Security update for the Linux Kernel

Announcement ID:	SUSE-SU-2024:4345-1
Release Date:	2024-12-17T08:31:01Z
Rating:	important
References:	bsc#1218644 bsc#1220382 bsc#1221309 bsc#1222590 bsc#1229345 bsc#1229808 bsc#1230220 bsc#1231646 bsc#1232165 bsc#1232187 bsc#1232224 bsc#1232312 bsc#1232436 bsc#1232860 bsc#1232907 bsc#1232919 bsc#1232928 bsc#1233070 bsc#1233117 bsc#1233214 bsc#1233293 bsc#1233453 bsc#1233456 bsc#1233463 bsc#1233468 bsc#1233479 bsc#1233490 bsc#1233491 bsc#1233555 bsc#1233557 bsc#1233561 bsc#1233977
Cross-References:	CVE-2023-52922 CVE-2024-26782 CVE-2024-43854 CVE-2024-44932 CVE-2024-44964 CVE-2024-47757 CVE-2024-49925 CVE-2024-49945 CVE-2024-50017 CVE-2024-50089 CVE-2024-50115 CVE-2024-50125 CVE-2024-50127 CVE-2024-50154 CVE-2024-50205 CVE-2024-50208 CVE-2024-50259 CVE-2024-50264 CVE-2024-50267 CVE-2024-50274 CVE-2024-50279 CVE-2024-50290 CVE-2024-50301 CVE-2024-50302 CVE-2024-53061 CVE-2024-53063 CVE-2024-53068
CVSS scores:	CVE-2023-52922 ( SUSE ): 6.9 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N CVE-2023-52922 ( SUSE ): 6.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H CVE-2023-52922 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2024-26782 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2024-43854 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2024-43854 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2024-44932 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2024-44932 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2024-44964 ( SUSE ): 7.1 CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:L/VI:L/VA:H/SC:H/SI:H/SA:H CVE-2024-44964 ( SUSE ): 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2024-44964 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2024-47757 ( SUSE ): 6.9 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N CVE-2024-47757 ( SUSE ): 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H CVE-2024-47757 ( NVD ): 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H CVE-2024-49925 ( SUSE ): 7.1 CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVE-2024-49925 ( SUSE ): 6.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2024-49925 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2024-49945 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2024-49945 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2024-50017 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2024-50017 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2024-50089 ( SUSE ): 7.1 CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVE-2024-50089 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2024-50089 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2024-50115 ( SUSE ): 4.5 CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:H CVE-2024-50115 ( SUSE ): 7.2 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:H CVE-2024-50115 ( NVD ): 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H CVE-2024-50125 ( SUSE ): 7.5 CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVE-2024-50125 ( SUSE ): 7.1 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2024-50125 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2024-50125 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2024-50127 ( SUSE ): 7.3 CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVE-2024-50127 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2024-50127 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2024-50127 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2024-50154 ( SUSE ): 7.3 CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVE-2024-50154 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2024-50154 ( NVD ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2024-50154 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2024-50205 ( SUSE ): 6.9 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N CVE-2024-50205 ( SUSE ): 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H CVE-2024-50205 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2024-50208 ( SUSE ): 6.9 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N CVE-2024-50208 ( SUSE ): 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H CVE-2024-50208 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2024-50259 ( SUSE ): 8.4 CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVE-2024-50259 ( SUSE ): 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2024-50259 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2024-50264 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2024-50264 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2024-50264 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2024-50267 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2024-50267 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2024-50267 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2024-50274 ( SUSE ): 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H CVE-2024-50274 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2024-50279 ( SUSE ): 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H CVE-2024-50279 ( NVD ): 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H CVE-2024-50290 ( SUSE ): 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H CVE-2024-50301 ( SUSE ): 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H CVE-2024-50301 ( NVD ): 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H CVE-2024-50302 ( SUSE ): 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H CVE-2024-50302 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2024-53061 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2024-53061 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2024-53063 ( SUSE ): 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H CVE-2024-53063 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2024-53068 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2024-53068 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products:	SUSE Linux Enterprise Micro 5.3 SUSE Linux Enterprise Micro 5.4 SUSE Linux Enterprise Micro for Rancher 5.3 SUSE Linux Enterprise Micro for Rancher 5.4

An update that solves 27 vulnerabilities and has five security fixes can now be installed.

Description:

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-26782: mptcp: fix double-free on socket dismantle (bsc#1222590).
• CVE-2024-43854: Initialize integrity buffer to zero before writing it to media (bsc#1229345)
• CVE-2024-44932: idpf: fix UAFs when destroying the queues (bsc#1229808).
• CVE-2024-44964: idpf: fix memory leaks and crashes while performing a soft reset (bsc#1230220).
• CVE-2024-47757: nilfs2: fix potential oob read in nilfs_btree_check_delete() (bsc#1232187).
• CVE-2024-49925: fbdev: efifb: Register sysfs groups through driver core (bsc#1232224)
• CVE-2024-49945: net/ncsi: Disable the ncsi work before freeing the associated structure (bsc#1232165).
• CVE-2024-50089: unicode: Do not special case ignorable code points (bsc#1232860).
• CVE-2024-50115: KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory (bsc#1232919).
• CVE-2024-50125: Bluetooth: SCO: Fix UAF on sco_sock_timeout (bsc#1232928).
• CVE-2024-50127: net: sched: fix use-after-free in taprio_change() (bsc#1232907).
• CVE-2024-50154: tcp/dccp: Do not use timer_pending() in reqsk_queue_unlink() (bsc#1233070).
• CVE-2024-50205: ALSA: firewire-lib: Avoid division by zero in apply_constraint_to_size() (bsc#1233293).
• CVE-2024-50208: RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages (bsc#1233117).
• CVE-2024-50259: netdevsim: Add trailing zero to terminate the string in nsim_nexthop_bucket_activity_write() (bsc#1233214).
• CVE-2024-50264: vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (bsc#1233453).
• CVE-2024-50267: usb: serial: io_edgeport: fix use after free in debug printk (bsc#1233456).
• CVE-2024-50274: idpf: avoid vport access in idpf_get_link_ksettings (bsc#1233463).
• CVE-2024-50279: dm cache: fix out-of-bounds access to the dirty bitset when resizing (bsc#1233468).
• CVE-2024-50290: media: cx24116: prevent overflows on SNR calculus (bsc#1233479).
• CVE-2024-50301: security/keys: fix slab-out-of-bounds in key_task_permission (bsc#1233490).
• CVE-2024-50302: HID: core: zero-initialize the report buffer (bsc#1233491).
• CVE-2024-53061: media: s5p-jpeg: prevent buffer overflows (bsc#1233555).
• CVE-2024-53063: media: dvbdev: prevent the risk of out of memory access (bsc#1233557).
• CVE-2024-53068: firmware: arm_scmi: Fix slab-use-after-free in scmi_bus_notifier() (bsc#1233561).

The following non-security bugs were fixed:

• Update config files (bsc#1218644).
• Update config files. Enabled IDPF for ARM64 (bsc#1221309)
• initramfs: avoid filename buffer overrun (bsc#1232436).
• kernel-binary: Enable livepatch package only when livepatch is enabled Otherwise the filelist may be empty failing the build (bsc#1218644).
• mm/memory: add non-anonymous page check in the copy_present_page() (bsc#1231646).
• rpm/scripts: Remove obsolete Symbols.list Symbols.list is not longer needed by the new klp-convert implementation. (bsc#1218644)
• x86/kexec: Add EFI config table identity mapping for kexec kernel (bsc#1220382).
• x86/mm/ident_map: Use gbpages only where full GB page should be mapped (bsc#1220382).

Special Instructions and Notes:

• Please reboot the system after installing this update.

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• SUSE Linux Enterprise Micro for Rancher 5.3
  zypper in -t patch SUSE-SLE-Micro-5.3-2024-4345=1
• SUSE Linux Enterprise Micro 5.3
  zypper in -t patch SUSE-SLE-Micro-5.3-2024-4345=1
• SUSE Linux Enterprise Micro for Rancher 5.4
  zypper in -t patch SUSE-SLE-Micro-5.4-2024-4345=1
• SUSE Linux Enterprise Micro 5.4
  zypper in -t patch SUSE-SLE-Micro-5.4-2024-4345=1

Package List:

• SUSE Linux Enterprise Micro for Rancher 5.3 (nosrc x86_64)
  • kernel-rt-5.14.21-150400.15.103.1
• SUSE Linux Enterprise Micro for Rancher 5.3 (x86_64)
  • kernel-rt-debuginfo-5.14.21-150400.15.103.1
  • kernel-rt-debugsource-5.14.21-150400.15.103.1
• SUSE Linux Enterprise Micro for Rancher 5.3 (noarch)
  • kernel-source-rt-5.14.21-150400.15.103.1
• SUSE Linux Enterprise Micro 5.3 (nosrc x86_64)
  • kernel-rt-5.14.21-150400.15.103.1
• SUSE Linux Enterprise Micro 5.3 (x86_64)
  • kernel-rt-debuginfo-5.14.21-150400.15.103.1
  • kernel-rt-debugsource-5.14.21-150400.15.103.1
• SUSE Linux Enterprise Micro 5.3 (noarch)
  • kernel-source-rt-5.14.21-150400.15.103.1
• SUSE Linux Enterprise Micro for Rancher 5.4 (nosrc x86_64)
  • kernel-rt-5.14.21-150400.15.103.1
• SUSE Linux Enterprise Micro for Rancher 5.4 (x86_64)
  • kernel-rt-debuginfo-5.14.21-150400.15.103.1
  • kernel-rt-debugsource-5.14.21-150400.15.103.1
• SUSE Linux Enterprise Micro for Rancher 5.4 (noarch)
  • kernel-source-rt-5.14.21-150400.15.103.1
• SUSE Linux Enterprise Micro 5.4 (nosrc x86_64)
  • kernel-rt-5.14.21-150400.15.103.1
• SUSE Linux Enterprise Micro 5.4 (x86_64)
  • kernel-rt-debuginfo-5.14.21-150400.15.103.1
  • kernel-rt-debugsource-5.14.21-150400.15.103.1
• SUSE Linux Enterprise Micro 5.4 (noarch)
  • kernel-source-rt-5.14.21-150400.15.103.1

References:

• https://www.suse.com/security/cve/CVE-2023-52922.html
• https://www.suse.com/security/cve/CVE-2024-26782.html
• https://www.suse.com/security/cve/CVE-2024-43854.html
• https://www.suse.com/security/cve/CVE-2024-44932.html
• https://www.suse.com/security/cve/CVE-2024-44964.html
• https://www.suse.com/security/cve/CVE-2024-47757.html
• https://www.suse.com/security/cve/CVE-2024-49925.html
• https://www.suse.com/security/cve/CVE-2024-49945.html
• https://www.suse.com/security/cve/CVE-2024-50017.html
• https://www.suse.com/security/cve/CVE-2024-50089.html
• https://www.suse.com/security/cve/CVE-2024-50115.html
• https://www.suse.com/security/cve/CVE-2024-50125.html
• https://www.suse.com/security/cve/CVE-2024-50127.html
• https://www.suse.com/security/cve/CVE-2024-50154.html
• https://www.suse.com/security/cve/CVE-2024-50205.html
• https://www.suse.com/security/cve/CVE-2024-50208.html
• https://www.suse.com/security/cve/CVE-2024-50259.html
• https://www.suse.com/security/cve/CVE-2024-50264.html
• https://www.suse.com/security/cve/CVE-2024-50267.html
• https://www.suse.com/security/cve/CVE-2024-50274.html
• https://www.suse.com/security/cve/CVE-2024-50279.html
• https://www.suse.com/security/cve/CVE-2024-50290.html
• https://www.suse.com/security/cve/CVE-2024-50301.html
• https://www.suse.com/security/cve/CVE-2024-50302.html
• https://www.suse.com/security/cve/CVE-2024-53061.html
• https://www.suse.com/security/cve/CVE-2024-53063.html
• https://www.suse.com/security/cve/CVE-2024-53068.html
• https://bugzilla.suse.com/show_bug.cgi?id=1218644
• https://bugzilla.suse.com/show_bug.cgi?id=1220382
• https://bugzilla.suse.com/show_bug.cgi?id=1221309
• https://bugzilla.suse.com/show_bug.cgi?id=1222590
• https://bugzilla.suse.com/show_bug.cgi?id=1229345
• https://bugzilla.suse.com/show_bug.cgi?id=1229808
• https://bugzilla.suse.com/show_bug.cgi?id=1230220
• https://bugzilla.suse.com/show_bug.cgi?id=1231646
• https://bugzilla.suse.com/show_bug.cgi?id=1232165
• https://bugzilla.suse.com/show_bug.cgi?id=1232187
• https://bugzilla.suse.com/show_bug.cgi?id=1232224
• https://bugzilla.suse.com/show_bug.cgi?id=1232312
• https://bugzilla.suse.com/show_bug.cgi?id=1232436
• https://bugzilla.suse.com/show_bug.cgi?id=1232860
• https://bugzilla.suse.com/show_bug.cgi?id=1232907
• https://bugzilla.suse.com/show_bug.cgi?id=1232919
• https://bugzilla.suse.com/show_bug.cgi?id=1232928
• https://bugzilla.suse.com/show_bug.cgi?id=1233070
• https://bugzilla.suse.com/show_bug.cgi?id=1233117
• https://bugzilla.suse.com/show_bug.cgi?id=1233214
• https://bugzilla.suse.com/show_bug.cgi?id=1233293
• https://bugzilla.suse.com/show_bug.cgi?id=1233453
• https://bugzilla.suse.com/show_bug.cgi?id=1233456
• https://bugzilla.suse.com/show_bug.cgi?id=1233463
• https://bugzilla.suse.com/show_bug.cgi?id=1233468
• https://bugzilla.suse.com/show_bug.cgi?id=1233479
• https://bugzilla.suse.com/show_bug.cgi?id=1233490
• https://bugzilla.suse.com/show_bug.cgi?id=1233491
• https://bugzilla.suse.com/show_bug.cgi?id=1233555
• https://bugzilla.suse.com/show_bug.cgi?id=1233557
• https://bugzilla.suse.com/show_bug.cgi?id=1233561
• https://bugzilla.suse.com/show_bug.cgi?id=1233977