Security update for the Linux Kernel SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2023:3421-1 Final 1 1 2023-08-24T08:55:49Z current 2023-08-24T08:55:49Z 2023-08-24T08:55:49Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for the Linux Kernel The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2023-2156: Fixed IPv6 RPL Protocol Reachable Assertion Denial-of-Service Vulnerability (bsc#1211131). - CVE-2022-40982: Fixed transient execution attack called 'Gather Data Sampling' (bsc#1206418). - CVE-2023-0459: Fixed information leak in __uaccess_begin_nospec (bsc#1211738). - CVE-2023-20569: Fixed side channel attack ‘Inception’ or ‘RAS Poisoning’ (bsc#1213287). - CVE-2023-20593: Fixed a ZenBleed issue in 'Zen 2' CPUs that could allow an attacker to potentially access sensitive information (bsc#1213286). - CVE-2023-2985: Fixed an use-after-free vulnerability in hfsplus_put_super in fs/hfsplus/super.c that could allow a local user to cause a denial of service (bsc#1211867). - CVE-2023-3117: Fixed an use-after-free vulnerability in the netfilter subsystem when processing named and anonymous sets in batch requests that could allow a local user with CAP_NET_ADMIN capability to crash or potentially escalate their privileges on the system (bsc#1213245). - CVE-2023-31248: Fixed an use-after-free vulnerability in nft_chain_lookup_byid that could allow a local attacker to escalate their privilege (bsc#1213061). - CVE-2023-3390: Fixed an use-after-free vulnerability in the netfilter subsystem in net/netfilter/nf_tables_api.c that could allow a local attacker with user access to cause a privilege escalation issue (bsc#1212846). - CVE-2023-35001: Fixed an out-of-bounds memory access flaw in nft_byteorder that could allow a local attacker to escalate their privilege (bsc#1213059). - CVE-2023-3567: Fixed a use-after-free in vcs_read in drivers/tty/vt/vc_screen.c (bsc#1213167). - CVE-2023-3609: Fixed reference counter leak leading to overflow in net/sched (bsc#1213586). - CVE-2023-3611: Fixed an out-of-bounds write in net/sched sch_qfq(bsc#1213585). - CVE-2023-3776: Fixed improper refcount update in cls_fw leads to use-after-free (bsc#1213588). - CVE-2023-3812: Fixed an out-of-bounds memory access flaw in the TUN/TAP device driver functionality that could allow a local user to crash or potentially escalate their privileges on the system (bsc#1213543). The following non-security bugs were fixed: - arm: cpu: switch to arch_cpu_finalize_init() (bsc#1206418). - get module prefix from kmod (bsc#1212835). - remove more packaging cruft for sle < 12 sp3 - block, bfq: fix division by zero error on zero wsum (bsc#1213653). - init, x86: move mem_encrypt_init() into arch_cpu_finalize_init() (bsc#1206418). - init: invoke arch_cpu_finalize_init() earlier (bsc#1206418). - init: provide arch_cpu_finalize_init() (bsc#1206418). - init: remove check_bugs() leftovers (bsc#1206418). - jbd2: export jbd2_journal_[grab|put]_journal_head (bsc#1199304). - kernel-binary.spec.in: remove superfluous %% in supplements fixes: 02b7735e0caf ('rpm/kernel-binary.spec.in: add enhances and supplements tags to in-tree kmps') - kernel-docs: add buildrequires on python3-base when using python3 the python3 binary is provided by python3-base. - kernel-docs: use python3 together with python3-sphinx (bsc#1212741). - keys: do not cache key in task struct if key is requested from kernel thread (bsc#1213354). - lockdep: add preemption enabled/disabled assertion apis (bsc#1207270 jsc#ped-4567). - locking/rwsem: add __always_inline annotation to __down_read_common() and inlined callers (bsc#1207270 jsc#ped-4567). - locking/rwsem: allow slowpath writer to ignore handoff bit if not set by first waiter (bsc#1207270 jsc#ped-4567). - locking/rwsem: always try to wake waiters in out_nolock path (bsc#1207270 jsc#ped-4567). - locking/rwsem: better collate rwsem_read_trylock() (bsc#1207270 jsc#ped-4567). - locking/rwsem: conditionally wake waiters in reader/writer slowpaths (bsc#1207270 jsc#ped-4567). - locking/rwsem: disable preemption for spinning region (bsc#1207270 jsc#ped-4567). - locking/rwsem: disable preemption in all down_read*() and up_read() code paths (bsc#1207270 jsc#ped-4567). - locking/rwsem: disable preemption in all down_write*() and up_write() code paths (bsc#1207270 jsc#ped-4567). - locking/rwsem: disable preemption while trying for rwsem lock (bsc#1207270 jsc#ped-4567). - locking/rwsem: enable reader optimistic lock stealing (bsc#1207270 jsc#ped-4567). - locking/rwsem: fix comment typo (bsc#1207270 jsc#ped-4567). - locking/rwsem: fix comments about reader optimistic lock stealing conditions (bsc#1207270 jsc#ped-4567). - locking/rwsem: fold __down_{read,write}*() (bsc#1207270 jsc#ped-4567). - locking/rwsem: introduce rwsem_write_trylock() (bsc#1207270 jsc#ped-4567). - locking/rwsem: make handoff bit handling more consistent (bsc#1207270 jsc#ped-4567). - locking/rwsem: no need to check for handoff bit if wait queue empty (bsc#1207270 jsc#ped-4567). - locking/rwsem: optimize down_read_trylock() under highly contended case (bsc#1207270 jsc#ped-4567). - locking/rwsem: pass the current atomic count to rwsem_down_read_slowpath() (bsc#1207270 jsc#ped-4567). - locking/rwsem: prevent non-first waiter from spinning in down_write() slowpath (bsc#1207270 jsc#ped-4567). - locking/rwsem: prevent potential lock starvation (bsc#1207270 jsc#ped-4567). - locking/rwsem: remove an unused parameter of rwsem_wake() (bsc#1207270 jsc#ped-4567). - locking/rwsem: remove reader optimistic spinning (bsc#1207270 jsc#ped-4567). - locking: add missing __sched attributes (bsc#1207270 jsc#ped-4567). - locking: remove rcu_read_{,un}lock() for preempt_{dis,en}able() (bsc#1207270 jsc#ped-4567). - net/sched: sch_qfq: refactor parsing of netlink parameters (bsc#1213585). - net: mana: add support for vlan tagging (bsc#1212301). - ocfs2: fix a deadlock when commit trans (bsc#1199304). - ocfs2: fix defrag path triggering jbd2 assert (bsc#1199304). - ocfs2: fix race between searching chunks and release journal_head from buffer_head (bsc#1199304). - rpm/check-for-config-changes: ignore also pahole_has_* we now also have options like config_pahole_has_lang_exclude. - rpm/check-for-config-changes: ignore also riscv_isa_* and dynamic_sigframe they depend on config_toolchain_has_*. - rwsem-rt: implement down_read_interruptible (bsc#1207270, jsc#ped-4567, sle realtime extension). - rwsem: implement down_read_interruptible (bsc#1207270 jsc#ped-4567). - rwsem: implement down_read_killable_nested (bsc#1207270 jsc#ped-4567). - ubi: fix failure attaching when vid_hdr offset equals to (sub)page size (bsc#1210584). - ubi: ensure that vid header offset + vid header size <= alloc, size (bsc#1210584). - usrmerge: adjust module path in the kernel sources (bsc#1212835). - x86/cpu: switch to arch_cpu_finalize_init() (bsc#1206418). - x86/fpu: remove cpuinfo argument from init functions (bsc#1206418). - x86/microcode/AMD: Make stub function static inline (bsc#1213868). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2023-3421,SUSE-SUSE-MicroOS-5.1-2023-3421,SUSE-SUSE-MicroOS-5.2-2023-3421 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2023/suse-su-20233421-1/ Link for SUSE-SU-2023:3421-1 https://lists.suse.com/pipermail/sle-updates/2023-August/031178.html E-Mail link for SUSE-SU-2023:3421-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1199304 SUSE Bug 1199304 https://bugzilla.suse.com/1206418 SUSE Bug 1206418 https://bugzilla.suse.com/1207270 SUSE Bug 1207270 https://bugzilla.suse.com/1210584 SUSE Bug 1210584 https://bugzilla.suse.com/1211131 SUSE Bug 1211131 https://bugzilla.suse.com/1211738 SUSE Bug 1211738 https://bugzilla.suse.com/1211867 SUSE Bug 1211867 https://bugzilla.suse.com/1212301 SUSE Bug 1212301 https://bugzilla.suse.com/1212741 SUSE Bug 1212741 https://bugzilla.suse.com/1212835 SUSE Bug 1212835 https://bugzilla.suse.com/1212846 SUSE Bug 1212846 https://bugzilla.suse.com/1213059 SUSE Bug 1213059 https://bugzilla.suse.com/1213061 SUSE Bug 1213061 https://bugzilla.suse.com/1213167 SUSE Bug 1213167 https://bugzilla.suse.com/1213245 SUSE Bug 1213245 https://bugzilla.suse.com/1213286 SUSE Bug 1213286 https://bugzilla.suse.com/1213287 SUSE Bug 1213287 https://bugzilla.suse.com/1213354 SUSE Bug 1213354 https://bugzilla.suse.com/1213543 SUSE Bug 1213543 https://bugzilla.suse.com/1213585 SUSE Bug 1213585 https://bugzilla.suse.com/1213586 SUSE Bug 1213586 https://bugzilla.suse.com/1213588 SUSE Bug 1213588 https://bugzilla.suse.com/1213653 SUSE Bug 1213653 https://bugzilla.suse.com/1213868 SUSE Bug 1213868 https://www.suse.com/security/cve/CVE-2022-40982/ SUSE CVE CVE-2022-40982 page https://www.suse.com/security/cve/CVE-2023-0459/ SUSE CVE CVE-2023-0459 page https://www.suse.com/security/cve/CVE-2023-20569/ SUSE CVE CVE-2023-20569 page https://www.suse.com/security/cve/CVE-2023-20593/ SUSE CVE CVE-2023-20593 page https://www.suse.com/security/cve/CVE-2023-2156/ SUSE CVE CVE-2023-2156 page https://www.suse.com/security/cve/CVE-2023-2985/ SUSE CVE CVE-2023-2985 page https://www.suse.com/security/cve/CVE-2023-3117/ SUSE CVE CVE-2023-3117 page https://www.suse.com/security/cve/CVE-2023-31248/ SUSE CVE CVE-2023-31248 page https://www.suse.com/security/cve/CVE-2023-3390/ SUSE CVE CVE-2023-3390 page https://www.suse.com/security/cve/CVE-2023-35001/ SUSE CVE CVE-2023-35001 page https://www.suse.com/security/cve/CVE-2023-3567/ SUSE CVE CVE-2023-3567 page https://www.suse.com/security/cve/CVE-2023-3609/ SUSE CVE CVE-2023-3609 page https://www.suse.com/security/cve/CVE-2023-3611/ SUSE CVE CVE-2023-3611 page https://www.suse.com/security/cve/CVE-2023-3776/ SUSE CVE CVE-2023-3776 page https://www.suse.com/security/cve/CVE-2023-3812/ SUSE CVE CVE-2023-3812 page SUSE Linux Enterprise Micro 5.1 SUSE Linux Enterprise Micro 5.2 cluster-md-kmp-rt-5.3.18-150300.138.3 cluster-md-kmp-rt_debug-5.3.18-150300.138.3 dlm-kmp-rt-5.3.18-150300.138.3 dlm-kmp-rt_debug-5.3.18-150300.138.3 gfs2-kmp-rt-5.3.18-150300.138.3 gfs2-kmp-rt_debug-5.3.18-150300.138.3 kernel-devel-rt-5.3.18-150300.138.2 kernel-rt-5.3.18-150300.138.3 kernel-rt-devel-5.3.18-150300.138.3 kernel-rt-extra-5.3.18-150300.138.3 kernel-rt-livepatch-devel-5.3.18-150300.138.3 kernel-rt-optional-5.3.18-150300.138.3 kernel-rt_debug-5.3.18-150300.138.3 kernel-rt_debug-devel-5.3.18-150300.138.3 kernel-rt_debug-extra-5.3.18-150300.138.3 kernel-rt_debug-livepatch-devel-5.3.18-150300.138.3 kernel-rt_debug-optional-5.3.18-150300.138.3 kernel-source-rt-5.3.18-150300.138.2 kernel-syms-rt-5.3.18-150300.138.1 kselftests-kmp-rt-5.3.18-150300.138.3 kselftests-kmp-rt_debug-5.3.18-150300.138.3 ocfs2-kmp-rt-5.3.18-150300.138.3 ocfs2-kmp-rt_debug-5.3.18-150300.138.3 reiserfs-kmp-rt-5.3.18-150300.138.3 reiserfs-kmp-rt_debug-5.3.18-150300.138.3 kernel-rt-5.3.18-150300.138.3 as a component of SUSE Linux Enterprise Micro 5.1 kernel-rt-5.3.18-150300.138.3 as a component of SUSE Linux Enterprise Micro 5.2 Information exposure through microarchitectural state after transient execution in certain vector execution units for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. CVE-2022-40982 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.138.3 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.138.3 moderate 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20233421-1/ https://www.suse.com/security/cve/CVE-2022-40982.html CVE-2022-40982 https://bugzilla.suse.com/1206418 SUSE Bug 1206418 https://bugzilla.suse.com/1215674 SUSE Bug 1215674 Copy_from_user on 64-bit versions of the Linux kernel does not implement the __uaccess_begin_nospec allowing a user to bypass the "access_ok" check and pass a kernel pointer to copy_from_user(). This would allow an attacker to leak information. We recommend upgrading beyond commit 74e19ef0ff8061ef55957c3abd71614ef0f42f47 CVE-2023-0459 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.138.3 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.138.3 moderate 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20233421-1/ https://www.suse.com/security/cve/CVE-2023-0459.html CVE-2023-0459 https://bugzilla.suse.com/1211738 SUSE Bug 1211738 https://bugzilla.suse.com/1215674 SUSE Bug 1215674 A side channel vulnerability on some of the AMD CPUs may allow an attacker to influence the return address prediction. This may result in speculative execution at an attacker-controlled address, potentially leading to information disclosure. CVE-2023-20569 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.138.3 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.138.3 moderate 5.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20233421-1/ https://www.suse.com/security/cve/CVE-2023-20569.html CVE-2023-20569 https://bugzilla.suse.com/1213287 SUSE Bug 1213287 An issue in "Zen 2" CPUs, under specific microarchitectural circumstances, may allow an attacker to potentially access sensitive information. CVE-2023-20593 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.138.3 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.138.3 moderate 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20233421-1/ https://www.suse.com/security/cve/CVE-2023-20593.html CVE-2023-20593 https://bugzilla.suse.com/1213286 SUSE Bug 1213286 https://bugzilla.suse.com/1213616 SUSE Bug 1213616 https://bugzilla.suse.com/1215674 SUSE Bug 1215674 A flaw was found in the networking subsystem of the Linux kernel within the handling of the RPL protocol. This issue results from the lack of proper handling of user-supplied data, which can lead to an assertion failure. This may allow an unauthenticated remote attacker to create a denial of service condition on the system. CVE-2023-2156 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.138.3 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.138.3 important 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20233421-1/ https://www.suse.com/security/cve/CVE-2023-2156.html CVE-2023-2156 https://bugzilla.suse.com/1211131 SUSE Bug 1211131 https://bugzilla.suse.com/1211395 SUSE Bug 1211395 A use after free flaw was found in hfsplus_put_super in fs/hfsplus/super.c in the Linux Kernel. This flaw could allow a local user to cause a denial of service problem. CVE-2023-2985 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.138.3 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.138.3 moderate 6.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20233421-1/ https://www.suse.com/security/cve/CVE-2023-2985.html CVE-2023-2985 https://bugzilla.suse.com/1211867 SUSE Bug 1211867 ** REJECT ** Duplicate of CVE-2023-3390. CVE-2023-3117 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.138.3 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.138.3 important 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20233421-1/ https://www.suse.com/security/cve/CVE-2023-3117.html CVE-2023-3117 https://bugzilla.suse.com/1212934 SUSE Bug 1212934 https://bugzilla.suse.com/1213245 SUSE Bug 1213245 Linux Kernel nftables Use-After-Free Local Privilege Escalation Vulnerability; `nft_chain_lookup_byid()` failed to check whether a chain was active and CAP_NET_ADMIN is in any user or network namespace CVE-2023-31248 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.138.3 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.138.3 important 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20233421-1/ https://www.suse.com/security/cve/CVE-2023-31248.html CVE-2023-31248 https://bugzilla.suse.com/1213061 SUSE Bug 1213061 https://bugzilla.suse.com/1213064 SUSE Bug 1213064 A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in net/netfilter/nf_tables_api.c. Mishandled error handling with NFT_MSG_NEWRULE makes it possible to use a dangling pointer in the same transaction causing a use-after-free vulnerability. This flaw allows a local attacker with user access to cause a privilege escalation issue. We recommend upgrading past commit 1240eb93f0616b21c675416516ff3d74798fdc97. CVE-2023-3390 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.138.3 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.138.3 important 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20233421-1/ https://www.suse.com/security/cve/CVE-2023-3390.html CVE-2023-3390 https://bugzilla.suse.com/1212846 SUSE Bug 1212846 https://bugzilla.suse.com/1212934 SUSE Bug 1212934 https://bugzilla.suse.com/1216225 SUSE Bug 1216225 Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm register contents when CAP_NET_ADMIN is in any user or network namespace CVE-2023-35001 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.138.3 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.138.3 important 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20233421-1/ https://www.suse.com/security/cve/CVE-2023-35001.html CVE-2023-35001 https://bugzilla.suse.com/1213059 SUSE Bug 1213059 https://bugzilla.suse.com/1213063 SUSE Bug 1213063 https://bugzilla.suse.com/1217531 SUSE Bug 1217531 A use-after-free flaw was found in vcs_read in drivers/tty/vt/vc_screen.c in vc_screen in the Linux Kernel. This issue may allow an attacker with local user access to cause a system crash or leak internal kernel information. CVE-2023-3567 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.138.3 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.138.3 important 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20233421-1/ https://www.suse.com/security/cve/CVE-2023-3567.html CVE-2023-3567 https://bugzilla.suse.com/1213167 SUSE Bug 1213167 https://bugzilla.suse.com/1213244 SUSE Bug 1213244 https://bugzilla.suse.com/1213842 SUSE Bug 1213842 https://bugzilla.suse.com/1215674 SUSE Bug 1215674 https://bugzilla.suse.com/1217444 SUSE Bug 1217444 https://bugzilla.suse.com/1217531 SUSE Bug 1217531 A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation. If tcf_change_indev() fails, u32_set_parms() will immediately return an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability. We recommend upgrading past commit 04c55383fa5689357bcdd2c8036725a55ed632bc. CVE-2023-3609 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.138.3 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.138.3 moderate 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20233421-1/ https://www.suse.com/security/cve/CVE-2023-3609.html CVE-2023-3609 https://bugzilla.suse.com/1213586 SUSE Bug 1213586 https://bugzilla.suse.com/1213587 SUSE Bug 1213587 https://bugzilla.suse.com/1217444 SUSE Bug 1217444 https://bugzilla.suse.com/1217531 SUSE Bug 1217531 An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation. The qfq_change_agg() function in net/sched/sch_qfq.c allows an out-of-bounds write because lmax is updated according to packet sizes without bounds checks. We recommend upgrading past commit 3e337087c3b5805fe0b8a46ba622a962880b5d64. CVE-2023-3611 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.138.3 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.138.3 moderate 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20233421-1/ https://www.suse.com/security/cve/CVE-2023-3611.html CVE-2023-3611 https://bugzilla.suse.com/1213585 SUSE Bug 1213585 https://bugzilla.suse.com/1223091 SUSE Bug 1223091 https://bugzilla.suse.com/1223973 SUSE Bug 1223973 A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to achieve local privilege escalation. If tcf_change_indev() fails, fw_set_parms() will immediately return an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability. We recommend upgrading past commit 0323bce598eea038714f941ce2b22541c46d488f. CVE-2023-3776 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.138.3 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.138.3 moderate 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20233421-1/ https://www.suse.com/security/cve/CVE-2023-3776.html CVE-2023-3776 https://bugzilla.suse.com/1213588 SUSE Bug 1213588 https://bugzilla.suse.com/1215119 SUSE Bug 1215119 https://bugzilla.suse.com/1215674 SUSE Bug 1215674 https://bugzilla.suse.com/1217444 SUSE Bug 1217444 https://bugzilla.suse.com/1217531 SUSE Bug 1217531 https://bugzilla.suse.com/1221578 SUSE Bug 1221578 https://bugzilla.suse.com/1221598 SUSE Bug 1221598 https://bugzilla.suse.com/1223091 SUSE Bug 1223091 https://bugzilla.suse.com/1223973 SUSE Bug 1223973 An out-of-bounds memory access flaw was found in the Linux kernel's TUN/TAP device driver functionality in how a user generates a malicious (too big) networking packet when napi frags is enabled. This flaw allows a local user to crash or potentially escalate their privileges on the system. CVE-2023-3812 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.138.3 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.138.3 important 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20233421-1/ https://www.suse.com/security/cve/CVE-2023-3812.html CVE-2023-3812 https://bugzilla.suse.com/1213543 SUSE Bug 1213543 https://bugzilla.suse.com/1213706 SUSE Bug 1213706 https://bugzilla.suse.com/1217444 SUSE Bug 1217444 https://bugzilla.suse.com/1217531 SUSE Bug 1217531