MGASA-2022-0324

This kernel update is based on upstream 5.15.65 and fixes at least the following security issues:

An out-of-bounds memory read flaw was found in the Linux kernel's BPF subsystem in how a user calls the bpftailcall function with a key larger than the max_entries of the map. This flaw allows a local user to gain unauthorized access to data (CVE-2022-2905).

A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem) when multiple calls to xfrmprobealgs occurred simultaneously. This flaw could allow a local attacker to potentially trigger an out-of-bounds write or leak kernel heap memory by performing an out-of-bounds read and copying it into a socket (CVE-2022-3028).

There exists a use-after-free in iouring in the Linux kernel. Signalfdpoll() and binderpoll() use a waitqueue whose lifetime is the current task. It will send a POLLFREE notification to all waiters before the queue is freed. Unfortunately, the iouring poll doesn't handle POLLFREE. This allows a use-after-free to occur if a signalfd or binder fd is polled with io_uring poll, and the waitqueue gets freed (CVE-2022-3176).

An issue was discovered in net/netfilter/nftablesapi.c in the kernel before 5.19.6. A denial of service can occur upon binding to an already bound chain (CVE-2022-39190).

mm/rmap.c in the Linux kernel before 5.19.7 has a use-after-free related to leaf anon_vma double reuse (CVE-2022-42703).

Other fixes in this update: - A fix for an issue causing excessive logging (mga#30779) due to an uppstream change that was included in the 5.15.62 kernel update released as MGASA-2022-0305. - bpf, cgroup: Fix kernel BUG in purgeeffectiveprogs - bpf: Restrict bpfsysbpf to CAP_PERFMON - Revert "xhci: turn off port power in shutdown" as it causes some systems to hang on shutdown.

For other upstream fixes in this update, see the referenced changelogs.