Bug 1216051 (CVE-2023-45862)

Summary:	VUL-0: CVE-2023-45862: kernel: malicious USB storage device can overwrite a buffer on the heap, upstream ce33e64c1788
Product:	[Novell Products] SUSE Security Incidents	Reporter:	Oliver Neukum <oneukum>
Component:	General	Assignee:	Security Team bot <security-team>
Status:	IN_PROGRESS ---	QA Contact:	Security Team bot <security-team>
Severity:	Normal
Priority:	P3 - Medium	CC:	meissner, pmladek, rfrohl
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/381141/
Whiteboard:	CVSSv3.1:SUSE:CVE-2023-45862:6.4:(AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Found By:	---	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description Oliver Neukum 2023-10-09 11:44:54 UTC

This is from upstream:

commit ce33e64c1788912976b61314b56935abd4bc97ef
Author: Kees Cook <keescook@chromium.org>
Date:   Sat Feb 4 10:35:46 2023 -0800

    USB: ene_usb6250: Allocate enough memory for full object
    
    The allocation of PageBuffer is 512 bytes in size, but the dereferencing
    of struct ms_bootblock_idi (also size 512) happens at a calculated offset
    within the allocation, which means the object could potentially extend
    beyond the end of the allocation. Avoid this case by just allocating
    enough space to catch any accesses beyond the end. Seen with GCC 13:

This is potentially quite serious because this is in the code path for TEST UNIT READY, which we run an arbitrary number of times.
By today's standards, this is a CVE.

Comment 1 Matthias Gerstner 2023-10-09 12:46:01 UTC

This is in the chromium package, right?

Is this already public somewhere or is this internal information?

Comment 2 Oliver Neukum 2023-10-09 13:43:56 UTC

(In reply to Matthias Gerstner from comment #1)
> This is in the chromium package, right?

No, this is in the kernel

> Is this already public somewhere or is this internal information?

The bug has been fixed upstream, but was not recognized as a security issue. Hence it is public.

Comment 6 Robert Frohl 2023-10-15 13:26:44 UTC

got assigned CVE-2023-45862

Comment 7 Petr Mladek 2023-10-16 11:17:01 UTC

Takashi, this seems to in your area.

Comment 8 Takashi Iwai 2023-10-19 15:40:59 UTC

Rather it's Oliver's own.

Comment 26 Maintenance Automation 2023-11-02 16:30:04 UTC

SUSE-SU-2023:4349-1: An update that solves four vulnerabilities and has 11 security fixes can now be installed.

Category: security (important)
Bug References: 1206010, 1208788, 1210778, 1213705, 1213950, 1213977, 1215743, 1215745, 1216046, 1216051, 1216107, 1216140, 1216340, 1216513, 1216514
CVE References: CVE-2023-31085, CVE-2023-34324, CVE-2023-39189, CVE-2023-45862
Sources used:
SUSE Linux Enterprise Live Patching 12-SP5 (src): kgraft-patch-SLE12-SP5_Update_50-1-8.3.1
SUSE Linux Enterprise Software Development Kit 12 SP5 (src): kernel-obs-build-4.12.14-122.183.1
SUSE Linux Enterprise High Performance Computing 12 SP5 (src): kernel-source-4.12.14-122.183.1, kernel-syms-4.12.14-122.183.1
SUSE Linux Enterprise Server 12 SP5 (src): kernel-source-4.12.14-122.183.1, kernel-syms-4.12.14-122.183.1
SUSE Linux Enterprise Server for SAP Applications 12 SP5 (src): kernel-source-4.12.14-122.183.1, kernel-syms-4.12.14-122.183.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 27 Maintenance Automation 2023-11-02 16:30:11 UTC

SUSE-SU-2023:4347-1: An update that solves 17 vulnerabilities and has two security fixes can now be installed.

Category: security (important)
Bug References: 1208995, 1210169, 1210778, 1212703, 1214233, 1214380, 1214386, 1215115, 1215117, 1215221, 1215275, 1215299, 1215467, 1215745, 1215858, 1215860, 1215861, 1216046, 1216051
CVE References: CVE-2020-36766, CVE-2023-1192, CVE-2023-1206, CVE-2023-1859, CVE-2023-31085, CVE-2023-34324, CVE-2023-39189, CVE-2023-39192, CVE-2023-39193, CVE-2023-39194, CVE-2023-40283, CVE-2023-42754, CVE-2023-45862, CVE-2023-4622, CVE-2023-4623, CVE-2023-4881, CVE-2023-4921
Sources used:
SUSE Linux Enterprise Live Patching 15-SP1 (src): kernel-livepatch-SLE15-SP1_Update_45-1-150100.3.3.1
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1 (src): kernel-obs-build-4.12.14-150100.197.160.1, kernel-syms-4.12.14-150100.197.160.1, kernel-source-4.12.14-150100.197.160.1
SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 (src): kernel-obs-build-4.12.14-150100.197.160.1, kernel-syms-4.12.14-150100.197.160.1, kernel-source-4.12.14-150100.197.160.1
SUSE Linux Enterprise Server for SAP Applications 15 SP1 (src): kernel-obs-build-4.12.14-150100.197.160.1, kernel-syms-4.12.14-150100.197.160.1, kernel-source-4.12.14-150100.197.160.1
SUSE CaaS Platform 4.0 (src): kernel-obs-build-4.12.14-150100.197.160.1, kernel-syms-4.12.14-150100.197.160.1, kernel-source-4.12.14-150100.197.160.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 28 Maintenance Automation 2023-11-02 16:30:24 UTC

SUSE-SU-2023:4348-1: An update that solves 11 vulnerabilities and has three security fixes can now be installed.

Category: security (important)
Bug References: 1210778, 1210853, 1212051, 1214842, 1215095, 1215467, 1215518, 1215745, 1215858, 1215860, 1215861, 1216046, 1216051, 1216134
CVE References: CVE-2023-2163, CVE-2023-31085, CVE-2023-3111, CVE-2023-34324, CVE-2023-3777, CVE-2023-39189, CVE-2023-39192, CVE-2023-39193, CVE-2023-39194, CVE-2023-42754, CVE-2023-45862
Sources used:
openSUSE Leap 15.3 (src): kernel-syms-5.3.18-150300.59.141.1, kernel-obs-build-5.3.18-150300.59.141.2, kernel-obs-qa-5.3.18-150300.59.141.1, kernel-source-5.3.18-150300.59.141.1, kernel-default-base-5.3.18-150300.59.141.2.150300.18.82.2, kernel-livepatch-SLE15-SP3_Update_38-1-150300.7.3.2
SUSE Linux Enterprise Live Patching 15-SP3 (src): kernel-livepatch-SLE15-SP3_Update_38-1-150300.7.3.2
SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (src): kernel-syms-5.3.18-150300.59.141.1, kernel-default-base-5.3.18-150300.59.141.2.150300.18.82.2, kernel-source-5.3.18-150300.59.141.1, kernel-obs-build-5.3.18-150300.59.141.2
SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (src): kernel-syms-5.3.18-150300.59.141.1, kernel-default-base-5.3.18-150300.59.141.2.150300.18.82.2, kernel-source-5.3.18-150300.59.141.1, kernel-obs-build-5.3.18-150300.59.141.2
SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (src): kernel-syms-5.3.18-150300.59.141.1, kernel-default-base-5.3.18-150300.59.141.2.150300.18.82.2, kernel-source-5.3.18-150300.59.141.1, kernel-obs-build-5.3.18-150300.59.141.2
SUSE Linux Enterprise Server for SAP Applications 15 SP3 (src): kernel-syms-5.3.18-150300.59.141.1, kernel-default-base-5.3.18-150300.59.141.2.150300.18.82.2, kernel-source-5.3.18-150300.59.141.1, kernel-obs-build-5.3.18-150300.59.141.2
SUSE Manager Proxy 4.2 (src): kernel-default-base-5.3.18-150300.59.141.2.150300.18.82.2, kernel-source-5.3.18-150300.59.141.1
SUSE Manager Retail Branch Server 4.2 (src): kernel-default-base-5.3.18-150300.59.141.2.150300.18.82.2, kernel-source-5.3.18-150300.59.141.1
SUSE Manager Server 4.2 (src): kernel-default-base-5.3.18-150300.59.141.2.150300.18.82.2, kernel-source-5.3.18-150300.59.141.1
SUSE Enterprise Storage 7.1 (src): kernel-syms-5.3.18-150300.59.141.1, kernel-default-base-5.3.18-150300.59.141.2.150300.18.82.2, kernel-source-5.3.18-150300.59.141.1, kernel-obs-build-5.3.18-150300.59.141.2
SUSE Linux Enterprise Micro 5.1 (src): kernel-default-base-5.3.18-150300.59.141.2.150300.18.82.2
SUSE Linux Enterprise Micro 5.2 (src): kernel-default-base-5.3.18-150300.59.141.2.150300.18.82.2
SUSE Linux Enterprise Micro for Rancher 5.2 (src): kernel-default-base-5.3.18-150300.59.141.2.150300.18.82.2

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 29 Maintenance Automation 2023-11-02 16:30:29 UTC

SUSE-SU-2023:4346-1: An update that solves four vulnerabilities and has 11 security fixes can now be installed.

Category: security (important)
Bug References: 1206010, 1208788, 1210778, 1213705, 1213950, 1213977, 1215743, 1215745, 1216046, 1216051, 1216107, 1216140, 1216340, 1216513, 1216514
CVE References: CVE-2023-31085, CVE-2023-34324, CVE-2023-39189, CVE-2023-45862
Sources used:
SUSE Linux Enterprise Server for SAP Applications 12 SP5 (src): kernel-source-azure-4.12.14-16.155.1, kernel-syms-azure-4.12.14-16.155.1
SUSE Linux Enterprise High Performance Computing 12 SP5 (src): kernel-source-azure-4.12.14-16.155.1, kernel-syms-azure-4.12.14-16.155.1
SUSE Linux Enterprise Server 12 SP5 (src): kernel-source-azure-4.12.14-16.155.1, kernel-syms-azure-4.12.14-16.155.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 30 Maintenance Automation 2023-11-02 16:30:36 UTC

SUSE-SU-2023:4345-1: An update that solves nine vulnerabilities and has 14 security fixes can now be installed.

Category: security (important)
Bug References: 1208788, 1210778, 1211307, 1212423, 1212649, 1213705, 1214842, 1215095, 1215104, 1215518, 1215745, 1215768, 1215860, 1215955, 1215986, 1216046, 1216051, 1216062, 1216345, 1216510, 1216511, 1216512, 1216621
CVE References: CVE-2023-2163, CVE-2023-31085, CVE-2023-34324, CVE-2023-3777, CVE-2023-39189, CVE-2023-39193, CVE-2023-45862, CVE-2023-46813, CVE-2023-5178
Sources used:
openSUSE Leap 15.4 (src): kernel-syms-azure-5.14.21-150400.14.72.1, kernel-source-azure-5.14.21-150400.14.72.1
Public Cloud Module 15-SP4 (src): kernel-syms-azure-5.14.21-150400.14.72.1, kernel-source-azure-5.14.21-150400.14.72.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 31 Maintenance Automation 2023-11-03 16:30:15 UTC

SUSE-SU-2023:4359-1: An update that solves four vulnerabilities and has 11 security fixes can now be installed.

Category: security (important)
Bug References: 1206010, 1208788, 1210778, 1213705, 1213950, 1213977, 1215743, 1215745, 1216046, 1216051, 1216107, 1216140, 1216340, 1216513, 1216514
CVE References: CVE-2023-31085, CVE-2023-34324, CVE-2023-39189, CVE-2023-45862
Sources used:
SUSE Linux Enterprise Real Time 12 SP5 (src): kernel-source-rt-4.12.14-10.149.1, kernel-syms-rt-4.12.14-10.149.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 32 Maintenance Automation 2023-11-06 16:30:04 UTC

SUSE-SU-2023:4377-1: An update that solves 10 vulnerabilities and has two security fixes can now be installed.

Category: security (important)
Bug References: 1210778, 1210853, 1212051, 1215467, 1215518, 1215745, 1215858, 1215860, 1215861, 1216046, 1216051, 1216134
CVE References: CVE-2023-2163, CVE-2023-31085, CVE-2023-3111, CVE-2023-34324, CVE-2023-39189, CVE-2023-39192, CVE-2023-39193, CVE-2023-39194, CVE-2023-42754, CVE-2023-45862
Sources used:
SUSE Linux Enterprise Live Patching 15-SP2 (src): kernel-livepatch-SLE15-SP2_Update_42-1-150200.5.3.1
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (src): kernel-obs-build-5.3.18-150200.24.169.1, kernel-source-5.3.18-150200.24.169.1, kernel-syms-5.3.18-150200.24.169.1, kernel-default-base-5.3.18-150200.24.169.1.150200.9.85.1
SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (src): kernel-obs-build-5.3.18-150200.24.169.1, kernel-source-5.3.18-150200.24.169.1, kernel-syms-5.3.18-150200.24.169.1, kernel-default-base-5.3.18-150200.24.169.1.150200.9.85.1
SUSE Linux Enterprise Server for SAP Applications 15 SP2 (src): kernel-obs-build-5.3.18-150200.24.169.1, kernel-source-5.3.18-150200.24.169.1, kernel-syms-5.3.18-150200.24.169.1, kernel-default-base-5.3.18-150200.24.169.1.150200.9.85.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.