SUSE CVE-2021-28687

HVM soft-reset crashes toolstack libxl requires all data structures passed across its public interface to be initialized before use and disposed of afterwards by calling a specific set of functions. Many internal data structures also require this initialize / dispose discipline, but not all of...

SUSE CVE-2021-28690

x86: TSX Async Abort protections not restored after S3 This issue relates to the TSX Async Abort speculative security vulnerability. Please see https://xenbits.xen.org/xsa/advisory-305.html for details. Mitigating TAA by disabling TSX the default and preferred option requires selecting a...

SUSE CVE-2022-30594

The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACESEIZE code path allows attackers to bypass intended restrictions on setting the PTSUSPENDSECCOMP flag...

GSD-2023-1001896 acpi: Fix suspend with Xen PV

acpi: Fix suspend with Xen PV This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.1.9 by commit b96903b7fc8c82ddfd92df4cdd83db3e567da0a5, it was...

kernel: Unprivileged users may use PTRACE_SEIZE to set PTRACE_O_SUSPEND_SECCOMP option

A flaw was found in the Linux kernel. The PTRACESEIZE code path allows attackers to bypass intended restrictions on setting the PTSUSPENDSECCOMP flag, possibly disabling seccomp...

kernel: Unprivileged users may use PTRACE_SEIZE to set PTRACE_O_SUSPEND_SECCOMP option

A flaw was found in the Linux kernel. The PTRACESEIZE code path allows attackers to bypass intended restrictions on setting the PTSUSPENDSECCOMP flag, possibly disabling seccomp...

PT-2023-33369 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.4.226 Description: The issue concerns the protection of tpm pm suspend with locks. It was introduced in version v5.1 and fixed in Linux Kernel version v5.4.226. The actual impact and attack plausibility have...

PT-2023-33140 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.12 Description: The issue concerns the protection of tpm pm suspend with locks. It was introduced in version v5.1 and fixed in Linux Kernel version v6.0.12. The actual impact and attack plausibility have no...

PT-2022-35106 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.3 Description: The issue concerns a potential security vulnerability in the Bluetooth functionality, specifically related to preventing double registration of suspend. The actual impact and attack...

kernel: Unprivileged users may use PTRACE_SEIZE to set PTRACE_O_SUSPEND_SECCOMP option

A flaw was found in the Linux kernel. The PTRACESEIZE code path allows attackers to bypass intended restrictions on setting the PTSUSPENDSECCOMP flag, possibly disabling seccomp...

kernel: Unprivileged users may use PTRACE_SEIZE to set PTRACE_O_SUSPEND_SECCOMP option

A flaw was found in the Linux kernel. The PTRACESEIZE code path allows attackers to bypass intended restrictions on setting the PTSUSPENDSECCOMP flag, possibly disabling seccomp...

PT-2022-28261 · Ckb · Ckb

Name of the Vulnerable Software and Affected Versions: ckb version 0.101.2 Description: The issue arises when the max cycles is insufficient, causing ScriptError::ExceededMaximumCycles to be raised directly instead of suspending as expected. This occurs randomly due to the random execution order ...

OESA-2022-1949 xorg-x11-server security update

Security Fixes: A flaw was found in xorg-x11-server in versions before 21.1.2 and before 1.20.14. An out-of-bounds access can occur in the SProcRenderCompositeGlyphs function. The highest threat from this vulnerability is to data confidentiality and integrity as well as system...

CVE-2022-2657

The Multivendor Marketplace Solution for WooCommerce WordPress plugin before 3.8.12 is lacking authorisation and CSRF in multiple AJAX actions, which could allow any authenticated users, such as subscriber to call them and suspend vendors reporter by the submitter or update arbitrary order status...

GSD-2022-1004828 virtio_net: fix xdp_rxq_info bug after suspend/resume

virtionet: fix xdprxqinfo bug after suspend/resume This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.250 by commit...

GSD-2022-1004742 virtio_net: fix xdp_rxq_info bug after suspend/resume

virtionet: fix xdprxqinfo bug after suspend/resume This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.202 by commit...

GSD-2022-1004627 virtio_net: fix xdp_rxq_info bug after suspend/resume

virtionet: fix xdprxqinfo bug after suspend/resume This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.127 by commit...

GSD-2022-1004564 net: atlantic: remove deep parameter on suspend/resume functions

net: atlantic: remove deep parameter on suspend/resume functions This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.132 by commit...

GSD-2022-1004465 virtio_net: fix xdp_rxq_info bug after suspend/resume

virtionet: fix xdprxqinfo bug after suspend/resume This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.51 by commit...

GSD-2022-1004259 virtio_net: fix xdp_rxq_info bug after suspend/resume

virtionet: fix xdprxqinfo bug after suspend/resume This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.18.8 by commit...