Security update for the Linux Kernel (Live Patch 0 for SLE 15 SP5) SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2024:0395-1 Final 1 1 2024-02-07T04:33:33Z current 2024-02-07T04:33:33Z 2024-02-07T04:33:33Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for the Linux Kernel (Live Patch 0 for SLE 15 SP5) This update for the Linux Kernel 5.14.21-150500_53 fixes several issues. The following security issues were fixed: - CVE-2023-6932: Fixed a use-after-free vulnerability in the ipv4 igmp component that could lead to local privilege escalation (bsc#1218255). - CVE-2023-6176: Fixed a denial of service in the cryptographic algorithm scatterwalk functionality (bsc#1217522). - CVE-2023-5178: Fixed a use-after-free vulnerability in queue intialization setup (bsc#1215768). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2024-395,SUSE-2024-396,SUSE-2024-397,SUSE-2024-402,SUSE-2024-403,SUSE-2024-405,SUSE-SLE-Module-Live-Patching-15-SP4-2024-398,SUSE-SLE-Module-Live-Patching-15-SP5-2024-402 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2024/suse-su-20240395-1/ Link for SUSE-SU-2024:0395-1 https://lists.suse.com/pipermail/sle-security-updates/2024-February/017877.html E-Mail link for SUSE-SU-2024:0395-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1216044 SUSE Bug 1216044 https://bugzilla.suse.com/1217522 SUSE Bug 1217522 https://bugzilla.suse.com/1218255 SUSE Bug 1218255 https://www.suse.com/security/cve/CVE-2023-5178/ SUSE CVE CVE-2023-5178 page https://www.suse.com/security/cve/CVE-2023-6176/ SUSE CVE CVE-2023-6176 page https://www.suse.com/security/cve/CVE-2023-6932/ SUSE CVE CVE-2023-6932 page SUSE Linux Enterprise Live Patching 15 SP4 SUSE Linux Enterprise Live Patching 15 SP5 kernel-livepatch-5_14_21-150400_24_60-default-9-150400.2.1 kernel-livepatch-5_14_21-150400_24_63-default-9-150400.2.1 kernel-livepatch-5_14_21-150400_24_69-default-6-150400.2.1 kernel-livepatch-5_14_21-150500_53-default-7-150500.3.1 kernel-livepatch-5_14_21-150500_55_12-default-6-150500.2.1 kernel-livepatch-5_14_21-150500_55_31-default-3-150500.2.1 kernel-livepatch-5_14_21-150400_24_74-default-6-150400.2.1 kernel-livepatch-5_14_21-150400_24_74-default-6-150400.2.1 as a component of SUSE Linux Enterprise Live Patching 15 SP4 kernel-livepatch-5_14_21-150500_53-default-7-150500.3.1 as a component of SUSE Linux Enterprise Live Patching 15 SP5 A use-after-free vulnerability was found in drivers/nvme/target/tcp.c` in `nvmet_tcp_free_crypto` due to a logical bug in the NVMe/TCP subsystem in the Linux kernel. This issue may allow a malicious user to cause a use-after-free and double-free problem, which may permit remote code execution or lead to local privilege escalation. CVE-2023-5178 SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_74-default-6-150400.2.1 SUSE Linux Enterprise Live Patching 15 SP5:kernel-livepatch-5_14_21-150500_53-default-7-150500.3.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20240395-1/ https://www.suse.com/security/cve/CVE-2023-5178.html CVE-2023-5178 https://bugzilla.suse.com/1215768 SUSE Bug 1215768 https://bugzilla.suse.com/1216044 SUSE Bug 1216044 A null pointer dereference flaw was found in the Linux kernel API for the cryptographic algorithm scatterwalk functionality. This issue occurs when a user constructs a malicious packet with specific socket configuration, which could allow a local user to crash the system or escalate their privileges on the system. CVE-2023-6176 SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_74-default-6-150400.2.1 SUSE Linux Enterprise Live Patching 15 SP5:kernel-livepatch-5_14_21-150500_53-default-7-150500.3.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20240395-1/ https://www.suse.com/security/cve/CVE-2023-6176.html CVE-2023-6176 https://bugzilla.suse.com/1217332 SUSE Bug 1217332 https://bugzilla.suse.com/1217522 SUSE Bug 1217522 A use-after-free vulnerability in the Linux kernel's ipv4: igmp component can be exploited to achieve local privilege escalation. A race condition can be exploited to cause a timer be mistakenly registered on a RCU read locked object which is freed by another thread. We recommend upgrading past commit e2b706c691905fe78468c361aaabc719d0a496f1. CVE-2023-6932 SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_24_74-default-6-150400.2.1 SUSE Linux Enterprise Live Patching 15 SP5:kernel-livepatch-5_14_21-150500_53-default-7-150500.3.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20240395-1/ https://www.suse.com/security/cve/CVE-2023-6932.html CVE-2023-6932 https://bugzilla.suse.com/1218253 SUSE Bug 1218253 https://bugzilla.suse.com/1218255 SUSE Bug 1218255 https://bugzilla.suse.com/1220015 SUSE Bug 1220015 https://bugzilla.suse.com/1220191 SUSE Bug 1220191 https://bugzilla.suse.com/1221578 SUSE Bug 1221578 https://bugzilla.suse.com/1221598 SUSE Bug 1221598