Описание
Security update for the Linux Kernel
The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes.
The following security bugs were fixed:
- CVE-2023-0461: Fixed use-after-free in icsk_ulp_data (bsc#1208787).
- CVE-2023-39197: Fixed a out-of-bounds read in nf_conntrack_dccp_packet() (bsc#1216976).
- CVE-2023-45863: Fixed a out-of-bounds write in fill_kobj_path() (bsc#1216058).
- CVE-2023-5717: Fixed a heap out-of-bounds write vulnerability in the Performance Events component (bsc#1216584).
- CVE-2023-45871: Fixed an issue in the IGB driver, where the buffer size may not be adequate for frames larger than the MTU (bsc#1216259).
- CVE-2023-39198: Fixed a race condition leading to use-after-free in qxl_mode_dumb_create() (bsc#1216965).
- CVE-2023-31083: Fixed race condition in hci_uart_tty_ioctl (bsc#1210780).
Список пакетов
SUSE Linux Enterprise High Availability Extension 15 SP1
SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS
SUSE Linux Enterprise Live Patching 15 SP1
SUSE Linux Enterprise Server 15 SP1-LTSS
SUSE Linux Enterprise Server for SAP Applications 15 SP1
openSUSE Leap 15.4
Ссылки
- Link for SUSE-SU-2023:4882-1
- E-Mail link for SUSE-SU-2023:4882-1
- SUSE Security Ratings
- SUSE Bug 1084909
- SUSE Bug 1208787
- SUSE Bug 1210780
- SUSE Bug 1216058
- SUSE Bug 1216259
- SUSE Bug 1216584
- SUSE Bug 1216965
- SUSE Bug 1216976
- SUSE CVE CVE-2023-0461 page
- SUSE CVE CVE-2023-31083 page
- SUSE CVE CVE-2023-39197 page
- SUSE CVE CVE-2023-39198 page
- SUSE CVE CVE-2023-45863 page
- SUSE CVE CVE-2023-45871 page
- SUSE CVE CVE-2023-5717 page
Описание
There is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local privilege escalation. To reach the vulnerability kernel configuration flag CONFIG_TLS or CONFIG_XFRM_ESPINTCP has to be configured, but the operation does not require any privilege. There is a use-after-free bug of icsk_ulp_data of a struct inet_connection_sock. When CONFIG_TLS is enabled, user can install a tls context (struct tls_context) on a connected tcp socket. The context is not cleared if this socket is disconnected and reused as a listener. If a new socket is created from the listener, the context is inherited and vulnerable. The setsockopt TCP_ULP operation does not require any privilege. We recommend upgrading past commit 2c02d41d71f90a5168391b6a5f2954112ba2307c
Затронутые продукты
Ссылки
- CVE-2023-0461
- SUSE Bug 1208787
- SUSE Bug 1208911
- SUSE Bug 1211833
- SUSE Bug 1217079
- SUSE Bug 1218514
Описание
An issue was discovered in drivers/bluetooth/hci_ldisc.c in the Linux kernel 6.2. In hci_uart_tty_ioctl, there is a race condition between HCIUARTSETPROTO and HCIUARTGETPROTO. HCI_UART_PROTO_SET is set before hu->proto is set. A NULL pointer dereference may occur.
Затронутые продукты
Ссылки
- CVE-2023-31083
- SUSE Bug 1210780
Описание
An out-of-bounds read vulnerability was found in Netfilter Connection Tracking (conntrack) in the Linux kernel. This flaw allows a remote user to disclose sensitive information via the DCCP protocol.
Затронутые продукты
Ссылки
- CVE-2023-39197
- SUSE Bug 1216976
- SUSE Bug 1220015
Описание
A race condition was found in the QXL driver in the Linux kernel. The qxl_mode_dumb_create() function dereferences the qobj returned by the qxl_gem_object_create_with_handle(), but the handle is the only one holding a reference to it. This flaw allows an attacker to guess the returned handle value and trigger a use-after-free issue, potentially leading to a denial of service or privilege escalation.
Затронутые продукты
Ссылки
- CVE-2023-39198
- SUSE Bug 1216965
- SUSE Bug 1217116
- SUSE Bug 1219703
Описание
An issue was discovered in lib/kobject.c in the Linux kernel before 6.2.3. With root access, an attacker can trigger a race condition that results in a fill_kobj_path out-of-bounds write.
Затронутые продукты
Ссылки
- CVE-2023-45863
- SUSE Bug 1216058
- SUSE Bug 1220015
Описание
An issue was discovered in drivers/net/ethernet/intel/igb/igb_main.c in the IGB driver in the Linux kernel before 6.5.3. A buffer size may not be adequate for frames larger than the MTU.
Затронутые продукты
Ссылки
- CVE-2023-45871
- SUSE Bug 1216259
Описание
A heap out-of-bounds write vulnerability in the Linux kernel's Linux Kernel Performance Events (perf) component can be exploited to achieve local privilege escalation. If perf_read_group() is called while an event's sibling_list is smaller than its child's sibling_list, it can increment or write to memory locations outside of the allocated buffer. We recommend upgrading past commit 32671e3799ca2e4590773fd0e63aaa4229e50c06.
Затронутые продукты
Ссылки
- CVE-2023-5717
- SUSE Bug 1216584
- SUSE Bug 1216644
- SUSE Bug 1217557
- SUSE Bug 1219697
- SUSE Bug 1220191