Bug 1220257 (CVE-2023-52452)

Summary:	VUL-0: CVE-2023-52452: kernel-source,kernel-source-azure,kernel-source-rt: bpf: Fix accesses to uninit stack slots
Product:	[Novell Products] SUSE Security Incidents	Reporter:	SMASH SMASH <smash_bz>
Component:	Incidents	Assignee:	Security Team bot <security-team>
Status:	RESOLVED FIXED	QA Contact:	Security Team bot <security-team>
Severity:	Normal
Priority:	P3 - Medium	CC:	shung-hsi.yu, stoyan.manolov, thomas.leroy, vasant.karasulli
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/394907/
Whiteboard:	CVSSv3.1:SUSE:CVE-2023-52452:4.4:(AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description SMASH SMASH 2024-02-23 09:56:37 UTC

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix accesses to uninit stack slots

Privileged programs are supposed to be able to read uninitialized stack
memory (ever since 6715df8d5) but, before this patch, these accesses
were permitted inconsistently. In particular, accesses were permitted
above state->allocated_stack, but not below it. In other words, if the
stack was already "large enough", the access was permitted, but
otherwise the access was rejected instead of being allowed to "grow the
stack". This undesired rejection was happening in two places:
- in check_stack_slot_within_bounds()
- in check_stack_range_initialized()
This patch arranges for these accesses to be permitted. A bunch of tests
that were relying on the old rejection had to change; all of them were
changed to add also run unprivileged, in which case the old behavior
persists. One tests couldn't be updated - global_func16 - because it
can't run unprivileged for other reasons.

This patch also fixes the tracking of the stack size for variable-offset
reads. This second fix is bundled in the same commit as the first one
because they're inter-related. Before this patch, writes to the stack
using registers containing a variable offset (as opposed to registers
with fixed, known values) were not properly contributing to the
function's needed stack size. As a result, it was possible for a program
to verify, but then to attempt to read out-of-bounds data at runtime
because a too small stack had been allocated for it.

Each function tracks the size of the stack it needs in
bpf_subprog_info.stack_depth, which is maintained by
update_stack_depth(). For regular memory accesses, check_mem_access()
was calling update_state_depth() but it was passing in only the fixed
part of the offset register, ignoring the variable offset. This was
incorrect; the minimum possible value of that register should be used
instead.

This tracking is now fixed by centralizing the tracking of stack size in
grow_stack_state(), and by lifting the calls to grow_stack_state() to
check_stack_access_within_bounds() as suggested by Andrii. The code is
now simpler and more convincingly tracks the correct maximum stack size.
check_stack_range_initialized() can now rely on enough stack having been
allocated for the access; this helps with the fix for the first issue.

A few tests were changed to also check the stack depth computation. The
one that fails without this patch is verifier_var_off:stack_write_priv_vs_unpriv.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-52452
https://www.cve.org/CVERecord?id=CVE-2023-52452
https://git.kernel.org/stable/c/0954982db8283016bf38e9db2da5adf47a102e19
https://git.kernel.org/stable/c/6b4a64bafd107e521c01eec3453ce94a3fb38529
https://git.kernel.org/stable/c/fbcf372c8eda2290470268e0afb5ab5d5f5d5fde

Comment 1 Thomas Leroy 2024-02-23 10:01:07 UTC

I have a doubt of the security implication of this one.

Reading uninitialized stack seems to be a feature for privileged bpf programs, but this patch seems to only make the access check more reliable.

Comment 3 Shung-Hsi Yu 2024-03-04 09:51:00 UTC

(In reply to Thomas Leroy from comment #1)
> I have a doubt of the security implication of this one.
> 
> Reading uninitialized stack seems to be a feature for privileged bpf
> programs, but this patch seems to only make the access check more reliable.

I believe the mention of vulnerability lies in the second part, where unprivileged BPF program can read beyond the allocated stack. (variable offset refers to the offset applied to a pointer  where exact value cannot be determined at verification time, e.g. ptr + (void *)*mem where the offset is read from memory and thus cannot be determined just by looking the BPF program instructions)

> ... Before this patch, writes to the stack
> using registers containing a variable offset (as opposed to registers
> with fixed, known values) were not properly contributing to the
> function's needed stack size. As a result, it was possible for a program
> to verify, but then to attempt to read out-of-bounds data at runtime
> because a too small stack had been allocated for it.

Since we have CONFIG_BPF_UNPRIV_DEFAULT_OFF=y it isn't possible for unprivileged user to load such kind of BPF program, making this rather low impact. Nevertheless I think the fix is still worth backporting.

Comment 4 Thomas Leroy 2024-03-04 10:43:30 UTC

(In reply to Shung-Hsi Yu from comment #3)
> Since we have CONFIG_BPF_UNPRIV_DEFAULT_OFF=y it isn't possible for
> unprivileged user to load such kind of BPF program, making this rather low
> impact. Nevertheless I think the fix is still worth backporting.

Thanks for checking! As far as I can see, cve/linux-5.14 is missing the fix. stable and SLE15-SP6 are already fixed.

Comment 5 Shung-Hsi Yu 2024-03-05 07:42:08 UTC

(In reply to Thomas Leroy from comment #4)
> Thanks for checking! As far as I can see, cve/linux-5.14 is missing the fix.
> stable and SLE15-SP6 are already fixed.

Seems like SLE15-SP6 is missing the fix as well. Backported the following patches to SLE15-SP6 (f480bf8727e4):
1. 5bd90cdc65ef "bpf: Minor logging improvement"
2. a833a17aeac7 "bpf: Fix verification of indirect var-off stack access" (using git-fixes as reference)
3. 1d38a9ee8157 "bpf: Guard stack limits against 32bit overflow" (using git-fixes as reference)
4. 92e1567ee3e3 "bpf: Add some comments to stack representation"
5. 6b4a64bafd10 "bpf: Fix accesses to uninit stack slots"
6. 2929bfac006d "bpf: Minor cleanup around stack bounds"

Patch 2 and 3 are independent fixes that does not have CVE reference but seems to have potential security implications, and at the same time help with the backport of patch 5, which is the actual fix for CVE-2023-52452. Patches 1, 4, and 5 are mainly pulled to better align with upstream codebase.

PR to SLE15-SP5 (92d9d8401d50) contains the same set of patches, where as PR to cve/linux-5.14 (7d031251613c) omits patch 1 and 4 to keep the changes minimal.

Reassigning back to security team.

Comment 6 Shung-Hsi Yu 2024-03-05 07:43:16 UTC

(In reply to Shung-Hsi Yu from comment #5)
> [snip]
> Patch 2 and 3 are independent fixes that does not have CVE reference but
> seems to have potential security implications, and at the same time help
> with the backport of patch 5, which is the actual fix for CVE-2023-52452.
> Patches 1, 4, and 5 are mainly pulled to better align with upstream codebase.
                    ^ typo, should be 6
> [snip]

Comment 17 Maintenance Automation 2024-03-12 20:30:11 UTC

SUSE-SU-2024:0855-1: An update that solves 50 vulnerabilities, contains one feature and has 23 security fixes can now be installed.

Category: security (important)
Bug References: 1194869, 1206453, 1209412, 1216776, 1217927, 1218195, 1218216, 1218450, 1218527, 1218562, 1218663, 1218915, 1219126, 1219127, 1219141, 1219146, 1219295, 1219443, 1219653, 1219827, 1219835, 1219839, 1219840, 1219934, 1220003, 1220009, 1220021, 1220030, 1220106, 1220140, 1220187, 1220238, 1220240, 1220241, 1220243, 1220250, 1220251, 1220253, 1220254, 1220255, 1220257, 1220267, 1220277, 1220317, 1220325, 1220326, 1220328, 1220330, 1220335, 1220344, 1220348, 1220350, 1220364, 1220392, 1220393, 1220398, 1220409, 1220433, 1220444, 1220457, 1220459, 1220469, 1220649, 1220735, 1220736, 1220796, 1220825, 1220845, 1220848, 1220917, 1220930, 1220931, 1220933
CVE References: CVE-2019-25162, CVE-2021-46923, CVE-2021-46924, CVE-2021-46932, CVE-2021-46934, CVE-2021-47083, CVE-2022-48627, CVE-2022-48628, CVE-2023-5197, CVE-2023-52340, CVE-2023-52429, CVE-2023-52439, CVE-2023-52443, CVE-2023-52445, CVE-2023-52447, CVE-2023-52448, CVE-2023-52449, CVE-2023-52451, CVE-2023-52452, CVE-2023-52456, CVE-2023-52457, CVE-2023-52462, CVE-2023-52463, CVE-2023-52464, CVE-2023-52467, CVE-2023-52475, CVE-2023-52478, CVE-2023-52482, CVE-2023-52530, CVE-2023-52531, CVE-2023-52559, CVE-2023-6270, CVE-2023-6817, CVE-2024-0607, CVE-2024-1151, CVE-2024-23849, CVE-2024-23850, CVE-2024-23851, CVE-2024-25744, CVE-2024-26585, CVE-2024-26586, CVE-2024-26589, CVE-2024-26591, CVE-2024-26593, CVE-2024-26595, CVE-2024-26598, CVE-2024-26602, CVE-2024-26603, CVE-2024-26607, CVE-2024-26622
Jira References: PED-7618
Sources used:
openSUSE Leap 15.5 (src): kernel-syms-azure-5.14.21-150500.33.37.1, kernel-source-azure-5.14.21-150500.33.37.1
Public Cloud Module 15-SP5 (src): kernel-syms-azure-5.14.21-150500.33.37.1, kernel-source-azure-5.14.21-150500.33.37.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 18 Maintenance Automation 2024-03-13 08:30:12 UTC

SUSE-SU-2024:0858-1: An update that solves 39 vulnerabilities, contains one feature and has 23 security fixes can now be installed.

Category: security (important)
Bug References: 1194869, 1206453, 1209412, 1213456, 1216776, 1217927, 1218195, 1218216, 1218450, 1218527, 1218663, 1218915, 1219126, 1219127, 1219141, 1219146, 1219295, 1219443, 1219653, 1219827, 1219835, 1219839, 1219840, 1219934, 1220003, 1220009, 1220021, 1220030, 1220106, 1220140, 1220187, 1220238, 1220240, 1220241, 1220243, 1220250, 1220251, 1220253, 1220254, 1220255, 1220257, 1220267, 1220277, 1220317, 1220326, 1220328, 1220330, 1220335, 1220344, 1220348, 1220350, 1220364, 1220392, 1220393, 1220398, 1220409, 1220444, 1220457, 1220459, 1220649, 1220796, 1220825
CVE References: CVE-2019-25162, CVE-2021-46923, CVE-2021-46924, CVE-2021-46932, CVE-2023-28746, CVE-2023-5197, CVE-2023-52340, CVE-2023-52429, CVE-2023-52439, CVE-2023-52443, CVE-2023-52445, CVE-2023-52447, CVE-2023-52448, CVE-2023-52449, CVE-2023-52451, CVE-2023-52452, CVE-2023-52456, CVE-2023-52457, CVE-2023-52463, CVE-2023-52464, CVE-2023-52475, CVE-2023-52478, CVE-2023-6817, CVE-2024-0607, CVE-2024-1151, CVE-2024-23849, CVE-2024-23850, CVE-2024-23851, CVE-2024-25744, CVE-2024-26585, CVE-2024-26586, CVE-2024-26589, CVE-2024-26591, CVE-2024-26593, CVE-2024-26595, CVE-2024-26598, CVE-2024-26602, CVE-2024-26603, CVE-2024-26622
Jira References: PED-7618
Sources used:
openSUSE Leap 15.5 (src): kernel-default-base-5.14.21-150500.55.52.1.150500.6.23.1, kernel-syms-5.14.21-150500.55.52.1, kernel-source-5.14.21-150500.55.52.1, kernel-obs-qa-5.14.21-150500.55.52.1, kernel-obs-build-5.14.21-150500.55.52.1, kernel-livepatch-SLE15-SP5_Update_11-1-150500.11.3.1
SUSE Linux Enterprise Micro 5.5 (src): kernel-default-base-5.14.21-150500.55.52.1.150500.6.23.1
Basesystem Module 15-SP5 (src): kernel-default-base-5.14.21-150500.55.52.1.150500.6.23.1, kernel-source-5.14.21-150500.55.52.1
Development Tools Module 15-SP5 (src): kernel-source-5.14.21-150500.55.52.1, kernel-syms-5.14.21-150500.55.52.1, kernel-obs-build-5.14.21-150500.55.52.1
SUSE Linux Enterprise Live Patching 15-SP5 (src): kernel-livepatch-SLE15-SP5_Update_11-1-150500.11.3.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 20 Maintenance Automation 2024-03-14 20:30:12 UTC

SUSE-SU-2024:0900-1: An update that solves 49 vulnerabilities and has five security fixes can now be installed.

Category: security (important)
Bug References: 1211515, 1213456, 1214064, 1218195, 1218216, 1218562, 1218915, 1219073, 1219126, 1219127, 1219146, 1219295, 1219633, 1219653, 1219827, 1219835, 1220009, 1220140, 1220187, 1220238, 1220240, 1220241, 1220243, 1220250, 1220251, 1220253, 1220254, 1220255, 1220257, 1220326, 1220328, 1220330, 1220335, 1220344, 1220350, 1220364, 1220398, 1220409, 1220433, 1220444, 1220457, 1220459, 1220469, 1220649, 1220735, 1220736, 1220796, 1220797, 1220825, 1220845, 1220917, 1220930, 1220931, 1220933
CVE References: CVE-2019-25162, CVE-2021-46923, CVE-2021-46924, CVE-2021-46932, CVE-2021-46934, CVE-2021-47083, CVE-2022-48627, CVE-2023-28746, CVE-2023-5197, CVE-2023-52340, CVE-2023-52429, CVE-2023-52439, CVE-2023-52443, CVE-2023-52445, CVE-2023-52447, CVE-2023-52448, CVE-2023-52449, CVE-2023-52451, CVE-2023-52452, CVE-2023-52456, CVE-2023-52457, CVE-2023-52463, CVE-2023-52464, CVE-2023-52467, CVE-2023-52475, CVE-2023-52478, CVE-2023-52482, CVE-2023-52484, CVE-2023-52530, CVE-2023-52531, CVE-2023-52559, CVE-2023-6270, CVE-2023-6817, CVE-2024-0607, CVE-2024-1151, CVE-2024-23849, CVE-2024-23850, CVE-2024-23851, CVE-2024-26585, CVE-2024-26586, CVE-2024-26589, CVE-2024-26591, CVE-2024-26593, CVE-2024-26595, CVE-2024-26598, CVE-2024-26602, CVE-2024-26603, CVE-2024-26607, CVE-2024-26622
Sources used:
openSUSE Leap 15.4 (src): kernel-syms-5.14.21-150400.24.111.1, kernel-source-5.14.21-150400.24.111.1, kernel-obs-build-5.14.21-150400.24.111.1, kernel-livepatch-SLE15-SP4_Update_24-1-150400.9.3.1, kernel-default-base-5.14.21-150400.24.111.2.150400.24.52.1, kernel-obs-qa-5.14.21-150400.24.111.1
openSUSE Leap Micro 5.3 (src): kernel-default-base-5.14.21-150400.24.111.2.150400.24.52.1
openSUSE Leap Micro 5.4 (src): kernel-default-base-5.14.21-150400.24.111.2.150400.24.52.1
SUSE Linux Enterprise Micro for Rancher 5.3 (src): kernel-default-base-5.14.21-150400.24.111.2.150400.24.52.1
SUSE Linux Enterprise Micro 5.3 (src): kernel-default-base-5.14.21-150400.24.111.2.150400.24.52.1
SUSE Linux Enterprise Micro for Rancher 5.4 (src): kernel-default-base-5.14.21-150400.24.111.2.150400.24.52.1
SUSE Linux Enterprise Micro 5.4 (src): kernel-default-base-5.14.21-150400.24.111.2.150400.24.52.1
SUSE Linux Enterprise Live Patching 15-SP4 (src): kernel-livepatch-SLE15-SP4_Update_24-1-150400.9.3.1
SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (src): kernel-source-5.14.21-150400.24.111.1, kernel-obs-build-5.14.21-150400.24.111.1, kernel-default-base-5.14.21-150400.24.111.2.150400.24.52.1, kernel-syms-5.14.21-150400.24.111.1
SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (src): kernel-source-5.14.21-150400.24.111.1, kernel-obs-build-5.14.21-150400.24.111.1, kernel-default-base-5.14.21-150400.24.111.2.150400.24.52.1, kernel-syms-5.14.21-150400.24.111.1
SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (src): kernel-source-5.14.21-150400.24.111.1, kernel-obs-build-5.14.21-150400.24.111.1, kernel-default-base-5.14.21-150400.24.111.2.150400.24.52.1, kernel-syms-5.14.21-150400.24.111.1
SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (src): kernel-source-5.14.21-150400.24.111.1, kernel-obs-build-5.14.21-150400.24.111.1, kernel-default-base-5.14.21-150400.24.111.2.150400.24.52.1, kernel-syms-5.14.21-150400.24.111.1
SUSE Linux Enterprise Server for SAP Applications 15 SP4 (src): kernel-source-5.14.21-150400.24.111.1, kernel-obs-build-5.14.21-150400.24.111.1, kernel-default-base-5.14.21-150400.24.111.2.150400.24.52.1, kernel-syms-5.14.21-150400.24.111.1
SUSE Manager Proxy 4.3 (src): kernel-source-5.14.21-150400.24.111.1, kernel-default-base-5.14.21-150400.24.111.2.150400.24.52.1
SUSE Manager Retail Branch Server 4.3 (src): kernel-source-5.14.21-150400.24.111.1, kernel-default-base-5.14.21-150400.24.111.2.150400.24.52.1
SUSE Manager Server 4.3 (src): kernel-source-5.14.21-150400.24.111.1, kernel-default-base-5.14.21-150400.24.111.2.150400.24.52.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 22 Maintenance Automation 2024-03-15 16:30:10 UTC

SUSE-SU-2024:0910-1: An update that solves 39 vulnerabilities, contains one feature and has 23 security fixes can now be installed.

Category: security (important)
Bug References: 1194869, 1206453, 1209412, 1213456, 1216776, 1217927, 1218195, 1218216, 1218450, 1218527, 1218663, 1218915, 1219126, 1219127, 1219141, 1219146, 1219295, 1219443, 1219653, 1219827, 1219835, 1219839, 1219840, 1219934, 1220003, 1220009, 1220021, 1220030, 1220106, 1220140, 1220187, 1220238, 1220240, 1220241, 1220243, 1220250, 1220251, 1220253, 1220254, 1220255, 1220257, 1220267, 1220277, 1220317, 1220326, 1220328, 1220330, 1220335, 1220344, 1220348, 1220350, 1220364, 1220392, 1220393, 1220398, 1220409, 1220444, 1220457, 1220459, 1220649, 1220796, 1220825
CVE References: CVE-2019-25162, CVE-2021-46923, CVE-2021-46924, CVE-2021-46932, CVE-2023-28746, CVE-2023-5197, CVE-2023-52340, CVE-2023-52429, CVE-2023-52439, CVE-2023-52443, CVE-2023-52445, CVE-2023-52447, CVE-2023-52448, CVE-2023-52449, CVE-2023-52451, CVE-2023-52452, CVE-2023-52456, CVE-2023-52457, CVE-2023-52463, CVE-2023-52464, CVE-2023-52475, CVE-2023-52478, CVE-2023-6817, CVE-2024-0607, CVE-2024-1151, CVE-2024-23849, CVE-2024-23850, CVE-2024-23851, CVE-2024-25744, CVE-2024-26585, CVE-2024-26586, CVE-2024-26589, CVE-2024-26591, CVE-2024-26593, CVE-2024-26595, CVE-2024-26598, CVE-2024-26602, CVE-2024-26603, CVE-2024-26622
Jira References: PED-7618
Sources used:
openSUSE Leap 15.5 (src): kernel-source-rt-5.14.21-150500.13.38.1, kernel-syms-rt-5.14.21-150500.13.38.1, kernel-livepatch-SLE15-SP5-RT_Update_11-1-150500.11.3.1
SUSE Linux Enterprise Micro 5.5 (src): kernel-source-rt-5.14.21-150500.13.38.1
SUSE Linux Enterprise Live Patching 15-SP5 (src): kernel-livepatch-SLE15-SP5-RT_Update_11-1-150500.11.3.1
SUSE Real Time Module 15-SP5 (src): kernel-source-rt-5.14.21-150500.13.38.1, kernel-syms-rt-5.14.21-150500.13.38.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 23 Maintenance Automation 2024-03-15 16:30:22 UTC

SUSE-SU-2024:0900-2: An update that solves 49 vulnerabilities and has five security fixes can now be installed.

Category: security (important)
Bug References: 1211515, 1213456, 1214064, 1218195, 1218216, 1218562, 1218915, 1219073, 1219126, 1219127, 1219146, 1219295, 1219633, 1219653, 1219827, 1219835, 1220009, 1220140, 1220187, 1220238, 1220240, 1220241, 1220243, 1220250, 1220251, 1220253, 1220254, 1220255, 1220257, 1220326, 1220328, 1220330, 1220335, 1220344, 1220350, 1220364, 1220398, 1220409, 1220433, 1220444, 1220457, 1220459, 1220469, 1220649, 1220735, 1220736, 1220796, 1220797, 1220825, 1220845, 1220917, 1220930, 1220931, 1220933
CVE References: CVE-2019-25162, CVE-2021-46923, CVE-2021-46924, CVE-2021-46932, CVE-2021-46934, CVE-2021-47083, CVE-2022-48627, CVE-2023-28746, CVE-2023-5197, CVE-2023-52340, CVE-2023-52429, CVE-2023-52439, CVE-2023-52443, CVE-2023-52445, CVE-2023-52447, CVE-2023-52448, CVE-2023-52449, CVE-2023-52451, CVE-2023-52452, CVE-2023-52456, CVE-2023-52457, CVE-2023-52463, CVE-2023-52464, CVE-2023-52467, CVE-2023-52475, CVE-2023-52478, CVE-2023-52482, CVE-2023-52484, CVE-2023-52530, CVE-2023-52531, CVE-2023-52559, CVE-2023-6270, CVE-2023-6817, CVE-2024-0607, CVE-2024-1151, CVE-2024-23849, CVE-2024-23850, CVE-2024-23851, CVE-2024-26585, CVE-2024-26586, CVE-2024-26589, CVE-2024-26591, CVE-2024-26593, CVE-2024-26595, CVE-2024-26598, CVE-2024-26602, CVE-2024-26603, CVE-2024-26607, CVE-2024-26622
Sources used:
SUSE Manager Proxy 4.3 (src): kernel-source-5.14.21-150400.24.111.1, kernel-default-base-5.14.21-150400.24.111.2.150400.24.52.1, kernel-syms-5.14.21-150400.24.111.1
SUSE Manager Server 4.3 (src): kernel-source-5.14.21-150400.24.111.1, kernel-default-base-5.14.21-150400.24.111.2.150400.24.52.1, kernel-syms-5.14.21-150400.24.111.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 26 Maintenance Automation 2024-03-22 16:30:08 UTC

SUSE-SU-2024:0977-1: An update that solves 49 vulnerabilities and has five security fixes can now be installed.

Category: security (important)
Bug References: 1211515, 1213456, 1214064, 1218195, 1218216, 1218562, 1218915, 1219073, 1219126, 1219127, 1219146, 1219295, 1219633, 1219653, 1219827, 1219835, 1220009, 1220140, 1220187, 1220238, 1220240, 1220241, 1220243, 1220250, 1220251, 1220253, 1220254, 1220255, 1220257, 1220326, 1220328, 1220330, 1220335, 1220344, 1220350, 1220364, 1220398, 1220409, 1220433, 1220444, 1220457, 1220459, 1220469, 1220649, 1220735, 1220736, 1220796, 1220797, 1220825, 1220845, 1220917, 1220930, 1220931, 1220933
CVE References: CVE-2019-25162, CVE-2021-46923, CVE-2021-46924, CVE-2021-46932, CVE-2021-46934, CVE-2021-47083, CVE-2022-48627, CVE-2023-28746, CVE-2023-5197, CVE-2023-52340, CVE-2023-52429, CVE-2023-52439, CVE-2023-52443, CVE-2023-52445, CVE-2023-52447, CVE-2023-52448, CVE-2023-52449, CVE-2023-52451, CVE-2023-52452, CVE-2023-52456, CVE-2023-52457, CVE-2023-52463, CVE-2023-52464, CVE-2023-52467, CVE-2023-52475, CVE-2023-52478, CVE-2023-52482, CVE-2023-52484, CVE-2023-52530, CVE-2023-52531, CVE-2023-52559, CVE-2023-6270, CVE-2023-6817, CVE-2024-0607, CVE-2024-1151, CVE-2024-23849, CVE-2024-23850, CVE-2024-23851, CVE-2024-26585, CVE-2024-26586, CVE-2024-26589, CVE-2024-26591, CVE-2024-26593, CVE-2024-26595, CVE-2024-26598, CVE-2024-26602, CVE-2024-26603, CVE-2024-26607, CVE-2024-26622
Maintenance Incident: [SUSE:Maintenance:33016](https://smelt.suse.de/incident/33016/)
Sources used:
SUSE Linux Enterprise Micro for Rancher 5.3 (src):
 kernel-source-rt-5.14.21-150400.15.71.1
SUSE Linux Enterprise Micro 5.3 (src):
 kernel-source-rt-5.14.21-150400.15.71.1
SUSE Linux Enterprise Micro for Rancher 5.4 (src):
 kernel-source-rt-5.14.21-150400.15.71.1
SUSE Linux Enterprise Micro 5.4 (src):
 kernel-source-rt-5.14.21-150400.15.71.1
SUSE Linux Enterprise Live Patching 15-SP4 (src):
 kernel-livepatch-SLE15-SP4-RT_Update_19-1-150400.1.3.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.