SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2023:1608-1)

high Nessus Plugin ID 173627

Language:

Synopsis

The remote SUSE host is missing one or more security updates.

Description

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:1608-1 advisory.

- A vulnerability was found in Linux Kernel. It has been classified as problematic. Affected is an unknown function of the file mm/memory.c of the component Driver Handler. The manipulation leads to use after free. It is possible to launch the attack remotely. It is recommended to apply a patch to fix this issue.
The identifier of this vulnerability is VDB-211020. (CVE-2022-3523)

- An out-of-bounds(OOB) memory access vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_kms.c in GPU component in the Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing a denial of service(DoS). (CVE-2022-36280)

- A NULL pointer dereference vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in GPU component of Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing a denial of service(DoS).
(CVE-2022-38096)

- The current implementation of the prctl syscall does not issue an IBPB immediately during the syscall. The ib_prctl_set function updates the Thread Information Flags (TIFs) for the task and updates the SPEC_CTRL MSR on the function __speculation_ctrl_update, but the IBPB is only issued on the next schedule, when the TIF bits are checked. This leaves the victim vulnerable to values already injected on the BTB, prior to the prctl syscall. The patch that added the support for the conditional mitigation via prctl (ib_prctl_set) dates back to the kernel 4.9.176. We recommend upgrading past commit a664ec9158eeddd75121d39c9a0758016097fa96 (CVE-2023-0045)

- A NULL pointer dereference vulnerability in the Linux kernel NVMe functionality, in nvmet_setup_auth(), allows an attacker to perform a Pre-Auth Denial of Service (DoS) attack on a remote machine. Affected versions v6.0-rc1 to v6.0-rc3, fixed in v6.0-rc4. (CVE-2023-0122)

- There is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local privilege escalation. To reach the vulnerability kernel configuration flag CONFIG_TLS or CONFIG_XFRM_ESPINTCP has to be configured, but the operation does not require any privilege. There is a use-after-free bug of icsk_ulp_data of a struct inet_connection_sock. When CONFIG_TLS is enabled, user can install a tls context (struct tls_context) on a connected tcp socket. The context is not cleared if this socket is disconnected and reused as a listener. If a new socket is created from the listener, the context is inherited and vulnerable. The setsockopt TCP_ULP operation does not require any privilege. We recommend upgrading past commit 2c02d41d71f90a5168391b6a5f2954112ba2307c (CVE-2023-0461)

- A use-after-free flaw was found in qdisc_graft in net/sched/sch_api.c in the Linux Kernel due to a race problem. This flaw leads to a denial of service issue. If patch ebda44da44f6 (net: sched: fix race condition in qdisc_graft()) not applied yet, then kernel could be affected. (CVE-2023-0590)

- A flaw possibility of memory leak in the Linux kernel cpu_entry_area mapping of X86 CPU data to memory was found in the way user can guess location of exception stack(s) or other important data. A local user could use this flaw to get access to some important data with expected location in memory. (CVE-2023-0597)

- A flaw was found in the Linux Kernel. The tls_is_tx_ready() incorrectly checks for list emptiness, potentially accessing a type confused entry to the list_head, leaking the last byte of the confused field that overlaps with rec->tx_ready. (CVE-2023-1075)

- A flaw was found in the Linux Kernel. The tun/tap sockets have their socket UID hardcoded to 0 due to a type confusion in their initialization function. While it will be often correct, as tuntap devices require CAP_NET_ADMIN, it may not always be the case, e.g., a non-root user only having that capability. This would make tun/tap sockets being incorrectly treated in filtering/routing decisions, possibly bypassing network filters. (CVE-2023-1076)

- A flaw was found in the Linux Kernel in RDS (Reliable Datagram Sockets) protocol. The rds_rm_zerocopy_callback() uses list_entry() on the head of a list causing a type confusion. Local user can trigger this with rds_message_put(). Type confusion leads to `struct rds_msg_zcopy_info *info` actually points to something else that is potentially controlled by local user. It is known how to trigger this, which causes an out of bounds access, and a lock corruption. (CVE-2023-1078)

- In nf_tables_updtable, if nf_tables_table_enable returns an error, nft_trans_destroy is called to free the transaction object. nft_trans_destroy() calls list_del(), but the transaction was never placed on a list
-- the list head is all zeroes, this results in a NULL pointer dereference. (CVE-2023-1095)

- A flaw use after free in the Linux kernel integrated infrared receiver/transceiver driver was found in the way user detaching rc device. A local user could use this flaw to crash the system or potentially escalate their privileges on the system. (CVE-2023-1118)

- In the Linux kernel before 5.17, an error path in dwc3_qcom_acpi_register_core in drivers/usb/dwc3/dwc3-qcom.c lacks certain platform_device_put and kfree calls. (CVE-2023-22995)

- In the Linux kernel before 6.0.3, drivers/gpu/drm/virtio/virtgpu_object.c misinterprets the drm_gem_shmem_get_sg_table return value (expects it to be NULL in the error case, whereas it is actually an error pointer). (CVE-2023-22998)

- In the Linux kernel before 5.17, drivers/phy/tegra/xusb.c mishandles the tegra_xusb_find_port_node return value. Callers expect NULL in the error case, but an error pointer is used. (CVE-2023-23000)

- In the Linux kernel before 5.16.3, drivers/scsi/ufs/ufs-mediatek.c misinterprets the regulator_get return value (expects it to be NULL in the error case, whereas it is actually an error pointer). (CVE-2023-23001)

- In the Linux kernel before 5.19, drivers/gpu/drm/arm/malidp_planes.c misinterprets the get_sg_table return value (expects it to be NULL in the error case, whereas it is actually an error pointer). (CVE-2023-23004)

- cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service (slab-out-of-bounds read) because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results). (CVE-2023-23454)

- atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results). (CVE-2023-23455)

- In rndis_query_oid in drivers/net/wireless/rndis_wlan.c in the Linux kernel through 6.1.5, there is an integer overflow in an addition. (CVE-2023-23559)

- The Linux kernel through 6.1.9 has a Use-After-Free in bigben_remove in drivers/hid/hid-bigbenff.c via a crafted USB device because the LED controllers remain registered for too long. (CVE-2023-25012)

- In the Linux kernel before 6.1.13, there is a double free in net/mpls/af_mpls.c upon an allocation failure (for registering the sysctl table under a new location) during the renaming of a device. (CVE-2023-26545)

- A NULL pointer dereference flaw was found in the az6027 driver in drivers/media/usb/dev-usb/az6027.c in the Linux Kernel. The message from user space is not checked properly before transferring into the device.
This flaw allows a local user to crash the system or potentially cause a denial of service.
(CVE-2023-28328)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

See Also

https://bugzilla.suse.com/1166486

https://bugzilla.suse.com/1177529

https://bugzilla.suse.com/1193629

https://bugzilla.suse.com/1197534

https://bugzilla.suse.com/1197617

https://bugzilla.suse.com/1198438

https://bugzilla.suse.com/1200054

https://bugzilla.suse.com/1202353

https://bugzilla.suse.com/1202633

https://bugzilla.suse.com/1203200

https://bugzilla.suse.com/1203331

https://bugzilla.suse.com/1203332

https://bugzilla.suse.com/1204363

https://bugzilla.suse.com/1204993

https://bugzilla.suse.com/1205544

https://bugzilla.suse.com/1205846

https://bugzilla.suse.com/1206103

https://bugzilla.suse.com/1206224

https://bugzilla.suse.com/1206232

https://bugzilla.suse.com/1206459

https://bugzilla.suse.com/1206492

https://bugzilla.suse.com/1206493

https://bugzilla.suse.com/1206640

https://bugzilla.suse.com/1206824

https://bugzilla.suse.com/1206877

https://bugzilla.suse.com/1206878

https://bugzilla.suse.com/1206880

https://bugzilla.suse.com/1206881

https://bugzilla.suse.com/1206882

https://bugzilla.suse.com/1206883

https://bugzilla.suse.com/1206884

https://bugzilla.suse.com/1206886

https://bugzilla.suse.com/1206894

https://bugzilla.suse.com/1206935

https://bugzilla.suse.com/1207036

https://bugzilla.suse.com/1207050

https://bugzilla.suse.com/1207051

https://bugzilla.suse.com/1207125

https://bugzilla.suse.com/1207270

https://bugzilla.suse.com/1207328

https://bugzilla.suse.com/1207529

https://bugzilla.suse.com/1207560

https://bugzilla.suse.com/1207588

https://bugzilla.suse.com/1207590

https://bugzilla.suse.com/1207591

https://bugzilla.suse.com/1207592

https://bugzilla.suse.com/1207593

https://bugzilla.suse.com/1207594

https://bugzilla.suse.com/1207603

https://bugzilla.suse.com/1207605

https://bugzilla.suse.com/1207606

https://bugzilla.suse.com/1207608

https://bugzilla.suse.com/1207609

https://bugzilla.suse.com/1207613

https://bugzilla.suse.com/1207615

https://bugzilla.suse.com/1207617

https://bugzilla.suse.com/1207618

https://bugzilla.suse.com/1207619

https://bugzilla.suse.com/1207620

https://bugzilla.suse.com/1207621

https://bugzilla.suse.com/1207623

https://bugzilla.suse.com/1207624

https://bugzilla.suse.com/1207625

https://bugzilla.suse.com/1207626

https://bugzilla.suse.com/1207630

https://bugzilla.suse.com/1207631

https://bugzilla.suse.com/1207632

https://bugzilla.suse.com/1207634

https://bugzilla.suse.com/1207635

https://bugzilla.suse.com/1207636

https://bugzilla.suse.com/1207638

https://bugzilla.suse.com/1207639

https://bugzilla.suse.com/1207640

https://bugzilla.suse.com/1207641

https://bugzilla.suse.com/1207642

https://bugzilla.suse.com/1207643

https://bugzilla.suse.com/1207644

https://bugzilla.suse.com/1207645

https://bugzilla.suse.com/1207646

https://bugzilla.suse.com/1207647

https://bugzilla.suse.com/1207648

https://bugzilla.suse.com/1207649

https://bugzilla.suse.com/1207650

https://bugzilla.suse.com/1207651

https://bugzilla.suse.com/1207652

https://bugzilla.suse.com/1207653

https://bugzilla.suse.com/1207768

https://bugzilla.suse.com/1207770

https://bugzilla.suse.com/1207771

https://bugzilla.suse.com/1207773

https://bugzilla.suse.com/1207795

https://bugzilla.suse.com/1207845

https://bugzilla.suse.com/1207875

https://bugzilla.suse.com/1208149

https://bugzilla.suse.com/1208153

https://bugzilla.suse.com/1208179

https://bugzilla.suse.com/1208183

https://bugzilla.suse.com/1208212

https://bugzilla.suse.com/1208290

https://bugzilla.suse.com/1208420

https://bugzilla.suse.com/1208428

https://bugzilla.suse.com/1208429

https://bugzilla.suse.com/1208449

https://bugzilla.suse.com/1208534

https://bugzilla.suse.com/1208541

https://bugzilla.suse.com/1208542

https://bugzilla.suse.com/1208570

https://bugzilla.suse.com/1208598

https://bugzilla.suse.com/1208599

https://bugzilla.suse.com/1208601

https://bugzilla.suse.com/1208605

https://bugzilla.suse.com/1208607

https://bugzilla.suse.com/1208628

https://bugzilla.suse.com/1208700

https://bugzilla.suse.com/1208741

https://bugzilla.suse.com/1208759

https://bugzilla.suse.com/1208776

https://bugzilla.suse.com/1208777

https://bugzilla.suse.com/1208784

https://bugzilla.suse.com/1208787

https://bugzilla.suse.com/1208816

https://bugzilla.suse.com/1208829

https://bugzilla.suse.com/1208837

https://bugzilla.suse.com/1208843

https://bugzilla.suse.com/1208848

https://bugzilla.suse.com/1209008

https://bugzilla.suse.com/1209159

https://bugzilla.suse.com/1209188

https://bugzilla.suse.com/1209256

https://bugzilla.suse.com/1209258

https://bugzilla.suse.com/1209262

https://bugzilla.suse.com/1209291

https://bugzilla.suse.com/1209436

https://bugzilla.suse.com/1209457

https://bugzilla.suse.com/1209504

https://bugzilla.suse.com/1209572

https://www.suse.com/security/cve/CVE-2022-3523

https://www.suse.com/security/cve/CVE-2022-36280

https://www.suse.com/security/cve/CVE-2022-38096

https://www.suse.com/security/cve/CVE-2023-0045

https://www.suse.com/security/cve/CVE-2023-0122

https://www.suse.com/security/cve/CVE-2023-0461

https://www.suse.com/security/cve/CVE-2023-0590

https://www.suse.com/security/cve/CVE-2023-0597

https://www.suse.com/security/cve/CVE-2023-1075

https://www.suse.com/security/cve/CVE-2023-1076

https://www.suse.com/security/cve/CVE-2023-1078

https://www.suse.com/security/cve/CVE-2023-1095

https://www.suse.com/security/cve/CVE-2023-1118

https://www.suse.com/security/cve/CVE-2023-22995

https://www.suse.com/security/cve/CVE-2023-22998

https://www.suse.com/security/cve/CVE-2023-23000

https://www.suse.com/security/cve/CVE-2023-23001

https://www.suse.com/security/cve/CVE-2023-23004

https://www.suse.com/security/cve/CVE-2023-23454

https://www.suse.com/security/cve/CVE-2023-23455

https://www.suse.com/security/cve/CVE-2023-23559

https://www.suse.com/security/cve/CVE-2023-25012

https://www.suse.com/security/cve/CVE-2023-26545

https://www.suse.com/security/cve/CVE-2023-28328

http://www.nessus.org/u?73d91484

Plugin Details

Severity: High

ID: 173627

File Name: suse_SU-2023-1608-1.nasl

Version: 1.4

Type: local

Agent: unix

Published: 3/29/2023

Updated: 7/14/2023

Supported Sensors: Agentless Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.4

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.1

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N

CVSS Score Source: CVE-2023-0045

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 7

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS Score Source: CVE-2023-23559

Vulnerability Information

CPE: p-cpe:/a:novell:suse_linux:kernel-azure, p-cpe:/a:novell:suse_linux:kernel-azure-devel, p-cpe:/a:novell:suse_linux:kernel-devel-azure, p-cpe:/a:novell:suse_linux:kernel-source-azure, p-cpe:/a:novell:suse_linux:kernel-syms-azure, cpe:/o:novell:suse_linux:15

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 3/28/2023

Vulnerability Publication Date: 9/9/2022

Reference Information

CVE: CVE-2022-3523, CVE-2022-36280, CVE-2022-38096, CVE-2023-0045, CVE-2023-0122, CVE-2023-0461, CVE-2023-0590, CVE-2023-0597, CVE-2023-1075, CVE-2023-1076, CVE-2023-1078, CVE-2023-1095, CVE-2023-1118, CVE-2023-22995, CVE-2023-22998, CVE-2023-23000, CVE-2023-23001, CVE-2023-23004, CVE-2023-23454, CVE-2023-23455, CVE-2023-23559, CVE-2023-25012, CVE-2023-26545, CVE-2023-28328

SuSE: SUSE-SU-2023:1608-1