Most recent entries from all

ALSA-2022:5249 — Important: kernel security and bug fix update

Affected: AlmaLinux:9: bpftool, AlmaLinux:9: kernel, AlmaLinux:9: kernel-abi-stablelists, AlmaLinux:9: kernel-core, AlmaLinux:9: kernel-cross-headers, AlmaLinux:9: kernel-debug, AlmaLinux:9: kernel-debug-core, AlmaLinux:9: kernel-debug-devel, AlmaLinux:9: kernel-debug-devel-matched, AlmaLinux:9: kernel-debug-modules and 18 more

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Small table perturb size in the TCP source port generation algorithm can lead to information leak (CVE-2022-1012) * kernel: race condition in perf_event_open leads to privilege escalation (CVE-2022-1729) * kernel: a use-after-free write in the netfilter subsystem can lead to privilege escalation to root (CVE-2022-1966) * kernel: buffer overflow in IPsec ESP transformation code (CVE-2022-27666) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * make SHA512_arch algos and CRYPTO_USER built-ins (BZ#2072643) * SR-IOV performance > 50% degradation (BZ#2074830) * fix data corruption caused by dm-integrity (BZ#2082187) * SCTP client-side peeloff issues [almalinux-9] (BZ#2084044) * TCP connection fails in a asymmetric routing situation (BZ#2085480) * Fails to boot Multiple RT VMs each with multiple vCPUs (BZ#2086963) * spec: Fix separate tools build (BZ#2090852) * call traces related to eeh_pseries observed and vmcore is not captured, when kdump is triggered (BZ#2092255) * Mark ThunderX NIC driver as unmaintained (BZ#2092638)

bdu:2022-01567

certfr-2022-avi-282 — Une vulnérabilité a été découverte dans le noyau Linux d'Ubuntu. Elle permet à un attaquant de provoquer une exécution…

certfr-2022-avi-282

cnvd-2022-79427

EUVD-2026-15388

fkie_cve-2022-27666

A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and net/ipv6/esp6.c. This flaw allows a local attacker with a normal user privilege to overwrite kernel heap objects and may cause a local privilege escalation threat.

GHSA-5h7v-72v6-2r5w

In the Linux kernel before 5.16.15, there is a buffer overflow in ESP transformation in net/ipv4/esp4.c and net/ipv6/esp6.c via a large message. In some configurations, local users can gain privileges by overwriting kernel heap objects.

gsd-2022-27666

msrc_CVE-2022-27666 — A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and net/ipv6/esp6.c. This fla…

msrc_CVE-2022-27666

OESA-2022-1621 — kernel security update

Affected: openEuler:20.03-LTS-SP1: kernel, openEuler:20.03-LTS-SP2: kernel, openEuler:20.03-LTS-SP3: kernel, openEuler:22.03-LTS: kernel

The Linux Kernel, the operating system core itself. Security Fix(es): A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and net/ipv6/esp6.c. This flaw allows a local attacker with a normal user privilege to overwrite kernel heap objects and may cause a local privilege escalation threat.(CVE-2022-27666) In aio_poll_complete_work of aio.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-185125206References: Upstream kernel(CVE-2021-39698)

Vulnerability Summary for CVE-2022-1198.(CVE-2022-1198)

ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c in the Linux kernel through 5.17.1 has a double free.(CVE-2022-28390)

A flaw was found in the Linux kernel in net/netfilter/nf_tables_core.c:nft_do_chain, which can cause a use-after-free. This issue needs to handle return with proper preconditions, as it can lead to a kernel information leak problem caused by a local, unprivileged attacker.(CVE-2022-1016)

Product: AndroidVersions: Android kernelAndroid ID: A-173788806References: Upstream kernel.(CVE-2021-39713)

A use-after-free exists in the Linux Kernel in tc_new_tfilter that could allow a local attacker to gain privilege escalation. The exploit requires unprivileged user namespaces. We recommend upgrading past commit…

RHSA-2022:4809 — Red Hat Security Advisory: kpatch-patch security update

kernel: buffer overflow in IPsec ESP transformation code

RHSA-2022:5249 — Red Hat Security Advisory: kernel security and bug fix update

kernel: Small table perturb size in the TCP source port generation algorithm can lead to information leak kernel: race condition in perf_event_open leads to privilege escalation kernel: netfilter: nf_tables: incorrect NFT_STATEFUL_EXPR check leads to a use-after-free (write) kernel: buffer overflow in IPsec ESP transformation code kernel: a use-after-free write in the netfilter subsystem can lead to privilege escalation to root kernel: dm integrity: fix memory corruption when tag_size is less than digest size

SUSE-SU-2022:1163-1 — Security update for the Linux Kernel

Security update for the Linux Kernel

UBUNTU-CVE-2022-27666

Affected: Ubuntu:Pro:14.04:LTS: linux-azure, Ubuntu:Pro:16.04:LTS: linux-aws-hwe, Ubuntu:Pro:16.04:LTS: linux-azure, Ubuntu:Pro:16.04:LTS: linux-gcp, Ubuntu:Pro:16.04:LTS: linux-hwe, Ubuntu:Pro:16.04:LTS: linux-oracle, Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux, Ubuntu:18.04:LTS: linux-aws, Ubuntu:18.04:LTS: linux-aws-5.4 and 85 more

WID-SEC-W-2022-0157 — Linux Kernel: Schwachstelle ermöglicht nicht spezifizierten Angriff

Ein entfernter, anonymer Angreifer kann eine Schwachstelle im Linux Kernel ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.