Security update for the Linux Kernel SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2023:2506-1 Final 1 1 2023-06-14T07:24:44Z current 2023-06-14T07:24:44Z 2023-06-14T07:24:44Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for the Linux Kernel The SUSE Linux Enterprise 11 SP4 LTSS EXTREME CORE kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2023-2162: Fixed an use-after-free flaw in iscsi_sw_tcp_session_create (bsc#1210647). - CVE-2023-32269: Fixed a use-after-free in af_netrom.c, related to the fact that accept() was also allowed for a successfully connected AF_NETROM socket (bsc#1211186). - CVE-2023-1989: Fixed a use after free in btsdio_remove (bsc#1210336). - CVE-2017-5753: Fixed spectre vulnerability in prlimit (bsc#1209256). - CVE-2023-1670: Fixed a use after free in the Xircom 16-bit PCMCIA Ethernet driver. A local user could use this flaw to crash the system or potentially escalate their privileges on the system (bsc#1209871). - CVE-2023-1513: Fixed an uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak (bsc#1209532). - CVE-2023-28328: Fixed a denial of service issue in az6027 driver in drivers/media/usb/dev-usb/az6027.c (bsc#1209291). - CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795). - CVE-2018-9517: Fixed possible memory corruption due to a use after free in pppol2tp_connect (bsc#1108488). - CVE-2023-1118: Fixed a use-after-free bugs caused by ene_tx_irqsim() in media/rc (bsc#1208837). - CVE-2023-23559: Fixed integer overflow in rndis_wlan that leads to a buffer overflow (bsc#1207051). - CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207036). - CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (bsc#1207125). - CVE-2022-3567: Fixed a to race condition in inet6_stream_ops()/inet6_dgram_ops() (bsc#1204414). The following non-security bugs were fixed: - Do not sign the vanilla kernel (bsc#1209008). - do not fallthrough in cbq_classify and stop on TC_ACT_SHOT The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2023-2506,SUSE-SLE-SERVER-11-SP4-LTSS-EXTREME-CORE-2023-2506 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2023/suse-su-20232506-1/ Link for SUSE-SU-2023:2506-1 https://lists.suse.com/pipermail/sle-updates/2023-June/029875.html E-Mail link for SUSE-SU-2023:2506-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1108488 SUSE Bug 1108488 https://bugzilla.suse.com/1204414 SUSE Bug 1204414 https://bugzilla.suse.com/1207036 SUSE Bug 1207036 https://bugzilla.suse.com/1207051 SUSE Bug 1207051 https://bugzilla.suse.com/1207125 SUSE Bug 1207125 https://bugzilla.suse.com/1207795 SUSE Bug 1207795 https://bugzilla.suse.com/1208837 SUSE Bug 1208837 https://bugzilla.suse.com/1209008 SUSE Bug 1209008 https://bugzilla.suse.com/1209256 SUSE Bug 1209256 https://bugzilla.suse.com/1209291 SUSE Bug 1209291 https://bugzilla.suse.com/1209532 SUSE Bug 1209532 https://bugzilla.suse.com/1209871 SUSE Bug 1209871 https://bugzilla.suse.com/1210336 SUSE Bug 1210336 https://bugzilla.suse.com/1210647 SUSE Bug 1210647 https://bugzilla.suse.com/1211186 SUSE Bug 1211186 https://www.suse.com/security/cve/CVE-2017-5753/ SUSE CVE CVE-2017-5753 page https://www.suse.com/security/cve/CVE-2018-9517/ SUSE CVE CVE-2018-9517 page https://www.suse.com/security/cve/CVE-2022-3567/ SUSE CVE CVE-2022-3567 page https://www.suse.com/security/cve/CVE-2023-0590/ SUSE CVE CVE-2023-0590 page https://www.suse.com/security/cve/CVE-2023-1118/ SUSE CVE CVE-2023-1118 page https://www.suse.com/security/cve/CVE-2023-1513/ SUSE CVE CVE-2023-1513 page https://www.suse.com/security/cve/CVE-2023-1670/ SUSE CVE CVE-2023-1670 page https://www.suse.com/security/cve/CVE-2023-1989/ SUSE CVE CVE-2023-1989 page https://www.suse.com/security/cve/CVE-2023-2162/ SUSE CVE CVE-2023-2162 page https://www.suse.com/security/cve/CVE-2023-23454/ SUSE CVE CVE-2023-23454 page https://www.suse.com/security/cve/CVE-2023-23455/ SUSE CVE CVE-2023-23455 page https://www.suse.com/security/cve/CVE-2023-23559/ SUSE CVE CVE-2023-23559 page https://www.suse.com/security/cve/CVE-2023-28328/ SUSE CVE CVE-2023-28328 page https://www.suse.com/security/cve/CVE-2023-32269/ SUSE CVE CVE-2023-32269 page SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE kernel-debug-3.0.101-108.141.1 kernel-debug-base-3.0.101-108.141.1 kernel-debug-devel-3.0.101-108.141.1 kernel-debug-extra-3.0.101-108.141.1 kernel-debug-hmac-3.0.101-108.141.1 kernel-default-3.0.101-108.141.1 kernel-default-base-3.0.101-108.141.1 kernel-default-devel-3.0.101-108.141.1 kernel-default-extra-3.0.101-108.141.1 kernel-default-hmac-3.0.101-108.141.1 kernel-docs-3.0.101-108.141.1 kernel-ec2-3.0.101-108.141.1 kernel-ec2-base-3.0.101-108.141.1 kernel-ec2-devel-3.0.101-108.141.1 kernel-ec2-extra-3.0.101-108.141.1 kernel-ec2-hmac-3.0.101-108.141.1 kernel-pae-3.0.101-108.141.1 kernel-pae-base-3.0.101-108.141.1 kernel-pae-devel-3.0.101-108.141.1 kernel-pae-extra-3.0.101-108.141.1 kernel-pae-hmac-3.0.101-108.141.1 kernel-source-3.0.101-108.141.1 kernel-source-vanilla-3.0.101-108.141.1 kernel-syms-3.0.101-108.141.1 kernel-trace-3.0.101-108.141.1 kernel-trace-base-3.0.101-108.141.1 kernel-trace-devel-3.0.101-108.141.1 kernel-trace-extra-3.0.101-108.141.1 kernel-trace-hmac-3.0.101-108.141.1 kernel-vanilla-3.0.101-108.141.1 kernel-vanilla-base-3.0.101-108.141.1 kernel-vanilla-devel-3.0.101-108.141.1 kernel-vanilla-hmac-3.0.101-108.141.1 kernel-xen-3.0.101-108.141.1 kernel-xen-base-3.0.101-108.141.1 kernel-xen-devel-3.0.101-108.141.1 kernel-xen-extra-3.0.101-108.141.1 kernel-xen-hmac-3.0.101-108.141.1 kernel-default-3.0.101-108.141.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE kernel-default-base-3.0.101-108.141.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE kernel-default-devel-3.0.101-108.141.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE kernel-ec2-3.0.101-108.141.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE kernel-ec2-base-3.0.101-108.141.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE kernel-ec2-devel-3.0.101-108.141.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE kernel-source-3.0.101-108.141.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE kernel-syms-3.0.101-108.141.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE kernel-trace-3.0.101-108.141.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE kernel-trace-base-3.0.101-108.141.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE kernel-trace-devel-3.0.101-108.141.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE kernel-xen-3.0.101-108.141.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE kernel-xen-base-3.0.101-108.141.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE kernel-xen-devel-3.0.101-108.141.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis. CVE-2017-5753 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-default-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-default-base-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-default-devel-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-ec2-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-ec2-base-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-ec2-devel-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-source-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-syms-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-trace-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-trace-base-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-trace-devel-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-xen-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-xen-base-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-xen-devel-3.0.101-108.141.1 important 4.9 AV:L/AC:L/Au:N/C:C/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20232506-1/ https://www.suse.com/security/cve/CVE-2017-5753.html CVE-2017-5753 https://bugzilla.suse.com/1068032 SUSE Bug 1068032 https://bugzilla.suse.com/1074562 SUSE Bug 1074562 https://bugzilla.suse.com/1074578 SUSE Bug 1074578 https://bugzilla.suse.com/1074701 SUSE Bug 1074701 https://bugzilla.suse.com/1075006 SUSE Bug 1075006 https://bugzilla.suse.com/1075419 SUSE Bug 1075419 https://bugzilla.suse.com/1075748 SUSE Bug 1075748 https://bugzilla.suse.com/1080039 SUSE Bug 1080039 https://bugzilla.suse.com/1087084 SUSE Bug 1087084 https://bugzilla.suse.com/1087939 SUSE Bug 1087939 https://bugzilla.suse.com/1089055 SUSE Bug 1089055 https://bugzilla.suse.com/1136865 SUSE Bug 1136865 https://bugzilla.suse.com/1178658 SUSE Bug 1178658 https://bugzilla.suse.com/1201877 SUSE Bug 1201877 https://bugzilla.suse.com/1209547 SUSE Bug 1209547 In pppol2tp_connect, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android kernel. Android ID: A-38159931. CVE-2018-9517 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-default-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-default-base-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-default-devel-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-ec2-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-ec2-base-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-ec2-devel-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-source-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-syms-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-trace-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-trace-base-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-trace-devel-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-xen-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-xen-base-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-xen-devel-3.0.101-108.141.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20232506-1/ https://www.suse.com/security/cve/CVE-2018-9517.html CVE-2018-9517 https://bugzilla.suse.com/1108488 SUSE Bug 1108488 A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects the function inet6_stream_ops/inet6_dgram_ops of the component IPv6 Handler. The manipulation leads to race condition. It is recommended to apply a patch to fix this issue. VDB-211090 is the identifier assigned to this vulnerability. CVE-2022-3567 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-default-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-default-base-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-default-devel-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-ec2-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-ec2-base-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-ec2-devel-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-source-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-syms-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-trace-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-trace-base-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-trace-devel-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-xen-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-xen-base-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-xen-devel-3.0.101-108.141.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20232506-1/ https://www.suse.com/security/cve/CVE-2022-3567.html CVE-2022-3567 https://bugzilla.suse.com/1204414 SUSE Bug 1204414 A use-after-free flaw was found in qdisc_graft in net/sched/sch_api.c in the Linux Kernel due to a race problem. This flaw leads to a denial of service issue. If patch ebda44da44f6 ("net: sched: fix race condition in qdisc_graft()") not applied yet, then kernel could be affected. CVE-2023-0590 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-default-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-default-base-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-default-devel-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-ec2-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-ec2-base-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-ec2-devel-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-source-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-syms-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-trace-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-trace-base-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-trace-devel-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-xen-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-xen-base-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-xen-devel-3.0.101-108.141.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20232506-1/ https://www.suse.com/security/cve/CVE-2023-0590.html CVE-2023-0590 https://bugzilla.suse.com/1207795 SUSE Bug 1207795 https://bugzilla.suse.com/1207822 SUSE Bug 1207822 https://bugzilla.suse.com/1211495 SUSE Bug 1211495 https://bugzilla.suse.com/1211833 SUSE Bug 1211833 A flaw use after free in the Linux kernel integrated infrared receiver/transceiver driver was found in the way user detaching rc device. A local user could use this flaw to crash the system or potentially escalate their privileges on the system. CVE-2023-1118 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-default-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-default-base-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-default-devel-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-ec2-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-ec2-base-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-ec2-devel-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-source-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-syms-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-trace-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-trace-base-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-trace-devel-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-xen-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-xen-base-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-xen-devel-3.0.101-108.141.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20232506-1/ https://www.suse.com/security/cve/CVE-2023-1118.html CVE-2023-1118 https://bugzilla.suse.com/1208837 SUSE Bug 1208837 https://bugzilla.suse.com/1208910 SUSE Bug 1208910 https://bugzilla.suse.com/1210423 SUSE Bug 1210423 https://bugzilla.suse.com/1211495 SUSE Bug 1211495 https://bugzilla.suse.com/1213841 SUSE Bug 1213841 https://bugzilla.suse.com/1213842 SUSE Bug 1213842 A flaw was found in KVM. When calling the KVM_GET_DEBUGREGS ioctl, on 32-bit systems, there might be some uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak. CVE-2023-1513 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-default-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-default-base-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-default-devel-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-ec2-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-ec2-base-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-ec2-devel-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-source-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-syms-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-trace-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-trace-base-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-trace-devel-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-xen-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-xen-base-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-xen-devel-3.0.101-108.141.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20232506-1/ https://www.suse.com/security/cve/CVE-2023-1513.html CVE-2023-1513 https://bugzilla.suse.com/1209532 SUSE Bug 1209532 A flaw use after free in the Linux kernel Xircom 16-bit PCMCIA (PC-card) Ethernet driver was found.A local user could use this flaw to crash the system or potentially escalate their privileges on the system. CVE-2023-1670 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-default-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-default-base-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-default-devel-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-ec2-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-ec2-base-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-ec2-devel-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-source-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-syms-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-trace-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-trace-base-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-trace-devel-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-xen-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-xen-base-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-xen-devel-3.0.101-108.141.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20232506-1/ https://www.suse.com/security/cve/CVE-2023-1670.html CVE-2023-1670 https://bugzilla.suse.com/1209871 SUSE Bug 1209871 A use-after-free flaw was found in btsdio_remove in drivers\bluetooth\btsdio.c in the Linux Kernel. In this flaw, a call to btsdio_remove with an unfinished job, may cause a race problem leading to a UAF on hdev devices. CVE-2023-1989 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-default-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-default-base-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-default-devel-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-ec2-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-ec2-base-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-ec2-devel-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-source-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-syms-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-trace-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-trace-base-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-trace-devel-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-xen-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-xen-base-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-xen-devel-3.0.101-108.141.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20232506-1/ https://www.suse.com/security/cve/CVE-2023-1989.html CVE-2023-1989 https://bugzilla.suse.com/1210336 SUSE Bug 1210336 https://bugzilla.suse.com/1210500 SUSE Bug 1210500 https://bugzilla.suse.com/1213841 SUSE Bug 1213841 https://bugzilla.suse.com/1213842 SUSE Bug 1213842 https://bugzilla.suse.com/1214128 SUSE Bug 1214128 A use-after-free vulnerability was found in iscsi_sw_tcp_session_create in drivers/scsi/iscsi_tcp.c in SCSI sub-component in the Linux Kernel. In this flaw an attacker could leak kernel internal information. CVE-2023-2162 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-default-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-default-base-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-default-devel-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-ec2-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-ec2-base-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-ec2-devel-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-source-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-syms-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-trace-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-trace-base-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-trace-devel-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-xen-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-xen-base-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-xen-devel-3.0.101-108.141.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20232506-1/ https://www.suse.com/security/cve/CVE-2023-2162.html CVE-2023-2162 https://bugzilla.suse.com/1210647 SUSE Bug 1210647 https://bugzilla.suse.com/1210662 SUSE Bug 1210662 https://bugzilla.suse.com/1213841 SUSE Bug 1213841 https://bugzilla.suse.com/1213842 SUSE Bug 1213842 https://bugzilla.suse.com/1214128 SUSE Bug 1214128 cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service (slab-out-of-bounds read) because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results). CVE-2023-23454 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-default-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-default-base-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-default-devel-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-ec2-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-ec2-base-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-ec2-devel-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-source-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-syms-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-trace-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-trace-base-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-trace-devel-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-xen-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-xen-base-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-xen-devel-3.0.101-108.141.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20232506-1/ https://www.suse.com/security/cve/CVE-2023-23454.html CVE-2023-23454 https://bugzilla.suse.com/1207036 SUSE Bug 1207036 https://bugzilla.suse.com/1207188 SUSE Bug 1207188 https://bugzilla.suse.com/1208030 SUSE Bug 1208030 https://bugzilla.suse.com/1208044 SUSE Bug 1208044 https://bugzilla.suse.com/1208085 SUSE Bug 1208085 https://bugzilla.suse.com/1211833 SUSE Bug 1211833 atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results). CVE-2023-23455 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-default-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-default-base-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-default-devel-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-ec2-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-ec2-base-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-ec2-devel-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-source-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-syms-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-trace-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-trace-base-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-trace-devel-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-xen-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-xen-base-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-xen-devel-3.0.101-108.141.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20232506-1/ https://www.suse.com/security/cve/CVE-2023-23455.html CVE-2023-23455 https://bugzilla.suse.com/1207125 SUSE Bug 1207125 https://bugzilla.suse.com/1207189 SUSE Bug 1207189 https://bugzilla.suse.com/1211833 SUSE Bug 1211833 In rndis_query_oid in drivers/net/wireless/rndis_wlan.c in the Linux kernel through 6.1.5, there is an integer overflow in an addition. CVE-2023-23559 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-default-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-default-base-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-default-devel-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-ec2-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-ec2-base-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-ec2-devel-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-source-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-syms-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-trace-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-trace-base-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-trace-devel-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-xen-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-xen-base-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-xen-devel-3.0.101-108.141.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20232506-1/ https://www.suse.com/security/cve/CVE-2023-23559.html CVE-2023-23559 https://bugzilla.suse.com/1207051 SUSE Bug 1207051 A NULL pointer dereference flaw was found in the az6027 driver in drivers/media/usb/dev-usb/az6027.c in the Linux Kernel. The message from user space is not checked properly before transferring into the device. This flaw allows a local user to crash the system or potentially cause a denial of service. CVE-2023-28328 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-default-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-default-base-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-default-devel-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-ec2-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-ec2-base-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-ec2-devel-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-source-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-syms-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-trace-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-trace-base-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-trace-devel-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-xen-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-xen-base-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-xen-devel-3.0.101-108.141.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20232506-1/ https://www.suse.com/security/cve/CVE-2023-28328.html CVE-2023-28328 https://bugzilla.suse.com/1209291 SUSE Bug 1209291 An issue was discovered in the Linux kernel before 6.1.11. In net/netrom/af_netrom.c, there is a use-after-free because accept is also allowed for a successfully connected AF_NETROM socket. However, in order for an attacker to exploit this, the system must have netrom routing configured or the attacker must have the CAP_NET_ADMIN capability. CVE-2023-32269 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-default-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-default-base-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-default-devel-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-ec2-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-ec2-base-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-ec2-devel-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-source-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-syms-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-trace-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-trace-base-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-trace-devel-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-xen-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-xen-base-3.0.101-108.141.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-xen-devel-3.0.101-108.141.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20232506-1/ https://www.suse.com/security/cve/CVE-2023-32269.html CVE-2023-32269 https://bugzilla.suse.com/1211186 SUSE Bug 1211186