FlawAtlas
Search the atlas
SUSE-SU-2023:2151-1 Not scored

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2023-2124: Fixed an out of bound access in the XFS subsystem that could have lead to denial-of-service or potentially privilege escalation (bsc#1210498). - CVE-2023-1670: Fixed a use after free in the Xircom 16-bit PCMCIA Ethernet driver. A local user could use this flaw to crash the system or potentially escalate their privileges on the system (bsc#1209871). - CVE-2023-2162: Fixed an use-after-free flaw in iscsi_sw_tcp_session_create (bsc#1210647). - CVE-2023-1998: Fixed a use after free during login when accessing the shost ipaddress (bsc#1210506). - CVE-2023-30772: Fixed a race condition and resultant use-after-free in da9150_charger_remove (bsc#1210329). - CVE-2023-1855: Fixed a use after free in xgene_hwmon_remove (bsc#1210202). - CVE-2023-1989: Fixed a use after free in btsdio_remove (bsc#1210336). - CVE-2023-1990: Fixed a use after free in ndlc_remove (bsc#1210337). - CVE-2022-43945: Fixed a buffer overflow in the NFSD implementation (bsc#1205128). - CVE-2023-1611: Fixed an use-after-free flaw in btrfs_search_slot (bsc#1209687). - CVE-2020-36691: Fixed a denial of service vulnerability via a nested Netlink policy with a back reference (bsc#1209777). The following non-security bugs were fixed: - cifs: fix negotiate context parsing (bsc#1210301). - cred: allow get_cred() and put_cred() to be given NULL (bsc#1209887).

Exploit probability Not scored
Published May 9, 2023
Required by Not available
Last source change February 4, 2026

02 / AFFECTED SOFTWARE

Affected packages

SUSE:Linux Enterprise High Availability Extension 15 SP1 kernel-default
SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS kernel-default
SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS kernel-docs
SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS kernel-obs-build
SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS kernel-source
SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS kernel-syms
SUSE:Linux Enterprise Live Patching 15 SP1 kernel-default
SUSE:Linux Enterprise Live Patching 15 SP1 kernel-livepatch-SLE15-SP1_Update_40
SUSE:Linux Enterprise Server 15 SP1-LTSS kernel-default
SUSE:Linux Enterprise Server 15 SP1-LTSS kernel-docs
SUSE:Linux Enterprise Server 15 SP1-LTSS kernel-obs-build
SUSE:Linux Enterprise Server 15 SP1-LTSS kernel-source
SUSE:Linux Enterprise Server 15 SP1-LTSS kernel-syms
SUSE:Linux Enterprise Server 15 SP1-LTSS kernel-zfcpdump
SUSE:Linux Enterprise Server for SAP Applications 15 SP1 kernel-default
SUSE:Linux Enterprise Server for SAP Applications 15 SP1 kernel-docs
SUSE:Linux Enterprise Server for SAP Applications 15 SP1 kernel-obs-build
SUSE:Linux Enterprise Server for SAP Applications 15 SP1 kernel-source
SUSE:Linux Enterprise Server for SAP Applications 15 SP1 kernel-syms
openSUSE:Leap 15.4 kernel-debug
openSUSE:Leap 15.4 kernel-default
openSUSE:Leap 15.4 kernel-kvmsmall
openSUSE:Leap 15.4 kernel-vanilla
openSUSE:Leap 15.4 kernel-zfcpdump

03 / CONNECTIONS

Connected vulnerabilities

04 / EVIDENCE

Source records

Open Source Vulnerabilities SUSE-SU-2023:2151-1

The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2023-2124: Fixed an out of bound access in the XFS subsystem that could have lead to denial-of-service or potentially privilege escalation (bsc#1210498). - CVE-2023-1670: Fixed a use after free in the Xircom 16-bit PCMCIA Ethernet driver. A local user could use this flaw to crash the system or potentially escalate their privileges on the system (bsc#1209871). - CVE-2023-2162: Fixed an use-after-free flaw in iscsi_sw_tcp_session_create (bsc#1210647). - CVE-2023-1998: Fixed a use after free during login when accessing the shost ipaddress (bsc#1210506). - CVE-2023-30772: Fixed a race condition and resultant use-after-free in da9150_charger_remove (bsc#1210329). - CVE-2023-1855: Fixed a use after free in xgene_hwmon_remove (bsc#1210202). - CVE-2023-1989: Fixed a use after free in btsdio_remove (bsc#1210336). - CVE-2023-1990: Fixed a use after free in ndlc_remove (bsc#1210337). - CVE-2022-43945: Fixed a buffer overflow in the NFSD implementation (bsc#1205128). - CVE-2023-1611: Fixed an use-after-free flaw in btrfs_search_slot (bsc#1209687). - CVE-2020-36691: Fixed a denial of service vulnerability via a nested Netlink policy with a back reference (bsc#1209777). The following non-security bugs were fixed: - cifs: fix negotiate context parsing (bsc#1210301). - cred: allow get_cred() and put_cred() to be given NULL (bsc#1209887).

View original source

05 / REFERENCES

Further evidence