CVE-2023-46813

An issue was discovered in the Linux kernel before 6.5.9, exploitable by local users with userspace access to MMIO registers. Incorrect access checking in the #VC handler and instruction emulation of the SEV-ES emulation of MMIO accesses could lead to arbitrary write access to kernel memory (and thus privilege escalation). This depends on a race condition through which userspace can replace an instruction before the #VC handler reads it.

An issue was discovered in the Linux kernel before 6.5.9, exploitable by local users with userspace access to MMIO registers. Incorrect access checking in the #VC handler and instruction emulation of the SEV-ES emulation of MMIO accesses could lead to arbitrary write access to kernel memory (and thus privilege escalation). This depends on a race condition through which userspace can replace an instruction before the #VC handler reads it.

The Linux Kernel, the operating system core itself.

Security Fix(es):

An issue was discovered in the USB subsystem in the Linux kernel through 6.4.2. There is an out-of-bounds and crash in read_descriptors in drivers/usb/core/sysfs.c.(CVE-2023-37453)

An issue was discovered in the Linux kernel before 6.5.9, exploitable by local users with userspace access to MMIO registers. Incorrect access checking in the #VC handler and instruction emulation of the SEV-ES emulation of MMIO accesses could lead to arbitrary write access to kernel memory (and thus privilege escalation). This depends on a race condition through which userspace can replace an instruction before the #VC handler reads it.(CVE-2023-46813)

An issue was discovered in the Linux kernel through 6.5.9. During a race with SQ thread exit, an io_uring/fdinfo.c io_uring_show_fdinfo NULL pointer dereference can occur.(CVE-2023-46862)

A use-after-free vulnerability was found in drivers/nvme/target/tcp.cinnvmet_tcp_free_crypto` due to a logical bug in the NVMe-oF/TCP subsystem in the Linux kernel. This issue may allow a malicious user to cause a use-after-free and double-free problem, which may permit remote code execution or lead to local privilege escalation in case that the attacker already has local privileges.(CVE-2023-5178)

The Linux Kernel, the operating system core itself.

Security Fix(es):

An issue was discovered in the USB subsystem in the Linux kernel through 6.4.2. There is an out-of-bounds and crash in read_descriptors in drivers/usb/core/sysfs.c.(CVE-2023-37453)

An issue was discovered in the Linux kernel before 6.5.9, exploitable by local users with userspace access to MMIO registers. Incorrect access checking in the #VC handler and instruction emulation of the SEV-ES emulation of MMIO accesses could lead to arbitrary write access to kernel memory (and thus privilege escalation). This depends on a race condition through which userspace can replace an instruction before the #VC handler reads it.(CVE-2023-46813)

An issue was discovered in the Linux kernel through 6.5.9. During a race with SQ thread exit, an io_uring/fdinfo.c io_uring_show_fdinfo NULL pointer dereference can occur.(CVE-2023-46862)

A use-after-free vulnerability was found in drivers/nvme/target/tcp.cinnvmet_tcp_free_crypto` due to a logical bug in the NVMe-oF/TCP subsystem in the Linux kernel. This issue may allow a malicious user to cause a use-after-free and double-free problem, which may permit remote code execution or lead to local privilege escalation in case that the attacker already has local privileges.(CVE-2023-5178)

The Linux Kernel, the operating system core itself.

Security Fix(es):

An issue was discovered in the USB subsystem in the Linux kernel through 6.4.2. There is an out-of-bounds and crash in read_descriptors in drivers/usb/core/sysfs.c.(CVE-2023-37453)

An issue was discovered in the Linux kernel before 6.5.9, exploitable by local users with userspace access to MMIO registers. Incorrect access checking in the #VC handler and instruction emulation of the SEV-ES emulation of MMIO accesses could lead to arbitrary write access to kernel memory (and thus privilege escalation). This depends on a race condition through which userspace can replace an instruction before the #VC handler reads it.(CVE-2023-46813)

An issue was discovered in the Linux kernel through 6.5.9. During a race with SQ thread exit, an io_uring/fdinfo.c io_uring_show_fdinfo NULL pointer dereference can occur.(CVE-2023-46862)

A use-after-free vulnerability was found in drivers/nvme/target/tcp.cinnvmet_tcp_free_crypto` due to a logical bug in the NVMe-oF/TCP subsystem in the Linux kernel. This issue may allow a malicious user to cause a use-after-free and double-free problem, which may permit remote code execution or lead to local privilege escalation in case that the attacker already has local privileges.(CVE-2023-5178)

An issue was discovered in the Linux kernel before 6.5.9, exploitable by local users with userspace access to MMIO registers. Incorrect access checking in the #VC handler and instruction emulation of the SEV-ES emulation of MMIO accesses could lead to arbitrary write access to kernel memory (and thus privilege escalation). This depends on a race condition through which userspace can replace an instruction before the #VC handler reads it.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: net/sched: sch_hfsc UAF (CVE-2023-4623)
• kernel: use-after-free in sch_qfq network scheduler (CVE-2023-4921)
• kernel: inactive elements in nft_pipapo_walk (CVE-2023-6817)
• kernel: IGB driver inadequate buffer size for frames larger than MTU (CVE-2023-45871)
• kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as destination (CVE-2024-0646)
• kernel: nfp: use-after-free in area_cache_get() (CVE-2022-3545)
• kernel: null-ptr-deref vulnerabilities in sl_tx_timeout in drivers/net/slip (CVE-2022-41858)
• kernel: HID: check empty report_list in hid_validate_values() (CVE-2023-1073)
• kernel: Possible use-after-free since the two fdget() during vhost_net_set_backend() (CVE-2023-1838)
• kernel: NULL pointer dereference in can_rcv_filter (CVE-2023-2166)
• kernel: Slab-out-of-bound read in compare_netdev_and_ip (CVE-2023-2176)
• kernel: A heap out-of-bounds write when function perf_read_group is called and sibling_list is smaller than its child's sibling_list (CVE-2023-5717)
• kernel: NULL pointer dereference in nvmet_tcp_build_iovec (CVE-2023-6356)
• kernel: NULL pointer dereference in nvmet_tcp_execute_request (CVE-2023-6535)
• kernel: NULL pointer dereference in __nvmet_req_complete (CVE-2023-6536)
• kernel: Out-Of-Bounds Read vulnerability in smbCalcSize (CVE-2023-6606)
• kernel: OOB Access in smb2_dump_detail (CVE-2023-6610)
• kernel: use-after-free in l2cap_sock_release in net/bluetooth/l2cap_sock.c (CVE-2023-40283)
• kernel: SEV-ES local priv escalation (CVE-2023-46813)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• net/tls: do not free tls_rec on async operation in bpf_exec_tx_verdict() {CVE-2023-6176}
• wifi: mac80211: fix MBSSID parsing use-after-free {CVE-2022-42719}
• mac80211: always allocate struct ieee802_11_elems {CVE-2022-42719}
• x86/sev: Check for user-space IOIO pointing to kernel space {CVE-2023-46813}
• x86/sev: Check IOBM for IOIO exceptions from user-space {CVE-2023-46813}
• x86/sev: Disable MMIO emulation from user mode {CVE-2023-46813}
• netfilter: nftables: exthdr: fix 4-byte stack OOB write {CVE-2023-4881}
• net: sched: sch_qfq: Fix UAF in qfq_dequeue() {CVE-2023-4921}
• netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c {CVE-2023-42753}
• net/sched: cls_tcindex: downgrade to imperfect hash {CVE-2023-1829}
• USB: ene_usb6250: Allocate enough memory for full object {CVE-2023-45862}
• igb: set max size RX buffer when store bad packet is enabled {CVE-2023-45871}
• net/sched: sch_hfsc: Ensure inner classes have fsc curve {CVE-2023-4623}
• Fix double fget() in vhost_net_set_backend() {CVE-2023-1838}
• nvmet-tcp: Fix a possible UAF in queue intialization setup {CVE-2023-5178}
• drm/qxl: fix UAF on handle creation {CVE-2023-39198}
• net: add kerneldoc comment for sk_peer_lock {CVE-2021-4203}
• af_unix: fix races in sk_peer_pid and sk_peer_cred accesses {CVE-2021-4203}
• block-map: add __GFP_ZERO flag for alloc_page in function bio_copy_kern {CVE-2022-0494}
• media: ov519: add missing endpoint sanity checks {CVE-2020-11608}
• act_mirred: use the backlog for nested calls to mirred ingress {CVE-2022-4269}
• net/sched: act_mirred: better wording on protection against excessive stack growth {CVE-2022-4269}
• inet: use bigger hash table for IP ID generation {CVE-2021-45486}
• net: revert "net: get rid of an signed integer overflow in ip_idents_reserve()" {CVE-2021-45486}

• net/tls: do not free tls_rec on async operation in bpf_exec_tx_verdict() {CVE-2023-6176}
• wifi: mac80211: fix MBSSID parsing use-after-free {CVE-2022-42719}
• mac80211: always allocate struct ieee802_11_elems {CVE-2022-42719}
• x86/sev: Check for user-space IOIO pointing to kernel space {CVE-2023-46813}
• x86/sev: Check IOBM for IOIO exceptions from user-space {CVE-2023-46813}
• x86/sev: Disable MMIO emulation from user mode {CVE-2023-46813}
• netfilter: nftables: exthdr: fix 4-byte stack OOB write {CVE-2023-4881}
• net: sched: sch_qfq: Fix UAF in qfq_dequeue() {CVE-2023-4921}
• netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c {CVE-2023-42753}
• net/sched: cls_tcindex: downgrade to imperfect hash {CVE-2023-1829}
• USB: ene_usb6250: Allocate enough memory for full object {CVE-2023-45862}
• igb: set max size RX buffer when store bad packet is enabled {CVE-2023-45871}
• net/sched: sch_hfsc: Ensure inner classes have fsc curve {CVE-2023-4623}
• Fix double fget() in vhost_net_set_backend() {CVE-2023-1838}
• nvmet-tcp: Fix a possible UAF in queue intialization setup {CVE-2023-5178}
• drm/qxl: fix UAF on handle creation {CVE-2023-39198}
• net: add kerneldoc comment for sk_peer_lock {CVE-2021-4203}
• af_unix: fix races in sk_peer_pid and sk_peer_cred accesses {CVE-2021-4203}
• block-map: add __GFP_ZERO flag for alloc_page in function bio_copy_kern {CVE-2022-0494}
• media: ov519: add missing endpoint sanity checks {CVE-2020-11608}
• act_mirred: use the backlog for nested calls to mirred ingress {CVE-2022-4269}
• net/sched: act_mirred: better wording on protection against excessive stack growth {CVE-2022-4269}
• inet: use bigger hash table for IP ID generation {CVE-2021-45486}
• net: revert "net: get rid of an signed integer overflow in ip_idents_reserve()" {CVE-2021-45486}

• tun: add missing verification for short frame {CVE-2024-41091}
• tap: add missing verification for short frame {CVE-2024-41090}
• drm/amd/display: Fix potential index out of bounds in color transformation function {CVE-2024-38552}
• net: fix __dst_negative_advice() race {CVE-2024-36971}
• net: annotate data-races around sk->sk_dst_pending_confirm {CVE-2024-36971}
• net: fix out-of-bounds access in ops_init {CVE-2024-36883}
• net/sched: flower: Fix chain template offload {CVE-2024-26669}
• netfilter: nf_tables: use timestamp to check for set element timeout {CVE-2024-27397}
• netfilter: nft_set_rbtree: Remove unused variable nft_net {CVE-2024-27397}
• netfilter: nft_set_rbtree: prefer sync gc to async worker {CVE-2024-27397}
• netfilter: nft_set_rbtree: rename gc deactivate+erase function {CVE-2024-27397}
• netfilter: nf_tables: de-constify set commit ops function argument {CVE-2024-27397}
• netfilter: nft_set_rbtree: .deactivate fails if element has expired {CVE-2024-27397}
• sched/membarrier: reduce the ability to hammer on sys_membarrier {CVE-2024-26602}
• drm/vmwgfx: Fix possible null pointer derefence with invalid contexts {CVE-2022-38096}
• sched/psi: Fix use-after-free in ep_remove_wait_queue() {CVE-2023-52707}
• wait: add wake_up_pollfree() {CVE-2023-52707}
• x86/sev: Check for user-space IOIO pointing to kernel space {CVE-2023-46813}
• x86/sev: Check IOBM for IOIO exceptions from user-space {CVE-2023-46813}
• x86/sev: Disable MMIO emulation from user mode {CVE-2023-46813}
• tcp: Fix shift-out-of-bounds in dctcp_update_alpha(). {CVE-2024-37356}
• blk-cgroup: fix list corruption from reorder of WRITE ->lqueued {CVE-2024-38384}
• netfilter: complete validation of user input {CVE-2024-35962}
• SUNRPC: Fix UAF in svc_tcp_listen_data_ready() {CVE-2023-52885}
• PM / devfreq: Synchronize devfreq_monitor_[start/stop] {CVE-2023-52635}
• netfilter: validate user input for expected length {CVE-2024-35896}
• virtio: delete vq in vp_find_vqs_msix() when request_irq() fails {CVE-2024-37353}
• bnxt: prevent skb UAF after handing over to PTP worker {CVE-2022-48637}
• net: openvswitch: fix overwriting ct original tuple for ICMPv6 {CVE-2024-38558}
• net: core: reject skb_copy(_expand) for fraglist GSO skbs {CVE-2024-36929}
• rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation {CVE-2024-36017}
• ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound {CVE-2024-33621}
• drm/vmwgfx: Fix invalid reads in fence signaled events {CVE-2024-36960}
• gro: fix ownership transfer {CVE-2024-35890}
• mlxbf_gige: stop interface during shutdown {CVE-2024-35885}
• scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() {CVE-2023-52809}
• wifi: mt76: replace skb_put with skb_put_zero {CVE-2024-42225}
• drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc {CVE-2024-42228}
• scsi: mpi3mr: Sanitise num_phys {CVE-2024-42159}
• bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD {CVE-2024-42161}
• drm/amdgpu/mes: fix use-after-free issue {CVE-2024-38581}
• i40e: fix vf may be used uninitialized in this function warning {CVE-2024-36020}
• vt: fix unicode buffer corruption when deleting characters {CVE-2024-35823}
• ata: libata-core: Fix double free on error {CVE-2024-41087}
• netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path {CVE-2024-26925}
• tcp_metrics: validate source addr length {CVE-2024-42154}

This kernel update is based on upstream 6.5.11 and fixes or adds mitigations for at least the following security issues:

A use-after-free vulnerability was found in drivers/nvme/target/tcp.cinnvmet_tcp_free_crypto` due to a logical bug in the NVMe-oF/TCP subsystem in the Linux kernel. This issue may allow a malicious user to cause a use-after-free and double-free problem, which may permit remote code execution or lead to local privilege escalation in case that the attacker already has local privileges. (CVE-2023-5178)

x86: KVM: SVM: always update the x2avic msr interception: The following problem exists since x2avic was enabled in the KVM: svm_set_x2apic_msr_interception is called to enable the interception of the x2apic msrs. In particular it is called at the moment the guest resets its apic. Assuming that the guest's apic is in x2apic mode, the reset will bring it back to the xapic mode. The svm_set_x2apic_msr_interception however has an erroneous check for '!apic_x2apic_mode()' which prevents it from doing anything in this case. As a result of this, all x2apic msrs are left unintercepted, and that exposes the bare metal x2apic (if enabled) to the guest. Removing the erroneous '!apic_x2apic_mode()' check fixes that. (CVE-2023-5090)

In unprivileged Xen guests event handling can cause a deadlock with Xen console handling. The evtchn_rwlock and the hvc_lock are taken in opposite sequence in __hvc_poll() and in Xen console IRQ handling. This is fixed by xen/events: replace evtchn_rwlock with RCU (CVE-2023-34324)

A use-after-free vulnerability in the Linux kernel's fs/smb/client component can be exploited to achieve local privilege escalation. In case of an error in smb3_fs_context_parse_param, ctx->password was freed but the field was not set to NULL which could lead to double free. We recommend upgrading past commit e6e43b8aa7cd3c3af686caf0c2e11819a886d705 (CVE-2023-5345)

A flaw was found in the Netfilter subsystem in the Linux kernel. The nfnl_osf_add_callback function did not validate the user mode controlled opt_num field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure. (CVE-2023-39189)

The reference count changes made as part of the CVE-2023-33951 and CVE-2023-33952 fixes exposed a use-after-free flaw in the way memory objects were handled when they were being used to store a surface. When running inside a VMware guest with 3D acceleration enabled, a local, unprivileged user could potentially use this flaw to escalate their privileges. (CVE-2023-5633)

A heap out-of-bounds write vulnerability in the Linux kernel's Linux Kernel Performance Events (perf) component can be exploited to achieve local privilege escalation. If perf_read_group() is called while an event's sibling_list is smaller than its child's sibling_list, it can increment or write to memory locations outside of the allocated buffer. We recommend upgrading past commit 32671e3799ca2e4590773fd0e63aaa4229e50c06. (CVE-2023-5717)

An issue was discovered in the Linux kernel before 6.5.9, exploitable by local users with userspace access to MMIO registers. Incorrect access checking in the #VC handler and instruction emulation of the SEV-ES emulation of MMIO accesses could lead to arbitrary write access to kernel memory (and thus privilege escalation). This depends on a race condition through which userspace can replace an instruction before the #VC handler reads it. (CVE-2023-46813)

A null pointer dereference flaw was found in the Linux kernel API for the cryptographic algorithm scatterwalk functionality. This issue occurs when a user constructs a malicious packet with specific socket configuration, which could allow a local user to crash the system or escalate their privileges on the system. (CVE-2023-6176)

Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B through 5.2 may permit an unauthenticated nearby device to spoof the BD_ADDR of…

This kernel update is based on upstream 6.5.11 and fixes or adds mitigations for at least the following security issues:

A use-after-free vulnerability was found in drivers/nvme/target/tcp.cinnvmet_tcp_free_crypto` due to a logical bug in the NVMe-oF/TCP subsystem in the Linux kernel. This issue may allow a malicious user to cause a use-after-free and double-free problem, which may permit remote code execution or lead to local privilege escalation in case that the attacker already has local privileges. (CVE-2023-5178)

x86: KVM: SVM: always update the x2avic msr interception: The following problem exists since x2avic was enabled in the KVM: svm_set_x2apic_msr_interception is called to enable the interception of the x2apic msrs. In particular it is called at the moment the guest resets its apic. Assuming that the guest's apic is in x2apic mode, the reset will bring it back to the xapic mode. The svm_set_x2apic_msr_interception however has an erroneous check for '!apic_x2apic_mode()' which prevents it from doing anything in this case. As a result of this, all x2apic msrs are left unintercepted, and that exposes the bare metal x2apic (if enabled) to the guest. Removing the erroneous '!apic_x2apic_mode()' check fixes that. (CVE-2023-5090)

In unprivileged Xen guests event handling can cause a deadlock with Xen console handling. The evtchn_rwlock and the hvc_lock are taken in opposite sequence in __hvc_poll() and in Xen console IRQ handling. This is fixed by xen/events: replace evtchn_rwlock with RCU (CVE-2023-34324)

A use-after-free vulnerability in the Linux kernel's fs/smb/client component can be exploited to achieve local privilege escalation. In case of an error in smb3_fs_context_parse_param, ctx->password was freed but the field was not set to NULL which could lead to double free. We recommend upgrading past commit e6e43b8aa7cd3c3af686caf0c2e11819a886d705 (CVE-2023-5345)

A flaw was found in the Netfilter subsystem in the Linux kernel. The nfnl_osf_add_callback function did not validate the user mode controlled opt_num field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure. (CVE-2023-39189)

The reference count changes made as part of the CVE-2023-33951 and CVE-2023-33952 fixes exposed a use-after-free flaw in the way memory objects were handled when they were being used to store a surface. When running inside a VMware guest with 3D acceleration enabled, a local, unprivileged user could potentially use this flaw to escalate their privileges. (CVE-2023-5633)

A heap out-of-bounds write vulnerability in the Linux kernel's Linux Kernel Performance Events (perf) component can be exploited to achieve local privilege escalation. If perf_read_group() is called while an event's sibling_list is smaller than its child's sibling_list, it can increment or write to memory locations outside of the allocated buffer. We recommend upgrading past commit 32671e3799ca2e4590773fd0e63aaa4229e50c06. (CVE-2023-5717)

An issue was discovered in the Linux kernel before 6.5.9, exploitable by local users with userspace access to MMIO registers. Incorrect access checking in the #VC handler and instruction emulation of the SEV-ES emulation of MMIO accesses could lead to arbitrary write access to kernel memory (and thus privilege escalation). This depends on a race condition through which userspace can replace an instruction before the #VC handler reads it. (CVE-2023-46813)

A null pointer dereference flaw was found in the Linux kernel API for the cryptographic algorithm scatterwalk functionality. This issue occurs when a user constructs a malicious packet with specific socket configuration, which could allow a local user to crash the system or escalate their privileges on the system. (CVE-2023-6176)

Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B through 5.2 may permit an unauthenticated nearby device to spoof the BD_ADDR of…

These are all security issues fixed in the kernel-devel-6.6.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the kernel-devel-longterm-6.6.17-1.1 package on the GA media of openSUSE Tumbleweed.

The SUSE Linux Enterprise 15 SP4 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-3777: Fixed a use-after-free vulnerability in netfilter: nf_tables component can be exploited to achieve local privilege escalation. (bsc#1215095)
• CVE-2023-46813: Fixed an incorrect access checking in the VC handler and instruction emulation of the SEV-ES emulation of MMIO accesses that could lead to arbitrary write access to kernel memory. (bsc#1212649)
• CVE-2023-31085: Fixed a divide-by-zero error in do_div(sz,mtd->erasesize) that could cause a local DoS. (bsc#1210778)
• CVE-2023-45862: Fixed an issue in the ENE UB6250 reader driver whwere an object could potentially extend beyond the end of an allocation causing. (bsc#1216051)
• CVE-2023-39193: Fixed an out of bounds read in the xtables subsystem (bsc#1215860).
• CVE-2023-5178: Fixed an UAF in queue intialization setup. (bsc#1215768)
• CVE-2023-2163: Fixed an incorrect verifier pruning in BPF that could lead to unsafe code paths being incorrectly marked as safe, resulting in arbitrary read/write in kernel memory, lateral privilege escalation, and container escape. (bsc#1215518)
• CVE-2023-34324: Fixed a possible deadlock in Linux kernel event handling. (bsc#1215745).
• CVE-2023-39189: Fixed a flaw in the Netfilter subsystem that could allow a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure. (bsc#1216046)

The following non-security bugs were fixed:

• 9p: virtio: make sure 'offs' is initialized in zc_request (git-fixes).
• ACPI: irq: Fix incorrect return value in acpi_register_gsi() (git-fixes).
• ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CBA (git-fixes).
• ALSA: hda: Disable power save for solving pop issue on Lenovo ThinkCentre M70q (git-fixes).
• ALSA: hda/realtek: Change model for Intel RVP board (git-fixes).
• ALSA: usb-audio: Fix microphone sound on Opencomm2 Headset (git-fixes).
• ASoC: codecs: wcd938x-sdw: fix runtime PM imbalance on probe errors (git-fixes).
• ASoC: codecs: wcd938x-sdw: fix use after free on driver unbind (git-fixes).
• ASoC: codecs: wcd938x: drop bogus bind error handling (git-fixes).
• ASoC: codecs: wcd938x: fix unbind tear down order (git-fixes).
• ASoC: fsl: imx-pcm-rpmsg: Add SNDRV_PCM_INFO_BATCH flag (git-fixes).
• ASoC: imx-rpmsg: Set ignore_pmdown_time for dai_link (git-fixes).
• ASoC: pxa: fix a memory leak in probe() (git-fixes).
• ata: libata-core: Do not register PM operations for SAS ports (git-fixes).
• ata: libata-core: Fix ata_port_request_pm() locking (git-fixes).
• ata: libata-core: Fix port and device removal (git-fixes).
• ata: libata-sata: increase PMP SRST timeout to 10s (git-fixes).
• ata: libata-scsi: ignore reserved bits for REPORT SUPPORTED OPERATION CODES (git-fixes).
• blk-cgroup: Fix NULL deref caused by blkg_policy_data being installed before init (bsc#1216062).
• blk-cgroup: support to track if policy is online (bsc#1216062).
• Bluetooth: avoid memcmp() out of bounds warning (git-fixes).
• Bluetooth: Avoid redundant authentication (git-fixes).
• Bluetooth: btusb: add shutdown function for QCA6174 (git-fixes).
• Bluetooth: Fix a refcnt underflow problem for hci_conn (git-fixes).
• Bluetooth: hci_event: Fix coding style (git-fixes).
• Bluetooth: hci_event: Fix using memcmp when comparing keys (git-fixes).
• Bluetooth: hci_event: Ignore NULL link key (git-fixes).
• Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name (git-fixes).
• Bluetooth: hci_sock: fix slab oob read in create_monitor_event (git-fixes).
• Bluetooth: Reject connection with the device which has same BD_ADDR (git-fixes).
• Bluetooth: vhci: Fix race when opening vhci device (git-fixes).
• bpf: propagate precision in ALU/ALU64 operations (git-fixes).
• bus: ti-sysc: Fix missing AM35xx SoC matching (git-fixes).
• bus: ti-sysc: Use fsleep() instead of usleep_range() in sysc_reset()…

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-3777: Fixed a use-after-free vulnerability in netfilter: nf_tables component can be exploited to achieve local privilege escalation. (bsc#1215095)
• CVE-2023-46813: Fixed a local privilege escalation with user-space programs that have access to MMIO regions (bsc#1212649).
• CVE-2023-31085: Fixed a divide-by-zero error in do_div(sz,mtd->erasesize) that could cause a local DoS. (bsc#1210778)
• CVE-2023-45862: Fixed an issue in the ENE UB6250 reader driver whwere an object could potentially extend beyond the end of an allocation causing. (bsc#1216051)
• CVE-2023-5178: Fixed an UAF in queue intialization setup. (bsc#1215768)
• CVE-2023-2163: Fixed an incorrect verifier pruning in BPF that could lead to unsafe code paths being incorrectly marked as safe, resulting in arbitrary read/write in kernel memory, lateral privilege escalation, and container escape. (bsc#1215518)
• CVE-2023-34324: Fixed a possible deadlock in Linux kernel event handling. (bsc#1215745).
• CVE-2023-39189: Fixed a flaw in the Netfilter subsystem that could allow a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure. (bsc#1216046)

The following non-security bugs were fixed:

• 9p: virtio: make sure 'offs' is initialized in zc_request (git-fixes).
• ACPI: irq: Fix incorrect return value in acpi_register_gsi() (git-fixes).
• ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CBA (git-fixes).
• ALSA: hda/realtek: Change model for Intel RVP board (git-fixes).
• ALSA: hda: Disable power save for solving pop issue on Lenovo ThinkCentre M70q (git-fixes).
• ALSA: usb-audio: Fix microphone sound on Opencomm2 Headset (git-fixes).
• ASoC: codecs: wcd938x-sdw: fix runtime PM imbalance on probe errors (git-fixes).
• ASoC: codecs: wcd938x-sdw: fix use after free on driver unbind (git-fixes).
• ASoC: codecs: wcd938x: drop bogus bind error handling (git-fixes).
• ASoC: codecs: wcd938x: fix unbind tear down order (git-fixes).
• ASoC: fsl: imx-pcm-rpmsg: Add SNDRV_PCM_INFO_BATCH flag (git-fixes).
• ASoC: imx-rpmsg: Set ignore_pmdown_time for dai_link (git-fixes).
• ASoC: pxa: fix a memory leak in probe() (git-fixes).
• Bluetooth: Avoid redundant authentication (git-fixes).
• Bluetooth: Fix a refcnt underflow problem for hci_conn (git-fixes).
• Bluetooth: Reject connection with the device which has same BD_ADDR (git-fixes).
• Bluetooth: avoid memcmp() out of bounds warning (git-fixes).
• Bluetooth: btusb: add shutdown function for QCA6174 (git-fixes).
• Bluetooth: hci_event: Fix coding style (git-fixes).
• Bluetooth: hci_event: Fix using memcmp when comparing keys (git-fixes).
• Bluetooth: hci_event: Ignore NULL link key (git-fixes).
• Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name (git-fixes).
• Bluetooth: hci_sock: fix slab oob read in create_monitor_event (git-fixes).
• Bluetooth: vhci: Fix race when opening vhci device (git-fixes).
• Documentation: qat: change kernel version (PED-6401).
• Documentation: qat: rewrite description (PED-6401).
• Drivers: hv: vmbus: Call hv_synic_free() if hv_synic_alloc() fails (git-fixes).
• Drivers: hv: vmbus: Fix vmbus_wait_for_unload() to scan present CPUs (git-fixes).
• Fix metadata references
• HID: holtek: fix slab-out-of-bounds Write in holtek_kbd_input_event (git-fixes).
• HID: intel-ish-hid: ipc: Disable and reenable ACPI GPE bit (git-fixes).
• HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect (git-fixes).
• HID: multitouch: Add required quirk for Synaptics 0xcd7e device (git-fixes).
• HID: sony: Fix a potential memory leak in sony_probe() (git-fixes).
• HID: sony: remove duplicate NULL check before calling usb_free_urb() (git-fixes).
• IB/mlx4: Fix the size of a buffer in add_port_entries() (git-fixes)
• Input: goodix - ensure int GPIO is in input for gpio_count == 1…

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-3777: Fixed a use-after-free vulnerability in netfilter: nf_tables component can be exploited to achieve local privilege escalation. (bsc#1215095)
• CVE-2023-46813: Fixed a local privilege escalation with user-space programs that have access to MMIO regions (bsc#1212649).
• CVE-2023-31085: Fixed a divide-by-zero error in do_div(sz,mtd->erasesize) that could cause a local DoS. (bsc#1210778)
• CVE-2023-39193: Fixed an out of bounds read in the xtables subsystem (bsc#1215860).
• CVE-2023-5178: Fixed an use-after-free and a double-free flaw that could allow a malicious user to execute a remote code execution. (bsc#1215768)
• CVE-2023-2163: Fixed an incorrect verifier pruning in BPF that could lead to unsafe code paths being incorrectly marked as safe, resulting in arbitrary read/write in kernel memory, lateral privilege escalation, and container escape. (bsc#1215518)
• CVE-2023-34324: Fixed a possible deadlock in Linux kernel event handling. (bsc#1215745).
• CVE-2023-39189: Fixed a flaw in the Netfilter subsystem that could allow a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure. (bsc#1216046)
• CVE-2023-39191: Fixed a lack of validation of dynamic pointers within user-supplied eBPF programs that may have allowed an attacker with CAP_BPF privileges to escalate privileges and execute arbitrary code. (bsc#1215863)

The following non-security bugs were fixed:

• 9p: virtio: make sure 'offs' is initialized in zc_request (git-fixes).
• ACPI: irq: Fix incorrect return value in acpi_register_gsi() (git-fixes).
• ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CBA (git-fixes).
• ALSA: hda/realtek - ALC287 I2S speaker platform support (git-fixes).
• ALSA: hda/realtek - ALC287 merge RTK codec with CS CS35L41 AMP (git-fixes).
• ALSA: hda/realtek - Fixed ASUS platform headset Mic issue (git-fixes).
• ALSA: hda/realtek - Fixed two speaker platform (git-fixes).
• ALSA: hda/realtek: Add quirk for ASUS ROG GU603ZV (git-fixes).
• ALSA: hda/realtek: Change model for Intel RVP board (git-fixes).
• ALSA: hda/relatek: Enable Mute LED on HP Laptop 15s-fq5xxx (git-fixes).
• ALSA: hda: Disable power save for solving pop issue on Lenovo ThinkCentre M70q (git-fixes).
• ALSA: hda: intel-dsp-cfg: add LunarLake support (git-fixes).
• ALSA: hda: intel-sdw-acpi: Use u8 type for link index (git-fixes).
• ALSA: usb-audio: Fix microphone sound on Nexigo webcam (git-fixes).
• ALSA: usb-audio: Fix microphone sound on Opencomm2 Headset (git-fixes).
• ASoC: amd: yc: Fix non-functional mic on Lenovo 82YM (git-fixes).
• ASoC: codecs: wcd938x-sdw: fix runtime PM imbalance on probe errors (git-fixes).
• ASoC: codecs: wcd938x-sdw: fix use after free on driver unbind (git-fixes).
• ASoC: codecs: wcd938x: drop bogus bind error handling (git-fixes).
• ASoC: codecs: wcd938x: fix unbind tear down order (git-fixes).
• ASoC: fsl: imx-pcm-rpmsg: Add SNDRV_PCM_INFO_BATCH flag (git-fixes).
• ASoC: imx-rpmsg: Set ignore_pmdown_time for dai_link (git-fixes).
• ASoC: pxa: fix a memory leak in probe() (git-fixes).
• Bluetooth: Avoid redundant authentication (git-fixes).
• Bluetooth: Fix a refcnt underflow problem for hci_conn (git-fixes).
• Bluetooth: ISO: Fix handling of listen for unicast (git-fixes).
• Bluetooth: Reject connection with the device which has same BD_ADDR (git-fixes).
• Bluetooth: avoid memcmp() out of bounds warning (git-fixes).
• Bluetooth: btusb: add shutdown function for QCA6174 (git-fixes).
• Bluetooth: hci_codec: Fix leaking content of local_codecs (git-fixes).
• Bluetooth: hci_event: Fix coding style (git-fixes).
• Bluetooth: hci_event: Fix using memcmp when comparing keys (git-fixes).
• Bluetooth: hci_event: Ignore NULL link key (git-fixes).
• Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name (git-fixes). -…

The SUSE Linux Enterprise 15 SP5 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-3777: Fixed a use-after-free vulnerability in netfilter: nf_tables component can be exploited to achieve local privilege escalation. (bsc#1215095)
• CVE-2023-46813: Fixed a local privilege escalation with user-space programs that have access to MMIO regions (bsc#1212649).
• CVE-2023-31085: Fixed a divide-by-zero error in do_div(sz,mtd->erasesize) that could cause a local DoS. (bsc#1210778)
• CVE-2023-45862: Fixed an issue in the ENE UB6250 reader driver whwere an object could potentially extend beyond the end of an allocation causing. (bsc#1216051)
• CVE-2023-39193: Fixed an out of bounds read in the xtables subsystem (bsc#1215860).
• CVE-2023-5178: Fixed an UAF in queue intialization setup. (bsc#1215768)
• CVE-2023-2163: Fixed an incorrect verifier pruning in BPF that could lead to unsafe code paths being incorrectly marked as safe, resulting in arbitrary read/write in kernel memory, lateral privilege escalation, and container escape. (bsc#1215518)
• CVE-2023-34324: Fixed a possible deadlock in Linux kernel event handling. (bsc#1215745).
• CVE-2023-39189: Fixed a flaw in the Netfilter subsystem that could allow a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure. (bsc#1216046)
• CVE-2023-39191: Fixed a lack of validation of dynamic pointers within user-supplied eBPF programs that may have allowed an attacker with CAP_BPF privileges to escalate privileges and execute arbitrary code. (bsc#1215863)
• CVE-2023-2860: Fixed an out-of-bounds read vulnerability in the processing of seg6 attributes. This flaw allowed a privileged local user to disclose sensitive information. (bsc#1211592)

The following non-security bugs were fixed:

• 9p: virtio: make sure 'offs' is initialized in zc_request (git-fixes).
• ACPI: irq: Fix incorrect return value in acpi_register_gsi() (git-fixes).
• ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CBA (git-fixes).
• ALSA: hda/realtek - ALC287 I2S speaker platform support (git-fixes).
• ALSA: hda/realtek - ALC287 merge RTK codec with CS CS35L41 AMP (git-fixes).
• ALSA: hda/realtek - Fixed ASUS platform headset Mic issue (git-fixes).
• ALSA: hda/realtek - Fixed two speaker platform (git-fixes).
• ALSA: hda/realtek: Add quirk for ASUS ROG GU603ZV (git-fixes).
• ALSA: hda/realtek: Change model for Intel RVP board (git-fixes).
• ALSA: hda/relatek: Enable Mute LED on HP Laptop 15s-fq5xxx (git-fixes).
• ALSA: hda: Disable power save for solving pop issue on Lenovo ThinkCentre M70q (git-fixes).
• ALSA: hda: intel-dsp-cfg: add LunarLake support (git-fixes).
• ALSA: hda: intel-sdw-acpi: Use u8 type for link index (git-fixes).
• ALSA: usb-audio: Fix microphone sound on Nexigo webcam (git-fixes).
• ALSA: usb-audio: Fix microphone sound on Opencomm2 Headset (git-fixes).
• ASoC: amd: yc: Fix non-functional mic on Lenovo 82YM (git-fixes).
• ASoC: codecs: wcd938x-sdw: fix runtime PM imbalance on probe errors (git-fixes).
• ASoC: codecs: wcd938x-sdw: fix use after free on driver unbind (git-fixes).
• ASoC: codecs: wcd938x: drop bogus bind error handling (git-fixes).
• ASoC: codecs: wcd938x: fix unbind tear down order (git-fixes).
• ASoC: fsl: imx-pcm-rpmsg: Add SNDRV_PCM_INFO_BATCH flag (git-fixes).
• ASoC: imx-rpmsg: Set ignore_pmdown_time for dai_link (git-fixes).
• ASoC: pxa: fix a memory leak in probe() (git-fixes).
• Bluetooth: Avoid redundant authentication (git-fixes).
• Bluetooth: Fix a refcnt underflow problem for hci_conn (git-fixes).
• Bluetooth: ISO: Fix handling of listen for unicast (git-fixes).
• Bluetooth: Reject connection with the device which has same BD_ADDR (git-fixes).
• Bluetooth: avoid memcmp() out of bounds warning (git-fixes).
• Bluetooth: btusb: add shutdown function for QCA6174 (git-fixes).
• Bluetooth: hci_codec: Fix leaking content of local_codecs…

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-2006: Fixed a race condition in the RxRPC network protocol (bsc#1210447).
• CVE-2023-25775: Fixed improper access control in the Intel Ethernet Controller RDMA driver (bsc#1216959).
• CVE-2023-3777: Fixed a use-after-free vulnerability in netfilter: nf_tables component can be exploited to achieve local privilege escalation. (bsc#1215095)
• CVE-2023-39197: Fixed a out-of-bounds read in nf_conntrack_dccp_packet() (bsc#1216976).
• CVE-2023-39198: Fixed a race condition leading to use-after-free in qxl_mode_dumb_create() (bsc#1216965).
• CVE-2023-4244: Fixed a use-after-free in the nf_tables component, which could be exploited to achieve local privilege escalation (bsc#1215420).
• CVE-2023-45863: Fixed a out-of-bounds write in fill_kobj_path() (bsc#1216058).
• CVE-2023-45871: Fixed an issue in the IGB driver, where the buffer size may not be adequate for frames larger than the MTU (bsc#1216259).
• CVE-2023-46813: Fixed SEV-ES local priv escalation (bsc#1212649).
• CVE-2023-46862: Fixed a NULL pointer dereference in io_uring_show_fdinfo() (bsc#1216693).
• CVE-2023-5158: Fixed a denial of service in vringh_kiov_advance() in drivers/vhost/vringh.c in the host side of a virtio ring (bsc#1215710).
• CVE-2023-5633: Fixed a use-after-free flaw in the way memory objects were handled when they were being used to store a surface (bsc#1216527).
• CVE-2023-5717: Fixed a heap out-of-bounds write vulnerability in the Performance Events component (bsc#1216584).
• CVE-2023-6039: Fixed a use-after-free in lan78xx_disconnect in drivers/net/usb/lan78xx.c (bsc#1217068).
• CVE-2023-6176: Fixed a denial of service in the cryptographic algorithm scatterwalk functionality (bsc#1217332).

The following non-security bugs were fixed:

• acpi: fpdt: properly handle invalid fpdt subtables (git-fixes).
• acpi: resource: do irq override on tongfang gmxxgxx (git-fixes).
• acpi: resource: skip irq override on asus expertbook b1402cva (git-fixes).
• acpi: sysfs: fix create_pnp_modalias() and create_of_modalias() (git-fixes).
• alsa: hda/realtek - add dell alc295 to pin fall back table (git-fixes).
• alsa: hda/realtek - alc287 realtek i2s speaker platform support (git-fixes).
• alsa: hda/realtek - enable internal speaker of asus k6500zc (git-fixes).
• alsa: hda/realtek: add quirk for asus ux7602zm (git-fixes).
• alsa: hda/realtek: add quirks for asus 2024 zenbooks (git-fixes).
• alsa: hda/realtek: add quirks for hp laptops (git-fixes).
• alsa: hda/realtek: add support dual speaker for dell (git-fixes).
• alsa: hda/realtek: enable mute led on hp 255 g10 (git-fixes).
• alsa: hda/realtek: enable mute led on hp 255 g8 (git-fixes).
• alsa: hda: asus um5302la: added quirks for cs35l41/10431a83 on i2c bus (git-fixes).
• alsa: hda: cs35l41: fix unbalanced pm_runtime_get() (git-fixes).
• alsa: hda: cs35l41: undo runtime pm changes at driver exit time (git-fixes).
• alsa: hda: disable power-save on kontron singlepc (bsc#1217140).
• alsa: hda: fix possible null-ptr-deref when assigning a stream (git-fixes).
• alsa: hda: intel-dsp-config: fix jsl chromebook quirk detection (git-fixes).
• alsa: info: fix potential deadlock at disconnection (git-fixes).
• alsa: usb-audio: add quirk flag to enable native dsd for mcintosh devices (git-fixes).
• arm/xen: fix xen_vcpu_info allocation alignment (git-fixes).
• arm64: add cortex-a520 cpu part definition (git-fixes)
• arm64: allow kprobes on el0 handlers (git-fixes)
• arm64: armv8_deprecated move emulation functions (git-fixes)
• arm64: armv8_deprecated: fix unused-function error (git-fixes)
• arm64: armv8_deprecated: fold ops into insn_emulation (git-fixes)
• arm64: armv8_deprecated: move aarch32 helper earlier (git-fixes)
• arm64: armv8_deprecated: rework deprected instruction handling (git-fixes)
• arm64: consistently pass esr_elx to die() (git-fixes)
• arm64: die(): pass 'err' as…

This update for the Linux Kernel 5.14.21-150500_13_18 fixes several issues.

The following security issues were fixed:

• CVE-2023-6531: Fixed a use-after-free flaw due to a race problem in the unix garbage collector's deletion of SKB races with unix_stream_read_generic()on the socket that the SKB is queued on (bsc#1218487).
• CVE-2023-46813: Fixed a local privilege escalation with user-space programs that have access to MMIO regions (bsc#1216898).
• CVE-2023-39191: Fixed a lack of validation of dynamic pointers within user-supplied eBPF programs that may have allowed an attacker with CAP_BPF privileges to escalate privileges and execute arbitrary code. (bsc#1215863)
• CVE-2023-51779: Fixed a use-after-free because of a bt_sock_ioctl race condition in bt_sock_recvmsg (bsc#1218610).

This update for the Linux Kernel 5.14.21-150500_13_5 fixes several issues.

The following security issues were fixed:

• CVE-2023-6531: Fixed a use-after-free flaw due to a race problem in the unix garbage collector's deletion of SKB races with unix_stream_read_generic()on the socket that the SKB is queued on (bsc#1218487).
• CVE-2023-46813: Fixed a local privilege escalation with user-space programs that have access to MMIO regions (bsc#1216898).
• CVE-2023-39191: Fixed a lack of validation of dynamic pointers within user-supplied eBPF programs that may have allowed an attacker with CAP_BPF privileges to escalate privileges and execute arbitrary code. (bsc#1215863)
• CVE-2023-51779: Fixed a use-after-free because of a bt_sock_ioctl race condition in bt_sock_recvmsg (bsc#1218610).

This update for the Linux Kernel 5.14.21-150500_55_12 fixes several issues.

The following security issues were fixed:

• CVE-2023-6531: Fixed a use-after-free flaw due to a race problem in the unix garbage collector's deletion of SKB races with unix_stream_read_generic()on the socket that the SKB is queued on (bsc#1218487).
• CVE-2023-46813: Fixed a local privilege escalation with user-space programs that have access to MMIO regions (bsc#1216898).
• CVE-2023-39191: Fixed a lack of validation of dynamic pointers within user-supplied eBPF programs that may have allowed an attacker with CAP_BPF privileges to escalate privileges and execute arbitrary code. (bsc#1215863)
• CVE-2023-51779: Fixed a use-after-free because of a bt_sock_ioctl race condition in bt_sock_recvmsg (bsc#1218610).

This update for the Linux Kernel 5.14.21-150500_53 fixes several issues.

The following security issues were fixed:

• CVE-2023-6531: Fixed a use-after-free flaw due to a race problem in the unix garbage collector's deletion of SKB races with unix_stream_read_generic()on the socket that the SKB is queued on (bsc#1218487).
• CVE-2023-46813: Fixed a local privilege escalation with user-space programs that have access to MMIO regions (bsc#1216898).
• CVE-2023-39191: Fixed a lack of validation of dynamic pointers within user-supplied eBPF programs that may have allowed an attacker with CAP_BPF privileges to escalate privileges and execute arbitrary code. (bsc#1215863)
• CVE-2023-51779: Fixed a use-after-free because of a bt_sock_ioctl race condition in bt_sock_recvmsg (bsc#1218610).
• CVE-2023-0461: Fixed use-after-free in icsk_ulp_data (bsc#1208911).

This update for the Linux Kernel 5.14.21-150500_55_28 fixes several issues.

The following security issues were fixed:

• CVE-2023-6531: Fixed a use-after-free flaw due to a race problem in the unix garbage collector's deletion of SKB races with unix_stream_read_generic()on the socket that the SKB is queued on (bsc#1218487).
• CVE-2023-46813: Fixed a local privilege escalation with user-space programs that have access to MMIO regions (bsc#1216898).
• CVE-2023-39191: Fixed a lack of validation of dynamic pointers within user-supplied eBPF programs that may have allowed an attacker with CAP_BPF privileges to escalate privileges and execute arbitrary code. (bsc#1215863)
• CVE-2023-51779: Fixed a use-after-free because of a bt_sock_ioctl race condition in bt_sock_recvmsg (bsc#1218610).

This update for the Linux Kernel 5.14.21-150400_24_60 fixes several issues.

The following security issues were fixed:

• CVE-2023-6531: Fixed a use-after-free flaw due to a race problem in the unix garbage collector's deletion of SKB races with unix_stream_read_generic()on the socket that the SKB is queued on (bsc#1218487).
• CVE-2023-46813: Fixed a local privilege escalation with user-space programs that have access to MMIO regions (bsc#1216898).
• CVE-2023-51779: Fixed a use-after-free because of a bt_sock_ioctl race condition in bt_sock_recvmsg (bsc#1218610).

This update for the Linux Kernel 5.14.21-150500_11 fixes several issues.

The following security issues were fixed:

• CVE-2023-6531: Fixed a use-after-free flaw due to a race problem in the unix garbage collector's deletion of SKB races with unix_stream_read_generic()on the socket that the SKB is queued on (bsc#1218487).
• CVE-2023-46813: Fixed a local privilege escalation with user-space programs that have access to MMIO regions (bsc#1216898).
• CVE-2023-39191: Fixed a lack of validation of dynamic pointers within user-supplied eBPF programs that may have allowed an attacker with CAP_BPF privileges to escalate privileges and execute arbitrary code. (bsc#1215863)
• CVE-2023-51779: Fixed a use-after-free because of a bt_sock_ioctl race condition in bt_sock_recvmsg (bsc#1218610).
• CVE-2023-0461: Fixed use-after-free in icsk_ulp_data (bsc#1208911).

Tom Dohrmann discovered that the Secure Encrypted Virtualization (SEV) implementation for AMD processors in the Linux kernel contained a race condition when accessing MMIO registers. A local attacker in a SEV guest VM could possibly use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-46813)

It was discovered that the io_uring subsystem in the Linux kernel contained a race condition, leading to a null pointer dereference vulnerability. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-46862)

Marek Marczykowski-Górecki discovered that the Xen event channel infrastructure implementation in the Linux kernel contained a race condition. An attacker in a guest VM could possibly use this to cause a denial of service (paravirtualized device unavailability). (CVE-2023-34324)

Zheng Wang discovered a use-after-free in the Renesas Ethernet AVB driver in the Linux kernel during device removal. A privileged attacker could use this to cause a denial of service (system crash). (CVE-2023-35827)

Tom Dohrmann discovered that the Secure Encrypted Virtualization (SEV) implementation for AMD processors in the Linux kernel contained a race condition when accessing MMIO registers. A local attacker in a SEV guest VM could possibly use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-46813)

It was discovered that the io_uring subsystem in the Linux kernel contained a race condition, leading to a null pointer dereference vulnerability. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-46862)

It was discovered that the netfilter subsystem in the Linux kernel did not properly validate inner tunnel netlink attributes, leading to a null pointer dereference vulnerability. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-5972)

It was discovered that the TLS subsystem in the Linux kernel did not properly perform cryptographic operations in some situations, leading to a null pointer dereference vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-6176)

Jann Horn discovered that a race condition existed in the Linux kernel when handling io_uring over sockets, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-6531)

Xingyuan Mo discovered that the netfilter subsystem in the Linux kernel did not properly handle dynset expressions passed from userspace, leading to a null pointer dereference vulnerability. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-6622)

It was discovered that the TIPC protocol implementation in the Linux kernel did not properly handle locking during tipc_crypto_key_revoke() operations. A local attacker could use this to cause a denial of service (kernel deadlock). (CVE-2024-0641)

Quentin Minster discovered that a race condition existed in the KSMBD implementation in the Linux kernel when handling sessions operations. A remote attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-32250, CVE-2023-32252, CVE-2023-32257)

Marek Marczykowski-Górecki discovered that the Xen event channel infrastructure implementation in the Linux kernel contained a race condition. An attacker in a guest VM could possibly use this to cause a denial of service (paravirtualized device unavailability). (CVE-2023-34324)

Zheng Wang discovered a use-after-free in the Renesas Ethernet AVB driver in the Linux kernel during device removal. A privileged attacker could use this to cause a denial of service (system crash). (CVE-2023-35827)

Tom Dohrmann discovered that the Secure Encrypted Virtualization (SEV) implementation for AMD processors in the Linux kernel contained a race condition when accessing MMIO registers. A local attacker in a SEV guest VM could possibly use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-46813)

It was discovered that the Microchip USB Ethernet driver in the Linux kernel contained a race condition during device removal, leading to a use- after-free vulnerability. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2023-6039)

It was discovered that the TLS subsystem in the Linux kernel did not properly perform cryptographic operations in some situations, leading to a null pointer dereference vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-6176)

Xingyuan Mo discovered that the netfilter subsystem in the Linux kernel did not properly handle dynset expressions passed from userspace, leading to a null pointer dereference vulnerability. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-6622)

It was discovered that the TIPC protocol implementation in the Linux kernel did not properly handle locking during tipc_crypto_key_revoke() operations. A local attacker could use this to cause a denial of service (kernel deadlock). (CVE-2024-0641)

Quentin Minster discovered that a race condition existed in the KSMBD implementation in the Linux kernel when handling sessions operations. A remote attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-32250, CVE-2023-32252, CVE-2023-32257)

Marek Marczykowski-Górecki discovered that the Xen event channel infrastructure implementation in the Linux kernel contained a race condition. An attacker in a guest VM could possibly use this to cause a denial of service (paravirtualized device unavailability). (CVE-2023-34324)

Zheng Wang discovered a use-after-free in the Renesas Ethernet AVB driver in the Linux kernel during device removal. A privileged attacker could use this to cause a denial of service (system crash). (CVE-2023-35827)

Tom Dohrmann discovered that the Secure Encrypted Virtualization (SEV) implementation for AMD processors in the Linux kernel contained a race condition when accessing MMIO registers. A local attacker in a SEV guest VM could possibly use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-46813)

It was discovered that the Microchip USB Ethernet driver in the Linux kernel contained a race condition during device removal, leading to a use- after-free vulnerability. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2023-6039)

It was discovered that the TLS subsystem in the Linux kernel did not properly perform cryptographic operations in some situations, leading to a null pointer dereference vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-6176)

Xingyuan Mo discovered that the netfilter subsystem in the Linux kernel did not properly handle dynset expressions passed from userspace, leading to a null pointer dereference vulnerability. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-6622)

It was discovered that the TIPC protocol implementation in the Linux kernel did not properly handle locking during tipc_crypto_key_revoke() operations. A local attacker could use this to cause a denial of service (kernel deadlock). (CVE-2024-0641)

Quentin Minster discovered that a race condition existed in the KSMBD implementation in the Linux kernel when handling sessions operations. A remote attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-32250, CVE-2023-32252, CVE-2023-32257)

Marek Marczykowski-Górecki discovered that the Xen event channel infrastructure implementation in the Linux kernel contained a race condition. An attacker in a guest VM could possibly use this to cause a denial of service (paravirtualized device unavailability). (CVE-2023-34324)

Zheng Wang discovered a use-after-free in the Renesas Ethernet AVB driver in the Linux kernel during device removal. A privileged attacker could use this to cause a denial of service (system crash). (CVE-2023-35827)

Tom Dohrmann discovered that the Secure Encrypted Virtualization (SEV) implementation for AMD processors in the Linux kernel contained a race condition when accessing MMIO registers. A local attacker in a SEV guest VM could possibly use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-46813)

It was discovered that the Microchip USB Ethernet driver in the Linux kernel contained a race condition during device removal, leading to a use- after-free vulnerability. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2023-6039)

It was discovered that the TLS subsystem in the Linux kernel did not properly perform cryptographic operations in some situations, leading to a null pointer dereference vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-6176)

Xingyuan Mo discovered that the netfilter subsystem in the Linux kernel did not properly handle dynset expressions passed from userspace, leading to a null pointer dereference vulnerability. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-6622)

It was discovered that the TIPC protocol implementation in the Linux kernel did not properly handle locking during tipc_crypto_key_revoke() operations. A local attacker could use this to cause a denial of service (kernel deadlock). (CVE-2024-0641)

Quentin Minster discovered that a race condition existed in the KSMBD implementation in the Linux kernel when handling sessions operations. A remote attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-32250, CVE-2023-32252, CVE-2023-32257)

Marek Marczykowski-Górecki discovered that the Xen event channel infrastructure implementation in the Linux kernel contained a race condition. An attacker in a guest VM could possibly use this to cause a denial of service (paravirtualized device unavailability). (CVE-2023-34324)

Zheng Wang discovered a use-after-free in the Renesas Ethernet AVB driver in the Linux kernel during device removal. A privileged attacker could use this to cause a denial of service (system crash). (CVE-2023-35827)

Tom Dohrmann discovered that the Secure Encrypted Virtualization (SEV) implementation for AMD processors in the Linux kernel contained a race condition when accessing MMIO registers. A local attacker in a SEV guest VM could possibly use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-46813)

It was discovered that the Microchip USB Ethernet driver in the Linux kernel contained a race condition during device removal, leading to a use- after-free vulnerability. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2023-6039)

Lin Ma discovered that the netfilter subsystem in the Linux kernel did not properly validate network family support while creating a new netfilter table. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2023-6040)

It was discovered that the TLS subsystem in the Linux kernel did not properly perform cryptographic operations in some situations, leading to a null pointer dereference vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-6176)

It was discovered that the CIFS network file system implementation in the Linux kernel did not properly validate the server frame size in certain situation, leading to an out-of-bounds read vulnerability. An attacker could use this to construct a malicious CIFS image that, when operated on, could cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-6606)

Xingyuan Mo discovered that the netfilter subsystem in the Linux kernel did not properly handle dynset expressions passed from userspace, leading to a null pointer dereference vulnerability. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-6622)

Xingyuan Mo discovered that the netfilter subsystem in the Linux kernel did not properly handle inactive elements in its PIPAPO data structure, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-6817)

Budimir Markovic, Lucas De Marchi, and Pengfei Xu discovered that the perf subsystem in the Linux kernel did not properly validate all event sizes when attaching new events, leading to an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-6931)

It was discovered that the IGMP protocol implementation in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-6932)

Kevin Rich discovered that the netfilter subsystem in the Linux kernel did not properly check deactivated elements in certain situations, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-0193)

It was discovered that the TIPC protocol implementation in…

Quentin Minster discovered that a race condition existed in the KSMBD implementation in the Linux kernel when handling sessions operations. A remote attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-32250, CVE-2023-32252, CVE-2023-32257)

Marek Marczykowski-Górecki discovered that the Xen event channel infrastructure implementation in the Linux kernel contained a race condition. An attacker in a guest VM could possibly use this to cause a denial of service (paravirtualized device unavailability). (CVE-2023-34324)

Zheng Wang discovered a use-after-free in the Renesas Ethernet AVB driver in the Linux kernel during device removal. A privileged attacker could use this to cause a denial of service (system crash). (CVE-2023-35827)

Tom Dohrmann discovered that the Secure Encrypted Virtualization (SEV) implementation for AMD processors in the Linux kernel contained a race condition when accessing MMIO registers. A local attacker in a SEV guest VM could possibly use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-46813)

It was discovered that the Microchip USB Ethernet driver in the Linux kernel contained a race condition during device removal, leading to a use- after-free vulnerability. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2023-6039)

Lin Ma discovered that the netfilter subsystem in the Linux kernel did not properly validate network family support while creating a new netfilter table. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2023-6040)

It was discovered that the TLS subsystem in the Linux kernel did not properly perform cryptographic operations in some situations, leading to a null pointer dereference vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-6176)

It was discovered that the CIFS network file system implementation in the Linux kernel did not properly validate the server frame size in certain situation, leading to an out-of-bounds read vulnerability. An attacker could use this to construct a malicious CIFS image that, when operated on, could cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-6606)

Xingyuan Mo discovered that the netfilter subsystem in the Linux kernel did not properly handle dynset expressions passed from userspace, leading to a null pointer dereference vulnerability. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-6622)

Xingyuan Mo discovered that the netfilter subsystem in the Linux kernel did not properly handle inactive elements in its PIPAPO data structure, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-6817)

Budimir Markovic, Lucas De Marchi, and Pengfei Xu discovered that the perf subsystem in the Linux kernel did not properly validate all event sizes when attaching new events, leading to an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-6931)

It was discovered that the IGMP protocol implementation in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-6932)

Kevin Rich discovered that the netfilter subsystem in the Linux kernel did not properly check deactivated elements in certain situations, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-0193)

It was discovered that the TIPC protocol implementation in…