Bug 1216965 (CVE-2023-39198)

Summary: VUL-0: CVE-2023-39198: kernel: QXL: race condition leading to use-after-free in qxl_mode_dumb_create()
Product: [Novell Products] SUSE Security Incidents Reporter: SMASH SMASH <smash_bz>
Component: IncidentsAssignee: Security Team bot <security-team>
Status: NEW --- QA Contact: Security Team bot <security-team>
Severity: Major    
Priority: P3 - Medium CC: jack, meissner, stoyan.manolov
Version: unspecified   
Target Milestone: ---   
Hardware: Other   
OS: Other   
URL: https://smash.suse.de/issue/384365/
Whiteboard: CVSSv3.1:SUSE:CVE-2023-39198:7.5:(AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H)
Found By: Security Response Team Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---
Bug Depends on:    
Bug Blocks: 1217116    

Description SMASH SMASH 2023-11-08 15:08:16 UTC 
A race condition leading to a use-after-free issue was found in the QXL driver in the Linux kernel.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-39198
Comment 1 Jan Kara 2023-11-10 10:16:20 UTC 
More complete description from the CVE:
A race condition was found in the QXL driver in the Linux kernel. The qxl_mode_dumb_create() function dereferences the qobj returned by the qxl_gem_object_create_with_handle(), but the handle is the only one holding a reference to it. This flaw allows an attacker to guess the returned handle value and trigger a use-after-free issue, potentially leading to a denial of service or privilege escalation.
Comment 2 Jan Kara 2023-11-10 10:19:24 UTC 
Takashi, assigning to you to assure forward progress. Not sure how the graphics stack is split between you, Patrik and Thomas so feel free to reassign to one of them if they are more appropriate. Thanks!
Comment 3 Takashi Iwai 2023-11-10 14:29:59 UTC 
The upstream fix is commit c611589b4259ed63b9b77be6872b1ce07ec0ac16
 drm/qxl: fix UAF on handle creation
included in 6.5-rc1.

SLE15-SP6 and SLE15-SP4/SP5 have already the fix via git-fixes.  I updated the patch reference.

The fix is backported to cve/linux-5.3 and cve/linux-4.12 branches.

cve/linux-4.4 and older aren't affected by the bug as qxl_mode_dumb_create() doesn't have any dereference to qobj.

Reassigned back to security team.
Comment 28 Maintenance Automation 2023-12-12 16:30:06 UTC 
SUSE-SU-2023:4732-1: An update that solves 15 vulnerabilities, contains three features and has 39 security fixes can now be installed.

Category: security (important)
Bug References: 1207948, 1210447, 1212649, 1214286, 1214700, 1214840, 1214976, 1215095, 1215123, 1215124, 1215292, 1215420, 1215458, 1215710, 1215802, 1215931, 1216058, 1216105, 1216259, 1216527, 1216584, 1216621, 1216687, 1216693, 1216759, 1216761, 1216788, 1216844, 1216861, 1216909, 1216959, 1216965, 1216976, 1217036, 1217068, 1217086, 1217095, 1217124, 1217140, 1217147, 1217195, 1217196, 1217200, 1217205, 1217332, 1217366, 1217511, 1217515, 1217598, 1217599, 1217609, 1217687, 1217731, 1217780
CVE References: CVE-2023-2006, CVE-2023-25775, CVE-2023-3777, CVE-2023-39197, CVE-2023-39198, CVE-2023-4244, CVE-2023-45863, CVE-2023-45871, CVE-2023-46813, CVE-2023-46862, CVE-2023-5158, CVE-2023-5633, CVE-2023-5717, CVE-2023-6039, CVE-2023-6176
Jira References: PED-3184, PED-5021, PED-7237
Sources used:
openSUSE Leap 15.5 (src): kernel-source-rt-5.14.21-150500.13.27.2, kernel-syms-rt-5.14.21-150500.13.27.1, kernel-livepatch-SLE15-SP5-RT_Update_8-1-150500.11.3.2
SUSE Linux Enterprise Live Patching 15-SP5 (src): kernel-livepatch-SLE15-SP5-RT_Update_8-1-150500.11.3.2
SUSE Real Time Module 15-SP5 (src): kernel-source-rt-5.14.21-150500.13.27.2, kernel-syms-rt-5.14.21-150500.13.27.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 29 Maintenance Automation 2023-12-12 16:30:16 UTC 
SUSE-SU-2023:4731-1: An update that solves 12 vulnerabilities, contains three features and has 28 security fixes can now be installed.

Category: security (important)
Bug References: 1084909, 1189998, 1210447, 1214286, 1214976, 1215124, 1215292, 1215420, 1215458, 1215710, 1216058, 1216105, 1216259, 1216584, 1216693, 1216759, 1216761, 1216844, 1216861, 1216909, 1216959, 1216965, 1216976, 1217036, 1217068, 1217086, 1217124, 1217140, 1217195, 1217200, 1217205, 1217332, 1217366, 1217515, 1217598, 1217599, 1217609, 1217687, 1217731, 1217780
CVE References: CVE-2023-2006, CVE-2023-25775, CVE-2023-39197, CVE-2023-39198, CVE-2023-4244, CVE-2023-45863, CVE-2023-45871, CVE-2023-46862, CVE-2023-5158, CVE-2023-5717, CVE-2023-6039, CVE-2023-6176
Jira References: PED-3184, PED-5021, PED-7237
Sources used:
openSUSE Leap 15.4 (src): kernel-source-rt-5.14.21-150400.15.62.1, kernel-syms-rt-5.14.21-150400.15.62.1
SUSE Linux Enterprise Live Patching 15-SP4 (src): kernel-livepatch-SLE15-SP4-RT_Update_16-1-150400.1.3.1
SUSE Real Time Module 15-SP4 (src): kernel-source-rt-5.14.21-150400.15.62.1, kernel-syms-rt-5.14.21-150400.15.62.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 30 Maintenance Automation 2023-12-12 16:30:26 UTC 
SUSE-SU-2023:4735-1: An update that solves seven vulnerabilities, contains two features and has 19 security fixes can now be installed.

Category: security (important)
Bug References: 1084909, 1176950, 1190208, 1203496, 1205462, 1208787, 1210780, 1214037, 1214285, 1214408, 1214764, 1216031, 1216058, 1216259, 1216584, 1216759, 1216965, 1216976, 1217036, 1217087, 1217206, 1217519, 1217525, 1217603, 1217604, 1217607
CVE References: CVE-2023-0461, CVE-2023-31083, CVE-2023-39197, CVE-2023-39198, CVE-2023-45863, CVE-2023-45871, CVE-2023-5717
Jira References: PED-3184, PED-5021
Sources used:
SUSE Linux Enterprise Real Time 12 SP5 (src): kernel-source-rt-4.12.14-10.154.1, kernel-syms-rt-4.12.14-10.154.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 31 Maintenance Automation 2023-12-12 16:30:34 UTC 
SUSE-SU-2023:4734-1: An update that solves 13 vulnerabilities, contains three features and has 38 security fixes can now be installed.

Category: security (important)
Bug References: 1084909, 1207948, 1210447, 1214286, 1214700, 1214840, 1214976, 1215123, 1215124, 1215292, 1215420, 1215458, 1215710, 1215802, 1215931, 1216058, 1216105, 1216259, 1216527, 1216584, 1216687, 1216693, 1216759, 1216788, 1216844, 1216861, 1216909, 1216959, 1216965, 1216976, 1217036, 1217068, 1217086, 1217095, 1217124, 1217140, 1217147, 1217195, 1217196, 1217200, 1217205, 1217332, 1217366, 1217511, 1217515, 1217598, 1217599, 1217609, 1217687, 1217731, 1217780
CVE References: CVE-2023-2006, CVE-2023-25775, CVE-2023-39197, CVE-2023-39198, CVE-2023-4244, CVE-2023-45863, CVE-2023-45871, CVE-2023-46862, CVE-2023-5158, CVE-2023-5633, CVE-2023-5717, CVE-2023-6039, CVE-2023-6176
Jira References: PED-3184, PED-5021, PED-7237
Sources used:
openSUSE Leap 15.5 (src): kernel-syms-azure-5.14.21-150500.33.26.1, kernel-source-azure-5.14.21-150500.33.26.1
Public Cloud Module 15-SP5 (src): kernel-syms-azure-5.14.21-150500.33.26.1, kernel-source-azure-5.14.21-150500.33.26.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 32 Maintenance Automation 2023-12-12 16:30:42 UTC 
SUSE-SU-2023:4733-1: An update that solves seven vulnerabilities, contains two features and has eight security fixes can now be installed.

Category: security (important)
Bug References: 1084909, 1210780, 1214037, 1214344, 1214764, 1215371, 1216058, 1216259, 1216584, 1216965, 1216976, 1217140, 1217332, 1217408, 1217780
CVE References: CVE-2023-31083, CVE-2023-39197, CVE-2023-39198, CVE-2023-45863, CVE-2023-45871, CVE-2023-5717, CVE-2023-6176
Jira References: PED-3184, PED-5021
Sources used:

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 33 Maintenance Automation 2023-12-12 16:30:50 UTC 
SUSE-SU-2023:4730-1: An update that solves 13 vulnerabilities, contains three features and has 38 security fixes can now be installed.

Category: security (important)
Bug References: 1084909, 1207948, 1210447, 1214286, 1214700, 1214840, 1214976, 1215123, 1215124, 1215292, 1215420, 1215458, 1215710, 1215802, 1215931, 1216058, 1216105, 1216259, 1216527, 1216584, 1216687, 1216693, 1216759, 1216788, 1216844, 1216861, 1216909, 1216959, 1216965, 1216976, 1217036, 1217068, 1217086, 1217095, 1217124, 1217140, 1217147, 1217195, 1217196, 1217200, 1217205, 1217332, 1217366, 1217511, 1217515, 1217598, 1217599, 1217609, 1217687, 1217731, 1217780
CVE References: CVE-2023-2006, CVE-2023-25775, CVE-2023-39197, CVE-2023-39198, CVE-2023-4244, CVE-2023-45863, CVE-2023-45871, CVE-2023-46862, CVE-2023-5158, CVE-2023-5633, CVE-2023-5717, CVE-2023-6039, CVE-2023-6176
Jira References: PED-3184, PED-5021, PED-7237
Sources used:
openSUSE Leap 15.5 (src): kernel-syms-5.14.21-150500.55.39.1, kernel-source-5.14.21-150500.55.39.1, kernel-livepatch-SLE15-SP5_Update_8-1-150500.11.3.1, kernel-obs-build-5.14.21-150500.55.39.1, kernel-obs-qa-5.14.21-150500.55.39.1, kernel-default-base-5.14.21-150500.55.39.1.150500.6.17.1
SUSE Linux Enterprise Micro 5.5 (src): kernel-default-base-5.14.21-150500.55.39.1.150500.6.17.1
Basesystem Module 15-SP5 (src): kernel-source-5.14.21-150500.55.39.1, kernel-default-base-5.14.21-150500.55.39.1.150500.6.17.1
Development Tools Module 15-SP5 (src): kernel-source-5.14.21-150500.55.39.1, kernel-syms-5.14.21-150500.55.39.1, kernel-obs-build-5.14.21-150500.55.39.1
SUSE Linux Enterprise Live Patching 15-SP5 (src): kernel-livepatch-SLE15-SP5_Update_8-1-150500.11.3.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 35 Maintenance Automation 2023-12-13 16:30:06 UTC 
SUSE-SU-2023:4784-1: An update that solves seven vulnerabilities, contains two features and has 19 security fixes can now be installed.

Category: security (important)
Bug References: 1084909, 1176950, 1190208, 1203496, 1205462, 1208787, 1210780, 1214037, 1214285, 1214408, 1214764, 1216031, 1216058, 1216259, 1216584, 1216759, 1216965, 1216976, 1217036, 1217087, 1217206, 1217519, 1217525, 1217603, 1217604, 1217607
CVE References: CVE-2023-0461, CVE-2023-31083, CVE-2023-39197, CVE-2023-39198, CVE-2023-45863, CVE-2023-45871, CVE-2023-5717
Jira References: PED-3184, PED-5021
Sources used:
SUSE Linux Enterprise Live Patching 12-SP5 (src): kgraft-patch-SLE12-SP5_Update_51-1-8.3.1
SUSE Linux Enterprise Software Development Kit 12 SP5 (src): kernel-obs-build-4.12.14-122.186.1
SUSE Linux Enterprise High Performance Computing 12 SP5 (src): kernel-source-4.12.14-122.186.1, kernel-syms-4.12.14-122.186.1
SUSE Linux Enterprise Server 12 SP5 (src): kernel-source-4.12.14-122.186.1, kernel-syms-4.12.14-122.186.1
SUSE Linux Enterprise Server for SAP Applications 12 SP5 (src): kernel-source-4.12.14-122.186.1, kernel-syms-4.12.14-122.186.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 36 Maintenance Automation 2023-12-13 16:30:11 UTC 
SUSE-SU-2023:4783-1: An update that solves seven vulnerabilities, contains two features and has five security fixes can now be installed.

Category: security (important)
Bug References: 1084909, 1210780, 1214037, 1214344, 1214764, 1216058, 1216259, 1216584, 1216965, 1216976, 1217332, 1217780
CVE References: CVE-2023-31083, CVE-2023-39197, CVE-2023-39198, CVE-2023-45863, CVE-2023-45871, CVE-2023-5717, CVE-2023-6176
Jira References: PED-3184, PED-5021
Sources used:
SUSE Linux Enterprise Live Patching 15-SP2 (src): kernel-livepatch-SLE15-SP2_Update_43-1-150200.5.3.1
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (src): kernel-syms-5.3.18-150200.24.172.1, kernel-default-base-5.3.18-150200.24.172.1.150200.9.87.1, kernel-source-5.3.18-150200.24.172.1, kernel-obs-build-5.3.18-150200.24.172.1
SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (src): kernel-syms-5.3.18-150200.24.172.1, kernel-default-base-5.3.18-150200.24.172.1.150200.9.87.1, kernel-source-5.3.18-150200.24.172.1, kernel-obs-build-5.3.18-150200.24.172.1
SUSE Linux Enterprise Server for SAP Applications 15 SP2 (src): kernel-syms-5.3.18-150200.24.172.1, kernel-default-base-5.3.18-150200.24.172.1.150200.9.87.1, kernel-source-5.3.18-150200.24.172.1, kernel-obs-build-5.3.18-150200.24.172.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 37 Maintenance Automation 2023-12-13 16:30:50 UTC 
SUSE-SU-2023:4782-1: An update that solves 12 vulnerabilities, contains three features and has 25 security fixes can now be installed.

Category: security (important)
Bug References: 1210447, 1214286, 1214976, 1215124, 1215292, 1215420, 1215458, 1215710, 1216058, 1216105, 1216259, 1216584, 1216693, 1216759, 1216844, 1216861, 1216909, 1216959, 1216965, 1216976, 1217036, 1217068, 1217086, 1217124, 1217140, 1217195, 1217200, 1217205, 1217332, 1217366, 1217515, 1217598, 1217599, 1217609, 1217687, 1217731, 1217780
CVE References: CVE-2023-2006, CVE-2023-25775, CVE-2023-39197, CVE-2023-39198, CVE-2023-4244, CVE-2023-45863, CVE-2023-45871, CVE-2023-46862, CVE-2023-5158, CVE-2023-5717, CVE-2023-6039, CVE-2023-6176
Jira References: PED-3184, PED-5021, PED-7237
Sources used:
openSUSE Leap 15.4 (src): kernel-source-azure-5.14.21-150400.14.75.1, kernel-syms-azure-5.14.21-150400.14.75.1
Public Cloud Module 15-SP4 (src): kernel-source-azure-5.14.21-150400.14.75.1, kernel-syms-azure-5.14.21-150400.14.75.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 38 Maintenance Automation 2023-12-13 20:30:26 UTC 
SUSE-SU-2023:4811-1: An update that solves seven vulnerabilities, contains two features and has eight security fixes can now be installed.

Category: security (important)
Bug References: 1084909, 1210780, 1214037, 1214344, 1214764, 1215371, 1216058, 1216259, 1216584, 1216965, 1216976, 1217140, 1217332, 1217408, 1217780
CVE References: CVE-2023-31083, CVE-2023-39197, CVE-2023-39198, CVE-2023-45863, CVE-2023-45871, CVE-2023-5717, CVE-2023-6176
Jira References: PED-3184, PED-5021
Sources used:
openSUSE Leap 15.3 (src): kernel-obs-build-5.3.18-150300.59.144.1, kernel-syms-5.3.18-150300.59.144.1, kernel-livepatch-SLE15-SP3_Update_39-1-150300.7.3.1, kernel-default-base-5.3.18-150300.59.144.1.150300.18.84.1, kernel-obs-qa-5.3.18-150300.59.144.1, kernel-source-5.3.18-150300.59.144.1
SUSE Linux Enterprise Live Patching 15-SP3 (src): kernel-livepatch-SLE15-SP3_Update_39-1-150300.7.3.1
SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (src): kernel-obs-build-5.3.18-150300.59.144.1, kernel-syms-5.3.18-150300.59.144.1, kernel-default-base-5.3.18-150300.59.144.1.150300.18.84.1, kernel-source-5.3.18-150300.59.144.1
SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (src): kernel-obs-build-5.3.18-150300.59.144.1, kernel-syms-5.3.18-150300.59.144.1, kernel-default-base-5.3.18-150300.59.144.1.150300.18.84.1, kernel-source-5.3.18-150300.59.144.1
SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (src): kernel-obs-build-5.3.18-150300.59.144.1, kernel-syms-5.3.18-150300.59.144.1, kernel-default-base-5.3.18-150300.59.144.1.150300.18.84.1, kernel-source-5.3.18-150300.59.144.1
SUSE Linux Enterprise Server for SAP Applications 15 SP3 (src): kernel-obs-build-5.3.18-150300.59.144.1, kernel-syms-5.3.18-150300.59.144.1, kernel-default-base-5.3.18-150300.59.144.1.150300.18.84.1, kernel-source-5.3.18-150300.59.144.1
SUSE Enterprise Storage 7.1 (src): kernel-obs-build-5.3.18-150300.59.144.1, kernel-syms-5.3.18-150300.59.144.1, kernel-default-base-5.3.18-150300.59.144.1.150300.18.84.1, kernel-source-5.3.18-150300.59.144.1
SUSE Linux Enterprise Micro 5.1 (src): kernel-default-base-5.3.18-150300.59.144.1.150300.18.84.1
SUSE Linux Enterprise Micro 5.2 (src): kernel-default-base-5.3.18-150300.59.144.1.150300.18.84.1
SUSE Linux Enterprise Micro for Rancher 5.2 (src): kernel-default-base-5.3.18-150300.59.144.1.150300.18.84.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 39 Maintenance Automation 2023-12-13 20:30:35 UTC 
SUSE-SU-2023:4810-1: An update that solves 12 vulnerabilities, contains three features and has 26 security fixes can now be installed.

Category: security (important)
Bug References: 1084909, 1210447, 1214286, 1214976, 1215124, 1215292, 1215420, 1215458, 1215710, 1216058, 1216105, 1216259, 1216584, 1216693, 1216759, 1216844, 1216861, 1216909, 1216959, 1216965, 1216976, 1217036, 1217068, 1217086, 1217124, 1217140, 1217195, 1217200, 1217205, 1217332, 1217366, 1217515, 1217598, 1217599, 1217609, 1217687, 1217731, 1217780
CVE References: CVE-2023-2006, CVE-2023-25775, CVE-2023-39197, CVE-2023-39198, CVE-2023-4244, CVE-2023-45863, CVE-2023-45871, CVE-2023-46862, CVE-2023-5158, CVE-2023-5717, CVE-2023-6039, CVE-2023-6176
Jira References: PED-3184, PED-5021, PED-7237
Sources used:
openSUSE Leap 15.4 (src): kernel-obs-qa-5.14.21-150400.24.100.1, kernel-obs-build-5.14.21-150400.24.100.2, kernel-syms-5.14.21-150400.24.100.1, kernel-default-base-5.14.21-150400.24.100.2.150400.24.46.2, kernel-source-5.14.21-150400.24.100.2, kernel-livepatch-SLE15-SP4_Update_21-1-150400.9.3.2
openSUSE Leap Micro 5.3 (src): kernel-default-base-5.14.21-150400.24.100.2.150400.24.46.2
openSUSE Leap Micro 5.4 (src): kernel-default-base-5.14.21-150400.24.100.2.150400.24.46.2
SUSE Linux Enterprise Micro for Rancher 5.3 (src): kernel-default-base-5.14.21-150400.24.100.2.150400.24.46.2
SUSE Linux Enterprise Micro 5.3 (src): kernel-default-base-5.14.21-150400.24.100.2.150400.24.46.2
SUSE Linux Enterprise Micro for Rancher 5.4 (src): kernel-default-base-5.14.21-150400.24.100.2.150400.24.46.2
SUSE Linux Enterprise Micro 5.4 (src): kernel-default-base-5.14.21-150400.24.100.2.150400.24.46.2
Basesystem Module 15-SP4 (src): kernel-default-base-5.14.21-150400.24.100.2.150400.24.46.2, kernel-source-5.14.21-150400.24.100.2
Development Tools Module 15-SP4 (src): kernel-source-5.14.21-150400.24.100.2, kernel-obs-build-5.14.21-150400.24.100.2, kernel-syms-5.14.21-150400.24.100.1
SUSE Linux Enterprise Live Patching 15-SP4 (src): kernel-livepatch-SLE15-SP4_Update_21-1-150400.9.3.2

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 40 Maintenance Automation 2023-12-15 12:30:01 UTC 
SUSE-SU-2023:4882-1: An update that solves seven vulnerabilities, contains two features and has one security fix can now be installed.

Category: security (important)
Bug References: 1084909, 1208787, 1210780, 1216058, 1216259, 1216584, 1216965, 1216976
CVE References: CVE-2023-0461, CVE-2023-31083, CVE-2023-39197, CVE-2023-39198, CVE-2023-45863, CVE-2023-45871, CVE-2023-5717
Jira References: PED-3184, PED-5021
Sources used:
SUSE Linux Enterprise Live Patching 15-SP1 (src): kernel-livepatch-SLE15-SP1_Update_46-1-150100.3.5.1
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1 (src): kernel-syms-4.12.14-150100.197.165.1, kernel-obs-build-4.12.14-150100.197.165.1, kernel-source-4.12.14-150100.197.165.1
SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 (src): kernel-syms-4.12.14-150100.197.165.1, kernel-obs-build-4.12.14-150100.197.165.1, kernel-source-4.12.14-150100.197.165.1
SUSE Linux Enterprise Server for SAP Applications 15 SP1 (src): kernel-syms-4.12.14-150100.197.165.1, kernel-obs-build-4.12.14-150100.197.165.1, kernel-source-4.12.14-150100.197.165.1
SUSE CaaS Platform 4.0 (src): kernel-syms-4.12.14-150100.197.165.1, kernel-obs-build-4.12.14-150100.197.165.1, kernel-source-4.12.14-150100.197.165.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 41 Maintenance Automation 2023-12-15 12:30:08 UTC 
SUSE-SU-2023:4883-1: An update that solves seven vulnerabilities, contains two features and has 18 security fixes can now be installed.

Category: security (important)
Bug References: 1176950, 1190208, 1203496, 1205462, 1208787, 1210780, 1214037, 1214285, 1214408, 1214764, 1216031, 1216058, 1216259, 1216584, 1216759, 1216965, 1216976, 1217036, 1217087, 1217206, 1217519, 1217525, 1217603, 1217604, 1217607
CVE References: CVE-2023-0461, CVE-2023-31083, CVE-2023-39197, CVE-2023-39198, CVE-2023-45863, CVE-2023-45871, CVE-2023-5717
Jira References: PED-3184, PED-5021
Sources used:
SUSE Linux Enterprise Server for SAP Applications 12 SP5 (src): kernel-source-azure-4.12.14-16.160.1, kernel-syms-azure-4.12.14-16.160.1
SUSE Linux Enterprise High Performance Computing 12 SP5 (src): kernel-source-azure-4.12.14-16.160.1, kernel-syms-azure-4.12.14-16.160.1
SUSE Linux Enterprise Server 12 SP5 (src): kernel-source-azure-4.12.14-16.160.1, kernel-syms-azure-4.12.14-16.160.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.