Bugzilla – Bug 1200019
VUL-0: CVE-2022-1972: kernel: buffer overflow in nftable can lead to privilege escalation
Last modified: 2023-01-18 17:41:50 UTC
From linux-distros: Hello, I found a vulnerability in the linux kernel that can lead to local privilege escalation, I notified security@kernel.org yesterday, they have made a patch https://patchwork.ozlabs.org/project/netfilter-devel/patch /20220527102510.333650-1-pablo@netfilter.org/ I didn't ask the cve mitre for a cve number, I hope you can assign a cve number to describe the vulnerability, thank you for your help Below are the details of the vulnerability I found Hello linux security team, I found out that there is an out-of-bounds write vulnerability in the nftable module that can lead to privilege escalation 1. Vulnerability location nft_set_desc_concat_parse function in net/netfilter/nf_tables_api.c https://github.com/torvalds/linux/blob/master/net/netfilter/nf_tables_api.c line 4238 2. root cause static int nft_set_desc_concat_parse(const struct nlattr *attr, struct nft_set_desc *desc) { ..... len = ntohl(nla_get_be32(tb[NFTA_SET_FIELD_LEN])); if (len * BITS_PER_BYTE / 32 > NFT_REG32_COUNT) return -E2BIG; desc->field_len[desc->field_count++] = len;//oob write ..... return 0; } 3. Affected Versions The vulnerability was introduced from https://github.com/torvalds/linux/commit/f3a2181e16f1dcbf5446ed43f6b5d9f56c459f85 5.6 - latest version 4. Vulnerability Exploitation This will cause two overflows, a stack overflow, and an out-of-bounds write within the object. Since if (len * BITS_PER_BYTE / 32 > NFT_REG32_COUNT) return -E2BIG; Content written out of bounds < 0x40 stack overflow location static int nft_set_desc_concat_parse(const struct nlattr *attr, struct nft_set_desc *desc) { .... desc->field_len[desc->field_count++] = len; //stack overflow } Out-of-bounds write position In the nf_tables_newset function set->field_count = desc.field_count; for (i = 0; i < desc.field_count; i++) set->field_len[i] = desc.field_len[i]; //Because field_count is controlled, it will cause out-of-bounds write problem 4.1 Information disclosure Set object structure: struct nft_set { ... u8 field_len[NFT_REG32_COUNT]; u8 field_count; ... u16 udlen; //for information leakage unsigned char *udata; }; Goal: Modify udlen to complete out-of-bounds read Overflow udlen field, such as original udlen=0x100, through precise overflow, overflow the lowest byte of udlen alone to make udlen=0x1ff. Then use the nf_table_fill_set function to read the set object information. A piece of code in the nf_table_fill_set function if (set->udata && nla_put(skb, NFTA_SET_USERDATA, set->udlen, set->udata)) //oob read At this position, the out-of-bounds read is completed through the increased udlen and leaked back to the user mode. At this time, the out-of-bounds write of the array is converted into an out-of-bounds leak. Here we can get the kernel base address and the heap address where the rop chain is stored through the layout 4.2 Control flow hijacking Although we can use stack overflow to first modify field_count to bypass canary and directly modify the return address, but since the content we write cannot be greater than 0x40, and the kernel address starts with 0xffffffff, we cannot directly hijack the control flow desc->field_len[desc->field_count++] = len; //stack overflow I used another method I noticed that the outer function call is static int nf_tables_newset(struct net *net, struct sock *nlsk, struct sk_buff *skb, const struct nlmsghdr *nlh, const struct nlattr * const nla[], struct netlink_ext_ack *extack) Among them, we can overwrite the function call parameters through stack overflow. After auditing all parameters, we found that only skb has the possibility of being used. Before the function returns, kfree_skb(skb) will be called to release the skb. We modify the skb address by overflowing one byte from the stack, such as the original skb address: 0xffffffff80002000, the original code flow is kfree_skb(0xffffffff80002000), we can modify the skb address to 0xffffffff80003000 by overflowing, and now the code flow is kfree_skb(0xffffffff80003000), at this time Another unrelated skb object can be freed, turning the stack overflow vulnerability into a uaf vulnerability. Then use the conventional idea to re-place the skb_shared_info object Hijack sk_buff -> skb_shared_info -> ubuf_info -> callback Complete control flow hijacking Combine them to complete privilege escalation I tested in ubuntu 21.10 and can get root access zzz@ubuntu:~/Documents/exp1$ ./leak zzz@ubuntu:~/Documents/exp1$ ./leak zzz@ubuntu:~/Documents/exp1$ ./leak zzz@ubuntu:~/Documents/exp1$ ./leak zzz@ubuntu:~/Documents/exp1$ ./leak found base_addr: ffffffffa5d3f320 zzz@ubuntu:~/Documents/exp1$ ./exp zzz@ubuntu:~/Documents/exp1$ ./exp zzz@ubuntu:~/Documents/exp1$ ./exp zzz@ubuntu:~/Documents/exp1$ ./exp zzz@ubuntu:~/Documents/exp1$ ./exp zzz@ubuntu:~/Documents/exp1$ ./exp zzz@ubuntu:~/Documents/exp1$ ./exp [*]exploit by Ezrak1e [*] kernel_offset : 24600000 [*] spray rop chain buffer [*]Init success [*] trigger vuln first! [*]Leak rop buffer addr : ffff9030d2945600 [*] spray second OK [*] trigger vuln second [*] spray msg_msg OK [*]hjack RIP #whoami root # uname Linux # uname -a Linux ubuntu 5.13.0-21-generic #21-Ubuntu SMP Tue Oct 19 08:59:28 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux # My exp is divided into two parts The first part is the leak part, which is used to leak the kernel base address and save it The second part is the exp part. First, obtain the heap address where the rop chain is stored. If it is not obtained, it needs to be executed again. After obtaining it, the complete utilization process begins. There is a problem with the success rate, the success rate is probably more than 50% 5.acknowledge ziming zhang(@ezrak1e) from Ant Group Light-Year Security Lab 6. Exploit code init.sh #/bin/sh gcc poc1.c `pkg-config --cflags --libs libnl-3.0 libnl-genl-3.0` -lmnl -lnftnl -masm=intel -no-pie -o exp --no-warnings gcc leak.c `pkg-config --cflags --libs libnl-3.0 libnl-genl-3.0` -lmnl -lnftnl -o leak --no-warnings
(In reply to Carlos López from comment #0) > The vulnerability was introduced from > https://github.com/torvalds/linux/commit/ > f3a2181e16f1dcbf5446ed43f6b5d9f56c459f85 We have this commit in: - master - stable - SLE15-SP4-GA - SLE15-SP4 - SLE15-SP3
Public: https://www.openwall.com/lists/oss-security/2022/06/02/1
Should be fixed by commit fecf31ee395b ("netfilter: nf_tables: sanitize nft_set_desc_concat_parse()") in net tree (not merged into mainline yet). The code was introduced in mainline 5.6-rc1 by commit f3a2181e16f1 ("netfilter: nf_tables: Support for sets with multiple ranged fields") so that SLE15-SP4 and master/stable need the fix. Unfortunately the offending commit was also backported into SLE15-SP3 but not SLE15-SP2-LTSS so we will probably need a backport into cve/linux-5.3 and an empty merge into SLE15-SP2-LTSS.
(In reply to Michal Kubeček from comment #6) > Unfortunately the offending commit was also > backported into SLE15-SP3 but not SLE15-SP2-LTSS so we will probably need > a backport into cve/linux-5.3 and an empty merge into SLE15-SP2-LTSS. This was a mistake, we cannot add the patch to cve/linux-5.3 as the code to be patched does not even exist there so I submitted only into SLE15-SP3 where we have a backport of commit f3a2181e16f1 introducing the code. The fix has been submitted to all relevant branches: stable 5.18.2 (merged) SLE15-SP4 fb312f53a1ab (merged) SLE15-SP3 323e1668e3f6 Reassigning back to security team.
*** Bug 1200522 has been marked as a duplicate of this bug. ***
SUSE-SU-2022:2079-1: An update that solves 15 vulnerabilities, contains two features and has 36 fixes is now available. Category: security (important) Bug References: 1055117,1061840,1065729,1103269,1118212,1152472,1152489,1153274,1154353,1156395,1158266,1167773,1176447,1178134,1180100,1183405,1188885,1195612,1195651,1195826,1196426,1196478,1196570,1196840,1197446,1197472,1197601,1197675,1198438,1198534,1198577,1198971,1198989,1199035,1199052,1199063,1199114,1199314,1199505,1199507,1199564,1199626,1199631,1199650,1199670,1199839,1200019,1200045,1200046,1200192,1200216 CVE References: CVE-2019-19377,CVE-2021-33061,CVE-2022-0168,CVE-2022-1184,CVE-2022-1652,CVE-2022-1729,CVE-2022-1972,CVE-2022-20008,CVE-2022-21123,CVE-2022-21125,CVE-2022-21127,CVE-2022-21166,CVE-2022-21180,CVE-2022-24448,CVE-2022-30594 JIRA References: SLE-13521,SLE-16387 Sources used: openSUSE Leap 15.3 (src): kernel-azure-5.3.18-150300.38.59.1, kernel-source-azure-5.3.18-150300.38.59.1, kernel-syms-azure-5.3.18-150300.38.59.1 SUSE Linux Enterprise Module for Public Cloud 15-SP3 (src): kernel-azure-5.3.18-150300.38.59.1, kernel-source-azure-5.3.18-150300.38.59.1, kernel-syms-azure-5.3.18-150300.38.59.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2022:2078-1: An update that solves 14 vulnerabilities, contains two features and has 32 fixes is now available. Category: security (important) Bug References: 1055117,1061840,1065729,1103269,1118212,1153274,1154353,1156395,1158266,1167773,1176447,1178134,1180100,1183405,1188885,1195826,1196426,1196478,1196570,1196840,1197446,1197472,1197601,1197675,1198438,1198577,1198971,1198989,1199035,1199052,1199063,1199114,1199314,1199505,1199507,1199564,1199626,1199631,1199650,1199670,1199839,1200019,1200045,1200046,1200192,1200216 CVE References: CVE-2019-19377,CVE-2021-33061,CVE-2022-0168,CVE-2022-1184,CVE-2022-1652,CVE-2022-1729,CVE-2022-1972,CVE-2022-20008,CVE-2022-21123,CVE-2022-21125,CVE-2022-21127,CVE-2022-21166,CVE-2022-21180,CVE-2022-30594 JIRA References: SLE-13521,SLE-16387 Sources used: openSUSE Leap 15.4 (src): dtb-aarch64-5.3.18-150300.59.71.1, kernel-preempt-5.3.18-150300.59.71.2 openSUSE Leap 15.3 (src): dtb-aarch64-5.3.18-150300.59.71.1, kernel-64kb-5.3.18-150300.59.71.2, kernel-debug-5.3.18-150300.59.71.2, kernel-default-5.3.18-150300.59.71.2, kernel-default-base-5.3.18-150300.59.71.2.150300.18.43.2, kernel-docs-5.3.18-150300.59.71.2, kernel-kvmsmall-5.3.18-150300.59.71.2, kernel-obs-build-5.3.18-150300.59.71.2, kernel-obs-qa-5.3.18-150300.59.71.1, kernel-preempt-5.3.18-150300.59.71.2, kernel-source-5.3.18-150300.59.71.2, kernel-syms-5.3.18-150300.59.71.1, kernel-zfcpdump-5.3.18-150300.59.71.2 SUSE Linux Enterprise Workstation Extension 15-SP3 (src): kernel-default-5.3.18-150300.59.71.2, kernel-preempt-5.3.18-150300.59.71.2 SUSE Linux Enterprise Module for Live Patching 15-SP3 (src): kernel-default-5.3.18-150300.59.71.2, kernel-livepatch-SLE15-SP3_Update_19-1-150300.7.3.2 SUSE Linux Enterprise Module for Legacy Software 15-SP3 (src): kernel-default-5.3.18-150300.59.71.2 SUSE Linux Enterprise Module for Development Tools 15-SP3 (src): kernel-docs-5.3.18-150300.59.71.2, kernel-obs-build-5.3.18-150300.59.71.2, kernel-preempt-5.3.18-150300.59.71.2, kernel-source-5.3.18-150300.59.71.2, kernel-syms-5.3.18-150300.59.71.1 SUSE Linux Enterprise Module for Basesystem 15-SP3 (src): kernel-64kb-5.3.18-150300.59.71.2, kernel-default-5.3.18-150300.59.71.2, kernel-default-base-5.3.18-150300.59.71.2.150300.18.43.2, kernel-preempt-5.3.18-150300.59.71.2, kernel-source-5.3.18-150300.59.71.2, kernel-zfcpdump-5.3.18-150300.59.71.2 SUSE Linux Enterprise Micro 5.2 (src): kernel-default-5.3.18-150300.59.71.2, kernel-default-base-5.3.18-150300.59.71.2.150300.18.43.2 SUSE Linux Enterprise Micro 5.1 (src): kernel-default-5.3.18-150300.59.71.2, kernel-default-base-5.3.18-150300.59.71.2.150300.18.43.2 SUSE Linux Enterprise High Availability 15-SP3 (src): kernel-default-5.3.18-150300.59.71.2 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2022:2177-1: An update that solves 20 vulnerabilities, contains three features and has 39 fixes is now available. Category: security (important) Bug References: 1055117,1061840,1065729,1103269,1118212,1153274,1154353,1156395,1158266,1167773,1176447,1177282,1178134,1180100,1183405,1188885,1195826,1196426,1196478,1196570,1196840,1197446,1197472,1197601,1197675,1198438,1198577,1198971,1198989,1199035,1199052,1199063,1199114,1199314,1199365,1199505,1199507,1199564,1199626,1199631,1199650,1199670,1199839,1200015,1200019,1200045,1200046,1200143,1200144,1200192,1200206,1200207,1200216,1200249,1200259,1200263,1200529,1200549,1200604 CVE References: CVE-2019-19377,CVE-2020-26541,CVE-2021-33061,CVE-2022-0168,CVE-2022-1184,CVE-2022-1652,CVE-2022-1729,CVE-2022-1966,CVE-2022-1972,CVE-2022-1974,CVE-2022-1975,CVE-2022-20008,CVE-2022-20141,CVE-2022-21123,CVE-2022-21125,CVE-2022-21127,CVE-2022-21166,CVE-2022-21180,CVE-2022-30594,CVE-2022-32250 JIRA References: SLE-13521,SLE-16387,SLE-8371 Sources used: SUSE Linux Enterprise Module for Realtime 15-SP3 (src): kernel-rt-5.3.18-150300.93.1, kernel-rt_debug-5.3.18-150300.93.1, kernel-source-rt-5.3.18-150300.93.1, kernel-syms-rt-5.3.18-150300.93.1 SUSE Linux Enterprise Micro 5.2 (src): kernel-rt-5.3.18-150300.93.1 SUSE Linux Enterprise Micro 5.1 (src): kernel-rt-5.3.18-150300.93.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2022:2520-1: An update that solves 49 vulnerabilities, contains 26 features and has 207 fixes is now available. Category: security (important) Bug References: 1055117,1061840,1065729,1071995,1089644,1103269,1118212,1121726,1137728,1156395,1157038,1157923,1175667,1179439,1179639,1180814,1183682,1183872,1184318,1184924,1187716,1188885,1189998,1190137,1190208,1190336,1190497,1190768,1190786,1190812,1191271,1191663,1192483,1193064,1193277,1193289,1193431,1193556,1193629,1193640,1193787,1193823,1193852,1194086,1194111,1194191,1194409,1194501,1194523,1194526,1194583,1194585,1194586,1194625,1194765,1194826,1194869,1195099,1195287,1195478,1195482,1195504,1195651,1195668,1195669,1195775,1195823,1195826,1195913,1195915,1195926,1195944,1195957,1195987,1196079,1196114,1196130,1196213,1196306,1196367,1196400,1196426,1196478,1196514,1196570,1196723,1196779,1196830,1196836,1196866,1196868,1196869,1196901,1196930,1196942,1196960,1197016,1197157,1197227,1197243,1197292,1197302,1197303,1197304,1197362,1197386,1197501,1197601,1197661,1197675,1197761,1197817,1197819,1197820,1197888,1197889,1197894,1197915,1197917,1197918,1197920,1197921,1197922,1197926,1198009,1198010,1198012,1198013,1198014,1198015,1198016,1198017,1198018,1198019,1198020,1198021,1198022,1198023,1198024,1198027,1198030,1198034,1198058,1198217,1198379,1198400,1198402,1198410,1198412,1198413,1198438,1198484,1198577,1198585,1198660,1198802,1198803,1198806,1198811,1198826,1198829,1198835,1198968,1198971,1199011,1199024,1199035,1199046,1199052,1199063,1199163,1199173,1199260,1199314,1199390,1199426,1199433,1199439,1199482,1199487,1199505,1199507,1199605,1199611,1199626,1199631,1199650,1199657,1199674,1199736,1199793,1199839,1199875,1199909,1200015,1200019,1200045,1200046,1200144,1200205,1200211,1200259,1200263,1200284,1200315,1200343,1200420,1200442,1200475,1200502,1200567,1200569,1200571,1200599,1200600,1200608,1200611,1200619,1200692,1200762,1200763,1200806,1200807,1200808,1200809,1200810,1200812,1200813,1200815,1200816,1200820,1200821,1200822,1200824,1200825,1200827,1200828,1200829,1200830,1200845,1200882,1200925,1201050,1201080,1201160,1201171,1201177,1201193,1201196,1201218,1201222,1201228,1201251,1201381,1201471,1201524 CVE References: CVE-2021-26341,CVE-2021-33061,CVE-2021-4204,CVE-2021-44879,CVE-2021-45402,CVE-2022-0264,CVE-2022-0494,CVE-2022-0617,CVE-2022-1012,CVE-2022-1016,CVE-2022-1184,CVE-2022-1198,CVE-2022-1205,CVE-2022-1462,CVE-2022-1508,CVE-2022-1651,CVE-2022-1652,CVE-2022-1671,CVE-2022-1679,CVE-2022-1729,CVE-2022-1734,CVE-2022-1789,CVE-2022-1852,CVE-2022-1966,CVE-2022-1972,CVE-2022-1974,CVE-2022-1998,CVE-2022-20132,CVE-2022-20154,CVE-2022-21123,CVE-2022-21125,CVE-2022-21127,CVE-2022-21166,CVE-2022-21180,CVE-2022-21499,CVE-2022-2318,CVE-2022-23222,CVE-2022-26365,CVE-2022-26490,CVE-2022-29582,CVE-2022-29900,CVE-2022-29901,CVE-2022-30594,CVE-2022-33740,CVE-2022-33741,CVE-2022-33742,CVE-2022-33743,CVE-2022-33981,CVE-2022-34918 JIRA References: SLE-13513,SLE-13521,SLE-15442,SLE-17855,SLE-18194,SLE-18234,SLE-18375,SLE-18377,SLE-18378,SLE-18382,SLE-18385,SLE-18901,SLE-18938,SLE-18978,SLE-19001,SLE-19026,SLE-19242,SLE-19249,SLE-19253,SLE-19924,SLE-21315,SLE-23643,SLE-24072,SLE-24093,SLE-24350,SLE-24549 Sources used: openSUSE Leap 15.4 (src): dtb-aarch64-5.14.21-150400.24.11.1, kernel-64kb-5.14.21-150400.24.11.1, kernel-debug-5.14.21-150400.24.11.1, kernel-default-5.14.21-150400.24.11.1, kernel-default-base-5.14.21-150400.24.11.1.150400.24.3.6, kernel-docs-5.14.21-150400.24.11.1, kernel-kvmsmall-5.14.21-150400.24.11.1, kernel-obs-build-5.14.21-150400.24.11.1, kernel-obs-qa-5.14.21-150400.24.11.1, kernel-source-5.14.21-150400.24.11.1, kernel-syms-5.14.21-150400.24.11.1, kernel-zfcpdump-5.14.21-150400.24.11.1 SUSE Linux Enterprise Workstation Extension 15-SP4 (src): kernel-default-5.14.21-150400.24.11.1 SUSE Linux Enterprise Module for Live Patching 15-SP4 (src): kernel-default-5.14.21-150400.24.11.1, kernel-livepatch-SLE15-SP4_Update_1-1-150400.9.5.3 SUSE Linux Enterprise Module for Legacy Software 15-SP4 (src): kernel-default-5.14.21-150400.24.11.1 SUSE Linux Enterprise Module for Development Tools 15-SP4 (src): kernel-docs-5.14.21-150400.24.11.1, kernel-obs-build-5.14.21-150400.24.11.1, kernel-source-5.14.21-150400.24.11.1, kernel-syms-5.14.21-150400.24.11.1 SUSE Linux Enterprise Module for Basesystem 15-SP4 (src): kernel-64kb-5.14.21-150400.24.11.1, kernel-default-5.14.21-150400.24.11.1, kernel-default-base-5.14.21-150400.24.11.1.150400.24.3.6, kernel-source-5.14.21-150400.24.11.1, kernel-zfcpdump-5.14.21-150400.24.11.1 SUSE Linux Enterprise High Availability 15-SP4 (src): kernel-default-5.14.21-150400.24.11.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2022:2615-1: An update that solves 48 vulnerabilities, contains 26 features and has 202 fixes is now available. Category: security (important) Bug References: 1055117,1061840,1065729,1071995,1089644,1103269,1118212,1121726,1137728,1156395,1157038,1157923,1175667,1179439,1179639,1180814,1183682,1183872,1184318,1184924,1187716,1188885,1189998,1190137,1190208,1190336,1190497,1190768,1190786,1190812,1191271,1191663,1192483,1193064,1193277,1193289,1193431,1193556,1193629,1193640,1193787,1193823,1193852,1194086,1194111,1194191,1194409,1194501,1194523,1194526,1194583,1194585,1194586,1194625,1194765,1194826,1194869,1195099,1195287,1195478,1195482,1195504,1195651,1195668,1195669,1195775,1195823,1195826,1195913,1195915,1195926,1195944,1195957,1195987,1196079,1196114,1196130,1196213,1196306,1196367,1196400,1196426,1196478,1196514,1196570,1196723,1196779,1196830,1196836,1196866,1196868,1196869,1196901,1196930,1196942,1196960,1197016,1197157,1197227,1197243,1197292,1197302,1197303,1197304,1197362,1197386,1197501,1197601,1197661,1197675,1197761,1197817,1197819,1197820,1197888,1197889,1197894,1197915,1197917,1197918,1197920,1197921,1197922,1197926,1198009,1198010,1198012,1198013,1198014,1198015,1198016,1198017,1198018,1198019,1198020,1198021,1198022,1198023,1198024,1198027,1198030,1198034,1198058,1198217,1198379,1198400,1198402,1198412,1198413,1198438,1198484,1198577,1198585,1198660,1198802,1198803,1198806,1198811,1198826,1198835,1198968,1198971,1199011,1199024,1199035,1199046,1199052,1199063,1199163,1199173,1199260,1199314,1199390,1199426,1199433,1199439,1199482,1199487,1199505,1199507,1199605,1199611,1199626,1199631,1199650,1199657,1199674,1199736,1199793,1199839,1199875,1199909,1200015,1200019,1200045,1200046,1200144,1200205,1200211,1200259,1200263,1200284,1200315,1200343,1200420,1200442,1200475,1200502,1200567,1200569,1200571,1200572,1200599,1200600,1200608,1200611,1200619,1200692,1200762,1200763,1200806,1200807,1200808,1200809,1200810,1200812,1200815,1200816,1200820,1200822,1200824,1200825,1200827,1200828,1200829,1200830,1200845,1200882,1200925,1201050,1201160,1201171,1201177,1201193,1201196,1201218,1201222,1201228,1201251,150300 CVE References: CVE-2021-26341,CVE-2021-33061,CVE-2021-4204,CVE-2021-44879,CVE-2021-45402,CVE-2022-0264,CVE-2022-0494,CVE-2022-0617,CVE-2022-1012,CVE-2022-1016,CVE-2022-1184,CVE-2022-1198,CVE-2022-1205,CVE-2022-1508,CVE-2022-1651,CVE-2022-1652,CVE-2022-1671,CVE-2022-1679,CVE-2022-1729,CVE-2022-1734,CVE-2022-1789,CVE-2022-1852,CVE-2022-1966,CVE-2022-1972,CVE-2022-1974,CVE-2022-1998,CVE-2022-20132,CVE-2022-20154,CVE-2022-21123,CVE-2022-21125,CVE-2022-21127,CVE-2022-21166,CVE-2022-21180,CVE-2022-21499,CVE-2022-2318,CVE-2022-23222,CVE-2022-26365,CVE-2022-26490,CVE-2022-29582,CVE-2022-29900,CVE-2022-29901,CVE-2022-30594,CVE-2022-33740,CVE-2022-33741,CVE-2022-33742,CVE-2022-33743,CVE-2022-33981,CVE-2022-34918 JIRA References: SLE-13513,SLE-13521,SLE-15442,SLE-17855,SLE-18194,SLE-18234,SLE-18375,SLE-18377,SLE-18378,SLE-18382,SLE-18385,SLE-18901,SLE-18938,SLE-18978,SLE-19001,SLE-19026,SLE-19242,SLE-19249,SLE-19253,SLE-19924,SLE-21315,SLE-23643,SLE-24072,SLE-24093,SLE-24350,SLE-24549 Sources used: openSUSE Leap 15.4 (src): kernel-azure-5.14.21-150400.14.7.1, kernel-source-azure-5.14.21-150400.14.7.1, kernel-syms-azure-5.14.21-150400.14.7.1 SUSE Linux Enterprise Module for Public Cloud 15-SP4 (src): kernel-azure-5.14.21-150400.14.7.1, kernel-source-azure-5.14.21-150400.14.7.1, kernel-syms-azure-5.14.21-150400.14.7.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
openSUSE-SU-2022:2177-1: An update that solves 20 vulnerabilities, contains three features and has 39 fixes is now available. Category: security (important) Bug References: 1055117,1061840,1065729,1103269,1118212,1153274,1154353,1156395,1158266,1167773,1176447,1177282,1178134,1180100,1183405,1188885,1195826,1196426,1196478,1196570,1196840,1197446,1197472,1197601,1197675,1198438,1198577,1198971,1198989,1199035,1199052,1199063,1199114,1199314,1199365,1199505,1199507,1199564,1199626,1199631,1199650,1199670,1199839,1200015,1200019,1200045,1200046,1200143,1200144,1200192,1200206,1200207,1200216,1200249,1200259,1200263,1200529,1200549,1200604 CVE References: CVE-2019-19377,CVE-2020-26541,CVE-2021-33061,CVE-2022-0168,CVE-2022-1184,CVE-2022-1652,CVE-2022-1729,CVE-2022-1966,CVE-2022-1972,CVE-2022-1974,CVE-2022-1975,CVE-2022-20008,CVE-2022-20141,CVE-2022-21123,CVE-2022-21125,CVE-2022-21127,CVE-2022-21166,CVE-2022-21180,CVE-2022-30594,CVE-2022-32250 JIRA References: SLE-13521,SLE-16387,SLE-8371 Sources used: openSUSE Leap Micro 5.2 (src): kernel-rt-5.3.18-150300.93.1
released