CVE-2023-4387

A use-after-free flaw was found in vmxnet3_rq_alloc_rx_buf in drivers/net/vmxnet3/vmxnet3_drv.c in VMware's vmxnet3 ethernet NIC driver in the Linux Kernel. This issue could allow a local attacker to crash the system due to a double-free while cleaning up vmxnet3_rq_cleanup_all, which could also lead to a kernel information leak problem.

A use-after-free flaw was found in vmxnet3_rq_alloc_rx_buf in drivers/net/vmxnet3/vmxnet3_drv.c in VMware's vmxnet3 ethernet NIC driver in the Linux Kernel. This issue could allow a local attacker to crash the system due to a double-free while cleaning up vmxnet3_rq_cleanup_all, which could also lead to a kernel information leak problem.

The Linux Kernel, the operating system core itself.

Security Fix(es):

A use-after-free flaw was found in net/sched/cls_fw.c in classifiers (cls_fw, cls_u32, and cls_route) in the Linux Kernel. This flaw allows a local attacker to perform a local privilege escalation due to incorrect handling of the existing filter, leading to a kernel information leak issue.(CVE-2023-4128)

A use-after-free flaw was found in vmxnet3_rq_alloc_rx_buf in drivers/net/vmxnet3/vmxnet3_drv.c in VMware's vmxnet3 ethernet NIC driver in the Linux Kernel. This issue could allow a local attacker to crash the system due to a double-free while cleaning up vmxnet3_rq_cleanup_all, which could also lead to a kernel information leak problem.(CVE-2023-4387)

The Linux Kernel, the operating system core itself.

Security Fix(es):

A use-after-free flaw was found in net/sched/cls_fw.c in classifiers (cls_fw, cls_u32, and cls_route) in the Linux Kernel. This flaw allows a local attacker to perform a local privilege escalation due to incorrect handling of the existing filter, leading to a kernel information leak issue.(CVE-2023-4128)

A use-after-free flaw was found in vmxnet3_rq_alloc_rx_buf in drivers/net/vmxnet3/vmxnet3_drv.c in VMware's vmxnet3 ethernet NIC driver in the Linux Kernel. This issue could allow a local attacker to crash the system due to a double-free while cleaning up vmxnet3_rq_cleanup_all, which could also lead to a kernel information leak problem.(CVE-2023-4387)

A use-after-free flaw was found in vmxnet3_rq_alloc_rx_buf in drivers/net/vmxnet3/vmxnet3_drv.c in VMware's vmxnet3 ethernet NIC driver in the Linux Kernel. This issue could allow a local attacker to crash the system due to a double-free while cleaning up vmxnet3_rq_cleanup_all, which could also lead to a kernel information leak problem.

• CVE-url: https://ubuntu.com/security/CVE-2023-4128
  • net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after- free
  • net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after- free
  • net/sched: cls_route: No longer copy tcf_result on update to avoid use- after-free
• CVE-url: https://ubuntu.com/security/CVE-2023-40283
  • Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb
• Jammy update: v5.15.42 upstream stable release (LP: #1981375) // CVE-url: https://ubuntu.com/security/CVE-2023-4387
  • net: vmxnet3: fix possible use-after-free bugs in vmxnet3_rq_alloc_rx_buf()
• CVE-2023-20593 // CVE-url: https://ubuntu.com/security/CVE-2023-20593
  • x86/cpu/amd: Move the errata checking functionality up
  • x86/cpu/amd: Add a Zenbleed fix
• CVE-2023-35001 // CVE-url: https://ubuntu.com/security/CVE-2023-35001
  • netfilter: nf_tables: prevent OOB access in nft_byteorder_eval
• Bionic update: upstream stable patchset 2023-04-05 (LP: #2015399) // CVE- url: https://ubuntu.com/security/CVE-2023-3567
  • vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF
• CVE-url: https://ubuntu.com/security/CVE-2023-0458
  • prlimit: do_prlimit needs to have a speculation check
• CVE-url: https://ubuntu.com/security/CVE-2023-2513
  • ext4: fix use-after-free in ext4_xattr_set_entry
• Jammy update: v5.15.61 upstream stable release (LP: #1990162) // CVE-url: https://ubuntu.com/security/CVE-2023-2513
  • ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h
• CVE-url: https://ubuntu.com/security/CVE-2023-3159
  • firewire: fix potential uaf in outbound_phy_packet_callback()
• Jammy update: v5.15.106 upstream stable release (LP: #2023233) // CVE-url: https://ubuntu.com/security/CVE-2023-1611
  • btrfs: fix race between quota disable and quota assign ioctls
• CVE-url: https://ubuntu.com/security/CVE-2023-3611
  • net/sched: sch_qfq: account for stab overhead in qfq_enqueue
• CVE-2023-3776 // CVE-url: https://ubuntu.com/security/CVE-2023-3776
  • net/sched: cls_fw: Fix improper refcount update leads to use-after-free

• CVE-url: https://ubuntu.com/security/CVE-2023-4128
  • net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after- free
  • net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after- free
  • net/sched: cls_route: No longer copy tcf_result on update to avoid use- after-free
• CVE-url: https://ubuntu.com/security/CVE-2023-40283
  • Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb
• Jammy update: v5.15.42 upstream stable release (LP: #1981375) // CVE-url: https://ubuntu.com/security/CVE-2023-4387
  • net: vmxnet3: fix possible use-after-free bugs in vmxnet3_rq_alloc_rx_buf()
• CVE-2023-20593 // CVE-url: https://ubuntu.com/security/CVE-2023-20593
  • x86/cpu/amd: Move the errata checking functionality up
  • x86/cpu/amd: Add a Zenbleed fix
• CVE-2023-35001 // CVE-url: https://ubuntu.com/security/CVE-2023-35001
  • netfilter: nf_tables: prevent OOB access in nft_byteorder_eval
• Bionic update: upstream stable patchset 2023-04-05 (LP: #2015399) // CVE- url: https://ubuntu.com/security/CVE-2023-3567
  • vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF
• CVE-url: https://ubuntu.com/security/CVE-2023-0458
  • prlimit: do_prlimit needs to have a speculation check
• CVE-url: https://ubuntu.com/security/CVE-2023-2513
  • ext4: fix use-after-free in ext4_xattr_set_entry
• Jammy update: v5.15.61 upstream stable release (LP: #1990162) // CVE-url: https://ubuntu.com/security/CVE-2023-2513
  • ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h
• CVE-url: https://ubuntu.com/security/CVE-2023-3159
  • firewire: fix potential uaf in outbound_phy_packet_callback()
• Jammy update: v5.15.106 upstream stable release (LP: #2023233) // CVE-url: https://ubuntu.com/security/CVE-2023-1611
  • btrfs: fix race between quota disable and quota assign ioctls
• CVE-url: https://ubuntu.com/security/CVE-2023-3611
  • net/sched: sch_qfq: account for stab overhead in qfq_enqueue
• CVE-2023-3776 // CVE-url: https://ubuntu.com/security/CVE-2023-3776
  • net/sched: cls_fw: Fix improper refcount update leads to use-after-free

• xen/xenbus: don't let xenbus_grant_ring() remove grants in error case {CVE-2022-23040}
• xen/xenbus: Fix granting of vmalloc'd memory
• xen/blkfront: don't use gnttab_query_foreign_access() for mapped status {CVE-2022-23036}
• xen/grant-table: add gnttab_try_end_foreign_access() {CVE-2022-23036}
• xen/blkfront: don't trust the backend response data blindly
• xen/blkfront: don't take local copy of a request from the ring page
• xen/blkfront: read response from backend only once
• net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free {CVE-2023-4128}
• net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free {CVE-2023-4128}
• net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after-free {CVE-2023-4128}
• media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221 {CVE-2022-45919}
• media: dvb-core: Fix use-after-free due on race condition at dvb_net {CVE-2022-45886}
• vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF {CVE-2023-3567}
• Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb {CVE-2023-40283}
• net: vmxnet3: fix possible use-after-free bugs in vmxnet3_rq_alloc_rx_buf() {CVE-2023-4387}
• tty: use new tty_insert_flip_string_and_push_buffer() in pty_write() {CVE-2022-1462}
• tty: extract tty_flip_buffer_commit() from tty_flip_buffer_push()
• mmu_gather: Force tlb-flush VM_PFNMAP vmas {CVE-2022-39188}
• net/sched: cls_u32: Fix reference counter leak leading to overflow {CVE-2023-3609}
• netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE {CVE-2023-3117}
• relayfs: fix out-of-bounds access in relay_file_read {CVE-2023-3268}
• xfs: verify buffer contents when we skip log replay {CVE-2023-2124}
• netfilter: nf_tables: stricter validation of element data {CVE-2022-34918}
• tpm: fix reference counting for struct tpm_chip {CVE-2022-2977}
• drm/virtio: Fix compile warnings (ents/nents) {CVE-2023-22998}
• drm/virtio: Correct drm_gem_shmem_get_sg_table() error handling {CVE-2023-22998}
• drm/virtio: Fix NULL vs IS_ERR checking in virtio_gpu_object_shmem_init {CVE-2023-22998}
• gfs2: Don't deref jdesc in evict {CVE-2023-3212}
• drm/i915/gvt: fix double free bug in split_2MB_gtt_entry {CVE-2022-3707}
• drm/amdkfd: Check for null pointer after calling kmemdup {CVE-2022-3108}
• hv_netvsc: Add check for kvmalloc_array {CVE-2022-3107}
• sfc_ef100: potential dereference of null pointer {CVE-2022-3106}
• RDMA/uverbs: Check for null return of kmalloc_array {CVE-2022-3105}
• drm: use the lookup lock in drm_is_current_master {CVE-2022-1280}
• drm: add a locked version of drm_is_current_master {CVE-2022-1280}
• drm: serialize drm_file.master with a new spinlock {CVE-2022-1280}
• drm/vmwgfx: fix potential UAF in vmwgfx_surface.c {CVE-2022-1280}
• drm: protect drm_master pointers in drm_lease.c {CVE-2022-1280}

• xen/xenbus: don't let xenbus_grant_ring() remove grants in error case {CVE-2022-23040}
• xen/xenbus: Fix granting of vmalloc'd memory
• xen/blkfront: don't use gnttab_query_foreign_access() for mapped status {CVE-2022-23036}
• xen/grant-table: add gnttab_try_end_foreign_access() {CVE-2022-23036}
• xen/blkfront: don't trust the backend response data blindly
• xen/blkfront: don't take local copy of a request from the ring page
• xen/blkfront: read response from backend only once
• net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free {CVE-2023-4128}
• net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free {CVE-2023-4128}
• net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after-free {CVE-2023-4128}
• media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221 {CVE-2022-45919}
• media: dvb-core: Fix use-after-free due on race condition at dvb_net {CVE-2022-45886}
• vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF {CVE-2023-3567}
• Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb {CVE-2023-40283}
• net: vmxnet3: fix possible use-after-free bugs in vmxnet3_rq_alloc_rx_buf() {CVE-2023-4387}
• tty: use new tty_insert_flip_string_and_push_buffer() in pty_write() {CVE-2022-1462}
• tty: extract tty_flip_buffer_commit() from tty_flip_buffer_push()
• mmu_gather: Force tlb-flush VM_PFNMAP vmas {CVE-2022-39188}
• net/sched: cls_u32: Fix reference counter leak leading to overflow {CVE-2023-3609}
• netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE {CVE-2023-3117}
• relayfs: fix out-of-bounds access in relay_file_read {CVE-2023-3268}
• xfs: verify buffer contents when we skip log replay {CVE-2023-2124}
• netfilter: nf_tables: stricter validation of element data {CVE-2022-34918}
• tpm: fix reference counting for struct tpm_chip {CVE-2022-2977}
• drm/virtio: Fix compile warnings (ents/nents) {CVE-2023-22998}
• drm/virtio: Correct drm_gem_shmem_get_sg_table() error handling {CVE-2023-22998}
• drm/virtio: Fix NULL vs IS_ERR checking in virtio_gpu_object_shmem_init {CVE-2023-22998}
• gfs2: Don't deref jdesc in evict {CVE-2023-3212}
• drm/i915/gvt: fix double free bug in split_2MB_gtt_entry {CVE-2022-3707}
• drm/amdkfd: Check for null pointer after calling kmemdup {CVE-2022-3108}
• hv_netvsc: Add check for kvmalloc_array {CVE-2022-3107}
• sfc_ef100: potential dereference of null pointer {CVE-2022-3106}
• RDMA/uverbs: Check for null return of kmalloc_array {CVE-2022-3105}
• drm: use the lookup lock in drm_is_current_master {CVE-2022-1280}
• drm: add a locked version of drm_is_current_master {CVE-2022-1280}
• drm: serialize drm_file.master with a new spinlock {CVE-2022-1280}
• drm/vmwgfx: fix potential UAF in vmwgfx_surface.c {CVE-2022-1280}
• drm: protect drm_master pointers in drm_lease.c {CVE-2022-1280}
• KVM: avoid NULL pointer dereference in kvm_dirty_ring_push {CVE-2022-1263}

• kvm: initialize all of the kvm_debugregs structure before sending it to userspace {CVE-2023-1513}
• wifi: mac80211: fix MBSSID parsing use-after-free {CVE-2022-42719}
• mac80211: always allocate struct ieee802_11_elems {CVE-2022-42719}
• netfilter: nf_tables: initialize registers in nft_do_chain() {CVE-2022-1016}
• xprtrdma: fix incorrect header size calculations {CVE-2022-0812}
• net: usb: fix memory leak in smsc75xx_bind {CVE-2021-47171}
• i2c: i801: Don't generate an interrupt on bus reset {CVE-2021-47153}
• pid: take a reference when initializing cad_pid {CVE-2021-47118}
• Input: appletouch - initialize work before device registration {CVE-2021-46932}
• HID: usbhid: fix info leak in hid_submit_ctrl {CVE-2021-46906}
• quota: check block number when reading the block in quota file {CVE-2021-45868}
• mwifiex: Fix skb_over_panic in mwifiex_usb_recv() {CVE-2021-43976}
• atlantic: Fix OOB read and write in hw_atl_utils_fw_rpc_wait {CVE-2021-43975}
• isdn: cpai: check ctr->cnr to avoid array index out of bound {CVE-2021-43389}
• usb: hso: fix error handling code of hso_create_net_device {CVE-2021-37159}
• can: bcm: fix infoleak in struct bcm_msg_head {CVE-2021-34693}
• dm ioctl: fix out of bounds array access when no devices {CVE-2021-31916}
• KVM: x86: hyper-v: Fix Hyper-V context null-ptr-deref {CVE-2021-30178}
• perf/x86/intel: Fix a crash caused by zero PEBS status {CVE-2021-28971}
• btrfs: fix race when cloning extent buffer during rewind of an old root {CVE-2021-28964}
• ovl: fix missing negative dentry check in ovl_rename() {CVE-2021-20321}
• drm/ttm/nouveau: don't call tt destroy callback on alloc failure. {CVE-2021-20292}
• bpf: Verifer, adjust_scalar_min_max_vals to always call update_reg_bounds() {CVE-2021-4159}
• btrfs: unlock newly allocated extent buffer after error {CVE-2021-4149}
• tracing: Fix bug in rb_per_cpu_empty() that might cause deadloop. {CVE-2021-3679}
• net: mac802154: Fix general protection fault {CVE-2021-3659}
• nfsd4: readdirplus shouldn't return parent of export {CVE-2021-3178}
• Bluetooth: SMP: Fail if remote and local public keys are identical {CVE-2021-0129}
• drm/nouveau: clean up all clients on device removal {CVE-2020-27820}
• drm/nouveau: Add a dedicated mutex for the clients list {CVE-2020-27820}
• drm/nouveau: use drm_dev_unplug() during device removal {CVE-2020-27820}
• Bluetooth: SMP: Fail if remote and local public keys are identical {CVE-2020-26555}
• vsock: Fix memory leak in vsock_connect() {CVE-2022-3629}
• RDMA/core: Don't infoleak GRH fields {CVE-2021-3923}
• xen/netfront: force data bouncing when backend is untrusted {CVE-2022-33741}
• net: Rename and export copy_skb_header
• floppy: use a statically allocated error counter {CVE-2022-1652}
• fuse: fix pipe buffer lifetime for direct_io {CVE-2022-1011}
• aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts {CVE-2024-26898}
• smb: client: fix use-after-free bug in cifs_debug_data_proc_show() {CVE-2023-52752}
• media: pvrusb2: fix use after free on context disconnection {CVE-2023-52445}
• media: dm1105: Fix use after free bug in dm1105_remove due to race condition {CVE-2023-35824}
• perf: Fix perf_event_validate_size() lockdep splat {CVE-2023-6931}
• perf: Fix perf_event_validate_size() {CVE-2023-6931}
• net/sched: sch_hfsc: Ensure inner classes have fsc curve {CVE-2023-4623}
• relayfs: fix out-of-bounds access in relay_file_read {CVE-2023-3268}
• xfs: verify buffer contents when we skip log replay {CVE-2023-2124}
• Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition {CVE-2023-1989}
• Fix double fget() in vhost_net_set_backend() {CVE-2023-1838}
• net/sched: cls_tcindex: downgrade to imperfect hash {CVE-2023-1829}
• xen/netfront: fix leaking data in shared pages {CVE-2022-33740}
• can: ems_usb: ems_usb_start_xmit(): fix double dev_kfree_skb() in error path {CVE-2022-28390}
• xen/blkfront: fix leaking data in shared pages {CVE-2022-26365}
• mISDN: fix use-after-free bugs in l1oip timer…

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-38457: Fixed a use-after-free vulnerability in vmwgfx driver that allowed a local attacker to cause a denial of service (bsc#1203330).
• CVE-2022-40133: Fixed a use-after-free vulnerability in vmwgfx driver that allowed a local attacker to cause a denial of service (bsc#1203329).
• CVE-2023-2007: Fixed a flaw in the DPT I2O Controller driver that could allow an attacker to escalate privileges and execute arbitrary code in the context of the kernel (bsc#1210448).
• CVE-2023-3610: Fixed use-after-free vulnerability in nf_tables can be exploited to achieve local privilege escalation (bsc#1213580).
• CVE-2023-3772: Fixed a flaw in XFRM subsystem that may have allowed a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer leading to a possible kernel crash and denial of service (bsc#1213666).
• CVE-2023-3863: Fixed a use-after-free flaw was found in nfc_llcp_find_local that allowed a local user with special privileges to impact a kernel information leak issue (bsc#1213601).
• CVE-2023-40283: Fixed use-after-free in l2cap_sock_ready_cb (bsc#1214233).
• CVE-2023-4128: Fixed a use-after-free flaw in net/sched/cls_fw.c that allowed a local attacker to perform a local privilege escalation due to incorrect handling of the existing filter, leading to a kernel information leak issue (bsc#1214149).
• CVE-2023-4133: Fixed use after free bugs caused by circular dependency problem in cxgb4 (bsc#1213970).
• CVE-2023-4134: Fixed use-after-free in cyttsp4_watchdog_work() (bsc#1213971).
• CVE-2023-4147: Fixed use-after-free in nf_tables_newrule (bsc#1213968).
• CVE-2023-4194: Fixed a type confusion in net tun_chr_open() (bsc#1214019).
• CVE-2023-4273: Fixed a flaw in the exFAT driver of the Linux kernel that alloawed a local privileged attacker to overflow the kernel stack (bsc#1214120).
• CVE-2023-4387: Fixed use-after-free flaw in vmxnet3_rq_alloc_rx_buf that could allow a local attacker to crash the system due to a double-free (bsc#1214350).
• CVE-2023-4459: Fixed a NULL pointer dereference flaw in vmxnet3_rq_cleanup that may have allowed a local attacker with normal user privilege to cause a denial of service (bsc#1214451).
• CVE-2023-4563: Fixed use-after-free in nft_verdict_dump due to a race between set GC and transaction (bsc#1214727).
• CVE-2023-4569: Fixed information leak in nft_set_catchall_flush in net/netfilter/nf_tables_api.c (bsc#1214729).
• CVE-2023-20588: Fixed a division-by-zero error on some AMD processors that can potentially return speculative data resulting in loss of confidentiality (bsc#1213927).
• CVE-2023-34319: Fixed buffer overrun triggered by unusual packet in xen/netback (XSA-432) (bsc#1213546).
• CVE-2023-37453: Fixed oversight in SuperSpeed initialization (bsc#1213123).

The following non-security bugs were fixed:

• ACPI/IORT: Update SMMUv3 DeviceID support (bsc#1214305).
• ACPI: processor: perflib: Avoid updating frequency QoS unnecessarily (git-fixes).
• ACPI: processor: perflib: Use the 'no limit' frequency QoS (git-fixes).
• ACPI: x86: s2idle: Fix a logic error parsing AMD constraints table (git-fixes).
• ALSA: ac97: Fix possible error value of *rac97 (git-fixes).
• ALSA: hda/cs8409: Support new Dell Dolphin Variants (git-fixes).
• ALSA: hda/realtek - Remodified 3k pull low procedure (git-fixes).
• ALSA: hda/realtek: Add quirk for HP Victus 16-d1xxx to enable mute LED (git-fixes).
• ALSA: hda/realtek: Add quirk for mute LEDs on HP ENVY x360 15-eu0xxx (git-fixes).
• ALSA: hda/realtek: Add quirks for HP G11 Laptops (git-fixes).
• ALSA: hda/realtek: Switch Dell Oasis models to use SPI (git-fixes).
• ALSA: pcm: Fix missing fixup call in compat hw_refine ioctl (git-fixes).
• ALSA: usb-audio: Add support for Mythware XA001AU capture and playback interfaces (git-fixes).
• ALSA: usb-audio: Fix init call orders for UAC1 (git-fixes). -…

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-38457: Fixed a use-after-free vulnerability in vmwgfx driver that allowed a local attacker to cause a denial of service (bsc#1203330).
• CVE-2022-40133: Fixed a use-after-free vulnerability in vmwgfx driver that allowed a local attacker to cause a denial of service (bsc#1203329).
• CVE-2023-2007: Fixed a flaw in the DPT I2O Controller driver that could allow an attacker to escalate privileges and execute arbitrary code in the context of the kernel (bsc#1210448).
• CVE-2023-3610: Fixed use-after-free vulnerability in nf_tables can be exploited to achieve local privilege escalation (bsc#1213580).
• CVE-2023-3772: Fixed a flaw in XFRM subsystem that may have allowed a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer leading to a possible kernel crash and denial of service (bsc#1213666).
• CVE-2023-3863: Fixed a use-after-free flaw was found in nfc_llcp_find_local that allowed a local user with special privileges to impact a kernel information leak issue (bsc#1213601).
• CVE-2023-40283: Fixed use-after-free in l2cap_sock_ready_cb (bsc#1214233).
• CVE-2023-4128: Fixed a use-after-free flaw in net/sched/cls_fw.c that allowed a local attacker to perform a local privilege escalation due to incorrect handling of the existing filter, leading to a kernel information leak issue (bsc#1214149).
• CVE-2023-4133: Fixed use after free bugs caused by circular dependency problem in cxgb4 (bsc#1213970).
• CVE-2023-4134: Fixed use-after-free in cyttsp4_watchdog_work() (bsc#1213971).
• CVE-2023-4147: Fixed use-after-free in nf_tables_newrule (bsc#1213968).
• CVE-2023-4194: Fixed a type confusion in net tun_chr_open() (bsc#1214019).
• CVE-2023-4273: Fixed a flaw in the exFAT driver of the Linux kernel that alloawed a local privileged attacker to overflow the kernel stack (bsc#1214120).
• CVE-2023-4387: Fixed use-after-free flaw in vmxnet3_rq_alloc_rx_buf that could allow a local attacker to crash the system due to a double-free (bsc#1214350).
• CVE-2023-4459: Fixed a NULL pointer dereference flaw in vmxnet3_rq_cleanup that may have allowed a local attacker with normal user privilege to cause a denial of service (bsc#1214451).
• CVE-2023-4563: Fixed use-after-free in nft_verdict_dump due to a race between set GC and transaction (bsc#1214727).
• CVE-2023-4569: Fixed information leak in nft_set_catchall_flush in net/netfilter/nf_tables_api.c (bsc#1214729).
• CVE-2023-20588: Fixed a division-by-zero error on some AMD processors that can potentially return speculative data resulting in loss of confidentiality (bsc#1213927).
• CVE-2023-34319: Fixed buffer overrun triggered by unusual packet in xen/netback (XSA-432) (bsc#1213546).
• CVE-2023-37453: Fixed oversight in SuperSpeed initialization (bsc#1213123).

The following non-security bugs were fixed:

• ACPI/IORT: Update SMMUv3 DeviceID support (bsc#1214305).
• ACPI: processor: perflib: Avoid updating frequency QoS unnecessarily (git-fixes).
• ACPI: processor: perflib: Use the 'no limit' frequency QoS (git-fixes).
• ACPI: x86: s2idle: Fix a logic error parsing AMD constraints table (git-fixes).
• ALSA: ac97: Fix possible error value of *rac97 (git-fixes).
• ALSA: hda/cs8409: Support new Dell Dolphin Variants (git-fixes).
• ALSA: hda/realtek - Remodified 3k pull low procedure (git-fixes).
• ALSA: hda/realtek: Add quirk for HP Victus 16-d1xxx to enable mute LED (git-fixes).
• ALSA: hda/realtek: Add quirk for mute LEDs on HP ENVY x360 15-eu0xxx (git-fixes).
• ALSA: hda/realtek: Add quirks for HP G11 Laptops (git-fixes).
• ALSA: hda/realtek: Switch Dell Oasis models to use SPI (git-fixes).
• ALSA: pcm: Fix missing fixup call in compat hw_refine ioctl (git-fixes).
• ALSA: usb-audio: Add support for Mythware XA001AU capture and playback interfaces (git-fixes).
• ALSA: usb-audio: Fix init call orders for UAC1 (git-fixes). -…

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-2007: Fixed a flaw in the DPT I2O Controller driver that could allow an attacker to escalate privileges and execute arbitrary code in the context of the kernel (bsc#1210448).
• CVE-2023-20588: Fixed a division-by-zero error on some AMD processors that can potentially return speculative data resulting in loss of confidentiality (bsc#1213927).
• CVE-2023-34319: Fixed buffer overrun triggered by unusual packet in xen/netback (XSA-432) (bsc#1213546).
• CVE-2023-3610: Fixed use-after-free vulnerability in nf_tables can be exploited to achieve local privilege escalation (bsc#1213580).
• CVE-2023-37453: Fixed oversight in SuperSpeed initialization (bsc#1213123).
• CVE-2023-3772: Fixed a flaw in XFRM subsystem that may have allowed a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer leading to a possible kernel crash and denial of service (bsc#1213666).
• CVE-2023-3863: Fixed a use-after-free flaw was found in nfc_llcp_find_local that allowed a local user with special privileges to impact a kernel information leak issue (bsc#1213601).
• CVE-2023-4128: Fixed a use-after-free flaw in net/sched/cls_fw.c that allowed a local attacker to perform a local privilege escalation due to incorrect handling of the existing filter, leading to a kernel information leak issue (bsc#1214149).
• CVE-2023-4133: Fixed use after free bugs caused by circular dependency problem in cxgb4 (bsc#1213970).
• CVE-2023-4134: Fixed use-after-free in cyttsp4_watchdog_work() (bsc#1213971).
• CVE-2023-4147: Fixed use-after-free in nf_tables_newrule (bsc#1213968).
• CVE-2023-4194: Fixed a type confusion in net tun_chr_open() (bsc#1214019).
• CVE-2023-4273: Fixed a flaw in the exFAT driver of the Linux kernel that alloawed a local privileged attacker to overflow the kernel stack (bsc#1214120).
• CVE-2023-4387: Fixed use-after-free flaw in vmxnet3_rq_alloc_rx_buf that could allow a local attacker to crash the system due to a double-free (bsc#1214350).
• CVE-2023-4459: Fixed a NULL pointer dereference flaw in vmxnet3_rq_cleanup that may have allowed a local attacker with normal user privilege to cause a denial of service (bsc#1214451).
• CVE-2023-4569: Fixed information leak in nft_set_catchall_flush in net/netfilter/nf_tables_api.c (bsc#1214729).

The following non-security bugs were fixed:

• acpi: processor: perflib: avoid updating frequency qos unnecessarily (git-fixes).
• acpi: processor: perflib: use the 'no limit' frequency qos (git-fixes).
• acpi: x86: s2idle: fix a logic error parsing amd constraints table (git-fixes).
• alsa: ac97: fix possible error value of *rac97 (git-fixes).
• alsa: hda/cs8409: support new dell dolphin variants (git-fixes).
• alsa: hda/realtek - remodified 3k pull low procedure (git-fixes).
• alsa: hda/realtek: add quirk for hp victus 16-d1xxx to enable mute led (git-fixes).
• alsa: hda/realtek: add quirk for mute leds on hp envy x360 15-eu0xxx (git-fixes).
• alsa: hda/realtek: add quirks for hp g11 laptops (git-fixes).
• alsa: hda/realtek: switch dell oasis models to use spi (git-fixes).
• alsa: pcm: fix missing fixup call in compat hw_refine ioctl (git-fixes).
• alsa: usb-audio: add support for mythware xa001au capture and playback interfaces (git-fixes).
• alsa: usb-audio: fix init call orders for uac1 (git-fixes).
• alsa: ymfpci: fix the missing snd_card_free() call at probe error (git-fixes).
• amba: bus: fix refcount leak (git-fixes).
• arm64: dts: imx8mn-var-som: add missing pull-up for onboard phy reset pinmux (git-fixes).
• arm64: dts: qcom: qrb5165-rb5: fix thermal zone conflict (git-fixes).
• arm64: dts: rockchip: disable hs400 for emmc on rock pi 4 (git-fixes).
• arm: dts: imx6dl: prtrvt, prtvt7, prti6q, prtwd2: fix usb related warnings (git-fixes).
• arm: dts: imx6sll: fixup of operating points (git-fixes).
• arm: spear: do not use timer…

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-2007: Fixed a flaw in the DPT I2O Controller driver that could allow an attacker to escalate privileges and execute arbitrary code in the context of the kernel (bsc#1210448).
• CVE-2023-20588: Fixed a division-by-zero error on some AMD processors that can potentially return speculative data resulting in loss of confidentiality (bsc#1213927).
• CVE-2023-34319: Fixed buffer overrun triggered by unusual packet in xen/netback (XSA-432) (bsc#1213546).
• CVE-2023-3610: Fixed use-after-free vulnerability in nf_tables can be exploited to achieve local privilege escalation (bsc#1213580).
• CVE-2023-37453: Fixed oversight in SuperSpeed initialization (bsc#1213123).
• CVE-2023-3772: Fixed a flaw in XFRM subsystem that may have allowed a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer leading to a possible kernel crash and denial of service (bsc#1213666).
• CVE-2023-3863: Fixed a use-after-free flaw was found in nfc_llcp_find_local that allowed a local user with special privileges to impact a kernel information leak issue (bsc#1213601).
• CVE-2023-4128: Fixed a use-after-free flaw in net/sched/cls_fw.c that allowed a local attacker to perform a local privilege escalation due to incorrect handling of the existing filter, leading to a kernel information leak issue (bsc#1214149).
• CVE-2023-4133: Fixed use after free bugs caused by circular dependency problem in cxgb4 (bsc#1213970).
• CVE-2023-4134: Fixed use-after-free in cyttsp4_watchdog_work() (bsc#1213971).
• CVE-2023-4147: Fixed use-after-free in nf_tables_newrule (bsc#1213968).
• CVE-2023-4194: Fixed a type confusion in net tun_chr_open() (bsc#1214019).
• CVE-2023-4273: Fixed a flaw in the exFAT driver of the Linux kernel that alloawed a local privileged attacker to overflow the kernel stack (bsc#1214120).
• CVE-2023-4387: Fixed use-after-free flaw in vmxnet3_rq_alloc_rx_buf that could allow a local attacker to crash the system due to a double-free (bsc#1214350).
• CVE-2023-4459: Fixed a NULL pointer dereference flaw in vmxnet3_rq_cleanup that may have allowed a local attacker with normal user privilege to cause a denial of service (bsc#1214451).
• CVE-2023-4569: Fixed information leak in nft_set_catchall_flush in net/netfilter/nf_tables_api.c (bsc#1214729).

The following non-security bugs were fixed:

• acpi: processor: perflib: avoid updating frequency qos unnecessarily (git-fixes).
• acpi: processor: perflib: use the 'no limit' frequency qos (git-fixes).
• acpi: x86: s2idle: fix a logic error parsing amd constraints table (git-fixes).
• alsa: ac97: fix possible error value of *rac97 (git-fixes).
• alsa: hda/cs8409: support new dell dolphin variants (git-fixes).
• alsa: hda/realtek - remodified 3k pull low procedure (git-fixes).
• alsa: hda/realtek: add quirk for hp victus 16-d1xxx to enable mute led (git-fixes).
• alsa: hda/realtek: add quirk for mute leds on hp envy x360 15-eu0xxx (git-fixes).
• alsa: hda/realtek: add quirks for hp g11 laptops (git-fixes).
• alsa: hda/realtek: switch dell oasis models to use spi (git-fixes).
• alsa: pcm: fix missing fixup call in compat hw_refine ioctl (git-fixes).
• alsa: usb-audio: add support for mythware xa001au capture and playback interfaces (git-fixes).
• alsa: usb-audio: fix init call orders for uac1 (git-fixes).
• alsa: ymfpci: fix the missing snd_card_free() call at probe error (git-fixes).
• amba: bus: fix refcount leak (git-fixes).
• arm64: dts: imx8mn-var-som: add missing pull-up for onboard phy reset pinmux (git-fixes).
• arm64: dts: qcom: qrb5165-rb5: fix thermal zone conflict (git-fixes).
• arm64: dts: rockchip: disable hs400 for emmc on rock pi 4 (git-fixes).
• arm: dts: imx6dl: prtrvt, prtvt7, prti6q, prtwd2: fix usb related warnings (git-fixes).
• arm: dts: imx6sll: fixup of operating points (git-fixes).
• arm: spear: do not use timer…

The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-36402: Fixed an integer overflow vulnerability in vmwgfx driver in that allowed a local attacker with a user account on the system to gain privilege, causing a denial of service (bsc#1203517).
• CVE-2023-2007: Fixed a flaw in the DPT I2O Controller driver that could allow an attacker to escalate privileges and execute arbitrary code in the context of the kernel (bsc#1210448).
• CVE-2023-20588: Fixed a division-by-zero error on some AMD processors that can potentially return speculative data resulting in loss of confidentiality (bsc#1213927).
• CVE-2023-34319: Fixed buffer overrun triggered by unusual packet in xen/netback (XSA-432) (bsc#1213546).
• CVE-2023-3772: Fixed a flaw in XFRM subsystem that may have allowed a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer leading to a possible kernel crash and denial of service (bsc#1213666).
• CVE-2023-3812: Fixed an out-of-bounds memory access flaw in the TUN/TAP device driver functionality that could allow a local user to crash or potentially escalate their privileges on the system (bsc#1213543).
• CVE-2023-3863: Fixed a use-after-free flaw was found in nfc_llcp_find_local that allowed a local user with special privileges to impact a kernel information leak issue (bsc#1213601).
• CVE-2023-40283: Fixed use-after-free in l2cap_sock_ready_cb (bsc#1214233).
• CVE-2023-4128: Fixed a use-after-free flaw in net/sched/cls_fw.c that allowed a local attacker to perform a local privilege escalation due to incorrect handling of the existing filter, leading to a kernel information leak issue (bsc#1214149).
• CVE-2023-4132: Fixed use-after-free vulnerability was found in the siano smsusb module that allowed a local user to crash the system, causing a denial of service condition (bsc#1213969).
• CVE-2023-4133: Fixed use after free bugs caused by circular dependency problem in cxgb4 (bsc#1213970).
• CVE-2023-4134: Fixed use-after-free in cyttsp4_watchdog_work() (bsc#1213971).
• CVE-2023-4194: Fixed a type confusion in net tun_chr_open() (bsc#1214019).
• CVE-2023-4385: Fixed a NULL pointer dereference flaw in dbFree that may have allowed a local attacker to crash the system due to a missing sanity check (bsc#1214348).
• CVE-2023-4387: Fixed use-after-free flaw in vmxnet3_rq_alloc_rx_buf that could allow a local attacker to crash the system due to a double-free (bsc#1214350).
• CVE-2023-4459: Fixed a NULL pointer dereference flaw in vmxnet3_rq_cleanup that may have allowed a local attacker with normal user privilege to cause a denial of service (bsc#1214451).

The following non-security bugs were fixed:

• af_key: fix send_acquire race with pfkey_register (git-fixes).
• af_packet: fix data-race in packet_setsockopt / packet_setsockopt (git-fixes).
• af_unix: fix a data race of sk->sk_receive_queue->qlen (git-fixes).
• arm64: re-enable support for contiguous hugepages (git-fixes)
• arm64: vdso: fix clock_getres() for clock_realtime (git-fixes)
• arm: spear: do not use timer namespace for timer_shutdown() function (bsc#1213970).
• bluetooth: nokia: fix value check in nokia_bluetooth_serdev_probe() (git-fixes).
• bnx2x: fix page fault following eeh recovery (bsc#1214299).
• bonding: fix a use-after-free problem when bond_sysfs_slave_add() failed (git-fixes).
• bpf, arm64: remove prefetch insn in xadd mapping (git-fixes)
• bpf, arm64: use more scalable stadd over ldxr / stxr loop in xadd (git-fixes)
• bridge: ebtables: do not crash when using dnat target in output chains (git-fixes).
• btrfs-allow-use-of-global-block-reserve-for-balance: (bsc#1214335).
• btrfs-unset-reloc-control-if-transaction-commit-fail: (bsc#1212051).
• clocksource/drivers/arm_arch_timer: do not use timer namespace for timer_shutdown() function (bsc#1213970).
• clocksource/drivers/sp804: do not use timer namespace for timer_shutdown() function…

The SUSE Linux Enterprise 15 SP5 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-38457: Fixed a use-after-free vulnerability in vmwgfx driver that allowed a local attacker to cause a denial of service (bsc#1203330).
• CVE-2022-40133: Fixed a use-after-free vulnerability in vmwgfx driver that allowed a local attacker to cause a denial of service (bsc#1203329).
• CVE-2023-2007: Fixed a flaw in the DPT I2O Controller driver that could allow an attacker to escalate privileges and execute arbitrary code in the context of the kernel (bsc#1210448).
• CVE-2023-3610: Fixed use-after-free vulnerability in nf_tables can be exploited to achieve local privilege escalation (bsc#1213580).
• CVE-2023-3772: Fixed a flaw in XFRM subsystem that may have allowed a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer leading to a possible kernel crash and denial of service (bsc#1213666).
• CVE-2023-3863: Fixed a use-after-free flaw was found in nfc_llcp_find_local that allowed a local user with special privileges to impact a kernel information leak issue (bsc#1213601).
• CVE-2023-4128: Fixed a use-after-free flaw in net/sched/cls_fw.c that allowed a local attacker to perform a local privilege escalation due to incorrect handling of the existing filter, leading to a kernel information leak issue (bsc#1214149).
• CVE-2023-4133: Fixed use after free bugs caused by circular dependency problem in cxgb4 (bsc#1213970).
• CVE-2023-4134: Fixed use-after-free in cyttsp4_watchdog_work() (bsc#1213971).
• CVE-2023-4147: Fixed use-after-free in nf_tables_newrule (bsc#1213968).
• CVE-2023-4194: Fixed a type confusion in net tun_chr_open() (bsc#1214019).
• CVE-2023-4273: Fixed a flaw in the exFAT driver of the Linux kernel that alloawed a local privileged attacker to overflow the kernel stack (bsc#1214120).
• CVE-2023-4387: Fixed use-after-free flaw in vmxnet3_rq_alloc_rx_buf that could allow a local attacker to crash the system due to a double-free (bsc#1214350).
• CVE-2023-4459: Fixed a NULL pointer dereference flaw in vmxnet3_rq_cleanup that may have allowed a local attacker with normal user privilege to cause a denial of service (bsc#1214451).
• CVE-2023-4563: Fixed use-after-free in nft_verdict_dump due to a race between set GC and transaction (bsc#1214727).
• CVE-2023-4569: Fixed information leak in nft_set_catchall_flush in net/netfilter/nf_tables_api.c (bsc#1214729).
• CVE-2023-20588: Fixed a division-by-zero error on some AMD processors that can potentially return speculative data resulting in loss of confidentiality (bsc#1213927).
• CVE-2023-34319: Fixed buffer overrun triggered by unusual packet in xen/netback (XSA-432) (bsc#1213546).
• CVE-2023-37453: Fixed oversight in SuperSpeed initialization (bsc#1213123).
• CVE-2023-40283: Fixed use-after-free in l2cap_sock_ready_cb (bsc#1214233).

The following non-security bugs were fixed:

• ACPI/IORT: Update SMMUv3 DeviceID support (bsc#1214305).
• ACPI: processor: perflib: Avoid updating frequency QoS unnecessarily (git-fixes).
• ACPI: processor: perflib: Use the 'no limit' frequency QoS (git-fixes).
• ACPI: x86: s2idle: Fix a logic error parsing AMD constraints table (git-fixes).
• ALSA: ac97: Fix possible error value of *rac97 (git-fixes).
• ALSA: hda/cs8409: Support new Dell Dolphin Variants (git-fixes).
• ALSA: hda/realtek - Remodified 3k pull low procedure (git-fixes).
• ALSA: hda/realtek: Add quirk for HP Victus 16-d1xxx to enable mute LED (git-fixes).
• ALSA: hda/realtek: Add quirk for mute LEDs on HP ENVY x360 15-eu0xxx (git-fixes).
• ALSA: hda/realtek: Add quirks for HP G11 Laptops (git-fixes).
• ALSA: hda/realtek: Switch Dell Oasis models to use SPI (git-fixes).
• ALSA: pcm: Fix missing fixup call in compat hw_refine ioctl (git-fixes).
• ALSA: usb-audio: Add support for Mythware XA001AU capture and playback interfaces (git-fixes).
• ALSA: usb-audio: Fix init call orders for UAC1 (git-fixes). -…

The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-36402: Fixed an integer overflow vulnerability in vmwgfx driver in that allowed a local attacker with a user account on the system to gain privilege, causing a denial of service (bsc#1203517).
• CVE-2023-2007: Fixed a flaw in the DPT I2O Controller driver that could allow an attacker to escalate privileges and execute arbitrary code in the context of the kernel (bsc#1210448).
• CVE-2023-20588: Fixed a division-by-zero error on some AMD processors that can potentially return speculative data resulting in loss of confidentiality (bsc#1213927).
• CVE-2023-3772: Fixed a flaw in XFRM subsystem that may have allowed a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer leading to a possible kernel crash and denial of service (bsc#1213666).
• CVE-2023-3812: Fixed an out-of-bounds memory access flaw in the TUN/TAP device driver functionality that could allow a local user to crash or potentially escalate their privileges on the system (bsc#1213543).
• CVE-2023-3863: Fixed a use-after-free flaw was found in nfc_llcp_find_local that allowed a local user with special privileges to impact a kernel information leak issue (bsc#1213601).
• CVE-2023-4128: Fixed a use-after-free flaw in net/sched/cls_fw.c that allowed a local attacker to perform a local privilege escalation due to incorrect handling of the existing filter, leading to a kernel information leak issue (bsc#1214149).
• CVE-2023-4132: Fixed use-after-free vulnerability was found in the siano smsusb module that allowed a local user to crash the system, causing a denial of service condition (bsc#1213969).
• CVE-2023-4134: Fixed use-after-free in cyttsp4_watchdog_work() (bsc#1213971).
• CVE-2023-4385: Fixed a NULL pointer dereference flaw in dbFree that may have allowed a local attacker to crash the system due to a missing sanity check (bsc#1214348).
• CVE-2023-4387: Fixed use-after-free flaw in vmxnet3_rq_alloc_rx_buf that could allow a local attacker to crash the system due to a double-free (bsc#1214350).
• CVE-2023-4459: Fixed a NULL pointer dereference flaw in vmxnet3_rq_cleanup that may have allowed a local attacker with normal user privilege to cause a denial of service (bsc#1214451).

The following non-security bugs were fixed:

• kabi/severities: Ignore newly added SRSO mitigation functions
• x86/cpu/kvm: Provide UNTRAIN_RET_VM (git-fixes).
• x86/cpu: Cleanup the untrain mess (git-fixes).
• x86/cpu: Fix __x86_return_thunk symbol type (git-fixes).
• x86/cpu: Fix up srso_safe_ret() and __x86_return_thunk() (git-fixes).
• x86/cpu: Rename original retbleed methods (git-fixes).
• x86/cpu: Rename srso_(.*)alias to srso_alias\1 (git-fixes).
• x86/retpoline,kprobes: Fix position of thunk sections with CONFIG_LTO_CLANG (git-fixes).
• x86/retpoline,kprobes: Skip optprobe check for indirect jumps with retpolines and IBT (git-fixes).
• x86/retpoline: Do not clobber RFLAGS during srso_safe_ret() (git-fixes).
• x86/speculation: Add cpu_show_gds() prototype (git-fixes).
• x86/speculation: Mark all Skylake CPUs as vulnerable to GDS (git-fixes).
• x86/srso: Correct the mitigation status when SMT is disabled (git-fixes).
• x86/srso: Disable the mitigation on unaffected configurations (git-fixes).
• x86/srso: Explain the untraining sequences a bit more (git-fixes).
• x86/srso: Fix build breakage with the LLVM linker (git-fixes).
• x86: Move gds_ucode_mitigated() declaration to header (git-fixes).

The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-36402: Fixed an integer overflow vulnerability in vmwgfx driver in that allowed a local attacker with a user account on the system to gain privilege, causing a denial of service (bsc#1203517).
• CVE-2023-2007: Fixed a flaw in the DPT I2O Controller driver that could allow an attacker to escalate privileges and execute arbitrary code in the context of the kernel (bsc#1210448).
• CVE-2023-3772: Fixed a flaw in XFRM subsystem that may have allowed a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer leading to a possible kernel crash and denial of service (bsc#1213666).
• CVE-2023-3812: Fixed an out-of-bounds memory access flaw in the TUN/TAP device driver functionality that could allow a local user to crash or potentially escalate their privileges on the system (bsc#1213543).
• CVE-2023-3863: Fixed a use-after-free flaw was found in nfc_llcp_find_local that allowed a local user with special privileges to impact a kernel information leak issue (bsc#1213601).
• CVE-2023-4128: Fixed a use-after-free flaw in net/sched/cls_fw.c that allowed a local attacker to perform a local privilege escalation due to incorrect handling of the existing filter, leading to a kernel information leak issue (bsc#1214149).
• CVE-2023-4132: Fixed use-after-free vulnerability was found in the siano smsusb module that allowed a local user to crash the system, causing a denial of service condition (bsc#1213969).
• CVE-2023-4133: Fixed use after free bugs caused by circular dependency problem in cxgb4 (bsc#1213970).
• CVE-2023-4134: Fixed use-after-free in cyttsp4_watchdog_work() (bsc#1213971).
• CVE-2023-4194: Fixed a type confusion in net tun_chr_open() (bsc#1214019).
• CVE-2023-4385: Fixed a NULL pointer dereference flaw in dbFree that may have allowed a local attacker to crash the system due to a missing sanity check (bsc#1214348).
• CVE-2023-4387: Fixed use-after-free flaw in vmxnet3_rq_alloc_rx_buf that could allow a local attacker to crash the system due to a double-free (bsc#1214350).
• CVE-2023-4459: Fixed a NULL pointer dereference flaw in vmxnet3_rq_cleanup that may have allowed a local attacker with normal user privilege to cause a denial of service (bsc#1214451).
• CVE-2023-20588: Fixed a division-by-zero error on some AMD processors that can potentially return speculative data resulting in loss of confidentiality (bsc#1213927).
• CVE-2023-34319: Fixed buffer overrun triggered by unusual packet in xen/netback (XSA-432) (bsc#1213546).
• CVE-2023-40283: Fixed use-after-free in l2cap_sock_ready_cb (bsc#1214233).

The following non-security bugs were fixed:

• ARM: spear: Do not use timer namespace for timer_shutdown() function (bsc#1213970).
• Bluetooth: nokia: fix value check in nokia_bluetooth_serdev_probe() (git-fixes).
• Revert 'scsi: qla2xxx: Fix buffer overrun' (bsc#1214928).
• SUNRPC: always clear XPRT_SOCK_CONNECTING before xprt_clear_connecting on TCP xprt (bsc#1214453).
• af_key: Fix send_acquire race with pfkey_register (git-fixes).
• af_packet: fix data-race in packet_setsockopt / packet_setsockopt (git-fixes).
• af_unix: Fix a data race of sk->sk_receive_queue->qlen (git-fixes).
• arm64: Re-enable support for contiguous hugepages (git-fixes)
• arm64: vdso: Fix clock_getres() for CLOCK_REALTIME (git-fixes)
• bnx2x: fix page fault following EEH recovery (bsc#1214299).
• bonding: Fix a use-after-free problem when bond_sysfs_slave_add() failed (git-fixes).
• bpf, arm64: remove prefetch insn in xadd mapping (git-fixes)
• bpf, arm64: use more scalable stadd over ldxr / stxr loop in xadd (git-fixes)
• bridge: ebtables: do not crash when using dnat target in output chains (git-fixes).
• btrfs-allow-use-of-global-block-reserve-for-balance-.patch: (bsc#1214335).
• btrfs-unset-reloc-control-if-transaction-commit-fail.patch: (bsc#1212051). -…

The SUSE Linux Enterprise 15 SP4 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-2007: Fixed a flaw in the DPT I2O Controller driver that could allow an attacker to escalate privileges and execute arbitrary code in the context of the kernel (bsc#1210448).
• CVE-2023-20588: Fixed a division-by-zero error on some AMD processors that can potentially return speculative data resulting in loss of confidentiality (bsc#1213927).
• CVE-2023-34319: Fixed buffer overrun triggered by unusual packet in xen/netback (XSA-432) (bsc#1213546).
• CVE-2023-3610: Fixed use-after-free vulnerability in nf_tables can be exploited to achieve local privilege escalation (bsc#1213580).
• CVE-2023-37453: Fixed oversight in SuperSpeed initialization (bsc#1213123).
• CVE-2023-3772: Fixed a flaw in XFRM subsystem that may have allowed a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer leading to a possible kernel crash and denial of service (bsc#1213666).
• CVE-2023-3863: Fixed a use-after-free flaw was found in nfc_llcp_find_local that allowed a local user with special privileges to impact a kernel information leak issue (bsc#1213601).
• CVE-2023-4128: Fixed a use-after-free flaw in net/sched/cls_fw.c that allowed a local attacker to perform a local privilege escalation due to incorrect handling of the existing filter, leading to a kernel information leak issue (bsc#1214149).
• CVE-2023-4133: Fixed use after free bugs caused by circular dependency problem in cxgb4 (bsc#1213970).
• CVE-2023-4134: Fixed use-after-free in cyttsp4_watchdog_work() (bsc#1213971).
• CVE-2023-4147: Fixed use-after-free in nf_tables_newrule (bsc#1213968).
• CVE-2023-4194: Fixed a type confusion in net tun_chr_open() (bsc#1214019).
• CVE-2023-4273: Fixed a flaw in the exFAT driver of the Linux kernel that alloawed a local privileged attacker to overflow the kernel stack (bsc#1214120).
• CVE-2023-4387: Fixed use-after-free flaw in vmxnet3_rq_alloc_rx_buf that could allow a local attacker to crash the system due to a double-free (bsc#1214350).
• CVE-2023-4459: Fixed a NULL pointer dereference flaw in vmxnet3_rq_cleanup that may have allowed a local attacker with normal user privilege to cause a denial of service (bsc#1214451).
• CVE-2023-4569: Fixed information leak in nft_set_catchall_flush in net/netfilter/nf_tables_api.c (bsc#1214729).

The following non-security bugs were fixed:

• acpi: processor: perflib: avoid updating frequency qos unnecessarily (git-fixes).
• acpi: processor: perflib: use the 'no limit' frequency qos (git-fixes).
• acpi: x86: s2idle: fix a logic error parsing amd constraints table (git-fixes).
• alsa: ac97: fix possible error value of *rac97 (git-fixes).
• alsa: hda/cs8409: support new dell dolphin variants (git-fixes).
• alsa: hda/realtek - remodified 3k pull low procedure (git-fixes).
• alsa: hda/realtek: add quirk for hp victus 16-d1xxx to enable mute led (git-fixes).
• alsa: hda/realtek: add quirk for mute leds on hp envy x360 15-eu0xxx (git-fixes).
• alsa: hda/realtek: add quirks for hp g11 laptops (git-fixes).
• alsa: hda/realtek: switch dell oasis models to use spi (git-fixes).
• alsa: pcm: fix missing fixup call in compat hw_refine ioctl (git-fixes).
• alsa: usb-audio: add support for mythware xa001au capture and playback interfaces (git-fixes).
• alsa: usb-audio: fix init call orders for uac1 (git-fixes).
• alsa: ymfpci: fix the missing snd_card_free() call at probe error (git-fixes).
• amba: bus: fix refcount leak (git-fixes).
• arm64: dts: imx8mn-var-som: add missing pull-up for onboard phy reset pinmux (git-fixes).
• arm64: dts: qcom: qrb5165-rb5: fix thermal zone conflict (git-fixes).
• arm64: dts: rockchip: disable hs400 for emmc on rock pi 4 (git-fixes).
• arm: dts: imx6dl: prtrvt, prtvt7, prti6q, prtwd2: fix usb related warnings (git-fixes).
• arm: dts: imx6sll: fixup of operating points (git-fixes).
• arm: spear: do not use timer…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-36402: Fixed an integer overflow vulnerability in vmwgfx driver in that allowed a local attacker with a user account on the system to gain privilege, causing a denial of service (bsc#1203517).
• CVE-2023-2007: Fixed a flaw in the DPT I2O Controller driver that could allow an attacker to escalate privileges and execute arbitrary code in the context of the kernel (bsc#1210448).
• CVE-2023-3772: Fixed a flaw in XFRM subsystem that may have allowed a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer leading to a possible kernel crash and denial of service (bsc#1213666).
• CVE-2023-3863: Fixed a use-after-free flaw was found in nfc_llcp_find_local that allowed a local user with special privileges to impact a kernel information leak issue (bsc#1213601).
• CVE-2023-4128: Fixed a use-after-free flaw in net/sched/cls_fw.c that allowed a local attacker to perform a local privilege escalation due to incorrect handling of the existing filter, leading to a kernel information leak issue (bsc#1214149).
• CVE-2023-4132: Fixed use-after-free vulnerability was found in the siano smsusb module that allowed a local user to crash the system, causing a denial of service condition (bsc#1213969).
• CVE-2023-4133: Fixed use after free bugs caused by circular dependency problem in cxgb4 (bsc#1213970).
• CVE-2023-4134: Fixed use-after-free in cyttsp4_watchdog_work() (bsc#1213971).
• CVE-2023-4147: Fixed use-after-free in nf_tables_newrule (bsc#1213968).
• CVE-2023-4194: Fixed a type confusion in net tun_chr_open() (bsc#1214019).
• CVE-2023-4273: Fixed a flaw in the exFAT driver of the Linux kernel that alloawed a local privileged attacker to overflow the kernel stack (bsc#1214120).
• CVE-2023-4385: Fixed a NULL pointer dereference flaw in dbFree that may have allowed a local attacker to crash the system due to a missing sanity check (bsc#1214348).
• CVE-2023-4387: Fixed use-after-free flaw in vmxnet3_rq_alloc_rx_buf that could allow a local attacker to crash the system due to a double-free (bsc#1214350).
• CVE-2023-4459: Fixed a NULL pointer dereference flaw in vmxnet3_rq_cleanup that may have allowed a local attacker with normal user privilege to cause a denial of service (bsc#1214451).
• CVE-2023-20588: Fixed a division-by-zero error on some AMD processors that can potentially return speculative data resulting in loss of confidentiality (bsc#1213927).
• CVE-2023-21400: Fixed several memory corruptions due to improper locking in io_uring (bsc#1213272).
• CVE-2023-34319: Fixed buffer overrun triggered by unusual packet in xen/netback (XSA-432) (bsc#1213546).

The following non-security bugs were fixed:

• ARM: spear: Do not use timer namespace for timer_shutdown() function (bsc#1213970).
• Do not add and remove genksyms ifdefs
• clocksource/drivers/arm_arch_timer: Do not use timer namespace for timer_shutdown() function (bsc#1213970).
• clocksource/drivers/sp804: Do not use timer namespace for timer_shutdown() function (bsc#1213970).
• e1000: Fix fall-through warnings for Clang (jsc#PED-5738).
• e1000: Fix typos in comments (jsc#PED-5738).
• e1000: Remove unnecessary use of kmap_atomic() (jsc#PED-5738).
• e1000: drop unneeded assignment in e1000_set_itr() (jsc#PED-5738).
• e1000: switch to napi_consume_skb() (jsc#PED-5738).
• intel/e1000:fix repeated words in comments (jsc#PED-5738).
• intel: remove checker warning (jsc#PED-5738).
• kabi/severities: Ignore newly added SRSO mitigation functions
• md/raid0: Factor out helper for mapping and submitting a bio (bsc#1213916).
• md/raid0: Fix performance regression for large sequential writes (bsc#1213916).
• net: e1000: remove repeated word 'slot' for e1000_main.c (jsc#PED-5738).
• net: e1000: remove repeated words for e1000_hw.c (jsc#PED-5738).
• powerpc/rtas: block error injection when locked down (bsc#1023051). -…

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-2007: Fixed a flaw in the DPT I2O Controller driver that could allow an attacker to escalate privileges and execute arbitrary code in the context of the kernel (bsc#1210448).
• CVE-2023-3772: Fixed a flaw in XFRM subsystem that may have allowed a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer leading to a possible kernel crash and denial of service (bsc#1213666).
• CVE-2023-3863: Fixed a use-after-free flaw was found in nfc_llcp_find_local that allowed a local user with special privileges to impact a kernel information leak issue (bsc#1213601).
• CVE-2023-4128: Fixed a use-after-free flaw in net/sched/cls_fw.c that allowed a local attacker to perform a local privilege escalation due to incorrect handling of the existing filter, leading to a kernel information leak issue (bsc#1214149).
• CVE-2023-4132: Fixed use-after-free vulnerability was found in the siano smsusb module that allowed a local user to crash the system, causing a denial of service condition (bsc#1213969).
• CVE-2023-4134: Fixed use-after-free in cyttsp4_watchdog_work() (bsc#1213971).
• CVE-2023-4273: Fixed a flaw in the exFAT driver of the Linux kernel that alloawed a local privileged attacker to overflow the kernel stack (bsc#1214120).
• CVE-2023-4385: Fixed a NULL pointer dereference flaw in dbFree that may have allowed a local attacker to crash the system due to a missing sanity check (bsc#1214348).
• CVE-2023-4387: Fixed use-after-free flaw in vmxnet3_rq_alloc_rx_buf that could allow a local attacker to crash the system due to a double-free (bsc#1214350).
• CVE-2023-4459: Fixed a NULL pointer dereference flaw in vmxnet3_rq_cleanup that may have allowed a local attacker with normal user privilege to cause a denial of service (bsc#1214451).
• CVE-2022-36402: Fixed an integer overflow vulnerability in vmwgfx driver in that allowed a local attacker with a user account on the system to gain privilege, causing a denial of service (bsc#1203517).
• CVE-2023-20588: Fixed a division-by-zero error on some AMD processors that can potentially return speculative data resulting in loss of confidentiality (bsc#1213927).
• CVE-2023-21400: Fixed several memory corruptions due to improper locking in io_uring (bsc#1213272).

The following non-security bugs were fixed:

• kabi/severities: Ignore newly added SRSO mitigation functions
• x86/cpu/kvm: Provide UNTRAIN_RET_VM (git-fixes).
• x86/cpu: Cleanup the untrain mess (git-fixes).
• x86/cpu: Rename original retbleed methods (git-fixes).
• x86/cpu: Rename srso_(.*)alias to srso_alias\1 (git-fixes).
• x86/retpoline: Do not clobber RFLAGS during srso_safe_ret() (git-fixes).
• x86/speculation: Add cpu_show_gds() prototype (git-fixes).
• x86/speculation: Mark all Skylake CPUs as vulnerable to GDS (git-fixes).
• x86/srso: Correct the mitigation status when SMT is disabled (git-fixes).
• x86/srso: Disable the mitigation on unaffected configurations (git-fixes).
• x86/srso: Explain the untraining sequences a bit more (git-fixes).
• x86: Move gds_ucode_mitigated() declaration to header (git-fixes).

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-36402: Fixed an integer overflow vulnerability in vmwgfx driver in that allowed a local attacker with a user account on the system to gain privilege, causing a denial of service (bsc#1203517).
• CVE-2023-2007: Fixed a flaw in the DPT I2O Controller driver that could allow an attacker to escalate privileges and execute arbitrary code in the context of the kernel (bsc#1210448).
• CVE-2023-20588: Fixed a division-by-zero error on some AMD processors that can potentially return speculative data resulting in loss of confidentiality (bsc#1213927).
• CVE-2023-34319: Fixed buffer overrun triggered by unusual packet in xen/netback (XSA-432) (bsc#1213546).
• CVE-2023-3772: Fixed a flaw in XFRM subsystem that may have allowed a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer leading to a possible kernel crash and denial of service (bsc#1213666).
• CVE-2023-3812: Fixed an out-of-bounds memory access flaw in the TUN/TAP device driver functionality that could allow a local user to crash or potentially escalate their privileges on the system (bsc#1213543).
• CVE-2023-3863: Fixed a use-after-free flaw was found in nfc_llcp_find_local that allowed a local user with special privileges to impact a kernel information leak issue (bsc#1213601).
• CVE-2023-40283: Fixed use-after-free in l2cap_sock_ready_cb (bsc#1214233).
• CVE-2023-4128: Fixed a use-after-free flaw in net/sched/cls_fw.c that allowed a local attacker to perform a local privilege escalation due to incorrect handling of the existing filter, leading to a kernel information leak issue (bsc#1214149).
• CVE-2023-4132: Fixed use-after-free vulnerability was found in the siano smsusb module that allowed a local user to crash the system, causing a denial of service condition (bsc#1213969).
• CVE-2023-4133: Fixed use after free bugs caused by circular dependency problem in cxgb4 (bsc#1213970).
• CVE-2023-4134: Fixed use-after-free in cyttsp4_watchdog_work() (bsc#1213971).
• CVE-2023-4194: Fixed a type confusion in net tun_chr_open() (bsc#1214019).
• CVE-2023-4385: Fixed a NULL pointer dereference flaw in dbFree that may have allowed a local attacker to crash the system due to a missing sanity check (bsc#1214348).
• CVE-2023-4387: Fixed use-after-free flaw in vmxnet3_rq_alloc_rx_buf that could allow a local attacker to crash the system due to a double-free (bsc#1214350).
• CVE-2023-4459: Fixed a NULL pointer dereference flaw in vmxnet3_rq_cleanup that may have allowed a local attacker with normal user privilege to cause a denial of service (bsc#1214451).

The following non-security bugs were fixed:

• af_key: fix send_acquire race with pfkey_register (git-fixes).
• af_packet: fix data-race in packet_setsockopt / packet_setsockopt (git-fixes).
• af_unix: fix a data race of sk->sk_receive_queue->qlen (git-fixes).
• arm64: re-enable support for contiguous hugepages (git-fixes)
• arm64: vdso: fix clock_getres() for clock_realtime (git-fixes)
• arm: spear: do not use timer namespace for timer_shutdown() function (bsc#1213970).
• bluetooth: nokia: fix value check in nokia_bluetooth_serdev_probe() (git-fixes).
• bnx2x: fix page fault following eeh recovery (bsc#1214299).
• bonding: fix a use-after-free problem when bond_sysfs_slave_add() failed (git-fixes).
• bpf, arm64: remove prefetch insn in xadd mapping (git-fixes)
• bpf, arm64: use more scalable stadd over ldxr / stxr loop in xadd (git-fixes)
• bridge: ebtables: do not crash when using dnat target in output chains (git-fixes).
• btrfs-allow-use-of-global-block-reserve-for-balance (bsc#1214335).
• btrfs-unset-reloc-control-if-transaction-commit-fail (bsc#1212051).
• clocksource/drivers/arm_arch_timer: do not use timer namespace for timer_shutdown() function (bsc#1213970).
• clocksource/drivers/sp804: do not use timer namespace for timer_shutdown() function…

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-36402: Fixed an integer overflow vulnerability in vmwgfx driver in that allowed a local attacker with a user account on the system to gain privilege, causing a denial of service (bsc#1203517).
• CVE-2023-2007: Fixed a flaw in the DPT I2O Controller driver that could allow an attacker to escalate privileges and execute arbitrary code in the context of the kernel (bsc#1210448).
• CVE-2023-3772: Fixed a flaw in XFRM subsystem that may have allowed a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer leading to a possible kernel crash and denial of service (bsc#1213666).
• CVE-2023-3863: Fixed a use-after-free flaw was found in nfc_llcp_find_local that allowed a local user with special privileges to impact a kernel information leak issue (bsc#1213601).
• CVE-2023-4128: Fixed a use-after-free flaw in net/sched/cls_fw.c that allowed a local attacker to perform a local privilege escalation due to incorrect handling of the existing filter, leading to a kernel information leak issue (bsc#1214149).
• CVE-2023-4132: Fixed use-after-free vulnerability was found in the siano smsusb module that allowed a local user to crash the system, causing a denial of service condition (bsc#1213969).
• CVE-2023-4133: Fixed use after free bugs caused by circular dependency problem in cxgb4 (bsc#1213970).
• CVE-2023-4134: Fixed use-after-free in cyttsp4_watchdog_work() (bsc#1213971).
• CVE-2023-4147: Fixed use-after-free in nf_tables_newrule (bsc#1213968).
• CVE-2023-4194: Fixed a type confusion in net tun_chr_open() (bsc#1214019).
• CVE-2023-4273: Fixed a flaw in the exFAT driver of the Linux kernel that alloawed a local privileged attacker to overflow the kernel stack (bsc#1214120).
• CVE-2023-4385: Fixed a NULL pointer dereference flaw in dbFree that may have allowed a local attacker to crash the system due to a missing sanity check (bsc#1214348).
• CVE-2023-4387: Fixed use-after-free flaw in vmxnet3_rq_alloc_rx_buf that could allow a local attacker to crash the system due to a double-free (bsc#1214350).
• CVE-2023-4459: Fixed a NULL pointer dereference flaw in vmxnet3_rq_cleanup that may have allowed a local attacker with normal user privilege to cause a denial of service (bsc#1214451).
• CVE-2023-20588: Fixed a division-by-zero error on some AMD processors that can potentially return speculative data resulting in loss of confidentiality (bsc#1213927).
• CVE-2023-21400: Fixed several memory corruptions due to improper locking in io_uring (bsc#1213272).
• CVE-2023-34319: Fixed buffer overrun triggered by unusual packet in xen/netback (XSA-432) (bsc#1213546).

The following non-security bugs were fixed:

• ARM: spear: Do not use timer namespace for timer_shutdown() function (bsc#1213970).
• Do not add and remove genksyms ifdefs
• clocksource/drivers/arm_arch_timer: Do not use timer namespace for timer_shutdown() function (bsc#1213970).
• clocksource/drivers/sp804: Do not use timer namespace for timer_shutdown() function (bsc#1213970).
• e1000: Fix fall-through warnings for Clang (jsc#PED-5738).
• e1000: Fix typos in comments (jsc#PED-5738).
• e1000: Remove unnecessary use of kmap_atomic() (jsc#PED-5738).
• e1000: drop unneeded assignment in e1000_set_itr() (jsc#PED-5738).
• e1000: switch to napi_consume_skb() (jsc#PED-5738).
• intel/e1000:fix repeated words in comments (jsc#PED-5738).
• intel: remove checker warning (jsc#PED-5738).
• kabi/severities: Ignore newly added SRSO mitigation functions
• md/raid0: Factor out helper for mapping and submitting a bio (bsc#1213916).
• md/raid0: Fix performance regression for large sequential writes (bsc#1213916).
• net: e1000: remove repeated word 'slot' for e1000_main.c (jsc#PED-5738).
• net: e1000: remove repeated words for e1000_hw.c (jsc#PED-5738).
• powerpc/rtas: block error injection when locked down (bsc#1023051). -…

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-2007: Fixed a flaw in the DPT I2O Controller driver that could allow an attacker to escalate privileges and execute arbitrary code in the context of the kernel (bsc#1210448).
• CVE-2023-20588: Fixed a division-by-zero error on some AMD processors that can potentially return speculative data resulting in loss of confidentiality (bsc#1213927).
• CVE-2023-34319: Fixed buffer overrun triggered by unusual packet in xen/netback (XSA-432) (bsc#1213546).
• CVE-2023-3610: Fixed use-after-free vulnerability in nf_tables can be exploited to achieve local privilege escalation (bsc#1213580).
• CVE-2023-37453: Fixed oversight in SuperSpeed initialization (bsc#1213123).
• CVE-2023-3772: Fixed a flaw in XFRM subsystem that may have allowed a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer leading to a possible kernel crash and denial of service (bsc#1213666).
• CVE-2023-3863: Fixed a use-after-free flaw was found in nfc_llcp_find_local that allowed a local user with special privileges to impact a kernel information leak issue (bsc#1213601).
• CVE-2023-4128: Fixed a use-after-free flaw in net/sched/cls_fw.c that allowed a local attacker to perform a local privilege escalation due to incorrect handling of the existing filter, leading to a kernel information leak issue (bsc#1214149).
• CVE-2023-4133: Fixed use after free bugs caused by circular dependency problem in cxgb4 (bsc#1213970).
• CVE-2023-4134: Fixed use-after-free in cyttsp4_watchdog_work() (bsc#1213971).
• CVE-2023-4147: Fixed use-after-free in nf_tables_newrule (bsc#1213968).
• CVE-2023-4194: Fixed a type confusion in net tun_chr_open() (bsc#1214019).
• CVE-2023-4273: Fixed a flaw in the exFAT driver of the Linux kernel that alloawed a local privileged attacker to overflow the kernel stack (bsc#1214120).
• CVE-2023-4387: Fixed use-after-free flaw in vmxnet3_rq_alloc_rx_buf that could allow a local attacker to crash the system due to a double-free (bsc#1214350).
• CVE-2023-4459: Fixed a NULL pointer dereference flaw in vmxnet3_rq_cleanup that may have allowed a local attacker with normal user privilege to cause a denial of service (bsc#1214451).
• CVE-2023-4569: Fixed information leak in nft_set_catchall_flush in net/netfilter/nf_tables_api.c (bsc#1214729).

The following non-security bugs were fixed:

• Drop amdgpu patch causing spamming (bsc#1215523)
• acpi: processor: perflib: avoid updating frequency qos unnecessarily (git-fixes).
• acpi: processor: perflib: use the 'no limit' frequency qos (git-fixes).
• acpi: x86: s2idle: fix a logic error parsing amd constraints table (git-fixes).
• alsa: ac97: fix possible error value of *rac97 (git-fixes).
• alsa: hda/cs8409: support new dell dolphin variants (git-fixes).
• alsa: hda/realtek - remodified 3k pull low procedure (git-fixes).
• alsa: hda/realtek: add quirk for hp victus 16-d1xxx to enable mute led (git-fixes).
• alsa: hda/realtek: add quirk for mute leds on hp envy x360 15-eu0xxx (git-fixes).
• alsa: hda/realtek: add quirks for hp g11 laptops (git-fixes).
• alsa: hda/realtek: switch dell oasis models to use spi (git-fixes).
• alsa: pcm: fix missing fixup call in compat hw_refine ioctl (git-fixes).
• alsa: usb-audio: add support for mythware xa001au capture and playback interfaces (git-fixes).
• alsa: usb-audio: fix init call orders for uac1 (git-fixes).
• alsa: ymfpci: fix the missing snd_card_free() call at probe error (git-fixes).
• amba: bus: fix refcount leak (git-fixes).
• arm64: dts: imx8mn-var-som: add missing pull-up for onboard phy reset pinmux (git-fixes).
• arm64: dts: qcom: qrb5165-rb5: fix thermal zone conflict (git-fixes).
• arm64: dts: rockchip: disable hs400 for emmc on rock pi 4 (git-fixes).
• arm: dts: imx6dl: prtrvt, prtvt7, prti6q, prtwd2: fix usb related warnings (git-fixes).
• arm: dts: imx6sll: fixup of operating points…

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-2007: Fixed a flaw in the DPT I2O Controller driver that could allow an attacker to escalate privileges and execute arbitrary code in the context of the kernel (bsc#1210448).
• CVE-2023-20588: Fixed a division-by-zero error on some AMD processors that can potentially return speculative data resulting in loss of confidentiality (bsc#1213927).
• CVE-2023-34319: Fixed buffer overrun triggered by unusual packet in xen/netback (XSA-432) (bsc#1213546).
• CVE-2023-3610: Fixed use-after-free vulnerability in nf_tables can be exploited to achieve local privilege escalation (bsc#1213580).
• CVE-2023-37453: Fixed oversight in SuperSpeed initialization (bsc#1213123).
• CVE-2023-3772: Fixed a flaw in XFRM subsystem that may have allowed a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer leading to a possible kernel crash and denial of service (bsc#1213666).
• CVE-2023-3863: Fixed a use-after-free flaw was found in nfc_llcp_find_local that allowed a local user with special privileges to impact a kernel information leak issue (bsc#1213601).
• CVE-2023-4128: Fixed a use-after-free flaw in net/sched/cls_fw.c that allowed a local attacker to perform a local privilege escalation due to incorrect handling of the existing filter, leading to a kernel information leak issue (bsc#1214149).
• CVE-2023-4133: Fixed use after free bugs caused by circular dependency problem in cxgb4 (bsc#1213970).
• CVE-2023-4134: Fixed use-after-free in cyttsp4_watchdog_work() (bsc#1213971).
• CVE-2023-4147: Fixed use-after-free in nf_tables_newrule (bsc#1213968).
• CVE-2023-4194: Fixed a type confusion in net tun_chr_open() (bsc#1214019).
• CVE-2023-4273: Fixed a flaw in the exFAT driver of the Linux kernel that alloawed a local privileged attacker to overflow the kernel stack (bsc#1214120).
• CVE-2023-4387: Fixed use-after-free flaw in vmxnet3_rq_alloc_rx_buf that could allow a local attacker to crash the system due to a double-free (bsc#1214350).
• CVE-2023-4459: Fixed a NULL pointer dereference flaw in vmxnet3_rq_cleanup that may have allowed a local attacker with normal user privilege to cause a denial of service (bsc#1214451).
• CVE-2023-4569: Fixed information leak in nft_set_catchall_flush in net/netfilter/nf_tables_api.c (bsc#1214729).

The following non-security bugs were fixed:

• Drop amdgpu patch causing spamming (bsc#1215523)
• acpi: processor: perflib: avoid updating frequency qos unnecessarily (git-fixes).
• acpi: processor: perflib: use the 'no limit' frequency qos (git-fixes).
• acpi: x86: s2idle: fix a logic error parsing amd constraints table (git-fixes).
• alsa: ac97: fix possible error value of *rac97 (git-fixes).
• alsa: hda/cs8409: support new dell dolphin variants (git-fixes).
• alsa: hda/realtek - remodified 3k pull low procedure (git-fixes).
• alsa: hda/realtek: add quirk for hp victus 16-d1xxx to enable mute led (git-fixes).
• alsa: hda/realtek: add quirk for mute leds on hp envy x360 15-eu0xxx (git-fixes).
• alsa: hda/realtek: add quirks for hp g11 laptops (git-fixes).
• alsa: hda/realtek: switch dell oasis models to use spi (git-fixes).
• alsa: pcm: fix missing fixup call in compat hw_refine ioctl (git-fixes).
• alsa: usb-audio: add support for mythware xa001au capture and playback interfaces (git-fixes).
• alsa: usb-audio: fix init call orders for uac1 (git-fixes).
• alsa: ymfpci: fix the missing snd_card_free() call at probe error (git-fixes).
• amba: bus: fix refcount leak (git-fixes).
• arm64: dts: imx8mn-var-som: add missing pull-up for onboard phy reset pinmux (git-fixes).
• arm64: dts: qcom: qrb5165-rb5: fix thermal zone conflict (git-fixes).
• arm64: dts: rockchip: disable hs400 for emmc on rock pi 4 (git-fixes).
• arm: dts: imx6dl: prtrvt, prtvt7, prti6q, prtwd2: fix usb related warnings (git-fixes).
• arm: dts: imx6sll: fixup of operating points…

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-38457: Fixed a use-after-free vulnerability in vmwgfx driver that allowed a local attacker to cause a denial of service (bsc#1203330).
• CVE-2022-40133: Fixed a use-after-free vulnerability in vmwgfx driver that allowed a local attacker to cause a denial of service (bsc#1203329).
• CVE-2023-2007: Fixed a flaw in the DPT I2O Controller driver that could allow an attacker to escalate privileges and execute arbitrary code in the context of the kernel (bsc#1210448).
• CVE-2023-20588: Fixed a division-by-zero error on some AMD processors that can potentially return speculative data resulting in loss of confidentiality (bsc#1213927).
• CVE-2023-34319: Fixed buffer overrun triggered by unusual packet in xen/netback (XSA-432) (bsc#1213546).
• CVE-2023-3610: Fixed use-after-free vulnerability in nf_tables can be exploited to achieve local privilege escalation (bsc#1213580).
• CVE-2023-37453: Fixed oversight in SuperSpeed initialization (bsc#1213123).
• CVE-2023-3772: Fixed a flaw in XFRM subsystem that may have allowed a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer leading to a possible kernel crash and denial of service (bsc#1213666).
• CVE-2023-3863: Fixed a use-after-free flaw was found in nfc_llcp_find_local that allowed a local user with special privileges to impact a kernel information leak issue (bsc#1213601).
• CVE-2023-40283: Fixed use-after-free in l2cap_sock_ready_cb (bsc#1214233).
• CVE-2023-4128: Fixed a use-after-free flaw in net/sched/cls_fw.c that allowed a local attacker to perform a local privilege escalation due to incorrect handling of the existing filter, leading to a kernel information leak issue (bsc#1214149).
• CVE-2023-4133: Fixed use after free bugs caused by circular dependency problem in cxgb4 (bsc#1213970).
• CVE-2023-4134: Fixed use-after-free in cyttsp4_watchdog_work() (bsc#1213971).
• CVE-2023-4147: Fixed use-after-free in nf_tables_newrule (bsc#1213968).
• CVE-2023-4194: Fixed a type confusion in net tun_chr_open() (bsc#1214019).
• CVE-2023-4273: Fixed a flaw in the exFAT driver of the Linux kernel that alloawed a local privileged attacker to overflow the kernel stack (bsc#1214120).
• CVE-2023-4387: Fixed use-after-free flaw in vmxnet3_rq_alloc_rx_buf that could allow a local attacker to crash the system due to a double-free (bsc#1214350).
• CVE-2023-4459: Fixed a NULL pointer dereference flaw in vmxnet3_rq_cleanup that may have allowed a local attacker with normal user privilege to cause a denial of service (bsc#1214451).
• CVE-2023-4563: Fixed use-after-free in nft_verdict_dump due to a race between set GC and transaction (bsc#1214727).
• CVE-2023-4569: Fixed information leak in nft_set_catchall_flush in net/netfilter/nf_tables_api.c (bsc#1214729).

The following non-security bugs were fixed:

• ACPI/IORT: Update SMMUv3 DeviceID support (bsc#1214305).
• ACPI: processor: perflib: Avoid updating frequency QoS unnecessarily (git-fixes).
• ACPI: processor: perflib: Use the 'no limit' frequency QoS (git-fixes).
• ACPI: x86: s2idle: Fix a logic error parsing AMD constraints table (git-fixes).
• ALSA: ac97: Fix possible error value of *rac97 (git-fixes).
• ALSA: hda/cs8409: Support new Dell Dolphin Variants (git-fixes).
• ALSA: hda/realtek - Remodified 3k pull low procedure (git-fixes).
• ALSA: hda/realtek: Add quirk for HP Victus 16-d1xxx to enable mute LED (git-fixes).
• ALSA: hda/realtek: Add quirk for mute LEDs on HP ENVY x360 15-eu0xxx (git-fixes).
• ALSA: hda/realtek: Add quirks for HP G11 Laptops (git-fixes).
• ALSA: hda/realtek: Switch Dell Oasis models to use SPI (git-fixes).
• ALSA: pcm: Fix missing fixup call in compat hw_refine ioctl (git-fixes).
• ALSA: usb-audio: Add support for Mythware XA001AU capture and playback interfaces (git-fixes).
• ALSA: usb-audio: Fix init call orders for UAC1 (git-fixes).
• ALSA:…

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-38457: Fixed a use-after-free vulnerability in vmwgfx driver that allowed a local attacker to cause a denial of service (bsc#1203330).
• CVE-2022-40133: Fixed a use-after-free vulnerability in vmwgfx driver that allowed a local attacker to cause a denial of service (bsc#1203329).
• CVE-2023-1192: Fixed use-after-free in cifs_demultiplex_thread() (bsc#1208995 CVE-2023-1192).
• CVE-2023-1859: Fixed a use-after-free flaw in xen_9pfs_front_removet that could lead to system crash and kernel information leak (bsc#1210169).
• CVE-2023-2007: Fixed a flaw in the DPT I2O Controller driver that could allow an attacker to escalate privileges and execute arbitrary code in the context of the kernel (bsc#1210448).
• CVE-2023-20588: Fixed a division-by-zero error on some AMD processors that can potentially return speculative data resulting in loss of confidentiality (bsc#1213927).
• CVE-2023-2177: Fixed null pointer dereference issue in the sctp network protocol that could lead to system crash or DoS (bsc#1210643).
• CVE-2023-34319: Fixed buffer overrun triggered by unusual packet in xen/netback (XSA-432) (bsc#1213546).
• CVE-2023-3610: Fixed use-after-free vulnerability in nf_tables can be exploited to achieve local privilege escalation (bsc#1213580).
• CVE-2023-37453: Fixed oversight in SuperSpeed initialization (bsc#1213123).
• CVE-2023-3772: Fixed a flaw in XFRM subsystem that may have allowed a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer leading to a possible kernel crash and denial of service (bsc#1213666).
• CVE-2023-3863: Fixed a use-after-free flaw was found in nfc_llcp_find_local that allowed a local user with special privileges to impact a kernel information leak issue (bsc#1213601).
• CVE-2023-40283: Fixed use-after-free in l2cap_sock_ready_cb (bsc#1214233).
• CVE-2023-4128: Fixed a use-after-free flaw in net/sched/cls_fw.c that allowed a local attacker to perform a local privilege escalation due to incorrect handling of the existing filter, leading to a kernel information leak issue (bsc#1214149).
• CVE-2023-4133: Fixed use after free bugs caused by circular dependency problem in cxgb4 (bsc#1213970).
• CVE-2023-4134: Fixed use-after-free in cyttsp4_watchdog_work() (bsc#1213971).
• CVE-2023-4147: Fixed use-after-free in nf_tables_newrule (bsc#1213968).
• CVE-2023-4194: Fixed a type confusion in net tun_chr_open() (bsc#1214019).
• CVE-2023-4273: Fixed a flaw in the exFAT driver of the Linux kernel that alloawed a local privileged attacker to overflow the kernel stack (bsc#1214120).
• CVE-2023-4387: Fixed use-after-free flaw in vmxnet3_rq_alloc_rx_buf that could allow a local attacker to crash the system due to a double-free (bsc#1214350).
• CVE-2023-4459: Fixed a NULL pointer dereference flaw in vmxnet3_rq_cleanup that may have allowed a local attacker with normal user privilege to cause a denial of service (bsc#1214451).
• CVE-2023-4563: Fixed use-after-free in nft_verdict_dump due to a race between set GC and transaction (bsc#1214727).
• CVE-2023-4569: Fixed information leak in nft_set_catchall_flush in net/netfilter/nf_tables_api.c (bsc#1214729).
• CVE-2023-4881: Fixed a out-of-bounds write flaw in the netfilter subsystem that could lead to potential information disclosure or a denial of service (bsc#1215221).

The following non-security bugs were fixed:

• ACPI/IORT: Update SMMUv3 DeviceID support (bsc#1214305).
• ACPI: processor: perflib: Avoid updating frequency QoS unnecessarily (git-fixes).
• ACPI: processor: perflib: Use the 'no limit' frequency QoS (git-fixes).
• ACPI: x86: s2idle: Fix a logic error parsing AMD constraints table (git-fixes).
• ALSA: ac97: Fix possible error value of *rac97 (git-fixes).
• ALSA: hda/cirrus: Fix broken audio on hardware with two CS42L42 codecs (git-fixes).
• ALSA: hda/cs8409: Support new Dell Dolphin…

Daniel Moghimi discovered that some Intel(R) Processors did not properly clear microarchitectural state after speculative execution of various instructions. A local unprivileged user could use this to obtain to sensitive information. (CVE-2022-40982)

Yang Lan discovered that the GFS2 file system implementation in the Linux kernel could attempt to dereference a null pointer in some situations. An attacker could use this to construct a malicious GFS2 image that, when mounted and operated on, could cause a denial of service (system crash). (CVE-2023-3212)

It was discovered that the NET/ROM protocol implementation in the Linux kernel contained a race condition in some situations, leading to a use- after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-32269)

It was discovered that the NFC implementation in the Linux kernel contained a use-after-free vulnerability when performing peer-to-peer communication in certain conditions. A privileged attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information (kernel memory). (CVE-2023-3863)

It was discovered that the bluetooth subsystem in the Linux kernel did not properly handle L2CAP socket release, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-40283)

It was discovered that some network classifier implementations in the Linux kernel contained use-after-free vulnerabilities. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-4128)

It was discovered that the JFS file system implementation in the Linux kernel did not properly validate memory allocations in certain situations, leading to a null pointer dereference vulnerability. An attacker could use this to construct a malicious JFS image that, when mounted, could cause a denial of service (system crash). (CVE-2023-4385)

It was discovered that the VMware VMXNET3 ethernet driver in the Linux kernel contained a use-after-free vulnerability in certain situations. A local attacker in a guest VM could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-4387)

It was discovered that the VMware VMXNET3 ethernet driver in the Linux kernel did not properly handle errors in certain situations, leading to a null pointer dereference vulnerability. A local attacker in a guest VM could use this to cause a denial of service (system crash). (CVE-2023-4459)