Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2023-20593: Fixed a ZenBleed issue in 'Zen 2' CPUs that could allow an attacker to potentially access sensitive information (bsc#1213286). - CVE-2023-2985: Fixed an use-after-free vulnerability in hfsplus_put_super in fs/hfsplus/super.c that could allow a local user to cause a denial of service (bsc#1211867). - CVE-2023-35001: Fixed an out-of-bounds memory access flaw in nft_byteorder that could allow a local attacker to escalate their privilege (bsc#1213059). - CVE-2022-40982: A transient execution attack called 'Gather Data Sampling' affecting is mitigated, together with respective Intel CPU Microcode updates (bsc#1206418, CVE-2022-40982). - CVE-2023-0459: Fixed that copy_from_user on 64-bit versions of the Linux kernel did not implement the __uaccess_begin_nospec allowing a user to bypass the 'access_ok' check which could be used to leak information (bsc#1211738). - CVE-2023-20569: A side channel attack known as ‘Inception’ or ‘RAS Poisoning’ may allow an attacker to influence branch prediction, potentially leading to information disclosure. (bsc#1213287). - CVE-2023-3567: A use-after-free flaw was found in vcs_read in drivers/tty/vt/vc_screen.c in vc_screen. This flaw allowed an attacker with local user access to cause a system crash or leak internal kernel information (bsc#1213167bsc#1213842). - CVE-2023-3609: A use-after-free vulnerability was fixed in net/sched: cls_u32 component can be exploited to achieve local privilege escalation. If tcf_change_indev() fails, u32_set_parms() will immediately return an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability. (bsc#1213586). - CVE-2023-3611: An out-of-bounds write vulnerability was fixed in net/sched: sch_qfq component can be exploited to achieve local privilege escalation. The qfq_change_agg() function in net/sched/sch_qfq.c allowed an out-of-bounds write because lmax is updated according to packet sizes without bounds checks. (bsc#1213585). - CVE-2023-3776: A use-after-free vulnerability was fixed in net/sched: cls_fw component can be exploited to achieve local privilege escalation. If tcf_change_indev() fails, fw_set_parms() will immediately return an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability. (bsc#1213588). The following non-security bugs were fixed: - Fix double fget() in vhost_net_set_backend() (git-fixes). - NFSv4.1: Always send a RECLAIM_COMPLETE after establishing lease (git-fixes). - SUNRPC: Fix UAF in svc_tcp_listen_data_ready() (git-fixes). - SUNRPC: remove the maximum number of retries in call_bind_status (git-fixes). - block: Fix a source code comment in include/uapi/linux/blkzoned.h (git-fixes). - livepatch: check kzalloc return values (git-fixes). - media: videodev2.h: Fix struct v4l2_input tuner index comment (git-fixes). - net/sched: sch_qfq: refactor parsing of netlink parameters (bsc#1213585). - net: skip virtio_net_hdr_set_proto if protocol already set (git-fixes). - net: virtio_net_hdr_to_skb: count transport header in UFO (git-fixes). - nfsd: fix double fget() bug in __write_ports_addfd() (git-fixes). - powerpc/64: Update Speculation_Store_Bypass in /proc/<pid>/status (bsc#1188885 ltc#193722 git-fixes). - powerpc/security: Fix Speculation_Store_Bypass reporting on Power10 (bsc#1188885 ltc#193722 git-fixes). - rpm/check-for-config-changes: ignore also RISCV_ISA_* and DYNAMIC_SIGFRAME They depend on CONFIG_TOOLCHAIN_HAS_*. - s390/cio: add dev_busid sysfs entry for each subchannel (bsc#1207526). - s390/cio: check the subchannel validity for dev_busid (bsc#1207526). - s390/cio: introduce io_subchannel_type (bsc#1207526). - s390/cpum_sf: Adjust sampling interval to avoid hitting sample limits (git-fixes bsc#1213827). - s390/maccess: add no DAT mode to kernel_write (git-fixes bsc#1213825). - s390/numa: move initial setup of node_to_cpumask_map (git-fixes bsc#1213766). - scsi: qla2xxx: Adjust IOCB resource on qpair create (bsc#1213747). - scsi: qla2xxx: Array index may go out of bound (bsc#1213747). - scsi: qla2xxx: Avoid fcport pointer dereference (bsc#1213747). - scsi: qla2xxx: Check valid rport returned by fc_bsg_to_rport() (bsc#1213747). - scsi: qla2xxx: Correct the index of array (bsc#1213747). - scsi: qla2xxx: Drop useless LIST_HEAD (bsc#1213747). - scsi: qla2xxx: Fix NULL pointer dereference in target mode (bsc#1213747). - scsi: qla2xxx: Fix TMF leak through (bsc#1213747). - scsi: qla2xxx: Fix buffer overrun (bsc#1213747). - scsi: qla2xxx: Fix command flush during TMF (bsc#1213747). - scsi: qla2xxx: Fix deletion race condition (bsc#1213747). - scsi: qla2xxx: Fix end of loop test (bsc#1213747). - scsi: qla2xxx: Fix erroneous link up failure (bsc#1213747). - scsi: qla2xxx: Fix error code in qla2x00_start_sp() (bsc#1213747). - scsi: qla2xxx: Fix potential NULL pointer dereference (bsc#1213747). - scsi: qla2xxx: Fix session hang in gnl (bsc#1213747). - scsi: qla2xxx: Limit TMF to 8 per function (bsc#1213747). - scsi: qla2xxx: Pointer may be dereferenced (bsc#1213747). - scsi: qla2xxx: Remove unused nvme_ls_waitq wait queue (bsc#1213747). - scsi: qla2xxx: Silence a static checker warning (bsc#1213747). - scsi: qla2xxx: Turn off noisy message log (bsc#1213747). - scsi: qla2xxx: Update version to 10.02.08.400-k (bsc#1213747). - scsi: qla2xxx: Update version to 10.02.08.500-k (bsc#1213747). - scsi: qla2xxx: fix inconsistent TMF timeout (bsc#1213747). - svcrdma: Prevent page release when nothing was received (git-fixes). - vfio-ccw: Prevent quiesce function going into an infinite loop (git-fixes bsc#1213819). - vfio-ccw: Release any channel program when releasing/removing vfio-ccw mdev (git-fixes bsc#1213823). - vhost/test: fix build for vhost test (git-fixes). - vhost/vsock: Use kvmalloc/kvfree for larger packets (git-fixes). - vhost/vsock: do not check owner in vhost_vsock_stop() while releasing (git-fixes). - vhost/vsock: fix incorrect used length reported to the guest (git-fixes). - vhost/vsock: fix packet delivery order to monitoring devices (git-fixes). - vhost/vsock: split packets to send using multiple buffers (git-fixes). - vhost: Fix the calculation in vhost_overflow() (git-fixes). - vhost_net: disable zerocopy by default (git-fixes). - vhost_net: fix OoB on sendmsg() failure (git-fixes). - virtio-balloon: fix managed page counts when migrating pages between zones (git-fixes). - virtio-mmio: fix missing put_device() when vm_cmdline_parent registration failed (git-fixes). - virtio-net: Keep stop() to follow mirror sequence of open() (git-fixes). - virtio-pci: Remove wrong address verification in vp_del_vqs() (git-fixes). - virtio: Improve vq->broken access to avoid any compiler optimization (git-fixes). - virtio_net: Fix error handling in virtnet_restore() (git-fixes). - virtio_net: bugfix overflow inside xdp_linearize_page() (git-fixes). - virtio_net: fix xdp_rxq_info bug after suspend/resume (git-fixes). - virtio_ring: Fix querying of maximum DMA mapping size for virtio device (git-fixes). - vringh: Use wiov->used to check for read/write desc order (git-fixes). - vringh: fix __vringh_iov() when riov and wiov are different (git-fixes). - vsock/virtio: stop workers during the .remove() (git-fixes). - vsock/virtio: use RCU to avoid use-after-free on the_virtio_vsock (git-fixes). - xen/blkfront: Only check REQ_FUA for writes (git-fixes).