Security update for the Linux Kernel SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2023:0767-1 Final 1 1 2023-03-16T12:17:04Z current 2023-03-16T12:17:04Z 2023-03-16T12:17:04Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for the Linux Kernel The SUSE Linux Enterprise 12 SP2 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2023-26545: Fixed double free in net/mpls/af_mpls.c upon an allocation failure (bsc#1208700). - CVE-2023-23559: Fixed integer overflow in rndis_wlan that leads to a buffer overflow (bsc#1207051). - CVE-2022-38096: Fixed NULL-ptr deref in vmw_cmd_dx_define_query() (bsc#1203331). - CVE-2022-36280: Fixed out-of-bounds memory access vulnerability found in vmwgfx driver (bsc#1203332). - CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2023-767,SUSE-SLE-SERVER-12-SP2-BCL-2023-767 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2023/suse-su-20230767-1/ Link for SUSE-SU-2023:0767-1 https://lists.suse.com/pipermail/sle-updates/2023-April/028598.html E-Mail link for SUSE-SU-2023:0767-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1203331 SUSE Bug 1203331 https://bugzilla.suse.com/1203332 SUSE Bug 1203332 https://bugzilla.suse.com/1207051 SUSE Bug 1207051 https://bugzilla.suse.com/1207795 SUSE Bug 1207795 https://bugzilla.suse.com/1208700 SUSE Bug 1208700 https://bugzilla.suse.com/1209188 SUSE Bug 1209188 https://www.suse.com/security/cve/CVE-2022-36280/ SUSE CVE CVE-2022-36280 page https://www.suse.com/security/cve/CVE-2022-38096/ SUSE CVE CVE-2022-38096 page https://www.suse.com/security/cve/CVE-2023-0590/ SUSE CVE CVE-2023-0590 page https://www.suse.com/security/cve/CVE-2023-23559/ SUSE CVE CVE-2023-23559 page https://www.suse.com/security/cve/CVE-2023-26545/ SUSE CVE CVE-2023-26545 page SUSE Linux Enterprise Server 12 SP2-BCL cluster-md-kmp-debug-4.4.121-92.202.5 cluster-md-kmp-default-4.4.121-92.202.5 cluster-md-kmp-vanilla-4.4.121-92.202.5 cluster-network-kmp-debug-4.4.121-92.202.5 cluster-network-kmp-default-4.4.121-92.202.5 cluster-network-kmp-vanilla-4.4.121-92.202.5 dlm-kmp-debug-4.4.121-92.202.5 dlm-kmp-default-4.4.121-92.202.5 dlm-kmp-vanilla-4.4.121-92.202.5 gfs2-kmp-debug-4.4.121-92.202.5 gfs2-kmp-default-4.4.121-92.202.5 gfs2-kmp-vanilla-4.4.121-92.202.5 kernel-debug-4.4.121-92.202.5 kernel-debug-base-4.4.121-92.202.5 kernel-debug-devel-4.4.121-92.202.5 kernel-debug-extra-4.4.121-92.202.5 kernel-debug-kgraft-4.4.121-92.202.5 kernel-default-4.4.121-92.202.5 kernel-default-base-4.4.121-92.202.5 kernel-default-devel-4.4.121-92.202.5 kernel-default-extra-4.4.121-92.202.5 kernel-default-kgraft-4.4.121-92.202.5 kernel-default-man-4.4.121-92.202.5 kernel-devel-4.4.121-92.202.6 kernel-docs-4.4.121-92.202.7 kernel-docs-html-4.4.121-92.202.7 kernel-docs-pdf-4.4.121-92.202.7 kernel-macros-4.4.121-92.202.6 kernel-obs-build-4.4.121-92.202.5 kernel-obs-qa-4.4.121-92.202.5 kernel-source-4.4.121-92.202.6 kernel-source-vanilla-4.4.121-92.202.6 kernel-syms-4.4.121-92.202.6 kernel-vanilla-4.4.121-92.202.5 kernel-vanilla-base-4.4.121-92.202.5 kernel-vanilla-devel-4.4.121-92.202.5 kernel-zfcpdump-4.4.121-92.202.5 ocfs2-kmp-debug-4.4.121-92.202.5 ocfs2-kmp-default-4.4.121-92.202.5 ocfs2-kmp-vanilla-4.4.121-92.202.5 kernel-default-4.4.121-92.202.5 as a component of SUSE Linux Enterprise Server 12 SP2-BCL kernel-default-base-4.4.121-92.202.5 as a component of SUSE Linux Enterprise Server 12 SP2-BCL kernel-default-devel-4.4.121-92.202.5 as a component of SUSE Linux Enterprise Server 12 SP2-BCL kernel-devel-4.4.121-92.202.6 as a component of SUSE Linux Enterprise Server 12 SP2-BCL kernel-macros-4.4.121-92.202.6 as a component of SUSE Linux Enterprise Server 12 SP2-BCL kernel-source-4.4.121-92.202.6 as a component of SUSE Linux Enterprise Server 12 SP2-BCL kernel-syms-4.4.121-92.202.6 as a component of SUSE Linux Enterprise Server 12 SP2-BCL An out-of-bounds(OOB) memory access vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_kms.c in GPU component in the Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing a denial of service(DoS). CVE-2022-36280 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-4.4.121-92.202.5 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-base-4.4.121-92.202.5 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-devel-4.4.121-92.202.5 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-devel-4.4.121-92.202.6 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-macros-4.4.121-92.202.6 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-source-4.4.121-92.202.6 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-syms-4.4.121-92.202.6 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20230767-1/ https://www.suse.com/security/cve/CVE-2022-36280.html CVE-2022-36280 https://bugzilla.suse.com/1203332 SUSE Bug 1203332 A NULL pointer dereference vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in GPU component of Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing a denial of service(DoS). CVE-2022-38096 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-4.4.121-92.202.5 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-base-4.4.121-92.202.5 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-devel-4.4.121-92.202.5 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-devel-4.4.121-92.202.6 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-macros-4.4.121-92.202.6 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-source-4.4.121-92.202.6 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-syms-4.4.121-92.202.6 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20230767-1/ https://www.suse.com/security/cve/CVE-2022-38096.html CVE-2022-38096 https://bugzilla.suse.com/1203331 SUSE Bug 1203331 A use-after-free flaw was found in qdisc_graft in net/sched/sch_api.c in the Linux Kernel due to a race problem. This flaw leads to a denial of service issue. If patch ebda44da44f6 ("net: sched: fix race condition in qdisc_graft()") not applied yet, then kernel could be affected. CVE-2023-0590 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-4.4.121-92.202.5 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-base-4.4.121-92.202.5 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-devel-4.4.121-92.202.5 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-devel-4.4.121-92.202.6 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-macros-4.4.121-92.202.6 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-source-4.4.121-92.202.6 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-syms-4.4.121-92.202.6 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20230767-1/ https://www.suse.com/security/cve/CVE-2023-0590.html CVE-2023-0590 https://bugzilla.suse.com/1207795 SUSE Bug 1207795 https://bugzilla.suse.com/1207822 SUSE Bug 1207822 https://bugzilla.suse.com/1211495 SUSE Bug 1211495 https://bugzilla.suse.com/1211833 SUSE Bug 1211833 In rndis_query_oid in drivers/net/wireless/rndis_wlan.c in the Linux kernel through 6.1.5, there is an integer overflow in an addition. CVE-2023-23559 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-4.4.121-92.202.5 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-base-4.4.121-92.202.5 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-devel-4.4.121-92.202.5 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-devel-4.4.121-92.202.6 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-macros-4.4.121-92.202.6 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-source-4.4.121-92.202.6 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-syms-4.4.121-92.202.6 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20230767-1/ https://www.suse.com/security/cve/CVE-2023-23559.html CVE-2023-23559 https://bugzilla.suse.com/1207051 SUSE Bug 1207051 In the Linux kernel before 6.1.13, there is a double free in net/mpls/af_mpls.c upon an allocation failure (for registering the sysctl table under a new location) during the renaming of a device. CVE-2023-26545 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-4.4.121-92.202.5 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-base-4.4.121-92.202.5 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-default-devel-4.4.121-92.202.5 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-devel-4.4.121-92.202.6 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-macros-4.4.121-92.202.6 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-source-4.4.121-92.202.6 SUSE Linux Enterprise Server 12 SP2-BCL:kernel-syms-4.4.121-92.202.6 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20230767-1/ https://www.suse.com/security/cve/CVE-2023-26545.html CVE-2023-26545 https://bugzilla.suse.com/1208700 SUSE Bug 1208700 https://bugzilla.suse.com/1208909 SUSE Bug 1208909 https://bugzilla.suse.com/1210423 SUSE Bug 1210423