CVE-2023-2124

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: use-after-free in l2cap_connect and l2cap_le_connect_req in net/bluetooth/l2cap_core.c (CVE-2022-42896)

• kernel: tcindex: use-after-free vulnerability in traffic control index filter allows privilege escalation (CVE-2023-1281)

• kernel: Use-after-free vulnerability in the Linux Kernel traffic control index filter (CVE-2023-1829)

• kernel: use-after-free vulnerability in the perf_group_detach function of the Linux Kernel Performance Events (CVE-2023-2235)

• kernel: OOB access in the Linux kernel's XFS subsystem (CVE-2023-2124)

• kernel: i2c: out-of-bounds write in xgene_slimpro_i2c_xfer() (CVE-2023-2194)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• simultaneous writes to a page on xfs can result in zero-byte data (BZ#2184101)

• Rocky Linux 8.4 - kernel: fix __clear_user() inline assembly constraints (BZ#2192602)

• LPAR is crashed by Phyp when doing DLPAR CPU operations (BZ#2193375)

• ice: ptp4l cpu usage spikes (BZ#2203285)

• Kernel - Significant performance drop for getrandom system call when FIPS is enabled (compared to Rocky Linux 8.x for all x < 6.z) (BZ#2208127)

• macvlan: backports from upstream (BZ#2209686)

• Intel 8.9 BUG VROC: Pull VMD secondary bus reset patch (BZ#2211198)

• Incorrect target abort handling causes iscsi deadlock (BZ#2211494)

• swap deadlock when attempt to charge a page to a cgroup stalls waiting on I/O plugged on another task in swap code (BZ#2211513)

• BUG_ON "kernel BUG at mm/rmap.c:1041!" in __page_set_anon_rmap() when vma->anon_vma==NULL (BZ#2211658)

• Rocky Linux 8.9: IPMI updates and bug fixes (BZ#2211667)

• Rocky Linux 8.6 opening console with mkvterm on novalink terminal fails due to drmgr reporting failure (L3:) (BZ#2212373)

• Rocky Linux 8.8 - P10 DD2.0: Wrong numa_node is assigned to vpmem device (BZ#2212451)

• Rocky Linux 8.8 beta: Occasional stall during initialization of ipmi_msghandler (BZ#2213189)

• ESXi Rocky Linux 8: Haswell generation CPU are impacted with performance due to IBRS (BZ#2213366)

• xen: fix section mismatch error with xen_callback_vector() and alloc_intr_gate() (BZ#2214281)

• jitter: Fix RCT/APT health test during initialization (BZ#2215079)

• aacraid misses interrupts when a CPU is disabled resulting in scsi timeouts and the adapter being unusable until reboot. (BZ#2216498)

• Hyper-V Rocky Linux 8: Fix VM crash/hang Issues due to fast VF add/remove events (BZ#2216543)

• rbd: avoid fast-diff corruption in snapshot-based mirroring [8.9] (BZ#2216769)

• Regression of 3b8cc6298724 ("blk-cgroup: Optimize blkcg_rstat_flush()") (BZ#2220810)

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: use-after-free in l2cap_connect and l2cap_le_connect_req in net/bluetooth/l2cap_core.c (CVE-2022-42896)

• kernel: tcindex: use-after-free vulnerability in traffic control index filter allows privilege escalation (CVE-2023-1281)

• kernel: Use-after-free vulnerability in the Linux Kernel traffic control index filter (CVE-2023-1829)

• kernel: use-after-free vulnerability in the perf_group_detach function of the Linux Kernel Performance Events (CVE-2023-2235)

• kernel: OOB access in the Linux kernel's XFS subsystem (CVE-2023-2124)

• kernel: i2c: out-of-bounds write in xgene_slimpro_i2c_xfer() (CVE-2023-2194)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Addding the building of i915 driver to 8.8 (BZ#2208276)

• kernel-rt: update RT source tree to the Rocky Linux-8.8.z2 source tree (BZ#2215026)

An out-of-bounds memory access flaw was found in the Linux kernel’s XFS file system in how a user restores an XFS image after failure (with a dirty log journal). This flaw allows a local user to crash or potentially escalate their privileges on the system.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: use-after-free vulnerability in the perf_group_detach function of the Linux Kernel Performance Events (CVE-2023-2235)
• kernel: netfilter: use-after-free in nf_tables when processing batch requests can lead to privilege escalation (CVE-2023-32233)
• Kernel: bluetooth: Unauthorized management command execution (CVE-2023-2002)
• kernel: OOB access in the Linux kernel's XFS subsystem (CVE-2023-2124)
• kernel: i2c: out-of-bounds write in xgene_slimpro_i2c_xfer() (CVE-2023-2194)
• kernel: tls: race condition in do_tls_getsockopt may lead to use-after-free or NULL pointer dereference (CVE-2023-28466)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• [RT] Single Node Openshift cluster becomes unreachable after running less than 2 hours (BZ#2186853)
• kernel-rt: update RT source tree to the latest AlmaLinux-9.2.z1 Batch (BZ#2188313)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: use-after-free vulnerability in the perf_group_detach function of the Linux Kernel Performance Events (CVE-2023-2235)
• kernel: netfilter: use-after-free in nf_tables when processing batch requests can lead to privilege escalation (CVE-2023-32233)
• Kernel: bluetooth: Unauthorized management command execution (CVE-2023-2002)
• kernel: OOB access in the Linux kernel's XFS subsystem (CVE-2023-2124)
• kernel: i2c: out-of-bounds write in xgene_slimpro_i2c_xfer() (CVE-2023-2194)
• kernel: tls: race condition in do_tls_getsockopt may lead to use-after-free or NULL pointer dereference (CVE-2023-28466)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Intel QAT Update - (kernel changes) (BZ#2176846)
• RPL-P IOTG/RPL-S IOTG: cpu frequency issues (BZ#2178857)
• In FIPS mode, kernel does not transition into error state when RCT or APT health tests fail (BZ#2181727)
• Kernel BUG in iwlmvm wifi driver when used Mesh systems (BZ#2186723)
• Azure AlmaLinux 9 Backport upstream commit 93827a0a36396f2fd6368a54a020f420c8916e9b [KVM: VMX: Fix crash due to uninitialized current_vmcs] (BZ#2186822)
• AlmaLinux 9 blktests nvme/047 lead kernel NULL pointer (BZ#2187536)
• Single Node Openshift cluster becomes unreachable after running less than 2 hours (BZ#2187709)
• kernel[-rt]: task deadline_test:1778 blocked for more than 622 seconds (BZ#2188655)
• fix page end in filemap_get_read_batch (BZ#2189349)
• AlmaLinux 9.2 hwpoison: data loss when memory error occurs on hugetlb pagecache (BZ#2192348)
• wdat_wdt watchdog timeout triggered unexpectedly (BZ#2192585)
• ice: high CPU usage with GNSS or ptp4l (BZ#2203154)
• AlmaLinux 9 "smpboot: Scheduler frequency invariance went wobbly, disabling!" on nohz_full CPUs after long run (BZ#2203178)
• Dying percpu kworkers cause issues on isolated CPUs [almalinux-9] (BZ#2203229)
• FJ9.2 Bug: [REG] NFS infinite loop of COMMIT call and NFS4ERR_DELAY reply. (BZ#2203335)
• perf errors - "event syntax error: 'unc_p_delayed_c_state_abort_core5'" b'_ value too big for format, maximum is 255' (BZ#2207471)
• AlmaLinux 9: Invalid character detected by rpminspect in Documentation/translations/zh_CN/process/magic-number.rst (BZ#2208242)
• cifs: backport small patches to bring us close to 9.1 - backport commit aea02fc40a7f cifs: fix wrong unlock before return from cifs_tree_connect (BZ#2209045)
• AlmaLinux 9 x86_64, kdump 2nd kernel will randomly panic on "kvm-08-guest25.hv2" (BZ#2210614)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: use-after-free in l2cap_connect and l2cap_le_connect_req in net/bluetooth/l2cap_core.c (CVE-2022-42896)
• kernel: tcindex: use-after-free vulnerability in traffic control index filter allows privilege escalation (CVE-2023-1281)
• kernel: Use-after-free vulnerability in the Linux Kernel traffic control index filter (CVE-2023-1829)
• kernel: use-after-free vulnerability in the perf_group_detach function of the Linux Kernel Performance Events (CVE-2023-2235)
• kernel: OOB access in the Linux kernel's XFS subsystem (CVE-2023-2124)
• kernel: i2c: out-of-bounds write in xgene_slimpro_i2c_xfer() (CVE-2023-2194)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: use-after-free in l2cap_connect and l2cap_le_connect_req in net/bluetooth/l2cap_core.c (CVE-2022-42896)
• kernel: tcindex: use-after-free vulnerability in traffic control index filter allows privilege escalation (CVE-2023-1281)
• kernel: Use-after-free vulnerability in the Linux Kernel traffic control index filter (CVE-2023-1829)
• kernel: use-after-free vulnerability in the perf_group_detach function of the Linux Kernel Performance Events (CVE-2023-2235)
• kernel: OOB access in the Linux kernel's XFS subsystem (CVE-2023-2124)
• kernel: i2c: out-of-bounds write in xgene_slimpro_i2c_xfer() (CVE-2023-2194)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• CVE-2023-32233 // CVE-url: https://ubuntu.com/security/CVE-2023-32233
  • netfilter: nf_tables: add nft_set_is_anonymous() helper
  • netfilter: nf_tables: split set destruction in deactivate and destroy phase
  • netfilter: nf_tables: unbind set in rule from commit path
  • netfilter: nf_tables: fix set double-free in abort path
  • netfilter: nf_tables: bogus EBUSY when deleting set after flush
  • netfilter: nf_tables: use-after-free in failing rule with bound set
  • netfilter: nf_tables: deactivate anonymous set from preparation phase
• Bionic update: upstream stable patchset 2018-12-12 (LP: #1808185) // CVE- url: https://ubuntu.com/security/CVE-2023-32233
  • netfilter: nf_tables: bogus EBUSY in chain deletions
• CVE-url: https://ubuntu.com/security/CVE-2023-32233
  • netfilter: nf_tables: release objects on netns destruction
  • netfilter: nf_tables: destroy basechain and rules on netdevice removal
  • netfilter: nft_hash: support deletion of inactive elements
  • netfilter: nf_tables: remove check against removal of inactive objects
  • netfilter: nfnetlink: pass down netns pointer to call() and call_rcu()
  • netfilter: nf_tables: introduce nft_setelem_parse_flags() helper
  • netfilter: nft_rbtree: introduce nft_rbtree_interval_end() helper
  • netfilter: nft_rbtree: allow adjacent intervals with dynamic updates
  • netfilter: nf_tables: parse element flags from nft_del_setelem()
  • netfilter: nf_tables: reject loops from set element jump to chain
  • netfilter: nf_tables: fix wrong destroy anonymous sets if binding fails
  • netfilter: nf_tables: add generic macros to check for generation mask
  • netfilter: nf_tables: add generation mask to tables
  • netfilter: nf_tables: add generation mask to chains
  • netfilter: nf_tables: add generation mask to sets
  • netfilter: nf_tables: get rid of NFT_BASECHAIN_DISABLED
  • netlink: add NLM_F_NONREC flag for deletion requests
  • netfilter: nf_tables: add support for inverted logic in nft_lookup
  • netfilter: nf_tables: get rid of possible_net_t from set and basechain
  • netfilter: nf_tables: simplify the basic expressions' init routine
  • netfilter: nf_tables: fix leak when expr clone fail
  • netfilter: nf_tables: missing sanitization in data from userspace
  • netfilter: nf_tables: revisit chain/object refcounting from elements
• CVE-2023-1380 // CVE-url: https://ubuntu.com/security/CVE-2023-1380
  • wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies()
• CVE-url: https://ubuntu.com/security/CVE-2023-2124
  • xfs: verify buffer contents when we skip log replay
• Bionic update: upstream stable patchset 2023-04-05 (LP: #2015399) // CVE- url: https://ubuntu.com/security/CVE-2023-32269
  • netrom: Fix use-after-free caused by accept on already connected socket
• Bionic update: upstream stable patchset 2023-04-05 (LP: #2015399) // CVE- url: https://ubuntu.com/security/CVE-2023-2162
  • scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress

• CVE-2023-32233 // CVE-url: https://ubuntu.com/security/CVE-2023-32233
  • netfilter: nf_tables: add nft_set_is_anonymous() helper
  • netfilter: nf_tables: split set destruction in deactivate and destroy phase
  • netfilter: nf_tables: unbind set in rule from commit path
  • netfilter: nf_tables: fix set double-free in abort path
  • netfilter: nf_tables: bogus EBUSY when deleting set after flush
  • netfilter: nf_tables: use-after-free in failing rule with bound set
  • netfilter: nf_tables: deactivate anonymous set from preparation phase
• Bionic update: upstream stable patchset 2018-12-12 (LP: #1808185) // CVE- url: https://ubuntu.com/security/CVE-2023-32233
  • netfilter: nf_tables: bogus EBUSY in chain deletions
• CVE-url: https://ubuntu.com/security/CVE-2023-32233
  • netfilter: nf_tables: release objects on netns destruction
  • netfilter: nf_tables: destroy basechain and rules on netdevice removal
  • netfilter: nft_hash: support deletion of inactive elements
  • netfilter: nf_tables: remove check against removal of inactive objects
  • netfilter: nfnetlink: pass down netns pointer to call() and call_rcu()
  • netfilter: nf_tables: introduce nft_setelem_parse_flags() helper
  • netfilter: nft_rbtree: introduce nft_rbtree_interval_end() helper
  • netfilter: nft_rbtree: allow adjacent intervals with dynamic updates
  • netfilter: nf_tables: parse element flags from nft_del_setelem()
  • netfilter: nf_tables: reject loops from set element jump to chain
  • netfilter: nf_tables: fix wrong destroy anonymous sets if binding fails
  • netfilter: nf_tables: add generic macros to check for generation mask
  • netfilter: nf_tables: add generation mask to tables
  • netfilter: nf_tables: add generation mask to chains
  • netfilter: nf_tables: add generation mask to sets
  • netfilter: nf_tables: get rid of NFT_BASECHAIN_DISABLED
  • netlink: add NLM_F_NONREC flag for deletion requests
  • netfilter: nf_tables: add support for inverted logic in nft_lookup
  • netfilter: nf_tables: get rid of possible_net_t from set and basechain
  • netfilter: nf_tables: simplify the basic expressions' init routine
  • netfilter: nf_tables: fix leak when expr clone fail
  • netfilter: nf_tables: missing sanitization in data from userspace
  • netfilter: nf_tables: revisit chain/object refcounting from elements
• CVE-2023-1380 // CVE-url: https://ubuntu.com/security/CVE-2023-1380
  • wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies()
• CVE-url: https://ubuntu.com/security/CVE-2023-2124
  • xfs: verify buffer contents when we skip log replay
• Bionic update: upstream stable patchset 2023-04-05 (LP: #2015399) // CVE- url: https://ubuntu.com/security/CVE-2023-32269
  • netrom: Fix use-after-free caused by accept on already connected socket
• Bionic update: upstream stable patchset 2023-04-05 (LP: #2015399) // CVE- url: https://ubuntu.com/security/CVE-2023-2162
  • scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress

• Jammy update: v5.15.75 upstream stable release (LP: #1996825) // CVE-url: https://ubuntu.com/security/CVE-2022-1184
  • ext4: fix check for block being out of directory size
• Jammy update: v5.15.61 upstream stable release (LP: #1990162) // CVE-url: https://ubuntu.com/security/CVE-2022-1184
  • ext4: check if directory block is within i_size
• Jammy update: v5.15.68 upstream stable release (LP: #1993003) // CVE-url: https://ubuntu.com/security/CVE-2022-3303
  • ALSA: pcm: oss: Fix race at SNDCTL_DSP_SYNC
• CVE-2023-1670 // CVE-url: https://ubuntu.com/security/CVE-2023-1670
  • xirc2ps_cs: Fix use after free bug in xirc2ps_detach
• CVE-url: https://ubuntu.com/security/CVE-2023-1989
  • Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition
• Jammy update: v5.15.104 upstream stable release (LP: #2023225) // CVE-url: https://ubuntu.com/security/CVE-2023-1990
  • nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition
• CVE-url: https://ubuntu.com/security/CVE-2023-2007
  • scsi: dpt_i2o: Remove obsolete driver
• CVE-2023-2124 // CVE-url: https://ubuntu.com/security/CVE-2023-2124
  • xfs: verify buffer contents when we skip log replay
• CVE-url: https://ubuntu.com/security/CVE-2023-23000
  • phy: tegra: xusb: Fix return value of tegra_xusb_find_port_node function
• CVE-url: https://ubuntu.com/security/CVE-2023-28466
  • net: tls: fix possible race condition between do_tls_getsockopt_conf() and do_tls_setsockopt_conf()
• CVE-url: https://ubuntu.com/security/CVE-2023-3090
  • ipvlan:Fix out-of-bounds caused by unclear skb->cb
• Jammy update: v5.15.63 upstream stable release (LP: #1990564) // CVE-url: https://ubuntu.com/security/CVE-2023-3111
  • btrfs: unset reloc control if transaction commit fails in prepare_to_relocate()
• CVE-url: https://ubuntu.com/security/CVE-2023-3111
  • btrfs: check return value of btrfs_commit_transaction in relocation
• CVE-url: https://ubuntu.com/security/CVE-2023-3141
  • memstick: r592: Fix UAF bug in r592_remove due to race condition
• CVE-url: https://ubuntu.com/security/CVE-2023-3212
  • gfs2: Don't deref jdesc in evict
• CVE-url: https://ubuntu.com/security/CVE-2023-3268
  • kernel/relay.c: fix read_pos error when multiple readers
  • relayfs: fix out-of-bounds access in relay_file_read
• CVE-url: https://ubuntu.com/security/CVE-2023-3390
  • netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE
• CVE-url: https://ubuntu.com/security/CVE-2023-35823
  • media: saa7134: fix use after free bug in saa7134_finidev due to race condition
• CVE-url: https://ubuntu.com/security/CVE-2023-35824
  • media: dm1105: Fix use after free bug in dm1105_remove due to race condition
• Miscellaneous Ubuntu changes
  • [Config] updateconfigs for SCSI_DPT_I2O
• Miscellaneous upstream changes
  • fixup! UBUNTU: [Packaging]: add tuxcare suffix

• Jammy update: v5.15.75 upstream stable release (LP: #1996825) // CVE-url: https://ubuntu.com/security/CVE-2022-1184
  • ext4: fix check for block being out of directory size
• Jammy update: v5.15.61 upstream stable release (LP: #1990162) // CVE-url: https://ubuntu.com/security/CVE-2022-1184
  • ext4: check if directory block is within i_size
• Jammy update: v5.15.68 upstream stable release (LP: #1993003) // CVE-url: https://ubuntu.com/security/CVE-2022-3303
  • ALSA: pcm: oss: Fix race at SNDCTL_DSP_SYNC
• CVE-2023-1670 // CVE-url: https://ubuntu.com/security/CVE-2023-1670
  • xirc2ps_cs: Fix use after free bug in xirc2ps_detach
• CVE-url: https://ubuntu.com/security/CVE-2023-1989
  • Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition
• Jammy update: v5.15.104 upstream stable release (LP: #2023225) // CVE-url: https://ubuntu.com/security/CVE-2023-1990
  • nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition
• CVE-url: https://ubuntu.com/security/CVE-2023-2007
  • scsi: dpt_i2o: Remove obsolete driver
• CVE-2023-2124 // CVE-url: https://ubuntu.com/security/CVE-2023-2124
  • xfs: verify buffer contents when we skip log replay
• CVE-url: https://ubuntu.com/security/CVE-2023-23000
  • phy: tegra: xusb: Fix return value of tegra_xusb_find_port_node function
• CVE-url: https://ubuntu.com/security/CVE-2023-28466
  • net: tls: fix possible race condition between do_tls_getsockopt_conf() and do_tls_setsockopt_conf()
• CVE-url: https://ubuntu.com/security/CVE-2023-3090
  • ipvlan:Fix out-of-bounds caused by unclear skb->cb
• Jammy update: v5.15.63 upstream stable release (LP: #1990564) // CVE-url: https://ubuntu.com/security/CVE-2023-3111
  • btrfs: unset reloc control if transaction commit fails in prepare_to_relocate()
• CVE-url: https://ubuntu.com/security/CVE-2023-3111
  • btrfs: check return value of btrfs_commit_transaction in relocation
• CVE-url: https://ubuntu.com/security/CVE-2023-3141
  • memstick: r592: Fix UAF bug in r592_remove due to race condition
• CVE-url: https://ubuntu.com/security/CVE-2023-3212
  • gfs2: Don't deref jdesc in evict
• CVE-url: https://ubuntu.com/security/CVE-2023-3268
  • kernel/relay.c: fix read_pos error when multiple readers
  • relayfs: fix out-of-bounds access in relay_file_read
• CVE-url: https://ubuntu.com/security/CVE-2023-3390
  • netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE
• CVE-url: https://ubuntu.com/security/CVE-2023-35823
  • media: saa7134: fix use after free bug in saa7134_finidev due to race condition
• CVE-url: https://ubuntu.com/security/CVE-2023-35824
  • media: dm1105: Fix use after free bug in dm1105_remove due to race condition
• Miscellaneous Ubuntu changes
  • [Config] updateconfigs for SCSI_DPT_I2O
• Miscellaneous upstream changes
  • fixup! UBUNTU: [Packaging]: add tuxcare suffix

• xen/xenbus: don't let xenbus_grant_ring() remove grants in error case {CVE-2022-23040}
• xen/xenbus: Fix granting of vmalloc'd memory
• xen/blkfront: don't use gnttab_query_foreign_access() for mapped status {CVE-2022-23036}
• xen/grant-table: add gnttab_try_end_foreign_access() {CVE-2022-23036}
• xen/blkfront: don't trust the backend response data blindly
• xen/blkfront: don't take local copy of a request from the ring page
• xen/blkfront: read response from backend only once
• net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free {CVE-2023-4128}
• net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free {CVE-2023-4128}
• net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after-free {CVE-2023-4128}
• media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221 {CVE-2022-45919}
• media: dvb-core: Fix use-after-free due on race condition at dvb_net {CVE-2022-45886}
• vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF {CVE-2023-3567}
• Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb {CVE-2023-40283}
• net: vmxnet3: fix possible use-after-free bugs in vmxnet3_rq_alloc_rx_buf() {CVE-2023-4387}
• tty: use new tty_insert_flip_string_and_push_buffer() in pty_write() {CVE-2022-1462}
• tty: extract tty_flip_buffer_commit() from tty_flip_buffer_push()
• mmu_gather: Force tlb-flush VM_PFNMAP vmas {CVE-2022-39188}
• net/sched: cls_u32: Fix reference counter leak leading to overflow {CVE-2023-3609}
• netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE {CVE-2023-3117}
• relayfs: fix out-of-bounds access in relay_file_read {CVE-2023-3268}
• xfs: verify buffer contents when we skip log replay {CVE-2023-2124}
• netfilter: nf_tables: stricter validation of element data {CVE-2022-34918}
• tpm: fix reference counting for struct tpm_chip {CVE-2022-2977}
• drm/virtio: Fix compile warnings (ents/nents) {CVE-2023-22998}
• drm/virtio: Correct drm_gem_shmem_get_sg_table() error handling {CVE-2023-22998}
• drm/virtio: Fix NULL vs IS_ERR checking in virtio_gpu_object_shmem_init {CVE-2023-22998}
• gfs2: Don't deref jdesc in evict {CVE-2023-3212}
• drm/i915/gvt: fix double free bug in split_2MB_gtt_entry {CVE-2022-3707}
• drm/amdkfd: Check for null pointer after calling kmemdup {CVE-2022-3108}
• hv_netvsc: Add check for kvmalloc_array {CVE-2022-3107}
• sfc_ef100: potential dereference of null pointer {CVE-2022-3106}
• RDMA/uverbs: Check for null return of kmalloc_array {CVE-2022-3105}
• drm: use the lookup lock in drm_is_current_master {CVE-2022-1280}
• drm: add a locked version of drm_is_current_master {CVE-2022-1280}
• drm: serialize drm_file.master with a new spinlock {CVE-2022-1280}
• drm/vmwgfx: fix potential UAF in vmwgfx_surface.c {CVE-2022-1280}
• drm: protect drm_master pointers in drm_lease.c {CVE-2022-1280}

• xen/xenbus: don't let xenbus_grant_ring() remove grants in error case {CVE-2022-23040}
• xen/xenbus: Fix granting of vmalloc'd memory
• xen/blkfront: don't use gnttab_query_foreign_access() for mapped status {CVE-2022-23036}
• xen/grant-table: add gnttab_try_end_foreign_access() {CVE-2022-23036}
• xen/blkfront: don't trust the backend response data blindly
• xen/blkfront: don't take local copy of a request from the ring page
• xen/blkfront: read response from backend only once
• net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free {CVE-2023-4128}
• net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free {CVE-2023-4128}
• net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after-free {CVE-2023-4128}
• media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221 {CVE-2022-45919}
• media: dvb-core: Fix use-after-free due on race condition at dvb_net {CVE-2022-45886}
• vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF {CVE-2023-3567}
• Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb {CVE-2023-40283}
• net: vmxnet3: fix possible use-after-free bugs in vmxnet3_rq_alloc_rx_buf() {CVE-2023-4387}
• tty: use new tty_insert_flip_string_and_push_buffer() in pty_write() {CVE-2022-1462}
• tty: extract tty_flip_buffer_commit() from tty_flip_buffer_push()
• mmu_gather: Force tlb-flush VM_PFNMAP vmas {CVE-2022-39188}
• net/sched: cls_u32: Fix reference counter leak leading to overflow {CVE-2023-3609}
• netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE {CVE-2023-3117}
• relayfs: fix out-of-bounds access in relay_file_read {CVE-2023-3268}
• xfs: verify buffer contents when we skip log replay {CVE-2023-2124}
• netfilter: nf_tables: stricter validation of element data {CVE-2022-34918}
• tpm: fix reference counting for struct tpm_chip {CVE-2022-2977}
• drm/virtio: Fix compile warnings (ents/nents) {CVE-2023-22998}
• drm/virtio: Correct drm_gem_shmem_get_sg_table() error handling {CVE-2023-22998}
• drm/virtio: Fix NULL vs IS_ERR checking in virtio_gpu_object_shmem_init {CVE-2023-22998}
• gfs2: Don't deref jdesc in evict {CVE-2023-3212}
• drm/i915/gvt: fix double free bug in split_2MB_gtt_entry {CVE-2022-3707}
• drm/amdkfd: Check for null pointer after calling kmemdup {CVE-2022-3108}
• hv_netvsc: Add check for kvmalloc_array {CVE-2022-3107}
• sfc_ef100: potential dereference of null pointer {CVE-2022-3106}
• RDMA/uverbs: Check for null return of kmalloc_array {CVE-2022-3105}
• drm: use the lookup lock in drm_is_current_master {CVE-2022-1280}
• drm: add a locked version of drm_is_current_master {CVE-2022-1280}
• drm: serialize drm_file.master with a new spinlock {CVE-2022-1280}
• drm/vmwgfx: fix potential UAF in vmwgfx_surface.c {CVE-2022-1280}
• drm: protect drm_master pointers in drm_lease.c {CVE-2022-1280}
• KVM: avoid NULL pointer dereference in kvm_dirty_ring_push {CVE-2022-1263}

• kvm: initialize all of the kvm_debugregs structure before sending it to userspace {CVE-2023-1513}
• wifi: mac80211: fix MBSSID parsing use-after-free {CVE-2022-42719}
• mac80211: always allocate struct ieee802_11_elems {CVE-2022-42719}
• netfilter: nf_tables: initialize registers in nft_do_chain() {CVE-2022-1016}
• xprtrdma: fix incorrect header size calculations {CVE-2022-0812}
• net: usb: fix memory leak in smsc75xx_bind {CVE-2021-47171}
• i2c: i801: Don't generate an interrupt on bus reset {CVE-2021-47153}
• pid: take a reference when initializing cad_pid {CVE-2021-47118}
• Input: appletouch - initialize work before device registration {CVE-2021-46932}
• HID: usbhid: fix info leak in hid_submit_ctrl {CVE-2021-46906}
• quota: check block number when reading the block in quota file {CVE-2021-45868}
• mwifiex: Fix skb_over_panic in mwifiex_usb_recv() {CVE-2021-43976}
• atlantic: Fix OOB read and write in hw_atl_utils_fw_rpc_wait {CVE-2021-43975}
• isdn: cpai: check ctr->cnr to avoid array index out of bound {CVE-2021-43389}
• usb: hso: fix error handling code of hso_create_net_device {CVE-2021-37159}
• can: bcm: fix infoleak in struct bcm_msg_head {CVE-2021-34693}
• dm ioctl: fix out of bounds array access when no devices {CVE-2021-31916}
• KVM: x86: hyper-v: Fix Hyper-V context null-ptr-deref {CVE-2021-30178}
• perf/x86/intel: Fix a crash caused by zero PEBS status {CVE-2021-28971}
• btrfs: fix race when cloning extent buffer during rewind of an old root {CVE-2021-28964}
• ovl: fix missing negative dentry check in ovl_rename() {CVE-2021-20321}
• drm/ttm/nouveau: don't call tt destroy callback on alloc failure. {CVE-2021-20292}
• bpf: Verifer, adjust_scalar_min_max_vals to always call update_reg_bounds() {CVE-2021-4159}
• btrfs: unlock newly allocated extent buffer after error {CVE-2021-4149}
• tracing: Fix bug in rb_per_cpu_empty() that might cause deadloop. {CVE-2021-3679}
• net: mac802154: Fix general protection fault {CVE-2021-3659}
• nfsd4: readdirplus shouldn't return parent of export {CVE-2021-3178}
• Bluetooth: SMP: Fail if remote and local public keys are identical {CVE-2021-0129}
• drm/nouveau: clean up all clients on device removal {CVE-2020-27820}
• drm/nouveau: Add a dedicated mutex for the clients list {CVE-2020-27820}
• drm/nouveau: use drm_dev_unplug() during device removal {CVE-2020-27820}
• Bluetooth: SMP: Fail if remote and local public keys are identical {CVE-2020-26555}
• vsock: Fix memory leak in vsock_connect() {CVE-2022-3629}
• RDMA/core: Don't infoleak GRH fields {CVE-2021-3923}
• xen/netfront: force data bouncing when backend is untrusted {CVE-2022-33741}
• net: Rename and export copy_skb_header
• floppy: use a statically allocated error counter {CVE-2022-1652}
• fuse: fix pipe buffer lifetime for direct_io {CVE-2022-1011}
• aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts {CVE-2024-26898}
• smb: client: fix use-after-free bug in cifs_debug_data_proc_show() {CVE-2023-52752}
• media: pvrusb2: fix use after free on context disconnection {CVE-2023-52445}
• media: dm1105: Fix use after free bug in dm1105_remove due to race condition {CVE-2023-35824}
• perf: Fix perf_event_validate_size() lockdep splat {CVE-2023-6931}
• perf: Fix perf_event_validate_size() {CVE-2023-6931}
• net/sched: sch_hfsc: Ensure inner classes have fsc curve {CVE-2023-4623}
• relayfs: fix out-of-bounds access in relay_file_read {CVE-2023-3268}
• xfs: verify buffer contents when we skip log replay {CVE-2023-2124}
• Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition {CVE-2023-1989}
• Fix double fget() in vhost_net_set_backend() {CVE-2023-1838}
• net/sched: cls_tcindex: downgrade to imperfect hash {CVE-2023-1829}
• xen/netfront: fix leaking data in shared pages {CVE-2022-33740}
• can: ems_usb: ems_usb_start_xmit(): fix double dev_kfree_skb() in error path {CVE-2022-28390}
• xen/blkfront: fix leaking data in shared pages {CVE-2022-26365}
• mISDN: fix use-after-free bugs in l1oip timer…

An out-of-bounds memory access flaw was found in the Linux kernel’s XFS file system in how a user restores an XFS image after failure (with a dirty log journal). This flaw allows a local user to crash or potentially escalate their privileges on the system.

This kernel update is based on upstream 5.15.117 and fixes atleast the following security issues:

In the Linux kernel through 6.2.7, fs/ntfs3/inode.c has an invalid kfree because it does not validate MFT flags before replaying logs (CVE-2022-48425).

An out-of-bounds memory access flaw was found in the Linux kernel’s XFS file system in how a user restores an XFS image after failure (with a dirty log journal). This flaw allows a local user to crash or potentially escalate their privileges on the system (CVE-2023-2124).

A flaw was found in the networking subsystem of the Linux kernel within the handling of the RPL protocol. This issue results from the lack of proper handling of user-supplied data, which can lead to an assertion failure. This may allow an unauthenticated remote attacker to create a denial of service condition on the system (CVE-2023-2156).

A denial of service problem was found, due to a possible recursive locking scenario, resulting in a deadlock in table_clear in drivers/md/dm-ioctl.c in the Linux Kernel Device Mapper-Multipathing sub-component (CVE-2023-2269).

A use-after-free flaw was found in r592_remove in drivers/memstick/host/r592.c in media access in the Linux Kernel. This flaw allows a local attacker to crash the system at device disconnect, possibly leading to a kernel information leak (CVE-2023-3141).

A NULL pointer dereference issue was found in the gfs2 file system in the Linux kernel. It occurs on corrupt gfs2 file systems when the evict code tries to reference the journal descriptor structure after it has been freed and set to NULL. A privileged local user could use this flaw to cause a kernel panic (CVE-2023-3212).

An out of bounds (OOB) memory access flaw was found in the Linux kernel in relay_file_read_start_pos in kernel/relay.c in the relayfs. This flaw could allow a local attacker to crash the system or leak kernel internal information (CVE-2023-3268).

An issue was discovered in drivers/media/dvb-core/dvb_frontend.c in the Linux kernel 6.2. There is a blocking operation when a task is in !TASK_RUNNING. In dvb_frontend_get_event, wait_event_interruptible is called; the condition is dvb_frontend_test_event(fepriv,events). In dvb_frontend_test_event, down(&fepriv->sem) is called. However, wait_event_interruptible would put the process to sleep, and down(&fepriv->sem) may block the process (CVE-2023-31084).

In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users can obtain root privileges. This occurs because anonymous sets are mishandled (CVE-2023-32233).

An issue was discovered in the Linux kernel before 6.3.3. There is an out-of-bounds read in crc16 in lib/crc16.c when called from fs/ext4/super.c because ext4_group_desc_csum does not properly check an offset (CVE-2023-34256).

An issue was discovered in fl_set_geneve_opt in net/sched/cls_flower.c in the Linux kernel before 6.3.7. It allows an out-of-bounds write in the flower classifier code via TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets. This may result in denial of service or privilege escalation (CVE-2023-35788).

An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in saa7134_finidev in drivers/media/pci/saa7134/saa7134-core.c (CVE-2023-35823).

An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in dm1105_remove in drivers/media/pci/dm1105/dm1105.c (CVE-2023-35824).

An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in renesas_usb3_remove in drivers/usb/gadget/udc/renesas_usb3.c (CVE-2023-35828).

An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in rkvdec_remove in drivers/staging/media/rkvdec/rkvdec.c (CVE-2023-35829).

For other upstream fixes in this update, see the referenced changelogs.

This kernel-linus update is based on upstream 5.15.117 and fixes atleast the following security issues:

In the Linux kernel through 6.2.7, fs/ntfs3/inode.c has an invalid kfree because it does not validate MFT flags before replaying logs (CVE-2022-48425).

An out-of-bounds memory access flaw was found in the Linux kernel’s XFS file system in how a user restores an XFS image after failure (with a dirty log journal). This flaw allows a local user to crash or potentially escalate their privileges on the system (CVE-2023-2124).

A flaw was found in the networking subsystem of the Linux kernel within the handling of the RPL protocol. This issue results from the lack of proper handling of user-supplied data, which can lead to an assertion failure. This may allow an unauthenticated remote attacker to create a denial of service condition on the system (CVE-2023-2156).

A denial of service problem was found, due to a possible recursive locking scenario, resulting in a deadlock in table_clear in drivers/md/dm-ioctl.c in the Linux Kernel Device Mapper-Multipathing sub-component (CVE-2023-2269).

A use-after-free flaw was found in r592_remove in drivers/memstick/host/r592.c in media access in the Linux Kernel. This flaw allows a local attacker to crash the system at device disconnect, possibly leading to a kernel information leak (CVE-2023-3141).

A NULL pointer dereference issue was found in the gfs2 file system in the Linux kernel. It occurs on corrupt gfs2 file systems when the evict code tries to reference the journal descriptor structure after it has been freed and set to NULL. A privileged local user could use this flaw to cause a kernel panic (CVE-2023-3212).

An out of bounds (OOB) memory access flaw was found in the Linux kernel in relay_file_read_start_pos in kernel/relay.c in the relayfs. This flaw could allow a local attacker to crash the system or leak kernel internal information (CVE-2023-3268).

An issue was discovered in drivers/media/dvb-core/dvb_frontend.c in the Linux kernel 6.2. There is a blocking operation when a task is in !TASK_RUNNING. In dvb_frontend_get_event, wait_event_interruptible is called; the condition is dvb_frontend_test_event(fepriv,events). In dvb_frontend_test_event, down(&fepriv->sem) is called. However, wait_event_interruptible would put the process to sleep, and down(&fepriv->sem) may block the process (CVE-2023-31084).

In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users can obtain root privileges. This occurs because anonymous sets are mishandled (CVE-2023-32233).

An issue was discovered in the Linux kernel before 6.3.3. There is an out-of-bounds read in crc16 in lib/crc16.c when called from fs/ext4/super.c because ext4_group_desc_csum does not properly check an offset (CVE-2023-34256).

An issue was discovered in fl_set_geneve_opt in net/sched/cls_flower.c in the Linux kernel before 6.3.7. It allows an out-of-bounds write in the flower classifier code via TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets. This may result in denial of service or privilege escalation (CVE-2023-35788).

An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in saa7134_finidev in drivers/media/pci/saa7134/saa7134-core.c (CVE-2023-35823).

An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in dm1105_remove in drivers/media/pci/dm1105/dm1105.c (CVE-2023-35824).

An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in renesas_usb3_remove in drivers/usb/gadget/udc/renesas_usb3.c (CVE-2023-35828).

An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in rkvdec_remove in drivers/staging/media/rkvdec/rkvdec.c (CVE-2023-35829).

For other upstream fixes in this update, see the referenced changelogs.

These are all security issues fixed in the kernel-devel-6.3.6-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the kernel-devel-longterm-6.6.17-1.1 package on the GA media of openSUSE Tumbleweed.

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-2124: Fixed an out of bound access in the XFS subsystem that could have lead to denial-of-service or potentially privilege escalation (bsc#1210498).
• CVE-2023-1872:Fixed a use after free vulnerability in the io_uring subsystem, which could lead to local privilege escalation (bsc#1210414).
• CVE-2022-2196: Fixed a regression related to KVM that allowed for speculative execution attacks (bsc#1206992).
• CVE-2023-1670: Fixed a use after free in the Xircom 16-bit PCMCIA Ethernet driver. A local user could use this flaw to crash the system or potentially escalate their privileges on the system (bsc#1209871).
• CVE-2023-2162: Fixed an use-after-free flaw in iscsi_sw_tcp_session_create (bsc#1210647).
• CVE-2023-2176: A vulnerability was found in compare_netdev_and_ip in drivers/infiniband/core/cma.c in RDMA. The improper cleanup results in out-of-boundary read, where a local user can utilize this problem to crash the system or escalation of privilege (bsc#1210629).
• CVE-2023-1998: Fixed a use after free during login when accessing the shost ipaddress (bsc#1210506).
• CVE-2023-30772: Fixed a race condition and resultant use-after-free in da9150_charger_remove (bsc#1210329).
• CVE-2023-2008: A flaw was found in the fault handler of the udmabuf device driver. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code (bsc#1210453).
• CVE-2023-1855: Fixed a use after free in xgene_hwmon_remove (bsc#1210202).
• CVE-2020-36691: Fixed a denial of service vulnerability via a nested Netlink policy with a back reference (bsc#1209777).
• CVE-2023-1990: Fixed a use after free in ndlc_remove (bsc#1210337).
• CVE-2023-1989: Fixed a use after free in btsdio_remove (bsc#1210336).
• CVE-2023-1611: Fixed an use-after-free flaw in btrfs_search_slot (bsc#1209687).
• CVE-2023-1838: Fixed an use-after-free flaw in virtio network subcomponent. This flaw could allow a local attacker to crash the system and lead to a kernel information leak problem. (bsc#1210203).

The following non-security bugs were fixed:

• Drivers: vmbus: Check for channel allocation before looking up relids (git-fixes).
• cifs: fix negotiate context parsing (bsc#1210301).
• keys: Fix linking a duplicate key to a keyring's assoc_array (bsc#1207088).
• vmxnet3: use gro callback when UPT is enabled (bsc#1209739).

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-2124: Fixed an out of bound access in the XFS subsystem that could have lead to denial-of-service or potentially privilege escalation (bsc#1210498).
• CVE-2023-1872:Fixed a use after free vulnerability in the io_uring subsystem, which could lead to local privilege escalation (bsc#1210414).
• CVE-2022-2196: Fixed a regression related to KVM that allowed for speculative execution attacks (bsc#1206992).
• CVE-2023-1670: Fixed a use after free in the Xircom 16-bit PCMCIA Ethernet driver. A local user could use this flaw to crash the system or potentially escalate their privileges on the system (bsc#1209871).
• CVE-2023-2162: Fixed an use-after-free flaw in iscsi_sw_tcp_session_create (bsc#1210647).
• CVE-2023-2176: A vulnerability was found in compare_netdev_and_ip in drivers/infiniband/core/cma.c in RDMA. The improper cleanup results in out-of-boundary read, where a local user can utilize this problem to crash the system or escalation of privilege (bsc#1210629).
• CVE-2023-1998: Fixed a use after free during login when accessing the shost ipaddress (bsc#1210506).
• CVE-2023-30772: Fixed a race condition and resultant use-after-free in da9150_charger_remove (bsc#1210329).
• CVE-2023-2008: A flaw was found in the fault handler of the udmabuf device driver. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code (bsc#1210453).
• CVE-2023-1855: Fixed a use after free in xgene_hwmon_remove (bsc#1210202).
• CVE-2020-36691: Fixed a denial of service vulnerability via a nested Netlink policy with a back reference (bsc#1209777).
• CVE-2023-1990: Fixed a use after free in ndlc_remove (bsc#1210337).
• CVE-2023-1989: Fixed a use after free in btsdio_remove (bsc#1210336).
• CVE-2022-43945: Fixed a buffer overflow in the NFSD implementation (bsc#1205128).
• CVE-2023-1611: Fixed an use-after-free flaw in btrfs_search_slot (bsc#1209687).
• CVE-2023-1838: Fixed an use-after-free flaw in virtio network subcomponent. This flaw could allow a local attacker to crash the system and lead to a kernel information leak problem. (bsc#1210203).

The following non-security bugs were fixed:

• Drivers: vmbus: Check for channel allocation before looking up relids (git-fixes).
• cifs: fix negotiate context parsing (bsc#1210301).
• keys: Fix linking a duplicate key to a keyring's assoc_array (bsc#1207088).
• vmxnet3: use gro callback when UPT is enabled (bsc#1209739).

The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-2124: Fixed an out of bound access in the XFS subsystem that could have lead to denial-of-service or potentially privilege escalation (bsc#1210498).
• CVE-2023-1670: Fixed a use after free in the Xircom 16-bit PCMCIA Ethernet driver. A local user could use this flaw to crash the system or potentially escalate their privileges on the system (bsc#1209871).
• CVE-2023-2162: Fixed an use-after-free flaw in iscsi_sw_tcp_session_create (bsc#1210647).
• CVE-2023-1998: Fixed a use after free during login when accessing the shost ipaddress (bsc#1210506).
• CVE-2023-30772: Fixed a race condition and resultant use-after-free in da9150_charger_remove (bsc#1210329).
• CVE-2023-1855: Fixed a use after free in xgene_hwmon_remove (bsc#1210202).
• CVE-2023-1989: Fixed a use after free in btsdio_remove (bsc#1210336).
• CVE-2023-1990: Fixed a use after free in ndlc_remove (bsc#1210337).
• CVE-2022-43945: Fixed a buffer overflow in the NFSD implementation (bsc#1205128).
• CVE-2023-1611: Fixed an use-after-free flaw in btrfs_search_slot (bsc#1209687).
• CVE-2020-36691: Fixed a denial of service vulnerability via a nested Netlink policy with a back reference (bsc#1209777).

The following non-security bugs were fixed:

• cifs: fix negotiate context parsing (bsc#1210301).
• cred: allow get_cred() and put_cred() to be given NULL (bsc#1209887).

The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-2124: Fixed an out of bound access in the XFS subsystem that could have lead to denial-of-service or potentially privilege escalation (bsc#1210498).
• CVE-2023-1670: Fixed a use after free in the Xircom 16-bit PCMCIA Ethernet driver. A local user could use this flaw to crash the system or potentially escalate their privileges on the system (bsc#1209871).
• CVE-2023-2162: Fixed an use-after-free flaw in iscsi_sw_tcp_session_create (bsc#1210647).
• CVE-2023-1998: Fixed a use after free during login when accessing the shost ipaddress (bsc#1210506).
• CVE-2023-30772: Fixed a race condition and resultant use-after-free in da9150_charger_remove (bsc#1210329).
• CVE-2023-1855: Fixed a use after free in xgene_hwmon_remove (bsc#1210202).
• CVE-2023-1989: Fixed a use after free in btsdio_remove (bsc#1210336).
• CVE-2023-1990: Fixed a use after free in ndlc_remove (bsc#1210337).

The following non-security bugs were fixed:

• ath10k: Fix error handling in case of CE pipe init failure (git-fixes).
• ath10k: Fix missing frame timestamp for beacon/probe-resp (git-fixes).
• ath10k: Fix the parsing error in service available event (git-fixes).
• ath10k: add missing error return code in ath10k_pci_probe() (git-fixes).
• ath10k: fix control-message timeout (git-fixes).
• ath10k: fix division by zero in send path (git-fixes).
• ath10k: fix memory overwrite of the WoWLAN wakeup packet pattern (git-fixes).
• audit: improve audit queue handling when 'audit=1' on cmdline (bsc#1209969).
• bpf, x86: Fix encoding for lower 8-bit registers in BPF_STX BPF_B (git-fixes).
• cachefiles: Drop superfluous readpages aops NULL check (bsc#1210430).
• cachefiles: Fix page leak in cachefiles_read_backing_file while vmscan is active (bsc#1210430).
• cachefiles: Fix race between read_waiter and read_copier involving op->to_do (bsc#1210430).
• cachefiles: Handle readpage error correctly (bsc#1210430).
• cgroup/cpuset: Wake up cpuset_attach_wq tasks in cpuset_cancel_attach() (bsc#1210827).
• cifs: fix negotiate context parsing (bsc#1210301).
• cifs: fix open leaks in open_cached_dir() (bsc#1209342).
• cred: allow get_cred() and put_cred() to be given NULL (bsc#1209887).
• crypto: x86/ghash - fix unaligned access in ghash_setkey() (git-fixes).
• drivers: net: lmc: fix case value for target abort error (git-fixes).
• fscache, cachefiles: remove redundant variable 'cache' (bsc#1210430).
• ftrace: Mark get_lock_parent_ip() __always_inline (git-fixes).
• intel_pmc_ipc: restore ability to call functions with irq enabled (git-fixes).
• ipmi: fix SSIF not responding under certain cond (git-fixes).
• iwlwifi: Fix -EIO error code that is never returned (git-fixes).
• iwlwifi: fw: make pos static in iwl_sar_get_ewrd_table() loop (git-fixes).
• iwlwifi: pcie: fix locking when 'HW not ready' (git-fixes).
• iwlwifi: pcie: gen2: fix locking when 'HW not ready' (git-fixes).
• iwlwifi: pcie: reschedule in long-running memory reads (git-fixes).
• kabi/severities: ignore KABI for NVMe, except nvme-fc (bsc#1174777).
• kcm: Only allow TCP sockets to be attached to a KCM mux (git-fixes).
• keys: Change keyring_serialise_link_sem to a mutex (bsc#1207088).
• keys: Fix linking a duplicate key to a keyring's assoc_array (bsc#1207088).
• keys: Hoist locking out of __key_link_begin() (bsc#1207088).
• kretprobe: Prevent triggering kretprobe from within kprobe_flush_task (git-fixes).
• l2tp: clean up stale tunnel or session in pppol2tp_connect's error path (git-fixes).
• l2tp: fix pseudo-wire type for sessions created by pppol2tp_connect() (git-fixes).
• l2tp: reject creation of non-PPP sessions on L2TPv2 tunnels (git-fixes).
• net/ncsi: Do not return error on normal response (git-fixes).
• net: axienet: Fix double deregister of mdio (git-fixes).
• net: core: dst: Add kernel-doc for 'net' parameter (git-fixes).
• net: core: dst_cache_set_ip6:…

The SUSE Linux Enterprise 12 SP5 AZURE kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-2483: Fixed a use after free bug in emac_remove due caused by a race condition (bsc#1211037).
• CVE-2023-2124: Fixed an out of bound access in the XFS subsystem that could have lead to denial-of-service or potentially privilege escalation (bsc#1210498).
• CVE-2023-1670: Fixed a use after free in the Xircom 16-bit PCMCIA Ethernet driver. A local user could use this flaw to crash the system or potentially escalate their privileges on the system (bsc#1209871).
• CVE-2023-2162: Fixed an use-after-free flaw in iscsi_sw_tcp_session_create (bsc#1210647).
• CVE-2023-1998: Fixed a use after free during login when accessing the shost ipaddress (bsc#1210506).
• CVE-2023-30772: Fixed a race condition and resultant use-after-free in da9150_charger_remove (bsc#1210329).
• CVE-2023-1855: Fixed a use after free in xgene_hwmon_remove (bsc#1210202).
• CVE-2023-1989: Fixed a use after free in btsdio_remove (bsc#1210336).
• CVE-2023-1990: Fixed a use after free in ndlc_remove (bsc#1210337).
• CVE-2022-43945: Fixed a buffer overflow in the NFSD implementation (bsc#1205128).
• CVE-2023-1611: Fixed an use-after-free flaw in btrfs_search_slot (bsc#1209687).
• CVE-2020-36691: Fixed a denial of service vulnerability via a nested Netlink policy with a back reference (bsc#1209777).

The following non-security bugs were fixed:

• USB: dwc3: fix runtime pm imbalance on probe errors (git-fixes).
• USB: dwc3: fix runtime pm imbalance on unbind (git-fixes).
• ath10k: Fix error handling in case of CE pipe init failure (git-fixes).
• ath10k: Fix missing frame timestamp for beacon/probe-resp (git-fixes).
• ath10k: Fix the parsing error in service available event (git-fixes).
• ath10k: add missing error return code in ath10k_pci_probe() (git-fixes).
• ath10k: fix control-message timeout (git-fixes).
• ath10k: fix division by zero in send path (git-fixes).
• ath10k: fix memory overwrite of the WoWLAN wakeup packet pattern (git-fixes).
• audit: improve audit queue handling when 'audit=1' on cmdline (bsc#1209969).
• bpf, x86: Fix encoding for lower 8-bit registers in BPF_STX BPF_B (git-fixes).
• cachefiles: Drop superfluous readpages aops NULL check (bsc#1210430).
• cachefiles: Fix page leak in cachefiles_read_backing_file while vmscan is active (bsc#1210430).
• cachefiles: Fix race between read_waiter and read_copier involving op->to_do (bsc#1210430).
• cachefiles: Handle readpage error correctly (bsc#1210430).
• cgroup/cpuset: Wake up cpuset_attach_wq tasks in cpuset_cancel_attach() (bsc#1210827).
• cifs: fix negotiate context parsing (bsc#1210301).
• cifs: fix open leaks in open_cached_dir() (bsc#1209342).
• cred: allow get_cred() and put_cred() to be given NULL (bsc#1209887).
• crypto: x86/ghash - fix unaligned access in ghash_setkey() (git-fixes).
• drivers: net: lmc: fix case value for target abort error (git-fixes).
• fscache, cachefiles: remove redundant variable 'cache' (bsc#1210430).
• ftrace: Mark get_lock_parent_ip() __always_inline (git-fixes).
• intel_pmc_ipc: restore ability to call functions with irq enabled (git-fixes).
• ipmi: fix SSIF not responding under certain cond (git-fixes).
• iwlwifi: Fix -EIO error code that is never returned (git-fixes).
• iwlwifi: fw: make pos static in iwl_sar_get_ewrd_table() loop (git-fixes).
• iwlwifi: pcie: fix locking when 'HW not ready' (git-fixes).
• iwlwifi: pcie: gen2: fix locking when 'HW not ready' (git-fixes).
• iwlwifi: pcie: reschedule in long-running memory reads (git-fixes).
• kabi/severities: ignore KABI for NVMe, except nvme-fc (bsc#1174777).
• kcm: Only allow TCP sockets to be attached to a KCM mux (git-fixes).
• keys: Change keyring_serialise_link_sem to a mutex (bsc#1207088).
• keys: Fix linking a duplicate key to a keyring's assoc_array (bsc#1207088).
• keys: Hoist locking out of __key_link_begin() (bsc#1207088).
• kretprobe: Prevent triggering…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-2483: Fixed a use after free bug in emac_remove due caused by a race condition (bsc#1211037).
• CVE-2023-2124: Fixed an out of bound access in the XFS subsystem that could have lead to denial-of-service or potentially privilege escalation (bsc#1210498).
• CVE-2023-1670: Fixed a use after free in the Xircom 16-bit PCMCIA Ethernet driver. A local user could use this flaw to crash the system or potentially escalate their privileges on the system (bsc#1209871).
• CVE-2023-2162: Fixed an use-after-free flaw in iscsi_sw_tcp_session_create (bsc#1210647).
• CVE-2023-1998: Fixed a use after free during login when accessing the shost ipaddress (bsc#1210506).
• CVE-2023-30772: Fixed a race condition and resultant use-after-free in da9150_charger_remove (bsc#1210329).
• CVE-2023-1855: Fixed a use after free in xgene_hwmon_remove (bsc#1210202).
• CVE-2023-1989: Fixed a use after free in btsdio_remove (bsc#1210336).
• CVE-2023-1990: Fixed a use after free in ndlc_remove (bsc#1210337).
• CVE-2022-43945: Fixed a buffer overflow in the NFSD implementation (bsc#1205128).
• CVE-2023-1611: Fixed an use-after-free flaw in btrfs_search_slot (bsc#1209687).
• CVE-2020-36691: Fixed a denial of service vulnerability via a nested Netlink policy with a back reference (bsc#1209777).

The following non-security bugs were fixed:

• ARM: 8702/1: head-common.S: Clear lr before jumping to start_kernel() (git-fixes)
• USB: dwc3: fix runtime pm imbalance on probe errors (git-fixes).
• USB: dwc3: fix runtime pm imbalance on unbind (git-fixes).
• arm64: kaslr: Reserve size of ARM64_MEMSTART_ALIGN in linear region (git-fixes)
• ath10k: Fix error handling in case of CE pipe init failure (git-fixes).
• ath10k: Fix missing frame timestamp for beacon/probe-resp (git-fixes).
• ath10k: Fix the parsing error in service available event (git-fixes).
• ath10k: add missing error return code in ath10k_pci_probe() (git-fixes).
• ath10k: fix control-message timeout (git-fixes).
• ath10k: fix division by zero in send path (git-fixes).
• ath10k: fix memory overwrite of the WoWLAN wakeup packet pattern (git-fixes).
• audit: improve audit queue handling when 'audit=1' on cmdline (bsc#1209969).
• bpf, x86: Fix encoding for lower 8-bit registers in BPF_STX BPF_B (git-fixes).
• bs-upload-kernel: Do not skip post-build-checks
• cachefiles: Drop superfluous readpages aops NULL check (bsc#1210430).
• cachefiles: Fix page leak in cachefiles_read_backing_file while vmscan is active (bsc#1210430).
• cachefiles: Fix race between read_waiter and read_copier involving op->to_do (bsc#1210430).
• cachefiles: Handle readpage error correctly (bsc#1210430).
• cgroup/cpuset: Wake up cpuset_attach_wq tasks in cpuset_cancel_attach() (bsc#1210827).
• cifs: fix negotiate context parsing (bsc#1210301).
• cifs: fix open leaks in open_cached_dir() (bsc#1209342).
• cred: allow get_cred() and put_cred() to be given NULL (bsc#1209887).
• crypto: x86/ghash - fix unaligned access in ghash_setkey() (git-fixes).
• drivers: net: lmc: fix case value for target abort error (git-fixes).
• fscache, cachefiles: remove redundant variable 'cache' (bsc#1210430).
• ftrace: Mark get_lock_parent_ip() __always_inline (git-fixes).
• intel_pmc_ipc: restore ability to call functions with irq enabled (git-fixes).
• ipmi: fix SSIF not responding under certain cond (git-fixes).
• iwlwifi: Fix -EIO error code that is never returned (git-fixes).
• iwlwifi: fw: make pos static in iwl_sar_get_ewrd_table() loop (git-fixes).
• iwlwifi: pcie: fix locking when 'HW not ready' (git-fixes).
• iwlwifi: pcie: gen2: fix locking when 'HW not ready' (git-fixes).
• iwlwifi: pcie: reschedule in long-running memory reads (git-fixes).
• kabi/severities: ignore KABI for NVMe, except nvme-fc (bsc#1174777).
• kcm: Only allow TCP sockets to be attached to a KCM mux (git-fixes).
• keys: Change…

The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-2483: Fixed a use after free bug in emac_remove due caused by a race condition (bsc#1211037).
• CVE-2023-2124: Fixed an out of bound access in the XFS subsystem that could have lead to denial-of-service or potentially privilege escalation (bsc#1210498).
• CVE-2023-1670: Fixed a use after free in the Xircom 16-bit PCMCIA Ethernet driver. A local user could use this flaw to crash the system or potentially escalate their privileges on the system (bsc#1209871).
• CVE-2017-5753: Fixed spectre V1 vulnerability on netlink (bsc#1209547).
• CVE-2017-5753: Fixed spectre vulnerability in prlimit (bsc#1209256).
• CVE-2020-36691: Fixed a denial of service (unbounded recursion) vulnerability via a nested Netlink policy with a back reference (bsc#1209613 bsc#1209777).
• CVE-2023-0394: Fixed a null pointer dereference flaw in the network subcomponent in the Linux kernel which could lead to system crash (bsc#1207168).
• CVE-2021-3923: Fixed stack information leak vulnerability that could lead to kernel protection bypass in infiniband RDMA (bsc#1209778).
• CVE-2021-4203: Fixed use-after-free read flaw that was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race with listen() (bsc#1194535).
• CVE-2022-20567: Fixed use after free that could lead to a local privilege escalation in pppol2tp_create of l2tp_ppp.c (bsc#1208850).
• CVE-2022-43945: Fixed a buffer overflow in the NFSD implementation (bsc#1205128).
• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2023-0597: Fixed lack of randomization of per-cpu entry area in x86/mm (bsc#1207845).
• CVE-2023-1076: Fixed incorrect UID assigned to tun/tap sockets (bsc#1208599).
• CVE-2023-1095: Fixed a NULL pointer dereference in nf_tables due to zeroed list head (bsc#1208777).
• CVE-2023-1118: Fixed a use-after-free bugs caused by ene_tx_irqsim() in media/rc (bsc#1208837).
• CVE-2023-1390: Fixed remote DoS vulnerability in tipc_link_xmit() (bsc#1209289).
• CVE-2023-1513: Fixed an uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak (bsc#1209532).
• CVE-2023-1611: Fixed an use-after-free flaw in btrfs_search_slot (bsc#1209687).
• CVE-2023-1855: Fixed an use-after-free flaw in xgene_hwmon_remove (bsc#1210202).
• CVE-2023-1989: Fixed an use-after-free flaw in btsdio_remove (bsc#1210336).
• CVE-2023-1990: Fixed an use-after-free flaw in ndlc_remove (bsc#1210337).
• CVE-2023-1998: Fixed an use-after-free flaw during login when accessing the shost ipaddress (bsc#1210506).
• CVE-2023-2162: Fixed an use-after-free flaw in iscsi_sw_tcp_session_create (bsc#1210647).
• CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207036).
• CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (bsc#1207125).
• CVE-2023-28328: Fixed a denial of service issue in az6027 driver in drivers/media/usb/dev-usb/az6027.c (bsc#1209291).
• CVE-2023-28464: Fixed user-after-free that could lead to privilege escalation in hci_conn_cleanup in net/uetooth/hci_conn.c (bsc#1209052).
• CVE-2023-28772: Fixed buffer overflow in seq_buf_putmem_hex in lib/seq_buf.c (bsc#1209549).
• CVE-2023-30772: Fixed race condition and resultant use-after-free in da9150_charger_remove (bsc#1210329).

The following non-security bugs were fixed:

• Do not sign the vanilla kernel (bsc#1209008).
• Fix kABI breakage (bsc#1208333)
• PCI: hv: Add a per-bus mutex state_lock (bsc#1207185).
• PCI: hv: Fix a race condition bug in hv_pci_query_relations() (bsc#1207185).
• PCI: hv: Fix a race condition in hv_irq_unmask() that can cause panic (bsc#1207185).
• PCI: hv: Remove the useless hv_pcichild_state from struct…

The SUSE Linux Enterprise 15 SP4 AZURE kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-28410: Fixed improper restriction of operations within the bounds of a memory buffer in some Intel(R) i915 Graphics drivers that may have allowed an authenticated user to potentially enable escalation of privilege via local access (bsc#1211263).
• CVE-2023-2156: Fixed a flaw in the networking subsystem within the handling of the RPL protocol (bsc#1211131).
• CVE-2023-1382: Fixed denial of service in tipc_conn_close (bsc#1209288).
• CVE-2023-3006: Fixed a known cache speculation vulnerability, known as Branch History Injection (BHI) or Spectre-BHB, for the new hw AmpereOne (bsc#1211855).
• CVE-2023-2269: Fixed a denial-of-service problem due to a possible recursive locking scenario, resulting in a deadlock in table_clear in drivers/md/dm-ioctl.c (bsc#1210806).
• CVE-2023-1079: Fixed a use-after-free problem that could have been triggered in asus_kbd_backlight_set when plugging/disconnecting a malicious USB device (bsc#1208604).
• CVE-2023-2162: Fixed an use-after-free flaw in iscsi_sw_tcp_session_create (bsc#1210647).
• CVE-2023-33288: Fixed a use-after-free in bq24190_remove in drivers/power/supply/bq24190_charger.c (bsc#1211590).
• CVE-2022-45886: Fixed a .disconnect versus dvb_device_open race condition in dvb_net.c that lead to a use-after-free (bsc#1205760).
• CVE-2022-45885: Fixed a race condition in dvb_frontend.c that could cause a use-after-free when a device is disconnected (bsc#1205758).
• CVE-2022-45887: Fixed a memory leak in ttusb_dec.c caused by the lack of a dvb_frontend_detach call (bsc#1205762).
• CVE-2022-45919: Fixed a use-after-free in dvb_ca_en50221.c that could occur if there is a disconnect after an open, because of the lack of a wait_event (bsc#1205803).
• CVE-2022-45884: Fixed a use-after-free in dvbdev.c, related to dvb_register_device dynamically allocating fops (bsc#1205756).
• CVE-2023-31084: Fixed a blocking issue in drivers/media/dvb-core/dvb_frontend.c (bsc#1210783).
• CVE-2023-2002: Fixed a flaw that allowed an attacker to unauthorized execution of management commands, compromising the confidentiality, integrity, and availability of Bluetooth communication (bsc#1210533).
• CVE-2023-31436: Fixed an out-of-bounds write in qfq_change_class() because lmax can exceed QFQ_MIN_LMAX (bsc#1210940).
• CVE-2023-30456: Fixed an issue in arch/x86/kvm/vmx/nested.c with nVMX on x86_64 lacks consistency checks for CR0 and CR4 (bsc#1210294).
• CVE-2022-4269: Fixed a flaw was found inside the Traffic Control (TC) subsystem (bsc#1206024).
• CVE-2023-32233: Fixed a use-after-free in Netfilter nf_tables when processing batch requests (bsc#1211043).
• CVE-2023-1380: Fixed a slab-out-of-bound read problem in brcmf_get_assoc_ies() (bsc#1209287).
• CVE-2023-2513: Fixed a use-after-free vulnerability in the ext4 filesystem (bsc#1211105).
• CVE-2023-2483: Fixed a use after free bug in emac_remove due caused by a race condition (bsc#1211037).
• CVE-2023-2124: Fixed an out-of-bound access in the XFS subsystem that could have lead to denial-of-service or potentially privilege escalation (bsc#1210498).

The following non-security bugs were fixed:

• 3c589_cs: Fix an error handling path in tc589_probe() (git-fixes).
• ACPI: EC: Fix oops when removing custom query handlers (git-fixes).
• ACPI: bus: Ensure that notify handlers are not running after removal (git-fixes).
• ACPI: processor: Fix evaluating _PDC method when running as Xen dom0 (git-fixes).
• ACPI: tables: Add support for NBFT (bsc#1195921).
• ACPICA: ACPICA: check null return of ACPI_ALLOCATE_ZEROED in acpi_db_display_objects (git-fixes).
• ACPICA: Avoid undefined behavior: applying zero offset to null pointer (git-fixes).
• ALSA: caiaq: input: Add error handling for unsupported input methods in snd_usb_caiaq_input_init (git-fixes).
• ALSA: cs46xx: mark snd_cs46xx_download_image as static (git-fixes).
• ALSA:…

The SUSE Linux Enterprise 15 SP5 AZURE kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-3161: Fixed shift-out-of-bounds in fbcon_set_font() (bsc#1212154).
• CVE-2023-21102: Fixed possible bypass of shadow stack protection in __efi_rt_asm_wrapper of efi-rt-wrapper.S (bsc#1212155).
• CVE-2023-3141: Fixed a use-after-free flaw in r592_remove in drivers/memstick/host/r592.c, that allowed local attackers to crash the system at device disconnect (bsc#1212129).
• CVE-2023-1077: Fixed a type confusion in pick_next_rt_entity(), that could cause memory corruption (bsc#1208600).
• CVE-2023-28410: Fixed improper restriction of operations within the bounds of a memory buffer in some Intel(R) i915 Graphics drivers that may have allowed an authenticated user to potentially enable escalation of privilege via local access (bsc#1211263).
• CVE-2023-2156: Fixed a flaw in the networking subsystem within the handling of the RPL protocol (bsc#1211131).
• CVE-2023-1382: Fixed denial of service in tipc_conn_close (bsc#1209288).
• CVE-2023-33951: Fixed a race condition that could have led to an information disclosure inside the vmwgfx driver (bsc#1211593).
• CVE-2023-33952: Fixed a double free that could have led to a local privilege escalation inside the vmwgfx driver (bsc#1211595).
• CVE-2023-3006: Fixed a known cache speculation vulnerability, known as Branch History Injection (BHI) or Spectre-BHB, for the new hw AmpereOne (bsc#1211855).
• CVE-2023-2269: Fixed a denial-of-service problem due to a possible recursive locking scenario, resulting in a deadlock in table_clear in drivers/md/dm-ioctl.c (bsc#1210806).
• CVE-2023-1079: Fixed a use-after-free problem that could have been triggered in asus_kbd_backlight_set when plugging/disconnecting a malicious USB device (bsc#1208604).
• CVE-2023-2162: Fixed an use-after-free flaw in iscsi_sw_tcp_session_create (bsc#1210647).
• CVE-2023-21106: Fixed possible memory corruption due to double free in adreno_set_param of adreno_gpu.c (bsc#1211654).
• CVE-2023-33288: Fixed a use-after-free in bq24190_remove in drivers/power/supply/bq24190_charger.c (bsc#1211590).
• CVE-2022-45886: Fixed a .disconnect versus dvb_device_open race condition in dvb_net.c that lead to a use-after-free (bsc#1205760).
• CVE-2022-45885: Fixed a race condition in dvb_frontend.c that could cause a use-after-free when a device is disconnected (bsc#1205758).
• CVE-2022-45887: Fixed a memory leak in ttusb_dec.c caused by the lack of a dvb_frontend_detach call (bsc#1205762).
• CVE-2022-45919: Fixed a use-after-free in dvb_ca_en50221.c that could occur if there is a disconnect after an open, because of the lack of a wait_event (bsc#1205803).
• CVE-2022-45884: Fixed a use-after-free in dvbdev.c, related to dvb_register_device dynamically allocating fops (bsc#1205756).
• CVE-2023-31084: Fixed a blocking issue in drivers/media/dvb-core/dvb_frontend.c (bsc#1210783).
• CVE-2023-2002: Fixed a flaw that allowed an attacker to unauthorized execution of management commands, compromising the confidentiality, integrity, and availability of Bluetooth communication (bsc#1210533).
• CVE-2023-31436: Fixed an out-of-bounds write in qfq_change_class() because lmax can exceed QFQ_MIN_LMAX (bsc#1210940).
• CVE-2023-30456: Fixed an issue in arch/x86/kvm/vmx/nested.c with nVMX on x86_64 lacks consistency checks for CR0 and CR4 (bsc#1210294).
• CVE-2022-4269: Fixed a flaw was found inside the Traffic Control (TC) subsystem (bsc#1206024).
• CVE-2023-32233: Fixed a use-after-free in Netfilter nf_tables when processing batch requests (bsc#1211043).
• CVE-2023-1380: Fixed a slab-out-of-bound read problem in brcmf_get_assoc_ies() (bsc#1209287).
• CVE-2023-2513: Fixed a use-after-free vulnerability in the ext4 filesystem (bsc#1211105).
• CVE-2023-2483: Fixed a use after free bug in emac_remove caused by a race condition (bsc#1211037).
• CVE-2023-2124: Fixed an out-of-bound access in the XFS subsystem…

The SUSE Linux Enterprise 15 SP2 LTSS kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-1637: Fixed vulnerability that could lead to unauthorized access to CPU memory after resuming CPU from suspend-to-RAM (bsc#1209779).
• CVE-2022-3566: Fixed race condition in the TCP Handler (bsc#1204405).
• CVE-2021-29650: Fixed an issue where the netfilter subsystem allowed attackers to cause a denial of service (bsc#1184208).
• CVE-2020-36694: Fixed an use-after-free issue in netfilter in the packet processing context (bsc#1211596).
• CVE-2023-1079: Fixed a use-after-free problem that could have been triggered in asus_kbd_backlight_set when plugging/disconnecting a malicious USB device (bsc#1208604).
• CVE-2023-33288: Fixed a use-after-free in bq24190_remove in drivers/power/supply/bq24190_charger.c (bsc#1211590).
• CVE-2022-45886: Fixed a .disconnect versus dvb_device_open race condition in dvb_net.c that lead to a use-after-free (bsc#1205760).
• CVE-2022-45885: Fixed a race condition in dvb_frontend.c that could cause a use-after-free when a device is disconnected (bsc#1205758).
• CVE-2022-45887: Fixed a memory leak in ttusb_dec.c caused by the lack of a dvb_frontend_detach call (bsc#1205762).
• CVE-2022-45919: Fixed a use-after-free in dvb_ca_en50221.c that could occur if there is a disconnect after an open, because of the lack of a wait_event (bsc#1205803).
• CVE-2022-45884: Fixed a use-after-free in dvbdev.c, related to dvb_register_device dynamically allocating fops (bsc#1205756).
• CVE-2023-31084: Fixed a blocking issue in drivers/media/dvb-core/dvb_frontend.c (bsc#1210783).
• CVE-2023-31436: Fixed an out-of-bounds write in qfq_change_class() because lmax can exceed QFQ_MIN_LMAX (bsc#1210940 bsc#1211260).
• CVE-2023-2194: Fixed an out-of-bounds write vulnerability in the SLIMpro I2C device driver (bsc#1210715).
• CVE-2023-32269: Fixed a use-after-free in af_netrom.c, related to the fact that accept() was also allowed for a successfully connected AF_NETROM socket (bsc#1211186).
• CVE-2023-32233: Fixed a use-after-free in Netfilter nf_tables when processing batch requests (bsc#1211043).
• CVE-2022-4269: Fixed a flaw was found inside the Traffic Control (TC) subsystem (bsc#1206024).
• CVE-2023-1380: Fixed a slab-out-of-bound read problem in brcmf_get_assoc_ies() (bsc#1209287).
• CVE-2023-2513: Fixed a use-after-free vulnerability in the ext4 filesystem (bsc#1211105).
• CVE-2023-2483: Fixed a use after free bug in emac_remove caused by a race condition (bsc#1211037).
• CVE-2023-23586: Fixed a memory information leak in the io_uring subsystem (bsc#1208474).
• CVE-2023-2124: Fixed an out of bound access in the XFS subsystem that could have lead to denial-of-service or potentially privilege escalation (bsc#1210498).

The following non-security bugs were fixed:

• Drivers: hv: vmbus: Optimize vmbus_on_event (bsc#1211622).
• Fix usrmerge error (boo#1211796)
• ipv6: sr: fix out-of-bounds read when setting HMAC data (bsc#1211592).
• kernel-binary: install expoline.o (boo#1210791 bsc#1211089)
• kernel-source: Remove unused macro variant_symbols
• kernel-spec-macros: Fix up obsolete_rebuilds_subpackage to generate obsoletes correctly (boo#1172073 bsc#1191731).
• rpm/constraints.in: Increase disk size constraint for riscv64 to 52GB
• rpm/kernel-binary.spec.in: Fix missing kernel-preempt-devel and KMP Provides (bsc#1199046)
• scsi: storvsc: Parameterize number hardware queues (bsc#1211622).
• usrmerge: Compatibility with earlier rpm (boo#1211796)

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-28410: Fixed improper restriction of operations within the bounds of a memory buffer in some Intel(R) i915 Graphics drivers that may have allowed an authenticated user to potentially enable escalation of privilege via local access (bsc#1211263).
• CVE-2023-2156: Fixed a flaw in the networking subsystem within the handling of the RPL protocol (bsc#1211131).
• CVE-2023-1382: Fixed denial of service in tipc_conn_close (bsc#1209288).
• CVE-2023-3006: Fixed a known cache speculation vulnerability, known as Branch History Injection (BHI) or Spectre-BHB, for the new hw AmpereOne (bsc#1211855).
• CVE-2023-2269: Fixed a denial-of-service problem due to a possible recursive locking scenario, resulting in a deadlock in table_clear in drivers/md/dm-ioctl.c (bsc#1210806).
• CVE-2023-1079: Fixed a use-after-free problem that could have been triggered in asus_kbd_backlight_set when plugging/disconnecting a malicious USB device (bsc#1208604).
• CVE-2023-2162: Fixed an use-after-free flaw in iscsi_sw_tcp_session_create (bsc#1210647).
• CVE-2023-33288: Fixed a use-after-free in bq24190_remove in drivers/power/supply/bq24190_charger.c (bsc#1211590).
• CVE-2022-45886: Fixed a .disconnect versus dvb_device_open race condition in dvb_net.c that lead to a use-after-free (bsc#1205760).
• CVE-2022-45885: Fixed a race condition in dvb_frontend.c that could cause a use-after-free when a device is disconnected (bsc#1205758).
• CVE-2022-45887: Fixed a memory leak in ttusb_dec.c caused by the lack of a dvb_frontend_detach call (bsc#1205762).
• CVE-2022-45919: Fixed a use-after-free in dvb_ca_en50221.c that could occur if there is a disconnect after an open, because of the lack of a wait_event (bsc#1205803).
• CVE-2022-45884: Fixed a use-after-free in dvbdev.c, related to dvb_register_device dynamically allocating fops (bsc#1205756).
• CVE-2023-31084: Fixed a blocking issue in drivers/media/dvb-core/dvb_frontend.c (bsc#1210783).
• CVE-2023-2002: Fixed a flaw that allowed an attacker to unauthorized execution of management commands, compromising the confidentiality, integrity, and availability of Bluetooth communication (bsc#1210533).
• CVE-2023-31436: Fixed an out-of-bounds write in qfq_change_class() because lmax can exceed QFQ_MIN_LMAX (bsc#1210940).
• CVE-2023-30456: Fixed an issue in arch/x86/kvm/vmx/nested.c with nVMX on x86_64 lacks consistency checks for CR0 and CR4 (bsc#1210294).
• CVE-2022-4269: Fixed a flaw was found inside the Traffic Control (TC) subsystem (bsc#1206024).
• CVE-2023-32233: Fixed a use-after-free in Netfilter nf_tables when processing batch requests (bsc#1211043).
• CVE-2023-1380: Fixed a slab-out-of-bound read problem in brcmf_get_assoc_ies() (bsc#1209287).
• CVE-2023-2513: Fixed a use-after-free vulnerability in the ext4 filesystem (bsc#1211105).
• CVE-2023-2483: Fixed a use after free bug in emac_remove caused by a race condition (bsc#1211037).
• CVE-2023-2124: Fixed an out-of-bound access in the XFS subsystem that could have lead to denial-of-service or potentially privilege escalation (bsc#1210498).

The following non-security bugs were fixed:

• 3c589_cs: Fix an error handling path in tc589_probe() (git-fixes).
• ACPI: EC: Fix oops when removing custom query handlers (git-fixes).
• ACPI: bus: Ensure that notify handlers are not running after removal (git-fixes).
• ACPI: processor: Fix evaluating _PDC method when running as Xen dom0 (git-fixes).
• ACPI: tables: Add support for NBFT (bsc#1195921).
• ACPICA: ACPICA: check null return of ACPI_ALLOCATE_ZEROED in acpi_db_display_objects (git-fixes).
• ACPICA: Avoid undefined behavior: applying zero offset to null pointer (git-fixes).
• ALSA: caiaq: input: Add error handling for unsupported input methods in snd_usb_caiaq_input_init (git-fixes).
• ALSA: cs46xx: mark snd_cs46xx_download_image as static (git-fixes).
• ALSA:…

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-35828: Fixed a use-after-free flaw inside renesas_usb3_remove in drivers/usb/gadget/udc/renesas_usb3.c (bsc#1212513).
• CVE-2023-35823: Fixed a use-after-free in saa7134_finidev in drivers/media/pci/saa7134/saa7134-core.c (bsc#1212494).
• CVE-2023-35788: Fixed an out-of-bounds write in the flower classifier code via TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets in fl_set_geneve_opt in net/sched/cls_flower.c (bsc#1212504).
• CVE-2023-33288: Fixed a use-after-free in bq24190_remove in drivers/power/supply/bq24190_charger.c (bsc#1211590).
• CVE-2023-32233: Fixed a use-after-free in Netfilter nf_tables when processing batch requests (bsc#1211043).
• CVE-2023-3161: Fixed shift-out-of-bounds in fbcon_set_font() (bsc#1212154).
• CVE-2023-31436: Fixed an out-of-bounds write in qfq_change_class() because lmax can exceed QFQ_MIN_LMAX (bsc#1210940).
• CVE-2023-3141: Fixed a use-after-free flaw in r592_remove in drivers/memstick/host/r592.c, that allowed local attackers to crash the system at device disconnect (bsc#1212129).
• CVE-2023-31084: Fixed a blocking issue in drivers/media/dvb-core/dvb_frontend.c (bsc#1210783).
• CVE-2023-30456: Fixed an issue in arch/x86/kvm/vmx/nested.c with nVMX on x86_64 lacks consistency checks for CR0 and CR4 (bsc#1210294).
• CVE-2023-3006: Fixed a known cache speculation vulnerability, known as Branch History Injection (BHI) or Spectre-BHB, for the new hw AmpereOne (bsc#1211855).
• CVE-2023-28410: Fixed improper restriction of operations within the bounds of a memory buffer in some Intel(R) i915 Graphics drivers that may have allowed an authenticated user to potentially enable escalation of privilege via local access (bsc#1211263).
• CVE-2023-2513: Fixed a use-after-free vulnerability in the ext4 filesystem (bsc#1211105).
• CVE-2023-2483: Fixed a use after free bug in emac_remove due caused by a race condition (bsc#1211037).
• CVE-2023-2269: Fixed a denial-of-service problem due to a possible recursive locking scenario, resulting in a deadlock in table_clear in drivers/md/dm-ioctl.c (bsc#1210806).
• CVE-2023-2162: Fixed an use-after-free flaw in iscsi_sw_tcp_session_create (bsc#1210647).
• CVE-2023-2156: Fixed a flaw in the networking subsystem within the handling of the RPL protocol (bsc#1211131).
• CVE-2023-2124: Fixed an out-of-bound access in the XFS subsystem that could have lead to denial-of-service or potentially privilege escalation (bsc#1210498).
• CVE-2023-21102: Fixed possible bypass of shadow stack protection in __efi_rt_asm_wrapper of efi-rt-wrapper.S (bsc#1212155).
• CVE-2023-2002: Fixed a flaw that allowed an attacker to unauthorized execution of management commands, compromising the confidentiality, integrity, and availability of Bluetooth communication (bsc#1210533).
• CVE-2023-1382: Fixed denial of service in tipc_conn_close (bsc#1209288).
• CVE-2023-1380: Fixed a slab-out-of-bound read problem in brcmf_get_assoc_ies() (bsc#1209287).
• CVE-2023-1249: Fixed a use-after-free flaw inside the core dump subsystem, that could have been used to crash the system (bsc#1209039).
• CVE-2023-1079: Fixed a use-after-free problem that could have been triggered in asus_kbd_backlight_set when plugging/disconnecting a malicious USB device (bsc#1208604).
• CVE-2023-1077: Fixed a type confusion in pick_next_rt_entity(), that could cause memory corruption (bsc#1208600).
• CVE-2022-45919: Fixed a use-after-free in dvb_ca_en50221.c that could occur if there is a disconnect after an open, because of the lack of a wait_event (bsc#1205803).
• CVE-2022-45887: Fixed a memory leak in ttusb_dec.c caused by the lack of a dvb_frontend_detach call (bsc#1205762).
• CVE-2022-45886: Fixed a .disconnect versus dvb_device_open race condition in dvb_net.c that lead to a use-after-free (bsc#1205760).
• CVE-2022-45885: Fixed a race condition in dvb_frontend.c that could cause a…

The SUSE Linux Enterprise 12 SP2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2017-5753: Fixed spectre vulnerability in prlimit (bsc#1209256).
• CVE-2022-3566: Fixed race condition in the TCP Handler (bsc#1204405).
• CVE-2022-45884: Fixed a use-after-free in dvbdev.c, related to dvb_register_device dynamically allocating fops (bsc#1205756).
• CVE-2022-45885: Fixed a race condition in dvb_frontend.c that could cause a use-after-free when a device is disconnected (bsc#1205758).
• CVE-2022-45886: Fixed a .disconnect versus dvb_device_open race condition in dvb_net.c that lead to a use-after-free (bsc#1205760).
• CVE-2022-45887: Fixed a memory leak in ttusb_dec.c caused by the lack of a dvb_frontend_detach call (bsc#1205762).
• CVE-2022-45919: Fixed a use-after-free in dvb_ca_en50221.c that could occur if there is a disconnect after an open, because of the lack of a wait_event (bsc#1205803).
• CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
• CVE-2023-1077: Fixed a type confusion in pick_next_rt_entity(), that could cause memory corruption (bsc#1208600).
• CVE-2023-1095: Fixed a NULL pointer dereference in nf_tables due to zeroed list head (bsc#1208777).
• CVE-2023-1118: Fixed a use-after-free bugs caused by ene_tx_irqsim() in media/rc (bsc#1208837).
• CVE-2023-1249: Fixed a use-after-free flaw in the core dump subsystem that allowed a local user to crash the system (bsc#1209039).
• CVE-2023-1380: Fixed a slab-out-of-bound read problem in brcmf_get_assoc_ies() (bsc#1209287).
• CVE-2023-1390: Fixed remote DoS vulnerability in tipc_link_xmit() (bsc#1209289).
• CVE-2023-1513: Fixed an uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak (bsc#1209532).
• CVE-2023-1611: Fixed an use-after-free flaw in btrfs_search_slot (bsc#1209687).
• CVE-2023-1670: Fixed a use after free in the Xircom 16-bit PCMCIA Ethernet driver. A local user could use this flaw to crash the system or potentially escalate their privileges on the system (bsc#1209871).
• CVE-2023-1989: Fixed a use after free in btsdio_remove (bsc#1210336).
• CVE-2023-1990: Fixed a use after free in ndlc_remove (bsc#1210337).
• CVE-2023-1998: Fixed a use after free during login when accessing the shost ipaddress (bsc#1210506).
• CVE-2023-2124: Fixed an out-of-bound access in the XFS subsystem that could have lead to denial-of-service or potentially privilege escalation (bsc#1210498).
• CVE-2023-2162: Fixed an use-after-free flaw in iscsi_sw_tcp_session_create (bsc#1210647).
• CVE-2023-2194: Fixed an out-of-bounds write vulnerability in the SLIMpro I2C device driver (bsc#1210715).
• CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207036).
• CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (bsc#1207125).
• CVE-2023-2513: Fixed a use-after-free vulnerability in the ext4 filesystem (bsc#1211105).
• CVE-2023-28328: Fixed a denial of service issue in az6027 driver in drivers/media/usb/dev-usb/az6027.c (bsc#1209291).
• CVE-2023-28464: Fixed user-after-free that could lead to privilege escalation in hci_conn_cleanup in net/uetooth/hci_conn.c (bsc#1209052).
• CVE-2023-28772: Fixed buffer overflow in seq_buf_putmem_hex in lib/seq_buf.c (bsc#1209549).
• CVE-2023-30772: Fixed race condition and resultant use-after-free in da9150_charger_remove (bsc#1210329).
• CVE-2023-3090: Fixed a heap out-of-bounds write in the ipvlan network driver (bsc#1212842).
• CVE-2023-3141: Fixed a use-after-free flaw in r592_remove in drivers/memstick/host/r592.c, that allowed local attackers to crash the system at device disconnect (bsc#1212129).
• CVE-2023-31436: Fixed an out-of-bounds write in qfq_change_class() because lmax can exceed QFQ_MIN_LMAX (bsc#1210940). -…