CVE-2023-4194

A flaw was found in the Linux kernel's TUN/TAP functionality. This issue could allow a local user to bypass network filters and gain unauthorized access to some resources. The original patches fixing CVE-2023-1076 are incorrect or incomplete. The problem is that the following upstream commits - a096ccca6e50 ("tun: tun_chr_open(): correctly initialize socket uid"), - 66b2c338adce ("tap: tap_open(): correctly initialize socket uid"), pass "inode->i_uid" to sock_init_data_uid() as the last parameter and that turns out to not be accurate.

A flaw was found in the Linux kernel's TUN/TAP functionality. This issue could allow a local user to bypass network filters and gain unauthorized access to some resources. The original patches fixing CVE-2023-1076 are incorrect or incomplete. The problem is that the following upstream commits - a096ccca6e50 ("tun: tun_chr_open(): correctly initialize socket uid"), - 66b2c338adce ("tap: tap_open(): correctly initialize socket uid"), pass "inode->i_uid" to sock_init_data_uid() as the last parameter and that turns out to not be accurate.

The Linux Kernel, the operating system core itself.

Security Fix(es):

A hash collision flaw was found in the IPv6 connection lookup table in the Linux kernel’s IPv6 functionality when a user makes a new kind of SYN flood attack. A user located in the local network or with a high bandwidth connection can increase the CPU usage of the server that accepts IPV6 connections up to 95%.(CVE-2023-1206)

A buffer overrun vulnerability was found in the netback driver in Xen due to an unusual split packet. This flaw allows an unprivileged guest to cause a denial of service (DoS) of the host by sending network packets to the backend, causing the backend to crash.(CVE-2023-34319)

An issue was discovered in l2cap_sock_release in net/bluetooth/l2cap_sock.c in the Linux kernel before 6.4.10. There is a use-after-free because the children of an sk are mishandled.(CVE-2023-40283)

A flaw was found in the Linux kernel's TUN/TAP functionality. This issue could allow a local user to bypass network filters and gain unauthorized access to some resources. The original patches fixing CVE-2023-1076 are incorrect or incomplete. The problem is that the following upstream commits - a096ccca6e50 ("tun: tun_chr_open(): correctly initialize socket uid"), - 66b2c338adce ("tap: tap_open(): correctly initialize socket uid"), pass "inode->i_uid" to sock_init_data_uid() as the last parameter and that turns out to not be accurate.(CVE-2023-4194)

A NULL pointer dereference flaw was found in dbFree in fs/jfs/jfs_dmap.c in the journaling file system (JFS) in the Linux Kernel. This issue may allow a local attacker to crash the system due to a missing sanity check.(CVE-2023-4385)

A NULL pointer dereference flaw was found in vmxnet3_rq_cleanup in drivers/net/vmxnet3/vmxnet3_drv.c in the networking sub-component in vmxnet3 in the Linux Kernel. This issue may allow a local attacker with normal user privilege to cause a denial of service due to a missing sanity check during cleanup.(CVE-2023-4459)

The Linux Kernel, the operating system core itself.

Security Fix(es):

A hash collision flaw was found in the IPv6 connection lookup table in the Linux kernel’s IPv6 functionality when a user makes a new kind of SYN flood attack. A user located in the local network or with a high bandwidth connection can increase the CPU usage of the server that accepts IPV6 connections up to 95%.(CVE-2023-1206)

A buffer overrun vulnerability was found in the netback driver in Xen due to an unusual split packet. This flaw allows an unprivileged guest to cause a denial of service (DoS) of the host by sending network packets to the backend, causing the backend to crash.(CVE-2023-34319)

An issue was discovered in the Linux kernel before 6.3.10. fs/smb/server/smb2misc.c in ksmbd does not validate the relationship between the command payload size and the RFC1002 length specification, leading to an out-of-bounds read.(CVE-2023-38432)

(CVE-2023-3867)

An issue was discovered in l2cap_sock_release in net/bluetooth/l2cap_sock.c in the Linux kernel before 6.4.10. There is a use-after-free because the children of an sk are mishandled.(CVE-2023-40283)

A flaw was found in the Linux kernel's TUN/TAP functionality. This issue could allow a local user to bypass network filters and gain unauthorized access to some resources. The original patches fixing CVE-2023-1076 are incorrect or incomplete. The problem is that the following upstream commits - a096ccca6e50 ("tun: tun_chr_open(): correctly initialize socket uid"), - 66b2c338adce ("tap: tap_open(): correctly initialize socket uid"), pass "inode->i_uid" to sock_init_data_uid() as the last parameter and that turns out to not be accurate.(CVE-2023-4194)

A flaw was found in btrfs_get_root_ref in fs/btrfs/disk-io.c in the btrfs filesystem in the Linux Kernel due to a double decrement of the reference count. This issue may allow a local attacker with user privilege to crash the system or may lead to leaked internal kernel information.(CVE-2023-4389)

The Linux Kernel, the operating system core itself.

Security Fix(es):

A hash collision flaw was found in the IPv6 connection lookup table in the Linux kernel’s IPv6 functionality when a user makes a new kind of SYN flood attack. A user located in the local network or with a high bandwidth connection can increase the CPU usage of the server that accepts IPV6 connections up to 95%.(CVE-2023-1206)

A buffer overrun vulnerability was found in the netback driver in Xen due to an unusual split packet. This flaw allows an unprivileged guest to cause a denial of service (DoS) of the host by sending network packets to the backend, causing the backend to crash.(CVE-2023-34319)

An issue was discovered in the Linux kernel before 6.3.10. fs/smb/server/smb2misc.c in ksmbd does not validate the relationship between the command payload size and the RFC1002 length specification, leading to an out-of-bounds read.(CVE-2023-38432)

(CVE-2023-3867)

An issue was discovered in l2cap_sock_release in net/bluetooth/l2cap_sock.c in the Linux kernel before 6.4.10. There is a use-after-free because the children of an sk are mishandled.(CVE-2023-40283)

A flaw was found in the Linux kernel's TUN/TAP functionality. This issue could allow a local user to bypass network filters and gain unauthorized access to some resources. The original patches fixing CVE-2023-1076 are incorrect or incomplete. The problem is that the following upstream commits - a096ccca6e50 ("tun: tun_chr_open(): correctly initialize socket uid"), - 66b2c338adce ("tap: tap_open(): correctly initialize socket uid"), pass "inode->i_uid" to sock_init_data_uid() as the last parameter and that turns out to not be accurate.(CVE-2023-4194)

The Linux Kernel, the operating system core itself.

Security Fix(es):

A hash collision flaw was found in the IPv6 connection lookup table in the Linux kernel’s IPv6 functionality when a user makes a new kind of SYN flood attack. A user located in the local network or with a high bandwidth connection can increase the CPU usage of the server that accepts IPV6 connections up to 95%.(CVE-2023-1206)

A buffer overrun vulnerability was found in the netback driver in Xen due to an unusual split packet. This flaw allows an unprivileged guest to cause a denial of service (DoS) of the host by sending network packets to the backend, causing the backend to crash.(CVE-2023-34319)

An issue was discovered in the Linux kernel before 6.3.10. fs/smb/server/smb2misc.c in ksmbd does not validate the relationship between the command payload size and the RFC1002 length specification, leading to an out-of-bounds read.(CVE-2023-38432)

(CVE-2023-3867)

An issue was discovered in l2cap_sock_release in net/bluetooth/l2cap_sock.c in the Linux kernel before 6.4.10. There is a use-after-free because the children of an sk are mishandled.(CVE-2023-40283)

A flaw was found in the Linux kernel's TUN/TAP functionality. This issue could allow a local user to bypass network filters and gain unauthorized access to some resources. The original patches fixing CVE-2023-1076 are incorrect or incomplete. The problem is that the following upstream commits - a096ccca6e50 ("tun: tun_chr_open(): correctly initialize socket uid"), - 66b2c338adce ("tap: tap_open(): correctly initialize socket uid"), pass "inode->i_uid" to sock_init_data_uid() as the last parameter and that turns out to not be accurate.(CVE-2023-4194)

The Linux Kernel, the operating system core itself.

Security Fix(es):

A hash collision flaw was found in the IPv6 connection lookup table in the Linux kernel’s IPv6 functionality when a user makes a new kind of SYN flood attack. A user located in the local network or with a high bandwidth connection can increase the CPU usage of the server that accepts IPV6 connections up to 95%.(CVE-2023-1206)

A buffer overrun vulnerability was found in the netback driver in Xen due to an unusual split packet. This flaw allows an unprivileged guest to cause a denial of service (DoS) of the host by sending network packets to the backend, causing the backend to crash.(CVE-2023-34319)

An issue was discovered in l2cap_sock_release in net/bluetooth/l2cap_sock.c in the Linux kernel before 6.4.10. There is a use-after-free because the children of an sk are mishandled.(CVE-2023-40283)

A flaw was found in the Linux kernel's TUN/TAP functionality. This issue could allow a local user to bypass network filters and gain unauthorized access to some resources. The original patches fixing CVE-2023-1076 are incorrect or incomplete. The problem is that the following upstream commits - a096ccca6e50 ("tun: tun_chr_open(): correctly initialize socket uid"), - 66b2c338adce ("tap: tap_open(): correctly initialize socket uid"), pass "inode->i_uid" to sock_init_data_uid() as the last parameter and that turns out to not be accurate.(CVE-2023-4194)

A NULL pointer dereference flaw was found in dbFree in fs/jfs/jfs_dmap.c in the journaling file system (JFS) in the Linux Kernel. This issue may allow a local attacker to crash the system due to a missing sanity check.(CVE-2023-4385)

A NULL pointer dereference flaw was found in vmxnet3_rq_cleanup in drivers/net/vmxnet3/vmxnet3_drv.c in the networking sub-component in vmxnet3 in the Linux Kernel. This issue may allow a local attacker with normal user privilege to cause a denial of service due to a missing sanity check during cleanup.(CVE-2023-4459)

A flaw was found in the Linux kernel's TUN/TAP functionality. This issue could allow a local user to bypass network filters and gain unauthorized access to some resources. The original patches fixing CVE-2023-1076 are incorrect or incomplete. The problem is that the following upstream commits - a096ccca6e50 ("tun: tun_chr_open(): correctly initialize socket uid"), - 66b2c338adce ("tap: tap_open(): correctly initialize socket uid"), pass "inode->i_uid" to sock_init_data_uid() as the last parameter and that turns out to not be accurate.

• drm/amd/pm: Fix negative array index read {CVE-2024-46821}
• drm/amd/display: Check gpio_id before used as array index {CVE-2024-46818}
• drm/amd/display: Check link_index before accessing dc->links[] {CVE-2024-46813}
• drm/amd/display: Fix index may exceed array range within fpu_update_bw_bounding_box {CVE-2024-46811}
• Squashfs: sanity check symbolic link size {CVE-2024-46744}
• platform/x86: panasonic-laptop: Fix SINF array out of bounds accesses {CVE-2024-46859}
• net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc() {CVE-2024-40995}
• net/sched: act_api: rely on rcu in tcf_idr_check_alloc {CVE-2024-40995}
• netfilter: bridge: confirm multicast packets before passing them up the stack {CVE-2024-27415}
• netfilter: let reset rules clean out conntrack entries {CVE-2024-27415}
• mm/filemap: make MAX_PAGECACHE_ORDER acceptable to xarray {CVE-2024-42243}
• gpiolib: cdev: Fix use after free in lineinfo_changed_notify {CVE-2024-36899}
• bpf, sockmap: Prevent lock inversion deadlock in map delete elem {CVE-2024-35895}
• bpf, sockmap: Fix preempt_rt splat when using raw_spin_lock_t {CVE-2024-35895}
• mm/huge_memory: don't unpoison huge_zero_folio {CVE-2024-40914}
• cxgb4: fix use after free bugs caused by circular dependency problem {CVE-2023-4133}
• timers: Restore ABI Compatibility with timer_delete Functions {CVE-2023-4133}
• timers: Provide timer_shutdown_sync {CVE-2023-4133}
• timers: Add shutdown mechanism to the internal functions {CVE-2023-4133}
• timers: Split [try_to_]del_timer_sync to prepare for shutdown mode {CVE-2023-4133}
• timers: Silently ignore timers with a NULL function {CVE-2023-4133}
• timers: Rename del_timer() to timer_delete() {CVE-2023-4133}
• timers: Rename del_timer_sync() to timer_delete_sync() {CVE-2023-4133}
• timers: Use del_timer_sync() even on UP {CVE-2023-4133}
• timers: Update kernel-doc for various functions {CVE-2023-4133}
• timers: Replace BUG_ON()s {CVE-2023-4133}
• timers: Get rid of del_singleshot_timer_sync() {CVE-2023-4133}
• clocksource/drivers/sp804: Do not use timer namespace for timer_shutdown() function {CVE-2023-4133}
• clocksource/drivers/arm_arch_timer: Do not use timer namespace for timer_shutdown() function {CVE-2023-4133}
• mm: avoid overflows in dirty throttling logic {CVE-2024-42131}
• ring-buffer: Fix a race between readers and resize checks {CVE-2024-38601}
• igc: avoid returning frame twice in XDP_REDIRECT {CVE-2024-26853}
• igc: Avoid transmit queue timeout for XDP {CVE-2024-26853}
• nfsd: fix RELEASE_LOCKOWNER {CVE-2024-26629}
• tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc {CVE-2023-52880}
• nvmet: fix a possible leak when destroy a ctrl during qp establishment {CVE-2024-42152}
• net: ntb_netdev: Move ntb_netdev_rx_handler() to call netif_rx() from __netif_rx() {CVE-2024-42110}
• x86: stop playing stack games in profile_pc() {CVE-2024-42096}
• xdp: Remove WARN() from __xdp_reg_mem_model() {CVE-2024-42082}
• NFSv4: Fix memory leak in nfs4_set_security_label {CVE-2024-41076}
• ppp: reject claimed-as-LCP but actually malformed packets {CVE-2024-41044}
• udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port(). {CVE-2024-41041}
• sched/deadline: Fix task_struct reference leak {CVE-2024-41023}
• tipc: force a dst refcount before doing decryption {CVE-2024-40983}
• scsi: qedi: Fix crash while reading debugfs attribute {CVE-2024-40978}
• wifi: iwlwifi: mvm: don't read past the mfuart notifcation {CVE-2024-40941}
• wifi: iwlwifi: mvm: check n_ssids before accessing the ssids {CVE-2024-40929}
• xhci: Handle TD clearing for multiple streams case {CVE-2024-40927}
• wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup() {CVE-2024-40912}
• wifi: cfg80211: Lock wiphy in cfg80211_get_station {CVE-2024-40911}
• ipv6: fix possible race in __fib6_drop_pcpu_from() {CVE-2024-40905}
• md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING {CVE-2024-39476}
• usb-storage: alauda: Check whether the media is…

These are all security issues fixed in the kernel-devel-6.4.11-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the kernel-devel-longterm-6.6.17-1.1 package on the GA media of openSUSE Tumbleweed.

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-40982: Fixed transient execution attack called 'Gather Data Sampling' (bsc#1206418).
• CVE-2023-0459: Fixed information leak in __uaccess_begin_nospec (bsc#1211738).
• CVE-2023-20569: Fixed side channel attack ‘Inception’ or ‘RAS Poisoning’ (bsc#1213287).
• CVE-2023-20593: Fixed a ZenBleed issue in 'Zen 2' CPUs that could allow an attacker to potentially access sensitive information (bsc#1213286).
• CVE-2023-2985: Fixed an use-after-free vulnerability in hfsplus_put_super in fs/hfsplus/super.c that could allow a local user to cause a denial of service (bsc#1211867).
• CVE-2023-3117: Fixed an use-after-free vulnerability in the netfilter subsystem when processing named and anonymous sets in batch requests that could allow a local user with CAP_NET_ADMIN capability to crash or potentially escalate their privileges on the system (bsc#1213245).
• CVE-2023-3390: Fixed an use-after-free vulnerability in the netfilter subsystem in net/netfilter/nf_tables_api.c that could allow a local attacker with user access to cause a privilege escalation issue (bsc#1212846).
• CVE-2023-34319: Fixed buffer overrun triggered by unusual packet in xen/netback (XSA-432) (bsc#1213546).
• CVE-2023-35001: Fixed an out-of-bounds memory access flaw in nft_byteorder that could allow a local attacker to escalate their privilege (bsc#1213059).
• CVE-2023-3567: Fixed a use-after-free in vcs_read in drivers/tty/vt/vc_screen.c (bsc#1213167).
• CVE-2023-3609: Fixed reference counter leak leading to overflow in net/sched (bsc#1213586).
• CVE-2023-3611: Fixed an out-of-bounds write in net/sched sch_qfq(bsc#1213585).
• CVE-2023-3776: Fixed improper refcount update in cls_fw leads to use-after-free (bsc#1213588).
• CVE-2023-3812: Fixed an out-of-bounds memory access flaw in the TUN/TAP device driver functionality that could allow a local user to crash or potentially escalate their privileges on the system (bsc#1213543).
• CVE-2023-4133: Fixed use after free bugs caused by circular dependency problem in cxgb4 (bsc#1213970).
• CVE-2023-4194: Fixed a type confusion in net tun_chr_open() bsc#1214019).

The following non-security bugs were fixed:

• arm: cpu: switch to arch_cpu_finalize_init() (bsc#1206418).
• arm: spear: do not use timer namespace for timer_shutdown() function (bsc#1213970).
• fix kabi when adding new cpuid leaves
• get module prefix from kmod (bsc#1212835).
• remove more packaging cruft for sle < 12 sp3
• cifs: fix open leaks in open_cached_dir() (bsc#1209342).
• clocksource/drivers/arm_arch_timer: do not use timer namespace for timer_shutdown() function (bsc#1213970).
• clocksource/drivers/sp804: do not use timer namespace for timer_shutdown() function (bsc#1213970).
• init, x86: move mem_encrypt_init() into arch_cpu_finalize_init() (bsc#1206418).
• init: invoke arch_cpu_finalize_init() earlier (bsc#1206418).
• init: provide arch_cpu_finalize_init() (bsc#1206418).
• init: remove check_bugs() leftovers (bsc#1206418).
• kernel-binary.spec.in: remove superfluous %% in supplements fixes: 02b7735e0caf ('rpm/kernel-binary.spec.in: add enhances and supplements tags to in-tree kmps')
• kernel-docs: add buildrequires on python3-base when using python3 the python3 binary is provided by python3-base.
• kernel-docs: use python3 together with python3-sphinx (bsc#1212741).
• keys: do not cache key in task struct if key is requested from kernel thread (bsc#1213354).
• keys: fix linking a duplicate key to a keyring's assoc_array (bsc#1207088).
• net/sched: sch_qfq: refactor parsing of netlink parameters (bsc#1213585).
• net: mana: add support for vlan tagging (bsc#1212301).
• rpm/check-for-config-changes: ignore also pahole_has_* we now also have options like config_pahole_has_lang_exclude.
• rpm/check-for-config-changes: ignore also riscv_isa_* and dynamic_sigframe they depend on config_toolchain_has_*. -…

The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-40982: Fixed transient execution attack called 'Gather Data Sampling' (bsc#1206418).
• CVE-2023-0459: Fixed information leak in __uaccess_begin_nospec (bsc#1211738).
• CVE-2023-20569: Fixed side channel attack ‘Inception’ or ‘RAS Poisoning’ (bsc#1213287).
• CVE-2023-20593: Fixed a ZenBleed issue in 'Zen 2' CPUs that could allow an attacker to potentially access sensitive information (bsc#1213286).
• CVE-2023-2985: Fixed an use-after-free vulnerability in hfsplus_put_super in fs/hfsplus/super.c that could allow a local user to cause a denial of service (bsc#1211867).
• CVE-2023-34319: Fixed buffer overrun triggered by unusual packet in xen/netback (XSA-432) (bsc#1213546).
• CVE-2023-35001: Fixed an out-of-bounds memory access flaw in nft_byteorder that could allow a local attacker to escalate their privilege (bsc#1213059).
• CVE-2023-3567: Fixed a use-after-free in vcs_read in drivers/tty/vt/vc_screen.c (bsc#1213167).
• CVE-2023-3609: Fixed reference counter leak leading to overflow in net/sched (bsc#1213586).
• CVE-2023-3611: Fixed an out-of-bounds write in net/sched sch_qfq(bsc#1213585).
• CVE-2023-3776: Fixed improper refcount update in cls_fw leads to use-after-free (bsc#1213588).
• CVE-2023-4133: Fixed use after free bugs caused by circular dependency problem in cxgb4 (bsc#1213970).
• CVE-2023-4194: Fixed a type confusion in net tun_chr_open() bsc#1214019).

The following non-security bugs were fixed:

• arm: spear: do not use timer namespace for timer_shutdown() function (bsc#1213970).
• clocksource/drivers/arm_arch_timer: do not use timer namespace for timer_shutdown() function (bsc#1213970).
• clocksource/drivers/sp804: do not use timer namespace for timer_shutdown() function (bsc#1213970).
• cpufeatures: allow adding more cpuid words
• get module prefix from kmod (bsc#1212835).
• kernel-binary.spec.in: remove superfluous %% in supplements fixes: 02b7735e0caf ('rpm/kernel-binary.spec.in: add enhances and supplements tags to in-tree kmps')
• kernel-docs: add buildrequires on python3-base when using python3 the python3 binary is provided by python3-base.
• kernel-docs: use python3 together with python3-sphinx (bsc#1212741).
• keys: change keyring_serialise_link_sem to a mutex (bsc#1207088).
• keys: fix linking a duplicate key to a keyring's assoc_array (bsc#1207088).
• keys: hoist locking out of __key_link_begin() (bsc#1207088).
• net/sched: sch_qfq: refactor parsing of netlink parameters (bsc#1213585).
• net: mana: add support for vlan tagging (bsc#1212301).
• readme.branch: add myself as co-maintainer
• remove more packaging cruft for sle < 12 sp3
• rpm/check-for-config-changes: ignore also pahole_has_* we now also have options like config_pahole_has_lang_exclude.
• rpm/check-for-config-changes: ignore also riscv_isa_* and dynamic_sigframe they depend on config_toolchain_has_*.
• timers: add shutdown mechanism to the internal functions (bsc#1213970).
• timers: provide timer_shutdown_sync (bsc#1213970).
• timers: rename del_timer() to timer_delete() (bsc#1213970).
• timers: rename del_timer_sync() to timer_delete_sync() (bsc#1213970).
• timers: replace bug_on()s (bsc#1213970).
• timers: silently ignore timers with a null function (bsc#1213970).
• timers: split [try_to_]del_timer_sync to prepare for shutdown mode (bsc#1213970).
• timers: update kernel-doc for various functions (bsc#1213970).
• timers: use del_timer_sync() even on up (bsc#1213970).
• ubi: ensure that vid header offset + vid header size <= alloc, size (bsc#1210584).
• ubi: fix failure attaching when vid_hdr offset equals to (sub)page size (bsc#1210584).
• usrmerge: Adjust module path in the kernel sources (bsc#1212835).

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-38457: Fixed a use-after-free vulnerability in vmwgfx driver that allowed a local attacker to cause a denial of service (bsc#1203330).
• CVE-2022-40133: Fixed a use-after-free vulnerability in vmwgfx driver that allowed a local attacker to cause a denial of service (bsc#1203329).
• CVE-2023-2007: Fixed a flaw in the DPT I2O Controller driver that could allow an attacker to escalate privileges and execute arbitrary code in the context of the kernel (bsc#1210448).
• CVE-2023-3610: Fixed use-after-free vulnerability in nf_tables can be exploited to achieve local privilege escalation (bsc#1213580).
• CVE-2023-3772: Fixed a flaw in XFRM subsystem that may have allowed a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer leading to a possible kernel crash and denial of service (bsc#1213666).
• CVE-2023-3863: Fixed a use-after-free flaw was found in nfc_llcp_find_local that allowed a local user with special privileges to impact a kernel information leak issue (bsc#1213601).
• CVE-2023-40283: Fixed use-after-free in l2cap_sock_ready_cb (bsc#1214233).
• CVE-2023-4128: Fixed a use-after-free flaw in net/sched/cls_fw.c that allowed a local attacker to perform a local privilege escalation due to incorrect handling of the existing filter, leading to a kernel information leak issue (bsc#1214149).
• CVE-2023-4133: Fixed use after free bugs caused by circular dependency problem in cxgb4 (bsc#1213970).
• CVE-2023-4134: Fixed use-after-free in cyttsp4_watchdog_work() (bsc#1213971).
• CVE-2023-4147: Fixed use-after-free in nf_tables_newrule (bsc#1213968).
• CVE-2023-4194: Fixed a type confusion in net tun_chr_open() (bsc#1214019).
• CVE-2023-4273: Fixed a flaw in the exFAT driver of the Linux kernel that alloawed a local privileged attacker to overflow the kernel stack (bsc#1214120).
• CVE-2023-4387: Fixed use-after-free flaw in vmxnet3_rq_alloc_rx_buf that could allow a local attacker to crash the system due to a double-free (bsc#1214350).
• CVE-2023-4459: Fixed a NULL pointer dereference flaw in vmxnet3_rq_cleanup that may have allowed a local attacker with normal user privilege to cause a denial of service (bsc#1214451).
• CVE-2023-4563: Fixed use-after-free in nft_verdict_dump due to a race between set GC and transaction (bsc#1214727).
• CVE-2023-4569: Fixed information leak in nft_set_catchall_flush in net/netfilter/nf_tables_api.c (bsc#1214729).
• CVE-2023-20588: Fixed a division-by-zero error on some AMD processors that can potentially return speculative data resulting in loss of confidentiality (bsc#1213927).
• CVE-2023-34319: Fixed buffer overrun triggered by unusual packet in xen/netback (XSA-432) (bsc#1213546).
• CVE-2023-37453: Fixed oversight in SuperSpeed initialization (bsc#1213123).

The following non-security bugs were fixed:

• ACPI/IORT: Update SMMUv3 DeviceID support (bsc#1214305).
• ACPI: processor: perflib: Avoid updating frequency QoS unnecessarily (git-fixes).
• ACPI: processor: perflib: Use the 'no limit' frequency QoS (git-fixes).
• ACPI: x86: s2idle: Fix a logic error parsing AMD constraints table (git-fixes).
• ALSA: ac97: Fix possible error value of *rac97 (git-fixes).
• ALSA: hda/cs8409: Support new Dell Dolphin Variants (git-fixes).
• ALSA: hda/realtek - Remodified 3k pull low procedure (git-fixes).
• ALSA: hda/realtek: Add quirk for HP Victus 16-d1xxx to enable mute LED (git-fixes).
• ALSA: hda/realtek: Add quirk for mute LEDs on HP ENVY x360 15-eu0xxx (git-fixes).
• ALSA: hda/realtek: Add quirks for HP G11 Laptops (git-fixes).
• ALSA: hda/realtek: Switch Dell Oasis models to use SPI (git-fixes).
• ALSA: pcm: Fix missing fixup call in compat hw_refine ioctl (git-fixes).
• ALSA: usb-audio: Add support for Mythware XA001AU capture and playback interfaces (git-fixes).
• ALSA: usb-audio: Fix init call orders for UAC1 (git-fixes). -…

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-38457: Fixed a use-after-free vulnerability in vmwgfx driver that allowed a local attacker to cause a denial of service (bsc#1203330).
• CVE-2022-40133: Fixed a use-after-free vulnerability in vmwgfx driver that allowed a local attacker to cause a denial of service (bsc#1203329).
• CVE-2023-2007: Fixed a flaw in the DPT I2O Controller driver that could allow an attacker to escalate privileges and execute arbitrary code in the context of the kernel (bsc#1210448).
• CVE-2023-3610: Fixed use-after-free vulnerability in nf_tables can be exploited to achieve local privilege escalation (bsc#1213580).
• CVE-2023-3772: Fixed a flaw in XFRM subsystem that may have allowed a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer leading to a possible kernel crash and denial of service (bsc#1213666).
• CVE-2023-3863: Fixed a use-after-free flaw was found in nfc_llcp_find_local that allowed a local user with special privileges to impact a kernel information leak issue (bsc#1213601).
• CVE-2023-40283: Fixed use-after-free in l2cap_sock_ready_cb (bsc#1214233).
• CVE-2023-4128: Fixed a use-after-free flaw in net/sched/cls_fw.c that allowed a local attacker to perform a local privilege escalation due to incorrect handling of the existing filter, leading to a kernel information leak issue (bsc#1214149).
• CVE-2023-4133: Fixed use after free bugs caused by circular dependency problem in cxgb4 (bsc#1213970).
• CVE-2023-4134: Fixed use-after-free in cyttsp4_watchdog_work() (bsc#1213971).
• CVE-2023-4147: Fixed use-after-free in nf_tables_newrule (bsc#1213968).
• CVE-2023-4194: Fixed a type confusion in net tun_chr_open() (bsc#1214019).
• CVE-2023-4273: Fixed a flaw in the exFAT driver of the Linux kernel that alloawed a local privileged attacker to overflow the kernel stack (bsc#1214120).
• CVE-2023-4387: Fixed use-after-free flaw in vmxnet3_rq_alloc_rx_buf that could allow a local attacker to crash the system due to a double-free (bsc#1214350).
• CVE-2023-4459: Fixed a NULL pointer dereference flaw in vmxnet3_rq_cleanup that may have allowed a local attacker with normal user privilege to cause a denial of service (bsc#1214451).
• CVE-2023-4563: Fixed use-after-free in nft_verdict_dump due to a race between set GC and transaction (bsc#1214727).
• CVE-2023-4569: Fixed information leak in nft_set_catchall_flush in net/netfilter/nf_tables_api.c (bsc#1214729).
• CVE-2023-20588: Fixed a division-by-zero error on some AMD processors that can potentially return speculative data resulting in loss of confidentiality (bsc#1213927).
• CVE-2023-34319: Fixed buffer overrun triggered by unusual packet in xen/netback (XSA-432) (bsc#1213546).
• CVE-2023-37453: Fixed oversight in SuperSpeed initialization (bsc#1213123).

The following non-security bugs were fixed:

• ACPI/IORT: Update SMMUv3 DeviceID support (bsc#1214305).
• ACPI: processor: perflib: Avoid updating frequency QoS unnecessarily (git-fixes).
• ACPI: processor: perflib: Use the 'no limit' frequency QoS (git-fixes).
• ACPI: x86: s2idle: Fix a logic error parsing AMD constraints table (git-fixes).
• ALSA: ac97: Fix possible error value of *rac97 (git-fixes).
• ALSA: hda/cs8409: Support new Dell Dolphin Variants (git-fixes).
• ALSA: hda/realtek - Remodified 3k pull low procedure (git-fixes).
• ALSA: hda/realtek: Add quirk for HP Victus 16-d1xxx to enable mute LED (git-fixes).
• ALSA: hda/realtek: Add quirk for mute LEDs on HP ENVY x360 15-eu0xxx (git-fixes).
• ALSA: hda/realtek: Add quirks for HP G11 Laptops (git-fixes).
• ALSA: hda/realtek: Switch Dell Oasis models to use SPI (git-fixes).
• ALSA: pcm: Fix missing fixup call in compat hw_refine ioctl (git-fixes).
• ALSA: usb-audio: Add support for Mythware XA001AU capture and playback interfaces (git-fixes).
• ALSA: usb-audio: Fix init call orders for UAC1 (git-fixes). -…

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-2007: Fixed a flaw in the DPT I2O Controller driver that could allow an attacker to escalate privileges and execute arbitrary code in the context of the kernel (bsc#1210448).
• CVE-2023-20588: Fixed a division-by-zero error on some AMD processors that can potentially return speculative data resulting in loss of confidentiality (bsc#1213927).
• CVE-2023-34319: Fixed buffer overrun triggered by unusual packet in xen/netback (XSA-432) (bsc#1213546).
• CVE-2023-3610: Fixed use-after-free vulnerability in nf_tables can be exploited to achieve local privilege escalation (bsc#1213580).
• CVE-2023-37453: Fixed oversight in SuperSpeed initialization (bsc#1213123).
• CVE-2023-3772: Fixed a flaw in XFRM subsystem that may have allowed a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer leading to a possible kernel crash and denial of service (bsc#1213666).
• CVE-2023-3863: Fixed a use-after-free flaw was found in nfc_llcp_find_local that allowed a local user with special privileges to impact a kernel information leak issue (bsc#1213601).
• CVE-2023-4128: Fixed a use-after-free flaw in net/sched/cls_fw.c that allowed a local attacker to perform a local privilege escalation due to incorrect handling of the existing filter, leading to a kernel information leak issue (bsc#1214149).
• CVE-2023-4133: Fixed use after free bugs caused by circular dependency problem in cxgb4 (bsc#1213970).
• CVE-2023-4134: Fixed use-after-free in cyttsp4_watchdog_work() (bsc#1213971).
• CVE-2023-4147: Fixed use-after-free in nf_tables_newrule (bsc#1213968).
• CVE-2023-4194: Fixed a type confusion in net tun_chr_open() (bsc#1214019).
• CVE-2023-4273: Fixed a flaw in the exFAT driver of the Linux kernel that alloawed a local privileged attacker to overflow the kernel stack (bsc#1214120).
• CVE-2023-4387: Fixed use-after-free flaw in vmxnet3_rq_alloc_rx_buf that could allow a local attacker to crash the system due to a double-free (bsc#1214350).
• CVE-2023-4459: Fixed a NULL pointer dereference flaw in vmxnet3_rq_cleanup that may have allowed a local attacker with normal user privilege to cause a denial of service (bsc#1214451).
• CVE-2023-4569: Fixed information leak in nft_set_catchall_flush in net/netfilter/nf_tables_api.c (bsc#1214729).

The following non-security bugs were fixed:

• acpi: processor: perflib: avoid updating frequency qos unnecessarily (git-fixes).
• acpi: processor: perflib: use the 'no limit' frequency qos (git-fixes).
• acpi: x86: s2idle: fix a logic error parsing amd constraints table (git-fixes).
• alsa: ac97: fix possible error value of *rac97 (git-fixes).
• alsa: hda/cs8409: support new dell dolphin variants (git-fixes).
• alsa: hda/realtek - remodified 3k pull low procedure (git-fixes).
• alsa: hda/realtek: add quirk for hp victus 16-d1xxx to enable mute led (git-fixes).
• alsa: hda/realtek: add quirk for mute leds on hp envy x360 15-eu0xxx (git-fixes).
• alsa: hda/realtek: add quirks for hp g11 laptops (git-fixes).
• alsa: hda/realtek: switch dell oasis models to use spi (git-fixes).
• alsa: pcm: fix missing fixup call in compat hw_refine ioctl (git-fixes).
• alsa: usb-audio: add support for mythware xa001au capture and playback interfaces (git-fixes).
• alsa: usb-audio: fix init call orders for uac1 (git-fixes).
• alsa: ymfpci: fix the missing snd_card_free() call at probe error (git-fixes).
• amba: bus: fix refcount leak (git-fixes).
• arm64: dts: imx8mn-var-som: add missing pull-up for onboard phy reset pinmux (git-fixes).
• arm64: dts: qcom: qrb5165-rb5: fix thermal zone conflict (git-fixes).
• arm64: dts: rockchip: disable hs400 for emmc on rock pi 4 (git-fixes).
• arm: dts: imx6dl: prtrvt, prtvt7, prti6q, prtwd2: fix usb related warnings (git-fixes).
• arm: dts: imx6sll: fixup of operating points (git-fixes).
• arm: spear: do not use timer…

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-2007: Fixed a flaw in the DPT I2O Controller driver that could allow an attacker to escalate privileges and execute arbitrary code in the context of the kernel (bsc#1210448).
• CVE-2023-20588: Fixed a division-by-zero error on some AMD processors that can potentially return speculative data resulting in loss of confidentiality (bsc#1213927).
• CVE-2023-34319: Fixed buffer overrun triggered by unusual packet in xen/netback (XSA-432) (bsc#1213546).
• CVE-2023-3610: Fixed use-after-free vulnerability in nf_tables can be exploited to achieve local privilege escalation (bsc#1213580).
• CVE-2023-37453: Fixed oversight in SuperSpeed initialization (bsc#1213123).
• CVE-2023-3772: Fixed a flaw in XFRM subsystem that may have allowed a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer leading to a possible kernel crash and denial of service (bsc#1213666).
• CVE-2023-3863: Fixed a use-after-free flaw was found in nfc_llcp_find_local that allowed a local user with special privileges to impact a kernel information leak issue (bsc#1213601).
• CVE-2023-4128: Fixed a use-after-free flaw in net/sched/cls_fw.c that allowed a local attacker to perform a local privilege escalation due to incorrect handling of the existing filter, leading to a kernel information leak issue (bsc#1214149).
• CVE-2023-4133: Fixed use after free bugs caused by circular dependency problem in cxgb4 (bsc#1213970).
• CVE-2023-4134: Fixed use-after-free in cyttsp4_watchdog_work() (bsc#1213971).
• CVE-2023-4147: Fixed use-after-free in nf_tables_newrule (bsc#1213968).
• CVE-2023-4194: Fixed a type confusion in net tun_chr_open() (bsc#1214019).
• CVE-2023-4273: Fixed a flaw in the exFAT driver of the Linux kernel that alloawed a local privileged attacker to overflow the kernel stack (bsc#1214120).
• CVE-2023-4387: Fixed use-after-free flaw in vmxnet3_rq_alloc_rx_buf that could allow a local attacker to crash the system due to a double-free (bsc#1214350).
• CVE-2023-4459: Fixed a NULL pointer dereference flaw in vmxnet3_rq_cleanup that may have allowed a local attacker with normal user privilege to cause a denial of service (bsc#1214451).
• CVE-2023-4569: Fixed information leak in nft_set_catchall_flush in net/netfilter/nf_tables_api.c (bsc#1214729).

The following non-security bugs were fixed:

• acpi: processor: perflib: avoid updating frequency qos unnecessarily (git-fixes).
• acpi: processor: perflib: use the 'no limit' frequency qos (git-fixes).
• acpi: x86: s2idle: fix a logic error parsing amd constraints table (git-fixes).
• alsa: ac97: fix possible error value of *rac97 (git-fixes).
• alsa: hda/cs8409: support new dell dolphin variants (git-fixes).
• alsa: hda/realtek - remodified 3k pull low procedure (git-fixes).
• alsa: hda/realtek: add quirk for hp victus 16-d1xxx to enable mute led (git-fixes).
• alsa: hda/realtek: add quirk for mute leds on hp envy x360 15-eu0xxx (git-fixes).
• alsa: hda/realtek: add quirks for hp g11 laptops (git-fixes).
• alsa: hda/realtek: switch dell oasis models to use spi (git-fixes).
• alsa: pcm: fix missing fixup call in compat hw_refine ioctl (git-fixes).
• alsa: usb-audio: add support for mythware xa001au capture and playback interfaces (git-fixes).
• alsa: usb-audio: fix init call orders for uac1 (git-fixes).
• alsa: ymfpci: fix the missing snd_card_free() call at probe error (git-fixes).
• amba: bus: fix refcount leak (git-fixes).
• arm64: dts: imx8mn-var-som: add missing pull-up for onboard phy reset pinmux (git-fixes).
• arm64: dts: qcom: qrb5165-rb5: fix thermal zone conflict (git-fixes).
• arm64: dts: rockchip: disable hs400 for emmc on rock pi 4 (git-fixes).
• arm: dts: imx6dl: prtrvt, prtvt7, prti6q, prtwd2: fix usb related warnings (git-fixes).
• arm: dts: imx6sll: fixup of operating points (git-fixes).
• arm: spear: do not use timer…

The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-36402: Fixed an integer overflow vulnerability in vmwgfx driver in that allowed a local attacker with a user account on the system to gain privilege, causing a denial of service (bsc#1203517).
• CVE-2023-2007: Fixed a flaw in the DPT I2O Controller driver that could allow an attacker to escalate privileges and execute arbitrary code in the context of the kernel (bsc#1210448).
• CVE-2023-20588: Fixed a division-by-zero error on some AMD processors that can potentially return speculative data resulting in loss of confidentiality (bsc#1213927).
• CVE-2023-34319: Fixed buffer overrun triggered by unusual packet in xen/netback (XSA-432) (bsc#1213546).
• CVE-2023-3772: Fixed a flaw in XFRM subsystem that may have allowed a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer leading to a possible kernel crash and denial of service (bsc#1213666).
• CVE-2023-3812: Fixed an out-of-bounds memory access flaw in the TUN/TAP device driver functionality that could allow a local user to crash or potentially escalate their privileges on the system (bsc#1213543).
• CVE-2023-3863: Fixed a use-after-free flaw was found in nfc_llcp_find_local that allowed a local user with special privileges to impact a kernel information leak issue (bsc#1213601).
• CVE-2023-40283: Fixed use-after-free in l2cap_sock_ready_cb (bsc#1214233).
• CVE-2023-4128: Fixed a use-after-free flaw in net/sched/cls_fw.c that allowed a local attacker to perform a local privilege escalation due to incorrect handling of the existing filter, leading to a kernel information leak issue (bsc#1214149).
• CVE-2023-4132: Fixed use-after-free vulnerability was found in the siano smsusb module that allowed a local user to crash the system, causing a denial of service condition (bsc#1213969).
• CVE-2023-4133: Fixed use after free bugs caused by circular dependency problem in cxgb4 (bsc#1213970).
• CVE-2023-4134: Fixed use-after-free in cyttsp4_watchdog_work() (bsc#1213971).
• CVE-2023-4194: Fixed a type confusion in net tun_chr_open() (bsc#1214019).
• CVE-2023-4385: Fixed a NULL pointer dereference flaw in dbFree that may have allowed a local attacker to crash the system due to a missing sanity check (bsc#1214348).
• CVE-2023-4387: Fixed use-after-free flaw in vmxnet3_rq_alloc_rx_buf that could allow a local attacker to crash the system due to a double-free (bsc#1214350).
• CVE-2023-4459: Fixed a NULL pointer dereference flaw in vmxnet3_rq_cleanup that may have allowed a local attacker with normal user privilege to cause a denial of service (bsc#1214451).

The following non-security bugs were fixed:

• af_key: fix send_acquire race with pfkey_register (git-fixes).
• af_packet: fix data-race in packet_setsockopt / packet_setsockopt (git-fixes).
• af_unix: fix a data race of sk->sk_receive_queue->qlen (git-fixes).
• arm64: re-enable support for contiguous hugepages (git-fixes)
• arm64: vdso: fix clock_getres() for clock_realtime (git-fixes)
• arm: spear: do not use timer namespace for timer_shutdown() function (bsc#1213970).
• bluetooth: nokia: fix value check in nokia_bluetooth_serdev_probe() (git-fixes).
• bnx2x: fix page fault following eeh recovery (bsc#1214299).
• bonding: fix a use-after-free problem when bond_sysfs_slave_add() failed (git-fixes).
• bpf, arm64: remove prefetch insn in xadd mapping (git-fixes)
• bpf, arm64: use more scalable stadd over ldxr / stxr loop in xadd (git-fixes)
• bridge: ebtables: do not crash when using dnat target in output chains (git-fixes).
• btrfs-allow-use-of-global-block-reserve-for-balance: (bsc#1214335).
• btrfs-unset-reloc-control-if-transaction-commit-fail: (bsc#1212051).
• clocksource/drivers/arm_arch_timer: do not use timer namespace for timer_shutdown() function (bsc#1213970).
• clocksource/drivers/sp804: do not use timer namespace for timer_shutdown() function…

The SUSE Linux Enterprise 15 SP5 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-38457: Fixed a use-after-free vulnerability in vmwgfx driver that allowed a local attacker to cause a denial of service (bsc#1203330).
• CVE-2022-40133: Fixed a use-after-free vulnerability in vmwgfx driver that allowed a local attacker to cause a denial of service (bsc#1203329).
• CVE-2023-2007: Fixed a flaw in the DPT I2O Controller driver that could allow an attacker to escalate privileges and execute arbitrary code in the context of the kernel (bsc#1210448).
• CVE-2023-3610: Fixed use-after-free vulnerability in nf_tables can be exploited to achieve local privilege escalation (bsc#1213580).
• CVE-2023-3772: Fixed a flaw in XFRM subsystem that may have allowed a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer leading to a possible kernel crash and denial of service (bsc#1213666).
• CVE-2023-3863: Fixed a use-after-free flaw was found in nfc_llcp_find_local that allowed a local user with special privileges to impact a kernel information leak issue (bsc#1213601).
• CVE-2023-4128: Fixed a use-after-free flaw in net/sched/cls_fw.c that allowed a local attacker to perform a local privilege escalation due to incorrect handling of the existing filter, leading to a kernel information leak issue (bsc#1214149).
• CVE-2023-4133: Fixed use after free bugs caused by circular dependency problem in cxgb4 (bsc#1213970).
• CVE-2023-4134: Fixed use-after-free in cyttsp4_watchdog_work() (bsc#1213971).
• CVE-2023-4147: Fixed use-after-free in nf_tables_newrule (bsc#1213968).
• CVE-2023-4194: Fixed a type confusion in net tun_chr_open() (bsc#1214019).
• CVE-2023-4273: Fixed a flaw in the exFAT driver of the Linux kernel that alloawed a local privileged attacker to overflow the kernel stack (bsc#1214120).
• CVE-2023-4387: Fixed use-after-free flaw in vmxnet3_rq_alloc_rx_buf that could allow a local attacker to crash the system due to a double-free (bsc#1214350).
• CVE-2023-4459: Fixed a NULL pointer dereference flaw in vmxnet3_rq_cleanup that may have allowed a local attacker with normal user privilege to cause a denial of service (bsc#1214451).
• CVE-2023-4563: Fixed use-after-free in nft_verdict_dump due to a race between set GC and transaction (bsc#1214727).
• CVE-2023-4569: Fixed information leak in nft_set_catchall_flush in net/netfilter/nf_tables_api.c (bsc#1214729).
• CVE-2023-20588: Fixed a division-by-zero error on some AMD processors that can potentially return speculative data resulting in loss of confidentiality (bsc#1213927).
• CVE-2023-34319: Fixed buffer overrun triggered by unusual packet in xen/netback (XSA-432) (bsc#1213546).
• CVE-2023-37453: Fixed oversight in SuperSpeed initialization (bsc#1213123).
• CVE-2023-40283: Fixed use-after-free in l2cap_sock_ready_cb (bsc#1214233).

The following non-security bugs were fixed:

• ACPI/IORT: Update SMMUv3 DeviceID support (bsc#1214305).
• ACPI: processor: perflib: Avoid updating frequency QoS unnecessarily (git-fixes).
• ACPI: processor: perflib: Use the 'no limit' frequency QoS (git-fixes).
• ACPI: x86: s2idle: Fix a logic error parsing AMD constraints table (git-fixes).
• ALSA: ac97: Fix possible error value of *rac97 (git-fixes).
• ALSA: hda/cs8409: Support new Dell Dolphin Variants (git-fixes).
• ALSA: hda/realtek - Remodified 3k pull low procedure (git-fixes).
• ALSA: hda/realtek: Add quirk for HP Victus 16-d1xxx to enable mute LED (git-fixes).
• ALSA: hda/realtek: Add quirk for mute LEDs on HP ENVY x360 15-eu0xxx (git-fixes).
• ALSA: hda/realtek: Add quirks for HP G11 Laptops (git-fixes).
• ALSA: hda/realtek: Switch Dell Oasis models to use SPI (git-fixes).
• ALSA: pcm: Fix missing fixup call in compat hw_refine ioctl (git-fixes).
• ALSA: usb-audio: Add support for Mythware XA001AU capture and playback interfaces (git-fixes).
• ALSA: usb-audio: Fix init call orders for UAC1 (git-fixes). -…

The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-36402: Fixed an integer overflow vulnerability in vmwgfx driver in that allowed a local attacker with a user account on the system to gain privilege, causing a denial of service (bsc#1203517).
• CVE-2023-2007: Fixed a flaw in the DPT I2O Controller driver that could allow an attacker to escalate privileges and execute arbitrary code in the context of the kernel (bsc#1210448).
• CVE-2023-3772: Fixed a flaw in XFRM subsystem that may have allowed a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer leading to a possible kernel crash and denial of service (bsc#1213666).
• CVE-2023-3812: Fixed an out-of-bounds memory access flaw in the TUN/TAP device driver functionality that could allow a local user to crash or potentially escalate their privileges on the system (bsc#1213543).
• CVE-2023-3863: Fixed a use-after-free flaw was found in nfc_llcp_find_local that allowed a local user with special privileges to impact a kernel information leak issue (bsc#1213601).
• CVE-2023-4128: Fixed a use-after-free flaw in net/sched/cls_fw.c that allowed a local attacker to perform a local privilege escalation due to incorrect handling of the existing filter, leading to a kernel information leak issue (bsc#1214149).
• CVE-2023-4132: Fixed use-after-free vulnerability was found in the siano smsusb module that allowed a local user to crash the system, causing a denial of service condition (bsc#1213969).
• CVE-2023-4133: Fixed use after free bugs caused by circular dependency problem in cxgb4 (bsc#1213970).
• CVE-2023-4134: Fixed use-after-free in cyttsp4_watchdog_work() (bsc#1213971).
• CVE-2023-4194: Fixed a type confusion in net tun_chr_open() (bsc#1214019).
• CVE-2023-4385: Fixed a NULL pointer dereference flaw in dbFree that may have allowed a local attacker to crash the system due to a missing sanity check (bsc#1214348).
• CVE-2023-4387: Fixed use-after-free flaw in vmxnet3_rq_alloc_rx_buf that could allow a local attacker to crash the system due to a double-free (bsc#1214350).
• CVE-2023-4459: Fixed a NULL pointer dereference flaw in vmxnet3_rq_cleanup that may have allowed a local attacker with normal user privilege to cause a denial of service (bsc#1214451).
• CVE-2023-20588: Fixed a division-by-zero error on some AMD processors that can potentially return speculative data resulting in loss of confidentiality (bsc#1213927).
• CVE-2023-34319: Fixed buffer overrun triggered by unusual packet in xen/netback (XSA-432) (bsc#1213546).
• CVE-2023-40283: Fixed use-after-free in l2cap_sock_ready_cb (bsc#1214233).

The following non-security bugs were fixed:

• ARM: spear: Do not use timer namespace for timer_shutdown() function (bsc#1213970).
• Bluetooth: nokia: fix value check in nokia_bluetooth_serdev_probe() (git-fixes).
• Revert 'scsi: qla2xxx: Fix buffer overrun' (bsc#1214928).
• SUNRPC: always clear XPRT_SOCK_CONNECTING before xprt_clear_connecting on TCP xprt (bsc#1214453).
• af_key: Fix send_acquire race with pfkey_register (git-fixes).
• af_packet: fix data-race in packet_setsockopt / packet_setsockopt (git-fixes).
• af_unix: Fix a data race of sk->sk_receive_queue->qlen (git-fixes).
• arm64: Re-enable support for contiguous hugepages (git-fixes)
• arm64: vdso: Fix clock_getres() for CLOCK_REALTIME (git-fixes)
• bnx2x: fix page fault following EEH recovery (bsc#1214299).
• bonding: Fix a use-after-free problem when bond_sysfs_slave_add() failed (git-fixes).
• bpf, arm64: remove prefetch insn in xadd mapping (git-fixes)
• bpf, arm64: use more scalable stadd over ldxr / stxr loop in xadd (git-fixes)
• bridge: ebtables: do not crash when using dnat target in output chains (git-fixes).
• btrfs-allow-use-of-global-block-reserve-for-balance-.patch: (bsc#1214335).
• btrfs-unset-reloc-control-if-transaction-commit-fail.patch: (bsc#1212051). -…

The SUSE Linux Enterprise 15 SP4 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-2007: Fixed a flaw in the DPT I2O Controller driver that could allow an attacker to escalate privileges and execute arbitrary code in the context of the kernel (bsc#1210448).
• CVE-2023-20588: Fixed a division-by-zero error on some AMD processors that can potentially return speculative data resulting in loss of confidentiality (bsc#1213927).
• CVE-2023-34319: Fixed buffer overrun triggered by unusual packet in xen/netback (XSA-432) (bsc#1213546).
• CVE-2023-3610: Fixed use-after-free vulnerability in nf_tables can be exploited to achieve local privilege escalation (bsc#1213580).
• CVE-2023-37453: Fixed oversight in SuperSpeed initialization (bsc#1213123).
• CVE-2023-3772: Fixed a flaw in XFRM subsystem that may have allowed a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer leading to a possible kernel crash and denial of service (bsc#1213666).
• CVE-2023-3863: Fixed a use-after-free flaw was found in nfc_llcp_find_local that allowed a local user with special privileges to impact a kernel information leak issue (bsc#1213601).
• CVE-2023-4128: Fixed a use-after-free flaw in net/sched/cls_fw.c that allowed a local attacker to perform a local privilege escalation due to incorrect handling of the existing filter, leading to a kernel information leak issue (bsc#1214149).
• CVE-2023-4133: Fixed use after free bugs caused by circular dependency problem in cxgb4 (bsc#1213970).
• CVE-2023-4134: Fixed use-after-free in cyttsp4_watchdog_work() (bsc#1213971).
• CVE-2023-4147: Fixed use-after-free in nf_tables_newrule (bsc#1213968).
• CVE-2023-4194: Fixed a type confusion in net tun_chr_open() (bsc#1214019).
• CVE-2023-4273: Fixed a flaw in the exFAT driver of the Linux kernel that alloawed a local privileged attacker to overflow the kernel stack (bsc#1214120).
• CVE-2023-4387: Fixed use-after-free flaw in vmxnet3_rq_alloc_rx_buf that could allow a local attacker to crash the system due to a double-free (bsc#1214350).
• CVE-2023-4459: Fixed a NULL pointer dereference flaw in vmxnet3_rq_cleanup that may have allowed a local attacker with normal user privilege to cause a denial of service (bsc#1214451).
• CVE-2023-4569: Fixed information leak in nft_set_catchall_flush in net/netfilter/nf_tables_api.c (bsc#1214729).

The following non-security bugs were fixed:

• acpi: processor: perflib: avoid updating frequency qos unnecessarily (git-fixes).
• acpi: processor: perflib: use the 'no limit' frequency qos (git-fixes).
• acpi: x86: s2idle: fix a logic error parsing amd constraints table (git-fixes).
• alsa: ac97: fix possible error value of *rac97 (git-fixes).
• alsa: hda/cs8409: support new dell dolphin variants (git-fixes).
• alsa: hda/realtek - remodified 3k pull low procedure (git-fixes).
• alsa: hda/realtek: add quirk for hp victus 16-d1xxx to enable mute led (git-fixes).
• alsa: hda/realtek: add quirk for mute leds on hp envy x360 15-eu0xxx (git-fixes).
• alsa: hda/realtek: add quirks for hp g11 laptops (git-fixes).
• alsa: hda/realtek: switch dell oasis models to use spi (git-fixes).
• alsa: pcm: fix missing fixup call in compat hw_refine ioctl (git-fixes).
• alsa: usb-audio: add support for mythware xa001au capture and playback interfaces (git-fixes).
• alsa: usb-audio: fix init call orders for uac1 (git-fixes).
• alsa: ymfpci: fix the missing snd_card_free() call at probe error (git-fixes).
• amba: bus: fix refcount leak (git-fixes).
• arm64: dts: imx8mn-var-som: add missing pull-up for onboard phy reset pinmux (git-fixes).
• arm64: dts: qcom: qrb5165-rb5: fix thermal zone conflict (git-fixes).
• arm64: dts: rockchip: disable hs400 for emmc on rock pi 4 (git-fixes).
• arm: dts: imx6dl: prtrvt, prtvt7, prti6q, prtwd2: fix usb related warnings (git-fixes).
• arm: dts: imx6sll: fixup of operating points (git-fixes).
• arm: spear: do not use timer…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-36402: Fixed an integer overflow vulnerability in vmwgfx driver in that allowed a local attacker with a user account on the system to gain privilege, causing a denial of service (bsc#1203517).
• CVE-2023-2007: Fixed a flaw in the DPT I2O Controller driver that could allow an attacker to escalate privileges and execute arbitrary code in the context of the kernel (bsc#1210448).
• CVE-2023-3772: Fixed a flaw in XFRM subsystem that may have allowed a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer leading to a possible kernel crash and denial of service (bsc#1213666).
• CVE-2023-3863: Fixed a use-after-free flaw was found in nfc_llcp_find_local that allowed a local user with special privileges to impact a kernel information leak issue (bsc#1213601).
• CVE-2023-4128: Fixed a use-after-free flaw in net/sched/cls_fw.c that allowed a local attacker to perform a local privilege escalation due to incorrect handling of the existing filter, leading to a kernel information leak issue (bsc#1214149).
• CVE-2023-4132: Fixed use-after-free vulnerability was found in the siano smsusb module that allowed a local user to crash the system, causing a denial of service condition (bsc#1213969).
• CVE-2023-4133: Fixed use after free bugs caused by circular dependency problem in cxgb4 (bsc#1213970).
• CVE-2023-4134: Fixed use-after-free in cyttsp4_watchdog_work() (bsc#1213971).
• CVE-2023-4147: Fixed use-after-free in nf_tables_newrule (bsc#1213968).
• CVE-2023-4194: Fixed a type confusion in net tun_chr_open() (bsc#1214019).
• CVE-2023-4273: Fixed a flaw in the exFAT driver of the Linux kernel that alloawed a local privileged attacker to overflow the kernel stack (bsc#1214120).
• CVE-2023-4385: Fixed a NULL pointer dereference flaw in dbFree that may have allowed a local attacker to crash the system due to a missing sanity check (bsc#1214348).
• CVE-2023-4387: Fixed use-after-free flaw in vmxnet3_rq_alloc_rx_buf that could allow a local attacker to crash the system due to a double-free (bsc#1214350).
• CVE-2023-4459: Fixed a NULL pointer dereference flaw in vmxnet3_rq_cleanup that may have allowed a local attacker with normal user privilege to cause a denial of service (bsc#1214451).
• CVE-2023-20588: Fixed a division-by-zero error on some AMD processors that can potentially return speculative data resulting in loss of confidentiality (bsc#1213927).
• CVE-2023-21400: Fixed several memory corruptions due to improper locking in io_uring (bsc#1213272).
• CVE-2023-34319: Fixed buffer overrun triggered by unusual packet in xen/netback (XSA-432) (bsc#1213546).

The following non-security bugs were fixed:

• ARM: spear: Do not use timer namespace for timer_shutdown() function (bsc#1213970).
• Do not add and remove genksyms ifdefs
• clocksource/drivers/arm_arch_timer: Do not use timer namespace for timer_shutdown() function (bsc#1213970).
• clocksource/drivers/sp804: Do not use timer namespace for timer_shutdown() function (bsc#1213970).
• e1000: Fix fall-through warnings for Clang (jsc#PED-5738).
• e1000: Fix typos in comments (jsc#PED-5738).
• e1000: Remove unnecessary use of kmap_atomic() (jsc#PED-5738).
• e1000: drop unneeded assignment in e1000_set_itr() (jsc#PED-5738).
• e1000: switch to napi_consume_skb() (jsc#PED-5738).
• intel/e1000:fix repeated words in comments (jsc#PED-5738).
• intel: remove checker warning (jsc#PED-5738).
• kabi/severities: Ignore newly added SRSO mitigation functions
• md/raid0: Factor out helper for mapping and submitting a bio (bsc#1213916).
• md/raid0: Fix performance regression for large sequential writes (bsc#1213916).
• net: e1000: remove repeated word 'slot' for e1000_main.c (jsc#PED-5738).
• net: e1000: remove repeated words for e1000_hw.c (jsc#PED-5738).
• powerpc/rtas: block error injection when locked down (bsc#1023051). -…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-36402: Fixed an integer overflow vulnerability in vmwgfx driver in that allowed a local attacker with a user account on the system to gain privilege, causing a denial of service (bsc#1203517).
• CVE-2023-2007: Fixed a flaw in the DPT I2O Controller driver that could allow an attacker to escalate privileges and execute arbitrary code in the context of the kernel (bsc#1210448).
• CVE-2023-20588: Fixed a division-by-zero error on some AMD processors that can potentially return speculative data resulting in loss of confidentiality (bsc#1213927).
• CVE-2023-34319: Fixed buffer overrun triggered by unusual packet in xen/netback (XSA-432) (bsc#1213546).
• CVE-2023-3772: Fixed a flaw in XFRM subsystem that may have allowed a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer leading to a possible kernel crash and denial of service (bsc#1213666).
• CVE-2023-3812: Fixed an out-of-bounds memory access flaw in the TUN/TAP device driver functionality that could allow a local user to crash or potentially escalate their privileges on the system (bsc#1213543).
• CVE-2023-3863: Fixed a use-after-free flaw was found in nfc_llcp_find_local that allowed a local user with special privileges to impact a kernel information leak issue (bsc#1213601).
• CVE-2023-40283: Fixed use-after-free in l2cap_sock_ready_cb (bsc#1214233).
• CVE-2023-4128: Fixed a use-after-free flaw in net/sched/cls_fw.c that allowed a local attacker to perform a local privilege escalation due to incorrect handling of the existing filter, leading to a kernel information leak issue (bsc#1214149).
• CVE-2023-4132: Fixed use-after-free vulnerability was found in the siano smsusb module that allowed a local user to crash the system, causing a denial of service condition (bsc#1213969).
• CVE-2023-4133: Fixed use after free bugs caused by circular dependency problem in cxgb4 (bsc#1213970).
• CVE-2023-4134: Fixed use-after-free in cyttsp4_watchdog_work() (bsc#1213971).
• CVE-2023-4194: Fixed a type confusion in net tun_chr_open() (bsc#1214019).
• CVE-2023-4385: Fixed a NULL pointer dereference flaw in dbFree that may have allowed a local attacker to crash the system due to a missing sanity check (bsc#1214348).
• CVE-2023-4387: Fixed use-after-free flaw in vmxnet3_rq_alloc_rx_buf that could allow a local attacker to crash the system due to a double-free (bsc#1214350).
• CVE-2023-4459: Fixed a NULL pointer dereference flaw in vmxnet3_rq_cleanup that may have allowed a local attacker with normal user privilege to cause a denial of service (bsc#1214451).

The following non-security bugs were fixed:

• af_key: fix send_acquire race with pfkey_register (git-fixes).
• af_packet: fix data-race in packet_setsockopt / packet_setsockopt (git-fixes).
• af_unix: fix a data race of sk->sk_receive_queue->qlen (git-fixes).
• arm64: re-enable support for contiguous hugepages (git-fixes)
• arm64: vdso: fix clock_getres() for clock_realtime (git-fixes)
• arm: spear: do not use timer namespace for timer_shutdown() function (bsc#1213970).
• bluetooth: nokia: fix value check in nokia_bluetooth_serdev_probe() (git-fixes).
• bnx2x: fix page fault following eeh recovery (bsc#1214299).
• bonding: fix a use-after-free problem when bond_sysfs_slave_add() failed (git-fixes).
• bpf, arm64: remove prefetch insn in xadd mapping (git-fixes)
• bpf, arm64: use more scalable stadd over ldxr / stxr loop in xadd (git-fixes)
• bridge: ebtables: do not crash when using dnat target in output chains (git-fixes).
• btrfs-allow-use-of-global-block-reserve-for-balance (bsc#1214335).
• btrfs-unset-reloc-control-if-transaction-commit-fail (bsc#1212051).
• clocksource/drivers/arm_arch_timer: do not use timer namespace for timer_shutdown() function (bsc#1213970).
• clocksource/drivers/sp804: do not use timer namespace for timer_shutdown() function…

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-36402: Fixed an integer overflow vulnerability in vmwgfx driver in that allowed a local attacker with a user account on the system to gain privilege, causing a denial of service (bsc#1203517).
• CVE-2023-2007: Fixed a flaw in the DPT I2O Controller driver that could allow an attacker to escalate privileges and execute arbitrary code in the context of the kernel (bsc#1210448).
• CVE-2023-3772: Fixed a flaw in XFRM subsystem that may have allowed a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer leading to a possible kernel crash and denial of service (bsc#1213666).
• CVE-2023-3863: Fixed a use-after-free flaw was found in nfc_llcp_find_local that allowed a local user with special privileges to impact a kernel information leak issue (bsc#1213601).
• CVE-2023-4128: Fixed a use-after-free flaw in net/sched/cls_fw.c that allowed a local attacker to perform a local privilege escalation due to incorrect handling of the existing filter, leading to a kernel information leak issue (bsc#1214149).
• CVE-2023-4132: Fixed use-after-free vulnerability was found in the siano smsusb module that allowed a local user to crash the system, causing a denial of service condition (bsc#1213969).
• CVE-2023-4133: Fixed use after free bugs caused by circular dependency problem in cxgb4 (bsc#1213970).
• CVE-2023-4134: Fixed use-after-free in cyttsp4_watchdog_work() (bsc#1213971).
• CVE-2023-4147: Fixed use-after-free in nf_tables_newrule (bsc#1213968).
• CVE-2023-4194: Fixed a type confusion in net tun_chr_open() (bsc#1214019).
• CVE-2023-4273: Fixed a flaw in the exFAT driver of the Linux kernel that alloawed a local privileged attacker to overflow the kernel stack (bsc#1214120).
• CVE-2023-4385: Fixed a NULL pointer dereference flaw in dbFree that may have allowed a local attacker to crash the system due to a missing sanity check (bsc#1214348).
• CVE-2023-4387: Fixed use-after-free flaw in vmxnet3_rq_alloc_rx_buf that could allow a local attacker to crash the system due to a double-free (bsc#1214350).
• CVE-2023-4459: Fixed a NULL pointer dereference flaw in vmxnet3_rq_cleanup that may have allowed a local attacker with normal user privilege to cause a denial of service (bsc#1214451).
• CVE-2023-20588: Fixed a division-by-zero error on some AMD processors that can potentially return speculative data resulting in loss of confidentiality (bsc#1213927).
• CVE-2023-21400: Fixed several memory corruptions due to improper locking in io_uring (bsc#1213272).
• CVE-2023-34319: Fixed buffer overrun triggered by unusual packet in xen/netback (XSA-432) (bsc#1213546).

The following non-security bugs were fixed:

• ARM: spear: Do not use timer namespace for timer_shutdown() function (bsc#1213970).
• Do not add and remove genksyms ifdefs
• clocksource/drivers/arm_arch_timer: Do not use timer namespace for timer_shutdown() function (bsc#1213970).
• clocksource/drivers/sp804: Do not use timer namespace for timer_shutdown() function (bsc#1213970).
• e1000: Fix fall-through warnings for Clang (jsc#PED-5738).
• e1000: Fix typos in comments (jsc#PED-5738).
• e1000: Remove unnecessary use of kmap_atomic() (jsc#PED-5738).
• e1000: drop unneeded assignment in e1000_set_itr() (jsc#PED-5738).
• e1000: switch to napi_consume_skb() (jsc#PED-5738).
• intel/e1000:fix repeated words in comments (jsc#PED-5738).
• intel: remove checker warning (jsc#PED-5738).
• kabi/severities: Ignore newly added SRSO mitigation functions
• md/raid0: Factor out helper for mapping and submitting a bio (bsc#1213916).
• md/raid0: Fix performance regression for large sequential writes (bsc#1213916).
• net: e1000: remove repeated word 'slot' for e1000_main.c (jsc#PED-5738).
• net: e1000: remove repeated words for e1000_hw.c (jsc#PED-5738).
• powerpc/rtas: block error injection when locked down (bsc#1023051). -…

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-2007: Fixed a flaw in the DPT I2O Controller driver that could allow an attacker to escalate privileges and execute arbitrary code in the context of the kernel (bsc#1210448).
• CVE-2023-20588: Fixed a division-by-zero error on some AMD processors that can potentially return speculative data resulting in loss of confidentiality (bsc#1213927).
• CVE-2023-34319: Fixed buffer overrun triggered by unusual packet in xen/netback (XSA-432) (bsc#1213546).
• CVE-2023-3610: Fixed use-after-free vulnerability in nf_tables can be exploited to achieve local privilege escalation (bsc#1213580).
• CVE-2023-37453: Fixed oversight in SuperSpeed initialization (bsc#1213123).
• CVE-2023-3772: Fixed a flaw in XFRM subsystem that may have allowed a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer leading to a possible kernel crash and denial of service (bsc#1213666).
• CVE-2023-3863: Fixed a use-after-free flaw was found in nfc_llcp_find_local that allowed a local user with special privileges to impact a kernel information leak issue (bsc#1213601).
• CVE-2023-4128: Fixed a use-after-free flaw in net/sched/cls_fw.c that allowed a local attacker to perform a local privilege escalation due to incorrect handling of the existing filter, leading to a kernel information leak issue (bsc#1214149).
• CVE-2023-4133: Fixed use after free bugs caused by circular dependency problem in cxgb4 (bsc#1213970).
• CVE-2023-4134: Fixed use-after-free in cyttsp4_watchdog_work() (bsc#1213971).
• CVE-2023-4147: Fixed use-after-free in nf_tables_newrule (bsc#1213968).
• CVE-2023-4194: Fixed a type confusion in net tun_chr_open() (bsc#1214019).
• CVE-2023-4273: Fixed a flaw in the exFAT driver of the Linux kernel that alloawed a local privileged attacker to overflow the kernel stack (bsc#1214120).
• CVE-2023-4387: Fixed use-after-free flaw in vmxnet3_rq_alloc_rx_buf that could allow a local attacker to crash the system due to a double-free (bsc#1214350).
• CVE-2023-4459: Fixed a NULL pointer dereference flaw in vmxnet3_rq_cleanup that may have allowed a local attacker with normal user privilege to cause a denial of service (bsc#1214451).
• CVE-2023-4569: Fixed information leak in nft_set_catchall_flush in net/netfilter/nf_tables_api.c (bsc#1214729).

The following non-security bugs were fixed:

• Drop amdgpu patch causing spamming (bsc#1215523)
• acpi: processor: perflib: avoid updating frequency qos unnecessarily (git-fixes).
• acpi: processor: perflib: use the 'no limit' frequency qos (git-fixes).
• acpi: x86: s2idle: fix a logic error parsing amd constraints table (git-fixes).
• alsa: ac97: fix possible error value of *rac97 (git-fixes).
• alsa: hda/cs8409: support new dell dolphin variants (git-fixes).
• alsa: hda/realtek - remodified 3k pull low procedure (git-fixes).
• alsa: hda/realtek: add quirk for hp victus 16-d1xxx to enable mute led (git-fixes).
• alsa: hda/realtek: add quirk for mute leds on hp envy x360 15-eu0xxx (git-fixes).
• alsa: hda/realtek: add quirks for hp g11 laptops (git-fixes).
• alsa: hda/realtek: switch dell oasis models to use spi (git-fixes).
• alsa: pcm: fix missing fixup call in compat hw_refine ioctl (git-fixes).
• alsa: usb-audio: add support for mythware xa001au capture and playback interfaces (git-fixes).
• alsa: usb-audio: fix init call orders for uac1 (git-fixes).
• alsa: ymfpci: fix the missing snd_card_free() call at probe error (git-fixes).
• amba: bus: fix refcount leak (git-fixes).
• arm64: dts: imx8mn-var-som: add missing pull-up for onboard phy reset pinmux (git-fixes).
• arm64: dts: qcom: qrb5165-rb5: fix thermal zone conflict (git-fixes).
• arm64: dts: rockchip: disable hs400 for emmc on rock pi 4 (git-fixes).
• arm: dts: imx6dl: prtrvt, prtvt7, prti6q, prtwd2: fix usb related warnings (git-fixes).
• arm: dts: imx6sll: fixup of operating points…

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-2007: Fixed a flaw in the DPT I2O Controller driver that could allow an attacker to escalate privileges and execute arbitrary code in the context of the kernel (bsc#1210448).
• CVE-2023-20588: Fixed a division-by-zero error on some AMD processors that can potentially return speculative data resulting in loss of confidentiality (bsc#1213927).
• CVE-2023-34319: Fixed buffer overrun triggered by unusual packet in xen/netback (XSA-432) (bsc#1213546).
• CVE-2023-3610: Fixed use-after-free vulnerability in nf_tables can be exploited to achieve local privilege escalation (bsc#1213580).
• CVE-2023-37453: Fixed oversight in SuperSpeed initialization (bsc#1213123).
• CVE-2023-3772: Fixed a flaw in XFRM subsystem that may have allowed a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer leading to a possible kernel crash and denial of service (bsc#1213666).
• CVE-2023-3863: Fixed a use-after-free flaw was found in nfc_llcp_find_local that allowed a local user with special privileges to impact a kernel information leak issue (bsc#1213601).
• CVE-2023-4128: Fixed a use-after-free flaw in net/sched/cls_fw.c that allowed a local attacker to perform a local privilege escalation due to incorrect handling of the existing filter, leading to a kernel information leak issue (bsc#1214149).
• CVE-2023-4133: Fixed use after free bugs caused by circular dependency problem in cxgb4 (bsc#1213970).
• CVE-2023-4134: Fixed use-after-free in cyttsp4_watchdog_work() (bsc#1213971).
• CVE-2023-4147: Fixed use-after-free in nf_tables_newrule (bsc#1213968).
• CVE-2023-4194: Fixed a type confusion in net tun_chr_open() (bsc#1214019).
• CVE-2023-4273: Fixed a flaw in the exFAT driver of the Linux kernel that alloawed a local privileged attacker to overflow the kernel stack (bsc#1214120).
• CVE-2023-4387: Fixed use-after-free flaw in vmxnet3_rq_alloc_rx_buf that could allow a local attacker to crash the system due to a double-free (bsc#1214350).
• CVE-2023-4459: Fixed a NULL pointer dereference flaw in vmxnet3_rq_cleanup that may have allowed a local attacker with normal user privilege to cause a denial of service (bsc#1214451).
• CVE-2023-4569: Fixed information leak in nft_set_catchall_flush in net/netfilter/nf_tables_api.c (bsc#1214729).

The following non-security bugs were fixed:

• Drop amdgpu patch causing spamming (bsc#1215523)
• acpi: processor: perflib: avoid updating frequency qos unnecessarily (git-fixes).
• acpi: processor: perflib: use the 'no limit' frequency qos (git-fixes).
• acpi: x86: s2idle: fix a logic error parsing amd constraints table (git-fixes).
• alsa: ac97: fix possible error value of *rac97 (git-fixes).
• alsa: hda/cs8409: support new dell dolphin variants (git-fixes).
• alsa: hda/realtek - remodified 3k pull low procedure (git-fixes).
• alsa: hda/realtek: add quirk for hp victus 16-d1xxx to enable mute led (git-fixes).
• alsa: hda/realtek: add quirk for mute leds on hp envy x360 15-eu0xxx (git-fixes).
• alsa: hda/realtek: add quirks for hp g11 laptops (git-fixes).
• alsa: hda/realtek: switch dell oasis models to use spi (git-fixes).
• alsa: pcm: fix missing fixup call in compat hw_refine ioctl (git-fixes).
• alsa: usb-audio: add support for mythware xa001au capture and playback interfaces (git-fixes).
• alsa: usb-audio: fix init call orders for uac1 (git-fixes).
• alsa: ymfpci: fix the missing snd_card_free() call at probe error (git-fixes).
• amba: bus: fix refcount leak (git-fixes).
• arm64: dts: imx8mn-var-som: add missing pull-up for onboard phy reset pinmux (git-fixes).
• arm64: dts: qcom: qrb5165-rb5: fix thermal zone conflict (git-fixes).
• arm64: dts: rockchip: disable hs400 for emmc on rock pi 4 (git-fixes).
• arm: dts: imx6dl: prtrvt, prtvt7, prti6q, prtwd2: fix usb related warnings (git-fixes).
• arm: dts: imx6sll: fixup of operating points…

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-38457: Fixed a use-after-free vulnerability in vmwgfx driver that allowed a local attacker to cause a denial of service (bsc#1203330).
• CVE-2022-40133: Fixed a use-after-free vulnerability in vmwgfx driver that allowed a local attacker to cause a denial of service (bsc#1203329).
• CVE-2023-2007: Fixed a flaw in the DPT I2O Controller driver that could allow an attacker to escalate privileges and execute arbitrary code in the context of the kernel (bsc#1210448).
• CVE-2023-20588: Fixed a division-by-zero error on some AMD processors that can potentially return speculative data resulting in loss of confidentiality (bsc#1213927).
• CVE-2023-34319: Fixed buffer overrun triggered by unusual packet in xen/netback (XSA-432) (bsc#1213546).
• CVE-2023-3610: Fixed use-after-free vulnerability in nf_tables can be exploited to achieve local privilege escalation (bsc#1213580).
• CVE-2023-37453: Fixed oversight in SuperSpeed initialization (bsc#1213123).
• CVE-2023-3772: Fixed a flaw in XFRM subsystem that may have allowed a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer leading to a possible kernel crash and denial of service (bsc#1213666).
• CVE-2023-3863: Fixed a use-after-free flaw was found in nfc_llcp_find_local that allowed a local user with special privileges to impact a kernel information leak issue (bsc#1213601).
• CVE-2023-40283: Fixed use-after-free in l2cap_sock_ready_cb (bsc#1214233).
• CVE-2023-4128: Fixed a use-after-free flaw in net/sched/cls_fw.c that allowed a local attacker to perform a local privilege escalation due to incorrect handling of the existing filter, leading to a kernel information leak issue (bsc#1214149).
• CVE-2023-4133: Fixed use after free bugs caused by circular dependency problem in cxgb4 (bsc#1213970).
• CVE-2023-4134: Fixed use-after-free in cyttsp4_watchdog_work() (bsc#1213971).
• CVE-2023-4147: Fixed use-after-free in nf_tables_newrule (bsc#1213968).
• CVE-2023-4194: Fixed a type confusion in net tun_chr_open() (bsc#1214019).
• CVE-2023-4273: Fixed a flaw in the exFAT driver of the Linux kernel that alloawed a local privileged attacker to overflow the kernel stack (bsc#1214120).
• CVE-2023-4387: Fixed use-after-free flaw in vmxnet3_rq_alloc_rx_buf that could allow a local attacker to crash the system due to a double-free (bsc#1214350).
• CVE-2023-4459: Fixed a NULL pointer dereference flaw in vmxnet3_rq_cleanup that may have allowed a local attacker with normal user privilege to cause a denial of service (bsc#1214451).
• CVE-2023-4563: Fixed use-after-free in nft_verdict_dump due to a race between set GC and transaction (bsc#1214727).
• CVE-2023-4569: Fixed information leak in nft_set_catchall_flush in net/netfilter/nf_tables_api.c (bsc#1214729).

The following non-security bugs were fixed:

• ACPI/IORT: Update SMMUv3 DeviceID support (bsc#1214305).
• ACPI: processor: perflib: Avoid updating frequency QoS unnecessarily (git-fixes).
• ACPI: processor: perflib: Use the 'no limit' frequency QoS (git-fixes).
• ACPI: x86: s2idle: Fix a logic error parsing AMD constraints table (git-fixes).
• ALSA: ac97: Fix possible error value of *rac97 (git-fixes).
• ALSA: hda/cs8409: Support new Dell Dolphin Variants (git-fixes).
• ALSA: hda/realtek - Remodified 3k pull low procedure (git-fixes).
• ALSA: hda/realtek: Add quirk for HP Victus 16-d1xxx to enable mute LED (git-fixes).
• ALSA: hda/realtek: Add quirk for mute LEDs on HP ENVY x360 15-eu0xxx (git-fixes).
• ALSA: hda/realtek: Add quirks for HP G11 Laptops (git-fixes).
• ALSA: hda/realtek: Switch Dell Oasis models to use SPI (git-fixes).
• ALSA: pcm: Fix missing fixup call in compat hw_refine ioctl (git-fixes).
• ALSA: usb-audio: Add support for Mythware XA001AU capture and playback interfaces (git-fixes).
• ALSA: usb-audio: Fix init call orders for UAC1 (git-fixes).
• ALSA:…

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-38457: Fixed a use-after-free vulnerability in vmwgfx driver that allowed a local attacker to cause a denial of service (bsc#1203330).
• CVE-2022-40133: Fixed a use-after-free vulnerability in vmwgfx driver that allowed a local attacker to cause a denial of service (bsc#1203329).
• CVE-2023-1192: Fixed use-after-free in cifs_demultiplex_thread() (bsc#1208995 CVE-2023-1192).
• CVE-2023-1859: Fixed a use-after-free flaw in xen_9pfs_front_removet that could lead to system crash and kernel information leak (bsc#1210169).
• CVE-2023-2007: Fixed a flaw in the DPT I2O Controller driver that could allow an attacker to escalate privileges and execute arbitrary code in the context of the kernel (bsc#1210448).
• CVE-2023-20588: Fixed a division-by-zero error on some AMD processors that can potentially return speculative data resulting in loss of confidentiality (bsc#1213927).
• CVE-2023-2177: Fixed null pointer dereference issue in the sctp network protocol that could lead to system crash or DoS (bsc#1210643).
• CVE-2023-34319: Fixed buffer overrun triggered by unusual packet in xen/netback (XSA-432) (bsc#1213546).
• CVE-2023-3610: Fixed use-after-free vulnerability in nf_tables can be exploited to achieve local privilege escalation (bsc#1213580).
• CVE-2023-37453: Fixed oversight in SuperSpeed initialization (bsc#1213123).
• CVE-2023-3772: Fixed a flaw in XFRM subsystem that may have allowed a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer leading to a possible kernel crash and denial of service (bsc#1213666).
• CVE-2023-3863: Fixed a use-after-free flaw was found in nfc_llcp_find_local that allowed a local user with special privileges to impact a kernel information leak issue (bsc#1213601).
• CVE-2023-40283: Fixed use-after-free in l2cap_sock_ready_cb (bsc#1214233).
• CVE-2023-4128: Fixed a use-after-free flaw in net/sched/cls_fw.c that allowed a local attacker to perform a local privilege escalation due to incorrect handling of the existing filter, leading to a kernel information leak issue (bsc#1214149).
• CVE-2023-4133: Fixed use after free bugs caused by circular dependency problem in cxgb4 (bsc#1213970).
• CVE-2023-4134: Fixed use-after-free in cyttsp4_watchdog_work() (bsc#1213971).
• CVE-2023-4147: Fixed use-after-free in nf_tables_newrule (bsc#1213968).
• CVE-2023-4194: Fixed a type confusion in net tun_chr_open() (bsc#1214019).
• CVE-2023-4273: Fixed a flaw in the exFAT driver of the Linux kernel that alloawed a local privileged attacker to overflow the kernel stack (bsc#1214120).
• CVE-2023-4387: Fixed use-after-free flaw in vmxnet3_rq_alloc_rx_buf that could allow a local attacker to crash the system due to a double-free (bsc#1214350).
• CVE-2023-4459: Fixed a NULL pointer dereference flaw in vmxnet3_rq_cleanup that may have allowed a local attacker with normal user privilege to cause a denial of service (bsc#1214451).
• CVE-2023-4563: Fixed use-after-free in nft_verdict_dump due to a race between set GC and transaction (bsc#1214727).
• CVE-2023-4569: Fixed information leak in nft_set_catchall_flush in net/netfilter/nf_tables_api.c (bsc#1214729).
• CVE-2023-4881: Fixed a out-of-bounds write flaw in the netfilter subsystem that could lead to potential information disclosure or a denial of service (bsc#1215221).

The following non-security bugs were fixed:

• ACPI/IORT: Update SMMUv3 DeviceID support (bsc#1214305).
• ACPI: processor: perflib: Avoid updating frequency QoS unnecessarily (git-fixes).
• ACPI: processor: perflib: Use the 'no limit' frequency QoS (git-fixes).
• ACPI: x86: s2idle: Fix a logic error parsing AMD constraints table (git-fixes).
• ALSA: ac97: Fix possible error value of *rac97 (git-fixes).
• ALSA: hda/cirrus: Fix broken audio on hardware with two CS42L42 codecs (git-fixes).
• ALSA: hda/cs8409: Support new Dell Dolphin…

It was discovered that the IPv6 implementation in the Linux kernel contained a high rate of hash collisions in connection lookup table. A remote attacker could use this to cause a denial of service (excessive CPU consumption). (CVE-2023-1206)

Ross Lagerwall discovered that the Xen netback backend driver in the Linux kernel did not properly handle certain unusual packets from a paravirtualized network frontend, leading to a buffer overflow. An attacker in a guest VM could use this to cause a denial of service (host system crash) or possibly execute arbitrary code. (CVE-2023-34319)

It was discovered that the bluetooth subsystem in the Linux kernel did not properly handle L2CAP socket release, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-40283)

It was discovered that some network classifier implementations in the Linux kernel contained use-after-free vulnerabilities. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-4128)

Andy Nguyen discovered that the KVM implementation for AMD processors in the Linux kernel with Secure Encrypted Virtualization (SEV) contained a race condition when accessing the GHCB page. A local attacker in a SEV guest VM could possibly use this to cause a denial of service (host system crash). (CVE-2023-4155)

It was discovered that the TUN/TAP driver in the Linux kernel did not properly initialize socket data. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-4194)

Maxim Suhanov discovered that the exFAT file system implementation in the Linux kernel did not properly check a file name length, leading to an out- of-bounds write vulnerability. An attacker could use this to construct a malicious exFAT image that, when mounted and operated on, could cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-4273)

It was discovered that some AMD x86-64 processors with SMT enabled could speculatively execute instructions using a return address from a sibling thread. A local attacker could possibly use this to expose sensitive information. (CVE-2022-27672)

William Zhao discovered that the Traffic Control (TC) subsystem in the Linux kernel did not properly handle network packet retransmission in certain situations. A local attacker could use this to cause a denial of service (kernel deadlock). (CVE-2022-4269)

Jordy Zomer and Alexandra Sandulescu discovered that syscalls invoking the do_prlimit() function in the Linux kernel did not properly handle speculative execution barriers. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2023-0458)

It was discovered that the TLS subsystem in the Linux kernel contained a type confusion vulnerability in some situations. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-1075)

It was discovered that the TUN/TAP driver in the Linux kernel did not properly initialize socket data. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-1076, CVE-2023-4194)

It was discovered that the IPv6 implementation in the Linux kernel contained a high rate of hash collisions in connection lookup table. A remote attacker could use this to cause a denial of service (excessive CPU consumption). (CVE-2023-1206)

It was discovered that the Broadcom FullMAC USB WiFi driver in the Linux kernel did not properly perform data buffer size validation in some situations. A physically proximate attacker could use this to craft a malicious USB device that when inserted, could cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-1380)

It was discovered that a race condition existed in the btrfs file system implementation in the Linux kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-1611)

Ruihan Li discovered that the bluetooth subsystem in the Linux kernel did not properly perform permissions checks when handling HCI sockets. A physically proximate attacker could use this to cause a denial of service (bluetooth communication). (CVE-2023-2002)

Tavis Ormandy discovered that some AMD processors did not properly handle speculative execution of certain vector register instructions. A local attacker could use this to expose sensitive information. (CVE-2023-20593)

It was discovered that a use-after-free vulnerability existed in the iSCSI TCP implementation in the Linux kernel. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2023-2162)

Juan Jose Lopez Jaimez, Meador Inge, Simon Scannell, and Nenad Stojanovski discovered that the BPF verifier in the Linux kernel did not properly mark registers for precision tracking in certain situations, leading to an out- of-bounds access vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-2163)

It was discovered that the perf subsystem in the Linux kernel contained a use-after-free vulnerability. A privileged local attacker could possibly use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-2235)

Zheng Zhang discovered that the device-mapper implementation in the Linux kernel did not properly handle locking during table_clear() operations. A local attacker could use this to cause a denial of service (kernel deadlock). (CVE-2023-2269)

Wei Chen discovered that the DVB USB AZ6027 driver in the Linux kernel contained a null pointer dereference when handling certain messages from user space. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-28328)

It was discovered that a race…

Hyunwoo Kim discovered that the DVB Core driver in the Linux kernel contained a race condition during device removal, leading to a use-after- free vulnerability. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-45886, CVE-2022-45919)

Hyunwoo Kim discovered that the Technotrend/Hauppauge USB DEC driver in the Linux kernel did not properly handle device removal events. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2022-45887)

It was discovered that the NTFS file system implementation in the Linux kernel did not properly validate MFT flags in certain situations. An attacker could use this to construct a malicious NTFS image that, when mounted and operated on, could cause a denial of service (system crash). (CVE-2022-48425)

It was discovered that the IPv6 implementation in the Linux kernel contained a high rate of hash collisions in connection lookup table. A remote attacker could use this to cause a denial of service (excessive CPU consumption). (CVE-2023-1206)

Daniel Trujillo, Johannes Wikner, and Kaveh Razavi discovered that some AMD processors utilising speculative execution and branch prediction may allow unauthorised memory reads via a speculative side-channel attack. A local attacker could use this to expose sensitive information, including kernel memory. (CVE-2023-20569)

It was discovered that the IPv6 RPL protocol implementation in the Linux kernel did not properly handle user-supplied data. A remote attacker could use this to cause a denial of service (system crash). (CVE-2023-2156)

Yang Lan discovered that the GFS2 file system implementation in the Linux kernel could attempt to dereference a null pointer in some situations. An attacker could use this to construct a malicious GFS2 image that, when mounted and operated on, could cause a denial of service (system crash). (CVE-2023-3212)

It was discovered that the KSMBD implementation in the Linux kernel did not properly validate buffer sizes in certain operations, leading to an integer underflow and out-of-bounds read vulnerability. A remote attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-38427)

Chih-Yen Chang discovered that the KSMBD implementation in the Linux kernel did not properly validate packet header sizes in certain situations, leading to an out-of-bounds read vulnerability. A remote attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-38431)

Andy Nguyen discovered that the KVM implementation for AMD processors in the Linux kernel with Secure Encrypted Virtualization (SEV) contained a race condition when accessing the GHCB page. A local attacker in a SEV guest VM could possibly use this to cause a denial of service (host system crash). (CVE-2023-4155)

It was discovered that the TUN/TAP driver in the Linux kernel did not properly initialize socket data. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-4194)

Maxim Suhanov discovered that the exFAT file system implementation in the Linux kernel did not properly check a file name length, leading to an out- of-bounds write vulnerability. An attacker could use this to construct a malicious exFAT image that, when mounted and operated on, could cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-4273)

It was discovered that the IPv6 implementation in the Linux kernel contained a high rate of hash collisions in connection lookup table. A remote attacker could use this to cause a denial of service (excessive CPU consumption). (CVE-2023-1206)

Daniel Trujillo, Johannes Wikner, and Kaveh Razavi discovered that some AMD processors utilising speculative execution and branch prediction may allow unauthorised memory reads via a speculative side-channel attack. A local attacker could use this to expose sensitive information, including kernel memory. (CVE-2023-20569)

It was discovered that the IPv6 RPL protocol implementation in the Linux kernel did not properly handle user-supplied data. A remote attacker could use this to cause a denial of service (system crash). (CVE-2023-2156)

Davide Ornaghi discovered that the DECnet network protocol implementation in the Linux kernel contained a null pointer dereference vulnerability. A remote attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. Please note that kernel support for the DECnet has been removed to resolve this CVE. (CVE-2023-3338)

Chih-Yen Chang discovered that the KSMBD implementation in the Linux kernel did not properly validate command payload size, leading to a out-of-bounds read vulnerability. A remote attacker could possibly use this to cause a denial of service (system crash). (CVE-2023-38432)

It was discovered that the NFC implementation in the Linux kernel contained a use-after-free vulnerability when performing peer-to-peer communication in certain conditions. A privileged attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information (kernel memory). (CVE-2023-3863)

Laurence Wit discovered that the KSMBD implementation in the Linux kernel did not properly validate a buffer size in certain situations, leading to an out-of-bounds read vulnerability. A remote attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-3865)

Laurence Wit discovered that the KSMBD implementation in the Linux kernel contained a null pointer dereference vulnerability when handling handling chained requests. A remote attacker could use this to cause a denial of service (system crash). (CVE-2023-3866)

It was discovered that the Siano USB MDTV receiver device driver in the Linux kernel did not properly handle device initialization failures in certain situations, leading to a use-after-free vulnerability. A physically proximate attacker could use this cause a denial of service (system crash). (CVE-2023-4132)

Andy Nguyen discovered that the KVM implementation for AMD processors in the Linux kernel with Secure Encrypted Virtualization (SEV) contained a race condition when accessing the GHCB page. A local attacker in a SEV guest VM could possibly use this to cause a denial of service (host system crash). (CVE-2023-4155)

It was discovered that the TUN/TAP driver in the Linux kernel did not properly initialize socket data. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-4194)

Maxim Suhanov discovered that the exFAT file system implementation in the Linux kernel did not properly check a file name length, leading to an out- of-bounds write vulnerability. An attacker could use this to construct a malicious exFAT image that, when mounted and operated on, could cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-4273)

Thelford Williams discovered that the Ceph file system messenger protocol implementation in the Linux kernel did not properly validate frame segment length in certain situation, leading to a buffer overflow vulnerability. A remote attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-44466)

It was discovered that the IPv6 implementation in the Linux kernel contained a high rate of hash collisions in connection lookup table. A remote attacker could use this to cause a denial of service (excessive CPU consumption). (CVE-2023-1206)

Daniël Trujillo, Johannes Wikner, and Kaveh Razavi discovered that some AMD processors utilising speculative execution and branch prediction may allow unauthorised memory reads via a speculative side-channel attack. A local attacker could use this to expose sensitive information, including kernel memory. (CVE-2023-20569)

It was discovered that the IPv6 RPL protocol implementation in the Linux kernel did not properly handle user-supplied data. A remote attacker could use this to cause a denial of service (system crash). (CVE-2023-2156)

Davide Ornaghi discovered that the DECnet network protocol implementation in the Linux kernel contained a null pointer dereference vulnerability. A remote attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. Please note that kernel support for the DECnet has been removed to resolve this CVE. (CVE-2023-3338)

Chih-Yen Chang discovered that the KSMBD implementation in the Linux kernel did not properly validate command payload size, leading to a out-of-bounds read vulnerability. A remote attacker could possibly use this to cause a denial of service (system crash). (CVE-2023-38432)

It was discovered that the NFC implementation in the Linux kernel contained a use-after-free vulnerability when performing peer-to-peer communication in certain conditions. A privileged attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information (kernel memory). (CVE-2023-3863)

Laurence Wit discovered that the KSMBD implementation in the Linux kernel did not properly validate a buffer size in certain situations, leading to an out-of-bounds read vulnerability. A remote attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-3865)

Laurence Wit discovered that the KSMBD implementation in the Linux kernel contained a null pointer dereference vulnerability when handling handling chained requests. A remote attacker could use this to cause a denial of service (system crash). (CVE-2023-3866)

It was discovered that the Siano USB MDTV receiver device driver in the Linux kernel did not properly handle device initialization failures in certain situations, leading to a use-after-free vulnerability. A physically proximate attacker could use this cause a denial of service (system crash). (CVE-2023-4132)

Andy Nguyen discovered that the KVM implementation for AMD processors in the Linux kernel with Secure Encrypted Virtualization (SEV) contained a race condition when accessing the GHCB page. A local attacker in a SEV guest VM could possibly use this to cause a denial of service (host system crash). (CVE-2023-4155)

It was discovered that the TUN/TAP driver in the Linux kernel did not properly initialize socket data. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-4194)

Maxim Suhanov discovered that the exFAT file system implementation in the Linux kernel did not properly check a file name length, leading to an out- of-bounds write vulnerability. An attacker could use this to construct a malicious exFAT image that, when mounted and operated on, could cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-4273)

Thelford Williams discovered that the Ceph file system messenger protocol implementation in the Linux kernel did not properly validate frame segment length in certain situation, leading to a buffer overflow vulnerability. A remote attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-44466)

It was discovered that the IPv6 implementation in the Linux kernel contained a high rate of hash collisions in connection lookup table. A remote attacker could use this to cause a denial of service (excessive CPU consumption). (CVE-2023-1206)

Daniel Trujillo, Johannes Wikner, and Kaveh Razavi discovered that some AMD processors utilising speculative execution and branch prediction may allow unauthorised memory reads via a speculative side-channel attack. A local attacker could use this to expose sensitive information, including kernel memory. (CVE-2023-20569)

It was discovered that the IPv6 RPL protocol implementation in the Linux kernel did not properly handle user-supplied data. A remote attacker could use this to cause a denial of service (system crash). (CVE-2023-2156)

Davide Ornaghi discovered that the DECnet network protocol implementation in the Linux kernel contained a null pointer dereference vulnerability. A remote attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. Please note that kernel support for the DECnet has been removed to resolve this CVE. (CVE-2023-3338)

Chih-Yen Chang discovered that the KSMBD implementation in the Linux kernel did not properly validate command payload size, leading to a out-of-bounds read vulnerability. A remote attacker could possibly use this to cause a denial of service (system crash). (CVE-2023-38432)

It was discovered that the NFC implementation in the Linux kernel contained a use-after-free vulnerability when performing peer-to-peer communication in certain conditions. A privileged attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information (kernel memory). (CVE-2023-3863)

Laurence Wit discovered that the KSMBD implementation in the Linux kernel did not properly validate a buffer size in certain situations, leading to an out-of-bounds read vulnerability. A remote attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-3865)

Laurence Wit discovered that the KSMBD implementation in the Linux kernel contained a null pointer dereference vulnerability when handling handling chained requests. A remote attacker could use this to cause a denial of service (system crash). (CVE-2023-3866)

It was discovered that the Siano USB MDTV receiver device driver in the Linux kernel did not properly handle device initialization failures in certain situations, leading to a use-after-free vulnerability. A physically proximate attacker could use this cause a denial of service (system crash). (CVE-2023-4132)

Andy Nguyen discovered that the KVM implementation for AMD processors in the Linux kernel with Secure Encrypted Virtualization (SEV) contained a race condition when accessing the GHCB page. A local attacker in a SEV guest VM could possibly use this to cause a denial of service (host system crash). (CVE-2023-4155)

It was discovered that the TUN/TAP driver in the Linux kernel did not properly initialize socket data. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-4194)

Maxim Suhanov discovered that the exFAT file system implementation in the Linux kernel did not properly check a file name length, leading to an out- of-bounds write vulnerability. An attacker could use this to construct a malicious exFAT image that, when mounted and operated on, could cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-4273)

Thelford Williams discovered that the Ceph file system messenger protocol implementation in the Linux kernel did not properly validate frame segment length in certain situation, leading to a buffer overflow vulnerability. A remote attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-44466)

It was discovered that the eBPF implementation in the Linux kernel contained a race condition around read-only maps. A privileged attacker could use this to modify read-only maps. (CVE-2021-4001)

It was discovered that the IPv6 implementation in the Linux kernel contained a high rate of hash collisions in connection lookup table. A remote attacker could use this to cause a denial of service (excessive CPU consumption). (CVE-2023-1206)

Yang Lan discovered that the GFS2 file system implementation in the Linux kernel could attempt to dereference a null pointer in some situations. An attacker could use this to construct a malicious GFS2 image that, when mounted and operated on, could cause a denial of service (system crash). (CVE-2023-3212)

Davide Ornaghi discovered that the DECnet network protocol implementation in the Linux kernel contained a null pointer dereference vulnerability. A remote attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. Please note that kernel support for the DECnet has been removed to resolve this CVE. (CVE-2023-3338)

It was discovered that the NFC implementation in the Linux kernel contained a use-after-free vulnerability when performing peer-to-peer communication in certain conditions. A privileged attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information (kernel memory). (CVE-2023-3863)

It was discovered that the TUN/TAP driver in the Linux kernel did not properly initialize socket data. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-4194)

It was discovered that the IPv6 implementation in the Linux kernel contained a high rate of hash collisions in connection lookup table. A remote attacker could use this to cause a denial of service (excessive CPU consumption). (CVE-2023-1206)

Daniel Trujillo, Johannes Wikner, and Kaveh Razavi discovered that some AMD processors utilising speculative execution and branch prediction may allow unauthorised memory reads via a speculative side-channel attack. A local attacker could use this to expose sensitive information, including kernel memory. (CVE-2023-20569)

It was discovered that the IPv6 RPL protocol implementation in the Linux kernel did not properly handle user-supplied data. A remote attacker could use this to cause a denial of service (system crash). (CVE-2023-2156)

Davide Ornaghi discovered that the DECnet network protocol implementation in the Linux kernel contained a null pointer dereference vulnerability. A remote attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. Please note that kernel support for the DECnet has been removed to resolve this CVE. (CVE-2023-3338)

Ross Lagerwall discovered that the Xen netback backend driver in the Linux kernel did not properly handle certain unusual packets from a paravirtualized network frontend, leading to a buffer overflow. An attacker in a guest VM could use this to cause a denial of service (host system crash) or possibly execute arbitrary code. (CVE-2023-34319)

Chih-Yen Chang discovered that the KSMBD implementation in the Linux kernel did not properly validate command payload size, leading to a out-of-bounds read vulnerability. A remote attacker could possibly use this to cause a denial of service (system crash). (CVE-2023-38432)

It was discovered that the NFC implementation in the Linux kernel contained a use-after-free vulnerability when performing peer-to-peer communication in certain conditions. A privileged attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information (kernel memory). (CVE-2023-3863)

Laurence Wit discovered that the KSMBD implementation in the Linux kernel did not properly validate a buffer size in certain situations, leading to an out-of-bounds read vulnerability. A remote attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-3865)

Laurence Wit discovered that the KSMBD implementation in the Linux kernel contained a null pointer dereference vulnerability when handling handling chained requests. A remote attacker could use this to cause a denial of service (system crash). (CVE-2023-3866)

It was discovered that the Siano USB MDTV receiver device driver in the Linux kernel did not properly handle device initialization failures in certain situations, leading to a use-after-free vulnerability. A physically proximate attacker could use this cause a denial of service (system crash). (CVE-2023-4132)

Andy Nguyen discovered that the KVM implementation for AMD processors in the Linux kernel with Secure Encrypted Virtualization (SEV) contained a race condition when accessing the GHCB page. A local attacker in a SEV guest VM could possibly use this to cause a denial of service (host system crash). (CVE-2023-4155)

It was discovered that the TUN/TAP driver in the Linux kernel did not properly initialize socket data. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-4194)

Bien Pham discovered that the netfiler subsystem in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. A local user could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-4244)

Maxim Suhanov discovered that the exFAT file system implementation in the Linux kernel did not properly check a file name length, leading to an out- of-bounds write vulnerability. An attacker could use this to construct a…

It was discovered that the IPv6 implementation in the Linux kernel contained a high rate of hash collisions in connection lookup table. A remote attacker could use this to cause a denial of service (excessive CPU consumption). (CVE-2023-1206)

Daniel Trujillo, Johannes Wikner, and Kaveh Razavi discovered that some AMD processors utilising speculative execution and branch prediction may allow unauthorised memory reads via a speculative side-channel attack. A local attacker could use this to expose sensitive information, including kernel memory. (CVE-2023-20569)

It was discovered that the IPv6 RPL protocol implementation in the Linux kernel did not properly handle user-supplied data. A remote attacker could use this to cause a denial of service (system crash). (CVE-2023-2156)

Davide Ornaghi discovered that the DECnet network protocol implementation in the Linux kernel contained a null pointer dereference vulnerability. A remote attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. Please note that kernel support for the DECnet has been removed to resolve this CVE. (CVE-2023-3338)

Ross Lagerwall discovered that the Xen netback backend driver in the Linux kernel did not properly handle certain unusual packets from a paravirtualized network frontend, leading to a buffer overflow. An attacker in a guest VM could use this to cause a denial of service (host system crash) or possibly execute arbitrary code. (CVE-2023-34319)

Chih-Yen Chang discovered that the KSMBD implementation in the Linux kernel did not properly validate command payload size, leading to a out-of-bounds read vulnerability. A remote attacker could possibly use this to cause a denial of service (system crash). (CVE-2023-38432)

It was discovered that the NFC implementation in the Linux kernel contained a use-after-free vulnerability when performing peer-to-peer communication in certain conditions. A privileged attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information (kernel memory). (CVE-2023-3863)

Laurence Wit discovered that the KSMBD implementation in the Linux kernel did not properly validate a buffer size in certain situations, leading to an out-of-bounds read vulnerability. A remote attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-3865)

Laurence Wit discovered that the KSMBD implementation in the Linux kernel contained a null pointer dereference vulnerability when handling handling chained requests. A remote attacker could use this to cause a denial of service (system crash). (CVE-2023-3866)

It was discovered that the Siano USB MDTV receiver device driver in the Linux kernel did not properly handle device initialization failures in certain situations, leading to a use-after-free vulnerability. A physically proximate attacker could use this cause a denial of service (system crash). (CVE-2023-4132)

Andy Nguyen discovered that the KVM implementation for AMD processors in the Linux kernel with Secure Encrypted Virtualization (SEV) contained a race condition when accessing the GHCB page. A local attacker in a SEV guest VM could possibly use this to cause a denial of service (host system crash). (CVE-2023-4155)

It was discovered that the TUN/TAP driver in the Linux kernel did not properly initialize socket data. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-4194)

Bien Pham discovered that the netfiler subsystem in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. A local user could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-4244)

Maxim Suhanov discovered that the exFAT file system implementation in the Linux kernel did not properly check a file name length, leading to an out- of-bounds write vulnerability. An attacker could use this to construct a…

Hyunwoo Kim discovered that the DVB Core driver in the Linux kernel contained a race condition during device removal, leading to a use-after- free vulnerability. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-45886, CVE-2022-45919)

Hyunwoo Kim discovered that the Technotrend/Hauppauge USB DEC driver in the Linux kernel did not properly handle device removal events. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2022-45887)

It was discovered that the NTFS file system implementation in the Linux kernel did not properly validate MFT flags in certain situations. An attacker could use this to construct a malicious NTFS image that, when mounted and operated on, could cause a denial of service (system crash). (CVE-2022-48425)

It was discovered that the IPv6 implementation in the Linux kernel contained a high rate of hash collisions in connection lookup table. A remote attacker could use this to cause a denial of service (excessive CPU consumption). (CVE-2023-1206)

Daniel Trujillo, Johannes Wikner, and Kaveh Razavi discovered that some AMD processors utilising speculative execution and branch prediction may allow unauthorised memory reads via a speculative side-channel attack. A local attacker could use this to expose sensitive information, including kernel memory. (CVE-2023-20569)

Jana Hofmann, Emanuele Vannacci, Cedric Fournet, Boris Kopf, and Oleksii Oleksenko discovered that some AMD processors could leak stale data from division operations in certain situations. A local attacker could possibly use this to expose sensitive information. (CVE-2023-20588)

It was discovered that the ARM64 KVM implementation in the Linux kernel did not properly restrict hypervisor memory access. An attacker in a guest VM could use this to execute arbitrary code in the host OS. (CVE-2023-21264)

It was discovered that the IPv6 RPL protocol implementation in the Linux kernel did not properly handle user-supplied data. A remote attacker could use this to cause a denial of service (system crash). (CVE-2023-2156)

Yu Hao and Weiteng Chen discovered that the Bluetooth HCI UART driver in the Linux kernel contained a race condition, leading to a null pointer dereference vulnerability. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-31083)

Yang Lan discovered that the GFS2 file system implementation in the Linux kernel could attempt to dereference a null pointer in some situations. An attacker could use this to construct a malicious GFS2 image that, when mounted and operated on, could cause a denial of service (system crash). (CVE-2023-3212)

Ross Lagerwall discovered that the Xen netback backend driver in the Linux kernel did not properly handle certain unusual packets from a paravirtualized network frontend, leading to a buffer overflow. An attacker in a guest VM could use this to cause a denial of service (host system crash) or possibly execute arbitrary code. (CVE-2023-34319)

Lin Ma discovered that the Netlink Transformation (XFRM) subsystem in the Linux kernel contained a null pointer dereference vulnerability in some situations. A local privileged attacker could use this to cause a denial of service (system crash). (CVE-2023-3772)

It was discovered that the KSMBD implementation in the Linux kernel did not properly validate buffer sizes in certain operations, leading to an integer underflow and out-of-bounds read vulnerability. A remote attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-38427)

Chih-Yen Chang discovered that the KSMBD implementation in the Linux kernel did not properly validate SMB request protocol IDs, leading to a out-of- bounds read vulnerability. A remote attacker could possibly use this to cause a denial of service (system crash). (CVE-2023-38430)

Chih-Yen Chang discovered that…