SUSE-SU-2023:4136-1: Security update for suse-module-tools

Q: Which systems are covered by this update?

The update applies to SUSE openSUSE Leap 15.5, SUSE Linux Enterprise Micro 5.5, and the SUSE Basesystem Module 15-SP5 on the listed architectures. It affects installations using suse-module-tools or suse-module-tools-legacy.

Q: What kernel functionality is disabled by the update?

The update blacklists the Linux kernel tcindex classifier module for CVE-2023-1829 and the Linux kernel RNDIS modules for CVE-2023-23559. Blacklisting prevents these modules from being loaded.

Q: How can I determine whether the update has been applied?

Verify that suse-module-tools has been updated to version 15.5.3. The provided advisory does not include package release identifiers beyond that version.

Published Oct 19, 2023

Updated

This update for suse-module-tools fixes the following issues: Update to version 15.5.3:

CVE-2023-1829: Blacklisted the Linux kernel tcindex classifier module (bsc#1210335).

CVE-2023-23559: Blacklisted the Linux kernel RNDIS modules (bsc#1205767, jsc#PED-5731).

Affected Software

7 affected componentsFixes available

All of the following

SUSE openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64 i586)

Any of the following

suse/suse-module-tools<15.5.3-150500.3.6.1

15.5.3-150500.3.6.1

suse/suse-module-tools-legacy<15.5.3-150500.3.6.1

15.5.3-150500.3.6.1

All of the following

SUSE SUSE Linux Enterprise Micro 5.5 (aarch64 s390x x86_64)

suse/suse-module-tools<15.5.3-150500.3.6.1

15.5.3-150500.3.6.1

All of the following

SUSE Basesystem Module 15-SP5 (aarch64 ppc64le s390x x86_64)

suse/suse-module-tools<15.5.3-150500.3.6.1

15.5.3-150500.3.6.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade suse/suse-module-tools to a version that resolves this vulnerability.
Fixed in 15.5.3-150500.3.6.1
Upgrade
Upgrade suse/suse-module-tools-legacy to a version that resolves this vulnerability.
Fixed in 15.5.3-150500.3.6.1
Upgrade
Upgrade suse-module-tools to a version that resolves this vulnerability.
Fixed in 15.5.3
Upgrade
Upgrade openSUSE Leap 15.5 to a version that resolves this vulnerability.
Patch SUSE-2023-4136=1
Upgrade
Upgrade SUSE Linux Enterprise Micro 5.5 to a version that resolves this vulnerability.
Patch SUSE-SLE-Micro-5.5-2023-4136=1
Upgrade
Upgrade Basesystem Module 15-SP5 to a version that resolves this vulnerability.
Patch SUSE-SLE-Module-Basesystem-15-SP5-2023-4136=1

Event History

Oct 19, 2023

Advisory Published

04:30 PM

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

Which systems are covered by this update?

The update applies to SUSE openSUSE Leap 15.5, SUSE Linux Enterprise Micro 5.5, and the SUSE Basesystem Module 15-SP5 on the listed architectures. It affects installations using suse-module-tools or suse-module-tools-legacy.

What kernel functionality is disabled by the update?

The update blacklists the Linux kernel tcindex classifier module for CVE-2023-1829 and the Linux kernel RNDIS modules for CVE-2023-23559. Blacklisting prevents these modules from being loaded.

How can I determine whether the update has been applied?

Verify that suse-module-tools has been updated to version 15.5.3. The provided advisory does not include package release identifiers beyond that version.

SUSE-SU-2023:4136-1: Security update for suse-module-tools

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which systems are covered by this update?

What kernel functionality is disabled by the update?

How can I determine whether the update has been applied?

Company

Resources

Contact

Frequently Asked Questions

Which systems are covered by this update?

What kernel functionality is disabled by the update?

How can I determine whether the update has been applied?