suse/kernel-livepatch-SLE15-SP2_Update_25&distro=SUSE Linux Enterprise Live Patching 15 SP2

Vulnerabilities (59)

• CVE-2022-27666Mar 23, 2022
  affected < 3-150200.2.1fixed 3-150200.2.1

  A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and net/ipv6/esp6.c. This flaw allows a local attacker with a normal user privilege to overwrite kernel heap objects and may cause a local privilege escalation threat.

• CVE-2022-1011Mar 18, 2022
  affected < 4-150200.2.1fixed 4-150200.2.1

  A use-after-free flaw was found in the Linux kernel’s FUSE filesystem in the way a user triggers write(). This flaw allows a local user to gain unauthorized access to data from the FUSE filesystem, resulting in privilege escalation.

• CVE-2021-39698Mar 16, 2022
  affected < 3-150200.2.1fixed 3-150200.2.1

  In aio_poll_complete_work of aio.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android ke

• CVE-2022-0002Mar 11, 2022
  affected < 1-5.5.1fixed 1-5.5.1

  Non-transparent sharing of branch predictor within a context in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access.

• CVE-2022-0001Mar 11, 2022
  affected < 1-5.5.1fixed 1-5.5.1

  Non-transparent sharing of branch predictor selectors between contexts in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access.

• CVE-2022-0516Mar 8, 2022
  affected < 1-5.5.1fixed 1-5.5.1

  A vulnerability was found in kvm_s390_guest_sida_op in the arch/s390/kvm/kvm-s390.c function in KVM for s390 in the Linux kernel. This flaw allows a local attacker with a normal user privilege to obtain unauthorized memory write access. This flaw affects Linux kernel versions pri

• CVE-2022-0847KEVMar 7, 2022
  affected < 1-5.5.1fixed 1-5.5.1

  A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus contain stale values. An unprivileged local user could use this flaw to write to

• CVE-2022-26490Mar 6, 2022
  affected < 10-150200.2.2fixed 10-150200.2.2

  st21nfca_connectivity_event_received in drivers/nfc/st21nfca/se.c in the Linux kernel through 5.16.12 has EVT_TRANSACTION buffer overflows because of untrusted length parameters.

• CVE-2022-0492Mar 3, 2022
  affected < 1-5.5.1fixed 1-5.5.1

  A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpecte

• CVE-2020-36516Feb 26, 2022
  affected < 11-150200.2.2fixed 11-150200.2.2

  An issue was discovered in the Linux kernel through 5.16.11. The mixed IPID assignment method with the hash-based IPID assignment policy allows an off-path attacker to inject data into a victim's TCP session or terminate that session.

• CVE-2022-25375Feb 20, 2022
  affected < 1-5.5.1fixed 1-5.5.1

  An issue was discovered in drivers/usb/gadget/function/rndis.c in the Linux kernel before 5.16.10. The RNDIS USB gadget lacks validation of the size of the RNDIS_MSG_SET command. Attackers can obtain sensitive information from kernel memory.

• CVE-2022-0617Feb 16, 2022
  affected < 1-5.5.1fixed 1-5.5.1

  A flaw null pointer dereference in the Linux kernel UDF file system functionality was found in the way user triggers udf_file_write_iter function for the malicious UDF image. A local user could use this flaw to crash the system. Actual from Linux kernel 4.2-rc1 till 5.17-rc2.

• CVE-2022-25258Feb 16, 2022
  affected < 1-5.5.1fixed 1-5.5.1

  An issue was discovered in drivers/usb/gadget/composite.c in the Linux kernel before 5.16.10. The USB Gadget subsystem lacks certain validation of interface OS descriptor requests (ones with a large array index and ones associated with NULL function pointer retrieval). Memory cor

• CVE-2021-44879Feb 13, 2022
  affected < 1-5.5.1fixed 1-5.5.1

  In gc_data_segment in fs/f2fs/gc.c in the Linux kernel before 5.16.3, special files are not considered, leading to a move_data_page NULL pointer dereference.

• CVE-2022-24958Feb 11, 2022
  affected < 1-5.5.1fixed 1-5.5.1

  drivers/usb/gadget/legacy/inode.c in the Linux kernel through 5.16.8 mishandles dev->buf release.

• CVE-2022-24959Feb 11, 2022
  affected < 1-5.5.1fixed 1-5.5.1

  An issue was discovered in the Linux kernel before 5.16.5. There is a memory leak in yam_siocdevprivate in drivers/net/hamradio/yam.c.

• CVE-2022-0487Feb 4, 2022
  affected < 1-5.5.1fixed 1-5.5.1

  A use-after-free vulnerability was found in rtsx_usb_ms_drv_remove in drivers/memstick/host/rtsx_usb_ms.c in memstick in the Linux kernel. In this flaw, a local attacker with a user privilege may impact system Confidentiality. This flaw affects kernel versions prior to 5.14 rc1.

• CVE-2022-24448Feb 4, 2022
  affected < 1-5.5.1fixed 1-5.5.1

  An issue was discovered in fs/nfs/dir.c in the Linux kernel before 5.16.5. If an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should occur, but the server instead returns

• CVE-2021-0920KEVDec 15, 2021
  affected < 2-150200.2.1fixed 2-150200.2.1

  In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndro