SUSE-SU-2023:2506-1: important: Security update for the Linux Kernel

sle-security-updates at lists.suse.com sle-security-updates at lists.suse.com
Wed Jun 14 08:30:23 UTC 2023



# Security update for the Linux Kernel

Announcement ID: SUSE-SU-2023:2506-1  
Rating: important  
References:

  * #1108488
  * #1204414
  * #1207036
  * #1207051
  * #1207125
  * #1207795
  * #1208837
  * #1209008
  * #1209256
  * #1209291
  * #1209532
  * #1209871
  * #1210336
  * #1210647
  * #1211186

  
Cross-References:

  * CVE-2017-5753
  * CVE-2018-9517
  * CVE-2022-3567
  * CVE-2023-0590
  * CVE-2023-1118
  * CVE-2023-1513
  * CVE-2023-1670
  * CVE-2023-1989
  * CVE-2023-2162
  * CVE-2023-23454
  * CVE-2023-23455
  * CVE-2023-23559
  * CVE-2023-28328
  * CVE-2023-32269

  
CVSS scores:

  * CVE-2017-5753 ( SUSE ):  5.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
  * CVE-2017-5753 ( SUSE ):  7.1 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
  * CVE-2017-5753 ( NVD ):  5.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
  * CVE-2017-5753 ( NVD ):  5.6 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
  * CVE-2018-9517 ( SUSE ):  2.5 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
  * CVE-2018-9517 ( NVD ):  6.7 CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
  * CVE-2022-3567 ( SUSE ):  5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
  * CVE-2022-3567 ( NVD ):  4.6 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
  * CVE-2023-0590 ( SUSE ):  7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
  * CVE-2023-0590 ( NVD ):  4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
  * CVE-2023-1118 ( SUSE ):  7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
  * CVE-2023-1118 ( NVD ):  7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  * CVE-2023-1513 ( SUSE ):  3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
  * CVE-2023-1513 ( NVD ):  3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
  * CVE-2023-1670 ( SUSE ):  4.4 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H
  * CVE-2023-1670 ( NVD ):  7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  * CVE-2023-1989 ( SUSE ):  7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  * CVE-2023-1989 ( NVD ):  7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
  * CVE-2023-2162 ( SUSE ):  7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
  * CVE-2023-2162 ( NVD ):  5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
  * CVE-2023-23454 ( SUSE ):  7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  * CVE-2023-23454 ( NVD ):  5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  * CVE-2023-23455 ( SUSE ):  7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  * CVE-2023-23455 ( NVD ):  5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  * CVE-2023-23559 ( SUSE ):  6.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
  * CVE-2023-23559 ( NVD ):  7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  * CVE-2023-28328 ( SUSE ):  5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  * CVE-2023-28328 ( NVD ):  5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  * CVE-2023-32269 ( SUSE ):  5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2023-32269 ( NVD ):  6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

  
Affected Products:

  * SUSE Linux Enterprise Server 11 SP4
  * SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME CORE 11-SP4

  
  
An update that solves 14 vulnerabilities and has one fix can now be installed.

## Description:

The SUSE Linux Enterprise 11 SP4 LTSS EXTREME CORE kernel was updated to receive
various security and bugfixes.

The following security bugs were fixed:

  * CVE-2023-2162: Fixed an use-after-free flaw in iscsi_sw_tcp_session_create
    (bsc#1210647).
  * CVE-2023-32269: Fixed a use-after-free in af_netrom.c, related to the fact
    that accept() was also allowed for a successfully connected AF_NETROM socket
    (bsc#1211186).
  * CVE-2023-1989: Fixed a use after free in btsdio_remove (bsc#1210336).
  * CVE-2017-5753: Fixed spectre vulnerability in prlimit (bsc#1209256).
  * CVE-2023-1670: Fixed a use after free in the Xircom 16-bit PCMCIA Ethernet
    driver. A local user could use this flaw to crash the system or potentially
    escalate their privileges on the system (bsc#1209871).
  * CVE-2023-1513: Fixed an uninitialized portions of the kvm_debugregs
    structure that could be copied to userspace, causing an information leak
    (bsc#1209532).
  * CVE-2023-28328: Fixed a denial of service issue in az6027 driver in
    drivers/media/usb/dev-usb/az6027.c (bsc#1209291).
  * CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
  * CVE-2018-9517: Fixed possible memory corruption due to a use after free in
    pppol2tp_connect (bsc#1108488).
  * CVE-2023-1118: Fixed a use-after-free bugs caused by ene_tx_irqsim() in
    media/rc (bsc#1208837).
  * CVE-2023-23559: Fixed integer overflow in rndis_wlan that leads to a buffer
    overflow (bsc#1207051).
  * CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler
    (bsc#1207036).
  * CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in
    net/sched/sch_atm.c because of type confusion (non-negative numbers can
    sometimes indicate a TC_ACT_SHOT condition rather than valid classification
    results) (bsc#1207125).
  * CVE-2022-3567: Fixed a to race condition in
    inet6_stream_ops()/inet6_dgram_ops() (bsc#1204414).

The following non-security bugs were fixed:

  * Do not sign the vanilla kernel (bsc#1209008).
  * do not fallthrough in cbq_classify and stop on TC_ACT_SHOT

## Special Instructions and Notes:

  * Please reboot the system after installing this update.

## Patch Instructions:

To install this SUSE Important update use the SUSE recommended installation
methods like YaST online_update or "zypper patch".  
Alternatively you can run the command listed for your product:

  * SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME CORE 11-SP4  
    zypper in -t patch SUSE-SLE-SERVER-11-SP4-LTSS-EXTREME-CORE-2023-2506=1

  * SUSE Linux Enterprise Server 11 SP4  
    zypper in -t patch SUSE-SLE-SERVER-11-SP4-LTSS-EXTREME-CORE-2023-2506=1

## Package List:

  * SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME CORE 11-SP4 (nosrc x86_64)
    * kernel-default-3.0.101-108.141.1
    * kernel-trace-3.0.101-108.141.1
    * kernel-xen-3.0.101-108.141.1
    * kernel-ec2-3.0.101-108.141.1
  * SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME CORE 11-SP4 (x86_64)
    * kernel-ec2-devel-3.0.101-108.141.1
    * kernel-trace-devel-3.0.101-108.141.1
    * kernel-xen-devel-3.0.101-108.141.1
    * kernel-syms-3.0.101-108.141.1
    * kernel-trace-base-3.0.101-108.141.1
    * kernel-xen-base-3.0.101-108.141.1
    * kernel-source-3.0.101-108.141.1
    * kernel-default-base-3.0.101-108.141.1
    * kernel-ec2-base-3.0.101-108.141.1
    * kernel-default-devel-3.0.101-108.141.1
  * SUSE Linux Enterprise Server 11 SP4 (nosrc x86_64)
    * kernel-default-3.0.101-108.141.1
    * kernel-trace-3.0.101-108.141.1
    * kernel-xen-3.0.101-108.141.1
    * kernel-ec2-3.0.101-108.141.1
  * SUSE Linux Enterprise Server 11 SP4 (x86_64)
    * kernel-ec2-devel-3.0.101-108.141.1
    * kernel-trace-devel-3.0.101-108.141.1
    * kernel-xen-devel-3.0.101-108.141.1
    * kernel-syms-3.0.101-108.141.1
    * kernel-trace-base-3.0.101-108.141.1
    * kernel-xen-base-3.0.101-108.141.1
    * kernel-source-3.0.101-108.141.1
    * kernel-default-base-3.0.101-108.141.1
    * kernel-ec2-base-3.0.101-108.141.1
    * kernel-default-devel-3.0.101-108.141.1

## References:

  * https://www.suse.com/security/cve/CVE-2017-5753.html
  * https://www.suse.com/security/cve/CVE-2018-9517.html
  * https://www.suse.com/security/cve/CVE-2022-3567.html
  * https://www.suse.com/security/cve/CVE-2023-0590.html
  * https://www.suse.com/security/cve/CVE-2023-1118.html
  * https://www.suse.com/security/cve/CVE-2023-1513.html
  * https://www.suse.com/security/cve/CVE-2023-1670.html
  * https://www.suse.com/security/cve/CVE-2023-1989.html
  * https://www.suse.com/security/cve/CVE-2023-2162.html
  * https://www.suse.com/security/cve/CVE-2023-23454.html
  * https://www.suse.com/security/cve/CVE-2023-23455.html
  * https://www.suse.com/security/cve/CVE-2023-23559.html
  * https://www.suse.com/security/cve/CVE-2023-28328.html
  * https://www.suse.com/security/cve/CVE-2023-32269.html
  * https://bugzilla.suse.com/show_bug.cgi?id=1108488
  * https://bugzilla.suse.com/show_bug.cgi?id=1204414
  * https://bugzilla.suse.com/show_bug.cgi?id=1207036
  * https://bugzilla.suse.com/show_bug.cgi?id=1207051
  * https://bugzilla.suse.com/show_bug.cgi?id=1207125
  * https://bugzilla.suse.com/show_bug.cgi?id=1207795
  * https://bugzilla.suse.com/show_bug.cgi?id=1208837
  * https://bugzilla.suse.com/show_bug.cgi?id=1209008
  * https://bugzilla.suse.com/show_bug.cgi?id=1209256
  * https://bugzilla.suse.com/show_bug.cgi?id=1209291
  * https://bugzilla.suse.com/show_bug.cgi?id=1209532
  * https://bugzilla.suse.com/show_bug.cgi?id=1209871
  * https://bugzilla.suse.com/show_bug.cgi?id=1210336
  * https://bugzilla.suse.com/show_bug.cgi?id=1210647
  * https://bugzilla.suse.com/show_bug.cgi?id=1211186

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.suse.com/pipermail/sle-security-updates/attachments/20230614/60488755/attachment.htm>


More information about the sle-security-updates mailing list