Security Bulletin
This security bulletin contains information about 25 vulnerabilities.
EUVDB-ID: #VU61097
Risk: Low
CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-39698
CWE-ID:
CWE-416 - Use After Free
Exploit availability: No
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a use-after-free error in Linux kernel. A local user can run a specially crafted program to trigger the use-after-free error and execute arbitrary code with elevated privileges.
Update the affected package the Linux Kernel to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
SUSE Linux Enterprise Module for Public Cloud: 15-SP3
openSUSE Leap: 15.3
SUSE Manager Server: 4.2
SUSE Manager Proxy: 4.2
SUSE Linux Enterprise Server for SAP Applications: 15-SP3
reiserfs-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
reiserfs-kmp-azure: before 5.3.18-150300.38.53.1
ocfs2-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
ocfs2-kmp-azure: before 5.3.18-150300.38.53.1
kselftests-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
kselftests-kmp-azure: before 5.3.18-150300.38.53.1
kernel-syms-azure: before 5.3.18-150300.38.53.1
kernel-azure-optional-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-optional: before 5.3.18-150300.38.53.1
kernel-azure-livepatch-devel: before 5.3.18-150300.38.53.1
kernel-azure-extra-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-extra: before 5.3.18-150300.38.53.1
kernel-azure-devel-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-devel: before 5.3.18-150300.38.53.1
kernel-azure-debugsource: before 5.3.18-150300.38.53.1
kernel-azure-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure: before 5.3.18-150300.38.53.1
gfs2-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
gfs2-kmp-azure: before 5.3.18-150300.38.53.1
dlm-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
dlm-kmp-azure: before 5.3.18-150300.38.53.1
cluster-md-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
cluster-md-kmp-azure: before 5.3.18-150300.38.53.1
kernel-source-azure: before 5.3.18-150300.38.53.1
kernel-devel-azure: before 5.3.18-150300.38.53.1
External linkshttp://www.suse.com/support/update/announcement/2022/suse-su-20221163-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU63567
Risk: Low
CVSSv3.1: 3.3 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-45402
CWE-ID:
CWE-125 - Out-of-bounds read
Exploit availability: No
DescriptionThe vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to check_alu_op() function in kernel/bpf/verifier.c does not properly update bounds while handling the mov32 instruction. A local user can obtain potentially sensitive address information.
Update the affected package the Linux Kernel to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
SUSE Linux Enterprise Module for Public Cloud: 15-SP3
openSUSE Leap: 15.3
SUSE Manager Server: 4.2
SUSE Manager Proxy: 4.2
SUSE Linux Enterprise Server for SAP Applications: 15-SP3
reiserfs-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
reiserfs-kmp-azure: before 5.3.18-150300.38.53.1
ocfs2-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
ocfs2-kmp-azure: before 5.3.18-150300.38.53.1
kselftests-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
kselftests-kmp-azure: before 5.3.18-150300.38.53.1
kernel-syms-azure: before 5.3.18-150300.38.53.1
kernel-azure-optional-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-optional: before 5.3.18-150300.38.53.1
kernel-azure-livepatch-devel: before 5.3.18-150300.38.53.1
kernel-azure-extra-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-extra: before 5.3.18-150300.38.53.1
kernel-azure-devel-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-devel: before 5.3.18-150300.38.53.1
kernel-azure-debugsource: before 5.3.18-150300.38.53.1
kernel-azure-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure: before 5.3.18-150300.38.53.1
gfs2-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
gfs2-kmp-azure: before 5.3.18-150300.38.53.1
dlm-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
dlm-kmp-azure: before 5.3.18-150300.38.53.1
cluster-md-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
cluster-md-kmp-azure: before 5.3.18-150300.38.53.1
kernel-source-azure: before 5.3.18-150300.38.53.1
kernel-devel-azure: before 5.3.18-150300.38.53.1
External linkshttp://www.suse.com/support/update/announcement/2022/suse-su-20221163-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU63422
Risk: Low
CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-45868
CWE-ID:
CWE-416 - Use After Free
Exploit availability: No
DescriptionThe vulnerability allows a local user to perform a denial-of-service attack.
The vulnerability exists due to fs/quota/quota_tree.c does not validate the block number in the quota tree (on disk). A local user can trigger use-after-free error and perform a denial-of-service attack.
MitigationUpdate the affected package the Linux Kernel to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
SUSE Linux Enterprise Module for Public Cloud: 15-SP3
openSUSE Leap: 15.3
SUSE Manager Server: 4.2
SUSE Manager Proxy: 4.2
SUSE Linux Enterprise Server for SAP Applications: 15-SP3
reiserfs-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
reiserfs-kmp-azure: before 5.3.18-150300.38.53.1
ocfs2-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
ocfs2-kmp-azure: before 5.3.18-150300.38.53.1
kselftests-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
kselftests-kmp-azure: before 5.3.18-150300.38.53.1
kernel-syms-azure: before 5.3.18-150300.38.53.1
kernel-azure-optional-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-optional: before 5.3.18-150300.38.53.1
kernel-azure-livepatch-devel: before 5.3.18-150300.38.53.1
kernel-azure-extra-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-extra: before 5.3.18-150300.38.53.1
kernel-azure-devel-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-devel: before 5.3.18-150300.38.53.1
kernel-azure-debugsource: before 5.3.18-150300.38.53.1
kernel-azure-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure: before 5.3.18-150300.38.53.1
gfs2-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
gfs2-kmp-azure: before 5.3.18-150300.38.53.1
dlm-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
dlm-kmp-azure: before 5.3.18-150300.38.53.1
cluster-md-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
cluster-md-kmp-azure: before 5.3.18-150300.38.53.1
kernel-source-azure: before 5.3.18-150300.38.53.1
kernel-devel-azure: before 5.3.18-150300.38.53.1
External linkshttp://www.suse.com/support/update/announcement/2022/suse-su-20221163-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU63423
Risk: Low
CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-0850
CWE-ID:
CWE-200 - Information exposure
Exploit availability: No
DescriptionThe vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output in the copy_page_to_iter() function in iov_iter.c in Linux kernel. A local user can gain unauthorized access to sensitive information on the system.
MitigationUpdate the affected package the Linux Kernel to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
SUSE Linux Enterprise Module for Public Cloud: 15-SP3
openSUSE Leap: 15.3
SUSE Manager Server: 4.2
SUSE Manager Proxy: 4.2
SUSE Linux Enterprise Server for SAP Applications: 15-SP3
reiserfs-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
reiserfs-kmp-azure: before 5.3.18-150300.38.53.1
ocfs2-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
ocfs2-kmp-azure: before 5.3.18-150300.38.53.1
kselftests-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
kselftests-kmp-azure: before 5.3.18-150300.38.53.1
kernel-syms-azure: before 5.3.18-150300.38.53.1
kernel-azure-optional-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-optional: before 5.3.18-150300.38.53.1
kernel-azure-livepatch-devel: before 5.3.18-150300.38.53.1
kernel-azure-extra-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-extra: before 5.3.18-150300.38.53.1
kernel-azure-devel-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-devel: before 5.3.18-150300.38.53.1
kernel-azure-debugsource: before 5.3.18-150300.38.53.1
kernel-azure-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure: before 5.3.18-150300.38.53.1
gfs2-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
gfs2-kmp-azure: before 5.3.18-150300.38.53.1
dlm-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
dlm-kmp-azure: before 5.3.18-150300.38.53.1
cluster-md-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
cluster-md-kmp-azure: before 5.3.18-150300.38.53.1
kernel-source-azure: before 5.3.18-150300.38.53.1
kernel-devel-azure: before 5.3.18-150300.38.53.1
External linkshttp://www.suse.com/support/update/announcement/2022/suse-su-20221163-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU63427
Risk: Low
CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-0854
CWE-ID:
CWE-401 - Missing release of memory after effective lifetime
Exploit availability: No
DescriptionThe vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due memory leak in the Linux kernel’s DMA subsystem when processing DMA_FROM_DEVICE calls. A local user can trigger a memory leak error and read random memory from the kernel space.
MitigationUpdate the affected package the Linux Kernel to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
SUSE Linux Enterprise Module for Public Cloud: 15-SP3
openSUSE Leap: 15.3
SUSE Manager Server: 4.2
SUSE Manager Proxy: 4.2
SUSE Linux Enterprise Server for SAP Applications: 15-SP3
reiserfs-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
reiserfs-kmp-azure: before 5.3.18-150300.38.53.1
ocfs2-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
ocfs2-kmp-azure: before 5.3.18-150300.38.53.1
kselftests-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
kselftests-kmp-azure: before 5.3.18-150300.38.53.1
kernel-syms-azure: before 5.3.18-150300.38.53.1
kernel-azure-optional-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-optional: before 5.3.18-150300.38.53.1
kernel-azure-livepatch-devel: before 5.3.18-150300.38.53.1
kernel-azure-extra-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-extra: before 5.3.18-150300.38.53.1
kernel-azure-devel-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-devel: before 5.3.18-150300.38.53.1
kernel-azure-debugsource: before 5.3.18-150300.38.53.1
kernel-azure-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure: before 5.3.18-150300.38.53.1
gfs2-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
gfs2-kmp-azure: before 5.3.18-150300.38.53.1
dlm-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
dlm-kmp-azure: before 5.3.18-150300.38.53.1
cluster-md-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
cluster-md-kmp-azure: before 5.3.18-150300.38.53.1
kernel-source-azure: before 5.3.18-150300.38.53.1
kernel-devel-azure: before 5.3.18-150300.38.53.1
External linkshttp://www.suse.com/support/update/announcement/2022/suse-su-20221163-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU63386
Risk: Low
CVSSv3.1: 7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C]
CVE-ID: CVE-2022-1011
CWE-ID:
CWE-416 - Use After Free
Exploit availability: Yes
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a use-after-free error in the write() function of FUSE filesystem. A local user can retireve (partial) /etc/shadow hashes and execute arbitrary code with elevated privileges.
MitigationUpdate the affected package the Linux Kernel to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
SUSE Linux Enterprise Module for Public Cloud: 15-SP3
openSUSE Leap: 15.3
SUSE Manager Server: 4.2
SUSE Manager Proxy: 4.2
SUSE Linux Enterprise Server for SAP Applications: 15-SP3
reiserfs-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
reiserfs-kmp-azure: before 5.3.18-150300.38.53.1
ocfs2-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
ocfs2-kmp-azure: before 5.3.18-150300.38.53.1
kselftests-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
kselftests-kmp-azure: before 5.3.18-150300.38.53.1
kernel-syms-azure: before 5.3.18-150300.38.53.1
kernel-azure-optional-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-optional: before 5.3.18-150300.38.53.1
kernel-azure-livepatch-devel: before 5.3.18-150300.38.53.1
kernel-azure-extra-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-extra: before 5.3.18-150300.38.53.1
kernel-azure-devel-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-devel: before 5.3.18-150300.38.53.1
kernel-azure-debugsource: before 5.3.18-150300.38.53.1
kernel-azure-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure: before 5.3.18-150300.38.53.1
gfs2-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
gfs2-kmp-azure: before 5.3.18-150300.38.53.1
dlm-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
dlm-kmp-azure: before 5.3.18-150300.38.53.1
cluster-md-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
cluster-md-kmp-azure: before 5.3.18-150300.38.53.1
kernel-source-azure: before 5.3.18-150300.38.53.1
kernel-devel-azure: before 5.3.18-150300.38.53.1
External linkshttp://www.suse.com/support/update/announcement/2022/suse-su-20221163-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
EUVDB-ID: #VU62028
Risk: Low
CVSSv3.1: 2.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-1016
CWE-ID:
CWE-416 - Use After Free
Exploit availability: No
DescriptionThe vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to a use-after-free error in net/netfilter/nf_tables_core.c:nft_do_chain in Linux kernel.. A local user can trigger a use-after-free error and gain access to sensitive information.
Update the affected package the Linux Kernel to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
SUSE Linux Enterprise Module for Public Cloud: 15-SP3
openSUSE Leap: 15.3
SUSE Manager Server: 4.2
SUSE Manager Proxy: 4.2
SUSE Linux Enterprise Server for SAP Applications: 15-SP3
reiserfs-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
reiserfs-kmp-azure: before 5.3.18-150300.38.53.1
ocfs2-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
ocfs2-kmp-azure: before 5.3.18-150300.38.53.1
kselftests-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
kselftests-kmp-azure: before 5.3.18-150300.38.53.1
kernel-syms-azure: before 5.3.18-150300.38.53.1
kernel-azure-optional-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-optional: before 5.3.18-150300.38.53.1
kernel-azure-livepatch-devel: before 5.3.18-150300.38.53.1
kernel-azure-extra-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-extra: before 5.3.18-150300.38.53.1
kernel-azure-devel-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-devel: before 5.3.18-150300.38.53.1
kernel-azure-debugsource: before 5.3.18-150300.38.53.1
kernel-azure-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure: before 5.3.18-150300.38.53.1
gfs2-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
gfs2-kmp-azure: before 5.3.18-150300.38.53.1
dlm-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
dlm-kmp-azure: before 5.3.18-150300.38.53.1
cluster-md-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
cluster-md-kmp-azure: before 5.3.18-150300.38.53.1
kernel-source-azure: before 5.3.18-150300.38.53.1
kernel-devel-azure: before 5.3.18-150300.38.53.1
External linkshttp://www.suse.com/support/update/announcement/2022/suse-su-20221163-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU63428
Risk: Low
CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-1048
CWE-ID:
CWE-416 - Use After Free
Exploit availability: No
DescriptionThe vulnerability allows a local user to execute arbitrary code with elevated privileges.
The vulnerability exists due to a use-after-free error in the Linux kernel’s sound subsystem in the way a user triggers concurrent calls of PCM hw_params. A local user can execute arbitrary code with elevated privileges and perform a denial-of-service attack.
MitigationUpdate the affected package the Linux Kernel to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
SUSE Linux Enterprise Module for Public Cloud: 15-SP3
openSUSE Leap: 15.3
SUSE Manager Server: 4.2
SUSE Manager Proxy: 4.2
SUSE Linux Enterprise Server for SAP Applications: 15-SP3
reiserfs-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
reiserfs-kmp-azure: before 5.3.18-150300.38.53.1
ocfs2-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
ocfs2-kmp-azure: before 5.3.18-150300.38.53.1
kselftests-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
kselftests-kmp-azure: before 5.3.18-150300.38.53.1
kernel-syms-azure: before 5.3.18-150300.38.53.1
kernel-azure-optional-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-optional: before 5.3.18-150300.38.53.1
kernel-azure-livepatch-devel: before 5.3.18-150300.38.53.1
kernel-azure-extra-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-extra: before 5.3.18-150300.38.53.1
kernel-azure-devel-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-devel: before 5.3.18-150300.38.53.1
kernel-azure-debugsource: before 5.3.18-150300.38.53.1
kernel-azure-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure: before 5.3.18-150300.38.53.1
gfs2-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
gfs2-kmp-azure: before 5.3.18-150300.38.53.1
dlm-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
dlm-kmp-azure: before 5.3.18-150300.38.53.1
cluster-md-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
cluster-md-kmp-azure: before 5.3.18-150300.38.53.1
kernel-source-azure: before 5.3.18-150300.38.53.1
kernel-devel-azure: before 5.3.18-150300.38.53.1
External linkshttp://www.suse.com/support/update/announcement/2022/suse-su-20221163-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU61765
Risk: Low
CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-1055
CWE-ID:
CWE-416 - Use After Free
Exploit availability: No
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a use-after-free error within the tc_new_tfilter in Linux kernel. A local user can run a specially crafted program to trigger a use-after-free error and execute arbitrary code with elevated privileges.
Update the affected package the Linux Kernel to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
SUSE Linux Enterprise Module for Public Cloud: 15-SP3
openSUSE Leap: 15.3
SUSE Manager Server: 4.2
SUSE Manager Proxy: 4.2
SUSE Linux Enterprise Server for SAP Applications: 15-SP3
reiserfs-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
reiserfs-kmp-azure: before 5.3.18-150300.38.53.1
ocfs2-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
ocfs2-kmp-azure: before 5.3.18-150300.38.53.1
kselftests-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
kselftests-kmp-azure: before 5.3.18-150300.38.53.1
kernel-syms-azure: before 5.3.18-150300.38.53.1
kernel-azure-optional-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-optional: before 5.3.18-150300.38.53.1
kernel-azure-livepatch-devel: before 5.3.18-150300.38.53.1
kernel-azure-extra-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-extra: before 5.3.18-150300.38.53.1
kernel-azure-devel-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-devel: before 5.3.18-150300.38.53.1
kernel-azure-debugsource: before 5.3.18-150300.38.53.1
kernel-azure-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure: before 5.3.18-150300.38.53.1
gfs2-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
gfs2-kmp-azure: before 5.3.18-150300.38.53.1
dlm-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
dlm-kmp-azure: before 5.3.18-150300.38.53.1
cluster-md-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
cluster-md-kmp-azure: before 5.3.18-150300.38.53.1
kernel-source-azure: before 5.3.18-150300.38.53.1
kernel-devel-azure: before 5.3.18-150300.38.53.1
External linkshttp://www.suse.com/support/update/announcement/2022/suse-su-20221163-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU63430
Risk: Low
CVSSv3.1: 4 [CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-1195
CWE-ID:
CWE-416 - Use After Free
Exploit availability: No
DescriptionThe vulnerability allows a local user to perform a denial of service attack.
The vulnerability exists due to a use-after-free error in the drivers/net/hamradio. A local user can cause a denial of service (DOS) when the mkiss or sixpack device is detached.
Update the affected package the Linux Kernel to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
SUSE Linux Enterprise Module for Public Cloud: 15-SP3
openSUSE Leap: 15.3
SUSE Manager Server: 4.2
SUSE Manager Proxy: 4.2
SUSE Linux Enterprise Server for SAP Applications: 15-SP3
reiserfs-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
reiserfs-kmp-azure: before 5.3.18-150300.38.53.1
ocfs2-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
ocfs2-kmp-azure: before 5.3.18-150300.38.53.1
kselftests-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
kselftests-kmp-azure: before 5.3.18-150300.38.53.1
kernel-syms-azure: before 5.3.18-150300.38.53.1
kernel-azure-optional-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-optional: before 5.3.18-150300.38.53.1
kernel-azure-livepatch-devel: before 5.3.18-150300.38.53.1
kernel-azure-extra-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-extra: before 5.3.18-150300.38.53.1
kernel-azure-devel-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-devel: before 5.3.18-150300.38.53.1
kernel-azure-debugsource: before 5.3.18-150300.38.53.1
kernel-azure-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure: before 5.3.18-150300.38.53.1
gfs2-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
gfs2-kmp-azure: before 5.3.18-150300.38.53.1
dlm-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
dlm-kmp-azure: before 5.3.18-150300.38.53.1
cluster-md-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
cluster-md-kmp-azure: before 5.3.18-150300.38.53.1
kernel-source-azure: before 5.3.18-150300.38.53.1
kernel-devel-azure: before 5.3.18-150300.38.53.1
External linkshttp://www.suse.com/support/update/announcement/2022/suse-su-20221163-1/
Q & A
Can this vulnerability be exploited remotely?
No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU63431
Risk: Low
CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-1198
CWE-ID:
CWE-416 - Use After Free
Exploit availability: No
DescriptionThe vulnerability allows a local user to perform a denial of service attack.
The vulnerability exists due to a use-after-free error in the drivers/net/hamradio/6pack.c. A local user can perform a denial of service (DoS) attack by simulating Amateur Radio.
Update the affected package the Linux Kernel to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
SUSE Linux Enterprise Module for Public Cloud: 15-SP3
openSUSE Leap: 15.3
SUSE Manager Server: 4.2
SUSE Manager Proxy: 4.2
SUSE Linux Enterprise Server for SAP Applications: 15-SP3
reiserfs-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
reiserfs-kmp-azure: before 5.3.18-150300.38.53.1
ocfs2-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
ocfs2-kmp-azure: before 5.3.18-150300.38.53.1
kselftests-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
kselftests-kmp-azure: before 5.3.18-150300.38.53.1
kernel-syms-azure: before 5.3.18-150300.38.53.1
kernel-azure-optional-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-optional: before 5.3.18-150300.38.53.1
kernel-azure-livepatch-devel: before 5.3.18-150300.38.53.1
kernel-azure-extra-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-extra: before 5.3.18-150300.38.53.1
kernel-azure-devel-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-devel: before 5.3.18-150300.38.53.1
kernel-azure-debugsource: before 5.3.18-150300.38.53.1
kernel-azure-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure: before 5.3.18-150300.38.53.1
gfs2-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
gfs2-kmp-azure: before 5.3.18-150300.38.53.1
dlm-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
dlm-kmp-azure: before 5.3.18-150300.38.53.1
cluster-md-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
cluster-md-kmp-azure: before 5.3.18-150300.38.53.1
kernel-source-azure: before 5.3.18-150300.38.53.1
kernel-devel-azure: before 5.3.18-150300.38.53.1
External linkshttp://www.suse.com/support/update/announcement/2022/suse-su-20221163-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU63432
Risk: Low
CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-1199
CWE-ID:
CWE-476 - NULL Pointer Dereference
Exploit availability: No
DescriptionThe vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to a Null pointer dereference and use after free errors in the ax25_release() function. A local user can simulate Amateur Radio and perform a denial of service (DoS) attack.
MitigationUpdate the affected package the Linux Kernel to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
SUSE Linux Enterprise Module for Public Cloud: 15-SP3
openSUSE Leap: 15.3
SUSE Manager Server: 4.2
SUSE Manager Proxy: 4.2
SUSE Linux Enterprise Server for SAP Applications: 15-SP3
reiserfs-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
reiserfs-kmp-azure: before 5.3.18-150300.38.53.1
ocfs2-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
ocfs2-kmp-azure: before 5.3.18-150300.38.53.1
kselftests-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
kselftests-kmp-azure: before 5.3.18-150300.38.53.1
kernel-syms-azure: before 5.3.18-150300.38.53.1
kernel-azure-optional-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-optional: before 5.3.18-150300.38.53.1
kernel-azure-livepatch-devel: before 5.3.18-150300.38.53.1
kernel-azure-extra-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-extra: before 5.3.18-150300.38.53.1
kernel-azure-devel-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-devel: before 5.3.18-150300.38.53.1
kernel-azure-debugsource: before 5.3.18-150300.38.53.1
kernel-azure-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure: before 5.3.18-150300.38.53.1
gfs2-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
gfs2-kmp-azure: before 5.3.18-150300.38.53.1
dlm-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
dlm-kmp-azure: before 5.3.18-150300.38.53.1
cluster-md-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
cluster-md-kmp-azure: before 5.3.18-150300.38.53.1
kernel-source-azure: before 5.3.18-150300.38.53.1
kernel-devel-azure: before 5.3.18-150300.38.53.1
External linkshttp://www.suse.com/support/update/announcement/2022/suse-su-20221163-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU63433
Risk: Low
CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-1205
CWE-ID:
CWE-476 - NULL Pointer Dereference
Exploit availability: No
DescriptionThe vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to a null pointer dereference and use after free errors in the net/ax25/ax25_timer.c. A local user can simulate Amateur Radio and perform a denial of service (DoS) attack.
Update the affected package the Linux Kernel to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
SUSE Linux Enterprise Module for Public Cloud: 15-SP3
openSUSE Leap: 15.3
SUSE Manager Server: 4.2
SUSE Manager Proxy: 4.2
SUSE Linux Enterprise Server for SAP Applications: 15-SP3
reiserfs-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
reiserfs-kmp-azure: before 5.3.18-150300.38.53.1
ocfs2-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
ocfs2-kmp-azure: before 5.3.18-150300.38.53.1
kselftests-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
kselftests-kmp-azure: before 5.3.18-150300.38.53.1
kernel-syms-azure: before 5.3.18-150300.38.53.1
kernel-azure-optional-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-optional: before 5.3.18-150300.38.53.1
kernel-azure-livepatch-devel: before 5.3.18-150300.38.53.1
kernel-azure-extra-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-extra: before 5.3.18-150300.38.53.1
kernel-azure-devel-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-devel: before 5.3.18-150300.38.53.1
kernel-azure-debugsource: before 5.3.18-150300.38.53.1
kernel-azure-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure: before 5.3.18-150300.38.53.1
gfs2-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
gfs2-kmp-azure: before 5.3.18-150300.38.53.1
dlm-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
dlm-kmp-azure: before 5.3.18-150300.38.53.1
cluster-md-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
cluster-md-kmp-azure: before 5.3.18-150300.38.53.1
kernel-source-azure: before 5.3.18-150300.38.53.1
kernel-devel-azure: before 5.3.18-150300.38.53.1
External linkshttp://www.suse.com/support/update/announcement/2022/suse-su-20221163-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU63305
Risk: Low
CVSSv3.1: 6.1 [CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-23036
Exploit availability: No
DescriptionThe vulnerability allows a local user to bypass implemented security restrictions.
The vulnerability exists due to a race condition in the blkfront ring buffer. A malicious backend can exploit the race condition and read or write data or perform a denial of service attack.
MitigationUpdate the affected package the Linux Kernel to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
SUSE Linux Enterprise Module for Public Cloud: 15-SP3
openSUSE Leap: 15.3
SUSE Manager Server: 4.2
SUSE Manager Proxy: 4.2
SUSE Linux Enterprise Server for SAP Applications: 15-SP3
reiserfs-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
reiserfs-kmp-azure: before 5.3.18-150300.38.53.1
ocfs2-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
ocfs2-kmp-azure: before 5.3.18-150300.38.53.1
kselftests-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
kselftests-kmp-azure: before 5.3.18-150300.38.53.1
kernel-syms-azure: before 5.3.18-150300.38.53.1
kernel-azure-optional-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-optional: before 5.3.18-150300.38.53.1
kernel-azure-livepatch-devel: before 5.3.18-150300.38.53.1
kernel-azure-extra-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-extra: before 5.3.18-150300.38.53.1
kernel-azure-devel-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-devel: before 5.3.18-150300.38.53.1
kernel-azure-debugsource: before 5.3.18-150300.38.53.1
kernel-azure-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure: before 5.3.18-150300.38.53.1
gfs2-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
gfs2-kmp-azure: before 5.3.18-150300.38.53.1
dlm-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
dlm-kmp-azure: before 5.3.18-150300.38.53.1
cluster-md-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
cluster-md-kmp-azure: before 5.3.18-150300.38.53.1
kernel-source-azure: before 5.3.18-150300.38.53.1
kernel-devel-azure: before 5.3.18-150300.38.53.1
External linkshttp://www.suse.com/support/update/announcement/2022/suse-su-20221163-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU63306
Risk: Low
CVSSv3.1: 6.1 [CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-23037
Exploit availability: No
DescriptionThe vulnerability allows a local user to bypass implemented security restrictions.
The vulnerability exists due to a race condition in the netfront ring buffer. A malicious backend can exploit the race condition and read or write data or perform a denial of service attack.
MitigationUpdate the affected package the Linux Kernel to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
SUSE Linux Enterprise Module for Public Cloud: 15-SP3
openSUSE Leap: 15.3
SUSE Manager Server: 4.2
SUSE Manager Proxy: 4.2
SUSE Linux Enterprise Server for SAP Applications: 15-SP3
reiserfs-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
reiserfs-kmp-azure: before 5.3.18-150300.38.53.1
ocfs2-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
ocfs2-kmp-azure: before 5.3.18-150300.38.53.1
kselftests-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
kselftests-kmp-azure: before 5.3.18-150300.38.53.1
kernel-syms-azure: before 5.3.18-150300.38.53.1
kernel-azure-optional-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-optional: before 5.3.18-150300.38.53.1
kernel-azure-livepatch-devel: before 5.3.18-150300.38.53.1
kernel-azure-extra-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-extra: before 5.3.18-150300.38.53.1
kernel-azure-devel-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-devel: before 5.3.18-150300.38.53.1
kernel-azure-debugsource: before 5.3.18-150300.38.53.1
kernel-azure-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure: before 5.3.18-150300.38.53.1
gfs2-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
gfs2-kmp-azure: before 5.3.18-150300.38.53.1
dlm-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
dlm-kmp-azure: before 5.3.18-150300.38.53.1
cluster-md-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
cluster-md-kmp-azure: before 5.3.18-150300.38.53.1
kernel-source-azure: before 5.3.18-150300.38.53.1
kernel-devel-azure: before 5.3.18-150300.38.53.1
External linkshttp://www.suse.com/support/update/announcement/2022/suse-su-20221163-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU63307
Risk: Low
CVSSv3.1: 6.1 [CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-23038
Exploit availability: No
DescriptionThe vulnerability allows a local user to bypass implemented security restrictions.
The vulnerability exists due to a race condition in the scsifront ring buffer. A malicious backend can exploit the race condition and read or write data or perform a denial of service attack.
MitigationUpdate the affected package the Linux Kernel to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
SUSE Linux Enterprise Module for Public Cloud: 15-SP3
openSUSE Leap: 15.3
SUSE Manager Server: 4.2
SUSE Manager Proxy: 4.2
SUSE Linux Enterprise Server for SAP Applications: 15-SP3
reiserfs-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
reiserfs-kmp-azure: before 5.3.18-150300.38.53.1
ocfs2-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
ocfs2-kmp-azure: before 5.3.18-150300.38.53.1
kselftests-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
kselftests-kmp-azure: before 5.3.18-150300.38.53.1
kernel-syms-azure: before 5.3.18-150300.38.53.1
kernel-azure-optional-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-optional: before 5.3.18-150300.38.53.1
kernel-azure-livepatch-devel: before 5.3.18-150300.38.53.1
kernel-azure-extra-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-extra: before 5.3.18-150300.38.53.1
kernel-azure-devel-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-devel: before 5.3.18-150300.38.53.1
kernel-azure-debugsource: before 5.3.18-150300.38.53.1
kernel-azure-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure: before 5.3.18-150300.38.53.1
gfs2-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
gfs2-kmp-azure: before 5.3.18-150300.38.53.1
dlm-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
dlm-kmp-azure: before 5.3.18-150300.38.53.1
cluster-md-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
cluster-md-kmp-azure: before 5.3.18-150300.38.53.1
kernel-source-azure: before 5.3.18-150300.38.53.1
kernel-devel-azure: before 5.3.18-150300.38.53.1
External linkshttp://www.suse.com/support/update/announcement/2022/suse-su-20221163-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU63308
Risk: Low
CVSSv3.1: 6.1 [CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-23039
Exploit availability: No
DescriptionThe vulnerability allows a local user to bypass implemented security restrictions.
The vulnerability exists due to a race condition in the gntalloc ring buffer. A malicious backend can exploit the race condition and read or write data or perform a denial of service attack.
MitigationUpdate the affected package the Linux Kernel to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
SUSE Linux Enterprise Module for Public Cloud: 15-SP3
openSUSE Leap: 15.3
SUSE Manager Server: 4.2
SUSE Manager Proxy: 4.2
SUSE Linux Enterprise Server for SAP Applications: 15-SP3
reiserfs-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
reiserfs-kmp-azure: before 5.3.18-150300.38.53.1
ocfs2-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
ocfs2-kmp-azure: before 5.3.18-150300.38.53.1
kselftests-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
kselftests-kmp-azure: before 5.3.18-150300.38.53.1
kernel-syms-azure: before 5.3.18-150300.38.53.1
kernel-azure-optional-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-optional: before 5.3.18-150300.38.53.1
kernel-azure-livepatch-devel: before 5.3.18-150300.38.53.1
kernel-azure-extra-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-extra: before 5.3.18-150300.38.53.1
kernel-azure-devel-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-devel: before 5.3.18-150300.38.53.1
kernel-azure-debugsource: before 5.3.18-150300.38.53.1
kernel-azure-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure: before 5.3.18-150300.38.53.1
gfs2-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
gfs2-kmp-azure: before 5.3.18-150300.38.53.1
dlm-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
dlm-kmp-azure: before 5.3.18-150300.38.53.1
cluster-md-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
cluster-md-kmp-azure: before 5.3.18-150300.38.53.1
kernel-source-azure: before 5.3.18-150300.38.53.1
kernel-devel-azure: before 5.3.18-150300.38.53.1
External linkshttp://www.suse.com/support/update/announcement/2022/suse-su-20221163-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU63309
Risk: Low
CVSSv3.1: 6.1 [CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-23040
Exploit availability: No
DescriptionThe vulnerability allows a local user to bypass implemented security restrictions.
The vulnerability exists due to a race condition in the xenbus ring buffer. A malicious backend can exploit the race condition and read or write data or perform a denial of service attack.
MitigationUpdate the affected package the Linux Kernel to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
SUSE Linux Enterprise Module for Public Cloud: 15-SP3
openSUSE Leap: 15.3
SUSE Manager Server: 4.2
SUSE Manager Proxy: 4.2
SUSE Linux Enterprise Server for SAP Applications: 15-SP3
reiserfs-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
reiserfs-kmp-azure: before 5.3.18-150300.38.53.1
ocfs2-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
ocfs2-kmp-azure: before 5.3.18-150300.38.53.1
kselftests-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
kselftests-kmp-azure: before 5.3.18-150300.38.53.1
kernel-syms-azure: before 5.3.18-150300.38.53.1
kernel-azure-optional-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-optional: before 5.3.18-150300.38.53.1
kernel-azure-livepatch-devel: before 5.3.18-150300.38.53.1
kernel-azure-extra-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-extra: before 5.3.18-150300.38.53.1
kernel-azure-devel-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-devel: before 5.3.18-150300.38.53.1
kernel-azure-debugsource: before 5.3.18-150300.38.53.1
kernel-azure-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure: before 5.3.18-150300.38.53.1
gfs2-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
gfs2-kmp-azure: before 5.3.18-150300.38.53.1
dlm-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
dlm-kmp-azure: before 5.3.18-150300.38.53.1
cluster-md-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
cluster-md-kmp-azure: before 5.3.18-150300.38.53.1
kernel-source-azure: before 5.3.18-150300.38.53.1
kernel-devel-azure: before 5.3.18-150300.38.53.1
External linkshttp://www.suse.com/support/update/announcement/2022/suse-su-20221163-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU63310
Risk: Low
CVSSv3.1: 6.1 [CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-23041
Exploit availability: No
DescriptionThe vulnerability allows a local user to bypass implemented security restrictions.
The vulnerability exists due to a race condition in blkfront, netfront, scsifront, usbfront, dmabuf, xenbus, 9p, kbdfront, and pvcalls ring buffers. A malicious backend can exploit the race condition and read or write data or perform a denial of service attack.
MitigationUpdate the affected package the Linux Kernel to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
SUSE Linux Enterprise Module for Public Cloud: 15-SP3
openSUSE Leap: 15.3
SUSE Manager Server: 4.2
SUSE Manager Proxy: 4.2
SUSE Linux Enterprise Server for SAP Applications: 15-SP3
reiserfs-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
reiserfs-kmp-azure: before 5.3.18-150300.38.53.1
ocfs2-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
ocfs2-kmp-azure: before 5.3.18-150300.38.53.1
kselftests-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
kselftests-kmp-azure: before 5.3.18-150300.38.53.1
kernel-syms-azure: before 5.3.18-150300.38.53.1
kernel-azure-optional-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-optional: before 5.3.18-150300.38.53.1
kernel-azure-livepatch-devel: before 5.3.18-150300.38.53.1
kernel-azure-extra-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-extra: before 5.3.18-150300.38.53.1
kernel-azure-devel-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-devel: before 5.3.18-150300.38.53.1
kernel-azure-debugsource: before 5.3.18-150300.38.53.1
kernel-azure-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure: before 5.3.18-150300.38.53.1
gfs2-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
gfs2-kmp-azure: before 5.3.18-150300.38.53.1
dlm-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
dlm-kmp-azure: before 5.3.18-150300.38.53.1
cluster-md-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
cluster-md-kmp-azure: before 5.3.18-150300.38.53.1
kernel-source-azure: before 5.3.18-150300.38.53.1
kernel-devel-azure: before 5.3.18-150300.38.53.1
External linkshttp://www.suse.com/support/update/announcement/2022/suse-su-20221163-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU63311
Risk: Low
CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-23042
CWE-ID:
CWE-617 - Reachable Assertion
Exploit availability: No
DescriptionThe vulnerability allows a local user to bypass implemented security restrictions.
The vulnerability exists due to reachable assertion in the netfront ring buffer. A malicious backend can exploit the race condition and read or write data or perform a denial of service attack.
MitigationUpdate the affected package the Linux Kernel to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
SUSE Linux Enterprise Module for Public Cloud: 15-SP3
openSUSE Leap: 15.3
SUSE Manager Server: 4.2
SUSE Manager Proxy: 4.2
SUSE Linux Enterprise Server for SAP Applications: 15-SP3
reiserfs-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
reiserfs-kmp-azure: before 5.3.18-150300.38.53.1
ocfs2-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
ocfs2-kmp-azure: before 5.3.18-150300.38.53.1
kselftests-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
kselftests-kmp-azure: before 5.3.18-150300.38.53.1
kernel-syms-azure: before 5.3.18-150300.38.53.1
kernel-azure-optional-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-optional: before 5.3.18-150300.38.53.1
kernel-azure-livepatch-devel: before 5.3.18-150300.38.53.1
kernel-azure-extra-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-extra: before 5.3.18-150300.38.53.1
kernel-azure-devel-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-devel: before 5.3.18-150300.38.53.1
kernel-azure-debugsource: before 5.3.18-150300.38.53.1
kernel-azure-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure: before 5.3.18-150300.38.53.1
gfs2-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
gfs2-kmp-azure: before 5.3.18-150300.38.53.1
dlm-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
dlm-kmp-azure: before 5.3.18-150300.38.53.1
cluster-md-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
cluster-md-kmp-azure: before 5.3.18-150300.38.53.1
kernel-source-azure: before 5.3.18-150300.38.53.1
kernel-devel-azure: before 5.3.18-150300.38.53.1
External linkshttp://www.suse.com/support/update/announcement/2022/suse-su-20221163-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU63316
Risk: Medium
CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-27223
CWE-ID:
CWE-129 - Improper Validation of Array Index
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code with elevated privileges.
The vulnerability exists due to improper validation of array index in drivers/usb/gadget/udc/udc-xilinx.c in the Linux kernel. A remote attacker can send specially crafted data to the system and execute arbitrary code with elevated privileges.
Update the affected package the Linux Kernel to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
SUSE Linux Enterprise Module for Public Cloud: 15-SP3
openSUSE Leap: 15.3
SUSE Manager Server: 4.2
SUSE Manager Proxy: 4.2
SUSE Linux Enterprise Server for SAP Applications: 15-SP3
reiserfs-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
reiserfs-kmp-azure: before 5.3.18-150300.38.53.1
ocfs2-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
ocfs2-kmp-azure: before 5.3.18-150300.38.53.1
kselftests-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
kselftests-kmp-azure: before 5.3.18-150300.38.53.1
kernel-syms-azure: before 5.3.18-150300.38.53.1
kernel-azure-optional-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-optional: before 5.3.18-150300.38.53.1
kernel-azure-livepatch-devel: before 5.3.18-150300.38.53.1
kernel-azure-extra-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-extra: before 5.3.18-150300.38.53.1
kernel-azure-devel-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-devel: before 5.3.18-150300.38.53.1
kernel-azure-debugsource: before 5.3.18-150300.38.53.1
kernel-azure-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure: before 5.3.18-150300.38.53.1
gfs2-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
gfs2-kmp-azure: before 5.3.18-150300.38.53.1
dlm-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
dlm-kmp-azure: before 5.3.18-150300.38.53.1
cluster-md-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
cluster-md-kmp-azure: before 5.3.18-150300.38.53.1
kernel-source-azure: before 5.3.18-150300.38.53.1
kernel-devel-azure: before 5.3.18-150300.38.53.1
External linkshttp://www.suse.com/support/update/announcement/2022/suse-su-20221163-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU61672
Risk: Low
CVSSv3.1: 6.3 [CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C]
CVE-ID: CVE-2022-27666
CWE-ID:
CWE-122 - Heap-based Buffer Overflow
Exploit availability: Yes
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error within IPsec ESP transformation code in net/ipv4/esp4.c and net/ipv6/esp6.c in Linux kernel. A local unprivileged user can pass specially crafted data to the system, trigger a heap-based buffer overflow and execute arbitrary code with elevated privileges.
Update the affected package the Linux Kernel to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
SUSE Linux Enterprise Module for Public Cloud: 15-SP3
openSUSE Leap: 15.3
SUSE Manager Server: 4.2
SUSE Manager Proxy: 4.2
SUSE Linux Enterprise Server for SAP Applications: 15-SP3
reiserfs-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
reiserfs-kmp-azure: before 5.3.18-150300.38.53.1
ocfs2-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
ocfs2-kmp-azure: before 5.3.18-150300.38.53.1
kselftests-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
kselftests-kmp-azure: before 5.3.18-150300.38.53.1
kernel-syms-azure: before 5.3.18-150300.38.53.1
kernel-azure-optional-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-optional: before 5.3.18-150300.38.53.1
kernel-azure-livepatch-devel: before 5.3.18-150300.38.53.1
kernel-azure-extra-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-extra: before 5.3.18-150300.38.53.1
kernel-azure-devel-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-devel: before 5.3.18-150300.38.53.1
kernel-azure-debugsource: before 5.3.18-150300.38.53.1
kernel-azure-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure: before 5.3.18-150300.38.53.1
gfs2-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
gfs2-kmp-azure: before 5.3.18-150300.38.53.1
dlm-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
dlm-kmp-azure: before 5.3.18-150300.38.53.1
cluster-md-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
cluster-md-kmp-azure: before 5.3.18-150300.38.53.1
kernel-source-azure: before 5.3.18-150300.38.53.1
kernel-devel-azure: before 5.3.18-150300.38.53.1
External linkshttp://www.suse.com/support/update/announcement/2022/suse-su-20221163-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
EUVDB-ID: #VU63160
Risk: Low
CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-28388
CWE-ID:
CWE-415 - Double Free
Exploit availability: No
DescriptionThe vulnerability allows a local user to execute arbitrary code with elevated privileges.
The vulnerability exists due to boundary error in the usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c. A local user can pass specially crafted data to the application, trigger double free error and execute arbitrary code with elevated privileges.
MitigationUpdate the affected package the Linux Kernel to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
SUSE Linux Enterprise Module for Public Cloud: 15-SP3
openSUSE Leap: 15.3
SUSE Manager Server: 4.2
SUSE Manager Proxy: 4.2
SUSE Linux Enterprise Server for SAP Applications: 15-SP3
reiserfs-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
reiserfs-kmp-azure: before 5.3.18-150300.38.53.1
ocfs2-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
ocfs2-kmp-azure: before 5.3.18-150300.38.53.1
kselftests-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
kselftests-kmp-azure: before 5.3.18-150300.38.53.1
kernel-syms-azure: before 5.3.18-150300.38.53.1
kernel-azure-optional-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-optional: before 5.3.18-150300.38.53.1
kernel-azure-livepatch-devel: before 5.3.18-150300.38.53.1
kernel-azure-extra-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-extra: before 5.3.18-150300.38.53.1
kernel-azure-devel-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-devel: before 5.3.18-150300.38.53.1
kernel-azure-debugsource: before 5.3.18-150300.38.53.1
kernel-azure-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure: before 5.3.18-150300.38.53.1
gfs2-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
gfs2-kmp-azure: before 5.3.18-150300.38.53.1
dlm-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
dlm-kmp-azure: before 5.3.18-150300.38.53.1
cluster-md-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
cluster-md-kmp-azure: before 5.3.18-150300.38.53.1
kernel-source-azure: before 5.3.18-150300.38.53.1
kernel-devel-azure: before 5.3.18-150300.38.53.1
External linkshttp://www.suse.com/support/update/announcement/2022/suse-su-20221163-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU63162
Risk: Low
CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-28389
CWE-ID:
CWE-415 - Double Free
Exploit availability: No
DescriptionThe vulnerability allows a local user to execute arbitrary code with elevated privileges.
The vulnerability exists due to boundary error in mcba_usb_start_xmit in drivers/net/can/usb/mcba_usb.c. A local user can pass specially crafted data to the application, trigger double free error and execute arbitrary code with elevated privileges.
MitigationUpdate the affected package the Linux Kernel to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
SUSE Linux Enterprise Module for Public Cloud: 15-SP3
openSUSE Leap: 15.3
SUSE Manager Server: 4.2
SUSE Manager Proxy: 4.2
SUSE Linux Enterprise Server for SAP Applications: 15-SP3
reiserfs-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
reiserfs-kmp-azure: before 5.3.18-150300.38.53.1
ocfs2-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
ocfs2-kmp-azure: before 5.3.18-150300.38.53.1
kselftests-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
kselftests-kmp-azure: before 5.3.18-150300.38.53.1
kernel-syms-azure: before 5.3.18-150300.38.53.1
kernel-azure-optional-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-optional: before 5.3.18-150300.38.53.1
kernel-azure-livepatch-devel: before 5.3.18-150300.38.53.1
kernel-azure-extra-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-extra: before 5.3.18-150300.38.53.1
kernel-azure-devel-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-devel: before 5.3.18-150300.38.53.1
kernel-azure-debugsource: before 5.3.18-150300.38.53.1
kernel-azure-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure: before 5.3.18-150300.38.53.1
gfs2-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
gfs2-kmp-azure: before 5.3.18-150300.38.53.1
dlm-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
dlm-kmp-azure: before 5.3.18-150300.38.53.1
cluster-md-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
cluster-md-kmp-azure: before 5.3.18-150300.38.53.1
kernel-source-azure: before 5.3.18-150300.38.53.1
kernel-devel-azure: before 5.3.18-150300.38.53.1
External linkshttp://www.suse.com/support/update/announcement/2022/suse-su-20221163-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU63164
Risk: Low
CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-28390
CWE-ID:
CWE-415 - Double Free
Exploit availability: No
DescriptionThe vulnerability allows a local user to execute arbitrary code with elevated privileges.
The vulnerability exists due to boundary error in ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c. A local user can pass specially crafted data to the application, trigger double free error and execute arbitrary code with elevated privileges.
MitigationUpdate the affected package the Linux Kernel to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
SUSE Linux Enterprise Module for Public Cloud: 15-SP3
openSUSE Leap: 15.3
SUSE Manager Server: 4.2
SUSE Manager Proxy: 4.2
SUSE Linux Enterprise Server for SAP Applications: 15-SP3
reiserfs-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
reiserfs-kmp-azure: before 5.3.18-150300.38.53.1
ocfs2-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
ocfs2-kmp-azure: before 5.3.18-150300.38.53.1
kselftests-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
kselftests-kmp-azure: before 5.3.18-150300.38.53.1
kernel-syms-azure: before 5.3.18-150300.38.53.1
kernel-azure-optional-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-optional: before 5.3.18-150300.38.53.1
kernel-azure-livepatch-devel: before 5.3.18-150300.38.53.1
kernel-azure-extra-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-extra: before 5.3.18-150300.38.53.1
kernel-azure-devel-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure-devel: before 5.3.18-150300.38.53.1
kernel-azure-debugsource: before 5.3.18-150300.38.53.1
kernel-azure-debuginfo: before 5.3.18-150300.38.53.1
kernel-azure: before 5.3.18-150300.38.53.1
gfs2-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
gfs2-kmp-azure: before 5.3.18-150300.38.53.1
dlm-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
dlm-kmp-azure: before 5.3.18-150300.38.53.1
cluster-md-kmp-azure-debuginfo: before 5.3.18-150300.38.53.1
cluster-md-kmp-azure: before 5.3.18-150300.38.53.1
kernel-source-azure: before 5.3.18-150300.38.53.1
kernel-devel-azure: before 5.3.18-150300.38.53.1
External linkshttp://www.suse.com/support/update/announcement/2022/suse-su-20221163-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.