suse/kgraft-patch-SLE12-SP5_Update_62&distro=SUSE Linux Enterprise Live Patching 12 SP5

Vulnerabilities (135)

• CVE-2024-50045MedOct 21, 2024
  affected < 1-8.3.1fixed 1-8.3.1

  In the Linux kernel, the following vulnerability has been resolved: netfilter: br_netfilter: fix panic with metadata_dst skb Fix a kernel panic in the br_netfilter module when sending untagged traffic via a VxLAN device. This happens during the check for fragmentation in br_nf_

• CVE-2024-50035HigOct 21, 2024
  affected < 1-8.3.1fixed 1-8.3.1

  In the Linux kernel, the following vulnerability has been resolved: ppp: fix ppp_async_encode() illegal access syzbot reported an issue in ppp_async_encode() [1] In this case, pppoe_sendmsg() is called with a zero size. Then ppp_async_encode() is called with an empty skb. BUG

• CVE-2024-50033HigOct 21, 2024
  affected < 1-8.3.1fixed 1-8.3.1

  In the Linux kernel, the following vulnerability has been resolved: slip: make slhc_remember() more robust against malicious packets syzbot found that slhc_remember() was missing checks against malicious packets [1]. slhc_remember() only checked the size of the packet was at l

• CVE-2022-49029Oct 21, 2024
  affected < 1-8.3.1fixed 1-8.3.1

  In the Linux kernel, the following vulnerability has been resolved: hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails Smatch report warning as follows: drivers/hwmon/ibmpex.c:509 ibmpex_register_bmc() warn: '&data->list' not removed from list If ibmpex_find_

• CVE-2022-49028Oct 21, 2024
  affected < 1-8.3.1fixed 1-8.3.1

  In the Linux kernel, the following vulnerability has been resolved: ixgbevf: Fix resource leak in ixgbevf_init_module() ixgbevf_init_module() won't destroy the workqueue created by create_singlethread_workqueue() when pci_register_driver() failed. Add destroy_workqueue() in fai

• CVE-2022-49027Oct 21, 2024
  affected < 1-8.3.1fixed 1-8.3.1

  In the Linux kernel, the following vulnerability has been resolved: iavf: Fix error handling in iavf_init_module() The iavf_init_module() won't destroy workqueue when pci_register_driver() failed. Call destroy_workqueue() when pci_register_driver() failed to prevent the resourc

• CVE-2022-49026Oct 21, 2024
  affected < 1-8.3.1fixed 1-8.3.1

  In the Linux kernel, the following vulnerability has been resolved: e100: Fix possible use after free in e100_xmit_prepare In e100_xmit_prepare(), if we can't map the skb, then return -ENOMEM, so e100_xmit_frame() will return NETDEV_TX_BUSY and the upper layer will resend the s

• CVE-2022-49021Oct 21, 2024
  affected < 1-8.3.1fixed 1-8.3.1

  In the Linux kernel, the following vulnerability has been resolved: net: phy: fix null-ptr-deref while probe() failed I got a null-ptr-deref report as following when doing fault injection test: BUG: kernel NULL pointer dereference, address: 0000000000000058 Oops: 0000 [#1] PRE

• CVE-2022-49020Oct 21, 2024
  affected < 1-8.3.1fixed 1-8.3.1

  In the Linux kernel, the following vulnerability has been resolved: net/9p: Fix a potential socket leak in p9_socket_open Both p9_fd_create_tcp() and p9_fd_create_unix() will call p9_socket_open(). If the creation of p9_trans_fd fails, p9_fd_create_tcp() and p9_fd_create_unix()

• CVE-2022-49015Oct 21, 2024
  affected < 1-8.3.1fixed 1-8.3.1

  In the Linux kernel, the following vulnerability has been resolved: net: hsr: Fix potential use-after-free The skb is delivered to netif_rx() which may free it, after calling this, dereferencing skb may trigger use-after-free.

• CVE-2022-49014Oct 21, 2024
  affected < 1-8.3.1fixed 1-8.3.1

  In the Linux kernel, the following vulnerability has been resolved: net: tun: Fix use-after-free in tun_detach() syzbot reported use-after-free in tun_detach() [1]. This causes call trace like below: ================================================================== BUG: KASA

• CVE-2022-49011Oct 21, 2024
  affected < 1-8.3.1fixed 1-8.3.1

  In the Linux kernel, the following vulnerability has been resolved: hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() As comment of pci_get_domain_bus_and_slot() says, it returns a pci device with refcount increment, when finish using it, the caller must decremen

• CVE-2022-49010Oct 21, 2024
  affected < 1-8.3.1fixed 1-8.3.1

  In the Linux kernel, the following vulnerability has been resolved: hwmon: (coretemp) Check for null before removing sysfs attrs If coretemp_add_core() gets an error then pdata->core_data[indx] is already NULL and has been kfreed. Don't pass that to sysfs_remove_group() as that

• CVE-2022-49002Oct 21, 2024
  affected < 1-8.3.1fixed 1-8.3.1

  In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init() for_each_pci_dev() is implemented by pci_get_device(). The comment of pci_get_device() says that it will increase the reference count for the re

• CVE-2022-49000Oct 21, 2024
  affected < 1-8.3.1fixed 1-8.3.1

  In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix PCI device refcount leak in has_external_pci() for_each_pci_dev() is implemented by pci_get_device(). The comment of pci_get_device() says that it will increase the reference count for the retur

• CVE-2022-48997Oct 21, 2024
  affected < 1-8.3.1fixed 1-8.3.1

  In the Linux kernel, the following vulnerability has been resolved: char: tpm: Protect tpm_pm_suspend with locks Currently tpm transactions are executed unconditionally in tpm_pm_suspend() function, which may lead to races with other tpm accessors in the system. Specifically,

• CVE-2022-48992Oct 21, 2024
  affected < 1-8.3.1fixed 1-8.3.1

  In the Linux kernel, the following vulnerability has been resolved: ASoC: soc-pcm: Add NULL check in BE reparenting Add NULL check in dpcm_be_reparent API, to handle kernel NULL pointer dereference error. The issue occurred in fuzzing test.

• CVE-2022-48991Oct 21, 2024
  affected < 1-8.3.1fixed 1-8.3.1

  In the Linux kernel, the following vulnerability has been resolved: mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths Any codepath that zaps page table entries must invoke MMU notifiers to ensure that secondary MMUs (like KVM) don't keep accessing pages which are

• CVE-2022-48988Oct 21, 2024
  affected < 1-8.3.1fixed 1-8.3.1

  In the Linux kernel, the following vulnerability has been resolved: memcg: fix possible use-after-free in memcg_write_event_control() memcg_write_event_control() accesses the dentry->d_name of the specified control fd to route the write call. As a cgroup interface file can't b

• CVE-2022-48985Oct 21, 2024
  affected < 1-8.3.1fixed 1-8.3.1

  In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix race on per-CQ variable napi work_done After calling napi_complete_done(), the NAPIF_STATE_SCHED bit may be cleared, and another CPU can start napi thread and access per-CQ variable, cq->work_don