CVE-2023-23454

cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service (slab-out-of-bounds read) because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results).

cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service (slab-out-of-bounds read) because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results).

The Linux Kernel, the operating system core itself.

Security Fix(es):

A buffer overflow vulnerability was found in the Netfilter subsystem in the Linux Kernel. This issue could allow the leakage of both stack and heap addresses, and potentially allow Local Privilege Escalation to the root user via arbitrary code execution.(CVE-2023-0179)

atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results).(CVE-2023-23455)

cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service (slab-out-of-bounds read) because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results).(CVE-2023-23454)

The Linux Kernel, the operating system core itself.

Security Fix(es):

A buffer overflow vulnerability was found in the Netfilter subsystem in the Linux Kernel. This issue could allow the leakage of both stack and heap addresses, and potentially allow Local Privilege Escalation to the root user via arbitrary code execution.(CVE-2023-0179)

atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results).(CVE-2023-23455)

cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service (slab-out-of-bounds read) because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results).(CVE-2023-23454)

The Linux Kernel, the operating system core itself.

Security Fix(es):

atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results).(CVE-2023-23455)

cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service (slab-out-of-bounds read) because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results).(CVE-2023-23454)

A NULL pointer dereference flaw was found in rawv6_push_pending_frames in net/ipv6/raw.c in the network subcomponent in the Linux kernel. This flaw causes the system to crash.(CVE-2023-0394)

The Linux Kernel, the operating system core itself.

Security Fix(es):

atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results).(CVE-2023-23455)

cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service (slab-out-of-bounds read) because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results).(CVE-2023-23454)

A NULL pointer dereference flaw was found in rawv6_push_pending_frames in net/ipv6/raw.c in the network subcomponent in the Linux kernel. This flaw causes the system to crash.(CVE-2023-0394)

cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service (slab-out-of-bounds read) because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results).

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• use-after-free caused by l2cap_reassemble_sdu() in net/bluetooth/l2cap_core.c (CVE-2022-3564)
• net/ulp: use-after-free in listening ULP sockets (CVE-2023-0461)
• hw: cpu: AMD CPUs may transiently execute beyond unconditional direct branch (CVE-2021-26341)
• malicious data for FBIOPUT_VSCREENINFO ioctl may cause OOB write memory (CVE-2021-33655)
• when setting font with malicious data by ioctl PIO_FONT, kernel will write memory out of bounds (CVE-2021-33656)
• possible race condition in drivers/tty/tty_buffers.c (CVE-2022-1462)
• use-after-free in ath9k_htc_probe_device() could cause an escalation of privileges (CVE-2022-1679)
• KVM: NULL pointer dereference in kvm_mmu_invpcid_gva (CVE-2022-1789)
• KVM: nVMX: missing IBPB when exiting from nested guest can lead to Spectre v2 attacks (CVE-2022-2196)
• netfilter: nf_conntrack_irc message handling issue (CVE-2022-2663)
• race condition in xfrm_probe_algs can lead to OOB read/write (CVE-2022-3028)
• media: em28xx: initialize refcount before kref_get (CVE-2022-3239)
• race condition in hugetlb_no_page() in mm/hugetlb.c (CVE-2022-3522)
• memory leak in ipv6_renew_options() (CVE-2022-3524)
• data races around icsk->icsk_af_ops in do_ipv6_setsockopt (CVE-2022-3566)
• data races around sk->sk_prot (CVE-2022-3567)
• memory leak in l2cap_recv_acldata of the file net/bluetooth/l2cap_core.c (CVE-2022-3619)
• denial of service in follow_page_pte in mm/gup.c due to poisoned pte entry (CVE-2022-3623)
• use-after-free after failed devlink reload in devlink_param_get (CVE-2022-3625)
• USB-accessible buffer overflow in brcmfmac (CVE-2022-3628)
• Double-free in split_2MB_gtt_entry when function intel_gvt_dma_map_guest_page failed (CVE-2022-3707)
• l2tp: missing lock when clearing sk_user_data can lead to NULL pointer dereference (CVE-2022-4129)
• igmp: use-after-free in ip_check_mc_rcu when opening and closing inet sockets (CVE-2022-20141)
• Executable Space Protection Bypass (CVE-2022-25265)
• Unprivileged users may use PTRACE_SEIZE to set PTRACE_O_SUSPEND_SECCOMP option (CVE-2022-30594)
• unmap_mapping_range() race with munmap() on VM_PFNMAP mappings leads to stale TLB entry (CVE-2022-39188)
• TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED leading to guest malfunctioning (CVE-2022-39189)
• Report vmalloc UAF in dvb-core/dmxdev (CVE-2022-41218)
• u8 overflow problem in cfg80211_update_notlisted_nontrans() (CVE-2022-41674)
• use-after-free related to leaf anon_vma double reuse (CVE-2022-42703)
• use-after-free in bss_ref_get in net/wireless/scan.c (CVE-2022-42720)
• BSS list corruption in cfg80211_add_nontrans_list in net/wireless/scan.c (CVE-2022-42721)
• Denial of service in beacon protection for P2P-device (CVE-2022-42722)
• memory corruption in usbmon driver (CVE-2022-43750)
• NULL pointer dereference in traffic control subsystem (CVE-2022-47929)
• NULL pointer dereference in rawv6_push_pending_frames (CVE-2023-0394)
• use-after-free caused by invalid pointer hostname in fs/cifs/connect.c (CVE-2023-1195)
• Soft lockup occurred during __page_mapcount (CVE-2023-1582)
• slab-out-of-bounds read vulnerabilities in cbq_classify (CVE-2023-23454)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

The following packages have been upgraded to a later upstream version: kernel (4.18.0). (BZ#2122230, BZ#2122267)

Security Fix(es):

• use-after-free caused by l2cap_reassemble_sdu() in net/bluetooth/l2cap_core.c (CVE-2022-3564)
• net/ulp: use-after-free in listening ULP sockets (CVE-2023-0461)
• hw: cpu: AMD CPUs may transiently execute beyond unconditional direct branch (CVE-2021-26341)
• malicious data for FBIOPUT_VSCREENINFO ioctl may cause OOB write memory (CVE-2021-33655)
• when setting font with malicious data by ioctl PIO_FONT, kernel will write memory out of bounds (CVE-2021-33656)
• possible race condition in drivers/tty/tty_buffers.c (CVE-2022-1462)
• use-after-free in ath9k_htc_probe_device() could cause an escalation of privileges (CVE-2022-1679)
• KVM: NULL pointer dereference in kvm_mmu_invpcid_gva (CVE-2022-1789)
• KVM: nVMX: missing IBPB when exiting from nested guest can lead to Spectre v2 attacks (CVE-2022-2196)
• netfilter: nf_conntrack_irc message handling issue (CVE-2022-2663)
• race condition in xfrm_probe_algs can lead to OOB read/write (CVE-2022-3028)
• media: em28xx: initialize refcount before kref_get (CVE-2022-3239)
• race condition in hugetlb_no_page() in mm/hugetlb.c (CVE-2022-3522)
• memory leak in ipv6_renew_options() (CVE-2022-3524)
• data races around icsk->icsk_af_ops in do_ipv6_setsockopt (CVE-2022-3566)
• data races around sk->sk_prot (CVE-2022-3567)
• memory leak in l2cap_recv_acldata of the file net/bluetooth/l2cap_core.c (CVE-2022-3619)
• denial of service in follow_page_pte in mm/gup.c due to poisoned pte entry (CVE-2022-3623)
• use-after-free after failed devlink reload in devlink_param_get (CVE-2022-3625)
• USB-accessible buffer overflow in brcmfmac (CVE-2022-3628)
• Double-free in split_2MB_gtt_entry when function intel_gvt_dma_map_guest_page failed (CVE-2022-3707)
• l2tp: missing lock when clearing sk_user_data can lead to NULL pointer dereference (CVE-2022-4129)
• igmp: use-after-free in ip_check_mc_rcu when opening and closing inet sockets (CVE-2022-20141)
• Executable Space Protection Bypass (CVE-2022-25265)
• Unprivileged users may use PTRACE_SEIZE to set PTRACE_O_SUSPEND_SECCOMP option (CVE-2022-30594)
• unmap_mapping_range() race with munmap() on VM_PFNMAP mappings leads to stale TLB entry (CVE-2022-39188)
• TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED leading to guest malfunctioning (CVE-2022-39189)
• Report vmalloc UAF in dvb-core/dmxdev (CVE-2022-41218)
• u8 overflow problem in cfg80211_update_notlisted_nontrans() (CVE-2022-41674)
• use-after-free related to leaf anon_vma double reuse (CVE-2022-42703)
• use-after-free in bss_ref_get in net/wireless/scan.c (CVE-2022-42720)
• BSS list corruption in cfg80211_add_nontrans_list in net/wireless/scan.c (CVE-2022-42721)
• Denial of service in beacon protection for P2P-device (CVE-2022-42722)
• memory corruption in usbmon driver (CVE-2022-43750)
• NULL pointer dereference in traffic control subsystem (CVE-2022-47929)
• NULL pointer dereference in rawv6_push_pending_frames (CVE-2023-0394)
• use-after-free caused by invalid pointer hostname in fs/cifs/connect.c (CVE-2023-1195)
• Soft lockup occurred during __page_mapcount (CVE-2023-1582)
• slab-out-of-bounds read vulnerabilities in cbq_classify (CVE-2023-23454)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

• ALSA: pcm: Fix races among concurrent prealloc proc writes {CVE-2022-1048}
• ALSA: pcm: Fix races among concurrent prepare and hw_params/hw_free calls {CVE-2022-1048}
• ALSA: pcm: Fix races among concurrent read/write and buffer changes {CVE-2022-1048}
• ALSA: pcm: Fix races among concurrent hw_params and hw_free calls {CVE-2022-1048}
• x86/elf: Disable automatic READ_IMPLIES_EXEC on 64-bit {CVE-2022-25265}
• x86/elf: Split READ_IMPLIES_EXEC from executable PT_GNU_STACK {CVE-2022-25265}
• x86/elf: Add table to document READ_IMPLIES_EXEC {CVE-2022-25265}
• drm/i915: fix TLB invalidation for Gen12 video and compute engines {CVE-2022-4139}
• drm/i915: Flush TLBs before releasing backing store {CVE-2022-0330}
• xfs: fix up non-directory creation in SGID directories {CVE-2021-4037}
• tcp: Fix data races around icsk->icsk_af_ops. {CVE-2022-3566}
• ipv6: Fix data races around sk->sk_prot. {CVE-2022-3567}
• ipv6: annotate some data-races around sk->sk_prot {CVE-2022-3567}
• ipv6: use indirect call wrappers for {tcp, udpv6}_{recv, send}msg() {CVE-2022-3567}
• netfilter: nf_tables: deactivate anonymous set from preparation phase {CVE-2023-32233}
• netfilter: nf_tables: bogus EBUSY when deleting set after flush
• media: dmxdev: fix UAF when dvb_register_device() fails {CVE-2022-41218}
• l2tp: Don't sleep and disable BH under writer-side sk_callback_lock {CVE-2022-4129}
• l2tp: Serialize access to sk_user_data with sk_callback_lock {CVE-2022-4129}
• net: fix a concurrency bug in l2tp_tunnel_register() {CVE-2022-4129}
• Bluetooth: L2CAP: Fix memory leak in vhci_write {CVE-2022-3619}
• Bluetooth: L2CAP: Fix handling fragmented length
• wifi: brcmfmac: Fix potential buffer overflow in brcmf_fweh_event_worker() {CVE-2022-3628}
• wifi: cfg80211: avoid nontransmitted BSS list corruption {CVE-2022-42721}
• cfg80211: scan: fix RCU in cfg80211_add_nontrans_list()
• wifi: cfg80211: fix BSS refcounting bugs {CVE-2022-42720}
• cfg80211: hold bss_lock while updating nontrans_list
• ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF {CVE-2023-0266}
• ALSA: control: Drop superfluous snd_power_wait() calls
• ALSA: control: Track in-flight control read/write/tlv accesses
• ALSA: control - introduce snd_ctl_notify_one() helper
• Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu {CVE-2022-3564}
• netfilter: nf_conntrack_irc: Tighten matching on DCC message {CVE-2022-2663}
• netfilter: nf_conntrack_irc: Fix forged IP logic {CVE-2022-2663}
• KVM: x86: Avoid theoretical NULL pointer dereference in kvm_irq_delivery_to_apic_fast() {CVE-2022-2153}
• KVM: Add infrastructure and macro to mark VM as bugged
• KVM: x86/mmu: fix NULL pointer dereference on guest INVPCID {CVE-2022-1789}
• tcp/udp: Fix memory leak in ipv6_renew_options(). {CVE-2022-3524}
• proc: proc_skip_spaces() shouldn't think it is working on C strings {CVE-2022-4378}
• proc: avoid integer type confusion in get_proc_long {CVE-2022-4378}
• wifi: mac80211: fix crash in beacon protection for P2P-device {CVE-2022-42722}
• net: sched: cbq: dont intepret cls results when asked to drop {CVE-2023-23454}
• ipv6: raw: Deduct extension header length in rawv6_push_pending_frames {CVE-2023-0394}
• net: sched: disallow noqueue for qdisc classes {CVE-2022-47929}
• wifi: cfg80211: fix u8 overflow in cfg80211_update_notlisted_nontrans() {CVE-2022-41674}
• af_key: Do not call xfrm_probe_algs in parallel {CVE-2022-3028}
• dm verity: set DM_TARGET_IMMUTABLE feature flag {CVE-2022-20572}

• ALSA: pcm: Fix races among concurrent prealloc proc writes {CVE-2022-1048}
• ALSA: pcm: Fix races among concurrent prepare and hw_params/hw_free calls {CVE-2022-1048}
• ALSA: pcm: Fix races among concurrent read/write and buffer changes {CVE-2022-1048}
• ALSA: pcm: Fix races among concurrent hw_params and hw_free calls {CVE-2022-1048}
• x86/elf: Disable automatic READ_IMPLIES_EXEC on 64-bit {CVE-2022-25265}
• x86/elf: Split READ_IMPLIES_EXEC from executable PT_GNU_STACK {CVE-2022-25265}
• x86/elf: Add table to document READ_IMPLIES_EXEC {CVE-2022-25265}
• KVM: SEV-ES: fix another issue with string I/O VMGEXITs {CVE-2021-4093}
• KVM: SEV-ES: go over the sev_pio_data buffer in multiple passes if needed {CVE-2021-4093}
• KVM: SEV-ES: keep INS functions together {CVE-2021-4093}
• KVM: x86: remove unnecessary arguments from complete_emulator_pio_in {CVE-2021-4093}
• KVM: x86: split the two parts of emulator_pio_in {CVE-2021-4093}
• KVM: x86: leave vcpu->arch.pio.count alone in emulator_pio_in_out {CVE-2021-4093}
• KVM: SEV-ES: clean up kvm_sev_es_ins/outs {CVE-2021-4093}
• KVM: SEV-ES: rename guest_ins_data to sev_pio_data {CVE-2021-4093}
• KVM: SEV-ES: fix length of string I/O {CVE-2021-4093}
• drm/i915: fix TLB invalidation for Gen12 video and compute engines {CVE-2022-4139}
• drm/i915: Flush TLBs before releasing backing store {CVE-2022-0330}
• xfs: fix up non-directory creation in SGID directories {CVE-2021-4037}
• tcp: Fix data races around icsk->icsk_af_ops. {CVE-2022-3566}
• ipv6: Fix data races around sk->sk_prot. {CVE-2022-3567}
• ipv6: annotate some data-races around sk->sk_prot {CVE-2022-3567}
• ipv6: use indirect call wrappers for {tcp, udpv6}_{recv, send}msg() {CVE-2022-3567}
• netfilter: nf_tables: deactivate anonymous set from preparation phase {CVE-2023-32233}
• netfilter: nf_tables: bogus EBUSY when deleting set after flush
• media: dmxdev: fix UAF when dvb_register_device() fails {CVE-2022-41218}
• l2tp: Don't sleep and disable BH under writer-side sk_callback_lock {CVE-2022-4129}
• l2tp: Serialize access to sk_user_data with sk_callback_lock {CVE-2022-4129}
• net: fix a concurrency bug in l2tp_tunnel_register() {CVE-2022-4129}
• Bluetooth: L2CAP: Fix memory leak in vhci_write {CVE-2022-3619}
• Bluetooth: L2CAP: Fix handling fragmented length
• wifi: brcmfmac: Fix potential buffer overflow in brcmf_fweh_event_worker() {CVE-2022-3628}
• wifi: cfg80211: avoid nontransmitted BSS list corruption {CVE-2022-42721}
• cfg80211: scan: fix RCU in cfg80211_add_nontrans_list()
• wifi: cfg80211: fix BSS refcounting bugs {CVE-2022-42720}
• cfg80211: hold bss_lock while updating nontrans_list
• ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF {CVE-2023-0266}
• ALSA: control: Drop superfluous snd_power_wait() calls
• ALSA: control: Track in-flight control read/write/tlv accesses
• Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu {CVE-2022-3564}
• netfilter: nf_conntrack_irc: Tighten matching on DCC message {CVE-2022-2663}
• netfilter: nf_conntrack_irc: Fix forged IP logic {CVE-2022-2663}
• KVM: x86: Avoid theoretical NULL pointer dereference in kvm_irq_delivery_to_apic_fast() {CVE-2022-2153}
• KVM: Add infrastructure and macro to mark VM as bugged
• KVM: x86/mmu: fix NULL pointer dereference on guest INVPCID {CVE-2022-1789}
• tcp/udp: Fix memory leak in ipv6_renew_options(). {CVE-2022-3524}
• proc: proc_skip_spaces() shouldn't think it is working on C strings {CVE-2022-4378}
• proc: avoid integer type confusion in get_proc_long {CVE-2022-4378}
• wifi: mac80211: fix crash in beacon protection for P2P-device {CVE-2022-42722}
• net: sched: cbq: dont intepret cls results when asked to drop {CVE-2023-23454}
• ipv6: raw: Deduct extension header length in rawv6_push_pending_frames {CVE-2023-0394}
• net: sched: disallow noqueue for qdisc classes {CVE-2022-47929}
• wifi: cfg80211: fix u8 overflow in cfg80211_update_notlisted_nontrans() {CVE-2022-41674}
• af_key: Do not call xfrm_probe_algs in…

• Jammy update: v5.15.86 upstream stable release (LP: #2005113) // CVE-url: https://ubuntu.com/security/CVE-2022-3606
  • libbpf: Fix null-pointer dereference in find_prog_by_sec_insn()
• Jammy update: v5.15.87 upstream stable release (LP: #2007441) // CVE-url: https://ubuntu.com/security/CVE-2023-23454
  • net: sched: cbq: dont intepret cls results when asked to drop
• Jammy update: v5.15.76 upstream stable release (LP: #1997113) // CVE-url: https://ubuntu.com/security/CVE-2023-0590
  • net: sched: fix race condition in qdisc_graft()
• Jammy update: v5.15.91 upstream stable release (LP: #2011467) // CVE-url: https://ubuntu.com/security/CVE-2022-4129
  • l2tp: Serialize access to sk_user_data with sk_callback_lock
• Jammy update: v5.15.105 upstream stable release (LP: #2023230) // CVE-url: https://ubuntu.com/security/CVE-2023-30772
  • power: supply: da9150: Fix use after free bug in da9150_charger_remove due to race condition
• Jammy update: v5.15.105 upstream stable release (LP: #2023230) // CVE-url: https://ubuntu.com/security/CVE-2023-2194
  • i2c: xgene-slimpro: Fix out-of-bounds bug in xgene_slimpro_i2c_xfer()
• CVE-2023-31084 // CVE-2023-31084 was assigned to this bug. // CVE-url: https://ubuntu.com/security/CVE-2023-31084
  • media: dvb-core: Fix kernel WARNING for blocking operation in wait_event*()
• Jammy update: v5.15.99 upstream stable release (LP: #2018438) // CVE-url: https://ubuntu.com/security/CVE-2023-2985
  • fs: hfsplus: fix UAF issue in hfsplus_put_super
• Jammy update: v5.15.111 upstream stable release (LP: #2025095) // CVE-url: https://ubuntu.com/security/CVE-2023-2269
  • dm ioctl: fix nested locking in table_clear() to remove deadlock concern

• Jammy update: v5.15.86 upstream stable release (LP: #2005113) // CVE-url: https://ubuntu.com/security/CVE-2022-3606
  • libbpf: Fix null-pointer dereference in find_prog_by_sec_insn()
• Jammy update: v5.15.87 upstream stable release (LP: #2007441) // CVE-url: https://ubuntu.com/security/CVE-2023-23454
  • net: sched: cbq: dont intepret cls results when asked to drop
• Jammy update: v5.15.76 upstream stable release (LP: #1997113) // CVE-url: https://ubuntu.com/security/CVE-2023-0590
  • net: sched: fix race condition in qdisc_graft()
• Jammy update: v5.15.91 upstream stable release (LP: #2011467) // CVE-url: https://ubuntu.com/security/CVE-2022-4129
  • l2tp: Serialize access to sk_user_data with sk_callback_lock
• Jammy update: v5.15.105 upstream stable release (LP: #2023230) // CVE-url: https://ubuntu.com/security/CVE-2023-30772
  • power: supply: da9150: Fix use after free bug in da9150_charger_remove due to race condition
• Jammy update: v5.15.105 upstream stable release (LP: #2023230) // CVE-url: https://ubuntu.com/security/CVE-2023-2194
  • i2c: xgene-slimpro: Fix out-of-bounds bug in xgene_slimpro_i2c_xfer()
• CVE-2023-31084 // CVE-2023-31084 was assigned to this bug. // CVE-url: https://ubuntu.com/security/CVE-2023-31084
  • media: dvb-core: Fix kernel WARNING for blocking operation in wait_event*()
• Jammy update: v5.15.99 upstream stable release (LP: #2018438) // CVE-url: https://ubuntu.com/security/CVE-2023-2985
  • fs: hfsplus: fix UAF issue in hfsplus_put_super
• Jammy update: v5.15.111 upstream stable release (LP: #2025095) // CVE-url: https://ubuntu.com/security/CVE-2023-2269
  • dm ioctl: fix nested locking in table_clear() to remove deadlock concern

• Jammy update: v5.15.86 upstream stable release (LP: #2005113) // CVE-url: https://ubuntu.com/security/CVE-2022-3606
  • libbpf: Fix null-pointer dereference in find_prog_by_sec_insn()
• Jammy update: v5.15.87 upstream stable release (LP: #2007441) // CVE-url: https://ubuntu.com/security/CVE-2023-23454
  • net: sched: cbq: dont intepret cls results when asked to drop
• Jammy update: v5.15.76 upstream stable release (LP: #1997113) // CVE-url: https://ubuntu.com/security/CVE-2023-0590
  • net: sched: fix race condition in qdisc_graft()
• Jammy update: v5.15.104 upstream stable release (LP: #2023225) // CVE-url: https://ubuntu.com/security/CVE-2023-1855
  • hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition
• Jammy update: v5.15.91 upstream stable release (LP: #2011467) // CVE-url: https://ubuntu.com/security/CVE-2022-4129
  • l2tp: Serialize access to sk_user_data with sk_callback_lock
• Jammy update: v5.15.105 upstream stable release (LP: #2023230) // CVE-url: https://ubuntu.com/security/CVE-2023-30772
  • power: supply: da9150: Fix use after free bug in da9150_charger_remove due to race condition
• Jammy update: v5.15.105 upstream stable release (LP: #2023230) // CVE-url: https://ubuntu.com/security/CVE-2023-2194
  • i2c: xgene-slimpro: Fix out-of-bounds bug in xgene_slimpro_i2c_xfer()
• Jammy update: v5.15.105 upstream stable release (LP: #2023230) // CVE-url: https://ubuntu.com/security/CVE-2023-33203
  • net: qcom/emac: Fix use after free bug in emac_remove due to race condition
• CVE-2023-31084 // CVE-2023-31084 was assigned to this bug. // CVE-url: https://ubuntu.com/security/CVE-2023-31084
  • media: dvb-core: Fix kernel WARNING for blocking operation in wait_event*()
• Jammy update: v5.15.99 upstream stable release (LP: #2018438) // CVE-url: https://ubuntu.com/security/CVE-2023-2985
  • fs: hfsplus: fix UAF issue in hfsplus_put_super
• Jammy update: v5.15.111 upstream stable release (LP: #2025095) // CVE-url: https://ubuntu.com/security/CVE-2023-2269
  • dm ioctl: fix nested locking in table_clear() to remove deadlock concern

• Jammy update: v5.15.86 upstream stable release (LP: #2005113) // CVE-url: https://ubuntu.com/security/CVE-2022-3606
  • libbpf: Fix null-pointer dereference in find_prog_by_sec_insn()
• Jammy update: v5.15.87 upstream stable release (LP: #2007441) // CVE-url: https://ubuntu.com/security/CVE-2023-23454
  • net: sched: cbq: dont intepret cls results when asked to drop
• Jammy update: v5.15.76 upstream stable release (LP: #1997113) // CVE-url: https://ubuntu.com/security/CVE-2023-0590
  • net: sched: fix race condition in qdisc_graft()
• Jammy update: v5.15.104 upstream stable release (LP: #2023225) // CVE-url: https://ubuntu.com/security/CVE-2023-1855
  • hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition
• Jammy update: v5.15.91 upstream stable release (LP: #2011467) // CVE-url: https://ubuntu.com/security/CVE-2022-4129
  • l2tp: Serialize access to sk_user_data with sk_callback_lock
• Jammy update: v5.15.105 upstream stable release (LP: #2023230) // CVE-url: https://ubuntu.com/security/CVE-2023-30772
  • power: supply: da9150: Fix use after free bug in da9150_charger_remove due to race condition
• Jammy update: v5.15.105 upstream stable release (LP: #2023230) // CVE-url: https://ubuntu.com/security/CVE-2023-2194
  • i2c: xgene-slimpro: Fix out-of-bounds bug in xgene_slimpro_i2c_xfer()
• Jammy update: v5.15.105 upstream stable release (LP: #2023230) // CVE-url: https://ubuntu.com/security/CVE-2023-33203
  • net: qcom/emac: Fix use after free bug in emac_remove due to race condition
• CVE-2023-31084 // CVE-2023-31084 was assigned to this bug. // CVE-url: https://ubuntu.com/security/CVE-2023-31084
  • media: dvb-core: Fix kernel WARNING for blocking operation in wait_event*()
• Jammy update: v5.15.99 upstream stable release (LP: #2018438) // CVE-url: https://ubuntu.com/security/CVE-2023-2985
  • fs: hfsplus: fix UAF issue in hfsplus_put_super
• Jammy update: v5.15.111 upstream stable release (LP: #2025095) // CVE-url: https://ubuntu.com/security/CVE-2023-2269
  • dm ioctl: fix nested locking in table_clear() to remove deadlock concern

This kernel update is based on upstream 5.15.88 and fixes atleast the following security issues:

A use-after-free flaw was found in the Linux kernel’s SGI GRU driver in the way the first gru_file_unlocked_ioctl function is called by the user, where a fail pass occurs in the gru_check_chiplet_assignment function. This flaw allows a local user to crash or potentially escalate their privileges on the system (CVE-2022-3424).

A vulnerability in the function btf_dump_name_dups of the file tools/lib/bpf/ btf_dump.c of the component libbpf. This flaw allows a manipulation that may lea to a use-after-free issue (CVE-2022-3534).

A vulnerability was found in area_cache_get in drivers/net/ethernet/ netronome/nfp/nfpcore/nfp_cppcore.c in the Netronome Flow Processor (NFP) driver in the Linux kernel. This flaw allows a manipulation that may lead to a use-after-free issue (CVE-2022-3545).

An out-of-bounds memory write vulnerability was found in the Linux kernel vmwgfx driver in vmw_kms_cursor_snoop due to a missing check of a memcpy length. This flaw allows a local, unprivileged attacker with access to either the /dev/dri/card0 or /dev/dri/rendererD128 and able to issue an ioctl() on the resulting file descriptor, to crash the system, causing a denial of service (CVE-2022-36280).

A use-after-free flaw was found in the Linux kernel’s dvb-core subsystem (DVB API used by Digital TV devices) in how a user physically removed a USB device (such as a DVB demultiplexer device) while running malicious code. This flaw allows a local user to crash or potentially escalate their privileges on the system (CVE-2022-41218).

An issue was discovered in the Linux kernel through 6.0.10. l2cap_config_req in net/bluetooth/l2cap_core.c has an integer wraparound via L2CAP_CONF_REQ packets (CVE-2022-45934).

In the Linux kernel before 6.1.6, a NULL pointer dereference bug in the traffic control subsystem allows an unprivileged user to trigger a denial of service (system crash) via a crafted traffic control configuration that is set up with "tc qdisc" and "tc class" commands. This affects qdisc_graft in net/sched/sch_api.c (CVE-2022-47929).

A buffer overflow vulnerability was found in the Netfilter subsystem in the Linux Kernel. This issue could allow the leakage of both stack and heap addresses, and potentially allow Local Privilege Escalation to the root user via arbitrary code execution (CVE-2023-0179).

A vulnerability in the kernel ksmbd allows a remote attacker to perform a denial of service (DoS) attack. The vulnerability exists due to a boundary error within the ksmbd_decode_ntlmssp_auth_blob() function in ksmbd when handling NTLMv2 authentication. A remote attacker can send specially crafted data to ksmbd, trigger a heap-based buffer overflow and perform a denial of service (DoS) attack (CVE-2023-0210).

ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF (CVE-2023-0266).

cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service (slab-out-of-bounds read) because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (CVE-2023-23454).

atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (CVE-2023-23455).

Other fixes in this update:

• fixes broken sound on Intel Tiger Lake systems (regression in kernel 5.15.82 released in MGASA-2022-0477 (mga #31319).
• xtables-addons have been updated to 3.23.

For other upstream fixes in this update, see the referenced changelogs.

This kernel-linus update is based on upstream 5.15.88 and fixes atleast the following security issues:

A use-after-free flaw was found in the Linux kernel’s SGI GRU driver in the way the first gru_file_unlocked_ioctl function is called by the user, where a fail pass occurs in the gru_check_chiplet_assignment function. This flaw allows a local user to crash or potentially escalate their privileges on the system (CVE-2022-3424).

A vulnerability in the function btf_dump_name_dups of the file tools/lib/bpf/ btf_dump.c of the component libbpf. This flaw allows a manipulation that may lea to a use-after-free issue (CVE-2022-3534).

A vulnerability was found in area_cache_get in drivers/net/ethernet/ netronome/nfp/nfpcore/nfp_cppcore.c in the Netronome Flow Processor (NFP) driver in the Linux kernel. This flaw allows a manipulation that may lead to a use-after-free issue (CVE-2022-3545).

Guests can trigger NIC interface reset/abort/crash via netback. It is possible for a guest to trigger a NIC interface reset/abort/crash in a Linux based network backend by sending certain kinds of packets. It appears to be an (unwritten?) assumption in the rest of the Linux network stack that packet protocol headers are all contained within the linear section of the SKB and some NICs behave badly if this is not the case. This has been reported to occur with Cisco (enic) and Broadcom NetXtrem II BCM5780 (bnx2x) though it may be an issue with other NICs/drivers as well. In case the frontend is sending requests with split headers, netback will forward those violating above mentioned assumption to the networking core, resulting in said misbehavior (CVE-2022-3643, XSA-423).

An out-of-bounds memory write vulnerability was found in the Linux kernel vmwgfx driver in vmw_kms_cursor_snoop due to a missing check of a memcpy length. This flaw allows a local, unprivileged attacker with access to either the /dev/dri/card0 or /dev/dri/rendererD128 and able to issue an ioctl() on the resulting file descriptor, to crash the system, causing a denial of service (CVE-2022-36280).

A use-after-free flaw was found in the Linux kernel’s dvb-core subsystem (DVB API used by Digital TV devices) in how a user physically removed a USB device (such as a DVB demultiplexer device) while running malicious code. This flaw allows a local user to crash or potentially escalate their privileges on the system (CVE-2022-41218).

An issue was discovered in the Linux kernel through 6.0.10. l2cap_config_req in net/bluetooth/l2cap_core.c has an integer wraparound via L2CAP_CONF_REQ packets (CVE-2022-45934).

In the Linux kernel before 6.1.6, a NULL pointer dereference bug in the traffic control subsystem allows an unprivileged user to trigger a denial of service (system crash) via a crafted traffic control configuration that is set up with "tc qdisc" and "tc class" commands. This affects qdisc_graft in net/sched/sch_api.c (CVE-2022-47929).

A vulnerability in the kernel ksmbd allows a remote attacker to perform a denial of service (DoS) attack. The vulnerability exists due to a boundary error within the ksmbd_decode_ntlmssp_auth_blob() function in ksmbd when handling NTLMv2 authentication. A remote attacker can send specially crafted data to ksmbd, trigger a heap-based buffer overflow and perform a denial of service (DoS) attack (CVE-2023-0210).

ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF (CVE-2023-0266).

cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service (slab-out-of-bounds read) because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (CVE-2023-23454).

atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results)…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-4662: Fixed a recursive locking violation in usb-storage that can cause the kernel to deadlock. (bsc#1206664)
• CVE-2022-3564: Fixed a bug which could lead to use after free, it was found in the function l2cap_reassemble_sdu of the file net/bluetooth/l2cap_core.c of the component Bluetooth. (bsc#1206073)
• CVE-2022-3108: Fixed a bug in kfd_parse_subtype_iolink in drivers/gpu/drm/amd/amdkfd/kfd_crat.c where a lack of check of the return value of kmemdup() could lead to a NULL pointer dereference. (bsc#1206389)
• CVE-2023-23454: Fixed a type confusion bug in the CBQ network scheduler which could lead to a use-after-free (bsc#1207036)
• CVE-2022-3107: Fixed a null pointer dereference caused by a missing check of the return value of kvmalloc_array. (bsc#1206395)
• CVE-2023-0394: Fixed a null pointer dereference flaw in the network subcomponent in the Linux kernel which could lead to system crash (bsc#1207168).

The following non-security bugs were fixed:

• arm64: alternative: Use true and false for boolean values (git-fixes)
• arm64: cmpwait: Clear event register before arming exclusive monitor (git-fixes)
• arm64: Fix minor issues with the dcache_by_line_op macro (git-fixes)
• arm64: fix possible spectre-v1 in ptrace_hbp_get_event() (git-fixes)
• arm64: fix possible spectre-v1 write in ptrace_hbp_set_event() (git-fixes)
• arm64: ftrace: do not adjust the LR value (git-fixes)
• arm64: io: Ensure calls to delay routines are ordered against prior (git-fixes)
• arm64: io: Ensure value passed to __iormb() is held in a 64-bit (git-fixes)
• arm64: jump_label.h: use asm_volatile_goto macro instead of 'asm (git-fixes)
• arm64: make secondary_start_kernel() notrace (git-fixes)
• arm64: makefile fix build of .i file in external module case (git-fixes)
• arm64: ptrace: remove addr_limit manipulation (git-fixes)
• arm64: rockchip: Force CONFIG_PM on Rockchip systems (git-fixes)
• arm64: smp: Handle errors reported by the firmware (git-fixes)
• arm64/kvm: consistently handle host HCR_EL2 flags (git-fixes)
• Bluetooth: hci_qca: Fix the teardown problem for real (git-fixes).
• CDC-NCM: remove 'connected' log message (git-fixes).
• ceph: remove bogus checks and WARN_ONs from ceph_set_page_dirty (bsc#1207195).
• flexfiles: enforce per-mirror stateid only for v4 DSes (git-fixes).
• flexfiles: use per-mirror specified stateid for IO (git-fixes).
• fs: nfs: Fix possible null-pointer dereferences in encode_attrs() (git-fixes).
• ibmveth: Always stop tx queues during close (bsc#1065729).
• ipv6: raw: Deduct extension header length in rawv6_push_pending_frames (bsc#1207168).
• kABI: mitigate new ufs_stats field (git-fixes).
• lockd: fix decoding of TEST results (git-fixes).
• media: Do not let tvp5150_get_vbi() go out of vbi_ram_default array (git-fixes).
• media: i2c: tvp5150: remove useless variable assignment in tvp5150_set_vbi() (git-fixes).
• memcg, kmem: further deprecate kmem.limit_in_bytes (bsc#1206896).
• memcg: Fix possible use-after-free in memcg_write_event_control() (bsc#1206344).
• mm, page_alloc: avoid expensive reclaim when compaction may not succeed (bsc#1204250).
• module: set MODULE_STATE_GOING state when a module fails to load (git-fixes).
• move new members of struct usbnet to end (git-fixes).
• net :sunrpc :clnt :Fix xps refcount imbalance on the error path (git-fixes).
• net: kalmia: clean up bind error path (git-fixes).
• net: kalmia: fix memory leaks (git-fixes).
• net: sched: atm: dont intepret cls results when asked to drop (bsc#1207036).
• net: sched: cbq: dont intepret cls results when asked to drop (bsc#1207036).
• net: sunrpc: Fix off-by-one issues in 'rpc_ntop6' (git-fixes).
• net: usb: asix: ax88772_bind return error when hw_reset fail (git-fixes).
• net: usb: asix: init MAC address buffers (git-fixes).
• net: usb: qmi_wwan: add Quectel EM160R-GL (git-fixes).
• net:…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-0266: Fixed a use-after-free bug led by a missing lock in ALSA. (bsc#1207134)
• CVE-2022-47929: Fixed a NULL pointer dereference bug in the traffic control subsystem which allowed an unprivileged user to trigger a denial of service via a crafted traffic control configuration. (bsc#1207237)
• CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207036)
• CVE-2023-23455: Fixed a bug that could allow attackers to cause a denial of service because of type confusion in atm_tc_enqueue. (bsc#1207125)
• CVE-2022-3435: Fixed an out-of-bounds read in fib_nh_match() of the file net/ipv4/fib_semantics.c (bsc#1204171).
• CVE-2022-4662: Fixed a recursive locking violation in usb-storage that can cause the kernel to deadlock. (bsc#1206664)
• CVE-2022-3115: Fixed a null pointer dereference in malidp_crtc.c caused by a lack of checks of the return value of kzalloc. (bsc#1206393)
• CVE-2022-47520: Fixed an out-of-bounds read when parsing a Robust Security Network (RSN) information element from a Netlink packet. (bsc#1206515)
• CVE-2022-3112: Fixed a null pointer dereference caused by lacks check of the return value of kzalloc() in vdec_helpers.c:amvdec_set_canvases. (bsc#1206399)
• CVE-2022-3564: Fixed a bug which could lead to use after free, it was found in the function l2cap_reassemble_sdu of the file net/bluetooth/l2cap_core.c of the component Bluetooth. (bsc#1206073)
• CVE-2022-3108: Fixed a bug in kfd_parse_subtype_iolink in drivers/gpu/drm/amd/amdkfd/kfd_crat.c where a lack of check of the return value of kmemdup() could lead to a NULL pointer dereference. (bsc#1206389)
• CVE-2019-19083: Fixed a memory leaks in clock_source_create that could allow attackers to cause a denial of service (bsc#1157049).
• CVE-2022-42328: Fixed a bug which could allow guests to trigger denial of service via the netback driver (bsc#1206114).
• CVE-2022-42329: Fixed a bug which could allow guests to trigger denial of service via the netback driver (bsc#1206113).
• CVE-2022-3643: Fixed a bug which could allow guests to trigger NIC interface reset/abort/crash via netback driver (bsc#1206113).
• CVE-2022-3107: Fixed a null pointer dereference caused by a missing check of the return value of kvmalloc_array. (bsc#1206395)
• CVE-2022-3111: Fixed a missing release of resource after effective lifetime bug caused by a missing free of the WM8350_IRQ_CHG_FAST_RDY in wm8350_init_charger. (bsc#1206394)
• CVE-2022-3105: Fixed a null pointer dereference caused by a missing check of the return value of kmalloc_array. (bsc#1206398)
• CVE-2022-3106: Fixed a null pointer dereference caused by a missing check of the return value of kmalloc. (bsc#1206397)

The following non-security bugs were fixed:

• afs: Fix some tracing details (git-fixes).
• arm64: cpu_errata: Add Hisilicon TSV110 to spectre-v2 safe list (git-fixes)
• arm64: dts: allwinner: H5: Add PMU node (git-fixes)
• arm64: dts: allwinner: H6: Add PMU mode (git-fixes)
• arm64: dts: marvell: Add AP806-dual missing CPU clocks (git-fixes)
• arm64: dts: rockchip: add reg property to brcmf sub-nodes (git-fixes)
• arm64: dts: rockchip: fix dwmmc clock name for px30 (git-fixes)
• arm64: dts: rockchip: Fix NanoPC-T4 cooling maps (git-fixes)
• arm64: memory: Add missing brackets to untagged_addr() macro (git-fixes)
• arm64: psci: Reduce the waiting time for cpu_psci_cpu_kill() (git-fixes).
• arm64: tags: Preserve tags for addresses translated via TTBR1 (git-fixes)
• arm64: tegra: Fix 'active-low' warning for Jetson Xavier regulator (git-fixes)
• block: Do not reread partition table on exclusively open device (bsc#1190969).
• ceph: avoid putting the realm twice when decoding snaps fails (bsc#1207198).
• ceph: do not update snapshot context when there is no new snapshot (bsc#1207218).
• cuse: prevent clone (bsc#1206177).
• drbd: destroy workqueue when drbd device…

The SUSE Linux Enterprise 15 SP2 LTSS kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (bsc#1207125).
• CVE-2023-23454: Fixed denial or service in cbq_classify in net/sched/sch_cbq.c (bnc#1207036).
• CVE-2023-0266: Fixed a use-after-free vulnerability inside the ALSA PCM package. SNDRV_CTL_IOCTL_ELEM_{READ|WRITE}32 was missing locks that could have been used in a use-after-free that could have resulted in a priviledge escalation to gain ring0 access from the system user (bsc#1207134).
• CVE-2022-47929: Fixed NULL pointer dereference bug in the traffic control subsystem (bnc#1207237).
• CVE-2022-47520: Fixed a out-of-bounds read when parsing a Robust Security Network (RSN) information element from a Netlink packet in the WILC1000 wireless driver (bsc#1206515).
• CVE-2022-4662: Fixed incorrect access control in the USB core subsystem that could lead a local user to crash the system (bnc#1206664).
• CVE-2022-42328, CVE-2022-42329: Fixed deadlock inside the netback driver that could have been triggered from a VM guest (bnc#1206114).
• CVE-2022-3643: Fixed reset/abort/crash via netback from VM guest (bnc#1206113).
• CVE-2022-3564: Fixed use-after-free in l2cap_core.c of the Bluetooth component (bnc#1206073).
• CVE-2022-3435: Fixed a out-of-bounds read in function fib_nh_match of the file net/ipv4/fib_semantics.c. It is possible to initiate the attack remotely (bnc#1204171).
• CVE-2022-3115: Fixed a null pointer dereference inside malidp_crtc_reset in drivers/gpu/drm/arm/malidp_crtc.c that lacked a check of the return value of kzalloc() (bnc#1206393).
• CVE-2022-3112: Fixed a null pointer dereference in amvdec_set_canvases in drivers/staging/media/meson/vdec/vdec_helpers.c that lacked a check of the return value of kzalloc() (bnc#1206399).
• CVE-2022-3108: Fixed missing check of return value of kmemdup() (bnc#1206389).
• CVE-2022-3107: Fixed missing check of return value of kvmalloc_array() (bnc#1206395).
• CVE-2022-3105: Fixed missing check of kmalloc_array() in uapi_finalize in drivers/infiniband/core/uverbs_uapi.c (bnc#1206398).

The following non-security bugs were fixed:

• HID: betop: check shape of output reports (git-fixes, bsc#1207186).
• HID: check empty report_list in bigben_probe() (git-fixes, bsc#1206784).
• HID: check empty report_list in hid_validate_values() (git-fixes, bsc#1206784).
• NFS: Handle missing attributes in OPEN reply (bsc#1203740).
• constraints: increase disk space for all architectures (bsc#1203693).
• ipv6: ping: fix wrong checksum for large frames (bsc#1203183).
• mm: /proc/pid/smaps_rollup: fix no vma's null-deref (bsc#1207769).
• net: sched: atm: dont intepret cls results when asked to drop (bsc#1207036).
• net: sched: cbq: dont intepret cls results when asked to drop (bsc#1207036).
• netfilter: nfnetlink_osf: fix possible bogus match in nf_osf_find() (bsc#1204614).
• rpm: suse-kernel-rpm-scriptlets to kmp buildreqs (boo#1205149).
• sctp: fail if no bound addresses can be used for a given scope (bsc#1206677).
• sctp: sysctl: make extra pointers netns aware (bsc#1204760).

The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-47929: Fixed NULL pointer dereference bug in the traffic control subsystem (bnc#1207237).
• CVE-2023-23454: Fixed denial or service in cbq_classify in net/sched/sch_cbq.c (bnc#1207036).
• CVE-2022-4662: Fixed incorrect access control in the USB core subsystem that could lead a local user to crash the system (bnc#1206664).
• CVE-2022-3564: Fixed use-after-free in l2cap_core.c of the Bluetooth component (bnc#1206073).

The following non-security bugs were fixed:

• Added support for enabling livepatching related packages on -RT (jsc#PED-1706).
• Added suse-kernel-rpm-scriptlets to kmp buildreqs (boo#1205149).
• Reverted 'constraints: increase disk space for all architectures' (bsc#1203693).
• HID: betop: check shape of output reports (bsc#1207186).
• HID: betop: fix slab-out-of-bounds Write in betop_probe (bsc#1207186).
• HID: check empty report_list in hid_validate_values() (bsc#1206784).
• net: sched: atm: dont intepret cls results when asked to drop (bsc#1207036).
• net: sched: cbq: dont intepret cls results when asked to drop (bsc#1207036).
• sctp: fail if no bound addresses can be used for a given scope (bsc#1206677).

The SUSE Linux Enterprise 15 SP1 kernel was updated receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-3107: Fixed missing check of return value of kvmalloc_array() (bnc#1206395).
• CVE-2022-3108: Fixed missing check of return value of kmemdup() (bnc#1206389).
• CVE-2022-3564: Fixed use-after-free in l2cap_core.c of the Bluetooth component (bnc#1206073).
• CVE-2022-4662: Fixed incorrect access control in the USB core subsystem that could lead a local user to crash the system (bnc#1206664).
• CVE-2022-47929: Fixed NULL pointer dereference bug in the traffic control subsystem (bnc#1207237).
• CVE-2023-23454: Fixed denial or service in cbq_classify in net/sched/sch_cbq.c (bnc#1207036).

The following non-security bugs were fixed:

• Added support for enabling livepatching related packages on -RT (jsc#PED-1706).
• Added suse-kernel-rpm-scriptlets to kmp buildreqs (boo#1205149).
• HID: betop: check shape of output reports (git-fixes, bsc#1207186).
• HID: betop: fix slab-out-of-bounds Write in betop_probe (git-fixes, bsc#1207186).
• HID: check empty report_list in hid_validate_values() (git-fixes, bsc#1206784).
• Reverted 'constraints: increase disk space for all architectures' (bsc#1203693)
• net: sched: atm: dont intepret cls results when asked to drop (bsc#1207036).
• net: sched: cbq: dont intepret cls results when asked to drop (bsc#1207036).
• sctp: fail if no bound addresses can be used for a given scope (bsc#1206677).

The SUSE Linux Enterprise 12 SP2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-9517: Fixed possible memory corruption due to a use after free in pppol2tp_connect (bsc#1108488).
• CVE-2022-3564: Fixed use-after-free in l2cap_core.c of the Bluetooth component (bsc#1206073).
• CVE-2022-3643: Fixed reset/abort/crash via netback from VM guest (bsc#1206113).
• CVE-2022-42895: Fixed an information leak in the net/bluetooth/l2cap_core.c's l2cap_parse_conf_req() which can be used to leak kernel pointers remotely (bsc#1205705).
• CVE-2022-42896: Fixed a use-after-free vulnerability in the net/bluetooth/l2cap_core.c's l2cap_connect() and l2cap_le_connect_req() which may have allowed code execution and leaking kernel memory (respectively) remotely via Bluetooth (bsc#1205709).
• CVE-2022-4662: Fixed incorrect access control in the USB core subsystem that could lead a local user to crash the system (bsc#1206664).
• CVE-2022-47929: Fixed NULL pointer dereference bug in the traffic control subsystem (bsc#1207237).
• CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207036).
• CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (bsc#1207125).

The following non-security bugs were fixed:

• HID: betop: check shape of output reports (git-fixes, bsc#1207186).
• HID: betop: fix slab-out-of-bounds Write in betop_probe (git-fixes).
• HID: check empty report_list in hid_validate_values() (git-fixes, bsc#1206784).
• sctp: fail if no bound addresses can be used for a given scope (bsc#1206677).

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (bsc#1207125).
• CVE-2023-23454: Fixed denial or service in cbq_classify in net/sched/sch_cbq.c (bnc#1207036).
• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2023-0266: Fixed a use-after-free vulnerability inside the ALSA PCM package. SNDRV_CTL_IOCTL_ELEM_{READ|WRITE}32 was missing locks that could have been used in a use-after-free that could have resulted in a priviledge escalation to gain ring0 access from the system user (bsc#1207134).
• CVE-2023-0179: Fixed incorrect arithmetics when fetching VLAN header bits (bsc#1207034).
• CVE-2023-0122: Fixed a NULL pointer dereference vulnerability in nvmet_setup_auth(), that allowed an attacker to perform a Pre-Auth Denial of Service (DoS) attack on a remote machine (bnc#1207050).
• CVE-2022-4382: Fixed a use-after-free flaw that was caused by a race condition among the superblock operations inside the gadgetfs code (bsc#1206258).
• CVE-2020-24588: Fixed injection of arbitrary network packets against devices that support receiving non-SSP A-MSDU frames (which is mandatory as part of 802.11n) (bsc#1199701).

The following non-security bugs were fixed:

• ACPI: EC: Fix EC address space handler unregistration (bsc#1207149).
• ACPI: EC: Fix ECDT probe ordering issues (bsc#1207149).
• ACPI: PRM: Check whether EFI runtime is available (git-fixes).
• ACPICA: Allow address_space_handler Install and _REG execution as 2 separate steps (bsc#1207149).
• ACPICA: include/acpi/acpixf.h: Fix indentation (bsc#1207149).
• ALSA: control-led: use strscpy in set_led_id() (git-fixes).
• ALSA: hda - Enable headset mic on another Dell laptop with ALC3254 (git-fixes).
• ALSA: hda/hdmi: Add a HP device 0x8715 to force connect list (git-fixes).
• ALSA: hda/realtek - Turn on power early (git-fixes).
• ALSA: hda/realtek: Add Acer Predator PH315-54 (git-fixes).
• ALSA: hda/realtek: Enable mute/micmute LEDs on HP Spectre x360 13-aw0xxx (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs do not work for a HP platform (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for a HP ProBook (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs, speaker do not work for a HP platform (git-fixes).
• ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path() (git-fixes).
• ALSA: hda: cs35l41: Check runtime suspend capability at runtime_idle (git-fixes).
• ALSA: hda: cs35l41: Do not return -EINVAL from system suspend/resume (git-fixes).
• ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF (git-fixes).
• ALSA: usb-audio: Make sure to stop endpoints before closing EPs (git-fixes).
• ALSA: usb-audio: Relax hw constraints for implicit fb sync (git-fixes).
• ARM: dts: at91: sam9x60: fix the ddr clock for sam9x60 (git-fixes).
• ARM: dts: imx6qdl-gw560x: Remove incorrect 'uart-has-rtscts' (git-fixes).
• ARM: dts: imx6ul-pico-dwarf: Use 'clock-frequency' (git-fixes).
• ARM: dts: imx7d-pico: Use 'clock-frequency' (git-fixes).
• ARM: dts: imx: Fix pca9547 i2c-mux node name (git-fixes).
• ARM: dts: vf610: Fix pca9548 i2c-mux node names (git-fixes).
• ARM: imx: add missing of_node_put() (git-fixes).
• ASoC: Intel: bytcr_rt5651: Drop reference count of ACPI device after use (git-fixes).
• ASoC: Intel: bytcr_wm5102: Drop reference count of ACPI device after use (git-fixes).
• ASoC: fsl-asoc-card: Fix naming of AC'97 CODEC widgets (git-fixes).
• ASoC: fsl_micfil: Correct the number of steps on SX controls (git-fixes).
• ASoC: fsl_ssi: Rename AC'97 streams to avoid collisions with AC'97 CODEC (git-fixes).
• ASoC: qcom: lpass-cpu: Fix fallback SD line index handling (git-fixes).
• ASoC: wm8904: fix wrong outputs…

The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-36280: Fixed an out-of-bounds memory access in vmwgfx driver causing denial of service (bsc#1203332).
• CVE-2022-47929: Fixed NULL pointer dereference bug in the traffic control subsystem (bsc#1207237).
• CVE-2023-0045: Fixed missing Flush IBP in ib_prctl_set (bsc#1207773).
• CVE-2023-0266: Fixed use-after-free in SNDRV that could have resulted in a priviledge escalation (bsc#1207134).
• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207036).

The following non-security bugs were fixed:

• Added support for enabling livepatching related packages on -RT (jsc#PED-1706).
• Added suse-kernel-rpm-scriptlets to kmp buildreqs (boo#1205149).
• Reverted 'scsi: smartpqi: set force_blk_mq=1.(bsc#1205397)'.
• amiflop: clean up on errors during setup (git-fixes).
• audit: ensure userspace is penalized the same as the kernel when under pressure (bsc#1204514).
• audit: improve robustness of the audit queue handling (bsc#1204514).
• bcache: fix super block seq numbers comparision in register_cache_set() (git-fixes).
• blk-cgroup: Fix memleak on error path (git-fixes).
• blk-cgroup: Pre-allocate tree node on blkg_conf_prep (git-fixes).
• blk-cgroup: fix missing put device in error path from blkg_conf_pref() (git-fixes).
• blk-mq: fix possible memleak when register 'hctx' failed (git-fixes).
• blk-mq: insert request not through ->queue_rq into sw/scheduler queue (git-fixes).
• blk-mq: move cancel of requeue_work into blk_mq_release (git-fixes).
• blk-throttle: fix UAF by deleteing timer in blk_throtl_exit() (git-fixes).
• blktrace: Fix output non-blktrace event when blk_classic option enabled (git-fixes).
• blktrace: break out of blktrace setup on concurrent calls (git-fixes).
• blktrace: ensure our debugfs dir exists (git-fixes).
• blktrace: fix endianness for blk_log_remap() (git-fixes).
• blktrace: fix endianness in get_pdu_int() (git-fixes).
• blktrace: use errno instead of bi_status (git-fixes).
• block, bfq: fix overwrite of bfq_group pointer in bfq_find_set_group() (bsc#1175995,jsc#SLE-15608).
• block, bfq: fix overwrite of bfq_group pointer in bfq_find_set_group() (git-fixes).
• block, bfq: increase idling for weight-raised queues (git-fixes).
• block, bfq: protect 'bfqd->queued' by 'bfqd->lock' (bsc#1207102).
• block, bfq: protect 'bfqd->queued' by 'bfqd->lock' (git-fixes).
• block/bio-integrity: do not free 'buf' if bio_integrity_add_page() failed (git-fixes).
• block/bio-integrity: fix a memory leak bug (git-fixes).
• block/swim: Check drive type (git-fixes).
• block/swim: Do not log an error message for an invalid ioctl (git-fixes).
• block/swim: Fix IO error at end of medium (git-fixes).
• block/swim: Rename macros to avoid inconsistent inverted logic (git-fixes).
• block/swim: Select appropriate drive on device open (git-fixes).
• block: Fix use-after-free issue accessing struct io_cq (git-fixes).
• block: add a lower-level bio_add_page interface (git-fixes).
• block: fix memleak when __blk_rq_map_user_iov() is failed (git-fixes).
• block: only update parent bi_status when bio fail (git-fixes).
• block: sed-opal: fix IOC_OPAL_ENABLE_DISABLE_MBR (git-fixes).
• brd: check and limit max_part par (git-fixes).
• ceph: remove bogus checks and WARN_ONs from ceph_set_page_dirty (bsc#1207195).
• compat_ioctl: block: handle BLKGETZONESZ/BLKGETNRZONES (git-fixes).
• constraints: increase disk space for all architectures (bsc#1203693)
• cryptoloop: add a deprecation warning (git-fixes).
• dm bio record: save/restore bi_end_io and bi_integrity (git-fixes).
• dm btree: add a defensive bounds check to insert_at() (git-fixes).
• dm cache: Fix ABBA deadlock between shrink_slab and dm_cache_metadata_abort (git-fixes).
• dm cache: Fix UAF in destroy() (git-fixes).
• dm cache: set needs_check flag after…

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-36280: Fixed an out-of-bounds memory access vulnerability that was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_kms.c (bnc#1203332).
• CVE-2023-0045: Fixed flush IBP in ib_prctl_set() (bsc#1207773).
• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2023-0122: Fixed a NULL pointer dereference vulnerability in nvmet_setup_auth(), that allowed an attacker to perform a Pre-Auth Denial of Service (DoS) attack on a remote machine (bnc#1207050).
• CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (bsc#1207125).
• CVE-2023-23454: Fixed denial or service in cbq_classify in net/sched/sch_cbq.c (bnc#1207036).
• CVE-2020-24588: Fixed injection of arbitrary network packets against devices that support receiving non-SSP A-MSDU frames (which is mandatory as part of 802.11n) (bsc#1199701).
• CVE-2023-0179: Fixed incorrect arithmetics when fetching VLAN header bits (bsc#1207034).
• CVE-2022-4382: Fixed a use-after-free flaw that was caused by a race condition among the superblock operations inside the gadgetfs code (bsc#1206258).
• CVE-2023-0266: Fixed a use-after-free vulnerability inside the ALSA PCM package. SNDRV_CTL_IOCTL_ELEM_{READ|WRITE}32 was missing locks that could have been used in a use-after-free that could have resulted in a priviledge escalation to gain ring0 access from the system user (bsc#1207134).
• CVE-2022-47929: Fixed NULL pointer dereference bug in the traffic control subsystem (bnc#1207237).

The following non-security bugs were fixed:

• ACPI: EC: Fix EC address space handler unregistration (bsc#1207149).
• ACPI: EC: Fix ECDT probe ordering issues (bsc#1207149).
• ACPI: PM: s2idle: Add support for upcoming AMD uPEP HID AMDI008 (bsc#1206224).
• ACPI: PM: s2idle: Use LPS0 idle if ACPI_FADT_LOW_POWER_S0 is unset (bsc#1206224).
• ACPI: PRM: Check whether EFI runtime is available (git-fixes).
• ACPI: x86: s2idle: Add a quirk for ASUS ROG Zephyrus G14 (bsc#1206224).
• ACPI: x86: s2idle: Add a quirk for ASUS TUF Gaming A17 FA707RE (bsc#1206224).
• ACPI: x86: s2idle: Add a quirk for ASUSTeK COMPUTER INC. ROG Flow X13 (bsc#1206224).
• ACPI: x86: s2idle: Add a quirk for Lenovo Slim 7 Pro 14ARH7 (bsc#1206224).
• ACPI: x86: s2idle: Add another ID to s2idle_dmi_table (bsc#1206224).
• ACPI: x86: s2idle: Add module parameter to prefer Microsoft GUID (bsc#1206224).
• ACPI: x86: s2idle: Fix a NULL pointer dereference (bsc#1206224).
• ACPI: x86: s2idle: Force AMD GUID/_REV 2 on HP Elitebook 865 (bsc#1206224).
• ACPI: x86: s2idle: If a new AMD _HID is missing assume Rembrandt (bsc#1206224).
• ACPI: x86: s2idle: Move _HID handling for AMD systems into structures (bsc#1206224).
• ACPI: x86: s2idle: Stop using AMD specific codepath for Rembrandt+ (bsc#1206224).
• ACPICA: Allow address_space_handler Install and _REG execution as 2 separate steps (bsc#1207149).
• ACPICA: include/acpi/acpixf.h: Fix indentation (bsc#1207149).
• ALSA: emux: Avoid potential array out-of-bound in snd_emux_xg_control() (git-fixes).
• ALSA: hda/realtek: Add Acer Predator PH315-54 (git-fixes).
• ALSA: hda/realtek: Add Positivo N14KP6-TG (git-fixes).
• ALSA: hda/realtek: Add quirk for ASUS UM3402 using CS35L41 (git-fixes).
• ALSA: hda/realtek: Enable mute/micmute LEDs on HP Elitebook, 645 G9 (git-fixes).
• ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book2 Pro 360 (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs do not work for a HP platform (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs, speaker do not work for a HP platform (git-fixes).
• ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path() (git-fixes).
• ALSA: pci: lx6464es: fix a debug loop (git-fixes). -…

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-3112: Fixed a null pointer dereference caused by lacks check of the return value of kzalloc() in vdec_helpers.c:amvdec_set_canvases (bsc#1206399).
• CVE-2022-3115: Fixed a null pointer dereference in malidp_crtc.c caused by a lack of checks of the return value of kzalloc (bsc#1206393).
• CVE-2022-3564: Fixed use-after-free in l2cap_core.c of the Bluetooth component (bsc#1206073).
• CVE-2022-47520: Fixed a out-of-bounds read when parsing a Robust Security Network (RSN) information element from a Netlink packet in the WILC1000 wireless driver (bsc#1206515).
• CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207036).
• CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type confusion (bsc#1207125).

The following non-security bugs were fixed:

• arm64: cpu_errata: Add Hisilicon TSV110 to spectre-v2 safe list (git-fixes)
• arm64: dts: allwinner: H5: Add PMU node (git-fixes)
• arm64: dts: allwinner: H6: Add PMU mode (git-fixes)
• arm64: dts: marvell: Add AP806-dual missing CPU clocks (git-fixes)
• arm64: dts: rockchip: Fix NanoPC-T4 cooling maps (git-fixes)
• arm64: dts: rockchip: add reg property to brcmf sub-nodes (git-fixes)
• arm64: dts: rockchip: fix dwmmc clock name for px30 (git-fixes)
• arm64: memory: Add missing brackets to untagged_addr() macro (git-fixes)
• arm64: psci: Reduce the waiting time for cpu_psci_cpu_kill() (git-fixes).
• arm64: tags: Preserve tags for addresses translated via TTBR1 (git-fixes)
• arm64: tegra: Fix 'active-low' warning for Jetson Xavier regulator (git-fixes)
• btrfs: Avoid unnecessary lock and leaf splits when up (bsc#1206904).
• drbd: destroy workqueue when drbd device was freed (git-fixes).
• drbd: remove usage of list iterator variable after loop (git-fixes).
• drbd: use after free in drbd_create_device() (git-fixes).
• ext4: Detect already used quota file early (bsc#1206873).
• ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h (bsc#1206878).
• ext4: avoid BUG_ON when creating xattrs (bsc#1205496).
• ext4: avoid crash when inline data creation follows DIO write (bsc#1206883).
• ext4: avoid race conditions when remounting with options that change dax (bsc#1206860).
• ext4: avoid resizing to a partial cluster size (bsc#1206880).
• ext4: choose hardlimit when softlimit is larger than hardlimit in ext4_statfs_project() (bsc#1206854).
• ext4: continue to expand file system when the target size does not reach (bsc#1206882).
• ext4: convert BUG_ON's to WARN_ON's in mballoc.c (bsc#1206859).
• ext4: correct max_inline_xattr_value_size computing (bsc#1206878).
• ext4: correct the error path of ext4_write_inline_data_end() (bsc#1206875).
• ext4: correct the misjudgment in ext4_iget_extra_inode (bsc#1206878).
• ext4: fix BUG_ON() when directory entry has invalid rec_len (bsc#1206886).
• ext4: fix a data race at inode->i_disksize (bsc#1206855).
• ext4: fix bug in extents parsing when eh_entries == 0 and eh_depth > 0 (bsc#1206881).
• ext4: fix corruption when online resizing a 1K bigalloc fs (bsc#1206891).
• ext4: fix extent status tree race in writeback error recovery path (bsc#1206877).
• ext4: fix null-ptr-deref in ext4_write_info (bsc#1206884).
• ext4: fix undefined behavior in bit shift for ext4_check_flag_values (bsc#1206890).
• ext4: fix uninititialized value in 'ext4_evict_inode' (bsc#1206893).
• ext4: fix use-after-free in ext4_ext_shift_extents (bsc#1206888).
• ext4: fix use-after-free in ext4_xattr_set_entry (bsc#1206878).
• ext4: fix warning in 'ext4_da_release_space' (bsc#1206887).
• ext4: iomap that extends beyond EOF should be marked dirty (bsc#1206637).
• ext4: make ext4_lazyinit_thread freezable (bsc#1206885).
• ext4: mark block bitmap corrupted when found instead of BUGON (bsc#1206857).
• ext4: silence the warning when evicting inode with dioread_nolock…

The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-23454: Fixed denial or service in cbq_classify in net/sched/sch_cbq.c (bnc#1207036).
• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2023-0394: Fixed a null pointer dereference flaw in the network subcomponent in the Linux kernel which could lead to system crash (bsc#1207168).
• CVE-2023-0266: Fixed a use-after-free vulnerability inside the ALSA PCM package. SNDRV_CTL_IOCTL_ELEM_{READ|WRITE}32 was missing locks that could have been used in a use-after-free that could have resulted in a priviledge escalation to gain ring0 access from the system user (bsc#1207134).
• CVE-2023-0045: Fixed flush IBP in ib_prctl_set() (bsc#1207773).
• CVE-2022-47929: Fixed NULL pointer dereference bug in the traffic control subsystem (bnc#1207237).
• CVE-2022-4662: Fixed incorrect access control in the USB core subsystem that could lead a local user to crash the system (bnc#1206664).
• CVE-2022-36280: Fixed an out-of-bounds memory access vulnerability that was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_kms.c (bnc#1203332).
• CVE-2022-3564: Fixed use-after-free in l2cap_core.c of the Bluetooth component (bnc#1206073).
• CVE-2022-3108: Fixed missing check of return value of kmemdup() (bnc#1206389).
• CVE-2022-3107: Fixed missing check of return value of kvmalloc_array() (bnc#1206395).

The following non-security bugs were fixed:

• Bluetooth: hci_qca: Fix the teardown problem for real (git-fixes).
• CDC-NCM: remove 'connected' log message (git-fixes).
• HID: betop: check shape of output reports (git-fixes, bsc#1207186).
• HID: betop: fix slab-out-of-bounds Write in betop_probe (git-fixes, bsc#1207186).
• HID: check empty report_list in hid_validate_values() (git-fixes, bsc#1206784).
• Input: convert autorepeat timer to use timer_setup() (git-fixes).
• Input: do not use WARN() in input_alloc_absinfo() (git-fixes).
• Input: i8042 - Add quirk for Fujitsu Lifebook T725 (git-fixes).
• Input: iforce - reformat the packet dump output (git-fixes).
• Input: iforce - wake up after clearing IFORCE_XMIT_RUNNING flag (git-fixes).
• Input: replace hard coded string with func in pr_err() (git-fixes).
• Input: switch to using sizeof(*type) when allocating memory (git-fixes).
• Input: use seq_putc() in input_seq_print_bitmap() (git-fixes).
• Input: use seq_puts() in input_devices_seq_show() (git-fixes).
• Makefile: link with -z noexecstack --no-warn-rwx-segments (bsc#1203200).
• NFS Handle missing attributes in OPEN reply (bsc#1203740).
• NFS: Correct size calculation for create reply length (git-fixes).
• NFS: Fix an Oops in nfs_d_automount() (git-fixes).
• NFS: Fix initialisation of I/O result struct in nfs_pgio_rpcsetup (git-fixes).
• NFS: Fix memory leaks in nfs_pageio_stop_mirroring() (git-fixes).
• NFS: direct.c: Fix memory leak of dreq when nfs_get_lock_context fails (git-fixes).
• NFS: nfs_compare_mount_options always compare auth flavors (git-fixes).
• NFS: nfs_find_open_context() may only select open files (git-fixes).
• NFS: swap IO handling is slightly different for O_DIRECT IO (git-fixes).
• NFS: swap-out must always use STABLE writes (git-fixes).
• NFSD: Keep existing listeners on portlist error (git-fixes).
• NFSD: Return nfserr_serverfault if splice_ok but buf->pages have data (git-fixes).
• NFSv2: Fix eof handling (git-fixes).
• NFSv2: Fix write regression (git-fixes).
• NFSv4 expose nfs_parse_server_name function (git-fixes).
• NFSv4 only print the label when its queried (git-fixes).
• NFSv4 remove zero number of fs_locations entries error check (git-fixes).
• NFSv4.1 handle ERR_DELAY error reclaiming locking state on delegation recall (git-fixes).
• NFSv4.1: Fix uninitialised variable in devicenotify (git-fixes).
• NFSv4.1: Handle RECLAIM_COMPLETE trunking errors (git-fixes).
• NFSv4.1: We must always send RECLAIM_COMPLETE after a reboot (git-fixes). -…

The SUSE Linux Enterprise 15 SP4 Azure kernel was updated to receive various security and bugfixes.

• CVE-2022-3523: Fixed use after free related to device private page handling (bsc#1204363).
• CVE-2022-36280: Fixed out-of-bounds memory access vulnerability found in vmwgfx driver (bsc#1203332).
• CVE-2022-38096: Fixed NULL-ptr deref in vmw_cmd_dx_define_query() (bsc#1203331).
• CVE-2023-0045: Fixed missing Flush IBP in ib_prctl_set (bsc#1207773).
• CVE-2023-0122: Fixed a NULL pointer dereference vulnerability in nvmet_setup_auth(), that allowed an attacker to perform a Pre-Auth Denial of Service (DoS) attack on a remote machine (bsc#1207050).
• CVE-2023-0461: Fixed use-after-free in icsk_ulp_data (bsc#1208787).
• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2023-0597: Fixed lack of randomization of per-cpu entry area in x86/mm (bsc#1207845).
• CVE-2023-1118: Fixed a use-after-free bugs caused by ene_tx_irqsim() in media/rc (bsc#1208837).
• CVE-2023-22995: Fixed lacks of certain platform_device_put and kfree in drivers/usb/dwc3/dwc3-qcom.c (bsc#1208741).
• CVE-2023-22998: Fixed misinterpretatino of the irtio_gpu_object_shmem_init() return value (bsc#1208776).
• CVE-2023-23000: Fixed return value of tegra_xusb_find_port_node function (bsc#1208816).
• CVE-2023-23004: Fixed misinterpretatino of the get_sg_table return value in arm/malidp_planes.c (bsc#1208843).
• CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207036).
• CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (bsc#1207125).
• CVE-2023-23559: Fixed integer overflow in rndis_wlan that leads to a buffer overflow (bsc#1207051).
• CVE-2023-26545: Fixed double free in net/mpls/af_mpls.c upon an allocation failure (bsc#1208700).

The following non-security bugs were fixed:

• acpi / x86: Add support for LPS0 callback handler (git-fixes).
• acpi: NFIT: fix a potential deadlock during NFIT teardown (git-fixes).
• acpi: PM: s2idle: Add support for upcoming AMD uPEP HID AMDI008 (bsc#1206224).
• acpi: PM: s2idle: Use LPS0 idle if ACPI_FADT_LOW_POWER_S0 is unset (bsc#1206224).
• acpi: battery: Fix missing NUL-termination with large strings (git-fixes).
• acpi: x86: s2idle: Add a quirk for ASUS ROG Zephyrus G14 (bsc#1206224).
• acpi: x86: s2idle: Add a quirk for ASUS TUF Gaming A17 FA707RE (bsc#1206224).
• acpi: x86: s2idle: Add a quirk for ASUSTeK COMPUTER INC. ROG Flow X13 (bsc#1206224).
• acpi: x86: s2idle: Add a quirk for Lenovo Slim 7 Pro 14ARH7 (bsc#1206224).
• acpi: x86: s2idle: Add another ID to s2idle_dmi_table (bsc#1206224).
• acpi: x86: s2idle: Add module parameter to prefer Microsoft GUID (bsc#1206224).
• acpi: x86: s2idle: Fix a NULL pointer dereference (bsc#1206224).
• acpi: x86: s2idle: Force AMD GUID/_REV 2 on HP Elitebook 865 (bsc#1206224).
• acpi: x86: s2idle: If a new AMD _HID is missing assume Rembrandt (bsc#1206224).
• acpi: x86: s2idle: Move _HID handling for AMD systems into structures (bsc#1206224).
• acpi: x86: s2idle: Stop using AMD specific codepath for Rembrandt+ (bsc#1206224).
• acpica: Drop port I/O validation for some regions (git-fixes).
• acpica: nsrepair: handle cases without a return value correctly (git-fixes).
• alsa: emux: Avoid potential array out-of-bound in snd_emux_xg_control() (git-fixes).
• alsa: hda/ca0132: minor fix for allocation size (git-fixes).
• alsa: hda/conexant: add a new hda codec SN6180 (git-fixes).
• alsa: hda/realtek - fixed wrong gpio assigned (git-fixes).
• alsa: hda/realtek: Add Positivo N14KP6-TG (git-fixes).
• alsa: hda/realtek: Add quirk for ASUS UM3402 using CS35L41 (git-fixes).
• alsa: hda/realtek: Enable mute/micmute LEDs on HP Elitebook, 645 G9 (git-fixes).
• alsa: hda/realtek: Fix the speaker output on Samsung Galaxy Book2 Pro 360 (git-fixes).
• alsa: hda/realtek: fix mute/micmute LEDs…

The SUSE Linux Enterprise 15 SP4 Azure kernel was updated to receive various security and bugfixes.

• CVE-2022-3523: Fixed use after free related to device private page handling (bsc#1204363).
• CVE-2022-36280: Fixed out-of-bounds memory access vulnerability found in vmwgfx driver (bsc#1203332).
• CVE-2022-38096: Fixed NULL-ptr deref in vmw_cmd_dx_define_query() (bsc#1203331).
• CVE-2023-0045: Fixed missing Flush IBP in ib_prctl_set (bsc#1207773).
• CVE-2023-0122: Fixed a NULL pointer dereference vulnerability in nvmet_setup_auth(), that allowed an attacker to perform a Pre-Auth Denial of Service (DoS) attack on a remote machine (bsc#1207050).
• CVE-2023-0461: Fixed use-after-free in icsk_ulp_data (bsc#1208787).
• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2023-0597: Fixed lack of randomization of per-cpu entry area in x86/mm (bsc#1207845).
• CVE-2023-1075: Fixed a type confusion in tls_is_tx_ready (bsc#1208598).
• CVE-2023-1076: Fixed incorrect UID assigned to tun/tap sockets (bsc#1208599).
• CVE-2023-1078: Fixed a heap out-of-bounds write in rds_rm_zerocopy_callback (bsc#1208601).
• CVE-2023-1095: Fixed a NULL pointer dereference in nf_tables due to zeroed list head (bsc#1208777).
• CVE-2023-1118: Fixed a use-after-free bugs caused by ene_tx_irqsim() in media/rc (bsc#1208837).
• CVE-2023-22995: Fixed lacks of certain platform_device_put and kfree in drivers/usb/dwc3/dwc3-qcom.c (bsc#1208741).
• CVE-2023-22998: Fixed misinterpretatino of the irtio_gpu_object_shmem_init() return value (bsc#1208776).
• CVE-2023-23000: Fixed return value of tegra_xusb_find_port_node function (bsc#1208816).
• CVE-2023-23001: Fixed misinterpretion of the regulator_get return value (bsc# 1208829).
• CVE-2023-23004: Fixed misinterpretatino of the get_sg_table return value in arm/malidp_planes.c (bsc#1208843).
• CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207036).
• CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (bsc#1207125).
• CVE-2023-23559: Fixed integer overflow in rndis_wlan that leads to a buffer overflow (bsc#1207051).
• CVE-2023-25012: Fixed a use-after-free in bigben_set_led() (bsc#1207560).
• CVE-2023-26545: Fixed double free in net/mpls/af_mpls.c upon an allocation failure (bsc#1208700).
• CVE-2023-28328: Fixed a denial of service issue in az6027 driver in drivers/media/usb/dev-usb/az6027.c (bsc#1209291).

The following non-security bugs were fixed:

• NFSv4.1 provide mount option to toggle trunking discovery (git-fixes).
• acpi / x86: Add support for LPS0 callback handler (git-fixes).
• acpi: Do not build ACPICA with '-Os' (git-fixes).
• acpi: NFIT: fix a potential deadlock during NFIT teardown (git-fixes).
• acpi: PM: s2idle: Add support for upcoming AMD uPEP HID AMDI008 (bsc#1206224).
• acpi: PM: s2idle: Use LPS0 idle if ACPI_FADT_LOW_POWER_S0 is unset (bsc#1206224).
• acpi: battery: Fix missing NUL-termination with large strings (git-fixes).
• acpi: resource: Add helper function acpi_dev_get_memory_resources() (git-fixes).
• acpi: video: Fix Lenovo Ideapad Z570 DMI match (git-fixes).
• acpi: x86: s2idle: Add a quirk for ASUS ROG Zephyrus G14 (bsc#1206224).
• acpi: x86: s2idle: Add a quirk for ASUS TUF Gaming A17 FA707RE (bsc#1206224).
• acpi: x86: s2idle: Add a quirk for ASUSTeK COMPUTER INC. ROG Flow X13 (bsc#1206224).
• acpi: x86: s2idle: Add a quirk for Lenovo Slim 7 Pro 14ARH7 (bsc#1206224).
• acpi: x86: s2idle: Add another ID to s2idle_dmi_table (bsc#1206224).
• acpi: x86: s2idle: Add module parameter to prefer Microsoft GUID (bsc#1206224).
• acpi: x86: s2idle: Fix a NULL pointer dereference (bsc#1206224).
• acpi: x86: s2idle: Force AMD GUID/_REV 2 on HP Elitebook 865 (bsc#1206224).
• acpi: x86: s2idle: If a new AMD _HID is missing assume Rembrandt (bsc#1206224).
• acpi: x86: s2idle: Move…

The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2017-5753: Fixed spectre V1 vulnerability on netlink (bsc#1209547).
• CVE-2017-5753: Fixed spectre vulnerability in prlimit (bsc#1209256).
• CVE-2021-3923: Fixed stack information leak vulnerability that could lead to kernel protection bypass in infiniband RDMA (bsc#1209778).
• CVE-2022-20567: Fixed use after free that could lead to a local privilege escalation in pppol2tp_create of l2tp_ppp.c (bsc#1208850).
• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2023-1076: Fixed incorrect UID assigned to tun/tap sockets (bsc#1208599).
• CVE-2023-1095: Fixed a NULL pointer dereference in nf_tables due to zeroed list head (bsc#1208777).
• CVE-2023-1281: Fixed use after free that could lead to privilege escalation in tcindex (bsc#1209634).
• CVE-2023-1390: Fixed remote DoS vulnerability in tipc_link_xmit() (bsc#1209289).
• CVE-2023-1513: Fixed an uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak (bsc#1209532).
• CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207036).
• CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (bsc#1207125).
• CVE-2023-28328: Fixed a denial of service issue in az6027 driver in drivers/media/usb/dev-usb/az6027.c (bsc#1209291).
• CVE-2023-28464: Fixed user-after-free that could lead to privilege escalation in hci_conn_cleanup in net/bluetooth/hci_conn.c (bsc#1209052).
• CVE-2023-28772: Fixed buffer overflow in seq_buf_putmem_hex in lib/seq_buf.c (bsc#1209549).

The following non-security bugs were fixed:

• ARM: 8702/1: head-common.S: Clear lr before jumping to start_kernel() (git-fixes)
• Bluetooth: btusb: Add VID:PID 13d3:3529 for Realtek RTL8821CE (git-fixes).
• Bluetooth: btusb: do not call kfree_skb() under spin_lock_irqsave() (git-fixes).
• Input: atmel_mxt_ts - fix double free in mxt_read_info_block (git-fixes).
• KVM: arm64: Hide system instruction access to Trace registers (git-fixes)
• NFSv4: Fix hangs when recovering open state after a server reboot (git-fixes).
• PCI/MSI: Enforce MSI entry updates to be visible (git-fixes).
• PCI/MSI: Enforce that MSI-X table entry is masked for update (git-fixes).
• PCI/MSI: Mask all unused MSI-X entries (git-fixes).
• PCI/MSI: Skip masking MSI-X on Xen PV (git-fixes).
• PCI/PM: Always return devices to D0 when thawing (git-fixes).
• PCI/PM: Avoid using device_may_wakeup() for runtime PM (git-fixes).
• PCI: Add ACS quirk for Intel Root Complex Integrated Endpoints (git-fixes).
• PCI: Add ACS quirk for iProc PAXB (git-fixes).
• PCI: Avoid FLR for AMD Matisse HD Audio & USB 3.0 (git-fixes).
• PCI: Avoid FLR for AMD Starship USB 3.0 (git-fixes).
• PCI: Make ACS quirk implementations more uniform (git-fixes).
• PCI: PM: Avoid forcing PCI_D0 for wakeup reasons inconsistently (git-fixes).
• PCI: PM: Avoid skipping bus-level PM on platforms without ACPI (git-fixes).
• PCI: Unify ACS quirk desired vs provided checking (git-fixes).
• PCI: Use pci_update_current_state() in pci_enable_device_flags() (git-fixes).
• PCI: aardvark: Do not blindly enable ASPM L0s and do not write to read-only register (git-fixes).
• PCI: aardvark: Do not rely on jiffies while holding spinlock (git-fixes).
• PCI: aardvark: Do not touch PCIe registers if no card connected (git-fixes).
• PCI: aardvark: Fix a leaked reference by adding missing of_node_put() (git-fixes).
• PCI: aardvark: Fix checking for PIO Non-posted Request (git-fixes).
• PCI: aardvark: Fix kernel panic during PIO transfer (git-fixes).
• PCI: aardvark: Improve link training (git-fixes).
• PCI: aardvark: Indicate error in 'val' when config read fails (git-fixes).
• PCI: aardvark: Introduce an…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2017-5753: Fixed spectre V1 vulnerability on netlink (bsc#1209547).
• CVE-2017-5753: Fixed spectre vulnerability in prlimit (bsc#1209256).
• CVE-2021-3923: Fixed stack information leak vulnerability that could lead to kernel protection bypass in infiniband RDMA (bsc#1209778).
• CVE-2022-20567: Fixed use after free that could lead to a local privilege escalation in pppol2tp_create of l2tp_ppp.c (bsc#1208850).
• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2023-1076: Fixed incorrect UID assigned to tun/tap sockets (bsc#1208599).
• CVE-2023-1095: Fixed a NULL pointer dereference in nf_tables due to zeroed list head (bsc#1208777).
• CVE-2023-1281: Fixed use after free that could lead to privilege escalation in tcindex (bsc#1209634).
• CVE-2023-1390: Fixed remote DoS vulnerability in tipc_link_xmit() (bsc#1209289).
• CVE-2023-1513: Fixed an uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak (bsc#1209532).
• CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207036).
• CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (bsc#1207125).
• CVE-2023-28328: Fixed a denial of service issue in az6027 driver in drivers/media/usb/dev-usb/az6027.c (bsc#1209291).
• CVE-2023-28464: Fixed user-after-free that could lead to privilege escalation in hci_conn_cleanup in net/bluetooth/hci_conn.c (bsc#1209052).
• CVE-2023-28772: Fixed buffer overflow in seq_buf_putmem_hex in lib/seq_buf.c (bsc#1209549).

The following non-security bugs were fixed:

• Bluetooth: btusb: Add VID:PID 13d3:3529 for Realtek RTL8821CE (git-fixes).
• Bluetooth: btusb: do not call kfree_skb() under spin_lock_irqsave() (git-fixes).
• Do not sign the vanilla kernel (bsc#1209008).
• Input: atmel_mxt_ts - fix double free in mxt_read_info_block (git-fixes).
• KVM: arm64: Hide system instruction access to Trace registers (git-fixes)
• NFSv4: Fix hangs when recovering open state after a server reboot (git-fixes). [iivanov] Fix Patch-mainline to v6.3-rc5
• PCI/MSI: Enforce MSI entry updates to be visible (git-fixes).
• PCI/MSI: Enforce that MSI-X table entry is masked for update (git-fixes).
• PCI/MSI: Mask all unused MSI-X entries (git-fixes).
• PCI/MSI: Skip masking MSI-X on Xen PV (git-fixes).
• PCI/PM: Always return devices to D0 when thawing (git-fixes).
• PCI/PM: Avoid using device_may_wakeup() for runtime PM (git-fixes).
• PCI: Add ACS quirk for Intel Root Complex Integrated Endpoints (git-fixes).
• PCI: Add ACS quirk for iProc PAXB (git-fixes).
• PCI: Avoid FLR for AMD Matisse HD Audio & USB 3.0 (git-fixes).
• PCI: Avoid FLR for AMD Starship USB 3.0 (git-fixes).
• PCI: Make ACS quirk implementations more uniform (git-fixes).
• PCI: PM: Avoid forcing PCI_D0 for wakeup reasons inconsistently (git-fixes).
• PCI: PM: Avoid skipping bus-level PM on platforms without ACPI (git-fixes).
• PCI: Unify ACS quirk desired vs provided checking (git-fixes).
• PCI: Use pci_update_current_state() in pci_enable_device_flags() (git-fixes).
• PCI: aardvark: Do not blindly enable ASPM L0s and do not write to read-only register (git-fixes).
• PCI: aardvark: Do not rely on jiffies while holding spinlock (git-fixes).
• PCI: aardvark: Do not touch PCIe registers if no card connected (git-fixes).
• PCI: aardvark: Fix a leaked reference by adding missing of_node_put() (git-fixes).
• PCI: aardvark: Fix checking for PIO Non-posted Request (git-fixes).
• PCI: aardvark: Fix kernel panic during PIO transfer (git-fixes).
• PCI: aardvark: Improve link training (git-fixes).
• PCI: aardvark: Indicate error in 'val' when config read fails (git-fixes).
• PCI: aardvark: Introduce an…

The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2017-5753: Fixed spectre V1 vulnerability on netlink (bsc#1209547).
• CVE-2017-5753: Fixed spectre vulnerability in prlimit (bsc#1209256).
• CVE-2021-3923: Fixed stack information leak vulnerability that could lead to kernel protection bypass in infiniband RDMA (bsc#1209778).
• CVE-2021-4203: Fixed use-after-free read flaw that was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race with listen() (bsc#1194535).
• CVE-2022-20567: Fixed use after free that could lead to a local privilege escalation in pppol2tp_create of l2tp_ppp.c (bsc#1208850).
• CVE-2023-0394: Fixed a null pointer dereference flaw in the network subcomponent in the Linux kernel which could lead to system crash (bsc#1207168).
• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2023-1076: Fixed incorrect UID assigned to tun/tap sockets (bsc#1208599).
• CVE-2023-1095: Fixed a NULL pointer dereference in nf_tables due to zeroed list head (bsc#1208777).
• CVE-2023-1281: Fixed use after free that could lead to privilege escalation in tcindex (bsc#1209634).
• CVE-2023-1390: Fixed remote DoS vulnerability in tipc_link_xmit() (bsc#1209289).
• CVE-2023-1513: Fixed an uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak (bsc#1209532).
• CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207036).
• CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (bsc#1207125).
• CVE-2023-28328: Fixed a denial of service issue in az6027 driver in drivers/media/usb/dev-usb/az6027.c (bsc#1209291).
• CVE-2023-28464: Fixed user-after-free that could lead to privilege escalation in hci_conn_cleanup in net/bluetooth/hci_conn.c (bsc#1209052).
• CVE-2023-28772: Fixed buffer overflow in seq_buf_putmem_hex in lib/seq_buf.c (bsc#1209549).

The following non-security bugs were fixed:

• Do not sign the vanilla kernel (bsc#1209008).
• PCI: hv: Add a per-bus mutex state_lock (bsc#1208811).
• PCI: hv: Fix a race condition in hv_irq_unmask() that can cause panic (bsc#1208811).
• PCI: hv: Remove the useless hv_pcichild_state from struct hv_pci_dev (bsc#1208811).
• PCI: hv: fix a race condition bug in hv_pci_query_relations() (bsc#1208811).
• Revert 'PCI: hv: Fix a timing issue which causes kdump to fail occasionally' (bsc#1208811).
• cifs: fix double free in dfs mounts (bsc#1209845).
• cifs: fix nodfs mount option (bsc#1209845).
• cifs: handle reconnect of tcon when there is no cached dfs referral (bsc#1209845).
• cifs: missing null pointer check in cifs_mount (bsc#1209845).
• cifs: serialize all mount attempts (bsc#1209845).
• cred: allow get_cred() and put_cred() to be given NULL (bsc#1209887).
• ibmvnic: Process crqs after enabling interrupts (bsc#1192273 ltc#194629).
• ibmvnic: do not stop queue in xmit (bsc#1192273 ltc#194629).
• ipv6: raw: Deduct extension header length in rawv6_push_pending_frames (bsc#1207168).
• kernel-module-subpackage: Fix expansion with -b parameter (bsc#1208179).

The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-2483: Fixed a use after free bug in emac_remove due caused by a race condition (bsc#1211037).
• CVE-2023-2124: Fixed an out of bound access in the XFS subsystem that could have lead to denial-of-service or potentially privilege escalation (bsc#1210498).
• CVE-2023-1670: Fixed a use after free in the Xircom 16-bit PCMCIA Ethernet driver. A local user could use this flaw to crash the system or potentially escalate their privileges on the system (bsc#1209871).
• CVE-2017-5753: Fixed spectre V1 vulnerability on netlink (bsc#1209547).
• CVE-2017-5753: Fixed spectre vulnerability in prlimit (bsc#1209256).
• CVE-2020-36691: Fixed a denial of service (unbounded recursion) vulnerability via a nested Netlink policy with a back reference (bsc#1209613 bsc#1209777).
• CVE-2023-0394: Fixed a null pointer dereference flaw in the network subcomponent in the Linux kernel which could lead to system crash (bsc#1207168).
• CVE-2021-3923: Fixed stack information leak vulnerability that could lead to kernel protection bypass in infiniband RDMA (bsc#1209778).
• CVE-2021-4203: Fixed use-after-free read flaw that was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race with listen() (bsc#1194535).
• CVE-2022-20567: Fixed use after free that could lead to a local privilege escalation in pppol2tp_create of l2tp_ppp.c (bsc#1208850).
• CVE-2022-43945: Fixed a buffer overflow in the NFSD implementation (bsc#1205128).
• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2023-0597: Fixed lack of randomization of per-cpu entry area in x86/mm (bsc#1207845).
• CVE-2023-1076: Fixed incorrect UID assigned to tun/tap sockets (bsc#1208599).
• CVE-2023-1095: Fixed a NULL pointer dereference in nf_tables due to zeroed list head (bsc#1208777).
• CVE-2023-1118: Fixed a use-after-free bugs caused by ene_tx_irqsim() in media/rc (bsc#1208837).
• CVE-2023-1390: Fixed remote DoS vulnerability in tipc_link_xmit() (bsc#1209289).
• CVE-2023-1513: Fixed an uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak (bsc#1209532).
• CVE-2023-1611: Fixed an use-after-free flaw in btrfs_search_slot (bsc#1209687).
• CVE-2023-1855: Fixed an use-after-free flaw in xgene_hwmon_remove (bsc#1210202).
• CVE-2023-1989: Fixed an use-after-free flaw in btsdio_remove (bsc#1210336).
• CVE-2023-1990: Fixed an use-after-free flaw in ndlc_remove (bsc#1210337).
• CVE-2023-1998: Fixed an use-after-free flaw during login when accessing the shost ipaddress (bsc#1210506).
• CVE-2023-2162: Fixed an use-after-free flaw in iscsi_sw_tcp_session_create (bsc#1210647).
• CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207036).
• CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (bsc#1207125).
• CVE-2023-28328: Fixed a denial of service issue in az6027 driver in drivers/media/usb/dev-usb/az6027.c (bsc#1209291).
• CVE-2023-28464: Fixed user-after-free that could lead to privilege escalation in hci_conn_cleanup in net/uetooth/hci_conn.c (bsc#1209052).
• CVE-2023-28772: Fixed buffer overflow in seq_buf_putmem_hex in lib/seq_buf.c (bsc#1209549).
• CVE-2023-30772: Fixed race condition and resultant use-after-free in da9150_charger_remove (bsc#1210329).

The following non-security bugs were fixed:

• Do not sign the vanilla kernel (bsc#1209008).
• Fix kABI breakage (bsc#1208333)
• PCI: hv: Add a per-bus mutex state_lock (bsc#1207185).
• PCI: hv: Fix a race condition bug in hv_pci_query_relations() (bsc#1207185).
• PCI: hv: Fix a race condition in hv_irq_unmask() that can cause panic (bsc#1207185).
• PCI: hv: Remove the useless hv_pcichild_state from struct…

This update for the Linux Kernel 5.14.21-150400_15_28 fixes one issue.

The following security issue was fixed:

• CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207188).

This update for the Linux Kernel 5.14.21-150400_15_23 fixes several issues.

The following security issues were fixed:

• CVE-2023-0386: Fixed privileges escalation for low-privileged users in the OverlayFS subsystem (bsc#1210499).
• CVE-2023-2162: Fixed an use-after-free flaw in iscsi_sw_tcp_session_create (bsc#1210662).
• CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207188).

This update for the Linux Kernel 5.14.21-150400_15_18 fixes several issues.

The following security issues were fixed:

• CVE-2023-28464: Fixed user-after-free that could lead to privilege escalation in hci_conn_cleanup in net/uetooth/hci_conn.c (bsc#1211111).
• CVE-2023-1989: Fixed a use after free in btsdio_remove (bsc#1210500).
• CVE-2023-0386: Fixed privileges escalation for low-privileged users in the OverlayFS subsystem (bsc#1210499).
• CVE-2023-1281: Fixed use after free that could lead to privilege escalation in tcindex (bsc#1209683).
• CVE-2023-2162: Fixed an use-after-free flaw in iscsi_sw_tcp_session_create (bsc#1210662).
• CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207188).

This update for the Linux Kernel 5.14.21-150400_15_5 fixes several issues.

The following security issues were fixed:

• CVE-2023-28464: Fixed user-after-free that could lead to privilege escalation in hci_conn_cleanup in net/uetooth/hci_conn.c (bsc#1211111).
• CVE-2023-1989: Fixed a use after free in btsdio_remove (bsc#1210500).
• CVE-2023-0386: Fixed privileges escalation for low-privileged users in the OverlayFS subsystem (bsc#1210499).
• CVE-2023-1281: Fixed use after free that could lead to privilege escalation in tcindex (bsc#1209683).
• CVE-2023-2162: Fixed an use-after-free flaw in iscsi_sw_tcp_session_create (bsc#1210662).
• CVE-2023-0461: Fixed use-after-free in icsk_ulp_data (bsc#1208911).
• CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207188).

This update for the Linux Kernel 4.12.14-150100_197_114 fixes several issues.

The following security issues were fixed:

• CVE-2023-28464: Fixed user-after-free that could lead to privilege escalation in hci_conn_cleanup in net/uetooth/hci_conn.c (bsc#1211111).
• CVE-2023-1989: Fixed a use after free in btsdio_remove (bsc#1210500).
• CVE-2023-1281: Fixed use after free that could lead to privilege escalation in tcindex (bsc#1209683).
• CVE-2023-2162: Fixed an use-after-free flaw in iscsi_sw_tcp_session_create (bsc#1210662).
• CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207188).

This update for the Linux Kernel 5.14.21-150400_15_11 fixes several issues.

The following security issues were fixed:

• CVE-2023-28464: Fixed user-after-free that could lead to privilege escalation in hci_conn_cleanup in net/uetooth/hci_conn.c (bsc#1211111).
• CVE-2023-1989: Fixed a use after free in btsdio_remove (bsc#1210500).
• CVE-2023-0386: Fixed privileges escalation for low-privileged users in the OverlayFS subsystem (bsc#1210499).
• CVE-2023-1281: Fixed use after free that could lead to privilege escalation in tcindex (bsc#1209683).
• CVE-2023-2162: Fixed an use-after-free flaw in iscsi_sw_tcp_session_create (bsc#1210662).
• CVE-2023-0461: Fixed use-after-free in icsk_ulp_data (bsc#1208911).
• CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207188).

This update for the Linux Kernel 4.12.14-150100_197_145 fixes one issue.

The following security issue was fixed:

• CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207188).