Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2023:4882-1

Опубликовано: 15 дек. 2023
Источник: suse-cvrf

Описание

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

  • CVE-2023-0461: Fixed use-after-free in icsk_ulp_data (bsc#1208787).
  • CVE-2023-39197: Fixed a out-of-bounds read in nf_conntrack_dccp_packet() (bsc#1216976).
  • CVE-2023-45863: Fixed a out-of-bounds write in fill_kobj_path() (bsc#1216058).
  • CVE-2023-5717: Fixed a heap out-of-bounds write vulnerability in the Performance Events component (bsc#1216584).
  • CVE-2023-45871: Fixed an issue in the IGB driver, where the buffer size may not be adequate for frames larger than the MTU (bsc#1216259).
  • CVE-2023-39198: Fixed a race condition leading to use-after-free in qxl_mode_dumb_create() (bsc#1216965).
  • CVE-2023-31083: Fixed race condition in hci_uart_tty_ioctl (bsc#1210780).

Список пакетов

SUSE Linux Enterprise High Availability Extension 15 SP1
cluster-md-kmp-default-4.12.14-150100.197.165.1
dlm-kmp-default-4.12.14-150100.197.165.1
gfs2-kmp-default-4.12.14-150100.197.165.1
ocfs2-kmp-default-4.12.14-150100.197.165.1
SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS
kernel-default-4.12.14-150100.197.165.1
kernel-default-base-4.12.14-150100.197.165.1
kernel-default-devel-4.12.14-150100.197.165.1
kernel-devel-4.12.14-150100.197.165.1
kernel-docs-4.12.14-150100.197.165.1
kernel-macros-4.12.14-150100.197.165.1
kernel-obs-build-4.12.14-150100.197.165.1
kernel-source-4.12.14-150100.197.165.1
kernel-syms-4.12.14-150100.197.165.1
SUSE Linux Enterprise Live Patching 15 SP1
kernel-default-livepatch-4.12.14-150100.197.165.1
kernel-default-livepatch-devel-4.12.14-150100.197.165.1
kernel-livepatch-4_12_14-150100_197_165-default-1-150100.3.5.1
SUSE Linux Enterprise Server 15 SP1-LTSS
kernel-default-4.12.14-150100.197.165.1
kernel-default-base-4.12.14-150100.197.165.1
kernel-default-devel-4.12.14-150100.197.165.1
kernel-default-man-4.12.14-150100.197.165.1
kernel-devel-4.12.14-150100.197.165.1
kernel-docs-4.12.14-150100.197.165.1
kernel-macros-4.12.14-150100.197.165.1
kernel-obs-build-4.12.14-150100.197.165.1
kernel-source-4.12.14-150100.197.165.1
kernel-syms-4.12.14-150100.197.165.1
reiserfs-kmp-default-4.12.14-150100.197.165.1
SUSE Linux Enterprise Server for SAP Applications 15 SP1
kernel-default-4.12.14-150100.197.165.1
kernel-default-base-4.12.14-150100.197.165.1
kernel-default-devel-4.12.14-150100.197.165.1
kernel-devel-4.12.14-150100.197.165.1
kernel-docs-4.12.14-150100.197.165.1
kernel-macros-4.12.14-150100.197.165.1
kernel-obs-build-4.12.14-150100.197.165.1
kernel-source-4.12.14-150100.197.165.1
kernel-syms-4.12.14-150100.197.165.1
reiserfs-kmp-default-4.12.14-150100.197.165.1
openSUSE Leap 15.4
kernel-debug-base-4.12.14-150100.197.165.1
kernel-default-man-4.12.14-150100.197.165.1
kernel-kvmsmall-base-4.12.14-150100.197.165.1
kernel-zfcpdump-man-4.12.14-150100.197.165.1

Описание

There is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local privilege escalation. To reach the vulnerability kernel configuration flag CONFIG_TLS or CONFIG_XFRM_ESPINTCP has to be configured, but the operation does not require any privilege. There is a use-after-free bug of icsk_ulp_data of a struct inet_connection_sock. When CONFIG_TLS is enabled, user can install a tls context (struct tls_context) on a connected tcp socket. The context is not cleared if this socket is disconnected and reused as a listener. If a new socket is created from the listener, the context is inherited and vulnerable. The setsockopt TCP_ULP operation does not require any privilege. We recommend upgrading past commit 2c02d41d71f90a5168391b6a5f2954112ba2307c


Затронутые продукты
SUSE Linux Enterprise High Availability Extension 15 SP1:cluster-md-kmp-default-4.12.14-150100.197.165.1
SUSE Linux Enterprise High Availability Extension 15 SP1:dlm-kmp-default-4.12.14-150100.197.165.1
SUSE Linux Enterprise High Availability Extension 15 SP1:gfs2-kmp-default-4.12.14-150100.197.165.1
SUSE Linux Enterprise High Availability Extension 15 SP1:ocfs2-kmp-default-4.12.14-150100.197.165.1

Ссылки

Описание

An issue was discovered in drivers/bluetooth/hci_ldisc.c in the Linux kernel 6.2. In hci_uart_tty_ioctl, there is a race condition between HCIUARTSETPROTO and HCIUARTGETPROTO. HCI_UART_PROTO_SET is set before hu->proto is set. A NULL pointer dereference may occur.


Затронутые продукты
SUSE Linux Enterprise High Availability Extension 15 SP1:cluster-md-kmp-default-4.12.14-150100.197.165.1
SUSE Linux Enterprise High Availability Extension 15 SP1:dlm-kmp-default-4.12.14-150100.197.165.1
SUSE Linux Enterprise High Availability Extension 15 SP1:gfs2-kmp-default-4.12.14-150100.197.165.1
SUSE Linux Enterprise High Availability Extension 15 SP1:ocfs2-kmp-default-4.12.14-150100.197.165.1

Ссылки

Описание

An out-of-bounds read vulnerability was found in Netfilter Connection Tracking (conntrack) in the Linux kernel. This flaw allows a remote user to disclose sensitive information via the DCCP protocol.


Затронутые продукты
SUSE Linux Enterprise High Availability Extension 15 SP1:cluster-md-kmp-default-4.12.14-150100.197.165.1
SUSE Linux Enterprise High Availability Extension 15 SP1:dlm-kmp-default-4.12.14-150100.197.165.1
SUSE Linux Enterprise High Availability Extension 15 SP1:gfs2-kmp-default-4.12.14-150100.197.165.1
SUSE Linux Enterprise High Availability Extension 15 SP1:ocfs2-kmp-default-4.12.14-150100.197.165.1

Ссылки

Описание

A race condition was found in the QXL driver in the Linux kernel. The qxl_mode_dumb_create() function dereferences the qobj returned by the qxl_gem_object_create_with_handle(), but the handle is the only one holding a reference to it. This flaw allows an attacker to guess the returned handle value and trigger a use-after-free issue, potentially leading to a denial of service or privilege escalation.


Затронутые продукты
SUSE Linux Enterprise High Availability Extension 15 SP1:cluster-md-kmp-default-4.12.14-150100.197.165.1
SUSE Linux Enterprise High Availability Extension 15 SP1:dlm-kmp-default-4.12.14-150100.197.165.1
SUSE Linux Enterprise High Availability Extension 15 SP1:gfs2-kmp-default-4.12.14-150100.197.165.1
SUSE Linux Enterprise High Availability Extension 15 SP1:ocfs2-kmp-default-4.12.14-150100.197.165.1

Ссылки

Описание

An issue was discovered in lib/kobject.c in the Linux kernel before 6.2.3. With root access, an attacker can trigger a race condition that results in a fill_kobj_path out-of-bounds write.


Затронутые продукты
SUSE Linux Enterprise High Availability Extension 15 SP1:cluster-md-kmp-default-4.12.14-150100.197.165.1
SUSE Linux Enterprise High Availability Extension 15 SP1:dlm-kmp-default-4.12.14-150100.197.165.1
SUSE Linux Enterprise High Availability Extension 15 SP1:gfs2-kmp-default-4.12.14-150100.197.165.1
SUSE Linux Enterprise High Availability Extension 15 SP1:ocfs2-kmp-default-4.12.14-150100.197.165.1

Ссылки

Описание

An issue was discovered in drivers/net/ethernet/intel/igb/igb_main.c in the IGB driver in the Linux kernel before 6.5.3. A buffer size may not be adequate for frames larger than the MTU.


Затронутые продукты
SUSE Linux Enterprise High Availability Extension 15 SP1:cluster-md-kmp-default-4.12.14-150100.197.165.1
SUSE Linux Enterprise High Availability Extension 15 SP1:dlm-kmp-default-4.12.14-150100.197.165.1
SUSE Linux Enterprise High Availability Extension 15 SP1:gfs2-kmp-default-4.12.14-150100.197.165.1
SUSE Linux Enterprise High Availability Extension 15 SP1:ocfs2-kmp-default-4.12.14-150100.197.165.1

Ссылки

Описание

A heap out-of-bounds write vulnerability in the Linux kernel's Linux Kernel Performance Events (perf) component can be exploited to achieve local privilege escalation. If perf_read_group() is called while an event's sibling_list is smaller than its child's sibling_list, it can increment or write to memory locations outside of the allocated buffer. We recommend upgrading past commit 32671e3799ca2e4590773fd0e63aaa4229e50c06.


Затронутые продукты
SUSE Linux Enterprise High Availability Extension 15 SP1:cluster-md-kmp-default-4.12.14-150100.197.165.1
SUSE Linux Enterprise High Availability Extension 15 SP1:dlm-kmp-default-4.12.14-150100.197.165.1
SUSE Linux Enterprise High Availability Extension 15 SP1:gfs2-kmp-default-4.12.14-150100.197.165.1
SUSE Linux Enterprise High Availability Extension 15 SP1:ocfs2-kmp-default-4.12.14-150100.197.165.1

Ссылки
Уязвимость SUSE-SU-2023:4882-1