rpm package
suse/kernel-preempt&distro=SUSE Enterprise Storage 7
pkg:rpm/suse/kernel-preempt&distro=SUSE%20Enterprise%20Storage%207
Vulnerabilities (279)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2022-0492 | — | < 5.3.18-24.107.1 | 5.3.18-24.107.1 | Mar 3, 2022 | A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpecte | ||
| CVE-2020-36516 | — | < 5.3.18-150200.24.129.1 | 5.3.18-150200.24.129.1 | Feb 26, 2022 | An issue was discovered in the Linux kernel through 5.16.11. The mixed IPID assignment method with the hash-based IPID assignment policy allows an off-path attacker to inject data into a victim's TCP session or terminate that session. | ||
| CVE-2022-25375 | — | < 5.3.18-24.107.1 | 5.3.18-24.107.1 | Feb 20, 2022 | An issue was discovered in drivers/usb/gadget/function/rndis.c in the Linux kernel before 5.16.10. The RNDIS USB gadget lacks validation of the size of the RNDIS_MSG_SET command. Attackers can obtain sensitive information from kernel memory. | ||
| CVE-2021-20321 | — | < 5.3.18-150200.24.115.1 | 5.3.18-150200.24.115.1 | Feb 18, 2022 | A race condition accessing file object in the Linux kernel OverlayFS subsystem was found in the way users do rename in specific way with OverlayFS. A local user could use this flaw to crash the system. | ||
| CVE-2022-0617 | — | < 5.3.18-24.107.1 | 5.3.18-24.107.1 | Feb 16, 2022 | A flaw null pointer dereference in the Linux kernel UDF file system functionality was found in the way user triggers udf_file_write_iter function for the malicious UDF image. A local user could use this flaw to crash the system. Actual from Linux kernel 4.2-rc1 till 5.17-rc2. | ||
| CVE-2022-25258 | — | < 5.3.18-24.107.1 | 5.3.18-24.107.1 | Feb 16, 2022 | An issue was discovered in drivers/usb/gadget/composite.c in the Linux kernel before 5.16.10. The USB Gadget subsystem lacks certain validation of interface OS descriptor requests (ones with a large array index and ones associated with NULL function pointer retrieval). Memory cor | ||
| CVE-2021-44879 | — | < 5.3.18-24.107.1 | 5.3.18-24.107.1 | Feb 13, 2022 | In gc_data_segment in fs/f2fs/gc.c in the Linux kernel before 5.16.3, special files are not considered, leading to a move_data_page NULL pointer dereference. | ||
| CVE-2022-0185 | — | KEV | < 5.3.18-24.99.1 | 5.3.18-24.99.1 | Feb 11, 2022 | A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functionality of the Linux kernel verified the supplied parameters length. An unprivileged (in case of unprivileged user namespaces enabled, otherwise needs namespaced | |
| CVE-2022-24958 | — | < 5.3.18-24.107.1 | 5.3.18-24.107.1 | Feb 11, 2022 | drivers/usb/gadget/legacy/inode.c in the Linux kernel through 5.16.8 mishandles dev->buf release. | ||
| CVE-2022-24959 | — | < 5.3.18-24.107.1 | 5.3.18-24.107.1 | Feb 11, 2022 | An issue was discovered in the Linux kernel before 5.16.5. There is a memory leak in yam_siocdevprivate in drivers/net/hamradio/yam.c. | ||
| CVE-2021-33061 | — | < 5.3.18-150200.24.115.1 | 5.3.18-150200.24.115.1 | Feb 9, 2022 | Insufficient control flow management for the Intel(R) 82599 Ethernet Controllers and Adapters may allow an authenticated user to potentially enable denial of service via local access. | ||
| CVE-2022-0487 | — | < 5.3.18-24.107.1 | 5.3.18-24.107.1 | Feb 4, 2022 | A use-after-free vulnerability was found in rtsx_usb_ms_drv_remove in drivers/memstick/host/rtsx_usb_ms.c in memstick in the Linux kernel. In this flaw, a local attacker with a user privilege may impact system Confidentiality. This flaw affects kernel versions prior to 5.14 rc1. | ||
| CVE-2022-24448 | — | < 5.3.18-24.107.1 | 5.3.18-24.107.1 | Feb 4, 2022 | An issue was discovered in fs/nfs/dir.c in the Linux kernel before 5.16.5. If an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should occur, but the server instead returns | ||
| CVE-2021-22600 | — | KEV | < 5.3.18-24.102.1 | 5.3.18-24.102.1 | Jan 26, 2022 | A double free bug in packet_set_ring() in net/packet/af_packet.c can be exploited by a local user through crafted syscalls to escalate privileges or deny service. We recommend upgrading kernel past the effected versions or rebuilding past ec6af094ea28f0f2dda1a6a33b14cd57e36a9755 | |
| CVE-2021-4001 | — | < 5.3.18-24.99.1 | 5.3.18-24.99.1 | Jan 21, 2022 | A race condition was found in the Linux kernel's ebpf verifier between bpf_map_update_elem and bpf_map_freeze due to a missing lock in kernel/bpf/syscall.c. In this flaw, a local user with a special privilege (cap_sys_admin or cap_bpf) can modify the frozen mapped address space. | ||
| CVE-2021-4083 | — | < 5.3.18-24.99.1 | 5.3.18-24.99.1 | Jan 18, 2022 | A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket file handlers in the way users call close() and fget() simultaneously and can potentially trigger a race condition. This flaw allows a local user to crash the system or escalat | ||
| CVE-2021-28715 | — | < 5.3.18-24.99.1 | 5.3.18-24.99.1 | Jan 6, 2022 | Guest can force Linux netback driver to hog large amounts of kernel memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Incoming data packets for a guest in the Linux kernel's netback driver are b | ||
| CVE-2021-28714 | — | < 5.3.18-24.99.1 | 5.3.18-24.99.1 | Jan 6, 2022 | Guest can force Linux netback driver to hog large amounts of kernel memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Incoming data packets for a guest in the Linux kernel's netback driver are b | ||
| CVE-2021-28713 | — | < 5.3.18-24.99.1 | 5.3.18-24.99.1 | Jan 5, 2022 | Rogue backends can cause DoS of guests via high frequency events T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Xen offers the ability to run PV backends in regular unprivileged guests, typically re | ||
| CVE-2021-28712 | — | < 5.3.18-24.99.1 | 5.3.18-24.99.1 | Jan 5, 2022 | Rogue backends can cause DoS of guests via high frequency events T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Xen offers the ability to run PV backends in regular unprivileged guests, typically re |
- CVE-2022-0492Mar 3, 2022affected < 5.3.18-24.107.1fixed 5.3.18-24.107.1
A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpecte
- CVE-2020-36516Feb 26, 2022affected < 5.3.18-150200.24.129.1fixed 5.3.18-150200.24.129.1
An issue was discovered in the Linux kernel through 5.16.11. The mixed IPID assignment method with the hash-based IPID assignment policy allows an off-path attacker to inject data into a victim's TCP session or terminate that session.
- CVE-2022-25375Feb 20, 2022affected < 5.3.18-24.107.1fixed 5.3.18-24.107.1
An issue was discovered in drivers/usb/gadget/function/rndis.c in the Linux kernel before 5.16.10. The RNDIS USB gadget lacks validation of the size of the RNDIS_MSG_SET command. Attackers can obtain sensitive information from kernel memory.
- CVE-2021-20321Feb 18, 2022affected < 5.3.18-150200.24.115.1fixed 5.3.18-150200.24.115.1
A race condition accessing file object in the Linux kernel OverlayFS subsystem was found in the way users do rename in specific way with OverlayFS. A local user could use this flaw to crash the system.
- CVE-2022-0617Feb 16, 2022affected < 5.3.18-24.107.1fixed 5.3.18-24.107.1
A flaw null pointer dereference in the Linux kernel UDF file system functionality was found in the way user triggers udf_file_write_iter function for the malicious UDF image. A local user could use this flaw to crash the system. Actual from Linux kernel 4.2-rc1 till 5.17-rc2.
- CVE-2022-25258Feb 16, 2022affected < 5.3.18-24.107.1fixed 5.3.18-24.107.1
An issue was discovered in drivers/usb/gadget/composite.c in the Linux kernel before 5.16.10. The USB Gadget subsystem lacks certain validation of interface OS descriptor requests (ones with a large array index and ones associated with NULL function pointer retrieval). Memory cor
- CVE-2021-44879Feb 13, 2022affected < 5.3.18-24.107.1fixed 5.3.18-24.107.1
In gc_data_segment in fs/f2fs/gc.c in the Linux kernel before 5.16.3, special files are not considered, leading to a move_data_page NULL pointer dereference.
- affected < 5.3.18-24.99.1fixed 5.3.18-24.99.1
A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functionality of the Linux kernel verified the supplied parameters length. An unprivileged (in case of unprivileged user namespaces enabled, otherwise needs namespaced
- CVE-2022-24958Feb 11, 2022affected < 5.3.18-24.107.1fixed 5.3.18-24.107.1
drivers/usb/gadget/legacy/inode.c in the Linux kernel through 5.16.8 mishandles dev->buf release.
- CVE-2022-24959Feb 11, 2022affected < 5.3.18-24.107.1fixed 5.3.18-24.107.1
An issue was discovered in the Linux kernel before 5.16.5. There is a memory leak in yam_siocdevprivate in drivers/net/hamradio/yam.c.
- CVE-2021-33061Feb 9, 2022affected < 5.3.18-150200.24.115.1fixed 5.3.18-150200.24.115.1
Insufficient control flow management for the Intel(R) 82599 Ethernet Controllers and Adapters may allow an authenticated user to potentially enable denial of service via local access.
- CVE-2022-0487Feb 4, 2022affected < 5.3.18-24.107.1fixed 5.3.18-24.107.1
A use-after-free vulnerability was found in rtsx_usb_ms_drv_remove in drivers/memstick/host/rtsx_usb_ms.c in memstick in the Linux kernel. In this flaw, a local attacker with a user privilege may impact system Confidentiality. This flaw affects kernel versions prior to 5.14 rc1.
- CVE-2022-24448Feb 4, 2022affected < 5.3.18-24.107.1fixed 5.3.18-24.107.1
An issue was discovered in fs/nfs/dir.c in the Linux kernel before 5.16.5. If an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should occur, but the server instead returns
- affected < 5.3.18-24.102.1fixed 5.3.18-24.102.1
A double free bug in packet_set_ring() in net/packet/af_packet.c can be exploited by a local user through crafted syscalls to escalate privileges or deny service. We recommend upgrading kernel past the effected versions or rebuilding past ec6af094ea28f0f2dda1a6a33b14cd57e36a9755
- CVE-2021-4001Jan 21, 2022affected < 5.3.18-24.99.1fixed 5.3.18-24.99.1
A race condition was found in the Linux kernel's ebpf verifier between bpf_map_update_elem and bpf_map_freeze due to a missing lock in kernel/bpf/syscall.c. In this flaw, a local user with a special privilege (cap_sys_admin or cap_bpf) can modify the frozen mapped address space.
- CVE-2021-4083Jan 18, 2022affected < 5.3.18-24.99.1fixed 5.3.18-24.99.1
A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket file handlers in the way users call close() and fget() simultaneously and can potentially trigger a race condition. This flaw allows a local user to crash the system or escalat
- CVE-2021-28715Jan 6, 2022affected < 5.3.18-24.99.1fixed 5.3.18-24.99.1
Guest can force Linux netback driver to hog large amounts of kernel memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Incoming data packets for a guest in the Linux kernel's netback driver are b
- CVE-2021-28714Jan 6, 2022affected < 5.3.18-24.99.1fixed 5.3.18-24.99.1
Guest can force Linux netback driver to hog large amounts of kernel memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Incoming data packets for a guest in the Linux kernel's netback driver are b
- CVE-2021-28713Jan 5, 2022affected < 5.3.18-24.99.1fixed 5.3.18-24.99.1
Rogue backends can cause DoS of guests via high frequency events T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Xen offers the ability to run PV backends in regular unprivileged guests, typically re
- CVE-2021-28712Jan 5, 2022affected < 5.3.18-24.99.1fixed 5.3.18-24.99.1
Rogue backends can cause DoS of guests via high frequency events T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Xen offers the ability to run PV backends in regular unprivileged guests, typically re
Page 13 of 14