SUSE-SU-2024:0797-1: Security update for sudo

Q: Which systems are covered by this update?

The update applies to sudo packages on SUSE Linux Enterprise 12 SP5 editions: High Performance Computing, Server, Server for SAP Applications, and Software Development Kit. Listed architectures include aarch64, x86_64, ppc64le, and s390x, depending on the edition.

Q: What is the practical security purpose of this update?

It makes sudo less vulnerable to ROWHAMMER attacks associated with CVE-2023-42465. The provided information does not specify exploit prerequisites, affected configurations, or interim mitigations.

Published Mar 7, 2024

Updated

This update for sudo fixes the following issues: CVE-2023-42465: Try to make sudo less vulnerable to ROWHAMMER attacks (bsc#1219026).

Affected Software

16 affected componentsFixes available

All of the following

SUSE SUSE Linux Enterprise High Performance Computing 12 SP5 (aarch64 x86_64)

Any of the following

suse/sudo<1.8.27-4.45.1

1.8.27-4.45.1

suse/sudo-debugsource<1.8.27-4.45.1

1.8.27-4.45.1

suse/sudo-debuginfo<1.8.27-4.45.1

1.8.27-4.45.1

All of the following

SUSE SUSE Linux Enterprise Server 12 SP5 (aarch64 ppc64le s390x x86_64)

Any of the following

suse/sudo<1.8.27-4.45.1

1.8.27-4.45.1

suse/sudo-debugsource<1.8.27-4.45.1

1.8.27-4.45.1

suse/sudo-debuginfo<1.8.27-4.45.1

1.8.27-4.45.1

All of the following

SUSE SUSE Linux Enterprise Server for SAP Applications 12 SP5 (ppc64le x86_64)

Any of the following

suse/sudo<1.8.27-4.45.1

1.8.27-4.45.1

suse/sudo-debugsource<1.8.27-4.45.1

1.8.27-4.45.1

suse/sudo-debuginfo<1.8.27-4.45.1

1.8.27-4.45.1

All of the following

SUSE SUSE Linux Enterprise Software Development Kit 12 SP5 (aarch64 ppc64le s390x x86_64)

Any of the following

suse/sudo-devel<1.8.27-4.45.1

1.8.27-4.45.1

suse/sudo-debugsource<1.8.27-4.45.1

1.8.27-4.45.1

suse/sudo-debuginfo<1.8.27-4.45.1

1.8.27-4.45.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade suse/sudo to a version that resolves this vulnerability.
Fixed in 1.8.27-4.45.1
Upgrade
Upgrade suse/sudo-debugsource to a version that resolves this vulnerability.
Fixed in 1.8.27-4.45.1
Upgrade
Upgrade suse/sudo-debuginfo to a version that resolves this vulnerability.
Fixed in 1.8.27-4.45.1
Upgrade
Upgrade suse/sudo-devel to a version that resolves this vulnerability.
Fixed in 1.8.27-4.45.1
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-SDK-12-SP5-2024-797=1
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-SERVER-12-SP5-2024-797=1

Event History

Mar 7, 2024

Advisory Published

via SUSE·12:30 PM

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2023-42465

Frequently Asked Questions

Which systems are covered by this update?

The update applies to sudo packages on SUSE Linux Enterprise 12 SP5 editions: High Performance Computing, Server, Server for SAP Applications, and Software Development Kit. Listed architectures include aarch64, x86_64, ppc64le, and s390x, depending on the edition.

What is the practical security purpose of this update?

It makes sudo less vulnerable to ROWHAMMER attacks associated with CVE-2023-42465. The provided information does not specify exploit prerequisites, affected configurations, or interim mitigations.

SUSE-SU-2024:0797-1: Security update for sudo

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which systems are covered by this update?

What is the practical security purpose of this update?

Company

Resources

Contact

Frequently Asked Questions

Which systems are covered by this update?

What is the practical security purpose of this update?