1195612 – (CVE-2022-24448) VUL-0: CVE-2022-24448: kernel-source,kernel-source-rt,kernel-source-azure: nfs_atomic_open() returns uninitialized data instead of ENOTDIR

Bug 1195612 (CVE-2022-24448) - VUL-0: CVE-2022-24448: kernel-source,kernel-source-rt,kernel-source-azure: nfs_atomic_open() returns uninitialized data instead of ENOTDIR

Summary: VUL-0: CVE-2022-24448: kernel-source,kernel-source-rt,kernel-source-azure: nf...

Status:	RESOLVED FIXED

Alias:	CVE-2022-24448

Product:	SUSE Security Incidents
Classification:	Novell Products
Component:	Incidents (show other bugs)
Version:	unspecified
Hardware:	Other Other

Priority:	P4 - Low Severity: Minor
Target Milestone:	---
Assignee:	Security Team bot
QA Contact:	Security Team bot

URL:	https://smash.suse.de/issue/322734/
Whiteboard:	CVSSv3.1:SUSE:CVE-2022-24448:5.5:(AV:...
Keywords:

Depends on:
Blocks:

Clone This Bug

Reported:	2022-02-07 07:46 UTC by Robert Frohl
Modified:	2024-06-25 16:37 UTC (History)
CC List:	5 users (show)

See Also:
Found By:	Security Response Team
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Robert Frohl 2022-02-07 07:46:55 UTC

CVE-2022-24448

An issue was discovered in fs/nfs/dir.c in the Linux kernel before 5.16.5. If an
application sets the O_DIRECTORY flag, and tries to open a regular file,
nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR
should occur, but the server instead returns uninitialized data in the file
descriptor.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-24448
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24448
https://github.com/torvalds/linux/commit/ac795161c93699d600db16c1a8cc23a65a1eceaf
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ac795161c93699d600db16c1a8cc23a65a1eceaf
https://www.spinics.net/lists/stable/msg531976.html
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.5

Comment 1 Robert Frohl 2022-02-07 09:50:00 UTC

ac795161c93699d600db16c1a8cc23a65a1eceaf:
> Fixes: 0dd2b47 ("nfs: implement i_op->atomic_open()")

issue introduced upstream with v3.6, will be fixed with v5.17.

Tracking as affected for SLE-12-SP2 till SLE-15-SP4 (4.4, 4.12, 5.3 and 5.14)

Comment 8 Swamp Workflow Management 2022-02-22 20:20:48 UTC

SUSE-SU-2022:0555-1: An update that solves 16 vulnerabilities and has 31 fixes is now available.

Category: security (critical)
Bug References: 1065729,1071995,1082555,1163405,1177599,1183405,1184209,1185377,1186207,1186222,1187428,1187723,1188605,1190973,1192729,1193096,1193234,1193235,1193242,1193507,1193660,1193669,1193727,1193767,1193861,1193864,1193867,1193927,1194001,1194027,1194048,1194227,1194302,1194410,1194493,1194516,1194529,1194814,1194880,1194888,1194965,1194985,1195065,1195073,1195254,1195272,1195612
CVE References: CVE-2020-28097,CVE-2021-3564,CVE-2021-39648,CVE-2021-39657,CVE-2021-4083,CVE-2021-4135,CVE-2021-4149,CVE-2021-4197,CVE-2021-4202,CVE-2021-44733,CVE-2021-45095,CVE-2022-0322,CVE-2022-0330,CVE-2022-0435,CVE-2022-22942,CVE-2022-24448
JIRA References: 
Sources used:
SUSE Linux Enterprise Real Time Extension 12-SP5 (src):    kernel-rt-4.12.14-10.78.1, kernel-rt_debug-4.12.14-10.78.1, kernel-source-rt-4.12.14-10.78.1, kernel-syms-rt-4.12.14-10.78.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 25 Swamp Workflow Management 2022-03-08 23:24:40 UTC

SUSE-SU-2022:0762-1: An update that solves 7 vulnerabilities and has 5 fixes is now available.

Category: security (important)
Bug References: 1146312,1185973,1191580,1193731,1194463,1195536,1195543,1195612,1195908,1195939,1196079,1196612
CVE References: CVE-2016-10905,CVE-2021-0920,CVE-2022-0001,CVE-2022-0002,CVE-2022-0492,CVE-2022-0617,CVE-2022-24448
JIRA References: 
Sources used:
SUSE OpenStack Cloud Crowbar 8 (src):    kernel-default-4.4.180-94.156.1, kernel-source-4.4.180-94.156.1, kernel-syms-4.4.180-94.156.1, kgraft-patch-SLE12-SP3_Update_43-1-4.3.1
SUSE OpenStack Cloud 8 (src):    kernel-default-4.4.180-94.156.1, kernel-source-4.4.180-94.156.1, kernel-syms-4.4.180-94.156.1, kgraft-patch-SLE12-SP3_Update_43-1-4.3.1
SUSE Linux Enterprise Server for SAP 12-SP3 (src):    kernel-default-4.4.180-94.156.1, kernel-source-4.4.180-94.156.1, kernel-syms-4.4.180-94.156.1, kgraft-patch-SLE12-SP3_Update_43-1-4.3.1
SUSE Linux Enterprise Server 12-SP3-LTSS (src):    kernel-default-4.4.180-94.156.1, kernel-source-4.4.180-94.156.1, kernel-syms-4.4.180-94.156.1, kgraft-patch-SLE12-SP3_Update_43-1-4.3.1
SUSE Linux Enterprise Server 12-SP3-BCL (src):    kernel-default-4.4.180-94.156.1, kernel-source-4.4.180-94.156.1, kernel-syms-4.4.180-94.156.1
SUSE Linux Enterprise High Availability 12-SP3 (src):    kernel-default-4.4.180-94.156.1
HPE Helion Openstack 8 (src):    kernel-default-4.4.180-94.156.1, kernel-source-4.4.180-94.156.1, kernel-syms-4.4.180-94.156.1, kgraft-patch-SLE12-SP3_Update_43-1-4.3.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 26 Swamp Workflow Management 2022-03-08 23:31:29 UTC

SUSE-SU-2022:0759-1: An update that solves 14 vulnerabilities, contains one feature and has 12 fixes is now available.

Category: security (important)
Bug References: 1189126,1191580,1192483,1194516,1195254,1195286,1195516,1195543,1195612,1195701,1195897,1195905,1195908,1195947,1195949,1195987,1195995,1196079,1196095,1196132,1196155,1196235,1196584,1196601,1196612,1196776
CVE References: CVE-2021-44879,CVE-2022-0001,CVE-2022-0002,CVE-2022-0487,CVE-2022-0492,CVE-2022-0516,CVE-2022-0617,CVE-2022-0644,CVE-2022-0847,CVE-2022-24448,CVE-2022-24958,CVE-2022-24959,CVE-2022-25258,CVE-2022-25375
JIRA References: SLE-23652
Sources used:
SUSE Manager Server 4.1 (src):    kernel-default-5.3.18-24.107.1, kernel-default-base-5.3.18-24.107.1.9.50.2, kernel-docs-5.3.18-24.107.1, kernel-obs-build-5.3.18-24.107.1, kernel-preempt-5.3.18-24.107.1, kernel-source-5.3.18-24.107.1, kernel-syms-5.3.18-24.107.1
SUSE Manager Retail Branch Server 4.1 (src):    kernel-default-5.3.18-24.107.1, kernel-default-base-5.3.18-24.107.1.9.50.2, kernel-docs-5.3.18-24.107.1, kernel-preempt-5.3.18-24.107.1, kernel-source-5.3.18-24.107.1, kernel-syms-5.3.18-24.107.1
SUSE Manager Proxy 4.1 (src):    kernel-default-5.3.18-24.107.1, kernel-default-base-5.3.18-24.107.1.9.50.2, kernel-docs-5.3.18-24.107.1, kernel-preempt-5.3.18-24.107.1, kernel-source-5.3.18-24.107.1, kernel-syms-5.3.18-24.107.1
SUSE Linux Enterprise Server for SAP 15-SP2 (src):    kernel-default-5.3.18-24.107.1, kernel-default-base-5.3.18-24.107.1.9.50.2, kernel-docs-5.3.18-24.107.1, kernel-obs-build-5.3.18-24.107.1, kernel-preempt-5.3.18-24.107.1, kernel-source-5.3.18-24.107.1, kernel-syms-5.3.18-24.107.1
SUSE Linux Enterprise Server 15-SP2-LTSS (src):    kernel-default-5.3.18-24.107.1, kernel-default-base-5.3.18-24.107.1.9.50.2, kernel-docs-5.3.18-24.107.1, kernel-obs-build-5.3.18-24.107.1, kernel-preempt-5.3.18-24.107.1, kernel-source-5.3.18-24.107.1, kernel-syms-5.3.18-24.107.1
SUSE Linux Enterprise Server 15-SP2-BCL (src):    kernel-default-5.3.18-24.107.1, kernel-default-base-5.3.18-24.107.1.9.50.2, kernel-docs-5.3.18-24.107.1, kernel-preempt-5.3.18-24.107.1, kernel-source-5.3.18-24.107.1, kernel-syms-5.3.18-24.107.1
SUSE Linux Enterprise Realtime Extension 15-SP2 (src):    kernel-default-5.3.18-24.107.1, kernel-default-base-5.3.18-24.107.1.9.50.2, kernel-docs-5.3.18-24.107.1, kernel-preempt-5.3.18-24.107.1, kernel-source-5.3.18-24.107.1, kernel-syms-5.3.18-24.107.1
SUSE Linux Enterprise Module for Live Patching 15-SP2 (src):    kernel-default-5.3.18-24.107.1, kernel-livepatch-SLE15-SP2_Update_25-1-5.5.1
SUSE Linux Enterprise Micro 5.0 (src):    kernel-default-5.3.18-24.107.1, kernel-default-base-5.3.18-24.107.1.9.50.2
SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (src):    kernel-default-5.3.18-24.107.1, kernel-default-base-5.3.18-24.107.1.9.50.2, kernel-docs-5.3.18-24.107.1, kernel-obs-build-5.3.18-24.107.1, kernel-preempt-5.3.18-24.107.1, kernel-source-5.3.18-24.107.1, kernel-syms-5.3.18-24.107.1
SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (src):    kernel-default-5.3.18-24.107.1, kernel-default-base-5.3.18-24.107.1.9.50.2, kernel-docs-5.3.18-24.107.1, kernel-obs-build-5.3.18-24.107.1, kernel-preempt-5.3.18-24.107.1, kernel-source-5.3.18-24.107.1, kernel-syms-5.3.18-24.107.1
SUSE Linux Enterprise High Availability 15-SP2 (src):    kernel-default-5.3.18-24.107.1
SUSE Enterprise Storage 7 (src):    kernel-default-5.3.18-24.107.1, kernel-default-base-5.3.18-24.107.1.9.50.2, kernel-docs-5.3.18-24.107.1, kernel-obs-build-5.3.18-24.107.1, kernel-preempt-5.3.18-24.107.1, kernel-source-5.3.18-24.107.1, kernel-syms-5.3.18-24.107.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 27 Swamp Workflow Management 2022-03-08 23:40:18 UTC

SUSE-SU-2022:0766-1: An update that solves 9 vulnerabilities and has 7 fixes is now available.

Category: security (important)
Bug References: 1107207,1185973,1191580,1194516,1195536,1195543,1195612,1195840,1195897,1195908,1195949,1195987,1196079,1196155,1196584,1196612
CVE References: CVE-2021-44879,CVE-2022-0001,CVE-2022-0002,CVE-2022-0487,CVE-2022-0492,CVE-2022-0617,CVE-2022-0644,CVE-2022-24448,CVE-2022-24959
JIRA References: 
Sources used:
SUSE Linux Enterprise Server for SAP 15 (src):    kernel-default-4.12.14-150.86.1, kernel-docs-4.12.14-150.86.1, kernel-obs-build-4.12.14-150.86.1, kernel-source-4.12.14-150.86.1, kernel-syms-4.12.14-150.86.1, kernel-vanilla-4.12.14-150.86.1
SUSE Linux Enterprise Server 15-LTSS (src):    kernel-default-4.12.14-150.86.1, kernel-docs-4.12.14-150.86.1, kernel-obs-build-4.12.14-150.86.1, kernel-source-4.12.14-150.86.1, kernel-syms-4.12.14-150.86.1, kernel-vanilla-4.12.14-150.86.1, kernel-zfcpdump-4.12.14-150.86.1
SUSE Linux Enterprise Module for Live Patching 15 (src):    kernel-default-4.12.14-150.86.1, kernel-livepatch-SLE15_Update_28-1-1.3.1
SUSE Linux Enterprise High Performance Computing 15-LTSS (src):    kernel-default-4.12.14-150.86.1, kernel-docs-4.12.14-150.86.1, kernel-obs-build-4.12.14-150.86.1, kernel-source-4.12.14-150.86.1, kernel-syms-4.12.14-150.86.1, kernel-vanilla-4.12.14-150.86.1
SUSE Linux Enterprise High Performance Computing 15-ESPOS (src):    kernel-default-4.12.14-150.86.1, kernel-docs-4.12.14-150.86.1, kernel-obs-build-4.12.14-150.86.1, kernel-source-4.12.14-150.86.1, kernel-syms-4.12.14-150.86.1, kernel-vanilla-4.12.14-150.86.1
SUSE Linux Enterprise High Availability 15 (src):    kernel-default-4.12.14-150.86.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 28 Swamp Workflow Management 2022-03-08 23:48:28 UTC

SUSE-SU-2022:0768-1: An update that solves 9 vulnerabilities and has 6 fixes is now available.

Category: security (important)
Bug References: 1185973,1191580,1194516,1195536,1195543,1195612,1195840,1195897,1195908,1195949,1195987,1196079,1196155,1196584,1196612
CVE References: CVE-2021-44879,CVE-2022-0001,CVE-2022-0002,CVE-2022-0487,CVE-2022-0492,CVE-2022-0617,CVE-2022-0644,CVE-2022-24448,CVE-2022-24959
JIRA References: 
Sources used:
SUSE Linux Enterprise Server for SAP 15-SP1 (src):    kernel-default-4.12.14-197.108.1, kernel-docs-4.12.14-197.108.1, kernel-obs-build-4.12.14-197.108.1, kernel-source-4.12.14-197.108.1, kernel-syms-4.12.14-197.108.1
SUSE Linux Enterprise Server 15-SP1-LTSS (src):    kernel-default-4.12.14-197.108.1, kernel-docs-4.12.14-197.108.1, kernel-obs-build-4.12.14-197.108.1, kernel-source-4.12.14-197.108.1, kernel-syms-4.12.14-197.108.1, kernel-zfcpdump-4.12.14-197.108.1
SUSE Linux Enterprise Server 15-SP1-BCL (src):    kernel-default-4.12.14-197.108.1, kernel-docs-4.12.14-197.108.1, kernel-obs-build-4.12.14-197.108.1, kernel-source-4.12.14-197.108.1, kernel-syms-4.12.14-197.108.1
SUSE Linux Enterprise Module for Live Patching 15-SP1 (src):    kernel-default-4.12.14-197.108.1, kernel-livepatch-SLE15-SP1_Update_29-1-3.3.1
SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src):    kernel-default-4.12.14-197.108.1, kernel-docs-4.12.14-197.108.1, kernel-obs-build-4.12.14-197.108.1, kernel-source-4.12.14-197.108.1, kernel-syms-4.12.14-197.108.1
SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (src):    kernel-default-4.12.14-197.108.1, kernel-docs-4.12.14-197.108.1, kernel-obs-build-4.12.14-197.108.1, kernel-source-4.12.14-197.108.1, kernel-syms-4.12.14-197.108.1
SUSE Linux Enterprise High Availability 15-SP1 (src):    kernel-default-4.12.14-197.108.1
SUSE Enterprise Storage 6 (src):    kernel-default-4.12.14-197.108.1, kernel-docs-4.12.14-197.108.1, kernel-obs-build-4.12.14-197.108.1, kernel-source-4.12.14-197.108.1, kernel-syms-4.12.14-197.108.1
SUSE CaaS Platform 4.0 (src):    kernel-default-4.12.14-197.108.1, kernel-docs-4.12.14-197.108.1, kernel-obs-build-4.12.14-197.108.1, kernel-source-4.12.14-197.108.1, kernel-syms-4.12.14-197.108.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 29 Swamp Workflow Management 2022-03-08 23:52:16 UTC

openSUSE-SU-2022:0768-1: An update that solves 9 vulnerabilities and has 6 fixes is now available.

Category: security (important)
Bug References: 1185973,1191580,1194516,1195536,1195543,1195612,1195840,1195897,1195908,1195949,1195987,1196079,1196155,1196584,1196612
CVE References: CVE-2021-44879,CVE-2022-0001,CVE-2022-0002,CVE-2022-0487,CVE-2022-0492,CVE-2022-0617,CVE-2022-0644,CVE-2022-24448,CVE-2022-24959
JIRA References: 
Sources used:
openSUSE Leap 15.4 (src):    kernel-debug-4.12.14-197.108.1, kernel-default-4.12.14-197.108.1, kernel-kvmsmall-4.12.14-197.108.1, kernel-vanilla-4.12.14-197.108.1, kernel-zfcpdump-4.12.14-197.108.1
openSUSE Leap 15.3 (src):    kernel-debug-4.12.14-197.108.1, kernel-default-4.12.14-197.108.1, kernel-kvmsmall-4.12.14-197.108.1, kernel-vanilla-4.12.14-197.108.1, kernel-zfcpdump-4.12.14-197.108.1

Comment 30 Swamp Workflow Management 2022-03-09 00:09:46 UTC

SUSE-SU-2022:0767-1: An update that solves 10 vulnerabilities, contains one feature and has 50 fixes is now available.

Category: security (important)
Bug References: 1046306,1050244,1089644,1094978,1097583,1097584,1097585,1097586,1097587,1097588,1101674,1101816,1103991,1109837,1111981,1112374,1114648,1114685,1114893,1117495,1118661,1119113,1136460,1136461,1157038,1157923,1158533,1174852,1185377,1185973,1187716,1189126,1191271,1191580,1191655,1193857,1193867,1194048,1194516,1195080,1195377,1195536,1195543,1195612,1195638,1195795,1195823,1195840,1195897,1195908,1195934,1195949,1195987,1195995,1196079,1196155,1196400,1196516,1196584,1196612
CVE References: CVE-2021-44879,CVE-2021-45095,CVE-2022-0001,CVE-2022-0002,CVE-2022-0487,CVE-2022-0492,CVE-2022-0617,CVE-2022-0644,CVE-2022-24448,CVE-2022-24959
JIRA References: SLE-20809
Sources used:
SUSE Linux Enterprise Workstation Extension 12-SP5 (src):    kernel-default-4.12.14-122.113.1
SUSE Linux Enterprise Software Development Kit 12-SP5 (src):    kernel-docs-4.12.14-122.113.1, kernel-obs-build-4.12.14-122.113.1
SUSE Linux Enterprise Server 12-SP5 (src):    kernel-default-4.12.14-122.113.1, kernel-source-4.12.14-122.113.1, kernel-syms-4.12.14-122.113.1
SUSE Linux Enterprise Live Patching 12-SP5 (src):    kernel-default-4.12.14-122.113.1, kgraft-patch-SLE12-SP5_Update_29-1-8.3.1
SUSE Linux Enterprise High Availability 12-SP5 (src):    kernel-default-4.12.14-122.113.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 31 Swamp Workflow Management 2022-03-09 00:16:05 UTC

SUSE-SU-2022:0765-1: An update that solves 10 vulnerabilities, contains one feature and has 50 fixes is now available.

Category: security (important)
Bug References: 1046306,1050244,1089644,1094978,1097583,1097584,1097585,1097586,1097587,1097588,1101674,1101816,1103991,1109837,1111981,1112374,1114648,1114685,1114893,1117495,1118661,1119113,1136460,1136461,1157038,1157923,1158533,1174852,1185377,1185973,1187716,1189126,1191271,1191580,1191655,1193857,1193867,1194048,1194516,1195080,1195377,1195536,1195543,1195612,1195638,1195795,1195823,1195840,1195897,1195908,1195934,1195949,1195987,1195995,1196079,1196155,1196400,1196516,1196584,1196612
CVE References: CVE-2021-44879,CVE-2021-45095,CVE-2022-0001,CVE-2022-0002,CVE-2022-0487,CVE-2022-0492,CVE-2022-0617,CVE-2022-0644,CVE-2022-24448,CVE-2022-24959
JIRA References: SLE-20809
Sources used:
SUSE Linux Enterprise Server 12-SP5 (src):    kernel-azure-4.12.14-16.91.1, kernel-source-azure-4.12.14-16.91.1, kernel-syms-azure-4.12.14-16.91.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 32 Swamp Workflow Management 2022-03-09 00:18:48 UTC

SUSE-SU-2022:0756-1: An update that solves 7 vulnerabilities and has four fixes is now available.

Category: security (important)
Bug References: 1146312,1190717,1191580,1193731,1194463,1195543,1195612,1195908,1195939,1196079,1196612
CVE References: CVE-2016-10905,CVE-2021-0920,CVE-2022-0001,CVE-2022-0002,CVE-2022-0492,CVE-2022-0617,CVE-2022-24448
JIRA References: 
Sources used:
SUSE Linux Enterprise Server 12-SP2-BCL (src):    kernel-default-4.4.121-92.169.1, kernel-source-4.4.121-92.169.1, kernel-syms-4.4.121-92.169.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 33 Swamp Workflow Management 2022-03-09 00:20:41 UTC

SUSE-SU-2022:0757-1: An update that solves 10 vulnerabilities and has 9 fixes is now available.

Category: security (important)
Bug References: 1107207,1114893,1185973,1191580,1194516,1195536,1195543,1195612,1195840,1195897,1195908,1195934,1195949,1195987,1196079,1196155,1196584,1196601,1196612
CVE References: CVE-2021-44879,CVE-2022-0001,CVE-2022-0002,CVE-2022-0487,CVE-2022-0492,CVE-2022-0617,CVE-2022-0644,CVE-2022-0847,CVE-2022-24448,CVE-2022-24959
JIRA References: 
Sources used:
SUSE OpenStack Cloud Crowbar 9 (src):    kernel-default-4.12.14-95.93.1, kernel-source-4.12.14-95.93.1, kernel-syms-4.12.14-95.93.1
SUSE OpenStack Cloud 9 (src):    kernel-default-4.12.14-95.93.1, kernel-source-4.12.14-95.93.1, kernel-syms-4.12.14-95.93.1
SUSE Linux Enterprise Server for SAP 12-SP4 (src):    kernel-default-4.12.14-95.93.1, kernel-source-4.12.14-95.93.1, kernel-syms-4.12.14-95.93.1
SUSE Linux Enterprise Server 12-SP4-LTSS (src):    kernel-default-4.12.14-95.93.1, kernel-source-4.12.14-95.93.1, kernel-syms-4.12.14-95.93.1
SUSE Linux Enterprise Live Patching 12-SP4 (src):    kernel-default-4.12.14-95.93.1, kgraft-patch-SLE12-SP4_Update_25-1-6.5.1
SUSE Linux Enterprise High Availability 12-SP4 (src):    kernel-default-4.12.14-95.93.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 41 Swamp Workflow Management 2022-03-30 13:20:17 UTC

SUSE-SU-2022:1039-1: An update that solves 22 vulnerabilities and has 22 fixes is now available.

Category: security (important)
Bug References: 1176447,1176774,1178134,1179439,1181147,1191428,1192273,1193731,1193787,1193864,1194463,1194516,1194943,1195051,1195211,1195254,1195353,1195403,1195612,1195897,1195905,1195939,1195949,1195987,1196079,1196095,1196130,1196132,1196155,1196299,1196301,1196433,1196468,1196472,1196488,1196627,1196723,1196779,1196830,1196836,1196866,1196868,1196956,1196959
CVE References: CVE-2021-0920,CVE-2021-39657,CVE-2021-39698,CVE-2021-44879,CVE-2021-45402,CVE-2022-0487,CVE-2022-0617,CVE-2022-0644,CVE-2022-23036,CVE-2022-23037,CVE-2022-23038,CVE-2022-23039,CVE-2022-23040,CVE-2022-23041,CVE-2022-23042,CVE-2022-24448,CVE-2022-24958,CVE-2022-24959,CVE-2022-25258,CVE-2022-25636,CVE-2022-26490,CVE-2022-26966
JIRA References: 
Sources used:
SUSE Linux Enterprise Workstation Extension 15-SP3 (src):    kernel-default-5.3.18-150300.59.60.4, kernel-preempt-5.3.18-150300.59.60.4
SUSE Linux Enterprise Module for Live Patching 15-SP3 (src):    kernel-default-5.3.18-150300.59.60.4, kernel-livepatch-SLE15-SP3_Update_16-1-150300.7.5.3
SUSE Linux Enterprise Module for Legacy Software 15-SP3 (src):    kernel-default-5.3.18-150300.59.60.4
SUSE Linux Enterprise Module for Development Tools 15-SP3 (src):    kernel-docs-5.3.18-150300.59.60.4, kernel-obs-build-5.3.18-150300.59.60.4, kernel-preempt-5.3.18-150300.59.60.4, kernel-source-5.3.18-150300.59.60.4, kernel-syms-5.3.18-150300.59.60.4
SUSE Linux Enterprise Module for Basesystem 15-SP3 (src):    kernel-64kb-5.3.18-150300.59.60.4, kernel-default-5.3.18-150300.59.60.4, kernel-default-base-5.3.18-150300.59.60.4.150300.18.37.5, kernel-preempt-5.3.18-150300.59.60.4, kernel-source-5.3.18-150300.59.60.4, kernel-zfcpdump-5.3.18-150300.59.60.4
SUSE Linux Enterprise Micro 5.1 (src):    kernel-default-5.3.18-150300.59.60.4, kernel-default-base-5.3.18-150300.59.60.4.150300.18.37.5
SUSE Linux Enterprise High Availability 15-SP3 (src):    kernel-default-5.3.18-150300.59.60.4

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 42 Swamp Workflow Management 2022-03-30 13:24:53 UTC

SUSE-SU-2022:1038-1: An update that solves 24 vulnerabilities and has 17 fixes is now available.

Category: security (important)
Bug References: 1176447,1176774,1178134,1179439,1181147,1191428,1192273,1193787,1194516,1194943,1195051,1195211,1195353,1195403,1195516,1195612,1195897,1195908,1195947,1195949,1195987,1196079,1196095,1196130,1196155,1196299,1196301,1196403,1196468,1196472,1196488,1196627,1196723,1196776,1196779,1196830,1196866,1196868,1197300,922815,998635
CVE References: CVE-2021-0920,CVE-2021-39698,CVE-2021-44879,CVE-2021-45402,CVE-2022-0487,CVE-2022-0492,CVE-2022-0516,CVE-2022-0617,CVE-2022-0644,CVE-2022-23036,CVE-2022-23037,CVE-2022-23038,CVE-2022-23039,CVE-2022-23040,CVE-2022-23041,CVE-2022-23042,CVE-2022-24448,CVE-2022-24958,CVE-2022-24959,CVE-2022-25258,CVE-2022-25636,CVE-2022-26490,CVE-2022-26966,CVE-2022-27223
JIRA References: 
Sources used:
SUSE Linux Enterprise Module for Realtime 15-SP3 (src):    kernel-rt-5.3.18-150300.82.1, kernel-rt_debug-5.3.18-150300.82.1, kernel-source-rt-5.3.18-150300.82.1, kernel-syms-rt-5.3.18-150300.82.1
SUSE Linux Enterprise Micro 5.1 (src):    kernel-rt-5.3.18-150300.82.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 43 Swamp Workflow Management 2022-03-30 13:31:10 UTC

openSUSE-SU-2022:1039-1: An update that solves 22 vulnerabilities and has 22 fixes is now available.

Category: security (important)
Bug References: 1176447,1176774,1178134,1179439,1181147,1191428,1192273,1193731,1193787,1193864,1194463,1194516,1194943,1195051,1195211,1195254,1195353,1195403,1195612,1195897,1195905,1195939,1195949,1195987,1196079,1196095,1196130,1196132,1196155,1196299,1196301,1196433,1196468,1196472,1196488,1196627,1196723,1196779,1196830,1196836,1196866,1196868,1196956,1196959
CVE References: CVE-2021-0920,CVE-2021-39657,CVE-2021-39698,CVE-2021-44879,CVE-2021-45402,CVE-2022-0487,CVE-2022-0617,CVE-2022-0644,CVE-2022-23036,CVE-2022-23037,CVE-2022-23038,CVE-2022-23039,CVE-2022-23040,CVE-2022-23041,CVE-2022-23042,CVE-2022-24448,CVE-2022-24958,CVE-2022-24959,CVE-2022-25258,CVE-2022-25636,CVE-2022-26490,CVE-2022-26966
JIRA References: 
Sources used:
openSUSE Leap 15.4 (src):    dtb-aarch64-5.3.18-150300.59.60.4, kernel-preempt-5.3.18-150300.59.60.4
openSUSE Leap 15.3 (src):    dtb-aarch64-5.3.18-150300.59.60.4, kernel-64kb-5.3.18-150300.59.60.4, kernel-debug-5.3.18-150300.59.60.4, kernel-default-5.3.18-150300.59.60.4, kernel-default-base-5.3.18-150300.59.60.4.150300.18.37.5, kernel-docs-5.3.18-150300.59.60.4, kernel-kvmsmall-5.3.18-150300.59.60.4, kernel-obs-build-5.3.18-150300.59.60.4, kernel-obs-qa-5.3.18-150300.59.60.4, kernel-preempt-5.3.18-150300.59.60.4, kernel-source-5.3.18-150300.59.60.4, kernel-syms-5.3.18-150300.59.60.4, kernel-zfcpdump-5.3.18-150300.59.60.4

Comment 44 Swamp Workflow Management 2022-03-30 13:35:18 UTC

openSUSE-SU-2022:1037-1: An update that solves 12 vulnerabilities and has 25 fixes is now available.

Category: security (important)
Bug References: 1176447,1176774,1178134,1179439,1181147,1191428,1192273,1193731,1193787,1193864,1194463,1194516,1195211,1195254,1195403,1195612,1195897,1195905,1195939,1195949,1195987,1196079,1196095,1196132,1196155,1196299,1196301,1196433,1196468,1196472,1196627,1196723,1196779,1196830,1196836,1196866,1196868
CVE References: CVE-2021-0920,CVE-2021-39657,CVE-2021-44879,CVE-2022-0487,CVE-2022-0617,CVE-2022-0644,CVE-2022-24448,CVE-2022-24958,CVE-2022-24959,CVE-2022-25258,CVE-2022-25636,CVE-2022-26490
JIRA References: 
Sources used:
openSUSE Leap 15.3 (src):    kernel-azure-5.3.18-150300.38.50.1, kernel-source-azure-5.3.18-150300.38.50.1, kernel-syms-azure-5.3.18-150300.38.50.1

Comment 45 Swamp Workflow Management 2022-03-30 13:39:55 UTC

SUSE-SU-2022:1037-1: An update that solves 12 vulnerabilities and has 25 fixes is now available.

Category: security (important)
Bug References: 1176447,1176774,1178134,1179439,1181147,1191428,1192273,1193731,1193787,1193864,1194463,1194516,1195211,1195254,1195403,1195612,1195897,1195905,1195939,1195949,1195987,1196079,1196095,1196132,1196155,1196299,1196301,1196433,1196468,1196472,1196627,1196723,1196779,1196830,1196836,1196866,1196868
CVE References: CVE-2021-0920,CVE-2021-39657,CVE-2021-44879,CVE-2022-0487,CVE-2022-0617,CVE-2022-0644,CVE-2022-24448,CVE-2022-24958,CVE-2022-24959,CVE-2022-25258,CVE-2022-25636,CVE-2022-26490
JIRA References: 
Sources used:
SUSE Linux Enterprise Module for Public Cloud 15-SP3 (src):    kernel-azure-5.3.18-150300.38.50.1, kernel-source-azure-5.3.18-150300.38.50.1, kernel-syms-azure-5.3.18-150300.38.50.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 47 Swamp Workflow Management 2022-04-19 13:23:36 UTC

SUSE-SU-2022:1257-1: An update that solves 33 vulnerabilities, contains one feature and has 9 fixes is now available.

Category: security (important)
Bug References: 1179639,1189126,1189562,1193731,1194516,1194943,1195051,1195254,1195286,1195353,1195403,1195516,1195543,1195612,1195897,1195905,1195939,1195987,1196018,1196079,1196095,1196155,1196196,1196235,1196468,1196488,1196612,1196761,1196776,1196823,1196830,1196836,1196956,1197227,1197331,1197366,1197389,1197462,1197702,1198031,1198032,1198033
CVE References: CVE-2021-0920,CVE-2021-39698,CVE-2021-44879,CVE-2021-45868,CVE-2022-0487,CVE-2022-0492,CVE-2022-0516,CVE-2022-0617,CVE-2022-0644,CVE-2022-0850,CVE-2022-0854,CVE-2022-1016,CVE-2022-1048,CVE-2022-1055,CVE-2022-23036,CVE-2022-23037,CVE-2022-23038,CVE-2022-23039,CVE-2022-23040,CVE-2022-23041,CVE-2022-23042,CVE-2022-24448,CVE-2022-24958,CVE-2022-24959,CVE-2022-25258,CVE-2022-25375,CVE-2022-26490,CVE-2022-26966,CVE-2022-27666,CVE-2022-28388,CVE-2022-28389,CVE-2022-28390,CVE-2022-28748
JIRA References: SLE-23652
Sources used:
SUSE Linux Enterprise Module for Realtime 15-SP2 (src):    kernel-rt-5.3.18-150200.79.2, kernel-rt_debug-5.3.18-150200.79.2, kernel-source-rt-5.3.18-150200.79.2, kernel-syms-rt-5.3.18-150200.79.1
SUSE Linux Enterprise Micro 5.0 (src):    kernel-rt-5.3.18-150200.79.2

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 48 Karasulli 2022-04-25 12:56:27 UTC

(In reply to Robert Frohl from comment #1)
> ac795161c93699d600db16c1a8cc23a65a1eceaf:
> > Fixes: 0dd2b47 ("nfs: implement i_op->atomic_open()")
> 
> issue introduced upstream with v3.6, will be fixed with v5.17.
> 
> Tracking as affected for SLE-12-SP2 till SLE-15-SP4 (4.4, 4.12, 5.3 and 5.14)

Applied to branches cve/4.4, cve/4.12, cve/5.3 and SLE-15-SP4

Comment 49 Neil Brown 2022-04-26 00:29:06 UTC

You need
 Commit 1751fc1db36f ("NFSv4: nfs_atomic_open() can race when looking up a non-regular file")

to complete the fix - it adds a test that should have been in the patch you backported.

Comment 50 Karasulli 2022-05-11 13:21:44 UTC

(In reply to Neil Brown from comment #49)
> You need
>  Commit 1751fc1db36f ("NFSv4: nfs_atomic_open() can race when looking up a
> non-regular file")
> 
> to complete the fix - it adds a test that should have been in the patch you
> backported.

Added this patch to cve/4.4, cve/4.12, cve/5.3.

SLE15-SP4 already contains this patch.

Comment 51 Takashi Iwai 2022-05-11 13:23:41 UTC

(In reply to Karasulli from comment #50)
> (In reply to Neil Brown from comment #49)
> > You need
> >  Commit 1751fc1db36f ("NFSv4: nfs_atomic_open() can race when looking up a
> > non-regular file")
> > 
> > to complete the fix - it adds a test that should have been in the patch you
> > backported.
> 
> Added this patch to cve/4.4, cve/4.12, cve/5.3.
> 
> SLE15-SP4 already contains this patch.

For already existing patch, don't forget to update the patch references.

Comment 52 Karasulli 2022-05-11 13:32:40 UTC

(In reply to Takashi Iwai from comment #51)
> (In reply to Karasulli from comment #50)
> > (In reply to Neil Brown from comment #49)
> > > You need
> > >  Commit 1751fc1db36f ("NFSv4: nfs_atomic_open() can race when looking up a
> > > non-regular file")
> > > 
> > > to complete the fix - it adds a test that should have been in the patch you
> > > backported.
> > 
> > Added this patch to cve/4.4, cve/4.12, cve/5.3.
> > 
> > SLE15-SP4 already contains this patch.
> 
> For already existing patch, don't forget to update the patch references.

Yes, updated the patch reference.

Comment 71 Swamp Workflow Management 2022-06-14 22:21:26 UTC

SUSE-SU-2022:2080-1: An update that solves 18 vulnerabilities and has 27 fixes is now available.

Category: security (important)
Bug References: 1024718,1055117,1061840,1065729,1129770,1158266,1162338,1162369,1173871,1188885,1194124,1195612,1195651,1196426,1196570,1197219,1197601,1198438,1198577,1198899,1198989,1199035,1199063,1199237,1199239,1199314,1199399,1199426,1199505,1199507,1199526,1199602,1199605,1199606,1199631,1199650,1199671,1199839,1200015,1200045,1200057,1200143,1200144,1200173,1200249
CVE References: CVE-2019-19377,CVE-2021-33061,CVE-2021-39711,CVE-2022-1184,CVE-2022-1652,CVE-2022-1729,CVE-2022-1734,CVE-2022-1966,CVE-2022-1974,CVE-2022-1975,CVE-2022-21123,CVE-2022-21125,CVE-2022-21127,CVE-2022-21166,CVE-2022-21180,CVE-2022-21499,CVE-2022-24448,CVE-2022-30594
JIRA References: 
Sources used:
SUSE Linux Enterprise Server 12-SP5 (src):    kernel-azure-4.12.14-16.100.2, kernel-source-azure-4.12.14-16.100.1, kernel-syms-azure-4.12.14-16.100.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 72 Swamp Workflow Management 2022-06-14 22:31:12 UTC

SUSE-SU-2022:2079-1: An update that solves 15 vulnerabilities, contains two features and has 36 fixes is now available.

Category: security (important)
Bug References: 1055117,1061840,1065729,1103269,1118212,1152472,1152489,1153274,1154353,1156395,1158266,1167773,1176447,1178134,1180100,1183405,1188885,1195612,1195651,1195826,1196426,1196478,1196570,1196840,1197446,1197472,1197601,1197675,1198438,1198534,1198577,1198971,1198989,1199035,1199052,1199063,1199114,1199314,1199505,1199507,1199564,1199626,1199631,1199650,1199670,1199839,1200019,1200045,1200046,1200192,1200216
CVE References: CVE-2019-19377,CVE-2021-33061,CVE-2022-0168,CVE-2022-1184,CVE-2022-1652,CVE-2022-1729,CVE-2022-1972,CVE-2022-20008,CVE-2022-21123,CVE-2022-21125,CVE-2022-21127,CVE-2022-21166,CVE-2022-21180,CVE-2022-24448,CVE-2022-30594
JIRA References: SLE-13521,SLE-16387
Sources used:
openSUSE Leap 15.3 (src):    kernel-azure-5.3.18-150300.38.59.1, kernel-source-azure-5.3.18-150300.38.59.1, kernel-syms-azure-5.3.18-150300.38.59.1
SUSE Linux Enterprise Module for Public Cloud 15-SP3 (src):    kernel-azure-5.3.18-150300.38.59.1, kernel-source-azure-5.3.18-150300.38.59.1, kernel-syms-azure-5.3.18-150300.38.59.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 94 Andrea Mattiazzo 2024-05-20 10:15:21 UTC

All done, closing.