csaf_suse - suse-su-2022:1257-1

Vulnerability from csaf_suse

Published

2022-04-19 09:03

Modified

2022-04-19 09:03

Summary

Security update for the Linux Kernel

Notes

Title of the patch

Security update for the Linux Kernel

Description of the patch

The SUSE Linux Enterprise 15 SP2 RT kernel was updated to receive various security bugfixes. The following security bugs were fixed: - CVE-2022-0854: Fixed a memory leak flaw was found in the Linux kernels DMA subsystem. This flaw allowed a local user to read random memory from the kernel space (bnc#1196823). - CVE-2022-28388: Fixed a double free in drivers/net/can/usb/usb_8dev.c vulnerability in the Linux kernel (bnc#1198032). - CVE-2022-28389: Fixed a double free in drivers/net/can/usb/mcba_usb.c vulnerability in the Linux kernel (bnc#1198033). - CVE-2022-28390: Fixed a double free in drivers/net/can/usb/ems_usb.c vulnerability in the Linux kernel (bnc#1198031). - CVE-2022-1048: Fixed a race Condition in snd_pcm_hw_free leading to use-after-free due to the AB/BA lock with buffer_mutex and mmap_lock (bsc#1197331). - CVE-2022-1055: Fixed a use-after-free in tc_new_tfilter that could allow a local attacker to gain privilege escalation (bnc#1197702). - CVE-2022-27666: Fixed a buffer overflow vulnerability in IPsec ESP transformation code. This flaw allowed a local attacker with a normal user privilege to overwrite kernel heap objects and may cause a local privilege escalation (bnc#1197462). - CVE-2021-45868: Fixed a wrong validation check in fs/quota/quota_tree.c which could lead to an use-after-free if there is a corrupted quota file (bnc#1197366). - CVE-2022-26966: Fixed an issue in drivers/net/usb/sr9700.c, which allowed attackers to obtain sensitive information from the memory via crafted frame lengths from a USB device (bsc#1196836). - CVE-2021-39698: Fixed a possible memory corruption due to a use after free in aio_poll_complete_work. This could lead to local escalation of privilege with no additional execution privileges needed (bsc#1196956). - CVE-2021-0920: Fixed a local privilege escalation due to a use-after-free bug in unix_gc (bsc#1193731). - CVE-2022-23036,CVE-2022-23037,CVE-2022-23038,CVE-2022-23039,CVE-2022-23040,CVE-2022-23041,CVE-2022-23042: Fixed multiple issues which could have lead to read/write access to memory pages or denial of service. These issues are related to the Xen PV device frontend drivers (bsc#1196488). - CVE-2022-26490: Fixed a buffer overflow in the st21nfca driver. An attacker with adjacent NFC access could trigger crash the system or corrupt system memory (bsc#1196830). - CVE-2022-0617: Fixed a null pointer dereference in UDF file system functionality. A local user could crash the system by triggering udf_file_write_iter() via a malicious UDF image (bsc#1196079). - CVE-2022-25375: The RNDIS USB gadget lacks validation of the size of the RNDIS_MSG_SET command. Attackers can obtain sensitive information from kernel memory (bsc#1196235). - CVE-2022-25258: The USB Gadget subsystem lacked certain validation of interface OS descriptor requests, which could have lead to memory corruption (bsc#1196096). - CVE-2021-44879: In gc_data_segment() in fs/f2fs/gc.c, special files were not considered, which lead to a move_data_page NULL pointer dereference (bsc#1195987). - CVE-2022-24959: Fixed a memory leak in yam_siocdevprivate() in drivers/net/hamradio/yam.c (bsc#1195897). - CVE-2022-24958: drivers/usb/gadget/legacy/inode.c mishandled dev->buf release (bsc#1195905). - CVE-2022-0516: Fixed missing check in ioctl related to KVM in s390 allows kernel memory read/write (bsc#1195516). - CVE-2022-24448: Fixed an issue in fs/nfs/dir.c. If an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should have occured, but the server instead returned uninitialized data in the file descriptor (bsc#1195612). - CVE-2022-0492: Fixed a privilege escalation related to cgroups v1 release_agent feature, which allowed bypassing namespace isolation unexpectedly (bsc#1195543). - CVE-2022-28748: Fixed various information leaks that could be caused by malicious USB devices (bsc#1196018). - CVE-2022-0644: Fixed a denial of service by a local user. A assertion failure could be triggered in kernel_read_file_from_fd() (bsc#1196155) - CVE-2022-0850: Fixed a kernel information leak vulnerability in iov_iter.c (bsc#1196761). - CVE-2022-1016: Fixed a vulnerability in the nf_tables component of the netfilter subsystem. This vulnerability gives an attacker a powerful primitive that can be used to both read from and write to relative stack data, which can lead to arbitrary code execution (bsc#1197227). The following non-security bugs were fixed: - cifs: use the correct max-length for dentry_path_raw() (bsc#1196196). - gve: multiple bugfixes (jsc#SLE-23652). - net/mlx5e: Fix page DMA map/unmap attributes (bsc#1196468). - netfilter: conntrack: do not refresh sctp entries in closed state (bsc#1197389). - powerpc/mm/numa: skip NUMA_NO_NODE onlining in parse_numa_properties() (bsc#1179639). - scsi: lpfc: Fix pt2pt NVMe PRLI reject LOGO loop (bsc#1189126). - scsi: target: iscsi: Fix cmd abort fabric stop race (bsc#1195286).

Patchnames

SUSE-2022-1257,SUSE-SLE-Module-RT-15-SP2-2022-1257,SUSE-SUSE-MicroOS-5.0-2022-1257

CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

JSON

To clipboard

{
   document: {
      aggregate_severity: {
         namespace: "https://www.suse.com/support/security/rating/",
         text: "important",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright 2024 SUSE LLC. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "Security update for the Linux Kernel",
            title: "Title of the patch",
         },
         {
            category: "description",
            text: "\nThe SUSE Linux Enterprise 15 SP2 RT kernel was updated to receive various security bugfixes.\n\n\nThe following security bugs were fixed:\n\n- CVE-2022-0854: Fixed a memory leak flaw was found in the Linux kernels DMA subsystem. This flaw allowed a local user to read random memory from the kernel space (bnc#1196823).\n- CVE-2022-28388: Fixed a double free in drivers/net/can/usb/usb_8dev.c vulnerability in the Linux kernel (bnc#1198032).\n- CVE-2022-28389: Fixed a double free in drivers/net/can/usb/mcba_usb.c vulnerability in the Linux kernel (bnc#1198033).\n- CVE-2022-28390: Fixed a double free in drivers/net/can/usb/ems_usb.c vulnerability in the Linux kernel (bnc#1198031).\n- CVE-2022-1048: Fixed a race Condition in snd_pcm_hw_free leading to use-after-free due to the AB/BA lock with buffer_mutex and mmap_lock (bsc#1197331).\n- CVE-2022-1055: Fixed a use-after-free in tc_new_tfilter that could allow a local attacker to gain privilege escalation (bnc#1197702).\n- CVE-2022-27666: Fixed a buffer overflow vulnerability in IPsec ESP transformation code. This flaw allowed a local attacker with a normal user privilege to overwrite kernel heap objects and may cause a local privilege escalation (bnc#1197462).\n- CVE-2021-45868: Fixed a wrong validation check in fs/quota/quota_tree.c which could lead to an use-after-free if there is a corrupted quota file (bnc#1197366).\n- CVE-2022-26966: Fixed an issue in drivers/net/usb/sr9700.c, which allowed attackers to obtain sensitive information from the memory via crafted frame lengths from a USB device (bsc#1196836).\n- CVE-2021-39698: Fixed a possible memory corruption due to a use after free in aio_poll_complete_work. This could lead to local escalation of privilege with no additional execution privileges needed (bsc#1196956).\n- CVE-2021-0920: Fixed a local privilege escalation due to a use-after-free bug in unix_gc (bsc#1193731).\n- CVE-2022-23036,CVE-2022-23037,CVE-2022-23038,CVE-2022-23039,CVE-2022-23040,CVE-2022-23041,CVE-2022-23042: Fixed multiple issues which could have lead to read/write access to memory pages or denial of service. These issues are related to the Xen PV device frontend drivers (bsc#1196488).\n- CVE-2022-26490: Fixed a buffer overflow in the st21nfca driver. An attacker with adjacent NFC access could trigger crash the system or corrupt system memory (bsc#1196830).\n- CVE-2022-0617: Fixed a null pointer dereference in UDF file system functionality. A local user could crash the system by triggering udf_file_write_iter() via a malicious UDF image (bsc#1196079).\n- CVE-2022-25375: The RNDIS USB gadget lacks validation of the size of the RNDIS_MSG_SET command. Attackers can obtain sensitive information from kernel memory (bsc#1196235).\n- CVE-2022-25258: The USB Gadget subsystem lacked certain validation of interface OS descriptor requests, which could have lead to memory corruption (bsc#1196096).\n- CVE-2021-44879: In gc_data_segment() in fs/f2fs/gc.c, special files were not considered, which lead to a move_data_page NULL pointer dereference (bsc#1195987).\n- CVE-2022-24959: Fixed a memory leak in yam_siocdevprivate() in drivers/net/hamradio/yam.c (bsc#1195897).\n- CVE-2022-24958: drivers/usb/gadget/legacy/inode.c mishandled dev->buf release (bsc#1195905).\n- CVE-2022-0516: Fixed missing check in ioctl related to KVM in s390 allows kernel memory read/write (bsc#1195516).\n- CVE-2022-24448: Fixed an issue in fs/nfs/dir.c. If an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should have occured, but the server instead returned uninitialized data in the file descriptor (bsc#1195612).\n- CVE-2022-0492: Fixed a privilege escalation related to cgroups v1 release_agent feature, which allowed bypassing namespace isolation unexpectedly (bsc#1195543).\n- CVE-2022-28748: Fixed various information leaks that could be caused by malicious USB devices (bsc#1196018).\n- CVE-2022-0644: Fixed a denial of service by a local user. A assertion failure could be triggered in kernel_read_file_from_fd() (bsc#1196155)\n- CVE-2022-0850: Fixed a kernel information leak vulnerability in iov_iter.c (bsc#1196761).\n- CVE-2022-1016: Fixed a vulnerability in the nf_tables component of the netfilter subsystem. This vulnerability gives an attacker a powerful primitive that can be used to both read from and write to relative stack data, which can lead to arbitrary code execution (bsc#1197227).\n\n\nThe following non-security bugs were fixed:\n\n- cifs: use the correct max-length for dentry_path_raw() (bsc#1196196).\n- gve: multiple bugfixes (jsc#SLE-23652).\n- net/mlx5e: Fix page DMA map/unmap attributes (bsc#1196468).\n- netfilter: conntrack: do not refresh sctp entries in closed state (bsc#1197389).\n- powerpc/mm/numa: skip NUMA_NO_NODE onlining in parse_numa_properties() (bsc#1179639).\n- scsi: lpfc: Fix pt2pt NVMe PRLI reject LOGO loop (bsc#1189126).\n- scsi: target: iscsi: Fix cmd abort fabric stop race (bsc#1195286).\n",
            title: "Description of the patch",
         },
         {
            category: "details",
            text: "SUSE-2022-1257,SUSE-SLE-Module-RT-15-SP2-2022-1257,SUSE-SUSE-MicroOS-5.0-2022-1257",
            title: "Patchnames",
         },
         {
            category: "legal_disclaimer",
            text: "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
            title: "Terms of use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://www.suse.com/support/security/contact/",
         name: "SUSE Product Security Team",
         namespace: "https://www.suse.com/",
      },
      references: [
         {
            category: "external",
            summary: "SUSE ratings",
            url: "https://www.suse.com/support/security/rating/",
         },
         {
            category: "self",
            summary: "URL of this CSAF notice",
            url: "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2022_1257-1.json",
         },
         {
            category: "self",
            summary: "URL for SUSE-SU-2022:1257-1",
            url: "https://www.suse.com/support/update/announcement/2022/suse-su-20221257-1/",
         },
         {
            category: "self",
            summary: "E-Mail link for SUSE-SU-2022:1257-1",
            url: "https://lists.suse.com/pipermail/sle-security-updates/2022-April/010746.html",
         },
         {
            category: "self",
            summary: "SUSE Bug 1179639",
            url: "https://bugzilla.suse.com/1179639",
         },
         {
            category: "self",
            summary: "SUSE Bug 1189126",
            url: "https://bugzilla.suse.com/1189126",
         },
         {
            category: "self",
            summary: "SUSE Bug 1189562",
            url: "https://bugzilla.suse.com/1189562",
         },
         {
            category: "self",
            summary: "SUSE Bug 1193731",
            url: "https://bugzilla.suse.com/1193731",
         },
         {
            category: "self",
            summary: "SUSE Bug 1194516",
            url: "https://bugzilla.suse.com/1194516",
         },
         {
            category: "self",
            summary: "SUSE Bug 1194943",
            url: "https://bugzilla.suse.com/1194943",
         },
         {
            category: "self",
            summary: "SUSE Bug 1195051",
            url: "https://bugzilla.suse.com/1195051",
         },
         {
            category: "self",
            summary: "SUSE Bug 1195254",
            url: "https://bugzilla.suse.com/1195254",
         },
         {
            category: "self",
            summary: "SUSE Bug 1195286",
            url: "https://bugzilla.suse.com/1195286",
         },
         {
            category: "self",
            summary: "SUSE Bug 1195353",
            url: "https://bugzilla.suse.com/1195353",
         },
         {
            category: "self",
            summary: "SUSE Bug 1195403",
            url: "https://bugzilla.suse.com/1195403",
         },
         {
            category: "self",
            summary: "SUSE Bug 1195516",
            url: "https://bugzilla.suse.com/1195516",
         },
         {
            category: "self",
            summary: "SUSE Bug 1195543",
            url: "https://bugzilla.suse.com/1195543",
         },
         {
            category: "self",
            summary: "SUSE Bug 1195612",
            url: "https://bugzilla.suse.com/1195612",
         },
         {
            category: "self",
            summary: "SUSE Bug 1195897",
            url: "https://bugzilla.suse.com/1195897",
         },
         {
            category: "self",
            summary: "SUSE Bug 1195905",
            url: "https://bugzilla.suse.com/1195905",
         },
         {
            category: "self",
            summary: "SUSE Bug 1195939",
            url: "https://bugzilla.suse.com/1195939",
         },
         {
            category: "self",
            summary: "SUSE Bug 1195987",
            url: "https://bugzilla.suse.com/1195987",
         },
         {
            category: "self",
            summary: "SUSE Bug 1196018",
            url: "https://bugzilla.suse.com/1196018",
         },
         {
            category: "self",
            summary: "SUSE Bug 1196079",
            url: "https://bugzilla.suse.com/1196079",
         },
         {
            category: "self",
            summary: "SUSE Bug 1196095",
            url: "https://bugzilla.suse.com/1196095",
         },
         {
            category: "self",
            summary: "SUSE Bug 1196155",
            url: "https://bugzilla.suse.com/1196155",
         },
         {
            category: "self",
            summary: "SUSE Bug 1196196",
            url: "https://bugzilla.suse.com/1196196",
         },
         {
            category: "self",
            summary: "SUSE Bug 1196235",
            url: "https://bugzilla.suse.com/1196235",
         },
         {
            category: "self",
            summary: "SUSE Bug 1196468",
            url: "https://bugzilla.suse.com/1196468",
         },
         {
            category: "self",
            summary: "SUSE Bug 1196488",
            url: "https://bugzilla.suse.com/1196488",
         },
         {
            category: "self",
            summary: "SUSE Bug 1196612",
            url: "https://bugzilla.suse.com/1196612",
         },
         {
            category: "self",
            summary: "SUSE Bug 1196761",
            url: "https://bugzilla.suse.com/1196761",
         },
         {
            category: "self",
            summary: "SUSE Bug 1196776",
            url: "https://bugzilla.suse.com/1196776",
         },
         {
            category: "self",
            summary: "SUSE Bug 1196823",
            url: "https://bugzilla.suse.com/1196823",
         },
         {
            category: "self",
            summary: "SUSE Bug 1196830",
            url: "https://bugzilla.suse.com/1196830",
         },
         {
            category: "self",
            summary: "SUSE Bug 1196836",
            url: "https://bugzilla.suse.com/1196836",
         },
         {
            category: "self",
            summary: "SUSE Bug 1196956",
            url: "https://bugzilla.suse.com/1196956",
         },
         {
            category: "self",
            summary: "SUSE Bug 1197227",
            url: "https://bugzilla.suse.com/1197227",
         },
         {
            category: "self",
            summary: "SUSE Bug 1197331",
            url: "https://bugzilla.suse.com/1197331",
         },
         {
            category: "self",
            summary: "SUSE Bug 1197366",
            url: "https://bugzilla.suse.com/1197366",
         },
         {
            category: "self",
            summary: "SUSE Bug 1197389",
            url: "https://bugzilla.suse.com/1197389",
         },
         {
            category: "self",
            summary: "SUSE Bug 1197462",
            url: "https://bugzilla.suse.com/1197462",
         },
         {
            category: "self",
            summary: "SUSE Bug 1197702",
            url: "https://bugzilla.suse.com/1197702",
         },
         {
            category: "self",
            summary: "SUSE Bug 1198031",
            url: "https://bugzilla.suse.com/1198031",
         },
         {
            category: "self",
            summary: "SUSE Bug 1198032",
            url: "https://bugzilla.suse.com/1198032",
         },
         {
            category: "self",
            summary: "SUSE Bug 1198033",
            url: "https://bugzilla.suse.com/1198033",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2021-0920 page",
            url: "https://www.suse.com/security/cve/CVE-2021-0920/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2021-39698 page",
            url: "https://www.suse.com/security/cve/CVE-2021-39698/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2021-44879 page",
            url: "https://www.suse.com/security/cve/CVE-2021-44879/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2021-45868 page",
            url: "https://www.suse.com/security/cve/CVE-2021-45868/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2022-0487 page",
            url: "https://www.suse.com/security/cve/CVE-2022-0487/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2022-0492 page",
            url: "https://www.suse.com/security/cve/CVE-2022-0492/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2022-0516 page",
            url: "https://www.suse.com/security/cve/CVE-2022-0516/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2022-0617 page",
            url: "https://www.suse.com/security/cve/CVE-2022-0617/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2022-0644 page",
            url: "https://www.suse.com/security/cve/CVE-2022-0644/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2022-0850 page",
            url: "https://www.suse.com/security/cve/CVE-2022-0850/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2022-0854 page",
            url: "https://www.suse.com/security/cve/CVE-2022-0854/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2022-1016 page",
            url: "https://www.suse.com/security/cve/CVE-2022-1016/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2022-1048 page",
            url: "https://www.suse.com/security/cve/CVE-2022-1048/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2022-1055 page",
            url: "https://www.suse.com/security/cve/CVE-2022-1055/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2022-23036 page",
            url: "https://www.suse.com/security/cve/CVE-2022-23036/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2022-23037 page",
            url: "https://www.suse.com/security/cve/CVE-2022-23037/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2022-23038 page",
            url: "https://www.suse.com/security/cve/CVE-2022-23038/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2022-23039 page",
            url: "https://www.suse.com/security/cve/CVE-2022-23039/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2022-23040 page",
            url: "https://www.suse.com/security/cve/CVE-2022-23040/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2022-23041 page",
            url: "https://www.suse.com/security/cve/CVE-2022-23041/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2022-23042 page",
            url: "https://www.suse.com/security/cve/CVE-2022-23042/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2022-24448 page",
            url: "https://www.suse.com/security/cve/CVE-2022-24448/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2022-24958 page",
            url: "https://www.suse.com/security/cve/CVE-2022-24958/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2022-24959 page",
            url: "https://www.suse.com/security/cve/CVE-2022-24959/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2022-25258 page",
            url: "https://www.suse.com/security/cve/CVE-2022-25258/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2022-25375 page",
            url: "https://www.suse.com/security/cve/CVE-2022-25375/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2022-26490 page",
            url: "https://www.suse.com/security/cve/CVE-2022-26490/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2022-26966 page",
            url: "https://www.suse.com/security/cve/CVE-2022-26966/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2022-27666 page",
            url: "https://www.suse.com/security/cve/CVE-2022-27666/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2022-28388 page",
            url: "https://www.suse.com/security/cve/CVE-2022-28388/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2022-28389 page",
            url: "https://www.suse.com/security/cve/CVE-2022-28389/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2022-28390 page",
            url: "https://www.suse.com/security/cve/CVE-2022-28390/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2022-28748 page",
            url: "https://www.suse.com/security/cve/CVE-2022-28748/",
         },
      ],
      title: "Security update for the Linux Kernel",
      tracking: {
         current_release_date: "2022-04-19T09:03:30Z",
         generator: {
            date: "2022-04-19T09:03:30Z",
            engine: {
               name: "cve-database.git:bin/generate-csaf.pl",
               version: "1",
            },
         },
         id: "SUSE-SU-2022:1257-1",
         initial_release_date: "2022-04-19T09:03:30Z",
         revision_history: [
            {
               date: "2022-04-19T09:03:30Z",
               number: "1",
               summary: "Current version",
            },
         ],
         status: "final",
         version: "1",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "kernel-devel-rt-5.3.18-150200.79.2.noarch",
                        product: {
                           name: "kernel-devel-rt-5.3.18-150200.79.2.noarch",
                           product_id: "kernel-devel-rt-5.3.18-150200.79.2.noarch",
                        },
                     },
                     {
                        category: "product_version",
                        name: "kernel-source-rt-5.3.18-150200.79.2.noarch",
                        product: {
                           name: "kernel-source-rt-5.3.18-150200.79.2.noarch",
                           product_id: "kernel-source-rt-5.3.18-150200.79.2.noarch",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "noarch",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
                        product: {
                           name: "cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
                           product_id: "cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "cluster-md-kmp-rt_debug-5.3.18-150200.79.2.x86_64",
                        product: {
                           name: "cluster-md-kmp-rt_debug-5.3.18-150200.79.2.x86_64",
                           product_id: "cluster-md-kmp-rt_debug-5.3.18-150200.79.2.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
                        product: {
                           name: "dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
                           product_id: "dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "dlm-kmp-rt_debug-5.3.18-150200.79.2.x86_64",
                        product: {
                           name: "dlm-kmp-rt_debug-5.3.18-150200.79.2.x86_64",
                           product_id: "dlm-kmp-rt_debug-5.3.18-150200.79.2.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                        product: {
                           name: "gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                           product_id: "gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "gfs2-kmp-rt_debug-5.3.18-150200.79.2.x86_64",
                        product: {
                           name: "gfs2-kmp-rt_debug-5.3.18-150200.79.2.x86_64",
                           product_id: "gfs2-kmp-rt_debug-5.3.18-150200.79.2.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "kernel-rt-5.3.18-150200.79.2.x86_64",
                        product: {
                           name: "kernel-rt-5.3.18-150200.79.2.x86_64",
                           product_id: "kernel-rt-5.3.18-150200.79.2.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "kernel-rt-devel-5.3.18-150200.79.2.x86_64",
                        product: {
                           name: "kernel-rt-devel-5.3.18-150200.79.2.x86_64",
                           product_id: "kernel-rt-devel-5.3.18-150200.79.2.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "kernel-rt-extra-5.3.18-150200.79.2.x86_64",
                        product: {
                           name: "kernel-rt-extra-5.3.18-150200.79.2.x86_64",
                           product_id: "kernel-rt-extra-5.3.18-150200.79.2.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "kernel-rt-livepatch-devel-5.3.18-150200.79.2.x86_64",
                        product: {
                           name: "kernel-rt-livepatch-devel-5.3.18-150200.79.2.x86_64",
                           product_id: "kernel-rt-livepatch-devel-5.3.18-150200.79.2.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "kernel-rt_debug-5.3.18-150200.79.2.x86_64",
                        product: {
                           name: "kernel-rt_debug-5.3.18-150200.79.2.x86_64",
                           product_id: "kernel-rt_debug-5.3.18-150200.79.2.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
                        product: {
                           name: "kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
                           product_id: "kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "kernel-rt_debug-extra-5.3.18-150200.79.2.x86_64",
                        product: {
                           name: "kernel-rt_debug-extra-5.3.18-150200.79.2.x86_64",
                           product_id: "kernel-rt_debug-extra-5.3.18-150200.79.2.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "kernel-rt_debug-livepatch-devel-5.3.18-150200.79.2.x86_64",
                        product: {
                           name: "kernel-rt_debug-livepatch-devel-5.3.18-150200.79.2.x86_64",
                           product_id: "kernel-rt_debug-livepatch-devel-5.3.18-150200.79.2.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "kernel-syms-rt-5.3.18-150200.79.1.x86_64",
                        product: {
                           name: "kernel-syms-rt-5.3.18-150200.79.1.x86_64",
                           product_id: "kernel-syms-rt-5.3.18-150200.79.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "kselftests-kmp-rt-5.3.18-150200.79.2.x86_64",
                        product: {
                           name: "kselftests-kmp-rt-5.3.18-150200.79.2.x86_64",
                           product_id: "kselftests-kmp-rt-5.3.18-150200.79.2.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "kselftests-kmp-rt_debug-5.3.18-150200.79.2.x86_64",
                        product: {
                           name: "kselftests-kmp-rt_debug-5.3.18-150200.79.2.x86_64",
                           product_id: "kselftests-kmp-rt_debug-5.3.18-150200.79.2.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                        product: {
                           name: "ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                           product_id: "ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "ocfs2-kmp-rt_debug-5.3.18-150200.79.2.x86_64",
                        product: {
                           name: "ocfs2-kmp-rt_debug-5.3.18-150200.79.2.x86_64",
                           product_id: "ocfs2-kmp-rt_debug-5.3.18-150200.79.2.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "reiserfs-kmp-rt-5.3.18-150200.79.2.x86_64",
                        product: {
                           name: "reiserfs-kmp-rt-5.3.18-150200.79.2.x86_64",
                           product_id: "reiserfs-kmp-rt-5.3.18-150200.79.2.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "reiserfs-kmp-rt_debug-5.3.18-150200.79.2.x86_64",
                        product: {
                           name: "reiserfs-kmp-rt_debug-5.3.18-150200.79.2.x86_64",
                           product_id: "reiserfs-kmp-rt_debug-5.3.18-150200.79.2.x86_64",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "x86_64",
               },
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "SUSE Real Time Module 15 SP2",
                        product: {
                           name: "SUSE Real Time Module 15 SP2",
                           product_id: "SUSE Real Time Module 15 SP2",
                           product_identification_helper: {
                              cpe: "cpe:/o:suse:sle-module-rt:15:sp2",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "SUSE Linux Enterprise Micro 5.0",
                        product: {
                           name: "SUSE Linux Enterprise Micro 5.0",
                           product_id: "SUSE Linux Enterprise Micro 5.0",
                           product_identification_helper: {
                              cpe: "cpe:/o:suse:suse-microos:5.0",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "SUSE Linux Enterprise",
               },
            ],
            category: "vendor",
            name: "SUSE",
         },
      ],
      relationships: [
         {
            category: "default_component_of",
            full_product_name: {
               name: "cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64 as component of SUSE Real Time Module 15 SP2",
               product_id: "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
            },
            product_reference: "cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
            relates_to_product_reference: "SUSE Real Time Module 15 SP2",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "dlm-kmp-rt-5.3.18-150200.79.2.x86_64 as component of SUSE Real Time Module 15 SP2",
               product_id: "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
            },
            product_reference: "dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
            relates_to_product_reference: "SUSE Real Time Module 15 SP2",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "gfs2-kmp-rt-5.3.18-150200.79.2.x86_64 as component of SUSE Real Time Module 15 SP2",
               product_id: "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
            },
            product_reference: "gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
            relates_to_product_reference: "SUSE Real Time Module 15 SP2",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "kernel-devel-rt-5.3.18-150200.79.2.noarch as component of SUSE Real Time Module 15 SP2",
               product_id: "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
            },
            product_reference: "kernel-devel-rt-5.3.18-150200.79.2.noarch",
            relates_to_product_reference: "SUSE Real Time Module 15 SP2",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "kernel-rt-5.3.18-150200.79.2.x86_64 as component of SUSE Real Time Module 15 SP2",
               product_id: "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
            },
            product_reference: "kernel-rt-5.3.18-150200.79.2.x86_64",
            relates_to_product_reference: "SUSE Real Time Module 15 SP2",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "kernel-rt-devel-5.3.18-150200.79.2.x86_64 as component of SUSE Real Time Module 15 SP2",
               product_id: "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
            },
            product_reference: "kernel-rt-devel-5.3.18-150200.79.2.x86_64",
            relates_to_product_reference: "SUSE Real Time Module 15 SP2",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "kernel-rt_debug-5.3.18-150200.79.2.x86_64 as component of SUSE Real Time Module 15 SP2",
               product_id: "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
            },
            product_reference: "kernel-rt_debug-5.3.18-150200.79.2.x86_64",
            relates_to_product_reference: "SUSE Real Time Module 15 SP2",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64 as component of SUSE Real Time Module 15 SP2",
               product_id: "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
            },
            product_reference: "kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
            relates_to_product_reference: "SUSE Real Time Module 15 SP2",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "kernel-source-rt-5.3.18-150200.79.2.noarch as component of SUSE Real Time Module 15 SP2",
               product_id: "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
            },
            product_reference: "kernel-source-rt-5.3.18-150200.79.2.noarch",
            relates_to_product_reference: "SUSE Real Time Module 15 SP2",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "kernel-syms-rt-5.3.18-150200.79.1.x86_64 as component of SUSE Real Time Module 15 SP2",
               product_id: "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
            },
            product_reference: "kernel-syms-rt-5.3.18-150200.79.1.x86_64",
            relates_to_product_reference: "SUSE Real Time Module 15 SP2",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64 as component of SUSE Real Time Module 15 SP2",
               product_id: "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
            },
            product_reference: "ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
            relates_to_product_reference: "SUSE Real Time Module 15 SP2",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "kernel-rt-5.3.18-150200.79.2.x86_64 as component of SUSE Linux Enterprise Micro 5.0",
               product_id: "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
            },
            product_reference: "kernel-rt-5.3.18-150200.79.2.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Micro 5.0",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2021-0920",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2021-0920",
            },
         ],
         notes: [
            {
               category: "general",
               text: "In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-196926917References: Upstream kernel",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
               "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
               "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
               "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2021-0920",
               url: "https://www.suse.com/security/cve/CVE-2021-0920",
            },
            {
               category: "external",
               summary: "SUSE Bug 1193731 for CVE-2021-0920",
               url: "https://bugzilla.suse.com/1193731",
            },
            {
               category: "external",
               summary: "SUSE Bug 1194463 for CVE-2021-0920",
               url: "https://bugzilla.suse.com/1194463",
            },
            {
               category: "external",
               summary: "SUSE Bug 1195939 for CVE-2021-0920",
               url: "https://bugzilla.suse.com/1195939",
            },
            {
               category: "external",
               summary: "SUSE Bug 1199255 for CVE-2021-0920",
               url: "https://bugzilla.suse.com/1199255",
            },
            {
               category: "external",
               summary: "SUSE Bug 1200084 for CVE-2021-0920",
               url: "https://bugzilla.suse.com/1200084",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
                  "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
                  "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-04-19T09:03:30Z",
               details: "important",
            },
         ],
         title: "CVE-2021-0920",
      },
      {
         cve: "CVE-2021-39698",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2021-39698",
            },
         ],
         notes: [
            {
               category: "general",
               text: "In aio_poll_complete_work of aio.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-185125206References: Upstream kernel",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
               "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
               "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
               "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2021-39698",
               url: "https://www.suse.com/security/cve/CVE-2021-39698",
            },
            {
               category: "external",
               summary: "SUSE Bug 1196956 for CVE-2021-39698",
               url: "https://bugzilla.suse.com/1196956",
            },
            {
               category: "external",
               summary: "SUSE Bug 1196959 for CVE-2021-39698",
               url: "https://bugzilla.suse.com/1196959",
            },
            {
               category: "external",
               summary: "SUSE Bug 1209225 for CVE-2021-39698",
               url: "https://bugzilla.suse.com/1209225",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
                  "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.4,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
                  "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-04-19T09:03:30Z",
               details: "important",
            },
         ],
         title: "CVE-2021-39698",
      },
      {
         cve: "CVE-2021-44879",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2021-44879",
            },
         ],
         notes: [
            {
               category: "general",
               text: "In gc_data_segment in fs/f2fs/gc.c in the Linux kernel before 5.16.3, special files are not considered, leading to a move_data_page NULL pointer dereference.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
               "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
               "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
               "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2021-44879",
               url: "https://www.suse.com/security/cve/CVE-2021-44879",
            },
            {
               category: "external",
               summary: "SUSE Bug 1195987 for CVE-2021-44879",
               url: "https://bugzilla.suse.com/1195987",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
                  "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.5,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
                  "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-04-19T09:03:30Z",
               details: "moderate",
            },
         ],
         title: "CVE-2021-44879",
      },
      {
         cve: "CVE-2021-45868",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2021-45868",
            },
         ],
         notes: [
            {
               category: "general",
               text: "In the Linux kernel before 5.15.3, fs/quota/quota_tree.c does not validate the block number in the quota tree (on disk). This can, for example, lead to a kernel/locking/rwsem.c use-after-free if there is a corrupted quota file.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
               "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
               "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
               "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2021-45868",
               url: "https://www.suse.com/security/cve/CVE-2021-45868",
            },
            {
               category: "external",
               summary: "SUSE Bug 1197366 for CVE-2021-45868",
               url: "https://bugzilla.suse.com/1197366",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
                  "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.1,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
                  "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-04-19T09:03:30Z",
               details: "moderate",
            },
         ],
         title: "CVE-2021-45868",
      },
      {
         cve: "CVE-2022-0487",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2022-0487",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A use-after-free vulnerability was found in rtsx_usb_ms_drv_remove in drivers/memstick/host/rtsx_usb_ms.c in memstick in the Linux kernel. In this flaw, a local attacker with a user privilege may impact system Confidentiality. This flaw affects kernel versions prior to 5.14 rc1.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
               "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
               "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
               "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2022-0487",
               url: "https://www.suse.com/security/cve/CVE-2022-0487",
            },
            {
               category: "external",
               summary: "SUSE Bug 1194516 for CVE-2022-0487",
               url: "https://bugzilla.suse.com/1194516",
            },
            {
               category: "external",
               summary: "SUSE Bug 1195949 for CVE-2022-0487",
               url: "https://bugzilla.suse.com/1195949",
            },
            {
               category: "external",
               summary: "SUSE Bug 1198615 for CVE-2022-0487",
               url: "https://bugzilla.suse.com/1198615",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
                  "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
                  "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-04-19T09:03:30Z",
               details: "moderate",
            },
         ],
         title: "CVE-2022-0487",
      },
      {
         cve: "CVE-2022-0492",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2022-0492",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A vulnerability was found in the Linux kernel's cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
               "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
               "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
               "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2022-0492",
               url: "https://www.suse.com/security/cve/CVE-2022-0492",
            },
            {
               category: "external",
               summary: "SUSE Bug 1195543 for CVE-2022-0492",
               url: "https://bugzilla.suse.com/1195543",
            },
            {
               category: "external",
               summary: "SUSE Bug 1195908 for CVE-2022-0492",
               url: "https://bugzilla.suse.com/1195908",
            },
            {
               category: "external",
               summary: "SUSE Bug 1196612 for CVE-2022-0492",
               url: "https://bugzilla.suse.com/1196612",
            },
            {
               category: "external",
               summary: "SUSE Bug 1196776 for CVE-2022-0492",
               url: "https://bugzilla.suse.com/1196776",
            },
            {
               category: "external",
               summary: "SUSE Bug 1198615 for CVE-2022-0492",
               url: "https://bugzilla.suse.com/1198615",
            },
            {
               category: "external",
               summary: "SUSE Bug 1199255 for CVE-2022-0492",
               url: "https://bugzilla.suse.com/1199255",
            },
            {
               category: "external",
               summary: "SUSE Bug 1199615 for CVE-2022-0492",
               url: "https://bugzilla.suse.com/1199615",
            },
            {
               category: "external",
               summary: "SUSE Bug 1200084 for CVE-2022-0492",
               url: "https://bugzilla.suse.com/1200084",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
                  "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
                  "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-04-19T09:03:30Z",
               details: "moderate",
            },
         ],
         title: "CVE-2022-0492",
      },
      {
         cve: "CVE-2022-0516",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2022-0516",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A vulnerability was found in kvm_s390_guest_sida_op in the arch/s390/kvm/kvm-s390.c function in KVM for s390 in the Linux kernel. This flaw allows a local attacker with a normal user privilege to obtain unauthorized memory write access. This flaw affects Linux kernel versions prior to 5.17-rc4.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
               "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
               "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
               "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2022-0516",
               url: "https://www.suse.com/security/cve/CVE-2022-0516",
            },
            {
               category: "external",
               summary: "SUSE Bug 1195516 for CVE-2022-0516",
               url: "https://bugzilla.suse.com/1195516",
            },
            {
               category: "external",
               summary: "SUSE Bug 1195947 for CVE-2022-0516",
               url: "https://bugzilla.suse.com/1195947",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
                  "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
                  "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-04-19T09:03:30Z",
               details: "important",
            },
         ],
         title: "CVE-2022-0516",
      },
      {
         cve: "CVE-2022-0617",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2022-0617",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A flaw null pointer dereference in the Linux kernel UDF file system functionality was found in the way user triggers udf_file_write_iter function for the malicious UDF image. A local user could use this flaw to crash the system. Actual from Linux kernel 4.2-rc1 till 5.17-rc2.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
               "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
               "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
               "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2022-0617",
               url: "https://www.suse.com/security/cve/CVE-2022-0617",
            },
            {
               category: "external",
               summary: "SUSE Bug 1196079 for CVE-2022-0617",
               url: "https://bugzilla.suse.com/1196079",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
                  "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.5,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
                  "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-04-19T09:03:30Z",
               details: "moderate",
            },
         ],
         title: "CVE-2022-0617",
      },
      {
         cve: "CVE-2022-0644",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2022-0644",
            },
         ],
         notes: [
            {
               category: "general",
               text: "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
               "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
               "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
               "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2022-0644",
               url: "https://www.suse.com/security/cve/CVE-2022-0644",
            },
            {
               category: "external",
               summary: "SUSE Bug 1196155 for CVE-2022-0644",
               url: "https://bugzilla.suse.com/1196155",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
                  "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.5,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
                  "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-04-19T09:03:30Z",
               details: "moderate",
            },
         ],
         title: "CVE-2022-0644",
      },
      {
         cve: "CVE-2022-0850",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2022-0850",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A vulnerability was found in linux kernel, where an information leak occurs via ext4_extent_header to userspace.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
               "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
               "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
               "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2022-0850",
               url: "https://www.suse.com/security/cve/CVE-2022-0850",
            },
            {
               category: "external",
               summary: "SUSE Bug 1196761 for CVE-2022-0850",
               url: "https://bugzilla.suse.com/1196761",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
                  "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 4.4,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
                  "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-04-19T09:03:30Z",
               details: "moderate",
            },
         ],
         title: "CVE-2022-0850",
      },
      {
         cve: "CVE-2022-0854",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2022-0854",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A memory leak flaw was found in the Linux kernel's DMA subsystem, in the way a user calls DMA_FROM_DEVICE. This flaw allows a local user to read random memory from the kernel space.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
               "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
               "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
               "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2022-0854",
               url: "https://www.suse.com/security/cve/CVE-2022-0854",
            },
            {
               category: "external",
               summary: "SUSE Bug 1196823 for CVE-2022-0854",
               url: "https://bugzilla.suse.com/1196823",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
                  "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.5,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
                  "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-04-19T09:03:30Z",
               details: "moderate",
            },
         ],
         title: "CVE-2022-0854",
      },
      {
         cve: "CVE-2022-1016",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2022-1016",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A flaw was found in the Linux kernel in net/netfilter/nf_tables_core.c:nft_do_chain, which can cause a use-after-free. This issue needs to handle 'return' with proper preconditions, as it can lead to a kernel information leak problem caused by a local, unprivileged attacker.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
               "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
               "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
               "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2022-1016",
               url: "https://www.suse.com/security/cve/CVE-2022-1016",
            },
            {
               category: "external",
               summary: "SUSE Bug 1197335 for CVE-2022-1016",
               url: "https://bugzilla.suse.com/1197335",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
                  "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.5,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
                  "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-04-19T09:03:30Z",
               details: "important",
            },
         ],
         title: "CVE-2022-1016",
      },
      {
         cve: "CVE-2022-1048",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2022-1048",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A use-after-free flaw was found in the Linux kernel's sound subsystem in the way a user triggers concurrent calls of PCM hw_params. The hw_free ioctls or similar race condition happens inside ALSA PCM for other ioctls. This flaw allows a local user to crash or potentially escalate their privileges on the system.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
               "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
               "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
               "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2022-1048",
               url: "https://www.suse.com/security/cve/CVE-2022-1048",
            },
            {
               category: "external",
               summary: "SUSE Bug 1197331 for CVE-2022-1048",
               url: "https://bugzilla.suse.com/1197331",
            },
            {
               category: "external",
               summary: "SUSE Bug 1197597 for CVE-2022-1048",
               url: "https://bugzilla.suse.com/1197597",
            },
            {
               category: "external",
               summary: "SUSE Bug 1200041 for CVE-2022-1048",
               url: "https://bugzilla.suse.com/1200041",
            },
            {
               category: "external",
               summary: "SUSE Bug 1204132 for CVE-2022-1048",
               url: "https://bugzilla.suse.com/1204132",
            },
            {
               category: "external",
               summary: "SUSE Bug 1212325 for CVE-2022-1048",
               url: "https://bugzilla.suse.com/1212325",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
                  "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.4,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
                  "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-04-19T09:03:30Z",
               details: "important",
            },
         ],
         title: "CVE-2022-1048",
      },
      {
         cve: "CVE-2022-1055",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2022-1055",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A use-after-free exists in the Linux Kernel in tc_new_tfilter that could allow a local attacker to gain privilege escalation. The exploit requires unprivileged user namespaces. We recommend upgrading past commit 04c2a47ffb13c29778e2a14e414ad4cb5a5db4b5",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
               "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
               "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
               "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2022-1055",
               url: "https://www.suse.com/security/cve/CVE-2022-1055",
            },
            {
               category: "external",
               summary: "SUSE Bug 1197702 for CVE-2022-1055",
               url: "https://bugzilla.suse.com/1197702",
            },
            {
               category: "external",
               summary: "SUSE Bug 1197705 for CVE-2022-1055",
               url: "https://bugzilla.suse.com/1197705",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
                  "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 8.4,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
                  "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-04-19T09:03:30Z",
               details: "important",
            },
         ],
         title: "CVE-2022-1055",
      },
      {
         cve: "CVE-2022-23036",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2022-23036",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malicious backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they assume that a following removal of the granted access will always succeed, which is not true in case the backend has mapped the granted page between those two operations. As a result the backend can keep access to the memory page of the guest no matter how the page will be used after the frontend I/O has finished. The xenbus driver has a similar problem, as it doesn't check the success of removing the granted access of a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038 gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus, 9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no longer in use, but the freeing of the related data page is not synchronized with dropping the granted access. As a result the backend can keep access to the memory page even after it has been freed and then re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which can be triggered by the backend. CVE-2022-23042",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
               "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
               "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
               "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2022-23036",
               url: "https://www.suse.com/security/cve/CVE-2022-23036",
            },
            {
               category: "external",
               summary: "SUSE Bug 1196488 for CVE-2022-23036",
               url: "https://bugzilla.suse.com/1196488",
            },
            {
               category: "external",
               summary: "SUSE Bug 1199099 for CVE-2022-23036",
               url: "https://bugzilla.suse.com/1199099",
            },
            {
               category: "external",
               summary: "SUSE Bug 1199141 for CVE-2022-23036",
               url: "https://bugzilla.suse.com/1199141",
            },
            {
               category: "external",
               summary: "SUSE Bug 1204132 for CVE-2022-23036",
               url: "https://bugzilla.suse.com/1204132",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
                  "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
                  "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-04-19T09:03:30Z",
               details: "important",
            },
         ],
         title: "CVE-2022-23036",
      },
      {
         cve: "CVE-2022-23037",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2022-23037",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malicious backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they assume that a following removal of the granted access will always succeed, which is not true in case the backend has mapped the granted page between those two operations. As a result the backend can keep access to the memory page of the guest no matter how the page will be used after the frontend I/O has finished. The xenbus driver has a similar problem, as it doesn't check the success of removing the granted access of a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038 gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus, 9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no longer in use, but the freeing of the related data page is not synchronized with dropping the granted access. As a result the backend can keep access to the memory page even after it has been freed and then re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which can be triggered by the backend. CVE-2022-23042",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
               "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
               "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
               "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2022-23037",
               url: "https://www.suse.com/security/cve/CVE-2022-23037",
            },
            {
               category: "external",
               summary: "SUSE Bug 1199099 for CVE-2022-23037",
               url: "https://bugzilla.suse.com/1199099",
            },
            {
               category: "external",
               summary: "SUSE Bug 1199141 for CVE-2022-23037",
               url: "https://bugzilla.suse.com/1199141",
            },
            {
               category: "external",
               summary: "SUSE Bug 1204132 for CVE-2022-23037",
               url: "https://bugzilla.suse.com/1204132",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
                  "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
                  "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-04-19T09:03:30Z",
               details: "important",
            },
         ],
         title: "CVE-2022-23037",
      },
      {
         cve: "CVE-2022-23038",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2022-23038",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malicious backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they assume that a following removal of the granted access will always succeed, which is not true in case the backend has mapped the granted page between those two operations. As a result the backend can keep access to the memory page of the guest no matter how the page will be used after the frontend I/O has finished. The xenbus driver has a similar problem, as it doesn't check the success of removing the granted access of a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038 gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus, 9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no longer in use, but the freeing of the related data page is not synchronized with dropping the granted access. As a result the backend can keep access to the memory page even after it has been freed and then re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which can be triggered by the backend. CVE-2022-23042",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
               "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
               "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
               "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2022-23038",
               url: "https://www.suse.com/security/cve/CVE-2022-23038",
            },
            {
               category: "external",
               summary: "SUSE Bug 1199099 for CVE-2022-23038",
               url: "https://bugzilla.suse.com/1199099",
            },
            {
               category: "external",
               summary: "SUSE Bug 1199141 for CVE-2022-23038",
               url: "https://bugzilla.suse.com/1199141",
            },
            {
               category: "external",
               summary: "SUSE Bug 1204132 for CVE-2022-23038",
               url: "https://bugzilla.suse.com/1204132",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
                  "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
                  "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-04-19T09:03:30Z",
               details: "important",
            },
         ],
         title: "CVE-2022-23038",
      },
      {
         cve: "CVE-2022-23039",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2022-23039",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malicious backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they assume that a following removal of the granted access will always succeed, which is not true in case the backend has mapped the granted page between those two operations. As a result the backend can keep access to the memory page of the guest no matter how the page will be used after the frontend I/O has finished. The xenbus driver has a similar problem, as it doesn't check the success of removing the granted access of a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038 gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus, 9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no longer in use, but the freeing of the related data page is not synchronized with dropping the granted access. As a result the backend can keep access to the memory page even after it has been freed and then re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which can be triggered by the backend. CVE-2022-23042",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
               "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
               "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
               "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2022-23039",
               url: "https://www.suse.com/security/cve/CVE-2022-23039",
            },
            {
               category: "external",
               summary: "SUSE Bug 1199099 for CVE-2022-23039",
               url: "https://bugzilla.suse.com/1199099",
            },
            {
               category: "external",
               summary: "SUSE Bug 1199141 for CVE-2022-23039",
               url: "https://bugzilla.suse.com/1199141",
            },
            {
               category: "external",
               summary: "SUSE Bug 1204132 for CVE-2022-23039",
               url: "https://bugzilla.suse.com/1204132",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
                  "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
                  "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-04-19T09:03:30Z",
               details: "important",
            },
         ],
         title: "CVE-2022-23039",
      },
      {
         cve: "CVE-2022-23040",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2022-23040",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malicious backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they assume that a following removal of the granted access will always succeed, which is not true in case the backend has mapped the granted page between those two operations. As a result the backend can keep access to the memory page of the guest no matter how the page will be used after the frontend I/O has finished. The xenbus driver has a similar problem, as it doesn't check the success of removing the granted access of a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038 gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus, 9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no longer in use, but the freeing of the related data page is not synchronized with dropping the granted access. As a result the backend can keep access to the memory page even after it has been freed and then re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which can be triggered by the backend. CVE-2022-23042",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
               "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
               "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
               "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2022-23040",
               url: "https://www.suse.com/security/cve/CVE-2022-23040",
            },
            {
               category: "external",
               summary: "SUSE Bug 1199099 for CVE-2022-23040",
               url: "https://bugzilla.suse.com/1199099",
            },
            {
               category: "external",
               summary: "SUSE Bug 1199141 for CVE-2022-23040",
               url: "https://bugzilla.suse.com/1199141",
            },
            {
               category: "external",
               summary: "SUSE Bug 1204132 for CVE-2022-23040",
               url: "https://bugzilla.suse.com/1204132",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
                  "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
                  "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-04-19T09:03:30Z",
               details: "important",
            },
         ],
         title: "CVE-2022-23040",
      },
      {
         cve: "CVE-2022-23041",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2022-23041",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malicious backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they assume that a following removal of the granted access will always succeed, which is not true in case the backend has mapped the granted page between those two operations. As a result the backend can keep access to the memory page of the guest no matter how the page will be used after the frontend I/O has finished. The xenbus driver has a similar problem, as it doesn't check the success of removing the granted access of a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038 gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus, 9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no longer in use, but the freeing of the related data page is not synchronized with dropping the granted access. As a result the backend can keep access to the memory page even after it has been freed and then re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which can be triggered by the backend. CVE-2022-23042",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
               "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
               "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
               "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2022-23041",
               url: "https://www.suse.com/security/cve/CVE-2022-23041",
            },
            {
               category: "external",
               summary: "SUSE Bug 1199099 for CVE-2022-23041",
               url: "https://bugzilla.suse.com/1199099",
            },
            {
               category: "external",
               summary: "SUSE Bug 1199141 for CVE-2022-23041",
               url: "https://bugzilla.suse.com/1199141",
            },
            {
               category: "external",
               summary: "SUSE Bug 1204132 for CVE-2022-23041",
               url: "https://bugzilla.suse.com/1204132",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
                  "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
                  "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-04-19T09:03:30Z",
               details: "important",
            },
         ],
         title: "CVE-2022-23041",
      },
      {
         cve: "CVE-2022-23042",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2022-23042",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malicious backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they assume that a following removal of the granted access will always succeed, which is not true in case the backend has mapped the granted page between those two operations. As a result the backend can keep access to the memory page of the guest no matter how the page will be used after the frontend I/O has finished. The xenbus driver has a similar problem, as it doesn't check the success of removing the granted access of a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038 gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus, 9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no longer in use, but the freeing of the related data page is not synchronized with dropping the granted access. As a result the backend can keep access to the memory page even after it has been freed and then re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which can be triggered by the backend. CVE-2022-23042",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
               "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
               "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
               "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2022-23042",
               url: "https://www.suse.com/security/cve/CVE-2022-23042",
            },
            {
               category: "external",
               summary: "SUSE Bug 1199099 for CVE-2022-23042",
               url: "https://bugzilla.suse.com/1199099",
            },
            {
               category: "external",
               summary: "SUSE Bug 1199141 for CVE-2022-23042",
               url: "https://bugzilla.suse.com/1199141",
            },
            {
               category: "external",
               summary: "SUSE Bug 1204132 for CVE-2022-23042",
               url: "https://bugzilla.suse.com/1204132",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
                  "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
                  "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-04-19T09:03:30Z",
               details: "important",
            },
         ],
         title: "CVE-2022-23042",
      },
      {
         cve: "CVE-2022-24448",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2022-24448",
            },
         ],
         notes: [
            {
               category: "general",
               text: "An issue was discovered in fs/nfs/dir.c in the Linux kernel before 5.16.5. If an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should occur, but the server instead returns uninitialized data in the file descriptor.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
               "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
               "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
               "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2022-24448",
               url: "https://www.suse.com/security/cve/CVE-2022-24448",
            },
            {
               category: "external",
               summary: "SUSE Bug 1195612 for CVE-2022-24448",
               url: "https://bugzilla.suse.com/1195612",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
                  "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.5,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
                  "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-04-19T09:03:30Z",
               details: "moderate",
            },
         ],
         title: "CVE-2022-24448",
      },
      {
         cve: "CVE-2022-24958",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2022-24958",
            },
         ],
         notes: [
            {
               category: "general",
               text: "drivers/usb/gadget/legacy/inode.c in the Linux kernel through 5.16.8 mishandles dev->buf release.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
               "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
               "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
               "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2022-24958",
               url: "https://www.suse.com/security/cve/CVE-2022-24958",
            },
            {
               category: "external",
               summary: "SUSE Bug 1195905 for CVE-2022-24958",
               url: "https://bugzilla.suse.com/1195905",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
                  "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.5,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
                  "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-04-19T09:03:30Z",
               details: "moderate",
            },
         ],
         title: "CVE-2022-24958",
      },
      {
         cve: "CVE-2022-24959",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2022-24959",
            },
         ],
         notes: [
            {
               category: "general",
               text: "An issue was discovered in the Linux kernel before 5.16.5. There is a memory leak in yam_siocdevprivate in drivers/net/hamradio/yam.c.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
               "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
               "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
               "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2022-24959",
               url: "https://www.suse.com/security/cve/CVE-2022-24959",
            },
            {
               category: "external",
               summary: "SUSE Bug 1195897 for CVE-2022-24959",
               url: "https://bugzilla.suse.com/1195897",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
                  "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.5,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
                  "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-04-19T09:03:30Z",
               details: "moderate",
            },
         ],
         title: "CVE-2022-24959",
      },
      {
         cve: "CVE-2022-25258",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2022-25258",
            },
         ],
         notes: [
            {
               category: "general",
               text: "An issue was discovered in drivers/usb/gadget/composite.c in the Linux kernel before 5.16.10. The USB Gadget subsystem lacks certain validation of interface OS descriptor requests (ones with a large array index and ones associated with NULL function pointer retrieval). Memory corruption might occur.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
               "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
               "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
               "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2022-25258",
               url: "https://www.suse.com/security/cve/CVE-2022-25258",
            },
            {
               category: "external",
               summary: "SUSE Bug 1196095 for CVE-2022-25258",
               url: "https://bugzilla.suse.com/1196095",
            },
            {
               category: "external",
               summary: "SUSE Bug 1196132 for CVE-2022-25258",
               url: "https://bugzilla.suse.com/1196132",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
                  "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
                  "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-04-19T09:03:30Z",
               details: "important",
            },
         ],
         title: "CVE-2022-25258",
      },
      {
         cve: "CVE-2022-25375",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2022-25375",
            },
         ],
         notes: [
            {
               category: "general",
               text: "An issue was discovered in drivers/usb/gadget/function/rndis.c in the Linux kernel before 5.16.10. The RNDIS USB gadget lacks validation of the size of the RNDIS_MSG_SET command. Attackers can obtain sensitive information from kernel memory.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
               "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
               "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
               "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2022-25375",
               url: "https://www.suse.com/security/cve/CVE-2022-25375",
            },
            {
               category: "external",
               summary: "SUSE Bug 1196235 for CVE-2022-25375",
               url: "https://bugzilla.suse.com/1196235",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
                  "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.5,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
                  "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-04-19T09:03:30Z",
               details: "moderate",
            },
         ],
         title: "CVE-2022-25375",
      },
      {
         cve: "CVE-2022-26490",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2022-26490",
            },
         ],
         notes: [
            {
               category: "general",
               text: "st21nfca_connectivity_event_received in drivers/nfc/st21nfca/se.c in the Linux kernel through 5.16.12 has EVT_TRANSACTION buffer overflows because of untrusted length parameters.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
               "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
               "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
               "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2022-26490",
               url: "https://www.suse.com/security/cve/CVE-2022-26490",
            },
            {
               category: "external",
               summary: "SUSE Bug 1196830 for CVE-2022-26490",
               url: "https://bugzilla.suse.com/1196830",
            },
            {
               category: "external",
               summary: "SUSE Bug 1201656 for CVE-2022-26490",
               url: "https://bugzilla.suse.com/1201656",
            },
            {
               category: "external",
               summary: "SUSE Bug 1201969 for CVE-2022-26490",
               url: "https://bugzilla.suse.com/1201969",
            },
            {
               category: "external",
               summary: "SUSE Bug 1211495 for CVE-2022-26490",
               url: "https://bugzilla.suse.com/1211495",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
                  "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
                  "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-04-19T09:03:30Z",
               details: "important",
            },
         ],
         title: "CVE-2022-26490",
      },
      {
         cve: "CVE-2022-26966",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2022-26966",
            },
         ],
         notes: [
            {
               category: "general",
               text: "An issue was discovered in the Linux kernel before 5.16.12. drivers/net/usb/sr9700.c allows attackers to obtain sensitive information from heap memory via crafted frame lengths from a device.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
               "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
               "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
               "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2022-26966",
               url: "https://www.suse.com/security/cve/CVE-2022-26966",
            },
            {
               category: "external",
               summary: "SUSE Bug 1196836 for CVE-2022-26966",
               url: "https://bugzilla.suse.com/1196836",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
                  "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 4.6,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
                  "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-04-19T09:03:30Z",
               details: "moderate",
            },
         ],
         title: "CVE-2022-26966",
      },
      {
         cve: "CVE-2022-27666",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2022-27666",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and net/ipv6/esp6.c. This flaw allows a local attacker with a normal user privilege to overwrite kernel heap objects and may cause a local privilege escalation threat.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
               "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
               "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
               "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2022-27666",
               url: "https://www.suse.com/security/cve/CVE-2022-27666",
            },
            {
               category: "external",
               summary: "SUSE Bug 1197131 for CVE-2022-27666",
               url: "https://bugzilla.suse.com/1197131",
            },
            {
               category: "external",
               summary: "SUSE Bug 1197133 for CVE-2022-27666",
               url: "https://bugzilla.suse.com/1197133",
            },
            {
               category: "external",
               summary: "SUSE Bug 1197462 for CVE-2022-27666",
               url: "https://bugzilla.suse.com/1197462",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
                  "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.7,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
                  "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-04-19T09:03:30Z",
               details: "important",
            },
         ],
         title: "CVE-2022-27666",
      },
      {
         cve: "CVE-2022-28388",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2022-28388",
            },
         ],
         notes: [
            {
               category: "general",
               text: "usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c in the Linux kernel through 5.17.1 has a double free.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
               "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
               "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
               "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2022-28388",
               url: "https://www.suse.com/security/cve/CVE-2022-28388",
            },
            {
               category: "external",
               summary: "SUSE Bug 1198032 for CVE-2022-28388",
               url: "https://bugzilla.suse.com/1198032",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
                  "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
                  "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-04-19T09:03:30Z",
               details: "moderate",
            },
         ],
         title: "CVE-2022-28388",
      },
      {
         cve: "CVE-2022-28389",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2022-28389",
            },
         ],
         notes: [
            {
               category: "general",
               text: "mcba_usb_start_xmit in drivers/net/can/usb/mcba_usb.c in the Linux kernel through 5.17.1 has a double free.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
               "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
               "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
               "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2022-28389",
               url: "https://www.suse.com/security/cve/CVE-2022-28389",
            },
            {
               category: "external",
               summary: "SUSE Bug 1198033 for CVE-2022-28389",
               url: "https://bugzilla.suse.com/1198033",
            },
            {
               category: "external",
               summary: "SUSE Bug 1201657 for CVE-2022-28389",
               url: "https://bugzilla.suse.com/1201657",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
                  "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
                  "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-04-19T09:03:30Z",
               details: "moderate",
            },
         ],
         title: "CVE-2022-28389",
      },
      {
         cve: "CVE-2022-28390",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2022-28390",
            },
         ],
         notes: [
            {
               category: "general",
               text: "ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c in the Linux kernel through 5.17.1 has a double free.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
               "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
               "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
               "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2022-28390",
               url: "https://www.suse.com/security/cve/CVE-2022-28390",
            },
            {
               category: "external",
               summary: "SUSE Bug 1198031 for CVE-2022-28390",
               url: "https://bugzilla.suse.com/1198031",
            },
            {
               category: "external",
               summary: "SUSE Bug 1201517 for CVE-2022-28390",
               url: "https://bugzilla.suse.com/1201517",
            },
            {
               category: "external",
               summary: "SUSE Bug 1207969 for CVE-2022-28390",
               url: "https://bugzilla.suse.com/1207969",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
                  "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
                  "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-04-19T09:03:30Z",
               details: "moderate",
            },
         ],
         title: "CVE-2022-28390",
      },
      {
         cve: "CVE-2022-28748",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2022-28748",
            },
         ],
         notes: [
            {
               category: "general",
               text: "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-2964. Reason: This candidate is a reservation duplicate of CVE-2022-2964. Notes: All CVE users should reference CVE-2022-2964 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
               "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
               "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
               "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
               "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2022-28748",
               url: "https://www.suse.com/security/cve/CVE-2022-28748",
            },
            {
               category: "external",
               summary: "SUSE Bug 1196018 for CVE-2022-28748",
               url: "https://bugzilla.suse.com/1196018",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
                  "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 3.7,
                  baseSeverity: "LOW",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-150200.79.2.x86_64",
                  "SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-150200.79.2.noarch",
                  "SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-150200.79.1.x86_64",
                  "SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-150200.79.2.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-04-19T09:03:30Z",
               details: "low",
            },
         ],
         title: "CVE-2022-28748",
      },
   ],
}

cve-2022-27666

Vulnerability from cvelistv5

Published

2022-03-23 05:07

Modified

2024-08-03 05:32

Severity ?

Summary

A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and net/ipv6/esp6.c. This flaw allows a local attacker with a normal user privilege to overwrite kernel heap objects and may cause a local privilege escalation threat.

References

▼	URL	Tags
	https://bugzilla.redhat.com/show_bug.cgi?id=2061633	x_refsource_MISC
	https://github.com/torvalds/linux/commit/ebe48d368e97d007bfeb76fcb065d6cfc4c96645	x_refsource_MISC
	https://security.netapp.com/advisory/ntap-20220429-0001/	x_refsource_CONFIRM
	https://www.debian.org/security/2022/dsa-5127	vendor-advisory, x_refsource_DEBIAN
	https://www.debian.org/security/2022/dsa-5173	vendor-advisory, x_refsource_DEBIAN

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T05:32:59.797Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=2061633",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/torvalds/linux/commit/ebe48d368e97d007bfeb76fcb065d6cfc4c96645",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20220429-0001/",
               },
               {
                  name: "DSA-5127",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2022/dsa-5127",
               },
               {
                  name: "DSA-5173",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2022/dsa-5173",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and net/ipv6/esp6.c. This flaw allows a local attacker with a normal user privilege to overwrite kernel heap objects and may cause a local privilege escalation threat.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-07-04T10:11:14",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2061633",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/torvalds/linux/commit/ebe48d368e97d007bfeb76fcb065d6cfc4c96645",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://security.netapp.com/advisory/ntap-20220429-0001/",
            },
            {
               name: "DSA-5127",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2022/dsa-5127",
            },
            {
               name: "DSA-5173",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2022/dsa-5173",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2022-27666",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and net/ipv6/esp6.c. This flaw allows a local attacker with a normal user privilege to overwrite kernel heap objects and may cause a local privilege escalation threat.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://bugzilla.redhat.com/show_bug.cgi?id=2061633",
                     refsource: "MISC",
                     url: "https://bugzilla.redhat.com/show_bug.cgi?id=2061633",
                  },
                  {
                     name: "https://github.com/torvalds/linux/commit/ebe48d368e97d007bfeb76fcb065d6cfc4c96645",
                     refsource: "MISC",
                     url: "https://github.com/torvalds/linux/commit/ebe48d368e97d007bfeb76fcb065d6cfc4c96645",
                  },
                  {
                     name: "https://security.netapp.com/advisory/ntap-20220429-0001/",
                     refsource: "CONFIRM",
                     url: "https://security.netapp.com/advisory/ntap-20220429-0001/",
                  },
                  {
                     name: "DSA-5127",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2022/dsa-5127",
                  },
                  {
                     name: "DSA-5173",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2022/dsa-5173",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2022-27666",
      datePublished: "2022-03-23T05:07:01",
      dateReserved: "2022-03-23T00:00:00",
      dateUpdated: "2024-08-03T05:32:59.797Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2022-23039

Vulnerability from cvelistv5

Published

2022-03-10 19:20

Modified

2024-08-03 03:28

Severity ?

Summary

Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malicious backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they assume that a following removal of the granted access will always succeed, which is not true in case the backend has mapped the granted page between those two operations. As a result the backend can keep access to the memory page of the guest no matter how the page will be used after the frontend I/O has finished. The xenbus driver has a similar problem, as it doesn't check the success of removing the granted access of a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038 gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus, 9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no longer in use, but the freeing of the related data page is not synchronized with dropping the granted access. As a result the backend can keep access to the memory page even after it has been freed and then re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which can be triggered by the backend. CVE-2022-23042

References

▼	URL	Tags
	https://xenbits.xenproject.org/xsa/advisory-396.txt	x_refsource_MISC
	https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html	mailing-list, x_refsource_MLIST

Impacted products

	Vendor	Product	Version
	unspecified	unspecified

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T03:28:42.973Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://xenbits.xenproject.org/xsa/advisory-396.txt",
               },
               {
                  name: "[debian-lts-announce] 20220701 [SECURITY] [DLA 3065-1] linux security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "unspecified",
               vendor: "unspecified",
               versions: [
                  {
                     status: "unknown",
                     version: "consult Xen advisory XSA-396",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "{'credit_data': {'description': {'description_data': [{'lang': 'eng', 'value': 'This issue was discovered by Demi Marie Obenour and Simon Gaiser of\\nInvisible Things Lab.'}]}}}",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malicious backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they assume that a following removal of the granted access will always succeed, which is not true in case the backend has mapped the granted page between those two operations. As a result the backend can keep access to the memory page of the guest no matter how the page will be used after the frontend I/O has finished. The xenbus driver has a similar problem, as it doesn't check the success of removing the granted access of a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038 gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus, 9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no longer in use, but the freeing of the related data page is not synchronized with dropping the granted access. As a result the backend can keep access to the memory page even after it has been freed and then re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which can be triggered by the backend. CVE-2022-23042",
            },
         ],
         metrics: [
            {
               other: {
                  content: {
                     description: {
                        description_data: [
                           {
                              lang: "eng",
                              value: "Due to race conditions and missing tests of return codes in the Linux\nPV device frontend drivers a malicious backend could gain access (read\nand write) to memory pages it shouldn't have, or it could directly\ntrigger Denial of Service (DoS) in the guest.",
                           },
                        ],
                     },
                  },
                  type: "unknown",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "unknown",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-07-01T13:06:47",
            orgId: "23aa2041-22e1-471f-9209-9b7396fa234f",
            shortName: "XEN",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://xenbits.xenproject.org/xsa/advisory-396.txt",
            },
            {
               name: "[debian-lts-announce] 20220701 [SECURITY] [DLA 3065-1] linux security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security@xen.org",
               ID: "CVE-2022-23039",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: "?",
                                          version_value: "consult Xen advisory XSA-396",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "",
                     },
                  ],
               },
            },
            configuration: {
               configuration_data: {
                  description: {
                     description_data: [
                        {
                           lang: "eng",
                           value: "All Linux guests using PV devices are vulnerable in case potentially\nmalicious PV device backends are being used.",
                        },
                     ],
                  },
               },
            },
            credit: {
               credit_data: {
                  description: {
                     description_data: [
                        {
                           lang: "eng",
                           value: "This issue was discovered by Demi Marie Obenour and Simon Gaiser of\nInvisible Things Lab.",
                        },
                     ],
                  },
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malicious backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they assume that a following removal of the granted access will always succeed, which is not true in case the backend has mapped the granted page between those two operations. As a result the backend can keep access to the memory page of the guest no matter how the page will be used after the frontend I/O has finished. The xenbus driver has a similar problem, as it doesn't check the success of removing the granted access of a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038 gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus, 9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no longer in use, but the freeing of the related data page is not synchronized with dropping the granted access. As a result the backend can keep access to the memory page even after it has been freed and then re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which can be triggered by the backend. CVE-2022-23042",
                  },
               ],
            },
            impact: {
               impact_data: {
                  description: {
                     description_data: [
                        {
                           lang: "eng",
                           value: "Due to race conditions and missing tests of return codes in the Linux\nPV device frontend drivers a malicious backend could gain access (read\nand write) to memory pages it shouldn't have, or it could directly\ntrigger Denial of Service (DoS) in the guest.",
                        },
                     ],
                  },
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "unknown",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://xenbits.xenproject.org/xsa/advisory-396.txt",
                     refsource: "MISC",
                     url: "https://xenbits.xenproject.org/xsa/advisory-396.txt",
                  },
                  {
                     name: "[debian-lts-announce] 20220701 [SECURITY] [DLA 3065-1] linux security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html",
                  },
               ],
            },
            workaround: {
               workaround_data: {
                  description: {
                     description_data: [
                        {
                           lang: "eng",
                           value: "There is no mitigation available other than not using PV devices in case\na backend is suspected to be potentially malicious.",
                        },
                     ],
                  },
               },
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "23aa2041-22e1-471f-9209-9b7396fa234f",
      assignerShortName: "XEN",
      cveId: "CVE-2022-23039",
      datePublished: "2022-03-10T19:20:19",
      dateReserved: "2022-01-10T00:00:00",
      dateUpdated: "2024-08-03T03:28:42.973Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-44879

Vulnerability from cvelistv5

Published

2022-02-13 00:00

Modified

2024-08-04 04:32

Severity ?

Summary

In gc_data_segment in fs/f2fs/gc.c in the Linux kernel before 5.16.3, special files are not considered, leading to a move_data_page NULL pointer dereference.

References

▼	URL	Tags
	https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.3
	https://bugzilla.kernel.org/show_bug.cgi?id=215231
	https://lore.kernel.org/linux-f2fs-devel/20211206144421.3735-3-chao%40kernel.org/T/
	https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9056d6489f5a41cfbb67f719d2c0ce61ead72d9f
	https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html	mailing-list
	https://lists.debian.org/debian-lts-announce/2024/01/msg00005.html	mailing-list

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T04:32:13.259Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.3",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://bugzilla.kernel.org/show_bug.cgi?id=215231",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://lore.kernel.org/linux-f2fs-devel/20211206144421.3735-3-chao%40kernel.org/T/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9056d6489f5a41cfbb67f719d2c0ce61ead72d9f",
               },
               {
                  name: "[debian-lts-announce] 20240111 [SECURITY] [DLA 3710-1] linux security update",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html",
               },
               {
                  name: "[debian-lts-announce] 20240111 [SECURITY] [DLA 3711-1] linux-5.10 security update",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2024/01/msg00005.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "In gc_data_segment in fs/f2fs/gc.c in the Linux kernel before 5.16.3, special files are not considered, leading to a move_data_page NULL pointer dereference.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-01-11T21:06:29.625692",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               url: "https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.3",
            },
            {
               url: "https://bugzilla.kernel.org/show_bug.cgi?id=215231",
            },
            {
               url: "https://lore.kernel.org/linux-f2fs-devel/20211206144421.3735-3-chao%40kernel.org/T/",
            },
            {
               url: "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9056d6489f5a41cfbb67f719d2c0ce61ead72d9f",
            },
            {
               name: "[debian-lts-announce] 20240111 [SECURITY] [DLA 3710-1] linux security update",
               tags: [
                  "mailing-list",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html",
            },
            {
               name: "[debian-lts-announce] 20240111 [SECURITY] [DLA 3711-1] linux-5.10 security update",
               tags: [
                  "mailing-list",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2024/01/msg00005.html",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2021-44879",
      datePublished: "2022-02-13T00:00:00",
      dateReserved: "2021-12-13T00:00:00",
      dateUpdated: "2024-08-04T04:32:13.259Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2022-25258

Vulnerability from cvelistv5

Published

2022-02-16 00:00

Modified

2024-08-03 04:36

Severity ?

Summary

An issue was discovered in drivers/usb/gadget/composite.c in the Linux kernel before 5.16.10. The USB Gadget subsystem lacks certain validation of interface OS descriptor requests (ones with a large array index and ones associated with NULL function pointer retrieval). Memory corruption might occur.

References

▼	URL	Tags
	https://github.com/torvalds/linux/commit/75e5b4849b81e19e9efe1654b30d7f3151c33c2c
	https://github.com/szymonh/d-os-descriptor
	https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.10
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TCW2KZYJ2H6BKZE3CVLHRIXYDGNYYC5P/	vendor-advisory
	https://www.debian.org/security/2022/dsa-5092	vendor-advisory
	https://lists.debian.org/debian-lts-announce/2022/03/msg00011.html	mailing-list
	https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html	mailing-list
	https://www.debian.org/security/2022/dsa-5096	vendor-advisory
	https://security.netapp.com/advisory/ntap-20221028-0007/

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T04:36:06.563Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/torvalds/linux/commit/75e5b4849b81e19e9efe1654b30d7f3151c33c2c",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/szymonh/d-os-descriptor",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.10",
               },
               {
                  name: "FEDORA-2022-9d4e48836d",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TCW2KZYJ2H6BKZE3CVLHRIXYDGNYYC5P/",
               },
               {
                  name: "DSA-5092",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2022/dsa-5092",
               },
               {
                  name: "[debian-lts-announce] 20220309 [SECURITY] [DLA 2940-1] linux security update",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2022/03/msg00011.html",
               },
               {
                  name: "[debian-lts-announce] 20220309 [SECURITY] [DLA 2941-1] linux-4.19 security update",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html",
               },
               {
                  name: "DSA-5096",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2022/dsa-5096",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20221028-0007/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "An issue was discovered in drivers/usb/gadget/composite.c in the Linux kernel before 5.16.10. The USB Gadget subsystem lacks certain validation of interface OS descriptor requests (ones with a large array index and ones associated with NULL function pointer retrieval). Memory corruption might occur.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-10-28T00:00:00",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               url: "https://github.com/torvalds/linux/commit/75e5b4849b81e19e9efe1654b30d7f3151c33c2c",
            },
            {
               url: "https://github.com/szymonh/d-os-descriptor",
            },
            {
               url: "https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.10",
            },
            {
               name: "FEDORA-2022-9d4e48836d",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TCW2KZYJ2H6BKZE3CVLHRIXYDGNYYC5P/",
            },
            {
               name: "DSA-5092",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://www.debian.org/security/2022/dsa-5092",
            },
            {
               name: "[debian-lts-announce] 20220309 [SECURITY] [DLA 2940-1] linux security update",
               tags: [
                  "mailing-list",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2022/03/msg00011.html",
            },
            {
               name: "[debian-lts-announce] 20220309 [SECURITY] [DLA 2941-1] linux-4.19 security update",
               tags: [
                  "mailing-list",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html",
            },
            {
               name: "DSA-5096",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://www.debian.org/security/2022/dsa-5096",
            },
            {
               url: "https://security.netapp.com/advisory/ntap-20221028-0007/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2022-25258",
      datePublished: "2022-02-16T00:00:00",
      dateReserved: "2022-02-16T00:00:00",
      dateUpdated: "2024-08-03T04:36:06.563Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2022-1016

Vulnerability from cvelistv5

Published

2022-08-29 14:03

Modified

2024-08-02 23:47

Severity ?

Summary

A flaw was found in the Linux kernel in net/netfilter/nf_tables_core.c:nft_do_chain, which can cause a use-after-free. This issue needs to handle 'return' with proper preconditions, as it can lead to a kernel information leak problem caused by a local, unprivileged attacker.

References

▼	URL	Tags
	http://blog.dbouman.nl/2022/04/02/How-The-Tables-Have-Turned-CVE-2022-1015-1016/	x_refsource_MISC
	https://seclists.org/oss-sec/2022/q1/205	x_refsource_MISC
	https://bugzilla.redhat.com/show_bug.cgi?id=2066614	x_refsource_MISC
	https://access.redhat.com/security/cve/CVE-2022-1016	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	n/a	Kernel	Version: Affects v3.13-rc1 and later, Fixed in v5.18-rc1

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T23:47:42.700Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "http://blog.dbouman.nl/2022/04/02/How-The-Tables-Have-Turned-CVE-2022-1015-1016/",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://seclists.org/oss-sec/2022/q1/205",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=2066614",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/security/cve/CVE-2022-1016",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "Kernel",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "Affects v3.13-rc1 and later, Fixed in v5.18-rc1",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A flaw was found in the Linux kernel in net/netfilter/nf_tables_core.c:nft_do_chain, which can cause a use-after-free. This issue needs to handle 'return' with proper preconditions, as it can lead to a kernel information leak problem caused by a local, unprivileged attacker.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-824",
                     description: "CWE-824 - Access of Uninitialized Pointer.",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-08-29T14:03:06",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "http://blog.dbouman.nl/2022/04/02/How-The-Tables-Have-Turned-CVE-2022-1015-1016/",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://seclists.org/oss-sec/2022/q1/205",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2066614",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://access.redhat.com/security/cve/CVE-2022-1016",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2022-1016",
      datePublished: "2022-08-29T14:03:06",
      dateReserved: "2022-03-17T00:00:00",
      dateUpdated: "2024-08-02T23:47:42.700Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2022-1055

Vulnerability from cvelistv5

Published

2022-03-29 15:05

Modified

2024-08-02 23:47

Severity ?

8.6 (High) - CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Summary

A use-after-free exists in the Linux Kernel in tc_new_tfilter that could allow a local attacker to gain privilege escalation. The exploit requires unprivileged user namespaces. We recommend upgrading past commit 04c2a47ffb13c29778e2a14e414ad4cb5a5db4b5

References

▼	URL	Tags
	https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=04c2a47ffb13c29778e2a14e414ad4cb5a5db4b5	x_refsource_MISC
	https://syzkaller.appspot.com/bug?id=2212474c958978ab86525fe6832ac8102c309ffc	x_refsource_MISC
	https://kernel.dance/#04c2a47ffb13c29778e2a14e414ad4cb5a5db4b5	x_refsource_MISC
	https://security.netapp.com/advisory/ntap-20220506-0007/	x_refsource_CONFIRM
	http://packetstormsecurity.com/files/167386/Kernel-Live-Patch-Security-Notice-LSN-0086-1.html	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	Linux	Kernel	Version: 0 < v5.17-rc3

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            affected: [
               {
                  cpes: [
                     "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  ],
                  defaultStatus: "unaffected",
                  product: "linux_kernel",
                  vendor: "linux",
                  versions: [
                     {
                        lessThan: "5.17_rc3",
                        status: "affected",
                        version: "0",
                        versionType: "custom",
                     },
                  ],
               },
            ],
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-1055",
                        options: [
                           {
                              Exploitation: "poc",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-05-21T17:47:41.220831Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-07-24T16:10:14.757Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T23:47:43.302Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=04c2a47ffb13c29778e2a14e414ad4cb5a5db4b5",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://syzkaller.appspot.com/bug?id=2212474c958978ab86525fe6832ac8102c309ffc",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://kernel.dance/#04c2a47ffb13c29778e2a14e414ad4cb5a5db4b5",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20220506-0007/",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "http://packetstormsecurity.com/files/167386/Kernel-Live-Patch-Security-Notice-LSN-0086-1.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unaffected",
               product: "Kernel",
               vendor: "Linux",
               versions: [
                  {
                     lessThan: "v5.17-rc3",
                     status: "affected",
                     version: "0",
                     versionType: "custom",
                  },
                  {
                     status: "unaffected",
                     version: "04c2a47ffb13c29778e2a14e414ad4cb5a5db4b5",
                     versionType: "git",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: false,
                     type: "text/html",
                     value: "<p>A use-after-free exists in the Linux Kernel in tc_new_tfilter that could allow a local attacker to gain privilege escalation. The exploit requires unprivileged user namespaces. We recommend upgrading past commit 04c2a47ffb13c29778e2a14e414ad4cb5a5db4b5</p>",
                  },
               ],
               value: "A use-after-free exists in the Linux Kernel in tc_new_tfilter that could allow a local attacker to gain privilege escalation. The exploit requires unprivileged user namespaces. We recommend upgrading past commit 04c2a47ffb13c29778e2a14e414ad4cb5a5db4b5",
            },
         ],
         metrics: [
            {
               cvssV4_0: {
                  Automatable: "NOT_DEFINED",
                  Recovery: "NOT_DEFINED",
                  Safety: "NOT_DEFINED",
                  attackComplexity: "HIGH",
                  attackRequirements: "NONE",
                  attackVector: "LOCAL",
                  baseScore: 8.6,
                  baseSeverity: "HIGH",
                  privilegesRequired: "LOW",
                  providerUrgency: "NOT_DEFINED",
                  subAvailabilityImpact: "NONE",
                  subConfidentialityImpact: "HIGH",
                  subIntegrityImpact: "HIGH",
                  userInteraction: "NONE",
                  valueDensity: "NOT_DEFINED",
                  vectorString: "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N",
                  version: "4.0",
                  vulnAvailabilityImpact: "NONE",
                  vulnConfidentialityImpact: "HIGH",
                  vulnIntegrityImpact: "HIGH",
                  vulnerabilityResponseEffort: "NOT_DEFINED",
               },
               format: "CVSS",
               scenarios: [
                  {
                     lang: "en",
                     value: "GENERAL",
                  },
               ],
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-416",
                     description: "CWE-416 Use After Free",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-05-21T04:00:52.197Z",
            orgId: "14ed7db2-1595-443d-9d34-6215bf890778",
            shortName: "Google",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=04c2a47ffb13c29778e2a14e414ad4cb5a5db4b5",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://syzkaller.appspot.com/bug?id=2212474c958978ab86525fe6832ac8102c309ffc",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://kernel.dance/#04c2a47ffb13c29778e2a14e414ad4cb5a5db4b5",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://security.netapp.com/advisory/ntap-20220506-0007/",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "http://packetstormsecurity.com/files/167386/Kernel-Live-Patch-Security-Notice-LSN-0086-1.html",
            },
         ],
         source: {
            discovery: "EXTERNAL",
         },
         title: "Use after Free in tc_new_tfilter allowing for privilege escalation in Linux Kernel",
         x_generator: {
            engine: "Vulnogram 0.0.9",
         },
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security@google.com",
               ID: "CVE-2022-1055",
               STATE: "PUBLIC",
               TITLE: "Use after Free in tc_new_tfilter allowing for privilege escalation in Linux Kernel",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "Kernel",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: ">",
                                          version_value: "v5.1-rc1",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Linux",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "A use-after-free exists in the Linux Kernel in tc_new_tfilter that could allow a local attacker to gain privilege escalation. The exploit requires unprivileged user namespaces. We recommend upgrading past commit 04c2a47ffb13c29778e2a14e414ad4cb5a5db4b5",
                  },
               ],
            },
            generator: {
               engine: "Vulnogram 0.0.9",
            },
            impact: {
               cvss: {
                  attackComplexity: "HIGH",
                  attackVector: "LOCAL",
                  availabilityImpact: "NONE",
                  baseScore: 6.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
                  version: "3.1",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-416 Use After Free",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=04c2a47ffb13c29778e2a14e414ad4cb5a5db4b5",
                     refsource: "MISC",
                     url: "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=04c2a47ffb13c29778e2a14e414ad4cb5a5db4b5",
                  },
                  {
                     name: "https://syzkaller.appspot.com/bug?id=2212474c958978ab86525fe6832ac8102c309ffc",
                     refsource: "MISC",
                     url: "https://syzkaller.appspot.com/bug?id=2212474c958978ab86525fe6832ac8102c309ffc",
                  },
                  {
                     name: "https://kernel.dance/#04c2a47ffb13c29778e2a14e414ad4cb5a5db4b5",
                     refsource: "MISC",
                     url: "https://kernel.dance/#04c2a47ffb13c29778e2a14e414ad4cb5a5db4b5",
                  },
                  {
                     name: "https://security.netapp.com/advisory/ntap-20220506-0007/",
                     refsource: "CONFIRM",
                     url: "https://security.netapp.com/advisory/ntap-20220506-0007/",
                  },
                  {
                     name: "http://packetstormsecurity.com/files/167386/Kernel-Live-Patch-Security-Notice-LSN-0086-1.html",
                     refsource: "MISC",
                     url: "http://packetstormsecurity.com/files/167386/Kernel-Live-Patch-Security-Notice-LSN-0086-1.html",
                  },
               ],
            },
            source: {
               discovery: "EXTERNAL",
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "14ed7db2-1595-443d-9d34-6215bf890778",
      assignerShortName: "Google",
      cveId: "CVE-2022-1055",
      datePublished: "2022-03-29T15:05:13",
      dateReserved: "2022-03-22T00:00:00",
      dateUpdated: "2024-08-02T23:47:43.302Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2022-1048

Vulnerability from cvelistv5

Published

2022-04-29 15:34

Modified

2024-08-02 23:47

Severity ?

Summary

A use-after-free flaw was found in the Linux kernel’s sound subsystem in the way a user triggers concurrent calls of PCM hw_params. The hw_free ioctls or similar race condition happens inside ALSA PCM for other ioctls. This flaw allows a local user to crash or potentially escalate their privileges on the system.

References

▼	URL	Tags
	https://bugzilla.redhat.com/show_bug.cgi?id=2066706	x_refsource_MISC
	https://lore.kernel.org/lkml/20220322170720.3529-5-tiwai%40suse.de/T/#m1d3b791b815556012c6be92f1c4a7086b854f7f3	x_refsource_MISC
	https://www.debian.org/security/2022/dsa-5127	vendor-advisory, x_refsource_DEBIAN
	https://security.netapp.com/advisory/ntap-20220629-0001/	x_refsource_CONFIRM
	https://www.debian.org/security/2022/dsa-5173	vendor-advisory, x_refsource_DEBIAN

Impacted products

	Vendor	Product	Version
	n/a	kernel	Version: Linux kernel 5.17-rc9

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T23:47:43.301Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=2066706",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://lore.kernel.org/lkml/20220322170720.3529-5-tiwai%40suse.de/T/#m1d3b791b815556012c6be92f1c4a7086b854f7f3",
               },
               {
                  name: "DSA-5127",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2022/dsa-5127",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20220629-0001/",
               },
               {
                  name: "DSA-5173",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2022/dsa-5173",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "kernel",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "Linux kernel 5.17-rc9",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A use-after-free flaw was found in the Linux kernel’s sound subsystem in the way a user triggers concurrent calls of PCM hw_params. The hw_free ioctls or similar race condition happens inside ALSA PCM for other ioctls. This flaw allows a local user to crash or potentially escalate their privileges on the system.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-416",
                     description: "CWE-416",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-07-04T10:06:10",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2066706",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://lore.kernel.org/lkml/20220322170720.3529-5-tiwai%40suse.de/T/#m1d3b791b815556012c6be92f1c4a7086b854f7f3",
            },
            {
               name: "DSA-5127",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2022/dsa-5127",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://security.netapp.com/advisory/ntap-20220629-0001/",
            },
            {
               name: "DSA-5173",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2022/dsa-5173",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secalert@redhat.com",
               ID: "CVE-2022-1048",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "kernel",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "Linux kernel 5.17-rc9",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "A use-after-free flaw was found in the Linux kernel’s sound subsystem in the way a user triggers concurrent calls of PCM hw_params. The hw_free ioctls or similar race condition happens inside ALSA PCM for other ioctls. This flaw allows a local user to crash or potentially escalate their privileges on the system.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-416",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://bugzilla.redhat.com/show_bug.cgi?id=2066706",
                     refsource: "MISC",
                     url: "https://bugzilla.redhat.com/show_bug.cgi?id=2066706",
                  },
                  {
                     name: "https://lore.kernel.org/lkml/20220322170720.3529-5-tiwai@suse.de/T/#m1d3b791b815556012c6be92f1c4a7086b854f7f3",
                     refsource: "MISC",
                     url: "https://lore.kernel.org/lkml/20220322170720.3529-5-tiwai@suse.de/T/#m1d3b791b815556012c6be92f1c4a7086b854f7f3",
                  },
                  {
                     name: "DSA-5127",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2022/dsa-5127",
                  },
                  {
                     name: "https://security.netapp.com/advisory/ntap-20220629-0001/",
                     refsource: "CONFIRM",
                     url: "https://security.netapp.com/advisory/ntap-20220629-0001/",
                  },
                  {
                     name: "DSA-5173",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2022/dsa-5173",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2022-1048",
      datePublished: "2022-04-29T15:34:44",
      dateReserved: "2022-03-22T00:00:00",
      dateUpdated: "2024-08-02T23:47:43.301Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2022-26490

Vulnerability from cvelistv5

Published

2022-03-06 03:58

Modified

2024-08-03 05:03

Severity ?

Summary

st21nfca_connectivity_event_received in drivers/nfc/st21nfca/se.c in the Linux kernel through 5.16.12 has EVT_TRANSACTION buffer overflows because of untrusted length parameters.

References

▼	URL	Tags
	https://github.com/torvalds/linux/commit/4fbcc1a4cb20fe26ad0225679c536c80f1648221	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BG4J46EMFPDD5QHYXDUI3PJCZQ7HQAZR/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C5AUUDGSDLGYU7SZSK4PFAN22NISQZBT/	vendor-advisory, x_refsource_FEDORA
	https://security.netapp.com/advisory/ntap-20220429-0004/	x_refsource_CONFIRM
	https://www.debian.org/security/2022/dsa-5127	vendor-advisory, x_refsource_DEBIAN
	https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html	mailing-list, x_refsource_MLIST
	https://www.debian.org/security/2022/dsa-5173	vendor-advisory, x_refsource_DEBIAN

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T05:03:32.925Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/torvalds/linux/commit/4fbcc1a4cb20fe26ad0225679c536c80f1648221",
               },
               {
                  name: "FEDORA-2022-9342e59a98",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BG4J46EMFPDD5QHYXDUI3PJCZQ7HQAZR/",
               },
               {
                  name: "FEDORA-2022-de4474b89d",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C5AUUDGSDLGYU7SZSK4PFAN22NISQZBT/",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20220429-0004/",
               },
               {
                  name: "DSA-5127",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2022/dsa-5127",
               },
               {
                  name: "[debian-lts-announce] 20220701 [SECURITY] [DLA 3065-1] linux security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html",
               },
               {
                  name: "DSA-5173",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2022/dsa-5173",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "st21nfca_connectivity_event_received in drivers/nfc/st21nfca/se.c in the Linux kernel through 5.16.12 has EVT_TRANSACTION buffer overflows because of untrusted length parameters.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-07-04T10:10:14",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/torvalds/linux/commit/4fbcc1a4cb20fe26ad0225679c536c80f1648221",
            },
            {
               name: "FEDORA-2022-9342e59a98",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BG4J46EMFPDD5QHYXDUI3PJCZQ7HQAZR/",
            },
            {
               name: "FEDORA-2022-de4474b89d",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C5AUUDGSDLGYU7SZSK4PFAN22NISQZBT/",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://security.netapp.com/advisory/ntap-20220429-0004/",
            },
            {
               name: "DSA-5127",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2022/dsa-5127",
            },
            {
               name: "[debian-lts-announce] 20220701 [SECURITY] [DLA 3065-1] linux security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html",
            },
            {
               name: "DSA-5173",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2022/dsa-5173",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2022-26490",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "st21nfca_connectivity_event_received in drivers/nfc/st21nfca/se.c in the Linux kernel through 5.16.12 has EVT_TRANSACTION buffer overflows because of untrusted length parameters.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://github.com/torvalds/linux/commit/4fbcc1a4cb20fe26ad0225679c536c80f1648221",
                     refsource: "MISC",
                     url: "https://github.com/torvalds/linux/commit/4fbcc1a4cb20fe26ad0225679c536c80f1648221",
                  },
                  {
                     name: "FEDORA-2022-9342e59a98",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BG4J46EMFPDD5QHYXDUI3PJCZQ7HQAZR/",
                  },
                  {
                     name: "FEDORA-2022-de4474b89d",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/C5AUUDGSDLGYU7SZSK4PFAN22NISQZBT/",
                  },
                  {
                     name: "https://security.netapp.com/advisory/ntap-20220429-0004/",
                     refsource: "CONFIRM",
                     url: "https://security.netapp.com/advisory/ntap-20220429-0004/",
                  },
                  {
                     name: "DSA-5127",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2022/dsa-5127",
                  },
                  {
                     name: "[debian-lts-announce] 20220701 [SECURITY] [DLA 3065-1] linux security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html",
                  },
                  {
                     name: "DSA-5173",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2022/dsa-5173",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2022-26490",
      datePublished: "2022-03-06T03:58:33",
      dateReserved: "2022-03-06T00:00:00",
      dateUpdated: "2024-08-03T05:03:32.925Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2022-25375

Vulnerability from cvelistv5

Published

2022-02-20 19:47

Modified

2024-08-03 04:36

Severity ?

Summary

An issue was discovered in drivers/usb/gadget/function/rndis.c in the Linux kernel before 5.16.10. The RNDIS USB gadget lacks validation of the size of the RNDIS_MSG_SET command. Attackers can obtain sensitive information from kernel memory.

References

▼	URL	Tags
	https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.10	x_refsource_MISC
	https://github.com/torvalds/linux/commit/38ea1eac7d88072bbffb630e2b3db83ca649b826	x_refsource_MISC
	https://github.com/szymonh/rndis-co	x_refsource_MISC
	http://www.openwall.com/lists/oss-security/2022/02/21/1	mailing-list, x_refsource_MLIST
	https://www.debian.org/security/2022/dsa-5092	vendor-advisory, x_refsource_DEBIAN
	https://lists.debian.org/debian-lts-announce/2022/03/msg00011.html	mailing-list, x_refsource_MLIST
	https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html	mailing-list, x_refsource_MLIST
	https://www.debian.org/security/2022/dsa-5096	vendor-advisory, x_refsource_DEBIAN

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T04:36:06.951Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.10",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/torvalds/linux/commit/38ea1eac7d88072bbffb630e2b3db83ca649b826",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/szymonh/rndis-co",
               },
               {
                  name: "[oss-security] 20220221 CVE-2022-25375 : Linux RNDIS USB Gadget memory extraction via packet filter",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2022/02/21/1",
               },
               {
                  name: "DSA-5092",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2022/dsa-5092",
               },
               {
                  name: "[debian-lts-announce] 20220309 [SECURITY] [DLA 2940-1] linux security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2022/03/msg00011.html",
               },
               {
                  name: "[debian-lts-announce] 20220309 [SECURITY] [DLA 2941-1] linux-4.19 security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html",
               },
               {
                  name: "DSA-5096",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2022/dsa-5096",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "An issue was discovered in drivers/usb/gadget/function/rndis.c in the Linux kernel before 5.16.10. The RNDIS USB gadget lacks validation of the size of the RNDIS_MSG_SET command. Attackers can obtain sensitive information from kernel memory.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-03-10T02:06:39",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.10",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/torvalds/linux/commit/38ea1eac7d88072bbffb630e2b3db83ca649b826",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/szymonh/rndis-co",
            },
            {
               name: "[oss-security] 20220221 CVE-2022-25375 : Linux RNDIS USB Gadget memory extraction via packet filter",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2022/02/21/1",
            },
            {
               name: "DSA-5092",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2022/dsa-5092",
            },
            {
               name: "[debian-lts-announce] 20220309 [SECURITY] [DLA 2940-1] linux security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2022/03/msg00011.html",
            },
            {
               name: "[debian-lts-announce] 20220309 [SECURITY] [DLA 2941-1] linux-4.19 security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html",
            },
            {
               name: "DSA-5096",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2022/dsa-5096",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2022-25375",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "An issue was discovered in drivers/usb/gadget/function/rndis.c in the Linux kernel before 5.16.10. The RNDIS USB gadget lacks validation of the size of the RNDIS_MSG_SET command. Attackers can obtain sensitive information from kernel memory.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.10",
                     refsource: "MISC",
                     url: "https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.10",
                  },
                  {
                     name: "https://github.com/torvalds/linux/commit/38ea1eac7d88072bbffb630e2b3db83ca649b826",
                     refsource: "MISC",
                     url: "https://github.com/torvalds/linux/commit/38ea1eac7d88072bbffb630e2b3db83ca649b826",
                  },
                  {
                     name: "https://github.com/szymonh/rndis-co",
                     refsource: "MISC",
                     url: "https://github.com/szymonh/rndis-co",
                  },
                  {
                     name: "[oss-security] 20220221 CVE-2022-25375 : Linux RNDIS USB Gadget memory extraction via packet filter",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2022/02/21/1",
                  },
                  {
                     name: "DSA-5092",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2022/dsa-5092",
                  },
                  {
                     name: "[debian-lts-announce] 20220309 [SECURITY] [DLA 2940-1] linux security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2022/03/msg00011.html",
                  },
                  {
                     name: "[debian-lts-announce] 20220309 [SECURITY] [DLA 2941-1] linux-4.19 security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html",
                  },
                  {
                     name: "DSA-5096",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2022/dsa-5096",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2022-25375",
      datePublished: "2022-02-20T19:47:01",
      dateReserved: "2022-02-20T00:00:00",
      dateUpdated: "2024-08-03T04:36:06.951Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2022-26966

Vulnerability from cvelistv5

Published

2022-03-12 21:30

Modified

2024-08-03 05:18

Severity ?

Summary

An issue was discovered in the Linux kernel before 5.16.12. drivers/net/usb/sr9700.c allows attackers to obtain sensitive information from heap memory via crafted frame lengths from a device.

References

▼	URL	Tags
	https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.10	x_refsource_MISC
	https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e9da0b56fe27206b49f39805f7dcda8a89379062	x_refsource_MISC
	https://security.netapp.com/advisory/ntap-20220419-0001/	x_refsource_CONFIRM
	https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html	mailing-list, x_refsource_MLIST

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T05:18:39.313Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.10",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e9da0b56fe27206b49f39805f7dcda8a89379062",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20220419-0001/",
               },
               {
                  name: "[debian-lts-announce] 20220701 [SECURITY] [DLA 3065-1] linux security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "An issue was discovered in the Linux kernel before 5.16.12. drivers/net/usb/sr9700.c allows attackers to obtain sensitive information from heap memory via crafted frame lengths from a device.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-07-01T13:06:22",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.10",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e9da0b56fe27206b49f39805f7dcda8a89379062",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://security.netapp.com/advisory/ntap-20220419-0001/",
            },
            {
               name: "[debian-lts-announce] 20220701 [SECURITY] [DLA 3065-1] linux security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2022-26966",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "An issue was discovered in the Linux kernel before 5.16.12. drivers/net/usb/sr9700.c allows attackers to obtain sensitive information from heap memory via crafted frame lengths from a device.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.10",
                     refsource: "MISC",
                     url: "https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.10",
                  },
                  {
                     name: "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e9da0b56fe27206b49f39805f7dcda8a89379062",
                     refsource: "MISC",
                     url: "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e9da0b56fe27206b49f39805f7dcda8a89379062",
                  },
                  {
                     name: "https://security.netapp.com/advisory/ntap-20220419-0001/",
                     refsource: "CONFIRM",
                     url: "https://security.netapp.com/advisory/ntap-20220419-0001/",
                  },
                  {
                     name: "[debian-lts-announce] 20220701 [SECURITY] [DLA 3065-1] linux security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2022-26966",
      datePublished: "2022-03-12T21:30:43",
      dateReserved: "2022-03-12T00:00:00",
      dateUpdated: "2024-08-03T05:18:39.313Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-0920

Vulnerability from cvelistv5

Published

2021-12-15 18:05

Modified

2025-02-04 19:04

Severity ?

6.4 (Medium) - CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Summary

In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-196926917References: Upstream kernel

References

▼	URL	Tags
	https://source.android.com/security/bulletin/2021-11-01	x_refsource_MISC
	https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html	mailing-list, x_refsource_MLIST

Impacted products

	Vendor	Product	Version
	n/a	Android	Version: Android kernel

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T15:55:16.898Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://source.android.com/security/bulletin/2021-11-01",
               },
               {
                  name: "[debian-lts-announce] 20211216 [SECURITY] [DLA 2843-1] linux security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  cvssV3_1: {
                     attackComplexity: "HIGH",
                     attackVector: "LOCAL",
                     availabilityImpact: "HIGH",
                     baseScore: 6.4,
                     baseSeverity: "MEDIUM",
                     confidentialityImpact: "HIGH",
                     integrityImpact: "HIGH",
                     privilegesRequired: "HIGH",
                     scope: "UNCHANGED",
                     userInteraction: "NONE",
                     vectorString: "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
                     version: "3.1",
                  },
               },
               {
                  other: {
                     content: {
                        id: "CVE-2021-0920",
                        options: [
                           {
                              Exploitation: "active",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-02-06T16:18:51.272894Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
               {
                  other: {
                     content: {
                        dateAdded: "2022-05-23",
                        reference: "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-0920",
                     },
                     type: "kev",
                  },
               },
            ],
            problemTypes: [
               {
                  descriptions: [
                     {
                        cweId: "CWE-416",
                        description: "CWE-416 Use After Free",
                        lang: "en",
                        type: "CWE",
                     },
                  ],
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-02-04T19:04:20.727Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "Android",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "Android kernel",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-196926917References: Upstream kernel",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "Elevation of privilege",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2021-12-17T00:06:43.000Z",
            orgId: "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
            shortName: "google_android",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://source.android.com/security/bulletin/2021-11-01",
            },
            {
               name: "[debian-lts-announce] 20211216 [SECURITY] [DLA 2843-1] linux security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security@android.com",
               ID: "CVE-2021-0920",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "Android",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "Android kernel",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-196926917References: Upstream kernel",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "Elevation of privilege",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://source.android.com/security/bulletin/2021-11-01",
                     refsource: "MISC",
                     url: "https://source.android.com/security/bulletin/2021-11-01",
                  },
                  {
                     name: "[debian-lts-announce] 20211216 [SECURITY] [DLA 2843-1] linux security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
      assignerShortName: "google_android",
      cveId: "CVE-2021-0920",
      datePublished: "2021-12-15T18:05:31.000Z",
      dateReserved: "2020-11-06T00:00:00.000Z",
      dateUpdated: "2025-02-04T19:04:20.727Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-45868

Vulnerability from cvelistv5

Published

2022-03-18 06:22

Modified

2024-08-04 04:54

Severity ?

Summary

In the Linux kernel before 5.15.3, fs/quota/quota_tree.c does not validate the block number in the quota tree (on disk). This can, for example, lead to a kernel/locking/rwsem.c use-after-free if there is a corrupted quota file.

References

▼	URL	Tags
	https://bugzilla.kernel.org/show_bug.cgi?id=214655	x_refsource_MISC
	https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9bf3d20331295b1ecb81f4ed9ef358c51699a050	x_refsource_MISC
	https://www.openwall.com/lists/oss-security/2022/03/17/2	x_refsource_MISC
	https://www.openwall.com/lists/oss-security/2022/03/17/1	x_refsource_MISC
	https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.3	x_refsource_MISC
	https://security.netapp.com/advisory/ntap-20220419-0003/	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T04:54:30.852Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.kernel.org/show_bug.cgi?id=214655",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9bf3d20331295b1ecb81f4ed9ef358c51699a050",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.openwall.com/lists/oss-security/2022/03/17/2",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.openwall.com/lists/oss-security/2022/03/17/1",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.3",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20220419-0003/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "In the Linux kernel before 5.15.3, fs/quota/quota_tree.c does not validate the block number in the quota tree (on disk). This can, for example, lead to a kernel/locking/rwsem.c use-after-free if there is a corrupted quota file.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-04-19T18:06:27",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://bugzilla.kernel.org/show_bug.cgi?id=214655",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9bf3d20331295b1ecb81f4ed9ef358c51699a050",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.openwall.com/lists/oss-security/2022/03/17/2",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.openwall.com/lists/oss-security/2022/03/17/1",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.3",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://security.netapp.com/advisory/ntap-20220419-0003/",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2021-45868",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "In the Linux kernel before 5.15.3, fs/quota/quota_tree.c does not validate the block number in the quota tree (on disk). This can, for example, lead to a kernel/locking/rwsem.c use-after-free if there is a corrupted quota file.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://bugzilla.kernel.org/show_bug.cgi?id=214655",
                     refsource: "MISC",
                     url: "https://bugzilla.kernel.org/show_bug.cgi?id=214655",
                  },
                  {
                     name: "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9bf3d20331295b1ecb81f4ed9ef358c51699a050",
                     refsource: "MISC",
                     url: "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9bf3d20331295b1ecb81f4ed9ef358c51699a050",
                  },
                  {
                     name: "https://www.openwall.com/lists/oss-security/2022/03/17/2",
                     refsource: "MISC",
                     url: "https://www.openwall.com/lists/oss-security/2022/03/17/2",
                  },
                  {
                     name: "https://www.openwall.com/lists/oss-security/2022/03/17/1",
                     refsource: "MISC",
                     url: "https://www.openwall.com/lists/oss-security/2022/03/17/1",
                  },
                  {
                     name: "https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.3",
                     refsource: "MISC",
                     url: "https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.3",
                  },
                  {
                     name: "https://security.netapp.com/advisory/ntap-20220419-0003/",
                     refsource: "CONFIRM",
                     url: "https://security.netapp.com/advisory/ntap-20220419-0003/",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2021-45868",
      datePublished: "2022-03-18T06:22:48",
      dateReserved: "2021-12-27T00:00:00",
      dateUpdated: "2024-08-04T04:54:30.852Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2022-0492

Vulnerability from cvelistv5

Published

2022-03-03 00:00

Modified

2024-08-02 23:32

Severity ?

Summary

A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.

References

▼	URL	Tags
	https://bugzilla.redhat.com/show_bug.cgi?id=2051505
	https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=24f6008564183aa120d07c03d9289519c2fe02af
	https://lists.debian.org/debian-lts-announce/2022/03/msg00011.html	mailing-list
	https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html	mailing-list
	https://www.debian.org/security/2022/dsa-5095	vendor-advisory
	https://www.debian.org/security/2022/dsa-5096	vendor-advisory
	http://packetstormsecurity.com/files/166444/Kernel-Live-Patch-Security-Notice-LSN-0085-1.html
	https://security.netapp.com/advisory/ntap-20220419-0002/
	http://packetstormsecurity.com/files/167386/Kernel-Live-Patch-Security-Notice-LSN-0086-1.html
	http://packetstormsecurity.com/files/176099/Docker-cgroups-Container-Escape.html

Impacted products

	Vendor	Product	Version
	n/a	kernel	Version: kernel 5.17 rc3

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T23:32:45.292Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=2051505",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=24f6008564183aa120d07c03d9289519c2fe02af",
               },
               {
                  name: "[debian-lts-announce] 20220309 [SECURITY] [DLA 2940-1] linux security update",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2022/03/msg00011.html",
               },
               {
                  name: "[debian-lts-announce] 20220309 [SECURITY] [DLA 2941-1] linux-4.19 security update",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html",
               },
               {
                  name: "DSA-5095",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2022/dsa-5095",
               },
               {
                  name: "DSA-5096",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2022/dsa-5096",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://packetstormsecurity.com/files/166444/Kernel-Live-Patch-Security-Notice-LSN-0085-1.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20220419-0002/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://packetstormsecurity.com/files/167386/Kernel-Live-Patch-Security-Notice-LSN-0086-1.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://packetstormsecurity.com/files/176099/Docker-cgroups-Container-Escape.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "kernel",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "kernel 5.17 rc3",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-287",
                     description: "CWE-287",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-12-07T15:06:18.421771",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2051505",
            },
            {
               url: "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=24f6008564183aa120d07c03d9289519c2fe02af",
            },
            {
               name: "[debian-lts-announce] 20220309 [SECURITY] [DLA 2940-1] linux security update",
               tags: [
                  "mailing-list",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2022/03/msg00011.html",
            },
            {
               name: "[debian-lts-announce] 20220309 [SECURITY] [DLA 2941-1] linux-4.19 security update",
               tags: [
                  "mailing-list",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html",
            },
            {
               name: "DSA-5095",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://www.debian.org/security/2022/dsa-5095",
            },
            {
               name: "DSA-5096",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://www.debian.org/security/2022/dsa-5096",
            },
            {
               url: "http://packetstormsecurity.com/files/166444/Kernel-Live-Patch-Security-Notice-LSN-0085-1.html",
            },
            {
               url: "https://security.netapp.com/advisory/ntap-20220419-0002/",
            },
            {
               url: "http://packetstormsecurity.com/files/167386/Kernel-Live-Patch-Security-Notice-LSN-0086-1.html",
            },
            {
               url: "http://packetstormsecurity.com/files/176099/Docker-cgroups-Container-Escape.html",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2022-0492",
      datePublished: "2022-03-03T00:00:00",
      dateReserved: "2022-02-04T00:00:00",
      dateUpdated: "2024-08-02T23:32:45.292Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2022-0487

Vulnerability from cvelistv5

Published

2022-02-04 22:29

Modified

2024-08-02 23:32

Severity ?

Summary

A use-after-free vulnerability was found in rtsx_usb_ms_drv_remove in drivers/memstick/host/rtsx_usb_ms.c in memstick in the Linux kernel. In this flaw, a local attacker with a user privilege may impact system Confidentiality. This flaw affects kernel versions prior to 5.14 rc1.

References

▼	URL	Tags
	https://bugzilla.redhat.com/show_bug.cgi?id=2044561	x_refsource_MISC
	https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=42933c8aa14be1caa9eda41f65cde8a3a95d3e39	x_refsource_MISC
	https://lists.debian.org/debian-lts-announce/2022/03/msg00011.html	mailing-list, x_refsource_MLIST
	https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html	mailing-list, x_refsource_MLIST
	https://www.debian.org/security/2022/dsa-5095	vendor-advisory, x_refsource_DEBIAN
	https://www.debian.org/security/2022/dsa-5096	vendor-advisory, x_refsource_DEBIAN

Impacted products

	Vendor	Product	Version
	n/a	kernel	Version: kernel 5.14 rc1

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T23:32:45.515Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=2044561",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=42933c8aa14be1caa9eda41f65cde8a3a95d3e39",
               },
               {
                  name: "[debian-lts-announce] 20220309 [SECURITY] [DLA 2940-1] linux security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2022/03/msg00011.html",
               },
               {
                  name: "[debian-lts-announce] 20220309 [SECURITY] [DLA 2941-1] linux-4.19 security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html",
               },
               {
                  name: "DSA-5095",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2022/dsa-5095",
               },
               {
                  name: "DSA-5096",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2022/dsa-5096",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "kernel",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "kernel 5.14 rc1",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A use-after-free vulnerability was found in rtsx_usb_ms_drv_remove in drivers/memstick/host/rtsx_usb_ms.c in memstick in the Linux kernel. In this flaw, a local attacker with a user privilege may impact system Confidentiality. This flaw affects kernel versions prior to 5.14 rc1.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-416",
                     description: "CWE-416",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-03-10T02:07:14",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2044561",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=42933c8aa14be1caa9eda41f65cde8a3a95d3e39",
            },
            {
               name: "[debian-lts-announce] 20220309 [SECURITY] [DLA 2940-1] linux security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2022/03/msg00011.html",
            },
            {
               name: "[debian-lts-announce] 20220309 [SECURITY] [DLA 2941-1] linux-4.19 security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html",
            },
            {
               name: "DSA-5095",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2022/dsa-5095",
            },
            {
               name: "DSA-5096",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2022/dsa-5096",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secalert@redhat.com",
               ID: "CVE-2022-0487",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "kernel",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "kernel 5.14 rc1",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "A use-after-free vulnerability was found in rtsx_usb_ms_drv_remove in drivers/memstick/host/rtsx_usb_ms.c in memstick in the Linux kernel. In this flaw, a local attacker with a user privilege may impact system Confidentiality. This flaw affects kernel versions prior to 5.14 rc1.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-416",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://bugzilla.redhat.com/show_bug.cgi?id=2044561",
                     refsource: "MISC",
                     url: "https://bugzilla.redhat.com/show_bug.cgi?id=2044561",
                  },
                  {
                     name: "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=42933c8aa14be1caa9eda41f65cde8a3a95d3e39",
                     refsource: "MISC",
                     url: "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=42933c8aa14be1caa9eda41f65cde8a3a95d3e39",
                  },
                  {
                     name: "[debian-lts-announce] 20220309 [SECURITY] [DLA 2940-1] linux security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2022/03/msg00011.html",
                  },
                  {
                     name: "[debian-lts-announce] 20220309 [SECURITY] [DLA 2941-1] linux-4.19 security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html",
                  },
                  {
                     name: "DSA-5095",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2022/dsa-5095",
                  },
                  {
                     name: "DSA-5096",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2022/dsa-5096",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2022-0487",
      datePublished: "2022-02-04T22:29:21",
      dateReserved: "2022-02-03T00:00:00",
      dateUpdated: "2024-08-02T23:32:45.515Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2022-0854

Vulnerability from cvelistv5

Published

2022-03-23 19:46

Modified

2024-08-02 23:40

Severity ?

Summary

A memory leak flaw was found in the Linux kernel’s DMA subsystem, in the way a user calls DMA_FROM_DEVICE. This flaw allows a local user to read random memory from the kernel space.

References

▼	URL	Tags
	https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/kernel/dma/swiotlb.c?h=v5.17-rc8&id=aa6f8dcbab473f3a3c7454b74caa46d36cdc5d13	x_refsource_MISC
	https://www.debian.org/security/2022/dsa-5161	vendor-advisory, x_refsource_DEBIAN
	https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html	mailing-list, x_refsource_MLIST
	https://www.debian.org/security/2022/dsa-5173	vendor-advisory, x_refsource_DEBIAN

Impacted products

	Vendor	Product	Version
	n/a	Kernel	Version: Linux kernel 5.17-rc8

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T23:40:04.528Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/kernel/dma/swiotlb.c?h=v5.17-rc8&id=aa6f8dcbab473f3a3c7454b74caa46d36cdc5d13",
               },
               {
                  name: "DSA-5161",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2022/dsa-5161",
               },
               {
                  name: "[debian-lts-announce] 20220701 [SECURITY] [DLA 3065-1] linux security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html",
               },
               {
                  name: "DSA-5173",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2022/dsa-5173",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "Kernel",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "Linux kernel 5.17-rc8",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A memory leak flaw was found in the Linux kernel’s DMA subsystem, in the way a user calls DMA_FROM_DEVICE. This flaw allows a local user to read random memory from the kernel space.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-200",
                     description: "CWE-200",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-07-04T10:11:26",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/kernel/dma/swiotlb.c?h=v5.17-rc8&id=aa6f8dcbab473f3a3c7454b74caa46d36cdc5d13",
            },
            {
               name: "DSA-5161",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2022/dsa-5161",
            },
            {
               name: "[debian-lts-announce] 20220701 [SECURITY] [DLA 3065-1] linux security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html",
            },
            {
               name: "DSA-5173",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2022/dsa-5173",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secalert@redhat.com",
               ID: "CVE-2022-0854",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "Kernel",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "Linux kernel 5.17-rc8",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "A memory leak flaw was found in the Linux kernel’s DMA subsystem, in the way a user calls DMA_FROM_DEVICE. This flaw allows a local user to read random memory from the kernel space.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-200",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/kernel/dma/swiotlb.c?h=v5.17-rc8&id=aa6f8dcbab473f3a3c7454b74caa46d36cdc5d13",
                     refsource: "MISC",
                     url: "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/kernel/dma/swiotlb.c?h=v5.17-rc8&id=aa6f8dcbab473f3a3c7454b74caa46d36cdc5d13",
                  },
                  {
                     name: "DSA-5161",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2022/dsa-5161",
                  },
                  {
                     name: "[debian-lts-announce] 20220701 [SECURITY] [DLA 3065-1] linux security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html",
                  },
                  {
                     name: "DSA-5173",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2022/dsa-5173",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2022-0854",
      datePublished: "2022-03-23T19:46:15",
      dateReserved: "2022-03-04T00:00:00",
      dateUpdated: "2024-08-02T23:40:04.528Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2022-23042

Vulnerability from cvelistv5

Published

2022-03-10 19:20

Modified

2024-08-03 03:28

Severity ?

Summary

References

▼	URL	Tags
	https://xenbits.xenproject.org/xsa/advisory-396.txt	x_refsource_MISC
	https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html	mailing-list, x_refsource_MLIST

Impacted products

	Vendor	Product	Version
	unspecified	unspecified

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T03:28:42.974Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://xenbits.xenproject.org/xsa/advisory-396.txt",
               },
               {
                  name: "[debian-lts-announce] 20220701 [SECURITY] [DLA 3065-1] linux security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "unspecified",
               vendor: "unspecified",
               versions: [
                  {
                     status: "unknown",
                     version: "consult Xen advisory XSA-396",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "{'credit_data': {'description': {'description_data': [{'lang': 'eng', 'value': 'This issue was discovered by Demi Marie Obenour and Simon Gaiser of\\nInvisible Things Lab.'}]}}}",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malicious backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they assume that a following removal of the granted access will always succeed, which is not true in case the backend has mapped the granted page between those two operations. As a result the backend can keep access to the memory page of the guest no matter how the page will be used after the frontend I/O has finished. The xenbus driver has a similar problem, as it doesn't check the success of removing the granted access of a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038 gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus, 9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no longer in use, but the freeing of the related data page is not synchronized with dropping the granted access. As a result the backend can keep access to the memory page even after it has been freed and then re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which can be triggered by the backend. CVE-2022-23042",
            },
         ],
         metrics: [
            {
               other: {
                  content: {
                     description: {
                        description_data: [
                           {
                              lang: "eng",
                              value: "Due to race conditions and missing tests of return codes in the Linux\nPV device frontend drivers a malicious backend could gain access (read\nand write) to memory pages it shouldn't have, or it could directly\ntrigger Denial of Service (DoS) in the guest.",
                           },
                        ],
                     },
                  },
                  type: "unknown",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "unknown",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-07-01T13:06:43",
            orgId: "23aa2041-22e1-471f-9209-9b7396fa234f",
            shortName: "XEN",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://xenbits.xenproject.org/xsa/advisory-396.txt",
            },
            {
               name: "[debian-lts-announce] 20220701 [SECURITY] [DLA 3065-1] linux security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security@xen.org",
               ID: "CVE-2022-23042",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: "?",
                                          version_value: "consult Xen advisory XSA-396",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "",
                     },
                  ],
               },
            },
            configuration: {
               configuration_data: {
                  description: {
                     description_data: [
                        {
                           lang: "eng",
                           value: "All Linux guests using PV devices are vulnerable in case potentially\nmalicious PV device backends are being used.",
                        },
                     ],
                  },
               },
            },
            credit: {
               credit_data: {
                  description: {
                     description_data: [
                        {
                           lang: "eng",
                           value: "This issue was discovered by Demi Marie Obenour and Simon Gaiser of\nInvisible Things Lab.",
                        },
                     ],
                  },
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malicious backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they assume that a following removal of the granted access will always succeed, which is not true in case the backend has mapped the granted page between those two operations. As a result the backend can keep access to the memory page of the guest no matter how the page will be used after the frontend I/O has finished. The xenbus driver has a similar problem, as it doesn't check the success of removing the granted access of a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038 gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus, 9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no longer in use, but the freeing of the related data page is not synchronized with dropping the granted access. As a result the backend can keep access to the memory page even after it has been freed and then re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which can be triggered by the backend. CVE-2022-23042",
                  },
               ],
            },
            impact: {
               impact_data: {
                  description: {
                     description_data: [
                        {
                           lang: "eng",
                           value: "Due to race conditions and missing tests of return codes in the Linux\nPV device frontend drivers a malicious backend could gain access (read\nand write) to memory pages it shouldn't have, or it could directly\ntrigger Denial of Service (DoS) in the guest.",
                        },
                     ],
                  },
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "unknown",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://xenbits.xenproject.org/xsa/advisory-396.txt",
                     refsource: "MISC",
                     url: "https://xenbits.xenproject.org/xsa/advisory-396.txt",
                  },
                  {
                     name: "[debian-lts-announce] 20220701 [SECURITY] [DLA 3065-1] linux security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html",
                  },
               ],
            },
            workaround: {
               workaround_data: {
                  description: {
                     description_data: [
                        {
                           lang: "eng",
                           value: "There is no mitigation available other than not using PV devices in case\na backend is suspected to be potentially malicious.",
                        },
                     ],
                  },
               },
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "23aa2041-22e1-471f-9209-9b7396fa234f",
      assignerShortName: "XEN",
      cveId: "CVE-2022-23042",
      datePublished: "2022-03-10T19:20:24",
      dateReserved: "2022-01-10T00:00:00",
      dateUpdated: "2024-08-03T03:28:42.974Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2022-24448

Vulnerability from cvelistv5

Published

2022-02-04 19:45

Modified

2024-08-03 04:13

Severity ?

Summary

An issue was discovered in fs/nfs/dir.c in the Linux kernel before 5.16.5. If an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should occur, but the server instead returns uninitialized data in the file descriptor.

References

▼	URL	Tags
	https://www.spinics.net/lists/stable/msg531976.html	x_refsource_MISC
	https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.5	x_refsource_MISC
	https://github.com/torvalds/linux/commit/ac795161c93699d600db16c1a8cc23a65a1eceaf	x_refsource_MISC
	https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ac795161c93699d600db16c1a8cc23a65a1eceaf	x_refsource_MISC
	https://www.debian.org/security/2022/dsa-5092	vendor-advisory, x_refsource_DEBIAN
	https://lists.debian.org/debian-lts-announce/2022/03/msg00011.html	mailing-list, x_refsource_MLIST
	https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html	mailing-list, x_refsource_MLIST
	https://www.debian.org/security/2022/dsa-5096	vendor-advisory, x_refsource_DEBIAN
	https://lore.kernel.org/all/67d6a536-9027-1928-99b6-af512a36cd1a%40huawei.com/T/	x_refsource_MISC
	https://github.com/torvalds/linux/commit/ab0fc21bc7105b54bafd85bd8b82742f9e68898a	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T04:13:56.018Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.spinics.net/lists/stable/msg531976.html",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.5",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/torvalds/linux/commit/ac795161c93699d600db16c1a8cc23a65a1eceaf",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ac795161c93699d600db16c1a8cc23a65a1eceaf",
               },
               {
                  name: "DSA-5092",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2022/dsa-5092",
               },
               {
                  name: "[debian-lts-announce] 20220309 [SECURITY] [DLA 2940-1] linux security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2022/03/msg00011.html",
               },
               {
                  name: "[debian-lts-announce] 20220309 [SECURITY] [DLA 2941-1] linux-4.19 security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html",
               },
               {
                  name: "DSA-5096",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2022/dsa-5096",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://lore.kernel.org/all/67d6a536-9027-1928-99b6-af512a36cd1a%40huawei.com/T/",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/torvalds/linux/commit/ab0fc21bc7105b54bafd85bd8b82742f9e68898a",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "An issue was discovered in fs/nfs/dir.c in the Linux kernel before 5.16.5. If an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should occur, but the server instead returns uninitialized data in the file descriptor.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-05-05T16:38:39",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.spinics.net/lists/stable/msg531976.html",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.5",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/torvalds/linux/commit/ac795161c93699d600db16c1a8cc23a65a1eceaf",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ac795161c93699d600db16c1a8cc23a65a1eceaf",
            },
            {
               name: "DSA-5092",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2022/dsa-5092",
            },
            {
               name: "[debian-lts-announce] 20220309 [SECURITY] [DLA 2940-1] linux security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2022/03/msg00011.html",
            },
            {
               name: "[debian-lts-announce] 20220309 [SECURITY] [DLA 2941-1] linux-4.19 security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html",
            },
            {
               name: "DSA-5096",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2022/dsa-5096",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://lore.kernel.org/all/67d6a536-9027-1928-99b6-af512a36cd1a%40huawei.com/T/",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/torvalds/linux/commit/ab0fc21bc7105b54bafd85bd8b82742f9e68898a",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2022-24448",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "An issue was discovered in fs/nfs/dir.c in the Linux kernel before 5.16.5. If an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should occur, but the server instead returns uninitialized data in the file descriptor.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://www.spinics.net/lists/stable/msg531976.html",
                     refsource: "MISC",
                     url: "https://www.spinics.net/lists/stable/msg531976.html",
                  },
                  {
                     name: "https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.5",
                     refsource: "MISC",
                     url: "https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.5",
                  },
                  {
                     name: "https://github.com/torvalds/linux/commit/ac795161c93699d600db16c1a8cc23a65a1eceaf",
                     refsource: "MISC",
                     url: "https://github.com/torvalds/linux/commit/ac795161c93699d600db16c1a8cc23a65a1eceaf",
                  },
                  {
                     name: "https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ac795161c93699d600db16c1a8cc23a65a1eceaf",
                     refsource: "MISC",
                     url: "https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ac795161c93699d600db16c1a8cc23a65a1eceaf",
                  },
                  {
                     name: "DSA-5092",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2022/dsa-5092",
                  },
                  {
                     name: "[debian-lts-announce] 20220309 [SECURITY] [DLA 2940-1] linux security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2022/03/msg00011.html",
                  },
                  {
                     name: "[debian-lts-announce] 20220309 [SECURITY] [DLA 2941-1] linux-4.19 security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html",
                  },
                  {
                     name: "DSA-5096",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2022/dsa-5096",
                  },
                  {
                     name: "https://lore.kernel.org/all/67d6a536-9027-1928-99b6-af512a36cd1a@huawei.com/T/",
                     refsource: "MISC",
                     url: "https://lore.kernel.org/all/67d6a536-9027-1928-99b6-af512a36cd1a@huawei.com/T/",
                  },
                  {
                     name: "https://github.com/torvalds/linux/commit/ab0fc21bc7105b54bafd85bd8b82742f9e68898a",
                     refsource: "MISC",
                     url: "https://github.com/torvalds/linux/commit/ab0fc21bc7105b54bafd85bd8b82742f9e68898a",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2022-24448",
      datePublished: "2022-02-04T19:45:48",
      dateReserved: "2022-02-04T00:00:00",
      dateUpdated: "2024-08-03T04:13:56.018Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2022-0516

Vulnerability from cvelistv5

Published

2022-03-08 14:06

Modified

2024-08-02 23:32

Severity ?

Summary

A vulnerability was found in kvm_s390_guest_sida_op in the arch/s390/kvm/kvm-s390.c function in KVM for s390 in the Linux kernel. This flaw allows a local attacker with a normal user privilege to obtain unauthorized memory write access. This flaw affects Linux kernel versions prior to 5.17-rc4.

References

▼	URL	Tags
	https://bugzilla.redhat.com/show_bug.cgi?id=2050237	x_refsource_MISC
	https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=09a93c1df3eafa43bcdfd7bf837c574911f12f55	x_refsource_MISC
	https://www.debian.org/security/2022/dsa-5092	vendor-advisory, x_refsource_DEBIAN
	https://security.netapp.com/advisory/ntap-20220331-0009/	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	n/a	kernel	Version: Linux kernel versions prior to 5.17-rc4

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T23:32:46.029Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=2050237",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=09a93c1df3eafa43bcdfd7bf837c574911f12f55",
               },
               {
                  name: "DSA-5092",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2022/dsa-5092",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20220331-0009/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "kernel",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "Linux kernel versions prior to 5.17-rc4",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A vulnerability was found in kvm_s390_guest_sida_op in the arch/s390/kvm/kvm-s390.c function in KVM for s390 in the Linux kernel. This flaw allows a local attacker with a normal user privilege to obtain unauthorized memory write access. This flaw affects Linux kernel versions prior to 5.17-rc4.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-200",
                     description: "CWE-200",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-03-31T08:06:17",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2050237",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=09a93c1df3eafa43bcdfd7bf837c574911f12f55",
            },
            {
               name: "DSA-5092",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2022/dsa-5092",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://security.netapp.com/advisory/ntap-20220331-0009/",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secalert@redhat.com",
               ID: "CVE-2022-0516",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "kernel",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "Linux kernel versions prior to 5.17-rc4",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "A vulnerability was found in kvm_s390_guest_sida_op in the arch/s390/kvm/kvm-s390.c function in KVM for s390 in the Linux kernel. This flaw allows a local attacker with a normal user privilege to obtain unauthorized memory write access. This flaw affects Linux kernel versions prior to 5.17-rc4.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-200",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://bugzilla.redhat.com/show_bug.cgi?id=2050237",
                     refsource: "MISC",
                     url: "https://bugzilla.redhat.com/show_bug.cgi?id=2050237",
                  },
                  {
                     name: "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=09a93c1df3eafa43bcdfd7bf837c574911f12f55",
                     refsource: "MISC",
                     url: "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=09a93c1df3eafa43bcdfd7bf837c574911f12f55",
                  },
                  {
                     name: "DSA-5092",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2022/dsa-5092",
                  },
                  {
                     name: "https://security.netapp.com/advisory/ntap-20220331-0009/",
                     refsource: "CONFIRM",
                     url: "https://security.netapp.com/advisory/ntap-20220331-0009/",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2022-0516",
      datePublished: "2022-03-08T14:06:13",
      dateReserved: "2022-02-07T00:00:00",
      dateUpdated: "2024-08-02T23:32:46.029Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2022-23040

Vulnerability from cvelistv5

Published

2022-03-10 19:20

Modified

2024-08-03 03:28

Severity ?

Summary

References

▼	URL	Tags
	https://xenbits.xenproject.org/xsa/advisory-396.txt	x_refsource_MISC
	https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html	mailing-list, x_refsource_MLIST

Impacted products

	Vendor	Product	Version
	unspecified	unspecified

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T03:28:42.981Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://xenbits.xenproject.org/xsa/advisory-396.txt",
               },
               {
                  name: "[debian-lts-announce] 20220701 [SECURITY] [DLA 3065-1] linux security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "unspecified",
               vendor: "unspecified",
               versions: [
                  {
                     status: "unknown",
                     version: "consult Xen advisory XSA-396",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "{'credit_data': {'description': {'description_data': [{'lang': 'eng', 'value': 'This issue was discovered by Demi Marie Obenour and Simon Gaiser of\\nInvisible Things Lab.'}]}}}",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malicious backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they assume that a following removal of the granted access will always succeed, which is not true in case the backend has mapped the granted page between those two operations. As a result the backend can keep access to the memory page of the guest no matter how the page will be used after the frontend I/O has finished. The xenbus driver has a similar problem, as it doesn't check the success of removing the granted access of a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038 gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus, 9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no longer in use, but the freeing of the related data page is not synchronized with dropping the granted access. As a result the backend can keep access to the memory page even after it has been freed and then re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which can be triggered by the backend. CVE-2022-23042",
            },
         ],
         metrics: [
            {
               other: {
                  content: {
                     description: {
                        description_data: [
                           {
                              lang: "eng",
                              value: "Due to race conditions and missing tests of return codes in the Linux\nPV device frontend drivers a malicious backend could gain access (read\nand write) to memory pages it shouldn't have, or it could directly\ntrigger Denial of Service (DoS) in the guest.",
                           },
                        ],
                     },
                  },
                  type: "unknown",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "unknown",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-07-01T13:06:37",
            orgId: "23aa2041-22e1-471f-9209-9b7396fa234f",
            shortName: "XEN",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://xenbits.xenproject.org/xsa/advisory-396.txt",
            },
            {
               name: "[debian-lts-announce] 20220701 [SECURITY] [DLA 3065-1] linux security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security@xen.org",
               ID: "CVE-2022-23040",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: "?",
                                          version_value: "consult Xen advisory XSA-396",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "",
                     },
                  ],
               },
            },
            configuration: {
               configuration_data: {
                  description: {
                     description_data: [
                        {
                           lang: "eng",
                           value: "All Linux guests using PV devices are vulnerable in case potentially\nmalicious PV device backends are being used.",
                        },
                     ],
                  },
               },
            },
            credit: {
               credit_data: {
                  description: {
                     description_data: [
                        {
                           lang: "eng",
                           value: "This issue was discovered by Demi Marie Obenour and Simon Gaiser of\nInvisible Things Lab.",
                        },
                     ],
                  },
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malicious backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they assume that a following removal of the granted access will always succeed, which is not true in case the backend has mapped the granted page between those two operations. As a result the backend can keep access to the memory page of the guest no matter how the page will be used after the frontend I/O has finished. The xenbus driver has a similar problem, as it doesn't check the success of removing the granted access of a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038 gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus, 9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no longer in use, but the freeing of the related data page is not synchronized with dropping the granted access. As a result the backend can keep access to the memory page even after it has been freed and then re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which can be triggered by the backend. CVE-2022-23042",
                  },
               ],
            },
            impact: {
               impact_data: {
                  description: {
                     description_data: [
                        {
                           lang: "eng",
                           value: "Due to race conditions and missing tests of return codes in the Linux\nPV device frontend drivers a malicious backend could gain access (read\nand write) to memory pages it shouldn't have, or it could directly\ntrigger Denial of Service (DoS) in the guest.",
                        },
                     ],
                  },
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "unknown",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://xenbits.xenproject.org/xsa/advisory-396.txt",
                     refsource: "MISC",
                     url: "https://xenbits.xenproject.org/xsa/advisory-396.txt",
                  },
                  {
                     name: "[debian-lts-announce] 20220701 [SECURITY] [DLA 3065-1] linux security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html",
                  },
               ],
            },
            workaround: {
               workaround_data: {
                  description: {
                     description_data: [
                        {
                           lang: "eng",
                           value: "There is no mitigation available other than not using PV devices in case\na backend is suspected to be potentially malicious.",
                        },
                     ],
                  },
               },
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "23aa2041-22e1-471f-9209-9b7396fa234f",
      assignerShortName: "XEN",
      cveId: "CVE-2022-23040",
      datePublished: "2022-03-10T19:20:21",
      dateReserved: "2022-01-10T00:00:00",
      dateUpdated: "2024-08-03T03:28:42.981Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2022-28390

Vulnerability from cvelistv5

Published

2022-04-03 20:07

Modified

2024-08-03 05:56

Severity ?

Summary

ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c in the Linux kernel through 5.17.1 has a double free.

References

▼	URL	Tags
	https://github.com/torvalds/linux/commit/c70222752228a62135cee3409dccefd494a24646	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LAWC35TO642FOP3UCA3C6IF7NAUFOVZ6/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XFMPUI3WI4U2F7ONHRW36WDY4ZE7LGGT/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6IHHC455LMSJNG4CSZ5CEAHYWY2DE5YW/	vendor-advisory, x_refsource_FEDORA
	https://www.debian.org/security/2022/dsa-5127	vendor-advisory, x_refsource_DEBIAN
	https://security.netapp.com/advisory/ntap-20220513-0001/	x_refsource_CONFIRM
	https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html	mailing-list, x_refsource_MLIST
	https://www.debian.org/security/2022/dsa-5173	vendor-advisory, x_refsource_DEBIAN

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T05:56:15.238Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/torvalds/linux/commit/c70222752228a62135cee3409dccefd494a24646",
               },
               {
                  name: "FEDORA-2022-af492757d9",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LAWC35TO642FOP3UCA3C6IF7NAUFOVZ6/",
               },
               {
                  name: "FEDORA-2022-5cd9d787dc",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XFMPUI3WI4U2F7ONHRW36WDY4ZE7LGGT/",
               },
               {
                  name: "FEDORA-2022-91633399ff",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6IHHC455LMSJNG4CSZ5CEAHYWY2DE5YW/",
               },
               {
                  name: "DSA-5127",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2022/dsa-5127",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20220513-0001/",
               },
               {
                  name: "[debian-lts-announce] 20220701 [SECURITY] [DLA 3065-1] linux security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html",
               },
               {
                  name: "DSA-5173",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2022/dsa-5173",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c in the Linux kernel through 5.17.1 has a double free.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-07-04T10:11:58",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/torvalds/linux/commit/c70222752228a62135cee3409dccefd494a24646",
            },
            {
               name: "FEDORA-2022-af492757d9",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LAWC35TO642FOP3UCA3C6IF7NAUFOVZ6/",
            },
            {
               name: "FEDORA-2022-5cd9d787dc",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XFMPUI3WI4U2F7ONHRW36WDY4ZE7LGGT/",
            },
            {
               name: "FEDORA-2022-91633399ff",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6IHHC455LMSJNG4CSZ5CEAHYWY2DE5YW/",
            },
            {
               name: "DSA-5127",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2022/dsa-5127",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://security.netapp.com/advisory/ntap-20220513-0001/",
            },
            {
               name: "[debian-lts-announce] 20220701 [SECURITY] [DLA 3065-1] linux security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html",
            },
            {
               name: "DSA-5173",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2022/dsa-5173",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2022-28390",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c in the Linux kernel through 5.17.1 has a double free.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://github.com/torvalds/linux/commit/c70222752228a62135cee3409dccefd494a24646",
                     refsource: "MISC",
                     url: "https://github.com/torvalds/linux/commit/c70222752228a62135cee3409dccefd494a24646",
                  },
                  {
                     name: "FEDORA-2022-af492757d9",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAWC35TO642FOP3UCA3C6IF7NAUFOVZ6/",
                  },
                  {
                     name: "FEDORA-2022-5cd9d787dc",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFMPUI3WI4U2F7ONHRW36WDY4ZE7LGGT/",
                  },
                  {
                     name: "FEDORA-2022-91633399ff",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6IHHC455LMSJNG4CSZ5CEAHYWY2DE5YW/",
                  },
                  {
                     name: "DSA-5127",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2022/dsa-5127",
                  },
                  {
                     name: "https://security.netapp.com/advisory/ntap-20220513-0001/",
                     refsource: "CONFIRM",
                     url: "https://security.netapp.com/advisory/ntap-20220513-0001/",
                  },
                  {
                     name: "[debian-lts-announce] 20220701 [SECURITY] [DLA 3065-1] linux security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html",
                  },
                  {
                     name: "DSA-5173",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2022/dsa-5173",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2022-28390",
      datePublished: "2022-04-03T20:07:21",
      dateReserved: "2022-04-03T00:00:00",
      dateUpdated: "2024-08-03T05:56:15.238Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2022-28389

Vulnerability from cvelistv5

Published

2022-04-03 20:07

Modified

2024-08-03 05:56

Severity ?

Summary

mcba_usb_start_xmit in drivers/net/can/usb/mcba_usb.c in the Linux kernel through 5.17.1 has a double free.

References

▼	URL	Tags
	https://github.com/torvalds/linux/commit/04c9b00ba83594a29813d6b1fb8fdc93a3915174	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LAWC35TO642FOP3UCA3C6IF7NAUFOVZ6/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XFMPUI3WI4U2F7ONHRW36WDY4ZE7LGGT/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6IHHC455LMSJNG4CSZ5CEAHYWY2DE5YW/	vendor-advisory, x_refsource_FEDORA
	https://www.debian.org/security/2022/dsa-5127	vendor-advisory, x_refsource_DEBIAN
	https://security.netapp.com/advisory/ntap-20220513-0001/	x_refsource_CONFIRM
	https://www.debian.org/security/2022/dsa-5173	vendor-advisory, x_refsource_DEBIAN

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T05:56:15.265Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/torvalds/linux/commit/04c9b00ba83594a29813d6b1fb8fdc93a3915174",
               },
               {
                  name: "FEDORA-2022-af492757d9",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LAWC35TO642FOP3UCA3C6IF7NAUFOVZ6/",
               },
               {
                  name: "FEDORA-2022-5cd9d787dc",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XFMPUI3WI4U2F7ONHRW36WDY4ZE7LGGT/",
               },
               {
                  name: "FEDORA-2022-91633399ff",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6IHHC455LMSJNG4CSZ5CEAHYWY2DE5YW/",
               },
               {
                  name: "DSA-5127",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2022/dsa-5127",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20220513-0001/",
               },
               {
                  name: "DSA-5173",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2022/dsa-5173",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "mcba_usb_start_xmit in drivers/net/can/usb/mcba_usb.c in the Linux kernel through 5.17.1 has a double free.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-07-04T10:11:40",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/torvalds/linux/commit/04c9b00ba83594a29813d6b1fb8fdc93a3915174",
            },
            {
               name: "FEDORA-2022-af492757d9",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LAWC35TO642FOP3UCA3C6IF7NAUFOVZ6/",
            },
            {
               name: "FEDORA-2022-5cd9d787dc",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XFMPUI3WI4U2F7ONHRW36WDY4ZE7LGGT/",
            },
            {
               name: "FEDORA-2022-91633399ff",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6IHHC455LMSJNG4CSZ5CEAHYWY2DE5YW/",
            },
            {
               name: "DSA-5127",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2022/dsa-5127",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://security.netapp.com/advisory/ntap-20220513-0001/",
            },
            {
               name: "DSA-5173",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2022/dsa-5173",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2022-28389",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "mcba_usb_start_xmit in drivers/net/can/usb/mcba_usb.c in the Linux kernel through 5.17.1 has a double free.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://github.com/torvalds/linux/commit/04c9b00ba83594a29813d6b1fb8fdc93a3915174",
                     refsource: "MISC",
                     url: "https://github.com/torvalds/linux/commit/04c9b00ba83594a29813d6b1fb8fdc93a3915174",
                  },
                  {
                     name: "FEDORA-2022-af492757d9",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAWC35TO642FOP3UCA3C6IF7NAUFOVZ6/",
                  },
                  {
                     name: "FEDORA-2022-5cd9d787dc",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFMPUI3WI4U2F7ONHRW36WDY4ZE7LGGT/",
                  },
                  {
                     name: "FEDORA-2022-91633399ff",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6IHHC455LMSJNG4CSZ5CEAHYWY2DE5YW/",
                  },
                  {
                     name: "DSA-5127",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2022/dsa-5127",
                  },
                  {
                     name: "https://security.netapp.com/advisory/ntap-20220513-0001/",
                     refsource: "CONFIRM",
                     url: "https://security.netapp.com/advisory/ntap-20220513-0001/",
                  },
                  {
                     name: "DSA-5173",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2022/dsa-5173",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2022-28389",
      datePublished: "2022-04-03T20:07:30",
      dateReserved: "2022-04-03T00:00:00",
      dateUpdated: "2024-08-03T05:56:15.265Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2022-23037

Vulnerability from cvelistv5

Published

2022-03-10 19:20

Modified

2024-08-03 03:28

Severity ?

Summary

References

▼	URL	Tags
	https://xenbits.xenproject.org/xsa/advisory-396.txt	x_refsource_MISC
	https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html	mailing-list, x_refsource_MLIST

Impacted products

	Vendor	Product	Version
	unspecified	unspecified

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T03:28:43.061Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://xenbits.xenproject.org/xsa/advisory-396.txt",
               },
               {
                  name: "[debian-lts-announce] 20220701 [SECURITY] [DLA 3065-1] linux security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "unspecified",
               vendor: "unspecified",
               versions: [
                  {
                     status: "unknown",
                     version: "consult Xen advisory XSA-396",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "{'credit_data': {'description': {'description_data': [{'lang': 'eng', 'value': 'This issue was discovered by Demi Marie Obenour and Simon Gaiser of\\nInvisible Things Lab.'}]}}}",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malicious backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they assume that a following removal of the granted access will always succeed, which is not true in case the backend has mapped the granted page between those two operations. As a result the backend can keep access to the memory page of the guest no matter how the page will be used after the frontend I/O has finished. The xenbus driver has a similar problem, as it doesn't check the success of removing the granted access of a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038 gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus, 9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no longer in use, but the freeing of the related data page is not synchronized with dropping the granted access. As a result the backend can keep access to the memory page even after it has been freed and then re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which can be triggered by the backend. CVE-2022-23042",
            },
         ],
         metrics: [
            {
               other: {
                  content: {
                     description: {
                        description_data: [
                           {
                              lang: "eng",
                              value: "Due to race conditions and missing tests of return codes in the Linux\nPV device frontend drivers a malicious backend could gain access (read\nand write) to memory pages it shouldn't have, or it could directly\ntrigger Denial of Service (DoS) in the guest.",
                           },
                        ],
                     },
                  },
                  type: "unknown",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "unknown",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-07-01T13:06:32",
            orgId: "23aa2041-22e1-471f-9209-9b7396fa234f",
            shortName: "XEN",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://xenbits.xenproject.org/xsa/advisory-396.txt",
            },
            {
               name: "[debian-lts-announce] 20220701 [SECURITY] [DLA 3065-1] linux security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security@xen.org",
               ID: "CVE-2022-23037",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: "?",
                                          version_value: "consult Xen advisory XSA-396",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "",
                     },
                  ],
               },
            },
            configuration: {
               configuration_data: {
                  description: {
                     description_data: [
                        {
                           lang: "eng",
                           value: "All Linux guests using PV devices are vulnerable in case potentially\nmalicious PV device backends are being used.",
                        },
                     ],
                  },
               },
            },
            credit: {
               credit_data: {
                  description: {
                     description_data: [
                        {
                           lang: "eng",
                           value: "This issue was discovered by Demi Marie Obenour and Simon Gaiser of\nInvisible Things Lab.",
                        },
                     ],
                  },
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malicious backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they assume that a following removal of the granted access will always succeed, which is not true in case the backend has mapped the granted page between those two operations. As a result the backend can keep access to the memory page of the guest no matter how the page will be used after the frontend I/O has finished. The xenbus driver has a similar problem, as it doesn't check the success of removing the granted access of a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038 gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus, 9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no longer in use, but the freeing of the related data page is not synchronized with dropping the granted access. As a result the backend can keep access to the memory page even after it has been freed and then re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which can be triggered by the backend. CVE-2022-23042",
                  },
               ],
            },
            impact: {
               impact_data: {
                  description: {
                     description_data: [
                        {
                           lang: "eng",
                           value: "Due to race conditions and missing tests of return codes in the Linux\nPV device frontend drivers a malicious backend could gain access (read\nand write) to memory pages it shouldn't have, or it could directly\ntrigger Denial of Service (DoS) in the guest.",
                        },
                     ],
                  },
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "unknown",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://xenbits.xenproject.org/xsa/advisory-396.txt",
                     refsource: "MISC",
                     url: "https://xenbits.xenproject.org/xsa/advisory-396.txt",
                  },
                  {
                     name: "[debian-lts-announce] 20220701 [SECURITY] [DLA 3065-1] linux security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html",
                  },
               ],
            },
            workaround: {
               workaround_data: {
                  description: {
                     description_data: [
                        {
                           lang: "eng",
                           value: "There is no mitigation available other than not using PV devices in case\na backend is suspected to be potentially malicious.",
                        },
                     ],
                  },
               },
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "23aa2041-22e1-471f-9209-9b7396fa234f",
      assignerShortName: "XEN",
      cveId: "CVE-2022-23037",
      datePublished: "2022-03-10T19:20:16",
      dateReserved: "2022-01-10T00:00:00",
      dateUpdated: "2024-08-03T03:28:43.061Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2022-23041

Vulnerability from cvelistv5

Published

2022-03-10 19:20

Modified

2024-08-03 03:28

Severity ?

Summary

References

▼	URL	Tags
	https://xenbits.xenproject.org/xsa/advisory-396.txt	x_refsource_MISC
	https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html	mailing-list, x_refsource_MLIST

Impacted products

	Vendor	Product	Version
	unspecified	unspecified

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T03:28:42.964Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://xenbits.xenproject.org/xsa/advisory-396.txt",
               },
               {
                  name: "[debian-lts-announce] 20220701 [SECURITY] [DLA 3065-1] linux security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "unspecified",
               vendor: "unspecified",
               versions: [
                  {
                     status: "unknown",
                     version: "consult Xen advisory XSA-396",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "{'credit_data': {'description': {'description_data': [{'lang': 'eng', 'value': 'This issue was discovered by Demi Marie Obenour and Simon Gaiser of\\nInvisible Things Lab.'}]}}}",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malicious backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they assume that a following removal of the granted access will always succeed, which is not true in case the backend has mapped the granted page between those two operations. As a result the backend can keep access to the memory page of the guest no matter how the page will be used after the frontend I/O has finished. The xenbus driver has a similar problem, as it doesn't check the success of removing the granted access of a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038 gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus, 9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no longer in use, but the freeing of the related data page is not synchronized with dropping the granted access. As a result the backend can keep access to the memory page even after it has been freed and then re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which can be triggered by the backend. CVE-2022-23042",
            },
         ],
         metrics: [
            {
               other: {
                  content: {
                     description: {
                        description_data: [
                           {
                              lang: "eng",
                              value: "Due to race conditions and missing tests of return codes in the Linux\nPV device frontend drivers a malicious backend could gain access (read\nand write) to memory pages it shouldn't have, or it could directly\ntrigger Denial of Service (DoS) in the guest.",
                           },
                        ],
                     },
                  },
                  type: "unknown",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "unknown",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-07-01T13:06:34",
            orgId: "23aa2041-22e1-471f-9209-9b7396fa234f",
            shortName: "XEN",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://xenbits.xenproject.org/xsa/advisory-396.txt",
            },
            {
               name: "[debian-lts-announce] 20220701 [SECURITY] [DLA 3065-1] linux security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security@xen.org",
               ID: "CVE-2022-23041",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: "?",
                                          version_value: "consult Xen advisory XSA-396",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "",
                     },
                  ],
               },
            },
            configuration: {
               configuration_data: {
                  description: {
                     description_data: [
                        {
                           lang: "eng",
                           value: "All Linux guests using PV devices are vulnerable in case potentially\nmalicious PV device backends are being used.",
                        },
                     ],
                  },
               },
            },
            credit: {
               credit_data: {
                  description: {
                     description_data: [
                        {
                           lang: "eng",
                           value: "This issue was discovered by Demi Marie Obenour and Simon Gaiser of\nInvisible Things Lab.",
                        },
                     ],
                  },
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malicious backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they assume that a following removal of the granted access will always succeed, which is not true in case the backend has mapped the granted page between those two operations. As a result the backend can keep access to the memory page of the guest no matter how the page will be used after the frontend I/O has finished. The xenbus driver has a similar problem, as it doesn't check the success of removing the granted access of a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038 gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus, 9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no longer in use, but the freeing of the related data page is not synchronized with dropping the granted access. As a result the backend can keep access to the memory page even after it has been freed and then re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which can be triggered by the backend. CVE-2022-23042",
                  },
               ],
            },
            impact: {
               impact_data: {
                  description: {
                     description_data: [
                        {
                           lang: "eng",
                           value: "Due to race conditions and missing tests of return codes in the Linux\nPV device frontend drivers a malicious backend could gain access (read\nand write) to memory pages it shouldn't have, or it could directly\ntrigger Denial of Service (DoS) in the guest.",
                        },
                     ],
                  },
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "unknown",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://xenbits.xenproject.org/xsa/advisory-396.txt",
                     refsource: "MISC",
                     url: "https://xenbits.xenproject.org/xsa/advisory-396.txt",
                  },
                  {
                     name: "[debian-lts-announce] 20220701 [SECURITY] [DLA 3065-1] linux security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html",
                  },
               ],
            },
            workaround: {
               workaround_data: {
                  description: {
                     description_data: [
                        {
                           lang: "eng",
                           value: "There is no mitigation available other than not using PV devices in case\na backend is suspected to be potentially malicious.",
                        },
                     ],
                  },
               },
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "23aa2041-22e1-471f-9209-9b7396fa234f",
      assignerShortName: "XEN",
      cveId: "CVE-2022-23041",
      datePublished: "2022-03-10T19:20:22",
      dateReserved: "2022-01-10T00:00:00",
      dateUpdated: "2024-08-03T03:28:42.964Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2022-24958

Vulnerability from cvelistv5

Published

2022-02-11 04:21

Modified

2024-08-03 04:29

Severity ?

Summary

drivers/usb/gadget/legacy/inode.c in the Linux kernel through 5.16.8 mishandles dev->buf release.

References

▼	URL	Tags
	https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=89f3594d0de58e8a57d92d497dea9fee3d4b9cda	x_refsource_MISC
	https://github.com/torvalds/linux/commit/89f3594d0de58e8a57d92d497dea9fee3d4b9cda	x_refsource_MISC
	https://github.com/torvalds/linux/commit/501e38a5531efbd77d5c73c0ba838a889bfc1d74	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TCW2KZYJ2H6BKZE3CVLHRIXYDGNYYC5P/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SUVZA2YVOQJBJTDIDQ5HF5TAU2C6WP6H/	vendor-advisory, x_refsource_FEDORA
	https://security.netapp.com/advisory/ntap-20220225-0008/	x_refsource_CONFIRM
	https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html	mailing-list, x_refsource_MLIST

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T04:29:01.617Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=89f3594d0de58e8a57d92d497dea9fee3d4b9cda",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/torvalds/linux/commit/89f3594d0de58e8a57d92d497dea9fee3d4b9cda",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/torvalds/linux/commit/501e38a5531efbd77d5c73c0ba838a889bfc1d74",
               },
               {
                  name: "FEDORA-2022-9d4e48836d",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TCW2KZYJ2H6BKZE3CVLHRIXYDGNYYC5P/",
               },
               {
                  name: "FEDORA-2022-2aa7c08b53",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SUVZA2YVOQJBJTDIDQ5HF5TAU2C6WP6H/",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20220225-0008/",
               },
               {
                  name: "[debian-lts-announce] 20220701 [SECURITY] [DLA 3065-1] linux security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "drivers/usb/gadget/legacy/inode.c in the Linux kernel through 5.16.8 mishandles dev->buf release.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-07-01T13:06:52",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=89f3594d0de58e8a57d92d497dea9fee3d4b9cda",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/torvalds/linux/commit/89f3594d0de58e8a57d92d497dea9fee3d4b9cda",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/torvalds/linux/commit/501e38a5531efbd77d5c73c0ba838a889bfc1d74",
            },
            {
               name: "FEDORA-2022-9d4e48836d",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TCW2KZYJ2H6BKZE3CVLHRIXYDGNYYC5P/",
            },
            {
               name: "FEDORA-2022-2aa7c08b53",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SUVZA2YVOQJBJTDIDQ5HF5TAU2C6WP6H/",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://security.netapp.com/advisory/ntap-20220225-0008/",
            },
            {
               name: "[debian-lts-announce] 20220701 [SECURITY] [DLA 3065-1] linux security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2022-24958",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "drivers/usb/gadget/legacy/inode.c in the Linux kernel through 5.16.8 mishandles dev->buf release.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=89f3594d0de58e8a57d92d497dea9fee3d4b9cda",
                     refsource: "MISC",
                     url: "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=89f3594d0de58e8a57d92d497dea9fee3d4b9cda",
                  },
                  {
                     name: "https://github.com/torvalds/linux/commit/89f3594d0de58e8a57d92d497dea9fee3d4b9cda",
                     refsource: "MISC",
                     url: "https://github.com/torvalds/linux/commit/89f3594d0de58e8a57d92d497dea9fee3d4b9cda",
                  },
                  {
                     name: "https://github.com/torvalds/linux/commit/501e38a5531efbd77d5c73c0ba838a889bfc1d74",
                     refsource: "MISC",
                     url: "https://github.com/torvalds/linux/commit/501e38a5531efbd77d5c73c0ba838a889bfc1d74",
                  },
                  {
                     name: "FEDORA-2022-9d4e48836d",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TCW2KZYJ2H6BKZE3CVLHRIXYDGNYYC5P/",
                  },
                  {
                     name: "FEDORA-2022-2aa7c08b53",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SUVZA2YVOQJBJTDIDQ5HF5TAU2C6WP6H/",
                  },
                  {
                     name: "https://security.netapp.com/advisory/ntap-20220225-0008/",
                     refsource: "CONFIRM",
                     url: "https://security.netapp.com/advisory/ntap-20220225-0008/",
                  },
                  {
                     name: "[debian-lts-announce] 20220701 [SECURITY] [DLA 3065-1] linux security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2022-24958",
      datePublished: "2022-02-11T04:21:36",
      dateReserved: "2022-02-11T00:00:00",
      dateUpdated: "2024-08-03T04:29:01.617Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2022-24959

Vulnerability from cvelistv5

Published

2022-02-11 04:21

Modified

2024-08-03 04:29

Severity ?

Summary

An issue was discovered in the Linux kernel before 5.16.5. There is a memory leak in yam_siocdevprivate in drivers/net/hamradio/yam.c.

References

▼	URL	Tags
	https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.5	x_refsource_MISC
	https://github.com/torvalds/linux/commit/29eb31542787e1019208a2e1047bb7c76c069536	x_refsource_MISC
	https://www.debian.org/security/2022/dsa-5092	vendor-advisory, x_refsource_DEBIAN
	https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html	mailing-list, x_refsource_MLIST
	https://www.debian.org/security/2022/dsa-5096	vendor-advisory, x_refsource_DEBIAN

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T04:29:01.558Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.5",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/torvalds/linux/commit/29eb31542787e1019208a2e1047bb7c76c069536",
               },
               {
                  name: "DSA-5092",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2022/dsa-5092",
               },
               {
                  name: "[debian-lts-announce] 20220309 [SECURITY] [DLA 2941-1] linux-4.19 security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html",
               },
               {
                  name: "DSA-5096",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2022/dsa-5096",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "An issue was discovered in the Linux kernel before 5.16.5. There is a memory leak in yam_siocdevprivate in drivers/net/hamradio/yam.c.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-03-10T02:07:01",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.5",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/torvalds/linux/commit/29eb31542787e1019208a2e1047bb7c76c069536",
            },
            {
               name: "DSA-5092",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2022/dsa-5092",
            },
            {
               name: "[debian-lts-announce] 20220309 [SECURITY] [DLA 2941-1] linux-4.19 security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html",
            },
            {
               name: "DSA-5096",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2022/dsa-5096",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2022-24959",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "An issue was discovered in the Linux kernel before 5.16.5. There is a memory leak in yam_siocdevprivate in drivers/net/hamradio/yam.c.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.5",
                     refsource: "MISC",
                     url: "https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.5",
                  },
                  {
                     name: "https://github.com/torvalds/linux/commit/29eb31542787e1019208a2e1047bb7c76c069536",
                     refsource: "MISC",
                     url: "https://github.com/torvalds/linux/commit/29eb31542787e1019208a2e1047bb7c76c069536",
                  },
                  {
                     name: "DSA-5092",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2022/dsa-5092",
                  },
                  {
                     name: "[debian-lts-announce] 20220309 [SECURITY] [DLA 2941-1] linux-4.19 security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html",
                  },
                  {
                     name: "DSA-5096",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2022/dsa-5096",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2022-24959",
      datePublished: "2022-02-11T04:21:16",
      dateReserved: "2022-02-11T00:00:00",
      dateUpdated: "2024-08-03T04:29:01.558Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2022-0644

Vulnerability from cvelistv5

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none

Show details on NVD website

JSON

To clipboard

{
   containers: {
      cna: {
         providerMetadata: {
            dateUpdated: "2022-08-29T14:03:06",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         rejectedReasons: [
            {
               lang: "en",
               value: "DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2022-0644",
      datePublished: "2022-08-29T14:03:06",
      dateRejected: "2022-08-29T14:03:06",
      dateReserved: "2022-02-16T00:00:00",
      dateUpdated: "2022-08-29T14:03:06",
      state: "REJECTED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.0",
}

cve-2022-28748

Vulnerability from cvelistv5

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-2964. Reason: This candidate is a reservation duplicate of CVE-2022-2964. Notes: All CVE users should reference CVE-2022-2964 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

Show details on NVD website

JSON

To clipboard

{
   containers: {
      cna: {
         providerMetadata: {
            dateUpdated: "2022-11-10T00:00:00",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         rejectedReasons: [
            {
               lang: "en",
               value: "DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-2964. Reason: This candidate is a reservation duplicate of CVE-2022-2964. Notes: All CVE users should reference CVE-2022-2964 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2022-28748",
      dateRejected: "2022-11-10T00:00:00",
      dateReserved: "2022-04-06T00:00:00",
      dateUpdated: "2022-11-10T00:00:00",
      state: "REJECTED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.0",
}

cve-2022-28388

Vulnerability from cvelistv5

Published

2022-04-03 20:07

Modified

2024-08-03 05:56

Severity ?

Summary

usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c in the Linux kernel through 5.17.1 has a double free.

References

▼	URL	Tags
	https://github.com/torvalds/linux/commit/3d3925ff6433f98992685a9679613a2cc97f3ce2	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LAWC35TO642FOP3UCA3C6IF7NAUFOVZ6/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XFMPUI3WI4U2F7ONHRW36WDY4ZE7LGGT/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6IHHC455LMSJNG4CSZ5CEAHYWY2DE5YW/	vendor-advisory, x_refsource_FEDORA
	https://www.debian.org/security/2022/dsa-5127	vendor-advisory, x_refsource_DEBIAN
	https://security.netapp.com/advisory/ntap-20220513-0001/	x_refsource_CONFIRM
	https://www.debian.org/security/2022/dsa-5173	vendor-advisory, x_refsource_DEBIAN

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T05:56:14.998Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/torvalds/linux/commit/3d3925ff6433f98992685a9679613a2cc97f3ce2",
               },
               {
                  name: "FEDORA-2022-af492757d9",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LAWC35TO642FOP3UCA3C6IF7NAUFOVZ6/",
               },
               {
                  name: "FEDORA-2022-5cd9d787dc",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XFMPUI3WI4U2F7ONHRW36WDY4ZE7LGGT/",
               },
               {
                  name: "FEDORA-2022-91633399ff",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6IHHC455LMSJNG4CSZ5CEAHYWY2DE5YW/",
               },
               {
                  name: "DSA-5127",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2022/dsa-5127",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20220513-0001/",
               },
               {
                  name: "DSA-5173",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2022/dsa-5173",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c in the Linux kernel through 5.17.1 has a double free.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-07-04T10:10:18",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/torvalds/linux/commit/3d3925ff6433f98992685a9679613a2cc97f3ce2",
            },
            {
               name: "FEDORA-2022-af492757d9",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LAWC35TO642FOP3UCA3C6IF7NAUFOVZ6/",
            },
            {
               name: "FEDORA-2022-5cd9d787dc",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XFMPUI3WI4U2F7ONHRW36WDY4ZE7LGGT/",
            },
            {
               name: "FEDORA-2022-91633399ff",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6IHHC455LMSJNG4CSZ5CEAHYWY2DE5YW/",
            },
            {
               name: "DSA-5127",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2022/dsa-5127",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://security.netapp.com/advisory/ntap-20220513-0001/",
            },
            {
               name: "DSA-5173",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2022/dsa-5173",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2022-28388",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c in the Linux kernel through 5.17.1 has a double free.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://github.com/torvalds/linux/commit/3d3925ff6433f98992685a9679613a2cc97f3ce2",
                     refsource: "MISC",
                     url: "https://github.com/torvalds/linux/commit/3d3925ff6433f98992685a9679613a2cc97f3ce2",
                  },
                  {
                     name: "FEDORA-2022-af492757d9",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAWC35TO642FOP3UCA3C6IF7NAUFOVZ6/",
                  },
                  {
                     name: "FEDORA-2022-5cd9d787dc",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFMPUI3WI4U2F7ONHRW36WDY4ZE7LGGT/",
                  },
                  {
                     name: "FEDORA-2022-91633399ff",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6IHHC455LMSJNG4CSZ5CEAHYWY2DE5YW/",
                  },
                  {
                     name: "DSA-5127",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2022/dsa-5127",
                  },
                  {
                     name: "https://security.netapp.com/advisory/ntap-20220513-0001/",
                     refsource: "CONFIRM",
                     url: "https://security.netapp.com/advisory/ntap-20220513-0001/",
                  },
                  {
                     name: "DSA-5173",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2022/dsa-5173",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2022-28388",
      datePublished: "2022-04-03T20:07:39",
      dateReserved: "2022-04-03T00:00:00",
      dateUpdated: "2024-08-03T05:56:14.998Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2022-0850

Vulnerability from cvelistv5

Published

2022-08-29 14:03

Modified

2024-08-02 23:40

Severity ?

Summary

A vulnerability was found in linux kernel, where an information leak occurs via ext4_extent_header to userspace.

References

▼	URL	Tags
	https://bugzilla.redhat.com/show_bug.cgi?id=2060606	x_refsource_MISC
	https://syzkaller.appspot.com/bug?id=78e9ad0e6952a3ca16e8234724b2fa92d041b9b8	x_refsource_MISC
	https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ce3aba43599f0b50adbebff133df8d08a3d5fffe	x_refsource_MISC
	https://access.redhat.com/security/cve/CVE-2022-0850	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	n/a	kernel	Version: Fixed in kernel v5.14 rc1

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T23:40:04.478Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=2060606",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://syzkaller.appspot.com/bug?id=78e9ad0e6952a3ca16e8234724b2fa92d041b9b8",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ce3aba43599f0b50adbebff133df8d08a3d5fffe",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/security/cve/CVE-2022-0850",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "kernel",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "Fixed in kernel v5.14 rc1",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A vulnerability was found in linux kernel, where an information leak occurs via ext4_extent_header to userspace.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-200",
                     description: "CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor.",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-08-29T14:03:05",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2060606",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://syzkaller.appspot.com/bug?id=78e9ad0e6952a3ca16e8234724b2fa92d041b9b8",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ce3aba43599f0b50adbebff133df8d08a3d5fffe",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://access.redhat.com/security/cve/CVE-2022-0850",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secalert@redhat.com",
               ID: "CVE-2022-0850",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "kernel",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "Fixed in kernel v5.14 rc1",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "A vulnerability was found in linux kernel, where an information leak occurs via ext4_extent_header to userspace.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor.",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://bugzilla.redhat.com/show_bug.cgi?id=2060606",
                     refsource: "MISC",
                     url: "https://bugzilla.redhat.com/show_bug.cgi?id=2060606",
                  },
                  {
                     name: "https://syzkaller.appspot.com/bug?id=78e9ad0e6952a3ca16e8234724b2fa92d041b9b8",
                     refsource: "MISC",
                     url: "https://syzkaller.appspot.com/bug?id=78e9ad0e6952a3ca16e8234724b2fa92d041b9b8",
                  },
                  {
                     name: "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ce3aba43599f0b50adbebff133df8d08a3d5fffe",
                     refsource: "MISC",
                     url: "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ce3aba43599f0b50adbebff133df8d08a3d5fffe",
                  },
                  {
                     name: "https://access.redhat.com/security/cve/CVE-2022-0850",
                     refsource: "MISC",
                     url: "https://access.redhat.com/security/cve/CVE-2022-0850",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2022-0850",
      datePublished: "2022-08-29T14:03:05",
      dateReserved: "2022-03-04T00:00:00",
      dateUpdated: "2024-08-02T23:40:04.478Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2022-0617

Vulnerability from cvelistv5

Published

2022-02-16 16:38

Modified

2024-08-02 23:32

Severity ?

Summary

A flaw null pointer dereference in the Linux kernel UDF file system functionality was found in the way user triggers udf_file_write_iter function for the malicious UDF image. A local user could use this flaw to crash the system. Actual from Linux kernel 4.2-rc1 till 5.17-rc2.

References

▼	URL	Tags
	https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7fc3b7c2981bbd1047916ade327beccb90994eee	x_refsource_MISC
	https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ea8569194b43f0f01f0a84c689388542c7254a1f	x_refsource_MISC
	https://lore.kernel.org/lkml/20220114172329.ygzry5rlz64ua2nr%40quack3.lan/T/	x_refsource_MISC
	https://lists.debian.org/debian-lts-announce/2022/03/msg00011.html	mailing-list, x_refsource_MLIST
	https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html	mailing-list, x_refsource_MLIST
	https://www.debian.org/security/2022/dsa-5095	vendor-advisory, x_refsource_DEBIAN
	https://www.debian.org/security/2022/dsa-5096	vendor-advisory, x_refsource_DEBIAN
	http://www.openwall.com/lists/oss-security/2022/04/13/2	mailing-list, x_refsource_MLIST

Impacted products

	Vendor	Product	Version
	n/a	Kernel	Version: Linux kernel 5.17-rc2

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T23:32:46.477Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7fc3b7c2981bbd1047916ade327beccb90994eee",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ea8569194b43f0f01f0a84c689388542c7254a1f",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://lore.kernel.org/lkml/20220114172329.ygzry5rlz64ua2nr%40quack3.lan/T/",
               },
               {
                  name: "[debian-lts-announce] 20220309 [SECURITY] [DLA 2940-1] linux security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2022/03/msg00011.html",
               },
               {
                  name: "[debian-lts-announce] 20220309 [SECURITY] [DLA 2941-1] linux-4.19 security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html",
               },
               {
                  name: "DSA-5095",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2022/dsa-5095",
               },
               {
                  name: "DSA-5096",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2022/dsa-5096",
               },
               {
                  name: "[oss-security] 20220413 CVE-2022-0617: udf:A null-ptr-deref bug be triggered when write to an ICB inode",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2022/04/13/2",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "Kernel",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "Linux kernel 5.17-rc2",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A flaw null pointer dereference in the Linux kernel UDF file system functionality was found in the way user triggers udf_file_write_iter function for the malicious UDF image. A local user could use this flaw to crash the system. Actual from Linux kernel 4.2-rc1 till 5.17-rc2.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-476",
                     description: "CWE-476",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-04-13T17:06:43",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7fc3b7c2981bbd1047916ade327beccb90994eee",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ea8569194b43f0f01f0a84c689388542c7254a1f",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://lore.kernel.org/lkml/20220114172329.ygzry5rlz64ua2nr%40quack3.lan/T/",
            },
            {
               name: "[debian-lts-announce] 20220309 [SECURITY] [DLA 2940-1] linux security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2022/03/msg00011.html",
            },
            {
               name: "[debian-lts-announce] 20220309 [SECURITY] [DLA 2941-1] linux-4.19 security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html",
            },
            {
               name: "DSA-5095",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2022/dsa-5095",
            },
            {
               name: "DSA-5096",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2022/dsa-5096",
            },
            {
               name: "[oss-security] 20220413 CVE-2022-0617: udf:A null-ptr-deref bug be triggered when write to an ICB inode",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2022/04/13/2",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secalert@redhat.com",
               ID: "CVE-2022-0617",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "Kernel",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "Linux kernel 5.17-rc2",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "A flaw null pointer dereference in the Linux kernel UDF file system functionality was found in the way user triggers udf_file_write_iter function for the malicious UDF image. A local user could use this flaw to crash the system. Actual from Linux kernel 4.2-rc1 till 5.17-rc2.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-476",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7fc3b7c2981bbd1047916ade327beccb90994eee",
                     refsource: "MISC",
                     url: "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7fc3b7c2981bbd1047916ade327beccb90994eee",
                  },
                  {
                     name: "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ea8569194b43f0f01f0a84c689388542c7254a1f",
                     refsource: "MISC",
                     url: "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ea8569194b43f0f01f0a84c689388542c7254a1f",
                  },
                  {
                     name: "https://lore.kernel.org/lkml/20220114172329.ygzry5rlz64ua2nr@quack3.lan/T/",
                     refsource: "MISC",
                     url: "https://lore.kernel.org/lkml/20220114172329.ygzry5rlz64ua2nr@quack3.lan/T/",
                  },
                  {
                     name: "[debian-lts-announce] 20220309 [SECURITY] [DLA 2940-1] linux security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2022/03/msg00011.html",
                  },
                  {
                     name: "[debian-lts-announce] 20220309 [SECURITY] [DLA 2941-1] linux-4.19 security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html",
                  },
                  {
                     name: "DSA-5095",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2022/dsa-5095",
                  },
                  {
                     name: "DSA-5096",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2022/dsa-5096",
                  },
                  {
                     name: "[oss-security] 20220413 CVE-2022-0617: udf:A null-ptr-deref bug be triggered when write to an ICB inode",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2022/04/13/2",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2022-0617",
      datePublished: "2022-02-16T16:38:03",
      dateReserved: "2022-02-15T00:00:00",
      dateUpdated: "2024-08-02T23:32:46.477Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-39698

Vulnerability from cvelistv5

Published

2022-03-16 14:04

Modified

2024-08-04 02:13

Severity ?

Summary

In aio_poll_complete_work of aio.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-185125206References: Upstream kernel

References

▼	URL	Tags
	https://source.android.com/security/bulletin/2022-03-01	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	n/a	Android	Version: Android kernel

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T02:13:37.664Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://source.android.com/security/bulletin/2022-03-01",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "Android",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "Android kernel",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "In aio_poll_complete_work of aio.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-185125206References: Upstream kernel",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "Elevation of privilege",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-03-16T14:04:14",
            orgId: "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
            shortName: "google_android",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://source.android.com/security/bulletin/2022-03-01",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security@android.com",
               ID: "CVE-2021-39698",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "Android",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "Android kernel",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "In aio_poll_complete_work of aio.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-185125206References: Upstream kernel",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "Elevation of privilege",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://source.android.com/security/bulletin/2022-03-01",
                     refsource: "MISC",
                     url: "https://source.android.com/security/bulletin/2022-03-01",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
      assignerShortName: "google_android",
      cveId: "CVE-2021-39698",
      datePublished: "2022-03-16T14:04:14",
      dateReserved: "2021-08-23T00:00:00",
      dateUpdated: "2024-08-04T02:13:37.664Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2022-23036

Vulnerability from cvelistv5

Published

2022-03-10 19:20

Modified

2024-08-03 03:28

Severity ?

Summary

References

▼	URL	Tags
	https://xenbits.xenproject.org/xsa/advisory-396.txt	x_refsource_MISC
	https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html	mailing-list, x_refsource_MLIST

Impacted products

	Vendor	Product	Version
	unspecified	unspecified

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T03:28:42.946Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://xenbits.xenproject.org/xsa/advisory-396.txt",
               },
               {
                  name: "[debian-lts-announce] 20220701 [SECURITY] [DLA 3065-1] linux security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "unspecified",
               vendor: "unspecified",
               versions: [
                  {
                     status: "unknown",
                     version: "consult Xen advisory XSA-396",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "{'credit_data': {'description': {'description_data': [{'lang': 'eng', 'value': 'This issue was discovered by Demi Marie Obenour and Simon Gaiser of\\nInvisible Things Lab.'}]}}}",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malicious backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they assume that a following removal of the granted access will always succeed, which is not true in case the backend has mapped the granted page between those two operations. As a result the backend can keep access to the memory page of the guest no matter how the page will be used after the frontend I/O has finished. The xenbus driver has a similar problem, as it doesn't check the success of removing the granted access of a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038 gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus, 9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no longer in use, but the freeing of the related data page is not synchronized with dropping the granted access. As a result the backend can keep access to the memory page even after it has been freed and then re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which can be triggered by the backend. CVE-2022-23042",
            },
         ],
         metrics: [
            {
               other: {
                  content: {
                     description: {
                        description_data: [
                           {
                              lang: "eng",
                              value: "Due to race conditions and missing tests of return codes in the Linux\nPV device frontend drivers a malicious backend could gain access (read\nand write) to memory pages it shouldn't have, or it could directly\ntrigger Denial of Service (DoS) in the guest.",
                           },
                        ],
                     },
                  },
                  type: "unknown",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "unknown",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-07-01T13:06:57",
            orgId: "23aa2041-22e1-471f-9209-9b7396fa234f",
            shortName: "XEN",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://xenbits.xenproject.org/xsa/advisory-396.txt",
            },
            {
               name: "[debian-lts-announce] 20220701 [SECURITY] [DLA 3065-1] linux security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security@xen.org",
               ID: "CVE-2022-23036",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: "?",
                                          version_value: "consult Xen advisory XSA-396",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "",
                     },
                  ],
               },
            },
            configuration: {
               configuration_data: {
                  description: {
                     description_data: [
                        {
                           lang: "eng",
                           value: "All Linux guests using PV devices are vulnerable in case potentially\nmalicious PV device backends are being used.",
                        },
                     ],
                  },
               },
            },
            credit: {
               credit_data: {
                  description: {
                     description_data: [
                        {
                           lang: "eng",
                           value: "This issue was discovered by Demi Marie Obenour and Simon Gaiser of\nInvisible Things Lab.",
                        },
                     ],
                  },
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malicious backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they assume that a following removal of the granted access will always succeed, which is not true in case the backend has mapped the granted page between those two operations. As a result the backend can keep access to the memory page of the guest no matter how the page will be used after the frontend I/O has finished. The xenbus driver has a similar problem, as it doesn't check the success of removing the granted access of a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038 gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus, 9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no longer in use, but the freeing of the related data page is not synchronized with dropping the granted access. As a result the backend can keep access to the memory page even after it has been freed and then re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which can be triggered by the backend. CVE-2022-23042",
                  },
               ],
            },
            impact: {
               impact_data: {
                  description: {
                     description_data: [
                        {
                           lang: "eng",
                           value: "Due to race conditions and missing tests of return codes in the Linux\nPV device frontend drivers a malicious backend could gain access (read\nand write) to memory pages it shouldn't have, or it could directly\ntrigger Denial of Service (DoS) in the guest.",
                        },
                     ],
                  },
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "unknown",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://xenbits.xenproject.org/xsa/advisory-396.txt",
                     refsource: "MISC",
                     url: "https://xenbits.xenproject.org/xsa/advisory-396.txt",
                  },
                  {
                     name: "[debian-lts-announce] 20220701 [SECURITY] [DLA 3065-1] linux security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html",
                  },
               ],
            },
            workaround: {
               workaround_data: {
                  description: {
                     description_data: [
                        {
                           lang: "eng",
                           value: "There is no mitigation available other than not using PV devices in case\na backend is suspected to be potentially malicious.",
                        },
                     ],
                  },
               },
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "23aa2041-22e1-471f-9209-9b7396fa234f",
      assignerShortName: "XEN",
      cveId: "CVE-2022-23036",
      datePublished: "2022-03-10T19:20:15",
      dateReserved: "2022-01-10T00:00:00",
      dateUpdated: "2024-08-03T03:28:42.946Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2022-23038

Vulnerability from cvelistv5

Published

2022-03-10 19:20

Modified

2024-08-03 03:28

Severity ?

Summary

References

▼	URL	Tags
	https://xenbits.xenproject.org/xsa/advisory-396.txt	x_refsource_MISC
	https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html	mailing-list, x_refsource_MLIST

Impacted products

	Vendor	Product	Version
	unspecified	unspecified

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T03:28:43.103Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://xenbits.xenproject.org/xsa/advisory-396.txt",
               },
               {
                  name: "[debian-lts-announce] 20220701 [SECURITY] [DLA 3065-1] linux security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "unspecified",
               vendor: "unspecified",
               versions: [
                  {
                     status: "unknown",
                     version: "consult Xen advisory XSA-396",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "{'credit_data': {'description': {'description_data': [{'lang': 'eng', 'value': 'This issue was discovered by Demi Marie Obenour and Simon Gaiser of\\nInvisible Things Lab.'}]}}}",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malicious backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they assume that a following removal of the granted access will always succeed, which is not true in case the backend has mapped the granted page between those two operations. As a result the backend can keep access to the memory page of the guest no matter how the page will be used after the frontend I/O has finished. The xenbus driver has a similar problem, as it doesn't check the success of removing the granted access of a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038 gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus, 9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no longer in use, but the freeing of the related data page is not synchronized with dropping the granted access. As a result the backend can keep access to the memory page even after it has been freed and then re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which can be triggered by the backend. CVE-2022-23042",
            },
         ],
         metrics: [
            {
               other: {
                  content: {
                     description: {
                        description_data: [
                           {
                              lang: "eng",
                              value: "Due to race conditions and missing tests of return codes in the Linux\nPV device frontend drivers a malicious backend could gain access (read\nand write) to memory pages it shouldn't have, or it could directly\ntrigger Denial of Service (DoS) in the guest.",
                           },
                        ],
                     },
                  },
                  type: "unknown",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "unknown",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-07-01T13:06:59",
            orgId: "23aa2041-22e1-471f-9209-9b7396fa234f",
            shortName: "XEN",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://xenbits.xenproject.org/xsa/advisory-396.txt",
            },
            {
               name: "[debian-lts-announce] 20220701 [SECURITY] [DLA 3065-1] linux security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security@xen.org",
               ID: "CVE-2022-23038",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: "?",
                                          version_value: "consult Xen advisory XSA-396",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "",
                     },
                  ],
               },
            },
            configuration: {
               configuration_data: {
                  description: {
                     description_data: [
                        {
                           lang: "eng",
                           value: "All Linux guests using PV devices are vulnerable in case potentially\nmalicious PV device backends are being used.",
                        },
                     ],
                  },
               },
            },
            credit: {
               credit_data: {
                  description: {
                     description_data: [
                        {
                           lang: "eng",
                           value: "This issue was discovered by Demi Marie Obenour and Simon Gaiser of\nInvisible Things Lab.",
                        },
                     ],
                  },
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malicious backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they assume that a following removal of the granted access will always succeed, which is not true in case the backend has mapped the granted page between those two operations. As a result the backend can keep access to the memory page of the guest no matter how the page will be used after the frontend I/O has finished. The xenbus driver has a similar problem, as it doesn't check the success of removing the granted access of a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038 gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus, 9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no longer in use, but the freeing of the related data page is not synchronized with dropping the granted access. As a result the backend can keep access to the memory page even after it has been freed and then re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which can be triggered by the backend. CVE-2022-23042",
                  },
               ],
            },
            impact: {
               impact_data: {
                  description: {
                     description_data: [
                        {
                           lang: "eng",
                           value: "Due to race conditions and missing tests of return codes in the Linux\nPV device frontend drivers a malicious backend could gain access (read\nand write) to memory pages it shouldn't have, or it could directly\ntrigger Denial of Service (DoS) in the guest.",
                        },
                     ],
                  },
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "unknown",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://xenbits.xenproject.org/xsa/advisory-396.txt",
                     refsource: "MISC",
                     url: "https://xenbits.xenproject.org/xsa/advisory-396.txt",
                  },
                  {
                     name: "[debian-lts-announce] 20220701 [SECURITY] [DLA 3065-1] linux security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html",
                  },
               ],
            },
            workaround: {
               workaround_data: {
                  description: {
                     description_data: [
                        {
                           lang: "eng",
                           value: "There is no mitigation available other than not using PV devices in case\na backend is suspected to be potentially malicious.",
                        },
                     ],
                  },
               },
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "23aa2041-22e1-471f-9209-9b7396fa234f",
      assignerShortName: "XEN",
      cveId: "CVE-2022-23038",
      datePublished: "2022-03-10T19:20:18",
      dateReserved: "2022-01-10T00:00:00",
      dateUpdated: "2024-08-03T03:28:43.103Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

Vulnerability from csaf_suse

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature