SUSE-SU-2023:4349-1: important: Security update for the Linux Kernel

sle-updates at lists.suse.com sle-updates at lists.suse.com
Thu Nov 2 16:30:06 UTC 2023 


# Security update for the Linux Kernel

Announcement ID: SUSE-SU-2023:4349-1  
Rating: important  
References:

  * bsc#1206010
  * bsc#1208788
  * bsc#1210778
  * bsc#1213705
  * bsc#1213950
  * bsc#1213977
  * bsc#1215743
  * bsc#1215745
  * bsc#1216046
  * bsc#1216051
  * bsc#1216107
  * bsc#1216140
  * bsc#1216340
  * bsc#1216513
  * bsc#1216514

  
Cross-References:

  * CVE-2023-31085
  * CVE-2023-34324
  * CVE-2023-39189
  * CVE-2023-45862

  
CVSS scores:

  * CVE-2023-31085 ( SUSE ):  5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  * CVE-2023-31085 ( NVD ):  5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  * CVE-2023-34324 ( SUSE ):  5.7 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  * CVE-2023-39189 ( SUSE ):  4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
  * CVE-2023-39189 ( NVD ):  5.1 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L
  * CVE-2023-45862 ( SUSE ):  6.4 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
  * CVE-2023-45862 ( NVD ):  7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

  
Affected Products:

  * SUSE Linux Enterprise High Availability Extension 12 SP5
  * SUSE Linux Enterprise High Performance Computing 12 SP5
  * SUSE Linux Enterprise Live Patching 12-SP5
  * SUSE Linux Enterprise Server 12 SP5
  * SUSE Linux Enterprise Server for SAP Applications 12 SP5
  * SUSE Linux Enterprise Software Development Kit 12 SP5
  * SUSE Linux Enterprise Workstation Extension 12 12-SP5

  
  
An update that solves four vulnerabilities and has 11 security fixes can now be
installed.

## Description:

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security
and bugfixes.

The following security bugs were fixed:

  * CVE-2023-31085: Fixed a divide-by-zero error in do_div(sz,mtd->erasesize)
    that could cause a local DoS. (bsc#1210778)
  * CVE-2023-45862: Fixed an issue in the ENE UB6250 reader driver whwere an
    object could potentially extend beyond the end of an allocation causing.
    (bsc#1216051)
  * CVE-2023-34324: Fixed a possible deadlock in Linux kernel event handling.
    (bsc#1215745).
  * CVE-2023-39189: Fixed a flaw in the Netfilter subsystem that could allow a
    local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read,
    leading to a crash or information disclosure. (bsc#1216046)

The following non-security bugs were fixed:

  * 9p: virtio: make sure 'offs' is initialized in zc_request (git-fixes).
  * audit: fix potential double free on error path from fsnotify_add_inode_mark
    (git-fixes).
  * CKC: Clarify usage
  * crypto: virtio: Fix use-after-free in virtio_crypto_skcipher_finalize_req()
    (git-fixes).
  * iommu/amd: Fix IOMMU interrupt generation in X2APIC mode (bsc#1206010).
  * iommu/amd: Remove useless irq affinity notifier (bsc#1206010).
  * iommu/amd: Set iommu->int_enabled consistently when interrupts are set up
    (bsc#1206010).
  * kabi: iommu/amd: Fix IOMMU interrupt generation in X2APIC mode
    (bsc#1206010).
  * KVM: s390: fix sthyi error handling (git-fixes bsc#1216107).
  * memcg: drop kmem.limit_in_bytes (bsc#1208788)
  * mm, memcg: reconsider kmem.limit_in_bytes deprecation (bsc#1208788
    bsc#1213705).
  * net: usb: dm9601: fix uninitialized variable use in dm9601_mdio_read (git-
    fixes).
  * net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg (git-
    fixes).
  * ratelimit: Fix data-races in ___ratelimit() (git-fixes).
  * ring-buffer: Fix bytes info in per_cpu buffer stats (git-fixes).
  * s390/pci: fix iommu bitmap allocation (git-fixes bsc#1216513).
  * s390/ptrace: fix setting syscall number (git-fixes bsc#1216340).
  * s390/vdso: add missing FORCE to build targets (git-fixes bsc#1216140).
  * s390/zcrypt: change reply buffer size offering (LTC#203322 bsc#1213950).
  * s390/zcrypt: fix reply buffer calculations for CCA replies (LTC#203322
    bsc#1213950).
  * sched: Avoid scale real weight down to zero (git fixes (sched)).
  * sched: correct SD_flags returned by tl->sd_flags() (git fixes (sched)).
  * sched: Reenable interrupts in do_sched_yield() (git fixes (sched)).
  * sched/core: Fix migration to invalid CPU in __set_cpus_allowed_ptr() (git
    fixes (sched)).
  * sched/core: Mitigate race cpus_share_cache()/update_top_cache_domain() (git
    fixes (sched)).
  * sched/fair: Do not balance task to its current running CPU (git fixes
    (sched)).
  * sched/rt: Minimize rq->lock contention in do_sched_rt_period_timer() (git
    fixes (sched)).
  * sched/rt: Restore rt_runtime after disabling RT_RUNTIME_SHARE (git fixes
    (sched)).
  * scsi: zfcp: Defer fc_rport blocking until after ADISC response (LTC#203327
    bsc#1213977 git-fixes).
  * scsi: zfcp: Fix a double put in zfcp_port_enqueue() (git-fixes bsc#1216514).
  * tools/thermal: Fix possible path truncations (git-fixes).
  * tracing: Fix cpu buffers unavailable due to 'record_disabled' missed (git-
    fixes).
  * tracing: Fix memleak due to race between current_tracer and trace (git-
    fixes).
  * tracing: Fix race issue between cpu buffer write and swap (git-fixes).
  * uas: Add US_FL_NO_REPORT_OPCODES for JMicron JMS583Gen 2 (git-fixes).
  * usb: serial: cp210x: add Silicon Labs IFS-USB-DATACABLE IDs (git-fixes).
  * usb: typec: altmodes/displayport: Fix configure initial pin assignment (git-
    fixes).
  * usb: typec: altmodes/displayport: fix pin_assignment_show (git-fixes).
  * use optional first argument as a base-ref instead of upstream branch
  * vhost-scsi: unbreak any layout for response (git-fixes).
  * virtio_balloon: fix deadlock on OOM (git-fixes).
  * virtio_balloon: fix increment of vb->num_pfns in fill_balloon() (git-fixes).
  * virtio_net: Fix error unwinding of XDP initialization (git-fixes).
  * virtio: Protect vqs list access (git-fixes).
  * vsock/virtio: add transport parameter to the
    virtio_transport_reset_no_sock() (git-fixes).
  * xen-netback: use default TX queue size for vifs (git-fixes).
  * xen/x86: obtain full video frame buffer address for Dom0 also under EFI
    (bsc#1215743).
  * xen/x86: obtain upper 32 bits of video frame buffer address for Dom0
    (bsc#1215743).

## Special Instructions and Notes:

  * Please reboot the system after installing this update.

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".  
Alternatively you can run the command listed for your product:

  * SUSE Linux Enterprise Server for SAP Applications 12 SP5  
    zypper in -t patch SUSE-SLE-HA-12-SP5-2023-4349=1 SUSE-SLE-
SERVER-12-SP5-2023-4349=1

  * SUSE Linux Enterprise High Availability Extension 12 SP5  
    zypper in -t patch SUSE-SLE-HA-12-SP5-2023-4349=1

  * SUSE Linux Enterprise Live Patching 12-SP5  
    zypper in -t patch SUSE-SLE-Live-Patching-12-SP5-2023-4349=1

  * SUSE Linux Enterprise Software Development Kit 12 SP5  
    zypper in -t patch SUSE-SLE-SDK-12-SP5-2023-4349=1

  * SUSE Linux Enterprise High Performance Computing 12 SP5  
    zypper in -t patch SUSE-SLE-SERVER-12-SP5-2023-4349=1

  * SUSE Linux Enterprise Server 12 SP5  
    zypper in -t patch SUSE-SLE-SERVER-12-SP5-2023-4349=1

  * SUSE Linux Enterprise Workstation Extension 12 12-SP5  
    zypper in -t patch SUSE-SLE-WE-12-SP5-2023-4349=1

## Package List:

  * SUSE Linux Enterprise Server for SAP Applications 12 SP5 (ppc64le x86_64)
    * kernel-default-base-4.12.14-122.183.1
    * kernel-default-debuginfo-4.12.14-122.183.1
    * dlm-kmp-default-4.12.14-122.183.1
    * kernel-default-devel-4.12.14-122.183.1
    * cluster-md-kmp-default-debuginfo-4.12.14-122.183.1
    * dlm-kmp-default-debuginfo-4.12.14-122.183.1
    * gfs2-kmp-default-4.12.14-122.183.1
    * kernel-default-base-debuginfo-4.12.14-122.183.1
    * kernel-default-debugsource-4.12.14-122.183.1
    * ocfs2-kmp-default-4.12.14-122.183.1
    * cluster-md-kmp-default-4.12.14-122.183.1
    * gfs2-kmp-default-debuginfo-4.12.14-122.183.1
    * kernel-syms-4.12.14-122.183.1
    * ocfs2-kmp-default-debuginfo-4.12.14-122.183.1
  * SUSE Linux Enterprise Server for SAP Applications 12 SP5 (nosrc ppc64le
    x86_64)
    * kernel-default-4.12.14-122.183.1
  * SUSE Linux Enterprise Server for SAP Applications 12 SP5 (noarch)
    * kernel-source-4.12.14-122.183.1
    * kernel-devel-4.12.14-122.183.1
    * kernel-macros-4.12.14-122.183.1
  * SUSE Linux Enterprise Server for SAP Applications 12 SP5 (x86_64)
    * kernel-default-devel-debuginfo-4.12.14-122.183.1
  * SUSE Linux Enterprise High Availability Extension 12 SP5 (ppc64le s390x
    x86_64)
    * kernel-default-debuginfo-4.12.14-122.183.1
    * dlm-kmp-default-4.12.14-122.183.1
    * cluster-md-kmp-default-debuginfo-4.12.14-122.183.1
    * dlm-kmp-default-debuginfo-4.12.14-122.183.1
    * gfs2-kmp-default-4.12.14-122.183.1
    * kernel-default-debugsource-4.12.14-122.183.1
    * ocfs2-kmp-default-4.12.14-122.183.1
    * cluster-md-kmp-default-4.12.14-122.183.1
    * gfs2-kmp-default-debuginfo-4.12.14-122.183.1
    * ocfs2-kmp-default-debuginfo-4.12.14-122.183.1
  * SUSE Linux Enterprise High Availability Extension 12 SP5 (nosrc)
    * kernel-default-4.12.14-122.183.1
  * SUSE Linux Enterprise Live Patching 12-SP5 (nosrc)
    * kernel-default-4.12.14-122.183.1
  * SUSE Linux Enterprise Live Patching 12-SP5 (ppc64le s390x x86_64)
    * kernel-default-kgraft-devel-4.12.14-122.183.1
    * kernel-default-debuginfo-4.12.14-122.183.1
    * kernel-default-kgraft-4.12.14-122.183.1
    * kgraft-patch-4_12_14-122_183-default-1-8.3.1
    * kernel-default-debugsource-4.12.14-122.183.1
  * SUSE Linux Enterprise Software Development Kit 12 SP5 (noarch nosrc)
    * kernel-docs-4.12.14-122.183.1
  * SUSE Linux Enterprise Software Development Kit 12 SP5 (aarch64 ppc64le s390x
    x86_64)
    * kernel-obs-build-4.12.14-122.183.1
    * kernel-obs-build-debugsource-4.12.14-122.183.1
  * SUSE Linux Enterprise High Performance Computing 12 SP5 (aarch64 nosrc
    x86_64)
    * kernel-default-4.12.14-122.183.1
  * SUSE Linux Enterprise High Performance Computing 12 SP5 (aarch64 x86_64)
    * kernel-default-base-4.12.14-122.183.1
    * kernel-default-debuginfo-4.12.14-122.183.1
    * kernel-default-devel-4.12.14-122.183.1
    * kernel-default-base-debuginfo-4.12.14-122.183.1
    * kernel-default-debugsource-4.12.14-122.183.1
    * kernel-syms-4.12.14-122.183.1
  * SUSE Linux Enterprise High Performance Computing 12 SP5 (noarch)
    * kernel-source-4.12.14-122.183.1
    * kernel-devel-4.12.14-122.183.1
    * kernel-macros-4.12.14-122.183.1
  * SUSE Linux Enterprise High Performance Computing 12 SP5 (x86_64)
    * kernel-default-devel-debuginfo-4.12.14-122.183.1
  * SUSE Linux Enterprise Server 12 SP5 (aarch64 ppc64le s390x x86_64 nosrc)
    * kernel-default-4.12.14-122.183.1
  * SUSE Linux Enterprise Server 12 SP5 (aarch64 ppc64le s390x x86_64)
    * kernel-default-base-4.12.14-122.183.1
    * kernel-default-debuginfo-4.12.14-122.183.1
    * kernel-default-devel-4.12.14-122.183.1
    * kernel-default-base-debuginfo-4.12.14-122.183.1
    * kernel-default-debugsource-4.12.14-122.183.1
    * kernel-syms-4.12.14-122.183.1
  * SUSE Linux Enterprise Server 12 SP5 (noarch)
    * kernel-source-4.12.14-122.183.1
    * kernel-devel-4.12.14-122.183.1
    * kernel-macros-4.12.14-122.183.1
  * SUSE Linux Enterprise Server 12 SP5 (s390x)
    * kernel-default-man-4.12.14-122.183.1
  * SUSE Linux Enterprise Server 12 SP5 (x86_64)
    * kernel-default-devel-debuginfo-4.12.14-122.183.1
  * SUSE Linux Enterprise Workstation Extension 12 12-SP5 (nosrc)
    * kernel-default-4.12.14-122.183.1
  * SUSE Linux Enterprise Workstation Extension 12 12-SP5 (x86_64)
    * kernel-default-extra-debuginfo-4.12.14-122.183.1
    * kernel-default-extra-4.12.14-122.183.1
    * kernel-default-debugsource-4.12.14-122.183.1
    * kernel-default-debuginfo-4.12.14-122.183.1

## References:

  * https://www.suse.com/security/cve/CVE-2023-31085.html
  * https://www.suse.com/security/cve/CVE-2023-34324.html
  * https://www.suse.com/security/cve/CVE-2023-39189.html
  * https://www.suse.com/security/cve/CVE-2023-45862.html
  * https://bugzilla.suse.com/show_bug.cgi?id=1206010
  * https://bugzilla.suse.com/show_bug.cgi?id=1208788
  * https://bugzilla.suse.com/show_bug.cgi?id=1210778
  * https://bugzilla.suse.com/show_bug.cgi?id=1213705
  * https://bugzilla.suse.com/show_bug.cgi?id=1213950
  * https://bugzilla.suse.com/show_bug.cgi?id=1213977
  * https://bugzilla.suse.com/show_bug.cgi?id=1215743
  * https://bugzilla.suse.com/show_bug.cgi?id=1215745
  * https://bugzilla.suse.com/show_bug.cgi?id=1216046
  * https://bugzilla.suse.com/show_bug.cgi?id=1216051
  * https://bugzilla.suse.com/show_bug.cgi?id=1216107
  * https://bugzilla.suse.com/show_bug.cgi?id=1216140
  * https://bugzilla.suse.com/show_bug.cgi?id=1216340
  * https://bugzilla.suse.com/show_bug.cgi?id=1216513
  * https://bugzilla.suse.com/show_bug.cgi?id=1216514

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.suse.com/pipermail/sle-updates/attachments/20231102/52e7777c/attachment.htm>

More information about the sle-updates mailing list