CVE-2023-35001

Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm register contents when CAP_NET_ADMIN is in any user or network namespace

The Linux Kernel, the operating system core itself.

Security Fix(es):

An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvb_net.c has a .disconnect versus dvb_device_open race condition that leads to a use-after-free.(CVE-2022-45886)

A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in net/netfilter/nf_tables_api.c.

Mishandled error handling with NFT_MSG_NEWRULE makes it possible to use a dangling pointer in the same transaction causing a use-after-free vulnerability. This flaw allows a local attacker with user access to cause a privilege escalation issue.

We recommend upgrading past commit 1240eb93f0616b21c675416516ff3d74798fdc97.(CVE-2023-3390)

Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm register contents when CAP_NET_ADMIN is in any user or network namespace(CVE-2023-35001)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: ipvlan: out-of-bounds write caused by unclear skb->cb (CVE-2023-3090)

• kernel: UAF in nftables when nft_set_lookup_global triggered after handling named and anonymous sets in batch requests (CVE-2023-3390)

• kernel: net/sched: cls_fw component can be exploited as result of failure in tcf_change_indev function (CVE-2023-3776)

• kernel: netfilter: use-after-free due to improper element removal in nft_pipapo_remove() (CVE-2023-4004)

• kernel: nf_tables: stack-out-of-bounds-read in nft_byteorder_eval() (CVE-2023-35001)

• kernel: cls_flower: out-of-bounds write in fl_set_geneve_opt() (CVE-2023-35788)

• kernel: bluetooth: Unauthorized management command execution (CVE-2023-2002)

• hw: amd: Cross-Process Information Leak (CVE-2023-20593)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• low memory deadlock with md devices and external (imsm) metadata handling - requires a kernfs notification backport (BZ#2208540)

• Intel 8.9 BUG, SPR EMR FHF ACPI: Fix system hang during S3 wakeup (BZ#2218025)

• OCS 4.8, cephfs kernel crash: mds_dispatch ceph_handle_snap unable to handle kernel NULL (BZ#2218271)

• st_gmac: tx-checksum offload on vlan is not consistent with st_gmac interface (BZ#2219907)

• refcount_t overflow often happens in mem_cgroup_id_get_online() (BZ#2221010)

• avoid unnecessary page fault retires on shared memory types (BZ#2221100)

• enable conntrack clash resolution for GRE (BZ#2223542)

• ice: avoid bonding causing auxiliary plug/unplug under RTNL lock (BZ#2224515)

• libceph: harden msgr2.1 frame segment length checks [8.x] (BZ#2227073)

• Important iavf bug fixes July 2023 (BZ#2228161)

• i40e error: Cannot set interface MAC/vlanid to 1e:b7:e2:02:b1:aa/0 for ifname ens4f0 vf 0: Resource temporarily unavailable (BZ#2228163)

• oops on cifs_mount due to null tcon (BZ#2229128)

• iptables argument "--suppl-groups" in extension "owner" does not work in Rocky Linux8 (BZ#2229715)

• Hyper-V Rocky Linux 8: incomplete fc_transport implementation in storvsc causes null dereference in fc_timed_out() (BZ#2230743)

• Withdrawal: GFS2: could not freeze filesystem: -16 (BZ#2231825)

• Rocky Linux 8 Hyper-V: Excessive hv_storvsc driver logging with srb_status SRB_STATUS_INTERNAL_ERROR (0x30) (BZ#2231988)

• Rocky Linux-8: crypto: rng - Fix lock imbalance in crypto_del_rng (BZ#2232215)

• Intel 8.9 iavf: Driver Update (BZ#2232399)

• Hyper-V Rocky Linux-8 hv_storvsc driver logging excessive storvsc_log events for storvsc_on_io_completion() function (BZ#2233227)

Enhancement(s):

• Intel 8.9 FEAT, EMR perf: Add EMR CPU PMU support (BZ#2230152)

• Intel 8.9 FEAT, SPR EMR power: Add uncore frequency control driver (BZ#2230158)

• Intel 8.9 FEAT EMR perf: RAPL PMU support on EMR (BZ#2230162)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: ipvlan: out-of-bounds write caused by unclear skb->cb (CVE-2023-3090)

• kernel: UAF in nftables when nft_set_lookup_global triggered after handling named and anonymous sets in batch requests (CVE-2023-3390)

• kernel: net/sched: cls_fw component can be exploited as result of failure in tcf_change_indev function (CVE-2023-3776)

• kernel: netfilter: use-after-free due to improper element removal in nft_pipapo_remove() (CVE-2023-4004)

• kernel: nf_tables: stack-out-of-bounds-read in nft_byteorder_eval() (CVE-2023-35001)

• kernel: cls_flower: out-of-bounds write in fl_set_geneve_opt() (CVE-2023-35788)

• kernel: bluetooth: Unauthorized management command execution (CVE-2023-2002)

• hw: amd: Cross-Process Information Leak (CVE-2023-20593)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• low memory deadlock with md devices and external (imsm) metadata handling - requires a kernfs notification backport (BZ#2208540)

• Intel 8.9 BUG, SPR EMR FHF ACPI: Fix system hang during S3 wakeup (BZ#2218025)

• OCS 4.8, cephfs kernel crash: mds_dispatch ceph_handle_snap unable to handle kernel NULL (BZ#2218271)

• st_gmac: tx-checksum offload on vlan is not consistent with st_gmac interface (BZ#2219907)

• refcount_t overflow often happens in mem_cgroup_id_get_online() (BZ#2221010)

• avoid unnecessary page fault retires on shared memory types (BZ#2221100)

• enable conntrack clash resolution for GRE (BZ#2223542)

• ice: avoid bonding causing auxiliary plug/unplug under RTNL lock (BZ#2224515)

• libceph: harden msgr2.1 frame segment length checks [8.x] (BZ#2227073)

• Important iavf bug fixes July 2023 (BZ#2228161)

• i40e error: Cannot set interface MAC/vlanid to 1e:b7:e2:02:b1:aa/0 for ifname ens4f0 vf 0: Resource temporarily unavailable (BZ#2228163)

• oops on cifs_mount due to null tcon (BZ#2229128)

• iptables argument "--suppl-groups" in extension "owner" does not work in Rocky Linux SIG Cloud8 (BZ#2229715)

• Hyper-V Rocky Linux SIG Cloud 8: incomplete fc_transport implementation in storvsc causes null dereference in fc_timed_out() (BZ#2230743)

• Withdrawal: GFS2: could not freeze filesystem: -16 (BZ#2231825)

• Rocky Linux SIG Cloud 8 Hyper-V: Excessive hv_storvsc driver logging with srb_status SRB_STATUS_INTERNAL_ERROR (0x30) (BZ#2231988)

• Rocky Linux SIG Cloud-8: crypto: rng - Fix lock imbalance in crypto_del_rng (BZ#2232215)

• Intel 8.9 iavf: Driver Update (BZ#2232399)

• Hyper-V Rocky Linux SIG Cloud-8 hv_storvsc driver logging excessive storvsc_log events for storvsc_on_io_completion() function (BZ#2233227)

Enhancement(s):

• Intel 8.9 FEAT, EMR perf: Add EMR CPU PMU support (BZ#2230152)

• Intel 8.9 FEAT, SPR EMR power: Add uncore frequency control driver (BZ#2230158)

• Intel 8.9 FEAT EMR perf: RAPL PMU support on EMR (BZ#2230162)

Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm register contents when CAP_NET_ADMIN is in any user or network namespace

The kernel packages contain the Linux kernel, the core of any Linux operating system.

The following packages have been upgraded to a later upstream version: kernel (5.14.0).

Security Fix(es):

• kernel: UAF in nftables when nft_set_lookup_global triggered after handling named and anonymous sets in batch requests (CVE-2023-3390)
• kernel: netfilter: nf_tables: fix chain binding transaction logic in the abort path of NFT_MSG_NEWRULE (CVE-2023-3610)
• kernel: net/sched: cls_fw component can be exploited as result of failure in tcf_change_indev function (CVE-2023-3776)
• kernel: netfilter: use-after-free due to improper element removal in nft_pipapo_remove() (CVE-2023-4004)
• kernel: netfilter: nf_tables_newrule when adding a rule with NFTA_RULE_CHAIN_ID leads to use-after-free (CVE-2023-4147)
• kernel: nf_tables: use-after-free in nft_chain_lookup_byid() (CVE-2023-31248)
• kernel: nf_tables: stack-out-of-bounds-read in nft_byteorder_eval() (CVE-2023-35001)
• kernel: save/restore speculative MSRs during S3 suspend/resume (CVE-2023-1637)
• hw: amd: Cross-Process Information Leak (CVE-2023-20593)
• kernel: bypass of shadow stack protection due to a logic error (CVE-2023-21102)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• [Intel 9.3 BUG] [SPR][EMR][FHF] ACPI: Fix system hang during S3 wakeup (BZ#2218026)
• [Dell 9.2 BUG] Monitor lost after replug WD19TBS to SUT port wiith VGA/DVI to type-C dongle (BZ#2219463)
• rtmutex: Incorrect waiter woken when requeueing in rt_mutex_adjust_prio_chain() (BZ#2222121)
• AlmaLinux AWS ARM Instability During Microshift e2e tests (BZ#2223310)
• AlmaLinux 9.x updates for SEV-SNP guest support (BZ#2224587)
• Lock state corruption from nested rtmutex blocking in blk_flush_plug() (BZ#2225623)
• bpf_jit_limit hit again - copy_seccomp() fix (BZ#2226945)
• libceph: harden msgr2.1 frame segment length checks (BZ#2227070)
• Temporary values used for the FIPS integrity test should be zeroized after use (BZ#2227768)
• Important iavf bug fixes July 2023 (BZ#2228156)
• [i40e/ice] error: Cannot set interface MAC/vlanid to 1e:b7:e2:02:b1:aa/0 for ifname ens4f0 vf 0: Resource temporarily unavailable (BZ#2228158)
• lvconvert --splitcache, --uncache operations getting hung (BZ#2228481)
• perf: EMR core and uncore PMU support (BZ#2230175)
• NVIDIA - Grace: Backport i2c: tegra: Set ACPI node as primary fwnode (BZ#2230483)
• NVIDIA - Grace: Backport i2c: tegra: Fix PEC support for SMBUS block read (BZ#2230488)
• [Hyper-V][AlmaLinux 9]incomplete fc_transport implementation in storvsc causes null dereference in fc_timed_out() (BZ#2230747)
• Kernel config option CONFIG_CRYPTO_STATS should be disabled until it is enhanced (BZ#2231850)
• [AlmaLinux 9][Hyper-V]Excessive hv_storvsc driver logging with srb_status SRB_STATUS_INTERNAL_ERROR (0x30) (BZ#2231990)
• AlmaLinux-9: WARNING: bad unlock balance detected! (BZ#2232213)
• NVIDIA - Grace: Backport drm/ast patch expected for kernel 6.4 (BZ#2232302)
• [Lenovo 9.1 bug] AlmaLinux 9 will hang when "echo c > /proc/sysrq-trigger". (BZ#2232700)
• [AlmaLinux-9] bz2022169 in /kernel/general/process/reg-suit fails on aarch64 (/proc/[pid]/wchan broken) (BZ#2233928)

Enhancement(s):

• [Intel 9.3 FEAT] cpufreq: intel_pstate: Enable HWP IO boost for all servers (BZ#2210270)
• [Dell 9.3 FEAT] - New MB with AMP Codec Change on Maya Bay (audio driver) (BZ#2218960)
• [Lenovo 9.3 FEAT] MDRAID - Update to the latest upstream (BZ#2221170)
• [Intel 9.3 FEAT] [EMR] Add EMR support to uncore-frequency driver (BZ#2230169)

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: UAF in nftables when nft_set_lookup_global triggered after handling named and anonymous sets in batch requests (CVE-2023-3390)
• kernel: netfilter: nf_tables: fix chain binding transaction logic in the abort path of NFT_MSG_NEWRULE (CVE-2023-3610)
• kernel: net/sched: cls_fw component can be exploited as result of failure in tcf_change_indev function (CVE-2023-3776)
• kernel: netfilter: use-after-free due to improper element removal in nft_pipapo_remove() (CVE-2023-4004)
• kernel: netfilter: nf_tables_newrule when adding a rule with NFTA_RULE_CHAIN_ID leads to use-after-free (CVE-2023-4147)
• kernel: nf_tables: use-after-free in nft_chain_lookup_byid() (CVE-2023-31248)
• kernel: nf_tables: stack-out-of-bounds-read in nft_byteorder_eval() (CVE-2023-35001)
• kernel: save/restore speculative MSRs during S3 suspend/resume (CVE-2023-1637)
• hw: amd: Cross-Process Information Leak (CVE-2023-20593)
• kernel: bypass of shadow stack protection due to a logic error (CVE-2023-21102)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• kernel-rt: update RT source tree to the latest AlmaLinux-9.2.z3 Batch (BZ#2228482)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: ipvlan: out-of-bounds write caused by unclear skb->cb (CVE-2023-3090)
• kernel: UAF in nftables when nft_set_lookup_global triggered after handling named and anonymous sets in batch requests (CVE-2023-3390)
• kernel: net/sched: cls_fw component can be exploited as result of failure in tcf_change_indev function (CVE-2023-3776)
• kernel: netfilter: use-after-free due to improper element removal in nft_pipapo_remove() (CVE-2023-4004)
• kernel: nf_tables: stack-out-of-bounds-read in nft_byteorder_eval() (CVE-2023-35001)
• kernel: cls_flower: out-of-bounds write in fl_set_geneve_opt() (CVE-2023-35788)
• kernel: bluetooth: Unauthorized management command execution (CVE-2023-2002)
• hw: amd: Cross-Process Information Leak (CVE-2023-20593)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• low memory deadlock with md devices and external (imsm) metadata handling - requires a kernfs notification backport (BZ#2208540)
• Intel 8.9 BUG, SPR EMR FHF ACPI: Fix system hang during S3 wakeup (BZ#2218025)
• OCS 4.8, cephfs kernel crash: mds_dispatch ceph_handle_snap unable to handle kernel NULL (BZ#2218271)
• st_gmac: tx-checksum offload on vlan is not consistent with st_gmac interface (BZ#2219907)
• refcount_t overflow often happens in mem_cgroup_id_get_online() (BZ#2221010)
• avoid unnecessary page fault retires on shared memory types (BZ#2221100)
• enable conntrack clash resolution for GRE (BZ#2223542)
• ice: avoid bonding causing auxiliary plug/unplug under RTNL lock (BZ#2224515)
• libceph: harden msgr2.1 frame segment length checks [8.x] (BZ#2227073)
• Important iavf bug fixes July 2023 (BZ#2228161)
• i40e error: Cannot set interface MAC/vlanid to 1e:b7:e2:02:b1:aa/0 for ifname ens4f0 vf 0: Resource temporarily unavailable (BZ#2228163)
• oops on cifs_mount due to null tcon (BZ#2229128)
• iptables argument "--suppl-groups" in extension "owner" does not work in AlmaLinux8 (BZ#2229715)
• Hyper-V AlmaLinux 8: incomplete fc_transport implementation in storvsc causes null dereference in fc_timed_out() (BZ#2230743)
• Withdrawal: GFS2: could not freeze filesystem: -16 (BZ#2231825)
• AlmaLinux 8 Hyper-V: Excessive hv_storvsc driver logging with srb_status SRB_STATUS_INTERNAL_ERROR (0x30) (BZ#2231988)
• AlmaLinux-8: crypto: rng - Fix lock imbalance in crypto_del_rng (BZ#2232215)
• Intel 8.9 iavf: Driver Update (BZ#2232399)
• Hyper-V AlmaLinux-8 hv_storvsc driver logging excessive storvsc_log events for storvsc_on_io_completion() function (BZ#2233227)

Enhancement(s):

• Intel 8.9 FEAT, EMR perf: Add EMR CPU PMU support (BZ#2230152)
• Intel 8.9 FEAT, SPR EMR power: Add uncore frequency control driver (BZ#2230158)
• Intel 8.9 FEAT EMR perf: RAPL PMU support on EMR (BZ#2230162)

• CVE-url: https://ubuntu.com/security/CVE-2023-4128
  • net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after- free
  • net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after- free
  • net/sched: cls_route: No longer copy tcf_result on update to avoid use- after-free
• CVE-url: https://ubuntu.com/security/CVE-2023-40283
  • Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb
• Jammy update: v5.15.42 upstream stable release (LP: #1981375) // CVE-url: https://ubuntu.com/security/CVE-2023-4387
  • net: vmxnet3: fix possible use-after-free bugs in vmxnet3_rq_alloc_rx_buf()
• CVE-2023-20593 // CVE-url: https://ubuntu.com/security/CVE-2023-20593
  • x86/cpu/amd: Move the errata checking functionality up
  • x86/cpu/amd: Add a Zenbleed fix
• CVE-2023-35001 // CVE-url: https://ubuntu.com/security/CVE-2023-35001
  • netfilter: nf_tables: prevent OOB access in nft_byteorder_eval
• Bionic update: upstream stable patchset 2023-04-05 (LP: #2015399) // CVE- url: https://ubuntu.com/security/CVE-2023-3567
  • vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF
• CVE-url: https://ubuntu.com/security/CVE-2023-0458
  • prlimit: do_prlimit needs to have a speculation check
• CVE-url: https://ubuntu.com/security/CVE-2023-2513
  • ext4: fix use-after-free in ext4_xattr_set_entry
• Jammy update: v5.15.61 upstream stable release (LP: #1990162) // CVE-url: https://ubuntu.com/security/CVE-2023-2513
  • ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h
• CVE-url: https://ubuntu.com/security/CVE-2023-3159
  • firewire: fix potential uaf in outbound_phy_packet_callback()
• Jammy update: v5.15.106 upstream stable release (LP: #2023233) // CVE-url: https://ubuntu.com/security/CVE-2023-1611
  • btrfs: fix race between quota disable and quota assign ioctls
• CVE-url: https://ubuntu.com/security/CVE-2023-3611
  • net/sched: sch_qfq: account for stab overhead in qfq_enqueue
• CVE-2023-3776 // CVE-url: https://ubuntu.com/security/CVE-2023-3776
  • net/sched: cls_fw: Fix improper refcount update leads to use-after-free

• CVE-url: https://ubuntu.com/security/CVE-2023-4128
  • net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after- free
  • net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after- free
  • net/sched: cls_route: No longer copy tcf_result on update to avoid use- after-free
• CVE-url: https://ubuntu.com/security/CVE-2023-40283
  • Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb
• Jammy update: v5.15.42 upstream stable release (LP: #1981375) // CVE-url: https://ubuntu.com/security/CVE-2023-4387
  • net: vmxnet3: fix possible use-after-free bugs in vmxnet3_rq_alloc_rx_buf()
• CVE-2023-20593 // CVE-url: https://ubuntu.com/security/CVE-2023-20593
  • x86/cpu/amd: Move the errata checking functionality up
  • x86/cpu/amd: Add a Zenbleed fix
• CVE-2023-35001 // CVE-url: https://ubuntu.com/security/CVE-2023-35001
  • netfilter: nf_tables: prevent OOB access in nft_byteorder_eval
• Bionic update: upstream stable patchset 2023-04-05 (LP: #2015399) // CVE- url: https://ubuntu.com/security/CVE-2023-3567
  • vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF
• CVE-url: https://ubuntu.com/security/CVE-2023-0458
  • prlimit: do_prlimit needs to have a speculation check
• CVE-url: https://ubuntu.com/security/CVE-2023-2513
  • ext4: fix use-after-free in ext4_xattr_set_entry
• Jammy update: v5.15.61 upstream stable release (LP: #1990162) // CVE-url: https://ubuntu.com/security/CVE-2023-2513
  • ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h
• CVE-url: https://ubuntu.com/security/CVE-2023-3159
  • firewire: fix potential uaf in outbound_phy_packet_callback()
• Jammy update: v5.15.106 upstream stable release (LP: #2023233) // CVE-url: https://ubuntu.com/security/CVE-2023-1611
  • btrfs: fix race between quota disable and quota assign ioctls
• CVE-url: https://ubuntu.com/security/CVE-2023-3611
  • net/sched: sch_qfq: account for stab overhead in qfq_enqueue
• CVE-2023-3776 // CVE-url: https://ubuntu.com/security/CVE-2023-3776
  • net/sched: cls_fw: Fix improper refcount update leads to use-after-free

• CVE-url: https://ubuntu.com/security/CVE-2023-4128
  • net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after- free
  • net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after- free
  • net/sched: cls_route: No longer copy tcf_result on update to avoid use- after-free
• CVE-url: https://ubuntu.com/security/CVE-2023-40283
  • Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb
• CVE-2023-20593 // CVE-url: https://ubuntu.com/security/CVE-2023-20593
  • x86/cpu/amd: Move the errata checking functionality up
  • x86/cpu/amd: Add a Zenbleed fix
• CVE-2023-1859 // CVE-url: https://ubuntu.com/security/CVE-2023-1859
  • 9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race condition
• CVE-url: https://ubuntu.com/security/CVE-2023-35001
  • netfilter: nf_tables: prevent OOB access in nft_byteorder_eval
• Jammy update: v5.15.106 upstream stable release (LP: #2023233) // CVE-url: https://ubuntu.com/security/CVE-2023-1611
  • btrfs: fix race between quota disable and quota assign ioctls
• CVE-2023-3611 // CVE-url: https://ubuntu.com/security/CVE-2023-3611
  • net/sched: sch_qfq: account for stab overhead in qfq_enqueue
• CVE-2023-3776 // CVE-url: https://ubuntu.com/security/CVE-2023-3776
  • net/sched: cls_fw: Fix improper refcount update leads to use-after-free

• CVE-url: https://ubuntu.com/security/CVE-2023-4128
  • net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after- free
  • net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after- free
  • net/sched: cls_route: No longer copy tcf_result on update to avoid use- after-free
• CVE-url: https://ubuntu.com/security/CVE-2023-40283
  • Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb
• CVE-2023-20593 // CVE-url: https://ubuntu.com/security/CVE-2023-20593
  • x86/cpu/amd: Move the errata checking functionality up
  • x86/cpu/amd: Add a Zenbleed fix
• CVE-2023-1859 // CVE-url: https://ubuntu.com/security/CVE-2023-1859
  • 9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race condition
• CVE-url: https://ubuntu.com/security/CVE-2023-35001
  • netfilter: nf_tables: prevent OOB access in nft_byteorder_eval
• Jammy update: v5.15.106 upstream stable release (LP: #2023233) // CVE-url: https://ubuntu.com/security/CVE-2023-1611
  • btrfs: fix race between quota disable and quota assign ioctls
• CVE-2023-3611 // CVE-url: https://ubuntu.com/security/CVE-2023-3611
  • net/sched: sch_qfq: account for stab overhead in qfq_enqueue
• CVE-2023-3776 // CVE-url: https://ubuntu.com/security/CVE-2023-3776
  • net/sched: cls_fw: Fix improper refcount update leads to use-after-free

• net_sched: cls_route: remove from list when handle is 0 {CVE-2022-2588}
• netfilter: nf_tables: do not allow RULE_ID to refer to another chain {CVE-2022-2586}
• netfilter: nf_tables: do not allow SET_ID to refer to another table {CVE-2022-2586}
• netfilter: nf_tables: prevent OOB access in nft_byteorder_eval {CVE-2023-35001}
• smb: client: fix potential OOB in smb2_dump_detail() {CVE-2023-6610}
• smb: client: fix OOB in smbCalcSize() {CVE-2023-6606}
• ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet {CVE-2023-6932}
• perf: Fix perf_event_validate_size() lockdep splat {CVE-2023-6931}
• perf: Fix perf_event_validate_size() {CVE-2023-6931}

• net_sched: cls_route: remove from list when handle is 0 {CVE-2022-2588}
• netfilter: nf_tables: do not allow RULE_ID to refer to another chain {CVE-2022-2586}
• netfilter: nf_tables: do not allow SET_ID to refer to another table {CVE-2022-2586}
• netfilter: nf_tables: prevent OOB access in nft_byteorder_eval {CVE-2023-35001}
• smb: client: fix potential OOB in smb2_dump_detail() {CVE-2023-6610}
• smb: client: fix OOB in smbCalcSize() {CVE-2023-6606}
• ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet {CVE-2023-6932}
• perf: Fix perf_event_validate_size() lockdep splat {CVE-2023-6931}
• perf: Fix perf_event_validate_size() {CVE-2023-6931}

It was discovered that the Broadcom FullMAC USB WiFi driver in the Linux kernel did not properly perform data buffer size validation in some situations. A physically proximate attacker could use this to craft a malicious USB device that when inserted, could cause a denial of service (system crash) or possibly expose sensitive information.(CVE-2023-1380)

Reima Ishii discovered that the nested KVM implementation for Intel x86 processors in the Linux kernel did not properly validate control registers in certain situations. An attacker in a guest VM could use this to cause a denial of service (guest crash).(CVE-2023-30456)

Mingi Cho discovered that the netfilter subsystem in the Linux kernel did not properly validate the status of a nft chain while performing a lookup by id, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-2023-31248)

Gwangun Jung discovered that the Quick Fair Queueing scheduler implementation in the Linux kernel contained an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-2023-31436)

Tanguy Dubroca discovered that the netfilter subsystem in the Linux kernel did not properly handle certain pointer data type, leading to an out-of- bounds write vulnerability. A privileged attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-2023-35001)

It was discovered that the IP-VLAN network driver for the Linux kernel did not properly initialize memory in some situations, leading to an out-of- bounds write vulnerability. An attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-2023-3090)

Querijn Voet discovered that a race condition existed in the io_uring subsystem in the Linux kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-2023-3389)

It was discovered that the netfilter subsystem in the Linux kernel did not properly handle some error conditions, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-2023-3390)

Mingi Cho discovered that the netfilter subsystem in the Linux kernel did not properly validate the status of a nft chain while performing a lookup by id, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-2023-31248)

Shir Tamari and Sagi Tzadik discovered that the OverlayFS implementation in the Ubuntu Linux kernel did not properly perform permission checks in certain situations. A local attacker could possibly use this to gain elevated privileges.(CVE-2023-32629)

Tanguy Dubroca discovered that the netfilter subsystem in the Linux kernel did not properly handle certain pointer data type, leading to an out-of- bounds write vulnerability. A privileged attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-2023-35001)

Hangyu Hua discovered that the Flower classifier implementation in the Linux kernel contained an out-of-bounds write vulnerability. An attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-2023-35788)

This kernel update is based on upstream 5.15.120 and fixes atleast the following security issues:

A flaw null pointer dereference in the Linux kernel DECnet networking protocol was found. A remote user could use this flaw to crash the system. This is fixed by removing DECnet support (CVE-2023-3338).

A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in net/netfilter/nf_tables_api.c. Mishandled error handling with NFT_MSG_NEWRULE makes it possible to use a dangling pointer in the same transaction causing a use-after-free vulnerability. This flaw allows a local attacker with user access to cause a privilege escalation issue (CVE-2023-3390).

Linux Kernel nftables Use-After-Free Local Privilege Escalation Vulnerability; nft_chain_lookup_byid() failed to check whether a chain was active and CAP_NET_ADMIN is in any user or network namespace (CVE-2023-31248).

Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm register contents when CAP_NET_ADMIN is in any user or network namespace (CVE-2023-35001).

NOTE!! This kernel also contains a fix for dkms builds hanging / stalling during upgrade to Mageia 9 (mga#31982) due to the new make 4.4 series utility ending up in a loop processing Makefile in kernel-devel packages. So if you use dkms packaged drivers, you need to be running this kernel (or any later released ones) before you do an online upgrade to avoid the upgrade stalling / hanging.

For other upstream fixes in this update, see the referenced changelogs.

This kernel-linus update is based on upstream 5.15.122 and fixes atleast the following security issues:

Under specific microarchitectural circumstances, a register in "Zen 2" CPUs may not be written to 0 correctly. This may cause data from another process and/or thread to be stored in the YMM register, which may allow an attacker to potentially access sensitive information (CVE-2023-20593, also known as Zenbleed).

This update adds a kernel-side mitigation for this issue to protect users until Amd gets their fixed microcode / AGESA updates out for all affected CPUs. The fixed microcode for Amd EPYC gen2 is available in the microcode-0.20230613-2.mga8.nonfree package. For other affected CPUs, see the referenced amd.com url that has info about estimated microcode update timelines for various CPUs.

Linux Kernel nftables Use-After-Free Local Privilege Escalation Vulnerability; nft_chain_lookup_byid() failed to check whether a chain was active and CAP_NET_ADMIN is in any user or network namespace (CVE-2023-31248).

Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm register contents when CAP_NET_ADMIN is in any user or network namespace (CVE-2023-35001).

For other upstream fixes in this update, see the referenced changelogs.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: UAF in nftables when nft_set_lookup_global triggered after handling named and anonymous sets in batch requests (CVE-2023-3390)

• kernel: netfilter: nf_tables: fix chain binding transaction logic in the abort path of NFT_MSG_NEWRULE (CVE-2023-3610)

• kernel: net/sched: cls_fw component can be exploited as result of failure in tcf_change_indev function (CVE-2023-3776)

• kernel: netfilter: use-after-free due to improper element removal in nft_pipapo_remove() (CVE-2023-4004)

• kernel: netfilter: nf_tables_newrule when adding a rule with NFTA_RULE_CHAIN_ID leads to use-after-free (CVE-2023-4147)

• kernel: nf_tables: use-after-free in nft_chain_lookup_byid() (CVE-2023-31248)

• kernel: nf_tables: stack-out-of-bounds-read in nft_byteorder_eval() (CVE-2023-35001)

• kernel: save/restore speculative MSRs during S3 suspend/resume (CVE-2023-1637)

• hw: amd: Cross-Process Information Leak (CVE-2023-20593)

• kernel: bypass of shadow stack protection due to a logic error (CVE-2023-21102)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• kernel-rt: update RT source tree to the latest Rocky Linux-9.2.z3 Batch (BZ#2228482)

The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-20593: Fixed a ZenBleed issue in 'Zen 2' CPUs that could allow an attacker to potentially access sensitive information (bsc#1213286).
• CVE-2023-2985: Fixed an use-after-free vulnerability in hfsplus_put_super in fs/hfsplus/super.c that could allow a local user to cause a denial of service (bsc#1211867).
• CVE-2023-35001: Fixed an out-of-bounds memory access flaw in nft_byteorder that could allow a local attacker to escalate their privilege (bsc#1213059).

The following non-security bugs were fixed:

• Get module prefix from kmod (bsc#1212835).
• USB: add NO_LPM quirk for Realforce 87U Keyboard (git-fixes).
• USB: core: add quirk for Alcor Link AK9563 smartcard reader (git-fixes).
• USB: core: hub: Disable autosuspend for Cypress CY7C65632 (git-fixes).
• USB: hcd-pci: Fully suspend across freeze/thaw cycle (git-fixes).
• USB: hub: Add delay for SuperSpeed hub resume to let links transit to U0 (git-fixes).
• USB: serial: option: add Fibocom FM160 0x0111 composition (git-fixes).
• USB: serial: option: add Quectel EM05-G (GR) modem (git-fixes).
• USB: serial: option: add Quectel EM05-G (RS) modem (git-fixes).
• USB: serial: option: add Sierra Wireless EM9191 (git-fixes).
• USB: serial: option: add u-blox LARA-R6 00B modem (git-fixes).
• blkcg, writeback: dead memcgs shouldn't contribute to writeback ownership arbitration (bsc#1213022).
• btrfs: fix resolving backrefs for inline extent followed by prealloc (bsc#1213133).
• dlm: Delete an unnecessary variable initialisation in dlm_ls_start() (git-fixes).
• dlm: NULL check before kmem_cache_destroy is not needed (git-fixes).
• dlm: fix invalid cluster name warning (git-fixes).
• dlm: fix missing idr_destroy for recover_idr (git-fixes).
• dlm: fix missing lkb refcount handling (git-fixes).
• dlm: fix plock invalid read (git-fixes).
• dlm: fix possible call to kfree() for non-initialized pointer (git-fixes).
• ext4: Fix reusing stale buffer heads from last failed mounting (bsc#1213020).
• ext4: add inode table check in __ext4_get_inode_loc to aovid possible infinite loop (bsc#1207617).
• ext4: avoid BUG_ON when creating xattrs (bsc#1205496).
• ext4: avoid unaccounted block allocation when expanding inode (bsc#1207634).
• ext4: bail out of ext4_xattr_ibody_get() fails for any reason (bsc#1213018).
• ext4: fail ext4_iget if special inode unallocated (bsc#1213010).
• ext4: fix RENAME_WHITEOUT handling for inline directories (bsc#1210766).
• ext4: fix WARNING in ext4_update_inline_data (bsc#1213012).
• ext4: fix bug_on in __es_tree_search caused by bad boot loader inode (bsc#1207620).
• ext4: fix cgroup writeback accounting with fs-layer encryption (bsc#1210765).
• ext4: fix deadlock due to mbcache entry corruption (bsc#1207653).
• ext4: fix error code return to user-space in ext4_get_branch() (bsc#1207630).
• ext4: fix i_disksize exceeding i_size problem in paritally written case (bsc#1213015).
• ext4: fix to check return value of freeze_bdev() in ext4_shutdown() (bsc#1213021).
• ext4: improve error recovery code paths in __ext4_remount() (bsc#1213017).
• ext4: init quota for 'old.inode' in 'ext4_rename' (bsc#1207629).
• ext4: initialize quota before expanding inode in setproject ioctl (bsc#1207633).
• ext4: move where set the MAY_INLINE_DATA flag is set (bsc#1213011).
• ext4: only update i_reserved_data_blocks on successful block allocation (bsc#1213019).
• ext4: zero i_disksize when initializing the bootloader inode (bsc#1213013).
• fs: dlm: cancel work sync othercon (git-fixes).
• fs: dlm: filter user dlm messages for kernel locks (git-fixes).
• fs: dlm: fix configfs memory leak (git-fixes).
• fs: dlm: fix debugfs dump (git-fixes).
• fs: dlm: fix memory leak when fenced (git-fixes).
• fs: dlm: fix race between test_bit() and queue_work() (git-fixes).
• fs: dlm: handle -EBUSY first in lock arg validation (git-fixes).
• fs: fix…

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-2985: Fixed an use-after-free vulnerability in hfsplus_put_super in fs/hfsplus/super.c that could allow a local user to cause a denial of service (bsc#1211867).
• CVE-2023-3117: Fixed an use-after-free vulnerability in the netfilter subsystem when processing named and anonymous sets in batch requests that could allow a local user with CAP_NET_ADMIN capability to crash or potentially escalate their privileges on the system (bsc#1213245).
• CVE-2023-3390: Fixed an use-after-free vulnerability in the netfilter subsystem in net/netfilter/nf_tables_api.c that could allow a local attacker with user access to cause a privilege escalation issue (bsc#1212846).
• CVE-2023-3812: Fixed an out-of-bounds memory access flaw in the TUN/TAP device driver functionality that could allow a local user to crash or potentially escalate their privileges on the system (bsc#1213543).
• CVE-2023-20593: Fixed a ZenBleed issue in 'Zen 2' CPUs that could allow an attacker to potentially access sensitive information (bsc#1213286).
• CVE-2023-31248: Fixed an use-after-free vulnerability in nft_chain_lookup_byid that could allow a local attacker to escalate their privilege (bsc#1213061).
• CVE-2023-35001: Fixed an out-of-bounds memory access flaw in nft_byteorder that could allow a local attacker to escalate their privilege (bsc#1213059).

The following non-security bugs were fixed:

• ACPI: utils: Fix acpi_evaluate_dsm_typed() redefinition error (git-fixes).
• ALSA: fireface: make read-only const array for model names static (git-fixes).
• ALSA: hda/realtek - remove 3k pull low procedure (git-fixes).
• ALSA: hda/realtek: Add quirk for ASUS ROG G614Jx (git-fixes).
• ALSA: hda/realtek: Add quirk for ASUS ROG GA402X (git-fixes).
• ALSA: hda/realtek: Add quirk for ASUS ROG GX650P (git-fixes).
• ALSA: hda/realtek: Add quirk for ASUS ROG GZ301V (git-fixes).
• ALSA: hda/realtek: Add quirk for Clevo NPx0SNx (git-fixes).
• ALSA: hda/realtek: Add quirk for Clevo NS70AU (git-fixes).
• ALSA: hda/realtek: Add quirks for Unis H3C Desktop B760 & Q760 (git-fixes).
• ALSA: hda/realtek: Add support for DELL Oasis 13/14/16 laptops (git-fixes).
• ALSA: hda/realtek: Amend G634 quirk to enable rear speakers (git-fixes).
• ALSA: hda/realtek: Enable Mute LED on HP Laptop 15s-eq2xxx (git-fixes).
• ALSA: hda/realtek: Fix generic fixup definition for cs35l41 amp (git-fixes).
• ALSA: hda/realtek: Whitespace fix (git-fixes).
• ALSA: hda: fix a possible null-pointer dereference due to data race in snd_hdac_regmap_sync() (git-fixes).
• ALSA: oxfw: make read-only const array models static (git-fixes).
• ALSA: pcm: Fix potential data race at PCM memory allocation helpers (git-fixes).
• ASoC: codecs: wcd-mbhc-v2: fix resource leaks on component remove (git-fixes).
• ASoC: codecs: wcd934x: fix resource leaks on component remove (git-fixes).
• ASoC: codecs: wcd938x: fix codec initialisation race (git-fixes).
• ASoC: codecs: wcd938x: fix dB range for HPHL and HPHR (git-fixes).
• ASoC: codecs: wcd938x: fix missing clsh ctrl error handling (git-fixes).
• ASoC: codecs: wcd938x: fix soundwire initialisation race (git-fixes).
• ASoC: tegra: Fix ADX byte map (git-fixes).
• ASoC: tegra: Fix AMX byte map (git-fixes).
• Add MODULE_FIRMWARE() for FIRMWARE_TG357766 (git-fixes).
• Documentation: ABI: sysfs-class-net-qmi: pass_through contact update (git-fixes).
• Documentation: bonding: fix the doc of peer_notif_delay (git-fixes).
• Documentation: timers: hrtimers: Make hybrid union historical (git-fixes).
• Enable NXP SNVS RTC driver for i.MX 8MQ/8MP (jsc#PED-4758)
• Fix documentation of panic_on_warn (git-fixes).
• IB/hfi1: Use bitmap_zalloc() when applicable (git-fixes)
• PCI/PM: Avoid putting EloPOS E2/S2/H2 PCIe Ports in D3cold (git-fixes).
• PCI: Add function 1 DMA alias quirk for Marvell 88SE9235 (git-fixes).
• RDMA/rxe: Fix access checks in…