Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2024:0624-1

Опубликовано: 26 фев. 2024
Источник: suse-cvrf

Описание

Security update for the Linux Kernel RT (Live Patch 5 for SLE 15 SP5)

This update for the Linux Kernel 5.14.21-150500_13_18 fixes several issues.

The following security issues were fixed:

  • CVE-2023-4921: Fixed a use-after-free vulnerability in the QFQ network scheduler which could be exploited to achieve local privilege escalation (bsc#1215300).
  • CVE-2023-51780: Fixed a use-after-free in do_vcc_ioctl in net/atm/ioctl.c, because of a vcc_recvmsg race condition (bsc#1218733).

Список пакетов

SUSE Linux Enterprise Live Patching 15 SP5
kernel-livepatch-5_14_21-150500_13_18-rt-5-150500.2.1

Ссылки

Описание

A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation. When the plug qdisc is used as a class of the qfq qdisc, sending network packets triggers use-after-free in qfq_dequeue() due to the incorrect .peek handler of sch_plug and lack of error checking in agg_dequeue(). We recommend upgrading past commit 8fc134fee27f2263988ae38920bc03da416b03d8.

Затронутые продукты
SUSE Linux Enterprise Live Patching 15 SP5:kernel-livepatch-5_14_21-150500_13_18-rt-5-150500.2.1
Ссылки

Описание

An issue was discovered in the Linux kernel before 6.6.8. do_vcc_ioctl in net/atm/ioctl.c has a use-after-free because of a vcc_recvmsg race condition.

Затронутые продукты
SUSE Linux Enterprise Live Patching 15 SP5:kernel-livepatch-5_14_21-150500_13_18-rt-5-150500.2.1
Ссылки