CVE-2023-3611

An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation.

The qfq_change_agg() function in net/sched/sch_qfq.c allows an out-of-bounds write because lmax is updated according to packet sizes without bounds checks.

We recommend upgrading past commit 3e337087c3b5805fe0b8a46ba622a962880b5d64.

An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation. The qfq_change_agg() function in net/sched/sch_qfq.c allows an out-of-bounds write because lmax is updated according to packet sizes without bounds checks. We recommend upgrading past commit 3e337087c3b5805fe0b8a46ba622a962880b5d64.

The Linux Kernel, the operating system core itself.

Security Fix(es):

In multiple functions of binder.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

(CVE-2023-21255)

(CVE-2023-2163)

A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the handling of SMB2_TREE_CONNECT and SMB2_QUERY_INFO commands. The issue results from the lack of proper validation of a pointer prior to accessing it. An attacker can leverage this vulnerability to create a denial-of-service condition on the system.(CVE-2023-32248)

VUL-0: CVE-2023-32255: kernel: Linux Kernel ksmbd Session Setup Memory Leak Denial-of-Service Vulnerability(CVE-2023-32255)

A use-after-free flaw was found in vcs_read in drivers/tty/vt/vc_screen.c in vc_screen in the Linux Kernel. This flaw allows an attacker with local user access to cause a system crash or leak internal kernel information.(CVE-2023-3567)

A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation.

If tcf_change_indev() fails, u32_set_parms() will immediately return an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability.

We recommend upgrading past commit 04c55383fa5689357bcdd2c8036725a55ed632bc.

(CVE-2023-3609)

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.

Flaw in the error handling of bound chains causes a use-after-free in the abort path of NFT_MSG_NEWRULE. The vulnerability requires CAP_NET_ADMIN to be triggered.

We recommend upgrading past commit 4bedf9eee016286c835e3d8fa981ddece5338795.

(CVE-2023-3610)

An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation.

The qfq_change_agg() function in net/sched/sch_qfq.c allows an out-of-bounds write because lmax is updated according to packet sizes without bounds checks.

We recommend upgrading past commit 3e337087c3b5805fe0b8a46ba622a962880b5d64.

(CVE-2023-3611)

A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to achieve local privilege escalation.

If tcf_change_indev() fails, fw_set_parms() will immediately return an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability.

We recommend upgrading past commit 0323bce598eea038714f941ce2b22541c46d488f.

(CVE-2023-3776)

An issue was discovered in the Linux kernel before 6.3.4. ksmbd has an out-of-bounds read in smb2_find_context_vals when create_context's name_len is larger than the tag length.(CVE-2023-38426)

An issue was discovered in the Linux kernel before 6.3.4. fs/ksmbd/smb2pdu.c in ksmbd does not properly check the UserName value because it does not consider the address of security buffer, leading to an out-of-bounds read.(CVE-2023-38428)

The Linux Kernel, the operating system core itself.

Security Fix(es):

In multiple functions of binder.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

(CVE-2023-21255)

(CVE-2023-2163)

A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the handling of SMB2_TREE_CONNECT and SMB2_QUERY_INFO commands. The issue results from the lack of proper validation of a pointer prior to accessing it. An attacker can leverage this vulnerability to create a denial-of-service condition on the system.(CVE-2023-32248)

VUL-0: CVE-2023-32255: kernel: Linux Kernel ksmbd Session Setup Memory Leak Denial-of-Service Vulnerability(CVE-2023-32255)

A use-after-free flaw was found in vcs_read in drivers/tty/vt/vc_screen.c in vc_screen in the Linux Kernel. This flaw allows an attacker with local user access to cause a system crash or leak internal kernel information.(CVE-2023-3567)

A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation.

If tcf_change_indev() fails, u32_set_parms() will immediately return an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability.

We recommend upgrading past commit 04c55383fa5689357bcdd2c8036725a55ed632bc.

(CVE-2023-3609)

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.

Flaw in the error handling of bound chains causes a use-after-free in the abort path of NFT_MSG_NEWRULE. The vulnerability requires CAP_NET_ADMIN to be triggered.

We recommend upgrading past commit 4bedf9eee016286c835e3d8fa981ddece5338795.

(CVE-2023-3610)

An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation.

The qfq_change_agg() function in net/sched/sch_qfq.c allows an out-of-bounds write because lmax is updated according to packet sizes without bounds checks.

We recommend upgrading past commit 3e337087c3b5805fe0b8a46ba622a962880b5d64.

(CVE-2023-3611)

A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to achieve local privilege escalation.

If tcf_change_indev() fails, fw_set_parms() will immediately return an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability.

We recommend upgrading past commit 0323bce598eea038714f941ce2b22541c46d488f.

(CVE-2023-3776)

An issue was discovered in the Linux kernel before 6.3.4. ksmbd has an out-of-bounds read in smb2_find_context_vals when create_context's name_len is larger than the tag length.(CVE-2023-38426)

An issue was discovered in the Linux kernel before 6.3.4. fs/ksmbd/smb2pdu.c in ksmbd does not properly check the UserName value because it does not consider the address of security buffer, leading to an out-of-bounds read.(CVE-2023-38428)

The Linux Kernel, the operating system core itself.

Security Fix(es):

In multiple functions of binder.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

(CVE-2023-21255)

A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation.

If tcf_change_indev() fails, u32_set_parms() will immediately return an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability.

We recommend upgrading past commit 04c55383fa5689357bcdd2c8036725a55ed632bc.

(CVE-2023-3609)

An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation.

The qfq_change_agg() function in net/sched/sch_qfq.c allows an out-of-bounds write because lmax is updated according to packet sizes without bounds checks.

We recommend upgrading past commit 3e337087c3b5805fe0b8a46ba622a962880b5d64.

(CVE-2023-3611)

A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to achieve local privilege escalation.

If tcf_change_indev() fails, fw_set_parms() will immediately return an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability.

We recommend upgrading past commit 0323bce598eea038714f941ce2b22541c46d488f.

(CVE-2023-3776)

An out-of-bounds memory access flaw was found in the Linux kernel’s TUN/TAP device driver functionality in how a user generates a malicious (too big) networking packet when napi frags is enabled. This flaw allows a local user to crash or potentially escalate their privileges on the system.(CVE-2023-3812)

The Linux Kernel, the operating system core itself.

Security Fix(es):

In multiple functions of binder.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

(CVE-2023-21255)

A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation.

If tcf_change_indev() fails, u32_set_parms() will immediately return an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability.

We recommend upgrading past commit 04c55383fa5689357bcdd2c8036725a55ed632bc.

(CVE-2023-3609)

An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation.

The qfq_change_agg() function in net/sched/sch_qfq.c allows an out-of-bounds write because lmax is updated according to packet sizes without bounds checks.

We recommend upgrading past commit 3e337087c3b5805fe0b8a46ba622a962880b5d64.

(CVE-2023-3611)

A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to achieve local privilege escalation.

If tcf_change_indev() fails, fw_set_parms() will immediately return an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability.

We recommend upgrading past commit 0323bce598eea038714f941ce2b22541c46d488f.

(CVE-2023-3776)

An out-of-bounds memory access flaw was found in the Linux kernel’s TUN/TAP device driver functionality in how a user generates a malicious (too big) networking packet when napi frags is enabled. This flaw allows a local user to crash or potentially escalate their privileges on the system.(CVE-2023-3812)

The Linux Kernel, the operating system core itself.

Security Fix(es):

In multiple functions of binder.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

(CVE-2023-21255)

(CVE-2023-2163)

A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the handling of SMB2_TREE_CONNECT and SMB2_QUERY_INFO commands. The issue results from the lack of proper validation of a pointer prior to accessing it. An attacker can leverage this vulnerability to create a denial-of-service condition on the system.(CVE-2023-32248)

VUL-0: CVE-2023-32255: kernel: Linux Kernel ksmbd Session Setup Memory Leak Denial-of-Service Vulnerability(CVE-2023-32255)

A use-after-free flaw was found in vcs_read in drivers/tty/vt/vc_screen.c in vc_screen in the Linux Kernel. This flaw allows an attacker with local user access to cause a system crash or leak internal kernel information.(CVE-2023-3567)

A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation.

If tcf_change_indev() fails, u32_set_parms() will immediately return an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability.

We recommend upgrading past commit 04c55383fa5689357bcdd2c8036725a55ed632bc.

(CVE-2023-3609)

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.

Flaw in the error handling of bound chains causes a use-after-free in the abort path of NFT_MSG_NEWRULE. The vulnerability requires CAP_NET_ADMIN to be triggered.

We recommend upgrading past commit 4bedf9eee016286c835e3d8fa981ddece5338795.

(CVE-2023-3610)

An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation.

The qfq_change_agg() function in net/sched/sch_qfq.c allows an out-of-bounds write because lmax is updated according to packet sizes without bounds checks.

We recommend upgrading past commit 3e337087c3b5805fe0b8a46ba622a962880b5d64.

(CVE-2023-3611)

A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to achieve local privilege escalation.

If tcf_change_indev() fails, fw_set_parms() will immediately return an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability.

We recommend upgrading past commit 0323bce598eea038714f941ce2b22541c46d488f.

(CVE-2023-3776)

An out-of-bounds memory access flaw was found in the Linux kernel’s TUN/TAP device driver functionality in how a user generates a malicious (too big) networking packet when napi frags is enabled. This flaw allows a local user to crash or potentially escalate their privileges on the system.(CVE-2023-3812)

An issue was discovered in the Linux kernel before 6.3.4. ksmbd has an out-of-bounds read in smb2_find_context_vals when create_context's name_len is larger than the tag length.(CVE-2023-38426)

An issue was discovered in the Linux kernel before 6.3.4. fs/ksmbd/smb2pdu.c in ksmbd does not properly check the UserName value because it does not consider the address of security buffer, leading to an out-of-bounds read.(CVE-2023-38428)

An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation. The qfq_change_agg() function in net/sched/sch_qfq.c allows an out-of-bounds write because lmax is updated according to packet sizes without bounds checks. We recommend upgrading past commit 3e337087c3b5805fe0b8a46ba622a962880b5d64.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: tun: avoid double free in tun_free_netdev (CVE-2022-4744)
• kernel: net/sched: multiple vulnerabilities (CVE-2023-3609, CVE-2023-3611, CVE-2023-4128, CVE-2023-4206, CVE-2023-4207, CVE-2023-4208)
• kernel: out-of-bounds write in qfq_change_class function (CVE-2023-31436)
• kernel: out-of-bounds write in hw_atl_utils_fw_rpc_wait (CVE-2021-43975)
• kernel: Rate limit overflow messages in r8152 in intr_callback (CVE-2022-3594)
• kernel: use after free flaw in l2cap_conn_del (CVE-2022-3640)
• kernel: double free in usb_8dev_start_xmit (CVE-2022-28388)
• kernel: vmwgfx: multiple vulnerabilities (CVE-2022-38457, CVE-2022-40133, CVE-2023-33951, CVE-2023-33952)
• hw: Intel: Gather Data Sampling (GDS) side channel vulnerability (CVE-2022-40982)
• kernel: Information leak in l2cap_parse_conf_req (CVE-2022-42895)
• kernel: KVM: multiple vulnerabilities (CVE-2022-45869, CVE-2023-4155, CVE-2023-30456)
• kernel: memory leak in ttusb_dec_exit_dvb (CVE-2022-45887)
• kernel: speculative pointer dereference in do_prlimit (CVE-2023-0458)
• kernel: use-after-free due to race condition in qdisc_graft (CVE-2023-0590)
• kernel: x86/mm: Randomize per-cpu entry area (CVE-2023-0597)
• kernel: HID: check empty report_list in hid_validate_values (CVE-2023-1073)
• kernel: sctp: fail if no bound addresses can be used for a given scope (CVE-2023-1074)
• kernel: hid: Use After Free in asus_remove (CVE-2023-1079)
• kernel: use-after-free in drivers/media/rc/ene_ir.c (CVE-2023-1118)
• kernel: hash collisions in the IPv6 connection lookup table (CVE-2023-1206)
• kernel: ovl: fix use after free in struct ovl_aio_req (CVE-2023-1252)
• kernel: denial of service in tipc_conn_close (CVE-2023-1382)
• kernel: Use after free bug in btsdio_remove due to race condition (CVE-2023-1989)
• kernel: Spectre v2 SMT mitigations problem (CVE-2023-1998)
• kernel: ext4: use-after-free in ext4_xattr_set_entry (CVE-2023-2513)
• kernel: fbcon: shift-out-of-bounds in fbcon_set_font (CVE-2023-3161)
• kernel: out-of-bounds access in relay_file_read (CVE-2023-3268)
• kernel: xfrm: NULL pointer dereference in xfrm_update_ae_params (CVE-2023-3772)
• kernel: smsusb: use-after-free caused by do_submit_urb (CVE-2023-4132)
• kernel: Race between task migrating pages and another task calling exit_mmap (CVE-2023-4732)
• Kernel: denial of service in atm_tc_enqueue due to type confusion (CVE-2023-23455)
• kernel: mpls: double free on sysctl allocation failure (CVE-2023-26545)
• kernel: Denial of service issue in az6027 driver (CVE-2023-28328)
• kernel: lib/seq_buf.c has a seq_buf_putmem_hex buffer overflow (CVE-2023-28772)
• kernel: blocking operation in dvb_frontend_get_event and wait_event_interruptible (CVE-2023-31084)
• kernel: net: qcom/emac: race condition leading to use-after-free in emac_remove (CVE-2023-33203)
• kernel: saa7134: race condition leading to use-after-free in saa7134_finidev (CVE-2023-35823)
• kernel: dm1105: race condition leading to use-after-free in dm1105_remove.c (CVE-2023-35824)
• kernel: r592: race condition leading to use-after-free in r592_remove (CVE-2023-35825)
• kernel: net/tls: tls_is_tx_ready() checked list_entry (CVE-2023-1075)
• kernel: use-after-free bug in remove function xgene_hwmon_remove (CVE-2023-1855)
• kernel: Use after free bug in r592_remove (CVE-2023-3141)
• kernel: gfs2: NULL pointer dereference in gfs2_evict_inode (CVE-2023-3212)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

• CVE-url: https://ubuntu.com/security/CVE-2023-4128
  • net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after- free
  • net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after- free
  • net/sched: cls_route: No longer copy tcf_result on update to avoid use- after-free
• CVE-url: https://ubuntu.com/security/CVE-2023-40283
  • Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb
• Jammy update: v5.15.42 upstream stable release (LP: #1981375) // CVE-url: https://ubuntu.com/security/CVE-2023-4387
  • net: vmxnet3: fix possible use-after-free bugs in vmxnet3_rq_alloc_rx_buf()
• CVE-2023-20593 // CVE-url: https://ubuntu.com/security/CVE-2023-20593
  • x86/cpu/amd: Move the errata checking functionality up
  • x86/cpu/amd: Add a Zenbleed fix
• CVE-2023-35001 // CVE-url: https://ubuntu.com/security/CVE-2023-35001
  • netfilter: nf_tables: prevent OOB access in nft_byteorder_eval
• Bionic update: upstream stable patchset 2023-04-05 (LP: #2015399) // CVE- url: https://ubuntu.com/security/CVE-2023-3567
  • vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF
• CVE-url: https://ubuntu.com/security/CVE-2023-0458
  • prlimit: do_prlimit needs to have a speculation check
• CVE-url: https://ubuntu.com/security/CVE-2023-2513
  • ext4: fix use-after-free in ext4_xattr_set_entry
• Jammy update: v5.15.61 upstream stable release (LP: #1990162) // CVE-url: https://ubuntu.com/security/CVE-2023-2513
  • ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h
• CVE-url: https://ubuntu.com/security/CVE-2023-3159
  • firewire: fix potential uaf in outbound_phy_packet_callback()
• Jammy update: v5.15.106 upstream stable release (LP: #2023233) // CVE-url: https://ubuntu.com/security/CVE-2023-1611
  • btrfs: fix race between quota disable and quota assign ioctls
• CVE-url: https://ubuntu.com/security/CVE-2023-3611
  • net/sched: sch_qfq: account for stab overhead in qfq_enqueue
• CVE-2023-3776 // CVE-url: https://ubuntu.com/security/CVE-2023-3776
  • net/sched: cls_fw: Fix improper refcount update leads to use-after-free

• CVE-url: https://ubuntu.com/security/CVE-2023-4128
  • net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after- free
  • net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after- free
  • net/sched: cls_route: No longer copy tcf_result on update to avoid use- after-free
• CVE-url: https://ubuntu.com/security/CVE-2023-40283
  • Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb
• Jammy update: v5.15.42 upstream stable release (LP: #1981375) // CVE-url: https://ubuntu.com/security/CVE-2023-4387
  • net: vmxnet3: fix possible use-after-free bugs in vmxnet3_rq_alloc_rx_buf()
• CVE-2023-20593 // CVE-url: https://ubuntu.com/security/CVE-2023-20593
  • x86/cpu/amd: Move the errata checking functionality up
  • x86/cpu/amd: Add a Zenbleed fix
• CVE-2023-35001 // CVE-url: https://ubuntu.com/security/CVE-2023-35001
  • netfilter: nf_tables: prevent OOB access in nft_byteorder_eval
• Bionic update: upstream stable patchset 2023-04-05 (LP: #2015399) // CVE- url: https://ubuntu.com/security/CVE-2023-3567
  • vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF
• CVE-url: https://ubuntu.com/security/CVE-2023-0458
  • prlimit: do_prlimit needs to have a speculation check
• CVE-url: https://ubuntu.com/security/CVE-2023-2513
  • ext4: fix use-after-free in ext4_xattr_set_entry
• Jammy update: v5.15.61 upstream stable release (LP: #1990162) // CVE-url: https://ubuntu.com/security/CVE-2023-2513
  • ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h
• CVE-url: https://ubuntu.com/security/CVE-2023-3159
  • firewire: fix potential uaf in outbound_phy_packet_callback()
• Jammy update: v5.15.106 upstream stable release (LP: #2023233) // CVE-url: https://ubuntu.com/security/CVE-2023-1611
  • btrfs: fix race between quota disable and quota assign ioctls
• CVE-url: https://ubuntu.com/security/CVE-2023-3611
  • net/sched: sch_qfq: account for stab overhead in qfq_enqueue
• CVE-2023-3776 // CVE-url: https://ubuntu.com/security/CVE-2023-3776
  • net/sched: cls_fw: Fix improper refcount update leads to use-after-free

• netfilter: nft_set_pipapo: fix improper element removal {CVE-2023-4004}
• net: tun: fix bugs for oversize packet when napi frags enabled {CVE-2023-3812}
• net/sched: cls_fw: Fix improper refcount update leads to use-after-free {CVE-2023-3776}
• net/sched: sch_qfq: account for stab overhead in qfq_enqueue {CVE-2023-3611}
• net/sched: sch_qfq: refactor parsing of netlink parameters
• ipvlan:Fix out-of-bounds caused by unclear skb->cb {CVE-2023-3090}
• media: saa7134: fix use after free bug in saa7134_finidev due to race condition {CVE-2023-35823}
• media: dm1105: Fix use after free bug in dm1105_remove due to race condition {CVE-2023-35824}
• memstick: r592: Fix UAF bug in r592_remove due to race condition {CVE-2023-3141}
• ovl: fix use after free in struct ovl_aio_req {CVE-2023-1252}
• xen/netfront: don't use gnttab_query_foreign_access() for mapped status {CVE-2022-23037}
• xen/netfront: react properly to failing gnttab_end_foreign_access_ref() {CVE-2022-23042}
• xen/netfront: don't trust the backend response data blindly
• xen/netfront: disentangle tx_skb_freelist
• xen: sync include/xen/interface/io/ring.h with Xen's newest version
• net/sched: flower: fix possible OOB write in fl_set_geneve_opt() {CVE-2023-35788}
• rds: rds_rm_zerocopy_callback() use list_first_entry() {CVE-2023-1078}
• misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault and gru_handle_user_call_os {CVE-2022-3424}
• NFSD: Cap rsize_bop result based on send buffer size {CVE-2022-43945}
• NFSD: Protect against send buffer overflow in NFSv3 READ {CVE-2022-43945}
• NFSD: Protect against send buffer overflow in NFSv2 READ {CVE-2022-43945}
• SUNRPC: Fix svcxdr_init_encode's buflen calculation {CVE-2022-43945}
• SUNRPC: Fix svcxdr_init_decode's end-of-buffer calculation {CVE-2022-43945}
• mm/mremap: hold the rmap lock in write mode when moving page table entries. {CVE-2022-39189}
• KVM: x86: do not report a vCPU as preempted outside instruction boundaries {CVE-2022-39189}
• net: tls: fix possible race condition between do_tls_getsockopt_conf() and do_tls_setsockopt_conf() {CVE-2023-28466}
• tee: handle lookup of shm with reference count 0 {CVE-2021-44733}

• netfilter: nft_set_pipapo: fix improper element removal {CVE-2023-4004}
• net: tun: fix bugs for oversize packet when napi frags enabled {CVE-2023-3812}
• net/sched: cls_fw: Fix improper refcount update leads to use-after-free {CVE-2023-3776}
• net/sched: sch_qfq: account for stab overhead in qfq_enqueue {CVE-2023-3611}
• net/sched: sch_qfq: refactor parsing of netlink parameters
• ipvlan:Fix out-of-bounds caused by unclear skb->cb {CVE-2023-3090}
• media: saa7134: fix use after free bug in saa7134_finidev due to race condition {CVE-2023-35823}
• media: dm1105: Fix use after free bug in dm1105_remove due to race condition {CVE-2023-35824}
• memstick: r592: Fix UAF bug in r592_remove due to race condition {CVE-2023-3141}
• ovl: fix use after free in struct ovl_aio_req {CVE-2023-1252}
• xen/netfront: don't use gnttab_query_foreign_access() for mapped status {CVE-2022-23037}
• xen/netfront: react properly to failing gnttab_end_foreign_access_ref() {CVE-2022-23042}
• xen/netfront: don't trust the backend response data blindly {CVE-2022-23042}
• xen/netfront: disentangle tx_skb_freelist {CVE-2022-23042}
• xen: sync include/xen/interface/io/ring.h with Xen's newest version {CVE-2022-23042}
• net/sched: flower: fix possible OOB write in fl_set_geneve_opt() {CVE-2023-35788}
• rds: rds_rm_zerocopy_callback() use list_first_entry() {CVE-2023-1078}
• misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault and gru_handle_user_call_os {CVE-2022-3424}
• mac80211: do not accept/forward invalid EAPOL frames {CVE-2020-26139}
• bpf: Fix 32 bit src register truncation on div/mod {CVE-2021-3600}
• NFSD: Cap rsize_bop result based on send buffer size {CVE-2022-43945}
• NFSD: Protect against send buffer overflow in NFSv3 READ {CVE-2022-43945}
• SUNRPC: Fix svcxdr_init_encode's buflen calculation {CVE-2022-43945}
• KVM: x86: do not report a vCPU as preempted outside instruction boundaries {CVE-2022-39189}
• net: tls: fix possible race condition between do_tls_getsockopt_conf() and do_tls_setsockopt_conf() {CVE-2023-28466}
• tee: handle lookup of shm with reference count 0 {CVE-2021-44733}

• CVE-url: https://ubuntu.com/security/CVE-2023-4128
  • net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after- free
  • net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after- free
  • net/sched: cls_route: No longer copy tcf_result on update to avoid use- after-free
• CVE-url: https://ubuntu.com/security/CVE-2023-40283
  • Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb
• CVE-2023-20593 // CVE-url: https://ubuntu.com/security/CVE-2023-20593
  • x86/cpu/amd: Move the errata checking functionality up
  • x86/cpu/amd: Add a Zenbleed fix
• CVE-2023-1859 // CVE-url: https://ubuntu.com/security/CVE-2023-1859
  • 9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race condition
• CVE-url: https://ubuntu.com/security/CVE-2023-35001
  • netfilter: nf_tables: prevent OOB access in nft_byteorder_eval
• Jammy update: v5.15.106 upstream stable release (LP: #2023233) // CVE-url: https://ubuntu.com/security/CVE-2023-1611
  • btrfs: fix race between quota disable and quota assign ioctls
• CVE-2023-3611 // CVE-url: https://ubuntu.com/security/CVE-2023-3611
  • net/sched: sch_qfq: account for stab overhead in qfq_enqueue
• CVE-2023-3776 // CVE-url: https://ubuntu.com/security/CVE-2023-3776
  • net/sched: cls_fw: Fix improper refcount update leads to use-after-free

• CVE-url: https://ubuntu.com/security/CVE-2023-4128
  • net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after- free
  • net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after- free
  • net/sched: cls_route: No longer copy tcf_result on update to avoid use- after-free
• CVE-url: https://ubuntu.com/security/CVE-2023-40283
  • Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb
• CVE-2023-20593 // CVE-url: https://ubuntu.com/security/CVE-2023-20593
  • x86/cpu/amd: Move the errata checking functionality up
  • x86/cpu/amd: Add a Zenbleed fix
• CVE-2023-1859 // CVE-url: https://ubuntu.com/security/CVE-2023-1859
  • 9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race condition
• CVE-url: https://ubuntu.com/security/CVE-2023-35001
  • netfilter: nf_tables: prevent OOB access in nft_byteorder_eval
• Jammy update: v5.15.106 upstream stable release (LP: #2023233) // CVE-url: https://ubuntu.com/security/CVE-2023-1611
  • btrfs: fix race between quota disable and quota assign ioctls
• CVE-2023-3611 // CVE-url: https://ubuntu.com/security/CVE-2023-3611
  • net/sched: sch_qfq: account for stab overhead in qfq_enqueue
• CVE-2023-3776 // CVE-url: https://ubuntu.com/security/CVE-2023-3776
  • net/sched: cls_fw: Fix improper refcount update leads to use-after-free

• blktrace: fix dereference after null check {CVE-2019-19768}
• blktrace: Protect q->blk_trace with RCU {CVE-2019-19768}
• blktrace: fix unlocked access to init/start-stop/teardown
• blktrace: Fix potential deadlock between delete & sysfs ops
• net: fix out-of-bounds access in ops_init {CVE-2024-36883}
• net/sched: sch_qfq: account for stab overhead in qfq_enqueue {CVE-2023-3611}
• scsi: pm8001: Fix use-after-free for aborted TMF sas_task {CVE-2022-48791}
• net: fix use-after-free in tw_timer_handler {CVE-2021-46936}
• ALSA: rawmidi: Fix racy buffer resize under concurrent accesses {CVE-2020-27786}
• ALSA: rawmidi: Fix race at copying & updating the position {CVE-2020-27786}
• tty: make FONTX ioctl use the tty pointer they were actually passed {CVE-2020-25668}
• vt: keyboard: avoid signed integer overflow in k_ascii {CVE-2020-13974}

• blktrace: fix dereference after null check {CVE-2019-19768}
• blktrace: Protect q->blk_trace with RCU {CVE-2019-19768}
• blktrace: fix unlocked access to init/start-stop/teardown
• blktrace: Fix potential deadlock between delete & sysfs ops
• net: fix out-of-bounds access in ops_init {CVE-2024-36883}
• net/sched: sch_qfq: account for stab overhead in qfq_enqueue {CVE-2023-3611}
• scsi: pm8001: Fix use-after-free for aborted TMF sas_task {CVE-2022-48791}
• net: fix use-after-free in tw_timer_handler {CVE-2021-46936}
• ALSA: rawmidi: Fix racy buffer resize under concurrent accesses {CVE-2020-27786}
• ALSA: rawmidi: Fix race at copying & updating the position {CVE-2020-27786}
• tty: make FONTX ioctl use the tty pointer they were actually passed {CVE-2020-25668}
• vt: keyboard: avoid signed integer overflow in k_ascii {CVE-2020-13974}
• spec: make single build including noarch packages

The SUSE Linux Enterprise 15 SP4 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-3609: Fixed an use-after-free vulnerability in net/sched (bsc#1213586).
• CVE-2023-3611: Fixed an out-of-bounds write vulnerability in net/sched (bsc#1213585).
• CVE-2023-3812: Fixed an out-of-bounds memory access flaw in the TUN/TAP device driver functionality that could allow a local user to crash or potentially escalate their privileges on the system (bsc#1213543).
• CVE-2023-35001: Fixed an out-of-bounds memory access flaw in nft_byteorder that could allow a local attacker to escalate their privilege (bsc#1213059).
• CVE-2023-31248: Fixed an use-after-free vulnerability in nft_chain_lookup_byid that could allow a local attacker to escalate their privilege (bsc#1213061).
• CVE-2023-3390: Fixed an use-after-free vulnerability in the netfilter subsystem in net/netfilter/nf_tables_api.c that could allow a local attacker with user access to cause a privilege escalation issue (bsc#1212846).
• CVE-2023-3117: Fixed an use-after-free vulnerability in the netfilter subsystem when processing named and anonymous sets in batch requests that could allow a local user with CAP_NET_ADMIN capability to crash or potentially escalate their privileges on the system (bsc#1213245).
• CVE-2023-20593: Fixed a ZenBleed issue in 'Zen 2' CPUs that could allow an attacker to potentially access sensitive information (bsc#1213286).
• CVE-2023-2985: Fixed an use-after-free vulnerability in hfsplus_put_super in fs/hfsplus/super.c that could allow a local user to cause a denial of service (bsc#1211867).

The following non-security bugs were fixed:

• Add MODULE_FIRMWARE() for FIRMWARE_TG357766 (git-fixes).
• Drop patch that caused issues with k3s (bsc#1213705).
• Enable NXP SNVS RTC driver for i.MX 8MQ/8MP (jsc#PED-4758)
• Fix documentation of panic_on_warn (git-fixes).
• Fixed launch issue on 15-SP5 (git-fixes, bsc#1210853).
• Revert 'arm64: dts: zynqmp: Add address-cells property to interrupt (git-fixes)
• Revert 'drm/amd/display: edp do not add non-edid timings' (git-fixes).
• acpi: utils: Fix acpi_evaluate_dsm_typed() redefinition error (git-fixes).
• alsa: fireface: make read-only const array for model names static (git-fixes).
• alsa: hda/realtek - remove 3k pull low procedure (git-fixes).
• alsa: hda/realtek: Add quirk for ASUS ROG G614Jx (git-fixes).
• alsa: hda/realtek: Add quirk for ASUS ROG GA402X (git-fixes).
• alsa: hda/realtek: Add quirk for ASUS ROG GX650P (git-fixes).
• alsa: hda/realtek: Add quirk for ASUS ROG GZ301V (git-fixes).
• alsa: hda/realtek: Add quirk for Clevo NPx0SNx (git-fixes).
• alsa: hda/realtek: Add quirk for Clevo NS70AU (git-fixes).
• alsa: hda/realtek: Add quirks for Unis H3C Desktop B760 & Q760 (git-fixes).
• alsa: hda/realtek: Add support for DELL Oasis 13/14/16 laptops (git-fixes).
• alsa: hda/realtek: Amend G634 quirk to enable rear speakers (git-fixes).
• alsa: hda/realtek: Enable Mute LED on HP Laptop 15s-eq2xxx (git-fixes).
• alsa: hda/realtek: Fix generic fixup definition for cs35l41 amp (git-fixes).
• alsa: hda/realtek: Whitespace fix (git-fixes).
• alsa: hda: fix a possible null-pointer dereference due to data race in snd_hdac_regmap_sync() (git-fixes).
• alsa: oxfw: make read-only const array models static (git-fixes).
• alsa: pcm: Fix potential data race at PCM memory allocation helpers (git-fixes).
• apparmor: fix missing error check for rhashtable_insert_fast (git-fixes).
• arm64/mm: mark private VM_FAULT_X defines as vm_fault_t (git-fixes)
• arm64: dts: microchip: sparx5: do not use PSCI on reference boards (git-fixes)
• arm64: vdso: Pass (void *) to virt_to_page() (git-fixes)
• arm64: xor-neon: mark xor_arm64_neon_*() static (git-fixes)
• asoc: codecs: wcd-mbhc-v2: fix resource leaks on component remove (git-fixes).
• asoc: codecs: wcd934x: fix resource leaks on component remove (git-fixes).
• asoc: codecs: wcd938x: fix codec initialisation race…

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-40982: Fixed transient execution attack called 'Gather Data Sampling' (bsc#1206418).
• CVE-2023-0459: Fixed information leak in __uaccess_begin_nospec (bsc#1211738).
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).
• CVE-2023-20569: Fixed side channel attack ‘Inception’ or ‘RAS Poisoning’ (bsc#1213287).
• CVE-2023-20593: Fixed a ZenBleed issue in 'Zen 2' CPUs that could allow an attacker to potentially access sensitive information (bsc#1213286).
• CVE-2023-21400: Fixed several memory corruptions due to improper locking in io_uring (bsc#1213272).
• CVE-2023-2156: Fixed a flaw in the networking subsystem within the handling of the RPL protocol (bsc#1211131).
• CVE-2023-2166: Fixed NULL pointer dereference in can_rcv_filter (bsc#1210627).
• CVE-2023-2430: Fixed amissing lock for IOPOLL in io_cqring_event_overflow() in io_uring.c that could allow a privileged user to cause a denial of service (bsc#1211014).
• CVE-2023-2985: Fixed an use-after-free vulnerability in hfsplus_put_super in fs/hfsplus/super.c that could allow a local user to cause a denial of service (bsc#1211867).
• CVE-2023-3090: Fixed a heap out-of-bounds write in the ipvlan network driver (bsc#1212842).
• CVE-2023-31083: Fixed race condition in hci_uart_tty_ioctl (bsc#1210780).
• CVE-2023-3111: Fixed a use-after-free vulnerability in prepare_to_relocate in fs/btrfs/relocation.c (bsc#1212051).
• CVE-2023-3117: Fixed an use-after-free vulnerability in the netfilter subsystem when processing named and anonymous sets in batch requests that could allow a local user with CAP_NET_ADMIN capability to crash or potentially escalate their privileges on the system (bsc#1213245).
• CVE-2023-31248: Fixed an use-after-free vulnerability in nft_chain_lookup_byid that could allow a local attacker to escalate their privilege (bsc#1213061).
• CVE-2023-3212: Fixed a NULL pointer dereference flaw in the gfs2 file system (bsc#1212265).
• CVE-2023-3268: Fixed an out of bounds memory access flaw in relay_file_read_start_pos in the relayfs (bsc#1212502).
• CVE-2023-3389: Fixed a use-after-free vulnerability in the io_uring subsystem (bsc#1212838).
• CVE-2023-3390: Fixed an use-after-free vulnerability in the netfilter subsystem in net/netfilter/nf_tables_api.c that could allow a local attacker with user access to cause a privilege escalation issue (bsc#1212846).
• CVE-2023-35001: Fixed an out-of-bounds memory access flaw in nft_byteorder that could allow a local attacker to escalate their privilege (bsc#1213059).
• CVE-2023-3567: Fixed a use-after-free in vcs_read in drivers/tty/vt/vc_screen.c (bsc#1213167).
• CVE-2023-3609: Fixed reference counter leak leading to overflow in net/sched (bsc#1213586).
• CVE-2023-3611: Fixed an out-of-bounds write in net/sched sch_qfq(bsc#1213585).
• CVE-2023-3776: Fixed improper refcount update in cls_fw leads to use-after-free (bsc#1213588).
• CVE-2023-3812: Fixed an out-of-bounds memory access flaw in the TUN/TAP device driver functionality that could allow a local user to crash or potentially escalate their privileges on the system (bsc#1213543).
• CVE-2023-38409: Fixed a use-after-free in drivers/video/fbdev/core/fbcon.c (bsc#1213417).
• CVE-2023-3863: Fixed a use-after-free flaw in nfc_llcp_find_local in net/nfc/llcp_core.c in NFC (bsc#1213601).
• CVE-2023-4004: Fixed improper element removal netfilter nft_set_pipapo (bsc#1213812).

The following non-security bugs were fixed:

• acpi/iort: remove erroneous id_count check in iort_node_get_rmr_info() (git-fixes).
• acpi: cppc: add acpi disabled check to acpi_cpc_valid() (bsc#1212445).
• acpi: cppc: add definition for undefined fadt preferred pm profile value (bsc#1212445).
• acpi: fix suspend with xen pv (git-fixes).
• acpi: utils: fix acpi_evaluate_dsm_typed() redefinition error…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-20593: Fixed a ZenBleed issue in 'Zen 2' CPUs that could allow an attacker to potentially access sensitive information (bsc#1213286).
• CVE-2023-2985: Fixed an use-after-free vulnerability in hfsplus_put_super in fs/hfsplus/super.c that could allow a local user to cause a denial of service (bsc#1211867).
• CVE-2023-35001: Fixed an out-of-bounds memory access flaw in nft_byteorder that could allow a local attacker to escalate their privilege (bsc#1213059).
• CVE-2022-40982: A transient execution attack called 'Gather Data Sampling' affecting is mitigated, together with respective Intel CPU Microcode updates (bsc#1206418, CVE-2022-40982).
• CVE-2023-0459: Fixed that copy_from_user on 64-bit versions of the Linux kernel did not implement the __uaccess_begin_nospec allowing a user to bypass the 'access_ok' check which could be used to leak information (bsc#1211738).
• CVE-2023-20569: A side channel attack known as ‘Inception’ or ‘RAS Poisoning’ may allow an attacker to influence branch prediction, potentially leading to information disclosure. (bsc#1213287).
• CVE-2023-3567: A use-after-free flaw was found in vcs_read in drivers/tty/vt/vc_screen.c in vc_screen. This flaw allowed an attacker with local user access to cause a system crash or leak internal kernel information (bsc#1213167bsc#1213842).
• CVE-2023-3609: A use-after-free vulnerability was fixed in net/sched: cls_u32 component can be exploited to achieve local privilege escalation. If tcf_change_indev() fails, u32_set_parms() will immediately return an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability. (bsc#1213586).
• CVE-2023-3611: An out-of-bounds write vulnerability was fixed in net/sched: sch_qfq component can be exploited to achieve local privilege escalation. The qfq_change_agg() function in net/sched/sch_qfq.c allowed an out-of-bounds write because lmax is updated according to packet sizes without bounds checks. (bsc#1213585).
• CVE-2023-3776: A use-after-free vulnerability was fixed in net/sched: cls_fw component can be exploited to achieve local privilege escalation. If tcf_change_indev() fails, fw_set_parms() will immediately return an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability. (bsc#1213588).

The following non-security bugs were fixed:

• Fix double fget() in vhost_net_set_backend() (git-fixes).
• NFSv4.1: Always send a RECLAIM_COMPLETE after establishing lease (git-fixes).
• SUNRPC: Fix UAF in svc_tcp_listen_data_ready() (git-fixes).
• SUNRPC: remove the maximum number of retries in call_bind_status (git-fixes).
• block: Fix a source code comment in include/uapi/linux/blkzoned.h (git-fixes).
• livepatch: check kzalloc return values (git-fixes).
• media: videodev2.h: Fix struct v4l2_input tuner index comment (git-fixes).
• net/sched: sch_qfq: refactor parsing of netlink parameters (bsc#1213585).
• net: skip virtio_net_hdr_set_proto if protocol already set (git-fixes).
• net: virtio_net_hdr_to_skb: count transport header in UFO (git-fixes).
• nfsd: fix double fget() bug in __write_ports_addfd() (git-fixes).
• powerpc/64: Update Speculation_Store_Bypass in /proc/<pid>/status (bsc#1188885 ltc#193722 git-fixes).
• powerpc/security: Fix Speculation_Store_Bypass reporting on Power10 (bsc#1188885 ltc#193722 git-fixes).
• rpm/check-for-config-changes: ignore also RISCV_ISA_* and DYNAMIC_SIGFRAME They depend on CONFIG_TOOLCHAIN_HAS_*.
• s390/cio: add dev_busid sysfs entry for each subchannel (bsc#1207526).
• s390/cio: check the…

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-40982: Fixed transient execution attack called 'Gather Data Sampling' (bsc#1206418).
• CVE-2023-0459: Fixed information leak in __uaccess_begin_nospec (bsc#1211738).
• CVE-2023-20569: Fixed side channel attack ‘Inception’ or ‘RAS Poisoning’ (bsc#1213287).
• CVE-2023-21400: Fixed several memory corruptions due to improper locking in io_uring (bsc#1213272).
• CVE-2023-2156: Fixed a flaw in the networking subsystem within the handling of the RPL protocol (bsc#1211131).
• CVE-2023-2166: Fixed NULL pointer dereference in can_rcv_filter (bsc#1210627).
• CVE-2023-31083: Fixed race condition in hci_uart_tty_ioctl (bsc#1210780).
• CVE-2023-3268: Fixed an out of bounds memory access flaw in relay_file_read_start_pos in the relayfs (bsc#1212502).
• CVE-2023-3567: Fixed a use-after-free in vcs_read in drivers/tty/vt/vc_screen.c (bsc#1213167).
• CVE-2023-3609: Fixed reference counter leak leading to overflow in net/sched (bsc#1213586).
• CVE-2023-3611: Fixed an out-of-bounds write in net/sched sch_qfq(bsc#1213585).
• CVE-2023-3776: Fixed improper refcount update in cls_fw leads to use-after-free (bsc#1213588).
• CVE-2023-38409: Fixed an issue in set_con2fb_map in drivers/video/fbdev/core/fbcon.c. Because an assignment occurs only for the first vc, the fbcon_registered_fb and fbcon_display arrays can be desynchronized in fbcon_mode_deleted (the con2fb_map points at the old fb_info) (bsc#1213417).
• CVE-2023-3863: Fixed a use-after-free flaw in nfc_llcp_find_local in net/nfc/llcp_core.c in NFC. This flaw allowed a local user with special privileges to impact a kernel information leak issue (bsc#1213601).
• CVE-2023-4004: Fixed improper element removal netfilter nft_set_pipapo (bsc#1213812).

The following non-security bugs were fixed:

• ACPI: CPPC: Add ACPI disabled check to acpi_cpc_valid() (bsc#1212445).
• ACPI: CPPC: Add definition for undefined FADT preferred PM profile value (bsc#1212445).
• ACPI/IORT: Remove erroneous id_count check in iort_node_get_rmr_info() (git-fixes).
• ACPI: utils: Fix acpi_evaluate_dsm_typed() redefinition error (git-fixes).
• afs: Adjust ACK interpretation to try and cope with NAT (git-fixes).
• afs: Fix access after dec in put functions (git-fixes).
• afs: Fix afs_getattr() to refetch file status if callback break occurred (git-fixes).
• afs: Fix dynamic root getattr (git-fixes).
• afs: Fix fileserver probe RTT handling (git-fixes).
• afs: Fix infinite loop found by xfstest generic/676 (git-fixes).
• afs: Fix lost servers_outstanding count (git-fixes).
• afs: Fix server->active leak in afs_put_server (git-fixes).
• afs: Fix setting of mtime when creating a file/dir/symlink (git-fixes).
• afs: Fix updating of i_size with dv jump from server (git-fixes).
• afs: Fix vlserver probe RTT handling (git-fixes).
• afs: Return -EAGAIN, not -EREMOTEIO, when a file already locked (git-fixes).
• afs: Use refcount_t rather than atomic_t (git-fixes).
• afs: Use the operation issue time instead of the reply time for callbacks (git-fixes).
• ALSA: emu10k1: roll up loops in DSP setup code for Audigy (git-fixes).
• ALSA: hda/realtek: Add quirk for Clevo NS70AU (git-fixes).
• ALSA: hda/realtek: Add support for DELL Oasis 13/14/16 laptops (git-fixes).
• ALSA: hda/realtek: Enable Mute LED on HP Laptop 15s-eq2xxx (git-fixes).
• ALSA: hda/realtek: Fix generic fixup definition for cs35l41 amp (git-fixes).
• ALSA: hda/realtek - remove 3k pull low procedure (git-fixes).
• ALSA: hda/realtek: Support ASUS G713PV laptop (git-fixes).
• ALSA: hda/relatek: Enable Mute LED on HP 250 G8 (git-fixes).
• ALSA: usb-audio: Add FIXED_RATE quirk for JBL Quantum610 Wireless (git-fixes).
• ALSA: usb-audio: Add new quirk FIXED_RATE for JBL Quantum810 Wireless (git-fixes).
• ALSA: usb-audio: Add quirk for Microsoft Modern Wireless Headset (bsc#1207129).
• ALSA: usb-audio: Always initialize…

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-40982: Fixed transient execution attack called 'Gather Data Sampling' (bsc#1206418).
• CVE-2023-0459: Fixed information leak in __uaccess_begin_nospec (bsc#1211738).
• CVE-2023-20569: Fixed side channel attack ‘Inception’ or ‘RAS Poisoning’ (bsc#1213287).
• CVE-2023-21400: Fixed several memory corruptions due to improper locking in io_uring (bsc#1213272).
• CVE-2023-2156: Fixed a flaw in the networking subsystem within the handling of the RPL protocol (bsc#1211131).
• CVE-2023-2166: Fixed NULL pointer dereference in can_rcv_filter (bsc#1210627).
• CVE-2023-31083: Fixed race condition in hci_uart_tty_ioctl (bsc#1210780).
• CVE-2023-3268: Fixed an out of bounds memory access flaw in relay_file_read_start_pos in the relayfs (bsc#1212502).
• CVE-2023-3567: Fixed a use-after-free in vcs_read in drivers/tty/vt/vc_screen.c (bsc#1213167).
• CVE-2023-3609: Fixed reference counter leak leading to overflow in net/sched (bsc#1213586).
• CVE-2023-3611: Fixed an out-of-bounds write in net/sched sch_qfq(bsc#1213585).
• CVE-2023-3776: Fixed improper refcount update in cls_fw leads to use-after-free (bsc#1213588).
• CVE-2023-4004: Fixed improper element removal netfilter nft_set_pipapo (bsc#1213812).

The following non-security bugs were fixed:

• afs: Fix access after dec in put functions (git-fixes).
• afs: Fix afs_getattr() to refetch file status if callback break occurred (git-fixes).
• afs: Fix dynamic root getattr (git-fixes).
• afs: Fix fileserver probe RTT handling (git-fixes).
• afs: Fix infinite loop found by xfstest generic/676 (git-fixes).
• afs: Fix lost servers_outstanding count (git-fixes).
• afs: Fix server->active leak in afs_put_server (git-fixes).
• afs: Fix setting of mtime when creating a file/dir/symlink (git-fixes).
• afs: Fix updating of i_size with dv jump from server (git-fixes).
• afs: Fix vlserver probe RTT handling (git-fixes).
• afs: Return -EAGAIN, not -EREMOTEIO, when a file already locked (git-fixes).
• afs: Use refcount_t rather than atomic_t (git-fixes).
• afs: Use the operation issue time instead of the reply time for callbacks (git-fixes).
• afs: adjust ack interpretation to try and cope with nat (git-fixes).
• alsa: emu10k1: roll up loops in dsp setup code for audigy (git-fixes).
• alsa: hda/realtek: support asus g713pv laptop (git-fixes).
• alsa: hda/relatek: enable mute led on hp 250 g8 (git-fixes).
• alsa: usb-audio: add quirk for microsoft modern wireless headset (bsc#1207129).
• alsa: usb-audio: update for native dsd support quirks (git-fixes).
• asoc: atmel: fix the 8k sample parameter in i2sc master (git-fixes).
• asoc: codecs: es8316: fix dmic config (git-fixes).
• asoc: da7219: check for failure reading aad irq events (git-fixes).
• asoc: da7219: flush pending aad irq when suspending (git-fixes).
• asoc: fsl_sai: disable bit clock with transmitter (git-fixes).
• asoc: fsl_spdif: silence output on stop (git-fixes).
• asoc: rt5682-sdw: fix for jd event handling in clockstop mode0 (git-fixes).
• asoc: rt711-sdca: fix for jd event handling in clockstop mode0 (git-fixes).
• asoc: rt711: fix for jd event handling in clockstop mode0 (git-fixes).
• asoc: wm8904: fill the cache for wm8904_adc_test_0 register (git-fixes).
• ata: pata_ns87415: mark ns87560_tf_read static (git-fixes).
• block, bfq: Fix division by zero error on zero wsum (bsc#1213653).
• block: Fix a source code comment in include/uapi/linux/blkzoned.h (git-fixes).
• can: gs_usb: gs_can_close(): add missing set of CAN state to CAN_STATE_STOPPED (git-fixes).
• ceph: do not let check_caps skip sending responses for revoke msgs (bsc#1213856).
• coda: Avoid partial allocation of sig_inputArgs (git-fixes).
• dlm: fix missing lkb refcount handling (git-fixes).
• dlm: fix plock invalid read (git-fixes).
• documentation: devices.txt: reconcile serial/ucc_uart minor numers (git-fixes). -…

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-40982: Fixed transient execution attack called 'Gather Data Sampling' (bsc#1206418).
• CVE-2023-0459: Fixed information leak in __uaccess_begin_nospec (bsc#1211738).
• CVE-2023-20569: Fixed side channel attack ‘Inception’ or ‘RAS Poisoning’ (bsc#1213287).
• CVE-2023-20593: Fixed a ZenBleed issue in 'Zen 2' CPUs that could allow an attacker to potentially access sensitive information (bsc#1213286).
• CVE-2023-21400: Fixed several memory corruptions due to improper locking in io_uring (bsc#1213272).
• CVE-2023-2156: Fixed a flaw in the networking subsystem within the handling of the RPL protocol (bsc#1211131).
• CVE-2023-2166: Fixed NULL pointer dereference in can_rcv_filter (bsc#1210627).
• CVE-2023-2985: Fixed an use-after-free vulnerability in hfsplus_put_super in fs/hfsplus/super.c that could allow a local user to cause a denial of service (bsc#1211867).
• CVE-2023-31083: Fixed race condition in hci_uart_tty_ioctl (bsc#1210780).
• CVE-2023-3117: Fixed an use-after-free vulnerability in the netfilter subsystem when processing named and anonymous sets in batch requests that could allow a local user with CAP_NET_ADMIN capability to crash or potentially escalate their privileges on the system (bsc#1213245).
• CVE-2023-31248: Fixed an use-after-free vulnerability in nft_chain_lookup_byid that could allow a local attacker to escalate their privilege (bsc#1213061).
• CVE-2023-3268: Fixed an out of bounds memory access flaw in relay_file_read_start_pos in the relayfs (bsc#1212502).
• CVE-2023-3390: Fixed an use-after-free vulnerability in the netfilter subsystem in net/netfilter/nf_tables_api.c that could allow a local attacker with user access to cause a privilege escalation issue (bsc#1212846).
• CVE-2023-35001: Fixed an out-of-bounds memory access flaw in nft_byteorder that could allow a local attacker to escalate their privilege (bsc#1213059).
• CVE-2023-3567: Fixed a use-after-free in vcs_read in drivers/tty/vt/vc_screen.c (bsc#1213167).
• CVE-2023-3609: Fixed reference counter leak leading to overflow in net/sched (bsc#1213586).
• CVE-2023-3611: Fixed an out-of-bounds write in net/sched sch_qfq(bsc#1213585).
• CVE-2023-3776: Fixed improper refcount update in cls_fw leads to use-after-free (bsc#1213588).
• CVE-2023-3812: Fixed an out-of-bounds memory access flaw in the TUN/TAP device driver functionality that could allow a local user to crash or potentially escalate their privileges on the system (bsc#1213543).
• CVE-2023-4004: Fixed improper element removal netfilter nft_set_pipapo (bsc#1213812).

The following non-security bugs were fixed:

• acpi: utils: fix acpi_evaluate_dsm_typed() redefinition error (git-fixes).
• add module_firmware() for firmware_tg357766 (git-fixes).
• afs: adjust ack interpretation to try and cope with nat (git-fixes).
• afs: fix access after dec in put functions (git-fixes).
• afs: fix afs_getattr() to refetch file status if callback break occurred (git-fixes).
• afs: fix dynamic root getattr (git-fixes).
• afs: fix fileserver probe rtt handling (git-fixes).
• afs: fix infinite loop found by xfstest generic/676 (git-fixes).
• afs: fix lost servers_outstanding count (git-fixes).
• afs: fix server->active leak in afs_put_server (git-fixes).
• afs: fix setting of mtime when creating a file/dir/symlink (git-fixes).
• afs: fix updating of i_size with dv jump from server (git-fixes).
• afs: fix vlserver probe rtt handling (git-fixes).
• afs: return -eagain, not -eremoteio, when a file already locked (git-fixes).
• afs: use refcount_t rather than atomic_t (git-fixes).
• afs: use the operation issue time instead of the reply time for callbacks (git-fixes).
• alsa: emu10k1: roll up loops in dsp setup code for audigy (git-fixes).
• alsa: fireface: make read-only const array for model names static (git-fixes).
• alsa: hda/realtek - remove 3k pull low…

The SUSE Linux Enterprise 12 SP2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-20784: Fixed a denial of service (infinite loop in update_blocked_averages) by mishandled leaf cfs_rq in kernel/sched/fair.c (bsc#1126703).
• CVE-2018-3639: Fixed Speculative Store Bypass aka 'Memory Disambiguation' (bsc#1087082).
• CVE-2022-40982: Fixed transient execution attack called 'Gather Data Sampling' (bsc#1206418).
• CVE-2023-0459: Fixed information leak in __uaccess_begin_nospec (bsc#1211738).
• CVE-2023-1637: Fixed vulnerability that could lead to unauthorized access to CPU memory after resuming CPU from suspend-to-RAM (bsc#1209779).
• CVE-2023-20569: Fixed side channel attack ‘Inception’ or ‘RAS Poisoning’ (bsc#1213287).
• CVE-2023-20593: Fixed a ZenBleed issue in 'Zen 2' CPUs that could allow an attacker to potentially access sensitive information (bsc#1213286).
• CVE-2023-2985: Fixed an use-after-free vulnerability in hfsplus_put_super in fs/hfsplus/super.c that could allow a local user to cause a denial of service (bsc#1211867).
• CVE-2023-3106: Fixed crash in XFRM_MSG_GETSA netlink handler (bsc#1213251).
• CVE-2023-3268: Fixed an out of bounds memory access flaw in relay_file_read_start_pos in the relayfs (bsc#1212502).
• CVE-2023-35001: Fixed an out-of-bounds memory access flaw in nft_byteorder that could allow a local attacker to escalate their privilege (bsc#1213059).
• CVE-2023-3567: Fixed a use-after-free in vcs_read in drivers/tty/vt/vc_screen.c (bsc#1213167).
• CVE-2023-3611: Fixed an out-of-bounds write in net/sched sch_qfq(bsc#1213585).
• CVE-2023-3776: Fixed improper refcount update in cls_fw leads to use-after-free (bsc#1213588).

The following non-security bugs were fixed:

• net/sched: sch_qfq: refactor parsing of netlink parameters (bsc#1213585).
• ubi: Fix failure attaching when vid_hdr offset equals to (sub)page size (bsc#1210584).
• ubi: ensure that VID header offset + VID header size <= alloc, size (bsc#1210584).
• x86: Treat R_X86_64_PLT32 as R_X86_64_PC32 (git-fixes) No it's not git-fixes it's used to make sle12-sp2 compile with newer toolchain to make the life of all the poor souls maintaining this ancient kernel on their modern machines, a little bit easier....

The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-40982: Fixed transient execution attack called 'Gather Data Sampling' (bsc#1206418).
• CVE-2023-0459: Fixed information leak in __uaccess_begin_nospec (bsc#1211738).
• CVE-2023-20569: Fixed side channel attack ‘Inception’ or ‘RAS Poisoning’ (bsc#1213287).
• CVE-2023-3567: Fixed a use-after-free in vcs_read in drivers/tty/vt/vc_screen.c (bsc#1213167).
• CVE-2023-3609: Fixed reference counter leak leading to overflow in net/sched (bsc#1213586).
• CVE-2023-3611: Fixed an out-of-bounds write in net/sched sch_qfq(bsc#1213585).
• CVE-2023-3776: Fixed improper refcount update in cls_fw leads to use-after-free (bsc#1213588).

The following non-security bugs were fixed:

• fix double fget() in vhost_net_set_backend() (git-fixes).
• nfsv4.1: always send a reclaim_complete after establishing lease (git-fixes).
• sunrpc: fix uaf in svc_tcp_listen_data_ready() (git-fixes).
• sunrpc: remove the maximum number of retries in call_bind_status (git-fixes).
• update suse/s390-dasd-fix-no-record-found-for-raw_track_access (git-fixes bsc#1212266 bsc#1207528).
• update suse/scsi-zfcp-fix-missing-auto-port-scan-and-thus-missing-target-ports (git-fixes bsc#1202670).
• block: fix a source code comment in include/uapi/linux/blkzoned.h (git-fixes).
• kabi fix test
• kernel-binary.spec.in: remove superfluous %% in supplements fixes: 02b7735e0caf ('rpm/kernel-binary.spec.in: add enhances and supplements tags to in-tree kmps')
• livepatch: check kzalloc return values (git-fixes).
• media: videodev2.h: fix struct v4l2_input tuner index comment (git-fixes).
• net/sched: sch_qfq: refactor parsing of netlink parameters (bsc#1213585).
• net: skip virtio_net_hdr_set_proto if protocol already set (git-fixes).
• net: virtio_net_hdr_to_skb: count transport header in ufo (git-fixes).
• nfsd: fix double fget() bug in __write_ports_addfd() (git-fixes).
• powerpc/64: update speculation_store_bypass in /proc/<pid>/status (bsc#1188885 ltc#193722 git-fixes).
• powerpc/security: fix speculation_store_bypass reporting on power10 (bsc#1188885 ltc#193722 git-fixes).
• rpm/check-for-config-changes: ignore also riscv_isa_* and dynamic_sigframe they depend on config_toolchain_has_*.
• s390/cio: add dev_busid sysfs entry for each subchannel (bsc#1207526).
• s390/cio: check the subchannel validity for dev_busid (bsc#1207526).
• s390/cio: introduce io_subchannel_type (bsc#1207526).
• s390/cpum_sf: adjust sampling interval to avoid hitting sample limits (git-fixes bsc#1213827).
• s390/maccess: add no dat mode to kernel_write (git-fixes bsc#1213825).
• s390/numa: move initial setup of node_to_cpumask_map (git-fixes bsc#1213766).
• scsi: qla2xxx: adjust iocb resource on qpair create (bsc#1213747).
• scsi: qla2xxx: array index may go out of bound (bsc#1213747).
• scsi: qla2xxx: avoid fcport pointer dereference (bsc#1213747).
• scsi: qla2xxx: check valid rport returned by fc_bsg_to_rport() (bsc#1213747).
• scsi: qla2xxx: correct the index of array (bsc#1213747).
• scsi: qla2xxx: drop useless list_head (bsc#1213747).
• scsi: qla2xxx: fix null pointer dereference in target mode (bsc#1213747).
• scsi: qla2xxx: fix tmf leak through (bsc#1213747).
• scsi: qla2xxx: fix buffer overrun (bsc#1213747).
• scsi: qla2xxx: fix command flush during tmf (bsc#1213747).
• scsi: qla2xxx: fix deletion race condition (bsc#1213747).
• scsi: qla2xxx: fix end of loop test (bsc#1213747).
• scsi: qla2xxx: fix erroneous link up failure (bsc#1213747).
• scsi: qla2xxx: fix error code in qla2x00_start_sp() (bsc#1213747).
• scsi: qla2xxx: fix potential null pointer dereference (bsc#1213747).
• scsi: qla2xxx: fix session hang in gnl (bsc#1213747).
• scsi: qla2xxx: limit tmf to 8 per function (bsc#1213747).
• scsi: qla2xxx: pointer may be dereferenced (bsc#1213747).
• scsi: qla2xxx: remove unused nvme_ls_waitq wait queue (bsc#1213747).
• scsi: qla2xxx:…

The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-3609: Fixed reference counter leak leading to overflow in net/sched (bsc#1213586).
• CVE-2023-3611: Fixed an out-of-bounds write in net/sched sch_qfq(bsc#1213585).
• CVE-2023-3567: Fixed a use-after-free in vcs_read in drivers/tty/vt/vc_screen.c (bsc#1213167).
• CVE-2023-0459: Fixed information leak in __uaccess_begin_nospec (bsc#1211738).
• CVE-2022-40982: Fixed transient execution attack called 'Gather Data Sampling' (bsc#1206418).
• CVE-2023-20593: Fixed a ZenBleed issue in 'Zen 2' CPUs that could allow an attacker to potentially access sensitive information (bsc#1213286).
• CVE-2023-2985: Fixed an use-after-free vulnerability in hfsplus_put_super in fs/hfsplus/super.c that could allow a local user to cause a denial of service (bsc#1211867).
• CVE-2023-35001: Fixed an out-of-bounds memory access flaw in nft_byteorder that could allow a local attacker to escalate their privilege (bsc#1213059).
• CVE-2023-20569: Fixed side channel attack ‘Inception’ or ‘RAS Poisoning’ (bsc#1213287).

The following non-security bugs were fixed:

• Get module prefix from kmod (bsc#1212835).
• USB: add NO_LPM quirk for Realforce 87U Keyboard (git-fixes).
• USB: core: add quirk for Alcor Link AK9563 smartcard reader (git-fixes).
• USB: core: hub: Disable autosuspend for Cypress CY7C65632 (git-fixes).
• USB: hcd-pci: Fully suspend across freeze/thaw cycle (git-fixes).
• USB: hub: Add delay for SuperSpeed hub resume to let links transit to U0 (git-fixes).
• USB: serial: option: add Fibocom FM160 0x0111 composition (git-fixes).
• USB: serial: option: add Quectel EM05-G (GR) modem (git-fixes).
• USB: serial: option: add Quectel EM05-G (RS) modem (git-fixes).
• USB: serial: option: add Sierra Wireless EM9191 (git-fixes).
• USB: serial: option: add u-blox LARA-R6 00B modem (git-fixes).
• blkcg, writeback: dead memcgs shouldn't contribute to writeback ownership arbitration (bsc#1213022).
• btrfs: fix resolving backrefs for inline extent followed by prealloc (bsc#1213133).
• delete suse/memcg-drop-kmem-limit_in_bytes. drop the patch in order to fix bsc#1213705.
• dlm: Delete an unnecessary variable initialisation in dlm_ls_start() (git-fixes).
• dlm: NULL check before kmem_cache_destroy is not needed (git-fixes).
• dlm: fix invalid cluster name warning (git-fixes).
• dlm: fix missing idr_destroy for recover_idr (git-fixes).
• dlm: fix missing lkb refcount handling (git-fixes).
• dlm: fix plock invalid read (git-fixes).
• dlm: fix possible call to kfree() for non-initialized pointer (git-fixes).
• ext4: Fix reusing stale buffer heads from last failed mounting (bsc#1213020).
• ext4: add inode table check in __ext4_get_inode_loc to aovid possible infinite loop (bsc#1207617).
• ext4: avoid BUG_ON when creating xattrs (bsc#1205496).
• ext4: avoid unaccounted block allocation when expanding inode (bsc#1207634).
• ext4: bail out of ext4_xattr_ibody_get() fails for any reason (bsc#1213018).
• ext4: fail ext4_iget if special inode unallocated (bsc#1213010).
• ext4: fix RENAME_WHITEOUT handling for inline directories (bsc#1210766).
• ext4: fix WARNING in ext4_update_inline_data (bsc#1213012).
• ext4: fix bug_on in __es_tree_search caused by bad boot loader inode (bsc#1207620).
• ext4: fix cgroup writeback accounting with fs-layer encryption (bsc#1210765).
• ext4: fix deadlock due to mbcache entry corruption (bsc#1207653).
• ext4: fix error code return to user-space in ext4_get_branch() (bsc#1207630).
• ext4: fix i_disksize exceeding i_size problem in paritally written case (bsc#1213015).
• ext4: fix to check return value of freeze_bdev() in ext4_shutdown() (bsc#1213021).
• ext4: improve error recovery code paths in __ext4_remount() (bsc#1213017).
• ext4: init quota for 'old.inode' in 'ext4_rename' (bsc#1207629).
• ext4: initialize quota before expanding inode in setproject ioctl (bsc#1207633). -…