CVE-2023-23455

atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results).

atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results).

The Linux Kernel, the operating system core itself.

Security Fix(es):

A buffer overflow vulnerability was found in the Netfilter subsystem in the Linux Kernel. This issue could allow the leakage of both stack and heap addresses, and potentially allow Local Privilege Escalation to the root user via arbitrary code execution.(CVE-2023-0179)

atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results).(CVE-2023-23455)

cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service (slab-out-of-bounds read) because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results).(CVE-2023-23454)

The Linux Kernel, the operating system core itself.

Security Fix(es):

A buffer overflow vulnerability was found in the Netfilter subsystem in the Linux Kernel. This issue could allow the leakage of both stack and heap addresses, and potentially allow Local Privilege Escalation to the root user via arbitrary code execution.(CVE-2023-0179)

atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results).(CVE-2023-23455)

cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service (slab-out-of-bounds read) because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results).(CVE-2023-23454)

The Linux Kernel, the operating system core itself.

Security Fix(es):

atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results).(CVE-2023-23455)

cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service (slab-out-of-bounds read) because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results).(CVE-2023-23454)

A NULL pointer dereference flaw was found in rawv6_push_pending_frames in net/ipv6/raw.c in the network subcomponent in the Linux kernel. This flaw causes the system to crash.(CVE-2023-0394)

The Linux Kernel, the operating system core itself.

Security Fix(es):

atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results).(CVE-2023-23455)

cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service (slab-out-of-bounds read) because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results).(CVE-2023-23454)

A NULL pointer dereference flaw was found in rawv6_push_pending_frames in net/ipv6/raw.c in the network subcomponent in the Linux kernel. This flaw causes the system to crash.(CVE-2023-0394)

atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results).

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: tun: avoid double free in tun_free_netdev (CVE-2022-4744)
• kernel: net/sched: multiple vulnerabilities (CVE-2023-3609, CVE-2023-3611, CVE-2023-4128, CVE-2023-4206, CVE-2023-4207, CVE-2023-4208)
• kernel: out-of-bounds write in qfq_change_class function (CVE-2023-31436)
• kernel: out-of-bounds write in hw_atl_utils_fw_rpc_wait (CVE-2021-43975)
• kernel: Rate limit overflow messages in r8152 in intr_callback (CVE-2022-3594)
• kernel: use after free flaw in l2cap_conn_del (CVE-2022-3640)
• kernel: double free in usb_8dev_start_xmit (CVE-2022-28388)
• kernel: vmwgfx: multiple vulnerabilities (CVE-2022-38457, CVE-2022-40133, CVE-2023-33951, CVE-2023-33952)
• hw: Intel: Gather Data Sampling (GDS) side channel vulnerability (CVE-2022-40982)
• kernel: Information leak in l2cap_parse_conf_req (CVE-2022-42895)
• kernel: KVM: multiple vulnerabilities (CVE-2022-45869, CVE-2023-4155, CVE-2023-30456)
• kernel: memory leak in ttusb_dec_exit_dvb (CVE-2022-45887)
• kernel: speculative pointer dereference in do_prlimit (CVE-2023-0458)
• kernel: use-after-free due to race condition in qdisc_graft (CVE-2023-0590)
• kernel: x86/mm: Randomize per-cpu entry area (CVE-2023-0597)
• kernel: HID: check empty report_list in hid_validate_values (CVE-2023-1073)
• kernel: sctp: fail if no bound addresses can be used for a given scope (CVE-2023-1074)
• kernel: hid: Use After Free in asus_remove (CVE-2023-1079)
• kernel: use-after-free in drivers/media/rc/ene_ir.c (CVE-2023-1118)
• kernel: hash collisions in the IPv6 connection lookup table (CVE-2023-1206)
• kernel: ovl: fix use after free in struct ovl_aio_req (CVE-2023-1252)
• kernel: denial of service in tipc_conn_close (CVE-2023-1382)
• kernel: Use after free bug in btsdio_remove due to race condition (CVE-2023-1989)
• kernel: Spectre v2 SMT mitigations problem (CVE-2023-1998)
• kernel: ext4: use-after-free in ext4_xattr_set_entry (CVE-2023-2513)
• kernel: fbcon: shift-out-of-bounds in fbcon_set_font (CVE-2023-3161)
• kernel: out-of-bounds access in relay_file_read (CVE-2023-3268)
• kernel: xfrm: NULL pointer dereference in xfrm_update_ae_params (CVE-2023-3772)
• kernel: smsusb: use-after-free caused by do_submit_urb (CVE-2023-4132)
• kernel: Race between task migrating pages and another task calling exit_mmap (CVE-2023-4732)
• Kernel: denial of service in atm_tc_enqueue due to type confusion (CVE-2023-23455)
• kernel: mpls: double free on sysctl allocation failure (CVE-2023-26545)
• kernel: Denial of service issue in az6027 driver (CVE-2023-28328)
• kernel: lib/seq_buf.c has a seq_buf_putmem_hex buffer overflow (CVE-2023-28772)
• kernel: blocking operation in dvb_frontend_get_event and wait_event_interruptible (CVE-2023-31084)
• kernel: net: qcom/emac: race condition leading to use-after-free in emac_remove (CVE-2023-33203)
• kernel: saa7134: race condition leading to use-after-free in saa7134_finidev (CVE-2023-35823)
• kernel: dm1105: race condition leading to use-after-free in dm1105_remove.c (CVE-2023-35824)
• kernel: r592: race condition leading to use-after-free in r592_remove (CVE-2023-35825)
• kernel: net/tls: tls_is_tx_ready() checked list_entry (CVE-2023-1075)
• kernel: use-after-free bug in remove function xgene_hwmon_remove (CVE-2023-1855)
• kernel: Use after free bug in r592_remove (CVE-2023-3141)
• kernel: gfs2: NULL pointer dereference in gfs2_evict_inode (CVE-2023-3212)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

• CVE-2022-1198
  • drivers: hamradio: 6pack: fix UAF bug caused by mod_timer()
• Bionic update: upstream stable patchset 2022-03-04 (LP: #1963717) // CVE-2020-36516
  • ipv4: avoid using shared IP generator for connected sockets
• CVE-2022-36879
  • xfrm: xfrm_policy: fix a possible double xfrm_pols_put() in xfrm_bundle_lookup()
• CVE-2022-3061
  • video: fbdev: i740fb: Error out if 'pixclock' equals zero
• CVE-2022-1516
  • net/x25: Fix null-ptr-deref caused by x25_disconnect
• CVE-2022-1205
  • ax25: Fix NULL pointer dereferences in ax25 timers
  • ax25: Fix UAF bugs in ax25 timers
• CVE-2022-2318
  • net: rose: fix UAF bugs caused by timer handler
• CVE-2022-1195
  • hamradio: defer 6pack kfree after unregister_netdev
  • hamradio: defer ax25 kfree after unregister_netdev
  • hamradio: improve the incomplete fix to avoid NPD
• CVE-2022-0494
  • block-map: add __GFP_ZERO flag for alloc_page in function bio_copy_kern
• CVE-2021-26401
  • x86/speculation: Use generic retpoline by default on AMD
• Bionic update: upstream stable patchset 2022-10-18 (LP: #1993349) // CVE-2022-39188
  • mm: Fix TLB flush for not-first PFNMAP mappings in unmap_region()
• Bionic update: upstream stable patchset 2022-10-06 (LP: #1992112) // CVE-2022-39188
  • mm: Force TLB flush for PFNMAP mappings before unlink_file_vma()
• CVE-2022-45934
  • Bluetooth: L2CAP: Fix u8 overflow
• Bionic update: upstream stable patchset 2022-06-21 (LP: #1979355) // CVE-2022-2991
  • lightnvm: disable the subsystem
• Bionic update: upstream stable patchset 2021-11-02 (LP: #1949512) // CVE-2021-4203
  • af_unix: fix races in sk_peer_pid and sk_peer_cred accesses
• Bionic update: upstream stable patchset 2022-04-26 (LP: #1970479) // CVE-2021-3772
  • sctp: fix the processing for INIT chunk
  • sctp: fix the processing for INIT_ACK chunk
• Bionic update: upstream stable patchset 2021-12-03 (LP: #1953202) // CVE-2021-3772
  • sctp: use init_tag from inithdr for ABORT chunk
  • sctp: fix the processing for COOKIE_ECHO chunk
  • sctp: add vtag check in sctp_sf_violation
  • sctp: add vtag check in sctp_sf_do_8_5_1_E_sa
  • sctp: add vtag check in sctp_sf_ootb
• CVE-2022-3303
  • ALSA: pcm: oss: Fix race at SNDCTL_DSP_SYNC
• Bionic update: upstream stable patchset 2022-09-21 (LP: #1990434) // CVE-2022-1462
  • tty: extract tty_flip_buffer_commit() from tty_flip_buffer_push()
  • tty: use new tty_insert_flip_string_and_push_buffer() in pty_write()
• CVE-2022-1462
  • tty: fix deadlock caused by calling printk() under tty_port->lock
• Bionic update: upstream stable patchset 2020-11-10 (LP: #1903768) // CVE-2022-1462
  • pty: do tty_flip_buffer_push without port->lock in pty_write
• Bionic update: upstream stable patchset 2019-02-08 (LP: #1815234) // CVE-2022-1462
  • tty: Fix data race in tty_insert_flip_string_fixed_flag
• Bionic update: upstream stable patchset 2022-10-18 (LP: #1993349) // CVE-2022-4662
  • USB: core: Prevent nested device-reset calls
• Bionic update: upstream stable patchset 2022-03-04 (LP: #1963717) // CVE-2022-0617
  • udf: Restore i_lenAlloc when inode expansion fails
  • udf: Fix NULL ptr deref when converting from inline format
• Bionic update: upstream stable patchset 2022-04-26 (LP: #1970479) // CVE-2022-1016
  • netfilter: nf_tables: initialize registers in nft_do_chain()
• Bionic update: upstream stable patchset 2022-05-17 (LP: #1973831) // CVE-2022-2380
  • video: fbdev: sm712fb: Fix crash in smtcfb_read()
• Bionic update: upstream stable patchset 2022-05-17 (LP: #1973831) // CVE-2022-3111
  • power: supply: wm8350-power: Add missing free in free_charger_irq
• CVE-2022-3628
  • wifi: brcmfmac: Fix potential buffer overflow in brcmf_fweh_event_worker()
• Bionic update:…

• CVE-2022-1198
  • drivers: hamradio: 6pack: fix UAF bug caused by mod_timer()
• Bionic update: upstream stable patchset 2022-03-04 (LP: #1963717) // CVE-2020-36516
  • ipv4: avoid using shared IP generator for connected sockets
• CVE-2022-36879
  • xfrm: xfrm_policy: fix a possible double xfrm_pols_put() in xfrm_bundle_lookup()
• CVE-2022-3061
  • video: fbdev: i740fb: Error out if 'pixclock' equals zero
• CVE-2022-1516
  • net/x25: Fix null-ptr-deref caused by x25_disconnect
• CVE-2022-1205
  • ax25: Fix NULL pointer dereferences in ax25 timers
  • ax25: Fix UAF bugs in ax25 timers
• CVE-2022-2318
  • net: rose: fix UAF bugs caused by timer handler
• CVE-2022-1195
  • hamradio: defer 6pack kfree after unregister_netdev
  • hamradio: defer ax25 kfree after unregister_netdev
  • hamradio: improve the incomplete fix to avoid NPD
• CVE-2022-0494
  • block-map: add __GFP_ZERO flag for alloc_page in function bio_copy_kern
• CVE-2021-26401
  • x86/speculation: Use generic retpoline by default on AMD
• Bionic update: upstream stable patchset 2022-10-18 (LP: #1993349) // CVE-2022-39188
  • mm: Fix TLB flush for not-first PFNMAP mappings in unmap_region()
• Bionic update: upstream stable patchset 2022-10-06 (LP: #1992112) // CVE-2022-39188
  • mm: Force TLB flush for PFNMAP mappings before unlink_file_vma()
• CVE-2022-45934
  • Bluetooth: L2CAP: Fix u8 overflow
• Bionic update: upstream stable patchset 2022-06-21 (LP: #1979355) // CVE-2022-2991
  • lightnvm: disable the subsystem
• Bionic update: upstream stable patchset 2021-11-02 (LP: #1949512) // CVE-2021-4203
  • af_unix: fix races in sk_peer_pid and sk_peer_cred accesses
• Bionic update: upstream stable patchset 2022-04-26 (LP: #1970479) // CVE-2021-3772
  • sctp: fix the processing for INIT chunk
  • sctp: fix the processing for INIT_ACK chunk
• Bionic update: upstream stable patchset 2021-12-03 (LP: #1953202) // CVE-2021-3772
  • sctp: use init_tag from inithdr for ABORT chunk
  • sctp: fix the processing for COOKIE_ECHO chunk
  • sctp: add vtag check in sctp_sf_violation
  • sctp: add vtag check in sctp_sf_do_8_5_1_E_sa
  • sctp: add vtag check in sctp_sf_ootb
• CVE-2022-3303
  • ALSA: pcm: oss: Fix race at SNDCTL_DSP_SYNC
• Bionic update: upstream stable patchset 2022-09-21 (LP: #1990434) // CVE-2022-1462
  • tty: extract tty_flip_buffer_commit() from tty_flip_buffer_push()
  • tty: use new tty_insert_flip_string_and_push_buffer() in pty_write()
• CVE-2022-1462
  • tty: fix deadlock caused by calling printk() under tty_port->lock
• Bionic update: upstream stable patchset 2020-11-10 (LP: #1903768) // CVE-2022-1462
  • pty: do tty_flip_buffer_push without port->lock in pty_write
• Bionic update: upstream stable patchset 2019-02-08 (LP: #1815234) // CVE-2022-1462
  • tty: Fix data race in tty_insert_flip_string_fixed_flag
• Bionic update: upstream stable patchset 2022-10-18 (LP: #1993349) // CVE-2022-4662
  • USB: core: Prevent nested device-reset calls
• Bionic update: upstream stable patchset 2022-03-04 (LP: #1963717) // CVE-2022-0617
  • udf: Restore i_lenAlloc when inode expansion fails
  • udf: Fix NULL ptr deref when converting from inline format
• Bionic update: upstream stable patchset 2022-04-26 (LP: #1970479) // CVE-2022-1016
  • netfilter: nf_tables: initialize registers in nft_do_chain()
• Bionic update: upstream stable patchset 2022-05-17 (LP: #1973831) // CVE-2022-2380
  • video: fbdev: sm712fb: Fix crash in smtcfb_read()
• Bionic update: upstream stable patchset 2022-05-17 (LP: #1973831) // CVE-2022-3111
  • power: supply: wm8350-power: Add missing free in free_charger_irq
• CVE-2022-3628
  • wifi: brcmfmac: Fix potential buffer overflow in brcmf_fweh_event_worker()
• Bionic update:…

This kernel update is based on upstream 5.15.88 and fixes atleast the following security issues:

A use-after-free flaw was found in the Linux kernel’s SGI GRU driver in the way the first gru_file_unlocked_ioctl function is called by the user, where a fail pass occurs in the gru_check_chiplet_assignment function. This flaw allows a local user to crash or potentially escalate their privileges on the system (CVE-2022-3424).

A vulnerability in the function btf_dump_name_dups of the file tools/lib/bpf/ btf_dump.c of the component libbpf. This flaw allows a manipulation that may lea to a use-after-free issue (CVE-2022-3534).

A vulnerability was found in area_cache_get in drivers/net/ethernet/ netronome/nfp/nfpcore/nfp_cppcore.c in the Netronome Flow Processor (NFP) driver in the Linux kernel. This flaw allows a manipulation that may lead to a use-after-free issue (CVE-2022-3545).

An out-of-bounds memory write vulnerability was found in the Linux kernel vmwgfx driver in vmw_kms_cursor_snoop due to a missing check of a memcpy length. This flaw allows a local, unprivileged attacker with access to either the /dev/dri/card0 or /dev/dri/rendererD128 and able to issue an ioctl() on the resulting file descriptor, to crash the system, causing a denial of service (CVE-2022-36280).

A use-after-free flaw was found in the Linux kernel’s dvb-core subsystem (DVB API used by Digital TV devices) in how a user physically removed a USB device (such as a DVB demultiplexer device) while running malicious code. This flaw allows a local user to crash or potentially escalate their privileges on the system (CVE-2022-41218).

An issue was discovered in the Linux kernel through 6.0.10. l2cap_config_req in net/bluetooth/l2cap_core.c has an integer wraparound via L2CAP_CONF_REQ packets (CVE-2022-45934).

In the Linux kernel before 6.1.6, a NULL pointer dereference bug in the traffic control subsystem allows an unprivileged user to trigger a denial of service (system crash) via a crafted traffic control configuration that is set up with "tc qdisc" and "tc class" commands. This affects qdisc_graft in net/sched/sch_api.c (CVE-2022-47929).

A buffer overflow vulnerability was found in the Netfilter subsystem in the Linux Kernel. This issue could allow the leakage of both stack and heap addresses, and potentially allow Local Privilege Escalation to the root user via arbitrary code execution (CVE-2023-0179).

A vulnerability in the kernel ksmbd allows a remote attacker to perform a denial of service (DoS) attack. The vulnerability exists due to a boundary error within the ksmbd_decode_ntlmssp_auth_blob() function in ksmbd when handling NTLMv2 authentication. A remote attacker can send specially crafted data to ksmbd, trigger a heap-based buffer overflow and perform a denial of service (DoS) attack (CVE-2023-0210).

ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF (CVE-2023-0266).

cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service (slab-out-of-bounds read) because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (CVE-2023-23454).

atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (CVE-2023-23455).

Other fixes in this update:

• fixes broken sound on Intel Tiger Lake systems (regression in kernel 5.15.82 released in MGASA-2022-0477 (mga #31319).
• xtables-addons have been updated to 3.23.

For other upstream fixes in this update, see the referenced changelogs.

This kernel-linus update is based on upstream 5.15.88 and fixes atleast the following security issues:

A use-after-free flaw was found in the Linux kernel’s SGI GRU driver in the way the first gru_file_unlocked_ioctl function is called by the user, where a fail pass occurs in the gru_check_chiplet_assignment function. This flaw allows a local user to crash or potentially escalate their privileges on the system (CVE-2022-3424).

A vulnerability in the function btf_dump_name_dups of the file tools/lib/bpf/ btf_dump.c of the component libbpf. This flaw allows a manipulation that may lea to a use-after-free issue (CVE-2022-3534).

A vulnerability was found in area_cache_get in drivers/net/ethernet/ netronome/nfp/nfpcore/nfp_cppcore.c in the Netronome Flow Processor (NFP) driver in the Linux kernel. This flaw allows a manipulation that may lead to a use-after-free issue (CVE-2022-3545).

Guests can trigger NIC interface reset/abort/crash via netback. It is possible for a guest to trigger a NIC interface reset/abort/crash in a Linux based network backend by sending certain kinds of packets. It appears to be an (unwritten?) assumption in the rest of the Linux network stack that packet protocol headers are all contained within the linear section of the SKB and some NICs behave badly if this is not the case. This has been reported to occur with Cisco (enic) and Broadcom NetXtrem II BCM5780 (bnx2x) though it may be an issue with other NICs/drivers as well. In case the frontend is sending requests with split headers, netback will forward those violating above mentioned assumption to the networking core, resulting in said misbehavior (CVE-2022-3643, XSA-423).

An out-of-bounds memory write vulnerability was found in the Linux kernel vmwgfx driver in vmw_kms_cursor_snoop due to a missing check of a memcpy length. This flaw allows a local, unprivileged attacker with access to either the /dev/dri/card0 or /dev/dri/rendererD128 and able to issue an ioctl() on the resulting file descriptor, to crash the system, causing a denial of service (CVE-2022-36280).

A use-after-free flaw was found in the Linux kernel’s dvb-core subsystem (DVB API used by Digital TV devices) in how a user physically removed a USB device (such as a DVB demultiplexer device) while running malicious code. This flaw allows a local user to crash or potentially escalate their privileges on the system (CVE-2022-41218).

An issue was discovered in the Linux kernel through 6.0.10. l2cap_config_req in net/bluetooth/l2cap_core.c has an integer wraparound via L2CAP_CONF_REQ packets (CVE-2022-45934).

In the Linux kernel before 6.1.6, a NULL pointer dereference bug in the traffic control subsystem allows an unprivileged user to trigger a denial of service (system crash) via a crafted traffic control configuration that is set up with "tc qdisc" and "tc class" commands. This affects qdisc_graft in net/sched/sch_api.c (CVE-2022-47929).

A vulnerability in the kernel ksmbd allows a remote attacker to perform a denial of service (DoS) attack. The vulnerability exists due to a boundary error within the ksmbd_decode_ntlmssp_auth_blob() function in ksmbd when handling NTLMv2 authentication. A remote attacker can send specially crafted data to ksmbd, trigger a heap-based buffer overflow and perform a denial of service (DoS) attack (CVE-2023-0210).

ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF (CVE-2023-0266).

cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service (slab-out-of-bounds read) because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (CVE-2023-23454).

atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results)…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-0266: Fixed a use-after-free bug led by a missing lock in ALSA. (bsc#1207134)
• CVE-2022-47929: Fixed a NULL pointer dereference bug in the traffic control subsystem which allowed an unprivileged user to trigger a denial of service via a crafted traffic control configuration. (bsc#1207237)
• CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207036)
• CVE-2023-23455: Fixed a bug that could allow attackers to cause a denial of service because of type confusion in atm_tc_enqueue. (bsc#1207125)
• CVE-2022-3435: Fixed an out-of-bounds read in fib_nh_match() of the file net/ipv4/fib_semantics.c (bsc#1204171).
• CVE-2022-4662: Fixed a recursive locking violation in usb-storage that can cause the kernel to deadlock. (bsc#1206664)
• CVE-2022-3115: Fixed a null pointer dereference in malidp_crtc.c caused by a lack of checks of the return value of kzalloc. (bsc#1206393)
• CVE-2022-47520: Fixed an out-of-bounds read when parsing a Robust Security Network (RSN) information element from a Netlink packet. (bsc#1206515)
• CVE-2022-3112: Fixed a null pointer dereference caused by lacks check of the return value of kzalloc() in vdec_helpers.c:amvdec_set_canvases. (bsc#1206399)
• CVE-2022-3564: Fixed a bug which could lead to use after free, it was found in the function l2cap_reassemble_sdu of the file net/bluetooth/l2cap_core.c of the component Bluetooth. (bsc#1206073)
• CVE-2022-3108: Fixed a bug in kfd_parse_subtype_iolink in drivers/gpu/drm/amd/amdkfd/kfd_crat.c where a lack of check of the return value of kmemdup() could lead to a NULL pointer dereference. (bsc#1206389)
• CVE-2019-19083: Fixed a memory leaks in clock_source_create that could allow attackers to cause a denial of service (bsc#1157049).
• CVE-2022-42328: Fixed a bug which could allow guests to trigger denial of service via the netback driver (bsc#1206114).
• CVE-2022-42329: Fixed a bug which could allow guests to trigger denial of service via the netback driver (bsc#1206113).
• CVE-2022-3643: Fixed a bug which could allow guests to trigger NIC interface reset/abort/crash via netback driver (bsc#1206113).
• CVE-2022-3107: Fixed a null pointer dereference caused by a missing check of the return value of kvmalloc_array. (bsc#1206395)
• CVE-2022-3111: Fixed a missing release of resource after effective lifetime bug caused by a missing free of the WM8350_IRQ_CHG_FAST_RDY in wm8350_init_charger. (bsc#1206394)
• CVE-2022-3105: Fixed a null pointer dereference caused by a missing check of the return value of kmalloc_array. (bsc#1206398)
• CVE-2022-3106: Fixed a null pointer dereference caused by a missing check of the return value of kmalloc. (bsc#1206397)

The following non-security bugs were fixed:

• afs: Fix some tracing details (git-fixes).
• arm64: cpu_errata: Add Hisilicon TSV110 to spectre-v2 safe list (git-fixes)
• arm64: dts: allwinner: H5: Add PMU node (git-fixes)
• arm64: dts: allwinner: H6: Add PMU mode (git-fixes)
• arm64: dts: marvell: Add AP806-dual missing CPU clocks (git-fixes)
• arm64: dts: rockchip: add reg property to brcmf sub-nodes (git-fixes)
• arm64: dts: rockchip: fix dwmmc clock name for px30 (git-fixes)
• arm64: dts: rockchip: Fix NanoPC-T4 cooling maps (git-fixes)
• arm64: memory: Add missing brackets to untagged_addr() macro (git-fixes)
• arm64: psci: Reduce the waiting time for cpu_psci_cpu_kill() (git-fixes).
• arm64: tags: Preserve tags for addresses translated via TTBR1 (git-fixes)
• arm64: tegra: Fix 'active-low' warning for Jetson Xavier regulator (git-fixes)
• block: Do not reread partition table on exclusively open device (bsc#1190969).
• ceph: avoid putting the realm twice when decoding snaps fails (bsc#1207198).
• ceph: do not update snapshot context when there is no new snapshot (bsc#1207218).
• cuse: prevent clone (bsc#1206177).
• drbd: destroy workqueue when drbd device…

The SUSE Linux Enterprise 15 SP2 LTSS kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (bsc#1207125).
• CVE-2023-23454: Fixed denial or service in cbq_classify in net/sched/sch_cbq.c (bnc#1207036).
• CVE-2023-0266: Fixed a use-after-free vulnerability inside the ALSA PCM package. SNDRV_CTL_IOCTL_ELEM_{READ|WRITE}32 was missing locks that could have been used in a use-after-free that could have resulted in a priviledge escalation to gain ring0 access from the system user (bsc#1207134).
• CVE-2022-47929: Fixed NULL pointer dereference bug in the traffic control subsystem (bnc#1207237).
• CVE-2022-47520: Fixed a out-of-bounds read when parsing a Robust Security Network (RSN) information element from a Netlink packet in the WILC1000 wireless driver (bsc#1206515).
• CVE-2022-4662: Fixed incorrect access control in the USB core subsystem that could lead a local user to crash the system (bnc#1206664).
• CVE-2022-42328, CVE-2022-42329: Fixed deadlock inside the netback driver that could have been triggered from a VM guest (bnc#1206114).
• CVE-2022-3643: Fixed reset/abort/crash via netback from VM guest (bnc#1206113).
• CVE-2022-3564: Fixed use-after-free in l2cap_core.c of the Bluetooth component (bnc#1206073).
• CVE-2022-3435: Fixed a out-of-bounds read in function fib_nh_match of the file net/ipv4/fib_semantics.c. It is possible to initiate the attack remotely (bnc#1204171).
• CVE-2022-3115: Fixed a null pointer dereference inside malidp_crtc_reset in drivers/gpu/drm/arm/malidp_crtc.c that lacked a check of the return value of kzalloc() (bnc#1206393).
• CVE-2022-3112: Fixed a null pointer dereference in amvdec_set_canvases in drivers/staging/media/meson/vdec/vdec_helpers.c that lacked a check of the return value of kzalloc() (bnc#1206399).
• CVE-2022-3108: Fixed missing check of return value of kmemdup() (bnc#1206389).
• CVE-2022-3107: Fixed missing check of return value of kvmalloc_array() (bnc#1206395).
• CVE-2022-3105: Fixed missing check of kmalloc_array() in uapi_finalize in drivers/infiniband/core/uverbs_uapi.c (bnc#1206398).

The following non-security bugs were fixed:

• HID: betop: check shape of output reports (git-fixes, bsc#1207186).
• HID: check empty report_list in bigben_probe() (git-fixes, bsc#1206784).
• HID: check empty report_list in hid_validate_values() (git-fixes, bsc#1206784).
• NFS: Handle missing attributes in OPEN reply (bsc#1203740).
• constraints: increase disk space for all architectures (bsc#1203693).
• ipv6: ping: fix wrong checksum for large frames (bsc#1203183).
• mm: /proc/pid/smaps_rollup: fix no vma's null-deref (bsc#1207769).
• net: sched: atm: dont intepret cls results when asked to drop (bsc#1207036).
• net: sched: cbq: dont intepret cls results when asked to drop (bsc#1207036).
• netfilter: nfnetlink_osf: fix possible bogus match in nf_osf_find() (bsc#1204614).
• rpm: suse-kernel-rpm-scriptlets to kmp buildreqs (boo#1205149).
• sctp: fail if no bound addresses can be used for a given scope (bsc#1206677).
• sctp: sysctl: make extra pointers netns aware (bsc#1204760).

The SUSE Linux Enterprise 12 SP2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-9517: Fixed possible memory corruption due to a use after free in pppol2tp_connect (bsc#1108488).
• CVE-2022-3564: Fixed use-after-free in l2cap_core.c of the Bluetooth component (bsc#1206073).
• CVE-2022-3643: Fixed reset/abort/crash via netback from VM guest (bsc#1206113).
• CVE-2022-42895: Fixed an information leak in the net/bluetooth/l2cap_core.c's l2cap_parse_conf_req() which can be used to leak kernel pointers remotely (bsc#1205705).
• CVE-2022-42896: Fixed a use-after-free vulnerability in the net/bluetooth/l2cap_core.c's l2cap_connect() and l2cap_le_connect_req() which may have allowed code execution and leaking kernel memory (respectively) remotely via Bluetooth (bsc#1205709).
• CVE-2022-4662: Fixed incorrect access control in the USB core subsystem that could lead a local user to crash the system (bsc#1206664).
• CVE-2022-47929: Fixed NULL pointer dereference bug in the traffic control subsystem (bsc#1207237).
• CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207036).
• CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (bsc#1207125).

The following non-security bugs were fixed:

• HID: betop: check shape of output reports (git-fixes, bsc#1207186).
• HID: betop: fix slab-out-of-bounds Write in betop_probe (git-fixes).
• HID: check empty report_list in hid_validate_values() (git-fixes, bsc#1206784).
• sctp: fail if no bound addresses can be used for a given scope (bsc#1206677).

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (bsc#1207125).
• CVE-2023-23454: Fixed denial or service in cbq_classify in net/sched/sch_cbq.c (bnc#1207036).
• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2023-0266: Fixed a use-after-free vulnerability inside the ALSA PCM package. SNDRV_CTL_IOCTL_ELEM_{READ|WRITE}32 was missing locks that could have been used in a use-after-free that could have resulted in a priviledge escalation to gain ring0 access from the system user (bsc#1207134).
• CVE-2023-0179: Fixed incorrect arithmetics when fetching VLAN header bits (bsc#1207034).
• CVE-2023-0122: Fixed a NULL pointer dereference vulnerability in nvmet_setup_auth(), that allowed an attacker to perform a Pre-Auth Denial of Service (DoS) attack on a remote machine (bnc#1207050).
• CVE-2022-4382: Fixed a use-after-free flaw that was caused by a race condition among the superblock operations inside the gadgetfs code (bsc#1206258).
• CVE-2020-24588: Fixed injection of arbitrary network packets against devices that support receiving non-SSP A-MSDU frames (which is mandatory as part of 802.11n) (bsc#1199701).

The following non-security bugs were fixed:

• ACPI: EC: Fix EC address space handler unregistration (bsc#1207149).
• ACPI: EC: Fix ECDT probe ordering issues (bsc#1207149).
• ACPI: PRM: Check whether EFI runtime is available (git-fixes).
• ACPICA: Allow address_space_handler Install and _REG execution as 2 separate steps (bsc#1207149).
• ACPICA: include/acpi/acpixf.h: Fix indentation (bsc#1207149).
• ALSA: control-led: use strscpy in set_led_id() (git-fixes).
• ALSA: hda - Enable headset mic on another Dell laptop with ALC3254 (git-fixes).
• ALSA: hda/hdmi: Add a HP device 0x8715 to force connect list (git-fixes).
• ALSA: hda/realtek - Turn on power early (git-fixes).
• ALSA: hda/realtek: Add Acer Predator PH315-54 (git-fixes).
• ALSA: hda/realtek: Enable mute/micmute LEDs on HP Spectre x360 13-aw0xxx (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs do not work for a HP platform (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for a HP ProBook (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs, speaker do not work for a HP platform (git-fixes).
• ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path() (git-fixes).
• ALSA: hda: cs35l41: Check runtime suspend capability at runtime_idle (git-fixes).
• ALSA: hda: cs35l41: Do not return -EINVAL from system suspend/resume (git-fixes).
• ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF (git-fixes).
• ALSA: usb-audio: Make sure to stop endpoints before closing EPs (git-fixes).
• ALSA: usb-audio: Relax hw constraints for implicit fb sync (git-fixes).
• ARM: dts: at91: sam9x60: fix the ddr clock for sam9x60 (git-fixes).
• ARM: dts: imx6qdl-gw560x: Remove incorrect 'uart-has-rtscts' (git-fixes).
• ARM: dts: imx6ul-pico-dwarf: Use 'clock-frequency' (git-fixes).
• ARM: dts: imx7d-pico: Use 'clock-frequency' (git-fixes).
• ARM: dts: imx: Fix pca9547 i2c-mux node name (git-fixes).
• ARM: dts: vf610: Fix pca9548 i2c-mux node names (git-fixes).
• ARM: imx: add missing of_node_put() (git-fixes).
• ASoC: Intel: bytcr_rt5651: Drop reference count of ACPI device after use (git-fixes).
• ASoC: Intel: bytcr_wm5102: Drop reference count of ACPI device after use (git-fixes).
• ASoC: fsl-asoc-card: Fix naming of AC'97 CODEC widgets (git-fixes).
• ASoC: fsl_micfil: Correct the number of steps on SX controls (git-fixes).
• ASoC: fsl_ssi: Rename AC'97 streams to avoid collisions with AC'97 CODEC (git-fixes).
• ASoC: qcom: lpass-cpu: Fix fallback SD line index handling (git-fixes).
• ASoC: wm8904: fix wrong outputs…

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-36280: Fixed an out-of-bounds memory access vulnerability that was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_kms.c (bnc#1203332).
• CVE-2023-0045: Fixed flush IBP in ib_prctl_set() (bsc#1207773).
• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2023-0122: Fixed a NULL pointer dereference vulnerability in nvmet_setup_auth(), that allowed an attacker to perform a Pre-Auth Denial of Service (DoS) attack on a remote machine (bnc#1207050).
• CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (bsc#1207125).
• CVE-2023-23454: Fixed denial or service in cbq_classify in net/sched/sch_cbq.c (bnc#1207036).
• CVE-2020-24588: Fixed injection of arbitrary network packets against devices that support receiving non-SSP A-MSDU frames (which is mandatory as part of 802.11n) (bsc#1199701).
• CVE-2023-0179: Fixed incorrect arithmetics when fetching VLAN header bits (bsc#1207034).
• CVE-2022-4382: Fixed a use-after-free flaw that was caused by a race condition among the superblock operations inside the gadgetfs code (bsc#1206258).
• CVE-2023-0266: Fixed a use-after-free vulnerability inside the ALSA PCM package. SNDRV_CTL_IOCTL_ELEM_{READ|WRITE}32 was missing locks that could have been used in a use-after-free that could have resulted in a priviledge escalation to gain ring0 access from the system user (bsc#1207134).
• CVE-2022-47929: Fixed NULL pointer dereference bug in the traffic control subsystem (bnc#1207237).

The following non-security bugs were fixed:

• ACPI: EC: Fix EC address space handler unregistration (bsc#1207149).
• ACPI: EC: Fix ECDT probe ordering issues (bsc#1207149).
• ACPI: PM: s2idle: Add support for upcoming AMD uPEP HID AMDI008 (bsc#1206224).
• ACPI: PM: s2idle: Use LPS0 idle if ACPI_FADT_LOW_POWER_S0 is unset (bsc#1206224).
• ACPI: PRM: Check whether EFI runtime is available (git-fixes).
• ACPI: x86: s2idle: Add a quirk for ASUS ROG Zephyrus G14 (bsc#1206224).
• ACPI: x86: s2idle: Add a quirk for ASUS TUF Gaming A17 FA707RE (bsc#1206224).
• ACPI: x86: s2idle: Add a quirk for ASUSTeK COMPUTER INC. ROG Flow X13 (bsc#1206224).
• ACPI: x86: s2idle: Add a quirk for Lenovo Slim 7 Pro 14ARH7 (bsc#1206224).
• ACPI: x86: s2idle: Add another ID to s2idle_dmi_table (bsc#1206224).
• ACPI: x86: s2idle: Add module parameter to prefer Microsoft GUID (bsc#1206224).
• ACPI: x86: s2idle: Fix a NULL pointer dereference (bsc#1206224).
• ACPI: x86: s2idle: Force AMD GUID/_REV 2 on HP Elitebook 865 (bsc#1206224).
• ACPI: x86: s2idle: If a new AMD _HID is missing assume Rembrandt (bsc#1206224).
• ACPI: x86: s2idle: Move _HID handling for AMD systems into structures (bsc#1206224).
• ACPI: x86: s2idle: Stop using AMD specific codepath for Rembrandt+ (bsc#1206224).
• ACPICA: Allow address_space_handler Install and _REG execution as 2 separate steps (bsc#1207149).
• ACPICA: include/acpi/acpixf.h: Fix indentation (bsc#1207149).
• ALSA: emux: Avoid potential array out-of-bound in snd_emux_xg_control() (git-fixes).
• ALSA: hda/realtek: Add Acer Predator PH315-54 (git-fixes).
• ALSA: hda/realtek: Add Positivo N14KP6-TG (git-fixes).
• ALSA: hda/realtek: Add quirk for ASUS UM3402 using CS35L41 (git-fixes).
• ALSA: hda/realtek: Enable mute/micmute LEDs on HP Elitebook, 645 G9 (git-fixes).
• ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book2 Pro 360 (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs do not work for a HP platform (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs, speaker do not work for a HP platform (git-fixes).
• ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path() (git-fixes).
• ALSA: pci: lx6464es: fix a debug loop (git-fixes). -…

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-3112: Fixed a null pointer dereference caused by lacks check of the return value of kzalloc() in vdec_helpers.c:amvdec_set_canvases (bsc#1206399).
• CVE-2022-3115: Fixed a null pointer dereference in malidp_crtc.c caused by a lack of checks of the return value of kzalloc (bsc#1206393).
• CVE-2022-3564: Fixed use-after-free in l2cap_core.c of the Bluetooth component (bsc#1206073).
• CVE-2022-47520: Fixed a out-of-bounds read when parsing a Robust Security Network (RSN) information element from a Netlink packet in the WILC1000 wireless driver (bsc#1206515).
• CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207036).
• CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type confusion (bsc#1207125).

The following non-security bugs were fixed:

• arm64: cpu_errata: Add Hisilicon TSV110 to spectre-v2 safe list (git-fixes)
• arm64: dts: allwinner: H5: Add PMU node (git-fixes)
• arm64: dts: allwinner: H6: Add PMU mode (git-fixes)
• arm64: dts: marvell: Add AP806-dual missing CPU clocks (git-fixes)
• arm64: dts: rockchip: Fix NanoPC-T4 cooling maps (git-fixes)
• arm64: dts: rockchip: add reg property to brcmf sub-nodes (git-fixes)
• arm64: dts: rockchip: fix dwmmc clock name for px30 (git-fixes)
• arm64: memory: Add missing brackets to untagged_addr() macro (git-fixes)
• arm64: psci: Reduce the waiting time for cpu_psci_cpu_kill() (git-fixes).
• arm64: tags: Preserve tags for addresses translated via TTBR1 (git-fixes)
• arm64: tegra: Fix 'active-low' warning for Jetson Xavier regulator (git-fixes)
• btrfs: Avoid unnecessary lock and leaf splits when up (bsc#1206904).
• drbd: destroy workqueue when drbd device was freed (git-fixes).
• drbd: remove usage of list iterator variable after loop (git-fixes).
• drbd: use after free in drbd_create_device() (git-fixes).
• ext4: Detect already used quota file early (bsc#1206873).
• ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h (bsc#1206878).
• ext4: avoid BUG_ON when creating xattrs (bsc#1205496).
• ext4: avoid crash when inline data creation follows DIO write (bsc#1206883).
• ext4: avoid race conditions when remounting with options that change dax (bsc#1206860).
• ext4: avoid resizing to a partial cluster size (bsc#1206880).
• ext4: choose hardlimit when softlimit is larger than hardlimit in ext4_statfs_project() (bsc#1206854).
• ext4: continue to expand file system when the target size does not reach (bsc#1206882).
• ext4: convert BUG_ON's to WARN_ON's in mballoc.c (bsc#1206859).
• ext4: correct max_inline_xattr_value_size computing (bsc#1206878).
• ext4: correct the error path of ext4_write_inline_data_end() (bsc#1206875).
• ext4: correct the misjudgment in ext4_iget_extra_inode (bsc#1206878).
• ext4: fix BUG_ON() when directory entry has invalid rec_len (bsc#1206886).
• ext4: fix a data race at inode->i_disksize (bsc#1206855).
• ext4: fix bug in extents parsing when eh_entries == 0 and eh_depth > 0 (bsc#1206881).
• ext4: fix corruption when online resizing a 1K bigalloc fs (bsc#1206891).
• ext4: fix extent status tree race in writeback error recovery path (bsc#1206877).
• ext4: fix null-ptr-deref in ext4_write_info (bsc#1206884).
• ext4: fix undefined behavior in bit shift for ext4_check_flag_values (bsc#1206890).
• ext4: fix uninititialized value in 'ext4_evict_inode' (bsc#1206893).
• ext4: fix use-after-free in ext4_ext_shift_extents (bsc#1206888).
• ext4: fix use-after-free in ext4_xattr_set_entry (bsc#1206878).
• ext4: fix warning in 'ext4_da_release_space' (bsc#1206887).
• ext4: iomap that extends beyond EOF should be marked dirty (bsc#1206637).
• ext4: make ext4_lazyinit_thread freezable (bsc#1206885).
• ext4: mark block bitmap corrupted when found instead of BUGON (bsc#1206857).
• ext4: silence the warning when evicting inode with dioread_nolock…

The SUSE Linux Enterprise 15 SP4 Azure kernel was updated to receive various security and bugfixes.

• CVE-2022-3523: Fixed use after free related to device private page handling (bsc#1204363).
• CVE-2022-36280: Fixed out-of-bounds memory access vulnerability found in vmwgfx driver (bsc#1203332).
• CVE-2022-38096: Fixed NULL-ptr deref in vmw_cmd_dx_define_query() (bsc#1203331).
• CVE-2023-0045: Fixed missing Flush IBP in ib_prctl_set (bsc#1207773).
• CVE-2023-0122: Fixed a NULL pointer dereference vulnerability in nvmet_setup_auth(), that allowed an attacker to perform a Pre-Auth Denial of Service (DoS) attack on a remote machine (bsc#1207050).
• CVE-2023-0461: Fixed use-after-free in icsk_ulp_data (bsc#1208787).
• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2023-0597: Fixed lack of randomization of per-cpu entry area in x86/mm (bsc#1207845).
• CVE-2023-1118: Fixed a use-after-free bugs caused by ene_tx_irqsim() in media/rc (bsc#1208837).
• CVE-2023-22995: Fixed lacks of certain platform_device_put and kfree in drivers/usb/dwc3/dwc3-qcom.c (bsc#1208741).
• CVE-2023-22998: Fixed misinterpretatino of the irtio_gpu_object_shmem_init() return value (bsc#1208776).
• CVE-2023-23000: Fixed return value of tegra_xusb_find_port_node function (bsc#1208816).
• CVE-2023-23004: Fixed misinterpretatino of the get_sg_table return value in arm/malidp_planes.c (bsc#1208843).
• CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207036).
• CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (bsc#1207125).
• CVE-2023-23559: Fixed integer overflow in rndis_wlan that leads to a buffer overflow (bsc#1207051).
• CVE-2023-26545: Fixed double free in net/mpls/af_mpls.c upon an allocation failure (bsc#1208700).

The following non-security bugs were fixed:

• acpi / x86: Add support for LPS0 callback handler (git-fixes).
• acpi: NFIT: fix a potential deadlock during NFIT teardown (git-fixes).
• acpi: PM: s2idle: Add support for upcoming AMD uPEP HID AMDI008 (bsc#1206224).
• acpi: PM: s2idle: Use LPS0 idle if ACPI_FADT_LOW_POWER_S0 is unset (bsc#1206224).
• acpi: battery: Fix missing NUL-termination with large strings (git-fixes).
• acpi: x86: s2idle: Add a quirk for ASUS ROG Zephyrus G14 (bsc#1206224).
• acpi: x86: s2idle: Add a quirk for ASUS TUF Gaming A17 FA707RE (bsc#1206224).
• acpi: x86: s2idle: Add a quirk for ASUSTeK COMPUTER INC. ROG Flow X13 (bsc#1206224).
• acpi: x86: s2idle: Add a quirk for Lenovo Slim 7 Pro 14ARH7 (bsc#1206224).
• acpi: x86: s2idle: Add another ID to s2idle_dmi_table (bsc#1206224).
• acpi: x86: s2idle: Add module parameter to prefer Microsoft GUID (bsc#1206224).
• acpi: x86: s2idle: Fix a NULL pointer dereference (bsc#1206224).
• acpi: x86: s2idle: Force AMD GUID/_REV 2 on HP Elitebook 865 (bsc#1206224).
• acpi: x86: s2idle: If a new AMD _HID is missing assume Rembrandt (bsc#1206224).
• acpi: x86: s2idle: Move _HID handling for AMD systems into structures (bsc#1206224).
• acpi: x86: s2idle: Stop using AMD specific codepath for Rembrandt+ (bsc#1206224).
• acpica: Drop port I/O validation for some regions (git-fixes).
• acpica: nsrepair: handle cases without a return value correctly (git-fixes).
• alsa: emux: Avoid potential array out-of-bound in snd_emux_xg_control() (git-fixes).
• alsa: hda/ca0132: minor fix for allocation size (git-fixes).
• alsa: hda/conexant: add a new hda codec SN6180 (git-fixes).
• alsa: hda/realtek - fixed wrong gpio assigned (git-fixes).
• alsa: hda/realtek: Add Positivo N14KP6-TG (git-fixes).
• alsa: hda/realtek: Add quirk for ASUS UM3402 using CS35L41 (git-fixes).
• alsa: hda/realtek: Enable mute/micmute LEDs on HP Elitebook, 645 G9 (git-fixes).
• alsa: hda/realtek: Fix the speaker output on Samsung Galaxy Book2 Pro 360 (git-fixes).
• alsa: hda/realtek: fix mute/micmute LEDs…

The SUSE Linux Enterprise 15 SP4 Azure kernel was updated to receive various security and bugfixes.

• CVE-2022-3523: Fixed use after free related to device private page handling (bsc#1204363).
• CVE-2022-36280: Fixed out-of-bounds memory access vulnerability found in vmwgfx driver (bsc#1203332).
• CVE-2022-38096: Fixed NULL-ptr deref in vmw_cmd_dx_define_query() (bsc#1203331).
• CVE-2023-0045: Fixed missing Flush IBP in ib_prctl_set (bsc#1207773).
• CVE-2023-0122: Fixed a NULL pointer dereference vulnerability in nvmet_setup_auth(), that allowed an attacker to perform a Pre-Auth Denial of Service (DoS) attack on a remote machine (bsc#1207050).
• CVE-2023-0461: Fixed use-after-free in icsk_ulp_data (bsc#1208787).
• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2023-0597: Fixed lack of randomization of per-cpu entry area in x86/mm (bsc#1207845).
• CVE-2023-1075: Fixed a type confusion in tls_is_tx_ready (bsc#1208598).
• CVE-2023-1076: Fixed incorrect UID assigned to tun/tap sockets (bsc#1208599).
• CVE-2023-1078: Fixed a heap out-of-bounds write in rds_rm_zerocopy_callback (bsc#1208601).
• CVE-2023-1095: Fixed a NULL pointer dereference in nf_tables due to zeroed list head (bsc#1208777).
• CVE-2023-1118: Fixed a use-after-free bugs caused by ene_tx_irqsim() in media/rc (bsc#1208837).
• CVE-2023-22995: Fixed lacks of certain platform_device_put and kfree in drivers/usb/dwc3/dwc3-qcom.c (bsc#1208741).
• CVE-2023-22998: Fixed misinterpretatino of the irtio_gpu_object_shmem_init() return value (bsc#1208776).
• CVE-2023-23000: Fixed return value of tegra_xusb_find_port_node function (bsc#1208816).
• CVE-2023-23001: Fixed misinterpretion of the regulator_get return value (bsc# 1208829).
• CVE-2023-23004: Fixed misinterpretatino of the get_sg_table return value in arm/malidp_planes.c (bsc#1208843).
• CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207036).
• CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (bsc#1207125).
• CVE-2023-23559: Fixed integer overflow in rndis_wlan that leads to a buffer overflow (bsc#1207051).
• CVE-2023-25012: Fixed a use-after-free in bigben_set_led() (bsc#1207560).
• CVE-2023-26545: Fixed double free in net/mpls/af_mpls.c upon an allocation failure (bsc#1208700).
• CVE-2023-28328: Fixed a denial of service issue in az6027 driver in drivers/media/usb/dev-usb/az6027.c (bsc#1209291).

The following non-security bugs were fixed:

• NFSv4.1 provide mount option to toggle trunking discovery (git-fixes).
• acpi / x86: Add support for LPS0 callback handler (git-fixes).
• acpi: Do not build ACPICA with '-Os' (git-fixes).
• acpi: NFIT: fix a potential deadlock during NFIT teardown (git-fixes).
• acpi: PM: s2idle: Add support for upcoming AMD uPEP HID AMDI008 (bsc#1206224).
• acpi: PM: s2idle: Use LPS0 idle if ACPI_FADT_LOW_POWER_S0 is unset (bsc#1206224).
• acpi: battery: Fix missing NUL-termination with large strings (git-fixes).
• acpi: resource: Add helper function acpi_dev_get_memory_resources() (git-fixes).
• acpi: video: Fix Lenovo Ideapad Z570 DMI match (git-fixes).
• acpi: x86: s2idle: Add a quirk for ASUS ROG Zephyrus G14 (bsc#1206224).
• acpi: x86: s2idle: Add a quirk for ASUS TUF Gaming A17 FA707RE (bsc#1206224).
• acpi: x86: s2idle: Add a quirk for ASUSTeK COMPUTER INC. ROG Flow X13 (bsc#1206224).
• acpi: x86: s2idle: Add a quirk for Lenovo Slim 7 Pro 14ARH7 (bsc#1206224).
• acpi: x86: s2idle: Add another ID to s2idle_dmi_table (bsc#1206224).
• acpi: x86: s2idle: Add module parameter to prefer Microsoft GUID (bsc#1206224).
• acpi: x86: s2idle: Fix a NULL pointer dereference (bsc#1206224).
• acpi: x86: s2idle: Force AMD GUID/_REV 2 on HP Elitebook 865 (bsc#1206224).
• acpi: x86: s2idle: If a new AMD _HID is missing assume Rembrandt (bsc#1206224).
• acpi: x86: s2idle: Move…

The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2017-5753: Fixed spectre V1 vulnerability on netlink (bsc#1209547).
• CVE-2017-5753: Fixed spectre vulnerability in prlimit (bsc#1209256).
• CVE-2021-3923: Fixed stack information leak vulnerability that could lead to kernel protection bypass in infiniband RDMA (bsc#1209778).
• CVE-2022-20567: Fixed use after free that could lead to a local privilege escalation in pppol2tp_create of l2tp_ppp.c (bsc#1208850).
• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2023-1076: Fixed incorrect UID assigned to tun/tap sockets (bsc#1208599).
• CVE-2023-1095: Fixed a NULL pointer dereference in nf_tables due to zeroed list head (bsc#1208777).
• CVE-2023-1281: Fixed use after free that could lead to privilege escalation in tcindex (bsc#1209634).
• CVE-2023-1390: Fixed remote DoS vulnerability in tipc_link_xmit() (bsc#1209289).
• CVE-2023-1513: Fixed an uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak (bsc#1209532).
• CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207036).
• CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (bsc#1207125).
• CVE-2023-28328: Fixed a denial of service issue in az6027 driver in drivers/media/usb/dev-usb/az6027.c (bsc#1209291).
• CVE-2023-28464: Fixed user-after-free that could lead to privilege escalation in hci_conn_cleanup in net/bluetooth/hci_conn.c (bsc#1209052).
• CVE-2023-28772: Fixed buffer overflow in seq_buf_putmem_hex in lib/seq_buf.c (bsc#1209549).

The following non-security bugs were fixed:

• ARM: 8702/1: head-common.S: Clear lr before jumping to start_kernel() (git-fixes)
• Bluetooth: btusb: Add VID:PID 13d3:3529 for Realtek RTL8821CE (git-fixes).
• Bluetooth: btusb: do not call kfree_skb() under spin_lock_irqsave() (git-fixes).
• Input: atmel_mxt_ts - fix double free in mxt_read_info_block (git-fixes).
• KVM: arm64: Hide system instruction access to Trace registers (git-fixes)
• NFSv4: Fix hangs when recovering open state after a server reboot (git-fixes).
• PCI/MSI: Enforce MSI entry updates to be visible (git-fixes).
• PCI/MSI: Enforce that MSI-X table entry is masked for update (git-fixes).
• PCI/MSI: Mask all unused MSI-X entries (git-fixes).
• PCI/MSI: Skip masking MSI-X on Xen PV (git-fixes).
• PCI/PM: Always return devices to D0 when thawing (git-fixes).
• PCI/PM: Avoid using device_may_wakeup() for runtime PM (git-fixes).
• PCI: Add ACS quirk for Intel Root Complex Integrated Endpoints (git-fixes).
• PCI: Add ACS quirk for iProc PAXB (git-fixes).
• PCI: Avoid FLR for AMD Matisse HD Audio & USB 3.0 (git-fixes).
• PCI: Avoid FLR for AMD Starship USB 3.0 (git-fixes).
• PCI: Make ACS quirk implementations more uniform (git-fixes).
• PCI: PM: Avoid forcing PCI_D0 for wakeup reasons inconsistently (git-fixes).
• PCI: PM: Avoid skipping bus-level PM on platforms without ACPI (git-fixes).
• PCI: Unify ACS quirk desired vs provided checking (git-fixes).
• PCI: Use pci_update_current_state() in pci_enable_device_flags() (git-fixes).
• PCI: aardvark: Do not blindly enable ASPM L0s and do not write to read-only register (git-fixes).
• PCI: aardvark: Do not rely on jiffies while holding spinlock (git-fixes).
• PCI: aardvark: Do not touch PCIe registers if no card connected (git-fixes).
• PCI: aardvark: Fix a leaked reference by adding missing of_node_put() (git-fixes).
• PCI: aardvark: Fix checking for PIO Non-posted Request (git-fixes).
• PCI: aardvark: Fix kernel panic during PIO transfer (git-fixes).
• PCI: aardvark: Improve link training (git-fixes).
• PCI: aardvark: Indicate error in 'val' when config read fails (git-fixes).
• PCI: aardvark: Introduce an…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2017-5753: Fixed spectre V1 vulnerability on netlink (bsc#1209547).
• CVE-2017-5753: Fixed spectre vulnerability in prlimit (bsc#1209256).
• CVE-2021-3923: Fixed stack information leak vulnerability that could lead to kernel protection bypass in infiniband RDMA (bsc#1209778).
• CVE-2022-20567: Fixed use after free that could lead to a local privilege escalation in pppol2tp_create of l2tp_ppp.c (bsc#1208850).
• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2023-1076: Fixed incorrect UID assigned to tun/tap sockets (bsc#1208599).
• CVE-2023-1095: Fixed a NULL pointer dereference in nf_tables due to zeroed list head (bsc#1208777).
• CVE-2023-1281: Fixed use after free that could lead to privilege escalation in tcindex (bsc#1209634).
• CVE-2023-1390: Fixed remote DoS vulnerability in tipc_link_xmit() (bsc#1209289).
• CVE-2023-1513: Fixed an uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak (bsc#1209532).
• CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207036).
• CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (bsc#1207125).
• CVE-2023-28328: Fixed a denial of service issue in az6027 driver in drivers/media/usb/dev-usb/az6027.c (bsc#1209291).
• CVE-2023-28464: Fixed user-after-free that could lead to privilege escalation in hci_conn_cleanup in net/bluetooth/hci_conn.c (bsc#1209052).
• CVE-2023-28772: Fixed buffer overflow in seq_buf_putmem_hex in lib/seq_buf.c (bsc#1209549).

The following non-security bugs were fixed:

• Bluetooth: btusb: Add VID:PID 13d3:3529 for Realtek RTL8821CE (git-fixes).
• Bluetooth: btusb: do not call kfree_skb() under spin_lock_irqsave() (git-fixes).
• Do not sign the vanilla kernel (bsc#1209008).
• Input: atmel_mxt_ts - fix double free in mxt_read_info_block (git-fixes).
• KVM: arm64: Hide system instruction access to Trace registers (git-fixes)
• NFSv4: Fix hangs when recovering open state after a server reboot (git-fixes). [iivanov] Fix Patch-mainline to v6.3-rc5
• PCI/MSI: Enforce MSI entry updates to be visible (git-fixes).
• PCI/MSI: Enforce that MSI-X table entry is masked for update (git-fixes).
• PCI/MSI: Mask all unused MSI-X entries (git-fixes).
• PCI/MSI: Skip masking MSI-X on Xen PV (git-fixes).
• PCI/PM: Always return devices to D0 when thawing (git-fixes).
• PCI/PM: Avoid using device_may_wakeup() for runtime PM (git-fixes).
• PCI: Add ACS quirk for Intel Root Complex Integrated Endpoints (git-fixes).
• PCI: Add ACS quirk for iProc PAXB (git-fixes).
• PCI: Avoid FLR for AMD Matisse HD Audio & USB 3.0 (git-fixes).
• PCI: Avoid FLR for AMD Starship USB 3.0 (git-fixes).
• PCI: Make ACS quirk implementations more uniform (git-fixes).
• PCI: PM: Avoid forcing PCI_D0 for wakeup reasons inconsistently (git-fixes).
• PCI: PM: Avoid skipping bus-level PM on platforms without ACPI (git-fixes).
• PCI: Unify ACS quirk desired vs provided checking (git-fixes).
• PCI: Use pci_update_current_state() in pci_enable_device_flags() (git-fixes).
• PCI: aardvark: Do not blindly enable ASPM L0s and do not write to read-only register (git-fixes).
• PCI: aardvark: Do not rely on jiffies while holding spinlock (git-fixes).
• PCI: aardvark: Do not touch PCIe registers if no card connected (git-fixes).
• PCI: aardvark: Fix a leaked reference by adding missing of_node_put() (git-fixes).
• PCI: aardvark: Fix checking for PIO Non-posted Request (git-fixes).
• PCI: aardvark: Fix kernel panic during PIO transfer (git-fixes).
• PCI: aardvark: Improve link training (git-fixes).
• PCI: aardvark: Indicate error in 'val' when config read fails (git-fixes).
• PCI: aardvark: Introduce an…

The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2017-5753: Fixed spectre V1 vulnerability on netlink (bsc#1209547).
• CVE-2017-5753: Fixed spectre vulnerability in prlimit (bsc#1209256).
• CVE-2021-3923: Fixed stack information leak vulnerability that could lead to kernel protection bypass in infiniband RDMA (bsc#1209778).
• CVE-2021-4203: Fixed use-after-free read flaw that was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race with listen() (bsc#1194535).
• CVE-2022-20567: Fixed use after free that could lead to a local privilege escalation in pppol2tp_create of l2tp_ppp.c (bsc#1208850).
• CVE-2023-0394: Fixed a null pointer dereference flaw in the network subcomponent in the Linux kernel which could lead to system crash (bsc#1207168).
• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2023-1076: Fixed incorrect UID assigned to tun/tap sockets (bsc#1208599).
• CVE-2023-1095: Fixed a NULL pointer dereference in nf_tables due to zeroed list head (bsc#1208777).
• CVE-2023-1281: Fixed use after free that could lead to privilege escalation in tcindex (bsc#1209634).
• CVE-2023-1390: Fixed remote DoS vulnerability in tipc_link_xmit() (bsc#1209289).
• CVE-2023-1513: Fixed an uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak (bsc#1209532).
• CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207036).
• CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (bsc#1207125).
• CVE-2023-28328: Fixed a denial of service issue in az6027 driver in drivers/media/usb/dev-usb/az6027.c (bsc#1209291).
• CVE-2023-28464: Fixed user-after-free that could lead to privilege escalation in hci_conn_cleanup in net/bluetooth/hci_conn.c (bsc#1209052).
• CVE-2023-28772: Fixed buffer overflow in seq_buf_putmem_hex in lib/seq_buf.c (bsc#1209549).

The following non-security bugs were fixed:

• Do not sign the vanilla kernel (bsc#1209008).
• PCI: hv: Add a per-bus mutex state_lock (bsc#1208811).
• PCI: hv: Fix a race condition in hv_irq_unmask() that can cause panic (bsc#1208811).
• PCI: hv: Remove the useless hv_pcichild_state from struct hv_pci_dev (bsc#1208811).
• PCI: hv: fix a race condition bug in hv_pci_query_relations() (bsc#1208811).
• Revert 'PCI: hv: Fix a timing issue which causes kdump to fail occasionally' (bsc#1208811).
• cifs: fix double free in dfs mounts (bsc#1209845).
• cifs: fix nodfs mount option (bsc#1209845).
• cifs: handle reconnect of tcon when there is no cached dfs referral (bsc#1209845).
• cifs: missing null pointer check in cifs_mount (bsc#1209845).
• cifs: serialize all mount attempts (bsc#1209845).
• cred: allow get_cred() and put_cred() to be given NULL (bsc#1209887).
• ibmvnic: Process crqs after enabling interrupts (bsc#1192273 ltc#194629).
• ibmvnic: do not stop queue in xmit (bsc#1192273 ltc#194629).
• ipv6: raw: Deduct extension header length in rawv6_push_pending_frames (bsc#1207168).
• kernel-module-subpackage: Fix expansion with -b parameter (bsc#1208179).

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-1611: Fixed an use-after-free flaw in btrfs_search_slot (bsc#1209687).
• CVE-2020-36691: Fixed an issue which could allow attackers to cause a denial of service via a nested Netlink policy with a back reference (bsc#1209613).
• CVE-2023-28772: Fixed buffer overflow in seq_buf_putmem_hex in lib/seq_buf.c (bsc#1209549).
• CVE-2023-1513: Fixed an uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak (bsc#1209532).
• CVE-2023-28464: Fixed user-after-free that could lead to privilege escalation in hci_conn_cleanup in net/bluetooth/hci_conn.c (bsc#1209052).
• CVE-2021-3923: Fixed stack information leak vulnerability that could lead to kernel protection bypass in infiniband RDMA (bsc#1209778).
• CVE-2023-1390: Fixed remote DoS vulnerability in tipc_link_xmit() (bsc#1209289).
• CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue led by a type confusion (bsc#1207125).
• CVE-2023-1281: Fixed use after free that could lead to privilege escalation in tcindex (bsc#1209634).
• CVE-2017-5753: Fixed spectre V1 vulnerability on netlink (bsc#1209547).
• CVE-2017-5753: Fixed spectre vulnerability in prlimit (bsc#1209256).
• CVE-2023-28328: Fixed a denial of service issue in az6027 driver in drivers/media/usb/dev-usb/az6027.c (bsc#1209291).
• CVE-2022-20567: Fixed use after free that could lead to a local privilege escalation in pppol2tp_create of l2tp_ppp.c (bsc#1208850).
• CVE-2023-1076: Fixed incorrect UID assigned to tun/tap sockets (bsc#1208599).
• CVE-2023-1095: Fixed a NULL pointer dereference in nf_tables due to zeroed list head (bsc#1208777).

The following non-security bugs were fixed:

• applicom: Fix PCI device refcount leak in applicom_init() (git-fixes).
• ARM: 8702/1: head-common.S: Clear lr before jumping to start_kernel() (git-fixes)
• arm64: cmpxchg_double*: hazard against entire exchange variable (git-fixes)
• arm64: cpu_ops: fix a leaked reference by adding missing of_node_put (git-fixes)
• arm64: Discard .note.GNU-stack section (bsc#1203693 bsc#1209798).
• arm64: Do not forget syscall when starting a new thread. (git-fixes)
• arm64: Fix compiler warning from pte_unmap() with (git-fixes)
• arm64: fix oops in concurrently setting insn_emulation sysctls (git-fixes)
• arm64: kaslr: Reserve size of ARM64_MEMSTART_ALIGN in linear region (git-fixes)
• arm64: kprobe: make page to RO mode when allocate it (git-fixes)
• arm64: kpti: ensure patched kernel text is fetched from PoU (git-fixes)
• arm64: Mark __stack_chk_guard as __ro_after_init (git-fixes)
• arm64: psci: Avoid printing in cpu_psci_cpu_die() (git-fixes)
• arm64: psci: Reduce the waiting time for cpu_psci_cpu_kill() (git-fixes)
• arm64: unwind: Prohibit probing on return_address() (git-fixes)
• arm64: Use test_tsk_thread_flag() for checking TIF_SINGLESTEP (git-fixes)
• arm64/alternatives: do not patch up internal branches (git-fixes)
• arm64/alternatives: move length validation inside the subsection (git-fixes)
• arm64/alternatives: use subsections for replacement sequences (git-fixes)
• arm64/cpufeature: Fix field sign for DIT hwcap detection (git-fixes)
• arm64/mm: fix variable 'pud' set but not used (git-fixes)
• arm64/mm: return cpu_all_mask when node is NUMA_NO_NODE (git-fixes)
• arm64/vdso: Discard .note.gnu.property sections in vDSO (git-fixes)
• Bluetooth: btusb: Add VID:PID 13d3:3529 for Realtek RTL8821CE (git-fixes).
• Bluetooth: btusb: do not call kfree_skb() under spin_lock_irqsave() (git-fixes).
• crypto: arm64 - Fix unused variable compilation warnings of (git-fixes)
• dt-bindings: reset: meson8b: fix duplicate reset IDs (git-fixes).
• ftrace: Fix invalid address access in lookup_rec() when index is 0 (git-fixes).
• ima: Fix function name error in comment (git-fixes).
• Input: atmel_mxt_ts - fix double free in mxt_read_info_block…

The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-2483: Fixed a use after free bug in emac_remove due caused by a race condition (bsc#1211037).
• CVE-2023-2124: Fixed an out of bound access in the XFS subsystem that could have lead to denial-of-service or potentially privilege escalation (bsc#1210498).
• CVE-2023-1670: Fixed a use after free in the Xircom 16-bit PCMCIA Ethernet driver. A local user could use this flaw to crash the system or potentially escalate their privileges on the system (bsc#1209871).
• CVE-2017-5753: Fixed spectre V1 vulnerability on netlink (bsc#1209547).
• CVE-2017-5753: Fixed spectre vulnerability in prlimit (bsc#1209256).
• CVE-2020-36691: Fixed a denial of service (unbounded recursion) vulnerability via a nested Netlink policy with a back reference (bsc#1209613 bsc#1209777).
• CVE-2023-0394: Fixed a null pointer dereference flaw in the network subcomponent in the Linux kernel which could lead to system crash (bsc#1207168).
• CVE-2021-3923: Fixed stack information leak vulnerability that could lead to kernel protection bypass in infiniband RDMA (bsc#1209778).
• CVE-2021-4203: Fixed use-after-free read flaw that was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race with listen() (bsc#1194535).
• CVE-2022-20567: Fixed use after free that could lead to a local privilege escalation in pppol2tp_create of l2tp_ppp.c (bsc#1208850).
• CVE-2022-43945: Fixed a buffer overflow in the NFSD implementation (bsc#1205128).
• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2023-0597: Fixed lack of randomization of per-cpu entry area in x86/mm (bsc#1207845).
• CVE-2023-1076: Fixed incorrect UID assigned to tun/tap sockets (bsc#1208599).
• CVE-2023-1095: Fixed a NULL pointer dereference in nf_tables due to zeroed list head (bsc#1208777).
• CVE-2023-1118: Fixed a use-after-free bugs caused by ene_tx_irqsim() in media/rc (bsc#1208837).
• CVE-2023-1390: Fixed remote DoS vulnerability in tipc_link_xmit() (bsc#1209289).
• CVE-2023-1513: Fixed an uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak (bsc#1209532).
• CVE-2023-1611: Fixed an use-after-free flaw in btrfs_search_slot (bsc#1209687).
• CVE-2023-1855: Fixed an use-after-free flaw in xgene_hwmon_remove (bsc#1210202).
• CVE-2023-1989: Fixed an use-after-free flaw in btsdio_remove (bsc#1210336).
• CVE-2023-1990: Fixed an use-after-free flaw in ndlc_remove (bsc#1210337).
• CVE-2023-1998: Fixed an use-after-free flaw during login when accessing the shost ipaddress (bsc#1210506).
• CVE-2023-2162: Fixed an use-after-free flaw in iscsi_sw_tcp_session_create (bsc#1210647).
• CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207036).
• CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (bsc#1207125).
• CVE-2023-28328: Fixed a denial of service issue in az6027 driver in drivers/media/usb/dev-usb/az6027.c (bsc#1209291).
• CVE-2023-28464: Fixed user-after-free that could lead to privilege escalation in hci_conn_cleanup in net/uetooth/hci_conn.c (bsc#1209052).
• CVE-2023-28772: Fixed buffer overflow in seq_buf_putmem_hex in lib/seq_buf.c (bsc#1209549).
• CVE-2023-30772: Fixed race condition and resultant use-after-free in da9150_charger_remove (bsc#1210329).

The following non-security bugs were fixed:

• Do not sign the vanilla kernel (bsc#1209008).
• Fix kABI breakage (bsc#1208333)
• PCI: hv: Add a per-bus mutex state_lock (bsc#1207185).
• PCI: hv: Fix a race condition bug in hv_pci_query_relations() (bsc#1207185).
• PCI: hv: Fix a race condition in hv_irq_unmask() that can cause panic (bsc#1207185).
• PCI: hv: Remove the useless hv_pcichild_state from struct…

The SUSE Linux Enterprise 11 SP4 LTSS EXTREME CORE kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-2162: Fixed an use-after-free flaw in iscsi_sw_tcp_session_create (bsc#1210647).
• CVE-2023-32269: Fixed a use-after-free in af_netrom.c, related to the fact that accept() was also allowed for a successfully connected AF_NETROM socket (bsc#1211186).
• CVE-2023-1989: Fixed a use after free in btsdio_remove (bsc#1210336).
• CVE-2017-5753: Fixed spectre vulnerability in prlimit (bsc#1209256).
• CVE-2023-1670: Fixed a use after free in the Xircom 16-bit PCMCIA Ethernet driver. A local user could use this flaw to crash the system or potentially escalate their privileges on the system (bsc#1209871).
• CVE-2023-1513: Fixed an uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak (bsc#1209532).
• CVE-2023-28328: Fixed a denial of service issue in az6027 driver in drivers/media/usb/dev-usb/az6027.c (bsc#1209291).
• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2018-9517: Fixed possible memory corruption due to a use after free in pppol2tp_connect (bsc#1108488).
• CVE-2023-1118: Fixed a use-after-free bugs caused by ene_tx_irqsim() in media/rc (bsc#1208837).
• CVE-2023-23559: Fixed integer overflow in rndis_wlan that leads to a buffer overflow (bsc#1207051).
• CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207036).
• CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (bsc#1207125).
• CVE-2022-3567: Fixed a to race condition in inet6_stream_ops()/inet6_dgram_ops() (bsc#1204414).

The following non-security bugs were fixed:

• Do not sign the vanilla kernel (bsc#1209008).
• do not fallthrough in cbq_classify and stop on TC_ACT_SHOT

This update for the Linux Kernel 4.12.14-95_102 fixes several issues.

The following security issues were fixed:

• CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (bsc#1207189).
• CVE-2023-31436: Fixed an out-of-bounds write in qfq_change_class() because lmax can exceed QFQ_MIN_LMAX (bsc#1210989).
• CVE-2023-1390: Fixed remote DoS vulnerability in tipc_link_xmit() (bsc#1210779).

This update for the Linux Kernel 4.12.14-150100_197_131 fixes several issues.

The following security issues were fixed:

• CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (bsc#1207189).
• CVE-2023-31436: Fixed an out-of-bounds write in qfq_change_class() because lmax can exceed QFQ_MIN_LMAX (bsc#1210989).
• CVE-2023-1390: Fixed remote DoS vulnerability in tipc_link_xmit() (bsc#1210779).
• CVE-2023-28466: Fixed race condition that could lead to use-after-free or NULL pointer dereference in do_tls_getsockopt in net/tls/tls_main.c (bsc#1210452).

This update for the Linux Kernel 5.14.21-150400_15_8 fixes several issues.

The following security issues were fixed:

• CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (bsc#1207189).
• CVE-2023-31436: Fixed an out-of-bounds write in qfq_change_class() because lmax can exceed QFQ_MIN_LMAX (bsc#1210989).
• CVE-2023-28466: Fixed race condition that could lead to use-after-free or NULL pointer dereference in do_tls_getsockopt in net/tls/tls_main.c (bsc#1210452).

This update for the Linux Kernel 4.12.14-122_144 fixes several issues.

The following security issues were fixed:

• CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (bsc#1207189).
• CVE-2023-31436: Fixed an out-of-bounds write in qfq_change_class() because lmax can exceed QFQ_MIN_LMAX (bsc#1210989).
• CVE-2023-1390: Fixed remote DoS vulnerability in tipc_link_xmit() (bsc#1210779).
• CVE-2023-28466: Fixed race condition that could lead to use-after-free or NULL pointer dereference in do_tls_getsockopt in net/tls/tls_main.c (bsc#1210452).

This update for the Linux Kernel 5.3.18-150200_24_126 fixes several issues.

The following security issues were fixed:

• CVE-2022-4744: Fixed double-free that could lead to DoS or privilege escalation in TUN/TAP device driver functionality (bsc#1209672).
• CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (bsc#1207189).
• CVE-2023-31436: Fixed an out-of-bounds write in qfq_change_class() because lmax can exceed QFQ_MIN_LMAX (bsc#1210989).
• CVE-2023-1390: Fixed remote DoS vulnerability in tipc_link_xmit() (bsc#1210779).
• CVE-2023-28466: Fixed race condition that could lead to use-after-free or NULL pointer dereference in do_tls_getsockopt in net/tls/tls_main.c (bsc#1210452).

This update for the Linux Kernel 5.3.18-150200_24_129 fixes several issues.

The following security issues were fixed:

• CVE-2022-4744: Fixed double-free that could lead to DoS or privilege escalation in TUN/TAP device driver functionality (bsc#1209672).
• CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (bsc#1207189).
• CVE-2023-31436: Fixed an out-of-bounds write in qfq_change_class() because lmax can exceed QFQ_MIN_LMAX (bsc#1210989).
• CVE-2023-1390: Fixed remote DoS vulnerability in tipc_link_xmit() (bsc#1210779).
• CVE-2023-28466: Fixed race condition that could lead to use-after-free or NULL pointer dereference in do_tls_getsockopt in net/tls/tls_main.c (bsc#1210452).

This update for the Linux Kernel 4.12.14-150100_197_117 fixes several issues.

The following security issues were fixed:

• CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (bsc#1207189).
• CVE-2023-31436: Fixed an out-of-bounds write in qfq_change_class() because lmax can exceed QFQ_MIN_LMAX (bsc#1210989).
• CVE-2023-1390: Fixed remote DoS vulnerability in tipc_link_xmit() (bsc#1210779).
• CVE-2023-28466: Fixed race condition that could lead to use-after-free or NULL pointer dereference in do_tls_getsockopt in net/tls/tls_main.c (bsc#1210452).

This update for the Linux Kernel 4.12.14-95_111 fixes several issues.

The following security issues were fixed:

• CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (bsc#1207189).
• CVE-2023-31436: Fixed an out-of-bounds write in qfq_change_class() because lmax can exceed QFQ_MIN_LMAX (bsc#1210989).
• CVE-2023-1390: Fixed remote DoS vulnerability in tipc_link_xmit() (bsc#1210779).

This update for the Linux Kernel 5.3.18-150300_59_76 fixes several issues.

The following security issues were fixed:

• CVE-2022-4744: Fixed double-free that could lead to DoS or privilege escalation in TUN/TAP device driver functionality (bsc#1209672).
• CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (bsc#1207189).
• CVE-2023-31436: Fixed an out-of-bounds write in qfq_change_class() because lmax can exceed QFQ_MIN_LMAX (bsc#1210989).
• CVE-2023-1390: Fixed remote DoS vulnerability in tipc_link_xmit() (bsc#1210779).
• CVE-2023-28466: Fixed race condition that could lead to use-after-free or NULL pointer dereference in do_tls_getsockopt in net/tls/tls_main.c (bsc#1210452).

This update for the Linux Kernel 5.14.21-150400_24_18 fixes several issues.

The following security issues were fixed:

• CVE-2022-4744: Fixed double-free that could lead to DoS or privilege escalation in TUN/TAP device driver functionality (bsc#1209672).
• CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (bsc#1207189).
• CVE-2023-31436: Fixed an out-of-bounds write in qfq_change_class() because lmax can exceed QFQ_MIN_LMAX (bsc#1210989).
• CVE-2023-28466: Fixed race condition that could lead to use-after-free or NULL pointer dereference in do_tls_getsockopt in net/tls/tls_main.c (bsc#1210452).

This update for the Linux Kernel 4.12.14-122_130 fixes several issues.

The following security issues were fixed:

• CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (bsc#1207189).
• CVE-2023-31436: Fixed an out-of-bounds write in qfq_change_class() because lmax can exceed QFQ_MIN_LMAX (bsc#1210989).
• CVE-2023-1390: Fixed remote DoS vulnerability in tipc_link_xmit() (bsc#1210779).
• CVE-2023-28466: Fixed race condition that could lead to use-after-free or NULL pointer dereference in do_tls_getsockopt in net/tls/tls_main.c (bsc#1210452).

This update for the Linux Kernel 5.14.21-150400_24_33 fixes several issues.

The following security issues were fixed:

• CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (bsc#1207189).
• CVE-2023-31436: Fixed an out-of-bounds write in qfq_change_class() because lmax can exceed QFQ_MIN_LMAX (bsc#1210989).
• CVE-2023-28466: Fixed race condition that could lead to use-after-free or NULL pointer dereference in do_tls_getsockopt in net/tls/tls_main.c (bsc#1210452).

This update for the Linux Kernel 5.3.18-150300_59_90 fixes several issues.

The following security issues were fixed:

• CVE-2022-4744: Fixed double-free that could lead to DoS or privilege escalation in TUN/TAP device driver functionality (bsc#1209672).
• CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (bsc#1207189).
• CVE-2023-31436: Fixed an out-of-bounds write in qfq_change_class() because lmax can exceed QFQ_MIN_LMAX (bsc#1210989).
• CVE-2023-1390: Fixed remote DoS vulnerability in tipc_link_xmit() (bsc#1210779).
• CVE-2023-28466: Fixed race condition that could lead to use-after-free or NULL pointer dereference in do_tls_getsockopt in net/tls/tls_main.c (bsc#1210452).

This update for the Linux Kernel 5.14.21-150400_24_21 fixes several issues.

The following security issues were fixed:

• CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (bsc#1207189).
• CVE-2023-31436: Fixed an out-of-bounds write in qfq_change_class() because lmax can exceed QFQ_MIN_LMAX (bsc#1210989).
• CVE-2023-28466: Fixed race condition that could lead to use-after-free or NULL pointer dereference in do_tls_getsockopt in net/tls/tls_main.c (bsc#1210452).

This update for the Linux Kernel 5.3.18-150300_59_87 fixes several issues.

The following security issues were fixed:

• CVE-2022-4744: Fixed double-free that could lead to DoS or privilege escalation in TUN/TAP device driver functionality (bsc#1209672).
• CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (bsc#1207189).
• CVE-2023-31436: Fixed an out-of-bounds write in qfq_change_class() because lmax can exceed QFQ_MIN_LMAX (bsc#1210989).
• CVE-2023-1390: Fixed remote DoS vulnerability in tipc_link_xmit() (bsc#1210779).
• CVE-2023-28466: Fixed race condition that could lead to use-after-free or NULL pointer dereference in do_tls_getsockopt in net/tls/tls_main.c (bsc#1210452).