ALT-BU-2022-7310-5
Branch sisyphus update bulletin.
Package kernel-image-un-def updated to version 6.0.11-alt1 for branch sisyphus in task 311063.
Closed vulnerabilities
Modified: 2024-06-07
BDU:2022-07505
Уязвимость драйвера беспроводной сети WILC1000 ядра операционной системы Linux, позволяющая нарушителю выполнить произвольный код или вызвать отказ в обслуживании
Modified: 2024-06-07
BDU:2022-07506
Уязвимость драйвера беспроводной сети WILC1000 ядра операционной системы Linux, позволяющая нарушителю выполнить произвольный код или вызвать отказ в обслуживании
Modified: 2024-11-07
BDU:2022-07507
Уязвимость драйвера беспроводной сети WILC1000 ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании или повысить уровень привилегий
Modified: 2024-06-07
BDU:2022-07508
Уязвимость драйвера беспроводной сети WILC1000 ядра операционной системы Linux, позволяющая нарушителю выполнить произвольный код или вызвать отказ в обслуживании
Modified: 2025-01-29
BDU:2023-00061
Уязвимость драйвера GPU i915 ядра операционных систем Linux, позволяющая нарушителю повысить свои привилегии или вызвать отказ в обслуживании
Modified: 2024-03-01
BDU:2023-01111
Уязвимость функции inode_cgwb_move_to_attached() компонента fs/fs-writeback.c ядра операционных систем Linux, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации
Modified: 2024-09-13
BDU:2023-02406
Уязвимость функции io_install_fixed_file() подсистемы io_uring ядра операционных систем Linux, позволяющая нарушителю повысить свои привилегии или вызвать отказ в обслуживании
Modified: 2024-01-09
BDU:2023-02604
Уязвимость функции rxrpc_unbundle_conn() ядра операционных систем Linux, позволяющая нарушителю повысить свои привилегии
Modified: 2025-03-28
CVE-2022-4139
An incorrect TLB flush issue was found in the Linux kernel’s GPU i915 kernel driver, potentially leading to random memory corruption or data leaks. This flaw could allow a local user to crash the system or escalate their privileges on the system.
- https://bugzilla.redhat.com/show_bug.cgi?id=2147572
- https://security.netapp.com/advisory/ntap-20230309-0004/
- https://www.openwall.com/lists/oss-security/2022/11/30/1
- https://bugzilla.redhat.com/show_bug.cgi?id=2147572
- https://security.netapp.com/advisory/ntap-20230309-0004/
- https://www.openwall.com/lists/oss-security/2022/11/30/1
Modified: 2025-04-17
CVE-2022-47518
An issue was discovered in the Linux kernel before 6.0.11. Missing validation of the number of channels in drivers/net/wireless/microchip/wilc1000/cfg80211.c in the WILC1000 wireless driver can trigger a heap-based buffer overflow when copying the list of operating channels from Wi-Fi management frames.
- https://github.com/torvalds/linux/commit/0cdfa9e6f0915e3d243e2393bfa8a22e12d553b0
- https://lists.debian.org/debian-lts-announce/2022/12/msg00031.html
- https://lore.kernel.org/r/20221123153543.8568-5-philipturnbull%40github.com
- https://security.netapp.com/advisory/ntap-20230113-0007/
- https://github.com/torvalds/linux/commit/0cdfa9e6f0915e3d243e2393bfa8a22e12d553b0
- https://lists.debian.org/debian-lts-announce/2022/12/msg00031.html
- https://lore.kernel.org/r/20221123153543.8568-5-philipturnbull%40github.com
- https://security.netapp.com/advisory/ntap-20230113-0007/
Modified: 2025-04-17
CVE-2022-47519
An issue was discovered in the Linux kernel before 6.0.11. Missing validation of IEEE80211_P2P_ATTR_OPER_CHANNEL in drivers/net/wireless/microchip/wilc1000/cfg80211.c in the WILC1000 wireless driver can trigger an out-of-bounds write when parsing the channel list attribute from Wi-Fi management frames.
- https://github.com/torvalds/linux/commit/051ae669e4505abbe05165bebf6be7922de11f41
- https://lists.debian.org/debian-lts-announce/2022/12/msg00031.html
- https://lore.kernel.org/r/20221123153543.8568-3-philipturnbull%40github.com
- https://security.netapp.com/advisory/ntap-20230113-0007/
- https://github.com/torvalds/linux/commit/051ae669e4505abbe05165bebf6be7922de11f41
- https://lists.debian.org/debian-lts-announce/2022/12/msg00031.html
- https://lore.kernel.org/r/20221123153543.8568-3-philipturnbull%40github.com
- https://security.netapp.com/advisory/ntap-20230113-0007/
Modified: 2025-04-17
CVE-2022-47520
An issue was discovered in the Linux kernel before 6.0.11. Missing offset validation in drivers/net/wireless/microchip/wilc1000/hif.c in the WILC1000 wireless driver can trigger an out-of-bounds read when parsing a Robust Security Network (RSN) information element from a Netlink packet.
- https://github.com/torvalds/linux/commit/cd21d99e595ec1d8721e1058dcdd4f1f7de1d793
- https://lists.debian.org/debian-lts-announce/2022/12/msg00031.html
- https://lore.kernel.org/r/20221123153543.8568-2-philipturnbull%40github.com
- https://security.netapp.com/advisory/ntap-20230113-0007/
- https://github.com/torvalds/linux/commit/cd21d99e595ec1d8721e1058dcdd4f1f7de1d793
- https://lists.debian.org/debian-lts-announce/2022/12/msg00031.html
- https://lore.kernel.org/r/20221123153543.8568-2-philipturnbull%40github.com
- https://security.netapp.com/advisory/ntap-20230113-0007/
Modified: 2025-04-17
CVE-2022-47521
An issue was discovered in the Linux kernel before 6.0.11. Missing validation of IEEE80211_P2P_ATTR_CHANNEL_LIST in drivers/net/wireless/microchip/wilc1000/cfg80211.c in the WILC1000 wireless driver can trigger a heap-based buffer overflow when parsing the operating channel attribute from Wi-Fi management frames.
- https://github.com/torvalds/linux/commit/f9b62f9843c7b0afdaecabbcebf1dbba18599408
- https://lists.debian.org/debian-lts-announce/2022/12/msg00031.html
- https://lore.kernel.org/r/20221123153543.8568-4-philipturnbull%40github.com
- https://security.netapp.com/advisory/ntap-20230113-0007/
- https://github.com/torvalds/linux/commit/f9b62f9843c7b0afdaecabbcebf1dbba18599408
- https://lists.debian.org/debian-lts-announce/2022/12/msg00031.html
- https://lore.kernel.org/r/20221123153543.8568-4-philipturnbull%40github.com
- https://security.netapp.com/advisory/ntap-20230113-0007/
Modified: 2025-04-23
CVE-2023-2006
A race condition was found in the Linux kernel's RxRPC network protocol, within the processing of RxRPC bundles. This issue results from the lack of proper locking when performing operations on an object. This may allow an attacker to escalate privileges and execute arbitrary code in the context of the kernel.
- https://bugzilla.redhat.com/show_bug.cgi?id=2189112
- https://github.com/torvalds/linux/commit/3bcd6c7eaa53
- https://security.netapp.com/advisory/ntap-20230609-0004/
- https://www.zerodayinitiative.com/advisories/ZDI-23-439/
- https://bugzilla.redhat.com/show_bug.cgi?id=2189112
- https://github.com/torvalds/linux/commit/3bcd6c7eaa53
- https://security.netapp.com/advisory/ntap-20230609-0004/
- https://www.zerodayinitiative.com/advisories/ZDI-23-439/
Modified: 2025-02-13
CVE-2023-2236
A use-after-free vulnerability in the Linux Kernel io_uring subsystem can be exploited to achieve local privilege escalation. Both io_install_fixed_file and its callers call fput in a file in case of an error, causing a reference underflow which leads to a use-after-free vulnerability. We recommend upgrading past commit 9d94c04c0db024922e886c9fd429659f22f48ea4.
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9d94c04c0db024922e886c9fd429659f22f48ea4
- https://kernel.dance/9d94c04c0db024922e886c9fd429659f22f48ea4
- https://security.netapp.com/advisory/ntap-20230601-0010/
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9d94c04c0db024922e886c9fd429659f22f48ea4
- https://kernel.dance/9d94c04c0db024922e886c9fd429659f22f48ea4
- https://security.netapp.com/advisory/ntap-20230601-0010/
Modified: 2025-05-05
CVE-2023-26605
In the Linux kernel 6.0.8, there is a use-after-free in inode_cgwb_move_to_attached in fs/fs-writeback.c, related to __list_del_entry_valid.
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4e3c51f4e805291b057d12f5dda5aeb50a538dc4
- https://lkml.org/lkml/2023/2/22/3
- https://security.netapp.com/advisory/ntap-20230316-0010/
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4e3c51f4e805291b057d12f5dda5aeb50a538dc4
- https://lkml.org/lkml/2023/2/22/3
- https://security.netapp.com/advisory/ntap-20230316-0010/
Package kernel-image-std-def updated to version 5.15.81-alt1 for branch sisyphus in task 311064.
Closed vulnerabilities
Modified: 2024-06-07
BDU:2022-07505
Уязвимость драйвера беспроводной сети WILC1000 ядра операционной системы Linux, позволяющая нарушителю выполнить произвольный код или вызвать отказ в обслуживании
Modified: 2024-06-07
BDU:2022-07506
Уязвимость драйвера беспроводной сети WILC1000 ядра операционной системы Linux, позволяющая нарушителю выполнить произвольный код или вызвать отказ в обслуживании
Modified: 2024-11-07
BDU:2022-07507
Уязвимость драйвера беспроводной сети WILC1000 ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании или повысить уровень привилегий
Modified: 2024-06-07
BDU:2022-07508
Уязвимость драйвера беспроводной сети WILC1000 ядра операционной системы Linux, позволяющая нарушителю выполнить произвольный код или вызвать отказ в обслуживании
Modified: 2025-01-29
BDU:2023-00061
Уязвимость драйвера GPU i915 ядра операционных систем Linux, позволяющая нарушителю повысить свои привилегии или вызвать отказ в обслуживании
Modified: 2024-03-01
BDU:2023-01111
Уязвимость функции inode_cgwb_move_to_attached() компонента fs/fs-writeback.c ядра операционных систем Linux, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации
Modified: 2024-01-09
BDU:2023-02604
Уязвимость функции rxrpc_unbundle_conn() ядра операционных систем Linux, позволяющая нарушителю повысить свои привилегии
BDU:2026-03964
Уязвимость функции cifs_mount() модуля fs/cifs/connect.c файловой системы ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2026-04555
Уязвимость функции ceph_update_snap_trace() модуля fs/ceph/snap.c поддержки распределенной файловой системы Ceph ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2026-05813
Уязвимость функции sctp_sched_fcfs_dequeue() ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2025-03-28
CVE-2022-4139
An incorrect TLB flush issue was found in the Linux kernel’s GPU i915 kernel driver, potentially leading to random memory corruption or data leaks. This flaw could allow a local user to crash the system or escalate their privileges on the system.
- https://bugzilla.redhat.com/show_bug.cgi?id=2147572
- https://security.netapp.com/advisory/ntap-20230309-0004/
- https://www.openwall.com/lists/oss-security/2022/11/30/1
- https://bugzilla.redhat.com/show_bug.cgi?id=2147572
- https://security.netapp.com/advisory/ntap-20230309-0004/
- https://www.openwall.com/lists/oss-security/2022/11/30/1
Modified: 2025-04-17
CVE-2022-47518
An issue was discovered in the Linux kernel before 6.0.11. Missing validation of the number of channels in drivers/net/wireless/microchip/wilc1000/cfg80211.c in the WILC1000 wireless driver can trigger a heap-based buffer overflow when copying the list of operating channels from Wi-Fi management frames.
- https://github.com/torvalds/linux/commit/0cdfa9e6f0915e3d243e2393bfa8a22e12d553b0
- https://lists.debian.org/debian-lts-announce/2022/12/msg00031.html
- https://lore.kernel.org/r/20221123153543.8568-5-philipturnbull%40github.com
- https://security.netapp.com/advisory/ntap-20230113-0007/
- https://github.com/torvalds/linux/commit/0cdfa9e6f0915e3d243e2393bfa8a22e12d553b0
- https://lists.debian.org/debian-lts-announce/2022/12/msg00031.html
- https://lore.kernel.org/r/20221123153543.8568-5-philipturnbull%40github.com
- https://security.netapp.com/advisory/ntap-20230113-0007/
Modified: 2025-04-17
CVE-2022-47519
An issue was discovered in the Linux kernel before 6.0.11. Missing validation of IEEE80211_P2P_ATTR_OPER_CHANNEL in drivers/net/wireless/microchip/wilc1000/cfg80211.c in the WILC1000 wireless driver can trigger an out-of-bounds write when parsing the channel list attribute from Wi-Fi management frames.
- https://github.com/torvalds/linux/commit/051ae669e4505abbe05165bebf6be7922de11f41
- https://lists.debian.org/debian-lts-announce/2022/12/msg00031.html
- https://lore.kernel.org/r/20221123153543.8568-3-philipturnbull%40github.com
- https://security.netapp.com/advisory/ntap-20230113-0007/
- https://github.com/torvalds/linux/commit/051ae669e4505abbe05165bebf6be7922de11f41
- https://lists.debian.org/debian-lts-announce/2022/12/msg00031.html
- https://lore.kernel.org/r/20221123153543.8568-3-philipturnbull%40github.com
- https://security.netapp.com/advisory/ntap-20230113-0007/
Modified: 2025-04-17
CVE-2022-47520
An issue was discovered in the Linux kernel before 6.0.11. Missing offset validation in drivers/net/wireless/microchip/wilc1000/hif.c in the WILC1000 wireless driver can trigger an out-of-bounds read when parsing a Robust Security Network (RSN) information element from a Netlink packet.
- https://github.com/torvalds/linux/commit/cd21d99e595ec1d8721e1058dcdd4f1f7de1d793
- https://lists.debian.org/debian-lts-announce/2022/12/msg00031.html
- https://lore.kernel.org/r/20221123153543.8568-2-philipturnbull%40github.com
- https://security.netapp.com/advisory/ntap-20230113-0007/
- https://github.com/torvalds/linux/commit/cd21d99e595ec1d8721e1058dcdd4f1f7de1d793
- https://lists.debian.org/debian-lts-announce/2022/12/msg00031.html
- https://lore.kernel.org/r/20221123153543.8568-2-philipturnbull%40github.com
- https://security.netapp.com/advisory/ntap-20230113-0007/
Modified: 2025-04-17
CVE-2022-47521
An issue was discovered in the Linux kernel before 6.0.11. Missing validation of IEEE80211_P2P_ATTR_CHANNEL_LIST in drivers/net/wireless/microchip/wilc1000/cfg80211.c in the WILC1000 wireless driver can trigger a heap-based buffer overflow when parsing the operating channel attribute from Wi-Fi management frames.
- https://github.com/torvalds/linux/commit/f9b62f9843c7b0afdaecabbcebf1dbba18599408
- https://lists.debian.org/debian-lts-announce/2022/12/msg00031.html
- https://lore.kernel.org/r/20221123153543.8568-4-philipturnbull%40github.com
- https://security.netapp.com/advisory/ntap-20230113-0007/
- https://github.com/torvalds/linux/commit/f9b62f9843c7b0afdaecabbcebf1dbba18599408
- https://lists.debian.org/debian-lts-announce/2022/12/msg00031.html
- https://lore.kernel.org/r/20221123153543.8568-4-philipturnbull%40github.com
- https://security.netapp.com/advisory/ntap-20230113-0007/
Modified: 2025-11-06
CVE-2022-49770
In the Linux kernel, the following vulnerability has been resolved: ceph: avoid putting the realm twice when decoding snaps fails When decoding the snaps fails it maybe leaving the 'first_realm' and 'realm' pointing to the same snaprealm memory. And then it'll put it twice and could cause random use-after-free, BUG_ON, etc issues.
- https://git.kernel.org/stable/c/044bc6d3c2c0e9090b0841e7b723875756534b45
- https://git.kernel.org/stable/c/274e4c79a3a2a24fba7cfe0e41113f1138785c37
- https://git.kernel.org/stable/c/2f6e2de3a5289004650118b61f138fe7c28e1905
- https://git.kernel.org/stable/c/51884d153f7ec85e18d607b2467820a90e0f4359
- https://git.kernel.org/stable/c/cb7495fe957526555782ce0723f79ce92a6db22e
- https://git.kernel.org/stable/c/fd879c83e87735ab8f00ef7755752cf0cbae24b2
Modified: 2025-11-07
CVE-2022-49785
In the Linux kernel, the following vulnerability has been resolved: x86/sgx: Add overflow check in sgx_validate_offset_length() sgx_validate_offset_length() function verifies "offset" and "length" arguments provided by userspace, but was missing an overflow check on their addition. Add it.
Modified: 2025-11-10
CVE-2022-49822
In the Linux kernel, the following vulnerability has been resolved: cifs: Fix connections leak when tlink setup failed If the tlink setup failed, lost to put the connections, then the module refcnt leak since the cifsd kthread not exit. Also leak the fscache info, and for next mount with fsc, it will print the follow errors: CIFS: Cache volume key already in use (cifs,127.0.0.1:445,TEST) Let's check the result of tlink setup, and do some cleanup.
Modified: 2025-11-10
CVE-2022-49838
In the Linux kernel, the following vulnerability has been resolved: sctp: clear out_curr if all frag chunks of current msg are pruned A crash was reported by Zhen Chen: list_del corruption, ffffa035ddf01c18->next is NULL WARNING: CPU: 1 PID: 250682 at lib/list_debug.c:49 __list_del_entry_valid+0x59/0xe0 RIP: 0010:__list_del_entry_valid+0x59/0xe0 Call Trace: sctp_sched_dequeue_common+0x17/0x70 [sctp] sctp_sched_fcfs_dequeue+0x37/0x50 [sctp] sctp_outq_flush_data+0x85/0x360 [sctp] sctp_outq_uncork+0x77/0xa0 [sctp] sctp_cmd_interpreter.constprop.0+0x164/0x1450 [sctp] sctp_side_effects+0x37/0xe0 [sctp] sctp_do_sm+0xd0/0x230 [sctp] sctp_primitive_SEND+0x2f/0x40 [sctp] sctp_sendmsg_to_asoc+0x3fa/0x5c0 [sctp] sctp_sendmsg+0x3d5/0x440 [sctp] sock_sendmsg+0x5b/0x70 and in sctp_sched_fcfs_dequeue() it dequeued a chunk from stream out_curr outq while this outq was empty. Normally stream->out_curr must be set to NULL once all frag chunks of current msg are dequeued, as we can see in sctp_sched_dequeue_done(). However, in sctp_prsctp_prune_unsent() as it is not a proper dequeue, sctp_sched_dequeue_done() is not called to do this. This patch is to fix it by simply setting out_curr to NULL when the last frag chunk of current msg is dequeued from out_curr stream in sctp_prsctp_prune_unsent().
Modified: 2025-04-23
CVE-2023-2006
A race condition was found in the Linux kernel's RxRPC network protocol, within the processing of RxRPC bundles. This issue results from the lack of proper locking when performing operations on an object. This may allow an attacker to escalate privileges and execute arbitrary code in the context of the kernel.
- https://bugzilla.redhat.com/show_bug.cgi?id=2189112
- https://github.com/torvalds/linux/commit/3bcd6c7eaa53
- https://security.netapp.com/advisory/ntap-20230609-0004/
- https://www.zerodayinitiative.com/advisories/ZDI-23-439/
- https://bugzilla.redhat.com/show_bug.cgi?id=2189112
- https://github.com/torvalds/linux/commit/3bcd6c7eaa53
- https://security.netapp.com/advisory/ntap-20230609-0004/
- https://www.zerodayinitiative.com/advisories/ZDI-23-439/
Modified: 2025-05-05
CVE-2023-26605
In the Linux kernel 6.0.8, there is a use-after-free in inode_cgwb_move_to_attached in fs/fs-writeback.c, related to __list_del_entry_valid.
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4e3c51f4e805291b057d12f5dda5aeb50a538dc4
- https://lkml.org/lkml/2023/2/22/3
- https://security.netapp.com/advisory/ntap-20230316-0010/
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4e3c51f4e805291b057d12f5dda5aeb50a538dc4
- https://lkml.org/lkml/2023/2/22/3
- https://security.netapp.com/advisory/ntap-20230316-0010/
