CVE-2023-3161

A flaw was found in the Framebuffer Console (fbcon) in the Linux Kernel. When providing font->width and font->height greater than 32 to fbcon_set_font, since there are no checks in place, a shift-out-of-bounds occurs leading to undefined behavior and possible denial of service.

The Linux Kernel, the operating system core itself.

Security Fix(es):

An out-of-bounds read vulnerability was found in the SR-IPv6 implementation in the Linux kernel. Quoting ZDI security advisory [1]:

"This vulnerability allows local attackers to disclose sensitive information on affected installations of the Linux Kernel. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the processing of seg6 attributes. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute arbitrary code in the context of the kernel."

[1] https://www.zerodayinitiative.com/advisories/ZDI-CAN-18511/(CVE-2023-2860)

A known cache speculation vulnerability, known as Branch History Injection (BHI) or Spectre-BHB, becomes actual again for the new hw AmpereOne. Spectre-BHB is similar to Spectre v2, except that malicious code uses the shared branch history (stored in the CPU Branch History Buffer, or BHB) to influence mispredicted branches within the victim's hardware context. Once that occurs, speculation caused by the mispredicted branches can cause cache allocation. This issue leads to obtaining information that should not be accessible.(CVE-2023-3006)

A use after free issue was discovered in driver/firewire in outbound_phy_packet_callback in the Linux Kernel. In this flaw a local attacker with special privilege may cause a use after free problem when queue_event() fails.(CVE-2023-3159)

A flaw was found in the Framebuffer Console (fbcon) in the Linux Kernel. When providing font->width and font->height greater than 32 to fbcon_set_font, since there are no checks in place, a shift-out-of-bounds occurs leading to undefined behavior and possible denial of service.(CVE-2023-3161)

** DISPUTED ** An issue was discovered in the Linux kernel before 6.3.3. There is an out-of-bounds read in crc16 in lib/crc16.c when called from fs/ext4/super.c because ext4_group_desc_csum does not properly check an offset. NOTE: this is disputed by third parties because the kernel is not intended to defend against attackers with the stated "When modifying the block device while it is mounted by the filesystem" access.(CVE-2023-34256)

An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in saa7134_finidev in drivers/media/pci/saa7134/saa7134-core.c.(CVE-2023-35823)

An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in renesas_usb3_remove in drivers/usb/gadget/udc/renesas_usb3.c.(CVE-2023-35828)

The Linux Kernel, the operating system core itself.

Security Fix(es):

An out-of-bounds read vulnerability was found in the SR-IPv6 implementation in the Linux kernel. Quoting ZDI security advisory [1]:

"This vulnerability allows local attackers to disclose sensitive information on affected installations of the Linux Kernel. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the processing of seg6 attributes. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute arbitrary code in the context of the kernel."

[1] https://www.zerodayinitiative.com/advisories/ZDI-CAN-18511/(CVE-2023-2860)

A known cache speculation vulnerability, known as Branch History Injection (BHI) or Spectre-BHB, becomes actual again for the new hw AmpereOne. Spectre-BHB is similar to Spectre v2, except that malicious code uses the shared branch history (stored in the CPU Branch History Buffer, or BHB) to influence mispredicted branches within the victim's hardware context. Once that occurs, speculation caused by the mispredicted branches can cause cache allocation. This issue leads to obtaining information that should not be accessible.(CVE-2023-3006)

An issue was discovered in drivers/media/dvb-core/dvb_frontend.c in the Linux kernel 6.2. There is a blocking operation when a task is in !TASK_RUNNING. In dvb_frontend_get_event, wait_event_interruptible is called; the condition is dvb_frontend_test_event(fepriv,events). In dvb_frontend_test_event, down(&fepriv->sem) is called. However, wait_event_interruptible would put the process to sleep, and down(&fepriv->sem) may block the process.(CVE-2023-31084)

A flaw was found in the Framebuffer Console (fbcon) in the Linux Kernel. When providing font->width and font->height greater than 32 to fbcon_set_font, since there are no checks in place, a shift-out-of-bounds occurs leading to undefined behavior and possible denial of service.(CVE-2023-3161)

A NULL pointer dereference issue was found in the gfs2 file system in the Linux kernel. It occurs on corrupt gfs2 file systems when the evict code tries to reference the journal descriptor structure after it has been freed and set to NULL. A privileged local user could use this flaw to cause a kernel panic.(CVE-2023-3212)

** DISPUTED ** An issue was discovered in the Linux kernel before 6.3.3. There is an out-of-bounds read in crc16 in lib/crc16.c when called from fs/ext4/super.c because ext4_group_desc_csum does not properly check an offset. NOTE: this is disputed by third parties because the kernel is not intended to defend against attackers with the stated "When modifying the block device while it is mounted by the filesystem" access.(CVE-2023-34256)

An issue was discovered in fl_set_geneve_opt in net/sched/cls_flower.c in the Linux kernel before 6.3.7. It allows an out-of-bounds write in the flower classifier code via TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets. This may result in denial of service or privilege escalation.(CVE-2023-35788)

An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in saa7134_finidev in drivers/media/pci/saa7134/saa7134-core.c.(CVE-2023-35823)

An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in dm1105_remove in drivers/media/pci/dm1105/dm1105.c.(CVE-2023-35824)

An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in renesas_usb3_remove in drivers/usb/gadget/udc/renesas_usb3.c.(CVE-2023-35828)

The Linux Kernel, the operating system core itself.

Security Fix(es):

A known cache speculation vulnerability, known as Branch History Injection (BHI) or Spectre-BHB, becomes actual again for the new hw AmpereOne. Spectre-BHB is similar to Spectre v2, except that malicious code uses the shared branch history (stored in the CPU Branch History Buffer, or BHB) to influence mispredicted branches within the victim's hardware context. Once that occurs, speculation caused by the mispredicted branches can cause cache allocation. This issue leads to obtaining information that should not be accessible.(CVE-2023-3006)

An issue was discovered in drivers/media/dvb-core/dvb_frontend.c in the Linux kernel 6.2. There is a blocking operation when a task is in !TASK_RUNNING. In dvb_frontend_get_event, wait_event_interruptible is called; the condition is dvb_frontend_test_event(fepriv,events). In dvb_frontend_test_event, down(&fepriv->sem) is called. However, wait_event_interruptible would put the process to sleep, and down(&fepriv->sem) may block the process.(CVE-2023-31084)

A flaw was found in the Framebuffer Console (fbcon) in the Linux Kernel. When providing font->width and font->height greater than 32 to fbcon_set_font, since there are no checks in place, a shift-out-of-bounds occurs leading to undefined behavior and possible denial of service.(CVE-2023-3161)

A NULL pointer dereference issue was found in the gfs2 file system in the Linux kernel. It occurs on corrupt gfs2 file systems when the evict code tries to reference the journal descriptor structure after it has been freed and set to NULL. A privileged local user could use this flaw to cause a kernel panic.(CVE-2023-3212)

** DISPUTED ** An issue was discovered in the Linux kernel before 6.3.3. There is an out-of-bounds read in crc16 in lib/crc16.c when called from fs/ext4/super.c because ext4_group_desc_csum does not properly check an offset. NOTE: this is disputed by third parties because the kernel is not intended to defend against attackers with the stated "When modifying the block device while it is mounted by the filesystem" access.(CVE-2023-34256)

An issue was discovered in fl_set_geneve_opt in net/sched/cls_flower.c in the Linux kernel before 6.3.7. It allows an out-of-bounds write in the flower classifier code via TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets. This may result in denial of service or privilege escalation.(CVE-2023-35788)

An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in saa7134_finidev in drivers/media/pci/saa7134/saa7134-core.c.(CVE-2023-35823)

An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in dm1105_remove in drivers/media/pci/dm1105/dm1105.c.(CVE-2023-35824)

An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in renesas_usb3_remove in drivers/usb/gadget/udc/renesas_usb3.c.(CVE-2023-35828)

The Linux Kernel, the operating system core itself.

Security Fix(es):

An issue was discovered in drivers/media/dvb-core/dvb_frontend.c in the Linux kernel 6.2. There is a blocking operation when a task is in !TASK_RUNNING. In dvb_frontend_get_event, wait_event_interruptible is called; the condition is dvb_frontend_test_event(fepriv,events). In dvb_frontend_test_event, down(&fepriv->sem) is called. However, wait_event_interruptible would put the process to sleep, and down(&fepriv->sem) may block the process.(CVE-2023-31084)

A flaw was found in the Framebuffer Console (fbcon) in the Linux Kernel. When providing font->width and font->height greater than 32 to fbcon_set_font, since there are no checks in place, a shift-out-of-bounds occurs leading to undefined behavior and possible denial of service.(CVE-2023-3161)

A NULL pointer dereference issue was found in the gfs2 file system in the Linux kernel. It occurs on corrupt gfs2 file systems when the evict code tries to reference the journal descriptor structure after it has been freed and set to NULL. A privileged local user could use this flaw to cause a kernel panic.(CVE-2023-3212)

** DISPUTED ** An issue was discovered in the Linux kernel before 6.3.3. There is an out-of-bounds read in crc16 in lib/crc16.c when called from fs/ext4/super.c because ext4_group_desc_csum does not properly check an offset. NOTE: this is disputed by third parties because the kernel is not intended to defend against attackers with the stated "When modifying the block device while it is mounted by the filesystem" access.(CVE-2023-34256)

An issue was discovered in fl_set_geneve_opt in net/sched/cls_flower.c in the Linux kernel before 6.3.7. It allows an out-of-bounds write in the flower classifier code via TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets. This may result in denial of service or privilege escalation.(CVE-2023-35788)

An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in saa7134_finidev in drivers/media/pci/saa7134/saa7134-core.c.(CVE-2023-35823)

An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in dm1105_remove in drivers/media/pci/dm1105/dm1105.c.(CVE-2023-35824)

An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in renesas_usb3_remove in drivers/usb/gadget/udc/renesas_usb3.c.(CVE-2023-35828)

The Linux Kernel, the operating system core itself.

Security Fix(es):

An out-of-bounds read vulnerability was found in the SR-IPv6 implementation in the Linux kernel. Quoting ZDI security advisory [1]:

"This vulnerability allows local attackers to disclose sensitive information on affected installations of the Linux Kernel. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the processing of seg6 attributes. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute arbitrary code in the context of the kernel."

[1] https://www.zerodayinitiative.com/advisories/ZDI-CAN-18511/(CVE-2023-2860)

A known cache speculation vulnerability, known as Branch History Injection (BHI) or Spectre-BHB, becomes actual again for the new hw AmpereOne. Spectre-BHB is similar to Spectre v2, except that malicious code uses the shared branch history (stored in the CPU Branch History Buffer, or BHB) to influence mispredicted branches within the victim's hardware context. Once that occurs, speculation caused by the mispredicted branches can cause cache allocation. This issue leads to obtaining information that should not be accessible.(CVE-2023-3006)

A use after free issue was discovered in driver/firewire in outbound_phy_packet_callback in the Linux Kernel. In this flaw a local attacker with special privilege may cause a use after free problem when queue_event() fails.(CVE-2023-3159)

A flaw was found in the Framebuffer Console (fbcon) in the Linux Kernel. When providing font->width and font->height greater than 32 to fbcon_set_font, since there are no checks in place, a shift-out-of-bounds occurs leading to undefined behavior and possible denial of service.(CVE-2023-3161)

** DISPUTED ** An issue was discovered in the Linux kernel before 6.3.3. There is an out-of-bounds read in crc16 in lib/crc16.c when called from fs/ext4/super.c because ext4_group_desc_csum does not properly check an offset. NOTE: this is disputed by third parties because the kernel is not intended to defend against attackers with the stated "When modifying the block device while it is mounted by the filesystem" access.(CVE-2023-34256)

An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in saa7134_finidev in drivers/media/pci/saa7134/saa7134-core.c.(CVE-2023-35823)

An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in renesas_usb3_remove in drivers/usb/gadget/udc/renesas_usb3.c.(CVE-2023-35828)

A flaw was found in the Framebuffer Console (fbcon) in the Linux Kernel. When providing font->width and font->height greater than 32 to fbcon_set_font, since there are no checks in place, a shift-out-of-bounds occurs leading to undefined behavior and possible denial of service.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: tun: avoid double free in tun_free_netdev (CVE-2022-4744)
• kernel: net/sched: multiple vulnerabilities (CVE-2023-3609, CVE-2023-3611, CVE-2023-4128, CVE-2023-4206, CVE-2023-4207, CVE-2023-4208)
• kernel: out-of-bounds write in qfq_change_class function (CVE-2023-31436)
• kernel: out-of-bounds write in hw_atl_utils_fw_rpc_wait (CVE-2021-43975)
• kernel: Rate limit overflow messages in r8152 in intr_callback (CVE-2022-3594)
• kernel: use after free flaw in l2cap_conn_del (CVE-2022-3640)
• kernel: double free in usb_8dev_start_xmit (CVE-2022-28388)
• kernel: vmwgfx: multiple vulnerabilities (CVE-2022-38457, CVE-2022-40133, CVE-2023-33951, CVE-2023-33952)
• hw: Intel: Gather Data Sampling (GDS) side channel vulnerability (CVE-2022-40982)
• kernel: Information leak in l2cap_parse_conf_req (CVE-2022-42895)
• kernel: KVM: multiple vulnerabilities (CVE-2022-45869, CVE-2023-4155, CVE-2023-30456)
• kernel: memory leak in ttusb_dec_exit_dvb (CVE-2022-45887)
• kernel: speculative pointer dereference in do_prlimit (CVE-2023-0458)
• kernel: use-after-free due to race condition in qdisc_graft (CVE-2023-0590)
• kernel: x86/mm: Randomize per-cpu entry area (CVE-2023-0597)
• kernel: HID: check empty report_list in hid_validate_values (CVE-2023-1073)
• kernel: sctp: fail if no bound addresses can be used for a given scope (CVE-2023-1074)
• kernel: hid: Use After Free in asus_remove (CVE-2023-1079)
• kernel: use-after-free in drivers/media/rc/ene_ir.c (CVE-2023-1118)
• kernel: hash collisions in the IPv6 connection lookup table (CVE-2023-1206)
• kernel: ovl: fix use after free in struct ovl_aio_req (CVE-2023-1252)
• kernel: denial of service in tipc_conn_close (CVE-2023-1382)
• kernel: Use after free bug in btsdio_remove due to race condition (CVE-2023-1989)
• kernel: Spectre v2 SMT mitigations problem (CVE-2023-1998)
• kernel: ext4: use-after-free in ext4_xattr_set_entry (CVE-2023-2513)
• kernel: fbcon: shift-out-of-bounds in fbcon_set_font (CVE-2023-3161)
• kernel: out-of-bounds access in relay_file_read (CVE-2023-3268)
• kernel: xfrm: NULL pointer dereference in xfrm_update_ae_params (CVE-2023-3772)
• kernel: smsusb: use-after-free caused by do_submit_urb (CVE-2023-4132)
• kernel: Race between task migrating pages and another task calling exit_mmap (CVE-2023-4732)
• Kernel: denial of service in atm_tc_enqueue due to type confusion (CVE-2023-23455)
• kernel: mpls: double free on sysctl allocation failure (CVE-2023-26545)
• kernel: Denial of service issue in az6027 driver (CVE-2023-28328)
• kernel: lib/seq_buf.c has a seq_buf_putmem_hex buffer overflow (CVE-2023-28772)
• kernel: blocking operation in dvb_frontend_get_event and wait_event_interruptible (CVE-2023-31084)
• kernel: net: qcom/emac: race condition leading to use-after-free in emac_remove (CVE-2023-33203)
• kernel: saa7134: race condition leading to use-after-free in saa7134_finidev (CVE-2023-35823)
• kernel: dm1105: race condition leading to use-after-free in dm1105_remove.c (CVE-2023-35824)
• kernel: r592: race condition leading to use-after-free in r592_remove (CVE-2023-35825)
• kernel: net/tls: tls_is_tx_ready() checked list_entry (CVE-2023-1075)
• kernel: use-after-free bug in remove function xgene_hwmon_remove (CVE-2023-1855)
• kernel: Use after free bug in r592_remove (CVE-2023-3141)
• kernel: gfs2: NULL pointer dereference in gfs2_evict_inode (CVE-2023-3212)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

• Bionic update: upstream stable patchset 2021-11-12 (LP: #1950816) // CVE- url: https://ubuntu.com/security/CVE-2021-20321
  • ovl: fix missing negative dentry check in ovl_rename()
• CVE-url: https://ubuntu.com/security/CVE-2021-20321
  • ovl: cleanup unused var in rename2
• Jammy update: v5.15.93 upstream stable release (LP: #2012665) // CVE-url: https://ubuntu.com/security/CVE-2023-3161
  • fbcon: Check font dimension limits
• CVE-url: https://ubuntu.com/security/CVE-2021-3753
  • vt_kdsetmode: extend console locking
• Jammy update: v5.15.75 upstream stable release (LP: #1996825) // CVE-url: https://ubuntu.com/security/CVE-2022-1184
  • ext4: fix check for block being out of directory size
• Jammy update: v5.15.61 upstream stable release (LP: #1990162) // CVE-url: https://ubuntu.com/security/CVE-2022-1184
  • ext4: check if directory block is within i_size
• Jammy update: v5.15.104 upstream stable release (LP: #2023225) // CVE-url: https://ubuntu.com/security/CVE-2023-1990
  • nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition
• CVE-url: https://ubuntu.com/security/CVE-2023-3090
  • ipvlan:Fix out-of-bounds caused by unclear skb->cb
• Jammy update: v5.15.63 upstream stable release (LP: #1990564) // CVE-url: https://ubuntu.com/security/CVE-2023-3111
  • btrfs: unset reloc control if transaction commit fails in prepare_to_relocate()
• CVE-url: https://ubuntu.com/security/CVE-2023-3111
  • Btrfs: fill relocation block rsv after allocation
  • btrfs: check return value of btrfs_commit_transaction in relocation
• CVE-url: https://ubuntu.com/security/CVE-2023-3141
  • memstick: r592: Fix UAF bug in r592_remove due to race condition
• CVE-url: https://ubuntu.com/security/CVE-2023-3212
  • gfs2: Don't deref jdesc in evict
• CVE-url: https://ubuntu.com/security/CVE-2023-3268
  • kernel/relay.c: fix read_pos error when multiple readers
  • relayfs: fix out-of-bounds access in relay_file_read
• CVE-url: https://ubuntu.com/security/CVE-2023-3390
  • netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE
• CVE-url: https://ubuntu.com/security/CVE-2023-35824
  • media: dm1105: Fix use after free bug in dm1105_remove due to race condition

• Bionic update: upstream stable patchset 2021-11-12 (LP: #1950816) // CVE- url: https://ubuntu.com/security/CVE-2021-20321
  • ovl: fix missing negative dentry check in ovl_rename()
• CVE-url: https://ubuntu.com/security/CVE-2021-20321
  • ovl: cleanup unused var in rename2
• Jammy update: v5.15.93 upstream stable release (LP: #2012665) // CVE-url: https://ubuntu.com/security/CVE-2023-3161
  • fbcon: Check font dimension limits
• CVE-url: https://ubuntu.com/security/CVE-2021-3753
  • vt_kdsetmode: extend console locking
• Jammy update: v5.15.75 upstream stable release (LP: #1996825) // CVE-url: https://ubuntu.com/security/CVE-2022-1184
  • ext4: fix check for block being out of directory size
• Jammy update: v5.15.61 upstream stable release (LP: #1990162) // CVE-url: https://ubuntu.com/security/CVE-2022-1184
  • ext4: check if directory block is within i_size
• Jammy update: v5.15.104 upstream stable release (LP: #2023225) // CVE-url: https://ubuntu.com/security/CVE-2023-1990
  • nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition
• CVE-url: https://ubuntu.com/security/CVE-2023-3090
  • ipvlan:Fix out-of-bounds caused by unclear skb->cb
• Jammy update: v5.15.63 upstream stable release (LP: #1990564) // CVE-url: https://ubuntu.com/security/CVE-2023-3111
  • btrfs: unset reloc control if transaction commit fails in prepare_to_relocate()
• CVE-url: https://ubuntu.com/security/CVE-2023-3111
  • Btrfs: fill relocation block rsv after allocation
  • btrfs: check return value of btrfs_commit_transaction in relocation
• CVE-url: https://ubuntu.com/security/CVE-2023-3141
  • memstick: r592: Fix UAF bug in r592_remove due to race condition
• CVE-url: https://ubuntu.com/security/CVE-2023-3212
  • gfs2: Don't deref jdesc in evict
• CVE-url: https://ubuntu.com/security/CVE-2023-3268
  • kernel/relay.c: fix read_pos error when multiple readers
  • relayfs: fix out-of-bounds access in relay_file_read
• CVE-url: https://ubuntu.com/security/CVE-2023-3390
  • netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE
• CVE-url: https://ubuntu.com/security/CVE-2023-35824
  • media: dm1105: Fix use after free bug in dm1105_remove due to race condition

• net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv() {CVE-2024-26882}
• tls: fix use-after-free on failed backlog decryption {CVE-2024-26800}
• tls: separate no-async decryption request handling from async {CVE-2024-26584}
• tls: decrement decrypt_pending if no async completion will be called {CVE-2024-26584}
• net: tls: fix use-after-free with partial reads and async decrypt {CVE-2024-26582}
• net: tls: handle backlogging of crypto requests {CVE-2024-26584}
• net: tls: factor out tls_*crypt_async_wait()
• tap: tap_open(): correctly initialize socket uid {CVE-2023-1076}
• tun: tun_chr_open(): correctly initialize socket uid {CVE-2023-1076}
• net: add sock_init_data_uid() {CVE-2023-1076}
• netfilter: nf_tables: bail out on mismatching dynset and set expressions {CVE-2023-6622}
• drm/qxl: fix UAF on handle creation {CVE-2023-39198}
• smb: client: fix use-after-free bug in cifs_debug_data_proc_show() {CVE-2023-52752}
• USB: core: Fix deadlock in port "disable" sysfs attribute {CVE-2024-26933}
• USB: core: Add hub_get() and hub_put() routines {CVE-2024-26933}
• USB: core: Fix deadlock in usb_deauthorize_interface() {CVE-2024-26934}
• scsi: qla2xxx: Fix double free of fcport {CVE-2024-26929}
• netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() {CVE-2024-27020}
• net: ip_tunnel: prevent perpetual headroom growth {CVE-2024-26804}
• netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout {CVE-2024-26643}
• netfilter: nf_tables: disallow anonymous set with timeout flag {CVE-2024-26642}
• netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations {CVE-2024-26673}
• ipv6: sr: fix possible use-after-free and null-ptr-deref {CVE-2024-26735}
• fs: sysfs: Fix reference leak in sysfs_break_active_protection() {CVE-2024-26993}
• cifs: fix underflow in parse_server_interfaces() {CVE-2024-26828}
• mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path {CVE-2024-26595}
• mlxsw: spectrum_acl_tcam: Move devlink param to TCAM code {CVE-2024-26595}
• mlxsw: spectrum_acl_tcam: Make fini symmetric to init {CVE-2024-26595}
• mlxsw: spectrum_acl_tcam: Add missing mutex_destroy() {CVE-2024-26595}
• net: xfrm: Fix xfrm_address_filter OOB read {CVE-2023-39194}
• exfat: check if filename entries exceeds max filename length {CVE-2023-4273}
• xfrm: add NULL check in xfrm_update_ae_params {CVE-2023-3772}
• firmware: arm_scmi: Harden accesses to the reset domains {CVE-2022-48655}
• tcp: Reduce chance of collisions in inet6_hashfn(). {CVE-2023-1206}
• ipv4: fix null-deref in ipv4_link_failure {CVE-2023-42754}
• netfilter: nfnetlink_osf: avoid OOB read {CVE-2023-39189}
• netfilter: xt_sctp: validate the flag_info count {CVE-2023-39193}
• net: qcom/emac: Fix use after free bug in emac_remove due to race condition {CVE-2023-33203}
• net/tls: tls_is_tx_ready() checked list_entry {CVE-2023-1075}
• HID: asus: use spinlock to safely schedule workers {CVE-2023-1079}
• HID: asus: use spinlock to protect concurrent accesses {CVE-2023-1079}
• HID: intel_ish-hid: Add check for ishtp_dma_tx_map {CVE-2023-3358}
• gfs2: Don't deref jdesc in evict {CVE-2023-3212}
• fbcon: Check font dimension limits {CVE-2023-3161}
• KVM: nVMX: add missing consistency checks for CR0 and CR4 {CVE-2023-30456}
• hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition {CVE-2023-1855}
• Bluetooth: HCI: Fix global-out-of-bounds {CVE-2023-28866}
• HID: check empty report_list in hid_validate_values() {CVE-2023-1073}
• net: mpls: fix stale pointer if allocation fails during device rename {CVE-2023-26545}
• r8152: Rate limit overflow messages {CVE-2022-3594}
• drm/vmwgfx: Fix shader stage validation {CVE-2022-36402}
• Bluetooth: L2CAP: Fix attempting to access uninitialized memory {CVE-2022-42895}
• dm ioctl: fix nested locking in table_clear() to remove deadlock concern {CVE-2023-2269}
• mm/slab_common: fix slab_caches list corruption after kmem_cache_destroy() {CVE-2023-52562} -…

The SUSE Linux Enterprise 15 SP5 AZURE kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-3161: Fixed shift-out-of-bounds in fbcon_set_font() (bsc#1212154).
• CVE-2023-21102: Fixed possible bypass of shadow stack protection in __efi_rt_asm_wrapper of efi-rt-wrapper.S (bsc#1212155).
• CVE-2023-3141: Fixed a use-after-free flaw in r592_remove in drivers/memstick/host/r592.c, that allowed local attackers to crash the system at device disconnect (bsc#1212129).
• CVE-2023-1077: Fixed a type confusion in pick_next_rt_entity(), that could cause memory corruption (bsc#1208600).
• CVE-2023-28410: Fixed improper restriction of operations within the bounds of a memory buffer in some Intel(R) i915 Graphics drivers that may have allowed an authenticated user to potentially enable escalation of privilege via local access (bsc#1211263).
• CVE-2023-2156: Fixed a flaw in the networking subsystem within the handling of the RPL protocol (bsc#1211131).
• CVE-2023-1382: Fixed denial of service in tipc_conn_close (bsc#1209288).
• CVE-2023-33951: Fixed a race condition that could have led to an information disclosure inside the vmwgfx driver (bsc#1211593).
• CVE-2023-33952: Fixed a double free that could have led to a local privilege escalation inside the vmwgfx driver (bsc#1211595).
• CVE-2023-3006: Fixed a known cache speculation vulnerability, known as Branch History Injection (BHI) or Spectre-BHB, for the new hw AmpereOne (bsc#1211855).
• CVE-2023-2269: Fixed a denial-of-service problem due to a possible recursive locking scenario, resulting in a deadlock in table_clear in drivers/md/dm-ioctl.c (bsc#1210806).
• CVE-2023-1079: Fixed a use-after-free problem that could have been triggered in asus_kbd_backlight_set when plugging/disconnecting a malicious USB device (bsc#1208604).
• CVE-2023-2162: Fixed an use-after-free flaw in iscsi_sw_tcp_session_create (bsc#1210647).
• CVE-2023-21106: Fixed possible memory corruption due to double free in adreno_set_param of adreno_gpu.c (bsc#1211654).
• CVE-2023-33288: Fixed a use-after-free in bq24190_remove in drivers/power/supply/bq24190_charger.c (bsc#1211590).
• CVE-2022-45886: Fixed a .disconnect versus dvb_device_open race condition in dvb_net.c that lead to a use-after-free (bsc#1205760).
• CVE-2022-45885: Fixed a race condition in dvb_frontend.c that could cause a use-after-free when a device is disconnected (bsc#1205758).
• CVE-2022-45887: Fixed a memory leak in ttusb_dec.c caused by the lack of a dvb_frontend_detach call (bsc#1205762).
• CVE-2022-45919: Fixed a use-after-free in dvb_ca_en50221.c that could occur if there is a disconnect after an open, because of the lack of a wait_event (bsc#1205803).
• CVE-2022-45884: Fixed a use-after-free in dvbdev.c, related to dvb_register_device dynamically allocating fops (bsc#1205756).
• CVE-2023-31084: Fixed a blocking issue in drivers/media/dvb-core/dvb_frontend.c (bsc#1210783).
• CVE-2023-2002: Fixed a flaw that allowed an attacker to unauthorized execution of management commands, compromising the confidentiality, integrity, and availability of Bluetooth communication (bsc#1210533).
• CVE-2023-31436: Fixed an out-of-bounds write in qfq_change_class() because lmax can exceed QFQ_MIN_LMAX (bsc#1210940).
• CVE-2023-30456: Fixed an issue in arch/x86/kvm/vmx/nested.c with nVMX on x86_64 lacks consistency checks for CR0 and CR4 (bsc#1210294).
• CVE-2022-4269: Fixed a flaw was found inside the Traffic Control (TC) subsystem (bsc#1206024).
• CVE-2023-32233: Fixed a use-after-free in Netfilter nf_tables when processing batch requests (bsc#1211043).
• CVE-2023-1380: Fixed a slab-out-of-bound read problem in brcmf_get_assoc_ies() (bsc#1209287).
• CVE-2023-2513: Fixed a use-after-free vulnerability in the ext4 filesystem (bsc#1211105).
• CVE-2023-2483: Fixed a use after free bug in emac_remove caused by a race condition (bsc#1211037).
• CVE-2023-2124: Fixed an out-of-bound access in the XFS subsystem…

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-35828: Fixed a use-after-free flaw inside renesas_usb3_remove in drivers/usb/gadget/udc/renesas_usb3.c (bsc#1212513).
• CVE-2023-35823: Fixed a use-after-free in saa7134_finidev in drivers/media/pci/saa7134/saa7134-core.c (bsc#1212494).
• CVE-2023-35788: Fixed an out-of-bounds write in the flower classifier code via TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets in fl_set_geneve_opt in net/sched/cls_flower.c (bsc#1212504).
• CVE-2023-33288: Fixed a use-after-free in bq24190_remove in drivers/power/supply/bq24190_charger.c (bsc#1211590).
• CVE-2023-32233: Fixed a use-after-free in Netfilter nf_tables when processing batch requests (bsc#1211043).
• CVE-2023-3161: Fixed shift-out-of-bounds in fbcon_set_font() (bsc#1212154).
• CVE-2023-31436: Fixed an out-of-bounds write in qfq_change_class() because lmax can exceed QFQ_MIN_LMAX (bsc#1210940).
• CVE-2023-3141: Fixed a use-after-free flaw in r592_remove in drivers/memstick/host/r592.c, that allowed local attackers to crash the system at device disconnect (bsc#1212129).
• CVE-2023-31084: Fixed a blocking issue in drivers/media/dvb-core/dvb_frontend.c (bsc#1210783).
• CVE-2023-30456: Fixed an issue in arch/x86/kvm/vmx/nested.c with nVMX on x86_64 lacks consistency checks for CR0 and CR4 (bsc#1210294).
• CVE-2023-3006: Fixed a known cache speculation vulnerability, known as Branch History Injection (BHI) or Spectre-BHB, for the new hw AmpereOne (bsc#1211855).
• CVE-2023-28410: Fixed improper restriction of operations within the bounds of a memory buffer in some Intel(R) i915 Graphics drivers that may have allowed an authenticated user to potentially enable escalation of privilege via local access (bsc#1211263).
• CVE-2023-2513: Fixed a use-after-free vulnerability in the ext4 filesystem (bsc#1211105).
• CVE-2023-2483: Fixed a use after free bug in emac_remove due caused by a race condition (bsc#1211037).
• CVE-2023-2269: Fixed a denial-of-service problem due to a possible recursive locking scenario, resulting in a deadlock in table_clear in drivers/md/dm-ioctl.c (bsc#1210806).
• CVE-2023-2162: Fixed an use-after-free flaw in iscsi_sw_tcp_session_create (bsc#1210647).
• CVE-2023-2156: Fixed a flaw in the networking subsystem within the handling of the RPL protocol (bsc#1211131).
• CVE-2023-2124: Fixed an out-of-bound access in the XFS subsystem that could have lead to denial-of-service or potentially privilege escalation (bsc#1210498).
• CVE-2023-21102: Fixed possible bypass of shadow stack protection in __efi_rt_asm_wrapper of efi-rt-wrapper.S (bsc#1212155).
• CVE-2023-2002: Fixed a flaw that allowed an attacker to unauthorized execution of management commands, compromising the confidentiality, integrity, and availability of Bluetooth communication (bsc#1210533).
• CVE-2023-1382: Fixed denial of service in tipc_conn_close (bsc#1209288).
• CVE-2023-1380: Fixed a slab-out-of-bound read problem in brcmf_get_assoc_ies() (bsc#1209287).
• CVE-2023-1249: Fixed a use-after-free flaw inside the core dump subsystem, that could have been used to crash the system (bsc#1209039).
• CVE-2023-1079: Fixed a use-after-free problem that could have been triggered in asus_kbd_backlight_set when plugging/disconnecting a malicious USB device (bsc#1208604).
• CVE-2023-1077: Fixed a type confusion in pick_next_rt_entity(), that could cause memory corruption (bsc#1208600).
• CVE-2022-45919: Fixed a use-after-free in dvb_ca_en50221.c that could occur if there is a disconnect after an open, because of the lack of a wait_event (bsc#1205803).
• CVE-2022-45887: Fixed a memory leak in ttusb_dec.c caused by the lack of a dvb_frontend_detach call (bsc#1205762).
• CVE-2022-45886: Fixed a .disconnect versus dvb_device_open race condition in dvb_net.c that lead to a use-after-free (bsc#1205760).
• CVE-2022-45885: Fixed a race condition in dvb_frontend.c that could cause a…

The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-3090: Fixed a heap out-of-bounds write in the ipvlan network driver (bsc#1212842).
• CVE-2023-3111: Fixed a use-after-free vulnerability in prepare_to_relocate in fs/btrfs/relocation.c (bsc#1212051).
• CVE-2023-3358: Fixed a NULL pointer dereference flaw in the Integrated Sensor Hub (ISH) driver (bsc#1212606).
• CVE-2023-1249: Fixed a use-after-free flaw in the core dump subsystem that allowed a local user to crash the system (bsc#1209039).
• CVE-2023-3268: Fixed an out of bounds (OOB) memory access flaw in relay_file_read_start_pos in kernel/relay.c (bsc#1212502).
• CVE-2023-2002: Fixed a flaw that allowed an attacker to unauthorized execution of management commands, compromising the confidentiality, integrity, and availability of Bluetooth communication (bsc#1210533).
• CVE-2023-35824: Fixed a use-after-free in dm1105_remove in drivers/media/pci/dm1105/dm1105.c (bsc#1212501).
• CVE-2023-3161: Fixed shift-out-of-bounds in fbcon_set_font() (bsc#1212154).
• CVE-2023-3141: Fixed a use-after-free flaw in r592_remove in drivers/memstick/host/r592.c, that allowed local attackers to crash the system at device disconnect (bsc#1212129).
• CVE-2023-3159: Fixed use-after-free issue in driver/firewire in outbound_phy_packet_callback (bsc#1212128).
• CVE-2023-1077: Fixed a type confusion in pick_next_rt_entity(), that could cause memory corruption (bsc#1208600).
• CVE-2023-1637: Fixed vulnerability that could lead to unauthorized access to CPU memory after resuming CPU from suspend-to-RAM (bsc#1209779).
• CVE-2023-1079: Fixed a use-after-free problem that could have been triggered in asus_kbd_backlight_set when plugging/disconnecting a malicious USB device (bsc#1208604).

The following non-security bugs were fixed:

• Decrease the number of SMB3 smbdirect client SGEs (bsc#1190317).
• Drop dvb-core fix patch due to bug (bsc#1205758).
• Fix formatting of client smbdirect RDMA logging (bsc#1190317).
• Fix missing top level chapter numbers on SLE12 SP5 (bsc#1212158).
• Fix usrmerge error (boo#1211796)
• Handle variable number of SGEs in client smbdirect send (bsc#1190317).
• Reduce client smbdirect max receive segment size (bsc#1190317).
• Squashfs: fix handling and sanity checking of xattr_ids count (git-fixes).
• affs: initialize fsdata in affs_truncate() (git-fixes).
• bnx2x: Check if transceiver implements DDM before access (git-fixes).
• bnxt_en: Fix mqprio and XDP ring checking logic (git-fixes).
• bnxt_en: Fix typo in PCI id to device description string mapping (git-fixes).
• bnxt_en: Query default VLAN before VNIC setup on a VF (git-fixes).
• bnxt_en: Remove debugfs when pci_register_driver failed (git-fixes).
• bnxt_en: fix NQ resource accounting during vf creation on 57500 chips (git-fixes).
• bnxt_en: fix potentially incorrect return value for ndo_rx_flow_steer (git-fixes).
• bnxt_en: reclaim max resources if sriov enable fails (git-fixes).
• bonding: show full hw address in sysfs for slave entries (git-fixes).
• cdc-ncm: avoid overflow in sanity checking (git-fixes).
• ceph: fix use-after-free bug for inodes when flushing capsnaps (bsc#1212938).
• cifs: Add helper function to check smb1+ server (bsc#1190317).
• cifs: Convert struct fealist away from 1-element array (bsc#1190317).
• cifs: Fix connections leak when tlink setup failed (bsc#1190317).
• cifs: Fix lost destroy smbd connection when MR allocate failed (bsc#1190317).
• cifs: Fix memory leak when build ntlmssp negotiate blob failed (bsc#1190317).
• cifs: Fix oops due to uncleared server->smbd_conn in reconnect (bsc#1190317).
• cifs: Fix pages array leak when writedata alloc failed in cifs_writedata_alloc() (bsc#1190317).
• cifs: Fix pages leak when writedata alloc failed in cifs_write_from_iter() (bsc#1190317).
• cifs: Fix smb2_set_path_size() (bsc#1190317).
• cifs: Fix the error length of VALIDATE_NEGOTIATE_INFO message…

The SUSE Linux Enterprise 12 SP2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2017-5753: Fixed spectre vulnerability in prlimit (bsc#1209256).
• CVE-2022-3566: Fixed race condition in the TCP Handler (bsc#1204405).
• CVE-2022-45884: Fixed a use-after-free in dvbdev.c, related to dvb_register_device dynamically allocating fops (bsc#1205756).
• CVE-2022-45885: Fixed a race condition in dvb_frontend.c that could cause a use-after-free when a device is disconnected (bsc#1205758).
• CVE-2022-45886: Fixed a .disconnect versus dvb_device_open race condition in dvb_net.c that lead to a use-after-free (bsc#1205760).
• CVE-2022-45887: Fixed a memory leak in ttusb_dec.c caused by the lack of a dvb_frontend_detach call (bsc#1205762).
• CVE-2022-45919: Fixed a use-after-free in dvb_ca_en50221.c that could occur if there is a disconnect after an open, because of the lack of a wait_event (bsc#1205803).
• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2023-1077: Fixed a type confusion in pick_next_rt_entity(), that could cause memory corruption (bsc#1208600).
• CVE-2023-1095: Fixed a NULL pointer dereference in nf_tables due to zeroed list head (bsc#1208777).
• CVE-2023-1118: Fixed a use-after-free bugs caused by ene_tx_irqsim() in media/rc (bsc#1208837).
• CVE-2023-1249: Fixed a use-after-free flaw in the core dump subsystem that allowed a local user to crash the system (bsc#1209039).
• CVE-2023-1380: Fixed a slab-out-of-bound read problem in brcmf_get_assoc_ies() (bsc#1209287).
• CVE-2023-1390: Fixed remote DoS vulnerability in tipc_link_xmit() (bsc#1209289).
• CVE-2023-1513: Fixed an uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak (bsc#1209532).
• CVE-2023-1611: Fixed an use-after-free flaw in btrfs_search_slot (bsc#1209687).
• CVE-2023-1670: Fixed a use after free in the Xircom 16-bit PCMCIA Ethernet driver. A local user could use this flaw to crash the system or potentially escalate their privileges on the system (bsc#1209871).
• CVE-2023-1989: Fixed a use after free in btsdio_remove (bsc#1210336).
• CVE-2023-1990: Fixed a use after free in ndlc_remove (bsc#1210337).
• CVE-2023-1998: Fixed a use after free during login when accessing the shost ipaddress (bsc#1210506).
• CVE-2023-2124: Fixed an out-of-bound access in the XFS subsystem that could have lead to denial-of-service or potentially privilege escalation (bsc#1210498).
• CVE-2023-2162: Fixed an use-after-free flaw in iscsi_sw_tcp_session_create (bsc#1210647).
• CVE-2023-2194: Fixed an out-of-bounds write vulnerability in the SLIMpro I2C device driver (bsc#1210715).
• CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207036).
• CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (bsc#1207125).
• CVE-2023-2513: Fixed a use-after-free vulnerability in the ext4 filesystem (bsc#1211105).
• CVE-2023-28328: Fixed a denial of service issue in az6027 driver in drivers/media/usb/dev-usb/az6027.c (bsc#1209291).
• CVE-2023-28464: Fixed user-after-free that could lead to privilege escalation in hci_conn_cleanup in net/uetooth/hci_conn.c (bsc#1209052).
• CVE-2023-28772: Fixed buffer overflow in seq_buf_putmem_hex in lib/seq_buf.c (bsc#1209549).
• CVE-2023-30772: Fixed race condition and resultant use-after-free in da9150_charger_remove (bsc#1210329).
• CVE-2023-3090: Fixed a heap out-of-bounds write in the ipvlan network driver (bsc#1212842).
• CVE-2023-3141: Fixed a use-after-free flaw in r592_remove in drivers/memstick/host/r592.c, that allowed local attackers to crash the system at device disconnect (bsc#1212129).
• CVE-2023-31436: Fixed an out-of-bounds write in qfq_change_class() because lmax can exceed QFQ_MIN_LMAX (bsc#1210940). -…

The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-1077: Fixed a type confusion in pick_next_rt_entity(), that could cause memory corruption (bsc#1208600).
• CVE-2023-1079: Fixed a use-after-free problem that could have been triggered in asus_kbd_backlight_set when plugging/disconnecting a malicious USB device (bsc#1208604).
• CVE-2023-1249: Fixed a use-after-free flaw in the core dump subsystem that allowed a local user to crash the system (bsc#1209039).
• CVE-2023-1637: Fixed vulnerability that could lead to unauthorized access to CPU memory after resuming CPU from suspend-to-RAM (bsc#1209779).
• CVE-2023-2002: Fixed a flaw that allowed an attacker to unauthorized execution of management commands, compromising the confidentiality, integrity, and availability of Bluetooth communication (bsc#1210533).
• CVE-2023-3090: Fixed a heap out-of-bounds write in the ipvlan network driver (bsc#1212842).
• CVE-2023-3111: Fixed a use-after-free vulnerability in prepare_to_relocate in fs/btrfs/relocation.c (bsc#1212051).
• CVE-2023-3141: Fixed a use-after-free flaw in r592_remove in drivers/memstick/host/r592.c, that allowed local attackers to crash the system at device disconnect (bsc#1212129).
• CVE-2023-3159: Fixed use-after-free issue in driver/firewire in outbound_phy_packet_callback (bsc#1212128).
• CVE-2023-3161: Fixed shift-out-of-bounds in fbcon_set_font() (bsc#1212154).
• CVE-2023-3268: Fixed an out of bounds (OOB) memory access flaw in relay_file_read_start_pos in kernel/relay.c (bsc#1212502).
• CVE-2023-3358: Fixed a NULL pointer dereference flaw in the Integrated Sensor Hub (ISH) driver (bsc#1212606).
• CVE-2023-35824: Fixed a use-after-free in dm1105_remove in drivers/media/pci/dm1105/dm1105.c (bsc#1212501).

The following non-security bugs were fixed:

• Also include kernel-docs build requirements for ALP
• Avoid unsuported tar parameter on SLE12
• CDC-NCM: avoid overflow in sanity checking (git-fixes).
• CIFS: Spelling s/EACCESS/EACCES/ (bsc#1190317).
• Decrease the number of SMB3 smbdirect client SGEs (bsc#1190317).
• Fix formatting of client smbdirect RDMA logging (bsc#1190317).
• Fix missing top level chapter numbers on SLE12 SP5 (bsc#1212158).
• Generalize kernel-doc build requirements.
• Handle variable number of SGEs in client smbdirect send (bsc#1190317).
• Move obsolete KMP list into a separate file. The list of obsoleted KMPs varies per release, move it out of the spec file.
• Move setting %%build_html to config.sh
• Move setting %%split_optional to config.sh
• Move setting %%supported_modules_check to config.sh
• Move the kernel-binary conflicts out of the spec file. Thie list of conflicting packages varies per release. To reduce merge conflicts move the list out of the spec file.
• PCI/MSI: Clear PCI_MSIX_FLAGS_MASKALL on error (git-fixes).
• PCI/MSI: Destroy sysfs before freeing entries (git-fixes).
• PCI/MSI: Fix pci_irq_vector()/pci_irq_get_affinity() (git-fixes).
• PCI/MSI: Mask MSI-X vectors only on success (git-fixes).
• PCI: Add PCI_EXP_DEVCTL_PAYLOAD_* macros (git-fixes).
• PCI: aardvark: Clear all MSIs at setup (git-fixes).
• PCI: aardvark: Do not clear status bits of masked interrupts (git-fixes).
• PCI: aardvark: Do not unmask unused interrupts (git-fixes).
• PCI: aardvark: Fix return value of MSI domain .alloc() method (git-fixes).
• PCI: aardvark: Read all 16-bits from PCIE_MSI_PAYLOAD_REG (git-fixes).
• PCI: aardvark: Replace custom macros by standard linux/pci_regs.h macros (git-fixes).
• PCI: pciehp: Clear cmd_busy bit in polling mode (git-fixes).
• PCI: pciehp: Fix infinite loop in IRQ handler upon power fault (git-fixes).
• README.BRANCH: Add Miroslav Franc as a co-maintainer
• Reduce client smbdirect max receive segment size (bsc#1190317).
• Squashfs: fix handling and sanity checking of xattr_ids count (git-fixes).
• Trim obsolete KMP list. SLE11 is out of support, we do not need to handle…

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-24588: Fixed a bug that could allow an adversary to abuse devices that support receiving non-SSP A-MSDU frames to inject arbitrary network packets (bsc#1185861).
• CVE-2022-2196: Fixed a regression related to KVM that allowed for speculative execution attacks (bsc#1206992).
• CVE-2022-3523: Fixed a use after free related to device private page handling (bsc#1204363).
• CVE-2022-36280: Fixed out-of-bounds memory access vulnerability found in vmwgfx driver (bsc#1203332).
• CVE-2022-38096: Fixed NULL-ptr deref in vmw_cmd_dx_define_query() (bsc#1203331).
• CVE-2022-4269: Fixed a flaw was found inside the Traffic Control (TC) subsystem (bsc#1206024).
• CVE-2022-45884: Fixed a use-after-free in dvbdev.c, related to dvb_register_device dynamically allocating fops (bsc#1205756).
• CVE-2022-45885: Fixed a race condition in dvb_frontend.c that could cause a use-after-free when a device is disconnected (bsc#1205758).
• CVE-2022-45886: Fixed a .disconnect versus dvb_device_open race condition in dvb_net.c that lead to a use-after-free (bsc#1205760).
• CVE-2022-45887: Fixed a memory leak in ttusb_dec.c caused by the lack of a dvb_frontend_detach call (bsc#1205762).
• CVE-2022-45919: Fixed a use-after-free in dvb_ca_en50221.c that could occur if there is a disconnect after an open, because of the lack of a wait_event (bsc#1205803).
• CVE-2022-4744: Fixed double-free that could lead to DoS or privilege escalation in TUN/TAP device driver functionality (bsc#1209635).
• CVE-2023-0045: Fixed missing Flush IBP in ib_prctl_set (bsc#1207773).
• CVE-2023-0122: Fixed a NULL pointer dereference vulnerability in nvmet_setup_auth(), that allowed an attacker to perform a Pre-Auth Denial of Service (DoS) attack on a remote machine (bsc#1207050).
• CVE-2023-0179: Fixed incorrect arithmetics when fetching VLAN header bits (bsc#1207034).
• CVE-2023-0386: A flaw was found where unauthorized access to the execution of the setuid file with capabilities was found in the OverlayFS subsystem, when a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allowed a local user to escalate their privileges on the system (bsc#1209615).
• CVE-2023-0394: Fixed a null pointer dereference in the network subcomponent. This flaw could cause system crashes (bsc#1207168).
• CVE-2023-0461: Fixed use-after-free in icsk_ulp_data (bsc#1208787).
• CVE-2023-0469: Fixed a use-after-free flaw in io_uring/filetable.c in io_install_fixed_file in the io_uring subcomponent (bsc#1207521).
• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2023-0597: Fixed lack of randomization of per-cpu entry area in x86/mm (bsc#1207845).
• CVE-2023-1075: Fixed a type confusion in tls_is_tx_ready (bsc#1208598).
• CVE-2023-1076: Fixed incorrect UID assigned to tun/tap sockets (bsc#1208599).
• CVE-2023-1077: Fixed a type confusion in pick_next_rt_entity(), that could cause memory corruption (bsc#1208600).
• CVE-2023-1078: Fixed a heap out-of-bounds write in rds_rm_zerocopy_callback (bsc#1208601).
• CVE-2023-1079: Fixed a use-after-free problem that could have been triggered in asus_kbd_backlight_set when plugging/disconnecting a malicious USB device (bsc#1208604).
• CVE-2023-1095: Fixed a NULL pointer dereference in nf_tables due to zeroed list head (bsc#1208777).
• CVE-2023-1118: Fixed a use-after-free bugs caused by ene_tx_irqsim() in media/rc (bsc#1208837).
• CVE-2023-1249: Fixed a use-after-free flaw in the core dump subsystem that allowed a local user to crash the system (bsc#1209039).
• CVE-2023-1382: Fixed denial of service in tipc_conn_close (bsc#1209288).
• CVE-2023-1513: Fixed an uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak (bsc#1209532).
• CVE-2023-1582: Fixed soft lockup in __page_mapcount (bsc#1209636). -…

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-3090: Fixed a heap out-of-bounds write in the ipvlan network driver (bsc#1212842).
• CVE-2023-3358: Fixed a NULL pointer dereference flaw in the Integrated Sensor Hub (ISH) driver (bsc#1212606).
• CVE-2023-35828: Fixed a use-after-free flaw in renesas_usb3_remove in drivers/usb/gadget/udc/renesas_usb3.c (bsc#1212513).
• CVE-2023-1249: Fixed a use-after-free flaw in the core dump subsystem that allowed a local user to crash the system (bsc#1209039).
• CVE-2023-2002: Fixed a flaw that allowed an attacker to unauthorized execution of management commands, compromising the confidentiality, integrity, and availability of Bluetooth communication (bsc#1210533).
• CVE-2023-3268: Fixed an out of bounds (OOB) memory access flaw in relay_file_read_start_pos in kernel/relay.c (bsc#1212502).
• CVE-2023-35824: Fixed a use-after-free in dm1105_remove in drivers/media/pci/dm1105/dm1105.c (bsc#1212501).
• CVE-2023-35823: Fixed a use-after-free flaw in saa7134_finidev in drivers/media/pci/saa7134/saa7134-core.c (bsc#1212494).
• CVE-2023-35788: Fixed an out-of-bounds write in the flower classifier code via TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets in fl_set_geneve_opt in net/sched/cls_flower.c (bsc#1212504).
• CVE-2023-3161: Fixed shift-out-of-bounds in fbcon_set_font() (bsc#1212154).
• CVE-2023-3141: Fixed a use-after-free flaw in r592_remove in drivers/memstick/host/r592.c, that allowed local attackers to crash the system at device disconnect (bsc#1212129).
• CVE-2023-3159: Fixed use-after-free issue in driver/firewire in outbound_phy_packet_callback (bsc#1212128).
• CVE-2023-1077: Fixed a type confusion in pick_next_rt_entity(), that could cause memory corruption (bsc#1208600).

The following non-security bugs were fixed:

• Drivers: hv: vmbus: Optimize vmbus_on_event (bsc#1211622).
• Drivers: vmbus: Check for channel allocation before looking up relids (git-fixes).
• Drop dvb-core fix patch due to bug (bsc#1205758).
• Fix missing top level chapter numbers on SLE12 SP5 (bsc#1212158).
• Fix usrmerge error (boo#1211796)
• Remove obsolete KMP obsoletes (bsc#1210469).
• Replace mkinitrd dependency with dracut (bsc#1202353). Also update mkinitrd refrences in documentation and comments.
• cifs: do not include page data when checking signature (bsc#1200217).
• cifs: fix negotiate context parsing (bsc#1210301).
• cifs: fix open leaks in open_cached_dir() (bsc#1209342).
• google/gve:fix repeated words in comments (bsc#1211519).
• gve: Adding a new AdminQ command to verify driver (bsc#1211519).
• gve: Cache link_speed value from device (bsc#1211519).
• gve: Fix GFP flags when allocing pages (bsc#1211519).
• gve: Fix error return code in gve_prefill_rx_pages() (bsc#1211519).
• gve: Fix spelling mistake 'droping' -> 'dropping' (bsc#1211519).
• gve: Handle alternate miss completions (bsc#1211519).
• gve: Reduce alloc and copy costs in the GQ rx path (bsc#1211519).
• gve: Remove the code of clearing PBA bit (bsc#1211519).
• gve: Secure enough bytes in the first TX desc for all TCP pkts (bsc#1211519).
• gve: enhance no queue page list detection (bsc#1211519).
• ipv6: sr: fix out-of-bounds read when setting HMAC data (bsc#1211592).
• k-m-s: Drop Linux 2.6 support
• kernel-binary: install expoline.o (boo#1210791 bsc#1211089)
• keys: Fix linking a duplicate key to a keyring's assoc_array (bsc#1207088).
• rpm/kernel-binary.spec.in: Add Provides of kernel-preempt (jsc#SLE-18857) For smooth migration with the former kernel-preempt user, kernel-default provides kernel-preempt now when CONFIG_PREEMPT_DYNAMIC is defined.
• rpm/kernel-binary.spec.in: Fix compatibility wth newer rpm
• rpm/kernel-binary.spec.in: Fix missing kernel-preempt-devel and KMP Provides (bsc#1199046)
• rpm/kernel-docs.spec.in: pass PYTHON=python3 to fix build error (bsc#1160435)
• s390,dcssblk,dax: Add dax zero_page_range operation to dcssblk…

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).
• CVE-2023-3389: Fixed a use-after-free vulnerability in the io_uring subsystem (bsc#1212838).
• CVE-2023-3090: Fixed a heap out-of-bounds write in the ipvlan network driver (bsc#1212842).
• CVE-2023-3111: Fixed a use-after-free vulnerability in prepare_to_relocate in fs/btrfs/relocation.c (bsc#1212051).
• CVE-2023-3212: Fixed a NULL pointer dereference flaw in the gfs2 file system (bsc#1212265).
• CVE-2023-3358: Fixed a NULL pointer dereference flaw in the Integrated Sensor Hub (ISH) driver (bsc#1212606).
• CVE-2023-3357: Fixed a NULL pointer dereference flaw in the AMD Sensor Fusion Hub driver (bsc#1212605).
• CVE-2023-35828: Fixed a use-after-free flaw in renesas_usb3_remove in drivers/usb/gadget/udc/renesas_usb3.c (bsc#1212513).
• CVE-2023-1249: Fixed a use-after-free flaw in the core dump subsystem that allowed a local user to crash the system (bsc#1209039).
• CVE-2023-35829: Fixed a use-after-free flaw in rkvdec_remove in drivers/staging/media/rkvdec/rkvdec.c (bsc#1212495).
• CVE-2023-35788: Fixed an out-of-bounds write in the flower classifier code via TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets in fl_set_geneve_opt in net/sched/cls_flower.c (bsc#1212504).
• CVE-2023-35823: Fixed a use-after-free flaw in saa7134_finidev in drivers/media/pci/saa7134/saa7134-core.c (bsc#1212494).
• CVE-2023-3161: Fixed shift-out-of-bounds in fbcon_set_font() (bsc#1212154).
• CVE-2023-21102: Fixed possible bypass of shadow stack protection in __efi_rt_asm_wrapper of efi-rt-wrapper.S (bsc#1212155).
• CVE-2023-3141: Fixed a use-after-free flaw in r592_remove in drivers/memstick/host/r592.c, that allowed local attackers to crash the system at device disconnect (bsc#1212129).
• CVE-2023-1077: Fixed a type confusion in pick_next_rt_entity(), that could cause memory corruption (bsc#1208600).

The following non-security bugs were fixed:

• Drop dvb-core fix patch due to a bug (bsc#1205758).
• Enable kernel modules bttv bt878 and snd-bt878 (jsc#PED-3931).
• Fix missing top level chapter numbers on SLE12 SP5 (bsc#1212158).
• Fix usrmerge error (boo#1211796).
• Generalize kernel-doc build requirements.
• Get module prefix from kmod (bsc#1212835).
• Remove orphaned CONFIG_PRINTK_SAFE_LOG_BUF_SHIFT (bsc#1189998 git-fixes).
• Revert 'mtd: rawnand: arasan: Prevent an unsupported configuration' (git-fixes).
• Revert 'net: phy: dp83867: perform soft reset and retain established link' (git-fixes).
• Squashfs: fix handling and sanity checking of xattr_ids count (git-fixes).
• Update the Mellanox/Nvidia mlx5_core driver (jsc#SLE-19253).
• acpi: sleep: Avoid breaking S3 wakeup due to might_sleep() (git-fixes).
• affs: initialize fsdata in affs_truncate() (git-fixes).
• alsa: ac97: Fix possible NULL dereference in snd_ac97_mixer (git-fixes).
• alsa: hda/realtek: Add 'Intel Reference board' and 'NUC 13' SSID in the ALC256 (git-fixes).
• alsa: hda/realtek: Add Lenovo P3 Tower platform (git-fixes).
• alsa: hda/realtek: Add a quirk for Compaq N14JP6 (git-fixes).
• alsa: hda/realtek: Add a quirk for HP Slim Desktop S01 (git-fixes).
• alsa: hda/realtek: Add quirk for ASUS ROG G634Z (git-fixes).
• alsa: hda/realtek: Add quirk for ASUS ROG GV601V (git-fixes).
• alsa: hda/realtek: Add quirk for Clevo NS50AU (git-fixes).
• alsa: hda/realtek: Add quirks for ASUS GU604V and GU603V (git-fixes).
• alsa: hda/realtek: Add quirks for Asus ROG 2024 laptops using CS35L41 (git-fixes).
• alsa: hda/realtek: Add quirks for ROG ALLY CS35l41 audio (git-fixes).
• alsa: hda/realtek: Enable 4 amplifiers instead of 2 on a HP platform (git-fixes).
• alsa: hda/realtek: Enable mute/micmute LEDs and limit mic boost on EliteBook (git-fixes).
• alsa: hda: Glenfly: add HD Audio PCI IDs and HDMI Codec Vendor IDs (git-fixes).
• alsa: oss: avoid…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-3090: Fixed a heap out-of-bounds write in the ipvlan network driver (bsc#1212842).
• CVE-2023-3111: Fixed a use-after-free vulnerability in prepare_to_relocate in fs/btrfs/relocation.c (bsc#1212051).
• CVE-2023-3358: Fixed a NULL pointer dereference flaw in the Integrated Sensor Hub (ISH) driver (bsc#1212606).
• CVE-2023-1249: Fixed a use-after-free flaw in the core dump subsystem that allowed a local user to crash the system (bsc#1209039).
• CVE-2023-3268: Fixed an out of bounds (OOB) memory access flaw in relay_file_read_start_pos in kernel/relay.c (bsc#1212502).
• CVE-2023-2002: Fixed a flaw that allowed an attacker to unauthorized execution of management commands, compromising the confidentiality, integrity, and availability of Bluetooth communication (bsc#1210533).
• CVE-2023-35824: Fixed a use-after-free in dm1105_remove in drivers/media/pci/dm1105/dm1105.c (bsc#1212501).
• CVE-2023-3161: Fixed shift-out-of-bounds in fbcon_set_font() (bsc#1212154).
• CVE-2023-3141: Fixed a use-after-free flaw in r592_remove in drivers/memstick/host/r592.c, that allowed local attackers to crash the system at device disconnect (bsc#1212129).
• CVE-2023-3159: Fixed use-after-free issue in driver/firewire in outbound_phy_packet_callback (bsc#1212128).
• CVE-2023-1077: Fixed a type confusion in pick_next_rt_entity(), that could cause memory corruption (bsc#1208600).
• CVE-2023-1637: Fixed vulnerability that could lead to unauthorized access to CPU memory after resuming CPU from suspend-to-RAM (bsc#1209779).
• CVE-2023-1079: Fixed a use-after-free problem that could have been triggered in asus_kbd_backlight_set when plugging/disconnecting a malicious USB device (bsc#1208604).

The following non-security bugs were fixed:

• Decrease the number of SMB3 smbdirect client SGEs (bsc#1190317).
• Drop dvb-core fix patch due to bug (bsc#1205758).
• Fix formatting of client smbdirect RDMA logging (bsc#1190317).
• Fix missing top level chapter numbers on SLE12 SP5 (bsc#1212158).
• Fix usrmerge error (boo#1211796).
• Handle variable number of SGEs in client smbdirect send (bsc#1190317).
• Reduce client smbdirect max receive segment size (bsc#1190317).
• Remove usrmerge compatibility symlink in buildroot (boo#1211796)
• affs: initialize fsdata in affs_truncate() (git-fixes).
• bnx2x: Check if transceiver implements DDM before access (git-fixes).
• bnxt_en: Fix mqprio and XDP ring checking logic (git-fixes).
• bnxt_en: Fix typo in PCI id to device description string mapping (git-fixes).
• bnxt_en: Query default VLAN before VNIC setup on a VF (git-fixes).
• bnxt_en: Remove debugfs when pci_register_driver failed (git-fixes).
• bnxt_en: fix NQ resource accounting during vf creation on 57500 chips (git-fixes).
• bnxt_en: fix potentially incorrect return value for ndo_rx_flow_steer (git-fixes).
• bnxt_en: reclaim max resources if sriov enable fails (git-fixes).
• bugzilla-create: always end email with @suse.com
• bugzilla-create: take bugzilla email from BUGZILLA_ACCOUNT_EMAIL env var Some people have emails in bugzilla that are completely different than emails they use in git and providing one with -e option is tedious. Make bugzilla-create more flexible by providing the third options that sits between command line option and git-config automation.
• cdc-ncm: avoid overflow in sanity checking (git-fixes).
• ceph: fix use-after-free bug for inodes when flushing capsnaps (bsc#1212938).
• cifs: Add helper function to check smb1+ server (bsc#1190317).
• cifs: Convert struct fealist away from 1-element array (bsc#1190317).
• cifs: Fix connections leak when tlink setup failed (bsc#1190317).
• cifs: Fix lost destroy smbd connection when MR allocate failed (bsc#1190317).
• cifs: Fix memory leak when build ntlmssp negotiate blob failed (bsc#1190317).
• cifs: Fix oops due to uncleared server->smbd_conn in reconnect…

The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-1079: Fixed a use-after-free problem that could have been triggered in asus_kbd_backlight_set when plugging/disconnecting a malicious USB device (bsc#1208604).
• CVE-2023-1249: Fixed a use-after-free flaw in the core dump subsystem that allowed a local user to crash the system (bsc#1209039).
• CVE-2023-1637: Fixed vulnerability that could lead to unauthorized access to CPU memory after resuming CPU from suspend-to-RAM (bsc#1209779).
• CVE-2023-2002: Fixed a flaw that allowed an attacker to unauthorized execution of management commands, compromising the confidentiality, integrity, and availability of Bluetooth communication (bsc#1210533).
• CVE-2023-3090: Fixed a heap out-of-bounds write in the ipvlan network driver (bsc#1212842).
• CVE-2023-3111: Fixed a use-after-free vulnerability in prepare_to_relocate in fs/btrfs/relocation.c (bsc#1212051).
• CVE-2023-3141: Fixed a use-after-free flaw in r592_remove in drivers/memstick/host/r592.c, that allowed local attackers to crash the system at device disconnect (bsc#1212129).
• CVE-2023-3159: Fixed use-after-free issue in driver/firewire in outbound_phy_packet_callback (bsc#1212128).
• CVE-2023-3161: Fixed shift-out-of-bounds in fbcon_set_font() (bsc#1212154).
• CVE-2023-3268: Fixed an out of bounds flaw in relay_file_read_start_pos in kernel/relay.c that allowed a local attacker to crash the system or leak kernel internal information (bsc#1212502).
• CVE-2023-3358: Fixed a NULL pointer dereference flaw in the Integrated Sensor Hub (ISH) driver (bsc#1212606).
• CVE-2023-35824: Fixed a use-after-free in dm1105_remove in drivers/media/pci/dm1105/dm1105.c (bsc#1212501).

The following non-security bugs were fixed:

• Fix missing top level chapter numbers on SLE12 SP5 (bsc#1212158).
• Move setting %%build_html to config.sh
• Move setting %%split_optional to config.sh
• Move setting %%supported_modules_check to config.sh
• rpm/kernel-binary.spec.in: Fix compatibility wth newer rpm
• rpm/kernel-docs.spec.in: pass PYTHON=python3 to fix build error (bsc#1160435)

The SUSE Linux Enterprise 15 SP4 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-1077: Fixed a type confusion in pick_next_rt_entity(), that could cause memory corruption (bsc#1208600).
• CVE-2023-1249: Fixed a use-after-free flaw in the core dump subsystem that allowed a local user to crash the system (bsc#1209039).
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).
• CVE-2023-21102: Fixed possible bypass of shadow stack protection in __efi_rt_asm_wrapper of efi-rt-wrapper.S (bsc#1212155).
• CVE-2023-3090: Fixed a heap out-of-bounds write in the ipvlan network driver (bsc#1212842).
• CVE-2023-3111: Fixed a use-after-free vulnerability in prepare_to_relocate in fs/btrfs/relocation.c (bsc#1212051).
• CVE-2023-3141: Fixed a use-after-free flaw in r592_remove in drivers/memstick/host/r592.c, that allowed local attackers to crash the system at device disconnect (bsc#1212129).
• CVE-2023-3161: Fixed shift-out-of-bounds in fbcon_set_font() (bsc#1212154).
• CVE-2023-3212: Fixed a NULL pointer dereference flaw in the gfs2 file system (bsc#1212265).
• CVE-2023-3357: Fixed a NULL pointer dereference flaw in the AMD Sensor Fusion Hub driver (bsc#1212605).
• CVE-2023-3358: Fixed a NULL pointer dereference flaw in the Integrated Sensor Hub (ISH) driver (bsc#1212606).
• CVE-2023-3389: Fixed a use-after-free vulnerability in the io_uring subsystem (bsc#1212838).
• CVE-2023-35788: Fixed an out-of-bounds write in the flower classifier code via TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets in fl_set_geneve_opt in net/sched/cls_flower.c (bsc#1212504).
• CVE-2023-35823: Fixed a use-after-free flaw in saa7134_finidev in drivers/media/pci/saa7134/saa7134-core.c (bsc#1212494).
• CVE-2023-35828: Fixed a use-after-free flaw in renesas_usb3_remove in drivers/usb/gadget/udc/renesas_usb3.c (bsc#1212513).
• CVE-2023-35829: Fixed a use-after-free flaw in rkvdec_remove in drivers/staging/media/rkvdec/rkvdec.c (bsc#1212495).

The following non-security bugs were fixed:

• ACPI: sleep: Avoid breaking S3 wakeup due to might_sleep() (git-fixes).
• ALSA: ac97: Fix possible NULL dereference in snd_ac97_mixer (git-fixes).
• ALSA: hda/realtek: Add 'Intel Reference board' and 'NUC 13' SSID in the ALC256 (git-fixes).
• ALSA: hda/realtek: Add Lenovo P3 Tower platform (git-fixes).
• ALSA: hda/realtek: Add a quirk for Compaq N14JP6 (git-fixes).
• ALSA: hda/realtek: Add a quirk for HP Slim Desktop S01 (git-fixes).
• ALSA: hda/realtek: Add quirk for ASUS ROG G634Z (git-fixes).
• ALSA: hda/realtek: Add quirk for ASUS ROG GV601V (git-fixes).
• ALSA: hda/realtek: Add quirk for Clevo NS50AU (git-fixes).
• ALSA: hda/realtek: Add quirks for ASUS GU604V and GU603V (git-fixes).
• ALSA: hda/realtek: Add quirks for Asus ROG 2024 laptops using CS35L41 (git-fixes).
• ALSA: hda/realtek: Add quirks for ROG ALLY CS35l41 audio (git-fixes).
• ALSA: hda/realtek: Enable 4 amplifiers instead of 2 on a HP platform (git-fixes).
• ALSA: hda/realtek: Enable mute/micmute LEDs and limit mic boost on EliteBook (git-fixes).
• ALSA: hda: Glenfly: add HD Audio PCI IDs and HDMI Codec Vendor IDs (git-fixes).
• ALSA: oss: avoid missing-prototype warnings (git-fixes).
• ALSA: usb-audio: Add quirk flag for HEM devices to enable native DSD playback (git-fixes).
• ALSA: usb-audio: Fix broken resume due to UAC3 power state (git-fixes).
• ARM: 9295/1: unwind:fix unwind abort for uleb128 case (git-fixes)
• ARM: cpu: Switch to arch_cpu_finalize_init() (bsc#1212448).
• ARM: dts: Fix erroneous ADS touchscreen polarities (git-fixes).
• ARM: dts: vexpress: add missing cache properties (git-fixes).
• ASoC: codecs: wsa881x: do not set can_multi_write flag (git-fixes).
• ASoC: dwc: limit the number of overrun messages (git-fixes).
• ASoC: dwc: move DMA init to snd_soc_dai_driver probe() (git-fixes).
• ASoC: es8316: Do not set rate constraints for unsupported MCLKs (git-fixes).
• ASoC: es8316:…

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-3090: Fixed a heap out-of-bounds write in the ipvlan network driver (bsc#1212842).
• CVE-2023-3358: Fixed a NULL pointer dereference flaw in the Integrated Sensor Hub (ISH) driver (bsc#1212606).
• CVE-2023-35828: Fixed a use-after-free flaw in renesas_usb3_remove in drivers/usb/gadget/udc/renesas_usb3.c (bsc#1212513).
• CVE-2023-1249: Fixed a use-after-free flaw in the core dump subsystem that allowed a local user to crash the system (bsc#1209039).
• CVE-2023-2002: Fixed a flaw that allowed an attacker to unauthorized execution of management commands, compromising the confidentiality, integrity, and availability of Bluetooth communication (bsc#1210533).
• CVE-2023-3268: Fixed an out of bounds (OOB) memory access flaw in relay_file_read_start_pos in the relayfs (bsc#1212502).
• CVE-2023-35824: Fixed a use-after-free in dm1105_remove in drivers/media/pci/dm1105/dm1105.c (bsc#1212501).
• CVE-2023-35823: Fixed a use-after-free flaw in saa7134_finidev in drivers/media/pci/saa7134/saa7134-core.c (bsc#1212494).
• CVE-2023-35788: Fixed an out-of-bounds write in the flower classifier code via TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets in fl_set_geneve_opt in net/sched/cls_flower.c (bsc#1212504).
• CVE-2023-3161: Fixed shift-out-of-bounds in fbcon_set_font() (bsc#1212154).
• CVE-2023-3141: Fixed a use-after-free flaw in r592_remove in drivers/memstick/host/r592.c, that allowed local attackers to crash the system at device disconnect (bsc#1212129).
• CVE-2023-3159: Fixed use-after-free issue in driver/firewire in outbound_phy_packet_callback (bsc#1212128).
• CVE-2023-1077: Fixed a type confusion in pick_next_rt_entity(), that could cause memory corruption (bsc#1208600).

The following non-security bugs were fixed:

• Drop dvb-core fix patch due to bug (bsc#1205758).
• Fix missing top level chapter numbers on SLE12 SP5 (bsc#1212158).
• fbcon: Check font dimension limits (CVE-2023-3161 bsc#1212154).
• google/gve:fix repeated words in comments (bsc#1211519).
• gve: Adding a new AdminQ command to verify driver (bsc#1211519).
• gve: Cache link_speed value from device (bsc#1211519).
• gve: Fix GFP flags when allocing pages (bsc#1211519).
• gve: Fix error return code in gve_prefill_rx_pages() (bsc#1211519).
• gve: Fix spelling mistake 'droping' -> 'dropping' (bsc#1211519).
• gve: Handle alternate miss completions (bsc#1211519).
• gve: Reduce alloc and copy costs in the GQ rx path (bsc#1211519).
• gve: Remove the code of clearing PBA bit (bsc#1211519).
• gve: Secure enough bytes in the first TX desc for all TCP pkts (bsc#1211519).
• gve: enhance no queue page list detection (bsc#1211519).
• rpm/kernel-binary.spec.in: Fix compatibility wth newer rpm
• rpm/kernel-docs.spec.in: pass PYTHON=python3 to fix build error (bsc#1160435)
• x86/build: Avoid relocation information in final vmlinux (bsc#1187829).

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-1077: Fixed a type confusion in pick_next_rt_entity(), that could cause memory corruption (bsc#1208600).
• CVE-2023-1249: Fixed a use-after-free flaw in the core dump subsystem that allowed a local user to crash the system (bsc#1209039).
• CVE-2023-2002: Fixed a flaw that allowed an attacker to unauthorized execution of management commands, compromising the confidentiality, integrity, and availability of Bluetooth communication (bsc#1210533).
• CVE-2023-3090: Fixed a heap out-of-bounds write in the ipvlan network driver (bsc#1212842).
• CVE-2023-3141: Fixed a use-after-free flaw in r592_remove in drivers/memstick/host/r592.c, that allowed local attackers to crash the system at device disconnect (bsc#1212129).
• CVE-2023-3159: Fixed use-after-free issue in driver/firewire in outbound_phy_packet_callback (bsc#1212128).
• CVE-2023-3161: Fixed shift-out-of-bounds in fbcon_set_font() (bsc#1212154).
• CVE-2023-3268: Fixed an out of bounds (OOB) memory access flaw in relay_file_read_start_pos in kernel/relay.c (bsc#1212502).
• CVE-2023-3358: Fixed a NULL pointer dereference flaw in the Integrated Sensor Hub (ISH) driver (bsc#1212606).
• CVE-2023-35788: Fixed an out-of-bounds write in the flower classifier code via TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets in fl_set_geneve_opt in net/sched/cls_flower.c (bsc#1212504).
• CVE-2023-35823: Fixed a use-after-free flaw in saa7134_finidev in drivers/media/pci/saa7134/saa7134-core.c (bsc#1212494).
• CVE-2023-35824: Fixed a use-after-free in dm1105_remove in drivers/media/pci/dm1105/dm1105.c (bsc#1212501).
• CVE-2023-35828: Fixed a use-after-free flaw in renesas_usb3_remove in drivers/usb/gadget/udc/renesas_usb3.c (bsc#1212513).

The following non-security bugs were fixed:

• Also include kernel-docs build requirements for ALP
• Avoid unsuported tar parameter on SLE12
• Fix missing top level chapter numbers on SLE12 SP5 (bsc#1212158).
• Fix usrmerge error (boo#1211796)
• Generalize kernel-doc build requirements.
• Move obsolete KMP list into a separate file. The list of obsoleted KMPs varies per release, move it out of the spec file.
• Move setting %%build_html to config.sh
• Move setting %%split_optional to config.sh
• Move setting %%supported_modules_check to config.sh
• Move the kernel-binary conflicts out of the spec file. Thie list of conflicting packages varies per release. To reduce merge conflicts move the list out of the spec file.
• Remove obsolete rpm spec constructs defattr does not need to be specified anymore buildroot does not need to be specified anymore
• Remove usrmerge compatibility symlink in buildroot (boo#1211796).
• Trim obsolete KMP list. SLE11 is out of support, we do not need to handle upgrading from SLE11 SP1.
• cifs: do not include page data when checking signature (bsc#1200217).
• cifs: fix open leaks in open_cached_dir() (bsc#1209342).
• google/gve:fix repeated words in comments (bsc#1211519).
• gve: Adding a new AdminQ command to verify driver (bsc#1211519).
• gve: Cache link_speed value from device (bsc#1211519).
• gve: Fix GFP flags when allocing pages (bsc#1211519).
• gve: Fix error return code in gve_prefill_rx_pages() (bsc#1211519).
• gve: Fix spelling mistake 'droping' -> 'dropping' (bsc#1211519).
• gve: Handle alternate miss completions (bsc#1211519).
• gve: Reduce alloc and copy costs in the GQ rx path (bsc#1211519).
• gve: Remove the code of clearing PBA bit (bsc#1211519).
• gve: Secure enough bytes in the first TX desc for all TCP pkts (bsc#1211519).
• gve: enhance no queue page list detection (bsc#1211519).
• kernel-binary: Add back kernel-default-base guarded by option Add configsh option for splitting off kernel-default-base, and for not signing the kernel on non-efi
• kernel-binary: install expoline.o (boo#1210791 bsc#1211089)
• kernel-source: Remove unused macro variant_symbols
• kernel-spec-macros: Fix up…

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-36280: Fixed out-of-bounds memory access vulnerability found in vmwgfx driver (bsc#1203332).
• CVE-2022-38096: Fixed NULL-ptr deref in vmw_cmd_dx_define_query() (bsc#1203331).
• CVE-2022-4269: Fixed a flaw was found inside the Traffic Control (TC) subsystem (bsc#1206024).
• CVE-2022-45884: Fixed a use-after-free in dvbdev.c, related to dvb_register_device dynamically allocating fops (bsc#1205756).
• CVE-2022-45885: Fixed a race condition in dvb_frontend.c that could cause a use-after-free when a device is disconnected (bsc#1205758).
• CVE-2022-45886: Fixed a .disconnect versus dvb_device_open race condition in dvb_net.c that lead to a use-after-free (bsc#1205760).
• CVE-2022-45887: Fixed a memory leak in ttusb_dec.c caused by the lack of a dvb_frontend_detach call (bsc#1205762).
• CVE-2022-45919: Fixed a use-after-free in dvb_ca_en50221.c that could occur if there is a disconnect after an open, because of the lack of a wait_event (bsc#1205803).
• CVE-2022-4744: Fixed double-free that could lead to DoS or privilege escalation in TUN/TAP device driver functionality (bsc#1209635).
• CVE-2023-0045: Fixed missing Flush IBP in ib_prctl_set (bsc#1207773).
• CVE-2023-0122: Fixed a NULL pointer dereference vulnerability in nvmet_setup_auth(), that allowed an attacker to perform a Pre-Auth Denial of Service (DoS) attack on a remote machine (bsc#1207050).
• CVE-2023-0179: Fixed incorrect arithmetics when fetching VLAN header bits (bsc#1207034).
• CVE-2023-0394: Fixed a null pointer dereference in the network subcomponent. This flaw could cause system crashes (bsc#1207168).
• CVE-2023-0461: Fixed use-after-free in icsk_ulp_data (bsc#1208787).
• CVE-2023-0469: Fixed a use-after-free flaw in io_uring/filetable.c in io_install_fixed_file in the io_uring subcomponent (bsc#1207521).
• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2023-0597: Fixed lack of randomization of per-cpu entry area in x86/mm (bsc#1207845).
• CVE-2023-1075: Fixed a type confusion in tls_is_tx_ready (bsc#1208598).
• CVE-2023-1076: Fixed incorrect UID assigned to tun/tap sockets (bsc#1208599).
• CVE-2023-1077: Fixed a type confusion in pick_next_rt_entity(), that could cause memory corruption (bsc#1208600).
• CVE-2023-1079: Fixed a use-after-free problem that could have been triggered in asus_kbd_backlight_set when plugging/disconnecting a malicious USB device (bsc#1208604).
• CVE-2023-1095: Fixed a NULL pointer dereference in nf_tables due to zeroed list head (bsc#1208777).
• CVE-2023-1118: Fixed a use-after-free bugs caused by ene_tx_irqsim() in media/rc (bsc#1208837).
• CVE-2023-1249: Fixed a use-after-free flaw in the core dump subsystem that allowed a local user to crash the system (bsc#1209039).
• CVE-2023-1382: Fixed denial of service in tipc_conn_close (bsc#1209288).
• CVE-2023-1513: Fixed an uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak (bsc#1209532).
• CVE-2023-1582: Fixed soft lockup in __page_mapcount (bsc#1209636).
• CVE-2023-1583: Fixed a NULL pointer dereference in io_file_bitmap_get in io_uring/filetable.c (bsc#1209637).
• CVE-2023-1611: Fixed an use-after-free flaw in btrfs_search_slot (bsc#1209687).
• CVE-2023-1637: Fixed vulnerability that could lead to unauthorized access to CPU memory after resuming CPU from suspend-to-RAM (bsc#1209779).
• CVE-2023-1652: Fixed use-after-free that could lead to DoS and information leak in nfsd4_ssc_setup_dul in fs/nfsd/nfs4proc.c (bsc#1209788).
• CVE-2023-1670: Fixed a use after free in the Xircom 16-bit PCMCIA Ethernet driver. A local user could use this flaw to crash the system or potentially escalate their privileges on the system (bsc#1209871).
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).
• CVE-2023-1838:…

The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-3268: Fixed an out of bounds memory access flaw in relay_file_read_start_pos in the relayfs (bsc#1212502).
• CVE-2023-3776: Fixed improper refcount update in cls_fw leads to use-after-free (bsc#1213588).
• CVE-2022-40982: Fixed transient execution attack called 'Gather Data Sampling' (bsc#1206418).
• CVE-2023-3567: Fixed a use-after-free in vcs_read in drivers/tty/vt/vc_screen.c (bsc#1213167).
• CVE-2023-0459: Fixed information leak in __uaccess_begin_nospec (bsc#1211738).
• CVE-2023-20593: Fixed a ZenBleed issue in 'Zen 2' CPUs that could allow an attacker to potentially access sensitive information (bsc#1213286).
• CVE-2018-3639: Fixed Speculative Store Bypass aka 'Memory Disambiguation' (bsc#1087082).
• CVE-2017-18344: Fixed an OOB access led by an invalid check in timer_create. (bsc#1102851).
• CVE-2022-45919: Fixed a use-after-free in dvb_ca_en50221.c that could occur if there is a disconnect after an open, because of the lack of a wait_event (bsc#1205803).
• CVE-2023-35824: Fixed a use-after-free in dm1105_remove in drivers/media/pci/dm1105/dm1105.c (bsc#1212501).
• CVE-2023-3161: Fixed shift-out-of-bounds in fbcon_set_font() (bsc#1212154).
• CVE-2023-3141: Fixed a use-after-free flaw in r592_remove in drivers/memstick/host/r592.c, that allowed local attackers to crash the system at device disconnect (bsc#1212129).
• CVE-2023-3159: Fixed use-after-free issue in driver/firewire in outbound_phy_packet_callback (bsc#1212128).

The following non-security bugs were fixed:

• fbcon: Check font dimension limits (CVE-2023-3161 bsc#1212154).
• firewire: fix potential uaf in outbound_phy_packet_callback() (CVE-2023-3159 bsc#1212128).
• kABI: restore _copy_from_user on x86_64 and copy_to_user on x86 (bsc#1211738 CVE-2023-0459).
• media: dm1105: Fix use after free bug in dm1105_remove due to race condition (bsc#1212501 CVE-2023-35824).
• media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221 (CVE-2022-45919 bsc#1205803).
• memstick: r592: Fix UAF bug in r592_remove due to race condition (CVE-2023-3141 bsc#1212129 bsc#1211449).
• net/sched: cls_fw: Fix improper refcount update leads to use-after-free (CVE-2023-3776 bsc#1213588).
• pkt_sched: fix error return code in fw_change_attrs() (bsc#1213588).
• pkt_sched: fix error return code in fw_change_attrs() (bsc#1213588).
• posix-timer: Properly check sigevent->sigev_notify (CVE-2017-18344, bsc#1102851, bsc#1208715).
• relayfs: fix out-of-bounds access in relay_file_read (bsc#1212502 CVE-2023-3268).
• uaccess: Add speculation barrier to copy_from_user() (bsc#1211738 CVE-2023-0459).
• vc_screen: don't clobber return value in vcs_read (bsc#1213167 CVE-2023-3567).
• vc_screen: modify vcs_size() handling in vcs_read() (bsc#1213167 CVE-2023-3567).
• vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF (bsc#1213167 CVE-2023-3567).
• x86: Unify copy_from_user() size checking (bsc#1211738 CVE-2023-0459).
• x86/copy_user: Unify the code by removing the 64-bit asm copy*_user() variants (bsc#1211738 CVE-2023-0459).
• x86/cpu/amd: Add a Zenbleed fix (bsc#1213286, CVE-2023-20593).
• x86/speculation: Add Gather Data Sampling mitigation (bsc#1206418, CVE-2022-40982).

Jiasheng Jiang discovered that the HSA Linux kernel driver for AMD Radeon GPU devices did not properly validate memory allocation in certain situations, leading to a null pointer dereference vulnerability. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-3108)

Zheng Wang discovered that the Intel i915 graphics driver in the Linux kernel did not properly handle certain error conditions, leading to a double-free. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-3707)

It was discovered that the infrared transceiver USB driver did not properly handle USB control messages. A local attacker with physical access could plug in a specially crafted USB device to cause a denial of service (memory exhaustion). (CVE-2022-3903)

Haowei Yan discovered that a race condition existed in the Layer 2 Tunneling Protocol (L2TP) implementation in the Linux kernel. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-4129)

Jordy Zomer and Alexandra Sandulescu discovered that syscalls invoking the do_prlimit() function in the Linux kernel did not properly handle speculative execution barriers. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2023-0458)

Jordy Zomer and Alexandra Sandulescu discovered that the Linux kernel did not properly implement speculative execution barriers in usercopy functions in certain situations. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2023-0459)

It was discovered that the Human Interface Device (HID) support driver in the Linux kernel contained a type confusion vulnerability in some situations. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-1073)

It was discovered that a memory leak existed in the SCTP protocol implementation in the Linux kernel. A local attacker could use this to cause a denial of service (memory exhaustion). (CVE-2023-1074)

It was discovered that the TLS subsystem in the Linux kernel contained a type confusion vulnerability in some situations. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-1075)

It was discovered that the TUN/TAP driver in the Linux kernel did not properly initialize socket data. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-1076)

It was discovered that the Real-Time Scheduling Class implementation in the Linux kernel contained a type confusion vulnerability in some situations. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-1077)

It was discovered that the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel contained a type confusion vulnerability in some situations. An attacker could use this to cause a denial of service (system crash). (CVE-2023-1078)

It was discovered that the ASUS HID driver in the Linux kernel did not properly handle device removal, leading to a use-after-free vulnerability. A local attacker with physical access could plug in a specially crafted USB device to cause a denial of service (system crash). (CVE-2023-1079)

Duoming Zhou discovered that a race condition existed in the infrared receiver/transceiver driver in the Linux kernel, leading to a use-after- free vulnerability. A privileged attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-1118)

It was discovered that the Traffic-Control Index (TCINDEX) implementation in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-1281)

It was discovered that the Broadcom FullMAC USB WiFi driver in the Linux kernel did not properly perform data buffer size validation in some situations. A…

Jordy Zomer and Alexandra Sandulescu discovered that syscalls invoking the do_prlimit() function in the Linux kernel did not properly handle speculative execution barriers. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2023-0458)

It was discovered that a race condition existed in the btrfs file system implementation in the Linux kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-1611)

It was discovered that the XFS file system implementation in the Linux kernel did not properly perform metadata validation when mounting certain images. An attacker could use this to specially craft a file system image that, when mounted, could cause a denial of service (system crash). (CVE-2023-2124)

It was discovered that a use-after-free vulnerability existed in the iSCSI TCP implementation in the Linux kernel. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2023-2162)

It was discovered that the ext4 file system implementation in the Linux kernel did not properly handle extra inode size for extended attributes, leading to a use-after-free vulnerability. A privileged attacker could possibly use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-2513)

It was discovered that the IP-VLAN network driver for the Linux kernel did not properly initialize memory in some situations, leading to an out-of- bounds write vulnerability. An attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-3090)

It was discovered that the Ricoh R5C592 MemoryStick card reader driver in the Linux kernel contained a race condition during module unload, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-3141)

It was discovered that a use-after-free vulnerability existed in the IEEE 1394 (Firewire) implementation in the Linux kernel. A privileged attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-3159)

Sanan Hasanov discovered that the framebuffer console driver in the Linux kernel did not properly perform checks for font dimension limits. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-3161)

It was discovered that the kernel->user space relay implementation in the Linux kernel did not properly perform certain buffer calculations, leading to an out-of-bounds read vulnerability. A local attacker could use this to cause a denial of service (system crash) or expose sensitive information (kernel memory). (CVE-2023-3268)

It was discovered that the netfilter subsystem in the Linux kernel did not properly handle some error conditions, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-3390)

Tanguy Dubroca discovered that the netfilter subsystem in the Linux kernel did not properly handle certain pointer data type, leading to an out-of- bounds write vulnerability. A privileged attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-35001)

Jiasheng Jiang discovered that the HSA Linux kernel driver for AMD Radeon GPU devices did not properly validate memory allocation in certain situations, leading to a null pointer dereference vulnerability. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-3108)

Zheng Wang discovered that the Intel i915 graphics driver in the Linux kernel did not properly handle certain error conditions, leading to a double-free. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-3707)

It was discovered that the infrared transceiver USB driver did not properly handle USB control messages. A local attacker with physical access could plug in a specially crafted USB device to cause a denial of service (memory exhaustion). (CVE-2022-3903)

Haowei Yan discovered that a race condition existed in the Layer 2 Tunneling Protocol (L2TP) implementation in the Linux kernel. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-4129)

Jordy Zomer and Alexandra Sandulescu discovered that syscalls invoking the do_prlimit() function in the Linux kernel did not properly handle speculative execution barriers. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2023-0458)

Jordy Zomer and Alexandra Sandulescu discovered that the Linux kernel did not properly implement speculative execution barriers in usercopy functions in certain situations. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2023-0459)

It was discovered that the Human Interface Device (HID) support driver in the Linux kernel contained a type confusion vulnerability in some situations. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-1073)

It was discovered that a memory leak existed in the SCTP protocol implementation in the Linux kernel. A local attacker could use this to cause a denial of service (memory exhaustion). (CVE-2023-1074)

It was discovered that the TLS subsystem in the Linux kernel contained a type confusion vulnerability in some situations. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-1075)

It was discovered that the TUN/TAP driver in the Linux kernel did not properly initialize socket data. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-1076)

It was discovered that the Real-Time Scheduling Class implementation in the Linux kernel contained a type confusion vulnerability in some situations. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-1077)

It was discovered that the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel contained a type confusion vulnerability in some situations. An attacker could use this to cause a denial of service (system crash). (CVE-2023-1078)

It was discovered that the ASUS HID driver in the Linux kernel did not properly handle device removal, leading to a use-after-free vulnerability. A local attacker with physical access could plug in a specially crafted USB device to cause a denial of service (system crash). (CVE-2023-1079)

Duoming Zhou discovered that a race condition existed in the infrared receiver/transceiver driver in the Linux kernel, leading to a use-after- free vulnerability. A privileged attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-1118)

It was discovered that the Traffic-Control Index (TCINDEX) implementation in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-1281)

It was discovered that the Broadcom FullMAC USB WiFi driver in the Linux kernel did not properly perform data buffer size validation in some situations. A…