1213123 – (CVE-2023-37453) VUL-0: CVE-2023-37453: kernel: out-of-bounds and crash in read_descriptors in drivers/usb/core/sysfs.c.

Bug 1213123 (CVE-2023-37453) - VUL-0: CVE-2023-37453: kernel: out-of-bounds and crash in read_descriptors in drivers/usb/core/sysfs.c.

Summary: VUL-0: CVE-2023-37453: kernel: out-of-bounds and crash in read_descriptors in...

Status:	RESOLVED FIXED
Duplicates (1):	ZDI-24-778 (view as bug list)

Alias:	CVE-2023-37453

Product:	SUSE Security Incidents
Classification:	Novell Products
Component:	Incidents (show other bugs)
Version:	unspecified
Hardware:	Other Other

Priority:	P3 - Medium Severity: Normal
Target Milestone:	---
Assignee:	Security Team bot
QA Contact:	Security Team bot

URL:	https://smash.suse.de/issue/371496/
Whiteboard:	CVSSv3.1:SUSE:CVE-2023-37453:4.6:(AV:...
Keywords:

Depends on:
Blocks:

Clone This Bug

Reported:	2023-07-07 07:17 UTC by Robert Frohl
Modified:	2024-06-25 17:49 UTC (History)
CC List:	4 users (show)

See Also:
Found By:	Security Response Team
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Robert Frohl 2023-07-07 07:17:32 UTC

CVE-2023-37453

An issue was discovered in the USB subsystem in the Linux kernel through 6.4.2.
There is an out-of-bounds and crash in read_descriptors in
drivers/usb/core/sysfs.c.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-37453
https://bugzilla.redhat.com/show_bug.cgi?id=2221039
https://www.cve.org/CVERecord?id=CVE-2023-37453
https://lore.kernel.org/all/000000000000c0ffe505fe86c9ca@google.com/T/
https://lore.kernel.org/all/000000000000e56434059580f86e@google.com/T/
https://syzkaller.appspot.com/bug?extid=18996170f8096c6174d0

Comment 4 Oliver Neukum 2023-09-05 11:50:25 UTC

The upstream fix is

ff33299ec8bb80cdcc073ad9c506bd79bb2ed20b
("USB: core: Fix race by not overwriting udev->descriptor in hub_port_init()")

The vulnerability is caused by
45bf39f8df7f ("USB: core: Don't hold device lock while reading the "descriptors" sysfs file")

While that is merged upstream only in v6.3, we have it in various kernels as a bug fix

Comment 5 Oliver Neukum 2023-09-05 12:56:43 UTC

The oldest kernel affected is SLE15-SP4

Comment 15 Maintenance Automation 2023-09-14 12:30:23 UTC

SUSE-SU-2023:3600-1: An update that solves 16 vulnerabilities, contains seven features and has 44 security fixes can now be installed.

Category: security (important)
Bug References: 1023051, 1120059, 1177719, 1188885, 1193629, 1194869, 1205462, 1208902, 1208949, 1209284, 1209799, 1210048, 1210448, 1212091, 1212142, 1212526, 1212857, 1212873, 1213026, 1213123, 1213546, 1213580, 1213601, 1213666, 1213757, 1213759, 1213916, 1213921, 1213927, 1213946, 1213968, 1213970, 1213971, 1214000, 1214019, 1214120, 1214149, 1214180, 1214238, 1214285, 1214297, 1214299, 1214350, 1214368, 1214370, 1214371, 1214372, 1214380, 1214386, 1214392, 1214393, 1214397, 1214428, 1214451, 1214659, 1214661, 1214729, 1214742, 1214743, 1214756
CVE References: CVE-2023-2007, CVE-2023-20588, CVE-2023-34319, CVE-2023-3610, CVE-2023-37453, CVE-2023-3772, CVE-2023-3863, CVE-2023-4128, CVE-2023-4133, CVE-2023-4134, CVE-2023-4147, CVE-2023-4194, CVE-2023-4273, CVE-2023-4387, CVE-2023-4459, CVE-2023-4569
Jira References: PED-4579, PED-4759, PED-4927, PED-4929, PED-5738, PED-6003, PED-6004
Sources used:
openSUSE Leap 15.4 (src): kernel-source-rt-5.14.21-150400.15.49.1, kernel-syms-rt-5.14.21-150400.15.49.1
SUSE Linux Enterprise Live Patching 15-SP4 (src): kernel-livepatch-SLE15-SP4-RT_Update_12-1-150400.1.3.1
SUSE Real Time Module 15-SP4 (src): kernel-source-rt-5.14.21-150400.15.49.1, kernel-syms-rt-5.14.21-150400.15.49.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 16 Maintenance Automation 2023-09-14 12:31:05 UTC

SUSE-SU-2023:3599-1: An update that solves 20 vulnerabilities, contains eight features and has 53 security fixes can now be installed.

Category: security (important)
Bug References: 1023051, 1120059, 1177719, 1188885, 1193629, 1194869, 1203329, 1203330, 1205462, 1206453, 1208902, 1208949, 1209284, 1209799, 1210048, 1210448, 1211220, 1212091, 1212142, 1212423, 1212526, 1212857, 1212873, 1213026, 1213123, 1213546, 1213580, 1213601, 1213666, 1213733, 1213757, 1213759, 1213916, 1213921, 1213927, 1213946, 1213949, 1213968, 1213970, 1213971, 1214000, 1214019, 1214073, 1214120, 1214149, 1214180, 1214233, 1214238, 1214285, 1214297, 1214299, 1214305, 1214350, 1214368, 1214370, 1214371, 1214372, 1214380, 1214386, 1214392, 1214393, 1214397, 1214404, 1214428, 1214451, 1214659, 1214661, 1214727, 1214729, 1214742, 1214743, 1214756, 1214976
CVE References: CVE-2022-38457, CVE-2022-40133, CVE-2023-2007, CVE-2023-20588, CVE-2023-34319, CVE-2023-3610, CVE-2023-37453, CVE-2023-3772, CVE-2023-3863, CVE-2023-40283, CVE-2023-4128, CVE-2023-4133, CVE-2023-4134, CVE-2023-4147, CVE-2023-4194, CVE-2023-4273, CVE-2023-4387, CVE-2023-4459, CVE-2023-4563, CVE-2023-4569
Jira References: PED-3924, PED-4579, PED-4759, PED-4927, PED-4929, PED-5738, PED-6003, PED-6004
Sources used:
openSUSE Leap 15.5 (src): kernel-syms-rt-5.14.21-150500.13.14.1, kernel-livepatch-SLE15-SP5-RT_Update_4-1-150500.11.3.1, kernel-source-rt-5.14.21-150500.13.14.1
SUSE Linux Enterprise Live Patching 15-SP5 (src): kernel-livepatch-SLE15-SP5-RT_Update_4-1-150500.11.3.1
SUSE Real Time Module 15-SP5 (src): kernel-syms-rt-5.14.21-150500.13.14.1, kernel-source-rt-5.14.21-150500.13.14.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 17 Maintenance Automation 2023-09-18 16:30:27 UTC

SUSE-SU-2023:3656-1: An update that solves 20 vulnerabilities, contains eight features and has 54 security fixes can now be installed.

Category: security (important)
Bug References: 1023051, 1120059, 1177719, 1188885, 1193629, 1194869, 1203329, 1203330, 1205462, 1206453, 1208902, 1208949, 1209284, 1209799, 1210048, 1210448, 1211220, 1212091, 1212142, 1212423, 1212526, 1212857, 1212873, 1213026, 1213123, 1213546, 1213580, 1213601, 1213666, 1213733, 1213757, 1213759, 1213916, 1213921, 1213927, 1213946, 1213949, 1213968, 1213970, 1213971, 1214000, 1214019, 1214073, 1214120, 1214149, 1214180, 1214233, 1214238, 1214285, 1214297, 1214299, 1214305, 1214350, 1214368, 1214370, 1214371, 1214372, 1214380, 1214386, 1214392, 1214393, 1214397, 1214404, 1214428, 1214451, 1214659, 1214661, 1214727, 1214729, 1214742, 1214743, 1214756, 1214760, 1214976
CVE References: CVE-2022-38457, CVE-2022-40133, CVE-2023-2007, CVE-2023-20588, CVE-2023-34319, CVE-2023-3610, CVE-2023-37453, CVE-2023-3772, CVE-2023-3863, CVE-2023-40283, CVE-2023-4128, CVE-2023-4133, CVE-2023-4134, CVE-2023-4147, CVE-2023-4194, CVE-2023-4273, CVE-2023-4387, CVE-2023-4459, CVE-2023-4563, CVE-2023-4569
Jira References: PED-3924, PED-4579, PED-4759, PED-4927, PED-4929, PED-5738, PED-6003, PED-6004
Sources used:
openSUSE Leap 15.5 (src): kernel-source-azure-5.14.21-150500.33.17.1, kernel-syms-azure-5.14.21-150500.33.17.1
Public Cloud Module 15-SP5 (src): kernel-source-azure-5.14.21-150500.33.17.1, kernel-syms-azure-5.14.21-150500.33.17.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 18 Maintenance Automation 2023-09-19 16:30:32 UTC

SUSE-SU-2023:3683-1: An update that solves 16 vulnerabilities, contains seven features and has 44 security fixes can now be installed.

Category: security (important)
Bug References: 1023051, 1120059, 1177719, 1188885, 1193629, 1194869, 1205462, 1208902, 1208949, 1209284, 1209799, 1210048, 1210448, 1212091, 1212142, 1212526, 1212857, 1212873, 1213026, 1213123, 1213546, 1213580, 1213601, 1213666, 1213757, 1213759, 1213916, 1213921, 1213927, 1213946, 1213968, 1213970, 1213971, 1214000, 1214019, 1214120, 1214149, 1214180, 1214238, 1214285, 1214297, 1214299, 1214350, 1214368, 1214370, 1214371, 1214372, 1214380, 1214386, 1214392, 1214393, 1214397, 1214428, 1214451, 1214659, 1214661, 1214729, 1214742, 1214743, 1214756
CVE References: CVE-2023-2007, CVE-2023-20588, CVE-2023-34319, CVE-2023-3610, CVE-2023-37453, CVE-2023-3772, CVE-2023-3863, CVE-2023-4128, CVE-2023-4133, CVE-2023-4134, CVE-2023-4147, CVE-2023-4194, CVE-2023-4273, CVE-2023-4387, CVE-2023-4459, CVE-2023-4569
Jira References: PED-4579, PED-4759, PED-4927, PED-4929, PED-5738, PED-6003, PED-6004
Sources used:
openSUSE Leap 15.4 (src): kernel-syms-5.14.21-150400.24.84.1, kernel-source-5.14.21-150400.24.84.1, kernel-default-base-5.14.21-150400.24.84.1.150400.24.37.1, kernel-obs-build-5.14.21-150400.24.84.1, kernel-livepatch-SLE15-SP4_Update_17-1-150400.9.3.1, kernel-obs-qa-5.14.21-150400.24.84.1
SUSE Linux Enterprise Micro for Rancher 5.3 (src): kernel-default-base-5.14.21-150400.24.84.1.150400.24.37.1
SUSE Linux Enterprise Micro 5.3 (src): kernel-default-base-5.14.21-150400.24.84.1.150400.24.37.1
SUSE Linux Enterprise Micro for Rancher 5.4 (src): kernel-default-base-5.14.21-150400.24.84.1.150400.24.37.1
SUSE Linux Enterprise Micro 5.4 (src): kernel-default-base-5.14.21-150400.24.84.1.150400.24.37.1
Basesystem Module 15-SP4 (src): kernel-default-base-5.14.21-150400.24.84.1.150400.24.37.1, kernel-source-5.14.21-150400.24.84.1
Development Tools Module 15-SP4 (src): kernel-syms-5.14.21-150400.24.84.1, kernel-obs-build-5.14.21-150400.24.84.1, kernel-source-5.14.21-150400.24.84.1
SUSE Linux Enterprise Live Patching 15-SP4 (src): kernel-livepatch-SLE15-SP4_Update_17-1-150400.9.3.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 19 Maintenance Automation 2023-09-19 16:30:53 UTC

SUSE-SU-2023:3682-1: An update that solves 16 vulnerabilities, contains seven features and has 45 security fixes can now be installed.

Category: security (important)
Bug References: 1023051, 1120059, 1177719, 1188885, 1193629, 1194869, 1205462, 1208902, 1208949, 1209284, 1209799, 1210048, 1210448, 1212091, 1212142, 1212526, 1212857, 1212873, 1213026, 1213123, 1213546, 1213580, 1213601, 1213666, 1213757, 1213759, 1213916, 1213921, 1213927, 1213946, 1213968, 1213970, 1213971, 1214000, 1214019, 1214120, 1214149, 1214180, 1214238, 1214285, 1214297, 1214299, 1214350, 1214368, 1214370, 1214371, 1214372, 1214380, 1214386, 1214392, 1214393, 1214397, 1214428, 1214451, 1214659, 1214661, 1214729, 1214742, 1214743, 1214756, 1214760
CVE References: CVE-2023-2007, CVE-2023-20588, CVE-2023-34319, CVE-2023-3610, CVE-2023-37453, CVE-2023-3772, CVE-2023-3863, CVE-2023-4128, CVE-2023-4133, CVE-2023-4134, CVE-2023-4147, CVE-2023-4194, CVE-2023-4273, CVE-2023-4387, CVE-2023-4459, CVE-2023-4569
Jira References: PED-4579, PED-4759, PED-4927, PED-4929, PED-5738, PED-6003, PED-6004
Sources used:
openSUSE Leap 15.4 (src): kernel-syms-azure-5.14.21-150400.14.66.1, kernel-source-azure-5.14.21-150400.14.66.1
Public Cloud Module 15-SP4 (src): kernel-syms-azure-5.14.21-150400.14.66.1, kernel-source-azure-5.14.21-150400.14.66.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 20 Maintenance Automation 2023-09-20 12:30:24 UTC

SUSE-SU-2023:3704-1: An update that solves 20 vulnerabilities, contains eight features and has 53 security fixes can now be installed.

Category: security (important)
Bug References: 1023051, 1120059, 1177719, 1188885, 1193629, 1194869, 1203329, 1203330, 1205462, 1206453, 1208902, 1208949, 1209284, 1209799, 1210048, 1210448, 1211220, 1212091, 1212142, 1212423, 1212526, 1212857, 1212873, 1213026, 1213123, 1213546, 1213580, 1213601, 1213666, 1213733, 1213757, 1213759, 1213916, 1213921, 1213927, 1213946, 1213949, 1213968, 1213970, 1213971, 1214000, 1214019, 1214073, 1214120, 1214149, 1214180, 1214233, 1214238, 1214285, 1214297, 1214299, 1214305, 1214350, 1214368, 1214370, 1214371, 1214372, 1214380, 1214386, 1214392, 1214393, 1214397, 1214404, 1214428, 1214451, 1214659, 1214661, 1214727, 1214729, 1214742, 1214743, 1214756, 1214976
CVE References: CVE-2022-38457, CVE-2022-40133, CVE-2023-2007, CVE-2023-20588, CVE-2023-34319, CVE-2023-3610, CVE-2023-37453, CVE-2023-3772, CVE-2023-3863, CVE-2023-40283, CVE-2023-4128, CVE-2023-4133, CVE-2023-4134, CVE-2023-4147, CVE-2023-4194, CVE-2023-4273, CVE-2023-4387, CVE-2023-4459, CVE-2023-4563, CVE-2023-4569
Jira References: PED-3924, PED-4579, PED-4759, PED-4927, PED-4929, PED-5738, PED-6003, PED-6004
Sources used:
openSUSE Leap 15.5 (src): kernel-livepatch-SLE15-SP5_Update_4-1-150500.11.3.1, kernel-obs-build-5.14.21-150500.55.22.1, kernel-syms-5.14.21-150500.55.22.1, kernel-obs-qa-5.14.21-150500.55.22.1, kernel-source-5.14.21-150500.55.22.1, kernel-default-base-5.14.21-150500.55.22.1.150500.6.8.1
Basesystem Module 15-SP5 (src): kernel-source-5.14.21-150500.55.22.1, kernel-default-base-5.14.21-150500.55.22.1.150500.6.8.1
Development Tools Module 15-SP5 (src): kernel-syms-5.14.21-150500.55.22.1, kernel-obs-build-5.14.21-150500.55.22.1, kernel-source-5.14.21-150500.55.22.1
SUSE Linux Enterprise Live Patching 15-SP5 (src): kernel-livepatch-SLE15-SP5_Update_4-1-150500.11.3.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 21 Maintenance Automation 2023-09-21 12:30:11 UTC

SUSE-SU-2023:3599-2: An update that solves 20 vulnerabilities, contains eight features and has 53 security fixes can now be installed.

Category: security (important)
Bug References: 1023051, 1120059, 1177719, 1188885, 1193629, 1194869, 1203329, 1203330, 1205462, 1206453, 1208902, 1208949, 1209284, 1209799, 1210048, 1210448, 1211220, 1212091, 1212142, 1212423, 1212526, 1212857, 1212873, 1213026, 1213123, 1213546, 1213580, 1213601, 1213666, 1213733, 1213757, 1213759, 1213916, 1213921, 1213927, 1213946, 1213949, 1213968, 1213970, 1213971, 1214000, 1214019, 1214073, 1214120, 1214149, 1214180, 1214233, 1214238, 1214285, 1214297, 1214299, 1214305, 1214350, 1214368, 1214370, 1214371, 1214372, 1214380, 1214386, 1214392, 1214393, 1214397, 1214404, 1214428, 1214451, 1214659, 1214661, 1214727, 1214729, 1214742, 1214743, 1214756, 1214976
CVE References: CVE-2022-38457, CVE-2022-40133, CVE-2023-2007, CVE-2023-20588, CVE-2023-34319, CVE-2023-3610, CVE-2023-37453, CVE-2023-3772, CVE-2023-3863, CVE-2023-40283, CVE-2023-4128, CVE-2023-4133, CVE-2023-4134, CVE-2023-4147, CVE-2023-4194, CVE-2023-4273, CVE-2023-4387, CVE-2023-4459, CVE-2023-4563, CVE-2023-4569
Jira References: PED-3924, PED-4579, PED-4759, PED-4927, PED-4929, PED-5738, PED-6003, PED-6004
Sources used:
openSUSE Leap 15.5 (src): kernel-syms-rt-5.14.21-150500.13.14.1, kernel-source-rt-5.14.21-150500.13.14.1, kernel-livepatch-SLE15-SP5-RT_Update_4-1-150500.11.3.1
SUSE Linux Enterprise Live Patching 15-SP5 (src): kernel-livepatch-SLE15-SP5-RT_Update_4-1-150500.11.3.1
SUSE Real Time Module 15-SP5 (src): kernel-syms-rt-5.14.21-150500.13.14.1, kernel-source-rt-5.14.21-150500.13.14.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 22 Maintenance Automation 2023-09-21 12:30:35 UTC

SUSE-SU-2023:3600-2: An update that solves 16 vulnerabilities, contains seven features and has 44 security fixes can now be installed.

Category: security (important)
Bug References: 1023051, 1120059, 1177719, 1188885, 1193629, 1194869, 1205462, 1208902, 1208949, 1209284, 1209799, 1210048, 1210448, 1212091, 1212142, 1212526, 1212857, 1212873, 1213026, 1213123, 1213546, 1213580, 1213601, 1213666, 1213757, 1213759, 1213916, 1213921, 1213927, 1213946, 1213968, 1213970, 1213971, 1214000, 1214019, 1214120, 1214149, 1214180, 1214238, 1214285, 1214297, 1214299, 1214350, 1214368, 1214370, 1214371, 1214372, 1214380, 1214386, 1214392, 1214393, 1214397, 1214428, 1214451, 1214659, 1214661, 1214729, 1214742, 1214743, 1214756
CVE References: CVE-2023-2007, CVE-2023-20588, CVE-2023-34319, CVE-2023-3610, CVE-2023-37453, CVE-2023-3772, CVE-2023-3863, CVE-2023-4128, CVE-2023-4133, CVE-2023-4134, CVE-2023-4147, CVE-2023-4194, CVE-2023-4273, CVE-2023-4387, CVE-2023-4459, CVE-2023-4569
Jira References: PED-4579, PED-4759, PED-4927, PED-4929, PED-5738, PED-6003, PED-6004
Sources used:
openSUSE Leap 15.4 (src): kernel-syms-rt-5.14.21-150400.15.49.1, kernel-source-rt-5.14.21-150400.15.49.1
SUSE Linux Enterprise Live Patching 15-SP4 (src): kernel-livepatch-SLE15-SP4-RT_Update_12-1-150400.1.3.1
SUSE Real Time Module 15-SP4 (src): kernel-syms-rt-5.14.21-150400.15.49.1, kernel-source-rt-5.14.21-150400.15.49.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 23 Maintenance Automation 2023-09-21 12:31:04 UTC

SUSE-SU-2023:3704-2: An update that solves 20 vulnerabilities, contains eight features and has 53 security fixes can now be installed.

Category: security (important)
Bug References: 1023051, 1120059, 1177719, 1188885, 1193629, 1194869, 1203329, 1203330, 1205462, 1206453, 1208902, 1208949, 1209284, 1209799, 1210048, 1210448, 1211220, 1212091, 1212142, 1212423, 1212526, 1212857, 1212873, 1213026, 1213123, 1213546, 1213580, 1213601, 1213666, 1213733, 1213757, 1213759, 1213916, 1213921, 1213927, 1213946, 1213949, 1213968, 1213970, 1213971, 1214000, 1214019, 1214073, 1214120, 1214149, 1214180, 1214233, 1214238, 1214285, 1214297, 1214299, 1214305, 1214350, 1214368, 1214370, 1214371, 1214372, 1214380, 1214386, 1214392, 1214393, 1214397, 1214404, 1214428, 1214451, 1214659, 1214661, 1214727, 1214729, 1214742, 1214743, 1214756, 1214976
CVE References: CVE-2022-38457, CVE-2022-40133, CVE-2023-2007, CVE-2023-20588, CVE-2023-34319, CVE-2023-3610, CVE-2023-37453, CVE-2023-3772, CVE-2023-3863, CVE-2023-40283, CVE-2023-4128, CVE-2023-4133, CVE-2023-4134, CVE-2023-4147, CVE-2023-4194, CVE-2023-4273, CVE-2023-4387, CVE-2023-4459, CVE-2023-4563, CVE-2023-4569
Jira References: PED-3924, PED-4579, PED-4759, PED-4927, PED-4929, PED-5738, PED-6003, PED-6004
Sources used:
openSUSE Leap 15.5 (src): kernel-livepatch-SLE15-SP5_Update_4-1-150500.11.3.1, kernel-obs-build-5.14.21-150500.55.22.1, kernel-syms-5.14.21-150500.55.22.1, kernel-obs-qa-5.14.21-150500.55.22.1, kernel-source-5.14.21-150500.55.22.1, kernel-default-base-5.14.21-150500.55.22.1.150500.6.8.1
Basesystem Module 15-SP5 (src): kernel-source-5.14.21-150500.55.22.1, kernel-default-base-5.14.21-150500.55.22.1.150500.6.8.1
Development Tools Module 15-SP5 (src): kernel-syms-5.14.21-150500.55.22.1, kernel-obs-build-5.14.21-150500.55.22.1, kernel-source-5.14.21-150500.55.22.1
SUSE Linux Enterprise Live Patching 15-SP5 (src): kernel-livepatch-SLE15-SP5_Update_4-1-150500.11.3.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 24 Maintenance Automation 2023-09-21 12:31:30 UTC

SUSE-SU-2023:3683-2: An update that solves 16 vulnerabilities, contains seven features and has 44 security fixes can now be installed.

Category: security (important)
Bug References: 1023051, 1120059, 1177719, 1188885, 1193629, 1194869, 1205462, 1208902, 1208949, 1209284, 1209799, 1210048, 1210448, 1212091, 1212142, 1212526, 1212857, 1212873, 1213026, 1213123, 1213546, 1213580, 1213601, 1213666, 1213757, 1213759, 1213916, 1213921, 1213927, 1213946, 1213968, 1213970, 1213971, 1214000, 1214019, 1214120, 1214149, 1214180, 1214238, 1214285, 1214297, 1214299, 1214350, 1214368, 1214370, 1214371, 1214372, 1214380, 1214386, 1214392, 1214393, 1214397, 1214428, 1214451, 1214659, 1214661, 1214729, 1214742, 1214743, 1214756
CVE References: CVE-2023-2007, CVE-2023-20588, CVE-2023-34319, CVE-2023-3610, CVE-2023-37453, CVE-2023-3772, CVE-2023-3863, CVE-2023-4128, CVE-2023-4133, CVE-2023-4134, CVE-2023-4147, CVE-2023-4194, CVE-2023-4273, CVE-2023-4387, CVE-2023-4459, CVE-2023-4569
Jira References: PED-4579, PED-4759, PED-4927, PED-4929, PED-5738, PED-6003, PED-6004
Sources used:
openSUSE Leap 15.4 (src): kernel-syms-5.14.21-150400.24.84.1, kernel-source-5.14.21-150400.24.84.1, kernel-default-base-5.14.21-150400.24.84.1.150400.24.37.1, kernel-obs-build-5.14.21-150400.24.84.1, kernel-livepatch-SLE15-SP4_Update_17-1-150400.9.3.1, kernel-obs-qa-5.14.21-150400.24.84.1
SUSE Linux Enterprise Micro for Rancher 5.3 (src): kernel-default-base-5.14.21-150400.24.84.1.150400.24.37.1
SUSE Linux Enterprise Micro 5.3 (src): kernel-default-base-5.14.21-150400.24.84.1.150400.24.37.1
SUSE Linux Enterprise Micro for Rancher 5.4 (src): kernel-default-base-5.14.21-150400.24.84.1.150400.24.37.1
SUSE Linux Enterprise Micro 5.4 (src): kernel-default-base-5.14.21-150400.24.84.1.150400.24.37.1
Basesystem Module 15-SP4 (src): kernel-default-base-5.14.21-150400.24.84.1.150400.24.37.1, kernel-source-5.14.21-150400.24.84.1
Development Tools Module 15-SP4 (src): kernel-syms-5.14.21-150400.24.84.1, kernel-obs-build-5.14.21-150400.24.84.1, kernel-source-5.14.21-150400.24.84.1
SUSE Linux Enterprise Live Patching 15-SP4 (src): kernel-livepatch-SLE15-SP4_Update_17-1-150400.9.3.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 35 Maintenance Automation 2023-10-04 08:31:13 UTC

SUSE-SU-2023:3964-1: An update that solves 16 vulnerabilities, contains seven features and has 49 security fixes can now be installed.

Category: security (important)
Bug References: 1023051, 1120059, 1177719, 1188885, 1193629, 1194869, 1205462, 1208902, 1208949, 1209284, 1209799, 1210048, 1210448, 1212091, 1212142, 1212526, 1212857, 1212873, 1213026, 1213123, 1213546, 1213580, 1213601, 1213666, 1213757, 1213759, 1213916, 1213921, 1213927, 1213946, 1213968, 1213970, 1213971, 1214000, 1214019, 1214120, 1214149, 1214180, 1214238, 1214285, 1214297, 1214299, 1214350, 1214368, 1214370, 1214371, 1214372, 1214380, 1214386, 1214392, 1214393, 1214397, 1214428, 1214451, 1214635, 1214659, 1214661, 1214729, 1214742, 1214743, 1214756, 1215522, 1215523, 1215552, 1215553
CVE References: CVE-2023-2007, CVE-2023-20588, CVE-2023-34319, CVE-2023-3610, CVE-2023-37453, CVE-2023-3772, CVE-2023-3863, CVE-2023-4128, CVE-2023-4133, CVE-2023-4134, CVE-2023-4147, CVE-2023-4194, CVE-2023-4273, CVE-2023-4387, CVE-2023-4459, CVE-2023-4569
Jira References: PED-4579, PED-4759, PED-4927, PED-4929, PED-5738, PED-6003, PED-6004
Sources used:
openSUSE Leap 15.4 (src): kernel-source-rt-5.14.21-150400.15.53.1, kernel-syms-rt-5.14.21-150400.15.53.1
SUSE Linux Enterprise Live Patching 15-SP4 (src): kernel-livepatch-SLE15-SP4-RT_Update_13-1-150400.1.3.1
SUSE Real Time Module 15-SP4 (src): kernel-source-rt-5.14.21-150400.15.53.1, kernel-syms-rt-5.14.21-150400.15.53.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 36 Maintenance Automation 2023-10-04 16:30:15 UTC

SUSE-SU-2023:3971-1: An update that solves 20 vulnerabilities, contains eight features and has 58 security fixes can now be installed.

Category: security (important)
Bug References: 1023051, 1120059, 1177719, 1188885, 1193629, 1194869, 1203329, 1203330, 1205462, 1206453, 1208902, 1208949, 1209284, 1209799, 1210048, 1210448, 1211220, 1212091, 1212142, 1212423, 1212526, 1212857, 1212873, 1213026, 1213123, 1213546, 1213580, 1213601, 1213666, 1213733, 1213757, 1213759, 1213916, 1213921, 1213927, 1213946, 1213949, 1213968, 1213970, 1213971, 1214000, 1214019, 1214073, 1214120, 1214149, 1214180, 1214233, 1214238, 1214285, 1214297, 1214299, 1214305, 1214350, 1214368, 1214370, 1214371, 1214372, 1214380, 1214386, 1214392, 1214393, 1214397, 1214404, 1214428, 1214451, 1214635, 1214659, 1214661, 1214727, 1214729, 1214742, 1214743, 1214756, 1214976, 1215522, 1215523, 1215552, 1215553
CVE References: CVE-2022-38457, CVE-2022-40133, CVE-2023-2007, CVE-2023-20588, CVE-2023-34319, CVE-2023-3610, CVE-2023-37453, CVE-2023-3772, CVE-2023-3863, CVE-2023-40283, CVE-2023-4128, CVE-2023-4133, CVE-2023-4134, CVE-2023-4147, CVE-2023-4194, CVE-2023-4273, CVE-2023-4387, CVE-2023-4459, CVE-2023-4563, CVE-2023-4569
Jira References: PED-3924, PED-4579, PED-4759, PED-4927, PED-4929, PED-5738, PED-6003, PED-6004
Sources used:
openSUSE Leap 15.5 (src): kernel-obs-build-5.14.21-150500.55.28.1, kernel-obs-qa-5.14.21-150500.55.28.1, kernel-syms-5.14.21-150500.55.28.1, kernel-source-5.14.21-150500.55.28.1, kernel-default-base-5.14.21-150500.55.28.1.150500.6.11.2, kernel-livepatch-SLE15-SP5_Update_5-1-150500.11.5.1
SUSE Linux Enterprise Micro 5.5 (src): kernel-default-base-5.14.21-150500.55.28.1.150500.6.11.2
Basesystem Module 15-SP5 (src): kernel-default-base-5.14.21-150500.55.28.1.150500.6.11.2, kernel-source-5.14.21-150500.55.28.1
Development Tools Module 15-SP5 (src): kernel-obs-build-5.14.21-150500.55.28.1, kernel-syms-5.14.21-150500.55.28.1, kernel-source-5.14.21-150500.55.28.1
SUSE Linux Enterprise Live Patching 15-SP5 (src): kernel-livepatch-SLE15-SP5_Update_5-1-150500.11.5.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 37 Maintenance Automation 2023-10-04 16:30:42 UTC

SUSE-SU-2023:3969-1: An update that solves 16 vulnerabilities, contains seven features and has 49 security fixes can now be installed.

Category: security (important)
Bug References: 1023051, 1120059, 1177719, 1188885, 1193629, 1194869, 1205462, 1208902, 1208949, 1209284, 1209799, 1210048, 1210448, 1212091, 1212142, 1212526, 1212857, 1212873, 1213026, 1213123, 1213546, 1213580, 1213601, 1213666, 1213757, 1213759, 1213916, 1213921, 1213927, 1213946, 1213968, 1213970, 1213971, 1214000, 1214019, 1214120, 1214149, 1214180, 1214238, 1214285, 1214297, 1214299, 1214350, 1214368, 1214370, 1214371, 1214372, 1214380, 1214386, 1214392, 1214393, 1214397, 1214428, 1214451, 1214635, 1214659, 1214661, 1214729, 1214742, 1214743, 1214756, 1215522, 1215523, 1215552, 1215553
CVE References: CVE-2023-2007, CVE-2023-20588, CVE-2023-34319, CVE-2023-3610, CVE-2023-37453, CVE-2023-3772, CVE-2023-3863, CVE-2023-4128, CVE-2023-4133, CVE-2023-4134, CVE-2023-4147, CVE-2023-4194, CVE-2023-4273, CVE-2023-4387, CVE-2023-4459, CVE-2023-4569
Jira References: PED-4579, PED-4759, PED-4927, PED-4929, PED-5738, PED-6003, PED-6004
Sources used:
openSUSE Leap 15.4 (src): kernel-source-5.14.21-150400.24.88.1, kernel-livepatch-SLE15-SP4_Update_18-1-150400.9.3.1, kernel-syms-5.14.21-150400.24.88.1, kernel-obs-qa-5.14.21-150400.24.88.1, kernel-obs-build-5.14.21-150400.24.88.1, kernel-default-base-5.14.21-150400.24.88.1.150400.24.40.1
SUSE Linux Enterprise Micro for Rancher 5.3 (src): kernel-default-base-5.14.21-150400.24.88.1.150400.24.40.1
SUSE Linux Enterprise Micro 5.3 (src): kernel-default-base-5.14.21-150400.24.88.1.150400.24.40.1
SUSE Linux Enterprise Micro for Rancher 5.4 (src): kernel-default-base-5.14.21-150400.24.88.1.150400.24.40.1
SUSE Linux Enterprise Micro 5.4 (src): kernel-default-base-5.14.21-150400.24.88.1.150400.24.40.1
Basesystem Module 15-SP4 (src): kernel-source-5.14.21-150400.24.88.1, kernel-default-base-5.14.21-150400.24.88.1.150400.24.40.1
Development Tools Module 15-SP4 (src): kernel-obs-build-5.14.21-150400.24.88.1, kernel-source-5.14.21-150400.24.88.1, kernel-syms-5.14.21-150400.24.88.1
SUSE Linux Enterprise Live Patching 15-SP4 (src): kernel-livepatch-SLE15-SP4_Update_18-1-150400.9.3.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 38 Maintenance Automation 2023-10-05 16:29:19 UTC

SUSE-SU-2023:3988-1: An update that solves 24 vulnerabilities, contains 10 features and has 64 security fixes can now be installed.

Category: security (important)
Bug References: 1023051, 1065729, 1120059, 1177719, 1187236, 1188885, 1193629, 1194869, 1203329, 1203330, 1205462, 1206453, 1208902, 1208949, 1208995, 1209284, 1209799, 1210048, 1210169, 1210448, 1210643, 1211220, 1212091, 1212142, 1212423, 1212526, 1212857, 1212873, 1213026, 1213123, 1213546, 1213580, 1213601, 1213666, 1213733, 1213757, 1213759, 1213916, 1213921, 1213927, 1213946, 1213949, 1213968, 1213970, 1213971, 1214000, 1214019, 1214073, 1214120, 1214149, 1214180, 1214233, 1214238, 1214285, 1214297, 1214299, 1214305, 1214350, 1214368, 1214370, 1214371, 1214372, 1214380, 1214386, 1214392, 1214393, 1214397, 1214404, 1214428, 1214451, 1214635, 1214659, 1214661, 1214727, 1214729, 1214742, 1214743, 1214756, 1214813, 1214873, 1214928, 1214976, 1214988, 1215123, 1215124, 1215148, 1215221, 1215523
CVE References: CVE-2022-38457, CVE-2022-40133, CVE-2023-1192, CVE-2023-1859, CVE-2023-2007, CVE-2023-20588, CVE-2023-2177, CVE-2023-34319, CVE-2023-3610, CVE-2023-37453, CVE-2023-3772, CVE-2023-3863, CVE-2023-40283, CVE-2023-4128, CVE-2023-4133, CVE-2023-4134, CVE-2023-4147, CVE-2023-4194, CVE-2023-4273, CVE-2023-4387, CVE-2023-4459, CVE-2023-4563, CVE-2023-4569, CVE-2023-4881
Jira References: PED-2023, PED-2025, PED-3924, PED-4579, PED-4759, PED-4927, PED-4929, PED-5738, PED-6003, PED-6004
Sources used:
SUSE Real Time Module 15-SP5 (src): kernel-syms-rt-5.14.21-150500.13.18.1, kernel-source-rt-5.14.21-150500.13.18.1
openSUSE Leap 15.5 (src): kernel-syms-rt-5.14.21-150500.13.18.1, kernel-livepatch-SLE15-SP5-RT_Update_5-1-150500.11.3.1, kernel-source-rt-5.14.21-150500.13.18.1
SUSE Linux Enterprise Live Patching 15-SP5 (src): kernel-livepatch-SLE15-SP5-RT_Update_5-1-150500.11.3.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 41 Maintenance Automation 2023-10-12 12:46:28 UTC

SUSE-SU-2023:4058-1: An update that solves 18 vulnerabilities, contains three features and has 71 security fixes can now be installed.

Category: security (important)
Bug References: 1065729, 1152472, 1187236, 1201284, 1202845, 1206453, 1208995, 1210169, 1210643, 1210658, 1212639, 1212703, 1213123, 1213534, 1213808, 1214022, 1214037, 1214040, 1214233, 1214351, 1214479, 1214543, 1214635, 1214813, 1214873, 1214928, 1214940, 1214941, 1214942, 1214943, 1214944, 1214945, 1214946, 1214947, 1214948, 1214949, 1214950, 1214951, 1214952, 1214953, 1214954, 1214955, 1214957, 1214958, 1214959, 1214961, 1214962, 1214963, 1214964, 1214965, 1214966, 1214967, 1214986, 1214988, 1214990, 1214991, 1214992, 1214993, 1214995, 1214997, 1214998, 1215115, 1215117, 1215123, 1215124, 1215148, 1215150, 1215221, 1215275, 1215322, 1215467, 1215523, 1215581, 1215752, 1215858, 1215860, 1215861, 1215875, 1215877, 1215894, 1215895, 1215896, 1215899, 1215911, 1215915, 1215916, 1215941, 1215956, 1215957
CVE References: CVE-2023-1192, CVE-2023-1206, CVE-2023-1859, CVE-2023-2177, CVE-2023-37453, CVE-2023-39192, CVE-2023-39193, CVE-2023-39194, CVE-2023-40283, CVE-2023-4155, CVE-2023-42753, CVE-2023-42754, CVE-2023-4389, CVE-2023-4622, CVE-2023-4623, CVE-2023-4881, CVE-2023-4921, CVE-2023-5345
Jira References: PED-1549, PED-2023, PED-2025
Sources used:
openSUSE Leap 15.5 (src): kernel-source-azure-5.14.21-150500.33.20.1, kernel-syms-azure-5.14.21-150500.33.20.1
Public Cloud Module 15-SP5 (src): kernel-source-azure-5.14.21-150500.33.20.1, kernel-syms-azure-5.14.21-150500.33.20.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 46 Andrea Mattiazzo 2024-05-23 15:53:35 UTC

All done, closing.

Comment 47 Andrea Mattiazzo 2024-06-18 10:04:34 UTC

*** Bug 1226474 has been marked as a duplicate of this bug. ***