Описание
Security update for the Linux Kernel (Live Patch 24 for SLE 15 SP1)
This update for the Linux Kernel 4.12.14-197_89 fixes several issues.
The following security issues were fixed:
- CVE-2022-27666: Fixed a buffer overflow vulnerability in IPsec ESP transformation code. This flaw allowed a local attacker with a normal user privilege to overwrite kernel heap objects and may cause a local privilege escalation. (bnc#1197462)
- CVE-2022-22942: Fixed stale file descriptors on failed usercopy. (bsc#1195065)
Список пакетов
SUSE Linux Enterprise Live Patching 15 SP1
kernel-livepatch-4_12_14-197_89-default-14-150100.2.1
Ссылки
- Link for SUSE-SU-2022:1193-1
- E-Mail link for SUSE-SU-2022:1193-1
- SUSE Security Ratings
- SUSE Bug 1195951
- SUSE Bug 1197133
- SUSE CVE CVE-2022-22942 page
- SUSE CVE CVE-2022-27666 page
Описание
The vmwgfx driver contains a local privilege escalation vulnerability that allows unprivileged users to gain access to files opened by other processes on the system through a dangling 'file' pointer.
Затронутые продукты
SUSE Linux Enterprise Live Patching 15 SP1:kernel-livepatch-4_12_14-197_89-default-14-150100.2.1
Ссылки
- CVE-2022-22942
- SUSE Bug 1195065
- SUSE Bug 1195951
Описание
A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and net/ipv6/esp6.c. This flaw allows a local attacker with a normal user privilege to overwrite kernel heap objects and may cause a local privilege escalation threat.
Затронутые продукты
SUSE Linux Enterprise Live Patching 15 SP1:kernel-livepatch-4_12_14-197_89-default-14-150100.2.1
Ссылки
- CVE-2022-27666
- SUSE Bug 1197131
- SUSE Bug 1197133
- SUSE Bug 1197462