CVE-2023-3777

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. When nf_tables_delrule() is flushing table rules, it is not checked whether the chain is bound and the chain's owner rule can also release the objects in certain circumstances. We recommend upgrading past commit 6eaf41e87a223ae6f8e7a28d6e78384ad7e407f8.

The Linux Kernel, the operating system core itself.

Security Fix(es):

A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the handling of SMB2_SESSION_SETUP commands. The issue results from the lack of control of resource consumption. An attacker can leverage this vulnerability to create a denial-of-service condition on the system.(CVE-2023-32247)

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.

When nf_tables_delrule() is flushing table rules, it is not checked whether the chain is bound and the chain's owner rule can also release the objects in certain circumstances.

We recommend upgrading past commit 6eaf41e87a223ae6f8e7a28d6e78384ad7e407f8.

(CVE-2023-3777)

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.

On an error when building a nftables rule, deactivating immediate expressions in nft_immediate_deactivate() can lead unbinding the chain and objects be deactivated but later used.

We recommend upgrading past commit 0a771f7b266b02d262900c75f1e175c7fe76fec2.

(CVE-2023-4015)

A use-after-free vulnerability in the Linux kernel's net/sched: cls_route component can be exploited to achieve local privilege escalation.

When route4_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter. This causes a problem when updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-free.

We recommend upgrading past commit b80b829e9e2c1b3f7aae34855e04d8f6ecaf13c8.

(CVE-2023-4206)

A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to achieve local privilege escalation.

When fw_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter. This causes a problem when updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-free.

We recommend upgrading past commit 76e42ae831991c828cffa8c37736ebfb831ad5ec.

(CVE-2023-4207)

A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation.

When u32_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter. This causes a problem when updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-free.

We recommend upgrading past commit 3044b16e7c6fe5d24b1cdbcf1bd0a9d92d1ebd81.

(CVE-2023-4208)

A use-after-free vulnerability in the Linux kernel's af_unix component can be exploited to achieve local privilege escalation.

The unix_stream_sendpage() function tries to add data to the last skb in the peer's recv queue without locking the queue. Thus there is a race where unix_stream_sendpage() could access an skb locklessly that is being released by garbage collection, resulting in use-after-free.

We recommend upgrading past commit 790c2f9d15b594350ae9bca7b236f2b1859de02c.

(CVE-2023-4622)

The Linux Kernel, the operating system core itself.

Security Fix(es):

A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the handling of SMB2_SESSION_SETUP commands. The issue results from the lack of control of resource consumption. An attacker can leverage this vulnerability to create a denial-of-service condition on the system.(CVE-2023-32247)

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.

When nf_tables_delrule() is flushing table rules, it is not checked whether the chain is bound and the chain's owner rule can also release the objects in certain circumstances.

We recommend upgrading past commit 6eaf41e87a223ae6f8e7a28d6e78384ad7e407f8.

(CVE-2023-3777)

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.

On an error when building a nftables rule, deactivating immediate expressions in nft_immediate_deactivate() can lead unbinding the chain and objects be deactivated but later used.

We recommend upgrading past commit 0a771f7b266b02d262900c75f1e175c7fe76fec2.

(CVE-2023-4015)

A use-after-free vulnerability in the Linux kernel's net/sched: cls_route component can be exploited to achieve local privilege escalation.

When route4_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter. This causes a problem when updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-free.

We recommend upgrading past commit b80b829e9e2c1b3f7aae34855e04d8f6ecaf13c8.

(CVE-2023-4206)

A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to achieve local privilege escalation.

When fw_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter. This causes a problem when updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-free.

We recommend upgrading past commit 76e42ae831991c828cffa8c37736ebfb831ad5ec.

(CVE-2023-4207)

A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation.

When u32_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter. This causes a problem when updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-free.

We recommend upgrading past commit 3044b16e7c6fe5d24b1cdbcf1bd0a9d92d1ebd81.

(CVE-2023-4208)

A use-after-free vulnerability in the Linux kernel's af_unix component can be exploited to achieve local privilege escalation.

The unix_stream_sendpage() function tries to add data to the last skb in the peer's recv queue without locking the queue. Thus there is a race where unix_stream_sendpage() could access an skb locklessly that is being released by garbage collection, resulting in use-after-free.

We recommend upgrading past commit 790c2f9d15b594350ae9bca7b236f2b1859de02c.

(CVE-2023-4622)

The Linux Kernel, the operating system core itself.

Security Fix(es):

A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the handling of SMB2_SESSION_SETUP commands. The issue results from the lack of control of resource consumption. An attacker can leverage this vulnerability to create a denial-of-service condition on the system.(CVE-2023-32247)

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.

When nf_tables_delrule() is flushing table rules, it is not checked whether the chain is bound and the chain's owner rule can also release the objects in certain circumstances.

We recommend upgrading past commit 6eaf41e87a223ae6f8e7a28d6e78384ad7e407f8.

(CVE-2023-3777)

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.

On an error when building a nftables rule, deactivating immediate expressions in nft_immediate_deactivate() can lead unbinding the chain and objects be deactivated but later used.

We recommend upgrading past commit 0a771f7b266b02d262900c75f1e175c7fe76fec2.

(CVE-2023-4015)

A use-after-free vulnerability in the Linux kernel's net/sched: cls_route component can be exploited to achieve local privilege escalation.

When route4_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter. This causes a problem when updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-free.

We recommend upgrading past commit b80b829e9e2c1b3f7aae34855e04d8f6ecaf13c8.

(CVE-2023-4206)

A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to achieve local privilege escalation.

When fw_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter. This causes a problem when updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-free.

We recommend upgrading past commit 76e42ae831991c828cffa8c37736ebfb831ad5ec.

(CVE-2023-4207)

A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation.

When u32_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter. This causes a problem when updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-free.

We recommend upgrading past commit 3044b16e7c6fe5d24b1cdbcf1bd0a9d92d1ebd81.

(CVE-2023-4208)

A use-after-free vulnerability in the Linux kernel's af_unix component can be exploited to achieve local privilege escalation.

The unix_stream_sendpage() function tries to add data to the last skb in the peer's recv queue without locking the queue. Thus there is a race where unix_stream_sendpage() could access an skb locklessly that is being released by garbage collection, resulting in use-after-free.

We recommend upgrading past commit 790c2f9d15b594350ae9bca7b236f2b1859de02c.

(CVE-2023-4622)

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. When nf_tables_delrule() is flushing table rules, it is not checked whether the chain is bound and the chain's owner rule can also release the objects in certain circumstances. We recommend upgrading past commit 6eaf41e87a223ae6f8e7a28d6e78384ad7e407f8.

• bpf: Fix re-attachment branch in bpf_tracing_prog_attach {CVE-2024-26591}
• ext4: improve error recovery code paths in __ext4_remount() {CVE-2024-0775}
• smb: client: fix OOB in receive_encrypted_standard() {CVE-2024-0565}
• mtd: Fix gluebi NULL pointer dereference caused by ftl notifier {CVE-2023-52449}
• net: prevent mss overflow in skb_segment() {CVE-2023-52435}
• smb: client: fix potential OOBs in smb2_parse_contexts() {CVE-2023-52434}
• atm: Fix Use-After-Free in do_vcc_ioctl {CVE-2023-51780}
• ida: Fix crash in ida_free when the bitmap is empty {CVE-2023-6915}
• nvmet: nul-terminate the NQNs passed in the connect command {CVE-2023-6121}
• netfilter: nf_tables: Reject tables of unsupported family {CVE-2023-6040}
• Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work {CVE-2023-1989}
• NFSD: fix use-after-free in nfsd4_ssc_setup_dul() {CVE-2023-1652}
• x86/bugs: Flush IBP in ib_prctl_set() {CVE-2023-0045}
• Bluetooth: L2CAP: Fix u8 overflow {CVE-2022-45934}
• Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm {CVE-2022-42896}
• x86: Clear .brk area at early boot {CVE-2022-36123}
• misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault and gru_handle_user_call_os {CVE-2022-3424}
• Fix double fget() in vhost_net_set_backend() {CVE-2023-1838}
• wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies() {CVE-2023-1380}
• netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one {CVE-2023-39197}
• relayfs: fix out-of-bounds access in relay_file_read {CVE-2023-3268}
• ipv6: rpl: Fix Route of Death. {CVE-2023-2156}
• ipv6: Fix out-of-bounds access in ipv6_find_tlv() {CVE-2023-2156}
• net: rpl: fix rpl header size calculation {CVE-2023-2156}
• memstick: r592: Fix UAF bug in r592_remove due to race condition {CVE-2023-3141}
• ovl: fix use after free in struct ovl_aio_req {CVE-2023-1252}
• drm/amdgpu: Fix potential fence use-after-free v2 {CVE-2023-51042}
• netfilter: nf_tables: reject QUEUE/DROP verdict parameters {CVE-2024-1086}
• perf: Fix perf_event_validate_size() lockdep splat {CVE-2023-6931}
• perf: Fix perf_event_validate_size() {CVE-2023-6931}
• drm/atomic: Fix potential use-after-free in nonblocking commits {CVE-2023-51043}
• nvmet-tcp: Fix the H2C expected PDU len calculation {CVE-2023-6356}
• nvmet-tcp: remove boilerplate code {CVE-2023-6356}
• nvmet-tcp: fix a crash in nvmet_req_complete() {CVE-2023-6356}
• nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length {CVE-2023-6356}
• net: tls, update curr on splice as well {CVE-2024-0646}
• smb: client: fix potential OOB in smb2_dump_detail() {CVE-2023-6610}
• smb: client: fix potential OOB in cifs_dump_detail() {CVE-2023-6610}
• smb: client: fix OOB in smbCalcSize() {CVE-2023-6606}
• ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet {CVE-2023-6932}
• RDMA/core: Update CMA destination address on rdma_resolve_addr {CVE-2023-2176}
• RDMA/core: Refactor rdma_bind_addr {CVE-2023-2176}
• nfp: fix use-after-free in area_cache_get() {CVE-2022-3545}
• netfilter: nf_tables: skip bound chain on rule flush {CVE-2023-3777}
• Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb {CVE-2023-40283}
• drivers: net: slip: fix NPD bug in sl_tx_timeout() {CVE-2022-41858}
• net/sched: sch_hfsc: upgrade 'rt' to 'sc' when it becomes a inner curve {CVE-2023-4623}
• net/sched: sch_hfsc: Ensure inner classes have fsc curve {CVE-2023-4623}
• vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF {CVE-2023-3567}
• nvmet-tcp: Fix a possible UAF in queue intialization setup {CVE-2023-5178}
• net: tun: fix bugs for oversize packet when napi frags enabled {CVE-2023-3812}
• netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c {CVE-2023-42753}
• bpf: Fix incorrect verifier pruning due to missing register precision taints {CVE-2023-2163}
• net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free {CVE-2023-4206}…

It was discovered that the IP-VLAN network driver for the Linux kernel did not properly initialize memory in some situations, leading to an out-of- bounds write vulnerability. An attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-2023-3090)

It was discovered that the virtual terminal driver in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information (kernel memory).(CVE-2023-3567)

It was discovered that the universal 32bit network packet classifier implementation in the Linux kernel did not properly perform reference counting in some situations, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-2023-3609)

It was discovered that the network packet classifier with netfilter/firewall marks implementation in the Linux kernel did not properly handle reference counting, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-2023-3776)

Kevin Rich discovered that the netfilter subsystem in the Linux kernel did not properly handle table rules flush in certain circumstances. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code.(CVE-2023-3777)

Kevin Rich discovered that the netfilter subsystem in the Linux kernel did not properly handle rule additions to bound chains in certain circumstances. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code.(CVE-2023-3995)

It was discovered that the netfilter subsystem in the Linux kernel did not properly handle PIPAPO element removal, leading to a use-after-free vulnerability. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code.(CVE-2023-4004)

It was discovered that some network classifier implementations in the Linux kernel contained use-after-free vulnerabilities. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-2023-4128)

Ye Zhang and Nicolas Wu discovered that the io_uring subsystem in the Linux kernel did not properly handle locking for rings with IOPOLL, leading to a double-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-2023-21400)

It was discovered that the bluetooth subsystem in the Linux kernel did not properly handle L2CAP socket release, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-2023-40283)

It was discovered that the Xen netback driver in the Linux kernel did not properly handle packets structured in certain ways. An attacker in a guest VM could possibly use this to cause a denial of service (host NIC availability).(CVE-2022-3643)

It was discovered that the virtual terminal driver in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information (kernel memory).(CVE-2023-3567)

It was discovered that the universal 32bit network packet classifier implementation in the Linux kernel did not properly perform reference counting in some situations, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-2023-3609)

It was discovered that the network packet classifier with netfilter/firewall marks implementation in the Linux kernel did not properly handle reference counting, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-2023-3776)

Kevin Rich discovered that the netfilter subsystem in the Linux kernel did not properly handle table rules flush in certain circumstances. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code.(CVE-2023-3777)

Kevin Rich discovered that the netfilter subsystem in the Linux kernel did not properly handle rule additions to bound chains in certain circumstances. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code.(CVE-2023-3995)

It was discovered that the netfilter subsystem in the Linux kernel did not properly handle PIPAPO element removal, leading to a use-after-free vulnerability. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code.(CVE-2023-4004)

Bing-Jhong Billy Jheng discovered that the Unix domain socket implementation in the Linux kernel contained a race condition in certain situations, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-2023-4622)

Budimir Markovic discovered that the qdisc implementation in the Linux kernel did not properly validate inner classes, leading to a use-after-free vulnerability. A local user could use this to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-2023-4623)

Alex Birnberg discovered that the netfilter subsystem in the Linux kernel did not properly validate register length, leading to an out-of- bounds write vulnerability. A local attacker could possibly use this to cause a denial of service (system crash).(CVE-2023-4881)

Kevin Rich discovered that the netfilter subsystem in the Linux kernel did not properly handle removal of rules from chain bindings in certain circumstances, leading to a use-after-free vulnerability. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code.(CVE-2023-5197)

Gwangun Jung discovered that the Quick Fair Queueing scheduler implementation in the Linux kernel contained an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-2023-31436)

Ross Lagerwall discovered that the Xen netback backend driver in the Linux kernel did not properly handle certain unusual packets from a paravirtualized network frontend, leading to a buffer overflow. An attacker in a guest VM could use this to cause a denial of service (host system crash) or possibly execute arbitrary code.(CVE-2023-34319)

It was discovered that the bluetooth subsystem in the Linux kernel did not properly handle L2CAP socket release, leading to a use-after-free vulnerability. A local…

The SUSE Linux Enterprise 15 SP4 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-3777: Fixed a use-after-free vulnerability in netfilter: nf_tables component can be exploited to achieve local privilege escalation. (bsc#1215095)
• CVE-2023-46813: Fixed an incorrect access checking in the VC handler and instruction emulation of the SEV-ES emulation of MMIO accesses that could lead to arbitrary write access to kernel memory. (bsc#1212649)
• CVE-2023-31085: Fixed a divide-by-zero error in do_div(sz,mtd->erasesize) that could cause a local DoS. (bsc#1210778)
• CVE-2023-45862: Fixed an issue in the ENE UB6250 reader driver whwere an object could potentially extend beyond the end of an allocation causing. (bsc#1216051)
• CVE-2023-39193: Fixed an out of bounds read in the xtables subsystem (bsc#1215860).
• CVE-2023-5178: Fixed an UAF in queue intialization setup. (bsc#1215768)
• CVE-2023-2163: Fixed an incorrect verifier pruning in BPF that could lead to unsafe code paths being incorrectly marked as safe, resulting in arbitrary read/write in kernel memory, lateral privilege escalation, and container escape. (bsc#1215518)
• CVE-2023-34324: Fixed a possible deadlock in Linux kernel event handling. (bsc#1215745).
• CVE-2023-39189: Fixed a flaw in the Netfilter subsystem that could allow a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure. (bsc#1216046)

The following non-security bugs were fixed:

• 9p: virtio: make sure 'offs' is initialized in zc_request (git-fixes).
• ACPI: irq: Fix incorrect return value in acpi_register_gsi() (git-fixes).
• ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CBA (git-fixes).
• ALSA: hda: Disable power save for solving pop issue on Lenovo ThinkCentre M70q (git-fixes).
• ALSA: hda/realtek: Change model for Intel RVP board (git-fixes).
• ALSA: usb-audio: Fix microphone sound on Opencomm2 Headset (git-fixes).
• ASoC: codecs: wcd938x-sdw: fix runtime PM imbalance on probe errors (git-fixes).
• ASoC: codecs: wcd938x-sdw: fix use after free on driver unbind (git-fixes).
• ASoC: codecs: wcd938x: drop bogus bind error handling (git-fixes).
• ASoC: codecs: wcd938x: fix unbind tear down order (git-fixes).
• ASoC: fsl: imx-pcm-rpmsg: Add SNDRV_PCM_INFO_BATCH flag (git-fixes).
• ASoC: imx-rpmsg: Set ignore_pmdown_time for dai_link (git-fixes).
• ASoC: pxa: fix a memory leak in probe() (git-fixes).
• ata: libata-core: Do not register PM operations for SAS ports (git-fixes).
• ata: libata-core: Fix ata_port_request_pm() locking (git-fixes).
• ata: libata-core: Fix port and device removal (git-fixes).
• ata: libata-sata: increase PMP SRST timeout to 10s (git-fixes).
• ata: libata-scsi: ignore reserved bits for REPORT SUPPORTED OPERATION CODES (git-fixes).
• blk-cgroup: Fix NULL deref caused by blkg_policy_data being installed before init (bsc#1216062).
• blk-cgroup: support to track if policy is online (bsc#1216062).
• Bluetooth: avoid memcmp() out of bounds warning (git-fixes).
• Bluetooth: Avoid redundant authentication (git-fixes).
• Bluetooth: btusb: add shutdown function for QCA6174 (git-fixes).
• Bluetooth: Fix a refcnt underflow problem for hci_conn (git-fixes).
• Bluetooth: hci_event: Fix coding style (git-fixes).
• Bluetooth: hci_event: Fix using memcmp when comparing keys (git-fixes).
• Bluetooth: hci_event: Ignore NULL link key (git-fixes).
• Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name (git-fixes).
• Bluetooth: hci_sock: fix slab oob read in create_monitor_event (git-fixes).
• Bluetooth: Reject connection with the device which has same BD_ADDR (git-fixes).
• Bluetooth: vhci: Fix race when opening vhci device (git-fixes).
• bpf: propagate precision in ALU/ALU64 operations (git-fixes).
• bus: ti-sysc: Fix missing AM35xx SoC matching (git-fixes).
• bus: ti-sysc: Use fsleep() instead of usleep_range() in sysc_reset()…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-31085: Fixed a divide-by-zero error in do_div(sz,mtd->erasesize) that could cause a local DoS. (bsc#1210778)
• CVE-2023-45862: Fixed an issue in the ENE UB6250 reader driver whwere an object could potentially extend beyond the end of an allocation causing. (bsc#1216051)
• CVE-2023-2163: Fixed an incorrect verifier pruning in BPF that could lead to unsafe code paths being incorrectly marked as safe, resulting in arbitrary read/write in kernel memory, lateral privilege escalation, and container escape. (bsc#1215518)
• CVE-2023-3777: Fixed a use-after-free vulnerability in netfilter: nf_tables component can be exploited to achieve local privilege escalation. (bsc#1215095)
• CVE-2023-34324: Fixed a possible deadlock in Linux kernel event handling. (bsc#1215745).
• CVE-2023-39189: Fixed a flaw in the Netfilter subsystem that could allow a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure. (bsc#1216046)
• CVE-2023-3111: Fixed a use-after-free vulnerability in prepare_to_relocate in fs/btrfs/relocation.c (bsc#1212051).
• CVE-2023-39194: Fixed an out of bounds read in the XFRM subsystem (bsc#1215861).
• CVE-2023-39193: Fixed an out of bounds read in the xtables subsystem (bsc#1215860).
• CVE-2023-39192: Fixed an out of bounds read in the netfilter (bsc#1215858).
• CVE-2023-42754: Fixed a NULL pointer dereference in the IPv4 stack that could lead to denial of service (bsc#1215467).

The following non-security bugs were fixed:

• bpf: propagate precision in ALU/ALU64 operations (git-fixes).
• KVM: x86: fix sending PV IPI (git-fixes, bsc#1210853, bsc#1216134).
• nvme-fc: Prevent null pointer dereference in nvme_fc_io_getuuid() (bsc#1214842).

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-3777: Fixed a use-after-free vulnerability in netfilter: nf_tables component can be exploited to achieve local privilege escalation. (bsc#1215095)
• CVE-2023-46813: Fixed a local privilege escalation with user-space programs that have access to MMIO regions (bsc#1212649).
• CVE-2023-31085: Fixed a divide-by-zero error in do_div(sz,mtd->erasesize) that could cause a local DoS. (bsc#1210778)
• CVE-2023-45862: Fixed an issue in the ENE UB6250 reader driver whwere an object could potentially extend beyond the end of an allocation causing. (bsc#1216051)
• CVE-2023-5178: Fixed an UAF in queue intialization setup. (bsc#1215768)
• CVE-2023-2163: Fixed an incorrect verifier pruning in BPF that could lead to unsafe code paths being incorrectly marked as safe, resulting in arbitrary read/write in kernel memory, lateral privilege escalation, and container escape. (bsc#1215518)
• CVE-2023-34324: Fixed a possible deadlock in Linux kernel event handling. (bsc#1215745).
• CVE-2023-39189: Fixed a flaw in the Netfilter subsystem that could allow a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure. (bsc#1216046)

The following non-security bugs were fixed:

• 9p: virtio: make sure 'offs' is initialized in zc_request (git-fixes).
• ACPI: irq: Fix incorrect return value in acpi_register_gsi() (git-fixes).
• ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CBA (git-fixes).
• ALSA: hda/realtek: Change model for Intel RVP board (git-fixes).
• ALSA: hda: Disable power save for solving pop issue on Lenovo ThinkCentre M70q (git-fixes).
• ALSA: usb-audio: Fix microphone sound on Opencomm2 Headset (git-fixes).
• ASoC: codecs: wcd938x-sdw: fix runtime PM imbalance on probe errors (git-fixes).
• ASoC: codecs: wcd938x-sdw: fix use after free on driver unbind (git-fixes).
• ASoC: codecs: wcd938x: drop bogus bind error handling (git-fixes).
• ASoC: codecs: wcd938x: fix unbind tear down order (git-fixes).
• ASoC: fsl: imx-pcm-rpmsg: Add SNDRV_PCM_INFO_BATCH flag (git-fixes).
• ASoC: imx-rpmsg: Set ignore_pmdown_time for dai_link (git-fixes).
• ASoC: pxa: fix a memory leak in probe() (git-fixes).
• Bluetooth: Avoid redundant authentication (git-fixes).
• Bluetooth: Fix a refcnt underflow problem for hci_conn (git-fixes).
• Bluetooth: Reject connection with the device which has same BD_ADDR (git-fixes).
• Bluetooth: avoid memcmp() out of bounds warning (git-fixes).
• Bluetooth: btusb: add shutdown function for QCA6174 (git-fixes).
• Bluetooth: hci_event: Fix coding style (git-fixes).
• Bluetooth: hci_event: Fix using memcmp when comparing keys (git-fixes).
• Bluetooth: hci_event: Ignore NULL link key (git-fixes).
• Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name (git-fixes).
• Bluetooth: hci_sock: fix slab oob read in create_monitor_event (git-fixes).
• Bluetooth: vhci: Fix race when opening vhci device (git-fixes).
• Documentation: qat: change kernel version (PED-6401).
• Documentation: qat: rewrite description (PED-6401).
• Drivers: hv: vmbus: Call hv_synic_free() if hv_synic_alloc() fails (git-fixes).
• Drivers: hv: vmbus: Fix vmbus_wait_for_unload() to scan present CPUs (git-fixes).
• Fix metadata references
• HID: holtek: fix slab-out-of-bounds Write in holtek_kbd_input_event (git-fixes).
• HID: intel-ish-hid: ipc: Disable and reenable ACPI GPE bit (git-fixes).
• HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect (git-fixes).
• HID: multitouch: Add required quirk for Synaptics 0xcd7e device (git-fixes).
• HID: sony: Fix a potential memory leak in sony_probe() (git-fixes).
• HID: sony: remove duplicate NULL check before calling usb_free_urb() (git-fixes).
• IB/mlx4: Fix the size of a buffer in add_port_entries() (git-fixes)
• Input: goodix - ensure int GPIO is in input for gpio_count == 1…

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-2163: Fixed an incorrect verifier pruning in BPF that could lead to unsafe code paths being incorrectly marked as safe, resulting in arbitrary read/write in kernel memory, lateral privilege escalation, and container escape. (bsc#1215518)
• CVE-2023-3777: Fixed a use-after-free vulnerability in netfilter: nf_tables component can be exploited to achieve local privilege escalation. (bsc#1215095)
• CVE-2023-34324: Fixed a possible deadlock in Linux kernel event handling. (bsc#1215745).
• CVE-2023-39189: Fixed a flaw in the Netfilter subsystem that could allow a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure. (bsc#1216046)
• CVE-2023-3111: Fixed a use-after-free vulnerability in prepare_to_relocate in fs/btrfs/relocation.c (bsc#1212051).
• CVE-2023-39194: Fixed an out of bounds read in the XFRM subsystem (bsc#1215861).
• CVE-2023-39193: Fixed an out of bounds read in the xtables subsystem (bsc#1215860).
• CVE-2023-39192: Fixed an out of bounds read in the netfilter (bsc#1215858).
• CVE-2023-42754: Fixed a NULL pointer dereference in the IPv4 stack that could lead to denial of service (bsc#1215467).

The following non-security bugs were fixed:

• nvme-fc: Prevent null pointer dereference in nvme_fc_io_getuuid() (bsc#1214842).

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-3777: Fixed a use-after-free vulnerability in netfilter: nf_tables component can be exploited to achieve local privilege escalation. (bsc#1215095)
• CVE-2023-46813: Fixed a local privilege escalation with user-space programs that have access to MMIO regions (bsc#1212649).
• CVE-2023-31085: Fixed a divide-by-zero error in do_div(sz,mtd->erasesize) that could cause a local DoS. (bsc#1210778)
• CVE-2023-39193: Fixed an out of bounds read in the xtables subsystem (bsc#1215860).
• CVE-2023-5178: Fixed an use-after-free and a double-free flaw that could allow a malicious user to execute a remote code execution. (bsc#1215768)
• CVE-2023-2163: Fixed an incorrect verifier pruning in BPF that could lead to unsafe code paths being incorrectly marked as safe, resulting in arbitrary read/write in kernel memory, lateral privilege escalation, and container escape. (bsc#1215518)
• CVE-2023-34324: Fixed a possible deadlock in Linux kernel event handling. (bsc#1215745).
• CVE-2023-39189: Fixed a flaw in the Netfilter subsystem that could allow a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure. (bsc#1216046)
• CVE-2023-39191: Fixed a lack of validation of dynamic pointers within user-supplied eBPF programs that may have allowed an attacker with CAP_BPF privileges to escalate privileges and execute arbitrary code. (bsc#1215863)

The following non-security bugs were fixed:

• 9p: virtio: make sure 'offs' is initialized in zc_request (git-fixes).
• ACPI: irq: Fix incorrect return value in acpi_register_gsi() (git-fixes).
• ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CBA (git-fixes).
• ALSA: hda/realtek - ALC287 I2S speaker platform support (git-fixes).
• ALSA: hda/realtek - ALC287 merge RTK codec with CS CS35L41 AMP (git-fixes).
• ALSA: hda/realtek - Fixed ASUS platform headset Mic issue (git-fixes).
• ALSA: hda/realtek - Fixed two speaker platform (git-fixes).
• ALSA: hda/realtek: Add quirk for ASUS ROG GU603ZV (git-fixes).
• ALSA: hda/realtek: Change model for Intel RVP board (git-fixes).
• ALSA: hda/relatek: Enable Mute LED on HP Laptop 15s-fq5xxx (git-fixes).
• ALSA: hda: Disable power save for solving pop issue on Lenovo ThinkCentre M70q (git-fixes).
• ALSA: hda: intel-dsp-cfg: add LunarLake support (git-fixes).
• ALSA: hda: intel-sdw-acpi: Use u8 type for link index (git-fixes).
• ALSA: usb-audio: Fix microphone sound on Nexigo webcam (git-fixes).
• ALSA: usb-audio: Fix microphone sound on Opencomm2 Headset (git-fixes).
• ASoC: amd: yc: Fix non-functional mic on Lenovo 82YM (git-fixes).
• ASoC: codecs: wcd938x-sdw: fix runtime PM imbalance on probe errors (git-fixes).
• ASoC: codecs: wcd938x-sdw: fix use after free on driver unbind (git-fixes).
• ASoC: codecs: wcd938x: drop bogus bind error handling (git-fixes).
• ASoC: codecs: wcd938x: fix unbind tear down order (git-fixes).
• ASoC: fsl: imx-pcm-rpmsg: Add SNDRV_PCM_INFO_BATCH flag (git-fixes).
• ASoC: imx-rpmsg: Set ignore_pmdown_time for dai_link (git-fixes).
• ASoC: pxa: fix a memory leak in probe() (git-fixes).
• Bluetooth: Avoid redundant authentication (git-fixes).
• Bluetooth: Fix a refcnt underflow problem for hci_conn (git-fixes).
• Bluetooth: ISO: Fix handling of listen for unicast (git-fixes).
• Bluetooth: Reject connection with the device which has same BD_ADDR (git-fixes).
• Bluetooth: avoid memcmp() out of bounds warning (git-fixes).
• Bluetooth: btusb: add shutdown function for QCA6174 (git-fixes).
• Bluetooth: hci_codec: Fix leaking content of local_codecs (git-fixes).
• Bluetooth: hci_event: Fix coding style (git-fixes).
• Bluetooth: hci_event: Fix using memcmp when comparing keys (git-fixes).
• Bluetooth: hci_event: Ignore NULL link key (git-fixes).
• Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name (git-fixes). -…

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-2163: Fixed an incorrect verifier pruning in BPF that could lead to unsafe code paths being incorrectly marked as safe, resulting in arbitrary read/write in kernel memory, lateral privilege escalation, and container escape. (bsc#1215518)
• CVE-2023-34324: Fixed a possible deadlock in Linux kernel event handling. (bsc#1215745).
• CVE-2023-39189: Fixed a flaw in the Netfilter subsystem that could allow a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure. (bsc#1216046)
• CVE-2023-5178: Fixed an UAF in queue intialization setup. (bsc#1215768)
• CVE-2023-31085: Fixed a divide-by-zero error in do_div(sz,mtd->erasesize) that could cause a local DoS. (bsc#1210778)
• CVE-2023-39193: Fixed an out of bounds read in the xtables subsystem (bsc#1215860).
• CVE-2023-3777: Fixed a use-after-free vulnerability in netfilter: nf_tables component can be exploited to achieve local privilege escalation. (bsc#1215095)

The following non-security bugs were fixed:

• 9p: virtio: make sure 'offs' is initialized in zc_request (git-fixes).
• ACPI: irq: Fix incorrect return value in acpi_register_gsi() (git-fixes).
• ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CBA (git-fixes).
• ALSA: hda: Disable power save for solving pop issue on Lenovo ThinkCentre M70q (git-fixes).
• ALSA: hda/realtek: Change model for Intel RVP board (git-fixes).
• ALSA: usb-audio: Fix microphone sound on Opencomm2 Headset (git-fixes).
• ASoC: codecs: wcd938x-sdw: fix runtime PM imbalance on probe errors (git-fixes).
• ASoC: codecs: wcd938x-sdw: fix use after free on driver unbind (git-fixes).
• ASoC: codecs: wcd938x: drop bogus bind error handling (git-fixes).
• ASoC: codecs: wcd938x: fix unbind tear down order (git-fixes).
• ASoC: fsl: imx-pcm-rpmsg: Add SNDRV_PCM_INFO_BATCH flag (git-fixes).
• ASoC: imx-rpmsg: Set ignore_pmdown_time for dai_link (git-fixes).
• ASoC: pxa: fix a memory leak in probe() (git-fixes).
• ata: libata-core: Do not register PM operations for SAS ports (git-fixes).
• ata: libata-core: Fix ata_port_request_pm() locking (git-fixes).
• ata: libata-core: Fix port and device removal (git-fixes).
• ata: libata-sata: increase PMP SRST timeout to 10s (git-fixes).
• ata: libata-scsi: ignore reserved bits for REPORT SUPPORTED OPERATION CODES (git-fixes).
• blk-cgroup: Fix NULL deref caused by blkg_policy_data being installed before init (bsc#1216062).
• blk-cgroup: support to track if policy is online (bsc#1216062).
• Bluetooth: avoid memcmp() out of bounds warning (git-fixes).
• Bluetooth: Avoid redundant authentication (git-fixes).
• Bluetooth: btusb: add shutdown function for QCA6174 (git-fixes).
• Bluetooth: Fix a refcnt underflow problem for hci_conn (git-fixes).
• Bluetooth: hci_event: Fix coding style (git-fixes).
• Bluetooth: hci_event: Fix using memcmp when comparing keys (git-fixes).
• Bluetooth: hci_event: Ignore NULL link key (git-fixes).
• Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name (git-fixes).
• Bluetooth: hci_sock: fix slab oob read in create_monitor_event (git-fixes).
• Bluetooth: Reject connection with the device which has same BD_ADDR (git-fixes).
• Bluetooth: vhci: Fix race when opening vhci device (git-fixes).
• bpf: propagate precision in ALU/ALU64 operations (git-fixes).
• bus: ti-sysc: Fix missing AM35xx SoC matching (git-fixes).
• bus: ti-sysc: Use fsleep() instead of usleep_range() in sysc_reset() (git-fixes).
• cgroup: Remove duplicates in cgroup v1 tasks file (bsc#1211307).
• cgroup/cpuset: Change references of cpuset_mutex to cpuset_rwsem (bsc#1215955).
• clk: tegra: fix error return case for recalc_rate (git-fixes).
• counter: microchip-tcb-capture: Fix the use of internal GCLK logic (git-fixes).
• crypto: qat - add fw_counters debugfs file (PED-6401).
• crypto: qat - add…

The SUSE Linux Enterprise 15 SP5 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-3777: Fixed a use-after-free vulnerability in netfilter: nf_tables component can be exploited to achieve local privilege escalation. (bsc#1215095)
• CVE-2023-46813: Fixed a local privilege escalation with user-space programs that have access to MMIO regions (bsc#1212649).
• CVE-2023-31085: Fixed a divide-by-zero error in do_div(sz,mtd->erasesize) that could cause a local DoS. (bsc#1210778)
• CVE-2023-45862: Fixed an issue in the ENE UB6250 reader driver whwere an object could potentially extend beyond the end of an allocation causing. (bsc#1216051)
• CVE-2023-39193: Fixed an out of bounds read in the xtables subsystem (bsc#1215860).
• CVE-2023-5178: Fixed an UAF in queue intialization setup. (bsc#1215768)
• CVE-2023-2163: Fixed an incorrect verifier pruning in BPF that could lead to unsafe code paths being incorrectly marked as safe, resulting in arbitrary read/write in kernel memory, lateral privilege escalation, and container escape. (bsc#1215518)
• CVE-2023-34324: Fixed a possible deadlock in Linux kernel event handling. (bsc#1215745).
• CVE-2023-39189: Fixed a flaw in the Netfilter subsystem that could allow a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure. (bsc#1216046)
• CVE-2023-39191: Fixed a lack of validation of dynamic pointers within user-supplied eBPF programs that may have allowed an attacker with CAP_BPF privileges to escalate privileges and execute arbitrary code. (bsc#1215863)
• CVE-2023-2860: Fixed an out-of-bounds read vulnerability in the processing of seg6 attributes. This flaw allowed a privileged local user to disclose sensitive information. (bsc#1211592)

The following non-security bugs were fixed:

• 9p: virtio: make sure 'offs' is initialized in zc_request (git-fixes).
• ACPI: irq: Fix incorrect return value in acpi_register_gsi() (git-fixes).
• ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CBA (git-fixes).
• ALSA: hda/realtek - ALC287 I2S speaker platform support (git-fixes).
• ALSA: hda/realtek - ALC287 merge RTK codec with CS CS35L41 AMP (git-fixes).
• ALSA: hda/realtek - Fixed ASUS platform headset Mic issue (git-fixes).
• ALSA: hda/realtek - Fixed two speaker platform (git-fixes).
• ALSA: hda/realtek: Add quirk for ASUS ROG GU603ZV (git-fixes).
• ALSA: hda/realtek: Change model for Intel RVP board (git-fixes).
• ALSA: hda/relatek: Enable Mute LED on HP Laptop 15s-fq5xxx (git-fixes).
• ALSA: hda: Disable power save for solving pop issue on Lenovo ThinkCentre M70q (git-fixes).
• ALSA: hda: intel-dsp-cfg: add LunarLake support (git-fixes).
• ALSA: hda: intel-sdw-acpi: Use u8 type for link index (git-fixes).
• ALSA: usb-audio: Fix microphone sound on Nexigo webcam (git-fixes).
• ALSA: usb-audio: Fix microphone sound on Opencomm2 Headset (git-fixes).
• ASoC: amd: yc: Fix non-functional mic on Lenovo 82YM (git-fixes).
• ASoC: codecs: wcd938x-sdw: fix runtime PM imbalance on probe errors (git-fixes).
• ASoC: codecs: wcd938x-sdw: fix use after free on driver unbind (git-fixes).
• ASoC: codecs: wcd938x: drop bogus bind error handling (git-fixes).
• ASoC: codecs: wcd938x: fix unbind tear down order (git-fixes).
• ASoC: fsl: imx-pcm-rpmsg: Add SNDRV_PCM_INFO_BATCH flag (git-fixes).
• ASoC: imx-rpmsg: Set ignore_pmdown_time for dai_link (git-fixes).
• ASoC: pxa: fix a memory leak in probe() (git-fixes).
• Bluetooth: Avoid redundant authentication (git-fixes).
• Bluetooth: Fix a refcnt underflow problem for hci_conn (git-fixes).
• Bluetooth: ISO: Fix handling of listen for unicast (git-fixes).
• Bluetooth: Reject connection with the device which has same BD_ADDR (git-fixes).
• Bluetooth: avoid memcmp() out of bounds warning (git-fixes).
• Bluetooth: btusb: add shutdown function for QCA6174 (git-fixes).
• Bluetooth: hci_codec: Fix leaking content of local_codecs…

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-2006: Fixed a race condition in the RxRPC network protocol (bsc#1210447).
• CVE-2023-25775: Fixed improper access control in the Intel Ethernet Controller RDMA driver (bsc#1216959).
• CVE-2023-3777: Fixed a use-after-free vulnerability in netfilter: nf_tables component can be exploited to achieve local privilege escalation. (bsc#1215095)
• CVE-2023-39197: Fixed a out-of-bounds read in nf_conntrack_dccp_packet() (bsc#1216976).
• CVE-2023-39198: Fixed a race condition leading to use-after-free in qxl_mode_dumb_create() (bsc#1216965).
• CVE-2023-4244: Fixed a use-after-free in the nf_tables component, which could be exploited to achieve local privilege escalation (bsc#1215420).
• CVE-2023-45863: Fixed a out-of-bounds write in fill_kobj_path() (bsc#1216058).
• CVE-2023-45871: Fixed an issue in the IGB driver, where the buffer size may not be adequate for frames larger than the MTU (bsc#1216259).
• CVE-2023-46813: Fixed SEV-ES local priv escalation (bsc#1212649).
• CVE-2023-46862: Fixed a NULL pointer dereference in io_uring_show_fdinfo() (bsc#1216693).
• CVE-2023-5158: Fixed a denial of service in vringh_kiov_advance() in drivers/vhost/vringh.c in the host side of a virtio ring (bsc#1215710).
• CVE-2023-5633: Fixed a use-after-free flaw in the way memory objects were handled when they were being used to store a surface (bsc#1216527).
• CVE-2023-5717: Fixed a heap out-of-bounds write vulnerability in the Performance Events component (bsc#1216584).
• CVE-2023-6039: Fixed a use-after-free in lan78xx_disconnect in drivers/net/usb/lan78xx.c (bsc#1217068).
• CVE-2023-6176: Fixed a denial of service in the cryptographic algorithm scatterwalk functionality (bsc#1217332).

The following non-security bugs were fixed:

• acpi: fpdt: properly handle invalid fpdt subtables (git-fixes).
• acpi: resource: do irq override on tongfang gmxxgxx (git-fixes).
• acpi: resource: skip irq override on asus expertbook b1402cva (git-fixes).
• acpi: sysfs: fix create_pnp_modalias() and create_of_modalias() (git-fixes).
• alsa: hda/realtek - add dell alc295 to pin fall back table (git-fixes).
• alsa: hda/realtek - alc287 realtek i2s speaker platform support (git-fixes).
• alsa: hda/realtek - enable internal speaker of asus k6500zc (git-fixes).
• alsa: hda/realtek: add quirk for asus ux7602zm (git-fixes).
• alsa: hda/realtek: add quirks for asus 2024 zenbooks (git-fixes).
• alsa: hda/realtek: add quirks for hp laptops (git-fixes).
• alsa: hda/realtek: add support dual speaker for dell (git-fixes).
• alsa: hda/realtek: enable mute led on hp 255 g10 (git-fixes).
• alsa: hda/realtek: enable mute led on hp 255 g8 (git-fixes).
• alsa: hda: asus um5302la: added quirks for cs35l41/10431a83 on i2c bus (git-fixes).
• alsa: hda: cs35l41: fix unbalanced pm_runtime_get() (git-fixes).
• alsa: hda: cs35l41: undo runtime pm changes at driver exit time (git-fixes).
• alsa: hda: disable power-save on kontron singlepc (bsc#1217140).
• alsa: hda: fix possible null-ptr-deref when assigning a stream (git-fixes).
• alsa: hda: intel-dsp-config: fix jsl chromebook quirk detection (git-fixes).
• alsa: info: fix potential deadlock at disconnection (git-fixes).
• alsa: usb-audio: add quirk flag to enable native dsd for mcintosh devices (git-fixes).
• arm/xen: fix xen_vcpu_info allocation alignment (git-fixes).
• arm64: add cortex-a520 cpu part definition (git-fixes)
• arm64: allow kprobes on el0 handlers (git-fixes)
• arm64: armv8_deprecated move emulation functions (git-fixes)
• arm64: armv8_deprecated: fix unused-function error (git-fixes)
• arm64: armv8_deprecated: fold ops into insn_emulation (git-fixes)
• arm64: armv8_deprecated: move aarch32 helper earlier (git-fixes)
• arm64: armv8_deprecated: rework deprected instruction handling (git-fixes)
• arm64: consistently pass esr_elx to die() (git-fixes)
• arm64: die(): pass 'err' as…

This update for the Linux Kernel 5.14.21-150500_11 fixes several issues.

The following security issues were fixed:

• CVE-2023-3610: Fixed use-after-free vulnerability in nf_tables can be exploited to achieve local privilege escalation (bsc#1213584).
• CVE-2023-3777: Fixed a use-after-free vulnerability in netfilter: nf_tables component can be exploited to achieve local privilege escalation. (bsc#1215097)
• CVE-2023-5345: Fixed an use-after-free vulnerability in the fs/smb/client component which could be exploited to achieve local privilege escalation. (bsc#1215971)
• CVE-2023-4622: Fixed a use-after-free vulnerability in the Unix domain sockets component which could be exploited to achieve local privilege escalation (bsc#1215442).
• CVE-2023-2163: Fixed an incorrect verifier pruning in BPF that could lead to unsafe code paths being incorrectly marked as safe, resulting in arbitrary read/write in kernel memory, lateral privilege escalation, and container escape. (bsc#1215519)

This update for the Linux Kernel 5.14.21-150500_13_18 fixes several issues.

The following security issues were fixed:

• CVE-2023-3777: Fixed a use-after-free vulnerability in netfilter: nf_tables component can be exploited to achieve local privilege escalation. (bsc#1215097)
• CVE-2023-5345: Fixed an use-after-free vulnerability in the fs/smb/client component which could be exploited to achieve local privilege escalation. (bsc#1215971)
• CVE-2023-4622: Fixed a use-after-free vulnerability in the Unix domain sockets component which could be exploited to achieve local privilege escalation (bsc#1215442).
• CVE-2023-2163: Fixed an incorrect verifier pruning in BPF that could lead to unsafe code paths being incorrectly marked as safe, resulting in arbitrary read/write in kernel memory, lateral privilege escalation, and container escape. (bsc#1215519)

This update for the Linux Kernel 5.14.21-150500_13_21 fixes several issues.

The following security issues were fixed:

• CVE-2023-3777: Fixed a use-after-free vulnerability in netfilter: nf_tables component can be exploited to achieve local privilege escalation. (bsc#1215097)
• CVE-2023-2163: Fixed an incorrect verifier pruning in BPF that could lead to unsafe code paths being incorrectly marked as safe, resulting in arbitrary read/write in kernel memory, lateral privilege escalation, and container escape. (bsc#1215519)

This update for the Linux Kernel 5.14.21-150500_13_24 fixes one issue.

The following security issue was fixed:

• CVE-2023-3777: Fixed a use-after-free vulnerability in netfilter: nf_tables component can be exploited to achieve local privilege escalation. (bsc#1215097)

This update for the Linux Kernel 5.14.21-150400_24_88 fixes several issues.

The following security issues were fixed:

• CVE-2023-3777: Fixed a use-after-free vulnerability in netfilter: nf_tables component can be exploited to achieve local privilege escalation. (bsc#1215097)
• CVE-2023-5345: Fixed an use-after-free vulnerability in the fs/smb/client component which could be exploited to achieve local privilege escalation. (bsc#1215971)
• CVE-2023-4622: Fixed a use-after-free vulnerability in the Unix domain sockets component which could be exploited to achieve local privilege escalation (bsc#1215442).
• CVE-2023-2163: Fixed an incorrect verifier pruning in BPF that could lead to unsafe code paths being incorrectly marked as safe, resulting in arbitrary read/write in kernel memory, lateral privilege escalation, and container escape. (bsc#1215519)

This update for the Linux Kernel 5.14.21-150500_53 fixes several issues.

The following security issues were fixed:

• CVE-2023-3610: Fixed use-after-free vulnerability in nf_tables can be exploited to achieve local privilege escalation (bsc#1213584).
• CVE-2023-3777: Fixed a use-after-free vulnerability in netfilter: nf_tables component can be exploited to achieve local privilege escalation. (bsc#1215097)
• CVE-2023-5345: Fixed an use-after-free vulnerability in the fs/smb/client component which could be exploited to achieve local privilege escalation. (bsc#1215971)
• CVE-2023-4622: Fixed a use-after-free vulnerability in the Unix domain sockets component which could be exploited to achieve local privilege escalation (bsc#1215442).
• CVE-2023-2163: Fixed an incorrect verifier pruning in BPF that could lead to unsafe code paths being incorrectly marked as safe, resulting in arbitrary read/write in kernel memory, lateral privilege escalation, and container escape. (bsc#1215519)

This update for the Linux Kernel 5.3.18-150300_59_124 fixes several issues.

The following security issues were fixed:

• CVE-2023-3777: Fixed a use-after-free vulnerability in netfilter: nf_tables component can be exploited to achieve local privilege escalation. (bsc#1215097)
• CVE-2023-4622: Fixed a use-after-free vulnerability in the Unix domain sockets component which could be exploited to achieve local privilege escalation (bsc#1215442).
• CVE-2023-2163: Fixed an incorrect verifier pruning in BPF that could lead to unsafe code paths being incorrectly marked as safe, resulting in arbitrary read/write in kernel memory, lateral privilege escalation, and container escape. (bsc#1215519)

This update for the Linux Kernel 5.3.18-150300_59_127 fixes several issues.

The following security issues were fixed:

• CVE-2023-3777: Fixed a use-after-free vulnerability in netfilter: nf_tables component can be exploited to achieve local privilege escalation. (bsc#1215097)
• CVE-2023-4622: Fixed a use-after-free vulnerability in the Unix domain sockets component which could be exploited to achieve local privilege escalation (bsc#1215442).
• CVE-2023-2163: Fixed an incorrect verifier pruning in BPF that could lead to unsafe code paths being incorrectly marked as safe, resulting in arbitrary read/write in kernel memory, lateral privilege escalation, and container escape. (bsc#1215519)

This update for the Linux Kernel 5.14.21-150400_24_60 fixes several issues.

The following security issues were fixed:

• CVE-2023-3610: Fixed use-after-free vulnerability in nf_tables can be exploited to achieve local privilege escalation (bsc#1213584).
• CVE-2023-3777: Fixed a use-after-free vulnerability in netfilter: nf_tables component can be exploited to achieve local privilege escalation. (bsc#1215097)
• CVE-2023-5345: Fixed an use-after-free vulnerability in the fs/smb/client component which could be exploited to achieve local privilege escalation. (bsc#1215971)
• CVE-2023-4622: Fixed a use-after-free vulnerability in the Unix domain sockets component which could be exploited to achieve local privilege escalation (bsc#1215442).
• CVE-2023-2163: Fixed an incorrect verifier pruning in BPF that could lead to unsafe code paths being incorrectly marked as safe, resulting in arbitrary read/write in kernel memory, lateral privilege escalation, and container escape. (bsc#1215519)

This update for the Linux Kernel 5.3.18-150300_59_112 fixes several issues.

The following security issues were fixed:

• CVE-2023-3777: Fixed a use-after-free vulnerability in netfilter: nf_tables component can be exploited to achieve local privilege escalation. (bsc#1215097)
• CVE-2023-4622: Fixed a use-after-free vulnerability in the Unix domain sockets component which could be exploited to achieve local privilege escalation (bsc#1215442).
• CVE-2023-2163: Fixed an incorrect verifier pruning in BPF that could lead to unsafe code paths being incorrectly marked as safe, resulting in arbitrary read/write in kernel memory, lateral privilege escalation, and container escape. (bsc#1215519)

This update for the Linux Kernel 5.3.18-150300_59_138 fixes several issues.

The following security issues were fixed:

• CVE-2023-3777: Fixed a use-after-free vulnerability in netfilter: nf_tables component can be exploited to achieve local privilege escalation. (bsc#1215097)
• CVE-2023-2163: Fixed an incorrect verifier pruning in BPF that could lead to unsafe code paths being incorrectly marked as safe, resulting in arbitrary read/write in kernel memory, lateral privilege escalation, and container escape. (bsc#1215519)

This update for the Linux Kernel 5.14.21-150500_55_12 fixes several issues.

The following security issues were fixed:

• CVE-2023-3610: Fixed use-after-free vulnerability in nf_tables can be exploited to achieve local privilege escalation (bsc#1213584).
• CVE-2023-3777: Fixed a use-after-free vulnerability in netfilter: nf_tables component can be exploited to achieve local privilege escalation. (bsc#1215097)
• CVE-2023-5345: Fixed an use-after-free vulnerability in the fs/smb/client component which could be exploited to achieve local privilege escalation. (bsc#1215971)
• CVE-2023-4622: Fixed a use-after-free vulnerability in the Unix domain sockets component which could be exploited to achieve local privilege escalation (bsc#1215442).
• CVE-2023-2163: Fixed an incorrect verifier pruning in BPF that could lead to unsafe code paths being incorrectly marked as safe, resulting in arbitrary read/write in kernel memory, lateral privilege escalation, and container escape. (bsc#1215519)

This update for the Linux Kernel 5.14.21-150500_55_19 fixes several issues.

The following security issues were fixed:

• CVE-2023-3610: Fixed use-after-free vulnerability in nf_tables can be exploited to achieve local privilege escalation (bsc#1213584).
• CVE-2023-3777: Fixed a use-after-free vulnerability in netfilter: nf_tables component can be exploited to achieve local privilege escalation. (bsc#1215097)
• CVE-2023-5345: Fixed an use-after-free vulnerability in the fs/smb/client component which could be exploited to achieve local privilege escalation. (bsc#1215971)
• CVE-2023-4622: Fixed a use-after-free vulnerability in the Unix domain sockets component which could be exploited to achieve local privilege escalation (bsc#1215442).
• CVE-2023-2163: Fixed an incorrect verifier pruning in BPF that could lead to unsafe code paths being incorrectly marked as safe, resulting in arbitrary read/write in kernel memory, lateral privilege escalation, and container escape. (bsc#1215519)

This update for the Linux Kernel 5.14.21-150400_24_28 fixes several issues.

The following security issues were fixed:

• CVE-2023-3610: Fixed use-after-free vulnerability in nf_tables can be exploited to achieve local privilege escalation (bsc#1213584).
• CVE-2023-3777: Fixed a use-after-free vulnerability in netfilter: nf_tables component can be exploited to achieve local privilege escalation. (bsc#1215097)
• CVE-2023-4622: Fixed a use-after-free vulnerability in the Unix domain sockets component which could be exploited to achieve local privilege escalation (bsc#1215442).
• CVE-2023-2163: Fixed an incorrect verifier pruning in BPF that could lead to unsafe code paths being incorrectly marked as safe, resulting in arbitrary read/write in kernel memory, lateral privilege escalation, and container escape. (bsc#1215519)

This update for the Linux Kernel 5.3.18-150300_59_109 fixes several issues.

The following security issues were fixed:

• CVE-2023-3777: Fixed a use-after-free vulnerability in netfilter: nf_tables component can be exploited to achieve local privilege escalation. (bsc#1215097)
• CVE-2023-4622: Fixed a use-after-free vulnerability in the Unix domain sockets component which could be exploited to achieve local privilege escalation (bsc#1215442).
• CVE-2023-2163: Fixed an incorrect verifier pruning in BPF that could lead to unsafe code paths being incorrectly marked as safe, resulting in arbitrary read/write in kernel memory, lateral privilege escalation, and container escape. (bsc#1215519)

This update for the Linux Kernel 5.14.21-150500_55_28 fixes several issues.

The following security issues were fixed:

• CVE-2023-3777: Fixed a use-after-free vulnerability in netfilter: nf_tables component can be exploited to achieve local privilege escalation. (bsc#1215097)
• CVE-2023-5345: Fixed an use-after-free vulnerability in the fs/smb/client component which could be exploited to achieve local privilege escalation. (bsc#1215971)
• CVE-2023-4622: Fixed a use-after-free vulnerability in the Unix domain sockets component which could be exploited to achieve local privilege escalation (bsc#1215442).
• CVE-2023-2163: Fixed an incorrect verifier pruning in BPF that could lead to unsafe code paths being incorrectly marked as safe, resulting in arbitrary read/write in kernel memory, lateral privilege escalation, and container escape. (bsc#1215519)

This update for the Linux Kernel 5.14.21-150500_55_31 fixes several issues.

The following security issues were fixed:

• CVE-2023-3777: Fixed a use-after-free vulnerability in netfilter: nf_tables component can be exploited to achieve local privilege escalation. (bsc#1215097)
• CVE-2023-2163: Fixed an incorrect verifier pruning in BPF that could lead to unsafe code paths being incorrectly marked as safe, resulting in arbitrary read/write in kernel memory, lateral privilege escalation, and container escape. (bsc#1215519)

This update for the Linux Kernel 5.3.18-150300_59_106 fixes several issues.

The following security issues were fixed:

• CVE-2023-3777: Fixed a use-after-free vulnerability in netfilter: nf_tables component can be exploited to achieve local privilege escalation. (bsc#1215097)
• CVE-2023-4622: Fixed a use-after-free vulnerability in the Unix domain sockets component which could be exploited to achieve local privilege escalation (bsc#1215442).
• CVE-2023-2163: Fixed an incorrect verifier pruning in BPF that could lead to unsafe code paths being incorrectly marked as safe, resulting in arbitrary read/write in kernel memory, lateral privilege escalation, and container escape. (bsc#1215519)

This update for the Linux Kernel 5.14.21-150400_24_81 fixes several issues.

The following security issues were fixed:

• CVE-2023-3610: Fixed use-after-free vulnerability in nf_tables can be exploited to achieve local privilege escalation (bsc#1213584).
• CVE-2023-3777: Fixed a use-after-free vulnerability in netfilter: nf_tables component can be exploited to achieve local privilege escalation. (bsc#1215097)
• CVE-2023-5345: Fixed an use-after-free vulnerability in the fs/smb/client component which could be exploited to achieve local privilege escalation. (bsc#1215971)
• CVE-2023-4622: Fixed a use-after-free vulnerability in the Unix domain sockets component which could be exploited to achieve local privilege escalation (bsc#1215442).
• CVE-2023-2163: Fixed an incorrect verifier pruning in BPF that could lead to unsafe code paths being incorrectly marked as safe, resulting in arbitrary read/write in kernel memory, lateral privilege escalation, and container escape. (bsc#1215519)

Daniel Moghimi discovered that some Intel(R) Processors did not properly clear microarchitectural state after speculative execution of various instructions. A local unprivileged user could use this to obtain to sensitive information. (CVE-2022-40982)

Tavis Ormandy discovered that some AMD processors did not properly handle speculative execution of certain vector register instructions. A local attacker could use this to expose sensitive information. (CVE-2023-20593)

Ye Zhang and Nicolas Wu discovered that the io_uring subsystem in the Linux kernel did not properly handle locking for rings with IOPOLL, leading to a double-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-21400)

It was discovered that the universal 32bit network packet classifier implementation in the Linux kernel did not properly perform reference counting in some situations, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-3609)

It was discovered that the netfilter subsystem in the Linux kernel did not properly handle certain error conditions, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-3610)

It was discovered that the Quick Fair Queueing network scheduler implementation in the Linux kernel contained an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-3611)

It was discovered that the network packet classifier with netfilter/firewall marks implementation in the Linux kernel did not properly handle reference counting, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-3776)

Kevin Rich discovered that the netfilter subsystem in the Linux kernel did not properly handle table rules flush in certain circumstances. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2023-3777)

Kevin Rich discovered that the netfilter subsystem in the Linux kernel did not properly handle rule additions to bound chains in certain circumstances. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2023-3995)

It was discovered that the netfilter subsystem in the Linux kernel did not properly handle PIPAPO element removal, leading to a use-after-free vulnerability. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2023-4004)

Kevin Rich discovered that the netfilter subsystem in the Linux kernel did not properly handle bound chain deactivation in certain circumstances. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2023-4015)

Daniel Moghimi discovered that some Intel(R) Processors did not properly clear microarchitectural state after speculative execution of various instructions. A local unprivileged user could use this to obtain to sensitive information. (CVE-2022-40982)

Tavis Ormandy discovered that some AMD processors did not properly handle speculative execution of certain vector register instructions. A local attacker could use this to expose sensitive information. (CVE-2023-20593)

Kevin Rich discovered that the netfilter subsystem in the Linux kernel did not properly handle table rules flush in certain circumstances. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2023-3777)

Kevin Rich discovered that the netfilter subsystem in the Linux kernel did not properly handle rule additions to bound chains in certain circumstances. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2023-3995)

It was discovered that the netfilter subsystem in the Linux kernel did not properly handle PIPAPO element removal, leading to a use-after-free vulnerability. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2023-4004)

Kevin Rich discovered that the netfilter subsystem in the Linux kernel did not properly handle bound chain deactivation in certain circumstances. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2023-4015)

Daniel Moghimi discovered that some Intel(R) Processors did not properly clear microarchitectural state after speculative execution of various instructions. A local unprivileged user could use this to obtain to sensitive information. (CVE-2022-40982)

Tavis Ormandy discovered that some AMD processors did not properly handle speculative execution of certain vector register instructions. A local attacker could use this to expose sensitive information. (CVE-2023-20593)

It was discovered that the universal 32bit network packet classifier implementation in the Linux kernel did not properly perform reference counting in some situations, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-3609)

It was discovered that the netfilter subsystem in the Linux kernel did not properly handle certain error conditions, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-3610)

It was discovered that the Quick Fair Queueing network scheduler implementation in the Linux kernel contained an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-3611)

It was discovered that the network packet classifier with netfilter/firewall marks implementation in the Linux kernel did not properly handle reference counting, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-3776)

Kevin Rich discovered that the netfilter subsystem in the Linux kernel did not properly handle table rules flush in certain circumstances. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2023-3777)

Kevin Rich discovered that the netfilter subsystem in the Linux kernel did not properly handle rule additions to bound chains in certain circumstances. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2023-3995)

It was discovered that the netfilter subsystem in the Linux kernel did not properly handle PIPAPO element removal, leading to a use-after-free vulnerability. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2023-4004)

Kevin Rich discovered that the netfilter subsystem in the Linux kernel did not properly handle bound chain deactivation in certain circumstances. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2023-4015)

Daniel Moghimi discovered that some Intel(R) Processors did not properly clear microarchitectural state after speculative execution of various instructions. A local unprivileged user could use this to obtain to sensitive information. (CVE-2022-40982)

Tavis Ormandy discovered that some AMD processors did not properly handle speculative execution of certain vector register instructions. A local attacker could use this to expose sensitive information. (CVE-2023-20593)

Ye Zhang and Nicolas Wu discovered that the io_uring subsystem in the Linux kernel did not properly handle locking for rings with IOPOLL, leading to a double-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-21400)

It was discovered that the universal 32bit network packet classifier implementation in the Linux kernel did not properly perform reference counting in some situations, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-3609)

It was discovered that the netfilter subsystem in the Linux kernel did not properly handle certain error conditions, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-3610)

It was discovered that the Quick Fair Queueing network scheduler implementation in the Linux kernel contained an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-3611)

It was discovered that the network packet classifier with netfilter/firewall marks implementation in the Linux kernel did not properly handle reference counting, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-3776)

Kevin Rich discovered that the netfilter subsystem in the Linux kernel did not properly handle table rules flush in certain circumstances. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2023-3777)

Kevin Rich discovered that the netfilter subsystem in the Linux kernel did not properly handle rule additions to bound chains in certain circumstances. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2023-3995)

It was discovered that the netfilter subsystem in the Linux kernel did not properly handle PIPAPO element removal, leading to a use-after-free vulnerability. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2023-4004)

Kevin Rich discovered that the netfilter subsystem in the Linux kernel did not properly handle bound chain deactivation in certain circumstances. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2023-4015)

Daniel Moghimi discovered that some Intel(R) Processors did not properly clear microarchitectural state after speculative execution of various instructions. A local unprivileged user could use this to obtain to sensitive information. (CVE-2022-40982)

Tavis Ormandy discovered that some AMD processors did not properly handle speculative execution of certain vector register instructions. A local attacker could use this to expose sensitive information. (CVE-2023-20593)

Ye Zhang and Nicolas Wu discovered that the io_uring subsystem in the Linux kernel did not properly handle locking for rings with IOPOLL, leading to a double-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-21400)

It was discovered that the universal 32bit network packet classifier implementation in the Linux kernel did not properly perform reference counting in some situations, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-3609)

It was discovered that the netfilter subsystem in the Linux kernel did not properly handle certain error conditions, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-3610)

It was discovered that the Quick Fair Queueing network scheduler implementation in the Linux kernel contained an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-3611)

It was discovered that the network packet classifier with netfilter/firewall marks implementation in the Linux kernel did not properly handle reference counting, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-3776)

Kevin Rich discovered that the netfilter subsystem in the Linux kernel did not properly handle table rules flush in certain circumstances. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2023-3777)

Kevin Rich discovered that the netfilter subsystem in the Linux kernel did not properly handle rule additions to bound chains in certain circumstances. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2023-3995)

It was discovered that the netfilter subsystem in the Linux kernel did not properly handle PIPAPO element removal, leading to a use-after-free vulnerability. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2023-4004)

Kevin Rich discovered that the netfilter subsystem in the Linux kernel did not properly handle bound chain deactivation in certain circumstances. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2023-4015)

Daniel Moghimi discovered that some Intel(R) Processors did not properly clear microarchitectural state after speculative execution of various instructions. A local unprivileged user could use this to obtain to sensitive information. (CVE-2022-40982)

William Zhao discovered that the Traffic Control (TC) subsystem in the Linux kernel did not properly handle network packet retransmission in certain situations. A local attacker could use this to cause a denial of service (kernel deadlock). (CVE-2022-4269)

It was discovered that the NTFS file system implementation in the Linux kernel did not properly check buffer indexes in certain situations, leading to an out-of-bounds read vulnerability. A local attacker could possibly use this to expose sensitive information (kernel memory). (CVE-2022-48502)

Seth Jenkins discovered that the Linux kernel did not properly perform address randomization for a per-cpu memory management structure. A local attacker could use this to expose sensitive information (kernel memory) or in conjunction with another kernel vulnerability. (CVE-2023-0597)

It was discovered that a race condition existed in the btrfs file system implementation in the Linux kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-1611)

It was discovered that the APM X-Gene SoC hardware monitoring driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or expose sensitive information (kernel memory). (CVE-2023-1855)

It was discovered that the ST NCI NFC driver did not properly handle device removal events. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2023-1990)

Ruihan Li discovered that the bluetooth subsystem in the Linux kernel did not properly perform permissions checks when handling HCI sockets. A physically proximate attacker could use this to cause a denial of service (bluetooth communication). (CVE-2023-2002)

Tavis Ormandy discovered that some AMD processors did not properly handle speculative execution of certain vector register instructions. A local attacker could use this to expose sensitive information. (CVE-2023-20593)

It was discovered that the XFS file system implementation in the Linux kernel did not properly perform metadata validation when mounting certain images. An attacker could use this to specially craft a file system image that, when mounted, could cause a denial of service (system crash). (CVE-2023-2124)

Ye Zhang and Nicolas Wu discovered that the io_uring subsystem in the Linux kernel did not properly handle locking for rings with IOPOLL, leading to a double-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-21400)

Juan Jose Lopez Jaimez, Meador Inge, Simon Scannell, and Nenad Stojanovski discovered that the BPF verifier in the Linux kernel did not properly mark registers for precision tracking in certain situations, leading to an out- of-bounds access vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-2163)

It was discovered that the SLIMpro I2C device driver in the Linux kernel did not properly validate user-supplied data in some situations, leading to an out-of-bounds write vulnerability. A privileged attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-2194)

It was discovered that the perf subsystem in the Linux kernel contained a use-after-free vulnerability. A privileged local attacker could possibly use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-2235)

Zheng Zhang discovered that the device-mapper implementation in…

Daniel Moghimi discovered that some Intel(R) Processors did not properly clear microarchitectural state after speculative execution of various instructions. A local unprivileged user could use this to obtain to sensitive information. (CVE-2022-40982)

Tavis Ormandy discovered that some AMD processors did not properly handle speculative execution of certain vector register instructions. A local attacker could use this to expose sensitive information. (CVE-2023-20593)

Ye Zhang and Nicolas Wu discovered that the io_uring subsystem in the Linux kernel did not properly handle locking for rings with IOPOLL, leading to a double-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-21400)

It was discovered that the universal 32bit network packet classifier implementation in the Linux kernel did not properly perform reference counting in some situations, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-3609)

It was discovered that the netfilter subsystem in the Linux kernel did not properly handle certain error conditions, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-3610)

It was discovered that the Quick Fair Queueing network scheduler implementation in the Linux kernel contained an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-3611)

It was discovered that the network packet classifier with netfilter/firewall marks implementation in the Linux kernel did not properly handle reference counting, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-3776)

Kevin Rich discovered that the netfilter subsystem in the Linux kernel did not properly handle table rules flush in certain circumstances. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2023-3777)

Kevin Rich discovered that the netfilter subsystem in the Linux kernel did not properly handle rule additions to bound chains in certain circumstances. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2023-3995)

It was discovered that the netfilter subsystem in the Linux kernel did not properly handle PIPAPO element removal, leading to a use-after-free vulnerability. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2023-4004)

Kevin Rich discovered that the netfilter subsystem in the Linux kernel did not properly handle bound chain deactivation in certain circumstances. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2023-4015)