Security update for the Linux Kernel (Live Patch 29 for SLE 15 SP2)

Announcement ID:	SUSE-SU-2023:2405-1
Rating:	important
References:	bsc#1207188 bsc#1208911 bsc#1209683 bsc#1210417 bsc#1210500 bsc#1210662 bsc#1211111
Cross-References:	CVE-2023-0461 CVE-2023-1281 CVE-2023-1872 CVE-2023-1989 CVE-2023-2162 CVE-2023-23454 CVE-2023-28464
CVSS scores:	CVE-2023-0461 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2023-0461 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2023-1281 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2023-1281 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2023-1872 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2023-1872 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2023-1989 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2023-1989 ( NVD ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2023-2162 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2023-2162 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2023-23454 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2023-23454 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2023-28464 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2023-28464 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products:	openSUSE Leap 15.3 SUSE Linux Enterprise High Performance Computing 15 SP2 SUSE Linux Enterprise High Performance Computing 15 SP3 SUSE Linux Enterprise Live Patching 15-SP2 SUSE Linux Enterprise Live Patching 15-SP3 SUSE Linux Enterprise Micro 5.1 SUSE Linux Enterprise Micro 5.2 SUSE Linux Enterprise Server 15 SP2 SUSE Linux Enterprise Server 15 SP3 SUSE Linux Enterprise Server for SAP Applications 15 SP2 SUSE Linux Enterprise Server for SAP Applications 15 SP3

An update that solves seven vulnerabilities can now be installed.

Description:

This update for the Linux Kernel 5.3.18-150200_24_126 fixes several issues.

The following security issues were fixed:

• CVE-2023-28464: Fixed user-after-free that could lead to privilege escalation in hci_conn_cleanup in net/uetooth/hci_conn.c (bsc#1211111).
• CVE-2023-1989: Fixed a use after free in btsdio_remove (bsc#1210500).
• CVE-2023-1872: Fixed a use after free vulnerability in the io_uring subsystem, which could lead to local privilege escalation (bsc#1210417).
• CVE-2023-1281: Fixed use after free that could lead to privilege escalation in tcindex (bsc#1209683).
• CVE-2023-2162: Fixed an use-after-free flaw in iscsi_sw_tcp_session_create (bsc#1210662).
• CVE-2023-0461: Fixed use-after-free in icsk_ulp_data (bsc#1208911).
• CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207188).

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• SUSE Linux Enterprise Live Patching 15-SP2
  zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP2-2023-2405=1 SUSE-SLE-Module-Live-Patching-15-SP2-2023-2406=1 SUSE-SLE-Module-Live-Patching-15-SP2-2023-2396=1 SUSE-SLE-Module-Live-Patching-15-SP2-2023-2407=1 SUSE-SLE-Module-Live-Patching-15-SP2-2023-2397=1
• openSUSE Leap 15.3
  zypper in -t patch SUSE-2023-2402=1 SUSE-2023-2408=1 SUSE-2023-2409=1 SUSE-2023-2410=1 SUSE-2023-2414=1 SUSE-2023-2417=1 SUSE-2023-2418=1
• SUSE Linux Enterprise Live Patching 15-SP3
  zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP3-2023-2402=1 SUSE-SLE-Module-Live-Patching-15-SP3-2023-2408=1 SUSE-SLE-Module-Live-Patching-15-SP3-2023-2409=1 SUSE-SLE-Module-Live-Patching-15-SP3-2023-2410=1 SUSE-SLE-Module-Live-Patching-15-SP3-2023-2414=1 SUSE-SLE-Module-Live-Patching-15-SP3-2023-2417=1 SUSE-SLE-Module-Live-Patching-15-SP3-2023-2418=1

Package List:

• SUSE Linux Enterprise Live Patching 15-SP2 (ppc64le s390x x86_64)
  • kernel-livepatch-5_3_18-150200_24_145-default-3-150200.2.3
  • kernel-livepatch-5_3_18-150200_24_142-default-4-150200.2.3
  • kernel-livepatch-5_3_18-150200_24_126-default-11-150200.2.3
  • kernel-livepatch-5_3_18-150200_24_145-default-debuginfo-3-150200.2.3
  • kernel-livepatch-SLE15-SP2_Update_33-debugsource-4-150200.2.3
  • kernel-livepatch-5_3_18-150200_24_129-default-8-150200.2.3
  • kernel-livepatch-SLE15-SP2_Update_31-debugsource-8-150200.2.3
  • kernel-livepatch-5_3_18-150200_24_134-default-debuginfo-8-150200.2.3
  • kernel-livepatch-5_3_18-150200_24_134-default-8-150200.2.3
  • kernel-livepatch-SLE15-SP2_Update_29-debugsource-11-150200.2.3
  • kernel-livepatch-5_3_18-150200_24_129-default-debuginfo-8-150200.2.3
  • kernel-livepatch-5_3_18-150200_24_126-default-debuginfo-11-150200.2.3
  • kernel-livepatch-SLE15-SP2_Update_34-debugsource-3-150200.2.3
  • kernel-livepatch-5_3_18-150200_24_142-default-debuginfo-4-150200.2.3
  • kernel-livepatch-SLE15-SP2_Update_30-debugsource-8-150200.2.3
• openSUSE Leap 15.3 (ppc64le s390x x86_64)
  • kernel-livepatch-5_3_18-150300_59_106-default-debuginfo-5-150300.2.3
  • kernel-livepatch-5_3_18-150300_59_98-default-8-150300.2.3
  • kernel-livepatch-5_3_18-150300_59_112-default-debuginfo-4-150300.2.3
  • kernel-livepatch-5_3_18-150300_59_115-default-debuginfo-3-150300.2.3
  • kernel-livepatch-SLE15-SP3_Update_30-debugsource-3-150300.2.3
  • kernel-livepatch-5_3_18-150300_59_98-default-debuginfo-8-150300.2.3
  • kernel-livepatch-5_3_18-150300_59_71-default-debuginfo-14-150300.2.3
  • kernel-livepatch-5_3_18-150300_59_93-default-10-150300.2.3
  • kernel-livepatch-5_3_18-150300_59_71-default-14-150300.2.3
  • kernel-livepatch-5_3_18-150300_59_93-default-debuginfo-10-150300.2.3
  • kernel-livepatch-5_3_18-150300_59_101-default-7-150300.2.3
  • kernel-livepatch-5_3_18-150300_59_106-default-5-150300.2.3
  • kernel-livepatch-SLE15-SP3_Update_26-debugsource-7-150300.2.3
  • kernel-livepatch-5_3_18-150300_59_115-default-3-150300.2.3
  • kernel-livepatch-SLE15-SP3_Update_27-debugsource-5-150300.2.3
  • kernel-livepatch-SLE15-SP3_Update_24-debugsource-10-150300.2.3
  • kernel-livepatch-5_3_18-150300_59_112-default-4-150300.2.3
  • kernel-livepatch-SLE15-SP3_Update_25-debugsource-8-150300.2.3
  • kernel-livepatch-5_3_18-150300_59_101-default-debuginfo-7-150300.2.3
  • kernel-livepatch-SLE15-SP3_Update_19-debugsource-14-150300.2.3
  • kernel-livepatch-SLE15-SP3_Update_29-debugsource-4-150300.2.3
• openSUSE Leap 15.3 (x86_64)
  • kernel-livepatch-5_3_18-150300_59_101-preempt-7-150300.2.3
  • kernel-livepatch-5_3_18-150300_59_98-preempt-debuginfo-8-150300.2.3
  • kernel-livepatch-5_3_18-150300_59_98-preempt-8-150300.2.3
  • kernel-livepatch-5_3_18-150300_59_101-preempt-debuginfo-7-150300.2.3
  • kernel-livepatch-5_3_18-150300_59_112-preempt-debuginfo-4-150300.2.3
  • kernel-livepatch-5_3_18-150300_59_93-preempt-debuginfo-10-150300.2.3
  • kernel-livepatch-5_3_18-150300_59_71-preempt-debuginfo-14-150300.2.3
  • kernel-livepatch-5_3_18-150300_59_112-preempt-4-150300.2.3
  • kernel-livepatch-5_3_18-150300_59_71-preempt-14-150300.2.3
  • kernel-livepatch-5_3_18-150300_59_106-preempt-debuginfo-5-150300.2.3
  • kernel-livepatch-5_3_18-150300_59_115-preempt-3-150300.2.3
  • kernel-livepatch-5_3_18-150300_59_115-preempt-debuginfo-3-150300.2.3
  • kernel-livepatch-5_3_18-150300_59_106-preempt-5-150300.2.3
  • kernel-livepatch-5_3_18-150300_59_93-preempt-10-150300.2.3
• SUSE Linux Enterprise Live Patching 15-SP3 (ppc64le s390x x86_64)
  • kernel-livepatch-5_3_18-150300_59_93-default-10-150300.2.3
  • kernel-livepatch-5_3_18-150300_59_71-default-14-150300.2.3
  • kernel-livepatch-5_3_18-150300_59_101-default-7-150300.2.3
  • kernel-livepatch-5_3_18-150300_59_112-default-4-150300.2.3
  • kernel-livepatch-5_3_18-150300_59_106-default-5-150300.2.3
  • kernel-livepatch-5_3_18-150300_59_115-default-3-150300.2.3
  • kernel-livepatch-5_3_18-150300_59_98-default-8-150300.2.3

References:

• https://www.suse.com/security/cve/CVE-2023-0461.html
• https://www.suse.com/security/cve/CVE-2023-1281.html
• https://www.suse.com/security/cve/CVE-2023-1872.html
• https://www.suse.com/security/cve/CVE-2023-1989.html
• https://www.suse.com/security/cve/CVE-2023-2162.html
• https://www.suse.com/security/cve/CVE-2023-23454.html
• https://www.suse.com/security/cve/CVE-2023-28464.html
• https://bugzilla.suse.com/show_bug.cgi?id=1207188
• https://bugzilla.suse.com/show_bug.cgi?id=1208911
• https://bugzilla.suse.com/show_bug.cgi?id=1209683
• https://bugzilla.suse.com/show_bug.cgi?id=1210417
• https://bugzilla.suse.com/show_bug.cgi?id=1210500
• https://bugzilla.suse.com/show_bug.cgi?id=1210662
• https://bugzilla.suse.com/show_bug.cgi?id=1211111