SUSE-SU-2023:4882-1: Security update for the Linux Kernel
The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: CVE-2023-0461: Fixed use-after-free in icskulpdata (bsc#1208787). CVE-2023-39197: Fixed a out-of-bounds read in nfconntrackdccppacket() (bsc#1216976). CVE-2023-45863: Fixed a out-of-bounds write in fillkobjpath() (bsc#1216058). CVE-2023-5717: Fixed a heap out-of-bounds write vulnerability in the Performance Events component (bsc#1216584). CVE-2023-45871: Fixed an issue in the IGB driver, where the buffer size may not be adequate for frames larger than the MTU (bsc#1216259). CVE-2023-39198: Fixed a race condition leading to use-after-free in qxlmodedumbcreate() (bsc#1216965). CVE-2023-31083: Fixed race condition in hciuartttyioctl (bsc#1210780).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
suse/kernel-debugto a version that resolves this vulnerability.Fixed in 4.12.14-150100.197.165.1 - Upgrade
Upgrade
suse/kernel-kvmsmallto a version that resolves this vulnerability.Fixed in 4.12.14-150100.197.165.1 - Upgrade
Upgrade
suse/kernel-defaultto a version that resolves this vulnerability.Fixed in 4.12.14-150100.197.165.1 - Upgrade
Upgrade
suse/kernel-zfcpdumpto a version that resolves this vulnerability.Fixed in 4.12.14-150100.197.165.1 - Upgrade
Upgrade
suse/kernel-debug-baseto a version that resolves this vulnerability.Fixed in 4.12.14-150100.197.165.1 - Upgrade
Upgrade
suse/kernel-debug-base-debuginfoto a version that resolves this vulnerability.Fixed in 4.12.14-150100.197.165.1 - Upgrade
Upgrade
suse/kernel-default-base-debuginfoto a version that resolves this vulnerability.Fixed in 4.12.14-150100.197.165.1 - Upgrade
Upgrade
suse/kernel-kvmsmall-base-debuginfoto a version that resolves this vulnerability.Fixed in 4.12.14-150100.197.165.1 - Upgrade
Upgrade
suse/kernel-kvmsmall-baseto a version that resolves this vulnerability.Fixed in 4.12.14-150100.197.165.1 - Upgrade
Upgrade
suse/kernel-default-manto a version that resolves this vulnerability.Fixed in 4.12.14-150100.197.165.1 - Upgrade
Upgrade
suse/kernel-zfcpdump-manto a version that resolves this vulnerability.Fixed in 4.12.14-150100.197.165.1 - Upgrade
Upgrade
suse/kernel-default-livepatch-develto a version that resolves this vulnerability.Fixed in 4.12.14-150100.197.165.1 - Upgrade
Upgrade
suse/kernel-livepatchto a version that resolves this vulnerability.Fixed in 4_12_14-150100_197_165-default-1-150100.3.5.1 - Upgrade
Upgrade
suse/kernel-default-debuginfoto a version that resolves this vulnerability.Fixed in 4.12.14-150100.197.165.1 - Upgrade
Upgrade
suse/kernel-default-debugsourceto a version that resolves this vulnerability.Fixed in 4.12.14-150100.197.165.1 - Upgrade
Upgrade
suse/kernel-default-livepatchto a version that resolves this vulnerability.Fixed in 4.12.14-150100.197.165.1 - Upgrade
Upgrade
suse/ocfs2-kmp-defaultto a version that resolves this vulnerability.Fixed in 4.12.14-150100.197.165.1 - Upgrade
Upgrade
suse/ocfs2-kmp-default-debuginfoto a version that resolves this vulnerability.Fixed in 4.12.14-150100.197.165.1 - Upgrade
Upgrade
suse/gfs2-kmp-default-debuginfoto a version that resolves this vulnerability.Fixed in 4.12.14-150100.197.165.1 - Upgrade
Upgrade
suse/gfs2-kmp-defaultto a version that resolves this vulnerability.Fixed in 4.12.14-150100.197.165.1 - Upgrade
Upgrade
suse/cluster-md-kmp-defaultto a version that resolves this vulnerability.Fixed in 4.12.14-150100.197.165.1 - Upgrade
Upgrade
suse/dlm-kmp-defaultto a version that resolves this vulnerability.Fixed in 4.12.14-150100.197.165.1 - Upgrade
Upgrade
suse/dlm-kmp-default-debuginfoto a version that resolves this vulnerability.Fixed in 4.12.14-150100.197.165.1 - Upgrade
Upgrade
suse/cluster-md-kmp-default-debuginfoto a version that resolves this vulnerability.Fixed in 4.12.14-150100.197.165.1 - Upgrade
Upgrade
suse/kernel-symsto a version that resolves this vulnerability.Fixed in 4.12.14-150100.197.165.1 - Upgrade
Upgrade
suse/kernel-obs-build-debugsourceto a version that resolves this vulnerability.Fixed in 4.12.14-150100.197.165.1 - Upgrade
Upgrade
suse/kernel-default-devel-debuginfoto a version that resolves this vulnerability.Fixed in 4.12.14-150100.197.165.1 - Upgrade
Upgrade
suse/kernel-default-baseto a version that resolves this vulnerability.Fixed in 4.12.14-150100.197.165.1 - Upgrade
Upgrade
suse/kernel-default-develto a version that resolves this vulnerability.Fixed in 4.12.14-150100.197.165.1 - Upgrade
Upgrade
suse/kernel-obs-buildto a version that resolves this vulnerability.Fixed in 4.12.14-150100.197.165.1 - Upgrade
Upgrade
suse/kernel-develto a version that resolves this vulnerability.Fixed in 4.12.14-150100.197.165.1 - Upgrade
Upgrade
suse/kernel-macrosto a version that resolves this vulnerability.Fixed in 4.12.14-150100.197.165.1 - Upgrade
Upgrade
suse/kernel-sourceto a version that resolves this vulnerability.Fixed in 4.12.14-150100.197.165.1 - Upgrade
Upgrade
suse/kernel-docsto a version that resolves this vulnerability.Fixed in 4.12.14-150100.197.165.1 - Upgrade
Upgrade
suse/reiserfs-kmp-default-debuginfoto a version that resolves this vulnerability.Fixed in 4.12.14-150100.197.165.1 - Upgrade
Upgrade
suse/reiserfs-kmp-defaultto a version that resolves this vulnerability.Fixed in 4.12.14-150100.197.165.1 - Upgrade
Upgrade
suse/kernel-zfcpdump-debugsourceto a version that resolves this vulnerability.Fixed in 4.12.14-150100.197.165.1 - Upgrade
Upgrade
suse/kernel-zfcpdump-debuginfoto a version that resolves this vulnerability.Fixed in 4.12.14-150100.197.165.1 - Upgrade
Upgrade
SUSE Linux Enterprise High Availability Extension 15 SP1to a version that resolves this vulnerability.Patch SUSE-SLE-Product-HA-15-SP1-2023-4882=1 - Upgrade
Upgrade
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1to a version that resolves this vulnerability.Patch SUSE-SLE-Product-HPC-15-SP1-LTSS-2023-4882=1 - Upgrade
Upgrade
SUSE Linux Enterprise Live Patching 15-SP1to a version that resolves this vulnerability.Patch SUSE-SLE-Module-Live-Patching-15-SP1-2023-4882=1 - Upgrade
Upgrade
SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1to a version that resolves this vulnerability.Patch SUSE-SLE-Product-SLES-15-SP1-LTSS-2023-4882=1 - Upgrade
Upgrade
SUSE Linux Enterprise Server for SAP Applications 15 SP1to a version that resolves this vulnerability.Patch SUSE-SLE-Product-SLES_SAP-15-SP1-2023-4882=1 - Upgrade
Upgrade
openSUSE Leap 15.4to a version that resolves this vulnerability.Patch openSUSE-SLE-15.4-2023-4882=1
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which systems are in scope for this update?
The update applies to SUSE Linux Enterprise 15 SP1 systems using the affected kernel package set, including kernel-default, kernel-default-base, kernel-syms, and the listed debug, debuginfo, devel, and build-debugsource packages.
Which kernel subsystems are implicated and may warrant prioritization?
The fixed issues involve TCP-related icsk_ulp_data handling, DCCP connection tracking, Performance Events, the IGB network driver, QXL graphics handling, and Bluetooth HCI UART ioctl handling. Systems using these subsystems may warrant particular review.
What remediation details are available?
SUSE issued a security update for the Linux Kernel on 2023-12-15. The provided advisory data does not include the specific fixed package version or temporary mitigations.