Security update for the Linux Kernel SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2023:4028-1 Final 1 1 2023-10-10T12:06:24Z current 2023-10-10T12:06:24Z 2023-10-10T12:06:24Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for the Linux Kernel The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2023-1077: Fixed a type confusion in pick_next_rt_entity() that could cause memory corruption (bsc#1208600). - CVE-2023-4623: Fixed a use-after-free issue in the HFSC network scheduler which could be exploited to achieve local privilege escalation (bsc#1215115). - CVE-2023-1192: Fixed use-after-free in cifs_demultiplex_thread() (bsc#1208995). - CVE-2023-20588: Fixed a potential data leak that could be triggered through a side channel when division by zero occurred on some AMD processors (bsc#1213927). - CVE-2023-4459: Fixed a NULL pointer dereference flaw in the vmxnet3 driver that may have allowed a local attacker with user privileges to cause a denial of service (bsc#1214451). - CVE-2023-3772: Fixed a flaw in the XFRM subsystem that may have allowed a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer leading to denial of service (bsc#1213666). - CVE-2023-2007: Removed the dpt_i2o driver due to security issues (bsc#1210448, jsc#PED-4579). - CVE-2023-4385: Fixed a NULL pointer dereference flaw in dbFree that may have allowed a local attacker to crash the system due to a missing sanity check (bsc#1214348). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2023-4028,SUSE-SLE-SERVER-11-SP4-LTSS-EXTREME-CORE-2023-4028 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2023/suse-su-20234028-1/ Link for SUSE-SU-2023:4028-1 https://lists.suse.com/pipermail/sle-security-updates/2023-October/016622.html E-Mail link for SUSE-SU-2023:4028-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1208600 SUSE Bug 1208600 https://bugzilla.suse.com/1208995 SUSE Bug 1208995 https://bugzilla.suse.com/1210448 SUSE Bug 1210448 https://bugzilla.suse.com/1213666 SUSE Bug 1213666 https://bugzilla.suse.com/1213927 SUSE Bug 1213927 https://bugzilla.suse.com/1214348 SUSE Bug 1214348 https://bugzilla.suse.com/1214451 SUSE Bug 1214451 https://bugzilla.suse.com/1215115 SUSE Bug 1215115 https://www.suse.com/security/cve/CVE-2023-1077/ SUSE CVE CVE-2023-1077 page https://www.suse.com/security/cve/CVE-2023-1192/ SUSE CVE CVE-2023-1192 page https://www.suse.com/security/cve/CVE-2023-2007/ SUSE CVE CVE-2023-2007 page https://www.suse.com/security/cve/CVE-2023-20588/ SUSE CVE CVE-2023-20588 page https://www.suse.com/security/cve/CVE-2023-3772/ SUSE CVE CVE-2023-3772 page https://www.suse.com/security/cve/CVE-2023-4385/ SUSE CVE CVE-2023-4385 page https://www.suse.com/security/cve/CVE-2023-4459/ SUSE CVE CVE-2023-4459 page https://www.suse.com/security/cve/CVE-2023-4623/ SUSE CVE CVE-2023-4623 page SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE kernel-debug-3.0.101-108.147.1 kernel-debug-base-3.0.101-108.147.1 kernel-debug-devel-3.0.101-108.147.1 kernel-debug-extra-3.0.101-108.147.1 kernel-debug-hmac-3.0.101-108.147.1 kernel-default-3.0.101-108.147.1 kernel-default-base-3.0.101-108.147.1 kernel-default-devel-3.0.101-108.147.1 kernel-default-extra-3.0.101-108.147.1 kernel-default-hmac-3.0.101-108.147.1 kernel-docs-3.0.101-108.147.1 kernel-ec2-3.0.101-108.147.1 kernel-ec2-base-3.0.101-108.147.1 kernel-ec2-devel-3.0.101-108.147.1 kernel-ec2-extra-3.0.101-108.147.1 kernel-ec2-hmac-3.0.101-108.147.1 kernel-pae-3.0.101-108.147.1 kernel-pae-base-3.0.101-108.147.1 kernel-pae-devel-3.0.101-108.147.1 kernel-pae-extra-3.0.101-108.147.1 kernel-pae-hmac-3.0.101-108.147.1 kernel-source-3.0.101-108.147.1 kernel-source-vanilla-3.0.101-108.147.1 kernel-syms-3.0.101-108.147.1 kernel-trace-3.0.101-108.147.1 kernel-trace-base-3.0.101-108.147.1 kernel-trace-devel-3.0.101-108.147.1 kernel-trace-extra-3.0.101-108.147.1 kernel-trace-hmac-3.0.101-108.147.1 kernel-vanilla-3.0.101-108.147.1 kernel-vanilla-base-3.0.101-108.147.1 kernel-vanilla-devel-3.0.101-108.147.1 kernel-vanilla-hmac-3.0.101-108.147.1 kernel-xen-3.0.101-108.147.1 kernel-xen-base-3.0.101-108.147.1 kernel-xen-devel-3.0.101-108.147.1 kernel-xen-extra-3.0.101-108.147.1 kernel-xen-hmac-3.0.101-108.147.1 kernel-default-3.0.101-108.147.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE kernel-default-base-3.0.101-108.147.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE kernel-default-devel-3.0.101-108.147.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE kernel-ec2-3.0.101-108.147.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE kernel-ec2-base-3.0.101-108.147.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE kernel-ec2-devel-3.0.101-108.147.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE kernel-source-3.0.101-108.147.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE kernel-syms-3.0.101-108.147.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE kernel-trace-3.0.101-108.147.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE kernel-trace-base-3.0.101-108.147.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE kernel-trace-devel-3.0.101-108.147.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE kernel-xen-3.0.101-108.147.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE kernel-xen-base-3.0.101-108.147.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE kernel-xen-devel-3.0.101-108.147.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE In the Linux kernel, pick_next_rt_entity() may return a type confused entry, not detected by the BUG_ON condition, as the confused entry will not be NULL, but list_head.The buggy error condition would lead to a type confused entry with the list head,which would then be used as a type confused sched_rt_entity,causing memory corruption. CVE-2023-1077 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-default-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-default-base-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-default-devel-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-ec2-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-ec2-base-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-ec2-devel-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-source-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-syms-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-trace-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-trace-base-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-trace-devel-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-xen-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-xen-base-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-xen-devel-3.0.101-108.147.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20234028-1/ https://www.suse.com/security/cve/CVE-2023-1077.html CVE-2023-1077 https://bugzilla.suse.com/1208600 SUSE Bug 1208600 https://bugzilla.suse.com/1208839 SUSE Bug 1208839 https://bugzilla.suse.com/1213841 SUSE Bug 1213841 https://bugzilla.suse.com/1213842 SUSE Bug 1213842 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVE-2023-1192 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-default-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-default-base-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-default-devel-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-ec2-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-ec2-base-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-ec2-devel-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-source-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-syms-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-trace-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-trace-base-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-trace-devel-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-xen-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-xen-base-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-xen-devel-3.0.101-108.147.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20234028-1/ https://www.suse.com/security/cve/CVE-2023-1192.html CVE-2023-1192 https://bugzilla.suse.com/1208995 SUSE Bug 1208995 The specific flaw exists within the DPT I2O Controller driver. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute arbitrary code in the context of the kernel. CVE-2023-2007 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-default-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-default-base-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-default-devel-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-ec2-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-ec2-base-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-ec2-devel-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-source-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-syms-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-trace-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-trace-base-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-trace-devel-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-xen-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-xen-base-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-xen-devel-3.0.101-108.147.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20234028-1/ https://www.suse.com/security/cve/CVE-2023-2007.html CVE-2023-2007 https://bugzilla.suse.com/1210448 SUSE Bug 1210448 A division-by-zero error on some AMD processors can potentially return speculative data resulting in loss of confidentiality.  CVE-2023-20588 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-default-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-default-base-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-default-devel-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-ec2-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-ec2-base-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-ec2-devel-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-source-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-syms-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-trace-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-trace-base-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-trace-devel-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-xen-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-xen-base-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-xen-devel-3.0.101-108.147.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20234028-1/ https://www.suse.com/security/cve/CVE-2023-20588.html CVE-2023-20588 https://bugzilla.suse.com/1213927 SUSE Bug 1213927 A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem). This issue may allow a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer in xfrm_update_ae_params(), leading to a possible kernel crash and denial of service. CVE-2023-3772 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-default-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-default-base-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-default-devel-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-ec2-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-ec2-base-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-ec2-devel-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-source-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-syms-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-trace-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-trace-base-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-trace-devel-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-xen-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-xen-base-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-xen-devel-3.0.101-108.147.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20234028-1/ https://www.suse.com/security/cve/CVE-2023-3772.html CVE-2023-3772 https://bugzilla.suse.com/1213666 SUSE Bug 1213666 A NULL pointer dereference flaw was found in dbFree in fs/jfs/jfs_dmap.c in the journaling file system (JFS) in the Linux Kernel. This issue may allow a local attacker to crash the system due to a missing sanity check. CVE-2023-4385 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-default-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-default-base-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-default-devel-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-ec2-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-ec2-base-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-ec2-devel-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-source-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-syms-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-trace-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-trace-base-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-trace-devel-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-xen-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-xen-base-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-xen-devel-3.0.101-108.147.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20234028-1/ https://www.suse.com/security/cve/CVE-2023-4385.html CVE-2023-4385 https://bugzilla.suse.com/1214348 SUSE Bug 1214348 A NULL pointer dereference flaw was found in vmxnet3_rq_cleanup in drivers/net/vmxnet3/vmxnet3_drv.c in the networking sub-component in vmxnet3 in the Linux Kernel. This issue may allow a local attacker with normal user privilege to cause a denial of service due to a missing sanity check during cleanup. CVE-2023-4459 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-default-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-default-base-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-default-devel-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-ec2-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-ec2-base-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-ec2-devel-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-source-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-syms-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-trace-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-trace-base-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-trace-devel-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-xen-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-xen-base-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-xen-devel-3.0.101-108.147.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20234028-1/ https://www.suse.com/security/cve/CVE-2023-4459.html CVE-2023-4459 https://bugzilla.suse.com/1214451 SUSE Bug 1214451 A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control) component can be exploited to achieve local privilege escalation. If a class with a link-sharing curve (i.e. with the HFSC_FSC flag set) has a parent without a link-sharing curve, then init_vf() will call vttree_insert() on the parent, but vttree_remove() will be skipped in update_vf(). This leaves a dangling pointer that can cause a use-after-free. We recommend upgrading past commit b3d26c5702c7d6c45456326e56d2ccf3f103e60f. CVE-2023-4623 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-default-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-default-base-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-default-devel-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-ec2-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-ec2-base-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-ec2-devel-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-source-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-syms-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-trace-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-trace-base-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-trace-devel-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-xen-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-xen-base-3.0.101-108.147.1 SUSE Linux Enterprise Server 11 SP4-LTSS-EXTREME-CORE:kernel-xen-devel-3.0.101-108.147.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20234028-1/ https://www.suse.com/security/cve/CVE-2023-4623.html CVE-2023-4623 https://bugzilla.suse.com/1215115 SUSE Bug 1215115 https://bugzilla.suse.com/1215440 SUSE Bug 1215440