Bug 1213167 (CVE-2023-3567) - VUL-0: CVE-2023-3567: kernel-source,kernel-source-rt,kernel-source-azure: use after free in vcs_read() in the vc_screen driver due to race condition
Summary: VUL-0: CVE-2023-3567: kernel-source,kernel-source-rt,kernel-source-azure: use...
Status: RESOLVED FIXED
Alias: CVE-2023-3567
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/371602/
Whiteboard: CVSSv3.1:SUSE:CVE-2023-3567:7.8:(AV:L...
Keywords:
Depends on:
Blocks: 1213244
  Show dependency tree / graph
 
Reported: 2023-07-10 06:35 UTC by Carlos López
Modified: 2024-06-26 08:40 UTC (History)
5 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Carlos López 2023-07-10 06:35:59 UTC 
CVE-2023-3567

A use-after-free flaw was found in vcs_read in drivers/tty/vt/vc_screen.c in vc_screen in the Linux Kernel. In this flaw an attacker with local user access may ead to a system crash or a leak of internal kernel information.

Reference:
https://www.spinics.net/lists/stable-commits/msg285184.html

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-3567
https://bugzilla.redhat.com/show_bug.cgi?id=2221463
Comment 1 Carlos López 2023-07-10 06:52:35 UTC 
Upstream fix:
https://github.com/torvalds/linux/commit/226fae124b2dac217ea5436060d623ff3385bc34

Fixes:
https://github.com/torvalds/linux/commit/ac751efa6a0d70f2c9daef5c7e3a92270f5c2dff

Which apparently is quite old

$ git describe --contains ac751efa6a0d70f2c9daef5c7e3a92270f5c2dff
v2.6.38-rc3~34

The fix is already in stable, master and ALP-current, tracking the rest of branches as affected.
Comment 2 Chester Lin 2023-07-10 13:29:07 UTC 
(In reply to Carlos López from comment #1)
> Upstream fix:
> https://github.com/torvalds/linux/commit/
> 226fae124b2dac217ea5436060d623ff3385bc34
> 
> Fixes:
> https://github.com/torvalds/linux/commit/
> ac751efa6a0d70f2c9daef5c7e3a92270f5c2dff
> 
> Which apparently is quite old
> 
> $ git describe --contains ac751efa6a0d70f2c9daef5c7e3a92270f5c2dff
> v2.6.38-rc3~34
> 
> The fix is already in stable, master and ALP-current, tracking the rest of
> branches as affected.

The patch 226fae124b2d has been applied in SLE15-SP4 and SLE15-SP5 but it's not yet present in the rest of the major branches.
Comment 3 Chester Lin 2023-07-11 14:06:01 UTC 

(In reply to Chester Lin from comment #2)
> (In reply to Carlos López from comment #1)
> > Upstream fix:
> > https://github.com/torvalds/linux/commit/
> > 226fae124b2dac217ea5436060d623ff3385bc34
> > 
> > Fixes:
> > https://github.com/torvalds/linux/commit/
> > ac751efa6a0d70f2c9daef5c7e3a92270f5c2dff
> > 
> > Which apparently is quite old
> > 
> > $ git describe --contains ac751efa6a0d70f2c9daef5c7e3a92270f5c2dff
> > v2.6.38-rc3~34
> > 
> > The fix is already in stable, master and ALP-current, tracking the rest of
> > branches as affected.
> 
> The patch 226fae124b2d has been applied in SLE15-SP4 and SLE15-SP5 but it's
> not yet present in the rest of the major branches.

Besides, there are two more fix patches [applied in SLE15-SP4 & SP5 as well] required based on the target patch 226fae124b2d :

46d733d0efc7 "vc_screen: modify vcs_size() handling in vcs_read()"
ae3419fbac84 "vc_screen: don't clobber return value in vcs_read"

These three patches are also backported in upstream stable branches since linux-5.4.y[1] but they are not available for the previous stable branches such as linux-4.14.y.

[1]https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/log/drivers/tty/vt/vc_screen.c?h=linux-5.4.y
Comment 4 Chester Lin 2023-07-11 14:08:18 UTC 
(In reply to Chester Lin from comment #3)
> 
> (In reply to Chester Lin from comment #2)
> > (In reply to Carlos López from comment #1)
> > > Upstream fix:
> > > https://github.com/torvalds/linux/commit/
> > > 226fae124b2dac217ea5436060d623ff3385bc34
> > > 
> > > Fixes:
> > > https://github.com/torvalds/linux/commit/
> > > ac751efa6a0d70f2c9daef5c7e3a92270f5c2dff
> > > 
> > > Which apparently is quite old
> > > 
> > > $ git describe --contains ac751efa6a0d70f2c9daef5c7e3a92270f5c2dff
> > > v2.6.38-rc3~34
> > > 
> > > The fix is already in stable, master and ALP-current, tracking the rest of
> > > branches as affected.
> > 
> > The patch 226fae124b2d has been applied in SLE15-SP4 and SLE15-SP5 but it's
> > not yet present in the rest of the major branches.
> 
> Besides, there are two more fix patches [applied in SLE15-SP4 & SP5 as well]
> required based on the target patch 226fae124b2d :
> 
> 46d733d0efc7 "vc_screen: modify vcs_size() handling in vcs_read()"
> ae3419fbac84 "vc_screen: don't clobber return value in vcs_read"
> 
> These three patches are also backported in upstream stable branches since
> linux-5.4.y[1] but they are not available for the previous stable branches
> such as linux-4.14.y.
> 
> [1]https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/log/
> drivers/tty/vt/vc_screen.c?h=linux-5.4.y(In reply to Chester Lin from comment #3)
> 
> (In reply to Chester Lin from comment #2)
> > (In reply to Carlos López from comment #1)
> > > Upstream fix:
> > > https://github.com/torvalds/linux/commit/
> > > 226fae124b2dac217ea5436060d623ff3385bc34
> > > 
> > > Fixes:
> > > https://github.com/torvalds/linux/commit/
> > > ac751efa6a0d70f2c9daef5c7e3a92270f5c2dff
> > > 
> > > Which apparently is quite old
> > > 
> > > $ git describe --contains ac751efa6a0d70f2c9daef5c7e3a92270f5c2dff
> > > v2.6.38-rc3~34
> > > 
> > > The fix is already in stable, master and ALP-current, tracking the rest of
> > > branches as affected.
> > 
> > The patch 226fae124b2d has been applied in SLE15-SP4 and SLE15-SP5 but it's
> > not yet present in the rest of the major branches.
> 
> Besides, there are two more fix patches [applied in SLE15-SP4 & SP5 as well]
> required based on the target patch 226fae124b2d :
> 
> 46d733d0efc7 "vc_screen: modify vcs_size() handling in vcs_read()"
> ae3419fbac84 "vc_screen: don't clobber return value in vcs_read"
> 
> These three patches are also backported in upstream stable branches since
> linux-5.4.y[1] but they are not available for the previous stable branches
> such as linux-4.14.y.
> 
> [1]https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/log/
> drivers/tty/vt/vc_screen.c?h=linux-5.4.y

Reassigning to me to ensure progress [1], see also the process at [2].
 
[1] https://confluence.suse.com/display/KSS/Kernel+Security+Sentinel
[2] https://wiki.suse.net/index.php/SUSE-Labs/Kernel/Security
Comment 5 Chester Lin 2023-07-11 14:11:19 UTC 
(In reply to Chester Lin from comment #3)
> 
> (In reply to Chester Lin from comment #2)
> > (In reply to Carlos López from comment #1)
> > > Upstream fix:
> > > https://github.com/torvalds/linux/commit/
> > > 226fae124b2dac217ea5436060d623ff3385bc34
> > > 
> > > Fixes:
> > > https://github.com/torvalds/linux/commit/
> > > ac751efa6a0d70f2c9daef5c7e3a92270f5c2dff
> > > 
> > > Which apparently is quite old
> > > 
> > > $ git describe --contains ac751efa6a0d70f2c9daef5c7e3a92270f5c2dff
> > > v2.6.38-rc3~34
> > > 
> > > The fix is already in stable, master and ALP-current, tracking the rest of
> > > branches as affected.
> > 
> > The patch 226fae124b2d has been applied in SLE15-SP4 and SLE15-SP5 but it's
> > not yet present in the rest of the major branches.
> 
> Besides, there are two more fix patches [applied in SLE15-SP4 & SP5 as well]
> required based on the target patch 226fae124b2d :
> 
> 46d733d0efc7 "vc_screen: modify vcs_size() handling in vcs_read()"
> ae3419fbac84 "vc_screen: don't clobber return value in vcs_read"
> 
> These three patches are also backported in upstream stable branches since
> linux-5.4.y[1] but they are not available for the previous stable branches
> such as linux-4.14.y.
> 
> [1]https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/log/
> drivers/tty/vt/vc_screen.c?h=linux-5.4.y

Hi Jiri,

May I have your suggestions here? IIUC it's not difficult to backport them to cve/linux-5.3 but I'm still checking if it's applicable for cve/linux-4.12, cve/linux-4.4 and cve/linux-3.0.

Thanks.
Comment 6 Jiri Slaby 2023-07-24 08:55:14 UTC 
(In reply to Chester Lin from comment #5)
> May I have your suggestions here? IIUC it's not difficult to backport them
> to cve/linux-5.3

Hi, it should be straightforward to apply these to 5.3.

> but I'm still checking if it's applicable for
> cve/linux-4.12, cve/linux-4.4 and cve/linux-3.0.

I think so -- but I haven't tried. 

So do you plan to backport the patches or should I try?
Comment 7 Chester Lin 2023-07-24 15:34:16 UTC 
(In reply to Jiri Slaby from comment #6)
> (In reply to Chester Lin from comment #5)
> > May I have your suggestions here? IIUC it's not difficult to backport them
> > to cve/linux-5.3
> 
> Hi, it should be straightforward to apply these to 5.3.
> 
> > but I'm still checking if it's applicable for
> > cve/linux-4.12, cve/linux-4.4 and cve/linux-3.0.
> 
> I think so -- but I haven't tried. 
> 
> So do you plan to backport the patches or should I try?

Hi Jiri,

Reassigned to you since you are the best person who works on tty subsystem :-)

Thanks!
Comment 8 Jiri Slaby 2023-07-26 08:32:19 UTC 
pushed to:
15-sp4 (only references update)
cve/linux-5.3
cve/linux-4.12
cve/linux-4.4
cve/linux-3.0
Comment 41 Paul Fee 2023-08-11 13:52:08 UTC 
https://www.suse.com/security/cve/CVE-2023-3567.html

This page mentions fix will be in kernel-default >= 5.14.21-150400.24.81.1, yet the latest version in repo-sle-update is 5.14.21-150400.24.74.1.

Any guidance on when the fix for CVE-2023-3567 will be published for SLE 15 SP4 / Leap 15.4?

http://download.opensuse.org/update/leap/15.4/sle/

Thanks.
Comment 44 Maintenance Automation 2023-08-14 08:30:26 UTC 
SUSE-SU-2023:3302-1: An update that solves 28 vulnerabilities, contains two features and has 115 fixes can now be installed.

Category: security (important)
Bug References: 1150305, 1187829, 1193629, 1194869, 1206418, 1207129, 1207894, 1207948, 1208788, 1210335, 1210565, 1210584, 1210627, 1210780, 1210825, 1210853, 1211014, 1211131, 1211243, 1211738, 1211811, 1211867, 1212051, 1212256, 1212265, 1212301, 1212445, 1212456, 1212502, 1212525, 1212603, 1212604, 1212685, 1212766, 1212835, 1212838, 1212842, 1212846, 1212848, 1212861, 1212869, 1212892, 1212901, 1212905, 1212961, 1213010, 1213011, 1213012, 1213013, 1213014, 1213015, 1213016, 1213017, 1213018, 1213019, 1213020, 1213021, 1213024, 1213025, 1213032, 1213034, 1213035, 1213036, 1213037, 1213038, 1213039, 1213040, 1213041, 1213059, 1213061, 1213087, 1213088, 1213089, 1213090, 1213092, 1213093, 1213094, 1213095, 1213096, 1213098, 1213099, 1213100, 1213102, 1213103, 1213104, 1213105, 1213106, 1213107, 1213108, 1213109, 1213110, 1213111, 1213112, 1213113, 1213114, 1213116, 1213134, 1213167, 1213205, 1213206, 1213226, 1213233, 1213245, 1213247, 1213252, 1213258, 1213259, 1213263, 1213264, 1213272, 1213286, 1213287, 1213304, 1213417, 1213493, 1213523, 1213524, 1213533, 1213543, 1213578, 1213585, 1213586, 1213588, 1213601, 1213620, 1213632, 1213653, 1213705, 1213713, 1213715, 1213747, 1213756, 1213759, 1213777, 1213810, 1213812, 1213856, 1213857, 1213863, 1213867, 1213870, 1213871, 1213872
CVE References: CVE-2022-40982, CVE-2023-0459, CVE-2023-1829, CVE-2023-20569, CVE-2023-20593, CVE-2023-21400, CVE-2023-2156, CVE-2023-2166, CVE-2023-2430, CVE-2023-2985, CVE-2023-3090, CVE-2023-31083, CVE-2023-3111, CVE-2023-3117, CVE-2023-31248, CVE-2023-3212, CVE-2023-3268, CVE-2023-3389, CVE-2023-3390, CVE-2023-35001, CVE-2023-3567, CVE-2023-3609, CVE-2023-3611, CVE-2023-3776, CVE-2023-3812, CVE-2023-38409, CVE-2023-3863, CVE-2023-4004
Jira References: PED-4718, PED-4758
Sources used:
openSUSE Leap 15.5 (src): kernel-livepatch-SLE15-SP5-RT_Update_3-1-150500.11.5.1, kernel-syms-rt-5.14.21-150500.13.11.1, kernel-source-rt-5.14.21-150500.13.11.1
SUSE Linux Enterprise Live Patching 15-SP5 (src): kernel-livepatch-SLE15-SP5-RT_Update_3-1-150500.11.5.1
SUSE Real Time Module 15-SP5 (src): kernel-syms-rt-5.14.21-150500.13.11.1, kernel-source-rt-5.14.21-150500.13.11.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 45 Marcus Meissner 2023-08-14 09:23:34 UTC 
(In reply to Paul Fee from comment #41)
> https://www.suse.com/security/cve/CVE-2023-3567.html
> 
> This page mentions fix will be in kernel-default >= 5.14.21-150400.24.81.1,
> yet the latest version in repo-sle-update is 5.14.21-150400.24.74.1.
> 
> Any guidance on when the fix for CVE-2023-3567 will be published for SLE 15
> SP4 / Leap 15.4?
> 
> http://download.opensuse.org/update/leap/15.4/sle/
> 
> Thanks.

The page lists the updates in QA, QA for kernels usually takes around a week.

So expect releases this week.
Comment 46 Maintenance Automation 2023-08-14 16:30:04 UTC 
SUSE-SU-2023:3309-1: An update that solves seven vulnerabilities and has 15 fixes can now be installed.

Category: security (important)
Bug References: 1188885, 1202670, 1206418, 1207526, 1207528, 1211738, 1212266, 1213167, 1213287, 1213350, 1213585, 1213586, 1213588, 1213705, 1213747, 1213766, 1213819, 1213823, 1213825, 1213827, 1213842, 962880
CVE References: CVE-2022-40982, CVE-2023-0459, CVE-2023-20569, CVE-2023-3567, CVE-2023-3609, CVE-2023-3611, CVE-2023-3776
Sources used:
SUSE Linux Enterprise Live Patching 12-SP5 (src): kgraft-patch-SLE12-SP5_Update_47-1-8.3.3
SUSE Linux Enterprise Software Development Kit 12 SP5 (src): kernel-obs-build-4.12.14-122.173.1
SUSE Linux Enterprise High Performance Computing 12 SP5 (src): kernel-syms-4.12.14-122.173.1, kernel-source-4.12.14-122.173.1
SUSE Linux Enterprise Server 12 SP5 (src): kernel-syms-4.12.14-122.173.1, kernel-source-4.12.14-122.173.1
SUSE Linux Enterprise Server for SAP Applications 12 SP5 (src): kernel-syms-4.12.14-122.173.1, kernel-source-4.12.14-122.173.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 47 Maintenance Automation 2023-08-14 16:30:14 UTC 
SUSE-SU-2023:3313-1: An update that solves 13 vulnerabilities and has 20 fixes can now be installed.

Category: security (important)
Bug References: 1206418, 1207129, 1210627, 1210780, 1211131, 1211738, 1212502, 1212604, 1212901, 1213167, 1213272, 1213287, 1213304, 1213585, 1213586, 1213588, 1213620, 1213653, 1213713, 1213715, 1213747, 1213756, 1213759, 1213777, 1213810, 1213812, 1213842, 1213856, 1213857, 1213863, 1213867, 1213870, 1213871
CVE References: CVE-2022-40982, CVE-2023-0459, CVE-2023-20569, CVE-2023-21400, CVE-2023-2156, CVE-2023-2166, CVE-2023-31083, CVE-2023-3268, CVE-2023-3567, CVE-2023-3609, CVE-2023-3611, CVE-2023-3776, CVE-2023-4004
Sources used:
SUSE Linux Enterprise Micro for Rancher 5.4 (src): kernel-default-base-5.14.21-150400.24.81.1.150400.24.35.3
SUSE Linux Enterprise Micro 5.4 (src): kernel-default-base-5.14.21-150400.24.81.1.150400.24.35.3
Basesystem Module 15-SP4 (src): kernel-default-base-5.14.21-150400.24.81.1.150400.24.35.3, kernel-source-5.14.21-150400.24.81.1
Development Tools Module 15-SP4 (src): kernel-source-5.14.21-150400.24.81.1, kernel-syms-5.14.21-150400.24.81.1, kernel-obs-build-5.14.21-150400.24.81.1
SUSE Linux Enterprise Live Patching 15-SP4 (src): kernel-livepatch-SLE15-SP4_Update_16-1-150400.9.3.3
openSUSE Leap 15.4 (src): kernel-obs-qa-5.14.21-150400.24.81.1, kernel-default-base-5.14.21-150400.24.81.1.150400.24.35.3, kernel-syms-5.14.21-150400.24.81.1, kernel-source-5.14.21-150400.24.81.1, kernel-obs-build-5.14.21-150400.24.81.1, kernel-livepatch-SLE15-SP4_Update_16-1-150400.9.3.3
openSUSE Leap Micro 5.3 (src): kernel-default-base-5.14.21-150400.24.81.1.150400.24.35.3
openSUSE Leap Micro 5.4 (src): kernel-default-base-5.14.21-150400.24.81.1.150400.24.35.3
SUSE Linux Enterprise Micro for Rancher 5.3 (src): kernel-default-base-5.14.21-150400.24.81.1.150400.24.35.3
SUSE Linux Enterprise Micro 5.3 (src): kernel-default-base-5.14.21-150400.24.81.1.150400.24.35.3

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 48 Maintenance Automation 2023-08-14 16:30:31 UTC 
SUSE-SU-2023:3311-1: An update that solves 15 vulnerabilities and has 27 fixes can now be installed.

Category: security (important)
Bug References: 1206418, 1207129, 1207948, 1210627, 1210780, 1210825, 1211131, 1211738, 1211811, 1212445, 1212502, 1212604, 1212766, 1212901, 1213167, 1213272, 1213287, 1213304, 1213417, 1213578, 1213585, 1213586, 1213588, 1213601, 1213620, 1213632, 1213653, 1213713, 1213715, 1213747, 1213756, 1213759, 1213777, 1213810, 1213812, 1213856, 1213857, 1213863, 1213867, 1213870, 1213871, 1213872
CVE References: CVE-2022-40982, CVE-2023-0459, CVE-2023-20569, CVE-2023-21400, CVE-2023-2156, CVE-2023-2166, CVE-2023-31083, CVE-2023-3268, CVE-2023-3567, CVE-2023-3609, CVE-2023-3611, CVE-2023-3776, CVE-2023-38409, CVE-2023-3863, CVE-2023-4004
Sources used:
openSUSE Leap 15.5 (src): kernel-syms-5.14.21-150500.55.19.1, kernel-default-base-5.14.21-150500.55.19.1.150500.6.6.4, kernel-livepatch-SLE15-SP5_Update_3-1-150500.11.3.4, kernel-source-5.14.21-150500.55.19.1, kernel-obs-qa-5.14.21-150500.55.19.1, kernel-obs-build-5.14.21-150500.55.19.1
Basesystem Module 15-SP5 (src): kernel-default-base-5.14.21-150500.55.19.1.150500.6.6.4, kernel-source-5.14.21-150500.55.19.1
Development Tools Module 15-SP5 (src): kernel-obs-build-5.14.21-150500.55.19.1, kernel-syms-5.14.21-150500.55.19.1, kernel-source-5.14.21-150500.55.19.1
SUSE Linux Enterprise Live Patching 15-SP5 (src): kernel-livepatch-SLE15-SP5_Update_3-1-150500.11.3.4

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 49 Maintenance Automation 2023-08-15 12:30:20 UTC 
SUSE-SU-2023:3318-1: An update that solves 20 vulnerabilities and has 89 fixes can now be installed.

Category: security (important)
Bug References: 1150305, 1193629, 1194869, 1206418, 1207129, 1207894, 1208788, 1210565, 1210584, 1210627, 1210780, 1210853, 1211131, 1211243, 1211738, 1211811, 1211867, 1212301, 1212502, 1212604, 1212846, 1212901, 1212905, 1213010, 1213011, 1213012, 1213013, 1213014, 1213015, 1213016, 1213017, 1213018, 1213019, 1213020, 1213021, 1213024, 1213025, 1213032, 1213034, 1213035, 1213036, 1213037, 1213038, 1213039, 1213040, 1213041, 1213059, 1213061, 1213087, 1213088, 1213089, 1213090, 1213092, 1213093, 1213094, 1213095, 1213096, 1213098, 1213099, 1213100, 1213102, 1213103, 1213104, 1213105, 1213106, 1213107, 1213108, 1213109, 1213110, 1213111, 1213112, 1213113, 1213114, 1213134, 1213167, 1213245, 1213247, 1213252, 1213258, 1213259, 1213263, 1213264, 1213272, 1213286, 1213287, 1213304, 1213523, 1213524, 1213543, 1213585, 1213586, 1213588, 1213620, 1213653, 1213705, 1213713, 1213715, 1213747, 1213756, 1213759, 1213777, 1213810, 1213812, 1213856, 1213857, 1213863, 1213867, 1213870, 1213871
CVE References: CVE-2022-40982, CVE-2023-0459, CVE-2023-20569, CVE-2023-20593, CVE-2023-21400, CVE-2023-2156, CVE-2023-2166, CVE-2023-2985, CVE-2023-31083, CVE-2023-3117, CVE-2023-31248, CVE-2023-3268, CVE-2023-3390, CVE-2023-35001, CVE-2023-3567, CVE-2023-3609, CVE-2023-3611, CVE-2023-3776, CVE-2023-3812, CVE-2023-4004
Sources used:
openSUSE Leap 15.4 (src): kernel-syms-rt-5.14.21-150400.15.46.1, kernel-source-rt-5.14.21-150400.15.46.1
SUSE Linux Enterprise Live Patching 15-SP4 (src): kernel-livepatch-SLE15-SP4-RT_Update_11-1-150400.1.5.1
SUSE Real Time Module 15-SP4 (src): kernel-syms-rt-5.14.21-150400.15.46.1, kernel-source-rt-5.14.21-150400.15.46.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 50 Maintenance Automation 2023-08-16 08:31:17 UTC 
SUSE-SU-2023:3329-1: An update that solves seven vulnerabilities and has 13 fixes can now be installed.

Category: security (important)
Bug References: 1188885, 1202670, 1206418, 1207526, 1207528, 1211738, 1212266, 1213167, 1213287, 1213350, 1213585, 1213586, 1213588, 1213705, 1213747, 1213766, 1213819, 1213823, 1213825, 1213827
CVE References: CVE-2022-40982, CVE-2023-0459, CVE-2023-20569, CVE-2023-3567, CVE-2023-3609, CVE-2023-3611, CVE-2023-3776
Sources used:
SUSE Linux Enterprise Real Time 12 SP5 (src): kernel-syms-rt-4.12.14-10.138.1, kernel-source-rt-4.12.14-10.138.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 51 Maintenance Automation 2023-08-16 08:31:36 UTC 
SUSE-SU-2023:3324-1: An update that solves 14 vulnerabilities and has two fixes can now be installed.

Category: security (important)
Bug References: 1087082, 1126703, 1206418, 1207561, 1209779, 1210584, 1211738, 1211867, 1212502, 1213059, 1213167, 1213251, 1213286, 1213287, 1213585, 1213588
CVE References: CVE-2018-20784, CVE-2018-3639, CVE-2022-40982, CVE-2023-0459, CVE-2023-1637, CVE-2023-20569, CVE-2023-20593, CVE-2023-2985, CVE-2023-3106, CVE-2023-3268, CVE-2023-35001, CVE-2023-3567, CVE-2023-3611, CVE-2023-3776
Sources used:
SUSE Linux Enterprise Server 12 SP2 BCL 12-SP2 (src): kernel-syms-4.4.121-92.208.1, kernel-source-4.4.121-92.208.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 52 Maintenance Automation 2023-08-16 12:30:06 UTC 
SUSE-SU-2023:3333-1: An update that solves 13 vulnerabilities can now be installed.

Category: security (important)
Bug References: 1087082, 1102851, 1205803, 1206418, 1211738, 1212128, 1212129, 1212154, 1212501, 1212502, 1213167, 1213286, 1213588
CVE References: CVE-2017-18344, CVE-2018-3639, CVE-2022-40982, CVE-2022-45919, CVE-2023-0459, CVE-2023-20593, CVE-2023-3141, CVE-2023-3159, CVE-2023-3161, CVE-2023-3268, CVE-2023-3567, CVE-2023-35824, CVE-2023-3776
Sources used:
SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME CORE 11-SP4 (src): kernel-syms-3.0.101-108.144.1, kernel-source-3.0.101-108.144.1
SUSE Linux Enterprise Server 11 SP4 (src): kernel-syms-3.0.101-108.144.1, kernel-source-3.0.101-108.144.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 53 Maintenance Automation 2023-08-17 16:30:16 UTC 
SUSE-SU-2023:3349-1: An update that solves 11 vulnerabilities and has 74 fixes can now be installed.

Category: security (important)
Bug References: 1087082, 1150305, 1173438, 1188885, 1202670, 1202716, 1205496, 1206418, 1207526, 1207528, 1207561, 1207617, 1207620, 1207629, 1207630, 1207633, 1207634, 1207653, 1208788, 1210584, 1210765, 1210766, 1210771, 1211738, 1211867, 1212266, 1212301, 1212657, 1212741, 1212835, 1212871, 1212905, 1212986, 1212987, 1212988, 1212989, 1212990, 1213010, 1213011, 1213012, 1213013, 1213014, 1213015, 1213017, 1213018, 1213019, 1213020, 1213021, 1213022, 1213023, 1213024, 1213025, 1213032, 1213033, 1213034, 1213035, 1213036, 1213037, 1213038, 1213039, 1213040, 1213041, 1213042, 1213059, 1213133, 1213167, 1213215, 1213218, 1213221, 1213286, 1213287, 1213344, 1213346, 1213350, 1213525, 1213585, 1213586, 1213588, 1213705, 1213747, 1213766, 1213819, 1213823, 1213825, 1213827
CVE References: CVE-2018-3639, CVE-2022-40982, CVE-2023-0459, CVE-2023-20569, CVE-2023-20593, CVE-2023-2985, CVE-2023-35001, CVE-2023-3567, CVE-2023-3609, CVE-2023-3611, CVE-2023-3776
Sources used:
SUSE Linux Enterprise Server for SAP Applications 12 SP5 (src): kernel-syms-azure-4.12.14-16.146.1, kernel-source-azure-4.12.14-16.146.1
SUSE Linux Enterprise High Performance Computing 12 SP5 (src): kernel-syms-azure-4.12.14-16.146.1, kernel-source-azure-4.12.14-16.146.1
SUSE Linux Enterprise Server 12 SP5 (src): kernel-syms-azure-4.12.14-16.146.1, kernel-source-azure-4.12.14-16.146.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 54 Maintenance Automation 2023-08-22 16:30:06 UTC 
SUSE-SU-2023:3376-1: An update that solves 15 vulnerabilities and has 27 fixes can now be installed.

Category: security (important)
Bug References: 1206418, 1207129, 1207948, 1210627, 1210780, 1210825, 1211131, 1211738, 1211811, 1212445, 1212502, 1212604, 1212766, 1212901, 1213167, 1213272, 1213287, 1213304, 1213417, 1213578, 1213585, 1213586, 1213588, 1213601, 1213620, 1213632, 1213653, 1213713, 1213715, 1213747, 1213756, 1213759, 1213777, 1213810, 1213812, 1213856, 1213857, 1213863, 1213867, 1213870, 1213871, 1213872
CVE References: CVE-2022-40982, CVE-2023-0459, CVE-2023-20569, CVE-2023-21400, CVE-2023-2156, CVE-2023-2166, CVE-2023-31083, CVE-2023-3268, CVE-2023-3567, CVE-2023-3609, CVE-2023-3611, CVE-2023-3776, CVE-2023-38409, CVE-2023-3863, CVE-2023-4004
Sources used:
openSUSE Leap 15.5 (src): kernel-syms-azure-5.14.21-150500.33.14.1, kernel-source-azure-5.14.21-150500.33.14.1
Public Cloud Module 15-SP5 (src): kernel-syms-azure-5.14.21-150500.33.14.1, kernel-source-azure-5.14.21-150500.33.14.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 55 Maintenance Automation 2023-08-22 20:30:13 UTC 
SUSE-SU-2023:3377-1: An update that solves 11 vulnerabilities and has 19 fixes can now be installed.

Category: security (important)
Bug References: 1206418, 1207129, 1210627, 1210780, 1211131, 1211738, 1212502, 1212604, 1212901, 1213167, 1213272, 1213287, 1213304, 1213588, 1213620, 1213653, 1213713, 1213715, 1213747, 1213756, 1213759, 1213777, 1213810, 1213812, 1213856, 1213857, 1213863, 1213867, 1213870, 1213871
CVE References: CVE-2022-40982, CVE-2023-0459, CVE-2023-20569, CVE-2023-21400, CVE-2023-2156, CVE-2023-2166, CVE-2023-31083, CVE-2023-3268, CVE-2023-3567, CVE-2023-3776, CVE-2023-4004
Sources used:
openSUSE Leap 15.4 (src): kernel-source-azure-5.14.21-150400.14.63.1, kernel-syms-azure-5.14.21-150400.14.63.1
Public Cloud Module 15-SP4 (src): kernel-source-azure-5.14.21-150400.14.63.1, kernel-syms-azure-5.14.21-150400.14.63.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 56 Maintenance Automation 2023-08-23 16:30:03 UTC 
SUSE-SU-2023:3392-1: An update that solves 13 vulnerabilities and has five fixes can now be installed.

Category: security (important)
Bug References: 1206418, 1207088, 1210584, 1211738, 1211867, 1212301, 1212741, 1212835, 1213059, 1213167, 1213286, 1213287, 1213546, 1213585, 1213586, 1213588, 1213970, 1214019
CVE References: CVE-2022-40982, CVE-2023-0459, CVE-2023-20569, CVE-2023-20593, CVE-2023-2985, CVE-2023-34319, CVE-2023-35001, CVE-2023-3567, CVE-2023-3609, CVE-2023-3611, CVE-2023-3776, CVE-2023-4133, CVE-2023-4194
Sources used:
SUSE Linux Enterprise Live Patching 15-SP1 (src): kernel-livepatch-SLE15-SP1_Update_43-1-150100.3.3.1
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1 (src): kernel-source-4.12.14-150100.197.154.1, kernel-syms-4.12.14-150100.197.154.1, kernel-obs-build-4.12.14-150100.197.154.1
SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 (src): kernel-source-4.12.14-150100.197.154.1, kernel-syms-4.12.14-150100.197.154.1, kernel-obs-build-4.12.14-150100.197.154.1
SUSE Linux Enterprise Server for SAP Applications 15 SP1 (src): kernel-source-4.12.14-150100.197.154.1, kernel-syms-4.12.14-150100.197.154.1, kernel-obs-build-4.12.14-150100.197.154.1
SUSE CaaS Platform 4.0 (src): kernel-source-4.12.14-150100.197.154.1, kernel-syms-4.12.14-150100.197.154.1, kernel-obs-build-4.12.14-150100.197.154.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 57 Maintenance Automation 2023-08-23 16:30:14 UTC 
SUSE-SU-2023:3390-1: An update that solves 16 vulnerabilities and has eight fixes can now be installed.

Category: security (important)
Bug References: 1206418, 1207088, 1209342, 1210584, 1211738, 1211867, 1212301, 1212741, 1212835, 1212846, 1213059, 1213167, 1213245, 1213286, 1213287, 1213354, 1213543, 1213546, 1213585, 1213586, 1213588, 1213868, 1213970, 1214019
CVE References: CVE-2022-40982, CVE-2023-0459, CVE-2023-20569, CVE-2023-20593, CVE-2023-2985, CVE-2023-3117, CVE-2023-3390, CVE-2023-34319, CVE-2023-35001, CVE-2023-3567, CVE-2023-3609, CVE-2023-3611, CVE-2023-3776, CVE-2023-3812, CVE-2023-4133, CVE-2023-4194
Sources used:
SUSE Linux Enterprise Live Patching 15-SP2 (src): kernel-livepatch-SLE15-SP2_Update_39-1-150200.5.3.2
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (src): kernel-obs-build-5.3.18-150200.24.160.2, kernel-syms-5.3.18-150200.24.160.1, kernel-default-base-5.3.18-150200.24.160.2.150200.9.79.2, kernel-source-5.3.18-150200.24.160.1
SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (src): kernel-obs-build-5.3.18-150200.24.160.2, kernel-syms-5.3.18-150200.24.160.1, kernel-default-base-5.3.18-150200.24.160.2.150200.9.79.2, kernel-source-5.3.18-150200.24.160.1
SUSE Linux Enterprise Server for SAP Applications 15 SP2 (src): kernel-obs-build-5.3.18-150200.24.160.2, kernel-syms-5.3.18-150200.24.160.1, kernel-default-base-5.3.18-150200.24.160.2.150200.9.79.2, kernel-source-5.3.18-150200.24.160.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 58 Maintenance Automation 2023-08-23 16:30:27 UTC 
SUSE-SU-2023:3391-1: An update that solves 15 vulnerabilities, contains one feature and has nine fixes can now be installed.

Category: security (important)
Bug References: 1199304, 1206418, 1207270, 1210584, 1211131, 1211738, 1211867, 1212301, 1212741, 1212835, 1212846, 1213059, 1213061, 1213167, 1213245, 1213286, 1213287, 1213354, 1213543, 1213585, 1213586, 1213588, 1213653, 1213868
CVE References: CVE-2022-40982, CVE-2023-0459, CVE-2023-20569, CVE-2023-20593, CVE-2023-2156, CVE-2023-2985, CVE-2023-3117, CVE-2023-31248, CVE-2023-3390, CVE-2023-35001, CVE-2023-3567, CVE-2023-3609, CVE-2023-3611, CVE-2023-3776, CVE-2023-3812
Jira References: PED-4567
Sources used:
SUSE Linux Enterprise Live Patching 15-SP3 (src): kernel-livepatch-SLE15-SP3_Update_35-1-150300.7.3.1
SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (src): kernel-obs-build-5.3.18-150300.59.130.1, kernel-default-base-5.3.18-150300.59.130.1.150300.18.76.1, kernel-source-5.3.18-150300.59.130.1, kernel-syms-5.3.18-150300.59.130.1
SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (src): kernel-obs-build-5.3.18-150300.59.130.1, kernel-default-base-5.3.18-150300.59.130.1.150300.18.76.1, kernel-source-5.3.18-150300.59.130.1, kernel-syms-5.3.18-150300.59.130.1
SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (src): kernel-obs-build-5.3.18-150300.59.130.1, kernel-default-base-5.3.18-150300.59.130.1.150300.18.76.1, kernel-source-5.3.18-150300.59.130.1, kernel-syms-5.3.18-150300.59.130.1
SUSE Linux Enterprise Server for SAP Applications 15 SP3 (src): kernel-obs-build-5.3.18-150300.59.130.1, kernel-default-base-5.3.18-150300.59.130.1.150300.18.76.1, kernel-source-5.3.18-150300.59.130.1, kernel-syms-5.3.18-150300.59.130.1
SUSE Manager Proxy 4.2 (src): kernel-default-base-5.3.18-150300.59.130.1.150300.18.76.1, kernel-source-5.3.18-150300.59.130.1
SUSE Manager Retail Branch Server 4.2 (src): kernel-default-base-5.3.18-150300.59.130.1.150300.18.76.1, kernel-source-5.3.18-150300.59.130.1
SUSE Manager Server 4.2 (src): kernel-default-base-5.3.18-150300.59.130.1.150300.18.76.1, kernel-source-5.3.18-150300.59.130.1
SUSE Enterprise Storage 7.1 (src): kernel-obs-build-5.3.18-150300.59.130.1, kernel-default-base-5.3.18-150300.59.130.1.150300.18.76.1, kernel-source-5.3.18-150300.59.130.1, kernel-syms-5.3.18-150300.59.130.1
SUSE Linux Enterprise Micro 5.1 (src): kernel-default-base-5.3.18-150300.59.130.1.150300.18.76.1
SUSE Linux Enterprise Micro 5.2 (src): kernel-default-base-5.3.18-150300.59.130.1.150300.18.76.1
SUSE Linux Enterprise Micro for Rancher 5.2 (src): kernel-default-base-5.3.18-150300.59.130.1.150300.18.76.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 59 Maintenance Automation 2023-08-24 12:31:11 UTC 
SUSE-SU-2023:3421-1: An update that solves 15 vulnerabilities, contains one feature and has nine fixes can now be installed.

Category: security (important)
Bug References: 1199304, 1206418, 1207270, 1210584, 1211131, 1211738, 1211867, 1212301, 1212741, 1212835, 1212846, 1213059, 1213061, 1213167, 1213245, 1213286, 1213287, 1213354, 1213543, 1213585, 1213586, 1213588, 1213653, 1213868
CVE References: CVE-2022-40982, CVE-2023-0459, CVE-2023-20569, CVE-2023-20593, CVE-2023-2156, CVE-2023-2985, CVE-2023-3117, CVE-2023-31248, CVE-2023-3390, CVE-2023-35001, CVE-2023-3567, CVE-2023-3609, CVE-2023-3611, CVE-2023-3776, CVE-2023-3812
Jira References: PED-4567
Sources used:

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 64 Marcus Meissner 2024-06-26 08:40:29 UTC 
done