csaf_suse - suse-su-2022:2377-1

suse-su-2022:2377-1

Vulnerability from csaf_suse

Published

2022-07-12 16:24

Modified

2022-07-12 16:24

Summary

Security update for the Linux Kernel

Notes

Title of the patch

Security update for the Linux Kernel

Description of the patch

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2022-29900, CVE-2022-29901: Fixed the RETBLEED attack, a new Spectre like Branch Target Buffer attack, that can leak arbitrary kernel information (bsc#1199657). - CVE-2022-1679: Fixed a use-after-free in the Atheros wireless driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages (bsc#1199487). - CVE-2022-20132: Fixed out of bounds read due to improper input validation in lg_probe and related functions of hid-lg.c (bsc#1200619). - CVE-2022-1012: Fixed information leak caused by small table perturb size in the TCP source port generation algorithm (bsc#1199482). - CVE-2022-33981: Fixed use-after-free in floppy driver (bsc#1200692) - CVE-2022-20141: Fixed a possible use after free due to improper locking in ip_check_mc_rcu() (bsc#1200604). - CVE-2021-4157: Fixed an out of memory bounds write flaw in the NFS subsystem, related to the replication of files with NFS. A user could potentially crash the system or escalate privileges on the system (bsc#1194013). - CVE-2022-20154: Fixed a use after free due to a race condition in lock_sock_nested of sock.c. This could lead to local escalation of privilege with System execution privileges needed (bsc#1200599). - CVE-2020-26541: Enforce the secure boot forbidden signature database (aka dbx) protection mechanism. (bsc#1177282) - CVE-2022-2318: Fixed a use-after-free vulnerabilities in the timer handler in net/rose/rose_timer.c that allow attackers to crash the system without any privileges (bsc#1201251). - CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742: Fixed multiple potential data leaks with Block and Network devices when using untrusted backends (bsc#1200762). The following non-security bugs were fixed: - audit: fix a race condition with the auditd tracking code (bsc#1197170). - block: bio-integrity: Advance seed correctly for larger interval sizes (git-fixes). - bnxt_en: Remove the setting of dev_port (git-fixes). - bonding: fix bond_neigh_init() (git-fixes). - dm crypt: Avoid percpu_counter spinlock contention in crypt_page_alloc() (git-fixes). - drbd: fix duplicate array initializer (git-fixes). - drbd: remove assign_p_sizes_qlim (git-fixes). - drbd: use bdev_alignment_offset instead of queue_alignment_offset (git-fixes). - drbd: use bdev based limit helpers in drbd_send_sizes (git-fixes). - exec: Force single empty string when argv is empty (bsc#1200571). - ext4: fix bug_on ext4_mb_use_inode_pa (bsc#1200810). - ext4: fix bug_on in __es_tree_search (bsc#1200809). - ext4: fix bug_on in ext4_writepages (bsc#1200872). - ext4: fix overhead calculation to account for the reserved gdt blocks (bsc#1200869). - ext4: fix race condition between ext4_write and ext4_convert_inline_data (bsc#1200807). - ext4: fix symlink file size not match to file content (bsc#1200868). - ext4: fix use-after-free in ext4_rename_dir_prepare (bsc#1200871). - ext4: force overhead calculation if the s_overhead_cluster makes no sense (bsc#1200870). - ext4: limit length to bitmap_maxbytes - blocksize in punch_hole (bsc#1200806). - ext4: make variable 'count' signed (bsc#1200820). - fs-writeback: writeback_sb_inodes Recalculate 'wrote' according skipped pages (bsc#1200873). - i915_vma: Rename vma_lookup to i915_vma_lookup (git-fixes). - ibmvnic: Properly dispose of all skbs during a failover (bsc#1200925). - init: Initialize noop_backing_dev_info early (bsc#1200822). - inotify: show inotify mask flags in proc fdinfo (bsc#1200600). - Input: bcm5974 - set missing URB_NO_TRANSFER_DMA_MAP urb flag (git-fixes). - Input: elan_i2c - fix regulator enable count imbalance after suspend/resume (git-fixes). - Input: elan_i2c - move regulator_[en|dis]able() out of elan_[en|dis]able_power() (git-fixes). - Input: omap4-keypad - fix pm_runtime_get_sync() error checking (git-fixes). - iomap: iomap_write_failed fix (bsc#1200829). - kvm: fix wrong exception emulation in check_rdtsc (git-fixes). - kvm: i8254: remove redundant assignment to pointer s (git-fixes). - KVM: LAPIC: Prevent setting the tscdeadline timer if the lapic is hw disabled (git-fixes). - KVM: s390: vsie/gmap: reduce gmap_rmap overhead (git-fixes). - KVM: x86: Allocate new rmap and large page tracking when moving memslot (git-fixes). - KVM: x86: always stop emulation on page fault (git-fixes). - KVM: x86: clear stale x86_emulate_ctxt->intercept value (git-fixes). - KVM: x86: clflushopt should be treated as a no-op by emulation (git-fixes). - kvm: x86/cpuid: Only provide CPUID leaf 0xA if host has architectural PMU (git-fixes). - KVM: x86: Do not force set BSP bit when local APIC is managed by userspace (git-fixes). - KVM: x86: do not modify masked bits of shared MSRs (git-fixes). - KVM: x86/emulator: Defer not-present segment check in __load_segment_descriptor() (git-fixes). - KVM: x86: Fix emulation in writing cr8 (git-fixes). - KVM: x86: Fix off-by-one error in kvm_vcpu_ioctl_x86_setup_mce (git-fixes). - KVM: x86: Fix potential put_fpu() w/o load_fpu() on MPX platform (git-fixes). - KVM: x86: Fix x86_decode_insn() return when fetching insn bytes fails (git-fixes). - KVM: x86: Free wbinvd_dirty_mask if vCPU creation fails (git-fixes). - kvm: x86: Improve emulation of CPUID leaves 0BH and 1FH (git-fixes). - KVM: x86: Inject #GP if guest attempts to toggle CR4.LA57 in 64-bit mode (git-fixes). - KVM: x86: Manually calculate reserved bits when loading PDPTRS (git-fixes). - KVM: x86: Manually flush collapsible SPTEs only when toggling flags (git-fixes). - KVM: x86: Migrate the PIT only if vcpu0 is migrated, not any BSP (git-fixes). - KVM: x86/mmu: Treat invalid shadow pages as obsolete (git-fixes). - KVM: x86: Refactor prefix decoding to prevent Spectre-v1/L1TF attacks (git-fixes). - KVM: x86: Remove spurious clearing of async #PF MSR (git-fixes). - KVM: x86: Remove spurious kvm_mmu_unload() from vcpu destruction path (git-fixes). - KVM: x86: remove stale comment from struct x86_emulate_ctxt (git-fixes). - KVM: x86: set ctxt->have_exception in x86_decode_insn() (git-fixes). - kvm: x86: skip populating logical dest map if apic is not sw enabled (git-fixes). - KVM: x86: Trace the original requested CPUID function in kvm_cpuid() (git-fixes). - KVM: x86: Update vCPU's hv_clock before back to guest when tsc_offset is adjusted (git-fixes). - md: bcache: check the return value of kzalloc() in detached_dev_do_request() (git-fixes). - md: fix an incorrect NULL check in does_sb_need_changing (git-fixes). - md: fix an incorrect NULL check in md_reload_sb (git-fixes). - md/raid0: Ignore RAID0 layout if the second zone has only one device (git-fixes). - mm: add vma_lookup(), update find_vma_intersection() comments (git-fixes). - net/mlx5: Avoid double free of root ns in the error flow path (git-fixes). - net/mlx5e: Replace reciprocal_scale in TX select queue function (git-fixes). - net/mlx5e: Switch to Toeplitz RSS hash by default (git-fixes). - net/mlx5: Fix auto group size calculation (git-fixes). - net: qed: Disable aRFS for NPAR and 100G (git-fixes). - net: qede: Disable aRFS for NPAR and 100G (git-fixes). - net: stmmac: update rx tail pointer register to fix rx dma hang issue (git-fixes). - NFSD: Fix possible sleep during nfsd4_release_lockowner() (git-fixes). - NFS: Further fixes to the writeback error handling (git-fixes). - PCI/ACPI: Allow D3 only if Root Port can signal and wake from D3 (git-fixes). - PCI: Tidy comments (git-fixes). - platform/chrome: cros_ec_proto: Send command again when timeout occurs (git-fixes). - powerpc/idle: Fix return value of __setup() handler (bsc#1065729). - powerpc/perf: Fix the threshold compare group constraint for power9 (bsc#1065729). - powerpc/rtas: Allow ibm,platform-dump RTAS call with null buffer address (bsc#1200343 ltc#198477). - qed: Enable automatic recovery on error condition (bsc#1196964). - raid5: introduce MD_BROKEN (git-fixes). - s390: fix detection of vector enhancements facility 1 vs. vector packed decimal facility (git-fixes). - s390: fix strrchr() implementation (git-fixes). - s390/ftrace: fix ftrace_update_ftrace_func implementation (git-fixes). - s390/gmap: do not unconditionally call pte_unmap_unlock() in __gmap_zap() (git-fixes). - s390/gmap: validate VMA in __gmap_zap() (git-fixes). - s390/mm: fix VMA and page table handling code in storage key handling functions (git-fixes). - s390/mm: validate VMA in PGSTE manipulation functions (git-fixes). - scsi: dc395x: Fix a missing check on list iterator (git-fixes). - scsi: ufs: qcom: Add a readl() to make sure ref_clk gets enabled (git-fixes). - scsi: ufs: qcom: Fix ufs_qcom_resume() (git-fixes). - SUNRPC: Fix the calculation of xdr->end in xdr_get_next_encode_buffer() (git-fixes). - target: remove an incorrect unmap zeroes data deduction (git-fixes). - tracing: Fix return value of trace_pid_write() (git-fixes). - usb: musb: Fix missing of_node_put() in omap2430_probe (git-fixes). - USB: serial: option: add Quectel BG95 modem (git-fixes). - USB: storage: karma: fix rio_karma_init return (git-fixes). - usb: usbip: add missing device lock on tweak configuration cmd (git-fixes). - usb: usbip: fix a refcount leak in stub_probe() (git-fixes). - video: fbdev: clcdfb: Fix refcount leak in clcdfb_of_vram_setup (bsc#1129770) - writeback: Avoid skipping inode writeback (bsc#1200813). - writeback: Fix inode->i_io_list not be protected by inode->i_lock error (bsc#1200821).

Patchnames

SUSE-2022-2377,SUSE-SLE-SERVER-12-SP5-2022-2377

CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for the Linux Kernel",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.\n\n\nThe following security bugs were fixed:\n\n- CVE-2022-29900, CVE-2022-29901: Fixed the RETBLEED attack, a new Spectre like Branch Target Buffer attack, that can leak arbitrary kernel information (bsc#1199657).\n- CVE-2022-1679: Fixed a use-after-free in the Atheros wireless driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages (bsc#1199487).\n- CVE-2022-20132: Fixed out of bounds read due to improper input validation in lg_probe and related functions of hid-lg.c (bsc#1200619).\n- CVE-2022-1012: Fixed information leak caused by small table perturb size in the TCP source port generation algorithm (bsc#1199482).\n- CVE-2022-33981: Fixed use-after-free in floppy driver (bsc#1200692)\n- CVE-2022-20141: Fixed a possible use after free due to improper locking in ip_check_mc_rcu() (bsc#1200604).\n- CVE-2021-4157: Fixed an out of memory bounds write flaw in the NFS subsystem, related to the replication of files with NFS. A user could potentially crash the system or escalate privileges on the system (bsc#1194013).\n- CVE-2022-20154: Fixed a use after free due to a race condition in lock_sock_nested of sock.c. This could lead to local escalation of privilege with System execution privileges needed (bsc#1200599).\n- CVE-2020-26541: Enforce the secure boot forbidden signature database (aka dbx) protection mechanism. (bsc#1177282)\n- CVE-2022-2318: Fixed a use-after-free vulnerabilities in the timer handler in net/rose/rose_timer.c that allow attackers to crash the system without any privileges (bsc#1201251).\n- CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742: Fixed multiple potential data leaks with Block and Network devices when using untrusted backends (bsc#1200762).\n\nThe following non-security bugs were fixed:\n\n- audit: fix a race condition with the auditd tracking code (bsc#1197170).\n- block: bio-integrity: Advance seed correctly for larger interval sizes (git-fixes).\n- bnxt_en: Remove the setting of dev_port (git-fixes).\n- bonding: fix bond_neigh_init() (git-fixes).\n- dm crypt: Avoid percpu_counter spinlock contention in crypt_page_alloc() (git-fixes).\n- drbd: fix duplicate array initializer (git-fixes).\n- drbd: remove assign_p_sizes_qlim (git-fixes).\n- drbd: use bdev_alignment_offset instead of queue_alignment_offset (git-fixes).\n- drbd: use bdev based limit helpers in drbd_send_sizes (git-fixes).\n- exec: Force single empty string when argv is empty (bsc#1200571).\n- ext4: fix bug_on ext4_mb_use_inode_pa (bsc#1200810).\n- ext4: fix bug_on in __es_tree_search (bsc#1200809).\n- ext4: fix bug_on in ext4_writepages (bsc#1200872).\n- ext4: fix overhead calculation to account for the reserved gdt blocks (bsc#1200869).\n- ext4: fix race condition between ext4_write and ext4_convert_inline_data (bsc#1200807).\n- ext4: fix symlink file size not match to file content (bsc#1200868).\n- ext4: fix use-after-free in ext4_rename_dir_prepare (bsc#1200871).\n- ext4: force overhead calculation if the s_overhead_cluster makes no sense (bsc#1200870).\n- ext4: limit length to bitmap_maxbytes - blocksize in punch_hole (bsc#1200806).\n- ext4: make variable \u0027count\u0027 signed (bsc#1200820).\n- fs-writeback: writeback_sb_inodes Recalculate \u0027wrote\u0027 according skipped pages (bsc#1200873).\n- i915_vma: Rename vma_lookup to i915_vma_lookup (git-fixes).\n- ibmvnic: Properly dispose of all skbs during a failover (bsc#1200925).\n- init: Initialize noop_backing_dev_info early (bsc#1200822).\n- inotify: show inotify mask flags in proc fdinfo (bsc#1200600).\n- Input: bcm5974 - set missing URB_NO_TRANSFER_DMA_MAP urb flag (git-fixes).\n- Input: elan_i2c - fix regulator enable count imbalance after suspend/resume (git-fixes).\n- Input: elan_i2c - move regulator_[en|dis]able() out of elan_[en|dis]able_power() (git-fixes).\n- Input: omap4-keypad - fix pm_runtime_get_sync() error checking (git-fixes).\n- iomap: iomap_write_failed fix (bsc#1200829).\n- kvm: fix wrong exception emulation in check_rdtsc (git-fixes).\n- kvm: i8254: remove redundant assignment to pointer s (git-fixes).\n- KVM: LAPIC: Prevent setting the tscdeadline timer if the lapic is hw disabled (git-fixes).\n- KVM: s390: vsie/gmap: reduce gmap_rmap overhead (git-fixes).\n- KVM: x86: Allocate new rmap and large page tracking when moving memslot (git-fixes).\n- KVM: x86: always stop emulation on page fault (git-fixes).\n- KVM: x86: clear stale x86_emulate_ctxt-\u003eintercept value (git-fixes).\n- KVM: x86: clflushopt should be treated as a no-op by emulation (git-fixes).\n- kvm: x86/cpuid: Only provide CPUID leaf 0xA if host has architectural PMU (git-fixes).\n- KVM: x86: Do not force set BSP bit when local APIC is managed by userspace (git-fixes).\n- KVM: x86: do not modify masked bits of shared MSRs (git-fixes).\n- KVM: x86/emulator: Defer not-present segment check in __load_segment_descriptor() (git-fixes).\n- KVM: x86: Fix emulation in writing cr8 (git-fixes).\n- KVM: x86: Fix off-by-one error in kvm_vcpu_ioctl_x86_setup_mce (git-fixes).\n- KVM: x86: Fix potential put_fpu() w/o load_fpu() on MPX platform (git-fixes).\n- KVM: x86: Fix x86_decode_insn() return when fetching insn bytes fails (git-fixes).\n- KVM: x86: Free wbinvd_dirty_mask if vCPU creation fails (git-fixes).\n- kvm: x86: Improve emulation of CPUID leaves 0BH and 1FH (git-fixes).\n- KVM: x86: Inject #GP if guest attempts to toggle CR4.LA57 in 64-bit mode (git-fixes).\n- KVM: x86: Manually calculate reserved bits when loading PDPTRS (git-fixes).\n- KVM: x86: Manually flush collapsible SPTEs only when toggling flags (git-fixes).\n- KVM: x86: Migrate the PIT only if vcpu0 is migrated, not any BSP (git-fixes).\n- KVM: x86/mmu: Treat invalid shadow pages as obsolete (git-fixes).\n- KVM: x86: Refactor prefix decoding to prevent Spectre-v1/L1TF attacks (git-fixes).\n- KVM: x86: Remove spurious clearing of async #PF MSR (git-fixes).\n- KVM: x86: Remove spurious kvm_mmu_unload() from vcpu destruction path (git-fixes).\n- KVM: x86: remove stale comment from struct x86_emulate_ctxt (git-fixes).\n- KVM: x86: set ctxt-\u003ehave_exception in x86_decode_insn() (git-fixes).\n- kvm: x86: skip populating logical dest map if apic is not sw enabled (git-fixes).\n- KVM: x86: Trace the original requested CPUID function in kvm_cpuid() (git-fixes).\n- KVM: x86: Update vCPU\u0027s hv_clock before back to guest when tsc_offset is adjusted (git-fixes).\n- md: bcache: check the return value of kzalloc() in detached_dev_do_request() (git-fixes).\n- md: fix an incorrect NULL check in does_sb_need_changing (git-fixes).\n- md: fix an incorrect NULL check in md_reload_sb (git-fixes).\n- md/raid0: Ignore RAID0 layout if the second zone has only one device (git-fixes).\n- mm: add vma_lookup(), update find_vma_intersection() comments (git-fixes).\n- net/mlx5: Avoid double free of root ns in the error flow path (git-fixes).\n- net/mlx5e: Replace reciprocal_scale in TX select queue function (git-fixes).\n- net/mlx5e: Switch to Toeplitz RSS hash by default (git-fixes).\n- net/mlx5: Fix auto group size calculation (git-fixes).\n- net: qed: Disable aRFS for NPAR and 100G (git-fixes).\n- net: qede: Disable aRFS for NPAR and 100G (git-fixes).\n- net: stmmac: update rx tail pointer register to fix rx dma hang issue (git-fixes).\n- NFSD: Fix possible sleep during nfsd4_release_lockowner() (git-fixes).\n- NFS: Further fixes to the writeback error handling (git-fixes).\n- PCI/ACPI: Allow D3 only if Root Port can signal and wake from D3 (git-fixes).\n- PCI: Tidy comments (git-fixes).\n- platform/chrome: cros_ec_proto: Send command again when timeout occurs (git-fixes).\n- powerpc/idle: Fix return value of __setup() handler (bsc#1065729).\n- powerpc/perf: Fix the threshold compare group constraint for power9 (bsc#1065729).\n- powerpc/rtas: Allow ibm,platform-dump RTAS call with null buffer address (bsc#1200343 ltc#198477).\n- qed: Enable automatic recovery on error condition (bsc#1196964).\n- raid5: introduce MD_BROKEN (git-fixes).\n- s390: fix detection of vector enhancements facility 1 vs. vector packed decimal facility (git-fixes).\n- s390: fix strrchr() implementation (git-fixes).\n- s390/ftrace: fix ftrace_update_ftrace_func implementation (git-fixes).\n- s390/gmap: do not unconditionally call pte_unmap_unlock() in __gmap_zap() (git-fixes).\n- s390/gmap: validate VMA in __gmap_zap() (git-fixes).\n- s390/mm: fix VMA and page table handling code in storage key handling functions (git-fixes).\n- s390/mm: validate VMA in PGSTE manipulation functions (git-fixes).\n- scsi: dc395x: Fix a missing check on list iterator (git-fixes).\n- scsi: ufs: qcom: Add a readl() to make sure ref_clk gets enabled (git-fixes).\n- scsi: ufs: qcom: Fix ufs_qcom_resume() (git-fixes).\n- SUNRPC: Fix the calculation of xdr-\u003eend in xdr_get_next_encode_buffer() (git-fixes).\n- target: remove an incorrect unmap zeroes data deduction (git-fixes).\n- tracing: Fix return value of trace_pid_write() (git-fixes).\n- usb: musb: Fix missing of_node_put() in omap2430_probe (git-fixes).\n- USB: serial: option: add Quectel BG95 modem (git-fixes).\n- USB: storage: karma: fix rio_karma_init return (git-fixes).\n- usb: usbip: add missing device lock on tweak configuration cmd (git-fixes).\n- usb: usbip: fix a refcount leak in stub_probe() (git-fixes).\n- video: fbdev: clcdfb: Fix refcount leak in clcdfb_of_vram_setup (bsc#1129770)\n- writeback: Avoid skipping inode writeback (bsc#1200813).\n- writeback: Fix inode-\u003ei_io_list not be protected by inode-\u003ei_lock error (bsc#1200821).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2022-2377,SUSE-SLE-SERVER-12-SP5-2022-2377",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2022_2377-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2022:2377-1",
        "url": "https://www.suse.com/support/update/announcement/2022/suse-su-20222377-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2022:2377-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-July/011520.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1065729",
        "url": "https://bugzilla.suse.com/1065729"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1129770",
        "url": "https://bugzilla.suse.com/1129770"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1177282",
        "url": "https://bugzilla.suse.com/1177282"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1194013",
        "url": "https://bugzilla.suse.com/1194013"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1196964",
        "url": "https://bugzilla.suse.com/1196964"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1197170",
        "url": "https://bugzilla.suse.com/1197170"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1199482",
        "url": "https://bugzilla.suse.com/1199482"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1199487",
        "url": "https://bugzilla.suse.com/1199487"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1199657",
        "url": "https://bugzilla.suse.com/1199657"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1200343",
        "url": "https://bugzilla.suse.com/1200343"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1200571",
        "url": "https://bugzilla.suse.com/1200571"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1200599",
        "url": "https://bugzilla.suse.com/1200599"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1200600",
        "url": "https://bugzilla.suse.com/1200600"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1200604",
        "url": "https://bugzilla.suse.com/1200604"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1200605",
        "url": "https://bugzilla.suse.com/1200605"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1200608",
        "url": "https://bugzilla.suse.com/1200608"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1200619",
        "url": "https://bugzilla.suse.com/1200619"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1200692",
        "url": "https://bugzilla.suse.com/1200692"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1200762",
        "url": "https://bugzilla.suse.com/1200762"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1200806",
        "url": "https://bugzilla.suse.com/1200806"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1200807",
        "url": "https://bugzilla.suse.com/1200807"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1200809",
        "url": "https://bugzilla.suse.com/1200809"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1200810",
        "url": "https://bugzilla.suse.com/1200810"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1200813",
        "url": "https://bugzilla.suse.com/1200813"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1200820",
        "url": "https://bugzilla.suse.com/1200820"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1200821",
        "url": "https://bugzilla.suse.com/1200821"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1200822",
        "url": "https://bugzilla.suse.com/1200822"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1200829",
        "url": "https://bugzilla.suse.com/1200829"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1200868",
        "url": "https://bugzilla.suse.com/1200868"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1200869",
        "url": "https://bugzilla.suse.com/1200869"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1200870",
        "url": "https://bugzilla.suse.com/1200870"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1200871",
        "url": "https://bugzilla.suse.com/1200871"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1200872",
        "url": "https://bugzilla.suse.com/1200872"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1200873",
        "url": "https://bugzilla.suse.com/1200873"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1200925",
        "url": "https://bugzilla.suse.com/1200925"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1201080",
        "url": "https://bugzilla.suse.com/1201080"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1201251",
        "url": "https://bugzilla.suse.com/1201251"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-26541 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-26541/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-4157 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-4157/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-1012 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-1012/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-1679 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-1679/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-20132 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-20132/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-20141 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-20141/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-20154 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-20154/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-2318 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-2318/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-26365 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-26365/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-29900 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-29900/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-29901 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-29901/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-33740 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-33740/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-33741 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-33741/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-33742 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-33742/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-33981 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-33981/"
      }
    ],
    "title": "Security update for the Linux Kernel",
    "tracking": {
      "current_release_date": "2022-07-12T16:24:12Z",
      "generator": {
        "date": "2022-07-12T16:24:12Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2022:2377-1",
      "initial_release_date": "2022-07-12T16:24:12Z",
      "revision_history": [
        {
          "date": "2022-07-12T16:24:12Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "kernel-devel-azure-4.12.14-16.103.1.noarch",
                "product": {
                  "name": "kernel-devel-azure-4.12.14-16.103.1.noarch",
                  "product_id": "kernel-devel-azure-4.12.14-16.103.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "kernel-source-azure-4.12.14-16.103.1.noarch",
                "product": {
                  "name": "kernel-source-azure-4.12.14-16.103.1.noarch",
                  "product_id": "kernel-source-azure-4.12.14-16.103.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cluster-md-kmp-azure-4.12.14-16.103.1.x86_64",
                "product": {
                  "name": "cluster-md-kmp-azure-4.12.14-16.103.1.x86_64",
                  "product_id": "cluster-md-kmp-azure-4.12.14-16.103.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "dlm-kmp-azure-4.12.14-16.103.1.x86_64",
                "product": {
                  "name": "dlm-kmp-azure-4.12.14-16.103.1.x86_64",
                  "product_id": "dlm-kmp-azure-4.12.14-16.103.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "gfs2-kmp-azure-4.12.14-16.103.1.x86_64",
                "product": {
                  "name": "gfs2-kmp-azure-4.12.14-16.103.1.x86_64",
                  "product_id": "gfs2-kmp-azure-4.12.14-16.103.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "kernel-azure-4.12.14-16.103.1.x86_64",
                "product": {
                  "name": "kernel-azure-4.12.14-16.103.1.x86_64",
                  "product_id": "kernel-azure-4.12.14-16.103.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "kernel-azure-base-4.12.14-16.103.1.x86_64",
                "product": {
                  "name": "kernel-azure-base-4.12.14-16.103.1.x86_64",
                  "product_id": "kernel-azure-base-4.12.14-16.103.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "kernel-azure-devel-4.12.14-16.103.1.x86_64",
                "product": {
                  "name": "kernel-azure-devel-4.12.14-16.103.1.x86_64",
                  "product_id": "kernel-azure-devel-4.12.14-16.103.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "kernel-azure-extra-4.12.14-16.103.1.x86_64",
                "product": {
                  "name": "kernel-azure-extra-4.12.14-16.103.1.x86_64",
                  "product_id": "kernel-azure-extra-4.12.14-16.103.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "kernel-azure-kgraft-devel-4.12.14-16.103.1.x86_64",
                "product": {
                  "name": "kernel-azure-kgraft-devel-4.12.14-16.103.1.x86_64",
                  "product_id": "kernel-azure-kgraft-devel-4.12.14-16.103.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "kernel-syms-azure-4.12.14-16.103.1.x86_64",
                "product": {
                  "name": "kernel-syms-azure-4.12.14-16.103.1.x86_64",
                  "product_id": "kernel-syms-azure-4.12.14-16.103.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "kselftests-kmp-azure-4.12.14-16.103.1.x86_64",
                "product": {
                  "name": "kselftests-kmp-azure-4.12.14-16.103.1.x86_64",
                  "product_id": "kselftests-kmp-azure-4.12.14-16.103.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "ocfs2-kmp-azure-4.12.14-16.103.1.x86_64",
                "product": {
                  "name": "ocfs2-kmp-azure-4.12.14-16.103.1.x86_64",
                  "product_id": "ocfs2-kmp-azure-4.12.14-16.103.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 12 SP5",
                "product": {
                  "name": "SUSE Linux Enterprise Server 12 SP5",
                  "product_id": "SUSE Linux Enterprise Server 12 SP5",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles:12:sp5"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP5",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP5",
                  "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles_sap:12:sp5"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-azure-4.12.14-16.103.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP5",
          "product_id": "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64"
        },
        "product_reference": "kernel-azure-4.12.14-16.103.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-azure-base-4.12.14-16.103.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP5",
          "product_id": "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64"
        },
        "product_reference": "kernel-azure-base-4.12.14-16.103.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-azure-devel-4.12.14-16.103.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP5",
          "product_id": "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64"
        },
        "product_reference": "kernel-azure-devel-4.12.14-16.103.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-devel-azure-4.12.14-16.103.1.noarch as component of SUSE Linux Enterprise Server 12 SP5",
          "product_id": "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch"
        },
        "product_reference": "kernel-devel-azure-4.12.14-16.103.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-source-azure-4.12.14-16.103.1.noarch as component of SUSE Linux Enterprise Server 12 SP5",
          "product_id": "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch"
        },
        "product_reference": "kernel-source-azure-4.12.14-16.103.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-syms-azure-4.12.14-16.103.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP5",
          "product_id": "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64"
        },
        "product_reference": "kernel-syms-azure-4.12.14-16.103.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-azure-4.12.14-16.103.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64"
        },
        "product_reference": "kernel-azure-4.12.14-16.103.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-azure-base-4.12.14-16.103.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64"
        },
        "product_reference": "kernel-azure-base-4.12.14-16.103.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-azure-devel-4.12.14-16.103.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64"
        },
        "product_reference": "kernel-azure-devel-4.12.14-16.103.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-devel-azure-4.12.14-16.103.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch"
        },
        "product_reference": "kernel-devel-azure-4.12.14-16.103.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-source-azure-4.12.14-16.103.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch"
        },
        "product_reference": "kernel-source-azure-4.12.14-16.103.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-syms-azure-4.12.14-16.103.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64"
        },
        "product_reference": "kernel-syms-azure-4.12.14-16.103.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2020-26541",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-26541"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The Linux kernel through 5.8.13 does not properly enforce the Secure Boot Forbidden Signature Database (aka dbx) protection mechanism. This affects certs/blacklist.c and certs/system_keyring.c.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
          "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
          "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-26541",
          "url": "https://www.suse.com/security/cve/CVE-2020-26541"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1177282 for CVE-2020-26541",
          "url": "https://bugzilla.suse.com/1177282"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2022-07-12T16:24:12Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-26541"
    },
    {
      "cve": "CVE-2021-4157",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-4157"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An out of memory bounds write flaw (1 or 2 bytes of memory) in the Linux kernel NFS subsystem was found in the way users use mirroring (replication of files with NFS). A user, having access to the NFS mount, could potentially use this flaw to crash the system or escalate privileges on the system.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
          "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
          "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-4157",
          "url": "https://www.suse.com/security/cve/CVE-2021-4157"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1194013 for CVE-2021-4157",
          "url": "https://bugzilla.suse.com/1194013"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.4,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2022-07-12T16:24:12Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2021-4157"
    },
    {
      "cve": "CVE-2022-1012",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-1012"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A memory leak problem was found in the TCP source port generation algorithm in net/ipv4/tcp.c due to the small table perturb size. This flaw may allow an attacker to information leak and may cause a denial of service problem.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
          "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
          "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-1012",
          "url": "https://www.suse.com/security/cve/CVE-2022-1012"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1199482 for CVE-2022-1012",
          "url": "https://bugzilla.suse.com/1199482"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1199694 for CVE-2022-1012",
          "url": "https://bugzilla.suse.com/1199694"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1202335 for CVE-2022-1012",
          "url": "https://bugzilla.suse.com/1202335"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2022-07-12T16:24:12Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2022-1012"
    },
    {
      "cve": "CVE-2022-1679",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-1679"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A use-after-free flaw was found in the Linux kernel\u0027s Atheros wireless adapter driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages. This flaw allows a local user to crash or potentially escalate their privileges on the system.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
          "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
          "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-1679",
          "url": "https://www.suse.com/security/cve/CVE-2022-1679"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1199487 for CVE-2022-1679",
          "url": "https://bugzilla.suse.com/1199487"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1201080 for CVE-2022-1679",
          "url": "https://bugzilla.suse.com/1201080"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1201832 for CVE-2022-1679",
          "url": "https://bugzilla.suse.com/1201832"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1204132 for CVE-2022-1679",
          "url": "https://bugzilla.suse.com/1204132"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1212316 for CVE-2022-1679",
          "url": "https://bugzilla.suse.com/1212316"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2022-07-12T16:24:12Z",
          "details": "important"
        }
      ],
      "title": "CVE-2022-1679"
    },
    {
      "cve": "CVE-2022-20132",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-20132"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In lg_probe and related functions of hid-lg.c and other USB HID files, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure if a malicious USB HID device were plugged in, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-188677105References: Upstream kernel",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
          "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
          "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-20132",
          "url": "https://www.suse.com/security/cve/CVE-2022-20132"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1200619 for CVE-2022-20132",
          "url": "https://bugzilla.suse.com/1200619"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1212287 for CVE-2022-20132",
          "url": "https://bugzilla.suse.com/1212287"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2022-07-12T16:24:12Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2022-20132"
    },
    {
      "cve": "CVE-2022-20141",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-20141"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In ip_check_mc_rcu of igmp.c, there is a possible use after free due to improper locking. This could lead to local escalation of privilege when opening and closing inet sockets with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-112551163References: Upstream kernel",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
          "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
          "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-20141",
          "url": "https://www.suse.com/security/cve/CVE-2022-20141"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1200604 for CVE-2022-20141",
          "url": "https://bugzilla.suse.com/1200604"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1200605 for CVE-2022-20141",
          "url": "https://bugzilla.suse.com/1200605"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1203034 for CVE-2022-20141",
          "url": "https://bugzilla.suse.com/1203034"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2022-07-12T16:24:12Z",
          "details": "important"
        }
      ],
      "title": "CVE-2022-20141"
    },
    {
      "cve": "CVE-2022-20154",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-20154"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In lock_sock_nested of sock.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-174846563References: Upstream kernel",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
          "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
          "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-20154",
          "url": "https://www.suse.com/security/cve/CVE-2022-20154"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1200599 for CVE-2022-20154",
          "url": "https://bugzilla.suse.com/1200599"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1200608 for CVE-2022-20154",
          "url": "https://bugzilla.suse.com/1200608"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1224298 for CVE-2022-20154",
          "url": "https://bugzilla.suse.com/1224298"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1224878 for CVE-2022-20154",
          "url": "https://bugzilla.suse.com/1224878"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2022-07-12T16:24:12Z",
          "details": "important"
        }
      ],
      "title": "CVE-2022-20154"
    },
    {
      "cve": "CVE-2022-2318",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-2318"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "There are use-after-free vulnerabilities caused by timer handler in net/rose/rose_timer.c of linux that allow attackers to crash linux kernel without any privileges.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
          "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
          "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-2318",
          "url": "https://www.suse.com/security/cve/CVE-2022-2318"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1201251 for CVE-2022-2318",
          "url": "https://bugzilla.suse.com/1201251"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1212303 for CVE-2022-2318",
          "url": "https://bugzilla.suse.com/1212303"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2022-07-12T16:24:12Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2022-2318"
    },
    {
      "cve": "CVE-2022-26365",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-26365"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device frontends don\u0027t zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740). Additionally the granularity of the grant table doesn\u0027t allow sharing less than a 4K page, leading to unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend (CVE-2022-33741, CVE-2022-33742).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
          "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
          "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-26365",
          "url": "https://www.suse.com/security/cve/CVE-2022-26365"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1200762 for CVE-2022-26365",
          "url": "https://bugzilla.suse.com/1200762"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2022-07-12T16:24:12Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2022-26365"
    },
    {
      "cve": "CVE-2022-29900",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-29900"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution under certain microarchitecture-dependent conditions.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
          "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
          "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-29900",
          "url": "https://www.suse.com/security/cve/CVE-2022-29900"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1199657 for CVE-2022-29900",
          "url": "https://bugzilla.suse.com/1199657"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1201469 for CVE-2022-29900",
          "url": "https://bugzilla.suse.com/1201469"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1207894 for CVE-2022-29900",
          "url": "https://bugzilla.suse.com/1207894"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2022-07-12T16:24:12Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2022-29900"
    },
    {
      "cve": "CVE-2022-29901",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-29901"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can hijack return instructions to achieve arbitrary speculative code execution under certain microarchitecture-dependent conditions.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
          "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
          "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-29901",
          "url": "https://www.suse.com/security/cve/CVE-2022-29901"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1199657 for CVE-2022-29901",
          "url": "https://bugzilla.suse.com/1199657"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1201469 for CVE-2022-29901",
          "url": "https://bugzilla.suse.com/1201469"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1207894 for CVE-2022-29901",
          "url": "https://bugzilla.suse.com/1207894"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2022-07-12T16:24:12Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2022-29901"
    },
    {
      "cve": "CVE-2022-33740",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-33740"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device frontends don\u0027t zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740). Additionally the granularity of the grant table doesn\u0027t allow sharing less than a 4K page, leading to unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend (CVE-2022-33741, CVE-2022-33742).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
          "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
          "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-33740",
          "url": "https://www.suse.com/security/cve/CVE-2022-33740"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1200762 for CVE-2022-33740",
          "url": "https://bugzilla.suse.com/1200762"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2022-07-12T16:24:12Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2022-33740"
    },
    {
      "cve": "CVE-2022-33741",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-33741"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device frontends don\u0027t zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740). Additionally the granularity of the grant table doesn\u0027t allow sharing less than a 4K page, leading to unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend (CVE-2022-33741, CVE-2022-33742).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
          "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
          "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-33741",
          "url": "https://www.suse.com/security/cve/CVE-2022-33741"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1200762 for CVE-2022-33741",
          "url": "https://bugzilla.suse.com/1200762"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2022-07-12T16:24:12Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2022-33741"
    },
    {
      "cve": "CVE-2022-33742",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-33742"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device frontends don\u0027t zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740). Additionally the granularity of the grant table doesn\u0027t allow sharing less than a 4K page, leading to unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend (CVE-2022-33741, CVE-2022-33742).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
          "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
          "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-33742",
          "url": "https://www.suse.com/security/cve/CVE-2022-33742"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1200762 for CVE-2022-33742",
          "url": "https://bugzilla.suse.com/1200762"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2022-07-12T16:24:12Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2022-33742"
    },
    {
      "cve": "CVE-2022-33981",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-33981"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "drivers/block/floppy.c in the Linux kernel before 5.17.6 is vulnerable to a denial of service, because of a concurrency use-after-free flaw after deallocating raw_cmd in the raw_cmd_ioctl function.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
          "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
          "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-33981",
          "url": "https://www.suse.com/security/cve/CVE-2022-33981"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1200692 for CVE-2022-33981",
          "url": "https://bugzilla.suse.com/1200692"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.103.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.103.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.103.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2022-07-12T16:24:12Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2022-33981"
    }
  ]
}

CVE-2022-29900 (GCVE-0-2022-29900)

Vulnerability from cvelistv5

Published

2022-07-12 15:50

Modified

2024-11-20 16:13

Severity ?

CWE

Summary

Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution under certain microarchitecture-dependent conditions.

References

►

URL

Tags

	https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1037
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MYI3OMJ7RIZNL3C6GUWNANNPEUUID6FM/	vendor-advisory
	https://www.debian.org/security/2022/dsa-5207	vendor-advisory
	https://lists.debian.org/debian-lts-announce/2022/09/msg00011.html	mailing-list
	https://www.secpod.com/blog/retbleed-intel-and-amd-processor-information-disclosure-vulnerability/
	https://security.gentoo.org/glsa/202402-07	vendor-advisory

Impacted products

	Vendor	Product	Version
	AMD	AMD Processors	Version: Processor Some AMD Processors

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T06:33:43.145Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1037"
          },
          {
            "name": "FEDORA-2022-a0d7a5eaf2",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MYI3OMJ7RIZNL3C6GUWNANNPEUUID6FM/"
          },
          {
            "name": "DSA-5207",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5207"
          },
          {
            "name": "[debian-lts-announce] 20220911 [SECURITY] [DLA 3102-1] linux-5.10 new package",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00011.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.secpod.com/blog/retbleed-intel-and-amd-processor-information-disclosure-vulnerability/"
          },
          {
            "name": "GLSA-202402-07",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202402-07"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-29900",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-20T16:09:18.710200Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-20T16:13:31.449Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "AMD Processors",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "Processor  Some AMD Processors"
            }
          ]
        }
      ],
      "datePublic": "2022-07-12T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution under certain microarchitecture-dependent conditions."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "NA",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-02-04T08:06:53.374904",
        "orgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
        "shortName": "AMD"
      },
      "references": [
        {
          "url": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1037"
        },
        {
          "name": "FEDORA-2022-a0d7a5eaf2",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MYI3OMJ7RIZNL3C6GUWNANNPEUUID6FM/"
        },
        {
          "name": "DSA-5207",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2022/dsa-5207"
        },
        {
          "name": "[debian-lts-announce] 20220911 [SECURITY] [DLA 3102-1] linux-5.10 new package",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00011.html"
        },
        {
          "url": "https://www.secpod.com/blog/retbleed-intel-and-amd-processor-information-disclosure-vulnerability/"
        },
        {
          "name": "GLSA-202402-07",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202402-07"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
    "assignerShortName": "AMD",
    "cveId": "CVE-2022-29900",
    "datePublished": "2022-07-12T15:50:10.585306Z",
    "dateReserved": "2022-04-28T00:00:00",
    "dateUpdated": "2024-11-20T16:13:31.449Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-33740 (GCVE-0-2022-33740)

Vulnerability from cvelistv5

Published

2022-07-05 12:50

Modified

2024-08-03 08:09

Severity ?

CWE

unknown

Summary

Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740). Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend (CVE-2022-33741, CVE-2022-33742).

References

►

URL

Tags

	https://xenbits.xenproject.org/xsa/advisory-403.txt	x_refsource_MISC
	http://xenbits.xen.org/xsa/advisory-403.html	x_refsource_CONFIRM
	http://www.openwall.com/lists/oss-security/2022/07/05/6	mailing-list, x_refsource_MLIST
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IGFTRZ66KQYTSYIRT5FRHF5D6O72NWOP/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RKRXZ4LHGCGMOG24ZCEJNY6R2BTS4S2Q/	vendor-advisory, x_refsource_FEDORA
	https://www.debian.org/security/2022/dsa-5191	vendor-advisory, x_refsource_DEBIAN
	https://lists.debian.org/debian-lts-announce/2022/10/msg00000.html	mailing-list, x_refsource_MLIST

Impacted products

Vendor

Product

Version

►

Linux

Xen

xen

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T08:09:22.628Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://xenbits.xenproject.org/xsa/advisory-403.txt"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://xenbits.xen.org/xsa/advisory-403.html"
          },
          {
            "name": "[oss-security] 20220705 Xen Security Advisory 403 v3 (CVE-2022-26365,CVE-2022-33740,CVE-2022-33741,CVE-2022-33742) - Linux disk/nic frontends data leaks",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2022/07/05/6"
          },
          {
            "name": "FEDORA-2022-c4ec706488",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IGFTRZ66KQYTSYIRT5FRHF5D6O72NWOP/"
          },
          {
            "name": "FEDORA-2022-2c9f8224f8",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RKRXZ4LHGCGMOG24ZCEJNY6R2BTS4S2Q/"
          },
          {
            "name": "DSA-5191",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5191"
          },
          {
            "name": "[debian-lts-announce] 20221002 [SECURITY] [DLA 3131-1] linux security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2022/10/msg00000.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Linux",
          "vendor": "Linux",
          "versions": [
            {
              "status": "unknown",
              "version": "consult Xen advisory XSA-403"
            }
          ]
        },
        {
          "product": "xen",
          "vendor": "Xen",
          "versions": [
            {
              "status": "unknown",
              "version": "consult Xen advisory XSA-403"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "{\u0027credit_data\u0027: {\u0027description\u0027: {\u0027description_data\u0027: [{\u0027lang\u0027: \u0027eng\u0027, \u0027value\u0027: \u0027The issue related to not zeroing memory areas used for shared communications\\nwas discovered by Roger Pau Monn\u00e9 of Citrix.\\n\\nThe issue related to leaking contiguous data in granted pages was disclosed\\npublicly.\u0027}]}}}"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device frontends don\u0027t zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740). Additionally the granularity of the grant table doesn\u0027t allow sharing less than a 4K page, leading to unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend (CVE-2022-33741, CVE-2022-33742)."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "description": {
                "description_data": [
                  {
                    "lang": "eng",
                    "value": "An untrusted backend can access data not intended to be shared.  If such\nmappings are made with write permissions the backend could also cause\nmalfunctions and/or crashes to consumers of contiguous data in the shared\npages."
                  }
                ]
              }
            },
            "type": "unknown"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "unknown",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-10-02T18:06:12",
        "orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
        "shortName": "XEN"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://xenbits.xenproject.org/xsa/advisory-403.txt"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://xenbits.xen.org/xsa/advisory-403.html"
        },
        {
          "name": "[oss-security] 20220705 Xen Security Advisory 403 v3 (CVE-2022-26365,CVE-2022-33740,CVE-2022-33741,CVE-2022-33742) - Linux disk/nic frontends data leaks",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2022/07/05/6"
        },
        {
          "name": "FEDORA-2022-c4ec706488",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IGFTRZ66KQYTSYIRT5FRHF5D6O72NWOP/"
        },
        {
          "name": "FEDORA-2022-2c9f8224f8",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RKRXZ4LHGCGMOG24ZCEJNY6R2BTS4S2Q/"
        },
        {
          "name": "DSA-5191",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2022/dsa-5191"
        },
        {
          "name": "[debian-lts-announce] 20221002 [SECURITY] [DLA 3131-1] linux security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2022/10/msg00000.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@xen.org",
          "ID": "CVE-2022-33740",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Linux",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "?",
                            "version_value": "consult Xen advisory XSA-403"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Linux"
              },
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "xen",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "?",
                            "version_value": "consult Xen advisory XSA-403"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Xen"
              }
            ]
          }
        },
        "configuration": {
          "configuration_data": {
            "description": {
              "description_data": [
                {
                  "lang": "eng",
                  "value": "All Linux guests using PV devices are vulnerable in case potentially\nmalicious PV device backends are being used."
                }
              ]
            }
          }
        },
        "credit": {
          "credit_data": {
            "description": {
              "description_data": [
                {
                  "lang": "eng",
                  "value": "The issue related to not zeroing memory areas used for shared communications\nwas discovered by Roger Pau Monn\u00e9 of Citrix.\n\nThe issue related to leaking contiguous data in granted pages was disclosed\npublicly."
                }
              ]
            }
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device frontends don\u0027t zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740). Additionally the granularity of the grant table doesn\u0027t allow sharing less than a 4K page, leading to unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend (CVE-2022-33741, CVE-2022-33742)."
            }
          ]
        },
        "impact": {
          "impact_data": {
            "description": {
              "description_data": [
                {
                  "lang": "eng",
                  "value": "An untrusted backend can access data not intended to be shared.  If such\nmappings are made with write permissions the backend could also cause\nmalfunctions and/or crashes to consumers of contiguous data in the shared\npages."
                }
              ]
            }
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "unknown"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://xenbits.xenproject.org/xsa/advisory-403.txt",
              "refsource": "MISC",
              "url": "https://xenbits.xenproject.org/xsa/advisory-403.txt"
            },
            {
              "name": "http://xenbits.xen.org/xsa/advisory-403.html",
              "refsource": "CONFIRM",
              "url": "http://xenbits.xen.org/xsa/advisory-403.html"
            },
            {
              "name": "[oss-security] 20220705 Xen Security Advisory 403 v3 (CVE-2022-26365,CVE-2022-33740,CVE-2022-33741,CVE-2022-33742) - Linux disk/nic frontends data leaks",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2022/07/05/6"
            },
            {
              "name": "FEDORA-2022-c4ec706488",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IGFTRZ66KQYTSYIRT5FRHF5D6O72NWOP/"
            },
            {
              "name": "FEDORA-2022-2c9f8224f8",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RKRXZ4LHGCGMOG24ZCEJNY6R2BTS4S2Q/"
            },
            {
              "name": "DSA-5191",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2022/dsa-5191"
            },
            {
              "name": "[debian-lts-announce] 20221002 [SECURITY] [DLA 3131-1] linux security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2022/10/msg00000.html"
            }
          ]
        },
        "workaround": {
          "workaround_data": {
            "description": {
              "description_data": [
                {
                  "lang": "eng",
                  "value": "There is no mitigation available other than not using PV devices in case\na backend is suspected to be potentially malicious."
                }
              ]
            }
          }
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
    "assignerShortName": "XEN",
    "cveId": "CVE-2022-33740",
    "datePublished": "2022-07-05T12:50:30",
    "dateReserved": "2022-06-15T00:00:00",
    "dateUpdated": "2024-08-03T08:09:22.628Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-33742 (GCVE-0-2022-33742)

Vulnerability from cvelistv5

Published

2022-07-05 12:50

Modified

2024-08-03 08:09

Severity ?

CWE

unknown

Summary

References

►

URL

Tags

	https://xenbits.xenproject.org/xsa/advisory-403.txt	x_refsource_MISC
	http://xenbits.xen.org/xsa/advisory-403.html	x_refsource_CONFIRM
	http://www.openwall.com/lists/oss-security/2022/07/05/6	mailing-list, x_refsource_MLIST
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IGFTRZ66KQYTSYIRT5FRHF5D6O72NWOP/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RKRXZ4LHGCGMOG24ZCEJNY6R2BTS4S2Q/	vendor-advisory, x_refsource_FEDORA
	https://www.debian.org/security/2022/dsa-5191	vendor-advisory, x_refsource_DEBIAN
	https://lists.debian.org/debian-lts-announce/2022/10/msg00000.html	mailing-list, x_refsource_MLIST

Impacted products

Vendor

Product

Version

►

Linux

Xen

xen

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T08:09:22.683Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://xenbits.xenproject.org/xsa/advisory-403.txt"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://xenbits.xen.org/xsa/advisory-403.html"
          },
          {
            "name": "[oss-security] 20220705 Xen Security Advisory 403 v3 (CVE-2022-26365,CVE-2022-33740,CVE-2022-33741,CVE-2022-33742) - Linux disk/nic frontends data leaks",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2022/07/05/6"
          },
          {
            "name": "FEDORA-2022-c4ec706488",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IGFTRZ66KQYTSYIRT5FRHF5D6O72NWOP/"
          },
          {
            "name": "FEDORA-2022-2c9f8224f8",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RKRXZ4LHGCGMOG24ZCEJNY6R2BTS4S2Q/"
          },
          {
            "name": "DSA-5191",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5191"
          },
          {
            "name": "[debian-lts-announce] 20221002 [SECURITY] [DLA 3131-1] linux security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2022/10/msg00000.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Linux",
          "vendor": "Linux",
          "versions": [
            {
              "status": "unknown",
              "version": "consult Xen advisory XSA-403"
            }
          ]
        },
        {
          "product": "xen",
          "vendor": "Xen",
          "versions": [
            {
              "status": "unknown",
              "version": "consult Xen advisory XSA-403"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "{\u0027credit_data\u0027: {\u0027description\u0027: {\u0027description_data\u0027: [{\u0027lang\u0027: \u0027eng\u0027, \u0027value\u0027: \u0027The issue related to not zeroing memory areas used for shared communications\\nwas discovered by Roger Pau Monn\u00e9 of Citrix.\\n\\nThe issue related to leaking contiguous data in granted pages was disclosed\\npublicly.\u0027}]}}}"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device frontends don\u0027t zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740). Additionally the granularity of the grant table doesn\u0027t allow sharing less than a 4K page, leading to unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend (CVE-2022-33741, CVE-2022-33742)."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "description": {
                "description_data": [
                  {
                    "lang": "eng",
                    "value": "An untrusted backend can access data not intended to be shared.  If such\nmappings are made with write permissions the backend could also cause\nmalfunctions and/or crashes to consumers of contiguous data in the shared\npages."
                  }
                ]
              }
            },
            "type": "unknown"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "unknown",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-10-02T18:06:05",
        "orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
        "shortName": "XEN"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://xenbits.xenproject.org/xsa/advisory-403.txt"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://xenbits.xen.org/xsa/advisory-403.html"
        },
        {
          "name": "[oss-security] 20220705 Xen Security Advisory 403 v3 (CVE-2022-26365,CVE-2022-33740,CVE-2022-33741,CVE-2022-33742) - Linux disk/nic frontends data leaks",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2022/07/05/6"
        },
        {
          "name": "FEDORA-2022-c4ec706488",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IGFTRZ66KQYTSYIRT5FRHF5D6O72NWOP/"
        },
        {
          "name": "FEDORA-2022-2c9f8224f8",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RKRXZ4LHGCGMOG24ZCEJNY6R2BTS4S2Q/"
        },
        {
          "name": "DSA-5191",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2022/dsa-5191"
        },
        {
          "name": "[debian-lts-announce] 20221002 [SECURITY] [DLA 3131-1] linux security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2022/10/msg00000.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@xen.org",
          "ID": "CVE-2022-33742",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Linux",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "?",
                            "version_value": "consult Xen advisory XSA-403"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Linux"
              },
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "xen",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "?",
                            "version_value": "consult Xen advisory XSA-403"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Xen"
              }
            ]
          }
        },
        "configuration": {
          "configuration_data": {
            "description": {
              "description_data": [
                {
                  "lang": "eng",
                  "value": "All Linux guests using PV devices are vulnerable in case potentially\nmalicious PV device backends are being used."
                }
              ]
            }
          }
        },
        "credit": {
          "credit_data": {
            "description": {
              "description_data": [
                {
                  "lang": "eng",
                  "value": "The issue related to not zeroing memory areas used for shared communications\nwas discovered by Roger Pau Monn\u00e9 of Citrix.\n\nThe issue related to leaking contiguous data in granted pages was disclosed\npublicly."
                }
              ]
            }
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device frontends don\u0027t zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740). Additionally the granularity of the grant table doesn\u0027t allow sharing less than a 4K page, leading to unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend (CVE-2022-33741, CVE-2022-33742)."
            }
          ]
        },
        "impact": {
          "impact_data": {
            "description": {
              "description_data": [
                {
                  "lang": "eng",
                  "value": "An untrusted backend can access data not intended to be shared.  If such\nmappings are made with write permissions the backend could also cause\nmalfunctions and/or crashes to consumers of contiguous data in the shared\npages."
                }
              ]
            }
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "unknown"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://xenbits.xenproject.org/xsa/advisory-403.txt",
              "refsource": "MISC",
              "url": "https://xenbits.xenproject.org/xsa/advisory-403.txt"
            },
            {
              "name": "http://xenbits.xen.org/xsa/advisory-403.html",
              "refsource": "CONFIRM",
              "url": "http://xenbits.xen.org/xsa/advisory-403.html"
            },
            {
              "name": "[oss-security] 20220705 Xen Security Advisory 403 v3 (CVE-2022-26365,CVE-2022-33740,CVE-2022-33741,CVE-2022-33742) - Linux disk/nic frontends data leaks",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2022/07/05/6"
            },
            {
              "name": "FEDORA-2022-c4ec706488",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IGFTRZ66KQYTSYIRT5FRHF5D6O72NWOP/"
            },
            {
              "name": "FEDORA-2022-2c9f8224f8",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RKRXZ4LHGCGMOG24ZCEJNY6R2BTS4S2Q/"
            },
            {
              "name": "DSA-5191",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2022/dsa-5191"
            },
            {
              "name": "[debian-lts-announce] 20221002 [SECURITY] [DLA 3131-1] linux security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2022/10/msg00000.html"
            }
          ]
        },
        "workaround": {
          "workaround_data": {
            "description": {
              "description_data": [
                {
                  "lang": "eng",
                  "value": "There is no mitigation available other than not using PV devices in case\na backend is suspected to be potentially malicious."
                }
              ]
            }
          }
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
    "assignerShortName": "XEN",
    "cveId": "CVE-2022-33742",
    "datePublished": "2022-07-05T12:50:39",
    "dateReserved": "2022-06-15T00:00:00",
    "dateUpdated": "2024-08-03T08:09:22.683Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-4157 (GCVE-0-2021-4157)

Vulnerability from cvelistv5

Published

2022-03-25 18:02

Modified

2024-08-03 17:16

Severity ?

CWE

CWE-119

Summary

An out of memory bounds write flaw (1 or 2 bytes of memory) in the Linux kernel NFS subsystem was found in the way users use mirroring (replication of files with NFS). A user, having access to the NFS mount, could potentially use this flaw to crash the system or escalate privileges on the system.

References

►

URL

Tags

	https://bugzilla.redhat.com/show_bug.cgi?id=2034342	x_refsource_MISC
	https://lore.kernel.org/lkml/20210517140244.822185482%40linuxfoundation.org/	x_refsource_MISC
	https://www.oracle.com/security-alerts/cpujul2022.html	x_refsource_MISC
	https://security.netapp.com/advisory/ntap-20220602-0007/	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	n/a	kernel	Version: kernel 5.13-rc1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:16:04.290Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2034342"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://lore.kernel.org/lkml/20210517140244.822185482%40linuxfoundation.org/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20220602-0007/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "kernel",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "kernel 5.13-rc1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An out of memory bounds write flaw (1 or 2 bytes of memory) in the Linux kernel NFS subsystem was found in the way users use mirroring (replication of files with NFS). A user, having access to the NFS mount, could potentially use this flaw to crash the system or escalate privileges on the system."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-119",
              "description": "CWE-119",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-07-25T16:43:17",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2034342"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://lore.kernel.org/lkml/20210517140244.822185482%40linuxfoundation.org/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20220602-0007/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2021-4157",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "kernel",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "kernel 5.13-rc1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An out of memory bounds write flaw (1 or 2 bytes of memory) in the Linux kernel NFS subsystem was found in the way users use mirroring (replication of files with NFS). A user, having access to the NFS mount, could potentially use this flaw to crash the system or escalate privileges on the system."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-119"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=2034342",
              "refsource": "MISC",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2034342"
            },
            {
              "name": "https://lore.kernel.org/lkml/20210517140244.822185482@linuxfoundation.org/",
              "refsource": "MISC",
              "url": "https://lore.kernel.org/lkml/20210517140244.822185482@linuxfoundation.org/"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujul2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20220602-0007/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20220602-0007/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2021-4157",
    "datePublished": "2022-03-25T18:02:43",
    "dateReserved": "2021-12-22T00:00:00",
    "dateUpdated": "2024-08-03T17:16:04.290Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-1679 (GCVE-0-2022-1679)

Vulnerability from cvelistv5

Published

2022-05-16 00:00

Modified

2024-08-03 00:10

Severity ?

CWE

CWE-416

Summary

A use-after-free flaw was found in the Linux kernel’s Atheros wireless adapter driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages. This flaw allows a local user to crash or potentially escalate their privileges on the system.

References

►

URL

Tags

	https://lore.kernel.org/lkml/87ilqc7jv9.fsf%40kernel.org/t/
	https://security.netapp.com/advisory/ntap-20220629-0007/
	https://lists.debian.org/debian-lts-announce/2022/10/msg00000.html	mailing-list
	https://lists.debian.org/debian-lts-announce/2022/11/msg00001.html	mailing-list

Impacted products

	Vendor	Product	Version
	n/a	Kernel	Version: Linux kernel 5.18-rc7

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T00:10:03.805Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lore.kernel.org/lkml/87ilqc7jv9.fsf%40kernel.org/t/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20220629-0007/"
          },
          {
            "name": "[debian-lts-announce] 20221002 [SECURITY] [DLA 3131-1] linux security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2022/10/msg00000.html"
          },
          {
            "name": "[debian-lts-announce] 20221101 [SECURITY] [DLA 3173-1] linux-5.10 security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2022/11/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Kernel",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Linux kernel 5.18-rc7"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A use-after-free flaw was found in the Linux kernel\u2019s Atheros wireless adapter driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages. This flaw allows a local user to crash or potentially escalate their privileges on the system."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "CWE-416",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-11-01T00:00:00",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "url": "https://lore.kernel.org/lkml/87ilqc7jv9.fsf%40kernel.org/t/"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20220629-0007/"
        },
        {
          "name": "[debian-lts-announce] 20221002 [SECURITY] [DLA 3131-1] linux security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2022/10/msg00000.html"
        },
        {
          "name": "[debian-lts-announce] 20221101 [SECURITY] [DLA 3173-1] linux-5.10 security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2022/11/msg00001.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2022-1679",
    "datePublished": "2022-05-16T00:00:00",
    "dateReserved": "2022-05-12T00:00:00",
    "dateUpdated": "2024-08-03T00:10:03.805Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-2318 (GCVE-0-2022-2318)

Vulnerability from cvelistv5

Published

2022-07-06 00:00

Modified

2024-08-03 00:32

Severity ?

CWE

CWE-416

Summary

There are use-after-free vulnerabilities caused by timer handler in net/rose/rose_timer.c of linux that allow attackers to crash linux kernel without any privileges.

References

►

URL

Tags

	https://github.com/torvalds/linux/commit/9cc02ede696272c5271a401e4f27c262359bc2f6
	https://www.debian.org/security/2022/dsa-5191	vendor-advisory
	https://lists.debian.org/debian-lts-announce/2022/10/msg00000.html	mailing-list
	https://security.netapp.com/advisory/ntap-20230120-0001/

Impacted products

	Vendor	Product	Version
	n/a	Kernel	Version: Linux Kernel version prior to kernel 5.19 rc5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T00:32:09.627Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/torvalds/linux/commit/9cc02ede696272c5271a401e4f27c262359bc2f6"
          },
          {
            "name": "DSA-5191",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5191"
          },
          {
            "name": "[debian-lts-announce] 20221002 [SECURITY] [DLA 3131-1] linux security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2022/10/msg00000.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20230120-0001/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Kernel",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Linux Kernel version prior to kernel 5.19 rc5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "There are use-after-free vulnerabilities caused by timer handler in net/rose/rose_timer.c of linux that allow attackers to crash linux kernel without any privileges."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "CWE-416",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-01-20T00:00:00",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "url": "https://github.com/torvalds/linux/commit/9cc02ede696272c5271a401e4f27c262359bc2f6"
        },
        {
          "name": "DSA-5191",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2022/dsa-5191"
        },
        {
          "name": "[debian-lts-announce] 20221002 [SECURITY] [DLA 3131-1] linux security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2022/10/msg00000.html"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20230120-0001/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2022-2318",
    "datePublished": "2022-07-06T00:00:00",
    "dateReserved": "2022-07-05T00:00:00",
    "dateUpdated": "2024-08-03T00:32:09.627Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-20141 (GCVE-0-2022-20141)

Vulnerability from cvelistv5

Published

2022-06-15 13:02

Modified

2024-08-03 02:02

Severity ?

CWE

Elevation of privilege

Summary

In ip_check_mc_rcu of igmp.c, there is a possible use after free due to improper locking. This could lead to local escalation of privilege when opening and closing inet sockets with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-112551163References: Upstream kernel

References

►

URL

Tags

https://source.android.com/security/bulletin/2022-06-01

x_refsource_MISC

Impacted products

	Vendor	Product	Version
	n/a	Android	Version: Android kernel

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T02:02:30.853Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://source.android.com/security/bulletin/2022-06-01"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Android",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Android kernel"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In ip_check_mc_rcu of igmp.c, there is a possible use after free due to improper locking. This could lead to local escalation of privilege when opening and closing inet sockets with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-112551163References: Upstream kernel"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Elevation of privilege",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-06-15T13:02:23",
        "orgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
        "shortName": "google_android"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://source.android.com/security/bulletin/2022-06-01"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@android.com",
          "ID": "CVE-2022-20141",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Android",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Android kernel"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In ip_check_mc_rcu of igmp.c, there is a possible use after free due to improper locking. This could lead to local escalation of privilege when opening and closing inet sockets with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-112551163References: Upstream kernel"
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Elevation of privilege"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://source.android.com/security/bulletin/2022-06-01",
              "refsource": "MISC",
              "url": "https://source.android.com/security/bulletin/2022-06-01"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
    "assignerShortName": "google_android",
    "cveId": "CVE-2022-20141",
    "datePublished": "2022-06-15T13:02:23",
    "dateReserved": "2021-10-14T00:00:00",
    "dateUpdated": "2024-08-03T02:02:30.853Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-33741 (GCVE-0-2022-33741)

Vulnerability from cvelistv5

Published

2022-07-05 12:50

Modified

2024-08-03 08:09

Severity ?

CWE

unknown

Summary

References

►

URL

Tags

	https://xenbits.xenproject.org/xsa/advisory-403.txt	x_refsource_MISC
	http://xenbits.xen.org/xsa/advisory-403.html	x_refsource_CONFIRM
	http://www.openwall.com/lists/oss-security/2022/07/05/6	mailing-list, x_refsource_MLIST
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IGFTRZ66KQYTSYIRT5FRHF5D6O72NWOP/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RKRXZ4LHGCGMOG24ZCEJNY6R2BTS4S2Q/	vendor-advisory, x_refsource_FEDORA
	https://www.debian.org/security/2022/dsa-5191	vendor-advisory, x_refsource_DEBIAN
	https://lists.debian.org/debian-lts-announce/2022/10/msg00000.html	mailing-list, x_refsource_MLIST

Impacted products

Vendor

Product

Version

►

Linux

Xen

xen

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T08:09:22.659Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://xenbits.xenproject.org/xsa/advisory-403.txt"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://xenbits.xen.org/xsa/advisory-403.html"
          },
          {
            "name": "[oss-security] 20220705 Xen Security Advisory 403 v3 (CVE-2022-26365,CVE-2022-33740,CVE-2022-33741,CVE-2022-33742) - Linux disk/nic frontends data leaks",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2022/07/05/6"
          },
          {
            "name": "FEDORA-2022-c4ec706488",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IGFTRZ66KQYTSYIRT5FRHF5D6O72NWOP/"
          },
          {
            "name": "FEDORA-2022-2c9f8224f8",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RKRXZ4LHGCGMOG24ZCEJNY6R2BTS4S2Q/"
          },
          {
            "name": "DSA-5191",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5191"
          },
          {
            "name": "[debian-lts-announce] 20221002 [SECURITY] [DLA 3131-1] linux security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2022/10/msg00000.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Linux",
          "vendor": "Linux",
          "versions": [
            {
              "status": "unknown",
              "version": "consult Xen advisory XSA-403"
            }
          ]
        },
        {
          "product": "xen",
          "vendor": "Xen",
          "versions": [
            {
              "status": "unknown",
              "version": "consult Xen advisory XSA-403"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "{\u0027credit_data\u0027: {\u0027description\u0027: {\u0027description_data\u0027: [{\u0027lang\u0027: \u0027eng\u0027, \u0027value\u0027: \u0027The issue related to not zeroing memory areas used for shared communications\\nwas discovered by Roger Pau Monn\u00e9 of Citrix.\\n\\nThe issue related to leaking contiguous data in granted pages was disclosed\\npublicly.\u0027}]}}}"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device frontends don\u0027t zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740). Additionally the granularity of the grant table doesn\u0027t allow sharing less than a 4K page, leading to unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend (CVE-2022-33741, CVE-2022-33742)."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "description": {
                "description_data": [
                  {
                    "lang": "eng",
                    "value": "An untrusted backend can access data not intended to be shared.  If such\nmappings are made with write permissions the backend could also cause\nmalfunctions and/or crashes to consumers of contiguous data in the shared\npages."
                  }
                ]
              }
            },
            "type": "unknown"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "unknown",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-10-02T18:06:06",
        "orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
        "shortName": "XEN"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://xenbits.xenproject.org/xsa/advisory-403.txt"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://xenbits.xen.org/xsa/advisory-403.html"
        },
        {
          "name": "[oss-security] 20220705 Xen Security Advisory 403 v3 (CVE-2022-26365,CVE-2022-33740,CVE-2022-33741,CVE-2022-33742) - Linux disk/nic frontends data leaks",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2022/07/05/6"
        },
        {
          "name": "FEDORA-2022-c4ec706488",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IGFTRZ66KQYTSYIRT5FRHF5D6O72NWOP/"
        },
        {
          "name": "FEDORA-2022-2c9f8224f8",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RKRXZ4LHGCGMOG24ZCEJNY6R2BTS4S2Q/"
        },
        {
          "name": "DSA-5191",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2022/dsa-5191"
        },
        {
          "name": "[debian-lts-announce] 20221002 [SECURITY] [DLA 3131-1] linux security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2022/10/msg00000.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@xen.org",
          "ID": "CVE-2022-33741",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Linux",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "?",
                            "version_value": "consult Xen advisory XSA-403"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Linux"
              },
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "xen",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "?",
                            "version_value": "consult Xen advisory XSA-403"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Xen"
              }
            ]
          }
        },
        "configuration": {
          "configuration_data": {
            "description": {
              "description_data": [
                {
                  "lang": "eng",
                  "value": "All Linux guests using PV devices are vulnerable in case potentially\nmalicious PV device backends are being used."
                }
              ]
            }
          }
        },
        "credit": {
          "credit_data": {
            "description": {
              "description_data": [
                {
                  "lang": "eng",
                  "value": "The issue related to not zeroing memory areas used for shared communications\nwas discovered by Roger Pau Monn\u00e9 of Citrix.\n\nThe issue related to leaking contiguous data in granted pages was disclosed\npublicly."
                }
              ]
            }
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device frontends don\u0027t zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740). Additionally the granularity of the grant table doesn\u0027t allow sharing less than a 4K page, leading to unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend (CVE-2022-33741, CVE-2022-33742)."
            }
          ]
        },
        "impact": {
          "impact_data": {
            "description": {
              "description_data": [
                {
                  "lang": "eng",
                  "value": "An untrusted backend can access data not intended to be shared.  If such\nmappings are made with write permissions the backend could also cause\nmalfunctions and/or crashes to consumers of contiguous data in the shared\npages."
                }
              ]
            }
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "unknown"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://xenbits.xenproject.org/xsa/advisory-403.txt",
              "refsource": "MISC",
              "url": "https://xenbits.xenproject.org/xsa/advisory-403.txt"
            },
            {
              "name": "http://xenbits.xen.org/xsa/advisory-403.html",
              "refsource": "CONFIRM",
              "url": "http://xenbits.xen.org/xsa/advisory-403.html"
            },
            {
              "name": "[oss-security] 20220705 Xen Security Advisory 403 v3 (CVE-2022-26365,CVE-2022-33740,CVE-2022-33741,CVE-2022-33742) - Linux disk/nic frontends data leaks",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2022/07/05/6"
            },
            {
              "name": "FEDORA-2022-c4ec706488",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IGFTRZ66KQYTSYIRT5FRHF5D6O72NWOP/"
            },
            {
              "name": "FEDORA-2022-2c9f8224f8",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RKRXZ4LHGCGMOG24ZCEJNY6R2BTS4S2Q/"
            },
            {
              "name": "DSA-5191",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2022/dsa-5191"
            },
            {
              "name": "[debian-lts-announce] 20221002 [SECURITY] [DLA 3131-1] linux security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2022/10/msg00000.html"
            }
          ]
        },
        "workaround": {
          "workaround_data": {
            "description": {
              "description_data": [
                {
                  "lang": "eng",
                  "value": "There is no mitigation available other than not using PV devices in case\na backend is suspected to be potentially malicious."
                }
              ]
            }
          }
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
    "assignerShortName": "XEN",
    "cveId": "CVE-2022-33741",
    "datePublished": "2022-07-05T12:50:33",
    "dateReserved": "2022-06-15T00:00:00",
    "dateUpdated": "2024-08-03T08:09:22.659Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-33981 (GCVE-0-2022-33981)

Vulnerability from cvelistv5

Published

2022-06-18 15:27

Modified

2025-05-05 16:15

Severity ?

3.3 (Low) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

CWE

Summary

drivers/block/floppy.c in the Linux kernel before 5.17.6 is vulnerable to a denial of service, because of a concurrency use-after-free flaw after deallocating raw_cmd in the raw_cmd_ioctl function.

References

►

URL

Tags

	https://github.com/torvalds/linux/commit/233087ca063686964a53c829d547c7571e3f67bf	x_refsource_MISC
	https://exchange.xforce.ibmcloud.com/vulnerabilities/225362	x_refsource_MISC
	https://seclists.org/oss-sec/2022/q2/66	x_refsource_MISC
	https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.17.6	x_refsource_MISC
	https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html	mailing-list, x_refsource_MLIST
	https://www.debian.org/security/2022/dsa-5173	vendor-advisory, x_refsource_DEBIAN

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T08:16:16.278Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/torvalds/linux/commit/233087ca063686964a53c829d547c7571e3f67bf"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/225362"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://seclists.org/oss-sec/2022/q2/66"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.17.6"
          },
          {
            "name": "[debian-lts-announce] 20220701 [SECURITY] [DLA 3065-1] linux security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html"
          },
          {
            "name": "DSA-5173",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5173"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "LOW",
              "baseScore": 3.3,
              "baseSeverity": "LOW",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-33981",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-23T13:30:57.267052Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-05T16:15:03.996Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "drivers/block/floppy.c in the Linux kernel before 5.17.6 is vulnerable to a denial of service, because of a concurrency use-after-free flaw after deallocating raw_cmd in the raw_cmd_ioctl function."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-07-04T10:07:13.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/torvalds/linux/commit/233087ca063686964a53c829d547c7571e3f67bf"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/225362"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://seclists.org/oss-sec/2022/q2/66"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.17.6"
        },
        {
          "name": "[debian-lts-announce] 20220701 [SECURITY] [DLA 3065-1] linux security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html"
        },
        {
          "name": "DSA-5173",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2022/dsa-5173"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2022-33981",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "drivers/block/floppy.c in the Linux kernel before 5.17.6 is vulnerable to a denial of service, because of a concurrency use-after-free flaw after deallocating raw_cmd in the raw_cmd_ioctl function."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/torvalds/linux/commit/233087ca063686964a53c829d547c7571e3f67bf",
              "refsource": "MISC",
              "url": "https://github.com/torvalds/linux/commit/233087ca063686964a53c829d547c7571e3f67bf"
            },
            {
              "name": "https://exchange.xforce.ibmcloud.com/vulnerabilities/225362",
              "refsource": "MISC",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/225362"
            },
            {
              "name": "https://seclists.org/oss-sec/2022/q2/66",
              "refsource": "MISC",
              "url": "https://seclists.org/oss-sec/2022/q2/66"
            },
            {
              "name": "https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.17.6",
              "refsource": "MISC",
              "url": "https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.17.6"
            },
            {
              "name": "[debian-lts-announce] 20220701 [SECURITY] [DLA 3065-1] linux security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html"
            },
            {
              "name": "DSA-5173",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2022/dsa-5173"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2022-33981",
    "datePublished": "2022-06-18T15:27:32.000Z",
    "dateReserved": "2022-06-18T00:00:00.000Z",
    "dateUpdated": "2025-05-05T16:15:03.996Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-1012 (GCVE-0-2022-1012)

Vulnerability from cvelistv5

Published

2022-08-05 00:00

Modified

2024-08-02 23:47

Severity ?

CWE

CWE-401

Summary

A memory leak problem was found in the TCP source port generation algorithm in net/ipv4/tcp.c due to the small table perturb size. This flaw may allow an attacker to information leak and may cause a denial of service problem.

References

►

URL

Tags

	https://lore.kernel.org/lkml/20220427065233.2075-1-w%401wt.eu/T/
	https://bugzilla.redhat.com/show_bug.cgi?id=2064604
	https://security.netapp.com/advisory/ntap-20221020-0006/

Impacted products

	Vendor	Product	Version
	n/a	Kernel	Version: Linux kernel version prior to 5.18-rc6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T23:47:42.922Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lore.kernel.org/lkml/20220427065233.2075-1-w%401wt.eu/T/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2064604"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20221020-0006/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Kernel",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Linux kernel version prior to 5.18-rc6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A memory leak problem was found in the TCP source port generation algorithm in net/ipv4/tcp.c due to the small table perturb size. This flaw may allow an attacker to information leak and may cause a denial of service problem."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-401",
              "description": "CWE-401",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-10-20T00:00:00",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "url": "https://lore.kernel.org/lkml/20220427065233.2075-1-w%401wt.eu/T/"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2064604"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20221020-0006/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2022-1012",
    "datePublished": "2022-08-05T00:00:00",
    "dateReserved": "2022-03-17T00:00:00",
    "dateUpdated": "2024-08-02T23:47:42.922Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-26541 (GCVE-0-2020-26541)

Vulnerability from cvelistv5

Published

2020-10-02 18:14

Modified

2024-08-04 15:56

Severity ?

6.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

CWE

Summary

The Linux kernel through 5.8.13 does not properly enforce the Secure Boot Forbidden Signature Database (aka dbx) protection mechanism. This affects certs/blacklist.c and certs/system_keyring.c.

References

►

URL

Tags

https://lkml.org/lkml/2020/9/15/1871

x_refsource_MISC

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T15:56:04.670Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://lkml.org/lkml/2020/9/15/1871"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Linux kernel through 5.8.13 does not properly enforce the Secure Boot Forbidden Signature Database (aka dbx) protection mechanism. This affects certs/blacklist.c and certs/system_keyring.c."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AC:L/AV:L/A:H/C:H/I:H/PR:H/S:U/UI:R",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-10-02T18:14:22",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://lkml.org/lkml/2020/9/15/1871"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-26541",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Linux kernel through 5.8.13 does not properly enforce the Secure Boot Forbidden Signature Database (aka dbx) protection mechanism. This affects certs/blacklist.c and certs/system_keyring.c."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AC:L/AV:L/A:H/C:H/I:H/PR:H/S:U/UI:R",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://lkml.org/lkml/2020/9/15/1871",
              "refsource": "MISC",
              "url": "https://lkml.org/lkml/2020/9/15/1871"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-26541",
    "datePublished": "2020-10-02T18:14:22",
    "dateReserved": "2020-10-02T00:00:00",
    "dateUpdated": "2024-08-04T15:56:04.670Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-26365 (GCVE-0-2022-26365)

Vulnerability from cvelistv5

Published

2022-07-05 12:50

Modified

2024-08-03 05:03

Severity ?

CWE

unknown

Summary

References

►

URL

Tags

	https://xenbits.xenproject.org/xsa/advisory-403.txt	x_refsource_MISC
	http://xenbits.xen.org/xsa/advisory-403.html	x_refsource_CONFIRM
	http://www.openwall.com/lists/oss-security/2022/07/05/6	mailing-list, x_refsource_MLIST
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IGFTRZ66KQYTSYIRT5FRHF5D6O72NWOP/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RKRXZ4LHGCGMOG24ZCEJNY6R2BTS4S2Q/	vendor-advisory, x_refsource_FEDORA
	https://www.debian.org/security/2022/dsa-5191	vendor-advisory, x_refsource_DEBIAN
	https://lists.debian.org/debian-lts-announce/2022/10/msg00000.html	mailing-list, x_refsource_MLIST

Impacted products

Vendor

Product

Version

►

Linux

Xen

xen

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T05:03:32.784Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://xenbits.xenproject.org/xsa/advisory-403.txt"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://xenbits.xen.org/xsa/advisory-403.html"
          },
          {
            "name": "[oss-security] 20220705 Xen Security Advisory 403 v3 (CVE-2022-26365,CVE-2022-33740,CVE-2022-33741,CVE-2022-33742) - Linux disk/nic frontends data leaks",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2022/07/05/6"
          },
          {
            "name": "FEDORA-2022-c4ec706488",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IGFTRZ66KQYTSYIRT5FRHF5D6O72NWOP/"
          },
          {
            "name": "FEDORA-2022-2c9f8224f8",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RKRXZ4LHGCGMOG24ZCEJNY6R2BTS4S2Q/"
          },
          {
            "name": "DSA-5191",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5191"
          },
          {
            "name": "[debian-lts-announce] 20221002 [SECURITY] [DLA 3131-1] linux security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2022/10/msg00000.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Linux",
          "vendor": "Linux",
          "versions": [
            {
              "status": "unknown",
              "version": "consult Xen advisory XSA-403"
            }
          ]
        },
        {
          "product": "xen",
          "vendor": "Xen",
          "versions": [
            {
              "status": "unknown",
              "version": "consult Xen advisory XSA-403"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "{\u0027credit_data\u0027: {\u0027description\u0027: {\u0027description_data\u0027: [{\u0027lang\u0027: \u0027eng\u0027, \u0027value\u0027: \u0027The issue related to not zeroing memory areas used for shared communications\\nwas discovered by Roger Pau Monn\u00e9 of Citrix.\\n\\nThe issue related to leaking contiguous data in granted pages was disclosed\\npublicly.\u0027}]}}}"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device frontends don\u0027t zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740). Additionally the granularity of the grant table doesn\u0027t allow sharing less than a 4K page, leading to unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend (CVE-2022-33741, CVE-2022-33742)."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "description": {
                "description_data": [
                  {
                    "lang": "eng",
                    "value": "An untrusted backend can access data not intended to be shared.  If such\nmappings are made with write permissions the backend could also cause\nmalfunctions and/or crashes to consumers of contiguous data in the shared\npages."
                  }
                ]
              }
            },
            "type": "unknown"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "unknown",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-10-02T18:06:21",
        "orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
        "shortName": "XEN"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://xenbits.xenproject.org/xsa/advisory-403.txt"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://xenbits.xen.org/xsa/advisory-403.html"
        },
        {
          "name": "[oss-security] 20220705 Xen Security Advisory 403 v3 (CVE-2022-26365,CVE-2022-33740,CVE-2022-33741,CVE-2022-33742) - Linux disk/nic frontends data leaks",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2022/07/05/6"
        },
        {
          "name": "FEDORA-2022-c4ec706488",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IGFTRZ66KQYTSYIRT5FRHF5D6O72NWOP/"
        },
        {
          "name": "FEDORA-2022-2c9f8224f8",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RKRXZ4LHGCGMOG24ZCEJNY6R2BTS4S2Q/"
        },
        {
          "name": "DSA-5191",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2022/dsa-5191"
        },
        {
          "name": "[debian-lts-announce] 20221002 [SECURITY] [DLA 3131-1] linux security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2022/10/msg00000.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@xen.org",
          "ID": "CVE-2022-26365",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Linux",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "?",
                            "version_value": "consult Xen advisory XSA-403"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Linux"
              },
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "xen",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "?",
                            "version_value": "consult Xen advisory XSA-403"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Xen"
              }
            ]
          }
        },
        "configuration": {
          "configuration_data": {
            "description": {
              "description_data": [
                {
                  "lang": "eng",
                  "value": "All Linux guests using PV devices are vulnerable in case potentially\nmalicious PV device backends are being used."
                }
              ]
            }
          }
        },
        "credit": {
          "credit_data": {
            "description": {
              "description_data": [
                {
                  "lang": "eng",
                  "value": "The issue related to not zeroing memory areas used for shared communications\nwas discovered by Roger Pau Monn\u00e9 of Citrix.\n\nThe issue related to leaking contiguous data in granted pages was disclosed\npublicly."
                }
              ]
            }
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device frontends don\u0027t zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740). Additionally the granularity of the grant table doesn\u0027t allow sharing less than a 4K page, leading to unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend (CVE-2022-33741, CVE-2022-33742)."
            }
          ]
        },
        "impact": {
          "impact_data": {
            "description": {
              "description_data": [
                {
                  "lang": "eng",
                  "value": "An untrusted backend can access data not intended to be shared.  If such\nmappings are made with write permissions the backend could also cause\nmalfunctions and/or crashes to consumers of contiguous data in the shared\npages."
                }
              ]
            }
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "unknown"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://xenbits.xenproject.org/xsa/advisory-403.txt",
              "refsource": "MISC",
              "url": "https://xenbits.xenproject.org/xsa/advisory-403.txt"
            },
            {
              "name": "http://xenbits.xen.org/xsa/advisory-403.html",
              "refsource": "CONFIRM",
              "url": "http://xenbits.xen.org/xsa/advisory-403.html"
            },
            {
              "name": "[oss-security] 20220705 Xen Security Advisory 403 v3 (CVE-2022-26365,CVE-2022-33740,CVE-2022-33741,CVE-2022-33742) - Linux disk/nic frontends data leaks",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2022/07/05/6"
            },
            {
              "name": "FEDORA-2022-c4ec706488",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IGFTRZ66KQYTSYIRT5FRHF5D6O72NWOP/"
            },
            {
              "name": "FEDORA-2022-2c9f8224f8",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RKRXZ4LHGCGMOG24ZCEJNY6R2BTS4S2Q/"
            },
            {
              "name": "DSA-5191",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2022/dsa-5191"
            },
            {
              "name": "[debian-lts-announce] 20221002 [SECURITY] [DLA 3131-1] linux security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2022/10/msg00000.html"
            }
          ]
        },
        "workaround": {
          "workaround_data": {
            "description": {
              "description_data": [
                {
                  "lang": "eng",
                  "value": "There is no mitigation available other than not using PV devices in case\na backend is suspected to be potentially malicious."
                }
              ]
            }
          }
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
    "assignerShortName": "XEN",
    "cveId": "CVE-2022-26365",
    "datePublished": "2022-07-05T12:50:28",
    "dateReserved": "2022-03-02T00:00:00",
    "dateUpdated": "2024-08-03T05:03:32.784Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-29901 (GCVE-0-2022-29901)

Vulnerability from cvelistv5

Published

2022-07-12 00:00

Modified

2024-08-03 06:33

Severity ?

5.6 (Medium) - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

CWE

CWE-200 - Information Exposure

Summary

Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can hijack return instructions to achieve arbitrary speculative code execution under certain microarchitecture-dependent conditions.

References

►

URL

Tags

	https://comsec.ethz.ch/retbleed
	https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00702.html
	http://www.openwall.com/lists/oss-security/2022/07/12/2	mailing-list
	http://www.openwall.com/lists/oss-security/2022/07/12/4	mailing-list
	http://www.openwall.com/lists/oss-security/2022/07/12/5	mailing-list
	http://www.openwall.com/lists/oss-security/2022/07/13/1	mailing-list
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M27MB3QFNIJV4EQQSXWARHP3OGX6CR6K/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D4RW5FCIYFNCQOEFJEUIRW3DGYW7CWBG/	vendor-advisory
	https://www.debian.org/security/2022/dsa-5207	vendor-advisory
	https://lists.debian.org/debian-lts-announce/2022/09/msg00011.html	mailing-list
	https://security.netapp.com/advisory/ntap-20221007-0007/
	https://lists.debian.org/debian-lts-announce/2022/12/msg00034.html	mailing-list
	https://www.secpod.com/blog/retbleed-intel-and-amd-processor-information-disclosure-vulnerability/
	https://security.gentoo.org/glsa/202402-07	vendor-advisory

Impacted products

	Vendor	Product	Version
	Intel	Intel Microprocessors	Version: generations 6 to 8

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T06:33:43.000Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://comsec.ethz.ch/retbleed"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00702.html"
          },
          {
            "name": "[oss-security] 20220712 Xen Security Advisory 407 v1 (CVE-2022-23816,CVE-2022-23825,CVE-2022-29900) - Retbleed - arbitrary speculative code execution with return instructions",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2022/07/12/2"
          },
          {
            "name": "[oss-security] 20220712 Re: Xen Security Advisory 407 v1 (CVE-2022-23816,CVE-2022-23825,CVE-2022-29900) - Retbleed - arbitrary speculative code execution with return instructions",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2022/07/12/4"
          },
          {
            "name": "[oss-security] 20220712 Re: Xen Security Advisory 407 v1 (CVE-2022-23816,CVE-2022-23825,CVE-2022-29900) - Retbleed - arbitrary speculative code execution with return instructions",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2022/07/12/5"
          },
          {
            "name": "[oss-security] 20220713 Re: Xen Security Advisory 407 v1 (CVE-2022-23816,CVE-2022-23825,CVE-2022-29900) - Retbleed - arbitrary speculative code execution with return instructions",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2022/07/13/1"
          },
          {
            "name": "FEDORA-2022-c69ef9c1dd",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M27MB3QFNIJV4EQQSXWARHP3OGX6CR6K/"
          },
          {
            "name": "FEDORA-2022-8aab5b5cde",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D4RW5FCIYFNCQOEFJEUIRW3DGYW7CWBG/"
          },
          {
            "name": "DSA-5207",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5207"
          },
          {
            "name": "[debian-lts-announce] 20220911 [SECURITY] [DLA 3102-1] linux-5.10 new package",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00011.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20221007-0007/"
          },
          {
            "name": "[debian-lts-announce] 20221223 [SECURITY] [DLA 3245-1] linux security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00034.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.secpod.com/blog/retbleed-intel-and-amd-processor-information-disclosure-vulnerability/"
          },
          {
            "name": "GLSA-202402-07",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202402-07"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Intel Microprocessors",
          "vendor": "Intel",
          "versions": [
            {
              "status": "affected",
              "version": "generations 6 to 8"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Johannes Wikner - ETH Z\u00fcrich"
        },
        {
          "lang": "en",
          "value": "Kaveh Razavi - ETH Z\u00fcrich"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can hijack return instructions to achieve arbitrary speculative code execution under certain microarchitecture-dependent conditions."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200 Information Exposure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-02-04T08:06:41.365488",
        "orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
        "shortName": "intel"
      },
      "references": [
        {
          "url": "https://comsec.ethz.ch/retbleed"
        },
        {
          "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00702.html"
        },
        {
          "name": "[oss-security] 20220712 Xen Security Advisory 407 v1 (CVE-2022-23816,CVE-2022-23825,CVE-2022-29900) - Retbleed - arbitrary speculative code execution with return instructions",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2022/07/12/2"
        },
        {
          "name": "[oss-security] 20220712 Re: Xen Security Advisory 407 v1 (CVE-2022-23816,CVE-2022-23825,CVE-2022-29900) - Retbleed - arbitrary speculative code execution with return instructions",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2022/07/12/4"
        },
        {
          "name": "[oss-security] 20220712 Re: Xen Security Advisory 407 v1 (CVE-2022-23816,CVE-2022-23825,CVE-2022-29900) - Retbleed - arbitrary speculative code execution with return instructions",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2022/07/12/5"
        },
        {
          "name": "[oss-security] 20220713 Re: Xen Security Advisory 407 v1 (CVE-2022-23816,CVE-2022-23825,CVE-2022-29900) - Retbleed - arbitrary speculative code execution with return instructions",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2022/07/13/1"
        },
        {
          "name": "FEDORA-2022-c69ef9c1dd",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M27MB3QFNIJV4EQQSXWARHP3OGX6CR6K/"
        },
        {
          "name": "FEDORA-2022-8aab5b5cde",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D4RW5FCIYFNCQOEFJEUIRW3DGYW7CWBG/"
        },
        {
          "name": "DSA-5207",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2022/dsa-5207"
        },
        {
          "name": "[debian-lts-announce] 20220911 [SECURITY] [DLA 3102-1] linux-5.10 new package",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00011.html"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20221007-0007/"
        },
        {
          "name": "[debian-lts-announce] 20221223 [SECURITY] [DLA 3245-1] linux security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00034.html"
        },
        {
          "url": "https://www.secpod.com/blog/retbleed-intel-and-amd-processor-information-disclosure-vulnerability/"
        },
        {
          "name": "GLSA-202402-07",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202402-07"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Arbitrary Memory Disclosure through CPU Side-Channel Attacks (Retbleed)",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
    "assignerShortName": "intel",
    "cveId": "CVE-2022-29901",
    "datePublished": "2022-07-12T00:00:00",
    "dateReserved": "2022-04-28T00:00:00",
    "dateUpdated": "2024-08-03T06:33:43.000Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-20154 (GCVE-0-2022-20154)

Vulnerability from cvelistv5

Published

2022-06-15 13:18

Modified

2024-08-03 02:02

Severity ?

CWE

Elevation of privilege

Summary

In lock_sock_nested of sock.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-174846563References: Upstream kernel

References

►

URL

Tags

https://source.android.com/security/bulletin/pixel/2022-06-01

x_refsource_MISC

Impacted products

	Vendor	Product	Version
	n/a	Android	Version: Android kernel

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T02:02:30.971Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://source.android.com/security/bulletin/pixel/2022-06-01"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Android",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Android kernel"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In lock_sock_nested of sock.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-174846563References: Upstream kernel"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Elevation of privilege",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-06-15T13:18:55",
        "orgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
        "shortName": "google_android"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://source.android.com/security/bulletin/pixel/2022-06-01"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@android.com",
          "ID": "CVE-2022-20154",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Android",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Android kernel"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In lock_sock_nested of sock.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-174846563References: Upstream kernel"
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Elevation of privilege"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://source.android.com/security/bulletin/pixel/2022-06-01",
              "refsource": "MISC",
              "url": "https://source.android.com/security/bulletin/pixel/2022-06-01"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
    "assignerShortName": "google_android",
    "cveId": "CVE-2022-20154",
    "datePublished": "2022-06-15T13:18:55",
    "dateReserved": "2021-10-14T00:00:00",
    "dateUpdated": "2024-08-03T02:02:30.971Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-20132 (GCVE-0-2022-20132)

Vulnerability from cvelistv5

Published

2022-06-15 13:00

Modified

2024-08-03 02:02

Severity ?

CWE

Information disclosure

Summary

In lg_probe and related functions of hid-lg.c and other USB HID files, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure if a malicious USB HID device were plugged in, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-188677105References: Upstream kernel

References

►

URL

Tags

https://source.android.com/security/bulletin/2022-06-01

x_refsource_MISC

Impacted products

	Vendor	Product	Version
	n/a	Android	Version: Android kernel

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T02:02:30.662Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://source.android.com/security/bulletin/2022-06-01"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Android",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Android kernel"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In lg_probe and related functions of hid-lg.c and other USB HID files, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure if a malicious USB HID device were plugged in, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-188677105References: Upstream kernel"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Information disclosure",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-06-15T13:00:51",
        "orgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
        "shortName": "google_android"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://source.android.com/security/bulletin/2022-06-01"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@android.com",
          "ID": "CVE-2022-20132",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Android",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Android kernel"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In lg_probe and related functions of hid-lg.c and other USB HID files, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure if a malicious USB HID device were plugged in, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-188677105References: Upstream kernel"
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Information disclosure"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://source.android.com/security/bulletin/2022-06-01",
              "refsource": "MISC",
              "url": "https://source.android.com/security/bulletin/2022-06-01"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
    "assignerShortName": "google_android",
    "cveId": "CVE-2022-20132",
    "datePublished": "2022-06-15T13:00:51",
    "dateReserved": "2021-10-14T00:00:00",
    "dateUpdated": "2024-08-03T02:02:30.662Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

suse-su-2022:2377-1

Vulnerability from csaf_suse

CVE-2022-29900 (GCVE-0-2022-29900)

Vulnerability from cvelistv5

CVE-2022-33740 (GCVE-0-2022-33740)

Vulnerability from cvelistv5

CVE-2022-33742 (GCVE-0-2022-33742)

Vulnerability from cvelistv5

CVE-2021-4157 (GCVE-0-2021-4157)

Vulnerability from cvelistv5

CVE-2022-1679 (GCVE-0-2022-1679)

Vulnerability from cvelistv5

CVE-2022-2318 (GCVE-0-2022-2318)

Vulnerability from cvelistv5

CVE-2022-20141 (GCVE-0-2022-20141)

Vulnerability from cvelistv5

CVE-2022-33741 (GCVE-0-2022-33741)

Vulnerability from cvelistv5

CVE-2022-33981 (GCVE-0-2022-33981)

Vulnerability from cvelistv5

CVE-2022-1012 (GCVE-0-2022-1012)

Vulnerability from cvelistv5

CVE-2020-26541 (GCVE-0-2020-26541)

Vulnerability from cvelistv5

CVE-2022-26365 (GCVE-0-2022-26365)

Vulnerability from cvelistv5

CVE-2022-29901 (GCVE-0-2022-29901)

Vulnerability from cvelistv5

CVE-2022-20154 (GCVE-0-2022-20154)

Vulnerability from cvelistv5

CVE-2022-20132 (GCVE-0-2022-20132)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature