Описание
Security update for the Linux Kernel
The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security and bugfixes.
The following security bugs were fixed:
- CVE-2019-25162: Fixed a potential use after free (bsc#1220409).
- CVE-2021-46923: Fixed reference leakage in fs/mount_setattr (bsc#1220457).
- CVE-2021-46924: Fixed fix memory leak in device probe and remove (bsc#1220459)
- CVE-2021-46932: Fixed missing work initialization before device registration (bsc#1220444)
- CVE-2023-28746: Fixed Register File Data Sampling (bsc#1213456).
- CVE-2023-5197: Fixed se-after-free due to addition and removal of rules from chain bindings within the same transaction (bsc#1218216).
- CVE-2023-52340: Fixed ICMPv6 “Packet Too Big” packets force a DoS of the Linux kernel by forcing 100% CPU (bsc#1219295).
- CVE-2023-52429: Fixed potential DoS in dm_table_create in drivers/md/dm-table.c (bsc#1219827).
- CVE-2023-52439: Fixed use-after-free in uio_open (bsc#1220140).
- CVE-2023-52443: Fixed crash when parsed profile name is empty (bsc#1220240).
- CVE-2023-52445: Fixed use after free on context disconnection (bsc#1220241).
- CVE-2023-52447: Fixed map_fd_put_ptr() signature kABI workaround (bsc#1220251).
- CVE-2023-52448: Fixed kernel NULL pointer dereference in gfs2_rgrp_dump (bsc#1220253).
- CVE-2023-52449: Fixed gluebi NULL pointer dereference caused by ftl notifier (bsc#1220238).
- CVE-2023-52451: Fixed access beyond end of drmem array (bsc#1220250).
- CVE-2023-52452: Fixed Fix accesses to uninit stack slots (bsc#1220257).
- CVE-2023-52456: Fixed tx statemachine deadlock (bsc#1220364).
- CVE-2023-52457: Fixed skipped resource freeing if pm_runtime_resume_and_get() failed (bsc#1220350).
- CVE-2023-52463: Fixed null pointer dereference in efivarfs (bsc#1220328).
- CVE-2023-52464: Fixed possible out-of-bounds string access (bsc#1220330)
- CVE-2023-52475: Fixed use-after-free in powermate_config_complete (bsc#1220649)
- CVE-2023-52478: Fixed kernel crash on receiver USB disconnect (bsc#1220796)
- CVE-2023-6817: Fixed use-after-free in nft_pipapo_walk (bsc#1218195).
- CVE-2024-0607: Fixed 64-bit load issue in nft_byteorder_eval() (bsc#1218915).
- CVE-2024-1151: Fixed unlimited number of recursions from action sets (bsc#1219835).
- CVE-2024-23849: Fixed array-index-out-of-bounds in rds_cmsg_recv (bsc#1219127).
- CVE-2024-23850: Fixed double free of anonymous device after snapshot creation failure (bsc#1219126).
- CVE-2024-23851: Fixed crash in copy_params in drivers/md/dm-ioctl.c (bsc#1219146).
- CVE-2024-25744: Fixed Security issue with int 80 interrupt vector (bsc#1217927).
- CVE-2024-26585: Fixed race between tx work scheduling and socket close (bsc#1220187).
- CVE-2024-26586: Fixed stack corruption (bsc#1220243).
- CVE-2024-26589: Fixed out of bounds read due to variable offset alu on PTR_TO_FLOW_KEYS (bsc#1220255).
- CVE-2024-26591: Fixed re-attachment branch in bpf_tracing_prog_attach (bsc#1220254).
- CVE-2024-26593: Fixed block process call transactions (bsc#1220009).
- CVE-2024-26595: Fixed NULL pointer dereference in error path (bsc#1220344).
- CVE-2024-26598: Fixed potential UAF in LPI translation cache (bsc#1220326).
- CVE-2024-26602: Fixed overall slowdowns with sys_membarrier (bsc1220398).
- CVE-2024-26603: Fixed infinite loop via #PF handling (bsc#1220335).
- CVE-2024-26622: Fixed UAF write bug in tomoyo_write_control() (bsc#1220825).
The following non-security bugs were fixed:
- acpi: apei: set memory failure flags as mf_action_required on synchronous events (git-fixes).
- acpi: button: add lid disable dmi quirk for nextbook ares 8a (git-fixes).
- acpi: extlog: fix null pointer dereference check (git-fixes).
- acpi: resource: add asus model s5402za to quirks (git-fixes).
- acpi: resource: skip irq override on asus expertbook b1502cba (git-fixes).
- acpi: resource: skip irq override on asus expertbook b2402cba (git-fixes).
- acpi: video: add backlight=native dmi quirk for apple imac11,3 (git-fixes).
- acpi: video: add backlight=native dmi quirk for apple imac12,1 and imac12,2 (git-fixes).
- acpi: video: add backlight=native dmi quirk for lenovo thinkpad x131e (3371 amd version) (git-fixes).
- acpi: video: add quirk for the colorful x15 at 23 laptop (git-fixes).
- add reference to recently released cve
- afs: fix the usage of read_seqbegin_or_lock() in afs_find_server*() (git-fixes).
- afs: fix the usage of read_seqbegin_or_lock() in afs_lookup_volume_rcu() (git-fixes).
- afs: hide silly-rename files from userspace (git-fixes).
- afs: increase buffer size in afs_update_volume_status() (git-fixes).
- ahci: asm1166: correct count of reported ports (git-fixes).
- alsa: drop leftover snd-rtctimer stuff from makefile (git-fixes).
- alsa: firewire-lib: fix to check cycle continuity (git-fixes).
- alsa: hda/conexant: add quirk for sws js201d (git-fixes).
- alsa: hda/realtek: apply headset jack quirk for non-bass alc287 thinkpads (git-fixes).
- alsa: hda/realtek: cs35l41: fix device id / model name (git-fixes).
- alsa: hda/realtek: cs35l41: fix order and duplicates in quirks table (git-fixes).
- alsa: hda/realtek: enable headset mic on vaio vjfe-adl (git-fixes).
- alsa: hda/realtek: enable mute led on hp laptop 14-fq0xxx (git-fixes).
- alsa: hda/realtek: fix mute/micmute led for hp mt645 (git-fixes).
- alsa: hda/realtek: fix mute/micmute leds for hp zbook power (git-fixes).
- alsa: hda/realtek: fix the external mic not being recognised for acer swift 1 sf114-32 (git-fixes).
- alsa: usb-audio: add a quirk for yamaha yit-w12tx transmitter (git-fixes).
- alsa: usb-audio: add delay quirk for motu m series 2nd revision (git-fixes).
- alsa: usb-audio: add quirk for rode nt-usb+ (git-fixes).
- alsa: usb-audio: check presence of valid altsetting control (git-fixes).
- alsa: usb-audio: ignore clock selector errors for single connection (git-fixes).
- alsa: usb-audio: more relaxed check of midi jack names (git-fixes).
- alsa: usb-audio: sort quirk table entries (git-fixes).
- arm64: entry: fix arm64_workaround_speculative_unpriv_load (bsc#1219443)
- arm64: entry: preserve/restore x29 even for compat tasks (bsc#1219443)
- arm64: entry: simplify tramp_alias macro and tramp_exit routine (bsc#1219443)
- arm64: errata: add cortex-a510 speculative unprivileged load (bsc#1219443) enable workaround.
- arm64: errata: add cortex-a520 speculative unprivileged load (bsc#1219443) enable workaround without kabi break.
- arm64: errata: mitigate ampere1 erratum ac03_cpu_38 at stage-2 (git-fixes) enable ampere_erratum_ac03_cpu_38 workaround without kabi break
- arm64: irq: set the correct node for shadow call stack (git-fixes)
- arm64: irq: set the correct node for vmap stack (git-fixes)
- arm64: rename arm64_workaround_2966298 (bsc#1219443)
- arm64: subscribe microsoft azure cobalt 100 to arm neoverse n2 errata (git-fixes)
- asoc: doc: fix undefined snd_soc_dapm_nopm argument (git-fixes).
- asoc: rt5645: fix deadlock in rt5645_jack_detect_work() (git-fixes).
- asoc: sof: ipc3: fix message bounds on ipc ops (git-fixes).
- asoc: sunxi: sun4i-spdif: add support for allwinner h616 (git-fixes).
- atm: idt77252: fix a memleak in open_card_ubr0 (git-fixes).
- bluetooth: avoid potential use-after-free in hci_error_reset (git-fixes).
- bluetooth: enforce validation on max value of connection interval (git-fixes).
- bluetooth: hci_event: fix handling of hci_ev_io_capa_request (git-fixes).
- bluetooth: hci_event: fix wrongly recorded wakeup bd_addr (git-fixes).
- bluetooth: hci_sync: check the correct flag before starting a scan (git-fixes).
- bluetooth: hci_sync: fix accept_list when attempting to suspend (git-fixes).
- bluetooth: l2cap: fix possible multiple reject send (git-fixes).
- bluetooth: qca: fix wrong event type for patch config command (git-fixes).
- bpf: fix verification of indirect var-off stack access (git-fixes).
- bpf: guard stack limits against 32bit overflow (git-fixes).
- bpf: minor logging improvement (bsc#1220257).
- bus: moxtet: add spi device table (git-fixes).
- cachefiles: fix memory leak in cachefiles_add_cache() (bsc#1220267).
- can: j1939: fix uaf in j1939_sk_match_filter during setsockopt(so_j1939_filter) (git-fixes).
- crypto: api - disallow identical driver names (git-fixes).
- crypto: ccp - fix null pointer dereference in __sev_platform_shutdown_locked (git-fixes).
- crypto: octeontx2 - fix cptvf driver cleanup (git-fixes).
- crypto: stm32/crc32 - fix parsing list of devices (git-fixes).
- dmaengine: fsl-qdma: fix a memory leak related to the queue command dma (git-fixes).
- dmaengine: fsl-qdma: fix soc may hang on 16 byte unaligned read (git-fixes).
- dmaengine: fsl-qdma: increase size of 'irq_name' (git-fixes).
- dmaengine: fsl-qdma: init irq after reg initialization (git-fixes).
- dmaengine: ptdma: use consistent dma masks (git-fixes).
- dmaengine: shdma: increase size of 'dev_id' (git-fixes).
- dmaengine: ti: edma: add some null pointer checks to the edma_probe (git-fixes).
- driver core: fix device_link_flag_is_sync_state_only() (git-fixes).
- drm/amd/display: fix memory leak in dm_sw_fini() (git-fixes).
- drm/amd/display: fix possible buffer overflow in 'find_dcfclk_for_voltage()' (git-fixes).
- drm/amd/display: fix possible null dereference on device remove/driver unload (git-fixes).
- drm/amd/display: increase frame-larger-than for all display_mode_vba files (git-fixes).
- drm/amd/display: increased min_dcfclk_mhz and min_fclk_mhz (git-fixes).
- drm/amd/display: preserve original aspect ratio in create stream (git-fixes).
- drm/amdgpu/display: initialize gamma correction mode variable in dcn30_get_gamcor_current() (git-fixes).
- drm/amdgpu: reset gpu for s3 suspend abort case (git-fixes).
- drm/amdgpu: skip to program gfxdec registers for suspend abort (git-fixes).
- drm/buddy: fix range bias (git-fixes).
- drm/crtc: fix uninitialized variable use even harder (git-fixes).
- drm/i915/gvt: fix uninitialized variable in handle_mmio() (git-fixes).
- drm/msm/dp: return correct colorimetry for dp_test_dynamic_range_cea case (git-fixes).
- drm/msm/dpu: check for valid hw_pp in dpu_encoder_helper_phys_cleanup (git-fixes).
- drm/msms/dp: fixed link clock divider bits be over written in bpc unknown case (git-fixes).
- drm/prime: support page array >= 4gb (git-fixes).
- drm/syncobj: call drm_syncobj_fence_add_wait when wait_available flag is set (git-fixes).
- drm/ttm: fix an invalid freeing on already freed page in error path (git-fixes).
- drop bcm5974 input patch causing a regression (bsc#1220030)
- efi/capsule-loader: fix incorrect allocation size (git-fixes).
- efi: do not add memblocks for soft-reserved memory (git-fixes).
- efi: runtime: fix potential overflow of soft-reserved region size (git-fixes).
- fbcon: always restore the old font data in fbcon_do_set_font() (git-fixes).
- fbdev: savage: error out if pixclock equals zero (git-fixes).
- fbdev: sis: error out if pixclock equals zero (git-fixes).
- firewire: core: send bus reset promptly on gap count error (git-fixes).
- fs: dlm: fix build with config_ipv6 disabled (git-fixes).
- fs:jfs:ubsan:array-index-out-of-bounds in dbadjtree (git-fixes).
- gpio: 74x164: enable output pins after registers are reset (git-fixes).
- gpio: fix resource unwinding order in error path (git-fixes).
- gpiolib: acpi: ignore touchpad wakeup on gpd g1619-04 (git-fixes).
- gpiolib: fix the error path order in gpiochip_add_data_with_key() (git-fixes).
- hid: apple: add 2021 magic keyboard fn key mapping (git-fixes).
- hid: apple: add support for the 2021 magic keyboard (git-fixes).
- hid: wacom: do not register input devices until after hid_hw_start (git-fixes).
- hid: wacom: generic: avoid reporting a serial of '0' to userspace (git-fixes).
- hwmon: (aspeed-pwm-tacho) mutex for tach reading (git-fixes).
- hwmon: (coretemp) enlarge per package core count limit (git-fixes).
- hwmon: (coretemp) fix bogus core_id to attr name mapping (git-fixes).
- hwmon: (coretemp) fix out-of-bounds memory access (git-fixes).
- i2c: i801: fix block process call transactions (git-fixes).
- i2c: i801: remove i801_set_block_buffer_mode (git-fixes).
- i2c: imx: add timer for handling the stop condition (git-fixes).
- i2c: imx: when being a target, mark the last read as processed (git-fixes).
- i3c: master: cdns: update maximum prescaler value for i2c clock (git-fixes).
- ib/hfi1: fix a memleak in init_credit_return (git-fixes)
- ib/hfi1: fix sdma.h tx->num_descs off-by-one error (git-fixes)
- iio: accel: bma400: fix a compilation problem (git-fixes).
- iio: adc: ad7091r: set alert bit in config register (git-fixes).
- iio: core: fix memleak in iio_device_register_sysfs (git-fixes).
- iio: hid-sensor-als: return 0 for hid_usage_sensor_time_timestamp (git-fixes).
- iio: magnetometer: rm3100: add boundary check for the value read from rm3100_reg_tmrc (git-fixes).
- input: iqs269a - switch to define_simple_dev_pm_ops() and pm_sleep_ptr() (git-fixes).
- input: xpad - add lenovo legion go controllers (git-fixes).
- irqchip/gic-v3-its: fix gicv4.1 vpe affinity update (git-fixes).
- irqchip/irq-brcmstb-l2: add write memory barrier before exit (git-fixes).
- jfs: fix array-index-out-of-bounds in dbadjtree (git-fixes).
- jfs: fix array-index-out-of-bounds in dinewext (git-fixes).
- jfs: fix slab-out-of-bounds read in dtsearch (git-fixes).
- jfs: fix uaf in jfs_evict_inode (git-fixes).
- kbuild: fix changing elf file type for output of gen_btf for big endian (git-fixes).
- kvm: s390: fix cc for successful pqap (git-fixes bsc#1219839).
- kvm: s390: fix setting of fpc register (git-fixes bsc#1220392).
- kvm: s390: vsie: fix race during shadow creation (git-fixes bsc#1220393).
- kvm: vmx: move verw closer to vmentry for mds mitigation (git-fixes).
- kvm: vmx: use bt+jnc, i.e. eflags.cf to select vmresume vs. vmlaunch (git-fixes).
- lan78xx: enable auto speed configuration for lan7850 if no eeprom is detected (git-fixes).
- leds: trigger: panic: do not register panic notifier if creating the trigger failed (git-fixes).
- lib/stackdepot: add depot_fetch_stack helper (jsc-ped#7423).
- lib/stackdepot: add refcount for records (jsc-ped#7423).
- lib/stackdepot: fix first entry having a 0-handle (jsc-ped#7423).
- lib/stackdepot: move stack_record struct definition into the header (jsc-ped#7423).
- libsubcmd: fix memory leak in uniq() (git-fixes).
- media: ddbridge: fix an error code problem in ddb_probe (git-fixes).
- media: ir_toy: fix a memleak in irtoy_tx (git-fixes).
- media: rc: bpf attach/detach requires write permission (git-fixes).
- media: rockchip: rga: fix swizzling for rgb formats (git-fixes).
- media: stk1160: fixed high volume of stk1160_dbg messages (git-fixes).
- mfd: syscon: fix null pointer dereference in of_syscon_register() (git-fixes).
- mm,page_owner: display all stacks and their count (jsc-ped#7423).
- mm,page_owner: filter out stacks by a threshold (jsc-ped#7423).
- mm,page_owner: implement the tracking of the stacks count (jsc-ped#7423).
- mm,page_owner: maintain own list of stack_records structs (jsc-ped#7423).
- mm,page_owner: update documentation regarding page_owner_stacks (jsc-ped#7423).
- mm/hwpoison: fix unpoison_memory() (bsc#1218663).
- mm/hwpoison: mf_mutex for soft offline and unpoison (bsc#1218663).
- mm/hwpoison: remove mf_msg_buddy_2nd and mf_msg_poisoned_huge (bsc#1218663).
- mm: memory-failure: fix potential unexpected return value from unpoison_memory() (git-fixes).
- mmc: core: fix emmc initialization with 1-bit bus connection (git-fixes).
- mmc: core: use mrq.sbc in close-ended ffu (git-fixes).
- mmc: mmc_spi: remove custom dma mapped buffers (git-fixes).
- mmc: sdhci-xenon: add timeout for phy init complete (git-fixes).
- mmc: sdhci-xenon: fix phy init clock stability (git-fixes).
- mmc: slot-gpio: allow non-sleeping gpio ro (git-fixes).
- modpost: trim leading spaces when processing source files list (git-fixes).
- mtd: spinand: gigadevice: fix the get ecc status issue (git-fixes).
- net: usb: dm9601: fix wrong return value in dm9601_mdio_read (git-fixes).
- netfs, fscache: prevent oops in fscache_put_cache() (bsc#1220003).
- nilfs2: fix data corruption in dsync block recovery for small block sizes (git-fixes).
- nilfs2: replace warn_ons for invalid dat metadata block requests (git-fixes).
- nouveau/svm: fix kvcalloc() argument order (git-fixes).
- nouveau: fix function cast warnings (git-fixes).
- ntfs: check overflow when iterating attr_records (git-fixes).
- ntfs: fix use-after-free in ntfs_attr_find() (git-fixes).
- nvme-fabrics: fix i/o connect error handling (git-fixes).
- nvme-host: fix the updating of the firmware version (git-fixes).
- pci/aer: decode requester id when no error info found (git-fixes).
- pci: add no pm reset quirk for nvidia spectrum devices (git-fixes).
- pci: add pci_header_type_mfd definition (bsc#1220021).
- pci: fix 64gt/s effective data rate calculation (git-fixes).
- pci: only override amd usb controller if required (git-fixes).
- pci: switchtec: fix stdev_release() crash after surprise hot remove (git-fixes).
- platform/x86: thinkpad_acpi: only update profile if successfully converted (git-fixes).
- platform/x86: touchscreen_dmi: add info for the teclast x16 plus tablet (git-fixes).
- platform/x86: touchscreen_dmi: allow partial (prefix) matches for acpi names (git-fixes).
- pm: core: remove unnecessary (void *) conversions (git-fixes).
- pm: runtime: have devm_pm_runtime_enable() handle pm_runtime_dont_use_autosuspend() (git-fixes).
- pnp: acpi: fix fortify warning (git-fixes).
- power: supply: bq27xxx-i2c: do not free non existing irq (git-fixes).
- powerpc/64: set task pt_regs->link to the lr value on scv entry (bsc#1194869).
- powerpc/powernv: fix fortify source warnings in opal-prd.c (bsc#1194869).
- powerpc/pseries: add a clear modifier to ibm,pa/pi-features parser (bsc#1220348).
- powerpc/pseries: rework lppaca_shared_proc() to avoid debug_preempt (bsc#1194869).
- powerpc/pseries: set cpu_ftr_dbell according to ibm,pi-features (bsc#1220348).
- powerpc/watchpoint: disable pagefaults when getting user instruction (bsc#1194869).
- powerpc/watchpoints: annotate atomic context in more places (bsc#1194869).
- powerpc/watchpoints: disable preemption in thread_change_pc() (bsc#1194869).
- powerpc: add crtsavres.o to always-y instead of extra-y (bsc#1194869).
- powerpc: do not include lppaca.h in paca.h (bsc#1194869).
- pstore/ram: fix crash when setting number of cpus to an odd number (git-fixes).
- ras/amd/atl: add mi300 row retirement support (jsc#ped-7618).
- ras/amd/atl: fix bit overflow in denorm_addr_df4_np2() (git-fixes).
- ras: introduce a fru memory poison manager (jsc#ped-7618).
- rdma/bnxt_re: add a missing check in bnxt_qplib_query_srq (git-fixes)
- rdma/bnxt_re: return error for srq resize (git-fixes)
- rdma/core: fix uninit-value access in ib_get_eth_speed() (bsc#1219934).
- rdma/core: get ib width and speed from netdev (bsc#1219934).
- rdma/irdma: add ae for too many rnrs (git-fixes)
- rdma/irdma: fix kasan issue with tasklet (git-fixes)
- rdma/irdma: set the cq read threshold for gen 1 (git-fixes)
- rdma/irdma: validate max_send_wr and max_recv_wr (git-fixes)
- rdma/qedr: fix qedr_create_user_qp error flow (git-fixes)
- rdma/srpt: fix function pointer cast warnings (git-fixes)
- rdma/srpt: support specifying the srpt_service_guid parameter (git-fixes)
- refresh patches.suse/dm_blk_ioctl-implement-path-failover-for-sg_io (bsc#1216776, bsc#1220277)
- regulator: core: only increment use_count when enable_count changes (git-fixes).
- regulator: pwm-regulator: add validity checks in continuous .get_voltage (git-fixes).
- revert 'drm/amd/display: increased min_dcfclk_mhz and min_fclk_mhz' (git-fixes).
- revert 'drm/amd/pm: resolve reboot exception for si oland' (git-fixes).
- revert 'drm/amd: flush any delayed gfxoff on suspend entry' (git-fixes).
- rpm/kernel-binary.spec.in: install scripts/gdb when enabled in config (bsc#1219653) they are put into -devel subpackage. and a proper link to /usr/share/gdb/auto-load/ is created.
- s390/qeth: fix potential loss of l3-ip@ in case of network issues (git-fixes bsc#1219840).
- s390: use the correct count for __iowrite64_copy() (git-fixes bsc#1220317).
- sched/membarrier: reduce the ability to hammer on sys_membarrier (git-fixes).
- scsi: core: move scsi_host_busy() out of host lock for waking up eh handler (git-fixes).
- scsi: core: move scsi_host_busy() out of host lock if it is for per-command (git-fixes).
- scsi: fnic: move fnic_fnic_flush_tx() to a work queue (git-fixes bsc#1219141).
- scsi: hisi_sas: prevent parallel flr and controller reset (git-fixes).
- scsi: ibmvfc: limit max hw queues by num_online_cpus() (bsc#1220106).
- scsi: ibmvfc: open-code reset loop for target reset (bsc#1220106).
- scsi: isci: fix an error code problem in isci_io_request_build() (git-fixes).
- scsi: lpfc: add condition to delete ndlp object after sending bls_rjt to an abts (bsc#1220021).
- scsi: lpfc: allow lpfc_plogi_confirm_nport() logic to execute for fabric nodes (bsc#1220021).
- scsi: lpfc: change lpfc_vport fc_flag member into a bitmask (bsc#1220021).
- scsi: lpfc: change lpfc_vport load_flag member into a bitmask (bsc#1220021).
- scsi: lpfc: change nlp state statistic counters into atomic_t (bsc#1220021).
- scsi: lpfc: copyright updates for 14.4.0.0 patches (bsc#1220021).
- scsi: lpfc: fix failure to delete vports when discovery is in progress (bsc#1220021).
- scsi: lpfc: fix possible memory leak in lpfc_rcv_padisc() (bsc#1220021).
- scsi: lpfc: initialize status local variable in lpfc_sli4_repost_sgl_list() (bsc#1220021).
- scsi: lpfc: move handling of reset congestion statistics events (bsc#1220021).
- scsi: lpfc: protect vport fc_nodes list with an explicit spin lock (bsc#1220021).
- scsi: lpfc: remove d_id swap log message from trace event logger (bsc#1220021).
- scsi: lpfc: remove nlp_rcv_plogi early return during rscn processing for ndlps (bsc#1220021).
- scsi: lpfc: remove shost_lock protection for fc_host_port shost apis (bsc#1220021).
- scsi: lpfc: replace deprecated strncpy() with strscpy() (bsc#1220021).
- scsi: lpfc: save fpin frequency statistics upon receipt of peer cgn notifications (bsc#1220021).
- scsi: lpfc: update lpfc version to 14.4.0.0 (bsc#1220021).
- scsi: lpfc: use pci_header_type_mfd instead of literal (bsc#1220021).
- scsi: lpfc: use sg_dma_len() api to get struct scatterlist's length (bsc#1220021).
- scsi: mpi3mr: refresh sdev queue depth after controller reset (git-fixes).
- scsi: revert 'scsi: fcoe: fix potential deadlock on &fip->ctlr_lock' (git-fixes bsc#1219141).
- serial: 8250: remove serial_rs485 sanitization from em485 (git-fixes).
- spi-mxs: fix chipselect glitch (git-fixes).
- spi: hisi-sfc-v3xx: return irq_none if no interrupts were detected (git-fixes).
- spi: ppc4xx: drop write-only variable (git-fixes).
- spi: sh-msiof: avoid integer overflow in constants (git-fixes).
- staging: iio: ad5933: fix type mismatch regression (git-fixes).
- supported.conf: remove external flag from ibm supported modules. (bsc#1209412)
- tcp: fix tcp_mtup_probe_success vs wrong snd_cwnd (bsc#1218450).
- tomoyo: fix uaf write bug in tomoyo_write_control() (git-fixes).
- topology/sysfs: add format parameter to macro defining 'show' functions for proc (jsc#ped-7618).
- topology/sysfs: add ppin in sysfs under cpu topology (jsc#ped-7618).
- tty: allow tiocslcktrmios with cap_checkpoint_restore (git-fixes).
- ubsan: array-index-out-of-bounds in dtsplitroot (git-fixes).
- usb: cdns3: fix memory double free when handle zero packet (git-fixes).
- usb: cdns3: fixed memory use after free at cdns3_gadget_ep_disable() (git-fixes).
- usb: cdns3: modify the return value of cdns_set_active () to void when config_pm_sleep is disabled (git-fixes).
- usb: cdns3: put the cdns set active part outside the spin lock (git-fixes).
- usb: cdns: readd old api (git-fixes).
- usb: cdnsp: blocked some cdns3 specific code (git-fixes).
- usb: cdnsp: fixed issue with incorrect detecting cdnsp family controllers (git-fixes).
- usb: dwc3: gadget: do not disconnect if not started (git-fixes).
- usb: dwc3: gadget: handle ep0 request dequeuing properly (git-fixes).
- usb: dwc3: gadget: ignore end transfer delay on teardown (git-fixes).
- usb: dwc3: gadget: queue pm runtime idle on disconnect event (git-fixes).
- usb: dwc3: gadget: refactor ep0 forced stall/restart into a separate api (git-fixes).
- usb: dwc3: gadget: submit endxfer command if delayed during disconnect (git-fixes).
- usb: dwc3: host: set xhci_sg_trb_cache_size_quirk (git-fixes).
- usb: f_mass_storage: forbid async queue when shutdown happen (git-fixes).
- usb: gadget: core: add missing kerneldoc for vbus_work (git-fixes).
- usb: gadget: core: adjust uevent timing on gadget unbind (git-fixes).
- usb: gadget: core: help prevent panic during uvc unconfigure (git-fixes).
- usb: gadget: core: remove unbalanced mutex_unlock in usb_gadget_activate (git-fixes).
- usb: gadget: f_hid: fix report descriptor allocation (git-fixes).
- usb: gadget: fix obscure lockdep violation for udc_mutex (git-fixes).
- usb: gadget: fix use-after-free read in usb_udc_uevent() (git-fixes).
- usb: gadget: fsl_qe_udc: validate endpoint index for ch9 udc (git-fixes).
- usb: gadget: ncm: avoid dropping datagrams of properly parsed ntbs (git-fixes).
- usb: gadget: udc: core: offload usb_udc_vbus_handler processing (git-fixes).
- usb: gadget: udc: core: prevent soft_connect_store() race (git-fixes).
- usb: gadget: udc: handle gadget_connect failure during bind operation (git-fixes).
- usb: hub: check for alternate port before enabling a_alt_hnp_support (bsc#1218527).
- usb: hub: replace hardcoded quirk value with bit() macro (git-fixes).
- usb: roles: do not get/set_role() when usb_role_switch is unregistered (git-fixes).
- usb: roles: fix null pointer issue when put module's reference (git-fixes).
- usb: serial: cp210x: add id for imst im871a-usb (git-fixes).
- usb: serial: option: add fibocom fm101-gl variant (git-fixes).
- usb: serial: qcserial: add new usb-id for dell wireless dw5826e (git-fixes).
- watchdog: it87_wdt: keep wdtctrl bit 3 unmodified for it8784/it8786 (git-fixes).
- wifi: ath11k: fix registration of 6ghz-only phy without the full channel range (git-fixes).
- wifi: ath9k: fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() (git-fixes).
- wifi: cfg80211: fix missing interfaces when dumping (git-fixes).
- wifi: cfg80211: free beacon_ies when overridden from hidden bss (git-fixes).
- wifi: iwlwifi: fix some error codes (git-fixes).
- wifi: iwlwifi: mvm: avoid baid size integer overflow (git-fixes).
- wifi: iwlwifi: uninitialized variable in iwl_acpi_get_ppag_table() (git-fixes).
- wifi: mac80211: adding missing drv_mgd_complete_tx() call (git-fixes).
- wifi: mac80211: fix race condition on enabling fast-xmit (git-fixes).
- wifi: nl80211: reject iftype change with mesh id change (git-fixes).
- wifi: rt2x00: restart beacon queue when hardware reset (git-fixes).
- wifi: rtl8xxxu: add additional usb ids for rtl8192eu devices (git-fixes).
- wifi: rtlwifi: rtl8723{be,ae}: using calculate_bit_shift() (git-fixes).
- wifi: wext-core: fix -wstringop-overflow warning in ioctl_standard_iw_point() (git-fixes).
- x86/asm: add _asm_rip() macro for x86-64 (%rip) suffix (git-fixes).
- x86/bugs: add asm helpers for executing verw (git-fixes).
- x86/bugs: use alternative() instead of mds_user_clear static key (git-fixes). also add mds_user_clear to kabi severities since it's strictly mitigation related so should be low risk.
- x86/cpu: x86_feature_intel_ppin finally had a cpuid bit (jsc#ped-7618).
- x86/entry_32: add verw just before userspace transition (git-fixes).
- x86/entry_64: add verw just before userspace transition (git-fixes).
- x86/mm: fix memory encryption features advertisement (bsc#1206453).
- xfs: remove unused fields from struct xbtree_ifakeroot (git-fixes).
- xfs: short circuit xfs_growfs_data_private() if delta is zero (git-fixes).
Список пакетов
Container bci/bci-sle15-kernel-module-devel:15.5
Container suse/hpc/warewulf4-x86_64/sle-hpc-node:latest
Container suse/sle-micro/base-5.5:latest
Container suse/sle-micro/kvm-5.5:latest
Image SLES15-SP5-BYOS-Azure
Image SLES15-SP5-BYOS-EC2
Image SLES15-SP5-BYOS-GCE
Image SLES15-SP5-CHOST-BYOS-Aliyun
Image SLES15-SP5-CHOST-BYOS-Azure
Image SLES15-SP5-CHOST-BYOS-EC2
Image SLES15-SP5-CHOST-BYOS-GCE
Image SLES15-SP5-CHOST-BYOS-GDC
Image SLES15-SP5-CHOST-BYOS-SAP-CCloud
Image SLES15-SP5-EC2
Image SLES15-SP5-GCE
Image SLES15-SP5-HPC-BYOS-Azure
Image SLES15-SP5-HPC-BYOS-EC2
Image SLES15-SP5-HPC-BYOS-GCE
Image SLES15-SP5-Hardened-BYOS-Azure
Image SLES15-SP5-Hardened-BYOS-EC2
Image SLES15-SP5-Hardened-BYOS-GCE
Image SLES15-SP5-Manager-Proxy-5-0-BYOS
Image SLES15-SP5-Manager-Proxy-5-0-BYOS-Azure
Image SLES15-SP5-Manager-Proxy-5-0-BYOS-EC2
Image SLES15-SP5-Manager-Proxy-5-0-BYOS-GCE
Image SLES15-SP5-Manager-Server-5-0
Image SLES15-SP5-Manager-Server-5-0-Azure-llc
Image SLES15-SP5-Manager-Server-5-0-Azure-ltd
Image SLES15-SP5-Manager-Server-5-0-BYOS
Image SLES15-SP5-Manager-Server-5-0-BYOS-Azure
Image SLES15-SP5-Manager-Server-5-0-BYOS-EC2
Image SLES15-SP5-Manager-Server-5-0-BYOS-GCE
Image SLES15-SP5-Manager-Server-5-0-EC2-llc
Image SLES15-SP5-Manager-Server-5-0-EC2-ltd
Image SLES15-SP5-Micro-5-5
Image SLES15-SP5-Micro-5-5-Azure
Image SLES15-SP5-Micro-5-5-BYOS
Image SLES15-SP5-Micro-5-5-BYOS-Azure
Image SLES15-SP5-Micro-5-5-BYOS-EC2
Image SLES15-SP5-Micro-5-5-BYOS-GCE
Image SLES15-SP5-Micro-5-5-EC2
Image SLES15-SP5-Micro-5-5-GCE
Image SLES15-SP5-SAP-Azure-3P
Image SLES15-SP5-SAP-Azure-LI-BYOS
Image SLES15-SP5-SAP-Azure-LI-BYOS-Production
Image SLES15-SP5-SAP-Azure-VLI-BYOS
Image SLES15-SP5-SAP-Azure-VLI-BYOS-Production
Image SLES15-SP5-SAP-BYOS-Azure
Image SLES15-SP5-SAP-BYOS-EC2
Image SLES15-SP5-SAP-BYOS-GCE
Image SLES15-SP5-SAP-Hardened-Azure
Image SLES15-SP5-SAP-Hardened-BYOS-Azure
Image SLES15-SP5-SAP-Hardened-BYOS-EC2
Image SLES15-SP5-SAP-Hardened-BYOS-GCE
Image SLES15-SP5-SAP-Hardened-GCE
Image SLES15-SP5-SAPCAL-Azure
Image SLES15-SP5-SAPCAL-EC2
Image SLES15-SP5-SAPCAL-GCE
SUSE Linux Enterprise High Availability Extension 15 SP5
SUSE Linux Enterprise Live Patching 15 SP5
SUSE Linux Enterprise Micro 5.5
SUSE Linux Enterprise Module for Basesystem 15 SP5
SUSE Linux Enterprise Module for Development Tools 15 SP5
SUSE Linux Enterprise Module for Legacy 15 SP5
SUSE Linux Enterprise Workstation Extension 15 SP5
openSUSE Leap 15.5
Ссылки
- Link for SUSE-SU-2024:0858-1
- E-Mail link for SUSE-SU-2024:0858-1
- SUSE Security Ratings
- SUSE Bug 1194869
- SUSE Bug 1206453
- SUSE Bug 1209412
- SUSE Bug 1213456
- SUSE Bug 1216776
- SUSE Bug 1217927
- SUSE Bug 1218195
- SUSE Bug 1218216
- SUSE Bug 1218450
- SUSE Bug 1218527
- SUSE Bug 1218663
- SUSE Bug 1218915
- SUSE Bug 1219126
- SUSE Bug 1219127
- SUSE Bug 1219141
- SUSE Bug 1219146
- SUSE Bug 1219295
Описание
In the Linux kernel, the following vulnerability has been resolved: i2c: Fix a potential use after free Free the adap structure only after we are done using it. This patch just moves the put_device() down a bit to avoid the use after free. [wsa: added comment to the code, added Fixes tag]
Затронутые продукты
Ссылки
- CVE-2019-25162
- SUSE Bug 1220409
Описание
In the Linux kernel, the following vulnerability has been resolved: fs/mount_setattr: always cleanup mount_kattr Make sure that finish_mount_kattr() is called after mount_kattr was succesfully built in both the success and failure case to prevent leaking any references we took when we built it. We returned early if path lookup failed thereby risking to leak an additional reference we took when building mount_kattr when an idmapped mount was requested.
Затронутые продукты
Ссылки
- CVE-2021-46923
- SUSE Bug 1220457
Описание
In the Linux kernel, the following vulnerability has been resolved: NFC: st21nfca: Fix memory leak in device probe and remove 'phy->pending_skb' is alloced when device probe, but forgot to free in the error handling path and remove path, this cause memory leak as follows: unreferenced object 0xffff88800bc06800 (size 512): comm "8", pid 11775, jiffies 4295159829 (age 9.032s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<00000000d66c09ce>] __kmalloc_node_track_caller+0x1ed/0x450 [<00000000c93382b3>] kmalloc_reserve+0x37/0xd0 [<000000005fea522c>] __alloc_skb+0x124/0x380 [<0000000019f29f9a>] st21nfca_hci_i2c_probe+0x170/0x8f2 Fix it by freeing 'pending_skb' in error and remove.
Затронутые продукты
Ссылки
- CVE-2021-46924
- SUSE Bug 1220459
Описание
In the Linux kernel, the following vulnerability has been resolved: Input: appletouch - initialize work before device registration Syzbot has reported warning in __flush_work(). This warning is caused by work->func == NULL, which means missing work initialization. This may happen, since input_dev->close() calls cancel_work_sync(&dev->work), but dev->work initalization happens _after_ input_register_device() call. So this patch moves dev->work initialization before registering input device
Затронутые продукты
Ссылки
- CVE-2021-46932
- SUSE Bug 1220444
Описание
Information exposure through microarchitectural state after transient execution from some register files for some Intel(R) Atom(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
Затронутые продукты
Ссылки
- CVE-2023-28746
- SUSE Bug 1213456
- SUSE Bug 1221323
Описание
A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. Addition and removal of rules from chain bindings within the same transaction causes leads to use-after-free. We recommend upgrading past commit f15f29fd4779be8a418b66e9d52979bb6d6c2325.
Затронутые продукты
Ссылки
- CVE-2023-5197
- SUSE Bug 1218216
Описание
The IPv6 implementation in the Linux kernel before 6.3 has a net/ipv6/route.c max_size threshold that can be consumed easily, e.g., leading to a denial of service (network is unreachable errors) when IPv6 packets are sent in a loop via a raw socket.
Затронутые продукты
Ссылки
- CVE-2023-52340
- SUSE Bug 1219295
- SUSE Bug 1219296
- SUSE Bug 1224298
- SUSE Bug 1224878
Описание
dm_table_create in drivers/md/dm-table.c in the Linux kernel through 6.7.4 can attempt to (in alloc_targets) allocate more than INT_MAX bytes, and crash, because of a missing check for struct dm_ioctl.target_count.
Затронутые продукты
Ссылки
- CVE-2023-52429
- SUSE Bug 1219827
Описание
In the Linux kernel, the following vulnerability has been resolved: uio: Fix use-after-free in uio_open core-1 core-2 ------------------------------------------------------- uio_unregister_device uio_open idev = idr_find() device_unregister(&idev->dev) put_device(&idev->dev) uio_device_release get_device(&idev->dev) kfree(idev) uio_free_minor(minor) uio_release put_device(&idev->dev) kfree(idev) ------------------------------------------------------- In the core-1 uio_unregister_device(), the device_unregister will kfree idev when the idev->dev kobject ref is 1. But after core-1 device_unregister, put_device and before doing kfree, the core-2 may get_device. Then: 1. After core-1 kfree idev, the core-2 will do use-after-free for idev. 2. When core-2 do uio_release and put_device, the idev will be double freed. To address this issue, we can get idev atomic & inc idev reference with minor_lock.
Затронутые продукты
Ссылки
- CVE-2023-52439
- SUSE Bug 1220140
Описание
In the Linux kernel, the following vulnerability has been resolved: apparmor: avoid crash when parsed profile name is empty When processing a packed profile in unpack_profile() described like "profile :ns::samba-dcerpcd /usr/lib*/samba/{,samba/}samba-dcerpcd {...}" a string ":samba-dcerpcd" is unpacked as a fully-qualified name and then passed to aa_splitn_fqname(). aa_splitn_fqname() treats ":samba-dcerpcd" as only containing a namespace. Thus it returns NULL for tmpname, meanwhile tmpns is non-NULL. Later aa_alloc_profile() crashes as the new profile name is NULL now. general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 6 PID: 1657 Comm: apparmor_parser Not tainted 6.7.0-rc2-dirty #16 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014 RIP: 0010:strlen+0x1e/0xa0 Call Trace: <TASK> ? strlen+0x1e/0xa0 aa_policy_init+0x1bb/0x230 aa_alloc_profile+0xb1/0x480 unpack_profile+0x3bc/0x4960 aa_unpack+0x309/0x15e0 aa_replace_profiles+0x213/0x33c0 policy_update+0x261/0x370 profile_replace+0x20e/0x2a0 vfs_write+0x2af/0xe00 ksys_write+0x126/0x250 do_syscall_64+0x46/0xf0 entry_SYSCALL_64_after_hwframe+0x6e/0x76 </TASK> ---[ end trace 0000000000000000 ]--- RIP: 0010:strlen+0x1e/0xa0 It seems such behaviour of aa_splitn_fqname() is expected and checked in other places where it is called (e.g. aa_remove_profiles). Well, there is an explicit comment "a ns name without a following profile is allowed" inside. AFAICS, nothing can prevent unpacked "name" to be in form like ":samba-dcerpcd" - it is passed from userspace. Deny the whole profile set replacement in such case and inform user with EPROTO and an explaining message. Found by Linux Verification Center (linuxtesting.org).
Затронутые продукты
Ссылки
- CVE-2023-52443
- SUSE Bug 1220240
Описание
In the Linux kernel, the following vulnerability has been resolved: media: pvrusb2: fix use after free on context disconnection Upon module load, a kthread is created targeting the pvr2_context_thread_func function, which may call pvr2_context_destroy and thus call kfree() on the context object. However, that might happen before the usb hub_event handler is able to notify the driver. This patch adds a sanity check before the invalid read reported by syzbot, within the context disconnection call stack.
Затронутые продукты
Ссылки
- CVE-2023-52445
- SUSE Bug 1220241
- SUSE Bug 1220315
Описание
In the Linux kernel, the following vulnerability has been resolved: bpf: Defer the free of inner map when necessary When updating or deleting an inner map in map array or map htab, the map may still be accessed by non-sleepable program or sleepable program. However bpf_map_fd_put_ptr() decreases the ref-counter of the inner map directly through bpf_map_put(), if the ref-counter is the last one (which is true for most cases), the inner map will be freed by ops->map_free() in a kworker. But for now, most .map_free() callbacks don't use synchronize_rcu() or its variants to wait for the elapse of a RCU grace period, so after the invocation of ops->map_free completes, the bpf program which is accessing the inner map may incur use-after-free problem. Fix the free of inner map by invoking bpf_map_free_deferred() after both one RCU grace period and one tasks trace RCU grace period if the inner map has been removed from the outer map before. The deferment is accomplished by using call_rcu() or call_rcu_tasks_trace() when releasing the last ref-counter of bpf map. The newly-added rcu_head field in bpf_map shares the same storage space with work field to reduce the size of bpf_map.
Затронутые продукты
Ссылки
- CVE-2023-52447
- SUSE Bug 1220251
Описание
In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump Syzkaller has reported a NULL pointer dereference when accessing rgd->rd_rgl in gfs2_rgrp_dump(). This can happen when creating rgd->rd_gl fails in read_rindex_entry(). Add a NULL pointer check in gfs2_rgrp_dump() to prevent that.
Затронутые продукты
Ссылки
- CVE-2023-52448
- SUSE Bug 1220253
Описание
In the Linux kernel, the following vulnerability has been resolved: mtd: Fix gluebi NULL pointer dereference caused by ftl notifier If both ftl.ko and gluebi.ko are loaded, the notifier of ftl triggers NULL pointer dereference when trying to access 'gluebi->desc' in gluebi_read(). ubi_gluebi_init ubi_register_volume_notifier ubi_enumerate_volumes ubi_notify_all gluebi_notify nb->notifier_call() gluebi_create mtd_device_register mtd_device_parse_register add_mtd_device blktrans_notify_add not->add() ftl_add_mtd tr->add_mtd() scan_header mtd_read mtd_read_oob mtd_read_oob_std gluebi_read mtd->read() gluebi->desc - NULL Detailed reproduction information available at the Link [1], In the normal case, obtain gluebi->desc in the gluebi_get_device(), and access gluebi->desc in the gluebi_read(). However, gluebi_get_device() is not executed in advance in the ftl_add_mtd() process, which leads to NULL pointer dereference. The solution for the gluebi module is to run jffs2 on the UBI volume without considering working with ftl or mtdblock [2]. Therefore, this problem can be avoided by preventing gluebi from creating the mtdblock device after creating mtd partition of the type MTD_UBIVOLUME.
Затронутые продукты
Ссылки
- CVE-2023-52449
- SUSE Bug 1220238
Описание
In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries/memhp: Fix access beyond end of drmem array dlpar_memory_remove_by_index() may access beyond the bounds of the drmem lmb array when the LMB lookup fails to match an entry with the given DRC index. When the search fails, the cursor is left pointing to &drmem_info->lmbs[drmem_info->n_lmbs], which is one element past the last valid entry in the array. The debug message at the end of the function then dereferences this pointer: pr_debug("Failed to hot-remove memory at %llx\n", lmb->base_addr); This was found by inspection and confirmed with KASAN: pseries-hotplug-mem: Attempting to hot-remove LMB, drc index 1234 ================================================================== BUG: KASAN: slab-out-of-bounds in dlpar_memory+0x298/0x1658 Read of size 8 at addr c000000364e97fd0 by task bash/949 dump_stack_lvl+0xa4/0xfc (unreliable) print_report+0x214/0x63c kasan_report+0x140/0x2e0 __asan_load8+0xa8/0xe0 dlpar_memory+0x298/0x1658 handle_dlpar_errorlog+0x130/0x1d0 dlpar_store+0x18c/0x3e0 kobj_attr_store+0x68/0xa0 sysfs_kf_write+0xc4/0x110 kernfs_fop_write_iter+0x26c/0x390 vfs_write+0x2d4/0x4e0 ksys_write+0xac/0x1a0 system_call_exception+0x268/0x530 system_call_vectored_common+0x15c/0x2ec Allocated by task 1: kasan_save_stack+0x48/0x80 kasan_set_track+0x34/0x50 kasan_save_alloc_info+0x34/0x50 __kasan_kmalloc+0xd0/0x120 __kmalloc+0x8c/0x320 kmalloc_array.constprop.0+0x48/0x5c drmem_init+0x2a0/0x41c do_one_initcall+0xe0/0x5c0 kernel_init_freeable+0x4ec/0x5a0 kernel_init+0x30/0x1e0 ret_from_kernel_user_thread+0x14/0x1c The buggy address belongs to the object at c000000364e80000 which belongs to the cache kmalloc-128k of size 131072 The buggy address is located 0 bytes to the right of allocated 98256-byte region [c000000364e80000, c000000364e97fd0) ================================================================== pseries-hotplug-mem: Failed to hot-remove memory at 0 Log failed lookups with a separate message and dereference the cursor only when it points to a valid entry.
Затронутые продукты
Ссылки
- CVE-2023-52451
- SUSE Bug 1220250
Описание
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix accesses to uninit stack slots Privileged programs are supposed to be able to read uninitialized stack memory (ever since 6715df8d5) but, before this patch, these accesses were permitted inconsistently. In particular, accesses were permitted above state->allocated_stack, but not below it. In other words, if the stack was already "large enough", the access was permitted, but otherwise the access was rejected instead of being allowed to "grow the stack". This undesired rejection was happening in two places: - in check_stack_slot_within_bounds() - in check_stack_range_initialized() This patch arranges for these accesses to be permitted. A bunch of tests that were relying on the old rejection had to change; all of them were changed to add also run unprivileged, in which case the old behavior persists. One tests couldn't be updated - global_func16 - because it can't run unprivileged for other reasons. This patch also fixes the tracking of the stack size for variable-offset reads. This second fix is bundled in the same commit as the first one because they're inter-related. Before this patch, writes to the stack using registers containing a variable offset (as opposed to registers with fixed, known values) were not properly contributing to the function's needed stack size. As a result, it was possible for a program to verify, but then to attempt to read out-of-bounds data at runtime because a too small stack had been allocated for it. Each function tracks the size of the stack it needs in bpf_subprog_info.stack_depth, which is maintained by update_stack_depth(). For regular memory accesses, check_mem_access() was calling update_state_depth() but it was passing in only the fixed part of the offset register, ignoring the variable offset. This was incorrect; the minimum possible value of that register should be used instead. This tracking is now fixed by centralizing the tracking of stack size in grow_stack_state(), and by lifting the calls to grow_stack_state() to check_stack_access_within_bounds() as suggested by Andrii. The code is now simpler and more convincingly tracks the correct maximum stack size. check_stack_range_initialized() can now rely on enough stack having been allocated for the access; this helps with the fix for the first issue. A few tests were changed to also check the stack depth computation. The one that fails without this patch is verifier_var_off:stack_write_priv_vs_unpriv.
Затронутые продукты
Ссылки
- CVE-2023-52452
- SUSE Bug 1220257
Описание
In the Linux kernel, the following vulnerability has been resolved: serial: imx: fix tx statemachine deadlock When using the serial port as RS485 port, the tx statemachine is used to control the RTS pin to drive the RS485 transceiver TX_EN pin. When the TTY port is closed in the middle of a transmission (for instance during userland application crash), imx_uart_shutdown disables the interface and disables the Transmission Complete interrupt. afer that, imx_uart_stop_tx bails on an incomplete transmission, to be retriggered by the TC interrupt. This interrupt is disabled and therefore the tx statemachine never transitions out of SEND. The statemachine is in deadlock now, and the TX_EN remains low, making the interface useless. imx_uart_stop_tx now checks for incomplete transmission AND whether TC interrupts are enabled before bailing to be retriggered. This makes sure the state machine handling is reached, and is properly set to WAIT_AFTER_SEND.
Затронутые продукты
Ссылки
- CVE-2023-52456
- SUSE Bug 1220364
Описание
In the Linux kernel, the following vulnerability has been resolved: serial: 8250: omap: Don't skip resource freeing if pm_runtime_resume_and_get() failed Returning an error code from .remove() makes the driver core emit the little helpful error message: remove callback returned a non-zero value. This will be ignored. and then remove the device anyhow. So all resources that were not freed are leaked in this case. Skipping serial8250_unregister_port() has the potential to keep enough of the UART around to trigger a use-after-free. So replace the error return (and with it the little helpful error message) by a more useful error message and continue to cleanup.
Затронутые продукты
Ссылки
- CVE-2023-52457
- SUSE Bug 1220350
Описание
In the Linux kernel, the following vulnerability has been resolved: efivarfs: force RO when remounting if SetVariable is not supported If SetVariable at runtime is not supported by the firmware we never assign a callback for that function. At the same time mount the efivarfs as RO so no one can call that. However, we never check the permission flags when someone remounts the filesystem as RW. As a result this leads to a crash looking like this: $ mount -o remount,rw /sys/firmware/efi/efivars $ efi-updatevar -f PK.auth PK [ 303.279166] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [ 303.280482] Mem abort info: [ 303.280854] ESR = 0x0000000086000004 [ 303.281338] EC = 0x21: IABT (current EL), IL = 32 bits [ 303.282016] SET = 0, FnV = 0 [ 303.282414] EA = 0, S1PTW = 0 [ 303.282821] FSC = 0x04: level 0 translation fault [ 303.283771] user pgtable: 4k pages, 48-bit VAs, pgdp=000000004258c000 [ 303.284913] [0000000000000000] pgd=0000000000000000, p4d=0000000000000000 [ 303.286076] Internal error: Oops: 0000000086000004 [#1] PREEMPT SMP [ 303.286936] Modules linked in: qrtr tpm_tis tpm_tis_core crct10dif_ce arm_smccc_trng rng_core drm fuse ip_tables x_tables ipv6 [ 303.288586] CPU: 1 PID: 755 Comm: efi-updatevar Not tainted 6.3.0-rc1-00108-gc7d0c4695c68 #1 [ 303.289748] Hardware name: Unknown Unknown Product/Unknown Product, BIOS 2023.04-00627-g88336918701d 04/01/2023 [ 303.291150] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 303.292123] pc : 0x0 [ 303.292443] lr : efivar_set_variable_locked+0x74/0xec [ 303.293156] sp : ffff800008673c10 [ 303.293619] x29: ffff800008673c10 x28: ffff0000037e8000 x27: 0000000000000000 [ 303.294592] x26: 0000000000000800 x25: ffff000002467400 x24: 0000000000000027 [ 303.295572] x23: ffffd49ea9832000 x22: ffff0000020c9800 x21: ffff000002467000 [ 303.296566] x20: 0000000000000001 x19: 00000000000007fc x18: 0000000000000000 [ 303.297531] x17: 0000000000000000 x16: 0000000000000000 x15: 0000aaaac807ab54 [ 303.298495] x14: ed37489f673633c0 x13: 71c45c606de13f80 x12: 47464259e219acf4 [ 303.299453] x11: ffff000002af7b01 x10: 0000000000000003 x9 : 0000000000000002 [ 303.300431] x8 : 0000000000000010 x7 : ffffd49ea8973230 x6 : 0000000000a85201 [ 303.301412] x5 : 0000000000000000 x4 : ffff0000020c9800 x3 : 00000000000007fc [ 303.302370] x2 : 0000000000000027 x1 : ffff000002467400 x0 : ffff000002467000 [ 303.303341] Call trace: [ 303.303679] 0x0 [ 303.303938] efivar_entry_set_get_size+0x98/0x16c [ 303.304585] efivarfs_file_write+0xd0/0x1a4 [ 303.305148] vfs_write+0xc4/0x2e4 [ 303.305601] ksys_write+0x70/0x104 [ 303.306073] __arm64_sys_write+0x1c/0x28 [ 303.306622] invoke_syscall+0x48/0x114 [ 303.307156] el0_svc_common.constprop.0+0x44/0xec [ 303.307803] do_el0_svc+0x38/0x98 [ 303.308268] el0_svc+0x2c/0x84 [ 303.308702] el0t_64_sync_handler+0xf4/0x120 [ 303.309293] el0t_64_sync+0x190/0x194 [ 303.309794] Code: ???????? ???????? ???????? ???????? (????????) [ 303.310612] ---[ end trace 0000000000000000 ]--- Fix this by adding a .reconfigure() function to the fs operations which we can use to check the requested flags and deny anything that's not RO if the firmware doesn't implement SetVariable at runtime.
Затронутые продукты
Ссылки
- CVE-2023-52463
- SUSE Bug 1220328
Описание
In the Linux kernel, the following vulnerability has been resolved: EDAC/thunderx: Fix possible out-of-bounds string access Enabling -Wstringop-overflow globally exposes a warning for a common bug in the usage of strncat(): drivers/edac/thunderx_edac.c: In function 'thunderx_ocx_com_threaded_isr': drivers/edac/thunderx_edac.c:1136:17: error: 'strncat' specified bound 1024 equals destination size [-Werror=stringop-overflow=] 1136 | strncat(msg, other, OCX_MESSAGE_SIZE); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ... 1145 | strncat(msg, other, OCX_MESSAGE_SIZE); ... 1150 | strncat(msg, other, OCX_MESSAGE_SIZE); ... Apparently the author of this driver expected strncat() to behave the way that strlcat() does, which uses the size of the destination buffer as its third argument rather than the length of the source buffer. The result is that there is no check on the size of the allocated buffer. Change it to strlcat(). [ bp: Trim compiler output, fixup commit message. ]
Затронутые продукты
Ссылки
- CVE-2023-52464
- SUSE Bug 1220330
Описание
In the Linux kernel, the following vulnerability has been resolved: Input: powermate - fix use-after-free in powermate_config_complete syzbot has found a use-after-free bug [1] in the powermate driver. This happens when the device is disconnected, which leads to a memory free from the powermate_device struct. When an asynchronous control message completes after the kfree and its callback is invoked, the lock does not exist anymore and hence the bug. Use usb_kill_urb() on pm->config to cancel any in-progress requests upon device disconnection. [1] https://syzkaller.appspot.com/bug?extid=0434ac83f907a1dbdd1e
Затронутые продукты
Ссылки
- CVE-2023-52475
- SUSE Bug 1220649
Описание
In the Linux kernel, the following vulnerability has been resolved: HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect hidpp_connect_event() has *four* time-of-check vs time-of-use (TOCTOU) races when it races with itself. hidpp_connect_event() primarily runs from a workqueue but it also runs on probe() and if a "device-connected" packet is received by the hw when the thread running hidpp_connect_event() from probe() is waiting on the hw, then a second thread running hidpp_connect_event() will be started from the workqueue. This opens the following races (note the below code is simplified): 1. Retrieving + printing the protocol (harmless race): if (!hidpp->protocol_major) { hidpp_root_get_protocol_version() hidpp->protocol_major = response.rap.params[0]; } We can actually see this race hit in the dmesg in the abrt output attached to rhbz#2227968: [ 3064.624215] logitech-hidpp-device 0003:046D:4071.0049: HID++ 4.5 device connected. [ 3064.658184] logitech-hidpp-device 0003:046D:4071.0049: HID++ 4.5 device connected. Testing with extra logging added has shown that after this the 2 threads take turn grabbing the hw access mutex (send_mutex) so they ping-pong through all the other TOCTOU cases managing to hit all of them: 2. Updating the name to the HIDPP name (harmless race): if (hidpp->name == hdev->name) { ... hidpp->name = new_name; } 3. Initializing the power_supply class for the battery (problematic!): hidpp_initialize_battery() { if (hidpp->battery.ps) return 0; probe_battery(); /* Blocks, threads take turns executing this */ hidpp->battery.desc.properties = devm_kmemdup(dev, hidpp_battery_props, cnt, GFP_KERNEL); hidpp->battery.ps = devm_power_supply_register(&hidpp->hid_dev->dev, &hidpp->battery.desc, cfg); } 4. Creating delayed input_device (potentially problematic): if (hidpp->delayed_input) return; hidpp->delayed_input = hidpp_allocate_input(hdev); The really big problem here is 3. Hitting the race leads to the following sequence: hidpp->battery.desc.properties = devm_kmemdup(dev, hidpp_battery_props, cnt, GFP_KERNEL); hidpp->battery.ps = devm_power_supply_register(&hidpp->hid_dev->dev, &hidpp->battery.desc, cfg); ... hidpp->battery.desc.properties = devm_kmemdup(dev, hidpp_battery_props, cnt, GFP_KERNEL); hidpp->battery.ps = devm_power_supply_register(&hidpp->hid_dev->dev, &hidpp->battery.desc, cfg); So now we have registered 2 power supplies for the same battery, which looks a bit weird from userspace's pov but this is not even the really big problem. Notice how: 1. This is all devm-maganaged 2. The hidpp->battery.desc struct is shared between the 2 power supplies 3. hidpp->battery.desc.properties points to the result from the second devm_kmemdup() This causes a use after free scenario on USB disconnect of the receiver: 1. The last registered power supply class device gets unregistered 2. The memory from the last devm_kmemdup() call gets freed, hidpp->battery.desc.properties now points to freed memory 3. The first registered power supply class device gets unregistered, this involves sending a remove uevent to userspace which invokes power_supply_uevent() to fill the uevent data 4. power_supply_uevent() uses hidpp->battery.desc.properties which now points to freed memory leading to backtraces like this one: Sep 22 20:01:35 eric kernel: BUG: unable to handle page fault for address: ffffb2140e017f08 ... Sep 22 20:01:35 eric kernel: Workqueue: usb_hub_wq hub_event Sep 22 20:01:35 eric kernel: RIP: 0010:power_supply_uevent+0xee/0x1d0 ... Sep 22 20:01:35 eric kernel: ? asm_exc_page_fault+0x26/0x30 Sep 22 20:01:35 eric kernel: ? power_supply_uevent+0xee/0x1d0 Sep 22 20:01:35 eric kernel: ? power_supply_uevent+0x10d/0x1d0 Sep 22 20:01:35 eric kernel: dev_uevent+0x10f/0x2d0 Sep 22 20:01:35 eric kernel: kobject_uevent_env+0x291/0x680 Sep 22 20:01:35 eric kernel: ---truncated---
Затронутые продукты
Ссылки
- CVE-2023-52478
- SUSE Bug 1220796
Описание
A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The function nft_pipapo_walk did not skip inactive elements during set walk which could lead double deactivations of PIPAPO (Pile Packet Policies) elements, leading to use-after-free. We recommend upgrading past commit 317eb9685095678f2c9f5a8189de698c5354316a.
Затронутые продукты
Ссылки
- CVE-2023-6817
- SUSE Bug 1218195
Описание
A flaw was found in the Netfilter subsystem in the Linux kernel. The issue is in the nft_byteorder_eval() function, where the code iterates through a loop and writes to the `dst` array. On each iteration, 8 bytes are written, but `dst` is an array of u32, so each element only has space for 4 bytes. That means every iteration overwrites part of the previous element corrupting this array of u32. This flaw allows a local user to cause a denial of service or potentially break NetFilter functionality.
Затронутые продукты
Ссылки
- CVE-2024-0607
- SUSE Bug 1218915
Описание
A vulnerability was reported in the Open vSwitch sub-component in the Linux Kernel. The flaw occurs when a recursive operation of code push recursively calls into the code block. The OVS module does not validate the stack depth, pushing too many frames and causing a stack overflow. As a result, this can lead to a crash or other related issues.
Затронутые продукты
Ссылки
- CVE-2024-1151
- SUSE Bug 1219835
Описание
In rds_recv_track_latency in net/rds/af_rds.c in the Linux kernel through 6.7.1, there is an off-by-one error for an RDS_MSG_RX_DGRAM_TRACE_MAX comparison, resulting in out-of-bounds access.
Затронутые продукты
Ссылки
- CVE-2024-23849
- SUSE Bug 1219127
Описание
In btrfs_get_root_ref in fs/btrfs/disk-io.c in the Linux kernel through 6.7.1, there can be an assertion failure and crash because a subvolume can be read out too soon after its root item is inserted upon subvolume creation.
Затронутые продукты
Ссылки
- CVE-2024-23850
- SUSE Bug 1219126
Описание
copy_params in drivers/md/dm-ioctl.c in the Linux kernel through 6.7.1 can attempt to allocate more than INT_MAX bytes, and crash, because of a missing param_kernel->data_size check. This is related to ctl_ioctl.
Затронутые продукты
Ссылки
- CVE-2024-23851
- SUSE Bug 1219146
Описание
In the Linux kernel before 6.6.7, an untrusted VMM can trigger int80 syscall handling at any given point. This is related to arch/x86/coco/tdx/tdx.c and arch/x86/mm/mem_encrypt_amd.c.
Затронутые продукты
Ссылки
- CVE-2024-25744
- SUSE Bug 1217927
- SUSE Bug 1220314
Описание
In the Linux kernel, the following vulnerability has been resolved: tls: fix race between tx work scheduling and socket close Similarly to previous commit, the submitting thread (recvmsg/sendmsg) may exit as soon as the async crypto handler calls complete(). Reorder scheduling the work before calling complete(). This seems more logical in the first place, as it's the inverse order of what the submitting thread will do.
Затронутые продукты
Ссылки
- CVE-2024-26585
- SUSE Bug 1220187
- SUSE Bug 1220211
- SUSE Bug 1224298
- SUSE Bug 1224878
Описание
In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix stack corruption When tc filters are first added to a net device, the corresponding local port gets bound to an ACL group in the device. The group contains a list of ACLs. In turn, each ACL points to a different TCAM region where the filters are stored. During forwarding, the ACLs are sequentially evaluated until a match is found. One reason to place filters in different regions is when they are added with decreasing priorities and in an alternating order so that two consecutive filters can never fit in the same region because of their key usage. In Spectrum-2 and newer ASICs the firmware started to report that the maximum number of ACLs in a group is more than 16, but the layout of the register that configures ACL groups (PAGT) was not updated to account for that. It is therefore possible to hit stack corruption [1] in the rare case where more than 16 ACLs in a group are required. Fix by limiting the maximum ACL group size to the minimum between what the firmware reports and the maximum ACLs that fit in the PAGT register. Add a test case to make sure the machine does not crash when this condition is hit. [1] Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: mlxsw_sp_acl_tcam_group_update+0x116/0x120 [...] dump_stack_lvl+0x36/0x50 panic+0x305/0x330 __stack_chk_fail+0x15/0x20 mlxsw_sp_acl_tcam_group_update+0x116/0x120 mlxsw_sp_acl_tcam_group_region_attach+0x69/0x110 mlxsw_sp_acl_tcam_vchunk_get+0x492/0xa20 mlxsw_sp_acl_tcam_ventry_add+0x25/0xe0 mlxsw_sp_acl_rule_add+0x47/0x240 mlxsw_sp_flower_replace+0x1a9/0x1d0 tc_setup_cb_add+0xdc/0x1c0 fl_hw_replace_filter+0x146/0x1f0 fl_change+0xc17/0x1360 tc_new_tfilter+0x472/0xb90 rtnetlink_rcv_msg+0x313/0x3b0 netlink_rcv_skb+0x58/0x100 netlink_unicast+0x244/0x390 netlink_sendmsg+0x1e4/0x440 ____sys_sendmsg+0x164/0x260 ___sys_sendmsg+0x9a/0xe0 __sys_sendmsg+0x7a/0xc0 do_syscall_64+0x40/0xe0 entry_SYSCALL_64_after_hwframe+0x63/0x6b
Затронутые продукты
Ссылки
- CVE-2024-26586
- SUSE Bug 1220243
Описание
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject variable offset alu on PTR_TO_FLOW_KEYS For PTR_TO_FLOW_KEYS, check_flow_keys_access() only uses fixed off for validation. However, variable offset ptr alu is not prohibited for this ptr kind. So the variable offset is not checked. The following prog is accepted: func#0 @0 0: R1=ctx() R10=fp0 0: (bf) r6 = r1 ; R1=ctx() R6_w=ctx() 1: (79) r7 = *(u64 *)(r6 +144) ; R6_w=ctx() R7_w=flow_keys() 2: (b7) r8 = 1024 ; R8_w=1024 3: (37) r8 /= 1 ; R8_w=scalar() 4: (57) r8 &= 1024 ; R8_w=scalar(smin=smin32=0, smax=umax=smax32=umax32=1024,var_off=(0x0; 0x400)) 5: (0f) r7 += r8 mark_precise: frame0: last_idx 5 first_idx 0 subseq_idx -1 mark_precise: frame0: regs=r8 stack= before 4: (57) r8 &= 1024 mark_precise: frame0: regs=r8 stack= before 3: (37) r8 /= 1 mark_precise: frame0: regs=r8 stack= before 2: (b7) r8 = 1024 6: R7_w=flow_keys(smin=smin32=0,smax=umax=smax32=umax32=1024,var_off =(0x0; 0x400)) R8_w=scalar(smin=smin32=0,smax=umax=smax32=umax32=1024, var_off=(0x0; 0x400)) 6: (79) r0 = *(u64 *)(r7 +0) ; R0_w=scalar() 7: (95) exit This prog loads flow_keys to r7, and adds the variable offset r8 to r7, and finally causes out-of-bounds access: BUG: unable to handle page fault for address: ffffc90014c80038 [...] Call Trace: <TASK> bpf_dispatcher_nop_func include/linux/bpf.h:1231 [inline] __bpf_prog_run include/linux/filter.h:651 [inline] bpf_prog_run include/linux/filter.h:658 [inline] bpf_prog_run_pin_on_cpu include/linux/filter.h:675 [inline] bpf_flow_dissect+0x15f/0x350 net/core/flow_dissector.c:991 bpf_prog_test_run_flow_dissector+0x39d/0x620 net/bpf/test_run.c:1359 bpf_prog_test_run kernel/bpf/syscall.c:4107 [inline] __sys_bpf+0xf8f/0x4560 kernel/bpf/syscall.c:5475 __do_sys_bpf kernel/bpf/syscall.c:5561 [inline] __se_sys_bpf kernel/bpf/syscall.c:5559 [inline] __x64_sys_bpf+0x73/0xb0 kernel/bpf/syscall.c:5559 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x3f/0x110 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b Fix this by rejecting ptr alu with variable offset on flow_keys. Applying the patch rejects the program with "R7 pointer arithmetic on flow_keys prohibited".
Затронутые продукты
Ссылки
- CVE-2024-26589
- SUSE Bug 1220255
Описание
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix re-attachment branch in bpf_tracing_prog_attach The following case can cause a crash due to missing attach_btf: 1) load rawtp program 2) load fentry program with rawtp as target_fd 3) create tracing link for fentry program with target_fd = 0 4) repeat 3 In the end we have: - prog->aux->dst_trampoline == NULL - tgt_prog == NULL (because we did not provide target_fd to link_create) - prog->aux->attach_btf == NULL (the program was loaded with attach_prog_fd=X) - the program was loaded for tgt_prog but we have no way to find out which one BUG: kernel NULL pointer dereference, address: 0000000000000058 Call Trace: <TASK> ? __die+0x20/0x70 ? page_fault_oops+0x15b/0x430 ? fixup_exception+0x22/0x330 ? exc_page_fault+0x6f/0x170 ? asm_exc_page_fault+0x22/0x30 ? bpf_tracing_prog_attach+0x279/0x560 ? btf_obj_id+0x5/0x10 bpf_tracing_prog_attach+0x439/0x560 __sys_bpf+0x1cf4/0x2de0 __x64_sys_bpf+0x1c/0x30 do_syscall_64+0x41/0xf0 entry_SYSCALL_64_after_hwframe+0x6e/0x76 Return -EINVAL in this situation.
Затронутые продукты
Ссылки
- CVE-2024-26591
- SUSE Bug 1220254
Описание
In the Linux kernel, the following vulnerability has been resolved: i2c: i801: Fix block process call transactions According to the Intel datasheets, software must reset the block buffer index twice for block process call transactions: once before writing the outgoing data to the buffer, and once again before reading the incoming data from the buffer. The driver is currently missing the second reset, causing the wrong portion of the block buffer to be read.
Затронутые продукты
Ссылки
- CVE-2024-26593
- SUSE Bug 1220009
Описание
In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path When calling mlxsw_sp_acl_tcam_region_destroy() from an error path after failing to attach the region to an ACL group, we hit a NULL pointer dereference upon 'region->group->tcam' [1]. Fix by retrieving the 'tcam' pointer using mlxsw_sp_acl_to_tcam(). [1] BUG: kernel NULL pointer dereference, address: 0000000000000000 [...] RIP: 0010:mlxsw_sp_acl_tcam_region_destroy+0xa0/0xd0 [...] Call Trace: mlxsw_sp_acl_tcam_vchunk_get+0x88b/0xa20 mlxsw_sp_acl_tcam_ventry_add+0x25/0xe0 mlxsw_sp_acl_rule_add+0x47/0x240 mlxsw_sp_flower_replace+0x1a9/0x1d0 tc_setup_cb_add+0xdc/0x1c0 fl_hw_replace_filter+0x146/0x1f0 fl_change+0xc17/0x1360 tc_new_tfilter+0x472/0xb90 rtnetlink_rcv_msg+0x313/0x3b0 netlink_rcv_skb+0x58/0x100 netlink_unicast+0x244/0x390 netlink_sendmsg+0x1e4/0x440 ____sys_sendmsg+0x164/0x260 ___sys_sendmsg+0x9a/0xe0 __sys_sendmsg+0x7a/0xc0 do_syscall_64+0x40/0xe0 entry_SYSCALL_64_after_hwframe+0x63/0x6b
Затронутые продукты
Ссылки
- CVE-2024-26595
- SUSE Bug 1220344
Описание
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache There is a potential UAF scenario in the case of an LPI translation cache hit racing with an operation that invalidates the cache, such as a DISCARD ITS command. The root of the problem is that vgic_its_check_cache() does not elevate the refcount on the vgic_irq before dropping the lock that serializes refcount changes. Have vgic_its_check_cache() raise the refcount on the returned vgic_irq and add the corresponding decrement after queueing the interrupt.
Затронутые продукты
Ссылки
- CVE-2024-26598
- SUSE Bug 1220326
- SUSE Bug 1221129
Описание
In the Linux kernel, the following vulnerability has been resolved: sched/membarrier: reduce the ability to hammer on sys_membarrier On some systems, sys_membarrier can be very expensive, causing overall slowdowns for everything. So put a lock on the path in order to serialize the accesses to prevent the ability for this to be called at too high of a frequency and saturate the machine.
Затронутые продукты
Ссылки
- CVE-2024-26602
- SUSE Bug 1220398
Описание
In the Linux kernel, the following vulnerability has been resolved: x86/fpu: Stop relying on userspace for info to fault in xsave buffer Before this change, the expected size of the user space buffer was taken from fx_sw->xstate_size. fx_sw->xstate_size can be changed from user-space, so it is possible construct a sigreturn frame where: * fx_sw->xstate_size is smaller than the size required by valid bits in fx_sw->xfeatures. * user-space unmaps parts of the sigrame fpu buffer so that not all of the buffer required by xrstor is accessible. In this case, xrstor tries to restore and accesses the unmapped area which results in a fault. But fault_in_readable succeeds because buf + fx_sw->xstate_size is within the still mapped area, so it goes back and tries xrstor again. It will spin in this loop forever. Instead, fault in the maximum size which can be touched by XRSTOR (taken from fpstate->user_size). [ dhansen: tweak subject / changelog ]
Затронутые продукты
Ссылки
- CVE-2024-26603
- SUSE Bug 1220335
Описание
In the Linux kernel, the following vulnerability has been resolved: tomoyo: fix UAF write bug in tomoyo_write_control() Since tomoyo_write_control() updates head->write_buf when write() of long lines is requested, we need to fetch head->write_buf after head->io_sem is held. Otherwise, concurrent write() requests can cause use-after-free-write and double-free problems.
Затронутые продукты
Ссылки
- CVE-2024-26622
- SUSE Bug 1220825
- SUSE Bug 1220828
- SUSE Bug 1224298
- SUSE Bug 1224878