Risk | High |
Patch available | YES |
Number of vulnerabilities | 22 |
CVE-ID | CVE-2020-36557 CVE-2020-36558 CVE-2021-26341 CVE-2021-33655 CVE-2021-33656 CVE-2021-4157 CVE-2022-1116 CVE-2022-1462 CVE-2022-1679 CVE-2022-20132 CVE-2022-20141 CVE-2022-20154 CVE-2022-21505 CVE-2022-2318 CVE-2022-26365 CVE-2022-29900 CVE-2022-29901 CVE-2022-33740 CVE-2022-33741 CVE-2022-33742 CVE-2022-33981 CVE-2022-36946 |
CWE-ID | CWE-362 CWE-476 CWE-668 CWE-787 CWE-119 CWE-190 CWE-125 CWE-416 CWE-200 CWE-264 CWE-254 CWE-1037 CWE-20 |
Exploitation vector | Network |
Public exploit | Public exploit code for vulnerability #22 is available. |
Vulnerable software |
SUSE Enterprise Storage Operating systems & Components / Operating system SUSE Linux Enterprise Storage Operating systems & Components / Operating system SUSE Linux Enterprise High Availability Operating systems & Components / Operating system SUSE Linux Enterprise Server for SAP Applications Operating systems & Components / Operating system SUSE Linux Enterprise Server Operating systems & Components / Operating system SUSE Linux Enterprise Module for Live Patching Operating systems & Components / Operating system SUSE Linux Enterprise High Performance Computing Operating systems & Components / Operating system SUSE Manager Server Operating systems & Components / Operating system SUSE Manager Retail Branch Server Operating systems & Components / Operating system SUSE Manager Proxy Operating systems & Components / Operating system SUSE Linux Enterprise Server for SAP Operating systems & Components / Operating system ocfs2-kmp-default-debuginfo Operating systems & Components / Operating system package or component ocfs2-kmp-default Operating systems & Components / Operating system package or component gfs2-kmp-default-debuginfo Operating systems & Components / Operating system package or component gfs2-kmp-default Operating systems & Components / Operating system package or component dlm-kmp-default-debuginfo Operating systems & Components / Operating system package or component dlm-kmp-default Operating systems & Components / Operating system package or component cluster-md-kmp-default-debuginfo Operating systems & Components / Operating system package or component cluster-md-kmp-default Operating systems & Components / Operating system package or component kernel-livepatch-SLE15-SP2_Update_29-debugsource Operating systems & Components / Operating system package or component kernel-livepatch-5_3_18-150200_24_126-default-debuginfo Operating systems & Components / Operating system package or component kernel-livepatch-5_3_18-150200_24_126-default Operating systems & Components / Operating system package or component kernel-default-livepatch-devel Operating systems & Components / Operating system package or component kernel-default-livepatch Operating systems & Components / Operating system package or component kernel-preempt-devel-debuginfo Operating systems & Components / Operating system package or component kernel-preempt-devel Operating systems & Components / Operating system package or component kernel-preempt-debugsource Operating systems & Components / Operating system package or component kernel-preempt-debuginfo Operating systems & Components / Operating system package or component kernel-preempt Operating systems & Components / Operating system package or component kernel-source Operating systems & Components / Operating system package or component kernel-macros Operating systems & Components / Operating system package or component kernel-docs Operating systems & Components / Operating system package or component kernel-devel Operating systems & Components / Operating system package or component reiserfs-kmp-default-debuginfo Operating systems & Components / Operating system package or component reiserfs-kmp-default Operating systems & Components / Operating system package or component kernel-syms Operating systems & Components / Operating system package or component kernel-obs-build-debugsource Operating systems & Components / Operating system package or component kernel-obs-build Operating systems & Components / Operating system package or component kernel-default-devel-debuginfo Operating systems & Components / Operating system package or component kernel-default-devel Operating systems & Components / Operating system package or component kernel-default-debugsource Operating systems & Components / Operating system package or component kernel-default-debuginfo Operating systems & Components / Operating system package or component kernel-default-base Operating systems & Components / Operating system package or component kernel-default Operating systems & Components / Operating system package or component |
Vendor | SUSE |
Security Bulletin
This security bulletin contains information about 22 vulnerabilities.
EUVDB-ID: #VU66588
Risk: Low
CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2020-36557
Exploit availability: No
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a race condition between the VT_DISALLOCATE IOCTL and closing/opening of ttys. A local user can exploit the race and gain unauthorized access to sensitive information and escalate privileges on the system.
MitigationUpdate the affected package the Linux Kernel to the latest version.
Vulnerable software versionsSUSE Enterprise Storage: 7.1
SUSE Linux Enterprise Storage: 7.1
SUSE Linux Enterprise High Availability: 15-SP2
SUSE Linux Enterprise Server for SAP Applications: 15-SP2
SUSE Linux Enterprise Server: 15-SP2-BCL - 15-SP2
SUSE Linux Enterprise Module for Live Patching: 15-SP2
SUSE Linux Enterprise High Performance Computing: 15-SP2-ESPOS - 15-SP2
SUSE Manager Server: 4.1
SUSE Manager Retail Branch Server: 4.1
SUSE Manager Proxy: 4.1
SUSE Linux Enterprise Server for SAP: 15-SP2
ocfs2-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
ocfs2-kmp-default: before 5.3.18-150200.24.126.1
gfs2-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
gfs2-kmp-default: before 5.3.18-150200.24.126.1
dlm-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
dlm-kmp-default: before 5.3.18-150200.24.126.1
cluster-md-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
cluster-md-kmp-default: before 5.3.18-150200.24.126.1
kernel-livepatch-SLE15-SP2_Update_29-debugsource: before 1-150200.5.5.1
kernel-livepatch-5_3_18-150200_24_126-default-debuginfo: before 1-150200.5.5.1
kernel-livepatch-5_3_18-150200_24_126-default: before 1-150200.5.5.1
kernel-default-livepatch-devel: before 5.3.18-150200.24.126.1
kernel-default-livepatch: before 5.3.18-150200.24.126.1
kernel-preempt-devel-debuginfo: before 5.3.18-150200.24.126.1
kernel-preempt-devel: before 5.3.18-150200.24.126.1
kernel-preempt-debugsource: before 5.3.18-150200.24.126.1
kernel-preempt-debuginfo: before 5.3.18-150200.24.126.1
kernel-preempt: before 5.3.18-150200.24.126.1
kernel-source: before 5.3.18-150200.24.126.1
kernel-macros: before 5.3.18-150200.24.126.1
kernel-docs: before 5.3.18-150200.24.126.1
kernel-devel: before 5.3.18-150200.24.126.1
reiserfs-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
reiserfs-kmp-default: before 5.3.18-150200.24.126.1
kernel-syms: before 5.3.18-150200.24.126.1
kernel-obs-build-debugsource: before 5.3.18-150200.24.126.1
kernel-obs-build: before 5.3.18-150200.24.126.1
kernel-default-devel-debuginfo: before 5.3.18-150200.24.126.1
kernel-default-devel: before 5.3.18-150200.24.126.1
kernel-default-debugsource: before 5.3.18-150200.24.126.1
kernel-default-debuginfo: before 5.3.18-150200.24.126.1
kernel-default-base: before 5.3.18-150200.24.126.1.150200.9.59.2
kernel-default: before 5.3.18-150200.24.126.1
CPE2.3https://www.suse.com/support/update/announcement/2022/suse-su-20222809-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU66589
Risk: Low
CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2020-36558
CWE-ID:
CWE-476 - NULL Pointer Dereference
Exploit availability: No
DescriptionThe vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error in the Linux kernel before 5.5.7 involving a VT_RESIZEX. A local user can perform a denial of service (DoS) attack.
MitigationUpdate the affected package the Linux Kernel to the latest version.
Vulnerable software versionsSUSE Enterprise Storage: 7.1
SUSE Linux Enterprise Storage: 7.1
SUSE Linux Enterprise High Availability: 15-SP2
SUSE Linux Enterprise Server for SAP Applications: 15-SP2
SUSE Linux Enterprise Server: 15-SP2-BCL - 15-SP2
SUSE Linux Enterprise Module for Live Patching: 15-SP2
SUSE Linux Enterprise High Performance Computing: 15-SP2-ESPOS - 15-SP2
SUSE Manager Server: 4.1
SUSE Manager Retail Branch Server: 4.1
SUSE Manager Proxy: 4.1
SUSE Linux Enterprise Server for SAP: 15-SP2
ocfs2-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
ocfs2-kmp-default: before 5.3.18-150200.24.126.1
gfs2-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
gfs2-kmp-default: before 5.3.18-150200.24.126.1
dlm-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
dlm-kmp-default: before 5.3.18-150200.24.126.1
cluster-md-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
cluster-md-kmp-default: before 5.3.18-150200.24.126.1
kernel-livepatch-SLE15-SP2_Update_29-debugsource: before 1-150200.5.5.1
kernel-livepatch-5_3_18-150200_24_126-default-debuginfo: before 1-150200.5.5.1
kernel-livepatch-5_3_18-150200_24_126-default: before 1-150200.5.5.1
kernel-default-livepatch-devel: before 5.3.18-150200.24.126.1
kernel-default-livepatch: before 5.3.18-150200.24.126.1
kernel-preempt-devel-debuginfo: before 5.3.18-150200.24.126.1
kernel-preempt-devel: before 5.3.18-150200.24.126.1
kernel-preempt-debugsource: before 5.3.18-150200.24.126.1
kernel-preempt-debuginfo: before 5.3.18-150200.24.126.1
kernel-preempt: before 5.3.18-150200.24.126.1
kernel-source: before 5.3.18-150200.24.126.1
kernel-macros: before 5.3.18-150200.24.126.1
kernel-docs: before 5.3.18-150200.24.126.1
kernel-devel: before 5.3.18-150200.24.126.1
reiserfs-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
reiserfs-kmp-default: before 5.3.18-150200.24.126.1
kernel-syms: before 5.3.18-150200.24.126.1
kernel-obs-build-debugsource: before 5.3.18-150200.24.126.1
kernel-obs-build: before 5.3.18-150200.24.126.1
kernel-default-devel-debuginfo: before 5.3.18-150200.24.126.1
kernel-default-devel: before 5.3.18-150200.24.126.1
kernel-default-debugsource: before 5.3.18-150200.24.126.1
kernel-default-debuginfo: before 5.3.18-150200.24.126.1
kernel-default-base: before 5.3.18-150200.24.126.1.150200.9.59.2
kernel-default: before 5.3.18-150200.24.126.1
CPE2.3https://www.suse.com/support/update/announcement/2022/suse-su-20222809-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU61565
Risk: Low
CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2021-26341
CWE-ID:
CWE-668 - Exposure of resource to wrong sphere
Exploit availability: No
DescriptionThe vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to some AMD CPUs may transiently execute beyond unconditional direct branches. A local user can gain unauthorized access to sensitive information on the system.
MitigationUpdate the affected package the Linux Kernel to the latest version.
Vulnerable software versionsSUSE Enterprise Storage: 7.1
SUSE Linux Enterprise Storage: 7.1
SUSE Linux Enterprise High Availability: 15-SP2
SUSE Linux Enterprise Server for SAP Applications: 15-SP2
SUSE Linux Enterprise Server: 15-SP2-BCL - 15-SP2
SUSE Linux Enterprise Module for Live Patching: 15-SP2
SUSE Linux Enterprise High Performance Computing: 15-SP2-ESPOS - 15-SP2
SUSE Manager Server: 4.1
SUSE Manager Retail Branch Server: 4.1
SUSE Manager Proxy: 4.1
SUSE Linux Enterprise Server for SAP: 15-SP2
ocfs2-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
ocfs2-kmp-default: before 5.3.18-150200.24.126.1
gfs2-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
gfs2-kmp-default: before 5.3.18-150200.24.126.1
dlm-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
dlm-kmp-default: before 5.3.18-150200.24.126.1
cluster-md-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
cluster-md-kmp-default: before 5.3.18-150200.24.126.1
kernel-livepatch-SLE15-SP2_Update_29-debugsource: before 1-150200.5.5.1
kernel-livepatch-5_3_18-150200_24_126-default-debuginfo: before 1-150200.5.5.1
kernel-livepatch-5_3_18-150200_24_126-default: before 1-150200.5.5.1
kernel-default-livepatch-devel: before 5.3.18-150200.24.126.1
kernel-default-livepatch: before 5.3.18-150200.24.126.1
kernel-preempt-devel-debuginfo: before 5.3.18-150200.24.126.1
kernel-preempt-devel: before 5.3.18-150200.24.126.1
kernel-preempt-debugsource: before 5.3.18-150200.24.126.1
kernel-preempt-debuginfo: before 5.3.18-150200.24.126.1
kernel-preempt: before 5.3.18-150200.24.126.1
kernel-source: before 5.3.18-150200.24.126.1
kernel-macros: before 5.3.18-150200.24.126.1
kernel-docs: before 5.3.18-150200.24.126.1
kernel-devel: before 5.3.18-150200.24.126.1
reiserfs-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
reiserfs-kmp-default: before 5.3.18-150200.24.126.1
kernel-syms: before 5.3.18-150200.24.126.1
kernel-obs-build-debugsource: before 5.3.18-150200.24.126.1
kernel-obs-build: before 5.3.18-150200.24.126.1
kernel-default-devel-debuginfo: before 5.3.18-150200.24.126.1
kernel-default-devel: before 5.3.18-150200.24.126.1
kernel-default-debugsource: before 5.3.18-150200.24.126.1
kernel-default-debuginfo: before 5.3.18-150200.24.126.1
kernel-default-base: before 5.3.18-150200.24.126.1.150200.9.59.2
kernel-default: before 5.3.18-150200.24.126.1
CPE2.3https://www.suse.com/support/update/announcement/2022/suse-su-20222809-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU65833
Risk: Low
CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2021-33655
CWE-ID:
CWE-787 - Out-of-bounds write
Exploit availability: No
Description The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error in FBIOPUT_VSCREENINFO IOCTL. A local user can trigger an out-of-bounds write error and execute arbitrary code with elevated privileges.
MitigationUpdate the affected package the Linux Kernel to the latest version.
Vulnerable software versionsSUSE Enterprise Storage: 7.1
SUSE Linux Enterprise Storage: 7.1
SUSE Linux Enterprise High Availability: 15-SP2
SUSE Linux Enterprise Server for SAP Applications: 15-SP2
SUSE Linux Enterprise Server: 15-SP2-BCL - 15-SP2
SUSE Linux Enterprise Module for Live Patching: 15-SP2
SUSE Linux Enterprise High Performance Computing: 15-SP2-ESPOS - 15-SP2
SUSE Manager Server: 4.1
SUSE Manager Retail Branch Server: 4.1
SUSE Manager Proxy: 4.1
SUSE Linux Enterprise Server for SAP: 15-SP2
ocfs2-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
ocfs2-kmp-default: before 5.3.18-150200.24.126.1
gfs2-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
gfs2-kmp-default: before 5.3.18-150200.24.126.1
dlm-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
dlm-kmp-default: before 5.3.18-150200.24.126.1
cluster-md-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
cluster-md-kmp-default: before 5.3.18-150200.24.126.1
kernel-livepatch-SLE15-SP2_Update_29-debugsource: before 1-150200.5.5.1
kernel-livepatch-5_3_18-150200_24_126-default-debuginfo: before 1-150200.5.5.1
kernel-livepatch-5_3_18-150200_24_126-default: before 1-150200.5.5.1
kernel-default-livepatch-devel: before 5.3.18-150200.24.126.1
kernel-default-livepatch: before 5.3.18-150200.24.126.1
kernel-preempt-devel-debuginfo: before 5.3.18-150200.24.126.1
kernel-preempt-devel: before 5.3.18-150200.24.126.1
kernel-preempt-debugsource: before 5.3.18-150200.24.126.1
kernel-preempt-debuginfo: before 5.3.18-150200.24.126.1
kernel-preempt: before 5.3.18-150200.24.126.1
kernel-source: before 5.3.18-150200.24.126.1
kernel-macros: before 5.3.18-150200.24.126.1
kernel-docs: before 5.3.18-150200.24.126.1
kernel-devel: before 5.3.18-150200.24.126.1
reiserfs-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
reiserfs-kmp-default: before 5.3.18-150200.24.126.1
kernel-syms: before 5.3.18-150200.24.126.1
kernel-obs-build-debugsource: before 5.3.18-150200.24.126.1
kernel-obs-build: before 5.3.18-150200.24.126.1
kernel-default-devel-debuginfo: before 5.3.18-150200.24.126.1
kernel-default-devel: before 5.3.18-150200.24.126.1
kernel-default-debugsource: before 5.3.18-150200.24.126.1
kernel-default-debuginfo: before 5.3.18-150200.24.126.1
kernel-default-base: before 5.3.18-150200.24.126.1.150200.9.59.2
kernel-default: before 5.3.18-150200.24.126.1
CPE2.3https://www.suse.com/support/update/announcement/2022/suse-su-20222809-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU66590
Risk: Low
CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2021-33656
CWE-ID:
CWE-787 - Out-of-bounds write
Exploit availability: No
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error when setting font with malicous data by ioctl cmd PIO_FONT. A local user can trigger an out-of-bounds write and execute arbitrary code with elevated privileges.
Update the affected package the Linux Kernel to the latest version.
Vulnerable software versionsSUSE Enterprise Storage: 7.1
SUSE Linux Enterprise Storage: 7.1
SUSE Linux Enterprise High Availability: 15-SP2
SUSE Linux Enterprise Server for SAP Applications: 15-SP2
SUSE Linux Enterprise Server: 15-SP2-BCL - 15-SP2
SUSE Linux Enterprise Module for Live Patching: 15-SP2
SUSE Linux Enterprise High Performance Computing: 15-SP2-ESPOS - 15-SP2
SUSE Manager Server: 4.1
SUSE Manager Retail Branch Server: 4.1
SUSE Manager Proxy: 4.1
SUSE Linux Enterprise Server for SAP: 15-SP2
ocfs2-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
ocfs2-kmp-default: before 5.3.18-150200.24.126.1
gfs2-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
gfs2-kmp-default: before 5.3.18-150200.24.126.1
dlm-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
dlm-kmp-default: before 5.3.18-150200.24.126.1
cluster-md-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
cluster-md-kmp-default: before 5.3.18-150200.24.126.1
kernel-livepatch-SLE15-SP2_Update_29-debugsource: before 1-150200.5.5.1
kernel-livepatch-5_3_18-150200_24_126-default-debuginfo: before 1-150200.5.5.1
kernel-livepatch-5_3_18-150200_24_126-default: before 1-150200.5.5.1
kernel-default-livepatch-devel: before 5.3.18-150200.24.126.1
kernel-default-livepatch: before 5.3.18-150200.24.126.1
kernel-preempt-devel-debuginfo: before 5.3.18-150200.24.126.1
kernel-preempt-devel: before 5.3.18-150200.24.126.1
kernel-preempt-debugsource: before 5.3.18-150200.24.126.1
kernel-preempt-debuginfo: before 5.3.18-150200.24.126.1
kernel-preempt: before 5.3.18-150200.24.126.1
kernel-source: before 5.3.18-150200.24.126.1
kernel-macros: before 5.3.18-150200.24.126.1
kernel-docs: before 5.3.18-150200.24.126.1
kernel-devel: before 5.3.18-150200.24.126.1
reiserfs-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
reiserfs-kmp-default: before 5.3.18-150200.24.126.1
kernel-syms: before 5.3.18-150200.24.126.1
kernel-obs-build-debugsource: before 5.3.18-150200.24.126.1
kernel-obs-build: before 5.3.18-150200.24.126.1
kernel-default-devel-debuginfo: before 5.3.18-150200.24.126.1
kernel-default-devel: before 5.3.18-150200.24.126.1
kernel-default-debugsource: before 5.3.18-150200.24.126.1
kernel-default-debuginfo: before 5.3.18-150200.24.126.1
kernel-default-base: before 5.3.18-150200.24.126.1.150200.9.59.2
kernel-default: before 5.3.18-150200.24.126.1
CPE2.3https://www.suse.com/support/update/announcement/2022/suse-su-20222809-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU63323
Risk: High
CVSSv4.0: 6.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2021-4157
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in the Linux kernel NFS subsystem. A remote attacker can create a specially crafted data and crash the system or escalate privileges on the system
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationUpdate the affected package the Linux Kernel to the latest version.
Vulnerable software versionsSUSE Enterprise Storage: 7.1
SUSE Linux Enterprise Storage: 7.1
SUSE Linux Enterprise High Availability: 15-SP2
SUSE Linux Enterprise Server for SAP Applications: 15-SP2
SUSE Linux Enterprise Server: 15-SP2-BCL - 15-SP2
SUSE Linux Enterprise Module for Live Patching: 15-SP2
SUSE Linux Enterprise High Performance Computing: 15-SP2-ESPOS - 15-SP2
SUSE Manager Server: 4.1
SUSE Manager Retail Branch Server: 4.1
SUSE Manager Proxy: 4.1
SUSE Linux Enterprise Server for SAP: 15-SP2
ocfs2-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
ocfs2-kmp-default: before 5.3.18-150200.24.126.1
gfs2-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
gfs2-kmp-default: before 5.3.18-150200.24.126.1
dlm-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
dlm-kmp-default: before 5.3.18-150200.24.126.1
cluster-md-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
cluster-md-kmp-default: before 5.3.18-150200.24.126.1
kernel-livepatch-SLE15-SP2_Update_29-debugsource: before 1-150200.5.5.1
kernel-livepatch-5_3_18-150200_24_126-default-debuginfo: before 1-150200.5.5.1
kernel-livepatch-5_3_18-150200_24_126-default: before 1-150200.5.5.1
kernel-default-livepatch-devel: before 5.3.18-150200.24.126.1
kernel-default-livepatch: before 5.3.18-150200.24.126.1
kernel-preempt-devel-debuginfo: before 5.3.18-150200.24.126.1
kernel-preempt-devel: before 5.3.18-150200.24.126.1
kernel-preempt-debugsource: before 5.3.18-150200.24.126.1
kernel-preempt-debuginfo: before 5.3.18-150200.24.126.1
kernel-preempt: before 5.3.18-150200.24.126.1
kernel-source: before 5.3.18-150200.24.126.1
kernel-macros: before 5.3.18-150200.24.126.1
kernel-docs: before 5.3.18-150200.24.126.1
kernel-devel: before 5.3.18-150200.24.126.1
reiserfs-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
reiserfs-kmp-default: before 5.3.18-150200.24.126.1
kernel-syms: before 5.3.18-150200.24.126.1
kernel-obs-build-debugsource: before 5.3.18-150200.24.126.1
kernel-obs-build: before 5.3.18-150200.24.126.1
kernel-default-devel-debuginfo: before 5.3.18-150200.24.126.1
kernel-default-devel: before 5.3.18-150200.24.126.1
kernel-default-debugsource: before 5.3.18-150200.24.126.1
kernel-default-debuginfo: before 5.3.18-150200.24.126.1
kernel-default-base: before 5.3.18-150200.24.126.1.150200.9.59.2
kernel-default: before 5.3.18-150200.24.126.1
CPE2.3https://www.suse.com/support/update/announcement/2022/suse-su-20222809-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the local network (LAN).
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU63633
Risk: Low
CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2022-1116
CWE-ID:
CWE-190 - Integer overflow
Exploit availability: No
DescriptionThe vulnerability allows a local user to execute code with elevated privileges.
The vulnerability exists due to integer overflow in the io_uring subsystem in the Linux kernel. A local user can trigger integer overflow, cause a denial of service or execute arbitrary code with elevated privileges.
MitigationUpdate the affected package the Linux Kernel to the latest version.
Vulnerable software versionsSUSE Enterprise Storage: 7.1
SUSE Linux Enterprise Storage: 7.1
SUSE Linux Enterprise High Availability: 15-SP2
SUSE Linux Enterprise Server for SAP Applications: 15-SP2
SUSE Linux Enterprise Server: 15-SP2-BCL - 15-SP2
SUSE Linux Enterprise Module for Live Patching: 15-SP2
SUSE Linux Enterprise High Performance Computing: 15-SP2-ESPOS - 15-SP2
SUSE Manager Server: 4.1
SUSE Manager Retail Branch Server: 4.1
SUSE Manager Proxy: 4.1
SUSE Linux Enterprise Server for SAP: 15-SP2
ocfs2-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
ocfs2-kmp-default: before 5.3.18-150200.24.126.1
gfs2-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
gfs2-kmp-default: before 5.3.18-150200.24.126.1
dlm-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
dlm-kmp-default: before 5.3.18-150200.24.126.1
cluster-md-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
cluster-md-kmp-default: before 5.3.18-150200.24.126.1
kernel-livepatch-SLE15-SP2_Update_29-debugsource: before 1-150200.5.5.1
kernel-livepatch-5_3_18-150200_24_126-default-debuginfo: before 1-150200.5.5.1
kernel-livepatch-5_3_18-150200_24_126-default: before 1-150200.5.5.1
kernel-default-livepatch-devel: before 5.3.18-150200.24.126.1
kernel-default-livepatch: before 5.3.18-150200.24.126.1
kernel-preempt-devel-debuginfo: before 5.3.18-150200.24.126.1
kernel-preempt-devel: before 5.3.18-150200.24.126.1
kernel-preempt-debugsource: before 5.3.18-150200.24.126.1
kernel-preempt-debuginfo: before 5.3.18-150200.24.126.1
kernel-preempt: before 5.3.18-150200.24.126.1
kernel-source: before 5.3.18-150200.24.126.1
kernel-macros: before 5.3.18-150200.24.126.1
kernel-docs: before 5.3.18-150200.24.126.1
kernel-devel: before 5.3.18-150200.24.126.1
reiserfs-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
reiserfs-kmp-default: before 5.3.18-150200.24.126.1
kernel-syms: before 5.3.18-150200.24.126.1
kernel-obs-build-debugsource: before 5.3.18-150200.24.126.1
kernel-obs-build: before 5.3.18-150200.24.126.1
kernel-default-devel-debuginfo: before 5.3.18-150200.24.126.1
kernel-default-devel: before 5.3.18-150200.24.126.1
kernel-default-debugsource: before 5.3.18-150200.24.126.1
kernel-default-debuginfo: before 5.3.18-150200.24.126.1
kernel-default-base: before 5.3.18-150200.24.126.1.150200.9.59.2
kernel-default: before 5.3.18-150200.24.126.1
CPE2.3https://www.suse.com/support/update/announcement/2022/suse-su-20222809-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU66591
Risk: Low
CVSSv4.0: 4.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2022-1462
CWE-ID:
CWE-125 - Out-of-bounds read
Exploit availability: No
DescriptionThe vulnerability allows a local user to perform denial of service (DoS) attack.
The vulnerability exists due to a boundary condition within the the Linux kernel’s TeleTYpe subsystem caused by a race condition when using ioctls TIOCSPTLCK and TIOCGPTPEER and TIOCSTI and TCXONC with leakage of memory file. A local user can trigger an out-of-bounds read error and crash the system or read random kernel memory.
MitigationUpdate the affected package the Linux Kernel to the latest version.
Vulnerable software versionsSUSE Enterprise Storage: 7.1
SUSE Linux Enterprise Storage: 7.1
SUSE Linux Enterprise High Availability: 15-SP2
SUSE Linux Enterprise Server for SAP Applications: 15-SP2
SUSE Linux Enterprise Server: 15-SP2-BCL - 15-SP2
SUSE Linux Enterprise Module for Live Patching: 15-SP2
SUSE Linux Enterprise High Performance Computing: 15-SP2-ESPOS - 15-SP2
SUSE Manager Server: 4.1
SUSE Manager Retail Branch Server: 4.1
SUSE Manager Proxy: 4.1
SUSE Linux Enterprise Server for SAP: 15-SP2
ocfs2-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
ocfs2-kmp-default: before 5.3.18-150200.24.126.1
gfs2-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
gfs2-kmp-default: before 5.3.18-150200.24.126.1
dlm-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
dlm-kmp-default: before 5.3.18-150200.24.126.1
cluster-md-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
cluster-md-kmp-default: before 5.3.18-150200.24.126.1
kernel-livepatch-SLE15-SP2_Update_29-debugsource: before 1-150200.5.5.1
kernel-livepatch-5_3_18-150200_24_126-default-debuginfo: before 1-150200.5.5.1
kernel-livepatch-5_3_18-150200_24_126-default: before 1-150200.5.5.1
kernel-default-livepatch-devel: before 5.3.18-150200.24.126.1
kernel-default-livepatch: before 5.3.18-150200.24.126.1
kernel-preempt-devel-debuginfo: before 5.3.18-150200.24.126.1
kernel-preempt-devel: before 5.3.18-150200.24.126.1
kernel-preempt-debugsource: before 5.3.18-150200.24.126.1
kernel-preempt-debuginfo: before 5.3.18-150200.24.126.1
kernel-preempt: before 5.3.18-150200.24.126.1
kernel-source: before 5.3.18-150200.24.126.1
kernel-macros: before 5.3.18-150200.24.126.1
kernel-docs: before 5.3.18-150200.24.126.1
kernel-devel: before 5.3.18-150200.24.126.1
reiserfs-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
reiserfs-kmp-default: before 5.3.18-150200.24.126.1
kernel-syms: before 5.3.18-150200.24.126.1
kernel-obs-build-debugsource: before 5.3.18-150200.24.126.1
kernel-obs-build: before 5.3.18-150200.24.126.1
kernel-default-devel-debuginfo: before 5.3.18-150200.24.126.1
kernel-default-devel: before 5.3.18-150200.24.126.1
kernel-default-debugsource: before 5.3.18-150200.24.126.1
kernel-default-debuginfo: before 5.3.18-150200.24.126.1
kernel-default-base: before 5.3.18-150200.24.126.1.150200.9.59.2
kernel-default: before 5.3.18-150200.24.126.1
CPE2.3https://www.suse.com/support/update/announcement/2022/suse-su-20222809-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU64861
Risk: Low
CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2022-1679
CWE-ID:
CWE-416 - Use After Free
Exploit availability: No
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a use-after-free error within the ath9k_htc_wait_for_target() function in the Linux kernel’s Atheros wireless adapter driver. A local user can execute arbitrary code with elevated privileges.
Update the affected package the Linux Kernel to the latest version.
Vulnerable software versionsSUSE Enterprise Storage: 7.1
SUSE Linux Enterprise Storage: 7.1
SUSE Linux Enterprise High Availability: 15-SP2
SUSE Linux Enterprise Server for SAP Applications: 15-SP2
SUSE Linux Enterprise Server: 15-SP2-BCL - 15-SP2
SUSE Linux Enterprise Module for Live Patching: 15-SP2
SUSE Linux Enterprise High Performance Computing: 15-SP2-ESPOS - 15-SP2
SUSE Manager Server: 4.1
SUSE Manager Retail Branch Server: 4.1
SUSE Manager Proxy: 4.1
SUSE Linux Enterprise Server for SAP: 15-SP2
ocfs2-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
ocfs2-kmp-default: before 5.3.18-150200.24.126.1
gfs2-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
gfs2-kmp-default: before 5.3.18-150200.24.126.1
dlm-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
dlm-kmp-default: before 5.3.18-150200.24.126.1
cluster-md-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
cluster-md-kmp-default: before 5.3.18-150200.24.126.1
kernel-livepatch-SLE15-SP2_Update_29-debugsource: before 1-150200.5.5.1
kernel-livepatch-5_3_18-150200_24_126-default-debuginfo: before 1-150200.5.5.1
kernel-livepatch-5_3_18-150200_24_126-default: before 1-150200.5.5.1
kernel-default-livepatch-devel: before 5.3.18-150200.24.126.1
kernel-default-livepatch: before 5.3.18-150200.24.126.1
kernel-preempt-devel-debuginfo: before 5.3.18-150200.24.126.1
kernel-preempt-devel: before 5.3.18-150200.24.126.1
kernel-preempt-debugsource: before 5.3.18-150200.24.126.1
kernel-preempt-debuginfo: before 5.3.18-150200.24.126.1
kernel-preempt: before 5.3.18-150200.24.126.1
kernel-source: before 5.3.18-150200.24.126.1
kernel-macros: before 5.3.18-150200.24.126.1
kernel-docs: before 5.3.18-150200.24.126.1
kernel-devel: before 5.3.18-150200.24.126.1
reiserfs-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
reiserfs-kmp-default: before 5.3.18-150200.24.126.1
kernel-syms: before 5.3.18-150200.24.126.1
kernel-obs-build-debugsource: before 5.3.18-150200.24.126.1
kernel-obs-build: before 5.3.18-150200.24.126.1
kernel-default-devel-debuginfo: before 5.3.18-150200.24.126.1
kernel-default-devel: before 5.3.18-150200.24.126.1
kernel-default-debugsource: before 5.3.18-150200.24.126.1
kernel-default-debuginfo: before 5.3.18-150200.24.126.1
kernel-default-base: before 5.3.18-150200.24.126.1.150200.9.59.2
kernel-default: before 5.3.18-150200.24.126.1
CPE2.3https://www.suse.com/support/update/announcement/2022/suse-su-20222809-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU64136
Risk: Low
CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2022-20132
CWE-ID:
CWE-200 - Information exposure
Exploit availability: No
DescriptionThe vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output in the USB HID component in Linux Kernel. A local user can trigger the vulnerability to gain access to potentially sensitive information.
MitigationUpdate the affected package the Linux Kernel to the latest version.
Vulnerable software versionsSUSE Enterprise Storage: 7.1
SUSE Linux Enterprise Storage: 7.1
SUSE Linux Enterprise High Availability: 15-SP2
SUSE Linux Enterprise Server for SAP Applications: 15-SP2
SUSE Linux Enterprise Server: 15-SP2-BCL - 15-SP2
SUSE Linux Enterprise Module for Live Patching: 15-SP2
SUSE Linux Enterprise High Performance Computing: 15-SP2-ESPOS - 15-SP2
SUSE Manager Server: 4.1
SUSE Manager Retail Branch Server: 4.1
SUSE Manager Proxy: 4.1
SUSE Linux Enterprise Server for SAP: 15-SP2
ocfs2-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
ocfs2-kmp-default: before 5.3.18-150200.24.126.1
gfs2-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
gfs2-kmp-default: before 5.3.18-150200.24.126.1
dlm-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
dlm-kmp-default: before 5.3.18-150200.24.126.1
cluster-md-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
cluster-md-kmp-default: before 5.3.18-150200.24.126.1
kernel-livepatch-SLE15-SP2_Update_29-debugsource: before 1-150200.5.5.1
kernel-livepatch-5_3_18-150200_24_126-default-debuginfo: before 1-150200.5.5.1
kernel-livepatch-5_3_18-150200_24_126-default: before 1-150200.5.5.1
kernel-default-livepatch-devel: before 5.3.18-150200.24.126.1
kernel-default-livepatch: before 5.3.18-150200.24.126.1
kernel-preempt-devel-debuginfo: before 5.3.18-150200.24.126.1
kernel-preempt-devel: before 5.3.18-150200.24.126.1
kernel-preempt-debugsource: before 5.3.18-150200.24.126.1
kernel-preempt-debuginfo: before 5.3.18-150200.24.126.1
kernel-preempt: before 5.3.18-150200.24.126.1
kernel-source: before 5.3.18-150200.24.126.1
kernel-macros: before 5.3.18-150200.24.126.1
kernel-docs: before 5.3.18-150200.24.126.1
kernel-devel: before 5.3.18-150200.24.126.1
reiserfs-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
reiserfs-kmp-default: before 5.3.18-150200.24.126.1
kernel-syms: before 5.3.18-150200.24.126.1
kernel-obs-build-debugsource: before 5.3.18-150200.24.126.1
kernel-obs-build: before 5.3.18-150200.24.126.1
kernel-default-devel-debuginfo: before 5.3.18-150200.24.126.1
kernel-default-devel: before 5.3.18-150200.24.126.1
kernel-default-debugsource: before 5.3.18-150200.24.126.1
kernel-default-debuginfo: before 5.3.18-150200.24.126.1
kernel-default-base: before 5.3.18-150200.24.126.1.150200.9.59.2
kernel-default: before 5.3.18-150200.24.126.1
CPE2.3https://www.suse.com/support/update/announcement/2022/suse-su-20222809-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU64134
Risk: Low
CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2022-20141
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to improper imposition of security restrictions in the Linux kernel's components. A local user can trigger the vulnerability to bypass security restrictions bypass and escalate privileges on the system.
MitigationUpdate the affected package the Linux Kernel to the latest version.
Vulnerable software versionsSUSE Enterprise Storage: 7.1
SUSE Linux Enterprise Storage: 7.1
SUSE Linux Enterprise High Availability: 15-SP2
SUSE Linux Enterprise Server for SAP Applications: 15-SP2
SUSE Linux Enterprise Server: 15-SP2-BCL - 15-SP2
SUSE Linux Enterprise Module for Live Patching: 15-SP2
SUSE Linux Enterprise High Performance Computing: 15-SP2-ESPOS - 15-SP2
SUSE Manager Server: 4.1
SUSE Manager Retail Branch Server: 4.1
SUSE Manager Proxy: 4.1
SUSE Linux Enterprise Server for SAP: 15-SP2
ocfs2-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
ocfs2-kmp-default: before 5.3.18-150200.24.126.1
gfs2-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
gfs2-kmp-default: before 5.3.18-150200.24.126.1
dlm-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
dlm-kmp-default: before 5.3.18-150200.24.126.1
cluster-md-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
cluster-md-kmp-default: before 5.3.18-150200.24.126.1
kernel-livepatch-SLE15-SP2_Update_29-debugsource: before 1-150200.5.5.1
kernel-livepatch-5_3_18-150200_24_126-default-debuginfo: before 1-150200.5.5.1
kernel-livepatch-5_3_18-150200_24_126-default: before 1-150200.5.5.1
kernel-default-livepatch-devel: before 5.3.18-150200.24.126.1
kernel-default-livepatch: before 5.3.18-150200.24.126.1
kernel-preempt-devel-debuginfo: before 5.3.18-150200.24.126.1
kernel-preempt-devel: before 5.3.18-150200.24.126.1
kernel-preempt-debugsource: before 5.3.18-150200.24.126.1
kernel-preempt-debuginfo: before 5.3.18-150200.24.126.1
kernel-preempt: before 5.3.18-150200.24.126.1
kernel-source: before 5.3.18-150200.24.126.1
kernel-macros: before 5.3.18-150200.24.126.1
kernel-docs: before 5.3.18-150200.24.126.1
kernel-devel: before 5.3.18-150200.24.126.1
reiserfs-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
reiserfs-kmp-default: before 5.3.18-150200.24.126.1
kernel-syms: before 5.3.18-150200.24.126.1
kernel-obs-build-debugsource: before 5.3.18-150200.24.126.1
kernel-obs-build: before 5.3.18-150200.24.126.1
kernel-default-devel-debuginfo: before 5.3.18-150200.24.126.1
kernel-default-devel: before 5.3.18-150200.24.126.1
kernel-default-debugsource: before 5.3.18-150200.24.126.1
kernel-default-debuginfo: before 5.3.18-150200.24.126.1
kernel-default-base: before 5.3.18-150200.24.126.1.150200.9.59.2
kernel-default: before 5.3.18-150200.24.126.1
CPE2.3https://www.suse.com/support/update/announcement/2022/suse-su-20222809-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU64207
Risk: Low
CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2022-20154
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to unspecified error in the Linux Kernel. A local user can bypass security restrictions and escalate privileges on the system.
Update the affected package the Linux Kernel to the latest version.
Vulnerable software versionsSUSE Enterprise Storage: 7.1
SUSE Linux Enterprise Storage: 7.1
SUSE Linux Enterprise High Availability: 15-SP2
SUSE Linux Enterprise Server for SAP Applications: 15-SP2
SUSE Linux Enterprise Server: 15-SP2-BCL - 15-SP2
SUSE Linux Enterprise Module for Live Patching: 15-SP2
SUSE Linux Enterprise High Performance Computing: 15-SP2-ESPOS - 15-SP2
SUSE Manager Server: 4.1
SUSE Manager Retail Branch Server: 4.1
SUSE Manager Proxy: 4.1
SUSE Linux Enterprise Server for SAP: 15-SP2
ocfs2-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
ocfs2-kmp-default: before 5.3.18-150200.24.126.1
gfs2-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
gfs2-kmp-default: before 5.3.18-150200.24.126.1
dlm-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
dlm-kmp-default: before 5.3.18-150200.24.126.1
cluster-md-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
cluster-md-kmp-default: before 5.3.18-150200.24.126.1
kernel-livepatch-SLE15-SP2_Update_29-debugsource: before 1-150200.5.5.1
kernel-livepatch-5_3_18-150200_24_126-default-debuginfo: before 1-150200.5.5.1
kernel-livepatch-5_3_18-150200_24_126-default: before 1-150200.5.5.1
kernel-default-livepatch-devel: before 5.3.18-150200.24.126.1
kernel-default-livepatch: before 5.3.18-150200.24.126.1
kernel-preempt-devel-debuginfo: before 5.3.18-150200.24.126.1
kernel-preempt-devel: before 5.3.18-150200.24.126.1
kernel-preempt-debugsource: before 5.3.18-150200.24.126.1
kernel-preempt-debuginfo: before 5.3.18-150200.24.126.1
kernel-preempt: before 5.3.18-150200.24.126.1
kernel-source: before 5.3.18-150200.24.126.1
kernel-macros: before 5.3.18-150200.24.126.1
kernel-docs: before 5.3.18-150200.24.126.1
kernel-devel: before 5.3.18-150200.24.126.1
reiserfs-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
reiserfs-kmp-default: before 5.3.18-150200.24.126.1
kernel-syms: before 5.3.18-150200.24.126.1
kernel-obs-build-debugsource: before 5.3.18-150200.24.126.1
kernel-obs-build: before 5.3.18-150200.24.126.1
kernel-default-devel-debuginfo: before 5.3.18-150200.24.126.1
kernel-default-devel: before 5.3.18-150200.24.126.1
kernel-default-debugsource: before 5.3.18-150200.24.126.1
kernel-default-debuginfo: before 5.3.18-150200.24.126.1
kernel-default-base: before 5.3.18-150200.24.126.1.150200.9.59.2
kernel-default: before 5.3.18-150200.24.126.1
CPE2.3https://www.suse.com/support/update/announcement/2022/suse-su-20222809-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU66592
Risk: Low
CVSSv4.0: 4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2022-21505
CWE-ID:
CWE-254 - Security Features
Exploit availability: No
DescriptionThe vulnerability allows an attacker to bypass implemented security restrictions.
The vulnerability exists due to incorrect implementation of the IMA lockdown feature. If IMA appraisal is used with the "ima_appraise=log" boot param, lockdown can be defeated with kexec on any machine with Secure Boot. An attacker with physical access to device can bypass Secure Boot mechanism.
Update the affected package the Linux Kernel to the latest version.
Vulnerable software versionsSUSE Enterprise Storage: 7.1
SUSE Linux Enterprise Storage: 7.1
SUSE Linux Enterprise High Availability: 15-SP2
SUSE Linux Enterprise Server for SAP Applications: 15-SP2
SUSE Linux Enterprise Server: 15-SP2-BCL - 15-SP2
SUSE Linux Enterprise Module for Live Patching: 15-SP2
SUSE Linux Enterprise High Performance Computing: 15-SP2-ESPOS - 15-SP2
SUSE Manager Server: 4.1
SUSE Manager Retail Branch Server: 4.1
SUSE Manager Proxy: 4.1
SUSE Linux Enterprise Server for SAP: 15-SP2
ocfs2-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
ocfs2-kmp-default: before 5.3.18-150200.24.126.1
gfs2-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
gfs2-kmp-default: before 5.3.18-150200.24.126.1
dlm-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
dlm-kmp-default: before 5.3.18-150200.24.126.1
cluster-md-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
cluster-md-kmp-default: before 5.3.18-150200.24.126.1
kernel-livepatch-SLE15-SP2_Update_29-debugsource: before 1-150200.5.5.1
kernel-livepatch-5_3_18-150200_24_126-default-debuginfo: before 1-150200.5.5.1
kernel-livepatch-5_3_18-150200_24_126-default: before 1-150200.5.5.1
kernel-default-livepatch-devel: before 5.3.18-150200.24.126.1
kernel-default-livepatch: before 5.3.18-150200.24.126.1
kernel-preempt-devel-debuginfo: before 5.3.18-150200.24.126.1
kernel-preempt-devel: before 5.3.18-150200.24.126.1
kernel-preempt-debugsource: before 5.3.18-150200.24.126.1
kernel-preempt-debuginfo: before 5.3.18-150200.24.126.1
kernel-preempt: before 5.3.18-150200.24.126.1
kernel-source: before 5.3.18-150200.24.126.1
kernel-macros: before 5.3.18-150200.24.126.1
kernel-docs: before 5.3.18-150200.24.126.1
kernel-devel: before 5.3.18-150200.24.126.1
reiserfs-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
reiserfs-kmp-default: before 5.3.18-150200.24.126.1
kernel-syms: before 5.3.18-150200.24.126.1
kernel-obs-build-debugsource: before 5.3.18-150200.24.126.1
kernel-obs-build: before 5.3.18-150200.24.126.1
kernel-default-devel-debuginfo: before 5.3.18-150200.24.126.1
kernel-default-devel: before 5.3.18-150200.24.126.1
kernel-default-debugsource: before 5.3.18-150200.24.126.1
kernel-default-debuginfo: before 5.3.18-150200.24.126.1
kernel-default-base: before 5.3.18-150200.24.126.1.150200.9.59.2
kernel-default: before 5.3.18-150200.24.126.1
CPE2.3https://www.suse.com/support/update/announcement/2022/suse-su-20222809-1/
Q & A
Can this vulnerability be exploited remotely?
No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU65318
Risk: Low
CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2022-2318
CWE-ID:
CWE-416 - Use After Free
Exploit availability: No
DescriptionThe vulnerability allows a local user to perform a denial of service attack.
The vulnerability exists due to a use-after-free error caused by timer handler in net/rose/rose_timer.c of linux. A local user can exploit the vulnerability to perform a denial of service attack.
MitigationUpdate the affected package the Linux Kernel to the latest version.
Vulnerable software versionsSUSE Enterprise Storage: 7.1
SUSE Linux Enterprise Storage: 7.1
SUSE Linux Enterprise High Availability: 15-SP2
SUSE Linux Enterprise Server for SAP Applications: 15-SP2
SUSE Linux Enterprise Server: 15-SP2-BCL - 15-SP2
SUSE Linux Enterprise Module for Live Patching: 15-SP2
SUSE Linux Enterprise High Performance Computing: 15-SP2-ESPOS - 15-SP2
SUSE Manager Server: 4.1
SUSE Manager Retail Branch Server: 4.1
SUSE Manager Proxy: 4.1
SUSE Linux Enterprise Server for SAP: 15-SP2
ocfs2-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
ocfs2-kmp-default: before 5.3.18-150200.24.126.1
gfs2-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
gfs2-kmp-default: before 5.3.18-150200.24.126.1
dlm-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
dlm-kmp-default: before 5.3.18-150200.24.126.1
cluster-md-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
cluster-md-kmp-default: before 5.3.18-150200.24.126.1
kernel-livepatch-SLE15-SP2_Update_29-debugsource: before 1-150200.5.5.1
kernel-livepatch-5_3_18-150200_24_126-default-debuginfo: before 1-150200.5.5.1
kernel-livepatch-5_3_18-150200_24_126-default: before 1-150200.5.5.1
kernel-default-livepatch-devel: before 5.3.18-150200.24.126.1
kernel-default-livepatch: before 5.3.18-150200.24.126.1
kernel-preempt-devel-debuginfo: before 5.3.18-150200.24.126.1
kernel-preempt-devel: before 5.3.18-150200.24.126.1
kernel-preempt-debugsource: before 5.3.18-150200.24.126.1
kernel-preempt-debuginfo: before 5.3.18-150200.24.126.1
kernel-preempt: before 5.3.18-150200.24.126.1
kernel-source: before 5.3.18-150200.24.126.1
kernel-macros: before 5.3.18-150200.24.126.1
kernel-docs: before 5.3.18-150200.24.126.1
kernel-devel: before 5.3.18-150200.24.126.1
reiserfs-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
reiserfs-kmp-default: before 5.3.18-150200.24.126.1
kernel-syms: before 5.3.18-150200.24.126.1
kernel-obs-build-debugsource: before 5.3.18-150200.24.126.1
kernel-obs-build: before 5.3.18-150200.24.126.1
kernel-default-devel-debuginfo: before 5.3.18-150200.24.126.1
kernel-default-devel: before 5.3.18-150200.24.126.1
kernel-default-debugsource: before 5.3.18-150200.24.126.1
kernel-default-debuginfo: before 5.3.18-150200.24.126.1
kernel-default-base: before 5.3.18-150200.24.126.1.150200.9.59.2
kernel-default: before 5.3.18-150200.24.126.1
CPE2.3https://www.suse.com/support/update/announcement/2022/suse-su-20222809-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU65345
Risk: Low
CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2022-26365
CWE-ID:
CWE-200 - Information exposure
Exploit availability: No
DescriptionThe vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to Linux Block and Network PV device frontends don't zero memory regions before sharing them with the backend. A local user can gain unauthorized access to sensitive information on the system.
MitigationUpdate the affected package the Linux Kernel to the latest version.
Vulnerable software versionsSUSE Enterprise Storage: 7.1
SUSE Linux Enterprise Storage: 7.1
SUSE Linux Enterprise High Availability: 15-SP2
SUSE Linux Enterprise Server for SAP Applications: 15-SP2
SUSE Linux Enterprise Server: 15-SP2-BCL - 15-SP2
SUSE Linux Enterprise Module for Live Patching: 15-SP2
SUSE Linux Enterprise High Performance Computing: 15-SP2-ESPOS - 15-SP2
SUSE Manager Server: 4.1
SUSE Manager Retail Branch Server: 4.1
SUSE Manager Proxy: 4.1
SUSE Linux Enterprise Server for SAP: 15-SP2
ocfs2-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
ocfs2-kmp-default: before 5.3.18-150200.24.126.1
gfs2-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
gfs2-kmp-default: before 5.3.18-150200.24.126.1
dlm-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
dlm-kmp-default: before 5.3.18-150200.24.126.1
cluster-md-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
cluster-md-kmp-default: before 5.3.18-150200.24.126.1
kernel-livepatch-SLE15-SP2_Update_29-debugsource: before 1-150200.5.5.1
kernel-livepatch-5_3_18-150200_24_126-default-debuginfo: before 1-150200.5.5.1
kernel-livepatch-5_3_18-150200_24_126-default: before 1-150200.5.5.1
kernel-default-livepatch-devel: before 5.3.18-150200.24.126.1
kernel-default-livepatch: before 5.3.18-150200.24.126.1
kernel-preempt-devel-debuginfo: before 5.3.18-150200.24.126.1
kernel-preempt-devel: before 5.3.18-150200.24.126.1
kernel-preempt-debugsource: before 5.3.18-150200.24.126.1
kernel-preempt-debuginfo: before 5.3.18-150200.24.126.1
kernel-preempt: before 5.3.18-150200.24.126.1
kernel-source: before 5.3.18-150200.24.126.1
kernel-macros: before 5.3.18-150200.24.126.1
kernel-docs: before 5.3.18-150200.24.126.1
kernel-devel: before 5.3.18-150200.24.126.1
reiserfs-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
reiserfs-kmp-default: before 5.3.18-150200.24.126.1
kernel-syms: before 5.3.18-150200.24.126.1
kernel-obs-build-debugsource: before 5.3.18-150200.24.126.1
kernel-obs-build: before 5.3.18-150200.24.126.1
kernel-default-devel-debuginfo: before 5.3.18-150200.24.126.1
kernel-default-devel: before 5.3.18-150200.24.126.1
kernel-default-debugsource: before 5.3.18-150200.24.126.1
kernel-default-debuginfo: before 5.3.18-150200.24.126.1
kernel-default-base: before 5.3.18-150200.24.126.1.150200.9.59.2
kernel-default: before 5.3.18-150200.24.126.1
CPE2.3https://www.suse.com/support/update/announcement/2022/suse-su-20222809-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU65205
Risk: Low
CVSSv4.0: 4.4 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2022-29900
CWE-ID:
CWE-1037 - Processor optimization removal or modification of security-critical code
Exploit availability: No
Description
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a mistrained branch predictions for return instructions. A local user can execute arbitrary speculative code under certain microarchitecture-dependent conditions. The vulnerability was dubbed RETbleed.
MitigationUpdate the affected package the Linux Kernel to the latest version.
Vulnerable software versionsSUSE Enterprise Storage: 7.1
SUSE Linux Enterprise Storage: 7.1
SUSE Linux Enterprise High Availability: 15-SP2
SUSE Linux Enterprise Server for SAP Applications: 15-SP2
SUSE Linux Enterprise Server: 15-SP2-BCL - 15-SP2
SUSE Linux Enterprise Module for Live Patching: 15-SP2
SUSE Linux Enterprise High Performance Computing: 15-SP2-ESPOS - 15-SP2
SUSE Manager Server: 4.1
SUSE Manager Retail Branch Server: 4.1
SUSE Manager Proxy: 4.1
SUSE Linux Enterprise Server for SAP: 15-SP2
ocfs2-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
ocfs2-kmp-default: before 5.3.18-150200.24.126.1
gfs2-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
gfs2-kmp-default: before 5.3.18-150200.24.126.1
dlm-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
dlm-kmp-default: before 5.3.18-150200.24.126.1
cluster-md-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
cluster-md-kmp-default: before 5.3.18-150200.24.126.1
kernel-livepatch-SLE15-SP2_Update_29-debugsource: before 1-150200.5.5.1
kernel-livepatch-5_3_18-150200_24_126-default-debuginfo: before 1-150200.5.5.1
kernel-livepatch-5_3_18-150200_24_126-default: before 1-150200.5.5.1
kernel-default-livepatch-devel: before 5.3.18-150200.24.126.1
kernel-default-livepatch: before 5.3.18-150200.24.126.1
kernel-preempt-devel-debuginfo: before 5.3.18-150200.24.126.1
kernel-preempt-devel: before 5.3.18-150200.24.126.1
kernel-preempt-debugsource: before 5.3.18-150200.24.126.1
kernel-preempt-debuginfo: before 5.3.18-150200.24.126.1
kernel-preempt: before 5.3.18-150200.24.126.1
kernel-source: before 5.3.18-150200.24.126.1
kernel-macros: before 5.3.18-150200.24.126.1
kernel-docs: before 5.3.18-150200.24.126.1
kernel-devel: before 5.3.18-150200.24.126.1
reiserfs-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
reiserfs-kmp-default: before 5.3.18-150200.24.126.1
kernel-syms: before 5.3.18-150200.24.126.1
kernel-obs-build-debugsource: before 5.3.18-150200.24.126.1
kernel-obs-build: before 5.3.18-150200.24.126.1
kernel-default-devel-debuginfo: before 5.3.18-150200.24.126.1
kernel-default-devel: before 5.3.18-150200.24.126.1
kernel-default-debugsource: before 5.3.18-150200.24.126.1
kernel-default-debuginfo: before 5.3.18-150200.24.126.1
kernel-default-base: before 5.3.18-150200.24.126.1.150200.9.59.2
kernel-default: before 5.3.18-150200.24.126.1
CPE2.3https://www.suse.com/support/update/announcement/2022/suse-su-20222809-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU65220
Risk: Low
CVSSv4.0: 1.9 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2022-29901
CWE-ID:
CWE-1037 - Processor optimization removal or modification of security-critical code
Exploit availability: No
DescriptionThe vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to the way non-transparent sharing of branch predictor targets between contexts. A local user can exploit the vulnerability to gain access to sensitive information.
Update the affected package the Linux Kernel to the latest version.
Vulnerable software versionsSUSE Enterprise Storage: 7.1
SUSE Linux Enterprise Storage: 7.1
SUSE Linux Enterprise High Availability: 15-SP2
SUSE Linux Enterprise Server for SAP Applications: 15-SP2
SUSE Linux Enterprise Server: 15-SP2-BCL - 15-SP2
SUSE Linux Enterprise Module for Live Patching: 15-SP2
SUSE Linux Enterprise High Performance Computing: 15-SP2-ESPOS - 15-SP2
SUSE Manager Server: 4.1
SUSE Manager Retail Branch Server: 4.1
SUSE Manager Proxy: 4.1
SUSE Linux Enterprise Server for SAP: 15-SP2
ocfs2-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
ocfs2-kmp-default: before 5.3.18-150200.24.126.1
gfs2-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
gfs2-kmp-default: before 5.3.18-150200.24.126.1
dlm-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
dlm-kmp-default: before 5.3.18-150200.24.126.1
cluster-md-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
cluster-md-kmp-default: before 5.3.18-150200.24.126.1
kernel-livepatch-SLE15-SP2_Update_29-debugsource: before 1-150200.5.5.1
kernel-livepatch-5_3_18-150200_24_126-default-debuginfo: before 1-150200.5.5.1
kernel-livepatch-5_3_18-150200_24_126-default: before 1-150200.5.5.1
kernel-default-livepatch-devel: before 5.3.18-150200.24.126.1
kernel-default-livepatch: before 5.3.18-150200.24.126.1
kernel-preempt-devel-debuginfo: before 5.3.18-150200.24.126.1
kernel-preempt-devel: before 5.3.18-150200.24.126.1
kernel-preempt-debugsource: before 5.3.18-150200.24.126.1
kernel-preempt-debuginfo: before 5.3.18-150200.24.126.1
kernel-preempt: before 5.3.18-150200.24.126.1
kernel-source: before 5.3.18-150200.24.126.1
kernel-macros: before 5.3.18-150200.24.126.1
kernel-docs: before 5.3.18-150200.24.126.1
kernel-devel: before 5.3.18-150200.24.126.1
reiserfs-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
reiserfs-kmp-default: before 5.3.18-150200.24.126.1
kernel-syms: before 5.3.18-150200.24.126.1
kernel-obs-build-debugsource: before 5.3.18-150200.24.126.1
kernel-obs-build: before 5.3.18-150200.24.126.1
kernel-default-devel-debuginfo: before 5.3.18-150200.24.126.1
kernel-default-devel: before 5.3.18-150200.24.126.1
kernel-default-debugsource: before 5.3.18-150200.24.126.1
kernel-default-debuginfo: before 5.3.18-150200.24.126.1
kernel-default-base: before 5.3.18-150200.24.126.1.150200.9.59.2
kernel-default: before 5.3.18-150200.24.126.1
CPE2.3https://www.suse.com/support/update/announcement/2022/suse-su-20222809-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU65346
Risk: Low
CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2022-33740
CWE-ID:
CWE-200 - Information exposure
Exploit availability: No
DescriptionThe vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to Linux Block and Network PV device frontends don't zero memory regions before sharing them with the backend. A local user can gain unauthorized access to sensitive information on the system.
Update the affected package the Linux Kernel to the latest version.
Vulnerable software versionsSUSE Enterprise Storage: 7.1
SUSE Linux Enterprise Storage: 7.1
SUSE Linux Enterprise High Availability: 15-SP2
SUSE Linux Enterprise Server for SAP Applications: 15-SP2
SUSE Linux Enterprise Server: 15-SP2-BCL - 15-SP2
SUSE Linux Enterprise Module for Live Patching: 15-SP2
SUSE Linux Enterprise High Performance Computing: 15-SP2-ESPOS - 15-SP2
SUSE Manager Server: 4.1
SUSE Manager Retail Branch Server: 4.1
SUSE Manager Proxy: 4.1
SUSE Linux Enterprise Server for SAP: 15-SP2
ocfs2-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
ocfs2-kmp-default: before 5.3.18-150200.24.126.1
gfs2-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
gfs2-kmp-default: before 5.3.18-150200.24.126.1
dlm-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
dlm-kmp-default: before 5.3.18-150200.24.126.1
cluster-md-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
cluster-md-kmp-default: before 5.3.18-150200.24.126.1
kernel-livepatch-SLE15-SP2_Update_29-debugsource: before 1-150200.5.5.1
kernel-livepatch-5_3_18-150200_24_126-default-debuginfo: before 1-150200.5.5.1
kernel-livepatch-5_3_18-150200_24_126-default: before 1-150200.5.5.1
kernel-default-livepatch-devel: before 5.3.18-150200.24.126.1
kernel-default-livepatch: before 5.3.18-150200.24.126.1
kernel-preempt-devel-debuginfo: before 5.3.18-150200.24.126.1
kernel-preempt-devel: before 5.3.18-150200.24.126.1
kernel-preempt-debugsource: before 5.3.18-150200.24.126.1
kernel-preempt-debuginfo: before 5.3.18-150200.24.126.1
kernel-preempt: before 5.3.18-150200.24.126.1
kernel-source: before 5.3.18-150200.24.126.1
kernel-macros: before 5.3.18-150200.24.126.1
kernel-docs: before 5.3.18-150200.24.126.1
kernel-devel: before 5.3.18-150200.24.126.1
reiserfs-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
reiserfs-kmp-default: before 5.3.18-150200.24.126.1
kernel-syms: before 5.3.18-150200.24.126.1
kernel-obs-build-debugsource: before 5.3.18-150200.24.126.1
kernel-obs-build: before 5.3.18-150200.24.126.1
kernel-default-devel-debuginfo: before 5.3.18-150200.24.126.1
kernel-default-devel: before 5.3.18-150200.24.126.1
kernel-default-debugsource: before 5.3.18-150200.24.126.1
kernel-default-debuginfo: before 5.3.18-150200.24.126.1
kernel-default-base: before 5.3.18-150200.24.126.1.150200.9.59.2
kernel-default: before 5.3.18-150200.24.126.1
CPE2.3https://www.suse.com/support/update/announcement/2022/suse-su-20222809-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU65351
Risk: Low
CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2022-33741
CWE-ID:
CWE-200 - Information exposure
Exploit availability: No
DescriptionThe vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to granularity of the grant table doesn't allow sharing less than a 4K page, leading to unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend. A local user can gain unauthorized access to sensitive information on the system.
Update the affected package the Linux Kernel to the latest version.
Vulnerable software versionsSUSE Enterprise Storage: 7.1
SUSE Linux Enterprise Storage: 7.1
SUSE Linux Enterprise High Availability: 15-SP2
SUSE Linux Enterprise Server for SAP Applications: 15-SP2
SUSE Linux Enterprise Server: 15-SP2-BCL - 15-SP2
SUSE Linux Enterprise Module for Live Patching: 15-SP2
SUSE Linux Enterprise High Performance Computing: 15-SP2-ESPOS - 15-SP2
SUSE Manager Server: 4.1
SUSE Manager Retail Branch Server: 4.1
SUSE Manager Proxy: 4.1
SUSE Linux Enterprise Server for SAP: 15-SP2
ocfs2-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
ocfs2-kmp-default: before 5.3.18-150200.24.126.1
gfs2-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
gfs2-kmp-default: before 5.3.18-150200.24.126.1
dlm-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
dlm-kmp-default: before 5.3.18-150200.24.126.1
cluster-md-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
cluster-md-kmp-default: before 5.3.18-150200.24.126.1
kernel-livepatch-SLE15-SP2_Update_29-debugsource: before 1-150200.5.5.1
kernel-livepatch-5_3_18-150200_24_126-default-debuginfo: before 1-150200.5.5.1
kernel-livepatch-5_3_18-150200_24_126-default: before 1-150200.5.5.1
kernel-default-livepatch-devel: before 5.3.18-150200.24.126.1
kernel-default-livepatch: before 5.3.18-150200.24.126.1
kernel-preempt-devel-debuginfo: before 5.3.18-150200.24.126.1
kernel-preempt-devel: before 5.3.18-150200.24.126.1
kernel-preempt-debugsource: before 5.3.18-150200.24.126.1
kernel-preempt-debuginfo: before 5.3.18-150200.24.126.1
kernel-preempt: before 5.3.18-150200.24.126.1
kernel-source: before 5.3.18-150200.24.126.1
kernel-macros: before 5.3.18-150200.24.126.1
kernel-docs: before 5.3.18-150200.24.126.1
kernel-devel: before 5.3.18-150200.24.126.1
reiserfs-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
reiserfs-kmp-default: before 5.3.18-150200.24.126.1
kernel-syms: before 5.3.18-150200.24.126.1
kernel-obs-build-debugsource: before 5.3.18-150200.24.126.1
kernel-obs-build: before 5.3.18-150200.24.126.1
kernel-default-devel-debuginfo: before 5.3.18-150200.24.126.1
kernel-default-devel: before 5.3.18-150200.24.126.1
kernel-default-debugsource: before 5.3.18-150200.24.126.1
kernel-default-debuginfo: before 5.3.18-150200.24.126.1
kernel-default-base: before 5.3.18-150200.24.126.1.150200.9.59.2
kernel-default: before 5.3.18-150200.24.126.1
CPE2.3https://www.suse.com/support/update/announcement/2022/suse-su-20222809-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU65348
Risk: Low
CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2022-33742
CWE-ID:
CWE-200 - Information exposure
Exploit availability: No
DescriptionThe vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to granularity of the grant table doesn't allow sharing less than a 4K page, leading to unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend. A local user can gain unauthorized access to sensitive information on the system.
Update the affected package the Linux Kernel to the latest version.
Vulnerable software versionsSUSE Enterprise Storage: 7.1
SUSE Linux Enterprise Storage: 7.1
SUSE Linux Enterprise High Availability: 15-SP2
SUSE Linux Enterprise Server for SAP Applications: 15-SP2
SUSE Linux Enterprise Server: 15-SP2-BCL - 15-SP2
SUSE Linux Enterprise Module for Live Patching: 15-SP2
SUSE Linux Enterprise High Performance Computing: 15-SP2-ESPOS - 15-SP2
SUSE Manager Server: 4.1
SUSE Manager Retail Branch Server: 4.1
SUSE Manager Proxy: 4.1
SUSE Linux Enterprise Server for SAP: 15-SP2
ocfs2-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
ocfs2-kmp-default: before 5.3.18-150200.24.126.1
gfs2-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
gfs2-kmp-default: before 5.3.18-150200.24.126.1
dlm-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
dlm-kmp-default: before 5.3.18-150200.24.126.1
cluster-md-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
cluster-md-kmp-default: before 5.3.18-150200.24.126.1
kernel-livepatch-SLE15-SP2_Update_29-debugsource: before 1-150200.5.5.1
kernel-livepatch-5_3_18-150200_24_126-default-debuginfo: before 1-150200.5.5.1
kernel-livepatch-5_3_18-150200_24_126-default: before 1-150200.5.5.1
kernel-default-livepatch-devel: before 5.3.18-150200.24.126.1
kernel-default-livepatch: before 5.3.18-150200.24.126.1
kernel-preempt-devel-debuginfo: before 5.3.18-150200.24.126.1
kernel-preempt-devel: before 5.3.18-150200.24.126.1
kernel-preempt-debugsource: before 5.3.18-150200.24.126.1
kernel-preempt-debuginfo: before 5.3.18-150200.24.126.1
kernel-preempt: before 5.3.18-150200.24.126.1
kernel-source: before 5.3.18-150200.24.126.1
kernel-macros: before 5.3.18-150200.24.126.1
kernel-docs: before 5.3.18-150200.24.126.1
kernel-devel: before 5.3.18-150200.24.126.1
reiserfs-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
reiserfs-kmp-default: before 5.3.18-150200.24.126.1
kernel-syms: before 5.3.18-150200.24.126.1
kernel-obs-build-debugsource: before 5.3.18-150200.24.126.1
kernel-obs-build: before 5.3.18-150200.24.126.1
kernel-default-devel-debuginfo: before 5.3.18-150200.24.126.1
kernel-default-devel: before 5.3.18-150200.24.126.1
kernel-default-debugsource: before 5.3.18-150200.24.126.1
kernel-default-debuginfo: before 5.3.18-150200.24.126.1
kernel-default-base: before 5.3.18-150200.24.126.1.150200.9.59.2
kernel-default: before 5.3.18-150200.24.126.1
CPE2.3https://www.suse.com/support/update/announcement/2022/suse-su-20222809-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU64944
Risk: Low
CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2022-33981
CWE-ID:
CWE-416 - Use After Free
Exploit availability: No
DescriptionThe vulnerability allows a local user to perform denial of service attack.
The vulnerability exists due to a use-after-free error in drivers/block/floppy.c in the Linux kernel when deallocating raw_cmd in the raw_cmd_ioctl function(). A local user can trigger use-after-free and perform denial of service attack.
MitigationUpdate the affected package the Linux Kernel to the latest version.
Vulnerable software versionsSUSE Enterprise Storage: 7.1
SUSE Linux Enterprise Storage: 7.1
SUSE Linux Enterprise High Availability: 15-SP2
SUSE Linux Enterprise Server for SAP Applications: 15-SP2
SUSE Linux Enterprise Server: 15-SP2-BCL - 15-SP2
SUSE Linux Enterprise Module for Live Patching: 15-SP2
SUSE Linux Enterprise High Performance Computing: 15-SP2-ESPOS - 15-SP2
SUSE Manager Server: 4.1
SUSE Manager Retail Branch Server: 4.1
SUSE Manager Proxy: 4.1
SUSE Linux Enterprise Server for SAP: 15-SP2
ocfs2-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
ocfs2-kmp-default: before 5.3.18-150200.24.126.1
gfs2-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
gfs2-kmp-default: before 5.3.18-150200.24.126.1
dlm-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
dlm-kmp-default: before 5.3.18-150200.24.126.1
cluster-md-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
cluster-md-kmp-default: before 5.3.18-150200.24.126.1
kernel-livepatch-SLE15-SP2_Update_29-debugsource: before 1-150200.5.5.1
kernel-livepatch-5_3_18-150200_24_126-default-debuginfo: before 1-150200.5.5.1
kernel-livepatch-5_3_18-150200_24_126-default: before 1-150200.5.5.1
kernel-default-livepatch-devel: before 5.3.18-150200.24.126.1
kernel-default-livepatch: before 5.3.18-150200.24.126.1
kernel-preempt-devel-debuginfo: before 5.3.18-150200.24.126.1
kernel-preempt-devel: before 5.3.18-150200.24.126.1
kernel-preempt-debugsource: before 5.3.18-150200.24.126.1
kernel-preempt-debuginfo: before 5.3.18-150200.24.126.1
kernel-preempt: before 5.3.18-150200.24.126.1
kernel-source: before 5.3.18-150200.24.126.1
kernel-macros: before 5.3.18-150200.24.126.1
kernel-docs: before 5.3.18-150200.24.126.1
kernel-devel: before 5.3.18-150200.24.126.1
reiserfs-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
reiserfs-kmp-default: before 5.3.18-150200.24.126.1
kernel-syms: before 5.3.18-150200.24.126.1
kernel-obs-build-debugsource: before 5.3.18-150200.24.126.1
kernel-obs-build: before 5.3.18-150200.24.126.1
kernel-default-devel-debuginfo: before 5.3.18-150200.24.126.1
kernel-default-devel: before 5.3.18-150200.24.126.1
kernel-default-debugsource: before 5.3.18-150200.24.126.1
kernel-default-debuginfo: before 5.3.18-150200.24.126.1
kernel-default-base: before 5.3.18-150200.24.126.1.150200.9.59.2
kernel-default: before 5.3.18-150200.24.126.1
CPE2.3https://www.suse.com/support/update/announcement/2022/suse-su-20222809-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU66476
Risk: Medium
CVSSv4.0: 7.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/U:Green]
CVE-ID: CVE-2022-36946
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: Yes
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input within the nfqnl_mangle() function in net/netfilter/nfnetlink_queue.c in the Linux kernel when processing IPv6 packets. A remote attacker can send specially crafted packets to the system and perform a denial of service (DoS) attack.
MitigationUpdate the affected package the Linux Kernel to the latest version.
Vulnerable software versionsSUSE Enterprise Storage: 7.1
SUSE Linux Enterprise Storage: 7.1
SUSE Linux Enterprise High Availability: 15-SP2
SUSE Linux Enterprise Server for SAP Applications: 15-SP2
SUSE Linux Enterprise Server: 15-SP2-BCL - 15-SP2
SUSE Linux Enterprise Module for Live Patching: 15-SP2
SUSE Linux Enterprise High Performance Computing: 15-SP2-ESPOS - 15-SP2
SUSE Manager Server: 4.1
SUSE Manager Retail Branch Server: 4.1
SUSE Manager Proxy: 4.1
SUSE Linux Enterprise Server for SAP: 15-SP2
ocfs2-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
ocfs2-kmp-default: before 5.3.18-150200.24.126.1
gfs2-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
gfs2-kmp-default: before 5.3.18-150200.24.126.1
dlm-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
dlm-kmp-default: before 5.3.18-150200.24.126.1
cluster-md-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
cluster-md-kmp-default: before 5.3.18-150200.24.126.1
kernel-livepatch-SLE15-SP2_Update_29-debugsource: before 1-150200.5.5.1
kernel-livepatch-5_3_18-150200_24_126-default-debuginfo: before 1-150200.5.5.1
kernel-livepatch-5_3_18-150200_24_126-default: before 1-150200.5.5.1
kernel-default-livepatch-devel: before 5.3.18-150200.24.126.1
kernel-default-livepatch: before 5.3.18-150200.24.126.1
kernel-preempt-devel-debuginfo: before 5.3.18-150200.24.126.1
kernel-preempt-devel: before 5.3.18-150200.24.126.1
kernel-preempt-debugsource: before 5.3.18-150200.24.126.1
kernel-preempt-debuginfo: before 5.3.18-150200.24.126.1
kernel-preempt: before 5.3.18-150200.24.126.1
kernel-source: before 5.3.18-150200.24.126.1
kernel-macros: before 5.3.18-150200.24.126.1
kernel-docs: before 5.3.18-150200.24.126.1
kernel-devel: before 5.3.18-150200.24.126.1
reiserfs-kmp-default-debuginfo: before 5.3.18-150200.24.126.1
reiserfs-kmp-default: before 5.3.18-150200.24.126.1
kernel-syms: before 5.3.18-150200.24.126.1
kernel-obs-build-debugsource: before 5.3.18-150200.24.126.1
kernel-obs-build: before 5.3.18-150200.24.126.1
kernel-default-devel-debuginfo: before 5.3.18-150200.24.126.1
kernel-default-devel: before 5.3.18-150200.24.126.1
kernel-default-debugsource: before 5.3.18-150200.24.126.1
kernel-default-debuginfo: before 5.3.18-150200.24.126.1
kernel-default-base: before 5.3.18-150200.24.126.1.150200.9.59.2
kernel-default: before 5.3.18-150200.24.126.1
CPE2.3https://www.suse.com/support/update/announcement/2022/suse-su-20222809-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.