CVE-2023-42753

An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro could lead to a miscalculation of the h->nets array offset, providing attackers with the primitive to arbitrarily increment/decrement a memory buffer out-of-bound. This issue may allow a local user to crash the system or potentially escalate their privileges on the system.

An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro could lead to a miscalculation of the h->nets array offset, providing attackers with the primitive to arbitrarily increment/decrement a memory buffer out-of-bound. This issue may allow a local user to crash the system or potentially escalate their privileges on the system.

The Linux Kernel, the operating system core itself.

Security Fix(es):

An issue was discovered in the Linux kernel before 5.8.6. drivers/media/cec/core/cec-api.c leaks one byte of kernel memory on specific hardware to unprivileged users, because of directly assigning log_addrs with a hole in the struct.(CVE-2020-36766)

An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro could lead to a miscalculation of the h->nets array offset, providing attackers with the primitive to arbitrarily increment/decrement a memory buffer out-of-bound. This issue may allow a local user to crash the system or potentially escalate their privileges on the system.(CVE-2023-42753)

The Linux Kernel, the operating system core itself.

Security Fix(es):

An issue was discovered in the Linux kernel before 5.8.6. drivers/media/cec/core/cec-api.c leaks one byte of kernel memory on specific hardware to unprivileged users, because of directly assigning log_addrs with a hole in the struct.(CVE-2020-36766)

An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro could lead to a miscalculation of the h->nets array offset, providing attackers with the primitive to arbitrarily increment/decrement a memory buffer out-of-bound. This issue may allow a local user to crash the system or potentially escalate their privileges on the system.(CVE-2023-42753)

The Linux Kernel, the operating system core itself.

Security Fix(es):

An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro could lead to a miscalculation of the h->nets array offset, providing attackers with the primitive to arbitrarily increment/decrement a memory buffer out-of-bound. This issue may allow a local user to crash the system or potentially escalate their privileges on the system.(CVE-2023-42753)

The Linux Kernel, the operating system core itself.

Security Fix(es):

An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro could lead to a miscalculation of the h->nets array offset, providing attackers with the primitive to arbitrarily increment/decrement a memory buffer out-of-bound. This issue may allow a local user to crash the system or potentially escalate their privileges on the system.(CVE-2023-42753)

The Linux Kernel, the operating system core itself.

Security Fix(es):

An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro could lead to a miscalculation of the h->nets array offset, providing attackers with the primitive to arbitrarily increment/decrement a memory buffer out-of-bound. This issue may allow a local user to crash the system or potentially escalate their privileges on the system.(CVE-2023-42753)

An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro could lead to a miscalculation of the h->nets array offset, providing attackers with the primitive to arbitrarily increment/decrement a memory buffer out-of-bound. This issue may allow a local user to crash the system or potentially escalate their privileges on the system.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: use after free in unix_stream_sendpage (CVE-2023-4622)
• kernel: vmwgfx: reference count issue leads to use-after-free in surface handling (CVE-2023-5633)
• kernel: netfilter: potential slab-out-of-bound access due to integer underflow (CVE-2023-42753)
• Kernel: UAF during login when accessing the shost ipaddress (CVE-2023-2162)
• hw amd: Return Address Predictor vulnerability leading to information disclosure (CVE-2023-20569)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Backport OVS l4 Symmetric Hashing to almalinux-8 (JIRA:AlmaLinux-12746)
• Unbounded memory usage by TCP for receive buffers (JIRA:AlmaLinux-15096)
• various kind of guests freeze on rhel 8.8 (JIRA:AlmaLinux-15121)
• AlmaLinux 8: netfilter: conntrack: Fix gre tunneling over ipv6 (JIRA:AlmaLinux-15259)
• NFSv4.1 needs to handle ENOENT error from GETDEVICEINFO (JIRA:AlmaLinux-16407)
• DM multipath showing failed path for an nvme-o-FC LUN when performing I/O operations (JIRA:AlmaLinux-14718)

• CVE-url: https://ubuntu.com/security/CVE-2023-42753
  • netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c
• CVE-2022-40982 // CVE-url: https://ubuntu.com/security/CVE-2022-40982
  • init: Provide arch_cpu_finalize_init()
  • x86/cpu: Switch to arch_cpu_finalize_init()
  • init: Remove check_bugs() leftovers
  • x86/speculation: Add Gather Data Sampling mitigation
  • x86/speculation: Add force option to GDS mitigation
  • x86/speculation: Add Kconfig option for GDS
  • KVM: Add GDS_NO support to KVM
• CVE-url: https://ubuntu.com/security/CVE-2022-40982
  • vmlinux.lds.h: Create section for protection against instrumentation
  • x86/cpu: Move arch_smt_update() to a neutral place
• CVE-2023-20588 // CVE-url: https://ubuntu.com/security/CVE-2023-20588
  • x86/bugs: Increase the x86 bugs vector size to two u32s
  • x86/CPU/AMD: Do not leak quotient data after a division by 0
  • x86/CPU/AMD: Fix the DIV(0) initial fix attempt
• CVE-2023-3863 // CVE-url: https://ubuntu.com/security/CVE-2023-3863
  • nfc: llcp: simplify llcp_sock_connect() error paths
  • net: nfc: Fix use-after-free caused by nfc_llcp_find_local
• CVE-url: https://ubuntu.com/security/CVE-2023-3863
  • nfc: Fix to check for kmemdup failure
• CVE-url: https://ubuntu.com/security/CVE-2023-4921
  • net: sched: sch_qfq: Fix UAF in qfq_dequeue()
• Miscellaneous Ubuntu changes
  • [Config] CONFIG_GDS_FORCE_MITIGATION=n

• CVE-url: https://ubuntu.com/security/CVE-2023-42753
  • netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c
• CVE-2022-40982 // CVE-url: https://ubuntu.com/security/CVE-2022-40982
  • init: Provide arch_cpu_finalize_init()
  • x86/cpu: Switch to arch_cpu_finalize_init()
  • init: Remove check_bugs() leftovers
  • x86/speculation: Add Gather Data Sampling mitigation
  • x86/speculation: Add force option to GDS mitigation
  • x86/speculation: Add Kconfig option for GDS
  • KVM: Add GDS_NO support to KVM
• CVE-url: https://ubuntu.com/security/CVE-2022-40982
  • vmlinux.lds.h: Create section for protection against instrumentation
  • x86/cpu: Move arch_smt_update() to a neutral place
• CVE-2023-20588 // CVE-url: https://ubuntu.com/security/CVE-2023-20588
  • x86/bugs: Increase the x86 bugs vector size to two u32s
  • x86/CPU/AMD: Do not leak quotient data after a division by 0
  • x86/CPU/AMD: Fix the DIV(0) initial fix attempt
• CVE-2023-3863 // CVE-url: https://ubuntu.com/security/CVE-2023-3863
  • nfc: llcp: simplify llcp_sock_connect() error paths
  • net: nfc: Fix use-after-free caused by nfc_llcp_find_local
• CVE-url: https://ubuntu.com/security/CVE-2023-3863
  • nfc: Fix to check for kmemdup failure
• CVE-url: https://ubuntu.com/security/CVE-2023-4921
  • net: sched: sch_qfq: Fix UAF in qfq_dequeue()
• Miscellaneous Ubuntu changes
  • [Config] CONFIG_GDS_FORCE_MITIGATION=n

• CVE-url: https://ubuntu.com/security/CVE-2023-42753
  • netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c
• CVE-2022-40982 // CVE-url: https://ubuntu.com/security/CVE-2022-40982
  • init: Provide arch_cpu_finalize_init()
  • x86/cpu: Switch to arch_cpu_finalize_init()
  • init: Remove check_bugs() leftovers
  • x86/speculation: Add Gather Data Sampling mitigation
  • x86/speculation: Add force option to GDS mitigation
  • x86/speculation: Add Kconfig option for GDS
  • KVM: Add GDS_NO support to KVM
• CVE-url: https://ubuntu.com/security/CVE-2022-40982
  • x86/cpu: Move arch_smt_update() to a neutral place
• Bionic update: upstream stable patchset 2019-07-23 (LP: #1837664) // CVE- url: https://ubuntu.com/security/CVE-2022-40982
  • cpu/hotplug: Fix "SMT disabled by BIOS" detection for KVM
• Jammy update: v5.15.94 upstream stable release (LP: #2012673) // CVE-url: https://ubuntu.com/security/CVE-2022-40982
  • x86/speculation: Identify processors vulnerable to SMT RSB predictions
• CVE-2023-20588 // CVE-url: https://ubuntu.com/security/CVE-2023-20588
  • x86/bugs: Increase the x86 bugs vector size to two u32s
  • x86/CPU/AMD: Do not leak quotient data after a division by 0
  • x86/CPU/AMD: Fix the DIV(0) initial fix attempt
• CVE-2023-3863 // CVE-url: https://ubuntu.com/security/CVE-2023-3863
  • nfc: llcp: simplify llcp_sock_connect() error paths
  • net: nfc: Fix use-after-free caused by nfc_llcp_find_local
• Jammy update: v5.15.46 upstream stable release (LP: #1981864) // CVE-url: https://ubuntu.com/security/CVE-2023-4385
  • fs: jfs: fix possible NULL pointer dereference in dbFree()
• Jammy update: v5.15.42 upstream stable release (LP: #1981375) // CVE-url: https://ubuntu.com/security/CVE-2023-4459
  • net: vmxnet3: fix possible NULL pointer dereference in vmxnet3_rq_cleanup()
• CVE-url: https://ubuntu.com/security/CVE-2023-4921
  • net: sched: sch_qfq: Fix UAF in qfq_dequeue()
• Miscellaneous Ubuntu changes
  • [Config] CONFIG_GDS_FORCE_MITIGATION=n

• CVE-url: https://ubuntu.com/security/CVE-2023-42753
  • netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c
• CVE-2022-40982 // CVE-url: https://ubuntu.com/security/CVE-2022-40982
  • init: Provide arch_cpu_finalize_init()
  • x86/cpu: Switch to arch_cpu_finalize_init()
  • init: Remove check_bugs() leftovers
  • x86/speculation: Add Gather Data Sampling mitigation
  • x86/speculation: Add force option to GDS mitigation
  • x86/speculation: Add Kconfig option for GDS
  • KVM: Add GDS_NO support to KVM
• CVE-url: https://ubuntu.com/security/CVE-2022-40982
  • x86/cpu: Move arch_smt_update() to a neutral place
• Bionic update: upstream stable patchset 2019-07-23 (LP: #1837664) // CVE- url: https://ubuntu.com/security/CVE-2022-40982
  • cpu/hotplug: Fix "SMT disabled by BIOS" detection for KVM
• Jammy update: v5.15.94 upstream stable release (LP: #2012673) // CVE-url: https://ubuntu.com/security/CVE-2022-40982
  • x86/speculation: Identify processors vulnerable to SMT RSB predictions
• CVE-2023-20588 // CVE-url: https://ubuntu.com/security/CVE-2023-20588
  • x86/bugs: Increase the x86 bugs vector size to two u32s
  • x86/CPU/AMD: Do not leak quotient data after a division by 0
  • x86/CPU/AMD: Fix the DIV(0) initial fix attempt
• CVE-2023-3863 // CVE-url: https://ubuntu.com/security/CVE-2023-3863
  • nfc: llcp: simplify llcp_sock_connect() error paths
  • net: nfc: Fix use-after-free caused by nfc_llcp_find_local
• Jammy update: v5.15.46 upstream stable release (LP: #1981864) // CVE-url: https://ubuntu.com/security/CVE-2023-4385
  • fs: jfs: fix possible NULL pointer dereference in dbFree()
• Jammy update: v5.15.42 upstream stable release (LP: #1981375) // CVE-url: https://ubuntu.com/security/CVE-2023-4459
  • net: vmxnet3: fix possible NULL pointer dereference in vmxnet3_rq_cleanup()
• CVE-url: https://ubuntu.com/security/CVE-2023-4921
  • net: sched: sch_qfq: Fix UAF in qfq_dequeue()
• Miscellaneous Ubuntu changes
  • [Config] CONFIG_GDS_FORCE_MITIGATION=n

• net/tls: do not free tls_rec on async operation in bpf_exec_tx_verdict() {CVE-2023-6176}
• wifi: mac80211: fix MBSSID parsing use-after-free {CVE-2022-42719}
• mac80211: always allocate struct ieee802_11_elems {CVE-2022-42719}
• x86/sev: Check for user-space IOIO pointing to kernel space {CVE-2023-46813}
• x86/sev: Check IOBM for IOIO exceptions from user-space {CVE-2023-46813}
• x86/sev: Disable MMIO emulation from user mode {CVE-2023-46813}
• netfilter: nftables: exthdr: fix 4-byte stack OOB write {CVE-2023-4881}
• net: sched: sch_qfq: Fix UAF in qfq_dequeue() {CVE-2023-4921}
• netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c {CVE-2023-42753}
• net/sched: cls_tcindex: downgrade to imperfect hash {CVE-2023-1829}
• USB: ene_usb6250: Allocate enough memory for full object {CVE-2023-45862}
• igb: set max size RX buffer when store bad packet is enabled {CVE-2023-45871}
• net/sched: sch_hfsc: Ensure inner classes have fsc curve {CVE-2023-4623}
• Fix double fget() in vhost_net_set_backend() {CVE-2023-1838}
• nvmet-tcp: Fix a possible UAF in queue intialization setup {CVE-2023-5178}
• drm/qxl: fix UAF on handle creation {CVE-2023-39198}
• net: add kerneldoc comment for sk_peer_lock {CVE-2021-4203}
• af_unix: fix races in sk_peer_pid and sk_peer_cred accesses {CVE-2021-4203}
• block-map: add __GFP_ZERO flag for alloc_page in function bio_copy_kern {CVE-2022-0494}
• media: ov519: add missing endpoint sanity checks {CVE-2020-11608}
• act_mirred: use the backlog for nested calls to mirred ingress {CVE-2022-4269}
• net/sched: act_mirred: better wording on protection against excessive stack growth {CVE-2022-4269}
• inet: use bigger hash table for IP ID generation {CVE-2021-45486}
• net: revert "net: get rid of an signed integer overflow in ip_idents_reserve()" {CVE-2021-45486}

• net/tls: do not free tls_rec on async operation in bpf_exec_tx_verdict() {CVE-2023-6176}
• wifi: mac80211: fix MBSSID parsing use-after-free {CVE-2022-42719}
• mac80211: always allocate struct ieee802_11_elems {CVE-2022-42719}
• x86/sev: Check for user-space IOIO pointing to kernel space {CVE-2023-46813}
• x86/sev: Check IOBM for IOIO exceptions from user-space {CVE-2023-46813}
• x86/sev: Disable MMIO emulation from user mode {CVE-2023-46813}
• netfilter: nftables: exthdr: fix 4-byte stack OOB write {CVE-2023-4881}
• net: sched: sch_qfq: Fix UAF in qfq_dequeue() {CVE-2023-4921}
• netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c {CVE-2023-42753}
• net/sched: cls_tcindex: downgrade to imperfect hash {CVE-2023-1829}
• USB: ene_usb6250: Allocate enough memory for full object {CVE-2023-45862}
• igb: set max size RX buffer when store bad packet is enabled {CVE-2023-45871}
• net/sched: sch_hfsc: Ensure inner classes have fsc curve {CVE-2023-4623}
• Fix double fget() in vhost_net_set_backend() {CVE-2023-1838}
• nvmet-tcp: Fix a possible UAF in queue intialization setup {CVE-2023-5178}
• drm/qxl: fix UAF on handle creation {CVE-2023-39198}
• net: add kerneldoc comment for sk_peer_lock {CVE-2021-4203}
• af_unix: fix races in sk_peer_pid and sk_peer_cred accesses {CVE-2021-4203}
• block-map: add __GFP_ZERO flag for alloc_page in function bio_copy_kern {CVE-2022-0494}
• media: ov519: add missing endpoint sanity checks {CVE-2020-11608}
• act_mirred: use the backlog for nested calls to mirred ingress {CVE-2022-4269}
• net/sched: act_mirred: better wording on protection against excessive stack growth {CVE-2022-4269}
• inet: use bigger hash table for IP ID generation {CVE-2021-45486}
• net: revert "net: get rid of an signed integer overflow in ip_idents_reserve()" {CVE-2021-45486}

• bpf: Fix re-attachment branch in bpf_tracing_prog_attach {CVE-2024-26591}
• ext4: improve error recovery code paths in __ext4_remount() {CVE-2024-0775}
• smb: client: fix OOB in receive_encrypted_standard() {CVE-2024-0565}
• mtd: Fix gluebi NULL pointer dereference caused by ftl notifier {CVE-2023-52449}
• net: prevent mss overflow in skb_segment() {CVE-2023-52435}
• smb: client: fix potential OOBs in smb2_parse_contexts() {CVE-2023-52434}
• atm: Fix Use-After-Free in do_vcc_ioctl {CVE-2023-51780}
• ida: Fix crash in ida_free when the bitmap is empty {CVE-2023-6915}
• nvmet: nul-terminate the NQNs passed in the connect command {CVE-2023-6121}
• netfilter: nf_tables: Reject tables of unsupported family {CVE-2023-6040}
• Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work {CVE-2023-1989}
• NFSD: fix use-after-free in nfsd4_ssc_setup_dul() {CVE-2023-1652}
• x86/bugs: Flush IBP in ib_prctl_set() {CVE-2023-0045}
• Bluetooth: L2CAP: Fix u8 overflow {CVE-2022-45934}
• Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm {CVE-2022-42896}
• x86: Clear .brk area at early boot {CVE-2022-36123}
• misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault and gru_handle_user_call_os {CVE-2022-3424}
• Fix double fget() in vhost_net_set_backend() {CVE-2023-1838}
• wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies() {CVE-2023-1380}
• netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one {CVE-2023-39197}
• relayfs: fix out-of-bounds access in relay_file_read {CVE-2023-3268}
• ipv6: rpl: Fix Route of Death. {CVE-2023-2156}
• ipv6: Fix out-of-bounds access in ipv6_find_tlv() {CVE-2023-2156}
• net: rpl: fix rpl header size calculation {CVE-2023-2156}
• memstick: r592: Fix UAF bug in r592_remove due to race condition {CVE-2023-3141}
• ovl: fix use after free in struct ovl_aio_req {CVE-2023-1252}
• drm/amdgpu: Fix potential fence use-after-free v2 {CVE-2023-51042}
• netfilter: nf_tables: reject QUEUE/DROP verdict parameters {CVE-2024-1086}
• perf: Fix perf_event_validate_size() lockdep splat {CVE-2023-6931}
• perf: Fix perf_event_validate_size() {CVE-2023-6931}
• drm/atomic: Fix potential use-after-free in nonblocking commits {CVE-2023-51043}
• nvmet-tcp: Fix the H2C expected PDU len calculation {CVE-2023-6356}
• nvmet-tcp: remove boilerplate code {CVE-2023-6356}
• nvmet-tcp: fix a crash in nvmet_req_complete() {CVE-2023-6356}
• nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length {CVE-2023-6356}
• net: tls, update curr on splice as well {CVE-2024-0646}
• smb: client: fix potential OOB in smb2_dump_detail() {CVE-2023-6610}
• smb: client: fix potential OOB in cifs_dump_detail() {CVE-2023-6610}
• smb: client: fix OOB in smbCalcSize() {CVE-2023-6606}
• ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet {CVE-2023-6932}
• RDMA/core: Update CMA destination address on rdma_resolve_addr {CVE-2023-2176}
• RDMA/core: Refactor rdma_bind_addr {CVE-2023-2176}
• nfp: fix use-after-free in area_cache_get() {CVE-2022-3545}
• netfilter: nf_tables: skip bound chain on rule flush {CVE-2023-3777}
• Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb {CVE-2023-40283}
• drivers: net: slip: fix NPD bug in sl_tx_timeout() {CVE-2022-41858}
• net/sched: sch_hfsc: upgrade 'rt' to 'sc' when it becomes a inner curve {CVE-2023-4623}
• net/sched: sch_hfsc: Ensure inner classes have fsc curve {CVE-2023-4623}
• vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF {CVE-2023-3567}
• nvmet-tcp: Fix a possible UAF in queue intialization setup {CVE-2023-5178}
• net: tun: fix bugs for oversize packet when napi frags enabled {CVE-2023-3812}
• netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c {CVE-2023-42753}
• bpf: Fix incorrect verifier pruning due to missing register precision taints {CVE-2023-2163}
• net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free {CVE-2023-4206}…

• kvm: initialize all of the kvm_debugregs structure before sending it to userspace {CVE-2023-1513}
• wifi: mac80211: fix MBSSID parsing use-after-free {CVE-2022-42719}
• mac80211: always allocate struct ieee802_11_elems {CVE-2022-42719}
• netfilter: nf_tables: initialize registers in nft_do_chain() {CVE-2022-1016}
• xprtrdma: fix incorrect header size calculations {CVE-2022-0812}
• net: usb: fix memory leak in smsc75xx_bind {CVE-2021-47171}
• i2c: i801: Don't generate an interrupt on bus reset {CVE-2021-47153}
• pid: take a reference when initializing cad_pid {CVE-2021-47118}
• Input: appletouch - initialize work before device registration {CVE-2021-46932}
• HID: usbhid: fix info leak in hid_submit_ctrl {CVE-2021-46906}
• quota: check block number when reading the block in quota file {CVE-2021-45868}
• mwifiex: Fix skb_over_panic in mwifiex_usb_recv() {CVE-2021-43976}
• atlantic: Fix OOB read and write in hw_atl_utils_fw_rpc_wait {CVE-2021-43975}
• isdn: cpai: check ctr->cnr to avoid array index out of bound {CVE-2021-43389}
• usb: hso: fix error handling code of hso_create_net_device {CVE-2021-37159}
• can: bcm: fix infoleak in struct bcm_msg_head {CVE-2021-34693}
• dm ioctl: fix out of bounds array access when no devices {CVE-2021-31916}
• KVM: x86: hyper-v: Fix Hyper-V context null-ptr-deref {CVE-2021-30178}
• perf/x86/intel: Fix a crash caused by zero PEBS status {CVE-2021-28971}
• btrfs: fix race when cloning extent buffer during rewind of an old root {CVE-2021-28964}
• ovl: fix missing negative dentry check in ovl_rename() {CVE-2021-20321}
• drm/ttm/nouveau: don't call tt destroy callback on alloc failure. {CVE-2021-20292}
• bpf: Verifer, adjust_scalar_min_max_vals to always call update_reg_bounds() {CVE-2021-4159}
• btrfs: unlock newly allocated extent buffer after error {CVE-2021-4149}
• tracing: Fix bug in rb_per_cpu_empty() that might cause deadloop. {CVE-2021-3679}
• net: mac802154: Fix general protection fault {CVE-2021-3659}
• nfsd4: readdirplus shouldn't return parent of export {CVE-2021-3178}
• Bluetooth: SMP: Fail if remote and local public keys are identical {CVE-2021-0129}
• drm/nouveau: clean up all clients on device removal {CVE-2020-27820}
• drm/nouveau: Add a dedicated mutex for the clients list {CVE-2020-27820}
• drm/nouveau: use drm_dev_unplug() during device removal {CVE-2020-27820}
• Bluetooth: SMP: Fail if remote and local public keys are identical {CVE-2020-26555}
• vsock: Fix memory leak in vsock_connect() {CVE-2022-3629}
• RDMA/core: Don't infoleak GRH fields {CVE-2021-3923}
• xen/netfront: force data bouncing when backend is untrusted {CVE-2022-33741}
• net: Rename and export copy_skb_header
• floppy: use a statically allocated error counter {CVE-2022-1652}
• fuse: fix pipe buffer lifetime for direct_io {CVE-2022-1011}
• aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts {CVE-2024-26898}
• smb: client: fix use-after-free bug in cifs_debug_data_proc_show() {CVE-2023-52752}
• media: pvrusb2: fix use after free on context disconnection {CVE-2023-52445}
• media: dm1105: Fix use after free bug in dm1105_remove due to race condition {CVE-2023-35824}
• perf: Fix perf_event_validate_size() lockdep splat {CVE-2023-6931}
• perf: Fix perf_event_validate_size() {CVE-2023-6931}
• net/sched: sch_hfsc: Ensure inner classes have fsc curve {CVE-2023-4623}
• relayfs: fix out-of-bounds access in relay_file_read {CVE-2023-3268}
• xfs: verify buffer contents when we skip log replay {CVE-2023-2124}
• Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition {CVE-2023-1989}
• Fix double fget() in vhost_net_set_backend() {CVE-2023-1838}
• net/sched: cls_tcindex: downgrade to imperfect hash {CVE-2023-1829}
• xen/netfront: fix leaking data in shared pages {CVE-2022-33740}
• can: ems_usb: ems_usb_start_xmit(): fix double dev_kfree_skb() in error path {CVE-2022-28390}
• xen/blkfront: fix leaking data in shared pages {CVE-2022-26365}
• mISDN: fix use-after-free bugs in l1oip timer…

It was discovered that the Xen netback driver in the Linux kernel did not properly handle packets structured in certain ways. An attacker in a guest VM could possibly use this to cause a denial of service (host NIC availability).(CVE-2022-3643)

It was discovered that the virtual terminal driver in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information (kernel memory).(CVE-2023-3567)

It was discovered that the universal 32bit network packet classifier implementation in the Linux kernel did not properly perform reference counting in some situations, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-2023-3609)

It was discovered that the network packet classifier with netfilter/firewall marks implementation in the Linux kernel did not properly handle reference counting, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-2023-3776)

Kevin Rich discovered that the netfilter subsystem in the Linux kernel did not properly handle table rules flush in certain circumstances. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code.(CVE-2023-3777)

Kevin Rich discovered that the netfilter subsystem in the Linux kernel did not properly handle rule additions to bound chains in certain circumstances. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code.(CVE-2023-3995)

It was discovered that the netfilter subsystem in the Linux kernel did not properly handle PIPAPO element removal, leading to a use-after-free vulnerability. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code.(CVE-2023-4004)

Bing-Jhong Billy Jheng discovered that the Unix domain socket implementation in the Linux kernel contained a race condition in certain situations, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-2023-4622)

Budimir Markovic discovered that the qdisc implementation in the Linux kernel did not properly validate inner classes, leading to a use-after-free vulnerability. A local user could use this to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-2023-4623)

Alex Birnberg discovered that the netfilter subsystem in the Linux kernel did not properly validate register length, leading to an out-of- bounds write vulnerability. A local attacker could possibly use this to cause a denial of service (system crash).(CVE-2023-4881)

Kevin Rich discovered that the netfilter subsystem in the Linux kernel did not properly handle removal of rules from chain bindings in certain circumstances, leading to a use-after-free vulnerability. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code.(CVE-2023-5197)

Gwangun Jung discovered that the Quick Fair Queueing scheduler implementation in the Linux kernel contained an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-2023-31436)

Ross Lagerwall discovered that the Xen netback backend driver in the Linux kernel did not properly handle certain unusual packets from a paravirtualized network frontend, leading to a buffer overflow. An attacker in a guest VM could use this to cause a denial of service (host system crash) or possibly execute arbitrary code.(CVE-2023-34319)

It was discovered that the bluetooth subsystem in the Linux kernel did not properly handle L2CAP socket release, leading to a use-after-free vulnerability. A local…

These are all security issues fixed in the kernel-devel-6.5.6-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the kernel-devel-longterm-6.6.17-1.1 package on the GA media of openSUSE Tumbleweed.