Stay Vigilant with Timely Linux Security Advisories

security advisorydenial of servicekernel

Ubuntu 22.04 & 20.04 USN-6704-4 Moderate: Kernel Denial Of Service Risks

Several security issues were fixed in the Linux kernel.. ========================================================================== Ubuntu Security Notice USN-6704-4 March 28, 2024 linux-intel-iotg, linux-intel-iotg-5.15 vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS Summary: Several security issues were fixed in the Linux kernel. Software Description: - linux-intel-iotg: Linux kernel for Intel IoT platforms - linux-intel-iotg-5.15: Linux kernel for Intel IoT platforms Details: It was discovered that the NVIDIA Tegra XUSB pad controller driver in the Linux kernel did not properly handle return values in certain error conditions. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-23000) Quentin Minster discovered that the KSMBD implementation in the Linux kernel did not properly handle session setup requests. A remote attacker could possibly use this to cause a denial of service (memory exhaustion). (CVE-2023-32247) Lonial Con discovered that the netfilter subsystem in the Linux kernel did not properly handle element deactivation in certain cases, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-1085) Notselwyn discovered that the netfilter subsystem in the Linux kernel did not properly handle verdict parameters in certain cases, leading to a use- after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-1086) It was discovered that a race condition existed in the SCSI Emulex LightPulse Fibre Channel driver in the Linux kernel when unregistering FCF and re-scanning an HBA FCF table, leading to a null pointer dereference vulnerability. A local attacker could use thisto cause a denial of service (system crash). (CVE-2024-24855) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 22.04 LTS: linux-image-5.15.0-1051-intel-iotg 5.15.0-1051.57 linux-image-intel-iotg 5.15.0.1051.51 Ubuntu 20.04 LTS: linux-image-5.15.0-1051-intel-iotg 5.15.0-1051.57~20.04.1 linux-image-intel 5.15.0.1051.57~20.04.41 linux-image-intel-iotg 5.15.0.1051.57~20.04.41 After a standard system update you need to reboot your computer to make all the necessary changes. ATTENTION: Due to an unavoidable ABI change the kernel updates have been given a new version number, which requires you to recompile and reinstall all third party kernel modules you might have installed. Unless you manually uninstalled the standard kernel metapackages (e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual, linux-powerpc), a standard system upgrade will automatically perform this as well. References: https://ubuntu.com/security/notices/USN-6704-4 https://ubuntu.com/security/notices/USN-6704-1 CVE-2023-23000, CVE-2023-32247, CVE-2024-1085, CVE-2024-1086, CVE-2024-24855 Package Information: https://launchpad.net/ubuntu/+source/linux-intel-iotg/5.15.0-1051.57 . Attention Ubuntu 20.04 and 22.04 users: Several vulnerabilities have been found in the Linux kernel. Update your system promptly to protect against threats. Linux Kernel Security, Ubuntu Update, Denial of Service Risks. . LinuxSecurity.com Team

Mar 28, 2024 Ubuntu

security advisorydenial of serviceubuntu

Ubuntu 20.04 LTS USN-6681-4 Critical: Denial of Service Fixes

Several security issues were fixed in the Linux kernel.. ========================================================================== Ubuntu Security Notice USN-6681-4 March 19, 2024 linux-aws, linux-aws-5.4 vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS (Available with Ubuntu Pro) Summary: Several security issues were fixed in the Linux kernel. Software Description: - linux-aws: Linux kernel for Amazon Web Services (AWS) systems - linux-aws-5.4: Linux kernel for Amazon Web Services (AWS) systems Details: Wenqing Liu discovered that the f2fs file system implementation in the Linux kernel did not properly validate inode types while performing garbage collection. An attacker could use this to construct a malicious f2fs image that, when mounted and operated on, could cause a denial of service (system crash). (CVE-2021-44879) It was discovered that the DesignWare USB3 for Qualcomm SoCs driver in the Linux kernel did not properly handle certain error conditions during device registration. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2023-22995) Bien Pham discovered that the netfiler subsystem in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. A local user could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-4244) It was discovered that a race condition existed in the Bluetooth subsystem of the Linux kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-51779) It was discovered that a race condition existed in the ATM (Asynchronous Transfer Mode) subsystem of the Linux kernel, leading to a use-after-free vulnerability. A local attacker could use this to causea denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-51780) It was discovered that a race condition existed in the Rose X.25 protocol implementation in the Linux kernel, leading to a use-after- free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-51782) Alon Zahavi discovered that the NVMe-oF/TCP subsystem of the Linux kernel did not properly handle connect command payloads in certain situations, leading to an out-of-bounds read vulnerability. A remote attacker could use this to expose sensitive information (kernel memory). (CVE-2023-6121) It was discovered that the VirtIO subsystem in the Linux kernel did not properly initialize memory in some situations. A local attacker could use this to possibly expose sensitive information (kernel memory). (CVE-2024-0340) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 20.04 LTS: linux-image-5.4.0-1120-aws 5.4.0-1120.130 linux-image-aws-lts-20.04 5.4.0.1120.117 Ubuntu 18.04 LTS (Available with Ubuntu Pro): linux-image-5.4.0-1120-aws 5.4.0-1120.130~18.04.1 linux-image-aws 5.4.0.1120.98 After a standard system update you need to reboot your computer to make all the necessary changes. ATTENTION: Due to an unavoidable ABI change the kernel updates have been given a new version number, which requires you to recompile and reinstall all third party kernel modules you might have installed. Unless you manually uninstalled the standard kernel metapackages (e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual, linux-powerpc), a standard system upgrade will automatically perform this as well. References: https://ubuntu.com/security/notices/USN-6681-4 https://ubuntu.com/security/notices/USN-6681-1 CVE-2021-44879, CVE-2023-22995, CVE-2023-4244, CVE-2023-51779, CVE-2023-51780,CVE-2023-51782, CVE-2023-6121, CVE-2024-0340 Package Information: https://launchpad.net/ubuntu/+source/linux-aws/5.4.0-1120.130 . Ubuntu Security Bulletin USN-6681-4 highlights urgent kernel vulnerabilities, providing remedies for localized threats and system enhancements.. Kernel Security Updates, Local Attack Fixes, Linux Kernel Patches. . Severity: Critical. LinuxSecurity.com Team

Mar 19, 2024 •Critical Ubuntu

security advisorydenial of servicekernel update

SUSE 15 SP4: 2023:4072-1 Important Kernel Security Update

* #1202845 * #1213808 * #1214928 * #1214940 * #1214941 . # Security update for the Linux Kernel Announcement ID: SUSE-SU-2023:4072-1 Rating: important References: * #1202845 * #1213808 * #1214928 * #1214940 * #1214941 * #1214942 * #1214943 * #1214944 * #1214950 * #1214951 * #1214954 * #1214957 * #1214986 * #1214988 * #1214992 * #1214993 * #1215322 * #1215877 * #1215894 * #1215895 * #1215896 * #1215911 * #1215915 * #1215916 Cross-References: * CVE-2023-1192 * CVE-2023-1206 * CVE-2023-1859 * CVE-2023-2177 * CVE-2023-39192 * CVE-2023-39193 * CVE-2023-39194 * CVE-2023-4155 * CVE-2023-42753 * CVE-2023-42754 * CVE-2023-4389 * CVE-2023-4563 * CVE-2023-4622 * CVE-2023-4623 * CVE-2023-4881 * CVE-2023-4921 * CVE-2023-5345 CVSS scores: * CVE-2023-1192 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H * CVE-2023-1206 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-1206 ( NVD ): 5.7 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H * CVE-2023-1859 ( SUSE ): 1.9 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L * CVE-2023-1859 ( NVD ): 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H * CVE-2023-2177 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H * CVE-2023-2177 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H * CVE-2023-39192 ( SUSE ): 6.0 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H * CVE-2023-39192 ( NVD ): 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L * CVE-2023-39193 ( SUSE ): 5.1 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L * CVE-2023-39193 ( NVD ): 5.1 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L * CVE-2023-39194 ( SUSE ): 3.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N * CVE-2023-39194 ( NVD ): 3.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N * CVE-2023-4155 ( SUSE ): 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H * CVE-2023-4155 ( NVD ): 5.3 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H * CVE-2023-42753 ( NVD ): 7.0CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-42754 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H * CVE-2023-42754 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H * CVE-2023-4389 ( SUSE ): 5.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H * CVE-2023-4389 ( NVD ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-4563 ( SUSE ): 0.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:N * CVE-2023-4622 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-4622 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-4623 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-4623 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-4881 ( SUSE ): 6.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L * CVE-2023-4881 ( NVD ): 6.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H * CVE-2023-4921 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-4921 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-5345 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-5345 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: * Basesystem Module 15-SP4 * Development Tools Module 15-SP4 * Legacy Module 15-SP4 * openSUSE Leap 15.4 * SUSE Linux Enterprise Desktop 15 SP4 * SUSE Linux Enterprise High Availability Extension 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise Live Patching 15-SP4 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Micro for Rancher 5.3 * SUSE Linux Enterprise Micro for Rancher 5.4 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Workstation Extension 15 SP4 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 An update thatsolves 17 vulnerabilities and has seven security fixes can now be installed. ## Description: The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: * CVE-2023-4563: Fixed an use-after-free flaw in the nftables sub-component. This vulnerability could allow a local attacker to crash the system or lead to a kernel information leak problem. (bsc#1214727) * CVE-2023-39194: Fixed a flaw in the processing of state filters which could allow a local attackers to disclose sensitive information. (bsc#1215861) * CVE-2023-39193: Fixed a flaw in the processing of state filters which could allow a local attackers to disclose sensitive information. (bsc#1215860) * CVE-2023-39192: Fixed a flaw in the u32_match_it function which could allow a local attackers to disclose sensitive information. (bsc#1215858) * CVE-2023-42754: Fixed a null pointer dereference in ipv4_link_failure which could lead an authenticated attacker to trigger a DoS. (bsc#1215467) * CVE-2023-5345: fixed an use-after-free vulnerability in the fs/smb/client component which could be exploited to achieve local privilege escalation. (bsc#1215899) * CVE-2023-4155: Fixed a flaw in KVM AMD Secure Encrypted Virtualization (SEV). An attacker can trigger a stack overflow and cause a denial of service or potentially guest-to-host escape in kernel configurations without stack guard pages. (bsc#1214022) * CVE-2023-4389: Fixed a reference counting issue in the Btrfs filesystem that could be exploited in order to leak internal kernel information or crash the system (bsc#1214351). * CVE-2023-42753: Fixed an array indexing vulnerability in the netfilter subsystem. This issue may have allowed a local user to crash the system or potentially escalate their privileges (bsc#1215150). * CVE-2023-1206: Fixed a hash collision flaw in the IPv6 connection lookup table. A user located in the local network or with a highbandwidth connection can increase the CPU usage of the server that accepts IPV6 connections up to 95% (bsc#1212703). * CVE-2023-4921: Fixed a use-after-free vulnerability in the QFQ network scheduler which could be exploited to achieve local privilege escalatio (bsc#1215275). * CVE-2023-4622: Fixed a use-after-free vulnerability in the Unix domain sockets component which could be exploited to achieve local privilege escalation (bsc#1215117). * CVE-2023-4623: Fixed a use-after-free issue in the HFSC network scheduler which could be exploited to achieve local privilege escalation (bsc#1215115). * CVE-2023-1859: Fixed a use-after-free flaw in Xen transport for 9pfs which could be exploited to crash the system (bsc#1210169). * CVE-2023-4881: Fixed a out-of-bounds write flaw in the netfilter subsystem that could lead to potential information disclosure or a denial of service (bsc#1215221). * CVE-2023-2177: Fixed a null pointer dereference issue in the sctp network protocol which could allow a user to crash the system (bsc#1210643). * CVE-2023-1192: Fixed use-after-free in cifs_demultiplex_thread() (bsc#1208995). The following non-security bugs were fixed: * ALSA: hda/cirrus: Fix broken audio on hardware with two CS42L42 codecs (git- fixes). * ALSA: hda/realtek: Splitting the UX3402 into two separate models (git- fixes). * ARM: pxa: remove use of symbol_get() (git-fixes). * arm64: csum: Fix OoB access in IP checksum code for negative lengths (git- fixes). * arm64: module-plts: inline linux/moduleloader.h (git-fixes) * arm64: module: Use module_init_layout_section() to spot init sections (git- fixes) * arm64: sdei: abort running SDEI handlers during crash (git-fixes) * arm64: tegra: Update AHUB clock parent and rate (git-fixes) * arm64/fpsimd: Only provide the length to cpufeature for xCR registers (git- fixes) * ASoC: imx-audmix: Fix return error with devm_clk_get() (git-fixes). * ASoC: meson: spdifin: starthw on dai probe (git-fixes). * ASoC: soc-utils: Export snd_soc_dai_is_dummy() symbol (git-fixes). * ASoC: tegra: Fix redundant PLLA and PLLA_OUT0 updates (git-fixes). * ata: libata: disallow dev-initiated LPM transitions to unsupported states (git-fixes). * ata: pata_falcon: fix IO base selection for Q40 (git-fixes). * ata: pata_ftide010: Add missing MODULE_DESCRIPTION (git-fixes). * ata: sata_gemini: Add missing MODULE_DESCRIPTION (git-fixes). * backlight: gpio_backlight: Drop output GPIO direction check for initial power state (git-fixes). * blk-iocost: fix divide by 0 error in calc_lcoefs() (bsc#1214986). * blk-iocost: use spin_lock_irqsave in adjust_inuse_and_calc_cost (bsc#1214992). * block/mq-deadline: use correct way to throttling write requests (bsc#1214993). * Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition (git-fixes). * bnx2x: new flag for track HW resource allocation (bsc#1202845 bsc#1215322). * bpf: Clear the probe_addr for uprobe (git-fixes). * btrfs: do not hold CPU for too long when defragging a file (bsc#1214988). * drm: gm12u320: Fix the timeout usage for usb_bulk_msg() (git-fixes). * drm/amd/display: fix the white screen issue when > = 64GB DRAM (git-fixes). * drm/amd/display: prevent potential division by zero errors (git-fixes). * drm/display: Do not assume dual mode adaptors support i2c sub-addressing (bsc#1213808). * drm/i915: mark requests for GuC virtual engines to avoid use-after-free (git-fixes). * drm/i915/gvt: Drop unused helper intel_vgpu_reset_gtt() (git-fixes). * drm/virtio: Correct drm_gem_shmem_get_sg_table() error handling (git-fixes). * drm/virtio: Use appropriate atomic state in virtio_gpu_plane_cleanup_fb() (git-fixes). * ext4: avoid potential data overflow in next_linear_group (bsc#1214951). * ext4: correct inline offset when handling xattrs in inode body (bsc#1214950). * ext4: fix memory leaks in ext4_fname_{setup_filename,prepare_lookup} (bsc#1214954). * ext4: fix wrong unit use in ext4_mb_clear_bb (bsc#1214943). * ext4: fix wrong unit use in ext4_mb_new_blocks (bsc#1214944). * ext4: get block from bh in ext4_free_blocks for fast commit replay (bsc#1214942). * ext4: reflect error codes from ext4_multi_mount_protect() to its callers (bsc#1214941). * ext4: Remove ext4 locking of moved directory (bsc#1214957). * ext4: set goal start correctly in ext4_mb_normalize_request (bsc#1214940). * fs: do not update freeing inode i_io_list (bsc#1214813). * fs: Establish locking order for unrelated directories (bsc#1214958). * fs: Lock moved directories (bsc#1214959). * fs: lockd: avoid possible wrong NULL parameter (git-fixes). * fs: no need to check source (bsc#1215752). * fs: record I_DIRTY_TIME even if inode already has I_DIRTY_INODE (bsc#1214813). * fuse: nlookup missing decrement in fuse_direntplus_link (bsc#1215581). * gve: Add AF_XDP zero-copy support for GQI-QPL format (bsc#1214479). * gve: Add XDP DROP and TX support for GQI-QPL format (bsc#1214479). * gve: Add XDP REDIRECT support for GQI-QPL format (bsc#1214479). * gve: Changes to add new TX queues (bsc#1214479). * gve: Control path for DQO-QPL (bsc#1214479). * gve: fix frag_list chaining (bsc#1214479). * gve: Fix gve interrupt names (bsc#1214479). * gve: RX path for DQO-QPL (bsc#1214479). * gve: trivial spell fix Recive to Receive (bsc#1214479). * gve: Tx path for DQO-QPL (bsc#1214479). * gve: Unify duplicate GQ min pkt desc size constants (bsc#1214479). * gve: use vmalloc_array and vcalloc (bsc#1214479). * gve: XDP support GQI-QPL: helper function changes (bsc#1214479). * hwrng: virtio - add an internal buffer (git-fixes). * hwrng: virtio - always add a pending request (git-fixes). * hwrng: virtio - do not wait on cleanup (git-fixes). * hwrng: virtio - do not waste entropy (git-fixes). * hwrng: virtio - Fix race on data_avail and actual data (git-fixes). * i2c: aspeed: Reset the i2c controller when timeout occurs(git-fixes). * i3c: master: svc: fix probe failure when no i3c device exist (git-fixes). * idr: fix param name in idr_alloc_cyclic() doc (git-fixes). * Input: tca6416-keypad - fix interrupt enable disbalance (git-fixes). * iommu/virtio: Detach domain on endpoint release (git-fixes). * jbd2: check 'jh-> b_transaction' before removing it from checkpoint (bsc#1214953). * jbd2: correct the end of the journal recovery scan range (bsc#1214955). * jbd2: fix a race when checking checkpoint buffer busy (bsc#1214949). * jbd2: fix checkpoint cleanup performance regression (bsc#1214952). * jbd2: Fix wrongly judgement for buffer head removing while doing checkpoint (bsc#1214948). * jbd2: recheck chechpointing non-dirty buffer (bsc#1214945). * jbd2: remove journal_clean_one_cp_list() (bsc#1214947). * jbd2: remove t_checkpoint_io_list (bsc#1214946). * jbd2: restore t_checkpoint_io_list to maintain kABI (bsc#1214946). * kabi/severities: ignore mlx4 internal symbols * kconfig: fix possible buffer overflow (git-fixes). * kernel-binary: Move build-time definitions together Move source list and build architecture to buildrequires to aid in future reorganization of the spec template. * kernel-binary: python3 is needed for build At least scripts/bpf_helpers_doc.py requires python3 since Linux 4.18 Other simimlar scripts may exist. * kselftest/runner.sh: Propagate SIGTERM to runner child (git-fixes). * KVM: s390: fix KVM_S390_GET_CMMA_BITS for GFNs in memslot holes (git-fixes bsc#1215915). * KVM: s390: interrupt: use READ_ONCE() before cmpxchg() (git-fixes bsc#1215896). * KVM: s390: pv: fix external interruption loop not always detected (git-fixes bsc#1215916). * KVM: s390: vsie: Fix the initialization of the epoch extension (epdx) field (git-fixes bsc#1215894). * KVM: s390: vsie: fix the length of APCB bitmap (git-fixes bsc#1215895). * KVM: s390/diag: fix racy access of physical cpu number in diag 9c handler (git-fixes bsc#1215911). * KVM:SVM: Remove a duplicate definition of VMCB_AVIC_APIC_BAR_MASK (git- fixes). * KVM: VMX: Fix header file dependency of asm/vmx.h (git-fixes). * KVM: x86: Fix KVM_CAP_SYNC_REGS's sync_regs() TOCTOU issues (git-fixes). * KVM: x86/mmu: Include mmu.h in spte.h (git-fixes). * loop: Fix use-after-free issues (bsc#1214991). * loop: loop_set_status_from_info() check before assignment (bsc#1214990). * mlx4: Avoid resetting MLX4_INTFF_BONDING per driver (bsc#1187236). * mlx4: Connect the ethernet part to the auxiliary bus (bsc#1187236). * mlx4: Connect the infiniband part to the auxiliary bus (bsc#1187236). * mlx4: Delete custom device management logic (bsc#1187236). * mlx4: Get rid of the mlx4_interface.activate callback (bsc#1187236). * mlx4: Get rid of the mlx4_interface.get_dev callback (bsc#1187236). * mlx4: Move the bond work to the core driver (bsc#1187236). * mlx4: Register mlx4 devices to an auxiliary virtual bus (bsc#1187236). * mlx4: Rename member mlx4_en_dev.nb to netdev_nb (bsc#1187236). * mlx4: Replace the mlx4_interface.event callback with a notifier (bsc#1187236). * mlx4: Use 'void *' as the event param of mlx4_dispatch_event() (bsc#1187236). * module: Expose module_init_layout_section() (git-fixes) * net: do not allow gso_size to be set to GSO_BY_FRAGS (git-fixes). * net: mana: Add page pool for RX buffers (bsc#1214040). * net: mana: Configure hwc timeout from hardware (bsc#1214037). * net: phy: micrel: Correct bit assignments for phy_device flags (git-fixes). * net: usb: qmi_wwan: add Quectel EM05GV2 (git-fixes). * net/mlx4: Remove many unnecessary NULL values (bsc#1187236). * NFS: Guard against READDIR loop when entry names exceed MAXNAMELEN (git- fixes). * NFS/blocklayout: Use the passed in gfp flags (git-fixes). * NFS/pNFS: Fix assignment of xprtdata.cred (git-fixes). * NFS/pNFS: Report EINVAL errors from connect() to the server (git-fixes). * NFSD: da_addr_body field missing in some GETDEVICEINFO replies (git-fixes). * NFSD: fixchange_info in NFSv4 RENAME replies (git-fixes). * NFSD: Fix race to FREE_STATEID and cl_revoked (git-fixes). * NFSv4: Fix dropped lock for racing OPEN and delegation return (git-fixes). * NFSv4: fix out path in __nfs4_get_acl_uncached (git-fixes). * NFSv4.2: fix error handling in nfs42_proc_getxattr (git-fixes). * NFSv4.2: fix handling of COPY ERR_OFFLOAD_NO_REQ (git-fixes). * NFSv4/pNFS: minor fix for cleanup path in nfs4_get_device_info (git-fixes). * ntb: Clean up tx tail index on link down (git-fixes). * ntb: Drop packets when qp link is down (git-fixes). * ntb: Fix calculation ntb_transport_tx_free_entry() (git-fixes). * nvme-auth: use chap-> s2 to indicate bidirectional authentication (bsc#1214543). * nvme-tcp: add recovery_delay to sysfs (bsc#1201284). * nvme-tcp: delay error recovery until the next KATO interval (bsc#1201284). * nvme-tcp: Do not terminate commands when in RESETTING (bsc#1201284). * nvme-tcp: make 'err_work' a delayed work (bsc#1201284). * PCI: Free released resource after coalescing (git-fixes). * platform/mellanox: mlxbf-pmc: Fix potential buffer overflows (git-fixes). * platform/mellanox: mlxbf-pmc: Fix reading of unprogrammed events (git- fixes). * platform/mellanox: mlxbf-tmfifo: Drop jumbo frames (git-fixes). * platform/mellanox: mlxbf-tmfifo: Drop the Rx packet if no more descriptors (git-fixes). * platform/x86: intel_scu_ipc: Check status after timeout in busy_loop() (git- fixes). * platform/x86: intel_scu_ipc: Check status upon timeout in ipc_wait_for_interrupt() (git-fixes). * platform/x86: intel_scu_ipc: Do not override scu in intel_scu_ipc_dev_simple_command() (git-fixes). * platform/x86: intel_scu_ipc: Fail IPC send if still busy (git-fixes). * powerpc/fadump: make is_kdump_kernel() return false when fadump is active (bsc#1212639 ltc#202582). * powerpc/iommu: Fix notifiers being shared by PCI and VIO buses (bsc#1065729). * powerpc/rtas: mandate RTAS syscall filtering (bsc#1023051). *powerpc/xics: Remove unnecessary endian conversion (bsc#1065729). * printk: ringbuffer: Fix truncating buffer size min_t cast (bsc#1215875). * pwm: lpc32xx: Remove handling of PWM channels (git-fixes). * quota: add new helper dquot_active() (bsc#1214998). * quota: factor out dquot_write_dquot() (bsc#1214995). * quota: fix dqput() to follow the guarantees dquot_srcu should provide (bsc#1214963). * quota: fix warning in dqgrab() (bsc#1214962). * quota: Properly disable quotas when add_dquot_ref() fails (bsc#1214961). * quota: rename dquot_active() to inode_quota_active() (bsc#1214997). * s390/qeth: Do not call dev_close/dev_open (DOWN/UP) (bsc#1214873 git-fixes). * s390/zcrypt: do not leak memory if dev_set_name() fails (git-fixes bsc#1215148). * scsi: 3w-xxxx: Add error handling for initialization failure in tw_probe() (git-fixes). * scsi: 53c700: Check that command slot is not NULL (git-fixes). * scsi: core: Fix legacy /proc parsing buffer overflow (git-fixes). * scsi: core: Fix possible memory leak if device_add() fails (git-fixes). * scsi: fnic: Replace return codes in fnic_clean_pending_aborts() (git-fixes). * scsi: lpfc: Do not abuse UUID APIs and LPFC_COMPRESS_VMID_SIZE (git-fixes). * scsi: lpfc: Early return after marking final NLP_DROPPED flag in dev_loss_tmo (git-fixes). * scsi: lpfc: Fix the NULL vs IS_ERR() bug for debugfs_create_file() (git- fixes). * scsi: lpfc: Modify when a node should be put in device recovery mode during RSCN (git-fixes). * scsi: lpfc: Prevent use-after-free during rmmod with mapped NVMe rports (git-fixes). * scsi: lpfc: Remove reftag check in DIF paths (git-fixes). * scsi: qedf: Add synchronization between I/O completions and abort (bsc#1210658). * scsi: qedf: Fix firmware halt over suspend and resume (git-fixes). * scsi: qedf: Fix NULL dereference in error handling (git-fixes). * scsi: qedi: Fix firmware halt over suspend and resume (git-fixes). * scsi: qla2xxx: Add logs for SFP temperaturemonitoring (bsc#1214928). * scsi: qla2xxx: Allow 32-byte CDBs (bsc#1214928). * scsi: qla2xxx: Error code did not return to upper layer (bsc#1214928). * scsi: qla2xxx: Fix firmware resource tracking (bsc#1214928). * scsi: qla2xxx: Fix NULL vs IS_ERR() bug for debugfs_create_dir() (git- fixes). * scsi: qla2xxx: Fix smatch warn for qla_init_iocb_limit() (bsc#1214928). * scsi: qla2xxx: Flush mailbox commands on chip reset (bsc#1214928). * scsi: qla2xxx: Move resource to allow code reuse (bsc#1214928). * scsi: qla2xxx: Remove unsupported ql2xenabledif option (bsc#1214928). * scsi: qla2xxx: Remove unused declarations (bsc#1214928). * scsi: qla2xxx: Remove unused variables in qla24xx_build_scsi_type_6_iocbs() (bsc#1214928). * scsi: qla2xxx: Update version to 10.02.09.100-k (bsc#1214928). * scsi: qla2xxx: Use raw_smp_processor_id() instead of smp_processor_id() (git-fixes). * scsi: scsi_debug: Remove dead code (git-fixes). * scsi: snic: Fix double free in snic_tgt_create() (git-fixes). * scsi: snic: Fix possible memory leak if device_add() fails (git-fixes). * scsi: storvsc: Handle additional SRB status values (git-fixes). * scsi: zfcp: Fix a double put in zfcp_port_enqueue() (git-fixes bsc#1215941). * selftests: tracing: Fix to unmount tracefs for recovering environment (git- fixes). * SUNRPC: Mark the cred for revalidation if the server rejects it (git-fixes). * tcpm: Avoid soft reset when partner does not support get_status (git-fixes). * tracing: Fix race issue between cpu buffer write and swap (git-fixes). * tracing: Remove extra space at the end of hwlat_detector/mode (git-fixes). * tracing: Remove unnecessary copying of tr-> current_trace (git-fixes). * uapi: stddef.h: Fix __DECLARE_FLEX_ARRAY for C++ (git-fixes). * udf: Fix extension of the last extent in the file (bsc#1214964). * udf: Fix file corruption when appending just after end of preallocated extent (bsc#1214965). * udf: Fix off-by-one error when discarding preallocation(bsc#1214966). * udf: Fix uninitialized array access for some pathnames (bsc#1214967). * uprobes/x86: Allow to probe a NOP instruction with 0x66 prefix (git-fixes). * usb: ehci: add workaround for chipidea PORTSC.PEC bug (git-fixes). * usb: ehci: move new member has_ci_pec_bug into hole (git-fixes). * usb: serial: option: add FOXCONN T99W368/T99W373 product (git-fixes). * usb: serial: option: add Quectel EM05G variant (0x030e) (git-fixes). * usb: typec: tcpci: clear the fault status bit (git-fixes). * usb: typec: tcpci: move tcpci.h to include/linux/usb/ (git-fixes). * vhost_vdpa: fix the crash in unmap a large memory (git-fixes). * vhost-scsi: unbreak any layout for response (git-fixes). * vhost: allow batching hint without size (git-fixes). * vhost: fix hung thread due to erroneous iotlb entries (git-fixes). * vhost: handle error while adding split ranges to iotlb (git-fixes). * virtio_net: add checking sq is full inside xdp xmit (git-fixes). * virtio_net: Fix probe failed when modprobe virtio_net (git-fixes). * virtio_net: reorder some funcs (git-fixes). * virtio_net: separate the logic of checking whether sq is full (git-fixes). * virtio_ring: fix avail_wrap_counter in virtqueue_add_packed (git-fixes). * virtio-mmio: do not break lifecycle of vm_dev (git-fixes). * virtio-net: fix race between set queues and probe (git-fixes). * virtio-net: set queues after driver_ok (git-fixes). * virtio-rng: make device ready before making request (git-fixes). * virtio: acknowledge all features before access (git-fixes). * vmcore: remove dependency with is_kdump_kernel() for exporting vmcore (bsc#1212639 ltc#202582). * watchdog: intel-mid_wdt: add MODULE_ALIAS() to allow auto-load (git-fixes). * word-at-a-time: use the same return type for has_zero regardless of endianness (bsc#1065729). * x86/alternative: Fix race in try_get_desc() (git-fixes). * x86/boot/e820: Fix typo in e820.c comment (git-fixes). * x86/bugs: Reset speculation control settings on init(git-fixes). * x86/cpu: Add Lunar Lake M (git-fixes). * x86/cpu: Add model number for Intel Arrow Lake processor (git-fixes). * x86/fpu: Take task_struct* in copy_sigframe_from_user_to_xstate() (git- fixes). * x86/head/64: Switch to KERNEL_CS as soon as new GDT is installed (git- fixes). * x86/i8259: Mark legacy PIC interrupts with IRQ_LEVEL (git-fixes). * x86/ioapic: Do not return 0 from arch_dynirq_lower_bound() (git-fixes). * x86/ioremap: Fix page aligned size calculation in __ioremap_caller() (git- fixes). * x86/mce: Retrieve poison range from hardware (git-fixes). * x86/mem_encrypt: Unbreak the AMD_MEM_ENCRYPT=n build (git-fixes). * x86/mm: Avoid incomplete Global INVLPG flushes (git-fixes). * x86/mm: Do not shuffle CPU entry areas without KASLR (git-fixes). * x86/purgatory: remove PGO flags (git-fixes). * x86/PVH: avoid 32-bit build warning when obtaining VGA console info (git- fixes). * x86/reboot: Disable virtualization in an emergency if SVM is supported (git- fixes). * x86/resctl: fix scheduler confusion with 'current' (git-fixes). * x86/resctrl: Fix task CLOSID/RMID update race (git-fixes). * x86/resctrl: Fix to restore to original value when re-enabling hardware prefetch register (git-fixes). * x86/rtc: Remove __init for runtime functions (git-fixes). * x86/sgx: Reduce delay and interference of enclave release (git-fixes). * x86/srso: Do not probe microcode in a guest (git-fixes). * x86/srso: Fix SBPB enablement for spec_rstack_overflow=off (git-fixes). * x86/srso: Fix srso_show_state() side effect (git-fixes). * x86/srso: Set CPUID feature bits independently of bug or mitigation status (git-fixes). * x86/virt: Force GIF=1 prior to disabling SVM (for reboot flows) (git-fixes). * xen: remove a confusing comment on auto-translated guest I/O (git-fixes). * xprtrdma: Remap Receive buffers after a reconnect (git-fixes). ## Special Instructions and Notes: * Please reboot the system after installing this update. ## PatchInstructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2023-4072=1 * SUSE Linux Enterprise Micro for Rancher 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2023-4072=1 * SUSE Linux Enterprise Micro 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2023-4072=1 * SUSE Linux Enterprise Micro for Rancher 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2023-4072=1 * SUSE Linux Enterprise Micro 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2023-4072=1 * Basesystem Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2023-4072=1 * Development Tools Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP4-2023-4072=1 * Legacy Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Legacy-15-SP4-2023-4072=1 * SUSE Linux Enterprise Live Patching 15-SP4 zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP4-2023-4072=1 Please note that this is the initial kernel livepatch without fixes itself, this package is later updated by separate standalone kernel livepatch updates. * SUSE Linux Enterprise High Availability Extension 15 SP4 zypper in -t patch SUSE-SLE-Product-HA-15-SP4-2023-4072=1 * SUSE Linux Enterprise Workstation Extension 15 SP4 zypper in -t patch SUSE-SLE-Product-WE-15-SP4-2023-4072=1 ## Package List: * openSUSE Leap 15.4 (noarch nosrc) * kernel-docs-5.14.21-150400.24.92.1 * openSUSE Leap 15.4 (noarch) * kernel-source-vanilla-5.14.21-150400.24.92.1 * kernel-macros-5.14.21-150400.24.92.1 * kernel-docs-html-5.14.21-150400.24.92.1 * kernel-devel-5.14.21-150400.24.92.1 * kernel-source-5.14.21-150400.24.92.1 * openSUSE Leap 15.4 (nosrc ppc64le x86_64) * kernel-debug-5.14.21-150400.24.92.1 * openSUSE Leap 15.4 (ppc64le x86_64) * kernel-debug-debugsource-5.14.21-150400.24.92.1 *kernel-debug-debuginfo-5.14.21-150400.24.92.1 * kernel-debug-devel-debuginfo-5.14.21-150400.24.92.1 * kernel-debug-livepatch-devel-5.14.21-150400.24.92.1 * kernel-debug-devel-5.14.21-150400.24.92.1 * openSUSE Leap 15.4 (aarch64 ppc64le x86_64) * kernel-kvmsmall-devel-5.14.21-150400.24.92.1 * kernel-kvmsmall-devel-debuginfo-5.14.21-150400.24.92.1 * kernel-kvmsmall-livepatch-devel-5.14.21-150400.24.92.1 * kernel-default-base-rebuild-5.14.21-150400.24.92.1.150400.24.42.1 * kernel-kvmsmall-debuginfo-5.14.21-150400.24.92.1 * kernel-kvmsmall-debugsource-5.14.21-150400.24.92.1 * kernel-default-base-5.14.21-150400.24.92.1.150400.24.42.1 * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64) * kernel-default-devel-5.14.21-150400.24.92.1 * kernel-default-livepatch-devel-5.14.21-150400.24.92.1 * kernel-default-debuginfo-5.14.21-150400.24.92.1 * kselftests-kmp-default-5.14.21-150400.24.92.1 * gfs2-kmp-default-debuginfo-5.14.21-150400.24.92.1 * cluster-md-kmp-default-5.14.21-150400.24.92.1 * reiserfs-kmp-default-debuginfo-5.14.21-150400.24.92.1 * kernel-default-livepatch-5.14.21-150400.24.92.1 * dlm-kmp-default-5.14.21-150400.24.92.1 * kernel-syms-5.14.21-150400.24.92.1 * reiserfs-kmp-default-5.14.21-150400.24.92.1 * cluster-md-kmp-default-debuginfo-5.14.21-150400.24.92.1 * kselftests-kmp-default-debuginfo-5.14.21-150400.24.92.1 * kernel-default-devel-debuginfo-5.14.21-150400.24.92.1 * kernel-default-extra-5.14.21-150400.24.92.1 * kernel-obs-build-5.14.21-150400.24.92.1 * kernel-default-extra-debuginfo-5.14.21-150400.24.92.1 * ocfs2-kmp-default-5.14.21-150400.24.92.1 * kernel-obs-qa-5.14.21-150400.24.92.1 * dlm-kmp-default-debuginfo-5.14.21-150400.24.92.1 * gfs2-kmp-default-5.14.21-150400.24.92.1 * kernel-default-optional-debuginfo-5.14.21-150400.24.92.1 * ocfs2-kmp-default-debuginfo-5.14.21-150400.24.92.1 * kernel-default-debugsource-5.14.21-150400.24.92.1 *kernel-obs-build-debugsource-5.14.21-150400.24.92.1 * kernel-default-optional-5.14.21-150400.24.92.1 * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 nosrc) * kernel-default-5.14.21-150400.24.92.1 * openSUSE Leap 15.4 (aarch64 nosrc ppc64le x86_64) * kernel-kvmsmall-5.14.21-150400.24.92.1 * openSUSE Leap 15.4 (ppc64le s390x x86_64) * kernel-livepatch-5_14_21-150400_24_92-default-debuginfo-1-150400.9.3.1 * kernel-livepatch-5_14_21-150400_24_92-default-1-150400.9.3.1 * kernel-livepatch-SLE15-SP4_Update_19-debugsource-1-150400.9.3.1 * openSUSE Leap 15.4 (nosrc s390x) * kernel-zfcpdump-5.14.21-150400.24.92.1 * openSUSE Leap 15.4 (s390x) * kernel-zfcpdump-debuginfo-5.14.21-150400.24.92.1 * kernel-zfcpdump-debugsource-5.14.21-150400.24.92.1 * openSUSE Leap 15.4 (nosrc) * dtb-aarch64-5.14.21-150400.24.92.1 * openSUSE Leap 15.4 (aarch64) * dtb-allwinner-5.14.21-150400.24.92.1 * kernel-64kb-optional-debuginfo-5.14.21-150400.24.92.1 * dtb-cavium-5.14.21-150400.24.92.1 * dtb-amd-5.14.21-150400.24.92.1 * dtb-exynos-5.14.21-150400.24.92.1 * dtb-lg-5.14.21-150400.24.92.1 * dtb-hisilicon-5.14.21-150400.24.92.1 * dtb-nvidia-5.14.21-150400.24.92.1 * cluster-md-kmp-64kb-5.14.21-150400.24.92.1 * kernel-64kb-extra-5.14.21-150400.24.92.1 * kernel-64kb-optional-5.14.21-150400.24.92.1 * dtb-amazon-5.14.21-150400.24.92.1 * ocfs2-kmp-64kb-5.14.21-150400.24.92.1 * dtb-freescale-5.14.21-150400.24.92.1 * dtb-rockchip-5.14.21-150400.24.92.1 * dtb-marvell-5.14.21-150400.24.92.1 * cluster-md-kmp-64kb-debuginfo-5.14.21-150400.24.92.1 * dtb-apm-5.14.21-150400.24.92.1 * gfs2-kmp-64kb-5.14.21-150400.24.92.1 * reiserfs-kmp-64kb-debuginfo-5.14.21-150400.24.92.1 * reiserfs-kmp-64kb-5.14.21-150400.24.92.1 * kselftests-kmp-64kb-debuginfo-5.14.21-150400.24.92.1 * dtb-renesas-5.14.21-150400.24.92.1 * dtb-broadcom-5.14.21-150400.24.92.1 * dtb-mediatek-5.14.21-150400.24.92.1 *kernel-64kb-debuginfo-5.14.21-150400.24.92.1 * kernel-64kb-livepatch-devel-5.14.21-150400.24.92.1 * ocfs2-kmp-64kb-debuginfo-5.14.21-150400.24.92.1 * dtb-qcom-5.14.21-150400.24.92.1 * dtb-amlogic-5.14.21-150400.24.92.1 * dtb-xilinx-5.14.21-150400.24.92.1 * dlm-kmp-64kb-5.14.21-150400.24.92.1 * gfs2-kmp-64kb-debuginfo-5.14.21-150400.24.92.1 * kernel-64kb-debugsource-5.14.21-150400.24.92.1 * dtb-altera-5.14.21-150400.24.92.1 * dtb-sprd-5.14.21-150400.24.92.1 * dtb-apple-5.14.21-150400.24.92.1 * dtb-arm-5.14.21-150400.24.92.1 * kselftests-kmp-64kb-5.14.21-150400.24.92.1 * dtb-socionext-5.14.21-150400.24.92.1 * dlm-kmp-64kb-debuginfo-5.14.21-150400.24.92.1 * kernel-64kb-devel-debuginfo-5.14.21-150400.24.92.1 * kernel-64kb-extra-debuginfo-5.14.21-150400.24.92.1 * kernel-64kb-devel-5.14.21-150400.24.92.1 * openSUSE Leap 15.4 (aarch64 nosrc) * kernel-64kb-5.14.21-150400.24.92.1 * SUSE Linux Enterprise Micro for Rancher 5.3 (aarch64 nosrc s390x x86_64) * kernel-default-5.14.21-150400.24.92.1 * SUSE Linux Enterprise Micro for Rancher 5.3 (aarch64 x86_64) * kernel-default-base-5.14.21-150400.24.92.1.150400.24.42.1 * SUSE Linux Enterprise Micro for Rancher 5.3 (aarch64 s390x x86_64) * kernel-default-debuginfo-5.14.21-150400.24.92.1 * kernel-default-debugsource-5.14.21-150400.24.92.1 * SUSE Linux Enterprise Micro 5.3 (aarch64 nosrc s390x x86_64) * kernel-default-5.14.21-150400.24.92.1 * SUSE Linux Enterprise Micro 5.3 (aarch64 x86_64) * kernel-default-base-5.14.21-150400.24.92.1.150400.24.42.1 * SUSE Linux Enterprise Micro 5.3 (aarch64 s390x x86_64) * kernel-default-debuginfo-5.14.21-150400.24.92.1 * kernel-default-debugsource-5.14.21-150400.24.92.1 * SUSE Linux Enterprise Micro for Rancher 5.4 (aarch64 nosrc s390x x86_64) * kernel-default-5.14.21-150400.24.92.1 * SUSE Linux Enterprise Micro for Rancher 5.4 (aarch64 x86_64) * kernel-default-base-5.14.21-150400.24.92.1.150400.24.42.1 * SUSELinux Enterprise Micro for Rancher 5.4 (aarch64 s390x x86_64) * kernel-default-debuginfo-5.14.21-150400.24.92.1 * kernel-default-debugsource-5.14.21-150400.24.92.1 * SUSE Linux Enterprise Micro 5.4 (aarch64 nosrc s390x x86_64) * kernel-default-5.14.21-150400.24.92.1 * SUSE Linux Enterprise Micro 5.4 (aarch64 x86_64) * kernel-default-base-5.14.21-150400.24.92.1.150400.24.42.1 * SUSE Linux Enterprise Micro 5.4 (aarch64 s390x x86_64) * kernel-default-debuginfo-5.14.21-150400.24.92.1 * kernel-default-debugsource-5.14.21-150400.24.92.1 * Basesystem Module 15-SP4 (aarch64 nosrc) * kernel-64kb-5.14.21-150400.24.92.1 * Basesystem Module 15-SP4 (aarch64) * kernel-64kb-devel-debuginfo-5.14.21-150400.24.92.1 * kernel-64kb-devel-5.14.21-150400.24.92.1 * kernel-64kb-debugsource-5.14.21-150400.24.92.1 * kernel-64kb-debuginfo-5.14.21-150400.24.92.1 * Basesystem Module 15-SP4 (aarch64 ppc64le s390x x86_64 nosrc) * kernel-default-5.14.21-150400.24.92.1 * Basesystem Module 15-SP4 (aarch64 ppc64le x86_64) * kernel-default-base-5.14.21-150400.24.92.1.150400.24.42.1 * Basesystem Module 15-SP4 (aarch64 ppc64le s390x x86_64) * kernel-default-devel-5.14.21-150400.24.92.1 * kernel-default-debuginfo-5.14.21-150400.24.92.1 * kernel-default-debugsource-5.14.21-150400.24.92.1 * kernel-default-devel-debuginfo-5.14.21-150400.24.92.1 * Basesystem Module 15-SP4 (noarch) * kernel-devel-5.14.21-150400.24.92.1 * kernel-macros-5.14.21-150400.24.92.1 * Basesystem Module 15-SP4 (nosrc s390x) * kernel-zfcpdump-5.14.21-150400.24.92.1 * Basesystem Module 15-SP4 (s390x) * kernel-zfcpdump-debuginfo-5.14.21-150400.24.92.1 * kernel-zfcpdump-debugsource-5.14.21-150400.24.92.1 * Development Tools Module 15-SP4 (noarch nosrc) * kernel-docs-5.14.21-150400.24.92.1 * Development Tools Module 15-SP4 (aarch64 ppc64le s390x x86_64) * kernel-syms-5.14.21-150400.24.92.1 * kernel-obs-build-5.14.21-150400.24.92.1 *kernel-obs-build-debugsource-5.14.21-150400.24.92.1 * Development Tools Module 15-SP4 (noarch) * kernel-source-5.14.21-150400.24.92.1 * Legacy Module 15-SP4 (nosrc) * kernel-default-5.14.21-150400.24.92.1 * Legacy Module 15-SP4 (aarch64 ppc64le s390x x86_64) * kernel-default-debuginfo-5.14.21-150400.24.92.1 * kernel-default-debugsource-5.14.21-150400.24.92.1 * reiserfs-kmp-default-debuginfo-5.14.21-150400.24.92.1 * reiserfs-kmp-default-5.14.21-150400.24.92.1 * SUSE Linux Enterprise Live Patching 15-SP4 (ppc64le s390x x86_64) * kernel-default-livepatch-devel-5.14.21-150400.24.92.1 * kernel-livepatch-SLE15-SP4_Update_19-debugsource-1-150400.9.3.1 * kernel-livepatch-5_14_21-150400_24_92-default-debuginfo-1-150400.9.3.1 * kernel-livepatch-5_14_21-150400_24_92-default-1-150400.9.3.1 * kernel-default-debuginfo-5.14.21-150400.24.92.1 * kernel-default-livepatch-5.14.21-150400.24.92.1 * kernel-default-debugsource-5.14.21-150400.24.92.1 * SUSE Linux Enterprise Live Patching 15-SP4 (nosrc) * kernel-default-5.14.21-150400.24.92.1 * SUSE Linux Enterprise High Availability Extension 15 SP4 (aarch64 ppc64le s390x x86_64) * cluster-md-kmp-default-debuginfo-5.14.21-150400.24.92.1 * ocfs2-kmp-default-5.14.21-150400.24.92.1 * dlm-kmp-default-debuginfo-5.14.21-150400.24.92.1 * gfs2-kmp-default-debuginfo-5.14.21-150400.24.92.1 * ocfs2-kmp-default-debuginfo-5.14.21-150400.24.92.1 * kernel-default-debuginfo-5.14.21-150400.24.92.1 * cluster-md-kmp-default-5.14.21-150400.24.92.1 * dlm-kmp-default-5.14.21-150400.24.92.1 * kernel-default-debugsource-5.14.21-150400.24.92.1 * gfs2-kmp-default-5.14.21-150400.24.92.1 * SUSE Linux Enterprise High Availability Extension 15 SP4 (nosrc) * kernel-default-5.14.21-150400.24.92.1 * SUSE Linux Enterprise Workstation Extension 15 SP4 (nosrc) * kernel-default-5.14.21-150400.24.92.1 * SUSE Linux Enterprise Workstation Extension 15 SP4 (x86_64) *kernel-default-debuginfo-5.14.21-150400.24.92.1 * kernel-default-debugsource-5.14.21-150400.24.92.1 * kernel-default-extra-5.14.21-150400.24.92.1 * kernel-default-extra-debuginfo-5.14.21-150400.24.92.1 ## References: * https://www.suse.com/security/cve/CVE-2023-1192.html * https://www.suse.com/security/cve/CVE-2023-1206.html * https://www.suse.com/security/cve/CVE-2023-1859.html * https://www.suse.com/security/cve/CVE-2023-2177.html * https://www.suse.com/security/cve/CVE-2023-39192.html * https://www.suse.com/security/cve/CVE-2023-39193.html * https://www.suse.com/security/cve/CVE-2023-39194.html * https://www.suse.com/security/cve/CVE-2023-4155.html * https://www.suse.com/security/cve/CVE-2023-42753.html * https://www.suse.com/security/cve/CVE-2023-42754.html * https://www.suse.com/security/cve/CVE-2023-4389.html * https://www.suse.com/security/cve/CVE-2023-4563.html * https://www.suse.com/security/cve/CVE-2023-4622.html * https://www.suse.com/security/cve/CVE-2023-4623.html * https://www.suse.com/security/cve/CVE-2023-4881.html * https://www.suse.com/security/cve/CVE-2023-4921.html * https://www.suse.com/security/cve/CVE-2023-5345.html * https://bugzilla.suse.com/show_bug.cgi?id=1202845 * https://bugzilla.suse.com/show_bug.cgi?id=1213808 * https://bugzilla.suse.com/show_bug.cgi?id=1214928 * https://bugzilla.suse.com/show_bug.cgi?id=1214940 * https://bugzilla.suse.com/show_bug.cgi?id=1214941 * https://bugzilla.suse.com/show_bug.cgi?id=1214942 * https://bugzilla.suse.com/show_bug.cgi?id=1214943 * https://bugzilla.suse.com/show_bug.cgi?id=1214944 * https://bugzilla.suse.com/show_bug.cgi?id=1214950 * https://bugzilla.suse.com/show_bug.cgi?id=1214951 * https://bugzilla.suse.com/show_bug.cgi?id=1214954 * https://bugzilla.suse.com/show_bug.cgi?id=1214957 * https://bugzilla.suse.com/show_bug.cgi?id=1214986 * https://bugzilla.suse.com/show_bug.cgi?id=1214988 * https://bugzilla.suse.com/show_bug.cgi?id=1214992 *https://bugzilla.suse.com/show_bug.cgi?id=1214993 * https://bugzilla.suse.com/show_bug.cgi?id=1215322 * https://bugzilla.suse.com/show_bug.cgi?id=1215877 * https://bugzilla.suse.com/show_bug.cgi?id=1215894 * https://bugzilla.suse.com/show_bug.cgi?id=1215895 * https://bugzilla.suse.com/show_bug.cgi?id=1215896 * https://bugzilla.suse.com/show_bug.cgi?id=1215911 * https://bugzilla.suse.com/show_bug.cgi?id=1215915 * https://bugzilla.suse.com/show_bug.cgi?id=1215916 . An essential update to the Linux kernel in SUSE resolves a number of significant security flaws. A system reboot is necessary for all machines.. Linux Kernel Update,SUSE Security Advisories,Kernels Security Fixes,Open Source Kernel Management. . Severity: Important. LinuxSecurity.com Team

Oct 13, 2023 •Important SuSE

security advisorydenial of servicecritical issue

Ubuntu 18.04 LTS USN-6396-1 Critical: Kernel Denial Of Service Risks

Several security issues were fixed in the Linux kernel.. ========================================================================== Ubuntu Security Notice USN-6396-1 September 26, 2023 linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-gcp, linux-gcp-4.15, linux-hwe, linux-oracle vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 18.04 LTS (Available with Ubuntu Pro) - Ubuntu 16.04 LTS (Available with Ubuntu Pro) Summary: Several security issues were fixed in the Linux kernel. Software Description: - linux: Linux kernel - linux-aws: Linux kernel for Amazon Web Services (AWS) systems - linux-azure-4.15: Linux kernel for Microsoft Azure Cloud systems - linux-gcp-4.15: Linux kernel for Google Cloud Platform (GCP) systems - linux-aws-hwe: Linux kernel for Amazon Web Services (AWS-HWE) systems - linux-azure: Linux kernel for Microsoft Azure Cloud systems - linux-gcp: Linux kernel for Google Cloud Platform (GCP) systems - linux-hwe: Linux hardware enablement (HWE) kernel - linux-oracle: Linux kernel for Oracle Cloud systems Details: It was discovered that some AMD x86-64 processors with SMT enabled could speculatively execute instructions using a return address from a sibling thread. A local attacker could possibly use this to expose sensitive information. (CVE-2022-27672) Daniel Moghimi discovered that some Intel(R) Processors did not properly clear microarchitectural state after speculative execution of various instructions. A local unprivileged user could use this to obtain to sensitive information. (CVE-2022-40982) Yang Lan discovered that the GFS2 file system implementation in the Linux kernel could attempt to dereference a null pointer in some situations. An attacker could use this to construct a malicious GFS2 image that, when mounted and operated on, could cause a denial of service (system crash). (CVE-2023-3212) Itwas discovered that the NFC implementation in the Linux kernel contained a use-after-free vulnerability when performing peer-to-peer communication in certain conditions. A privileged attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information (kernel memory). (CVE-2023-3863) It was discovered that the bluetooth subsystem in the Linux kernel did not properly handle L2CAP socket release, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-40283) It was discovered that some network classifier implementations in the Linux kernel contained use-after-free vulnerabilities. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-4128) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 18.04 LTS (Available with Ubuntu Pro): linux-image-4.15.0-1155-gcp 4.15.0-1155.172 linux-image-4.15.0-1161-aws 4.15.0-1161.174 linux-image-4.15.0-1170-azure 4.15.0-1170.185 linux-image-4.15.0-218-generic 4.15.0-218.229 linux-image-4.15.0-218-lowlatency 4.15.0-218.229 linux-image-aws-lts-18.04 4.15.0.1161.159 linux-image-azure-lts-18.04 4.15.0.1170.138 linux-image-gcp-lts-18.04 4.15.0.1155.169 linux-image-generic 4.15.0.218.202 linux-image-lowlatency 4.15.0.218.202 linux-image-virtual 4.15.0.218.202 Ubuntu 16.04 LTS (Available with Ubuntu Pro): linux-image-4.15.0-1124-oracle 4.15.0-1124.135~16.04.1 linux-image-4.15.0-1155-gcp 4.15.0-1155.172~16.04.1 linux-image-4.15.0-1161-aws 4.15.0-1161.174~16.04.1 linux-image-4.15.0-1170-azure 4.15.0-1170.185~16.04.1 linux-image-4.15.0-218-generic 4.15.0-218.229~16.04.1 linux-image-4.15.0-218-lowlatency 4.15.0-218.229~16.04.1 linux-image-aws-hwe 4.15.0.1161.144 linux-image-azure 4.15.0.1170.154 linux-image-gcp 4.15.0.1155.145 linux-image-generic-hwe-16.04 4.15.0.218.2 linux-image-gke 4.15.0.1155.145 linux-image-lowlatency-hwe-16.04 4.15.0.218.2 linux-image-oem 4.15.0.218.2 linux-image-oracle 4.15.0.1124.105 linux-image-virtual-hwe-16.04 4.15.0.218.2 After a standard system update you need to reboot your computer to make all the necessary changes. ATTENTION: Due to an unavoidable ABI change the kernel updates have been given a new version number, which requires you to recompile and reinstall all third party kernel modules you might have installed. Unless you manually uninstalled the standard kernel metapackages (e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual, linux-powerpc), a standard system upgrade will automatically perform this as well. References: CVE-2022-27672, CVE-2022-40982, CVE-2023-3212, CVE-2023-3863, CVE-2023-40283, CVE-2023-4128 . An advisory detailing security updates for the Ubuntu Linux kernel has been released, highlighting vulnerabilities and urging users to take necessary actions swiftly. Linux Kernel, Ubuntu Security, System Updates, Denial Of Service, Local Attacks. . Severity: Critical. LinuxSecurity.com Team

Sep 26, 2023 •Critical Ubuntu

security advisorykernel updateimportant

SUSE Linux Enterprise Server: 2018:0115-1 Important Kernel Security Update

An update that solves 14 vulnerabilities and has one errata is now available.. SUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2018:0115-1 Rating: important References: #1045205 #1050231 #1066569 #1066693 #1068032 #1068671 #1070771 #1070781 #1071074 #1071470 #1071693 #1071694 #1071695 #1072561 #1072876 Cross-References: CVE-2017-11600 CVE-2017-13167 CVE-2017-15115 CVE-2017-15868 CVE-2017-16534 CVE-2017-16538 CVE-2017-17448 CVE-2017-17449 CVE-2017-17450 CVE-2017-17558 CVE-2017-5715 CVE-2017-5753 CVE-2017-5754 CVE-2017-8824 Affected Products: SUSE Linux Enterprise Server 12-LTSS SUSE Linux Enterprise Module for Public Cloud 12 ______________________________________________________________________________ An update that solves 14 vulnerabilities and has one errata is now available. Description: The SUSE Linux Enterprise 12 GA LTSS kernel was updated to receive various security and bugfixes. This update adds mitigations for various side channel attacks against modern CPUs that could disclose content of otherwise unreadable memory (bnc#1068032). - CVE-2017-5753 / "SpectreAttack": Local attackers on systems with modern CPUs featuring deep instruction pipelining could use attacker controllable speculative execution over code patterns in the Linux Kernel to leak content from otherwise not readable memory in the same address space, allowing retrieval of passwords, cryptographic keys and other secrets. This problem is mitigated by adding speculative fencing on affected code paths throughout the Linux kernel. This issue is addressed for the x86_64, the IBM Power and IBM zSeries architecture. - CVE-2017-5715 /"SpectreAttack": Local attackers on systems with modern CPUs featuring branch prediction could use mispredicted branches to speculatively execute code patterns that in turn could be made to leak other non-readable content in the same address space, an attack similar to CVE-2017-5753. This problem is mitigated by disabling predictive branches, depending on CPU architecture either by firmware updates and/or fixes in the user-kernel privilege boundaries. This is done with help of Linux Kernel fixes on the Intel/AMD x86_64 and IBM zSeries architectures. On x86_64, this requires also updates of the CPU microcode packages, delivered in seperate updates. For IBM Power and zSeries the required firmware updates are supplied over regular channels by IBM. As this feature can have a performance impact, it can be disabled using the "nospec" kernel commandline option. - CVE-2017-5754 / "MeltdownAttack": Local attackers on systems with modern CPUs featuring deep instruction pipelining could use code patterns in userspace to speculative executive code that would read otherwise read protected memory, an attack similar to CVE-2017-5753. This problem is mitigated by unmapping the Linux Kernel from the user address space during user code execution, following a approach called "KAISER". The terms used here are "KAISER" / "Kernel Address Isolation" and "PTI" / "Page Table Isolation". This update does this on the x86_64 architecture, it is not required on the IBM zSeries architecture. This feature can be enabled / disabled by the "pti=[on|off|auto]" or "nopti" commandline options. The following security bugs were fixed: - CVE-2017-15868: The bnep_add_connection function in net/bluetooth/bnep/core.c in the Linux kernel did not ensure that an l2cap socket is available, which allowed local users to gain privileges via a crafted application (bnc#1071470). - CVE-2017-13167: An elevation ofprivilege vulnerability in the kernel sound timer. (bnc#1072876). - CVE-2017-16538: drivers/media/usb/dvb-usb-v2/lmedm04.c in the Linux kernel allowed local users to cause a denial of service (general protection fault and system crash) or possibly have unspecified other impact via a crafted USB device, related to a missing warm-start check and incorrect attach timing (dm04_lme2510_frontend_attach versus dm04_lme2510_tuner) (bnc#1066569). - CVE-2017-17558: The usb_destroy_configuration function in drivers/usb/core/config.c in the USB core subsystem in the Linux kernel did not consider the maximum number of configurations and interfaces before attempting to release resources, which allowed local users to cause a denial of service (out-of-bounds write access) or possibly have unspecified other impact via a crafted USB device (bnc#1072561). - CVE-2017-17450: net/netfilter/xt_osf.c in the Linux kernel did not require the CAP_NET_ADMIN capability for add_callback and remove_callback operations, which allowed local users to bypass intended access restrictions because the xt_osf_fingers data structure is shared across all net namespaces (bnc#1071695). - CVE-2017-17449: The __netlink_deliver_tap_skb function in net/netlink/af_netlink.c in the Linux kernel through 4.14.4, when CONFIG_NLMON is enabled, did not restrict observations of Netlink messages to a single net namespace, which allowed local users to obtain sensitive information by leveraging the CAP_NET_ADMIN capability to sniff an nlmon interface for all Netlink activity on the system (bnc#1071694). - CVE-2017-17448: net/netfilter/nfnetlink_cthelper.c in the Linux kernel did not require the CAP_NET_ADMIN capability for new, get, and del operations, which allowed local users to bypass intended access restrictions because the nfnl_cthelper_list data structure is shared across all net namespaces (bnc#1071693). - CVE-2017-8824:The dccp_disconnect function in net/dccp/proto.c in the Linux kernel allowed local users to gain privileges or cause a denial of service (use-after-free) via an AF_UNSPEC connect system call during the DCCP_LISTEN state (bnc#1070771). - CVE-2017-15115: The sctp_do_peeloff function in net/sctp/socket.c in the Linux kernel did not check whether the intended netns is used in a peel-off action, which allowed local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via crafted system calls (bnc#1068671). - CVE-2017-11600: net/xfrm/xfrm_policy.c in the Linux kernel through 4.12.3, when CONFIG_XFRM_MIGRATE is enabled, did not ensure that the dir value of xfrm_userpolicy_id is XFRM_POLICY_MAX or less, which allowed local users to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via an XFRM_MSG_MIGRATE xfrm Netlink message (bnc#1050231). - CVE-2017-16534: The cdc_parse_cdc_header function in drivers/usb/core/message.c in the Linux kernel allowed local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066693). The following non-security bugs were fixed: - kvm: svm: Do not intercept new speculative control MSRs (bsc#1068032). - audit: Fix use after free in audit_remove_watch_rule() (bsc#1045205). - bpf: prevent speculative execution in eBPF interpreter (bnc#1068032). - carl9170: prevent speculative execution (bnc#1068032). - fs: prevent speculative execution (bnc#1068032). - kaiser: make kernel_stack user-mapped - kvm: x86: Add speculative control CPUID support for guests (bsc#1068032). - locking/barriers: introduce new memory barrier gmb() (bnc#1068032). - p54: prevent speculative execution (bnc#1068032). - powerpc/barrier: add gmb. - powerpc: Convert cmp to cmpd in idle enter sequence (bsc#1070781). - powerpc/vdso64: Use double word compare on pointers (bsc#1070781). Conflicts: series.conf - ptrace: Add a new thread access check (bsc#1068032). - s390: introduce CPU alternatives (bsc#1068032). - s390/spinlock: add gmb memory barrier. - s390/spinlock: add ppa to system call path. - uas: Only complain about missing sg if all other checks succeed (bsc#1071074). - udf: prevent speculative execution (bnc#1068032). - usb: uas: fix bug in handling of alternate settings (bsc#1071074). - uvcvideo: prevent speculative execution (bnc#1068032). - x86/CPU/AMD: Add speculative control support for AMD (bsc#1068032). - x86/CPU/AMD: Make the LFENCE instruction serialized (bsc#1068032). - x86/CPU/AMD: Remove now unused definition of MFENCE_RDTSC feature (bsc#1068032). - x86/CPU: Check speculation control CPUID bit (bsc#1068032). - x86/enter: Add macros to set/clear IBRS and set IBPB (bsc#1068032). - x86/entry: Add a function to overwrite the RSB (bsc#1068032). - x86/entry: Stuff RSB for entry to kernel for non-SMEP platform (bsc#1068032). - x86/entry: Use IBRS on entry to kernel space (bsc#1068032). - x86/feature: Enable the x86 feature to control Speculation (bsc#1068032). - x86/idle: Disable IBRS when offlining a CPU and re-enable on wakeup (bsc#1068032). - x86/idle: Toggle IBRS when going idle (bsc#1068032). - x86/kaiser: Move feature detection up (bsc#1068032). - x86/kvm: Add MSR_IA32_SPEC_CTRL and MSR_IA32_PRED_CMD to kvm (bsc#1068032). - x86/kvm: Flush IBP when switching VMs (bsc#1068032). - x86/kvm: Pad RSB on VM transition (bsc#1068032). - x86/kvm: Toggle IBRS on VM entry and exit (bsc#1068032). - x86/microcode/AMD: Add support for fam17h microcode loading (bsc#1068032). - x86/mm: Only set IBPB when the new thread cannot ptrace current thread (bsc#1068032). - x86/mm: Set IBPB upon context switch (bsc#1068032). - x86/MSR: Move native_*msr(.. u64) to msr.h (bsc#1068032). - x86/spec: Add IBRScontrol functions (bsc#1068032). - x86/spec: Add "nospec" chicken bit (bsc#1068032). - x86/spec: Check CPUID direclty post microcode reload to support IBPB feature (bsc#1068032). - x86/spec_ctrl: Add an Indirect Branch Predictor barrier (bsc#1068032). - x86/spec_ctrl: Check whether IBPB is enabled before using it (bsc#1068032). - x86/spec_ctrl: Check whether IBRS is enabled before using it (bsc#1068032). - x86/svm: Add code to clear registers on VM exit (bsc#1068032). - x86/svm: Clobber the RSB on VM exit (bsc#1068032). - x86/svm: Set IBPB when running a different VCPU (bsc#1068032). - x86/svm: Set IBRS value on VM entry and exit (bsc#1068032). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2018-83=1 - SUSE Linux Enterprise Module for Public Cloud 12: zypper in -t patch SUSE-SLE-Module-Public-Cloud-12-2018-83=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 12-LTSS (ppc64le s390x x86_64): kernel-default-3.12.61-52.111.1 kernel-default-base-3.12.61-52.111.1 kernel-default-base-debuginfo-3.12.61-52.111.1 kernel-default-debuginfo-3.12.61-52.111.1 kernel-default-debugsource-3.12.61-52.111.1 kernel-default-devel-3.12.61-52.111.1 kernel-syms-3.12.61-52.111.1 - SUSE Linux Enterprise Server 12-LTSS (x86_64): kernel-xen-3.12.61-52.111.1 kernel-xen-base-3.12.61-52.111.1 kernel-xen-base-debuginfo-3.12.61-52.111.1 kernel-xen-debuginfo-3.12.61-52.111.1 kernel-xen-debugsource-3.12.61-52.111.1 kernel-xen-devel-3.12.61-52.111.1 - SUSE Linux Enterprise Server 12-LTSS (noarch): kernel-devel-3.12.61-52.111.1 kernel-macros-3.12.61-52.111.1 kernel-source-3.12.61-52.111.1 - SUSE Linux Enterprise Server 12-LTSS (s390x): kernel-default-man-3.12.61-52.111.1 - SUSE Linux Enterprise Module for Public Cloud 12 (x86_64): kernel-ec2-3.12.61-52.111.1 kernel-ec2-debuginfo-3.12.61-52.111.1 kernel-ec2-debugsource-3.12.61-52.111.1 kernel-ec2-devel-3.12.61-52.111.1 kernel-ec2-extra-3.12.61-52.111.1 kernel-ec2-extra-debuginfo-3.12.61-52.111.1 References: https://www.suse.com/security/cve/CVE-2017-11600.html https://www.suse.com/security/cve/CVE-2017-13167.html https://www.suse.com/security/cve/CVE-2017-15115.html https://www.suse.com/security/cve/CVE-2017-15868.html https://www.suse.com/security/cve/CVE-2017-16534.html https://www.suse.com/security/cve/CVE-2017-16538.html https://www.suse.com/security/cve/CVE-2017-17448.html https://www.suse.com/security/cve/CVE-2017-17449.html https://www.suse.com/security/cve/CVE-2017-17450.html https://www.suse.com/security/cve/CVE-2017-17558.html https://www.suse.com/security/cve/CVE-2017-5715.html https://www.suse.com/security/cve/CVE-2017-5753.html https://www.suse.com/security/cve/CVE-2017-5754.html https://www.suse.com/security/cve/CVE-2017-8824.html https://bugzilla.suse.com/1045205 https://bugzilla.suse.com/1050231 https://bugzilla.suse.com/1066569 https://bugzilla.suse.com/1066693 https://bugzilla.suse.com/1068032 https://bugzilla.suse.com/1068671 https://bugzilla.suse.com/1070771 https://bugzilla.suse.com/1070781 https://bugzilla.suse.com/1071074 https://bugzilla.suse.com/1071470 https://bugzilla.suse.com/1071693 https://bugzilla.suse.com/1071694 https://bugzilla.suse.com/1071695 https://bugzilla.suse.com/1072561 https://bugzilla.suse.com/1072876 -- . Significant update from SUSE boosts kernel defenses by fixing 14 vulnerabilities, strengthening safeguards against internal threats.. SUSE Linux Security, Kernel Update, System Vulnerability Fix, Linux Security Patches. . Severity: Important. LinuxSecurity.com Team

Jan 16, 2018 •Important SuSE

security advisorysecurity updateimportant

SUSE: 2013:1022-3 Important: Linux Kernel Local Attack Fixes

An update that solves 14 vulnerabilities and has 38 fixes An update that solves 14 vulnerabilities and has 38 fixes An update that solves 14 vulnerabilities and has 38 fixes is now available. It includes one version update. is now available. It includes one version update.. SUSE Security Update: Security update for Linux kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:1022-3 Rating: important References: #763968 #764209 #768052 #769685 #788590 #792584 #793139 #797042 #797175 #800907 #802153 #804154 #804609 #805804 #805945 #806431 #806980 #808647 #809122 #809155 #809748 #809895 #810580 #810624 #810722 #812281 #814719 #815356 #815444 #815745 #816443 #816451 #816586 #816668 #816708 #817010 #817339 #818053 #818327 #818371 #818514 #818516 #818798 #819295 #819519 #819655 #819789 #820434 #821560 #821930 #822431 #822722 Cross-References: CVE-2013-0160 CVE-2013-1979 CVE-2013-3076 CVE-2013-3222 CVE-2013-3223 CVE-2013-3224 CVE-2013-3225 CVE-2013-3227 CVE-2013-3228 CVE-2013-3229 CVE-2013-3231 CVE-2013-3232 CVE-2013-3234 CVE-2013-3235 Affected Products: SUSE Linux Enterprise Real Time 11 SP2 ______________________________________________________________________________ An update that solves 14 vulnerabilities and has 38 fixes is now available. It includes one version update. Description: The SUSE Linux Enterprise 11 Service Pack 2 kernel has been updated to Linux kernel 3.0.80 which fixes various bugs and security issues. The following security issues have been fixed: * CVE-2013-0160: Timing side channel on attacks were possible on /dev/ptmx that could allow local attackers to predict keypresses like e.g. passwords. This hasbeen fixed again by updating accessed/modified time on the pty devices in resolution of 8 seconds, so that idle time detection can still work. * CVE-2013-3222: The vcc_recvmsg function in net/atm/common.c in the Linux kernel did not initialize a certain length variable, which allowed local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call. * CVE-2013-3223: The ax25_recvmsg function in net/ax25/af_ax25.c in the Linux kernel did not initialize a certain data structure, which allowed local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call. * CVE-2013-3224: The bt_sock_recvmsg function in net/bluetooth/af_bluetooth.c in the Linux kernel did not properly initialize a certain length variable, which allowed local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call. * CVE-2013-3225: The rfcomm_sock_recvmsg function in net/bluetooth/rfcomm/sock.c in the Linux kernel did not initialize a certain length variable, which allowed local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call. * CVE-2013-3227: The caif_seqpkt_recvmsg function in net/caif/caif_socket.c in the Linux kernel did not initialize a certain length variable, which allowed local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call. * CVE-2013-3228: The irda_recvmsg_dgram function in net/irda/af_irda.c in the Linux kernel did not initialize a certain length variable, which allowed local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call. * CVE-2013-3229: The iucv_sock_recvmsg function in net/iucv/af_iucv.c in the Linux kernel did not initialize a certain length variable, whichallowed local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call. * CVE-2013-3231: The llc_ui_recvmsg function in net/llc/af_llc.c in the Linux kernel did not initialize a certain length variable, which allowed local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call. * CVE-2013-3232: The nr_recvmsg function in net/netrom/af_netrom.c in the Linux kernel did not initialize a certain data structure, which allowed local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call. * CVE-2013-3234: The rose_recvmsg function in net/rose/af_rose.c in the Linux kernel did not initialize a certain data structure, which allowed local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call. * CVE-2013-3235: net/tipc/socket.c in the Linux kernel did not initialize a certain data structure and a certain length variable, which allowed local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call. * CVE-2013-3076: The crypto API in the Linux kernel did not initialize certain length variables, which allowed local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call, related to the hash_recvmsg function in crypto/algif_hash.c and the skcipher_recvmsg function in crypto/algif_skcipher.c. * CVE-2013-1979: The scm_set_cred function in include/net/scm.h in the Linux kernel used incorrect uid and gid values during credentials passing, which allowed local users to gain privileges via a crafted application. * A kernel information leak via tkill/tgkill was fixed. The following bugs have been fixed: * reiserfs: fix spurious multiple-fill in reiserfs_readdir_dentry(bnc#822722). * libfc: do not exch_done() on invalid sequence ptr (bnc#810722). * netfilter: ip6t_LOG: fix logging of packet mark (bnc#821930). * hyperv: use 3.4 as LIC version string (bnc#822431). * virtio_net: introduce VIRTIO_NET_HDR_F_DATA_VALID (bnc#819655). * xen/netback: do not disconnect frontend when seeing oversize packet. * xen/netfront: reduce gso_max_size to account for max TCP header. * xen/netfront: fix kABI after "reduce gso_max_size to account for max TCP header". * xfs: Fix kABI due to change in xfs_buf (bnc#815356). * xfs: fix race while discarding buffers [V4] (bnc#815356 (comment 36)). * xfs: Serialize file-extending direct IO (bnc#818371). * xhci: Do not switch webcams in some HP ProBooks to XHCI (bnc#805804). * bluetooth: Do not switch BT on HP ProBook 4340 (bnc#812281). * s390/ftrace: fix mcount adjustment (bnc#809895). * mm: memory_dev_init make sure nmi watchdog does not trigger while registering memory sections (bnc#804609, bnc#820434). * patches.fixes/xfs-backward-alloc-fix.diff: xfs: Avoid pathological backwards allocation (bnc#805945). * mm: compaction: Restart compaction from near where it left off * mm: compaction: cache if a pageblock was scanned and no pages were isolated * mm: compaction: clear PG_migrate_skip based on compaction and reclaim activity * mm: compaction: Scan PFN caching KABI workaround * mm: page_allocator: Remove first_pass guard * mm: vmscan: do not stall on writeback during memory compaction Cache compaction restart points for faster compaction cycles (bnc#816451) * qlge: fix dma map leak when the last chunk is not allocated (bnc#819519). * SUNRPC: Get rid of the redundant xprt-> shutdown bit field (bnc#800907). * SUNRPC: Ensure that we grab the XPRT_LOCK before calling xprt_alloc_slot (bnc#800907). * SUNRPC: Fix a UDP transport regression (bnc#800907). * SUNRPC: Allow caller of rpc_sleep_on() to select priority levels(bnc#800907). * SUNRPC: Replace xprt-> resend and xprt-> sending with a priority queue (bnc#800907). * SUNRPC: Fix potential races in xprt_lock_write_next() (bnc#800907). * md: cannot re-add disks after recovery (bnc#808647). * fs/xattr.c:getxattr(): improve handling of allocation failures (bnc#818053). * fs/xattr.c:listxattr(): fall back to vmalloc() if kmalloc() failed (bnc#818053). * fs/xattr.c:setxattr(): improve handling of allocation failures (bnc#818053). * fs/xattr.c: suppress page allocation failure warnings from sys_listxattr() (bnc#818053). * virtio-blk: Call revalidate_disk() upon online disk resize (bnc#817339). * usb-storage: CY7C68300A chips do not support Cypress ATACB (bnc#819295). * patches.kernel.org/patch-3.0.60-61: Update references (add bnc#810580). * usb: Using correct way to clear usb3.0 devices remote wakeup feature (bnc#818516). * xhci: Fix TD size for isochronous URBs (bnc#818514). * ALSA: hda - fixup D3 pin and right channel mute on Haswell HDMI audio (bnc#818798). * ALSA: hda - Apply pin-enablement workaround to all Haswell HDMI codecs (bnc#818798). * xfs: fallback to vmalloc for large buffers in xfs_attrmulti_attr_get (bnc#818053). * xfs: fallback to vmalloc for large buffers in xfs_attrlist_by_handle (bnc#818053). * xfs: xfs: fallback to vmalloc for large buffers in xfs_compat_attrlist_by_handle (bnc#818053). * xHCI: store rings type. * xhci: Fix hang on back-to-back Set TR Deq Ptr commands. * xHCI: check enqueue pointer advance into dequeue seg. * xHCI: store rings last segment and segment numbers. * xHCI: Allocate 2 segments for transfer ring. * xHCI: count free TRBs on transfer ring. * xHCI: factor out segments allocation and free function. * xHCI: update sg tablesize. * xHCI: set cycle state when allocate rings. * xhci: Reserve one command for USB3 LPM disable. * xHCI: dynamic ring expansion. * xhci: Do not warn on empty ring for suspendeddevices. * md/raid1: Do not release reference to device while handling read error (bnc#809122, bnc#814719). * rpm/mkspec: Stop generating the get_release_number.sh file. * rpm/kernel-spec-macros: Properly handle KOTD release numbers with .g suffix. * rpm/kernel-spec-macros: Drop the %release_num macro We no longer put the -rcX tag into the release string. * rpm/kernel-*.spec.in, rpm/mkspec: Do not force the " " string in specfiles. * mm/mmap: check for RLIMIT_AS before unmapping (bnc#818327). * mm: Fix add_page_wait_queue() to work for PG_Locked bit waiters (bnc#792584). * mm: Fix add_page_wait_queue() to work for PG_Locked bit waiters (bnc#792584). * bonding: only use primary address for ARP (bnc#815444). * bonding: remove entries for master_ip and vlan_ip and query devices instead (bnc#815444). * mm: speedup in __early_pfn_to_nid (bnc#810624). * TTY: fix atime/mtime regression (bnc#815745). * sd_dif: problem with verify of type 1 protection information (PI) (bnc#817010). * sched: harden rq rt usage accounting (bnc#769685, bnc#788590). * rcu: Avoid spurious RCU CPU stall warnings (bnc#816586). * rcu: Dump local stack if cannot dump all CPUs stacks (bnc#816586). * rcu: Fix detection of abruptly-ending stall (bnc#816586). * rcu: Suppress NMI backtraces when stall ends before dump (bnc#816586). * Update Xen patches to 3.0.74. * btrfs: do not re-enter when allocating a chunk. * btrfs: save us a read_lock. * btrfs: Check CAP_DAC_READ_SEARCH for BTRFS_IOC_INO_PATHS. * btrfs: remove unused fs_info from btrfs_decode_error(). * btrfs: handle null fs_info in btrfs_panic(). * btrfs: fix varargs in __btrfs_std_error. * btrfs: fix the race between bio and btrfs_stop_workers. * btrfs: fix NULL pointer after aborting a transaction. * btrfs: fix infinite loop when we abort on mount. * xfs: Do not allocate new buffers on every call to _xfs_buf_find (bnc#763968). * xfs: fix bufferlookup race on allocation failure (bnc#763968). Security Issue references: * CVE-2013-0160 * CVE-2013-3076 * CVE-2013-3222 * CVE-2013-3223 * CVE-2013-3224 * CVE-2013-3225 * CVE-2013-3227 * CVE-2013-3228 * CVE-2013-3229 * CVE-2013-3231 * CVE-2013-3232 * CVE-2013-3234 * CVE-2013-3235 * CVE-2013-1979 Indications: Everyone using the Real Time Linux Kernel on x86_64 architecture should update. Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Real Time 11 SP2: zypper in -t patch slertesp2-kernel-7828 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Real Time 11 SP2 (x86_64) [New Version: 3.0.80.rt108]: cluster-network-kmp-rt-1.4_3.0.80_rt108_0.5-2.18.47 cluster-network-kmp-rt_trace-1.4_3.0.80_rt108_0.5-2.18.47 drbd-kmp-rt-8.4.2_3.0.80_rt108_0.5-0.6.6.38 drbd-kmp-rt_trace-8.4.2_3.0.80_rt108_0.5-0.6.6.38 iscsitarget-kmp-rt-1.4.20_3.0.80_rt108_0.5-0.23.44 iscsitarget-kmp-rt_trace-1.4.20_3.0.80_rt108_0.5-0.23.44 kernel-rt-3.0.80.rt108-0.5.1 kernel-rt-base-3.0.80.rt108-0.5.1 kernel-rt-devel-3.0.80.rt108-0.5.1 kernel-rt_trace-3.0.80.rt108-0.5.1 kernel-rt_trace-base-3.0.80.rt108-0.5.1 kernel-rt_trace-devel-3.0.80.rt108-0.5.1 kernel-source-rt-3.0.80.rt108-0.5.1 kernel-syms-rt-3.0.80.rt108-0.5.1 lttng-modules-kmp-rt-2.0.4_3.0.80_rt108_0.5-0.7.35 lttng-modules-kmp-rt_trace-2.0.4_3.0.80_rt108_0.5-0.7.35 ocfs2-kmp-rt-1.6_3.0.80_rt108_0.5-0.11.46 ocfs2-kmp-rt_trace-1.6_3.0.80_rt108_0.5-0.11.46 ofed-kmp-rt-1.5.2_3.0.80_rt108_0.5-0.28.28.18 ofed-kmp-rt_trace-1.5.2_3.0.80_rt108_0.5-0.28.28.18 References: https://www.suse.com/security/cve/CVE-2013-0160.html https://www.suse.com/security/cve/CVE-2013-1979.html https://www.suse.com/security/cve/CVE-2013-3076.html https://www.suse.com/security/cve/CVE-2013-3222.html https://www.suse.com/security/cve/CVE-2013-3223.html https://www.suse.com/security/cve/CVE-2013-3224.html https://www.suse.com/security/cve/CVE-2013-3225.html https://www.suse.com/security/cve/CVE-2013-3227.html https://www.suse.com/security/cve/CVE-2013-3228.html https://www.suse.com/security/cve/CVE-2013-3229.html https://www.suse.com/security/cve/CVE-2013-3231.html https://www.suse.com/security/cve/CVE-2013-3232.html https://www.suse.com/security/cve/CVE-2013-3234.html https://www.suse.com/security/cve/CVE-2013-3235.html . The recent SUSE patch resolves various vulnerabilities within the Linux kernel, strengthening protection for impacted environments through critical updates.. Linux Kernel Security Update,SUSE Important Advisory,Kernel Fixes,Local Attacks. . Severity: Important. LinuxSecurity.com Team

Jun 18, 2013 •Important SuSE

security advisoryinformation leakimportant

SUSE Linux 11 SP2: 2013:1022-2 Important Kernel Information Leak Fix

An update that solves 14 vulnerabilities and has 38 fixes An update that solves 14 vulnerabilities and has 38 fixes An update that solves 14 vulnerabilities and has 38 fixes is now available. It includes one version update. is now available. It includes one version update.. SUSE Security Update: Security update for Linux kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:1022-2 Rating: important References: #763968 #764209 #768052 #769685 #788590 #792584 #793139 #797042 #797175 #800907 #802153 #804154 #804609 #805804 #805945 #806431 #806980 #808647 #809122 #809155 #809748 #809895 #810580 #810624 #810722 #812281 #814719 #815356 #815444 #815745 #816443 #816451 #816586 #816668 #816708 #817010 #817339 #818053 #818327 #818371 #818514 #818516 #818798 #819295 #819519 #819655 #819789 #820434 #821560 #821930 #822431 #822722 Cross-References: CVE-2013-0160 CVE-2013-1979 CVE-2013-3076 CVE-2013-3222 CVE-2013-3223 CVE-2013-3224 CVE-2013-3225 CVE-2013-3227 CVE-2013-3228 CVE-2013-3229 CVE-2013-3231 CVE-2013-3232 CVE-2013-3234 CVE-2013-3235 Affected Products: SUSE Linux Enterprise Server 11 SP2 for VMware SUSE Linux Enterprise Server 11 SP2 SUSE Linux Enterprise High Availability Extension 11 SP2 SUSE Linux Enterprise Desktop 11 SP2 ______________________________________________________________________________ An update that solves 14 vulnerabilities and has 38 fixes is now available. It includes one version update. Description: The SUSE Linux Enterprise 11 Service Pack 2 kernel has been updated to Linux kernel 3.0.80 which fixes various bugs and security issues. The following securityissues have been fixed: * CVE-2013-0160: Timing side channel on attacks were possible on /dev/ptmx that could allow local attackers to predict keypresses like e.g. passwords. This has been fixed again by updating accessed/modified time on the pty devices in resolution of 8 seconds, so that idle time detection can still work. * CVE-2013-3222: The vcc_recvmsg function in net/atm/common.c in the Linux kernel did not initialize a certain length variable, which allowed local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call. * CVE-2013-3223: The ax25_recvmsg function in net/ax25/af_ax25.c in the Linux kernel did not initialize a certain data structure, which allowed local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call. * CVE-2013-3224: The bt_sock_recvmsg function in net/bluetooth/af_bluetooth.c in the Linux kernel did not properly initialize a certain length variable, which allowed local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call. * CVE-2013-3225: The rfcomm_sock_recvmsg function in net/bluetooth/rfcomm/sock.c in the Linux kernel did not initialize a certain length variable, which allowed local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call. * CVE-2013-3227: The caif_seqpkt_recvmsg function in net/caif/caif_socket.c in the Linux kernel did not initialize a certain length variable, which allowed local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call. * CVE-2013-3228: The irda_recvmsg_dgram function in net/irda/af_irda.c in the Linux kernel did not initialize a certain length variable, which allowed local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call. * CVE-2013-3229: The iucv_sock_recvmsg function in net/iucv/af_iucv.c in the Linux kernel did not initialize a certain length variable, which allowed local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call. * CVE-2013-3231: The llc_ui_recvmsg function in net/llc/af_llc.c in the Linux kernel did not initialize a certain length variable, which allowed local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call. * CVE-2013-3232: The nr_recvmsg function in net/netrom/af_netrom.c in the Linux kernel did not initialize a certain data structure, which allowed local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call. * CVE-2013-3234: The rose_recvmsg function in net/rose/af_rose.c in the Linux kernel did not initialize a certain data structure, which allowed local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call. * CVE-2013-3235: net/tipc/socket.c in the Linux kernel did not initialize a certain data structure and a certain length variable, which allowed local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call. * CVE-2013-3076: The crypto API in the Linux kernel did not initialize certain length variables, which allowed local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call, related to the hash_recvmsg function in crypto/algif_hash.c and the skcipher_recvmsg function in crypto/algif_skcipher.c. * CVE-2013-1979: The scm_set_cred function in include/net/scm.h in the Linux kernel used incorrect uid and gid values during credentials passing, which allowed local users to gain privileges via a craftedapplication. * A kernel information leak via tkill/tgkill was fixed. The following bugs have been fixed: * reiserfs: fix spurious multiple-fill in reiserfs_readdir_dentry (bnc#822722). * libfc: do not exch_done() on invalid sequence ptr (bnc#810722). * netfilter: ip6t_LOG: fix logging of packet mark (bnc#821930). * hyperv: use 3.4 as LIC version string (bnc#822431). * virtio_net: introduce VIRTIO_NET_HDR_F_DATA_VALID (bnc#819655). * xen/netback: do not disconnect frontend when seeing oversize packet. * xen/netfront: reduce gso_max_size to account for max TCP header. * xen/netfront: fix kABI after "reduce gso_max_size to account for max TCP header". * xfs: Fix kABI due to change in xfs_buf (bnc#815356). * xfs: fix race while discarding buffers [V4] (bnc#815356 (comment 36)). * xfs: Serialize file-extending direct IO (bnc#818371). * xhci: Do not switch webcams in some HP ProBooks to XHCI (bnc#805804). * bluetooth: Do not switch BT on HP ProBook 4340 (bnc#812281). * s390/ftrace: fix mcount adjustment (bnc#809895). * mm: memory_dev_init make sure nmi watchdog does not trigger while registering memory sections (bnc#804609, bnc#820434). * patches.fixes/xfs-backward-alloc-fix.diff: xfs: Avoid pathological backwards allocation (bnc#805945). * mm: compaction: Restart compaction from near where it left off * mm: compaction: cache if a pageblock was scanned and no pages were isolated * mm: compaction: clear PG_migrate_skip based on compaction and reclaim activity * mm: compaction: Scan PFN caching KABI workaround * mm: page_allocator: Remove first_pass guard * mm: vmscan: do not stall on writeback during memory compaction Cache compaction restart points for faster compaction cycles (bnc#816451) * qlge: fix dma map leak when the last chunk is not allocated (bnc#819519). * SUNRPC: Get rid of the redundant xprt-> shutdown bit field (bnc#800907). * SUNRPC: Ensure that we grab theXPRT_LOCK before calling xprt_alloc_slot (bnc#800907). * SUNRPC: Fix a UDP transport regression (bnc#800907). * SUNRPC: Allow caller of rpc_sleep_on() to select priority levels (bnc#800907). * SUNRPC: Replace xprt-> resend and xprt-> sending with a priority queue (bnc#800907). * SUNRPC: Fix potential races in xprt_lock_write_next() (bnc#800907). * md: cannot re-add disks after recovery (bnc#808647). * fs/xattr.c:getxattr(): improve handling of allocation failures (bnc#818053). * fs/xattr.c:listxattr(): fall back to vmalloc() if kmalloc() failed (bnc#818053). * fs/xattr.c:setxattr(): improve handling of allocation failures (bnc#818053). * fs/xattr.c: suppress page allocation failure warnings from sys_listxattr() (bnc#818053). * virtio-blk: Call revalidate_disk() upon online disk resize (bnc#817339). * usb-storage: CY7C68300A chips do not support Cypress ATACB (bnc#819295). * patches.kernel.org/patch-3.0.60-61: Update references (add bnc#810580). * usb: Using correct way to clear usb3.0 devices remote wakeup feature (bnc#818516). * xhci: Fix TD size for isochronous URBs (bnc#818514). * ALSA: hda - fixup D3 pin and right channel mute on Haswell HDMI audio (bnc#818798). * ALSA: hda - Apply pin-enablement workaround to all Haswell HDMI codecs (bnc#818798). * xfs: fallback to vmalloc for large buffers in xfs_attrmulti_attr_get (bnc#818053). * xfs: fallback to vmalloc for large buffers in xfs_attrlist_by_handle (bnc#818053). * xfs: xfs: fallback to vmalloc for large buffers in xfs_compat_attrlist_by_handle (bnc#818053). * xHCI: store rings type. * xhci: Fix hang on back-to-back Set TR Deq Ptr commands. * xHCI: check enqueue pointer advance into dequeue seg. * xHCI: store rings last segment and segment numbers. * xHCI: Allocate 2 segments for transfer ring. * xHCI: count free TRBs on transfer ring. * xHCI: factor out segments allocation and free function. * xHCI: update sg tablesize. * xHCI: set cycle state when allocate rings. * xhci: Reserve one command for USB3 LPM disable. * xHCI: dynamic ring expansion. * xhci: Do not warn on empty ring for suspended devices. * md/raid1: Do not release reference to device while handling read error (bnc#809122, bnc#814719). * rpm/mkspec: Stop generating the get_release_number.sh file. * rpm/kernel-spec-macros: Properly handle KOTD release numbers with .g suffix. * rpm/kernel-spec-macros: Drop the %release_num macro We no longer put the -rcX tag into the release string. * rpm/kernel-*.spec.in, rpm/mkspec: Do not force the " " string in specfiles. * mm/mmap: check for RLIMIT_AS before unmapping (bnc#818327). * mm: Fix add_page_wait_queue() to work for PG_Locked bit waiters (bnc#792584). * mm: Fix add_page_wait_queue() to work for PG_Locked bit waiters (bnc#792584). * bonding: only use primary address for ARP (bnc#815444). * bonding: remove entries for master_ip and vlan_ip and query devices instead (bnc#815444). * mm: speedup in __early_pfn_to_nid (bnc#810624). * TTY: fix atime/mtime regression (bnc#815745). * sd_dif: problem with verify of type 1 protection information (PI) (bnc#817010). * sched: harden rq rt usage accounting (bnc#769685, bnc#788590). * rcu: Avoid spurious RCU CPU stall warnings (bnc#816586). * rcu: Dump local stack if cannot dump all CPUs stacks (bnc#816586). * rcu: Fix detection of abruptly-ending stall (bnc#816586). * rcu: Suppress NMI backtraces when stall ends before dump (bnc#816586). * Update Xen patches to 3.0.74. * btrfs: do not re-enter when allocating a chunk. * btrfs: save us a read_lock. * btrfs: Check CAP_DAC_READ_SEARCH for BTRFS_IOC_INO_PATHS. * btrfs: remove unused fs_info from btrfs_decode_error(). * btrfs: handle null fs_info in btrfs_panic(). * btrfs: fix varargs in __btrfs_std_error. * btrfs: fix the race between bio and btrfs_stop_workers. * btrfs: fix NULL pointerafter aborting a transaction. * btrfs: fix infinite loop when we abort on mount. * xfs: Do not allocate new buffers on every call to _xfs_buf_find (bnc#763968). * xfs: fix buffer lookup race on allocation failure (bnc#763968). Security Issue references: * CVE-2013-0160 * CVE-2013-3076 * CVE-2013-3222 * CVE-2013-3223 * CVE-2013-3224 * CVE-2013-3225 * CVE-2013-3227 * CVE-2013-3228 * CVE-2013-3229 * CVE-2013-3231 * CVE-2013-3232 * CVE-2013-3234 * CVE-2013-3235 * CVE-2013-1979 Indications: Everyone using the Linux Kernel on x86_64 architecture should update. Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP2 for VMware: zypper in -t patch slessp2-kernel-7811 slessp2-kernel-7814 - SUSE Linux Enterprise Server 11 SP2: zypper in -t patch slessp2-kernel-7811 slessp2-kernel-7812 slessp2-kernel-7813 slessp2-kernel-7814 slessp2-kernel-7819 - SUSE Linux Enterprise High Availability Extension 11 SP2: zypper in -t patch sleshasp2-kernel-7811 sleshasp2-kernel-7812 sleshasp2-kernel-7813 sleshasp2-kernel-7814 sleshasp2-kernel-7819 - SUSE Linux Enterprise Desktop 11 SP2: zypper in -t patch sledsp2-kernel-7811 sledsp2-kernel-7814 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP2 for VMware (i586 x86_64) [New Version: 3.0.80]: kernel-default-3.0.80-0.5.1 kernel-default-base-3.0.80-0.5.1 kernel-default-devel-3.0.80-0.5.1 kernel-source-3.0.80-0.5.1 kernel-syms-3.0.80-0.5.1 kernel-trace-3.0.80-0.5.1 kernel-trace-base-3.0.80-0.5.1 kernel-trace-devel-3.0.80-0.5.1 kernel-xen-devel-3.0.80-0.5.1 - SUSE LinuxEnterprise Server 11 SP2 for VMware (x86_64): xen-kmp-trace-4.1.5_02_3.0.80_0.5-0.5.5 - SUSE Linux Enterprise Server 11 SP2 for VMware (i586) [New Version: 3.0.80]: kernel-pae-3.0.80-0.5.1 kernel-pae-base-3.0.80-0.5.1 kernel-pae-devel-3.0.80-0.5.1 - SUSE Linux Enterprise Server 11 SP2 (i586 ia64 ppc64 s390x x86_64) [New Version: 3.0.80]: kernel-default-3.0.80-0.5.1 kernel-default-base-3.0.80-0.5.1 kernel-default-devel-3.0.80-0.5.1 kernel-source-3.0.80-0.5.1 kernel-syms-3.0.80-0.5.1 kernel-trace-3.0.80-0.5.1 kernel-trace-base-3.0.80-0.5.1 kernel-trace-devel-3.0.80-0.5.1 - SUSE Linux Enterprise Server 11 SP2 (i586 x86_64) [New Version: 3.0.80]: kernel-ec2-3.0.80-0.5.1 kernel-ec2-base-3.0.80-0.5.1 kernel-ec2-devel-3.0.80-0.5.1 kernel-xen-3.0.80-0.5.1 kernel-xen-base-3.0.80-0.5.1 kernel-xen-devel-3.0.80-0.5.1 - SUSE Linux Enterprise Server 11 SP2 (x86_64): xen-kmp-default-4.1.5_02_3.0.80_0.5-0.5.5 xen-kmp-trace-4.1.5_02_3.0.80_0.5-0.5.5 - SUSE Linux Enterprise Server 11 SP2 (s390x) [New Version: 3.0.80]: kernel-default-man-3.0.80-0.5.1 - SUSE Linux Enterprise Server 11 SP2 (ppc64) [New Version: 3.0.80]: kernel-ppc64-3.0.80-0.5.1 kernel-ppc64-base-3.0.80-0.5.1 kernel-ppc64-devel-3.0.80-0.5.1 - SUSE Linux Enterprise Server 11 SP2 (i586) [New Version: 3.0.80]: kernel-pae-3.0.80-0.5.1 kernel-pae-base-3.0.80-0.5.1 kernel-pae-devel-3.0.80-0.5.1 - SUSE Linux Enterprise High Availability Extension 11 SP2 (i586 ia64 ppc64 s390x x86_64): cluster-network-kmp-default-1.4_3.0.80_0.5-2.18.45 cluster-network-kmp-trace-1.4_3.0.80_0.5-2.18.45 gfs2-kmp-default-2_3.0.80_0.5-0.7.76 gfs2-kmp-trace-2_3.0.80_0.5-0.7.76 ocfs2-kmp-default-1.6_3.0.80_0.5-0.11.44 ocfs2-kmp-trace-1.6_3.0.80_0.5-0.11.44 - SUSE Linux Enterprise High Availability Extension 11 SP2 (i586 x86_64): cluster-network-kmp-xen-1.4_3.0.80_0.5-2.18.45 gfs2-kmp-xen-2_3.0.80_0.5-0.7.76 ocfs2-kmp-xen-1.6_3.0.80_0.5-0.11.44 - SUSE Linux Enterprise High Availability Extension 11 SP2 (ppc64): cluster-network-kmp-ppc64-1.4_3.0.80_0.5-2.18.45 gfs2-kmp-ppc64-2_3.0.80_0.5-0.7.76 ocfs2-kmp-ppc64-1.6_3.0.80_0.5-0.11.44 - SUSE Linux Enterprise High Availability Extension 11 SP2 (i586): cluster-network-kmp-pae-1.4_3.0.80_0.5-2.18.45 gfs2-kmp-pae-2_3.0.80_0.5-0.7.76 ocfs2-kmp-pae-1.6_3.0.80_0.5-0.11.44 - SUSE Linux Enterprise Desktop 11 SP2 (i586 x86_64) [New Version: 3.0.80]: kernel-default-3.0.80-0.5.1 kernel-default-base-3.0.80-0.5.1 kernel-default-devel-3.0.80-0.5.1 kernel-default-extra-3.0.80-0.5.1 kernel-source-3.0.80-0.5.1 kernel-syms-3.0.80-0.5.1 kernel-trace-3.0.80-0.5.1 kernel-trace-base-3.0.80-0.5.1 kernel-trace-devel-3.0.80-0.5.1 kernel-trace-extra-3.0.80-0.5.1 kernel-xen-3.0.80-0.5.1 kernel-xen-base-3.0.80-0.5.1 kernel-xen-devel-3.0.80-0.5.1 kernel-xen-extra-3.0.80-0.5.1 - SUSE Linux Enterprise Desktop 11 SP2 (x86_64): xen-kmp-default-4.1.5_02_3.0.80_0.5-0.5.5 xen-kmp-trace-4.1.5_02_3.0.80_0.5-0.5.5 - SUSE Linux Enterprise Desktop 11 SP2 (i586) [New Version: 3.0.80]: kernel-pae-3.0.80-0.5.1 kernel-pae-base-3.0.80-0.5.1 kernel-pae-devel-3.0.80-0.5.1 kernel-pae-extra-3.0.80-0.5.1 References: https://www.suse.com/security/cve/CVE-2013-0160.html https://www.suse.com/security/cve/CVE-2013-1979.html https://www.suse.com/security/cve/CVE-2013-3076.html https://www.suse.com/security/cve/CVE-2013-3222.html https://www.suse.com/security/cve/CVE-2013-3223.html https://www.suse.com/security/cve/CVE-2013-3224.html https://www.suse.com/security/cve/CVE-2013-3225.html https://www.suse.com/security/cve/CVE-2013-3227.html https://www.suse.com/security/cve/CVE-2013-3228.html https://www.suse.com/security/cve/CVE-2013-3229.html https://www.suse.com/security/cve/CVE-2013-3231.html https://www.suse.com/security/cve/CVE-2013-3232.html https://www.suse.com/security/cve/CVE-2013-3234.html https://www.suse.com/security/cve/CVE-2013-3235.html . The Linux kernel has been bolstered with patches addressing 14 notable security flaws, aiming to fortify defenses against potential exploits and cybersecurity weaknesses.. Linux Kernel Update, SUSE Security Update, System Vulnerabilities, Threat Defense, Linux Security Issues. . Severity: Important. LinuxSecurity.com Team

Jun 17, 2013 •Important SuSE

Community Poll

More Polls

Should Linux servers automatically install security updates?

Yes — critical security patches should install automatically.
No — every update should be tested before deployment.
Only critical vulnerabilities should auto-install.
I patch when Reddit starts panicking.

Stay Secure with the Latest Linux Advisories

Rocky Linux 8 RLSA-2026-42550 kernel-rt Important Security Fixes

Rocky Linux RLSA-2026-42552 Kernel Important Security Fix

Rocky Linux RLSA-2026-42733 glibc Moderate Information Disclosure and DoS

Fedora 43 Kernel Important Security Fix for net/can 2026-f1fc7772c3

Fedora 43 Nuclei Important Cross-site Scripting DoS Threat 2026-d36ca2dd19

Fedora 43 perl-Crypt-OpenSSL-X509 Important Fix CVE-2026-58101

Fedora 43 rust-syslog Critical Path Traversal DoS Vuln 2026-659cb50390

Fedora 43 Rust RPKI Critical Path Traversal Issues Fix 2026-659cb50390

Fedora 43 Routinator Important Security Fixes CVE-2026-49232 to 49235

Refine advisories

Get the latest News and Insights

Community Poll

Should Linux servers automatically install security updates?

Trending News

Ubuntu 24.04 Linux Kernel High Copy Fail Escalation USN-8277-2

Fedora 42 Kernel Important Security Fix Update 2026-b9f338a467

Ubuntu 26.04 LTS Samba Critical Update Denial of Service USN-8306-1

Ubuntu 24.04 LTS Linux Kernel Critical Security Issues Vuln 8373-1

Explore Latest Linux Security advisories

Ubuntu 22.04 & 20.04 USN-6704-4 Moderate: Kernel Denial Of Service Risks

Ubuntu 20.04 LTS USN-6681-4 Critical: Denial of Service Fixes

SUSE 15 SP4: 2023:4072-1 Important Kernel Security Update

Ubuntu 18.04 LTS USN-6396-1 Critical: Kernel Denial Of Service Risks

SUSE Linux Enterprise Server: 2018:0115-1 Important Kernel Security Update

SUSE: 2013:1022-3 Important: Linux Kernel Local Attack Fixes

SUSE Linux 11 SP2: 2013:1022-2 Important Kernel Information Leak Fix

Get the latest News and Insights

Community Poll

Should Linux servers automatically install security updates?

Trending News

Ubuntu 24.04 Linux Kernel High Copy Fail Escalation USN-8277-2

Fedora 42 Kernel Important Security Fix Update 2026-b9f338a467

Ubuntu 26.04 LTS Samba Critical Update Denial of Service USN-8306-1

Ubuntu 24.04 LTS Linux Kernel Critical Security Issues Vuln 8373-1

Powered By

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases

QUICK LINKS

subscribe to newsletters!

Stay Secure with the Latest Linux Advisories

Rocky Linux 8 RLSA-2026-42550 kernel-rt Important Security Fixes

Rocky Linux RLSA-2026-42552 Kernel Important Security Fix

Rocky Linux RLSA-2026-42733 glibc Moderate Information Disclosure and DoS

Fedora 43 Kernel Important Security Fix for net/can 2026-f1fc7772c3

Fedora 43 Nuclei Important Cross-site Scripting DoS Threat 2026-d36ca2dd19

Fedora 43 perl-Crypt-OpenSSL-X509 Important Fix CVE-2026-58101

Fedora 43 rust-syslog Critical Path Traversal DoS Vuln 2026-659cb50390

Fedora 43 Rust RPKI Critical Path Traversal Issues Fix 2026-659cb50390

Fedora 43 Routinator Important Security Fixes CVE-2026-49232 to 49235

Refine advisories

severity

Topics

Distro

Published Date

Get the latest News and Insights

Community Poll

Should Linux servers automatically install security updates?

Trending News

Explore Latest Linux Security advisories

Get the latest News and Insights

Community Poll

Should Linux servers automatically install security updates?

Trending News

Search Topics

Powered By

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases

QUICK LINKS

subscribe to newsletters!