural fill buffers on some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.

• CVE-2022-21123MedJun 15, 2022
  affected < 4.12.14-150000.150.92.2fixed 4.12.14-150000.150.92.2

  Incomplete cleanup of multi-core shared buffers for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.

• CVE-2022-20166MedJun 15, 2022
  affected < 4.12.14-150000.150.98.2fixed 4.12.14-150000.150.98.2

  In various methods of kernel base drivers, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: An