December 2023 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2023:0405-1: moderate: Security update for fish
by opensuse-security＠opensuse.org 16 Dec '23

16 Dec '23

openSUSE Security Update: Security update for fish ______________________________________________________________________________ Announcement ID: openSUSE-SU-2023:0405-1 Rating: moderate References: #1217808 Cross-References: CVE-2023-49284 CVSS scores: CVE-2023-49284 (NVD) : 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H CVE-2023-49284 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L Affected Products: openSUSE Backports SLE-15-SP5 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for fish fixes the following issues: - CVE-2023-49284: Fixed shell expansion triggered by command substitution output (boo#1217808). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP5: zypper in -t patch openSUSE-2023-405=1 Package List: - openSUSE Backports SLE-15-SP5 (aarch64 i586 ppc64le s390x x86_64): fish-3.3.1-bp155.4.3.1 fish-devel-3.3.1-bp155.4.3.1 References: https://www.suse.com/security/cve/CVE-2023-49284.html https://bugzilla.suse.com/1217808

1 0

openSUSE-RU-2023:0403-1: moderate: Recommended update for krb5-appl
by maintenance＠opensuse.org 16 Dec '23

16 Dec '23

openSUSE Recommended Update: Recommended update for krb5-appl ______________________________________________________________________________ Announcement ID: openSUSE-RU-2023:0403-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP5 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for krb5-appl fixes the following issues: Ship some krb5 applications in version 1.0.3 (krb5 enabled ftp, telnet). Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP5: zypper in -t patch openSUSE-2023-403=1 Package List: - openSUSE Backports SLE-15-SP5 (aarch64 i586 ppc64le s390x x86_64): krb5-appl-clients-1.0.3-bp155.2.1 krb5-appl-servers-1.0.3-bp155.2.1 References:

1 0

SUSE-RU-2023:4884-1: moderate: Recommended update for kiwi-templates-Minimal-s390x
by null＠suse.de 15 Dec '23

15 Dec '23

# Recommended update for kiwi-templates-Minimal-s390x Announcement ID: SUSE-RU-2023:4884-1 Rating: moderate References: * bsc#1211722 * bsc#1215676 * bsc#1215723 * bsc#1215766 Affected Products: * Development Tools Module 15-SP5 * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that has four fixes can now be installed. ## Description: This update for kiwi-templates-Minimal-s390x fixes the following issues: * Add group(wheel) (bsc#1215723) * Remove the /boot/writable subvolume, only needed for transactional systems * Add rsyslog (bsc#1215766) * Install wicked explicitly * Add "rw" to the kernel cmdline (bsc#1211722) * Remove kernel-firmware-all package (bsc#1215676) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch SUSE-2023-4884=1 openSUSE-SLE-15.5-2023-4884=1 * Development Tools Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP5-2023-4884=1 ## Package List: * openSUSE Leap 15.5 (noarch) * kiwi-templates-Minimal-s390x-15.5-150500.5.6.1 * Development Tools Module 15-SP5 (noarch) * kiwi-templates-Minimal-s390x-15.5-150500.5.6.1 ## References: * https://bugzilla.suse.com/show_bug.cgi?id=1211722 * https://bugzilla.suse.com/show_bug.cgi?id=1215676 * https://bugzilla.suse.com/show_bug.cgi?id=1215723 * https://bugzilla.suse.com/show_bug.cgi?id=1215766

1 0

SUSE-RU-2023:4876-1: moderate: Recommended update for obs-service-recompress
by null＠suse.de 15 Dec '23

15 Dec '23

# Recommended update for obs-service-recompress Announcement ID: SUSE-RU-2023:4876-1 Rating: moderate References: * bsc#1216361 Affected Products: * openSUSE Leap 15.4 * openSUSE Leap 15.5 An update that has one fix can now be installed. ## Description: This update for obs-service-recompress fixes the following issues: * add zstd compression support (bsc#1216361) * do not follow symlinks (https://github.com/openSUSE/obs-service- recompress/issues/9) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-4876=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2023-4876=1 ## Package List: * openSUSE Leap 15.4 (noarch) * obs-service-recompress-0.5.2-150000.3.3.1 * openSUSE Leap 15.5 (noarch) * obs-service-recompress-0.5.2-150000.3.3.1 ## References: * https://bugzilla.suse.com/show_bug.cgi?id=1216361

1 0

SUSE-SU-2023:4871-1: important: Security update for the Linux Kernel (Live Patch 27 for SLE 15 SP3)
by null＠suse.de 14 Dec '23

14 Dec '23

# Security update for the Linux Kernel (Live Patch 27 for SLE 15 SP3) Announcement ID: SUSE-SU-2023:4871-1 Rating: important References: * bsc#1215097 * bsc#1215442 * bsc#1215519 Cross-References: * CVE-2023-2163 * CVE-2023-3777 * CVE-2023-4622 CVSS scores: * CVE-2023-2163 ( SUSE ): 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N * CVE-2023-2163 ( NVD ): 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N * CVE-2023-3777 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-3777 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-4622 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-4622 ( NVD ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: * openSUSE Leap 15.3 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise Live Patching 15-SP3 * SUSE Linux Enterprise Micro 5.1 * SUSE Linux Enterprise Micro 5.2 * SUSE Linux Enterprise Server 15 SP3 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 An update that solves three vulnerabilities can now be installed. ## Description: This update for the Linux Kernel 5.3.18-150300_59_106 fixes several issues. The following security issues were fixed: * CVE-2023-3777: Fixed a use-after-free vulnerability in netfilter: nf_tables component can be exploited to achieve local privilege escalation. (bsc#1215097) * CVE-2023-4622: Fixed a use-after-free vulnerability in the Unix domain sockets component which could be exploited to achieve local privilege escalation (bsc#1215442). * CVE-2023-2163: Fixed an incorrect verifier pruning in BPF that could lead to unsafe code paths being incorrectly marked as safe, resulting in arbitrary read/write in kernel memory, lateral privilege escalation, and container escape. (bsc#1215519) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.3 zypper in -t patch SUSE-2023-4871=1 * SUSE Linux Enterprise Live Patching 15-SP3 zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP3-2023-4871=1 ## Package List: * openSUSE Leap 15.3 (ppc64le s390x x86_64) * kernel-livepatch-SLE15-SP3_Update_27-debugsource-11-150300.2.2 * kernel-livepatch-5_3_18-150300_59_106-default-11-150300.2.2 * kernel-livepatch-5_3_18-150300_59_106-default-debuginfo-11-150300.2.2 * openSUSE Leap 15.3 (x86_64) * kernel-livepatch-5_3_18-150300_59_106-preempt-debuginfo-11-150300.2.2 * kernel-livepatch-5_3_18-150300_59_106-preempt-11-150300.2.2 * SUSE Linux Enterprise Live Patching 15-SP3 (ppc64le s390x x86_64) * kernel-livepatch-5_3_18-150300_59_106-default-11-150300.2.2 ## References: * https://www.suse.com/security/cve/CVE-2023-2163.html * https://www.suse.com/security/cve/CVE-2023-3777.html * https://www.suse.com/security/cve/CVE-2023-4622.html * https://bugzilla.suse.com/show_bug.cgi?id=1215097 * https://bugzilla.suse.com/show_bug.cgi?id=1215442 * https://bugzilla.suse.com/show_bug.cgi?id=1215519

1 0

SUSE-SU-2023:4872-1: important: Security update for the Linux Kernel (Live Patch 16 for SLE 15 SP4)
by null＠suse.de 14 Dec '23

14 Dec '23

# Security update for the Linux Kernel (Live Patch 16 for SLE 15 SP4) Announcement ID: SUSE-SU-2023:4872-1 Rating: important References: * bsc#1213584 * bsc#1215097 * bsc#1215442 * bsc#1215519 * bsc#1215971 Cross-References: * CVE-2023-2163 * CVE-2023-3610 * CVE-2023-3777 * CVE-2023-4622 * CVE-2023-5345 CVSS scores: * CVE-2023-2163 ( SUSE ): 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N * CVE-2023-2163 ( NVD ): 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N * CVE-2023-3610 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-3610 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-3777 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-3777 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-4622 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-4622 ( NVD ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-5345 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-5345 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: * openSUSE Leap 15.4 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise Live Patching 15-SP4 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 An update that solves five vulnerabilities can now be installed. ## Description: This update for the Linux Kernel 5.14.21-150400_24_81 fixes several issues. The following security issues were fixed: * CVE-2023-3610: Fixed use-after-free vulnerability in nf_tables can be exploited to achieve local privilege escalation (bsc#1213584). * CVE-2023-3777: Fixed a use-after-free vulnerability in netfilter: nf_tables component can be exploited to achieve local privilege escalation. (bsc#1215097) * CVE-2023-5345: Fixed an use-after-free vulnerability in the fs/smb/client component which could be exploited to achieve local privilege escalation. (bsc#1215971) * CVE-2023-4622: Fixed a use-after-free vulnerability in the Unix domain sockets component which could be exploited to achieve local privilege escalation (bsc#1215442). * CVE-2023-2163: Fixed an incorrect verifier pruning in BPF that could lead to unsafe code paths being incorrectly marked as safe, resulting in arbitrary read/write in kernel memory, lateral privilege escalation, and container escape. (bsc#1215519) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2023-4872=1 * SUSE Linux Enterprise Live Patching 15-SP4 zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP4-2023-4872=1 ## Package List: * openSUSE Leap 15.4 (ppc64le s390x x86_64) * kernel-livepatch-5_14_21-150400_24_81-default-debuginfo-4-150400.2.1 * kernel-livepatch-5_14_21-150400_24_81-default-4-150400.2.1 * kernel-livepatch-SLE15-SP4_Update_16-debugsource-4-150400.2.1 * SUSE Linux Enterprise Live Patching 15-SP4 (ppc64le s390x x86_64) * kernel-livepatch-5_14_21-150400_24_81-default-debuginfo-4-150400.2.1 * kernel-livepatch-5_14_21-150400_24_81-default-4-150400.2.1 * kernel-livepatch-SLE15-SP4_Update_16-debugsource-4-150400.2.1 ## References: * https://www.suse.com/security/cve/CVE-2023-2163.html * https://www.suse.com/security/cve/CVE-2023-3610.html * https://www.suse.com/security/cve/CVE-2023-3777.html * https://www.suse.com/security/cve/CVE-2023-4622.html * https://www.suse.com/security/cve/CVE-2023-5345.html * https://bugzilla.suse.com/show_bug.cgi?id=1213584 * https://bugzilla.suse.com/show_bug.cgi?id=1215097 * https://bugzilla.suse.com/show_bug.cgi?id=1215442 * https://bugzilla.suse.com/show_bug.cgi?id=1215519 * https://bugzilla.suse.com/show_bug.cgi?id=1215971

1 0

openSUSE-RU-2023:0402-1: moderate: Recommended update for tor
by maintenance＠opensuse.org 14 Dec '23

14 Dec '23

openSUSE Recommended Update: Recommended update for tor ______________________________________________________________________________ Announcement ID: openSUSE-RU-2023:0402-1 Rating: moderate References: #1217918 Affected Products: openSUSE Backports SLE-15-SP4 openSUSE Backports SLE-15-SP5 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for tor fixes the following issues: Updated to tor 0.4.8.10: * (TROVE-2023-007, exit) (boo#1217918) - fix a a UAF and NULL pointer dereference crash on Exit relays Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP5: zypper in -t patch openSUSE-2023-402=1 - openSUSE Backports SLE-15-SP4: zypper in -t patch openSUSE-2023-402=1 Package List: - openSUSE Backports SLE-15-SP5 (aarch64 i586 ppc64le s390x x86_64): tor-0.4.8.10-bp155.2.9.1 tor-debuginfo-0.4.8.10-bp155.2.9.1 tor-debugsource-0.4.8.10-bp155.2.9.1 - openSUSE Backports SLE-15-SP4 (aarch64 i586 ppc64le s390x x86_64): tor-0.4.8.10-bp154.2.21.1 References: https://bugzilla.suse.com/1217918

1 0

SUSE-RU-2023:4860-1: moderate: Recommended update for yast2-x11
by null＠suse.de 14 Dec '23

14 Dec '23

# Recommended update for yast2-x11 Announcement ID: SUSE-RU-2023:4860-1 Rating: moderate References: * bsc#1216197 Affected Products: * Basesystem Module 15-SP5 * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that has one fix can now be installed. ## Description: This update for yast2-x11 fixes the following issue: * Prevent testX from hanging if no supported WM can be started (bsc#1216197) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch SUSE-2023-4860=1 openSUSE-SLE-15.5-2023-4860=1 * Basesystem Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2023-4860=1 ## Package List: * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64 i586) * yast2-x11-debuginfo-4.5.2-150500.3.5.1 * yast2-x11-4.5.2-150500.3.5.1 * yast2-x11-debugsource-4.5.2-150500.3.5.1 * Basesystem Module 15-SP5 (aarch64 ppc64le s390x x86_64) * yast2-x11-debuginfo-4.5.2-150500.3.5.1 * yast2-x11-4.5.2-150500.3.5.1 * yast2-x11-debugsource-4.5.2-150500.3.5.1 ## References: * https://bugzilla.suse.com/show_bug.cgi?id=1216197

1 0

SUSE-SU-2023:4849-1: important: Security update for the Linux Kernel (Live Patch 5 for SLE 15 SP4)
by null＠suse.de 14 Dec '23

14 Dec '23

# Security update for the Linux Kernel (Live Patch 5 for SLE 15 SP4) Announcement ID: SUSE-SU-2023:4849-1 Rating: important References: * bsc#1213584 * bsc#1215097 * bsc#1215442 * bsc#1215519 Cross-References: * CVE-2023-2163 * CVE-2023-3610 * CVE-2023-3777 * CVE-2023-4622 CVSS scores: * CVE-2023-2163 ( SUSE ): 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N * CVE-2023-2163 ( NVD ): 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N * CVE-2023-3610 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-3610 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-3777 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-3777 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-4622 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-4622 ( NVD ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: * openSUSE Leap 15.4 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise Live Patching 15-SP4 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 An update that solves four vulnerabilities can now be installed. ## Description: This update for the Linux Kernel 5.14.21-150400_24_33 fixes several issues. The following security issues were fixed: * CVE-2023-3610: Fixed use-after-free vulnerability in nf_tables can be exploited to achieve local privilege escalation (bsc#1213584). * CVE-2023-3777: Fixed a use-after-free vulnerability in netfilter: nf_tables component can be exploited to achieve local privilege escalation. (bsc#1215097) * CVE-2023-4622: Fixed a use-after-free vulnerability in the Unix domain sockets component which could be exploited to achieve local privilege escalation (bsc#1215442). * CVE-2023-2163: Fixed an incorrect verifier pruning in BPF that could lead to unsafe code paths being incorrectly marked as safe, resulting in arbitrary read/write in kernel memory, lateral privilege escalation, and container escape. (bsc#1215519) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2023-4849=1 SUSE-2023-4850=1 * SUSE Linux Enterprise Live Patching 15-SP4 zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP4-2023-4849=1 SUSE-SLE- Module-Live-Patching-15-SP4-2023-4850=1 ## Package List: * openSUSE Leap 15.4 (ppc64le s390x x86_64) * kernel-livepatch-5_14_21-150400_24_33-default-13-150400.2.2 * kernel-livepatch-5_14_21-150400_24_33-default-debuginfo-13-150400.2.2 * kernel-livepatch-5_14_21-150400_24_28-default-debuginfo-14-150400.2.2 * kernel-livepatch-5_14_21-150400_24_28-default-14-150400.2.2 * kernel-livepatch-SLE15-SP4_Update_5-debugsource-13-150400.2.2 * kernel-livepatch-SLE15-SP4_Update_4-debugsource-14-150400.2.2 * SUSE Linux Enterprise Live Patching 15-SP4 (ppc64le s390x x86_64) * kernel-livepatch-5_14_21-150400_24_33-default-13-150400.2.2 * kernel-livepatch-5_14_21-150400_24_33-default-debuginfo-13-150400.2.2 * kernel-livepatch-5_14_21-150400_24_28-default-debuginfo-14-150400.2.2 * kernel-livepatch-5_14_21-150400_24_28-default-14-150400.2.2 * kernel-livepatch-SLE15-SP4_Update_5-debugsource-13-150400.2.2 * kernel-livepatch-SLE15-SP4_Update_4-debugsource-14-150400.2.2 ## References: * https://www.suse.com/security/cve/CVE-2023-2163.html * https://www.suse.com/security/cve/CVE-2023-3610.html * https://www.suse.com/security/cve/CVE-2023-3777.html * https://www.suse.com/security/cve/CVE-2023-4622.html * https://bugzilla.suse.com/show_bug.cgi?id=1213584 * https://bugzilla.suse.com/show_bug.cgi?id=1215097 * https://bugzilla.suse.com/show_bug.cgi?id=1215442 * https://bugzilla.suse.com/show_bug.cgi?id=1215519

1 0

SUSE-SU-2023:4862-1: important: Security update for the Linux Kernel (Live Patch 28 for SLE 15 SP3)
by null＠suse.de 14 Dec '23

14 Dec '23

# Security update for the Linux Kernel (Live Patch 28 for SLE 15 SP3) Announcement ID: SUSE-SU-2023:4862-1 Rating: important References: * bsc#1215097 * bsc#1215442 * bsc#1215519 Cross-References: * CVE-2023-2163 * CVE-2023-3777 * CVE-2023-4622 CVSS scores: * CVE-2023-2163 ( SUSE ): 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N * CVE-2023-2163 ( NVD ): 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N * CVE-2023-3777 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-3777 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-4622 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-4622 ( NVD ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: * openSUSE Leap 15.3 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise Live Patching 15-SP3 * SUSE Linux Enterprise Micro 5.1 * SUSE Linux Enterprise Micro 5.2 * SUSE Linux Enterprise Server 15 SP3 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 An update that solves three vulnerabilities can now be installed. ## Description: This update for the Linux Kernel 5.3.18-150300_59_109 fixes several issues. The following security issues were fixed: * CVE-2023-3777: Fixed a use-after-free vulnerability in netfilter: nf_tables component can be exploited to achieve local privilege escalation. (bsc#1215097) * CVE-2023-4622: Fixed a use-after-free vulnerability in the Unix domain sockets component which could be exploited to achieve local privilege escalation (bsc#1215442). * CVE-2023-2163: Fixed an incorrect verifier pruning in BPF that could lead to unsafe code paths being incorrectly marked as safe, resulting in arbitrary read/write in kernel memory, lateral privilege escalation, and container escape. (bsc#1215519) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.3 zypper in -t patch SUSE-2023-4862=1 * SUSE Linux Enterprise Live Patching 15-SP3 zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP3-2023-4862=1 ## Package List: * openSUSE Leap 15.3 (ppc64le s390x x86_64) * kernel-livepatch-5_3_18-150300_59_109-default-debuginfo-11-150300.2.2 * kernel-livepatch-5_3_18-150300_59_109-default-11-150300.2.2 * kernel-livepatch-SLE15-SP3_Update_28-debugsource-11-150300.2.2 * openSUSE Leap 15.3 (x86_64) * kernel-livepatch-5_3_18-150300_59_109-preempt-debuginfo-11-150300.2.2 * kernel-livepatch-5_3_18-150300_59_109-preempt-11-150300.2.2 * SUSE Linux Enterprise Live Patching 15-SP3 (ppc64le s390x x86_64) * kernel-livepatch-5_3_18-150300_59_109-default-11-150300.2.2 ## References: * https://www.suse.com/security/cve/CVE-2023-2163.html * https://www.suse.com/security/cve/CVE-2023-3777.html * https://www.suse.com/security/cve/CVE-2023-4622.html * https://bugzilla.suse.com/show_bug.cgi?id=1215097 * https://bugzilla.suse.com/show_bug.cgi?id=1215442 * https://bugzilla.suse.com/show_bug.cgi?id=1215519

1 0