Security update for the Linux Kernel

Announcement ID: SUSE-SU-2024:1650-1
Rating: important
References:
Cross-References:
CVSS scores:
  • CVE-2021-46955 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
  • CVE-2021-47041 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  • CVE-2021-47074 ( SUSE ): 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
  • CVE-2021-47113 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  • CVE-2021-47131 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2021-47184 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  • CVE-2021-47185 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  • CVE-2021-47194 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  • CVE-2021-47194 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2021-47198 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  • CVE-2021-47198 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2021-47201 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  • CVE-2021-47203 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  • CVE-2021-47206 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  • CVE-2021-47207 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  • CVE-2021-47212 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  • CVE-2022-48631 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  • CVE-2022-48651 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2022-48654 ( SUSE ): 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
  • CVE-2022-48687 ( SUSE ): 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
  • CVE-2023-2860 ( SUSE ): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
  • CVE-2023-2860 ( NVD ): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
  • CVE-2023-6270 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2023-6270 ( NVD ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2024-0639 ( SUSE ): 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
  • CVE-2024-0639 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  • CVE-2024-0841 ( SUSE ): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
  • CVE-2024-0841 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2024-22099 ( SUSE ): 5.3 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
  • CVE-2024-22099 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  • CVE-2024-23307 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2024-23307 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2024-26688 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  • CVE-2024-26689 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  • CVE-2024-26733 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  • CVE-2024-26739 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  • CVE-2024-26744 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  • CVE-2024-26816 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
  • CVE-2024-26840 ( SUSE ): 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
  • CVE-2024-26852 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2024-26862 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
  • CVE-2024-26898 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2024-26898 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2024-26903 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  • CVE-2024-26903 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  • CVE-2024-26906 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  • CVE-2024-27043 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products:
  • SUSE Linux Enterprise High Availability Extension 15 SP2
  • SUSE Linux Enterprise High Performance Computing 15 SP2
  • SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2
  • SUSE Linux Enterprise Live Patching 15-SP2
  • SUSE Linux Enterprise Server 15 SP2
  • SUSE Linux Enterprise Server 15 SP2 Business Critical Linux 15-SP2
  • SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2
  • SUSE Linux Enterprise Server for SAP Applications 15 SP2
  • SUSE Manager Proxy 4.1
  • SUSE Manager Retail Branch Server 4.1
  • SUSE Manager Server 4.1

An update that solves 37 vulnerabilities and has three security fixes can now be installed.

Description:

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

  • CVE-2024-26840: Fixed a memory leak in cachefiles_add_cache() (bsc#1222976).
  • CVE-2021-47113: Abort btrfs rename_exchange if we fail to insert the second ref (bsc#1221543).
  • CVE-2021-47131: Fixed a use-after-free after the TLS device goes down and up (bsc#1221545).
  • CVE-2024-26852: Fixed net/ipv6 to avoid possible UAF in ip6_route_mpath_notify() (bsc#1223057).
  • CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets (bsc#1220513).
  • CVE-2024-26862: Fixed packet annotate data-races around ignore_outgoing (bsc#1223111).
  • CVE-2024-0639: Fixed a denial-of-service vulnerability due to a deadlock found in sctp_auto_asconf_init in net/sctp/socket.c (bsc#1218917).
  • CVE-2024-27043: Fixed a use-after-free in edia/dvbdev in different places (bsc#1223824).
  • CVE-2022-48631: Fixed a bug in ext4, when parsing extents where eh_entries == 0 and eh_depth > 0 (bsc#1223475).
  • CVE-2024-23307: Fixed Integer Overflow or Wraparound vulnerability in x86 and ARM md, raid, raid5 modules (bsc#1219169).
  • CVE-2022-48651: Fixed an out-of-bound bug in ipvlan caused by unset skb->mac_header (bsc#1223513).
  • CVE-2024-26816: Fixed relocations in .notes section when building with CONFIG_XEN_PV=y by ignoring them (bsc#1222624).
  • CVE-2024-26906: Disallowed vsyscall page read for copy_from_kernel_nofault() (bsc#1223202).
  • CVE-2024-26689: Fixed a use-after-free in encode_cap_msg() (bsc#1222503).
  • CVE-2021-47041: Don't set sk_user_data without write_lock (bsc#1220755).
  • CVE-2021-47074: Fixed memory leak in nvme_loop_create_ctrl() (bsc#1220854).
  • CVE-2024-26744: Fixed null pointer dereference in srpt_service_guid parameter in rdma/srpt (bsc#1222449).

The following non-security bugs were fixed:

  • net/tls: Remove the context from the list in tls_device_down (bsc#1221545).
  • tls: Fix context leak on tls_device_down (bsc#1221545).

Special Instructions and Notes:

  • Please reboot the system after installing this update.

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

  • SUSE Linux Enterprise Live Patching 15-SP2
    zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP2-2024-1650=1
  • SUSE Linux Enterprise High Availability Extension 15 SP2
    zypper in -t patch SUSE-SLE-Product-HA-15-SP2-2024-1650=1
  • SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2
    zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2024-1650=1
  • SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2
    zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2024-1650=1
  • SUSE Linux Enterprise Server for SAP Applications 15 SP2
    zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2024-1650=1

Package List:

  • SUSE Linux Enterprise Live Patching 15-SP2 (nosrc)
    • kernel-default-5.3.18-150200.24.191.1
  • SUSE Linux Enterprise Live Patching 15-SP2 (ppc64le s390x x86_64)
    • kernel-livepatch-5_3_18-150200_24_191-default-debuginfo-1-150200.5.3.1
    • kernel-livepatch-SLE15-SP2_Update_48-debugsource-1-150200.5.3.1
    • kernel-default-livepatch-5.3.18-150200.24.191.1
    • kernel-default-debuginfo-5.3.18-150200.24.191.1
    • kernel-livepatch-5_3_18-150200_24_191-default-1-150200.5.3.1
    • kernel-default-livepatch-devel-5.3.18-150200.24.191.1
    • kernel-default-debugsource-5.3.18-150200.24.191.1
  • SUSE Linux Enterprise High Availability Extension 15 SP2 (aarch64 ppc64le s390x x86_64)
    • cluster-md-kmp-default-5.3.18-150200.24.191.1
    • ocfs2-kmp-default-debuginfo-5.3.18-150200.24.191.1
    • gfs2-kmp-default-5.3.18-150200.24.191.1
    • cluster-md-kmp-default-debuginfo-5.3.18-150200.24.191.1
    • gfs2-kmp-default-debuginfo-5.3.18-150200.24.191.1
    • kernel-default-debuginfo-5.3.18-150200.24.191.1
    • dlm-kmp-default-5.3.18-150200.24.191.1
    • ocfs2-kmp-default-5.3.18-150200.24.191.1
    • dlm-kmp-default-debuginfo-5.3.18-150200.24.191.1
    • kernel-default-debugsource-5.3.18-150200.24.191.1
  • SUSE Linux Enterprise High Availability Extension 15 SP2 (nosrc)
    • kernel-default-5.3.18-150200.24.191.1
  • SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (aarch64 nosrc x86_64)
    • kernel-default-5.3.18-150200.24.191.1
    • kernel-preempt-5.3.18-150200.24.191.1
  • SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (aarch64 x86_64)
    • kernel-default-base-5.3.18-150200.24.191.1.150200.9.97.1
    • kernel-preempt-devel-debuginfo-5.3.18-150200.24.191.1
    • kernel-obs-build-5.3.18-150200.24.191.1
    • kernel-syms-5.3.18-150200.24.191.1
    • kernel-preempt-debugsource-5.3.18-150200.24.191.1
    • kernel-obs-build-debugsource-5.3.18-150200.24.191.1
    • kernel-default-devel-5.3.18-150200.24.191.1
    • kernel-default-debuginfo-5.3.18-150200.24.191.1
    • kernel-preempt-debuginfo-5.3.18-150200.24.191.1
    • kernel-default-devel-debuginfo-5.3.18-150200.24.191.1
    • kernel-preempt-devel-5.3.18-150200.24.191.1
    • kernel-default-debugsource-5.3.18-150200.24.191.1
  • SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (noarch)
    • kernel-macros-5.3.18-150200.24.191.1
    • kernel-source-5.3.18-150200.24.191.1
    • kernel-devel-5.3.18-150200.24.191.1
  • SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (noarch nosrc)
    • kernel-docs-5.3.18-150200.24.191.1
  • SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (aarch64 ppc64le s390x x86_64 nosrc)
    • kernel-default-5.3.18-150200.24.191.1
  • SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (aarch64 ppc64le s390x x86_64)
    • kernel-default-base-5.3.18-150200.24.191.1.150200.9.97.1
    • kernel-obs-build-5.3.18-150200.24.191.1
    • kernel-syms-5.3.18-150200.24.191.1
    • reiserfs-kmp-default-5.3.18-150200.24.191.1
    • kernel-obs-build-debugsource-5.3.18-150200.24.191.1
    • kernel-default-devel-5.3.18-150200.24.191.1
    • kernel-default-debuginfo-5.3.18-150200.24.191.1
    • reiserfs-kmp-default-debuginfo-5.3.18-150200.24.191.1
    • kernel-default-devel-debuginfo-5.3.18-150200.24.191.1
    • kernel-default-debugsource-5.3.18-150200.24.191.1
  • SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (noarch)
    • kernel-macros-5.3.18-150200.24.191.1
    • kernel-source-5.3.18-150200.24.191.1
    • kernel-devel-5.3.18-150200.24.191.1
  • SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (noarch nosrc)
    • kernel-docs-5.3.18-150200.24.191.1
  • SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (aarch64 nosrc x86_64)
    • kernel-preempt-5.3.18-150200.24.191.1
  • SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (aarch64 x86_64)
    • kernel-preempt-debugsource-5.3.18-150200.24.191.1
    • kernel-preempt-devel-debuginfo-5.3.18-150200.24.191.1
    • kernel-preempt-debuginfo-5.3.18-150200.24.191.1
    • kernel-preempt-devel-5.3.18-150200.24.191.1
  • SUSE Linux Enterprise Server for SAP Applications 15 SP2 (nosrc ppc64le x86_64)
    • kernel-default-5.3.18-150200.24.191.1
  • SUSE Linux Enterprise Server for SAP Applications 15 SP2 (ppc64le x86_64)
    • kernel-default-base-5.3.18-150200.24.191.1.150200.9.97.1
    • kernel-obs-build-5.3.18-150200.24.191.1
    • kernel-syms-5.3.18-150200.24.191.1
    • reiserfs-kmp-default-5.3.18-150200.24.191.1
    • kernel-obs-build-debugsource-5.3.18-150200.24.191.1
    • kernel-default-devel-5.3.18-150200.24.191.1
    • kernel-default-debuginfo-5.3.18-150200.24.191.1
    • reiserfs-kmp-default-debuginfo-5.3.18-150200.24.191.1
    • kernel-default-devel-debuginfo-5.3.18-150200.24.191.1
    • kernel-default-debugsource-5.3.18-150200.24.191.1
  • SUSE Linux Enterprise Server for SAP Applications 15 SP2 (noarch)
    • kernel-macros-5.3.18-150200.24.191.1
    • kernel-source-5.3.18-150200.24.191.1
    • kernel-devel-5.3.18-150200.24.191.1
  • SUSE Linux Enterprise Server for SAP Applications 15 SP2 (noarch nosrc)
    • kernel-docs-5.3.18-150200.24.191.1
  • SUSE Linux Enterprise Server for SAP Applications 15 SP2 (nosrc x86_64)
    • kernel-preempt-5.3.18-150200.24.191.1
  • SUSE Linux Enterprise Server for SAP Applications 15 SP2 (x86_64)
    • kernel-preempt-debugsource-5.3.18-150200.24.191.1
    • kernel-preempt-devel-debuginfo-5.3.18-150200.24.191.1
    • kernel-preempt-debuginfo-5.3.18-150200.24.191.1
    • kernel-preempt-devel-5.3.18-150200.24.191.1

References: