CVE-2022-40982

Information exposure through microarchitectural state after transient execution in certain vector execution units for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.

This is a tool to transform and deploy microcode update for x86 CPUs.

Security Fix(es):

Incorrect default permissions in some memory controller configurations for some Intel(R) Xeon(R) Processors when using Intel(R) Software Guard Extensions which may allow a privileged user to potentially enable escalation of privilege via local access.(CVE-2022-33196)

Improper isolation of shared resources in some Intel(R) Processors when using Intel(R) Software Guard Extensions may allow a privileged user to potentially enable information disclosure via local access.(CVE-2022-38090)

Information exposure through microarchitectural state after transient execution in certain vector execution units for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.(CVE-2022-40982)

This is a tool to transform and deploy microcode update for x86 CPUs.

Security Fix(es):

Incorrect default permissions in some memory controller configurations for some Intel(R) Xeon(R) Processors when using Intel(R) Software Guard Extensions which may allow a privileged user to potentially enable escalation of privilege via local access.(CVE-2022-33196)

Improper isolation of shared resources in some Intel(R) Processors when using Intel(R) Software Guard Extensions may allow a privileged user to potentially enable information disclosure via local access.(CVE-2022-38090)

Information exposure through microarchitectural state after transient execution in certain vector execution units for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.(CVE-2022-40982)

This is a tool to transform and deploy microcode update for x86 CPUs.

Security Fix(es):

Incorrect default permissions in some memory controller configurations for some Intel(R) Xeon(R) Processors when using Intel(R) Software Guard Extensions which may allow a privileged user to potentially enable escalation of privilege via local access.(CVE-2022-33196)

Improper isolation of shared resources in some Intel(R) Processors when using Intel(R) Software Guard Extensions may allow a privileged user to potentially enable information disclosure via local access.(CVE-2022-38090)

Information exposure through microarchitectural state after transient execution in certain vector execution units for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.(CVE-2022-40982)

This is a tool to transform and deploy microcode update for x86 CPUs.

Security Fix(es):

Incorrect default permissions in some memory controller configurations for some Intel(R) Xeon(R) Processors when using Intel(R) Software Guard Extensions which may allow a privileged user to potentially enable escalation of privilege via local access.(CVE-2022-33196)

Improper isolation of shared resources in some Intel(R) Processors when using Intel(R) Software Guard Extensions may allow a privileged user to potentially enable information disclosure via local access.(CVE-2022-38090)

Information exposure through microarchitectural state after transient execution in certain vector execution units for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.(CVE-2022-40982)

This is a tool to transform and deploy microcode update for x86 CPUs.

Security Fix(es):

Incorrect default permissions in some memory controller configurations for some Intel(R) Xeon(R) Processors when using Intel(R) Software Guard Extensions which may allow a privileged user to potentially enable escalation of privilege via local access.(CVE-2022-33196)

Improper isolation of shared resources in some Intel(R) Processors when using Intel(R) Software Guard Extensions may allow a privileged user to potentially enable information disclosure via local access.(CVE-2022-38090)

Information exposure through microarchitectural state after transient execution in certain vector execution units for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.(CVE-2022-40982)

Information exposure through microarchitectural state after transient execution in certain vector execution units for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: tun: avoid double free in tun_free_netdev (CVE-2022-4744)
• kernel: net/sched: multiple vulnerabilities (CVE-2023-3609, CVE-2023-3611, CVE-2023-4128, CVE-2023-4206, CVE-2023-4207, CVE-2023-4208)
• kernel: out-of-bounds write in qfq_change_class function (CVE-2023-31436)
• kernel: out-of-bounds write in hw_atl_utils_fw_rpc_wait (CVE-2021-43975)
• kernel: Rate limit overflow messages in r8152 in intr_callback (CVE-2022-3594)
• kernel: use after free flaw in l2cap_conn_del (CVE-2022-3640)
• kernel: double free in usb_8dev_start_xmit (CVE-2022-28388)
• kernel: vmwgfx: multiple vulnerabilities (CVE-2022-38457, CVE-2022-40133, CVE-2023-33951, CVE-2023-33952)
• hw: Intel: Gather Data Sampling (GDS) side channel vulnerability (CVE-2022-40982)
• kernel: Information leak in l2cap_parse_conf_req (CVE-2022-42895)
• kernel: KVM: multiple vulnerabilities (CVE-2022-45869, CVE-2023-4155, CVE-2023-30456)
• kernel: memory leak in ttusb_dec_exit_dvb (CVE-2022-45887)
• kernel: speculative pointer dereference in do_prlimit (CVE-2023-0458)
• kernel: use-after-free due to race condition in qdisc_graft (CVE-2023-0590)
• kernel: x86/mm: Randomize per-cpu entry area (CVE-2023-0597)
• kernel: HID: check empty report_list in hid_validate_values (CVE-2023-1073)
• kernel: sctp: fail if no bound addresses can be used for a given scope (CVE-2023-1074)
• kernel: hid: Use After Free in asus_remove (CVE-2023-1079)
• kernel: use-after-free in drivers/media/rc/ene_ir.c (CVE-2023-1118)
• kernel: hash collisions in the IPv6 connection lookup table (CVE-2023-1206)
• kernel: ovl: fix use after free in struct ovl_aio_req (CVE-2023-1252)
• kernel: denial of service in tipc_conn_close (CVE-2023-1382)
• kernel: Use after free bug in btsdio_remove due to race condition (CVE-2023-1989)
• kernel: Spectre v2 SMT mitigations problem (CVE-2023-1998)
• kernel: ext4: use-after-free in ext4_xattr_set_entry (CVE-2023-2513)
• kernel: fbcon: shift-out-of-bounds in fbcon_set_font (CVE-2023-3161)
• kernel: out-of-bounds access in relay_file_read (CVE-2023-3268)
• kernel: xfrm: NULL pointer dereference in xfrm_update_ae_params (CVE-2023-3772)
• kernel: smsusb: use-after-free caused by do_submit_urb (CVE-2023-4132)
• kernel: Race between task migrating pages and another task calling exit_mmap (CVE-2023-4732)
• Kernel: denial of service in atm_tc_enqueue due to type confusion (CVE-2023-23455)
• kernel: mpls: double free on sysctl allocation failure (CVE-2023-26545)
• kernel: Denial of service issue in az6027 driver (CVE-2023-28328)
• kernel: lib/seq_buf.c has a seq_buf_putmem_hex buffer overflow (CVE-2023-28772)
• kernel: blocking operation in dvb_frontend_get_event and wait_event_interruptible (CVE-2023-31084)
• kernel: net: qcom/emac: race condition leading to use-after-free in emac_remove (CVE-2023-33203)
• kernel: saa7134: race condition leading to use-after-free in saa7134_finidev (CVE-2023-35823)
• kernel: dm1105: race condition leading to use-after-free in dm1105_remove.c (CVE-2023-35824)
• kernel: r592: race condition leading to use-after-free in r592_remove (CVE-2023-35825)
• kernel: net/tls: tls_is_tx_ready() checked list_entry (CVE-2023-1075)
• kernel: use-after-free bug in remove function xgene_hwmon_remove (CVE-2023-1855)
• kernel: Use after free bug in r592_remove (CVE-2023-3141)
• kernel: gfs2: NULL pointer dereference in gfs2_evict_inode (CVE-2023-3212)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

• Update Intel CPU microcode to microcode-20230808 release addresses CVE-2022-40982:
  • Addition of 06-ba-02/0xe0 microcode (in microcode.dat) at revision 0x4119;
  • Addition of 06-ba-02/0xe0 microcode (in microcode.dat) at revision 0x4119;
  • Addition of 06-ba-03/0xe0 microcode (in microcode.dat) at revision 0x4119;
  • Addition of 06-ba-02/0xe0 microcode (in microcode.dat) at revision 0x4119;
  • Addition of 06-ba-02/0xe0 microcode (in microcode.dat) at revision 0x4119;
  • Addition of 06-ba-03/0xe0 microcode (in microcode.dat) at revision 0x4119;
  • Addition of 06-be-00/0x11 microcode (in microcode.dat) at revision 0x11;
  • Removal of 06-ba-02/0xc0 microcode (in microcode.dat) at revision 0x4112;
  • Removal of 06-ba-02/0xc0 microcode (in microcode.dat) at revision 0x4112;
  • Removal of 06-ba-03/0xc0 microcode (in microcode.dat) at revision 0x4112;
  • Removal of 06-ba-02/0xc0 microcode (in microcode.dat) at revision 0x4112;
  • Removal of 06-ba-02/0xc0 microcode (in microcode.dat) at revision 0x4112;
  • Removal of 06-ba-03/0xc0 microcode (in microcode.dat) at revision 0x4112;
  • Removal of 06-be-00/0x01 microcode (in microcode.dat) at revision 0x10;
  • Update of 06-55-03/0x97 (SKX-SP B1) microcode (in microcode.dat) from revision 0x1000171 up to 0x1000181;
  • Update of 06-55-04/0xb7 (SKX-D/SP/W/X H0/M0/M1/U0) microcode (in microcode.dat) from revision 0x2006f05 up to 0x2007006;
  • Update of 06-55-06/0xbf (CLX-SP B0) microcode (in microcode.dat) from revision 0x4003501 up to 0x4003604;
  • Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode (in microcode.dat) from revision 0x5003501 up to 0x5003604;
  • Update of 06-55-0b/0xbf (CPX-SP A1) microcode (in microcode.dat) from revision 0x7002601 up to 0x7002703;
  • Update of 06-6a-06/0x87 (ICX-SP D0) microcode (in microcode.dat) from revision 0xd000390 up to 0xd0003a5;
  • Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode (in microcode.dat) from revision 0xba up to 0xbc;
  • Update of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode (in microcode.dat) from revision 0xaa up to 0xac;
  • Update of 06-8c-02/0xc2 (TGL-R C0) microcode (in microcode.dat) from revision 0x2a up to 0x2c;
  • Update of 06-8d-01/0xc2 (TGL-H R0) microcode (in microcode.dat) from revision 0x44 up to 0x46;
  • Update of 06-8e-09/0x10 (AML-Y 2+2 H0) microcode (in microcode.dat) from revision 0xf2 up to 0xf4;
  • Update of 06-8e-09/0xc0 (KBL-U/U 2+3e/Y H0/J1) microcode (in microcode.dat) from revision 0xf2 up to 0xf4;
  • Update of 06-8e-0a/0xc0 (CFL-U 4+3e D0, KBL-R Y0) microcode (in microcode.dat) from revision 0xf2 up to 0xf4;
  • Update of 06-8e-0b/0xd0 (WHL-U W0) microcode (in microcode.dat) from revision 0xf2 up to 0xf4;
  • Update of 06-8e-0c/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0) microcode (in microcode.dat) from revision 0xf6 up to 0xf8;
  • Update of 06-8f-04/0x10 microcode (in microcode.dat) from revision 0x2c0001d1 up to 0x2c000271;
  • Update of 06-8f-04/0x87 microcode (in microcode.dat) from revision 0x2b000461 up to 0x2b0004b1;
  • Update of 06-8f-05/0x10 microcode (in microcode.dat) from revision 0x2c0001d1 up to 0x2c000271;
  • Update of 06-8f-05/0x87 microcode (in microcode.dat) from revision 0x2b000461 up to 0x2b0004b1;
  • Update of 06-8f-06/0x10 microcode (in microcode.dat) from revision 0x2c0001d1 up to 0x2c000271;
  • Update of 06-8f-06/0x87 microcode (in microcode.dat) from revision 0x2b000461 up to 0x2b0004b1;
  • Update of 06-8f-07/0x87 microcode (in microcode.dat) from revision 0x2b000461 up to 0x2b0004b1;
  • Addition of 06-8f-08/0x10 microcode (in microcode.dat) at revision 0x2c000271;
  • Addition of 06-8f-08/0x10 microcode (in microcode.dat) at revision 0x2c000271;
  • Removal of 06-8f-08/0x10 microcode (in microcode.dat) at revision 0x2c0001d1;
  • Removal of 06-8f-08/0x10 microcode (in microcode.dat) at revision 0x2c0001d1;
  • Addition of 06-8f-08/0x87 microcode (in…

• Update Intel CPU microcode to microcode-20230808 release addresses CVE-2022-40982:
  • Addition of 06-ba-02/0xe0 microcode (in microcode.dat) at revision 0x4119;
  • Addition of 06-ba-02/0xe0 microcode (in microcode.dat) at revision 0x4119;
  • Addition of 06-ba-03/0xe0 microcode (in microcode.dat) at revision 0x4119;
  • Addition of 06-ba-02/0xe0 microcode (in microcode.dat) at revision 0x4119;
  • Addition of 06-ba-02/0xe0 microcode (in microcode.dat) at revision 0x4119;
  • Addition of 06-ba-03/0xe0 microcode (in microcode.dat) at revision 0x4119;
  • Addition of 06-be-00/0x11 microcode (in microcode.dat) at revision 0x11;
  • Removal of 06-ba-02/0xc0 microcode (in microcode.dat) at revision 0x4112;
  • Removal of 06-ba-02/0xc0 microcode (in microcode.dat) at revision 0x4112;
  • Removal of 06-ba-03/0xc0 microcode (in microcode.dat) at revision 0x4112;
  • Removal of 06-ba-02/0xc0 microcode (in microcode.dat) at revision 0x4112;
  • Removal of 06-ba-02/0xc0 microcode (in microcode.dat) at revision 0x4112;
  • Removal of 06-ba-03/0xc0 microcode (in microcode.dat) at revision 0x4112;
  • Removal of 06-be-00/0x01 microcode (in microcode.dat) at revision 0x10;
  • Update of 06-55-03/0x97 (SKX-SP B1) microcode (in microcode.dat) from revision 0x1000171 up to 0x1000181;
  • Update of 06-55-04/0xb7 (SKX-D/SP/W/X H0/M0/M1/U0) microcode (in microcode.dat) from revision 0x2006f05 up to 0x2007006;
  • Update of 06-55-06/0xbf (CLX-SP B0) microcode (in microcode.dat) from revision 0x4003501 up to 0x4003604;
  • Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode (in microcode.dat) from revision 0x5003501 up to 0x5003604;
  • Update of 06-55-0b/0xbf (CPX-SP A1) microcode (in microcode.dat) from revision 0x7002601 up to 0x7002703;
  • Update of 06-6a-06/0x87 (ICX-SP D0) microcode (in microcode.dat) from revision 0xd000390 up to 0xd0003a5;
  • Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode (in microcode.dat) from revision 0xba up to 0xbc;
  • Update of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode (in microcode.dat) from revision 0xaa up to 0xac;
  • Update of 06-8c-02/0xc2 (TGL-R C0) microcode (in microcode.dat) from revision 0x2a up to 0x2c;
  • Update of 06-8d-01/0xc2 (TGL-H R0) microcode (in microcode.dat) from revision 0x44 up to 0x46;
  • Update of 06-8e-09/0x10 (AML-Y 2+2 H0) microcode (in microcode.dat) from revision 0xf2 up to 0xf4;
  • Update of 06-8e-09/0xc0 (KBL-U/U 2+3e/Y H0/J1) microcode (in microcode.dat) from revision 0xf2 up to 0xf4;
  • Update of 06-8e-0a/0xc0 (CFL-U 4+3e D0, KBL-R Y0) microcode (in microcode.dat) from revision 0xf2 up to 0xf4;
  • Update of 06-8e-0b/0xd0 (WHL-U W0) microcode (in microcode.dat) from revision 0xf2 up to 0xf4;
  • Update of 06-8e-0c/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0) microcode (in microcode.dat) from revision 0xf6 up to 0xf8;
  • Update of 06-8f-04/0x10 microcode (in microcode.dat) from revision 0x2c0001d1 up to 0x2c000271;
  • Update of 06-8f-04/0x87 microcode (in microcode.dat) from revision 0x2b000461 up to 0x2b0004b1;
  • Update of 06-8f-05/0x10 microcode (in microcode.dat) from revision 0x2c0001d1 up to 0x2c000271;
  • Update of 06-8f-05/0x87 microcode (in microcode.dat) from revision 0x2b000461 up to 0x2b0004b1;
  • Update of 06-8f-06/0x10 microcode (in microcode.dat) from revision 0x2c0001d1 up to 0x2c000271;
  • Update of 06-8f-06/0x87 microcode (in microcode.dat) from revision 0x2b000461 up to 0x2b0004b1;
  • Update of 06-8f-07/0x87 microcode (in microcode.dat) from revision 0x2b000461 up to 0x2b0004b1;
  • Addition of 06-8f-08/0x10 microcode (in microcode.dat) at revision 0x2c000271;
  • Addition of 06-8f-08/0x10 microcode (in microcode.dat) at revision 0x2c000271;
  • Removal of 06-8f-08/0x10 microcode (in microcode.dat) at revision 0x2c0001d1;
  • Removal of 06-8f-08/0x10 microcode (in microcode.dat) at revision 0x2c0001d1;
  • Addition of 06-8f-08/0x87 microcode (in…

• SECURITY UPDATE: New microcode data file 2023-08-08 - Updated microcodes: sig 0x00050653, pf_mask 0x97, 2023-03-23, rev 0x1000181, size 36864 sig 0x00050654, pf_mask 0xb7, 2023-03-06, rev 0x2007006, size 44032 sig 0x00050656, pf_mask 0xbf, 2023-03-17, rev 0x4003604, size 38912 sig 0x00050657, pf_mask 0xbf, 2023-03-17, rev 0x5003604, size 38912 sig 0x0005065b, pf_mask 0xbf, 2023-03-21, rev 0x7002703, size 30720 sig 0x000606a6, pf_mask 0x87, 2023-03-30, rev 0xd0003a5, size 297984 sig 0x000706e5, pf_mask 0x80, 2023-02-26, rev 0x00bc, size 113664 sig 0x000806c1, pf_mask 0x80, 2023-02-27, rev 0x00ac, size 111616 sig 0x000806c2, pf_mask 0xc2, 2023-02-27, rev 0x002c, size 98304 sig 0x000806d1, pf_mask 0xc2, 2023-02-27, rev 0x0046, size 103424 sig 0x000806e9, pf_mask 0x10, 2023-02-23, rev 0x00f4, size 105472 sig 0x000806e9, pf_mask 0xc0, 2023-02-22, rev 0x00f4, size 106496 sig 0x000806ea, pf_mask 0xc0, 2023-02-23, rev 0x00f4, size 105472 sig 0x000806eb, pf_mask 0xd0, 2023-02-23, rev 0x00f4, size 106496 sig 0x000806ec, pf_mask 0x94, 2023-02-26, rev 0x00f8, size 106496 sig 0x000806f4, pf_mask 0x10, 2023-05-15, rev 0x2c000271, size 605184 sig 0x000806f4, pf_mask 0x87, 2023-05-09, rev 0x2b0004b1, size 572416 sig 0x000806f5, pf_mask 0x10, 2023-05-15, rev 0x2c000271, size 605184 sig 0x000806f5, pf_mask 0x87, 2023-05-09, rev 0x2b0004b1, size 572416 sig 0x000806f6, pf_mask 0x10, 2023-05-15, rev 0x2c000271, size 605184 sig 0x000806f6, pf_mask 0x87, 2023-05-09, rev 0x2b0004b1, size 572416 sig 0x000806f7, pf_mask 0x87, 2023-05-09, rev 0x2b0004b1, size 572416 sig 0x000806f8, pf_mask 0x10, 2023-05-15, rev 0x2c000271, size 605184 sig 0x000806f8, pf_mask 0x87, 2023-05-09, rev 0x2b0004b1, size 572416 sig 0x00090672, pf_mask 0x07, 2023-04-18, rev 0x002e, size 220160 sig 0x00090675, pf_mask 0x07, 2023-04-18, rev 0x002e, size 220160 sig 0x000906a3, pf_mask 0x80, 2023-04-18, rev 0x042c, size 219136 sig 0x000906a4, pf_mask 0x80, 2023-04-18, rev 0x042c, size 219136 sig 0x000906e9, pf_mask 0x2a, 2023-02-23, rev 0x00f4, size 108544 sig 0x000906ea, pf_mask 0x22, 2023-02-23, rev 0x00f4, size 104448 sig 0x000906eb, pf_mask 0x02, 2023-02-23, rev 0x00f4, size 106496 sig 0x000906ec, pf_mask 0x22, 2023-02-23, rev 0x00f4, size 105472 sig 0x000906ed, pf_mask 0x22, 2023-02-27, rev 0x00fa, size 106496 sig 0x000a0652, pf_mask 0x20, 2023-02-23, rev 0x00f8, size 97280 sig 0x000a0653, pf_mask 0x22, 2023-02-23, rev 0x00f8, size 97280 sig 0x000a0655, pf_mask 0x22, 2023-02-23, rev 0x00f8, size 97280 sig 0x000a0660, pf_mask 0x80, 2023-02-23, rev 0x00f8, size 97280 sig 0x000a0661, pf_mask 0x80, 2023-02-23, rev 0x00f8, size 96256 sig 0x000a0671, pf_mask 0x02, 2023-02-26, rev 0x0059, size 104448 sig 0x000b0671, pf_mask 0x32, 2023-06-06, rev 0x0119, size 210944 sig 0x000b06a2, pf_mask 0xe0, 2023-06-06, rev 0x4119, size 216064 sig 0x000b06a3, pf_mask 0xe0, 2023-06-06, rev 0x4119, size 216064 sig 0x000b06e0, pf_mask 0x11, 2023-04-12, rev 0x0011, size 136192 sig 0x000b06f2, pf_mask 0x07, 2023-04-18, rev 0x002e, size 220160 sig 0x000b06f5, pf_mask 0x07, 2023-04-18, rev 0x002e, size 220160
  • CVE-2022-40982, INTEL-SA-00828
  • CVE-2023-23908, INTEL-SA-00836
  • CVE-2022-41804, INTEL-SA-00837
• source: update symlinks to reflect id of the latest release, 20230808

• SECURITY UPDATE: New microcode data file 2023-08-08 - Updated microcodes: sig 0x00050653, pf_mask 0x97, 2023-03-23, rev 0x1000181, size 36864 sig 0x00050654, pf_mask 0xb7, 2023-03-06, rev 0x2007006, size 44032 sig 0x00050656, pf_mask 0xbf, 2023-03-17, rev 0x4003604, size 38912 sig 0x00050657, pf_mask 0xbf, 2023-03-17, rev 0x5003604, size 38912 sig 0x0005065b, pf_mask 0xbf, 2023-03-21, rev 0x7002703, size 30720 sig 0x000606a6, pf_mask 0x87, 2023-03-30, rev 0xd0003a5, size 297984 sig 0x000706e5, pf_mask 0x80, 2023-02-26, rev 0x00bc, size 113664 sig 0x000806c1, pf_mask 0x80, 2023-02-27, rev 0x00ac, size 111616 sig 0x000806c2, pf_mask 0xc2, 2023-02-27, rev 0x002c, size 98304 sig 0x000806d1, pf_mask 0xc2, 2023-02-27, rev 0x0046, size 103424 sig 0x000806e9, pf_mask 0x10, 2023-02-23, rev 0x00f4, size 105472 sig 0x000806e9, pf_mask 0xc0, 2023-02-22, rev 0x00f4, size 106496 sig 0x000806ea, pf_mask 0xc0, 2023-02-23, rev 0x00f4, size 105472 sig 0x000806eb, pf_mask 0xd0, 2023-02-23, rev 0x00f4, size 106496 sig 0x000806ec, pf_mask 0x94, 2023-02-26, rev 0x00f8, size 106496 sig 0x000806f4, pf_mask 0x10, 2023-05-15, rev 0x2c000271, size 605184 sig 0x000806f4, pf_mask 0x87, 2023-05-09, rev 0x2b0004b1, size 572416 sig 0x000806f5, pf_mask 0x10, 2023-05-15, rev 0x2c000271, size 605184 sig 0x000806f5, pf_mask 0x87, 2023-05-09, rev 0x2b0004b1, size 572416 sig 0x000806f6, pf_mask 0x10, 2023-05-15, rev 0x2c000271, size 605184 sig 0x000806f6, pf_mask 0x87, 2023-05-09, rev 0x2b0004b1, size 572416 sig 0x000806f7, pf_mask 0x87, 2023-05-09, rev 0x2b0004b1, size 572416 sig 0x000806f8, pf_mask 0x10, 2023-05-15, rev 0x2c000271, size 605184 sig 0x000806f8, pf_mask 0x87, 2023-05-09, rev 0x2b0004b1, size 572416 sig 0x00090672, pf_mask 0x07, 2023-04-18, rev 0x002e, size 220160 sig 0x00090675, pf_mask 0x07, 2023-04-18, rev 0x002e, size 220160 sig 0x000906a3, pf_mask 0x80, 2023-04-18, rev 0x042c, size 219136 sig 0x000906a4, pf_mask 0x80, 2023-04-18, rev 0x042c, size 219136 sig 0x000906e9, pf_mask 0x2a, 2023-02-23, rev 0x00f4, size 108544 sig 0x000906ea, pf_mask 0x22, 2023-02-23, rev 0x00f4, size 104448 sig 0x000906eb, pf_mask 0x02, 2023-02-23, rev 0x00f4, size 106496 sig 0x000906ec, pf_mask 0x22, 2023-02-23, rev 0x00f4, size 105472 sig 0x000906ed, pf_mask 0x22, 2023-02-27, rev 0x00fa, size 106496 sig 0x000a0652, pf_mask 0x20, 2023-02-23, rev 0x00f8, size 97280 sig 0x000a0653, pf_mask 0x22, 2023-02-23, rev 0x00f8, size 97280 sig 0x000a0655, pf_mask 0x22, 2023-02-23, rev 0x00f8, size 97280 sig 0x000a0660, pf_mask 0x80, 2023-02-23, rev 0x00f8, size 97280 sig 0x000a0661, pf_mask 0x80, 2023-02-23, rev 0x00f8, size 96256 sig 0x000a0671, pf_mask 0x02, 2023-02-26, rev 0x0059, size 104448 sig 0x000b0671, pf_mask 0x32, 2023-06-06, rev 0x0119, size 210944 sig 0x000b06a2, pf_mask 0xe0, 2023-06-06, rev 0x4119, size 216064 sig 0x000b06a3, pf_mask 0xe0, 2023-06-06, rev 0x4119, size 216064 sig 0x000b06e0, pf_mask 0x11, 2023-04-12, rev 0x0011, size 136192 sig 0x000b06f2, pf_mask 0x07, 2023-04-18, rev 0x002e, size 220160 sig 0x000b06f5, pf_mask 0x07, 2023-04-18, rev 0x002e, size 220160
  • CVE-2022-40982, INTEL-SA-00828
  • CVE-2023-23908, INTEL-SA-00836
  • CVE-2022-41804, INTEL-SA-00837
• source: update symlinks to reflect id of the latest release, 20230808

• CVE-url: https://ubuntu.com/security/CVE-2023-42753
  • netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c
• CVE-2022-40982 // CVE-url: https://ubuntu.com/security/CVE-2022-40982
  • init: Provide arch_cpu_finalize_init()
  • x86/cpu: Switch to arch_cpu_finalize_init()
  • init: Remove check_bugs() leftovers
  • x86/speculation: Add Gather Data Sampling mitigation
  • x86/speculation: Add force option to GDS mitigation
  • x86/speculation: Add Kconfig option for GDS
  • KVM: Add GDS_NO support to KVM
• CVE-url: https://ubuntu.com/security/CVE-2022-40982
  • vmlinux.lds.h: Create section for protection against instrumentation
  • x86/cpu: Move arch_smt_update() to a neutral place
• CVE-2023-20588 // CVE-url: https://ubuntu.com/security/CVE-2023-20588
  • x86/bugs: Increase the x86 bugs vector size to two u32s
  • x86/CPU/AMD: Do not leak quotient data after a division by 0
  • x86/CPU/AMD: Fix the DIV(0) initial fix attempt
• CVE-2023-3863 // CVE-url: https://ubuntu.com/security/CVE-2023-3863
  • nfc: llcp: simplify llcp_sock_connect() error paths
  • net: nfc: Fix use-after-free caused by nfc_llcp_find_local
• CVE-url: https://ubuntu.com/security/CVE-2023-3863
  • nfc: Fix to check for kmemdup failure
• CVE-url: https://ubuntu.com/security/CVE-2023-4921
  • net: sched: sch_qfq: Fix UAF in qfq_dequeue()
• Miscellaneous Ubuntu changes
  • [Config] CONFIG_GDS_FORCE_MITIGATION=n

• CVE-url: https://ubuntu.com/security/CVE-2023-42753
  • netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c
• CVE-2022-40982 // CVE-url: https://ubuntu.com/security/CVE-2022-40982
  • init: Provide arch_cpu_finalize_init()
  • x86/cpu: Switch to arch_cpu_finalize_init()
  • init: Remove check_bugs() leftovers
  • x86/speculation: Add Gather Data Sampling mitigation
  • x86/speculation: Add force option to GDS mitigation
  • x86/speculation: Add Kconfig option for GDS
  • KVM: Add GDS_NO support to KVM
• CVE-url: https://ubuntu.com/security/CVE-2022-40982
  • vmlinux.lds.h: Create section for protection against instrumentation
  • x86/cpu: Move arch_smt_update() to a neutral place
• CVE-2023-20588 // CVE-url: https://ubuntu.com/security/CVE-2023-20588
  • x86/bugs: Increase the x86 bugs vector size to two u32s
  • x86/CPU/AMD: Do not leak quotient data after a division by 0
  • x86/CPU/AMD: Fix the DIV(0) initial fix attempt
• CVE-2023-3863 // CVE-url: https://ubuntu.com/security/CVE-2023-3863
  • nfc: llcp: simplify llcp_sock_connect() error paths
  • net: nfc: Fix use-after-free caused by nfc_llcp_find_local
• CVE-url: https://ubuntu.com/security/CVE-2023-3863
  • nfc: Fix to check for kmemdup failure
• CVE-url: https://ubuntu.com/security/CVE-2023-4921
  • net: sched: sch_qfq: Fix UAF in qfq_dequeue()
• Miscellaneous Ubuntu changes
  • [Config] CONFIG_GDS_FORCE_MITIGATION=n

• CVE-url: https://ubuntu.com/security/CVE-2023-42753
  • netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c
• CVE-2022-40982 // CVE-url: https://ubuntu.com/security/CVE-2022-40982
  • init: Provide arch_cpu_finalize_init()
  • x86/cpu: Switch to arch_cpu_finalize_init()
  • init: Remove check_bugs() leftovers
  • x86/speculation: Add Gather Data Sampling mitigation
  • x86/speculation: Add force option to GDS mitigation
  • x86/speculation: Add Kconfig option for GDS
  • KVM: Add GDS_NO support to KVM
• CVE-url: https://ubuntu.com/security/CVE-2022-40982
  • x86/cpu: Move arch_smt_update() to a neutral place
• Bionic update: upstream stable patchset 2019-07-23 (LP: #1837664) // CVE- url: https://ubuntu.com/security/CVE-2022-40982
  • cpu/hotplug: Fix "SMT disabled by BIOS" detection for KVM
• Jammy update: v5.15.94 upstream stable release (LP: #2012673) // CVE-url: https://ubuntu.com/security/CVE-2022-40982
  • x86/speculation: Identify processors vulnerable to SMT RSB predictions
• CVE-2023-20588 // CVE-url: https://ubuntu.com/security/CVE-2023-20588
  • x86/bugs: Increase the x86 bugs vector size to two u32s
  • x86/CPU/AMD: Do not leak quotient data after a division by 0
  • x86/CPU/AMD: Fix the DIV(0) initial fix attempt
• CVE-2023-3863 // CVE-url: https://ubuntu.com/security/CVE-2023-3863
  • nfc: llcp: simplify llcp_sock_connect() error paths
  • net: nfc: Fix use-after-free caused by nfc_llcp_find_local
• Jammy update: v5.15.46 upstream stable release (LP: #1981864) // CVE-url: https://ubuntu.com/security/CVE-2023-4385
  • fs: jfs: fix possible NULL pointer dereference in dbFree()
• Jammy update: v5.15.42 upstream stable release (LP: #1981375) // CVE-url: https://ubuntu.com/security/CVE-2023-4459
  • net: vmxnet3: fix possible NULL pointer dereference in vmxnet3_rq_cleanup()
• CVE-url: https://ubuntu.com/security/CVE-2023-4921
  • net: sched: sch_qfq: Fix UAF in qfq_dequeue()
• Miscellaneous Ubuntu changes
  • [Config] CONFIG_GDS_FORCE_MITIGATION=n

• CVE-url: https://ubuntu.com/security/CVE-2023-42753
  • netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c
• CVE-2022-40982 // CVE-url: https://ubuntu.com/security/CVE-2022-40982
  • init: Provide arch_cpu_finalize_init()
  • x86/cpu: Switch to arch_cpu_finalize_init()
  • init: Remove check_bugs() leftovers
  • x86/speculation: Add Gather Data Sampling mitigation
  • x86/speculation: Add force option to GDS mitigation
  • x86/speculation: Add Kconfig option for GDS
  • KVM: Add GDS_NO support to KVM
• CVE-url: https://ubuntu.com/security/CVE-2022-40982
  • x86/cpu: Move arch_smt_update() to a neutral place
• Bionic update: upstream stable patchset 2019-07-23 (LP: #1837664) // CVE- url: https://ubuntu.com/security/CVE-2022-40982
  • cpu/hotplug: Fix "SMT disabled by BIOS" detection for KVM
• Jammy update: v5.15.94 upstream stable release (LP: #2012673) // CVE-url: https://ubuntu.com/security/CVE-2022-40982
  • x86/speculation: Identify processors vulnerable to SMT RSB predictions
• CVE-2023-20588 // CVE-url: https://ubuntu.com/security/CVE-2023-20588
  • x86/bugs: Increase the x86 bugs vector size to two u32s
  • x86/CPU/AMD: Do not leak quotient data after a division by 0
  • x86/CPU/AMD: Fix the DIV(0) initial fix attempt
• CVE-2023-3863 // CVE-url: https://ubuntu.com/security/CVE-2023-3863
  • nfc: llcp: simplify llcp_sock_connect() error paths
  • net: nfc: Fix use-after-free caused by nfc_llcp_find_local
• Jammy update: v5.15.46 upstream stable release (LP: #1981864) // CVE-url: https://ubuntu.com/security/CVE-2023-4385
  • fs: jfs: fix possible NULL pointer dereference in dbFree()
• Jammy update: v5.15.42 upstream stable release (LP: #1981375) // CVE-url: https://ubuntu.com/security/CVE-2023-4459
  • net: vmxnet3: fix possible NULL pointer dereference in vmxnet3_rq_cleanup()
• CVE-url: https://ubuntu.com/security/CVE-2023-4921
  • net: sched: sch_qfq: Fix UAF in qfq_dequeue()
• Miscellaneous Ubuntu changes
  • [Config] CONFIG_GDS_FORCE_MITIGATION=n

• Update Intel CPU microcode to microcode-20231114 release, addresses CVE-2022-40982 (INTEL-SA-00828), CVE-2022-41804 (INTEL-SA-00837), CVE-2023-23908 (INTEL-SA-00836), CVE-2023-23583 (INTEL-SA-00950):
  • Addition of 06-9a-04/0x40 microcode (in 06-9a-04) at revision 0x5;
  • Addition of 06-ba-02/0xe0 microcode (in 06-ba-02) at revision 0x411c;
  • Addition of 06-ba-02/0xe0 microcode (in 06-ba-02) at revision 0x411c;
  • Addition of 06-ba-03/0xe0 microcode (in 06-ba-02) at revision 0x411c;
  • Addition of 06-ba-02/0xe0 microcode (in 06-ba-03) at revision 0x411c;
  • Addition of 06-ba-02/0xe0 microcode (in 06-ba-03) at revision 0x411c;
  • Addition of 06-ba-03/0xe0 microcode (in 06-ba-03) at revision 0x411c;
  • Addition of 06-be-00/0x11 microcode (in 06-be-00) at revision 0x12;
  • Removal of 06-ba-02/0xc0 microcode (in 06-ba-02) at revision 0x410e;
  • Removal of 06-ba-02/0xc0 microcode (in 06-ba-02) at revision 0x410e;
  • Removal of 06-ba-03/0xc0 microcode (in 06-ba-02) at revision 0x410e;
  • Removal of 06-ba-02/0xc0 microcode (in 06-ba-03) at revision 0x410e;
  • Removal of 06-ba-02/0xc0 microcode (in 06-ba-03) at revision 0x410e;
  • Removal of 06-ba-03/0xc0 microcode (in 06-ba-03) at revision 0x410e;
  • Update of 06-55-03/0x97 (SKX-SP B1) microcode (in 06-55-03) from revision 0x1000161 up to 0x1000181;
  • Update of 06-55-04/0xb7 (SKX-D/SP/W/X H0/M0/M1/U0) microcode (in 06-55-04) from revision 0x2006e05 up to 0x2007006;
  • Update of 06-55-06/0xbf (CLX-SP B0) microcode (in 06-55-06) from revision 0x4003303 up to 0x4003604;
  • Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode (in 06-55-07) from revision 0x5003303 up to 0x5003604;
  • Update of 06-55-0b/0xbf (CPX-SP A1) microcode (in 06-55-0b) from revision 0x7002503 up to 0x7002703;
  • Update of 06-6a-06/0x87 (ICX-SP D0) microcode (in 06-6a-06) from revision 0xd000389 up to 0xd0003b9;
  • Update of 06-6c-01/0x10 (ICL-D B0) microcode (in 06-6c-01) from revision 0x1000211 up to 0x1000268;
  • Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode (in 06-7e-05) from revision 0xb8 up to 0xc2;
  • Update of 06-8a-01/0x10 (LKF B2/B3) microcode (in 06-8a-01) from revision 0x32 up to 0x33;
  • Update of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode (in 06-8c-01) from revision 0xa6 up to 0xb4;
  • Update of 06-8c-02/0xc2 (TGL-R C0) microcode (in 06-8c-02) from revision 0x28 up to 0x34;
  • Update of 06-8d-01/0xc2 (TGL-H R0) microcode (in 06-8d-01) from revision 0x42 up to 0x4e;
  • Update of 06-8e-09/0x10 (AML-Y 2+2 H0) microcode (in 06-8e-09) from revision 0xf0 up to 0xf4;
  • Update of 06-8e-09/0xc0 (KBL-U/U 2+3e/Y H0/J1) microcode (in 06-8e-09) from revision 0xf0 up to 0xf4;
  • Update of 06-8e-0a/0xc0 (CFL-U 4+3e D0, KBL-R Y0) microcode (in 06-8e-0a) from revision 0xf0 up to 0xf4;
  • Update of 06-8e-0b/0xd0 (WHL-U W0) microcode (in 06-8e-0b) from revision 0xf0 up to 0xf4;
  • Update of 06-8e-0c/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0) microcode (in 06-8e-0c) from revision 0xf4 up to 0xf8;
  • Update of 06-8f-04/0x10 microcode (in 06-8f-04) from revision 0x2c000170 up to 0x2c000290;
  • Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in 06-8f-04) from revision 0x2b000181 up to 0x2b0004d0;
  • Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in 06-8f-04) from revision 0x2c000170 up to 0x2c000290;
  • Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in 06-8f-04) from revision 0x2b000181 up to 0x2b0004d0;
  • Update of 06-8f-06/0x10 microcode (in 06-8f-04) from revision 0x2c000170 up to 0x2c000290;
  • Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in 06-8f-04) from revision 0x2b000181 up to 0x2b0004d0;
  • Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in 06-8f-04) from revision 0x2b000181 up to 0x2b0004d0;
  • Addition of 06-8f-08/0x10 (SPR-HBM B3) microcode (in 06-8f-04) at revision 0x2c000290;
  • Addition of 06-8f-08/0x10 (SPR-HBM B3) microcode (in 06-8f-04) at revision …

• tipc: Return non-zero value from tipc_udp_addr2str() on error {CVE-2024-42284}
• dev/parport: fix the array out-of-bounds risk {CVE-2024-42301}
• RDMA/iwcm: Fix a use-after-free related to destroying CM IDs {CVE-2024-42285}
• scsi: aacraid: Fix double-free on probe failure {CVE-2024-46673}
• ipv6: prevent UAF in ip6_send_skb() {CVE-2024-44987}
• block/ioctl: prefer different overflow check {CVE-2024-41000}
• ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." {CVE-2024-40984}
• net/sched: Fix UAF when resolving a clash {CVE-2024-41040}
• nvme: avoid double free special payload {CVE-2024-41073}
• x86/tdx: Allow 32-bit emulation by default {CVE-2024-25744}
• x86/entry: Do not allow external 0x80 interrupts {CVE-2024-25742}
• x86/entry: Convert INT 0x80 emulation to IDTENTRY {CVE-2024-25742}
• x86/coco: Disable 32-bit emulation by default on TDX and SEV {CVE-2024-25742}
• x86: Make IA32_EMULATION boot time configurable {CVE-2024-25744}
• x86/entry: Make IA32 syscalls' availability depend on ia32_enabled() {CVE-2024-25744}
• x86/elf: Make loading of 32bit processes depend on ia32_enabled() {CVE-2024-25744}
• x86/entry: Compile entry_SYSCALL32_ignore() unconditionally {CVE-2024-25744}
• x86/entry: Rename ignore_sysret() {CVE-2024-25744}
• x86/cpu: Don't write CSTAR MSR on Intel CPUs {CVE-2024-25744}
• x86: Introduce ia32_enabled() {CVE-2024-25742}
• x86: Fix misspelled Kconfig symbols {CVE-2024-25744}
• x86/sev: Harden #VC instruction emulation somewhat {CVE-2024-25742}
• objtool: Add entry UNRET validation {CVE-2024-25744}
• x86/cpu: Switch to arch_cpu_finalize_init() {CVE-2022-40982}
• init: Provide arch_cpu_finalize_init() {CVE-2022-40982}
• gfs2: Fix potential glock use-after-free on unmount {CVE-2024-38570}
• gfs2: Rename sd_{ glock => kill }_wait {CVE-2024-38570}
• gfs2: Remove ill-placed consistency check {CVE-2024-38570}
• gfs2: simplify gdlm_put_lock with out_free label {CVE-2024-38570}
• dmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list {CVE-2024-40956}
• drm/amdgpu: add error handle to avoid out-of-bounds {CVE-2024-39471}
• net/mlx5: Discard command completions in internal error {CVE-2024-38555}
• net: bridge: xmit: make sure we have at least eth header len bytes {CVE-2024-38538}
• netfilter: nftables: exthdr: fix 4-byte stack OOB write {CVE-2023-52628}
• perf/core: Fix potential NULL deref {CVE-2023-5717}
• perf: Disallow mis-matched inherited group reads {CVE-2023-5717}

This update adds initial microcode updates for AMD and Intel CPUs for the following security issues:

AMD: A side channel vulnerability in some of the AMD CPUs may allow an attacker to influence the return address prediction. This may result in speculative execution at an attacker-controlled instruction pointer register, potentially leading to information disclosure (CVE-2023-20569).

Intel: Information exposure through microarchitectural state after transient execution in certain vector execution units for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access (CVE-2022-40982, INTEL-SA-00828).

Unauthorized error injection in Intel(R) SGX or Intel(R) TDX for some Intel(R) Xeon(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access (CVE-2022-41804, INTEL-SA-00837).

Improper access control in some 3rd Generation Intel(R) Xeon(R) Scalable processors may allow a privileged user to potentially enable information disclosure via local access (CVE-2023-23908, INTEL-SA-00836).

This kernel update is based on upstream 5.15.126 and fixes or adds mitigations for atleast the following security issues:

Information exposure through microarchitectural state after transient execution in certain vector execution units for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access (CVE-2022-40982, INTEL-SA-00828).

A hash collision flaw was found in the IPv6 connection lookup table in the Linux kernel’s IPv6 functionality when a user makes a new kind of SYN flood attack. A user located in the local network or with a high bandwidth connection can increase the CPU usage of the server that accepts IPV6 connections up to 95% (CVE-2023-1206).

A use-after-free flaw was found in the Linux kernel's netfilter in the way a user triggers the nft_pipapo_remove function with the element, without a NFT_SET_EXT_KEY_END. This issue could allow a local user to crash the system or potentially escalate their privileges on the system (CVE-2023-4004).

A use-after-free flaw was found in the Linux kernel’s Netfilter functionality when adding a rule with NFTA_RULE_CHAIN_ID. This flaw allows a local user to crash or escalate their privileges on the system (CVE-2023-4147).

A side channel vulnerability in some of the AMD CPUs may allow an attacker to influence the return address prediction. This may result in speculative execution at an attacker-controlled instruction pointer register, potentially leading to information disclosure (CVE-2023-20569).

A buffer overrun vulnerability was found in the netback driver in Xen due to an unusual split packet. This flaw allows an unprivileged guest to cause a denial of service (DoS) of the host by sending network packets to the backend, causing the backend to crash (CVE-2023-34319, XSA-432).

Security fix for AMD Zen1 information leak through Divide By Zero.

For other upstream fixes in this update, see the referenced changelogs.

This kerne-linusl update is based on upstream 5.15.126 and fixes or adds mitigations for atleast the following security issues:

Information exposure through microarchitectural state after transient execution in certain vector execution units for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access (CVE-2022-40982, INTEL-SA-00828).

A hash collision flaw was found in the IPv6 connection lookup table in the Linux kernel’s IPv6 functionality when a user makes a new kind of SYN flood attack. A user located in the local network or with a high bandwidth connection can increase the CPU usage of the server that accepts IPV6 connections up to 95% (CVE-2023-1206).

A use-after-free flaw was found in the Linux kernel's netfilter in the way a user triggers the nft_pipapo_remove function with the element, without a NFT_SET_EXT_KEY_END. This issue could allow a local user to crash the system or potentially escalate their privileges on the system (CVE-2023-4004).

A use-after-free flaw was found in the Linux kernel’s Netfilter functionality when adding a rule with NFTA_RULE_CHAIN_ID. This flaw allows a local user to crash or escalate their privileges on the system (CVE-2023-4147).

A side channel vulnerability in some of the AMD CPUs may allow an attacker to influence the return address prediction. This may result in speculative execution at an attacker-controlled instruction pointer register, potentially leading to information disclosure (CVE-2023-20569).

A buffer overrun vulnerability was found in the netback driver in Xen due to an unusual split packet. This flaw allows an unprivileged guest to cause a denial of service (DoS) of the host by sending network packets to the backend, causing the backend to crash (CVE-2023-34319, XSA-432).

For other upstream fixes in this update, see the referenced changelogs.

These are all security issues fixed in the kernel-devel-6.4.9-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ucode-intel-20230808-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the xen-4.17.2_02-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the kernel-devel-longterm-6.6.17-1.1 package on the GA media of openSUSE Tumbleweed.

This update for ucode-intel fixes the following issues:

• Updated to Intel CPU Microcode 20230808 release. (bsc#1214099)
• CVE-2022-40982: Fixed a potential security vulnerability in some Intel� Processors which may allow information disclosure.
• CVE-2023-23908: Fixed a potential security vulnerability in some 3rd Generation Intel� Xeon� Scalable processors which may allow information disclosure.
• CVE-2022-41804: Fixed a potential security vulnerability in some Intel� Xeon� Processors with Intel� Software Guard Extensions (SGX) which may allow escalation of privilege.