Security update for the Linux Kernel
The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2023-1077: Fixed a type confusion in pick_next_rt_entity() that could cause memory corruption (bsc#1208600). - CVE-2023-4623: Fixed a use-after-free issue in the HFSC network scheduler which could be exploited to achieve local privilege escalation (bsc#1215115). - CVE-2023-1192: Fixed use-after-free in cifs_demultiplex_thread() (bsc#1208995). - CVE-2023-20588: Fixed a potential data leak that could be triggered through a side channel when division by zero occurred on some AMD processors (bsc#1213927). - CVE-2023-4459: Fixed a NULL pointer dereference flaw in the vmxnet3 driver that may have allowed a local attacker with user privileges to cause a denial of service (bsc#1214451). - CVE-2023-3772: Fixed a flaw in the XFRM subsystem that may have allowed a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer leading to denial of service (bsc#1213666). - CVE-2023-2007: Removed the dpt_i2o driver due to security issues (bsc#1210448, jsc#PED-4579). - CVE-2023-4385: Fixed a NULL pointer dereference flaw in dbFree that may have allowed a local attacker to crash the system due to a missing sanity check (bsc#1214348).
02 / AFFECTED SOFTWARE
Affected packages
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2023-1077: Fixed a type confusion in pick_next_rt_entity() that could cause memory corruption (bsc#1208600). - CVE-2023-4623: Fixed a use-after-free issue in the HFSC network scheduler which could be exploited to achieve local privilege escalation (bsc#1215115). - CVE-2023-1192: Fixed use-after-free in cifs_demultiplex_thread() (bsc#1208995). - CVE-2023-20588: Fixed a potential data leak that could be triggered through a side channel when division by zero occurred on some AMD processors (bsc#1213927). - CVE-2023-4459: Fixed a NULL pointer dereference flaw in the vmxnet3 driver that may have allowed a local attacker with user privileges to cause a denial of service (bsc#1214451). - CVE-2023-3772: Fixed a flaw in the XFRM subsystem that may have allowed a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer leading to denial of service (bsc#1213666). - CVE-2023-2007: Removed the dpt_i2o driver due to security issues (bsc#1210448, jsc#PED-4579). - CVE-2023-4385: Fixed a NULL pointer dereference flaw in dbFree that may have allowed a local attacker to crash the system due to a missing sanity check (bsc#1214348).
05 / REFERENCES
Further evidence
- https://bugzilla.suse.com/1208600
- https://bugzilla.suse.com/1208995
- https://bugzilla.suse.com/1210448
- https://bugzilla.suse.com/1213666
- https://bugzilla.suse.com/1213927
- https://bugzilla.suse.com/1214348
- https://bugzilla.suse.com/1214451
- https://bugzilla.suse.com/1215115
- https://www.suse.com/security/cve/CVE-2023-1077
- https://www.suse.com/security/cve/CVE-2023-1192
- https://www.suse.com/security/cve/CVE-2023-2007
- https://www.suse.com/security/cve/CVE-2023-20588
- https://www.suse.com/security/cve/CVE-2023-3772
- https://www.suse.com/security/cve/CVE-2023-4385
- https://www.suse.com/security/cve/CVE-2023-4459
- https://www.suse.com/security/cve/CVE-2023-4623
- https://www.suse.com/support/update/announcement/2023/suse-su-20234028-1/