CVE-2024-26848

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-26760: Fixed scsi/target/pscsi bio_put() for error case (bsc#1222596).
• CVE-2024-27389: Fixed pstore inode handling with d_invalidate() (bsc#1223705).
• CVE-2024-27062: Fixed nouveau lock inside client object tree (bsc#1223834).
• CVE-2024-27056: Fixed wifi/iwlwifi/mvm to ensure offloading TID queue exists (bsc#1223822).
• CVE-2024-27046: Fixed nfp/flower handling acti_netdevs allocation failure (bsc#1223827).
• CVE-2024-27043: Fixed a use-after-free in edia/dvbdev in different places (bsc#1223824).
• CVE-2024-27041: Fixed drm/amd/display NULL checks for adev->dm.dc in amdgpu_dm_fini() (bsc#1223714).
• CVE-2024-27039: Fixed clk/hisilicon/hi3559a an erroneous devm_kfree() (bsc#1223821).
• CVE-2024-27038: Fixed clk_core_get NULL pointer dereference (bsc#1223816).
• CVE-2024-27030: Fixed octeontx2-af to use separate handlers for interrupts (bsc#1223790).
• CVE-2024-27014: Fixed net/mlx5e to prevent deadlock while disabling aRFS (bsc#1223735).
• CVE-2024-27013: Fixed tun limit printing rate when illegal packet received by tun device (bsc#1223745).
• CVE-2024-26993: Fixed fs/sysfs reference leak in sysfs_break_active_protection() (bsc#1223693).
• CVE-2024-26982: Fixed Squashfs inode number check not to be an invalid value of zero (bsc#1223634).
• CVE-2024-26970: Fixed clk/qcom/gcc-ipq6018 termination of frequency table arrays (bsc#1223644).
• CVE-2024-26969: Fixed clk/qcom/gcc-ipq8074 termination of frequency table arrays (bsc#1223645).
• CVE-2024-26966: Fixed clk/qcom/mmcc-apq8084 termination of frequency table arrays (bsc#1223646).
• CVE-2024-26965: Fixed clk/qcom/mmcc-msm8974 termination of frequency table arrays (bsc#1223648).
• CVE-2024-26960: Fixed mm/swap race between free_swap_and_cache() and swapoff() (bsc#1223655).
• CVE-2024-26951: Fixed wireguard/netlink check for dangling peer via is_dead instead of empty list (bsc#1223660).
• CVE-2024-26950: Fixed wireguard/netlink to access device through ctx instead of peer (bsc#1223661).
• CVE-2024-26948: Fixed drm/amd/display by adding dc_state NULL check in dc_state_release (bsc#1223664).
• CVE-2024-26927: Fixed ASoC/SOF bounds checking to firmware data Smatch (bsc#1223525).
• CVE-2024-26901: Fixed do_sys_name_to_handle() to use kzalloc() to prevent kernel-infoleak (bsc#1223198).
• CVE-2024-26896: Fixed wifi/wfx memory leak when starting AP (bsc#1223042).
• CVE-2024-26893: Fixed firmware/arm_scmi for possible double free in SMC transport cleanup path (bsc#1223196).
• CVE-2024-26885: Fixed bpf DEVMAP_HASH overflow check on 32-bit arches (bsc#1223190).
• CVE-2024-26884: Fixed bpf hashtab overflow check on 32-bit arches (bsc#1223189).
• CVE-2024-26883: Fixed bpf stackmap overflow check on 32-bit arches (bsc#1223035).
• CVE-2024-26882: Fixed net/ip_tunnel to make sure to pull inner header in ip_tunnel_rcv() (bsc#1223034).
• CVE-2024-26881: Fixed net/hns3 kernel crash when 1588 is received on HIP08 devices (bsc#1223041).
• CVE-2024-26879: Fixed clk/meson by adding missing clocks to axg_clk_regmaps (bsc#1223066).
• CVE-2024-26878: Fixed quota for potential NULL pointer dereference (bsc#1223060).
• CVE-2024-26866: Fixed spi/spi-fsl-lpspi by removing redundant spi_controller_put call (bsc#1223024).
• CVE-2024-26862: Fixed packet annotate data-races around ignore_outgoing (bsc#1223111).
• CVE-2024-26861: Fixed wireguard/receive annotate data-race around receiving_counter.counter (bsc#1223076).
• CVE-2024-26857: Fixed geneve to make sure to pull inner header in geneve_rx() (bsc#1223058).
• CVE-2024-26856: Fixed use-after-free inside sparx5_del_mact_entry (bsc#1223052).
• CVE-2024-26855: Fixed net/ice potential NULL pointer dereference in ice_bridge_setlink() (bsc#1223051).
• CVE-2024-26853: Fixed igc returning frame twice in XDP_REDIRECT (bsc#1223061).
• CVE-2024-26852: Fixed net/ipv6 to avoid possible UAF in ip6_route_mpath_notify()…

The SUSE Linux Enterprise 15 SP5 Real Time kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-27389: Fixed pstore inode handling with d_invalidate() (bsc#1223705).
• CVE-2024-27062: Fixed nouveau lock inside client object tree (bsc#1223834).
• CVE-2024-27056: Fixed wifi/iwlwifi/mvm to ensure offloading TID queue exists (bsc#1223822).
• CVE-2024-27046: Fixed nfp/flower handling acti_netdevs allocation failure (bsc#1223827).
• CVE-2024-27043: Fixed a use-after-free in edia/dvbdev in different places (bsc#1223824).
• CVE-2024-27041: Fixed drm/amd/display NULL checks for adev->dm.dc in amdgpu_dm_fini() (bsc#1223714).
• CVE-2024-27039: Fixed clk/hisilicon/hi3559a an erroneous devm_kfree() (bsc#1223821).
• CVE-2024-27038: Fixed clk_core_get NULL pointer dereference (bsc#1223816).
• CVE-2024-27030: Fixed octeontx2-af to use separate handlers for interrupts (bsc#1223790).
• CVE-2024-27014: Fixed net/mlx5e to prevent deadlock while disabling aRFS (bsc#1223735).
• CVE-2024-27013: Fixed tun limit printing rate when illegal packet received by tun device (bsc#1223745).
• CVE-2024-26993: Fixed fs/sysfs reference leak in sysfs_break_active_protection() (bsc#1223693).
• CVE-2024-26982: Fixed Squashfs inode number check not to be an invalid value of zero (bsc#1223634).
• CVE-2024-26970: Fixed clk/qcom/gcc-ipq6018 termination of frequency table arrays (bsc#1223644).
• CVE-2024-26969: Fixed clk/qcom/gcc-ipq8074 termination of frequency table arrays (bsc#1223645).
• CVE-2024-26966: Fixed clk/qcom/mmcc-apq8084 termination of frequency table arrays (bsc#1223646).
• CVE-2024-26965: Fixed clk/qcom/mmcc-msm8974 termination of frequency table arrays (bsc#1223648).
• CVE-2024-26960: Fixed mm/swap race between free_swap_and_cache() and swapoff() (bsc#1223655).
• CVE-2024-26951: Fixed wireguard/netlink check for dangling peer via is_dead instead of empty list (bsc#1223660).
• CVE-2024-26950: Fixed wireguard/netlink to access device through ctx instead of peer (bsc#1223661).
• CVE-2024-26948: Fixed drm/amd/display by adding dc_state NULL check in dc_state_release (bsc#1223664).
• CVE-2024-26927: Fixed ASoC/SOF bounds checking to firmware data Smatch (bsc#1223525).
• CVE-2024-26901: Fixed do_sys_name_to_handle() to use kzalloc() to prevent kernel-infoleak (bsc#1223198).
• CVE-2024-26896: Fixed wifi/wfx memory leak when starting AP (bsc#1223042).
• CVE-2024-26893: Fixed firmware/arm_scmi for possible double free in SMC transport cleanup path (bsc#1223196).
• CVE-2024-26885: Fixed bpf DEVMAP_HASH overflow check on 32-bit arches (bsc#1223190).
• CVE-2024-26884: Fixed bpf hashtab overflow check on 32-bit arches (bsc#1223189).
• CVE-2024-26883: Fixed bpf stackmap overflow check on 32-bit arches (bsc#1223035).
• CVE-2024-26882: Fixed net/ip_tunnel to make sure to pull inner header in ip_tunnel_rcv() (bsc#1223034).
• CVE-2024-26881: Fixed net/hns3 kernel crash when 1588 is received on HIP08 devices (bsc#1223041).
• CVE-2024-26879: Fixed clk/meson by adding missing clocks to axg_clk_regmaps (bsc#1223066).
• CVE-2024-26878: Fixed quota for potential NULL pointer dereference (bsc#1223060).
• CVE-2024-26866: Fixed spi/spi-fsl-lpspi by removing redundant spi_controller_put call (bsc#1223024).
• CVE-2024-26862: Fixed packet annotate data-races around ignore_outgoing (bsc#1223111).
• CVE-2024-26861: Fixed wireguard/receive annotate data-race around receiving_counter.counter (bsc#1223076).
• CVE-2024-26857: Fixed geneve to make sure to pull inner header in geneve_rx() (bsc#1223058).
• CVE-2024-26856: Fixed use-after-free inside sparx5_del_mact_entry (bsc#1223052).
• CVE-2024-26855: Fixed net/ice potential NULL pointer dereference in ice_bridge_setlink() (bsc#1223051).
• CVE-2024-26853: Fixed igc returning frame twice in XDP_REDIRECT (bsc#1223061).
• CVE-2024-26852: Fixed net/ipv6 to avoid possible UAF in ip6_route_mpath_notify() (bsc#1223057).
• CVE-2024-26848: Fixed afs endless loop in directory parsing…

The SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-22099: Fixed a null-pointer-dereference in rfcomm_check_security (bsc#1219170).
• CVE-2024-26764: Fixed IOCB_AIO_RW check in fs/aio before the struct aio_kiocb conversion (bsc#1222721).
• CVE-2024-26862: Fixed packet annotate data-races around ignore_outgoing (bsc#1223111).
• CVE-2024-26673: Fixed netfilter/nft_ct layer 3 and 4 protocol sanitization (bsc#1222368).
• CVE-2023-0160: Fixed deadlock flaw in BPF that could allow a local user to potentially crash the system (bsc#1209657).
• CVE-2024-26993: Fixed fs/sysfs reference leak in sysfs_break_active_protection() (bsc#1223693).
• CVE-2024-27013: Fixed tun limit printing rate when illegal packet received by tun device (bsc#1223745).
• CVE-2024-27014: Fixed net/mlx5e to prevent deadlock while disabling aRFS (bsc#1223735).
• CVE-2024-26948: Fixed drm/amd/display by adding dc_state NULL check in dc_state_release (bsc#1223664).
• CVE-2024-27056: Fixed wifi/iwlwifi/mvm to ensure offloading TID queue exists (bsc#1223822).
• CVE-2024-26960: Fixed mm/swap race between free_swap_and_cache() and swapoff() (bsc#1223655).
• CVE-2023-52652: Fixed NTB for possible name leak in ntb_register_device() (bsc#1223686).
• CVE-2024-23848: Fixed media/cec for possible use-after-free in cec_queue_msg_fh (bsc#1219104).
• CVE-2024-26982: Fixed Squashfs inode number check not to be an invalid value of zero (bsc#1223634).
• CVE-2024-26878: Fixed quota for potential NULL pointer dereference (bsc#1223060).
• CVE-2024-26901: Fixed do_sys_name_to_handle() to use kzalloc() to prevent kernel-infoleak (bsc#1223198).
• CVE-2024-26671: Fixed blk-mq IO hang from sbitmap wakeup race (bsc#1222357).
• CVE-2024-26772: Fixed ext4 to avoid allocating blocks from corrupted group in ext4_mb_find_by_goal() (bsc#1222613).
• CVE-2024-26906: Disallowed vsyscall page read for copy_from_kernel_nofault() (bsc#1223202).
• CVE-2024-26816: Ignore relocations in .notes section when building with CONFIG_XEN_PV=y (bsc#1222624).
• CVE-2024-26783: Fixed mm/vmscan bug when calling wakeup_kswapd() with a wrong zone index (bsc#1222615).
• CVE-2024-26883: Fixed bpf stackmap overflow check on 32-bit arches (bsc#1223035).
• CVE-2024-26884: Fixed bpf hashtab overflow check on 32-bit arches (bsc#1223189).
• CVE-2024-26885: Fixed bpf DEVMAP_HASH overflow check on 32-bit arches (bsc#1223190).
• CVE-2024-26882: Fixed net/ip_tunnel to make sure to pull inner header in ip_tunnel_rcv() (bsc#1223034).
• CVE-2023-52645: Fixed pmdomain/mediatek race conditions with genpd (bsc#1223033).
• CVE-2024-26836: Fixed platform/x86/think-lmi password opcode ordering for workstations (bsc#1222968).
• CVE-2024-26601: Fixed ext4 buddy bitmap corruption via fast commit replay (bsc#1220342).
• CVE-2024-26773: Fixed ext4 block allocation from corrupted group in ext4_mb_try_best_found() (bsc#1222618).
• CVE-2024-26807: Fixed spi/cadence-qspi NULL pointer reference in runtime PM hooks (bsc#1222801).
• CVE-2024-26737: Fixed selftests/bpf racing between bpf_timer_cancel_and_free and bpf_timer_cancel (bsc#1222557).
• CVE-2024-26733: Fixed an overflow in arp_req_get() in arp (bsc#1222585).
• CVE-2024-26684: Fixed net/stmmac/xgmac handling of DPP safety error for DMA channels (bsc#1222445).
• CVE-2024-26704: Fixed a double-free of blocks due to wrong extents moved_len in ext4 (bsc#1222422).
• CVE-2023-52591: Fixed a possible reiserfs filesystem corruption via directory renaming (bsc#1221044).
• CVE-2023-52503: Fixed tee/amdtee use-after-free vulnerability in amdtee_close_session (bsc#1220915).
• CVE-2024-26642: Fixed the set of anonymous timeout flag in netfilter nf_tables (bsc#1221830).
• CVE-2024-26614: Fixed the initialization of accept_queue's spinlocks (bsc#1221293).
• CVE-2024-25739: Fixed possible crash in create_empty_lvol() in drivers/mtd/ubi/vtbl.c (bsc#1219834).
• CVE-2023-6270: Fixed a use-after-free issue in…

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Ziming Zhang discovered that the DRM driver for VMware Virtual GPU did not properly handle certain error conditions, leading to a NULL pointer dereference. A local attacker could possibly trigger this vulnerability to cause a denial of service. (CVE-2022-38096)

Zheng Wang discovered that the Broadcom FullMAC WLAN driver in the Linux kernel contained a race condition during device removal, leading to a use- after-free vulnerability. A physically proximate attacker could possibly use this to cause a denial of service (system crash). (CVE-2023-47233)

It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2023-6270)

It was discovered that the Atheros 802.11ac wireless driver did not properly validate certain data structures, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service. (CVE-2023-7042)

It was discovered that the Intel Data Streaming and Intel Analytics Accelerator drivers in the Linux kernel allowed direct access to the devices for unprivileged users and virtual machines. A local attacker could use this to cause a denial of service. (CVE-2024-21823)

Gui-Dong Han discovered that the software RAID driver in the Linux kernel contained a race condition, leading to an integer overflow vulnerability. A privileged attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-23307)

Bai Jiaju discovered that the Xceive XC4000 silicon tuner device driver in the Linux kernel contained a race condition, leading to an integer overflow vulnerability. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-24861)

Chenyuan Yang discovered that the Unsorted Block Images (UBI) flash device volume management subsystem did not properly validate logical eraseblock sizes in certain situations. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-25739)

It was discovered that the MediaTek SoC Gigabit Ethernet driver in the Linux kernel contained a race condition when stopping the device. A local attacker could possibly use this to cause a denial of service (device unavailability). (CVE-2024-27432)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• PowerPC architecture;
• x86 architecture;
• Block layer subsystem;
• ACPI drivers;
• Bluetooth drivers;
• Clock framework and drivers;
• CPU frequency scaling framework;
• Cryptographic API;
• DPLL subsystem;
• ARM SCMI message protocol;
• EFI core;
• GPU drivers;
• InfiniBand drivers;
• IOMMU subsystem;
• LED subsystem;
• Multiple devices driver;
• Media drivers;
• MMC subsystem;
• Network drivers;
• NTB driver;
• NVME drivers;
• PCI subsystem;
• Powercap sysfs driver;
• SCSI drivers;
• Freescale SoC drivers;
• SPI subsystem;
• Media staging drivers;
• Thermal drivers;
• TTY drivers;
• USB subsystem;
• DesignWare USB3 driver;
• VFIO drivers;
• Backlight driver;
• Virtio drivers;
• Xen hypervisor drivers;
• AFS file system;
• File systems infrastructure;
• BTRFS file system;
• debug file system;
• Ext4 file system;
• F2FS file system;
• FAT file system;
• Network file system client;
• NILFS2 file system;
• Overlay file system;
• Pstore file system;
• Diskquota system;
• SMB network file system;
• UBI file system;
• io_uring subsystem;
• BPF subsystem;
• Core kernel;
• Memory management;
• Bluetooth subsystem;
• Networking core;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• IEEE 802.15.4 subsystem;
• Netfilter;
• Packet sockets;
• Network…

Ziming Zhang discovered that the DRM driver for VMware Virtual GPU did not properly handle certain error conditions, leading to a NULL pointer dereference. A local attacker could possibly trigger this vulnerability to cause a denial of service. (CVE-2022-38096)

Zheng Wang discovered that the Broadcom FullMAC WLAN driver in the Linux kernel contained a race condition during device removal, leading to a use- after-free vulnerability. A physically proximate attacker could possibly use this to cause a denial of service (system crash). (CVE-2023-47233)

It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2023-6270)

It was discovered that the Atheros 802.11ac wireless driver did not properly validate certain data structures, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service. (CVE-2023-7042)

Gui-Dong Han discovered that the software RAID driver in the Linux kernel contained a race condition, leading to an integer overflow vulnerability. A privileged attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-23307)

Bai Jiaju discovered that the Xceive XC4000 silicon tuner device driver in the Linux kernel contained a race condition, leading to an integer overflow vulnerability. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-24861)

Chenyuan Yang discovered that the Unsorted Block Images (UBI) flash device volume management subsystem did not properly validate logical eraseblock sizes in certain situations. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-25739)

It was discovered that the MediaTek SoC Gigabit Ethernet driver in the Linux kernel contained a race condition when stopping the device. A local attacker could possibly use this to cause a denial of service (device unavailability). (CVE-2024-27432)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• PowerPC architecture;
• x86 architecture;
• Block layer subsystem;
• ACPI drivers;
• Bluetooth drivers;
• Clock framework and drivers;
• CPU frequency scaling framework;
• Cryptographic API;
• DPLL subsystem;
• ARM SCMI message protocol;
• EFI core;
• GPU drivers;
• InfiniBand drivers;
• IOMMU subsystem;
• LED subsystem;
• Multiple devices driver;
• Media drivers;
• MMC subsystem;
• Network drivers;
• NTB driver;
• NVME drivers;
• PCI subsystem;
• Powercap sysfs driver;
• SCSI drivers;
• Freescale SoC drivers;
• SPI subsystem;
• Media staging drivers;
• Thermal drivers;
• TTY drivers;
• USB subsystem;
• DesignWare USB3 driver;
• VFIO drivers;
• Backlight driver;
• Virtio drivers;
• Xen hypervisor drivers;
• AFS file system;
• File systems infrastructure;
• BTRFS file system;
• debug file system;
• Ext4 file system;
• F2FS file system;
• FAT file system;
• Network file system client;
• NILFS2 file system;
• Overlay file system;
• Pstore file system;
• Diskquota system;
• SMB network file system;
• UBI file system;
• io_uring subsystem;
• BPF subsystem;
• Core kernel;
• Memory management;
• Bluetooth subsystem;
• Networking core;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• IEEE 802.15.4 subsystem;
• Netfilter;
• Packet sockets;
• Network traffic control;
• Sun RPC protocol;
• ALSA SH drivers;
• SOF drivers;
• USB sound devices;
• KVM core; (CVE-2024-26859, CVE-2024-26944, CVE-2024-27049, CVE-2024-26868, CVE-2024-26932, CVE-2024-35843, CVE-2024-35814, CVE-2024-26866, CVE-2024-26941, CVE-2024-27080,…