<?xml version="1.0" encoding="UTF-8"?>
<cvrfdoc xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:cvrf="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf" xmlns:cvrf-common="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/common" xmlns:cvssv2="http://scap.nist.gov/schema/cvss-v2/1.0" xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:ns0="http://purl.org/dc/elements/1.1/" xmlns:prod="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod" xmlns:scap-core="http://scap.nist.gov/schema/scap-core/1.0" xmlns:sch="http://purl.oclc.org/dsdl/schematron" xmlns:vuln="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf">
  <DocumentTitle xml:lang="en">Security update for the Linux Kernel (Live Patch 22 for SLE 12 SP5)</DocumentTitle>
  <DocumentType>SUSE Patch</DocumentType>
  <DocumentPublisher Type="Vendor">
    <ContactDetails>security@suse.de</ContactDetails>
    <IssuingAuthority>SUSE Security Team</IssuingAuthority>
  </DocumentPublisher>
  <DocumentTracking>
    <Identification>
      <ID>SUSE-SU-2022:2789-1</ID>
    </Identification>
    <Status>Final</Status>
    <Version>1</Version>
    <RevisionHistory>
      <Revision>
        <Number>1</Number>
        <Date>2022-08-11T16:20:43Z</Date>
        <Description>current</Description>
      </Revision>
    </RevisionHistory>
    <InitialReleaseDate>2022-08-11T16:20:43Z</InitialReleaseDate>
    <CurrentReleaseDate>2022-08-11T16:20:43Z</CurrentReleaseDate>
    <Generator>
      <Engine>cve-database/bin/generate-cvrf.pl</Engine>
      <Date>2017-02-24T01:00:00Z</Date>
    </Generator>
  </DocumentTracking>
  <DocumentNotes>
    <Note Title="Topic" Type="Summary" Ordinal="1" xml:lang="en">Security update for the Linux Kernel (Live Patch 22 for SLE 12 SP5)</Note>
    <Note Title="Details" Type="General" Ordinal="2" xml:lang="en">This update for the Linux Kernel 4.12.14-122_83 fixes several issues.

The following security issues were fixed:

- CVE-2022-28389: Fixed a double free in drivers/net/can/usb/mcba_usb.c vulnerability in the Linux kernel. (bnc#1198033)
- CVE-2022-26490: Fixed a buffer overflow in the st21nfca driver. An attacker with adjacent NFC access could crash the system or corrupt the system memory. (bsc#1196830) 
- CVE-2022-1419: Fixed a concurrency use-after-free in vgem_gem_dumb_create (bsc#1198742).
- CVE-2022-28390: Fixed a double free in drivers/net/can/usb/ems_usb.c vulnerability in the Linux kernel (bnc#1198031).
- CVE-2022-1679: Fixed a use-after-free in the Atheros wireless driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages (bsc#1199487).
- CVE-2022-20141: Fixed a possible use after free due to improper locking in ip_check_mc_rcu() (bsc#1200604).
</Note>
    <Note Title="Terms of Use" Type="Legal Disclaimer" Ordinal="3" xml:lang="en">The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).</Note>
    <Note Title="Patchnames" Type="Details" Ordinal="4" xml:lang="en">SUSE-2022-2789,SUSE-SLE-Live-Patching-12-SP5-2022-2785,SUSE-SLE-Live-Patching-12-SP5-2022-2786,SUSE-SLE-Live-Patching-12-SP5-2022-2789</Note>
  </DocumentNotes>
  <DocumentDistribution xml:lang="en">Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0)</DocumentDistribution>
  <DocumentReferences>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/update/announcement/2022/suse-su-20222789-1/</URL>
      <Description>Link for SUSE-SU-2022:2789-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://lists.suse.com/pipermail/sle-security-updates/2022-August/011900.html</URL>
      <Description>E-Mail link for SUSE-SU-2022:2789-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/security/rating/</URL>
      <Description>SUSE Security Ratings</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1200605</URL>
      <Description>SUSE Bug 1200605</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1201080</URL>
      <Description>SUSE Bug 1201080</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1201517</URL>
      <Description>SUSE Bug 1201517</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1201655</URL>
      <Description>SUSE Bug 1201655</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1201656</URL>
      <Description>SUSE Bug 1201656</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1201657</URL>
      <Description>SUSE Bug 1201657</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2022-1419/</URL>
      <Description>SUSE CVE CVE-2022-1419 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2022-1679/</URL>
      <Description>SUSE CVE CVE-2022-1679 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2022-20141/</URL>
      <Description>SUSE CVE CVE-2022-20141 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2022-26490/</URL>
      <Description>SUSE CVE CVE-2022-26490 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2022-28389/</URL>
      <Description>SUSE CVE CVE-2022-28389 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2022-28390/</URL>
      <Description>SUSE CVE CVE-2022-28390 page</Description>
    </Reference>
  </DocumentReferences>
  <ProductTree xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod">
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Live Patching 12 SP5">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Live Patching 12 SP5">
        <FullProductName ProductID="SUSE Linux Enterprise Live Patching 12 SP5" CPE="cpe:/o:suse:sle-live-patching:12:sp5">SUSE Linux Enterprise Live Patching 12 SP5</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Version" Name="kgraft-patch-4_12_14-122_83-default-17-2.2">
      <FullProductName ProductID="kgraft-patch-4_12_14-122_83-default-17-2.2">kgraft-patch-4_12_14-122_83-default-17-2.2</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="kgraft-patch-4_12_14-122_98-default-13-2.2">
      <FullProductName ProductID="kgraft-patch-4_12_14-122_98-default-13-2.2">kgraft-patch-4_12_14-122_98-default-13-2.2</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="kgraft-patch-4_12_14-122_91-default-15-2.2">
      <FullProductName ProductID="kgraft-patch-4_12_14-122_91-default-15-2.2">kgraft-patch-4_12_14-122_91-default-15-2.2</FullProductName>
    </Branch>
    <Relationship ProductReference="kgraft-patch-4_12_14-122_98-default-13-2.2" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Live Patching 12 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Live Patching 12 SP5:kgraft-patch-4_12_14-122_98-default-13-2.2">kgraft-patch-4_12_14-122_98-default-13-2.2 as a component of SUSE Linux Enterprise Live Patching 12 SP5</FullProductName>
    </Relationship>
    <Relationship ProductReference="kgraft-patch-4_12_14-122_91-default-15-2.2" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Live Patching 12 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Live Patching 12 SP5:kgraft-patch-4_12_14-122_91-default-15-2.2">kgraft-patch-4_12_14-122_91-default-15-2.2 as a component of SUSE Linux Enterprise Live Patching 12 SP5</FullProductName>
    </Relationship>
    <Relationship ProductReference="kgraft-patch-4_12_14-122_83-default-17-2.2" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Live Patching 12 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Live Patching 12 SP5:kgraft-patch-4_12_14-122_83-default-17-2.2">kgraft-patch-4_12_14-122_83-default-17-2.2 as a component of SUSE Linux Enterprise Live Patching 12 SP5</FullProductName>
    </Relationship>
  </ProductTree>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="1">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">The root cause of this vulnerability is that the ioctl$DRM_IOCTL_MODE_DESTROY_DUMB can decrease refcount of *drm_vgem_gem_object *(created in *vgem_gem_dumb_create*) concurrently, and *vgem_gem_dumb_create *will access the freed drm_vgem_gem_object.</Note>
    </Notes>
    <CVE>CVE-2022-1419</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Live Patching 12 SP5:kgraft-patch-4_12_14-122_83-default-17-2.2</ProductID>
        <ProductID>SUSE Linux Enterprise Live Patching 12 SP5:kgraft-patch-4_12_14-122_91-default-15-2.2</ProductID>
        <ProductID>SUSE Linux Enterprise Live Patching 12 SP5:kgraft-patch-4_12_14-122_98-default-13-2.2</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>4.6</BaseScoreV2>
        <VectorV2>AV:L/AC:L/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>7</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2022/suse-su-20222789-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2022-1419.html</URL>
        <Description>CVE-2022-1419</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1198742</URL>
        <Description>SUSE Bug 1198742</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1201655</URL>
        <Description>SUSE Bug 1201655</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1203034</URL>
        <Description>SUSE Bug 1203034</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="2">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">A use-after-free flaw was found in the Linux kernel’s Atheros wireless adapter driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages. This flaw allows a local user to crash or potentially escalate their privileges on the system.</Note>
    </Notes>
    <CVE>CVE-2022-1679</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Live Patching 12 SP5:kgraft-patch-4_12_14-122_83-default-17-2.2</ProductID>
        <ProductID>SUSE Linux Enterprise Live Patching 12 SP5:kgraft-patch-4_12_14-122_91-default-15-2.2</ProductID>
        <ProductID>SUSE Linux Enterprise Live Patching 12 SP5:kgraft-patch-4_12_14-122_98-default-13-2.2</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>7.2</BaseScoreV2>
        <VectorV2>AV:L/AC:L/Au:N/C:C/I:C/A:C</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>7</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2022/suse-su-20222789-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2022-1679.html</URL>
        <Description>CVE-2022-1679</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1199487</URL>
        <Description>SUSE Bug 1199487</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1201080</URL>
        <Description>SUSE Bug 1201080</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1201832</URL>
        <Description>SUSE Bug 1201832</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1204132</URL>
        <Description>SUSE Bug 1204132</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1212316</URL>
        <Description>SUSE Bug 1212316</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="3">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">In ip_check_mc_rcu of igmp.c, there is a possible use after free due to improper locking. This could lead to local escalation of privilege when opening and closing inet sockets with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-112551163References: Upstream kernel</Note>
    </Notes>
    <CVE>CVE-2022-20141</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Live Patching 12 SP5:kgraft-patch-4_12_14-122_83-default-17-2.2</ProductID>
        <ProductID>SUSE Linux Enterprise Live Patching 12 SP5:kgraft-patch-4_12_14-122_91-default-15-2.2</ProductID>
        <ProductID>SUSE Linux Enterprise Live Patching 12 SP5:kgraft-patch-4_12_14-122_98-default-13-2.2</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>6.9</BaseScoreV2>
        <VectorV2>AV:L/AC:M/Au:N/C:C/I:C/A:C</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>7</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2022/suse-su-20222789-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2022-20141.html</URL>
        <Description>CVE-2022-20141</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1200604</URL>
        <Description>SUSE Bug 1200604</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1200605</URL>
        <Description>SUSE Bug 1200605</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1203034</URL>
        <Description>SUSE Bug 1203034</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="4">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">st21nfca_connectivity_event_received in drivers/nfc/st21nfca/se.c in the Linux kernel through 5.16.12 has EVT_TRANSACTION buffer overflows because of untrusted length parameters.</Note>
    </Notes>
    <CVE>CVE-2022-26490</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Live Patching 12 SP5:kgraft-patch-4_12_14-122_83-default-17-2.2</ProductID>
        <ProductID>SUSE Linux Enterprise Live Patching 12 SP5:kgraft-patch-4_12_14-122_91-default-15-2.2</ProductID>
        <ProductID>SUSE Linux Enterprise Live Patching 12 SP5:kgraft-patch-4_12_14-122_98-default-13-2.2</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>4.6</BaseScoreV2>
        <VectorV2>AV:L/AC:L/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>7.8</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2022/suse-su-20222789-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2022-26490.html</URL>
        <Description>CVE-2022-26490</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1196830</URL>
        <Description>SUSE Bug 1196830</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1201656</URL>
        <Description>SUSE Bug 1201656</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1201969</URL>
        <Description>SUSE Bug 1201969</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1211495</URL>
        <Description>SUSE Bug 1211495</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="5">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">mcba_usb_start_xmit in drivers/net/can/usb/mcba_usb.c in the Linux kernel through 5.17.1 has a double free.</Note>
    </Notes>
    <CVE>CVE-2022-28389</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Live Patching 12 SP5:kgraft-patch-4_12_14-122_83-default-17-2.2</ProductID>
        <ProductID>SUSE Linux Enterprise Live Patching 12 SP5:kgraft-patch-4_12_14-122_91-default-15-2.2</ProductID>
        <ProductID>SUSE Linux Enterprise Live Patching 12 SP5:kgraft-patch-4_12_14-122_98-default-13-2.2</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>2.1</BaseScoreV2>
        <VectorV2>AV:L/AC:L/Au:N/C:N/I:N/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>7</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2022/suse-su-20222789-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2022-28389.html</URL>
        <Description>CVE-2022-28389</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1198033</URL>
        <Description>SUSE Bug 1198033</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1201657</URL>
        <Description>SUSE Bug 1201657</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="6">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c in the Linux kernel through 5.17.1 has a double free.</Note>
    </Notes>
    <CVE>CVE-2022-28390</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Live Patching 12 SP5:kgraft-patch-4_12_14-122_83-default-17-2.2</ProductID>
        <ProductID>SUSE Linux Enterprise Live Patching 12 SP5:kgraft-patch-4_12_14-122_91-default-15-2.2</ProductID>
        <ProductID>SUSE Linux Enterprise Live Patching 12 SP5:kgraft-patch-4_12_14-122_98-default-13-2.2</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>4.6</BaseScoreV2>
        <VectorV2>AV:L/AC:L/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>7</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2022/suse-su-20222789-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2022-28390.html</URL>
        <Description>CVE-2022-28390</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1198031</URL>
        <Description>SUSE Bug 1198031</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1201517</URL>
        <Description>SUSE Bug 1201517</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1207969</URL>
        <Description>SUSE Bug 1207969</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
</cvrfdoc>
