* bsc#1227471 * bsc#1227472 * bsc#1227651 * bsc#1228573 . # Security update for the Linux Kernel (Live Patch 50 for SLE 15 SP2) Announcement ID: SUSE-SU-2024:3768-1 Release Date: 2024-10-29T06:03:43Z Rating: important References: * bsc#1227471 * bsc#1227472 * bsc#1227651 * bsc#1228573 Cross-References: * CVE-2021-47291 * CVE-2021-47598 * CVE-2021-47600 * CVE-2024-41059 CVSS scores: * CVE-2021-47291 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2021-47598 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2021-47598 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2021-47600 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2021-47600 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-41059 ( SUSE ): 7.3 CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2024-41059 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-41059 ( NVD ): 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H Affected Products: * SUSE Linux Enterprise High Performance Computing 15 SP2 * SUSE Linux Enterprise Live Patching 15-SP2 * SUSE Linux Enterprise Server 15 SP2 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 An update that solves four vulnerabilities can now be installed. ## Description: This update for the Linux Kernel 5.3.18-150200_24_197 fixes several issues. The following security issues were fixed: * CVE-2021-47600: dm btree remove: fix use after free in rebalance_children() (bsc#1227472). * CVE-2021-47598: sch_cake: do not call cake_destroy() from cake_init() (bsc#1227471). * CVE-2021-47291: ipv6: fix another slab-out-of-bounds in fib6_nh_flush_exceptions (bsc#1227651). * CVE-2024-41059: hfsplus: fix uninit-value in copy_name (bsc#1228573). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternativelyyou can run the command listed for your product: * SUSE Linux Enterprise Live Patching 15-SP2 zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP2-2024-3768=1 ## Package List: * SUSE Linux Enterprise Live Patching 15-SP2 (ppc64le s390x x86_64) * kernel-livepatch-5_3_18-150200_24_197-default-debuginfo-3-150200.5.6.1 * kernel-livepatch-5_3_18-150200_24_197-default-3-150200.5.6.1 * kernel-livepatch-SLE15-SP2_Update_50-debugsource-3-150200.5.6.1 ## References: * https://www.suse.com/security/cve/CVE-2021-47291.html * https://www.suse.com/security/cve/CVE-2021-47598.html * https://www.suse.com/security/cve/CVE-2021-47600.html * https://www.suse.com/security/cve/CVE-2024-41059.html * https://bugzilla.suse.com/show_bug.cgi?id=1227471 * https://bugzilla.suse.com/show_bug.cgi?id=1227472 * https://bugzilla.suse.com/show_bug.cgi?id=1227651 * https://bugzilla.suse.com/show_bug.cgi?id=1228573 . Critical security enhancement for SUSE Linux Kernel Live Patch 50 tackles various vulnerabilities, reinforcing system safety.. SUSE Linux Kernel, Live Patching, Important Advisory, Security Update. . Severity: Important. LinuxSecurity.com Team
* bsc#1210619 * bsc#1220145 * bsc#1220537 * bsc#1223059 * bsc#1223363 . # Security update for the Linux Kernel (Live Patch 47 for SLE 15 SP2) Announcement ID: SUSE-SU-2024:2344-1 Rating: important References: * bsc#1210619 * bsc#1220145 * bsc#1220537 * bsc#1223059 * bsc#1223363 * bsc#1223514 * bsc#1223683 * bsc#1225211 Cross-References: * CVE-2021-46955 * CVE-2021-47383 * CVE-2022-48651 * CVE-2023-1829 * CVE-2024-23307 * CVE-2024-26828 * CVE-2024-26852 * CVE-2024-26923 CVSS scores: * CVE-2021-46955 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2021-47383 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2022-48651 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-1829 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-1829 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-23307 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-23307 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-26828 ( SUSE ): 7.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H * CVE-2024-26852 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-26923 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: * SUSE Linux Enterprise High Performance Computing 15 SP2 * SUSE Linux Enterprise Live Patching 15-SP2 * SUSE Linux Enterprise Server 15 SP2 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 An update that solves eight vulnerabilities can now be installed. ## Description: This update for the Linux Kernel 5.3.18-150200_24_188 fixes several issues. The following security issues were fixed: * CVE-2021-47383: Fixed out-of-bound vmalloc access in imageblit (bsc#1225211). * CVE-2024-26923: Fixed false-positive lockdep splat for spin_lock() in __unix_gc() (bsc#1223683). * CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223363). *CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets (bsc#1220537). * CVE-2024-23307: Fixed Integer Overflow or Wraparound vulnerability in x86 and ARM md, raid, raid5 modules (bsc#1220145). * CVE-2024-26852: Fixed use-after-free in ip6_route_mpath_notify() (bsc#1223059). * CVE-2022-48651: Fixed an out-of-bound bug in ipvlan caused by unset skb-> mac_header (bsc#1223514). * CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210619). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Live Patching 15-SP2 zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP2-2024-2344=1 ## Package List: * SUSE Linux Enterprise Live Patching 15-SP2 (ppc64le s390x x86_64) * kernel-livepatch-SLE15-SP2_Update_47-debugsource-4-150200.5.6.1 * kernel-livepatch-5_3_18-150200_24_188-default-4-150200.5.6.1 * kernel-livepatch-5_3_18-150200_24_188-default-debuginfo-4-150200.5.6.1 ## References: * https://www.suse.com/security/cve/CVE-2021-46955.html * https://www.suse.com/security/cve/CVE-2021-47383.html * https://www.suse.com/security/cve/CVE-2022-48651.html * https://www.suse.com/security/cve/CVE-2023-1829.html * https://www.suse.com/security/cve/CVE-2024-23307.html * https://www.suse.com/security/cve/CVE-2024-26828.html * https://www.suse.com/security/cve/CVE-2024-26852.html * https://www.suse.com/security/cve/CVE-2024-26923.html * https://bugzilla.suse.com/show_bug.cgi?id=1210619 * https://bugzilla.suse.com/show_bug.cgi?id=1220145 * https://bugzilla.suse.com/show_bug.cgi?id=1220537 * https://bugzilla.suse.com/show_bug.cgi?id=1223059 * https://bugzilla.suse.com/show_bug.cgi?id=1223363 * https://bugzilla.suse.com/show_bug.cgi?id=1223514 * https://bugzilla.suse.com/show_bug.cgi?id=1223683 *https://bugzilla.suse.com/show_bug.cgi?id=1225211 . A recent security patch resolves significant vulnerabilities in SUSE Linux Kernel Live Patch 47 for SLE 15 SP2. Urgent measures necessary.. SUSE Linux Kernel,Patch Update,SLE 15 SP2,Security Fixes,Live Patching. . Severity: Important. LinuxSecurity.com Team
* bsc#1222118 * bsc#1223059 Cross-References: * CVE-2023-52628 . # Security update for the Linux Kernel (Live Patch 15 for SLE 15 SP4) Announcement ID: SUSE-SU-2024:2164-1 Rating: important References: * bsc#1222118 * bsc#1223059 Cross-References: * CVE-2023-52628 * CVE-2024-26852 CVSS scores: * CVE-2023-52628 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-26852 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: * openSUSE Leap 15.4 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise Live Patching 15-SP4 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 An update that solves two vulnerabilities can now be installed. ## Description: This update for the Linux Kernel 5.14.21-150400_24_74 fixes several issues. The following security issues were fixed: * CVE-2023-52628: Fixed 4-byte stack OOB write in nftables (bsc#1222118). * CVE-2024-26852: Fixed use-after-free in ip6_route_mpath_notify() (bsc#1223059). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Live Patching 15-SP4 zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP4-2024-2164=1 * openSUSE Leap 15.4 zypper in -t patch SUSE-2024-2164=1 ## Package List: * SUSE Linux Enterprise Live Patching 15-SP4 (ppc64le s390x x86_64) * kernel-livepatch-SLE15-SP4_Update_15-debugsource-12-150400.2.1 * kernel-livepatch-5_14_21-150400_24_74-default-12-150400.2.1 * kernel-livepatch-5_14_21-150400_24_74-default-debuginfo-12-150400.2.1 * openSUSE Leap 15.4 (ppc64le s390x x86_64) * kernel-livepatch-SLE15-SP4_Update_15-debugsource-12-150400.2.1 *kernel-livepatch-5_14_21-150400_24_74-default-12-150400.2.1 * kernel-livepatch-5_14_21-150400_24_74-default-debuginfo-12-150400.2.1 ## References: * https://www.suse.com/security/cve/CVE-2023-52628.html * https://www.suse.com/security/cve/CVE-2024-26852.html * https://bugzilla.suse.com/show_bug.cgi?id=1222118 * https://bugzilla.suse.com/show_bug.cgi?id=1223059 . Enhancements aimed at rectifying significant vulnerabilities within the Linux Kernel for SUSE, specifically targeting stack overflow and use-after-free flaws.. SUSE Linux Kernel Update, Security Advisory, Live Patch, SLE 15 SP4. . Severity: Important. LinuxSecurity.com Team
Get the latest Linux and open source security news straight to your inbox.