Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2024:0727-1

Опубликовано: 29 фев. 2024
Источник: suse-cvrf

Описание

Security update for the Linux Kernel (Live Patch 1 for SLE 15 SP5)

This update for the Linux Kernel 5.14.21-150500_55_7 fixes several issues.

The following security issues were fixed:

  • CVE-2023-4921: Fixed a use-after-free vulnerability in the QFQ network scheduler which could be exploited to achieve local privilege escalation (bsc#1215300).
  • CVE-2023-39198: Fixed a race condition leading to a use-after-free in qxl_mode_dumb_create() (bsc#1217116).
  • CVE-2023-51780: Fixed a use-after-free in do_vcc_ioctl in net/atm/ioctl.c, because of a vcc_recvmsg race condition (bsc#1218733).

Список пакетов

SUSE Linux Enterprise Live Patching 15 SP5
kernel-livepatch-5_14_21-150500_55_7-default-7-150500.2.1

Ссылки

Описание

A race condition was found in the QXL driver in the Linux kernel. The qxl_mode_dumb_create() function dereferences the qobj returned by the qxl_gem_object_create_with_handle(), but the handle is the only one holding a reference to it. This flaw allows an attacker to guess the returned handle value and trigger a use-after-free issue, potentially leading to a denial of service or privilege escalation.

Затронутые продукты
SUSE Linux Enterprise Live Patching 15 SP5:kernel-livepatch-5_14_21-150500_55_7-default-7-150500.2.1
Ссылки

Описание

A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation. When the plug qdisc is used as a class of the qfq qdisc, sending network packets triggers use-after-free in qfq_dequeue() due to the incorrect .peek handler of sch_plug and lack of error checking in agg_dequeue(). We recommend upgrading past commit 8fc134fee27f2263988ae38920bc03da416b03d8.

Затронутые продукты
SUSE Linux Enterprise Live Patching 15 SP5:kernel-livepatch-5_14_21-150500_55_7-default-7-150500.2.1
Ссылки

Описание

An issue was discovered in the Linux kernel before 6.6.8. do_vcc_ioctl in net/atm/ioctl.c has a use-after-free because of a vcc_recvmsg race condition.

Затронутые продукты
SUSE Linux Enterprise Live Patching 15 SP5:kernel-livepatch-5_14_21-150500_55_7-default-7-150500.2.1
Ссылки