Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2024:3834-1

Опубликовано: 30 окт. 2024
Источник: suse-cvrf

Описание

Security update for the Linux Kernel RT (Live Patch 0 for SLE 15 SP6)

This update for the Linux Kernel 6.4.0-150600_8 fixes several issues.

The following security issues were fixed:

  • CVE-2024-35905: Fixed int overflow for stack access size (bsc#1226327).
  • CVE-2024-42133: Bluetooth: Ignore too large handle values in BIG (bsc#1231419)
  • CVE-2024-35863: Fixed potential UAF in is_valid_oplock_break() (bsc#1225011).
  • CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225819).
  • CVE-2024-35862: Fixed potential UAF in smb2_is_network_name_deleted() (bsc#1225311).
  • CVE-2024-35867: Fixed potential UAF in cifs_stats_proc_show() (bsc#1225012).
  • CVE-2024-35864: Fixed potential UAF in smb2_is_valid_lease_break() (bsc#1225309).

Список пакетов

SUSE Linux Enterprise Live Patching 15 SP6
kernel-livepatch-6_4_0-150600_8-rt-5-150600.3.1

Описание

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() Skip SMB sessions that are being teared down (e.g. @ses->ses_status == SES_EXITING) in cifs_debug_data_proc_show() to avoid use-after-free in @ses. This fixes the following GPF when reading from /proc/fs/cifs/DebugData while mounting and umounting [ 816.251274] general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6d81: 0000 [#1] PREEMPT SMP NOPTI ... [ 816.260138] Call Trace: [ 816.260329] <TASK> [ 816.260499] ? die_addr+0x36/0x90 [ 816.260762] ? exc_general_protection+0x1b3/0x410 [ 816.261126] ? asm_exc_general_protection+0x26/0x30 [ 816.261502] ? cifs_debug_tcon+0xbd/0x240 [cifs] [ 816.261878] ? cifs_debug_tcon+0xab/0x240 [cifs] [ 816.262249] cifs_debug_data_proc_show+0x516/0xdb0 [cifs] [ 816.262689] ? seq_read_iter+0x379/0x470 [ 816.262995] seq_read_iter+0x118/0x470 [ 816.263291] proc_reg_read_iter+0x53/0x90 [ 816.263596] ? srso_alias_return_thunk+0x5/0x7f [ 816.263945] vfs_read+0x201/0x350 [ 816.264211] ksys_read+0x75/0x100 [ 816.264472] do_syscall_64+0x3f/0x90 [ 816.264750] entry_SYSCALL_64_after_hwframe+0x6e/0xd8 [ 816.265135] RIP: 0033:0x7fd5e669d381


Затронутые продукты
SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_8-rt-5-150600.3.1

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in smb2_is_network_name_deleted() Skip sessions that are being teared down (status == SES_EXITING) to avoid UAF.


Затронутые продукты
SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_8-rt-5-150600.3.1

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in is_valid_oplock_break() Skip sessions that are being teared down (status == SES_EXITING) to avoid UAF.


Затронутые продукты
SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_8-rt-5-150600.3.1

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in smb2_is_valid_lease_break() Skip sessions that are being teared down (status == SES_EXITING) to avoid UAF.


Затронутые продукты
SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_8-rt-5-150600.3.1

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in cifs_stats_proc_show() Skip sessions that are being teared down (status == SES_EXITING) to avoid UAF.


Затронутые продукты
SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_8-rt-5-150600.3.1

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: bpf: Protect against int overflow for stack access size This patch re-introduces protection against the size of access to stack memory being negative; the access size can appear negative as a result of overflowing its signed int representation. This should not actually happen, as there are other protections along the way, but we should protect against it anyway. One code path was missing such protections (fixed in the previous patch in the series), causing out-of-bounds array accesses in check_stack_range_initialized(). This patch causes the verification of a program with such a non-sensical access size to fail. This check used to exist in a more indirect way, but was inadvertendly removed in a833a17aeac7.


Затронутые продукты
SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_8-rt-5-150600.3.1

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Ignore too large handle values in BIG hci_le_big_sync_established_evt is necessary to filter out cases where the handle value is belonging to ida id range, otherwise ida will be erroneously released in hci_conn_cleanup.


Затронутые продукты
SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_8-rt-5-150600.3.1

Ссылки
Уязвимость SUSE-SU-2024:3834-1