CVE-2023-3090

A heap out-of-bounds write vulnerability in the Linux Kernel ipvlan network driver can be exploited to achieve local privilege escalation.

The out-of-bounds write is caused by missing skb->cb initialization in the ipvlan network driver. The vulnerability is reachable if CONFIG_IPVLAN is enabled.

We recommend upgrading past commit 90cbed5247439a966b645b34eb0a2e037836ea8e.

A heap out-of-bounds write vulnerability in the Linux Kernel ipvlan network driver can be exploited to achieve local privilege escalation. The out-of-bounds write is caused by missing skb->cb initialization in the ipvlan network driver. The vulnerability is reachable if CONFIG_IPVLAN is enabled. We recommend upgrading past commit 90cbed5247439a966b645b34eb0a2e037836ea8e.

The Linux Kernel, the operating system core itself.

Security Fix(es):

A time-of-check to time-of-use issue exists in io_uring subsystem's IORING_OP_CLOSE operation in the Linux kernel's versions 5.6 - 5.11 (inclusive), which allows a local user to elevate their privileges to root. Introduced in b5dba59e0cf7e2cc4d3b3b1ac5fe81ddf21959eb, patched in 9eac1904d3364254d622bf2c771c4f85cd435fc2, backported to stable in 788d0824269bef539fe31a785b1517882eafed93.(CVE-2023-1295)

A heap out-of-bounds write vulnerability in the Linux Kernel ipvlan network driver can be exploited to achieve local privilege escalation.

The out-of-bounds write is caused by missing skb->cb initialization in the ipvlan network driver. The vulnerability is reachable if CONFIG_IPVLAN is enabled.

We recommend upgrading past commit 90cbed5247439a966b645b34eb0a2e037836ea8e.

(CVE-2023-3090)

A use-after-free flaw was found in the Netfilter subsystem of the Linux kernel when processing named and anonymous sets in batch requests, which can lead to performing arbitrary reads and writes in kernel memory. This flaw allows a local user with CAP_NET_ADMIN capability to crash or potentially escalate their privileges on the system.(CVE-2023-3117)

Linux Kernel nftables Use-After-Free Local Privilege Escalation Vulnerability; nft_chain_lookup_byid() failed to check whether a chain was active and CAP_NET_ADMIN is in any user or network namespace(CVE-2023-31248)

An issue was discovered in the Linux kernel through 6.1-rc8. dpu_crtc_atomic_check in drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c lacks check of the return value of kzalloc() and will cause the NULL Pointer Dereference.(CVE-2023-3220)

A flaw null pointer dereference in the Linux kernel DECnet networking protocol was found. A remote user could use this flaw to crash the system.(CVE-2023-3338)

A null pointer dereference was found in the Linux kernel's Integrated Sensor Hub (ISH) driver. This issue could allow a local user to crash the system.(CVE-2023-3358)

The Linux Kernel, the operating system core itself.

Security Fix(es):

A time-of-check to time-of-use issue exists in io_uring subsystem's IORING_OP_CLOSE operation in the Linux kernel's versions 5.6 - 5.11 (inclusive), which allows a local user to elevate their privileges to root. Introduced in b5dba59e0cf7e2cc4d3b3b1ac5fe81ddf21959eb, patched in 9eac1904d3364254d622bf2c771c4f85cd435fc2, backported to stable in 788d0824269bef539fe31a785b1517882eafed93.(CVE-2023-1295)

A heap out-of-bounds write vulnerability in the Linux Kernel ipvlan network driver can be exploited to achieve local privilege escalation.

The out-of-bounds write is caused by missing skb->cb initialization in the ipvlan network driver. The vulnerability is reachable if CONFIG_IPVLAN is enabled.

We recommend upgrading past commit 90cbed5247439a966b645b34eb0a2e037836ea8e.

(CVE-2023-3090)

A use-after-free flaw was found in the Netfilter subsystem of the Linux kernel when processing named and anonymous sets in batch requests, which can lead to performing arbitrary reads and writes in kernel memory. This flaw allows a local user with CAP_NET_ADMIN capability to crash or potentially escalate their privileges on the system.(CVE-2023-3117)

Linux Kernel nftables Use-After-Free Local Privilege Escalation Vulnerability; nft_chain_lookup_byid() failed to check whether a chain was active and CAP_NET_ADMIN is in any user or network namespace(CVE-2023-31248)

An issue was discovered in the Linux kernel through 6.1-rc8. dpu_crtc_atomic_check in drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c lacks check of the return value of kzalloc() and will cause the NULL Pointer Dereference.(CVE-2023-3220)

A flaw null pointer dereference in the Linux kernel DECnet networking protocol was found. A remote user could use this flaw to crash the system.(CVE-2023-3338)

A null pointer dereference was found in the Linux kernel's Integrated Sensor Hub (ISH) driver. This issue could allow a local user to crash the system.(CVE-2023-3358)

The Linux Kernel, the operating system core itself.

Security Fix(es):

A heap out-of-bounds write vulnerability in the Linux Kernel ipvlan network driver can be exploited to achieve local privilege escalation.

The out-of-bounds write is caused by missing skb->cb initialization in the ipvlan network driver. The vulnerability is reachable if CONFIG_IPVLAN is enabled.

We recommend upgrading past commit 90cbed5247439a966b645b34eb0a2e037836ea8e.

(CVE-2023-3090)

A use-after-free flaw was found in the Netfilter subsystem of the Linux kernel when processing named and anonymous sets in batch requests, which can lead to performing arbitrary reads and writes in kernel memory. This flaw allows a local user with CAP_NET_ADMIN capability to crash or potentially escalate their privileges on the system.(CVE-2023-3117)

Linux Kernel nftables Use-After-Free Local Privilege Escalation Vulnerability; nft_chain_lookup_byid() failed to check whether a chain was active and CAP_NET_ADMIN is in any user or network namespace(CVE-2023-31248)

An issue was discovered in the Linux kernel through 6.1-rc8. dpu_crtc_atomic_check in drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c lacks check of the return value of kzalloc() and will cause the NULL Pointer Dereference.(CVE-2023-3220)

A flaw null pointer dereference in the Linux kernel DECnet networking protocol was found. A remote user could use this flaw to crash the system.(CVE-2023-3338)

A null pointer dereference was found in the Linux kernel's Integrated Sensor Hub (ISH) driver. This issue could allow a local user to crash the system.(CVE-2023-3358)

The Linux Kernel, the operating system core itself.

Security Fix(es):

A time-of-check to time-of-use issue exists in io_uring subsystem's IORING_OP_CLOSE operation in the Linux kernel's versions 5.6 - 5.11 (inclusive), which allows a local user to elevate their privileges to root. Introduced in b5dba59e0cf7e2cc4d3b3b1ac5fe81ddf21959eb, patched in 9eac1904d3364254d622bf2c771c4f85cd435fc2, backported to stable in 788d0824269bef539fe31a785b1517882eafed93.(CVE-2023-1295)

A heap out-of-bounds write vulnerability in the Linux Kernel ipvlan network driver can be exploited to achieve local privilege escalation.

The out-of-bounds write is caused by missing skb->cb initialization in the ipvlan network driver. The vulnerability is reachable if CONFIG_IPVLAN is enabled.

We recommend upgrading past commit 90cbed5247439a966b645b34eb0a2e037836ea8e.

(CVE-2023-3090)

A use-after-free flaw was found in the Netfilter subsystem of the Linux kernel when processing named and anonymous sets in batch requests, which can lead to performing arbitrary reads and writes in kernel memory. This flaw allows a local user with CAP_NET_ADMIN capability to crash or potentially escalate their privileges on the system.(CVE-2023-3117)

An issue was discovered in the Linux kernel through 6.1-rc8. dpu_crtc_atomic_check in drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c lacks check of the return value of kzalloc() and will cause the NULL Pointer Dereference.(CVE-2023-3220)

A flaw null pointer dereference in the Linux kernel DECnet networking protocol was found. A remote user could use this flaw to crash the system.(CVE-2023-3338)

A null pointer dereference was found in the Linux kernel's Integrated Sensor Hub (ISH) driver. This issue could allow a local user to crash the system.(CVE-2023-3358)

The Linux Kernel, the operating system core itself.

Security Fix(es):

A time-of-check to time-of-use issue exists in io_uring subsystem's IORING_OP_CLOSE operation in the Linux kernel's versions 5.6 - 5.11 (inclusive), which allows a local user to elevate their privileges to root. Introduced in b5dba59e0cf7e2cc4d3b3b1ac5fe81ddf21959eb, patched in 9eac1904d3364254d622bf2c771c4f85cd435fc2, backported to stable in 788d0824269bef539fe31a785b1517882eafed93.(CVE-2023-1295)

A heap out-of-bounds write vulnerability in the Linux Kernel ipvlan network driver can be exploited to achieve local privilege escalation.

The out-of-bounds write is caused by missing skb->cb initialization in the ipvlan network driver. The vulnerability is reachable if CONFIG_IPVLAN is enabled.

We recommend upgrading past commit 90cbed5247439a966b645b34eb0a2e037836ea8e.

(CVE-2023-3090)

A use-after-free flaw was found in the Netfilter subsystem of the Linux kernel when processing named and anonymous sets in batch requests, which can lead to performing arbitrary reads and writes in kernel memory. This flaw allows a local user with CAP_NET_ADMIN capability to crash or potentially escalate their privileges on the system.(CVE-2023-3117)

An issue was discovered in the Linux kernel through 6.1-rc8. dpu_crtc_atomic_check in drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c lacks check of the return value of kzalloc() and will cause the NULL Pointer Dereference.(CVE-2023-3220)

A flaw null pointer dereference in the Linux kernel DECnet networking protocol was found. A remote user could use this flaw to crash the system.(CVE-2023-3338)

A null pointer dereference was found in the Linux kernel's Integrated Sensor Hub (ISH) driver. This issue could allow a local user to crash the system.(CVE-2023-3358)

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

tipc: fix the msg->req tlv len check in tipc_nl_compat_name_table_dump_header

This is a follow-up for commit 974cb0e3e7c9 ("tipc: fix uninit-value in tipc_nl_compat_name_table_dump") where it should have type casted sizeof(..) to int to work when TLV_GET_DATA_LEN() returns a negative value.

syzbot reported a call trace because of it:

BUG: KMSAN: uninit-value in ... tipc_nl_compat_name_table_dump+0x841/0xea0 net/tipc/netlink_compat.c:934 __tipc_nl_compat_dumpit+0xab2/0x1320 net/tipc/netlink_compat.c:238 tipc_nl_compat_dumpit+0x991/0xb50 net/tipc/netlink_compat.c:321 tipc_nl_compat_recv+0xb6e/0x1640 net/tipc/netlink_compat.c:1324 genl_family_rcv_msg_doit net/netlink/genetlink.c:731 [inline] genl_family_rcv_msg net/netlink/genetlink.c:775 [inline] genl_rcv_msg+0x103f/0x1260 net/netlink/genetlink.c:792 netlink_rcv_skb+0x3a5/0x6c0 net/netlink/af_netlink.c:2501 genl_rcv+0x3c/0x50 net/netlink/genetlink.c:803 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0xf3b/0x1270 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x1288/0x1440 net/netlink/af_netlink.c:1921 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg net/socket.c:734 inline

In the Linux kernel, the following vulnerability has been resolved:

net: tun: Fix memory leaks of napi_get_frags

kmemleak reports after running test_progs:

unreferenced object 0xffff8881b1672dc0 (size 232): comm "test_progs", pid 394388, jiffies 4354712116 (age 841.975s) hex dump (first 32 bytes): e0 84 d7 a8 81 88 ff ff 80 2c 67 b1 81 88 ff ff .........,g..... 00 40 c5 9b 81 88 ff ff 00 00 00 00 00 00 00 00 .@.............. backtrace: [<00000000c8f01748>] napi_skb_cache_get+0xd4/0x150 [<0000000041c7fc09>] __napi_build_skb+0x15/0x50 [<00000000431c7079>] __napi_alloc_skb+0x26e/0x540 [<000000003ecfa30e>] napi_get_frags+0x59/0x140 [<0000000099b2199e>] tun_get_user+0x183d/0x3bb0 [tun] [<000000008a5adef0>] tun_chr_write_iter+0xc0/0x1b1 [tun] [<0000000049993ff4>] do_iter_readv_writev+0x19f/0x320 [<000000008f338ea2>] do_iter_write+0x135/0x630 [<000000008a3377a4>] vfs_writev+0x12e/0x440 [<00000000a6b5639a>] do_writev+0x104/0x280 [<00000000ccf065d8>] do_syscall_64+0x3b/0x90 [<00000000d776e329>] entry_SYSCALL_64_after_hwframe+0x63/0xcd

The issue occurs in the following scenarios: tun_get_user() napi_gro_frags() napi_frags_finish() case GRO_NORMAL: gro_normal_one() list_add_tail(&skb->list, &napi->rx_list); <-- While napi->rx_count < READ_ONCE(gro_normal_batch), <-- gro_normal_list() is not called, napi->rx_list is not empty <-- not ask to complete the gro work, will cause memory leaks in <-- following tun_napi_del() ... tun_napi_del() netif_napi_del() __netif_napi_del() <-- &napi->rx_list is not empty, which caused memory leaks

To fix, add napi_complete() after napi_gro_frags().(CVE-2022-49871)

In the Linux kernel, the following vulnerability has been resolved:

wifi: cfg80211: fix memory leak in query_regdb_file()

In the function query_regdb_file() the alpha2 parameter is duplicated using kmemdup() and subsequently freed in regdb_fw_cb(). However, request_firmware_nowait() can fail without calling regdb_fw_cb() and thus leak memory.(CVE-2022-49881)

In the Linux kernel, the following vulnerability has been resolved:

net: mdio: fix undefined behavior in bit shift for __mdiobus_register

Shifting signed 32-bit value by 31 bits is undefined, so changing significant bit to unsigned. The UBSAN warning calltrace like below:

UBSAN: shift-out-of-bounds in drivers/net/phy/mdio_bus.c:586:27 left shift of 1 by 31…

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: ipvlan: out-of-bounds write caused by unclear skb->cb (CVE-2023-3090)

• kernel: cls_flower: out-of-bounds write in fl_set_geneve_opt() (CVE-2023-35788)

• kernel: KVM: x86/mmu: race condition in direct_page_fault() (CVE-2022-45869)

• kernel: speculative pointer dereference in do_prlimit() in kernel/sys.c (CVE-2023-0458)

• kernel: Spectre v2 SMT mitigations problem (CVE-2023-1998)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Rocky Linux9 rt: blktests block/024 failed (BZ#2209920)

• Backport pinned timers RT specific behavior for FIFO tasks (BZ#2210071)

• kernel-rt: update RT source tree to the Rocky Linux-9.2z2 source tree (BZ#2215122)

• kernel-rt: update RT source tree to the Rocky Linux-9.2z2b source tree (BZ#2222796)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: ipvlan: out-of-bounds write caused by unclear skb->cb (CVE-2023-3090)

• kernel: UAF in nftables when nft_set_lookup_global triggered after handling named and anonymous sets in batch requests (CVE-2023-3390)

• kernel: net/sched: cls_fw component can be exploited as result of failure in tcf_change_indev function (CVE-2023-3776)

• kernel: netfilter: use-after-free due to improper element removal in nft_pipapo_remove() (CVE-2023-4004)

• kernel: nf_tables: stack-out-of-bounds-read in nft_byteorder_eval() (CVE-2023-35001)

• kernel: cls_flower: out-of-bounds write in fl_set_geneve_opt() (CVE-2023-35788)

• kernel: bluetooth: Unauthorized management command execution (CVE-2023-2002)

• hw: amd: Cross-Process Information Leak (CVE-2023-20593)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• low memory deadlock with md devices and external (imsm) metadata handling - requires a kernfs notification backport (BZ#2208540)

• Intel 8.9 BUG, SPR EMR FHF ACPI: Fix system hang during S3 wakeup (BZ#2218025)

• OCS 4.8, cephfs kernel crash: mds_dispatch ceph_handle_snap unable to handle kernel NULL (BZ#2218271)

• st_gmac: tx-checksum offload on vlan is not consistent with st_gmac interface (BZ#2219907)

• refcount_t overflow often happens in mem_cgroup_id_get_online() (BZ#2221010)

• avoid unnecessary page fault retires on shared memory types (BZ#2221100)

• enable conntrack clash resolution for GRE (BZ#2223542)

• ice: avoid bonding causing auxiliary plug/unplug under RTNL lock (BZ#2224515)

• libceph: harden msgr2.1 frame segment length checks [8.x] (BZ#2227073)

• Important iavf bug fixes July 2023 (BZ#2228161)

• i40e error: Cannot set interface MAC/vlanid to 1e:b7:e2:02:b1:aa/0 for ifname ens4f0 vf 0: Resource temporarily unavailable (BZ#2228163)

• oops on cifs_mount due to null tcon (BZ#2229128)

• iptables argument "--suppl-groups" in extension "owner" does not work in Rocky Linux8 (BZ#2229715)

• Hyper-V Rocky Linux 8: incomplete fc_transport implementation in storvsc causes null dereference in fc_timed_out() (BZ#2230743)

• Withdrawal: GFS2: could not freeze filesystem: -16 (BZ#2231825)

• Rocky Linux 8 Hyper-V: Excessive hv_storvsc driver logging with srb_status SRB_STATUS_INTERNAL_ERROR (0x30) (BZ#2231988)

• Rocky Linux-8: crypto: rng - Fix lock imbalance in crypto_del_rng (BZ#2232215)

• Intel 8.9 iavf: Driver Update (BZ#2232399)

• Hyper-V Rocky Linux-8 hv_storvsc driver logging excessive storvsc_log events for storvsc_on_io_completion() function (BZ#2233227)

Enhancement(s):

• Intel 8.9 FEAT, EMR perf: Add EMR CPU PMU support (BZ#2230152)

• Intel 8.9 FEAT, SPR EMR power: Add uncore frequency control driver (BZ#2230158)

• Intel 8.9 FEAT EMR perf: RAPL PMU support on EMR (BZ#2230162)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: ipvlan: out-of-bounds write caused by unclear skb->cb (CVE-2023-3090)

• kernel: UAF in nftables when nft_set_lookup_global triggered after handling named and anonymous sets in batch requests (CVE-2023-3390)

• kernel: net/sched: cls_fw component can be exploited as result of failure in tcf_change_indev function (CVE-2023-3776)

• kernel: netfilter: use-after-free due to improper element removal in nft_pipapo_remove() (CVE-2023-4004)

• kernel: nf_tables: stack-out-of-bounds-read in nft_byteorder_eval() (CVE-2023-35001)

• kernel: cls_flower: out-of-bounds write in fl_set_geneve_opt() (CVE-2023-35788)

• kernel: bluetooth: Unauthorized management command execution (CVE-2023-2002)

• hw: amd: Cross-Process Information Leak (CVE-2023-20593)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• low memory deadlock with md devices and external (imsm) metadata handling - requires a kernfs notification backport (BZ#2208540)

• Intel 8.9 BUG, SPR EMR FHF ACPI: Fix system hang during S3 wakeup (BZ#2218025)

• OCS 4.8, cephfs kernel crash: mds_dispatch ceph_handle_snap unable to handle kernel NULL (BZ#2218271)

• st_gmac: tx-checksum offload on vlan is not consistent with st_gmac interface (BZ#2219907)

• refcount_t overflow often happens in mem_cgroup_id_get_online() (BZ#2221010)

• avoid unnecessary page fault retires on shared memory types (BZ#2221100)

• enable conntrack clash resolution for GRE (BZ#2223542)

• ice: avoid bonding causing auxiliary plug/unplug under RTNL lock (BZ#2224515)

• libceph: harden msgr2.1 frame segment length checks [8.x] (BZ#2227073)

• Important iavf bug fixes July 2023 (BZ#2228161)

• i40e error: Cannot set interface MAC/vlanid to 1e:b7:e2:02:b1:aa/0 for ifname ens4f0 vf 0: Resource temporarily unavailable (BZ#2228163)

• oops on cifs_mount due to null tcon (BZ#2229128)

• iptables argument "--suppl-groups" in extension "owner" does not work in Rocky Linux SIG Cloud8 (BZ#2229715)

• Hyper-V Rocky Linux SIG Cloud 8: incomplete fc_transport implementation in storvsc causes null dereference in fc_timed_out() (BZ#2230743)

• Withdrawal: GFS2: could not freeze filesystem: -16 (BZ#2231825)

• Rocky Linux SIG Cloud 8 Hyper-V: Excessive hv_storvsc driver logging with srb_status SRB_STATUS_INTERNAL_ERROR (0x30) (BZ#2231988)

• Rocky Linux SIG Cloud-8: crypto: rng - Fix lock imbalance in crypto_del_rng (BZ#2232215)

• Intel 8.9 iavf: Driver Update (BZ#2232399)

• Hyper-V Rocky Linux SIG Cloud-8 hv_storvsc driver logging excessive storvsc_log events for storvsc_on_io_completion() function (BZ#2233227)

Enhancement(s):

• Intel 8.9 FEAT, EMR perf: Add EMR CPU PMU support (BZ#2230152)

• Intel 8.9 FEAT, SPR EMR power: Add uncore frequency control driver (BZ#2230158)

• Intel 8.9 FEAT EMR perf: RAPL PMU support on EMR (BZ#2230162)

A heap out-of-bounds write vulnerability in the Linux Kernel ipvlan network driver can be exploited to achieve local privilege escalation. The out-of-bounds write is caused by missing skb->cb initialization in the ipvlan network driver. The vulnerability is reachable if CONFIG_IPVLAN is enabled. We recommend upgrading past commit 90cbed5247439a966b645b34eb0a2e037836ea8e.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: ipvlan: out-of-bounds write caused by unclear skb->cb (CVE-2023-3090)
• kernel: cls_flower: out-of-bounds write in fl_set_geneve_opt() (CVE-2023-35788)
• kernel: KVM: x86/mmu: race condition in direct_page_fault() (CVE-2022-45869)
• kernel: speculative pointer dereference in do_prlimit() in kernel/sys.c (CVE-2023-0458)
• kernel: Spectre v2 SMT mitigations problem (CVE-2023-1998)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: ipvlan: out-of-bounds write caused by unclear skb->cb (CVE-2023-3090)
• kernel: cls_flower: out-of-bounds write in fl_set_geneve_opt() (CVE-2023-35788)
• kernel: KVM: x86/mmu: race condition in direct_page_fault() (CVE-2022-45869)
• kernel: speculative pointer dereference in do_prlimit() in kernel/sys.c (CVE-2023-0458)
• kernel: Spectre v2 SMT mitigations problem (CVE-2023-1998)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: ipvlan: out-of-bounds write caused by unclear skb->cb (CVE-2023-3090)
• kernel: UAF in nftables when nft_set_lookup_global triggered after handling named and anonymous sets in batch requests (CVE-2023-3390)
• kernel: net/sched: cls_fw component can be exploited as result of failure in tcf_change_indev function (CVE-2023-3776)
• kernel: netfilter: use-after-free due to improper element removal in nft_pipapo_remove() (CVE-2023-4004)
• kernel: nf_tables: stack-out-of-bounds-read in nft_byteorder_eval() (CVE-2023-35001)
• kernel: cls_flower: out-of-bounds write in fl_set_geneve_opt() (CVE-2023-35788)
• kernel: bluetooth: Unauthorized management command execution (CVE-2023-2002)
• hw: amd: Cross-Process Information Leak (CVE-2023-20593)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• low memory deadlock with md devices and external (imsm) metadata handling - requires a kernfs notification backport (BZ#2208540)
• Intel 8.9 BUG, SPR EMR FHF ACPI: Fix system hang during S3 wakeup (BZ#2218025)
• OCS 4.8, cephfs kernel crash: mds_dispatch ceph_handle_snap unable to handle kernel NULL (BZ#2218271)
• st_gmac: tx-checksum offload on vlan is not consistent with st_gmac interface (BZ#2219907)
• refcount_t overflow often happens in mem_cgroup_id_get_online() (BZ#2221010)
• avoid unnecessary page fault retires on shared memory types (BZ#2221100)
• enable conntrack clash resolution for GRE (BZ#2223542)
• ice: avoid bonding causing auxiliary plug/unplug under RTNL lock (BZ#2224515)
• libceph: harden msgr2.1 frame segment length checks [8.x] (BZ#2227073)
• Important iavf bug fixes July 2023 (BZ#2228161)
• i40e error: Cannot set interface MAC/vlanid to 1e:b7:e2:02:b1:aa/0 for ifname ens4f0 vf 0: Resource temporarily unavailable (BZ#2228163)
• oops on cifs_mount due to null tcon (BZ#2229128)
• iptables argument "--suppl-groups" in extension "owner" does not work in AlmaLinux8 (BZ#2229715)
• Hyper-V AlmaLinux 8: incomplete fc_transport implementation in storvsc causes null dereference in fc_timed_out() (BZ#2230743)
• Withdrawal: GFS2: could not freeze filesystem: -16 (BZ#2231825)
• AlmaLinux 8 Hyper-V: Excessive hv_storvsc driver logging with srb_status SRB_STATUS_INTERNAL_ERROR (0x30) (BZ#2231988)
• AlmaLinux-8: crypto: rng - Fix lock imbalance in crypto_del_rng (BZ#2232215)
• Intel 8.9 iavf: Driver Update (BZ#2232399)
• Hyper-V AlmaLinux-8 hv_storvsc driver logging excessive storvsc_log events for storvsc_on_io_completion() function (BZ#2233227)

Enhancement(s):

• Intel 8.9 FEAT, EMR perf: Add EMR CPU PMU support (BZ#2230152)
• Intel 8.9 FEAT, SPR EMR power: Add uncore frequency control driver (BZ#2230158)
• Intel 8.9 FEAT EMR perf: RAPL PMU support on EMR (BZ#2230162)

• Bionic update: upstream stable patchset 2021-11-12 (LP: #1950816) // CVE- url: https://ubuntu.com/security/CVE-2021-20321
  • ovl: fix missing negative dentry check in ovl_rename()
• CVE-url: https://ubuntu.com/security/CVE-2021-20321
  • ovl: cleanup unused var in rename2
• Jammy update: v5.15.93 upstream stable release (LP: #2012665) // CVE-url: https://ubuntu.com/security/CVE-2023-3161
  • fbcon: Check font dimension limits
• CVE-url: https://ubuntu.com/security/CVE-2021-3753
  • vt_kdsetmode: extend console locking
• Jammy update: v5.15.75 upstream stable release (LP: #1996825) // CVE-url: https://ubuntu.com/security/CVE-2022-1184
  • ext4: fix check for block being out of directory size
• Jammy update: v5.15.61 upstream stable release (LP: #1990162) // CVE-url: https://ubuntu.com/security/CVE-2022-1184
  • ext4: check if directory block is within i_size
• Jammy update: v5.15.104 upstream stable release (LP: #2023225) // CVE-url: https://ubuntu.com/security/CVE-2023-1990
  • nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition
• CVE-url: https://ubuntu.com/security/CVE-2023-3090
  • ipvlan:Fix out-of-bounds caused by unclear skb->cb
• Jammy update: v5.15.63 upstream stable release (LP: #1990564) // CVE-url: https://ubuntu.com/security/CVE-2023-3111
  • btrfs: unset reloc control if transaction commit fails in prepare_to_relocate()
• CVE-url: https://ubuntu.com/security/CVE-2023-3111
  • Btrfs: fill relocation block rsv after allocation
  • btrfs: check return value of btrfs_commit_transaction in relocation
• CVE-url: https://ubuntu.com/security/CVE-2023-3141
  • memstick: r592: Fix UAF bug in r592_remove due to race condition
• CVE-url: https://ubuntu.com/security/CVE-2023-3212
  • gfs2: Don't deref jdesc in evict
• CVE-url: https://ubuntu.com/security/CVE-2023-3268
  • kernel/relay.c: fix read_pos error when multiple readers
  • relayfs: fix out-of-bounds access in relay_file_read
• CVE-url: https://ubuntu.com/security/CVE-2023-3390
  • netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE
• CVE-url: https://ubuntu.com/security/CVE-2023-35824
  • media: dm1105: Fix use after free bug in dm1105_remove due to race condition

• Bionic update: upstream stable patchset 2021-11-12 (LP: #1950816) // CVE- url: https://ubuntu.com/security/CVE-2021-20321
  • ovl: fix missing negative dentry check in ovl_rename()
• CVE-url: https://ubuntu.com/security/CVE-2021-20321
  • ovl: cleanup unused var in rename2
• Jammy update: v5.15.93 upstream stable release (LP: #2012665) // CVE-url: https://ubuntu.com/security/CVE-2023-3161
  • fbcon: Check font dimension limits
• CVE-url: https://ubuntu.com/security/CVE-2021-3753
  • vt_kdsetmode: extend console locking
• Jammy update: v5.15.75 upstream stable release (LP: #1996825) // CVE-url: https://ubuntu.com/security/CVE-2022-1184
  • ext4: fix check for block being out of directory size
• Jammy update: v5.15.61 upstream stable release (LP: #1990162) // CVE-url: https://ubuntu.com/security/CVE-2022-1184
  • ext4: check if directory block is within i_size
• Jammy update: v5.15.104 upstream stable release (LP: #2023225) // CVE-url: https://ubuntu.com/security/CVE-2023-1990
  • nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition
• CVE-url: https://ubuntu.com/security/CVE-2023-3090
  • ipvlan:Fix out-of-bounds caused by unclear skb->cb
• Jammy update: v5.15.63 upstream stable release (LP: #1990564) // CVE-url: https://ubuntu.com/security/CVE-2023-3111
  • btrfs: unset reloc control if transaction commit fails in prepare_to_relocate()
• CVE-url: https://ubuntu.com/security/CVE-2023-3111
  • Btrfs: fill relocation block rsv after allocation
  • btrfs: check return value of btrfs_commit_transaction in relocation
• CVE-url: https://ubuntu.com/security/CVE-2023-3141
  • memstick: r592: Fix UAF bug in r592_remove due to race condition
• CVE-url: https://ubuntu.com/security/CVE-2023-3212
  • gfs2: Don't deref jdesc in evict
• CVE-url: https://ubuntu.com/security/CVE-2023-3268
  • kernel/relay.c: fix read_pos error when multiple readers
  • relayfs: fix out-of-bounds access in relay_file_read
• CVE-url: https://ubuntu.com/security/CVE-2023-3390
  • netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE
• CVE-url: https://ubuntu.com/security/CVE-2023-35824
  • media: dm1105: Fix use after free bug in dm1105_remove due to race condition

• netfilter: nft_set_pipapo: fix improper element removal {CVE-2023-4004}
• net: tun: fix bugs for oversize packet when napi frags enabled {CVE-2023-3812}
• net/sched: cls_fw: Fix improper refcount update leads to use-after-free {CVE-2023-3776}
• net/sched: sch_qfq: account for stab overhead in qfq_enqueue {CVE-2023-3611}
• net/sched: sch_qfq: refactor parsing of netlink parameters
• ipvlan:Fix out-of-bounds caused by unclear skb->cb {CVE-2023-3090}
• media: saa7134: fix use after free bug in saa7134_finidev due to race condition {CVE-2023-35823}
• media: dm1105: Fix use after free bug in dm1105_remove due to race condition {CVE-2023-35824}
• memstick: r592: Fix UAF bug in r592_remove due to race condition {CVE-2023-3141}
• ovl: fix use after free in struct ovl_aio_req {CVE-2023-1252}
• xen/netfront: don't use gnttab_query_foreign_access() for mapped status {CVE-2022-23037}
• xen/netfront: react properly to failing gnttab_end_foreign_access_ref() {CVE-2022-23042}
• xen/netfront: don't trust the backend response data blindly
• xen/netfront: disentangle tx_skb_freelist
• xen: sync include/xen/interface/io/ring.h with Xen's newest version
• net/sched: flower: fix possible OOB write in fl_set_geneve_opt() {CVE-2023-35788}
• rds: rds_rm_zerocopy_callback() use list_first_entry() {CVE-2023-1078}
• misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault and gru_handle_user_call_os {CVE-2022-3424}
• NFSD: Cap rsize_bop result based on send buffer size {CVE-2022-43945}
• NFSD: Protect against send buffer overflow in NFSv3 READ {CVE-2022-43945}
• NFSD: Protect against send buffer overflow in NFSv2 READ {CVE-2022-43945}
• SUNRPC: Fix svcxdr_init_encode's buflen calculation {CVE-2022-43945}
• SUNRPC: Fix svcxdr_init_decode's end-of-buffer calculation {CVE-2022-43945}
• mm/mremap: hold the rmap lock in write mode when moving page table entries. {CVE-2022-39189}
• KVM: x86: do not report a vCPU as preempted outside instruction boundaries {CVE-2022-39189}
• net: tls: fix possible race condition between do_tls_getsockopt_conf() and do_tls_setsockopt_conf() {CVE-2023-28466}
• tee: handle lookup of shm with reference count 0 {CVE-2021-44733}

• netfilter: nft_set_pipapo: fix improper element removal {CVE-2023-4004}
• net: tun: fix bugs for oversize packet when napi frags enabled {CVE-2023-3812}
• net/sched: cls_fw: Fix improper refcount update leads to use-after-free {CVE-2023-3776}
• net/sched: sch_qfq: account for stab overhead in qfq_enqueue {CVE-2023-3611}
• net/sched: sch_qfq: refactor parsing of netlink parameters
• ipvlan:Fix out-of-bounds caused by unclear skb->cb {CVE-2023-3090}
• media: saa7134: fix use after free bug in saa7134_finidev due to race condition {CVE-2023-35823}
• media: dm1105: Fix use after free bug in dm1105_remove due to race condition {CVE-2023-35824}
• memstick: r592: Fix UAF bug in r592_remove due to race condition {CVE-2023-3141}
• ovl: fix use after free in struct ovl_aio_req {CVE-2023-1252}
• xen/netfront: don't use gnttab_query_foreign_access() for mapped status {CVE-2022-23037}
• xen/netfront: react properly to failing gnttab_end_foreign_access_ref() {CVE-2022-23042}
• xen/netfront: don't trust the backend response data blindly {CVE-2022-23042}
• xen/netfront: disentangle tx_skb_freelist {CVE-2022-23042}
• xen: sync include/xen/interface/io/ring.h with Xen's newest version {CVE-2022-23042}
• net/sched: flower: fix possible OOB write in fl_set_geneve_opt() {CVE-2023-35788}
• rds: rds_rm_zerocopy_callback() use list_first_entry() {CVE-2023-1078}
• misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault and gru_handle_user_call_os {CVE-2022-3424}
• mac80211: do not accept/forward invalid EAPOL frames {CVE-2020-26139}
• bpf: Fix 32 bit src register truncation on div/mod {CVE-2021-3600}
• NFSD: Cap rsize_bop result based on send buffer size {CVE-2022-43945}
• NFSD: Protect against send buffer overflow in NFSv3 READ {CVE-2022-43945}
• SUNRPC: Fix svcxdr_init_encode's buflen calculation {CVE-2022-43945}
• KVM: x86: do not report a vCPU as preempted outside instruction boundaries {CVE-2022-39189}
• net: tls: fix possible race condition between do_tls_getsockopt_conf() and do_tls_setsockopt_conf() {CVE-2023-28466}
• tee: handle lookup of shm with reference count 0 {CVE-2021-44733}

• Jammy update: v5.15.75 upstream stable release (LP: #1996825) // CVE-url: https://ubuntu.com/security/CVE-2022-1184
  • ext4: fix check for block being out of directory size
• Jammy update: v5.15.61 upstream stable release (LP: #1990162) // CVE-url: https://ubuntu.com/security/CVE-2022-1184
  • ext4: check if directory block is within i_size
• Jammy update: v5.15.68 upstream stable release (LP: #1993003) // CVE-url: https://ubuntu.com/security/CVE-2022-3303
  • ALSA: pcm: oss: Fix race at SNDCTL_DSP_SYNC
• CVE-2023-1670 // CVE-url: https://ubuntu.com/security/CVE-2023-1670
  • xirc2ps_cs: Fix use after free bug in xirc2ps_detach
• CVE-url: https://ubuntu.com/security/CVE-2023-1989
  • Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition
• Jammy update: v5.15.104 upstream stable release (LP: #2023225) // CVE-url: https://ubuntu.com/security/CVE-2023-1990
  • nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition
• CVE-url: https://ubuntu.com/security/CVE-2023-2007
  • scsi: dpt_i2o: Remove obsolete driver
• CVE-2023-2124 // CVE-url: https://ubuntu.com/security/CVE-2023-2124
  • xfs: verify buffer contents when we skip log replay
• CVE-url: https://ubuntu.com/security/CVE-2023-23000
  • phy: tegra: xusb: Fix return value of tegra_xusb_find_port_node function
• CVE-url: https://ubuntu.com/security/CVE-2023-28466
  • net: tls: fix possible race condition between do_tls_getsockopt_conf() and do_tls_setsockopt_conf()
• CVE-url: https://ubuntu.com/security/CVE-2023-3090
  • ipvlan:Fix out-of-bounds caused by unclear skb->cb
• Jammy update: v5.15.63 upstream stable release (LP: #1990564) // CVE-url: https://ubuntu.com/security/CVE-2023-3111
  • btrfs: unset reloc control if transaction commit fails in prepare_to_relocate()
• CVE-url: https://ubuntu.com/security/CVE-2023-3111
  • btrfs: check return value of btrfs_commit_transaction in relocation
• CVE-url: https://ubuntu.com/security/CVE-2023-3141
  • memstick: r592: Fix UAF bug in r592_remove due to race condition
• CVE-url: https://ubuntu.com/security/CVE-2023-3212
  • gfs2: Don't deref jdesc in evict
• CVE-url: https://ubuntu.com/security/CVE-2023-3268
  • kernel/relay.c: fix read_pos error when multiple readers
  • relayfs: fix out-of-bounds access in relay_file_read
• CVE-url: https://ubuntu.com/security/CVE-2023-3390
  • netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE
• CVE-url: https://ubuntu.com/security/CVE-2023-35823
  • media: saa7134: fix use after free bug in saa7134_finidev due to race condition
• CVE-url: https://ubuntu.com/security/CVE-2023-35824
  • media: dm1105: Fix use after free bug in dm1105_remove due to race condition
• Miscellaneous Ubuntu changes
  • [Config] updateconfigs for SCSI_DPT_I2O
• Miscellaneous upstream changes
  • fixup! UBUNTU: [Packaging]: add tuxcare suffix

• Jammy update: v5.15.75 upstream stable release (LP: #1996825) // CVE-url: https://ubuntu.com/security/CVE-2022-1184
  • ext4: fix check for block being out of directory size
• Jammy update: v5.15.61 upstream stable release (LP: #1990162) // CVE-url: https://ubuntu.com/security/CVE-2022-1184
  • ext4: check if directory block is within i_size
• Jammy update: v5.15.68 upstream stable release (LP: #1993003) // CVE-url: https://ubuntu.com/security/CVE-2022-3303
  • ALSA: pcm: oss: Fix race at SNDCTL_DSP_SYNC
• CVE-2023-1670 // CVE-url: https://ubuntu.com/security/CVE-2023-1670
  • xirc2ps_cs: Fix use after free bug in xirc2ps_detach
• CVE-url: https://ubuntu.com/security/CVE-2023-1989
  • Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition
• Jammy update: v5.15.104 upstream stable release (LP: #2023225) // CVE-url: https://ubuntu.com/security/CVE-2023-1990
  • nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition
• CVE-url: https://ubuntu.com/security/CVE-2023-2007
  • scsi: dpt_i2o: Remove obsolete driver
• CVE-2023-2124 // CVE-url: https://ubuntu.com/security/CVE-2023-2124
  • xfs: verify buffer contents when we skip log replay
• CVE-url: https://ubuntu.com/security/CVE-2023-23000
  • phy: tegra: xusb: Fix return value of tegra_xusb_find_port_node function
• CVE-url: https://ubuntu.com/security/CVE-2023-28466
  • net: tls: fix possible race condition between do_tls_getsockopt_conf() and do_tls_setsockopt_conf()
• CVE-url: https://ubuntu.com/security/CVE-2023-3090
  • ipvlan:Fix out-of-bounds caused by unclear skb->cb
• Jammy update: v5.15.63 upstream stable release (LP: #1990564) // CVE-url: https://ubuntu.com/security/CVE-2023-3111
  • btrfs: unset reloc control if transaction commit fails in prepare_to_relocate()
• CVE-url: https://ubuntu.com/security/CVE-2023-3111
  • btrfs: check return value of btrfs_commit_transaction in relocation
• CVE-url: https://ubuntu.com/security/CVE-2023-3141
  • memstick: r592: Fix UAF bug in r592_remove due to race condition
• CVE-url: https://ubuntu.com/security/CVE-2023-3212
  • gfs2: Don't deref jdesc in evict
• CVE-url: https://ubuntu.com/security/CVE-2023-3268
  • kernel/relay.c: fix read_pos error when multiple readers
  • relayfs: fix out-of-bounds access in relay_file_read
• CVE-url: https://ubuntu.com/security/CVE-2023-3390
  • netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE
• CVE-url: https://ubuntu.com/security/CVE-2023-35823
  • media: saa7134: fix use after free bug in saa7134_finidev due to race condition
• CVE-url: https://ubuntu.com/security/CVE-2023-35824
  • media: dm1105: Fix use after free bug in dm1105_remove due to race condition
• Miscellaneous Ubuntu changes
  • [Config] updateconfigs for SCSI_DPT_I2O
• Miscellaneous upstream changes
  • fixup! UBUNTU: [Packaging]: add tuxcare suffix

It was discovered that the IP-VLAN network driver for the Linux kernel did not properly initialize memory in some situations, leading to an out-of- bounds write vulnerability. An attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-2023-3090)

Querijn Voet discovered that a race condition existed in the io_uring subsystem in the Linux kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-2023-3389)

It was discovered that the netfilter subsystem in the Linux kernel did not properly handle some error conditions, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-2023-3390)

Mingi Cho discovered that the netfilter subsystem in the Linux kernel did not properly validate the status of a nft chain while performing a lookup by id, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-2023-31248)

Shir Tamari and Sagi Tzadik discovered that the OverlayFS implementation in the Ubuntu Linux kernel did not properly perform permission checks in certain situations. A local attacker could possibly use this to gain elevated privileges.(CVE-2023-32629)

Tanguy Dubroca discovered that the netfilter subsystem in the Linux kernel did not properly handle certain pointer data type, leading to an out-of- bounds write vulnerability. A privileged attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-2023-35001)

Hangyu Hua discovered that the Flower classifier implementation in the Linux kernel contained an out-of-bounds write vulnerability. An attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-2023-35788)

It was discovered that the IP-VLAN network driver for the Linux kernel did not properly initialize memory in some situations, leading to an out-of- bounds write vulnerability. An attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-2023-3090)

It was discovered that the virtual terminal driver in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information (kernel memory).(CVE-2023-3567)

It was discovered that the universal 32bit network packet classifier implementation in the Linux kernel did not properly perform reference counting in some situations, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-2023-3609)

It was discovered that the network packet classifier with netfilter/firewall marks implementation in the Linux kernel did not properly handle reference counting, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-2023-3776)

Kevin Rich discovered that the netfilter subsystem in the Linux kernel did not properly handle table rules flush in certain circumstances. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code.(CVE-2023-3777)

Kevin Rich discovered that the netfilter subsystem in the Linux kernel did not properly handle rule additions to bound chains in certain circumstances. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code.(CVE-2023-3995)

It was discovered that the netfilter subsystem in the Linux kernel did not properly handle PIPAPO element removal, leading to a use-after-free vulnerability. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code.(CVE-2023-4004)

It was discovered that some network classifier implementations in the Linux kernel contained use-after-free vulnerabilities. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-2023-4128)

Ye Zhang and Nicolas Wu discovered that the io_uring subsystem in the Linux kernel did not properly handle locking for rings with IOPOLL, leading to a double-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-2023-21400)

It was discovered that the bluetooth subsystem in the Linux kernel did not properly handle L2CAP socket release, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-2023-40283)

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).
• CVE-2023-3389: Fixed a use-after-free vulnerability in the io_uring subsystem (bsc#1212838).
• CVE-2023-3090: Fixed a heap out-of-bounds write in the ipvlan network driver (bsc#1212842).
• CVE-2023-3111: Fixed a use-after-free vulnerability in prepare_to_relocate in fs/btrfs/relocation.c (bsc#1212051).
• CVE-2023-3212: Fixed a NULL pointer dereference flaw in the gfs2 file system (bsc#1212265).
• CVE-2023-3358: Fixed a NULL pointer dereference flaw in the Integrated Sensor Hub (ISH) driver (bsc#1212606).
• CVE-2023-3357: Fixed a NULL pointer dereference flaw in the AMD Sensor Fusion Hub driver (bsc#1212605).

The following non-security bugs were fixed:

• Get module prefix from kmod (bsc#1212835).
• Revert 'mtd: rawnand: arasan: Prevent an unsupported configuration' (git-fixes).
• Revert 'net: phy: dp83867: perform soft reset and retain established link' (git-fixes).
• alsa: ac97: Fix possible NULL dereference in snd_ac97_mixer (git-fixes).
• alsa: hda/realtek: Add 'Intel Reference board' and 'NUC 13' SSID in the ALC256 (git-fixes).
• alsa: hda/realtek: Add quirk for ASUS ROG G634Z (git-fixes).
• alsa: hda/realtek: Add quirk for ASUS ROG GV601V (git-fixes).
• alsa: hda/realtek: Add quirks for ASUS GU604V and GU603V (git-fixes).
• alsa: hda/realtek: Add quirks for ROG ALLY CS35l41 audio (git-fixes).
• alsa: hda/realtek: Enable mute/micmute LEDs and limit mic boost on EliteBook (git-fixes).
• amdgpu: validate offset_in_bo of drm_amdgpu_gem_va (git-fixes).
• arm64: Add missing Set/Way CMO encodings (git-fixes).
• arm64: dts: Move BCM4908 dts to bcmbca folder (git-fixes)
• arm64: dts: broadcom: bcmbca: bcm4908: fix NAND interrupt name (git-fixes)
• arm64: dts: broadcom: bcmbca: bcm4908: fix procmon nodename (git-fixes)
• arm64: dts: imx8mn-var-som: fix PHY detection bug by adding deassert (git-fixes)
• arm: dts: Fix erroneous ADS touchscreen polarities (git-fixes).
• asoc: es8316: Do not set rate constraints for unsupported MCLKs (git-fixes).
• asoc: es8316: Increment max value for ALC Capture Target Volume control (git-fixes).
• asoc: imx-audmix: check return value of devm_kasprintf() (git-fixes).
• asoc: mediatek: mt8173: Fix irq error path (git-fixes).
• asoc: nau8824: Add quirk to active-high jack-detect (git-fixes).
• asoc: simple-card: Add missing of_node_put() in case of error (git-fixes).
• bus: fsl-mc: fsl-mc-allocator: Drop a write-only variable (git-fixes).
• bus: ti-sysc: Fix dispc quirk masking bool variables (git-fixes).
• can: isotp: isotp_sendmsg(): fix return error fix on TX path (git-fixes).
• can: kvaser_pciefd: Remove handler for unused KVASER_PCIEFD_PACK_TYPE_EFRAME_ACK (git-fixes).
• can: kvaser_pciefd: Remove useless write to interrupt register (git-fixes).
• can: length: fix bitstuffing count (git-fixes).
• can: length: fix description of the RRS field (git-fixes).
• can: length: make header self contained (git-fixes).
• clk: Fix memory leak in devm_clk_notifier_register() (git-fixes).
• clk: cdce925: check return value of kasprintf() (git-fixes).
• clk: imx: clk-imx8mn: fix memory leak in imx8mn_clocks_probe (git-fixes).
• clk: imx: clk-imx8mp: improve error handling in imx8mp_clocks_probe() (git-fixes).
• clk: imx: scu: use _safe list iterator to avoid a use after free (git-fixes).
• clk: keystone: sci-clk: check return value of kasprintf() (git-fixes).
• clk: samsung: Add Exynos4212 compatible to CLKOUT driver (git-fixes).
• clk: si5341: check return value of {devm_}kasprintf() (git-fixes).
• clk: si5341: free unused memory on probe failure (git-fixes).
• clk: si5341: return error if one synth clock registration fails (git-fixes).
• clk: tegra: tegra124-emc: Fix potential memory leak (git-fixes).
• clk: ti: clkctrl: check return value of kasprintf()…

The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-3090: Fixed a heap out-of-bounds write in the ipvlan network driver (bsc#1212842).
• CVE-2023-3111: Fixed a use-after-free vulnerability in prepare_to_relocate in fs/btrfs/relocation.c (bsc#1212051).
• CVE-2023-3358: Fixed a NULL pointer dereference flaw in the Integrated Sensor Hub (ISH) driver (bsc#1212606).
• CVE-2023-1249: Fixed a use-after-free flaw in the core dump subsystem that allowed a local user to crash the system (bsc#1209039).
• CVE-2023-3268: Fixed an out of bounds (OOB) memory access flaw in relay_file_read_start_pos in kernel/relay.c (bsc#1212502).
• CVE-2023-2002: Fixed a flaw that allowed an attacker to unauthorized execution of management commands, compromising the confidentiality, integrity, and availability of Bluetooth communication (bsc#1210533).
• CVE-2023-35824: Fixed a use-after-free in dm1105_remove in drivers/media/pci/dm1105/dm1105.c (bsc#1212501).
• CVE-2023-3161: Fixed shift-out-of-bounds in fbcon_set_font() (bsc#1212154).
• CVE-2023-3141: Fixed a use-after-free flaw in r592_remove in drivers/memstick/host/r592.c, that allowed local attackers to crash the system at device disconnect (bsc#1212129).
• CVE-2023-3159: Fixed use-after-free issue in driver/firewire in outbound_phy_packet_callback (bsc#1212128).
• CVE-2023-1077: Fixed a type confusion in pick_next_rt_entity(), that could cause memory corruption (bsc#1208600).
• CVE-2023-1637: Fixed vulnerability that could lead to unauthorized access to CPU memory after resuming CPU from suspend-to-RAM (bsc#1209779).
• CVE-2023-1079: Fixed a use-after-free problem that could have been triggered in asus_kbd_backlight_set when plugging/disconnecting a malicious USB device (bsc#1208604).

The following non-security bugs were fixed:

• Decrease the number of SMB3 smbdirect client SGEs (bsc#1190317).
• Drop dvb-core fix patch due to bug (bsc#1205758).
• Fix formatting of client smbdirect RDMA logging (bsc#1190317).
• Fix missing top level chapter numbers on SLE12 SP5 (bsc#1212158).
• Fix usrmerge error (boo#1211796)
• Handle variable number of SGEs in client smbdirect send (bsc#1190317).
• Reduce client smbdirect max receive segment size (bsc#1190317).
• Squashfs: fix handling and sanity checking of xattr_ids count (git-fixes).
• affs: initialize fsdata in affs_truncate() (git-fixes).
• bnx2x: Check if transceiver implements DDM before access (git-fixes).
• bnxt_en: Fix mqprio and XDP ring checking logic (git-fixes).
• bnxt_en: Fix typo in PCI id to device description string mapping (git-fixes).
• bnxt_en: Query default VLAN before VNIC setup on a VF (git-fixes).
• bnxt_en: Remove debugfs when pci_register_driver failed (git-fixes).
• bnxt_en: fix NQ resource accounting during vf creation on 57500 chips (git-fixes).
• bnxt_en: fix potentially incorrect return value for ndo_rx_flow_steer (git-fixes).
• bnxt_en: reclaim max resources if sriov enable fails (git-fixes).
• bonding: show full hw address in sysfs for slave entries (git-fixes).
• cdc-ncm: avoid overflow in sanity checking (git-fixes).
• ceph: fix use-after-free bug for inodes when flushing capsnaps (bsc#1212938).
• cifs: Add helper function to check smb1+ server (bsc#1190317).
• cifs: Convert struct fealist away from 1-element array (bsc#1190317).
• cifs: Fix connections leak when tlink setup failed (bsc#1190317).
• cifs: Fix lost destroy smbd connection when MR allocate failed (bsc#1190317).
• cifs: Fix memory leak when build ntlmssp negotiate blob failed (bsc#1190317).
• cifs: Fix oops due to uncleared server->smbd_conn in reconnect (bsc#1190317).
• cifs: Fix pages array leak when writedata alloc failed in cifs_writedata_alloc() (bsc#1190317).
• cifs: Fix pages leak when writedata alloc failed in cifs_write_from_iter() (bsc#1190317).
• cifs: Fix smb2_set_path_size() (bsc#1190317).
• cifs: Fix the error length of VALIDATE_NEGOTIATE_INFO message…