Security update for the Linux Kernel
Security update for the Linux Kernel
Announcement ID: | SUSE-SU-2023:2232-1 |
---|---|
Rating: | important |
References: |
|
Cross-References: |
|
CVSS scores: |
|
Affected Products: |
|
An update that solves 28 vulnerabilities and has 14 fixes can now be installed.
Description:
The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bugfixes.
The following security bugs were fixed:
- CVE-2023-2483: Fixed a use after free bug in emac_remove due caused by a race condition (bsc#1211037).
- CVE-2023-2124: Fixed an out of bound access in the XFS subsystem that could have lead to denial-of-service or potentially privilege escalation (bsc#1210498).
- CVE-2023-1670: Fixed a use after free in the Xircom 16-bit PCMCIA Ethernet driver. A local user could use this flaw to crash the system or potentially escalate their privileges on the system (bsc#1209871).
- CVE-2017-5753: Fixed spectre V1 vulnerability on netlink (bsc#1209547).
- CVE-2017-5753: Fixed spectre vulnerability in prlimit (bsc#1209256).
- CVE-2020-36691: Fixed a denial of service (unbounded recursion) vulnerability via a nested Netlink policy with a back reference (bsc#1209613 bsc#1209777).
- CVE-2021-3923: Fixed stack information leak vulnerability that could lead to kernel protection bypass in infiniband RDMA (bsc#1209778).
- CVE-2021-4203: Fixed use-after-free read flaw that was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race with listen() (bsc#1194535).
- CVE-2022-20567: Fixed use after free that could lead to a local privilege escalation in pppol2tp_create of l2tp_ppp.c (bsc#1208850).
- CVE-2022-43945: Fixed a buffer overflow in the NFSD implementation (bsc#1205128).
- CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
- CVE-2023-0597: Fixed lack of randomization of per-cpu entry area in x86/mm (bsc#1207845).
- CVE-2023-1076: Fixed incorrect UID assigned to tun/tap sockets (bsc#1208599).
- CVE-2023-1095: Fixed a NULL pointer dereference in nf_tables due to zeroed list head (bsc#1208777).
- CVE-2023-1118: Fixed a use-after-free bugs caused by ene_tx_irqsim() in media/rc (bsc#1208837).
- CVE-2023-1390: Fixed remote DoS vulnerability in tipc_link_xmit() (bsc#1209289).
- CVE-2023-1513: Fixed an uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak (bsc#1209532).
- CVE-2023-1611: Fixed an use-after-free flaw in btrfs_search_slot (bsc#1209687).
- CVE-2023-1855: Fixed an use-after-free flaw in xgene_hwmon_remove (bsc#1210202).
- CVE-2023-1989: Fixed an use-after-free flaw in btsdio_remove (bsc#1210336).
- CVE-2023-1990: Fixed an use-after-free flaw in ndlc_remove (bsc#1210337).
- CVE-2023-1998: Fixed an use-after-free flaw during login when accessing the shost ipaddress (bsc#1210506).
- CVE-2023-2162: Fixed an use-after-free flaw in iscsi_sw_tcp_session_create (bsc#1210647).
- CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207036).
- CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (bsc#1207125).
- CVE-2023-28328: Fixed a denial of service issue in az6027 driver in drivers/media/usb/dev-usb/az6027.c (bsc#1209291).
- CVE-2023-28464: Fixed user-after-free that could lead to privilege escalation in hci_conn_cleanup in net/uetooth/hci_conn.c (bsc#1209052).
- CVE-2023-28772: Fixed buffer overflow in seq_buf_putmem_hex in lib/seq_buf.c (bsc#1209549).
- CVE-2023-30772: Fixed race condition and resultant use-after-free in da9150_charger_remove (bsc#1210329).
The following non-security bugs were fixed:
- Do not sign the vanilla kernel (bsc#1209008).
- Fix kABI breakage (bsc#1208333)
- PCI: hv: Add a per-bus mutex state_lock (bsc#1207185).
- PCI: hv: Fix a race condition bug in hv_pci_query_relations() (bsc#1207185).
- PCI: hv: Fix a race condition in hv_irq_unmask() that can cause panic (bsc#1207185).
- PCI: hv: Remove the useless hv_pcichild_state from struct hv_pci_dev (bsc#1207185).
- Remove obsolete KMP obsoletes (bsc#1210469).
- Replace mkinitrd dependency with dracut (bsc#1202353).
- cifs: fix double free in dfs mounts (bsc#1209845).
- cifs: fix negotiate context parsing (bsc#1210301).
- cifs: handle reconnect of tcon when there is no cached dfs referral (bsc#1209845).
- cifs: missing null pointer check in cifs_mount (bsc#1209845).
- cifs: serialize all mount attempts (bsc#1209845).
- cred: allow get_cred() and put_cred() to be given NULL (bsc#1209887).
- ipv6: raw: Deduct extension header length in rawv6_push_pending_frames (bsc#1207168).
- k-m-s: Drop Linux 2.6 support
- kernel-module-subpackage: Fix expansion with -b parameter (bsc#1208179).
Special Instructions and Notes:
- Please reboot the system after installing this update.
Patch Instructions:
To install this SUSE Important update use the SUSE recommended
installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
-
SUSE OpenStack Cloud 9
zypper in -t patch SUSE-OpenStack-Cloud-9-2023-2232=1
-
SUSE OpenStack Cloud Crowbar 9
zypper in -t patch SUSE-OpenStack-Cloud-Crowbar-9-2023-2232=1
-
SUSE Linux Enterprise Server for SAP Applications 12 SP4
zypper in -t patch SUSE-SLE-HA-12-SP4-2023-2232=1 SUSE-SLE-SAP-12-SP4-2023-2232=1
-
SUSE Linux Enterprise High Availability Extension 12 SP4
zypper in -t patch SUSE-SLE-HA-12-SP4-2023-2232=1
-
SUSE Linux Enterprise Live Patching 12-SP4
zypper in -t patch SUSE-SLE-Live-Patching-12-SP4-2023-2232=1
-
SUSE Linux Enterprise Server 12 SP4 ESPOS 12-SP4
zypper in -t patch SUSE-SLE-SERVER-12-SP4-ESPOS-2023-2232=1
-
SUSE Linux Enterprise Server 12 SP4 LTSS 12-SP4
zypper in -t patch SUSE-SLE-SERVER-12-SP4-LTSS-2023-2232=1
Package List:
-
SUSE OpenStack Cloud 9 (nosrc x86_64)
- kernel-default-4.12.14-95.125.1
-
SUSE OpenStack Cloud 9 (x86_64)
- kernel-default-base-debuginfo-4.12.14-95.125.1
- kernel-default-base-4.12.14-95.125.1
- kernel-default-devel-debuginfo-4.12.14-95.125.1
- kernel-default-devel-4.12.14-95.125.1
- kernel-default-debuginfo-4.12.14-95.125.1
- kernel-default-debugsource-4.12.14-95.125.1
- kernel-syms-4.12.14-95.125.1
-
SUSE OpenStack Cloud 9 (noarch)
- kernel-source-4.12.14-95.125.1
- kernel-macros-4.12.14-95.125.1
- kernel-devel-4.12.14-95.125.1
-
SUSE OpenStack Cloud Crowbar 9 (nosrc x86_64)
- kernel-default-4.12.14-95.125.1
-
SUSE OpenStack Cloud Crowbar 9 (x86_64)
- kernel-default-base-debuginfo-4.12.14-95.125.1
- kernel-default-base-4.12.14-95.125.1
- kernel-default-devel-debuginfo-4.12.14-95.125.1
- kernel-default-devel-4.12.14-95.125.1
- kernel-default-debuginfo-4.12.14-95.125.1
- kernel-default-debugsource-4.12.14-95.125.1
- kernel-syms-4.12.14-95.125.1
-
SUSE OpenStack Cloud Crowbar 9 (noarch)
- kernel-source-4.12.14-95.125.1
- kernel-macros-4.12.14-95.125.1
- kernel-devel-4.12.14-95.125.1
-
SUSE Linux Enterprise Server for SAP Applications 12 SP4 (ppc64le x86_64)
- cluster-md-kmp-default-4.12.14-95.125.1
- gfs2-kmp-default-4.12.14-95.125.1
- kernel-default-base-debuginfo-4.12.14-95.125.1
- kernel-default-base-4.12.14-95.125.1
- ocfs2-kmp-default-debuginfo-4.12.14-95.125.1
- cluster-md-kmp-default-debuginfo-4.12.14-95.125.1
- gfs2-kmp-default-debuginfo-4.12.14-95.125.1
- kernel-default-debuginfo-4.12.14-95.125.1
- kernel-default-devel-4.12.14-95.125.1
- dlm-kmp-default-debuginfo-4.12.14-95.125.1
- dlm-kmp-default-4.12.14-95.125.1
- drbd-debugsource-9.0.14+git.62f906cf-4.26.2
- drbd-9.0.14+git.62f906cf-4.26.2
- kernel-default-debugsource-4.12.14-95.125.1
- drbd-kmp-default-9.0.14+git.62f906cf_k4.12.14_95.125-4.26.2
- ocfs2-kmp-default-4.12.14-95.125.1
- kernel-syms-4.12.14-95.125.1
- drbd-kmp-default-debuginfo-9.0.14+git.62f906cf_k4.12.14_95.125-4.26.2
-
SUSE Linux Enterprise Server for SAP Applications 12 SP4 (nosrc ppc64le x86_64)
- kernel-default-4.12.14-95.125.1
-
SUSE Linux Enterprise Server for SAP Applications 12 SP4 (noarch)
- kernel-source-4.12.14-95.125.1
- kernel-macros-4.12.14-95.125.1
- kernel-devel-4.12.14-95.125.1
-
SUSE Linux Enterprise Server for SAP Applications 12 SP4 (x86_64)
- kernel-default-devel-debuginfo-4.12.14-95.125.1
-
SUSE Linux Enterprise High Availability Extension 12 SP4 (ppc64le s390x x86_64)
- cluster-md-kmp-default-4.12.14-95.125.1
- gfs2-kmp-default-4.12.14-95.125.1
- ocfs2-kmp-default-debuginfo-4.12.14-95.125.1
- cluster-md-kmp-default-debuginfo-4.12.14-95.125.1
- gfs2-kmp-default-debuginfo-4.12.14-95.125.1
- kernel-default-debuginfo-4.12.14-95.125.1
- dlm-kmp-default-debuginfo-4.12.14-95.125.1
- dlm-kmp-default-4.12.14-95.125.1
- drbd-debugsource-9.0.14+git.62f906cf-4.26.2
- drbd-9.0.14+git.62f906cf-4.26.2
- kernel-default-debugsource-4.12.14-95.125.1
- drbd-kmp-default-9.0.14+git.62f906cf_k4.12.14_95.125-4.26.2
- ocfs2-kmp-default-4.12.14-95.125.1
- drbd-kmp-default-debuginfo-9.0.14+git.62f906cf_k4.12.14_95.125-4.26.2
-
SUSE Linux Enterprise High Availability Extension 12 SP4 (nosrc)
- kernel-default-4.12.14-95.125.1
-
SUSE Linux Enterprise Live Patching 12-SP4 (nosrc)
- kernel-default-4.12.14-95.125.1
-
SUSE Linux Enterprise Live Patching 12-SP4 (ppc64le s390x x86_64)
- kernel-default-kgraft-devel-4.12.14-95.125.1
- kgraft-patch-4_12_14-95_125-default-1-6.5.1
- kernel-default-kgraft-4.12.14-95.125.1
-
SUSE Linux Enterprise Server 12 SP4 ESPOS 12-SP4 (aarch64 nosrc x86_64)
- kernel-default-4.12.14-95.125.1
-
SUSE Linux Enterprise Server 12 SP4 ESPOS 12-SP4 (aarch64 x86_64)
- kernel-default-base-debuginfo-4.12.14-95.125.1
- kernel-default-base-4.12.14-95.125.1
- kernel-default-devel-4.12.14-95.125.1
- kernel-default-debuginfo-4.12.14-95.125.1
- kernel-default-debugsource-4.12.14-95.125.1
- kernel-syms-4.12.14-95.125.1
-
SUSE Linux Enterprise Server 12 SP4 ESPOS 12-SP4 (noarch)
- kernel-source-4.12.14-95.125.1
- kernel-macros-4.12.14-95.125.1
- kernel-devel-4.12.14-95.125.1
-
SUSE Linux Enterprise Server 12 SP4 ESPOS 12-SP4 (x86_64)
- kernel-default-devel-debuginfo-4.12.14-95.125.1
-
SUSE Linux Enterprise Server 12 SP4 LTSS 12-SP4 (aarch64 ppc64le s390x x86_64 nosrc)
- kernel-default-4.12.14-95.125.1
-
SUSE Linux Enterprise Server 12 SP4 LTSS 12-SP4 (aarch64 ppc64le s390x x86_64)
- kernel-default-base-debuginfo-4.12.14-95.125.1
- kernel-default-base-4.12.14-95.125.1
- kernel-default-devel-4.12.14-95.125.1
- kernel-default-debuginfo-4.12.14-95.125.1
- kernel-default-debugsource-4.12.14-95.125.1
- kernel-syms-4.12.14-95.125.1
-
SUSE Linux Enterprise Server 12 SP4 LTSS 12-SP4 (noarch)
- kernel-source-4.12.14-95.125.1
- kernel-macros-4.12.14-95.125.1
- kernel-devel-4.12.14-95.125.1
-
SUSE Linux Enterprise Server 12 SP4 LTSS 12-SP4 (s390x)
- kernel-default-man-4.12.14-95.125.1
-
SUSE Linux Enterprise Server 12 SP4 LTSS 12-SP4 (x86_64)
- kernel-default-devel-debuginfo-4.12.14-95.125.1
References:
- https://www.suse.com/security/cve/CVE-2017-5753.html
- https://www.suse.com/security/cve/CVE-2020-36691.html
- https://www.suse.com/security/cve/CVE-2021-3923.html
- https://www.suse.com/security/cve/CVE-2021-4203.html
- https://www.suse.com/security/cve/CVE-2022-20567.html
- https://www.suse.com/security/cve/CVE-2022-43945.html
- https://www.suse.com/security/cve/CVE-2023-0590.html
- https://www.suse.com/security/cve/CVE-2023-0597.html
- https://www.suse.com/security/cve/CVE-2023-1076.html
- https://www.suse.com/security/cve/CVE-2023-1095.html
- https://www.suse.com/security/cve/CVE-2023-1118.html
- https://www.suse.com/security/cve/CVE-2023-1390.html
- https://www.suse.com/security/cve/CVE-2023-1513.html
- https://www.suse.com/security/cve/CVE-2023-1611.html
- https://www.suse.com/security/cve/CVE-2023-1670.html
- https://www.suse.com/security/cve/CVE-2023-1855.html
- https://www.suse.com/security/cve/CVE-2023-1989.html
- https://www.suse.com/security/cve/CVE-2023-1990.html
- https://www.suse.com/security/cve/CVE-2023-1998.html
- https://www.suse.com/security/cve/CVE-2023-2124.html
- https://www.suse.com/security/cve/CVE-2023-2162.html
- https://www.suse.com/security/cve/CVE-2023-23454.html
- https://www.suse.com/security/cve/CVE-2023-23455.html
- https://www.suse.com/security/cve/CVE-2023-2483.html
- https://www.suse.com/security/cve/CVE-2023-28328.html
- https://www.suse.com/security/cve/CVE-2023-28464.html
- https://www.suse.com/security/cve/CVE-2023-28772.html
- https://www.suse.com/security/cve/CVE-2023-30772.html
- https://bugzilla.suse.com/show_bug.cgi?id=1076830
- https://bugzilla.suse.com/show_bug.cgi?id=1194535
- https://bugzilla.suse.com/show_bug.cgi?id=1202353
- https://bugzilla.suse.com/show_bug.cgi?id=1205128
- https://bugzilla.suse.com/show_bug.cgi?id=1207036
- https://bugzilla.suse.com/show_bug.cgi?id=1207125
- https://bugzilla.suse.com/show_bug.cgi?id=1207168
- https://bugzilla.suse.com/show_bug.cgi?id=1207185
- https://bugzilla.suse.com/show_bug.cgi?id=1207795
- https://bugzilla.suse.com/show_bug.cgi?id=1207845
- https://bugzilla.suse.com/show_bug.cgi?id=1208179
- https://bugzilla.suse.com/show_bug.cgi?id=1208333
- https://bugzilla.suse.com/show_bug.cgi?id=1208599
- https://bugzilla.suse.com/show_bug.cgi?id=1208777
- https://bugzilla.suse.com/show_bug.cgi?id=1208837
- https://bugzilla.suse.com/show_bug.cgi?id=1208850
- https://bugzilla.suse.com/show_bug.cgi?id=1209008
- https://bugzilla.suse.com/show_bug.cgi?id=1209052
- https://bugzilla.suse.com/show_bug.cgi?id=1209256
- https://bugzilla.suse.com/show_bug.cgi?id=1209289
- https://bugzilla.suse.com/show_bug.cgi?id=1209291
- https://bugzilla.suse.com/show_bug.cgi?id=1209532
- https://bugzilla.suse.com/show_bug.cgi?id=1209547
- https://bugzilla.suse.com/show_bug.cgi?id=1209549
- https://bugzilla.suse.com/show_bug.cgi?id=1209613
- https://bugzilla.suse.com/show_bug.cgi?id=1209687
- https://bugzilla.suse.com/show_bug.cgi?id=1209777
- https://bugzilla.suse.com/show_bug.cgi?id=1209778
- https://bugzilla.suse.com/show_bug.cgi?id=1209845
- https://bugzilla.suse.com/show_bug.cgi?id=1209871
- https://bugzilla.suse.com/show_bug.cgi?id=1209887
- https://bugzilla.suse.com/show_bug.cgi?id=1210124
- https://bugzilla.suse.com/show_bug.cgi?id=1210202
- https://bugzilla.suse.com/show_bug.cgi?id=1210301
- https://bugzilla.suse.com/show_bug.cgi?id=1210329
- https://bugzilla.suse.com/show_bug.cgi?id=1210336
- https://bugzilla.suse.com/show_bug.cgi?id=1210337
- https://bugzilla.suse.com/show_bug.cgi?id=1210469
- https://bugzilla.suse.com/show_bug.cgi?id=1210498
- https://bugzilla.suse.com/show_bug.cgi?id=1210506
- https://bugzilla.suse.com/show_bug.cgi?id=1210647
- https://bugzilla.suse.com/show_bug.cgi?id=1211037