CVE-2023-32233

In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users can obtain root privileges. This occurs because anonymous sets are mishandled.

In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users can obtain root privileges. This occurs because anonymous sets are mishandled.

The Linux Kernel, the operating system core itself.

Security Fix(es):

A use-after-free vulnerability was found in iscsi_sw_tcp_session_create in drivers/scsi/iscsi_tcp.c in SCSI sub-component in the Linux Kernel. In this flaw an attacker could leak kernel internal information.(CVE-2023-2162)

An out-of-bounds memory access flaw was found in the Linux kernel’s XFS file system in how a user restores an XFS image after failure (with a dirty log journal). This flaw allows a local user to crash or potentially escalate their privileges on the system(CVE-2023-2124)

In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users can obtain root privileges. This occurs because anonymous sets are mishandled.(CVE-2023-32233)

In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users can obtain root privileges. This occurs because anonymous sets are mishandled.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: netfilter: use-after-free in nf_tables when processing batch requests can lead to privilege escalation (CVE-2023-32233)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• The qede driver changes rx-usecs: to 256 causing performance impact (BZ#2176104)
• Intel QAT Update - (kernel changes) (BZ#2176850)
• In FIPS mode, kernel does not transition into error state when RCT or APT health tests fail (BZ#2181730)
• "smpboot: Scheduler frequency invariance went wobbly, disabling!" on nohz_full CPUs after long run (BZ#2188067)

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: netfilter: use-after-free in nf_tables when processing batch requests can lead to privilege escalation (CVE-2023-32233)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• smpboot: Scheduler frequency invariance went wobbly, disabling! (BZ#2188316)
• Crash: kernel BUG at kernel/locking/rtmutex.c:1338! (BZ#2188722)
• kernel-rt: update RT source tree to the AlmaLinux-8.8.z0 source tree. (BZ#2196667)

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: use-after-free vulnerability in the perf_group_detach function of the Linux Kernel Performance Events (CVE-2023-2235)
• kernel: netfilter: use-after-free in nf_tables when processing batch requests can lead to privilege escalation (CVE-2023-32233)
• Kernel: bluetooth: Unauthorized management command execution (CVE-2023-2002)
• kernel: OOB access in the Linux kernel's XFS subsystem (CVE-2023-2124)
• kernel: i2c: out-of-bounds write in xgene_slimpro_i2c_xfer() (CVE-2023-2194)
• kernel: tls: race condition in do_tls_getsockopt may lead to use-after-free or NULL pointer dereference (CVE-2023-28466)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• [RT] Single Node Openshift cluster becomes unreachable after running less than 2 hours (BZ#2186853)
• kernel-rt: update RT source tree to the latest AlmaLinux-9.2.z1 Batch (BZ#2188313)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: use-after-free vulnerability in the perf_group_detach function of the Linux Kernel Performance Events (CVE-2023-2235)
• kernel: netfilter: use-after-free in nf_tables when processing batch requests can lead to privilege escalation (CVE-2023-32233)
• Kernel: bluetooth: Unauthorized management command execution (CVE-2023-2002)
• kernel: OOB access in the Linux kernel's XFS subsystem (CVE-2023-2124)
• kernel: i2c: out-of-bounds write in xgene_slimpro_i2c_xfer() (CVE-2023-2194)
• kernel: tls: race condition in do_tls_getsockopt may lead to use-after-free or NULL pointer dereference (CVE-2023-28466)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Intel QAT Update - (kernel changes) (BZ#2176846)
• RPL-P IOTG/RPL-S IOTG: cpu frequency issues (BZ#2178857)
• In FIPS mode, kernel does not transition into error state when RCT or APT health tests fail (BZ#2181727)
• Kernel BUG in iwlmvm wifi driver when used Mesh systems (BZ#2186723)
• Azure AlmaLinux 9 Backport upstream commit 93827a0a36396f2fd6368a54a020f420c8916e9b [KVM: VMX: Fix crash due to uninitialized current_vmcs] (BZ#2186822)
• AlmaLinux 9 blktests nvme/047 lead kernel NULL pointer (BZ#2187536)
• Single Node Openshift cluster becomes unreachable after running less than 2 hours (BZ#2187709)
• kernel[-rt]: task deadline_test:1778 blocked for more than 622 seconds (BZ#2188655)
• fix page end in filemap_get_read_batch (BZ#2189349)
• AlmaLinux 9.2 hwpoison: data loss when memory error occurs on hugetlb pagecache (BZ#2192348)
• wdat_wdt watchdog timeout triggered unexpectedly (BZ#2192585)
• ice: high CPU usage with GNSS or ptp4l (BZ#2203154)
• AlmaLinux 9 "smpboot: Scheduler frequency invariance went wobbly, disabling!" on nohz_full CPUs after long run (BZ#2203178)
• Dying percpu kworkers cause issues on isolated CPUs [almalinux-9] (BZ#2203229)
• FJ9.2 Bug: [REG] NFS infinite loop of COMMIT call and NFS4ERR_DELAY reply. (BZ#2203335)
• perf errors - "event syntax error: 'unc_p_delayed_c_state_abort_core5'" b'_ value too big for format, maximum is 255' (BZ#2207471)
• AlmaLinux 9: Invalid character detected by rpminspect in Documentation/translations/zh_CN/process/magic-number.rst (BZ#2208242)
• cifs: backport small patches to bring us close to 9.1 - backport commit aea02fc40a7f cifs: fix wrong unlock before return from cifs_tree_connect (BZ#2209045)
• AlmaLinux 9 x86_64, kdump 2nd kernel will randomly panic on "kvm-08-guest25.hv2" (BZ#2210614)

• CVE-2023-32233 // CVE-url: https://ubuntu.com/security/CVE-2023-32233
  • netfilter: nf_tables: add nft_set_is_anonymous() helper
  • netfilter: nf_tables: split set destruction in deactivate and destroy phase
  • netfilter: nf_tables: unbind set in rule from commit path
  • netfilter: nf_tables: fix set double-free in abort path
  • netfilter: nf_tables: bogus EBUSY when deleting set after flush
  • netfilter: nf_tables: use-after-free in failing rule with bound set
  • netfilter: nf_tables: deactivate anonymous set from preparation phase
• Bionic update: upstream stable patchset 2018-12-12 (LP: #1808185) // CVE- url: https://ubuntu.com/security/CVE-2023-32233
  • netfilter: nf_tables: bogus EBUSY in chain deletions
• CVE-url: https://ubuntu.com/security/CVE-2023-32233
  • netfilter: nf_tables: release objects on netns destruction
  • netfilter: nf_tables: destroy basechain and rules on netdevice removal
  • netfilter: nft_hash: support deletion of inactive elements
  • netfilter: nf_tables: remove check against removal of inactive objects
  • netfilter: nfnetlink: pass down netns pointer to call() and call_rcu()
  • netfilter: nf_tables: introduce nft_setelem_parse_flags() helper
  • netfilter: nft_rbtree: introduce nft_rbtree_interval_end() helper
  • netfilter: nft_rbtree: allow adjacent intervals with dynamic updates
  • netfilter: nf_tables: parse element flags from nft_del_setelem()
  • netfilter: nf_tables: reject loops from set element jump to chain
  • netfilter: nf_tables: fix wrong destroy anonymous sets if binding fails
  • netfilter: nf_tables: add generic macros to check for generation mask
  • netfilter: nf_tables: add generation mask to tables
  • netfilter: nf_tables: add generation mask to chains
  • netfilter: nf_tables: add generation mask to sets
  • netfilter: nf_tables: get rid of NFT_BASECHAIN_DISABLED
  • netlink: add NLM_F_NONREC flag for deletion requests
  • netfilter: nf_tables: add support for inverted logic in nft_lookup
  • netfilter: nf_tables: get rid of possible_net_t from set and basechain
  • netfilter: nf_tables: simplify the basic expressions' init routine
  • netfilter: nf_tables: fix leak when expr clone fail
  • netfilter: nf_tables: missing sanitization in data from userspace
  • netfilter: nf_tables: revisit chain/object refcounting from elements
• CVE-2023-1380 // CVE-url: https://ubuntu.com/security/CVE-2023-1380
  • wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies()
• CVE-url: https://ubuntu.com/security/CVE-2023-2124
  • xfs: verify buffer contents when we skip log replay
• Bionic update: upstream stable patchset 2023-04-05 (LP: #2015399) // CVE- url: https://ubuntu.com/security/CVE-2023-32269
  • netrom: Fix use-after-free caused by accept on already connected socket
• Bionic update: upstream stable patchset 2023-04-05 (LP: #2015399) // CVE- url: https://ubuntu.com/security/CVE-2023-2162
  • scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress

• CVE-2023-32233 // CVE-url: https://ubuntu.com/security/CVE-2023-32233
  • netfilter: nf_tables: add nft_set_is_anonymous() helper
  • netfilter: nf_tables: split set destruction in deactivate and destroy phase
  • netfilter: nf_tables: unbind set in rule from commit path
  • netfilter: nf_tables: fix set double-free in abort path
  • netfilter: nf_tables: bogus EBUSY when deleting set after flush
  • netfilter: nf_tables: use-after-free in failing rule with bound set
  • netfilter: nf_tables: deactivate anonymous set from preparation phase
• Bionic update: upstream stable patchset 2018-12-12 (LP: #1808185) // CVE- url: https://ubuntu.com/security/CVE-2023-32233
  • netfilter: nf_tables: bogus EBUSY in chain deletions
• CVE-url: https://ubuntu.com/security/CVE-2023-32233
  • netfilter: nf_tables: release objects on netns destruction
  • netfilter: nf_tables: destroy basechain and rules on netdevice removal
  • netfilter: nft_hash: support deletion of inactive elements
  • netfilter: nf_tables: remove check against removal of inactive objects
  • netfilter: nfnetlink: pass down netns pointer to call() and call_rcu()
  • netfilter: nf_tables: introduce nft_setelem_parse_flags() helper
  • netfilter: nft_rbtree: introduce nft_rbtree_interval_end() helper
  • netfilter: nft_rbtree: allow adjacent intervals with dynamic updates
  • netfilter: nf_tables: parse element flags from nft_del_setelem()
  • netfilter: nf_tables: reject loops from set element jump to chain
  • netfilter: nf_tables: fix wrong destroy anonymous sets if binding fails
  • netfilter: nf_tables: add generic macros to check for generation mask
  • netfilter: nf_tables: add generation mask to tables
  • netfilter: nf_tables: add generation mask to chains
  • netfilter: nf_tables: add generation mask to sets
  • netfilter: nf_tables: get rid of NFT_BASECHAIN_DISABLED
  • netlink: add NLM_F_NONREC flag for deletion requests
  • netfilter: nf_tables: add support for inverted logic in nft_lookup
  • netfilter: nf_tables: get rid of possible_net_t from set and basechain
  • netfilter: nf_tables: simplify the basic expressions' init routine
  • netfilter: nf_tables: fix leak when expr clone fail
  • netfilter: nf_tables: missing sanitization in data from userspace
  • netfilter: nf_tables: revisit chain/object refcounting from elements
• CVE-2023-1380 // CVE-url: https://ubuntu.com/security/CVE-2023-1380
  • wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies()
• CVE-url: https://ubuntu.com/security/CVE-2023-2124
  • xfs: verify buffer contents when we skip log replay
• Bionic update: upstream stable patchset 2023-04-05 (LP: #2015399) // CVE- url: https://ubuntu.com/security/CVE-2023-32269
  • netrom: Fix use-after-free caused by accept on already connected socket
• Bionic update: upstream stable patchset 2023-04-05 (LP: #2015399) // CVE- url: https://ubuntu.com/security/CVE-2023-2162
  • scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress

• ALSA: pcm: Fix races among concurrent prealloc proc writes {CVE-2022-1048}
• ALSA: pcm: Fix races among concurrent prepare and hw_params/hw_free calls {CVE-2022-1048}
• ALSA: pcm: Fix races among concurrent read/write and buffer changes {CVE-2022-1048}
• ALSA: pcm: Fix races among concurrent hw_params and hw_free calls {CVE-2022-1048}
• x86/elf: Disable automatic READ_IMPLIES_EXEC on 64-bit {CVE-2022-25265}
• x86/elf: Split READ_IMPLIES_EXEC from executable PT_GNU_STACK {CVE-2022-25265}
• x86/elf: Add table to document READ_IMPLIES_EXEC {CVE-2022-25265}
• drm/i915: fix TLB invalidation for Gen12 video and compute engines {CVE-2022-4139}
• drm/i915: Flush TLBs before releasing backing store {CVE-2022-0330}
• xfs: fix up non-directory creation in SGID directories {CVE-2021-4037}
• tcp: Fix data races around icsk->icsk_af_ops. {CVE-2022-3566}
• ipv6: Fix data races around sk->sk_prot. {CVE-2022-3567}
• ipv6: annotate some data-races around sk->sk_prot {CVE-2022-3567}
• ipv6: use indirect call wrappers for {tcp, udpv6}_{recv, send}msg() {CVE-2022-3567}
• netfilter: nf_tables: deactivate anonymous set from preparation phase {CVE-2023-32233}
• netfilter: nf_tables: bogus EBUSY when deleting set after flush
• media: dmxdev: fix UAF when dvb_register_device() fails {CVE-2022-41218}
• l2tp: Don't sleep and disable BH under writer-side sk_callback_lock {CVE-2022-4129}
• l2tp: Serialize access to sk_user_data with sk_callback_lock {CVE-2022-4129}
• net: fix a concurrency bug in l2tp_tunnel_register() {CVE-2022-4129}
• Bluetooth: L2CAP: Fix memory leak in vhci_write {CVE-2022-3619}
• Bluetooth: L2CAP: Fix handling fragmented length
• wifi: brcmfmac: Fix potential buffer overflow in brcmf_fweh_event_worker() {CVE-2022-3628}
• wifi: cfg80211: avoid nontransmitted BSS list corruption {CVE-2022-42721}
• cfg80211: scan: fix RCU in cfg80211_add_nontrans_list()
• wifi: cfg80211: fix BSS refcounting bugs {CVE-2022-42720}
• cfg80211: hold bss_lock while updating nontrans_list
• ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF {CVE-2023-0266}
• ALSA: control: Drop superfluous snd_power_wait() calls
• ALSA: control: Track in-flight control read/write/tlv accesses
• ALSA: control - introduce snd_ctl_notify_one() helper
• Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu {CVE-2022-3564}
• netfilter: nf_conntrack_irc: Tighten matching on DCC message {CVE-2022-2663}
• netfilter: nf_conntrack_irc: Fix forged IP logic {CVE-2022-2663}
• KVM: x86: Avoid theoretical NULL pointer dereference in kvm_irq_delivery_to_apic_fast() {CVE-2022-2153}
• KVM: Add infrastructure and macro to mark VM as bugged
• KVM: x86/mmu: fix NULL pointer dereference on guest INVPCID {CVE-2022-1789}
• tcp/udp: Fix memory leak in ipv6_renew_options(). {CVE-2022-3524}
• proc: proc_skip_spaces() shouldn't think it is working on C strings {CVE-2022-4378}
• proc: avoid integer type confusion in get_proc_long {CVE-2022-4378}
• wifi: mac80211: fix crash in beacon protection for P2P-device {CVE-2022-42722}
• net: sched: cbq: dont intepret cls results when asked to drop {CVE-2023-23454}
• ipv6: raw: Deduct extension header length in rawv6_push_pending_frames {CVE-2023-0394}
• net: sched: disallow noqueue for qdisc classes {CVE-2022-47929}
• wifi: cfg80211: fix u8 overflow in cfg80211_update_notlisted_nontrans() {CVE-2022-41674}
• af_key: Do not call xfrm_probe_algs in parallel {CVE-2022-3028}
• dm verity: set DM_TARGET_IMMUTABLE feature flag {CVE-2022-20572}

• ALSA: pcm: Fix races among concurrent prealloc proc writes {CVE-2022-1048}
• ALSA: pcm: Fix races among concurrent prepare and hw_params/hw_free calls {CVE-2022-1048}
• ALSA: pcm: Fix races among concurrent read/write and buffer changes {CVE-2022-1048}
• ALSA: pcm: Fix races among concurrent hw_params and hw_free calls {CVE-2022-1048}
• x86/elf: Disable automatic READ_IMPLIES_EXEC on 64-bit {CVE-2022-25265}
• x86/elf: Split READ_IMPLIES_EXEC from executable PT_GNU_STACK {CVE-2022-25265}
• x86/elf: Add table to document READ_IMPLIES_EXEC {CVE-2022-25265}
• KVM: SEV-ES: fix another issue with string I/O VMGEXITs {CVE-2021-4093}
• KVM: SEV-ES: go over the sev_pio_data buffer in multiple passes if needed {CVE-2021-4093}
• KVM: SEV-ES: keep INS functions together {CVE-2021-4093}
• KVM: x86: remove unnecessary arguments from complete_emulator_pio_in {CVE-2021-4093}
• KVM: x86: split the two parts of emulator_pio_in {CVE-2021-4093}
• KVM: x86: leave vcpu->arch.pio.count alone in emulator_pio_in_out {CVE-2021-4093}
• KVM: SEV-ES: clean up kvm_sev_es_ins/outs {CVE-2021-4093}
• KVM: SEV-ES: rename guest_ins_data to sev_pio_data {CVE-2021-4093}
• KVM: SEV-ES: fix length of string I/O {CVE-2021-4093}
• drm/i915: fix TLB invalidation for Gen12 video and compute engines {CVE-2022-4139}
• drm/i915: Flush TLBs before releasing backing store {CVE-2022-0330}
• xfs: fix up non-directory creation in SGID directories {CVE-2021-4037}
• tcp: Fix data races around icsk->icsk_af_ops. {CVE-2022-3566}
• ipv6: Fix data races around sk->sk_prot. {CVE-2022-3567}
• ipv6: annotate some data-races around sk->sk_prot {CVE-2022-3567}
• ipv6: use indirect call wrappers for {tcp, udpv6}_{recv, send}msg() {CVE-2022-3567}
• netfilter: nf_tables: deactivate anonymous set from preparation phase {CVE-2023-32233}
• netfilter: nf_tables: bogus EBUSY when deleting set after flush
• media: dmxdev: fix UAF when dvb_register_device() fails {CVE-2022-41218}
• l2tp: Don't sleep and disable BH under writer-side sk_callback_lock {CVE-2022-4129}
• l2tp: Serialize access to sk_user_data with sk_callback_lock {CVE-2022-4129}
• net: fix a concurrency bug in l2tp_tunnel_register() {CVE-2022-4129}
• Bluetooth: L2CAP: Fix memory leak in vhci_write {CVE-2022-3619}
• Bluetooth: L2CAP: Fix handling fragmented length
• wifi: brcmfmac: Fix potential buffer overflow in brcmf_fweh_event_worker() {CVE-2022-3628}
• wifi: cfg80211: avoid nontransmitted BSS list corruption {CVE-2022-42721}
• cfg80211: scan: fix RCU in cfg80211_add_nontrans_list()
• wifi: cfg80211: fix BSS refcounting bugs {CVE-2022-42720}
• cfg80211: hold bss_lock while updating nontrans_list
• ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF {CVE-2023-0266}
• ALSA: control: Drop superfluous snd_power_wait() calls
• ALSA: control: Track in-flight control read/write/tlv accesses
• Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu {CVE-2022-3564}
• netfilter: nf_conntrack_irc: Tighten matching on DCC message {CVE-2022-2663}
• netfilter: nf_conntrack_irc: Fix forged IP logic {CVE-2022-2663}
• KVM: x86: Avoid theoretical NULL pointer dereference in kvm_irq_delivery_to_apic_fast() {CVE-2022-2153}
• KVM: Add infrastructure and macro to mark VM as bugged
• KVM: x86/mmu: fix NULL pointer dereference on guest INVPCID {CVE-2022-1789}
• tcp/udp: Fix memory leak in ipv6_renew_options(). {CVE-2022-3524}
• proc: proc_skip_spaces() shouldn't think it is working on C strings {CVE-2022-4378}
• proc: avoid integer type confusion in get_proc_long {CVE-2022-4378}
• wifi: mac80211: fix crash in beacon protection for P2P-device {CVE-2022-42722}
• net: sched: cbq: dont intepret cls results when asked to drop {CVE-2023-23454}
• ipv6: raw: Deduct extension header length in rawv6_push_pending_frames {CVE-2023-0394}
• net: sched: disallow noqueue for qdisc classes {CVE-2022-47929}
• wifi: cfg80211: fix u8 overflow in cfg80211_update_notlisted_nontrans() {CVE-2022-41674}
• af_key: Do not call xfrm_probe_algs in…

It was discovered that the OverlayFS implementation in the Linux kernel did not properly handle copy up operation in some conditions. A local attacker could possibly use this to gain elevated privileges.(CVE-2023-0386)

It was discovered that the Broadcom FullMAC USB WiFi driver in the Linux kernel did not properly perform data buffer size validation in some situations. A physically proximate attacker could use this to craft a malicious USB device that when inserted, could cause a denial of service (system crash) or possibly expose sensitive information.(CVE-2023-1380)

It was discovered that a race condition existed in the io_uring subsystem in the Linux kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-2023-1872)

Jean-Baptiste Cayrou discovered that the shiftfs file system in the Ubuntu Linux kernel contained a race condition when handling inode locking in some situations. A local attacker could use this to cause a denial of service (kernel deadlock).(CVE-2023-2612)

Gwangun Jung discovered that the Quick Fair Queueing scheduler implementation in the Linux kernel contained an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-2023-31436)

Patryk Sondej and Piotr Krysiuk discovered that a race condition existed in the netfilter subsystem of the Linux kernel when processing batch requests, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-2023-32233)

This kernel update is based on upstream 5.15.110 and fixes atleast the following security issues:

A slab-out-of-bound read problem was found in brcmf_get_assoc_ies in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c. This issue could occur when assoc_info->req_len data is bigger than the size of the buffer, defined as WL_EXTRA_BUF_MAX, leading to a denial of service (CVE-2023-1380).

It was discovered that a race condition existed in the Xen transport layer implementation for the 9P file system protocol in the Linux kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service or expose sensitive information (CVE-2023-1859).

An insufficient permission check has been found in the Bluetooth subsystem of the Linux kernel when handling ioctl system calls of HCI sockets. This causes tasks without the proper CAP_NET_ADMIN capability can easily mark HCI sockets as trusted. Trusted sockets are intended to enable the sending and receiving of management commands and events, such as pairing or connecting with a new device. As a result, unprivileged users can acquire a trusted socket, leading to unauthorized execution of management commands (CVE-2023-2002).

A heap out-of-bounds read/write vulnerability in the Linux Kernel traffic control (QoS) subsystem can be exploited to achieve local privilege escalation. The qfq_change_class function does not properly limit the lmax variable which can lead to out-of-bounds read/write. If the TCA_QFQ_LMAX value is not offered through nlattr, lmax is determined by the MTU value of the network device. The MTU of the loopback device can be set up to 2^31-1 and as a result, it is possible to have an lmax value that exceeds QFQ_MIN_LMAX (CVE-2023-2248).

qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write because lmax can exceed QFQ_MIN_LMAX (CVE-2023-31436).

Linux kernel use-after-free in Netfilter nf_tables when processing batch requests can be abused to perform arbitrary reads and writes in kernel memory. An unprivilegied local user can exploit this to start a local root shell (CVE-2023-32233).

For other upstream fixes in this update, see the referenced changelogs.

This kernel update is based on upstream 5.15.117 and fixes atleast the following security issues:

In the Linux kernel through 6.2.7, fs/ntfs3/inode.c has an invalid kfree because it does not validate MFT flags before replaying logs (CVE-2022-48425).

An out-of-bounds memory access flaw was found in the Linux kernel’s XFS file system in how a user restores an XFS image after failure (with a dirty log journal). This flaw allows a local user to crash or potentially escalate their privileges on the system (CVE-2023-2124).

A flaw was found in the networking subsystem of the Linux kernel within the handling of the RPL protocol. This issue results from the lack of proper handling of user-supplied data, which can lead to an assertion failure. This may allow an unauthenticated remote attacker to create a denial of service condition on the system (CVE-2023-2156).

A denial of service problem was found, due to a possible recursive locking scenario, resulting in a deadlock in table_clear in drivers/md/dm-ioctl.c in the Linux Kernel Device Mapper-Multipathing sub-component (CVE-2023-2269).

A use-after-free flaw was found in r592_remove in drivers/memstick/host/r592.c in media access in the Linux Kernel. This flaw allows a local attacker to crash the system at device disconnect, possibly leading to a kernel information leak (CVE-2023-3141).

A NULL pointer dereference issue was found in the gfs2 file system in the Linux kernel. It occurs on corrupt gfs2 file systems when the evict code tries to reference the journal descriptor structure after it has been freed and set to NULL. A privileged local user could use this flaw to cause a kernel panic (CVE-2023-3212).

An out of bounds (OOB) memory access flaw was found in the Linux kernel in relay_file_read_start_pos in kernel/relay.c in the relayfs. This flaw could allow a local attacker to crash the system or leak kernel internal information (CVE-2023-3268).

An issue was discovered in drivers/media/dvb-core/dvb_frontend.c in the Linux kernel 6.2. There is a blocking operation when a task is in !TASK_RUNNING. In dvb_frontend_get_event, wait_event_interruptible is called; the condition is dvb_frontend_test_event(fepriv,events). In dvb_frontend_test_event, down(&fepriv->sem) is called. However, wait_event_interruptible would put the process to sleep, and down(&fepriv->sem) may block the process (CVE-2023-31084).

In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users can obtain root privileges. This occurs because anonymous sets are mishandled (CVE-2023-32233).

An issue was discovered in the Linux kernel before 6.3.3. There is an out-of-bounds read in crc16 in lib/crc16.c when called from fs/ext4/super.c because ext4_group_desc_csum does not properly check an offset (CVE-2023-34256).

An issue was discovered in fl_set_geneve_opt in net/sched/cls_flower.c in the Linux kernel before 6.3.7. It allows an out-of-bounds write in the flower classifier code via TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets. This may result in denial of service or privilege escalation (CVE-2023-35788).

An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in saa7134_finidev in drivers/media/pci/saa7134/saa7134-core.c (CVE-2023-35823).

An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in dm1105_remove in drivers/media/pci/dm1105/dm1105.c (CVE-2023-35824).

An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in renesas_usb3_remove in drivers/usb/gadget/udc/renesas_usb3.c (CVE-2023-35828).

An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in rkvdec_remove in drivers/staging/media/rkvdec/rkvdec.c (CVE-2023-35829).

For other upstream fixes in this update, see the referenced changelogs.

This kernel-linus update is based on upstream 5.15.117 and fixes atleast the following security issues:

In the Linux kernel through 6.2.7, fs/ntfs3/inode.c has an invalid kfree because it does not validate MFT flags before replaying logs (CVE-2022-48425).

An out-of-bounds memory access flaw was found in the Linux kernel’s XFS file system in how a user restores an XFS image after failure (with a dirty log journal). This flaw allows a local user to crash or potentially escalate their privileges on the system (CVE-2023-2124).

A flaw was found in the networking subsystem of the Linux kernel within the handling of the RPL protocol. This issue results from the lack of proper handling of user-supplied data, which can lead to an assertion failure. This may allow an unauthenticated remote attacker to create a denial of service condition on the system (CVE-2023-2156).

A denial of service problem was found, due to a possible recursive locking scenario, resulting in a deadlock in table_clear in drivers/md/dm-ioctl.c in the Linux Kernel Device Mapper-Multipathing sub-component (CVE-2023-2269).

A use-after-free flaw was found in r592_remove in drivers/memstick/host/r592.c in media access in the Linux Kernel. This flaw allows a local attacker to crash the system at device disconnect, possibly leading to a kernel information leak (CVE-2023-3141).

A NULL pointer dereference issue was found in the gfs2 file system in the Linux kernel. It occurs on corrupt gfs2 file systems when the evict code tries to reference the journal descriptor structure after it has been freed and set to NULL. A privileged local user could use this flaw to cause a kernel panic (CVE-2023-3212).

An out of bounds (OOB) memory access flaw was found in the Linux kernel in relay_file_read_start_pos in kernel/relay.c in the relayfs. This flaw could allow a local attacker to crash the system or leak kernel internal information (CVE-2023-3268).

An issue was discovered in drivers/media/dvb-core/dvb_frontend.c in the Linux kernel 6.2. There is a blocking operation when a task is in !TASK_RUNNING. In dvb_frontend_get_event, wait_event_interruptible is called; the condition is dvb_frontend_test_event(fepriv,events). In dvb_frontend_test_event, down(&fepriv->sem) is called. However, wait_event_interruptible would put the process to sleep, and down(&fepriv->sem) may block the process (CVE-2023-31084).

In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users can obtain root privileges. This occurs because anonymous sets are mishandled (CVE-2023-32233).

An issue was discovered in the Linux kernel before 6.3.3. There is an out-of-bounds read in crc16 in lib/crc16.c when called from fs/ext4/super.c because ext4_group_desc_csum does not properly check an offset (CVE-2023-34256).

An issue was discovered in fl_set_geneve_opt in net/sched/cls_flower.c in the Linux kernel before 6.3.7. It allows an out-of-bounds write in the flower classifier code via TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets. This may result in denial of service or privilege escalation (CVE-2023-35788).

An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in saa7134_finidev in drivers/media/pci/saa7134/saa7134-core.c (CVE-2023-35823).

An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in dm1105_remove in drivers/media/pci/dm1105/dm1105.c (CVE-2023-35824).

An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in renesas_usb3_remove in drivers/usb/gadget/udc/renesas_usb3.c (CVE-2023-35828).

An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in rkvdec_remove in drivers/staging/media/rkvdec/rkvdec.c (CVE-2023-35829).

For other upstream fixes in this update, see the referenced changelogs.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: netfilter: use-after-free in nf_tables when processing batch requests can lead to privilege escalation (CVE-2023-32233)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• smpboot: Scheduler frequency invariance went wobbly, disabling! (BZ#2188316)

• Crash: kernel BUG at kernel/locking/rtmutex.c:1338! (BZ#2188722)

• kernel-rt: update RT source tree to the Rocky Linux-8.8.z0 source tree. (BZ#2196667)

The SUSE Linux Enterprise 15 SP4 AZURE kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-28410: Fixed improper restriction of operations within the bounds of a memory buffer in some Intel(R) i915 Graphics drivers that may have allowed an authenticated user to potentially enable escalation of privilege via local access (bsc#1211263).
• CVE-2023-2156: Fixed a flaw in the networking subsystem within the handling of the RPL protocol (bsc#1211131).
• CVE-2023-1382: Fixed denial of service in tipc_conn_close (bsc#1209288).
• CVE-2023-3006: Fixed a known cache speculation vulnerability, known as Branch History Injection (BHI) or Spectre-BHB, for the new hw AmpereOne (bsc#1211855).
• CVE-2023-2269: Fixed a denial-of-service problem due to a possible recursive locking scenario, resulting in a deadlock in table_clear in drivers/md/dm-ioctl.c (bsc#1210806).
• CVE-2023-1079: Fixed a use-after-free problem that could have been triggered in asus_kbd_backlight_set when plugging/disconnecting a malicious USB device (bsc#1208604).
• CVE-2023-2162: Fixed an use-after-free flaw in iscsi_sw_tcp_session_create (bsc#1210647).
• CVE-2023-33288: Fixed a use-after-free in bq24190_remove in drivers/power/supply/bq24190_charger.c (bsc#1211590).
• CVE-2022-45886: Fixed a .disconnect versus dvb_device_open race condition in dvb_net.c that lead to a use-after-free (bsc#1205760).
• CVE-2022-45885: Fixed a race condition in dvb_frontend.c that could cause a use-after-free when a device is disconnected (bsc#1205758).
• CVE-2022-45887: Fixed a memory leak in ttusb_dec.c caused by the lack of a dvb_frontend_detach call (bsc#1205762).
• CVE-2022-45919: Fixed a use-after-free in dvb_ca_en50221.c that could occur if there is a disconnect after an open, because of the lack of a wait_event (bsc#1205803).
• CVE-2022-45884: Fixed a use-after-free in dvbdev.c, related to dvb_register_device dynamically allocating fops (bsc#1205756).
• CVE-2023-31084: Fixed a blocking issue in drivers/media/dvb-core/dvb_frontend.c (bsc#1210783).
• CVE-2023-2002: Fixed a flaw that allowed an attacker to unauthorized execution of management commands, compromising the confidentiality, integrity, and availability of Bluetooth communication (bsc#1210533).
• CVE-2023-31436: Fixed an out-of-bounds write in qfq_change_class() because lmax can exceed QFQ_MIN_LMAX (bsc#1210940).
• CVE-2023-30456: Fixed an issue in arch/x86/kvm/vmx/nested.c with nVMX on x86_64 lacks consistency checks for CR0 and CR4 (bsc#1210294).
• CVE-2022-4269: Fixed a flaw was found inside the Traffic Control (TC) subsystem (bsc#1206024).
• CVE-2023-32233: Fixed a use-after-free in Netfilter nf_tables when processing batch requests (bsc#1211043).
• CVE-2023-1380: Fixed a slab-out-of-bound read problem in brcmf_get_assoc_ies() (bsc#1209287).
• CVE-2023-2513: Fixed a use-after-free vulnerability in the ext4 filesystem (bsc#1211105).
• CVE-2023-2483: Fixed a use after free bug in emac_remove due caused by a race condition (bsc#1211037).
• CVE-2023-2124: Fixed an out-of-bound access in the XFS subsystem that could have lead to denial-of-service or potentially privilege escalation (bsc#1210498).

The following non-security bugs were fixed:

• 3c589_cs: Fix an error handling path in tc589_probe() (git-fixes).
• ACPI: EC: Fix oops when removing custom query handlers (git-fixes).
• ACPI: bus: Ensure that notify handlers are not running after removal (git-fixes).
• ACPI: processor: Fix evaluating _PDC method when running as Xen dom0 (git-fixes).
• ACPI: tables: Add support for NBFT (bsc#1195921).
• ACPICA: ACPICA: check null return of ACPI_ALLOCATE_ZEROED in acpi_db_display_objects (git-fixes).
• ACPICA: Avoid undefined behavior: applying zero offset to null pointer (git-fixes).
• ALSA: caiaq: input: Add error handling for unsupported input methods in snd_usb_caiaq_input_init (git-fixes).
• ALSA: cs46xx: mark snd_cs46xx_download_image as static (git-fixes).
• ALSA:…

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-2156: Fixed a flaw in the networking subsystem within the handling of the RPL protocol (bsc#1211131).
• CVE-2023-1637: Fixed vulnerability that could lead to unauthorized access to CPU memory after resuming CPU from suspend-to-RAM (bsc#1209779).
• CVE-2022-3566: Fixed race condition in the TCP Handler (bsc#1204405).
• CVE-2020-36694: Fixed an use-after-free issue in netfilter in the packet processing context (bsc#1211596).
• CVE-2023-1079: Fixed a use-after-free problem that could have been triggered in asus_kbd_backlight_set when plugging/disconnecting a malicious USB device (bsc#1208604).
• CVE-2023-33288: Fixed a use-after-free in bq24190_remove in drivers/power/supply/bq24190_charger.c (bsc#1211590).
• CVE-2022-45886: Fixed a .disconnect versus dvb_device_open race condition in dvb_net.c that lead to a use-after-free (bsc#1205760).
• CVE-2022-45885: Fixed a race condition in dvb_frontend.c that could cause a use-after-free when a device is disconnected (bsc#1205758).
• CVE-2022-45887: Fixed a memory leak in ttusb_dec.c caused by the lack of a dvb_frontend_detach call (bsc#1205762).
• CVE-2022-45919: Fixed a use-after-free in dvb_ca_en50221.c that could occur if there is a disconnect after an open, because of the lack of a wait_event (bsc#1205803).
• CVE-2022-45884: Fixed a use-after-free in dvbdev.c, related to dvb_register_device dynamically allocating fops (bsc#1205756).
• CVE-2023-31084: Fixed a blocking issue in drivers/media/dvb-core/dvb_frontend.c (bsc#1210783).
• CVE-2023-31436: Fixed an out-of-bounds write in qfq_change_class() because lmax can exceed QFQ_MIN_LMAX (bsc#1210940 bsc#1211260).
• CVE-2023-2194: Fixed an out-of-bounds write vulnerability in the SLIMpro I2C device driver (bsc#1210715).
• CVE-2023-32269: Fixed a use-after-free in af_netrom.c, related to the fact that accept() was also allowed for a successfully connected AF_NETROM socket (bsc#1211186).
• CVE-2023-32233: Fixed a use-after-free in Netfilter nf_tables when processing batch requests (bsc#1211043).
• CVE-2022-4269: Fixed a flaw was found inside the Traffic Control (TC) subsystem (bsc#1206024).
• CVE-2023-1380: Fixed a slab-out-of-bound read problem in brcmf_get_assoc_ies() (bsc#1209287).
• CVE-2023-2513: Fixed a use-after-free vulnerability in the ext4 filesystem (bsc#1211105).
• CVE-2023-2483: Fixed a use after free bug in emac_remove due caused by a race condition (bsc#1211037).
• CVE-2023-23586: Fixed a memory information leak in the io_uring subsystem (bsc#1208474).

The following non-security bugs were fixed:

• Drivers: hv: vmbus: Optimize vmbus_on_event (bsc#1211622).
• SUNRPC: Ensure the transport backchannel association (bsc#1211203).
• ipv6: sr: fix out-of-bounds read when setting HMAC data (bsc#1211592).
• s390,dcssblk,dax: Add dax zero_page_range operation to dcssblk driver (bsc#1199636).