{"affected":[{"ecosystem_specific":{"binaries":[{"kernel-default":"4.4.121-92.169.1","kernel-default-base":"4.4.121-92.169.1","kernel-default-devel":"4.4.121-92.169.1","kernel-devel":"4.4.121-92.169.1","kernel-macros":"4.4.121-92.169.1","kernel-source":"4.4.121-92.169.1","kernel-syms":"4.4.121-92.169.1"}]},"package":{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","name":"kernel-default","purl":"pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-BCL"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"4.4.121-92.169.1"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"kernel-default":"4.4.121-92.169.1","kernel-default-base":"4.4.121-92.169.1","kernel-default-devel":"4.4.121-92.169.1","kernel-devel":"4.4.121-92.169.1","kernel-macros":"4.4.121-92.169.1","kernel-source":"4.4.121-92.169.1","kernel-syms":"4.4.121-92.169.1"}]},"package":{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","name":"kernel-source","purl":"pkg:rpm/suse/kernel-source&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-BCL"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"4.4.121-92.169.1"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"kernel-default":"4.4.121-92.169.1","kernel-default-base":"4.4.121-92.169.1","kernel-default-devel":"4.4.121-92.169.1","kernel-devel":"4.4.121-92.169.1","kernel-macros":"4.4.121-92.169.1","kernel-source":"4.4.121-92.169.1","kernel-syms":"4.4.121-92.169.1"}]},"package":{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","name":"kernel-syms","purl":"pkg:rpm/suse/kernel-syms&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-BCL"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"4.4.121-92.169.1"}],"type":"ECOSYSTEM"}]}],"aliases":[],"details":"The SUSE Linux Enterprise 12 SP2 kernel was updated to receive various security and bugfixes.\n\n\nTransient execution side-channel attacks attacking the Branch History Buffer (BHB),\nnamed 'Branch Target Injection' and 'Intra-Mode Branch History Injection' are now mitigated.\n\nThe following security bugs were fixed:\n\n- CVE-2022-0001: Fixed Branch History Injection vulnerability (bsc#1191580).\n- CVE-2022-0002: Fixed Intra-Mode Branch Target Injection vulnerability (bsc#1191580).\n- CVE-2022-0617: Fixed a null pointer dereference in UDF file system functionality. A local user could crash the system by triggering udf_file_write_iter() via a malicious UDF image. (bsc#1196079)\n- CVE-2022-0492: Fixed a privilege escalation related to cgroups v1 release_agent feature, which allowed bypassing namespace isolation unexpectedly (bsc#1195543).\n- CVE-2022-24448: Fixed an issue in fs/nfs/dir.c. If an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should have occured, but the server instead returned uninitialized data in the file descriptor (bsc#1195612).\n- CVE-2021-0920: Fixed a local privilege escalation due to a use-after-free bug in unix_gc (bsc#1193731).\n- CVE-2016-10905: Fixed a use-after-free is gfs2_clear_rgrpd() and read_rindex_entry() (bsc#1146312).\n\nThe following non-security bug was fixed:\n\n- net: sched: sch_teql: fix null-pointer dereference (bsc#1190717).\n","id":"SUSE-SU-2022:0756-1","modified":"2022-03-08T18:03:12Z","published":"2022-03-08T18:03:12Z","references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220756-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1146312"},{"type":"REPORT","url":"https://bugzilla.suse.com/1190717"},{"type":"REPORT","url":"https://bugzilla.suse.com/1191580"},{"type":"REPORT","url":"https://bugzilla.suse.com/1193731"},{"type":"REPORT","url":"https://bugzilla.suse.com/1194463"},{"type":"REPORT","url":"https://bugzilla.suse.com/1195543"},{"type":"REPORT","url":"https://bugzilla.suse.com/1195612"},{"type":"REPORT","url":"https://bugzilla.suse.com/1195908"},{"type":"REPORT","url":"https://bugzilla.suse.com/1195939"},{"type":"REPORT","url":"https://bugzilla.suse.com/1196079"},{"type":"REPORT","url":"https://bugzilla.suse.com/1196612"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2016-10905"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2021-0920"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2022-0001"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2022-0002"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2022-0492"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2022-0617"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2022-24448"}],"related":["CVE-2016-10905","CVE-2021-0920","CVE-2022-0001","CVE-2022-0002","CVE-2022-0492","CVE-2022-0617","CVE-2022-24448"],"summary":"Security update for the Linux Kernel","upstream":["CVE-2016-10905","CVE-2021-0920","CVE-2022-0001","CVE-2022-0002","CVE-2022-0492","CVE-2022-0617","CVE-2022-24448"]}