Bug 1203389 (CVE-2022-3202) - VUL-0: CVE-2022-3202: kernel: jfs: Null Pointer Deference in jfs_evict_inode leads to Denial of Service
Summary: VUL-0: CVE-2022-3202: kernel: jfs: Null Pointer Deference in jfs_evict_inode ...
Status: RESOLVED FIXED
Alias: CVE-2022-3202
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Minor
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/342199/
Whiteboard: CVSSv3.1:SUSE:CVE-2022-3202:6.3:(AV:L...
Keywords:
Depends on:
Blocks:
 
Reported: 2022-09-14 07:00 UTC by Robert Frohl
Modified: 2024-06-25 17:05 UTC (History)
2 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Robert Frohl 2022-09-14 07:00:21 UTC 
rh#2126423

A NULL pointer dereference flaw in diFree in fs/jfs/inode.c in Journaled File System (JFS)in the Linux kernel. This could allow a local attacker to crash the system or leak kernel internal information.

The following is the crash information:

BUG: kernel NULL pointer dereference, address: 0000000000000004
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 162c13067 P4D 162c13067 PUD 15f0f4067 PMD 0 
Oops: 0000 [#1] PREEMPT SMP
CPU: 0 PID: 6659 Comm: syz-executor348 Not tainted 5.17.0-rc4+ #5
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014
RIP: 0010:diFree+0x1d1/0x4330 build/../fs/jfs/jfs_imap.c:871
..
Call Trace:
 <TASK>
 jfs_evict_inode+0x605/0x6b0 build/../fs/jfs/inode.c:155
 evict+0x4f4/0xdd0 build/../fs/inode.c:664
 iput_final build/../fs/inode.c:1744 [inline]
 iput+0xc53/0x1100 build/../fs/inode.c:1770
 diFreeSpecial+0xec/0x1b0 build/../fs/jfs/jfs_imap.c:548
 jfs_mount+0xd1c/0x12c0 build/../fs/jfs/jfs_mount.c:191
 jfs_fill_super+0x76d/0x1670 build/../fs/jfs/super.c:560
 mount_bdev+0x626/0x920 build/../fs/super.c:1367
 jfs_do_mount+0xc9/0xe0 build/../fs/jfs/super.c:674
 legacy_get_tree+0x163/0x2e0 build/../fs/fs_context.c:610
 vfs_get_tree+0xd8/0x5d0 build/../fs/super.c:1497
 do_new_mount+0x7b5/0x16f0 build/../fs/namespace.c:2994
 path_mount+0x100d/0x27a0 build/../fs/namespace.c:3324
 do_mount build/../fs/namespace.c:3337 [inline]
 __do_sys_mount build/../fs/namespace.c:3545 [inline]
 __se_sys_mount+0x8a8/0x9d0 build/../fs/namespace.c:3522
 __x64_sys_mount+0x15d/0x1b0 build/../fs/namespace.c:3522
 do_syscall_x64 build/../arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x54/0xd0 build/../arch/x86/entry/common.c:82
 entry_SYSCALL_64_after_hwframe+0x44/0xae

Reference:
https://github.com/torvalds/linux/commit/a53046291020ec41e09181396c1e829287b48d47

References:
https://bugzilla.redhat.com/show_bug.cgi?id=2126423
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-3202
Comment 2 Robert Frohl 2022-09-14 08:36:05 UTC 
tracking as affected for SLE15-SP3 and SLE15-SP4
Comment 4 Anthony Iliopoulos 2022-09-14 09:42:41 UTC 
We don't support JFS in any of our active product branches. For SLE15-SP{3,4}, the module is being built but only shipped in kernel-modules-optional package, which is only released in opensuse leap. Even there, the module is blacklisted, so it will not load by default (exactly because the filesystem hasn't really been supported for a very long time).

I'll check if it makes sense to backport the following two:

commit 9d574f985fe3 ("jfs: fix GPF in diFree")
commit a53046291020 ("jfs: prevent NULL deref in diFree")

so that this is available to leap users that may explicitly load the jfs module.
Comment 8 Anthony Iliopoulos 2022-09-21 16:29:06 UTC 
The fixes are now merged into SLE15-SP3 and pending merging into SLE15-SP4. Handing over to security.

Please note as per comment #4 and comment #7, this isn't applicable to any SLE release.
Comment 17 Swamp Workflow Management 2022-10-14 13:24:07 UTC 
SUSE-SU-2022:3585-1: An update that solves 9 vulnerabilities, contains 12 features and has 38 fixes is now available.

Category: security (important)
Bug References: 1152472,1152489,1185032,1190497,1194023,1194869,1195917,1196444,1196869,1197659,1198189,1200622,1201309,1201310,1201987,1202095,1202960,1203039,1203066,1203101,1203197,1203263,1203338,1203360,1203361,1203389,1203410,1203505,1203552,1203664,1203693,1203699,1203701,1203767,1203769,1203794,1203798,1203893,1203902,1203906,1203908,1203933,1203935,1203939,1203969,1203987,1203992
CVE References: CVE-2022-1263,CVE-2022-2586,CVE-2022-3202,CVE-2022-3239,CVE-2022-3303,CVE-2022-39189,CVE-2022-41218,CVE-2022-41848,CVE-2022-41849
JIRA References: PED-387,PED-529,PED-652,PED-664,PED-682,PED-688,PED-720,PED-729,PED-755,PED-763,SLE-19924,SLE-24814
Sources used:
openSUSE Leap 15.4 (src):    kernel-azure-5.14.21-150400.14.16.1, kernel-source-azure-5.14.21-150400.14.16.1, kernel-syms-azure-5.14.21-150400.14.16.1
SUSE Linux Enterprise Module for Public Cloud 15-SP4 (src):    kernel-azure-5.14.21-150400.14.16.1, kernel-source-azure-5.14.21-150400.14.16.1, kernel-syms-azure-5.14.21-150400.14.16.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 21 Swamp Workflow Management 2022-10-18 13:30:04 UTC 
SUSE-SU-2022:3609-1: An update that solves 26 vulnerabilities, contains two features and has 89 fixes is now available.

Category: security (important)
Bug References: 1023051,1065729,1156395,1177471,1179722,1179723,1181862,1185032,1191662,1191667,1191881,1192594,1194023,1194272,1194535,1196444,1196616,1196867,1197158,1197659,1197755,1197756,1197757,1197760,1197763,1197920,1198971,1199255,1199291,1200084,1200313,1200431,1200622,1200845,1200868,1200869,1200870,1200871,1200872,1200873,1201019,1201309,1201310,1201420,1201442,1201489,1201610,1201645,1201705,1201726,1201865,1201948,1201990,1202095,1202096,1202097,1202154,1202341,1202346,1202347,1202385,1202393,1202396,1202447,1202577,1202636,1202672,1202677,1202701,1202708,1202709,1202710,1202711,1202712,1202713,1202714,1202715,1202716,1202717,1202718,1202720,1202722,1202745,1202756,1202810,1202811,1202860,1202895,1202898,1202960,1202984,1203063,1203098,1203107,1203116,1203117,1203135,1203136,1203137,1203159,1203313,1203389,1203410,1203424,1203552,1203622,1203737,1203769,1203906,1203909,1203933,1203935,1203939,1203987,1203992
CVE References: CVE-2016-3695,CVE-2020-16119,CVE-2020-27784,CVE-2020-36516,CVE-2021-4155,CVE-2021-4203,CVE-2022-20368,CVE-2022-20369,CVE-2022-2503,CVE-2022-2586,CVE-2022-2588,CVE-2022-26373,CVE-2022-2639,CVE-2022-2663,CVE-2022-2905,CVE-2022-2977,CVE-2022-3028,CVE-2022-3239,CVE-2022-3303,CVE-2022-36879,CVE-2022-39188,CVE-2022-39190,CVE-2022-41218,CVE-2022-41222,CVE-2022-41848,CVE-2022-41849
JIRA References: PED-529,SLE-24635
Sources used:
openSUSE Leap 15.3 (src):    kernel-azure-5.3.18-150300.38.80.1, kernel-source-azure-5.3.18-150300.38.80.1, kernel-syms-azure-5.3.18-150300.38.80.1
SUSE Linux Enterprise Module for Public Cloud 15-SP3 (src):    kernel-azure-5.3.18-150300.38.80.1, kernel-source-azure-5.3.18-150300.38.80.1, kernel-syms-azure-5.3.18-150300.38.80.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 24 Swamp Workflow Management 2022-10-26 14:14:58 UTC 
SUSE-SU-2022:3775-1: An update that solves 17 vulnerabilities, contains one feature and has 29 fixes is now available.

Category: security (important)
Bug References: 1177471,1185032,1194023,1196444,1197659,1199564,1200313,1200622,1201309,1201310,1201489,1201645,1201865,1201990,1202095,1202341,1202385,1202677,1202960,1202984,1203159,1203290,1203313,1203389,1203410,1203424,1203514,1203552,1203622,1203737,1203769,1203770,1203906,1203909,1203935,1203939,1203987,1203992,1204051,1204059,1204060,1204125,1204289,1204290,1204291,1204292
CVE References: CVE-2020-16119,CVE-2022-20008,CVE-2022-2503,CVE-2022-2586,CVE-2022-3169,CVE-2022-3239,CVE-2022-3303,CVE-2022-40768,CVE-2022-41218,CVE-2022-41222,CVE-2022-41674,CVE-2022-41848,CVE-2022-41849,CVE-2022-42719,CVE-2022-42720,CVE-2022-42721,CVE-2022-42722
JIRA References: PED-529
Sources used:
openSUSE Leap Micro 5.2 (src):    kernel-default-5.3.18-150300.59.98.1, kernel-default-base-5.3.18-150300.59.98.1.150300.18.56.3
openSUSE Leap 15.4 (src):    dtb-aarch64-5.3.18-150300.59.98.1
openSUSE Leap 15.3 (src):    dtb-aarch64-5.3.18-150300.59.98.1, kernel-64kb-5.3.18-150300.59.98.1, kernel-debug-5.3.18-150300.59.98.1, kernel-default-5.3.18-150300.59.98.1, kernel-default-base-5.3.18-150300.59.98.1.150300.18.56.3, kernel-docs-5.3.18-150300.59.98.1, kernel-kvmsmall-5.3.18-150300.59.98.1, kernel-obs-build-5.3.18-150300.59.98.1, kernel-obs-qa-5.3.18-150300.59.98.1, kernel-preempt-5.3.18-150300.59.98.1, kernel-source-5.3.18-150300.59.98.1, kernel-syms-5.3.18-150300.59.98.1, kernel-zfcpdump-5.3.18-150300.59.98.1
SUSE Linux Enterprise Workstation Extension 15-SP3 (src):    kernel-default-5.3.18-150300.59.98.1, kernel-preempt-5.3.18-150300.59.98.1
SUSE Linux Enterprise Module for Live Patching 15-SP3 (src):    kernel-default-5.3.18-150300.59.98.1, kernel-livepatch-SLE15-SP3_Update_25-1-150300.7.5.1
SUSE Linux Enterprise Module for Legacy Software 15-SP3 (src):    kernel-default-5.3.18-150300.59.98.1
SUSE Linux Enterprise Module for Development Tools 15-SP3 (src):    kernel-docs-5.3.18-150300.59.98.1, kernel-obs-build-5.3.18-150300.59.98.1, kernel-preempt-5.3.18-150300.59.98.1, kernel-source-5.3.18-150300.59.98.1, kernel-syms-5.3.18-150300.59.98.1
SUSE Linux Enterprise Module for Basesystem 15-SP3 (src):    kernel-64kb-5.3.18-150300.59.98.1, kernel-default-5.3.18-150300.59.98.1, kernel-default-base-5.3.18-150300.59.98.1.150300.18.56.3, kernel-preempt-5.3.18-150300.59.98.1, kernel-source-5.3.18-150300.59.98.1, kernel-zfcpdump-5.3.18-150300.59.98.1
SUSE Linux Enterprise Micro 5.2 (src):    kernel-default-5.3.18-150300.59.98.1, kernel-default-base-5.3.18-150300.59.98.1.150300.18.56.3
SUSE Linux Enterprise Micro 5.1 (src):    kernel-default-5.3.18-150300.59.98.1, kernel-default-base-5.3.18-150300.59.98.1.150300.18.56.3
SUSE Linux Enterprise High Availability 15-SP3 (src):    kernel-default-5.3.18-150300.59.98.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 25 Swamp Workflow Management 2022-10-31 14:32:50 UTC 
SUSE-SU-2022:3809-1: An update that solves 32 vulnerabilities, contains two features and has 84 fixes is now available.

Category: security (important)
Bug References: 1023051,1065729,1152489,1156395,1177471,1179722,1179723,1181862,1185032,1191662,1191667,1191881,1192594,1194023,1194272,1194535,1196444,1197158,1197659,1197755,1197756,1197757,1197760,1197763,1197920,1198971,1199291,1200288,1200313,1200431,1200622,1200845,1200868,1200869,1200870,1200871,1200872,1200873,1201019,1201309,1201310,1201420,1201489,1201610,1201705,1201726,1201865,1201948,1201990,1202095,1202096,1202097,1202341,1202346,1202347,1202385,1202393,1202396,1202447,1202577,1202636,1202638,1202672,1202677,1202701,1202708,1202709,1202710,1202711,1202712,1202713,1202714,1202715,1202716,1202717,1202718,1202720,1202722,1202745,1202756,1202810,1202811,1202860,1202895,1202898,1202960,1202984,1203063,1203098,1203107,1203117,1203135,1203136,1203137,1203159,1203290,1203389,1203410,1203424,1203514,1203552,1203622,1203737,1203769,1203770,1203802,1203906,1203909,1203935,1203939,1203987,1203992,1204051,1204059,1204060,1204125
CVE References: CVE-2016-3695,CVE-2020-16119,CVE-2020-27784,CVE-2021-4155,CVE-2021-4203,CVE-2022-20368,CVE-2022-20369,CVE-2022-2503,CVE-2022-2586,CVE-2022-2588,CVE-2022-26373,CVE-2022-2663,CVE-2022-2905,CVE-2022-2977,CVE-2022-3028,CVE-2022-3169,CVE-2022-32296,CVE-2022-3239,CVE-2022-3303,CVE-2022-36879,CVE-2022-39188,CVE-2022-39190,CVE-2022-40768,CVE-2022-41218,CVE-2022-41222,CVE-2022-41674,CVE-2022-41848,CVE-2022-41849,CVE-2022-42719,CVE-2022-42720,CVE-2022-42721,CVE-2022-42722
JIRA References: PED-529,SLE-24635
Sources used:
openSUSE Leap Micro 5.2 (src):    kernel-rt-5.3.18-150300.106.1
SUSE Linux Enterprise Module for Realtime 15-SP3 (src):    kernel-rt-5.3.18-150300.106.1, kernel-rt_debug-5.3.18-150300.106.1, kernel-source-rt-5.3.18-150300.106.1, kernel-syms-rt-5.3.18-150300.106.1
SUSE Linux Enterprise Micro 5.2 (src):    kernel-rt-5.3.18-150300.106.1
SUSE Linux Enterprise Micro 5.1 (src):    kernel-rt-5.3.18-150300.106.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 26 Swamp Workflow Management 2022-11-01 23:23:39 UTC 
SUSE-SU-2022:3844-1: An update that solves 15 vulnerabilities, contains 12 features and has 33 fixes is now available.

Category: security (important)
Bug References: 1185032,1190497,1194023,1194869,1195917,1196444,1196869,1197659,1198189,1200288,1200622,1201309,1201310,1201987,1202095,1202960,1203039,1203066,1203101,1203197,1203263,1203338,1203360,1203361,1203389,1203410,1203505,1203552,1203664,1203693,1203699,1203767,1203769,1203770,1203794,1203798,1203893,1203902,1203906,1203908,1203935,1203939,1203987,1203992,1204051,1204059,1204060,1204125
CVE References: CVE-2022-1263,CVE-2022-2586,CVE-2022-3202,CVE-2022-32296,CVE-2022-3239,CVE-2022-3303,CVE-2022-39189,CVE-2022-41218,CVE-2022-41674,CVE-2022-41848,CVE-2022-41849,CVE-2022-42719,CVE-2022-42720,CVE-2022-42721,CVE-2022-42722
JIRA References: PED-387,PED-529,PED-652,PED-664,PED-682,PED-688,PED-720,PED-729,PED-755,PED-763,SLE-19924,SLE-24814
Sources used:
openSUSE Leap 15.4 (src):    dtb-aarch64-5.14.21-150400.24.28.1, kernel-64kb-5.14.21-150400.24.28.1, kernel-debug-5.14.21-150400.24.28.1, kernel-default-5.14.21-150400.24.28.1, kernel-default-base-5.14.21-150400.24.28.1.150400.24.9.5, kernel-docs-5.14.21-150400.24.28.1, kernel-kvmsmall-5.14.21-150400.24.28.1, kernel-obs-build-5.14.21-150400.24.28.1, kernel-obs-qa-5.14.21-150400.24.28.1, kernel-source-5.14.21-150400.24.28.1, kernel-syms-5.14.21-150400.24.28.1, kernel-zfcpdump-5.14.21-150400.24.28.1
SUSE Linux Enterprise Workstation Extension 15-SP4 (src):    kernel-default-5.14.21-150400.24.28.1
SUSE Linux Enterprise Module for Live Patching 15-SP4 (src):    kernel-default-5.14.21-150400.24.28.1, kernel-livepatch-SLE15-SP4_Update_4-1-150400.9.3.5
SUSE Linux Enterprise Module for Legacy Software 15-SP4 (src):    kernel-default-5.14.21-150400.24.28.1
SUSE Linux Enterprise Module for Development Tools 15-SP4 (src):    kernel-docs-5.14.21-150400.24.28.1, kernel-obs-build-5.14.21-150400.24.28.1, kernel-source-5.14.21-150400.24.28.1, kernel-syms-5.14.21-150400.24.28.1
SUSE Linux Enterprise Module for Basesystem 15-SP4 (src):    kernel-64kb-5.14.21-150400.24.28.1, kernel-default-5.14.21-150400.24.28.1, kernel-default-base-5.14.21-150400.24.28.1.150400.24.9.5, kernel-source-5.14.21-150400.24.28.1, kernel-zfcpdump-5.14.21-150400.24.28.1
SUSE Linux Enterprise Micro 5.3 (src):    kernel-default-5.14.21-150400.24.28.1, kernel-default-base-5.14.21-150400.24.28.1.150400.24.9.5
SUSE Linux Enterprise High Availability 15-SP4 (src):    kernel-default-5.14.21-150400.24.28.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 31 Swamp Workflow Management 2022-12-23 15:18:23 UTC 
SUSE-SU-2022:4617-1: An update that solves 96 vulnerabilities, contains 50 features and has 246 fixes is now available.

Category: security (important)
Bug References: 1023051,1032323,1065729,1071995,1152472,1152489,1156395,1164051,1177471,1184350,1185032,1188238,1189297,1189999,1190256,1190497,1190969,1192968,1193629,1194023,1194592,1194869,1194904,1195480,1195917,1196018,1196444,1196616,1196632,1196867,1196869,1197158,1197391,1197659,1197755,1197756,1197757,1197763,1198189,1198410,1198577,1198702,1198971,1199086,1199364,1199515,1199670,1199904,1200015,1200058,1200268,1200288,1200301,1200313,1200431,1200465,1200494,1200544,1200567,1200622,1200644,1200651,1200692,1200788,1200845,1200868,1200869,1200870,1200871,1200872,1200873,1201019,1201308,1201309,1201310,1201361,1201427,1201442,1201455,1201489,1201610,1201675,1201725,1201726,1201768,1201865,1201940,1201941,1201948,1201954,1201956,1201958,1202095,1202096,1202097,1202113,1202131,1202154,1202187,1202262,1202265,1202312,1202341,1202346,1202347,1202385,1202393,1202447,1202471,1202558,1202623,1202636,1202672,1202681,1202685,1202686,1202700,1202710,1202711,1202712,1202713,1202715,1202716,1202757,1202758,1202759,1202761,1202762,1202763,1202764,1202765,1202766,1202767,1202768,1202769,1202770,1202771,1202773,1202774,1202775,1202776,1202778,1202779,1202780,1202781,1202782,1202783,1202822,1202823,1202824,1202860,1202867,1202872,1202874,1202898,1202914,1202960,1202989,1202992,1202993,1203002,1203008,1203036,1203039,1203041,1203063,1203066,1203067,1203098,1203101,1203107,1203116,1203117,1203138,1203139,1203159,1203183,1203197,1203208,1203229,1203263,1203290,1203338,1203360,1203361,1203389,1203391,1203410,1203435,1203505,1203511,1203514,1203552,1203606,1203664,1203693,1203699,1203767,1203769,1203770,1203794,1203798,1203802,1203829,1203893,1203902,1203906,1203908,1203922,1203935,1203939,1203960,1203969,1203987,1203992,1203994,1204017,1204051,1204059,1204060,1204092,1204125,1204132,1204142,1204166,1204168,1204170,1204171,1204183,1204228,1204241,1204289,1204290,1204291,1204292,1204353,1204354,1204355,1204402,1204405,1204413,1204414,1204415,1204417,1204424,1204428,1204431,1204432,1204439,1204470,1204479,1204486,1204498,1204533,1204569,1204574,1204575,1204576,1204619,1204624,1204631,1204635,1204636,1204637,1204646,1204647,1204650,1204653,1204693,1204705,1204719,1204728,1204745,1204753,1204780,1204810,1204850,1204868,1204926,1204933,1204934,1204947,1204957,1204963,1204970,1205007,1205100,1205111,1205113,1205128,1205130,1205149,1205153,1205220,1205257,1205264,1205282,1205313,1205331,1205332,1205427,1205428,1205473,1205496,1205507,1205514,1205521,1205567,1205616,1205617,1205653,1205671,1205679,1205683,1205700,1205705,1205709,1205711,1205744,1205764,1205796,1205882,1205993,1206035,1206036,1206037,1206045,1206046,1206047,1206048,1206049,1206050,1206051,1206056,1206057,1206113,1206114,1206147,1206149,1206207,1206273,1206391
CVE References: CVE-2016-3695,CVE-2020-16119,CVE-2020-36516,CVE-2021-33135,CVE-2021-4037,CVE-2022-1184,CVE-2022-1263,CVE-2022-1882,CVE-2022-20368,CVE-2022-20369,CVE-2022-2153,CVE-2022-2586,CVE-2022-2588,CVE-2022-2602,CVE-2022-26373,CVE-2022-2639,CVE-2022-2663,CVE-2022-28356,CVE-2022-28693,CVE-2022-2873,CVE-2022-28748,CVE-2022-2905,CVE-2022-2938,CVE-2022-2959,CVE-2022-2964,CVE-2022-2977,CVE-2022-2978,CVE-2022-3028,CVE-2022-3078,CVE-2022-3114,CVE-2022-3169,CVE-2022-3176,CVE-2022-3202,CVE-2022-32250,CVE-2022-32296,CVE-2022-3239,CVE-2022-3303,CVE-2022-33981,CVE-2022-3424,CVE-2022-3435,CVE-2022-3521,CVE-2022-3524,CVE-2022-3526,CVE-2022-3535,CVE-2022-3542,CVE-2022-3545,CVE-2022-3565,CVE-2022-3566,CVE-2022-3567,CVE-2022-3577,CVE-2022-3586,CVE-2022-3594,CVE-2022-3619,CVE-2022-3621,CVE-2022-3625,CVE-2022-3628,CVE-2022-3629,CVE-2022-3633,CVE-2022-3635,CVE-2022-3640,CVE-2022-3643,CVE-2022-3646,CVE-2022-3649,CVE-2022-36879,CVE-2022-36946,CVE-2022-3707,CVE-2022-3903,CVE-2022-39188,CVE-2022-39189,CVE-2022-39190,CVE-2022-40476,CVE-2022-40768,CVE-2022-4095,CVE-2022-41218,CVE-2022-4129,CVE-2022-4139,CVE-2022-41674,CVE-2022-41848,CVE-2022-41849,CVE-2022-41850,CVE-2022-41858,CVE-2022-42328,CVE-2022-42329,CVE-2022-42703,CVE-2022-42719,CVE-2022-42720,CVE-2022-42721,CVE-2022-42722,CVE-2022-42895,CVE-2022-42896,CVE-2022-43750,CVE-2022-4378,CVE-2022-43945,CVE-2022-45869,CVE-2022-45888,CVE-2022-45934
JIRA References: PED-1082,PED-1084,PED-1085,PED-1096,PED-1211,PED-1573,PED-1649,PED-1706,PED-1936,PED-2684,PED-387,PED-529,PED-611,PED-634,PED-652,PED-664,PED-676,PED-678,PED-679,PED-682,PED-688,PED-707,PED-720,PED-729,PED-732,PED-755,PED-763,PED-813,PED-817,PED-822,PED-824,PED-825,PED-833,PED-842,PED-846,PED-849,PED-850,PED-851,PED-856,PED-857,SLE-13847,SLE-18130,SLE-19359,SLE-19924,SLE-20183,SLE-23766,SLE-24572,SLE-24682,SLE-24814,SLE-9246
Sources used:
openSUSE Leap Micro 5.3 (src):    kernel-rt-5.14.21-150400.15.5.1
openSUSE Leap 15.4 (src):    kernel-rt-5.14.21-150400.15.5.1, kernel-rt_debug-5.14.21-150400.15.5.1, kernel-source-rt-5.14.21-150400.15.5.1, kernel-syms-rt-5.14.21-150400.15.5.1
SUSE Linux Enterprise Module for Realtime 15-SP4 (src):    kernel-rt-5.14.21-150400.15.5.1, kernel-rt_debug-5.14.21-150400.15.5.1, kernel-source-rt-5.14.21-150400.15.5.1, kernel-syms-rt-5.14.21-150400.15.5.1
SUSE Linux Enterprise Module for Live Patching 15-SP4 (src):    kernel-livepatch-SLE15-SP4-RT_Update_1-1-150400.1.3.1
SUSE Linux Enterprise Micro 5.3 (src):    kernel-rt-5.14.21-150400.15.5.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 38 Robert Frohl 2024-04-19 14:07:13 UTC 
done
Comment 39 Maintenance Automation 2024-06-12 20:31:30 UTC 
SUSE-SU-2024:2010-1: An update that solves 186 vulnerabilities and has 27 security fixes can now be installed.

Category: security (important)
Bug References: 1065729, 1151927, 1152472, 1154353, 1156395, 1174585, 1176447, 1176774, 1176869, 1178134, 1181147, 1184631, 1185589, 1185902, 1186885, 1188616, 1188772, 1189883, 1190795, 1191452, 1192107, 1194288, 1194591, 1196956, 1197760, 1198029, 1199304, 1200619, 1203389, 1206646, 1209657, 1210335, 1210629, 1213476, 1215420, 1216702, 1217169, 1220137, 1220144, 1220754, 1220877, 1220960, 1221044, 1221113, 1221829, 1222251, 1222619, 1222838, 1222867, 1223084, 1223138, 1223384, 1223390, 1223512, 1223626, 1223715, 1223932, 1223934, 1224099, 1224174, 1224438, 1224482, 1224511, 1224592, 1224816, 1224826, 1224830, 1224831, 1224832, 1224834, 1224841, 1224842, 1224843, 1224844, 1224846, 1224849, 1224852, 1224853, 1224854, 1224859, 1224882, 1224886, 1224888, 1224889, 1224891, 1224892, 1224893, 1224899, 1224904, 1224907, 1224909, 1224916, 1224917, 1224922, 1224923, 1224924, 1224926, 1224928, 1224953, 1224954, 1224955, 1224957, 1224961, 1224963, 1224965, 1224966, 1224968, 1224981, 1224982, 1224983, 1224984, 1224987, 1224990, 1224993, 1224996, 1224997, 1225026, 1225030, 1225058, 1225060, 1225083, 1225084, 1225091, 1225112, 1225113, 1225128, 1225140, 1225143, 1225148, 1225155, 1225164, 1225177, 1225178, 1225181, 1225192, 1225193, 1225198, 1225201, 1225206, 1225207, 1225208, 1225214, 1225223, 1225224, 1225230, 1225232, 1225233, 1225237, 1225238, 1225243, 1225244, 1225247, 1225251, 1225252, 1225256, 1225261, 1225262, 1225263, 1225301, 1225303, 1225316, 1225318, 1225320, 1225321, 1225322, 1225326, 1225327, 1225328, 1225330, 1225333, 1225336, 1225341, 1225346, 1225351, 1225354, 1225355, 1225357, 1225358, 1225360, 1225361, 1225366, 1225367, 1225369, 1225370, 1225372, 1225374, 1225384, 1225386, 1225387, 1225390, 1225393, 1225400, 1225404, 1225405, 1225409, 1225411, 1225424, 1225427, 1225435, 1225437, 1225438, 1225439, 1225446, 1225447, 1225448, 1225450, 1225453, 1225455, 1225468, 1225499, 1225500, 1225508, 1225534
CVE References: CVE-2020-36788, CVE-2021-3743, CVE-2021-39698, CVE-2021-43056, CVE-2021-47104, CVE-2021-47192, CVE-2021-47200, CVE-2021-47220, CVE-2021-47227, CVE-2021-47228, CVE-2021-47229, CVE-2021-47230, CVE-2021-47231, CVE-2021-47235, CVE-2021-47236, CVE-2021-47237, CVE-2021-47239, CVE-2021-47240, CVE-2021-47241, CVE-2021-47246, CVE-2021-47252, CVE-2021-47253, CVE-2021-47254, CVE-2021-47255, CVE-2021-47258, CVE-2021-47259, CVE-2021-47260, CVE-2021-47261, CVE-2021-47263, CVE-2021-47265, CVE-2021-47267, CVE-2021-47269, CVE-2021-47270, CVE-2021-47274, CVE-2021-47275, CVE-2021-47276, CVE-2021-47280, CVE-2021-47281, CVE-2021-47284, CVE-2021-47285, CVE-2021-47288, CVE-2021-47289, CVE-2021-47296, CVE-2021-47301, CVE-2021-47302, CVE-2021-47305, CVE-2021-47307, CVE-2021-47308, CVE-2021-47314, CVE-2021-47315, CVE-2021-47320, CVE-2021-47321, CVE-2021-47323, CVE-2021-47324, CVE-2021-47329, CVE-2021-47330, CVE-2021-47332, CVE-2021-47333, CVE-2021-47334, CVE-2021-47337, CVE-2021-47338, CVE-2021-47340, CVE-2021-47341, CVE-2021-47343, CVE-2021-47344, CVE-2021-47347, CVE-2021-47348, CVE-2021-47350, CVE-2021-47353, CVE-2021-47354, CVE-2021-47356, CVE-2021-47369, CVE-2021-47375, CVE-2021-47378, CVE-2021-47381, CVE-2021-47382, CVE-2021-47383, CVE-2021-47387, CVE-2021-47388, CVE-2021-47391, CVE-2021-47392, CVE-2021-47393, CVE-2021-47395, CVE-2021-47396, CVE-2021-47399, CVE-2021-47402, CVE-2021-47404, CVE-2021-47405, CVE-2021-47409, CVE-2021-47413, CVE-2021-47416, CVE-2021-47422, CVE-2021-47423, CVE-2021-47424, CVE-2021-47425, CVE-2021-47426, CVE-2021-47428, CVE-2021-47431, CVE-2021-47434, CVE-2021-47435, CVE-2021-47436, CVE-2021-47441, CVE-2021-47442, CVE-2021-47443, CVE-2021-47444, CVE-2021-47445, CVE-2021-47451, CVE-2021-47456, CVE-2021-47458, CVE-2021-47460, CVE-2021-47464, CVE-2021-47465, CVE-2021-47468, CVE-2021-47473, CVE-2021-47478, CVE-2021-47480, CVE-2021-47482, CVE-2021-47483, CVE-2021-47485, CVE-2021-47493, CVE-2021-47494, CVE-2021-47495, CVE-2021-47496, CVE-2021-47497, CVE-2021-47498, CVE-2021-47499, CVE-2021-47500, CVE-2021-47501, CVE-2021-47502, CVE-2021-47503, CVE-2021-47505, CVE-2021-47506, CVE-2021-47507, CVE-2021-47509, CVE-2021-47511, CVE-2021-47512, CVE-2021-47516, CVE-2021-47518, CVE-2021-47521, CVE-2021-47522, CVE-2021-47523, CVE-2021-47527, CVE-2021-47535, CVE-2021-47536, CVE-2021-47538, CVE-2021-47540, CVE-2021-47541, CVE-2021-47542, CVE-2021-47549, CVE-2021-47557, CVE-2021-47562, CVE-2021-47563, CVE-2021-47565, CVE-2022-1195, CVE-2022-20132, CVE-2022-48636, CVE-2022-48673, CVE-2022-48704, CVE-2022-48710, CVE-2023-0160, CVE-2023-1829, CVE-2023-2176, CVE-2023-4244, CVE-2023-47233, CVE-2023-52433, CVE-2023-52581, CVE-2023-52591, CVE-2023-52654, CVE-2023-52655, CVE-2023-52686, CVE-2023-52840, CVE-2023-52871, CVE-2023-52880, CVE-2023-6531, CVE-2024-26581, CVE-2024-26643, CVE-2024-26828, CVE-2024-26921, CVE-2024-26925, CVE-2024-26929, CVE-2024-26930, CVE-2024-27398, CVE-2024-27413, CVE-2024-35811, CVE-2024-35895, CVE-2024-35914
Maintenance Incident: [SUSE:Maintenance:34219](https://smelt.suse.de/incident/34219/)
Sources used:
SUSE Linux Enterprise Micro 5.1 (src):
 kernel-source-rt-5.3.18-150300.172.1
SUSE Linux Enterprise Micro 5.2 (src):
 kernel-source-rt-5.3.18-150300.172.1
SUSE Linux Enterprise Micro for Rancher 5.2 (src):
 kernel-source-rt-5.3.18-150300.172.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 40 Maintenance Automation 2024-06-24 20:32:01 UTC 
SUSE-SU-2024:2185-1: An update that solves 187 vulnerabilities and has 26 security fixes can now be installed.

Category: security (important)
Bug References: 1065729, 1151927, 1152472, 1154353, 1156395, 1174585, 1176447, 1176774, 1176869, 1178134, 1181147, 1184631, 1185570, 1185589, 1185902, 1186885, 1187357, 1188616, 1188772, 1189883, 1190795, 1191452, 1192107, 1194288, 1194591, 1196956, 1197760, 1198029, 1199304, 1200619, 1203389, 1206646, 1209657, 1210335, 1210629, 1213476, 1215420, 1216702, 1217169, 1220137, 1220144, 1220754, 1220877, 1220960, 1221044, 1221113, 1221829, 1222251, 1222619, 1222838, 1222867, 1223084, 1223138, 1223384, 1223390, 1223512, 1223932, 1223934, 1224099, 1224174, 1224438, 1224482, 1224511, 1224592, 1224816, 1224826, 1224830, 1224831, 1224832, 1224834, 1224841, 1224842, 1224843, 1224844, 1224846, 1224849, 1224852, 1224853, 1224854, 1224859, 1224882, 1224886, 1224888, 1224889, 1224891, 1224892, 1224893, 1224899, 1224904, 1224907, 1224909, 1224916, 1224917, 1224922, 1224923, 1224924, 1224926, 1224928, 1224953, 1224954, 1224955, 1224957, 1224961, 1224963, 1224965, 1224966, 1224968, 1224981, 1224982, 1224983, 1224984, 1224987, 1224990, 1224993, 1224996, 1224997, 1225026, 1225030, 1225058, 1225060, 1225083, 1225084, 1225091, 1225112, 1225113, 1225128, 1225140, 1225143, 1225148, 1225155, 1225164, 1225177, 1225178, 1225181, 1225192, 1225193, 1225198, 1225201, 1225206, 1225207, 1225208, 1225214, 1225223, 1225224, 1225230, 1225232, 1225233, 1225237, 1225238, 1225243, 1225244, 1225247, 1225251, 1225252, 1225256, 1225261, 1225262, 1225263, 1225301, 1225303, 1225316, 1225318, 1225320, 1225321, 1225322, 1225326, 1225327, 1225328, 1225330, 1225333, 1225336, 1225341, 1225346, 1225351, 1225354, 1225355, 1225357, 1225358, 1225360, 1225361, 1225366, 1225367, 1225369, 1225370, 1225372, 1225374, 1225384, 1225386, 1225387, 1225390, 1225393, 1225400, 1225404, 1225405, 1225409, 1225411, 1225424, 1225427, 1225435, 1225437, 1225438, 1225439, 1225446, 1225447, 1225448, 1225450, 1225453, 1225455, 1225468, 1225499, 1225500, 1225508, 1225534
CVE References: CVE-2020-36788, CVE-2021-3743, CVE-2021-39698, CVE-2021-43056, CVE-2021-47104, CVE-2021-47192, CVE-2021-47200, CVE-2021-47220, CVE-2021-47227, CVE-2021-47228, CVE-2021-47229, CVE-2021-47230, CVE-2021-47231, CVE-2021-47235, CVE-2021-47236, CVE-2021-47237, CVE-2021-47239, CVE-2021-47240, CVE-2021-47241, CVE-2021-47246, CVE-2021-47252, CVE-2021-47253, CVE-2021-47254, CVE-2021-47255, CVE-2021-47258, CVE-2021-47259, CVE-2021-47260, CVE-2021-47261, CVE-2021-47263, CVE-2021-47265, CVE-2021-47267, CVE-2021-47269, CVE-2021-47270, CVE-2021-47274, CVE-2021-47275, CVE-2021-47276, CVE-2021-47280, CVE-2021-47281, CVE-2021-47284, CVE-2021-47285, CVE-2021-47288, CVE-2021-47289, CVE-2021-47296, CVE-2021-47301, CVE-2021-47302, CVE-2021-47305, CVE-2021-47307, CVE-2021-47308, CVE-2021-47314, CVE-2021-47315, CVE-2021-47320, CVE-2021-47321, CVE-2021-47323, CVE-2021-47324, CVE-2021-47329, CVE-2021-47330, CVE-2021-47332, CVE-2021-47333, CVE-2021-47334, CVE-2021-47337, CVE-2021-47338, CVE-2021-47340, CVE-2021-47341, CVE-2021-47343, CVE-2021-47344, CVE-2021-47347, CVE-2021-47348, CVE-2021-47350, CVE-2021-47353, CVE-2021-47354, CVE-2021-47356, CVE-2021-47369, CVE-2021-47375, CVE-2021-47378, CVE-2021-47381, CVE-2021-47382, CVE-2021-47383, CVE-2021-47387, CVE-2021-47388, CVE-2021-47391, CVE-2021-47392, CVE-2021-47393, CVE-2021-47395, CVE-2021-47396, CVE-2021-47399, CVE-2021-47402, CVE-2021-47404, CVE-2021-47405, CVE-2021-47409, CVE-2021-47413, CVE-2021-47416, CVE-2021-47422, CVE-2021-47423, CVE-2021-47424, CVE-2021-47425, CVE-2021-47426, CVE-2021-47428, CVE-2021-47431, CVE-2021-47434, CVE-2021-47435, CVE-2021-47436, CVE-2021-47441, CVE-2021-47442, CVE-2021-47443, CVE-2021-47444, CVE-2021-47445, CVE-2021-47451, CVE-2021-47456, CVE-2021-47458, CVE-2021-47460, CVE-2021-47464, CVE-2021-47465, CVE-2021-47468, CVE-2021-47473, CVE-2021-47478, CVE-2021-47480, CVE-2021-47482, CVE-2021-47483, CVE-2021-47485, CVE-2021-47493, CVE-2021-47494, CVE-2021-47495, CVE-2021-47496, CVE-2021-47497, CVE-2021-47498, CVE-2021-47499, CVE-2021-47500, CVE-2021-47501, CVE-2021-47502, CVE-2021-47503, CVE-2021-47505, CVE-2021-47506, CVE-2021-47507, CVE-2021-47509, CVE-2021-47511, CVE-2021-47512, CVE-2021-47516, CVE-2021-47518, CVE-2021-47521, CVE-2021-47522, CVE-2021-47523, CVE-2021-47527, CVE-2021-47535, CVE-2021-47536, CVE-2021-47538, CVE-2021-47540, CVE-2021-47541, CVE-2021-47542, CVE-2021-47549, CVE-2021-47557, CVE-2021-47562, CVE-2021-47563, CVE-2021-47565, CVE-2022-1195, CVE-2022-20132, CVE-2022-48636, CVE-2022-48673, CVE-2022-48704, CVE-2022-48710, CVE-2023-0160, CVE-2023-1829, CVE-2023-2176, CVE-2023-424, CVE-2023-4244, CVE-2023-47233, CVE-2023-52433, CVE-2023-52581, CVE-2023-52591, CVE-2023-52654, CVE-2023-52655, CVE-2023-52686, CVE-2023-52840, CVE-2023-52871, CVE-2023-52880, CVE-2023-6531, CVE-2024-26581, CVE-2024-26643, CVE-2024-26828, CVE-2024-26921, CVE-2024-26925, CVE-2024-26929, CVE-2024-26930, CVE-2024-27398, CVE-2024-27413, CVE-2024-35811, CVE-2024-35895, CVE-2024-35914
Maintenance Incident: [SUSE:Maintenance:34168](https://smelt.suse.de/incident/34168/)
Sources used:
openSUSE Leap 15.3 (src):
 kernel-obs-build-5.3.18-150300.59.164.1, kernel-syms-5.3.18-150300.59.164.1, kernel-default-base-5.3.18-150300.59.164.1.150300.18.96.1, kernel-livepatch-SLE15-SP3_Update_45-1-150300.7.3.1, kernel-source-5.3.18-150300.59.164.1, kernel-obs-qa-5.3.18-150300.59.164.1
SUSE Linux Enterprise Live Patching 15-SP3 (src):
 kernel-livepatch-SLE15-SP3_Update_45-1-150300.7.3.1
SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (src):
 kernel-obs-build-5.3.18-150300.59.164.1, kernel-source-5.3.18-150300.59.164.1, kernel-default-base-5.3.18-150300.59.164.1.150300.18.96.1, kernel-syms-5.3.18-150300.59.164.1
SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (src):
 kernel-obs-build-5.3.18-150300.59.164.1, kernel-source-5.3.18-150300.59.164.1, kernel-default-base-5.3.18-150300.59.164.1.150300.18.96.1, kernel-syms-5.3.18-150300.59.164.1
SUSE Linux Enterprise Server for SAP Applications 15 SP3 (src):
 kernel-obs-build-5.3.18-150300.59.164.1, kernel-source-5.3.18-150300.59.164.1, kernel-default-base-5.3.18-150300.59.164.1.150300.18.96.1, kernel-syms-5.3.18-150300.59.164.1
SUSE Enterprise Storage 7.1 (src):
 kernel-obs-build-5.3.18-150300.59.164.1, kernel-source-5.3.18-150300.59.164.1, kernel-default-base-5.3.18-150300.59.164.1.150300.18.96.1, kernel-syms-5.3.18-150300.59.164.1
SUSE Linux Enterprise Micro 5.1 (src):
 kernel-default-base-5.3.18-150300.59.164.1.150300.18.96.1
SUSE Linux Enterprise Micro 5.2 (src):
 kernel-default-base-5.3.18-150300.59.164.1.150300.18.96.1
SUSE Linux Enterprise Micro for Rancher 5.2 (src):
 kernel-default-base-5.3.18-150300.59.164.1.150300.18.96.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.