AZL-68717 CVE-2022-49610 affecting package kernel 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved: KVM: VMX: Prevent RSB underflow before vmenter On VMX, there are some balanced returns between the time the guest's SPECCTRL value is written, and the vmenter. Balanced returns matched by a preceding call are usually ok, but it's...

CVE-2022-49592

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix dma queue left shift overflow issue When queue number is 4, left shift overflows due to 32 bits integer variable. Mask calculation is wrong for MTLRXQDMAMAP1. If CONFIGUBSAN is enabled, kernel dumps below warning...

DEBIAN-CVE-2022-49503

In the Linux kernel, the following vulnerability has been resolved: ath9khtc: fix potential out of bounds access with invalid rxstatus-rskeyix The "rxstatus-rskeyix" eventually gets passed to testbit so we need to ensure that it is within the bitmap. drivers/net/wireless/ath/ath9k/common.c:46...

DEBIAN-CVE-2022-49387

In the Linux kernel, the following vulnerability has been resolved: watchdog: rzg2lwdt: Fix 32bit overflow issue The value of timercycleus can be 0 due to 32bit overflow. For eg:- If we assign the counter value "0xfff" for computing maxval. This patch fixes this issue by appending ULL to 1024, so...

CVE-2022-49279

In the Linux kernel, the following vulnerability has been resolved: NFSD: prevent integer overflow on 32 bit systems On a 32 bit system, the "len sizeofp" operation can have an integer overflow...

DEBIAN-CVE-2022-49279

In the Linux kernel, the following vulnerability has been resolved: NFSD: prevent integer overflow on 32 bit systems On a 32 bit system, the "len sizeofp" operation can have an integer overflow...

UBUNTU-CVE-2022-49404

In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: Fix potential integer multiplication overflow errors When multiplying of different types, an overflow is possible even when storing the result in a larger type. This is because the conversion is done after the...

UBUNTU-CVE-2022-49279

In the Linux kernel, the following vulnerability has been resolved: NFSD: prevent integer overflow on 32 bit systems On a 32 bit system, the "len sizeofp" operation can have an integer overflow...

UBUNTU-CVE-2022-49623

In the Linux kernel, the following vulnerability has been resolved: powerpc/xive/spapr: correct bitmap allocation size kasan detects access beyond the end of the xibm-bitmap allocation: BUG: KASAN: slab-out-of-bounds in findfirstzerobit+0x40/0x140 Read of size 8 at addr c00000001d1d0118 by task...

UBUNTU-CVE-2022-49503

In the Linux kernel, the following vulnerability has been resolved: ath9khtc: fix potential out of bounds access with invalid rxstatus-rskeyix The "rxstatus-rskeyix" eventually gets passed to testbit so we need to ensure that it is within the bitmap. drivers/net/wireless/ath/ath9k/common.c:46...

UBUNTU-CVE-2022-49251

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: va-macro: fix accessing array out of bounds for enum type Accessing enums using integer would result in array out of bounds access on platforms like aarch64 where sizeoflong is 8 compared to enum size which is 4 byt...

UBUNTU-CVE-2022-49610

In the Linux kernel, the following vulnerability has been resolved: KVM: VMX: Prevent RSB underflow before vmenter On VMX, there are some balanced returns between the time the guest's SPECCTRL value is written, and the vmenter. Balanced returns matched by a preceding call are usually ok, but it's...

DEBIAN-CVE-2022-49075

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix qgroup reserve overflow the qgroup limit We use extentchangeset-byteschanged in qgroupreservedata to record how many bytes we set for EXTENTQGROUPRESERVED state. Currently the byteschanged is set as "unsigned int", and...

DEBIAN-CVE-2022-49074

In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3: Fix GICRCTLR.RWP polling It turns out that our polling of RWP is totally wrong when checking for it in the redistributors, as we test the distributor bit index, whereas it is a different bit number in the RDs...

CVE-2022-49067

In the Linux kernel, the following vulnerability has been resolved: powerpc: Fix virtaddrvalid for 64-bit Book3E & 32-bit mpe: On 64-bit Book3E vmalloc space starts at 0x8000000000000000. Because of the way pa works we have: pa0x8000000000000000 == 0, and therefore virttopfn0x8000000000000000 == ...

UBUNTU-CVE-2022-49074

In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3: Fix GICRCTLR.RWP polling It turns out that our polling of RWP is totally wrong when checking for it in the redistributors, as we test the distributor bit index, whereas it is a different bit number in the RDs...

CVE-2022-49710 dm mirror log: round up region bitmap size to BITS_PER_LONG

In the Linux kernel, the following vulnerability has been resolved: dm mirror log: round up region bitmap size to BITSPERLONG The code in dm-log rounds up bitsetsize to 32 bits. It then uses findnextzerobitle on the allocated region. findnextzerobitle accesses the bitmap using unsigned long...

CVE-2022-49659 can: m_can: m_can_{read_fifo,echo_tx_event}(): shift timestamp to full 32 bits

In the Linux kernel, the following vulnerability has been resolved: can: mcan: mcanreadfifo,echotxevent: shift timestamp to full 32 bits In commit 1be37d3b0414 "can: mcan: fix periph RX path: use rx-offload to ensure skbs are sent from softirq context" the RX path for peripheral devices was...

CVE-2022-49503 ath9k_htc: fix potential out of bounds access with invalid rxstatus->rs_keyix

In the Linux kernel, the following vulnerability has been resolved: ath9khtc: fix potential out of bounds access with invalid rxstatus-rskeyix The "rxstatus-rskeyix" eventually gets passed to testbit so we need to ensure that it is within the bitmap. drivers/net/wireless/ath/ath9k/common.c:46...

CVE-2022-49503

CVE-2022-49503 is a Linux kernel issue in ath9k_htc where rxstatus->rs_keyix can escape bounds when it is passed to test_bit(), risking out-of-bounds access in the bitmap. The condition is triggered in drivers/net/wireless/ath/ath9k/common.c:46 within ath9k_cmn_rx_accept(). The vulnerability s...