September 2024 - openSUSE Updates - openSUSE Mailing Lists

SUSE-SU-2024:3350-1: important: Security update for the Linux Kernel (Live Patch 15 for SLE 15 SP5)
by OPENSUSE-UPDATES 20 Sep '24

20 Sep '24

# Security update for the Linux Kernel (Live Patch 15 for SLE 15 SP5) Announcement ID: SUSE-SU-2024:3350-1 Rating: important References: * bsc#1223683 * bsc#1225099 * bsc#1228349 Cross-References: * CVE-2023-52846 * CVE-2024-26923 * CVE-2024-40909 CVSS scores: * CVE-2023-52846 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-26923 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-40909 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-40909 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: * openSUSE Leap 15.5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Live Patching 15-SP5 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that solves three vulnerabilities can now be installed. ## Description: This update for the Linux Kernel 5.14.21-150500_55_68 fixes several issues. The following security issues were fixed: * CVE-2024-40909: Fix a potential use-after-free in bpf_link_free() (bsc#1228349). * CVE-2023-52846: Prevent use after free in prp_create_tagged_frame() (bsc#1225099). * CVE-2024-26923: Fixed false-positive lockdep splat for spin_lock() in __unix_gc() (bsc#1223683). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch SUSE-2024-3350=1 * SUSE Linux Enterprise Live Patching 15-SP5 zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP5-2024-3350=1 ## Package List: * openSUSE Leap 15.5 (ppc64le s390x x86_64) * kernel-livepatch-SLE15-SP5_Update_15-debugsource-3-150500.11.6.2 * kernel-livepatch-5_14_21-150500_55_68-default-3-150500.11.6.2 * kernel-livepatch-5_14_21-150500_55_68-default-debuginfo-3-150500.11.6.2 * SUSE Linux Enterprise Live Patching 15-SP5 (ppc64le s390x x86_64) * kernel-livepatch-SLE15-SP5_Update_15-debugsource-3-150500.11.6.2 * kernel-livepatch-5_14_21-150500_55_68-default-3-150500.11.6.2 * kernel-livepatch-5_14_21-150500_55_68-default-debuginfo-3-150500.11.6.2 ## References: * https://www.suse.com/security/cve/CVE-2023-52846.html * https://www.suse.com/security/cve/CVE-2024-26923.html * https://www.suse.com/security/cve/CVE-2024-40909.html * https://bugzilla.suse.com/show_bug.cgi?id=1223683 * https://bugzilla.suse.com/show_bug.cgi?id=1225099 * https://bugzilla.suse.com/show_bug.cgi?id=1228349

1 0

SUSE-SU-2024:3347-1: important: Security update for the Linux Kernel (Live Patch 11 for SLE 15 SP5)
by OPENSUSE-UPDATES 19 Sep '24

19 Sep '24

# Security update for the Linux Kernel (Live Patch 11 for SLE 15 SP5) Announcement ID: SUSE-SU-2024:3347-1 Rating: important References: * bsc#1220145 * bsc#1220832 * bsc#1221302 * bsc#1222685 * bsc#1223059 * bsc#1223363 * bsc#1223514 * bsc#1223521 * bsc#1223681 * bsc#1223683 * bsc#1225013 * bsc#1225099 * bsc#1225310 * bsc#1225313 Cross-References: * CVE-2022-48651 * CVE-2022-48662 * CVE-2023-52502 * CVE-2023-52846 * CVE-2023-6546 * CVE-2024-23307 * CVE-2024-26610 * CVE-2024-26828 * CVE-2024-26852 * CVE-2024-26923 * CVE-2024-26930 * CVE-2024-27398 * CVE-2024-35817 * CVE-2024-35950 CVSS scores: * CVE-2022-48651 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2022-48662 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2022-48662 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-52502 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-52846 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-6546 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-6546 ( NVD ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-6546 ( NVD ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-23307 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-23307 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-26610 ( SUSE ): 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H * CVE-2024-26828 ( SUSE ): 7.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H * CVE-2024-26852 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-26923 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-26930 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-26930 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-27398 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-35817 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-35950 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: * openSUSE Leap 15.5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Live Patching 15-SP5 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that solves 14 vulnerabilities can now be installed. ## Description: This update for the Linux Kernel 5.14.21-150500_55_52 fixes several issues. The following security issues were fixed: * CVE-2023-52846: Prevent use after free in prp_create_tagged_frame() (bsc#1225099). * CVE-2022-48662: Fixed a general protection fault (GPF) in i915_perf_open_ioctl (bsc#1223521). * CVE-2022-48662: Fixed GPF in i915_perf_open_ioctl (bsc#1223521). * CVE-2024-35817: Set gtt bound flag in amdgpu_ttm_gart_bind (bsc#1225313). * CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1225013). * CVE-2024-35950: Fully protect modes with dev->mode_config.mutex (bsc#1225310). * CVE-2024-26923: Fixed false-positive lockdep splat for spin_lock() in __unix_gc() (bsc#1223683). * CVE-2024-26930: Fixed double free of the ha->vp_map pointer (bsc#1223681). * CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223363). * CVE-2024-23307: Fixed Integer Overflow or Wraparound vulnerability in x86 and ARM md, raid, raid5 modules (bsc#1220145). * CVE-2024-26852: Fixed use-after-free in ip6_route_mpath_notify() (bsc#1223059). * CVE-2024-26610: Fixed memory corruption in wifi/iwlwifi (bsc#1221302). * CVE-2022-48651: Fixed an out-of-bound bug in ipvlan caused by unset skb->mac_header (bsc#1223514). * CVE-2023-52502: Fixed a race condition in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn() (bsc#1220832). * CVE-2023-6546: Fixed a race condition in the GSM 0710 tty multiplexor via the GSMIOC_SETCONF ioctl that could lead to local privilege escalation (bsc#1222685). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch SUSE-2024-3347=1 * SUSE Linux Enterprise Live Patching 15-SP5 zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP5-2024-3347=1 ## Package List: * openSUSE Leap 15.5 (ppc64le s390x x86_64) * kernel-livepatch-5_14_21-150500_55_52-default-debuginfo-6-150500.11.6.2 * kernel-livepatch-SLE15-SP5_Update_11-debugsource-6-150500.11.6.2 * kernel-livepatch-5_14_21-150500_55_52-default-6-150500.11.6.2 * SUSE Linux Enterprise Live Patching 15-SP5 (ppc64le s390x x86_64) * kernel-livepatch-5_14_21-150500_55_52-default-debuginfo-6-150500.11.6.2 * kernel-livepatch-SLE15-SP5_Update_11-debugsource-6-150500.11.6.2 * kernel-livepatch-5_14_21-150500_55_52-default-6-150500.11.6.2 ## References: * https://www.suse.com/security/cve/CVE-2022-48651.html * https://www.suse.com/security/cve/CVE-2022-48662.html * https://www.suse.com/security/cve/CVE-2023-52502.html * https://www.suse.com/security/cve/CVE-2023-52846.html * https://www.suse.com/security/cve/CVE-2023-6546.html * https://www.suse.com/security/cve/CVE-2024-23307.html * https://www.suse.com/security/cve/CVE-2024-26610.html * https://www.suse.com/security/cve/CVE-2024-26828.html * https://www.suse.com/security/cve/CVE-2024-26852.html * https://www.suse.com/security/cve/CVE-2024-26923.html * https://www.suse.com/security/cve/CVE-2024-26930.html * https://www.suse.com/security/cve/CVE-2024-27398.html * https://www.suse.com/security/cve/CVE-2024-35817.html * https://www.suse.com/security/cve/CVE-2024-35950.html * https://bugzilla.suse.com/show_bug.cgi?id=1220145 * https://bugzilla.suse.com/show_bug.cgi?id=1220832 * https://bugzilla.suse.com/show_bug.cgi?id=1221302 * https://bugzilla.suse.com/show_bug.cgi?id=1222685 * https://bugzilla.suse.com/show_bug.cgi?id=1223059 * https://bugzilla.suse.com/show_bug.cgi?id=1223363 * https://bugzilla.suse.com/show_bug.cgi?id=1223514 * https://bugzilla.suse.com/show_bug.cgi?id=1223521 * https://bugzilla.suse.com/show_bug.cgi?id=1223681 * https://bugzilla.suse.com/show_bug.cgi?id=1223683 * https://bugzilla.suse.com/show_bug.cgi?id=1225013 * https://bugzilla.suse.com/show_bug.cgi?id=1225099 * https://bugzilla.suse.com/show_bug.cgi?id=1225310 * https://bugzilla.suse.com/show_bug.cgi?id=1225313

1 0

SUSE-SU-2024:3348-1: important: Security update for the Linux Kernel (Live Patch 12 for SLE 15 SP5)
by OPENSUSE-UPDATES 19 Sep '24

19 Sep '24

# Security update for the Linux Kernel (Live Patch 12 for SLE 15 SP5) Announcement ID: SUSE-SU-2024:3348-1 Rating: important References: * bsc#1221302 * bsc#1223059 * bsc#1223363 * bsc#1223514 * bsc#1223521 * bsc#1223683 * bsc#1225013 * bsc#1225099 * bsc#1225310 Cross-References: * CVE-2022-48651 * CVE-2022-48662 * CVE-2023-52846 * CVE-2024-26610 * CVE-2024-26828 * CVE-2024-26852 * CVE-2024-26923 * CVE-2024-27398 * CVE-2024-35950 CVSS scores: * CVE-2022-48651 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2022-48662 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2022-48662 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-52846 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-26610 ( SUSE ): 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H * CVE-2024-26828 ( SUSE ): 7.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H * CVE-2024-26852 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-26923 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-27398 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-35950 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: * openSUSE Leap 15.5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Live Patching 15-SP5 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that solves nine vulnerabilities can now be installed. ## Description: This update for the Linux Kernel 5.14.21-150500_55_59 fixes several issues. The following security issues were fixed: * CVE-2023-52846: Prevent use after free in prp_create_tagged_frame() (bsc#1225099). * CVE-2022-48662: Fixed a general protection fault (GPF) in i915_perf_open_ioctl (bsc#1223521). * CVE-2022-48662: Fixed GPF in i915_perf_open_ioctl (bsc#1223521). * CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1225013). * CVE-2024-35950: Fully protect modes with dev->mode_config.mutex (bsc#1225310). * CVE-2024-26923: Fixed false-positive lockdep splat for spin_lock() in __unix_gc() (bsc#1223683). * CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223363). * CVE-2024-26852: Fixed use-after-free in ip6_route_mpath_notify() (bsc#1223059). * CVE-2024-26610: Fixed memory corruption in wifi/iwlwifi (bsc#1221302). * CVE-2022-48651: Fixed an out-of-bound bug in ipvlan caused by unset skb->mac_header (bsc#1223514). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch SUSE-2024-3348=1 * SUSE Linux Enterprise Live Patching 15-SP5 zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP5-2024-3348=1 ## Package List: * openSUSE Leap 15.5 (ppc64le s390x x86_64) * kernel-livepatch-5_14_21-150500_55_59-default-6-150500.11.10.2 * kernel-livepatch-5_14_21-150500_55_59-default-debuginfo-6-150500.11.10.2 * kernel-livepatch-SLE15-SP5_Update_12-debugsource-6-150500.11.10.2 * SUSE Linux Enterprise Live Patching 15-SP5 (ppc64le s390x x86_64) * kernel-livepatch-5_14_21-150500_55_59-default-6-150500.11.10.2 * kernel-livepatch-5_14_21-150500_55_59-default-debuginfo-6-150500.11.10.2 * kernel-livepatch-SLE15-SP5_Update_12-debugsource-6-150500.11.10.2 ## References: * https://www.suse.com/security/cve/CVE-2022-48651.html * https://www.suse.com/security/cve/CVE-2022-48662.html * https://www.suse.com/security/cve/CVE-2023-52846.html * https://www.suse.com/security/cve/CVE-2024-26610.html * https://www.suse.com/security/cve/CVE-2024-26828.html * https://www.suse.com/security/cve/CVE-2024-26852.html * https://www.suse.com/security/cve/CVE-2024-26923.html * https://www.suse.com/security/cve/CVE-2024-27398.html * https://www.suse.com/security/cve/CVE-2024-35950.html * https://bugzilla.suse.com/show_bug.cgi?id=1221302 * https://bugzilla.suse.com/show_bug.cgi?id=1223059 * https://bugzilla.suse.com/show_bug.cgi?id=1223363 * https://bugzilla.suse.com/show_bug.cgi?id=1223514 * https://bugzilla.suse.com/show_bug.cgi?id=1223521 * https://bugzilla.suse.com/show_bug.cgi?id=1223683 * https://bugzilla.suse.com/show_bug.cgi?id=1225013 * https://bugzilla.suse.com/show_bug.cgi?id=1225099 * https://bugzilla.suse.com/show_bug.cgi?id=1225310

1 0

SUSE-SU-2024:3349-1: important: Security update for the Linux Kernel (Live Patch 13 for SLE 15 SP5)
by OPENSUSE-UPDATES 19 Sep '24

19 Sep '24

# Security update for the Linux Kernel (Live Patch 13 for SLE 15 SP5) Announcement ID: SUSE-SU-2024:3349-1 Rating: important References: * bsc#1223363 * bsc#1223683 * bsc#1225013 * bsc#1225099 Cross-References: * CVE-2023-52846 * CVE-2024-26828 * CVE-2024-26923 * CVE-2024-27398 CVSS scores: * CVE-2023-52846 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-26828 ( SUSE ): 7.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H * CVE-2024-26923 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-27398 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: * openSUSE Leap 15.5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Live Patching 15-SP5 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that solves four vulnerabilities can now be installed. ## Description: This update for the Linux Kernel 5.14.21-150500_55_62 fixes several issues. The following security issues were fixed: * CVE-2023-52846: Prevent use after free in prp_create_tagged_frame() (bsc#1225099). * CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1225013). * CVE-2024-26923: Fixed false-positive lockdep splat for spin_lock() in __unix_gc() (bsc#1223683). * CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223363). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch SUSE-2024-3349=1 * SUSE Linux Enterprise Live Patching 15-SP5 zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP5-2024-3349=1 ## Package List: * openSUSE Leap 15.5 (ppc64le s390x x86_64) * kernel-livepatch-SLE15-SP5_Update_13-debugsource-4-150500.11.6.2 * kernel-livepatch-5_14_21-150500_55_62-default-debuginfo-4-150500.11.6.2 * kernel-livepatch-5_14_21-150500_55_62-default-4-150500.11.6.2 * SUSE Linux Enterprise Live Patching 15-SP5 (ppc64le s390x x86_64) * kernel-livepatch-SLE15-SP5_Update_13-debugsource-4-150500.11.6.2 * kernel-livepatch-5_14_21-150500_55_62-default-debuginfo-4-150500.11.6.2 * kernel-livepatch-5_14_21-150500_55_62-default-4-150500.11.6.2 ## References: * https://www.suse.com/security/cve/CVE-2023-52846.html * https://www.suse.com/security/cve/CVE-2024-26828.html * https://www.suse.com/security/cve/CVE-2024-26923.html * https://www.suse.com/security/cve/CVE-2024-27398.html * https://bugzilla.suse.com/show_bug.cgi?id=1223363 * https://bugzilla.suse.com/show_bug.cgi?id=1223683 * https://bugzilla.suse.com/show_bug.cgi?id=1225013 * https://bugzilla.suse.com/show_bug.cgi?id=1225099

1 0

SUSE-RU-2024:3335-1: moderate: Recommended update for jemalloc
by OPENSUSE-UPDATES 19 Sep '24

19 Sep '24

# Recommended update for jemalloc Announcement ID: SUSE-RU-2024:3335-1 Rating: moderate References: * bsc#1105633 * bsc#1133136 * jsc#PED-7454 Affected Products: * Basesystem Module 15-SP6 * Development Tools Module 15-SP6 * openSUSE Leap 15.6 * SUSE Linux Enterprise Desktop 15 SP6 * SUSE Linux Enterprise Real Time 15 SP6 * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 An update that contains one feature and has two fixes can now be installed. ## Description: This update for jemalloc fixes the following issues: Update to release 5.3.0 (jsc#PED-7454): * Added the thread.idle mallctl which hints that the calling thread will be idle for a nontrivial period of time. * Allow small size classes to be the maximum size class to cache in the thread-specific cache, through the opt.[lg_]tcache_max option. * Make the behavior of realloc(ptr, 0) configurable with opt.zero_realloc. * Support C++17 over-aligned allocation. * Add the thread.peak mallctl for approximate per-thread peak memory tracking. * Add high resolution timestamp support for profiling. * Set lg-page to 2^16 on aarch64 to be compatible with 64k page size kernel * Enable LTO as it works (bsc#1133136). * Re-enable profiling on armv6/armv7 since bsc#1105633 is fixed Update to version 5.2.1: * Bug fixes: * Fix a severe virtual memory leak on Windows. This regression was first released in 5.0.0. * Fix size 0 handling in posix_memalign(). This regression was first released in 5.2.0. * Fix the prof_log unit test which may observe unexpected backtraces from compiler optimizations. The test was first added in 5.2.0. * Fix the declaration of the extent_avail tree. This regression was first released in 5.1.0. * Fix an incorrect reference in jeprof. This functionality was first released in 3.0.0. * Fix an assertion on the deallocation fast-path. This regression was first released in 5.2.0. * Fix the TLS_MODEL attribute in headers. This regression was first released in 5.0.0. * Optimizations and refactors: * Implement opt.retain on Windows and enable by default on 64-bit. * Optimize away a branch on the operator delete path. * Add format annotation to the format generator function. * Refactor and improve the size class header generation. * Remove best fit. * Avoid blocking on background thread locks for stats. * Disable LTO (bsc#1133136). * Drop static library package, nothing seems to use it. * Remove openSUSE 11.1 build support. Update to version 5.2.0: New features: * Implement oversize_threshold, which uses a dedicated arena for allocations crossing the specified threshold to reduce fragmentation. * Add extents usage information to stats. * Log time information for sampled allocations. * Support 0 size in sdallocx. * Output rate for certain counters in malloc_stats. * Add mallctl interfaces: * opt.oversize_threshold * stats.arenas.<i>.extent_avail * stats.arenas.<i>.extents.<j>.n{dirty,muzzy,retained} * stats.arenas.<i>.extents.<j>.{dirty,muzzy,retained}_bytes * Optimizations and refactors: * Refactor the TSD module. * Implement opt.oversize_threshold which uses a dedicated arena for requests crossing the threshold, also eagerly purges the oversize extents. Default the threshold to 8 MiB. * Improve error handling for THP state initialization. * Refactor and optimize the tcache fill / flush paths. * Optimize sync / lwsync on PowerPC. * Bypass extent_dalloc() when retain is enabled. * Lower the default number of background threads to 4 (when the feature is enabled). * Use arena index for arena-matching checks. * Avoid forced decay on thread termination when using background threads. * Disable muzzy decay by default. * Only initialize libgcc unwinder when profiling is enabled. * Bug fixes: * Fix background thread index issues with max_background_threads. * Fix stats output for opt.lg_extent_max_active_fit. * Properly trigger decay on tcache destroy. * Detect whether explicit extent zero out is necessary with huge pages or custom extent hooks, which may change the purge semantics. * Fix a side effect caused by extent_max_active_fit combined with decay-based purging, where freed extents can accumulate and not be reused for an extended period of time. * Fix a missing unlock on extent register error handling. * Incompatible changes: * Remove --with-lg-page-sizes. Update to version 5.1.0: New features: * Implement transparent huge page support for internal metadata. (@interwq) * Add opt.thp to allow enabling / disabling transparent huge pages for all mappings. (@interwq) * Add maximum background thread count option. (@djwatson) * Allow prof_active to control opt.lg_prof_interval and prof.gdump. (@interwq) * Allow arena index lookup based on allocation addresses via mallctl. (@lionkov) * Allow disabling initial-exec TLS model. (@davidtgoldblatt, @KenMacD) * Add opt.lg_extent_max_active_fit to set the max ratio between the size of the active extent selected (to split off from) and the size of the requested allocation. (@interwq, @davidtgoldblatt) * Add retain_grow_limit to set the max size when growing virtual address space. (@interwq) * Add mallctl interfaces: * arena.<i>.retain_grow_limit (@interwq) * arenas.lookup (@lionkov) * max_background_threads (@djwatson) * opt.lg_extent_max_active_fit (@interwq) * opt.max_background_threads (@djwatson) * opt.metadata_thp (@interwq) * opt.thp (@interwq) * stats.metadata_thp (@interwq) Portability improvements: * Support GNU/kFreeBSD configuration. (@paravoid) * Support m68k, nios2 and SH3 architectures. (@paravoid) * Fall back to FD_CLOEXEC when O_CLOEXEC is unavailable. (@zonyitoo) * Fix symbol listing for cross-compiling. (@tamird) * Fix high bits computation on ARM. (@davidtgoldblatt, @paravoid) * Disable the CPU_SPINWAIT macro for Power. (@davidtgoldblatt, @marxin) * Fix MSVC 2015 & 2017 builds. (@rustyx) * Improve RISC-V support. (@EdSchouten) * Set name mangling script in strict mode. (@nicolov) * Avoid MADV_HUGEPAGE on ARM. (@marxin) * Modify configure to determine return value of strerror_r. (@davidtgoldblatt, @cferris1000) * Make sure CXXFLAGS is tested with CPP compiler. (@nehaljwani) * Fix 32-bit build on MSVC. (@rustyx) * Fix external symbol on MSVC. (@maksqwe) * Avoid a printf format specifier warning. (@jasone) * Add configure option --disable-initial-exec-tls which can allow jemalloc to be dynamically loaded after program startup. (@davidtgoldblatt, @KenMacD) * AArch64: Add ILP32 support. (@cmuellner) * Add --with-lg-vaddr configure option to support cross compiling. (@cmuellner, @davidtgoldblatt) Optimizations and refactors: * Improve active extent fit with extent_max_active_fit. This considerably reduces fragmentation over time and improves virtual memory and metadata usage. (@davidtgoldblatt, @interwq) * Eagerly coalesce large extents to reduce fragmentation. (@interwq) * sdallocx: only read size info when page aligned (i.e. possibly sampled), which speeds up the sized deallocation path significantly. (@interwq) * Avoid attempting new mappings for in place expansion with retain, since it rarely succeeds in practice and causes high overhead. (@interwq) * Refactor OOM handling in newImpl. (@wqfish) * Add internal fine-grained logging functionality for debugging use. (@davidtgoldblatt) * Refactor arena / tcache interactions. (@davidtgoldblatt) * Refactor extent management with dumpable flag. (@davidtgoldblatt) * Add runtime detection of lazy purging. (@interwq) * Use pairing heap instead of red-black tree for extents_avail. (@djwatson) * Use sysctl on startup in FreeBSD. (@trasz) * Use thread local prng state instead of atomic. (@djwatson) * Make decay to always purge one more extent than before, because in practice large extents are usually the ones that cross the decay threshold. Purging the additional extent helps save memory as well as reduce VM fragmentation. (@interwq) * Fast division by dynamic values. (@davidtgoldblatt) * Improve the fit for aligned allocation. (@interwq, @edwinsmith) * Refactor extent_t bitpacking. (@rkmisra) * Optimize the generated assembly for ticker operations. (@davidtgoldblatt) * Convert stats printing to use a structured text emitter. (@davidtgoldblatt) * Remove preserve_lru feature for extents management. (@djwatson) * Consolidate two memory loads into one on the fast deallocation path. (@davidtgoldblatt, @interwq) Bug fixes (most of the issues are only relevant to jemalloc 5.0): * Fix deadlock with multithreaded fork in OS X. (@davidtgoldblatt) * Validate returned file descriptor before use. (@zonyitoo) * Fix a few background thread initialization and shutdown issues. (@interwq) * Fix an extent coalesce + decay race by taking both coalescing extents off the LRU list. (@interwq) * Fix potentially unbound increase during decay, caused by one thread keep stashing memory to purge while other threads generating new pages. The number of pages to purge is checked to prevent this. (@interwq) * Fix a FreeBSD bootstrap assertion. (@strejda, @interwq) * Handle 32 bit mutex counters. (@rkmisra) * Fix a indexing bug when creating background threads. (@davidtgoldblatt, @binliu19) * Fix arguments passed to extent_init. (@yuleniwo, @interwq) * Fix addresses used for ordering mutexes. (@rkmisra) * Fix abort_conf processing during bootstrap. (@interwq) * Fix include path order for out-of-tree builds. (@cmuellner) Incompatible changes: * Remove --disable-thp. (@interwq) * Remove mallctl interfaces: * config.thp (@interwq) Documentation: * Add TUNING.md. (@interwq, @davidtgoldblatt, @djwatson) * Disable THP for ARM (32 bits). This fix build by passing all tests successfully ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.6 zypper in -t patch SUSE-2024-3335=1 openSUSE-SLE-15.6-2024-3335=1 * Basesystem Module 15-SP6 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP6-2024-3335=1 * Development Tools Module 15-SP6 zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP6-2024-3335=1 ## Package List: * openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64 i586) * libjemalloc2-5.3.0-150600.15.4.1 * jemalloc-debugsource-5.3.0-150600.15.4.1 * jemalloc-5.3.0-150600.15.4.1 * libjemalloc2-debuginfo-5.3.0-150600.15.4.1 * jemalloc-devel-static-5.3.0-150600.15.4.1 * jemalloc-devel-5.3.0-150600.15.4.1 * Basesystem Module 15-SP6 (aarch64 ppc64le s390x x86_64) * jemalloc-debugsource-5.3.0-150600.15.4.1 * libjemalloc2-debuginfo-5.3.0-150600.15.4.1 * jemalloc-devel-5.3.0-150600.15.4.1 * jemalloc-devel-static-5.3.0-150600.15.4.1 * libjemalloc2-5.3.0-150600.15.4.1 * Development Tools Module 15-SP6 (aarch64 ppc64le s390x x86_64) * jemalloc-debugsource-5.3.0-150600.15.4.1 * jemalloc-5.3.0-150600.15.4.1 ## References: * https://bugzilla.suse.com/show_bug.cgi?id=1105633 * https://bugzilla.suse.com/show_bug.cgi?id=1133136 * https://jira.suse.com/browse/PED-7454

1 0

SUSE-SU-2024:3339-1: moderate: Security update for libmfx
by OPENSUSE-UPDATES 19 Sep '24

19 Sep '24

# Security update for libmfx Announcement ID: SUSE-SU-2024:3339-1 Rating: moderate References: * bsc#1219494 * bsc#1226892 * bsc#1226897 * bsc#1226898 * bsc#1226899 * bsc#1226900 * bsc#1226901 * jsc#PED-10024 Cross-References: * CVE-2023-22656 * CVE-2023-45221 * CVE-2023-47169 * CVE-2023-47282 * CVE-2023-48368 CVSS scores: * CVE-2023-22656 ( SUSE ): 3.9 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N * CVE-2023-45221 ( SUSE ): 4.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L * CVE-2023-47169 ( SUSE ): 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L * CVE-2023-47282 ( SUSE ): 3.9 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L * CVE-2023-48368 ( SUSE ): 5.9 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:H Affected Products: * Desktop Applications Module 15-SP5 * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Package Hub 15 15-SP5 An update that solves five vulnerabilities, contains one feature and has two security fixes can now be installed. ## Description: This update for libmfx fixes the following issues: * CVE-2023-48368: Fixed an improper input validation. (bsc#1226897) * CVE-2023-45221: Fixed an improper buffer restrictions. (bsc#1226898) * CVE-2023-22656: Fixed an out-of-bounds read. (bsc#1226899) * CVE-2023-47282: Fixed an out-of-bounds write. (bsc#1226900) * CVE-2023-47169: Fixed an improper buffer restrictions. (bsc#1226901) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-3339=1 SUSE-2024-3339=1 * Desktop Applications Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP5-2024-3339=1 * SUSE Package Hub 15 15-SP5 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP5-2024-3339=1 ## Package List: * openSUSE Leap 15.5 (x86_64) * libmfx1-22.6.1-150500.3.5.1 * libmfx-22.6.1-150500.3.5.1 * libmfx-debugsource-22.6.1-150500.3.5.1 * libmfx1-debuginfo-22.6.1-150500.3.5.1 * Desktop Applications Module 15-SP5 (x86_64) * libmfx1-22.6.1-150500.3.5.1 * libmfx-debugsource-22.6.1-150500.3.5.1 * libmfx1-debuginfo-22.6.1-150500.3.5.1 * SUSE Package Hub 15 15-SP5 (x86_64) * libmfx1-22.6.1-150500.3.5.1 ## References: * https://www.suse.com/security/cve/CVE-2023-22656.html * https://www.suse.com/security/cve/CVE-2023-45221.html * https://www.suse.com/security/cve/CVE-2023-47169.html * https://www.suse.com/security/cve/CVE-2023-47282.html * https://www.suse.com/security/cve/CVE-2023-48368.html * https://bugzilla.suse.com/show_bug.cgi?id=1219494 * https://bugzilla.suse.com/show_bug.cgi?id=1226892 * https://bugzilla.suse.com/show_bug.cgi?id=1226897 * https://bugzilla.suse.com/show_bug.cgi?id=1226898 * https://bugzilla.suse.com/show_bug.cgi?id=1226899 * https://bugzilla.suse.com/show_bug.cgi?id=1226900 * https://bugzilla.suse.com/show_bug.cgi?id=1226901 * https://jira.suse.com/browse/PED-10024

1 0

SUSE-SU-2024:3341-1: important: Security update for kubernetes1.23
by OPENSUSE-UPDATES 19 Sep '24

19 Sep '24

# Security update for kubernetes1.23 Announcement ID: SUSE-SU-2024:3341-1 Rating: important References: * bsc#1062303 * bsc#1194400 * bsc#1211630 * bsc#1211631 * bsc#1214406 * bsc#1216109 * bsc#1216123 * bsc#1219964 * bsc#1221400 * bsc#1222539 * bsc#1226136 * bsc#1229858 * bsc#1229867 * bsc#1229869 * bsc#1230323 Cross-References: * CVE-2021-25743 * CVE-2023-2727 * CVE-2023-2728 * CVE-2023-39325 * CVE-2023-44487 * CVE-2023-45288 * CVE-2024-0793 * CVE-2024-24786 * CVE-2024-3177 CVSS scores: * CVE-2021-25743 ( SUSE ): 4.0 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N * CVE-2021-25743 ( NVD ): 3.0 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N * CVE-2023-2727 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N * CVE-2023-2727 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N * CVE-2023-2728 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N * CVE-2023-2728 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N * CVE-2023-39325 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-39325 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-44487 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-44487 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-45288 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2024-0793 ( SUSE ): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H * CVE-2024-24786 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2024-3177 ( SUSE ): 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N * CVE-2024-3177 ( NVD ): 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N Affected Products: * openSUSE Leap 15.4 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 An update that solves nine vulnerabilities and has six security fixes can now be installed. ## Description: This update for kubernetes1.23 fixes the following issues: * CVE-2021-25743: escape, meta and control sequences in raw data output to terminal not neutralized. (bsc#1194400) * CVE-2023-2727: bypass of policies imposed by the ImagePolicyWebhook admission plugin. (bsc#1211630) * CVE-2023-2728: bypass of the mountable secrets policy enforced by the ServiceAccount admission plugin. (bsc#1211631) * CVE-2023-39325: go1.20: excessive resource consumption when dealing with rapid stream resets. (bsc#1229869) * CVE-2023-44487: google.golang.org/grpc, kube-apiserver: HTTP/2 rapid reset vulnerability. (bsc#1229869) * CVE-2023-45288: golang.org/x/net: excessive CPU consumption when processing unlimited sets of headers. (bsc#1229869) * CVE-2024-0793: kube-controller-manager pod crash when processing malformed HPA v1 manifests. (bsc#1219964) * CVE-2024-3177: bypass of the mountable secrets policy enforced by the ServiceAccount admission plugin. (bsc#1222539) * CVE-2024-24786: github.com/golang/protobuf: infinite loop when unmarshaling invalid JSON. (bsc#1229867) Bug fixes: * Use -trimpath in non-DBG mode for reproducible builds. (bsc#1062303) * Fix multiple issues for successful `kubeadm init` run. (bsc#1214406) * Update go to version 1.22.5 in build requirements. (bsc#1229858) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2024-3341=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2024-3341=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2024-3341=1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2024-3341=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2024-3341=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64) * kubernetes1.24-kubelet-common-1.24.17-150400.9.16.1 * kubernetes1.24-kubelet-1.24.17-150400.9.16.1 * kubernetes1.24-scheduler-1.24.17-150400.9.16.1 * kubernetes1.24-client-common-1.24.17-150400.9.16.1 * kubernetes1.24-controller-manager-1.24.17-150400.9.16.1 * kubernetes1.24-apiserver-1.24.17-150400.9.16.1 * kubernetes1.24-proxy-1.24.17-150400.9.16.1 * kubernetes1.24-kubeadm-1.24.17-150400.9.16.1 * kubernetes1.24-client-1.24.17-150400.9.16.1 * openSUSE Leap 15.4 (noarch) * kubernetes1.24-client-bash-completion-1.24.17-150400.9.16.1 * kubernetes1.24-client-fish-completion-1.24.17-150400.9.16.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64 x86_64) * kubernetes1.24-client-common-1.24.17-150400.9.16.1 * kubernetes1.24-client-1.24.17-150400.9.16.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64 x86_64) * kubernetes1.24-client-common-1.24.17-150400.9.16.1 * kubernetes1.24-client-1.24.17-150400.9.16.1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (aarch64 ppc64le s390x x86_64) * kubernetes1.24-client-common-1.24.17-150400.9.16.1 * kubernetes1.24-client-1.24.17-150400.9.16.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (ppc64le x86_64) * kubernetes1.24-client-common-1.24.17-150400.9.16.1 * kubernetes1.24-client-1.24.17-150400.9.16.1 ## References: * https://www.suse.com/security/cve/CVE-2021-25743.html * https://www.suse.com/security/cve/CVE-2023-2727.html * https://www.suse.com/security/cve/CVE-2023-2728.html * https://www.suse.com/security/cve/CVE-2023-39325.html * https://www.suse.com/security/cve/CVE-2023-44487.html * https://www.suse.com/security/cve/CVE-2023-45288.html * https://www.suse.com/security/cve/CVE-2024-0793.html * https://www.suse.com/security/cve/CVE-2024-24786.html * https://www.suse.com/security/cve/CVE-2024-3177.html * https://bugzilla.suse.com/show_bug.cgi?id=1062303 * https://bugzilla.suse.com/show_bug.cgi?id=1194400 * https://bugzilla.suse.com/show_bug.cgi?id=1211630 * https://bugzilla.suse.com/show_bug.cgi?id=1211631 * https://bugzilla.suse.com/show_bug.cgi?id=1214406 * https://bugzilla.suse.com/show_bug.cgi?id=1216109 * https://bugzilla.suse.com/show_bug.cgi?id=1216123 * https://bugzilla.suse.com/show_bug.cgi?id=1219964 * https://bugzilla.suse.com/show_bug.cgi?id=1221400 * https://bugzilla.suse.com/show_bug.cgi?id=1222539 * https://bugzilla.suse.com/show_bug.cgi?id=1226136 * https://bugzilla.suse.com/show_bug.cgi?id=1229858 * https://bugzilla.suse.com/show_bug.cgi?id=1229867 * https://bugzilla.suse.com/show_bug.cgi?id=1229869 * https://bugzilla.suse.com/show_bug.cgi?id=1230323

1 0

SUSE-SU-2024:3342-1: important: Security update for kubernetes1.24
by OPENSUSE-UPDATES 19 Sep '24

19 Sep '24

# Security update for kubernetes1.24 Announcement ID: SUSE-SU-2024:3342-1 Rating: important References: * bsc#1216109 * bsc#1216123 * bsc#1221400 * bsc#1226136 * bsc#1229858 * bsc#1229867 * bsc#1229869 * bsc#1230323 Cross-References: * CVE-2023-39325 * CVE-2023-44487 * CVE-2023-45288 * CVE-2024-24786 CVSS scores: * CVE-2023-39325 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-39325 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-44487 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-44487 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-45288 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2024-24786 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: * Containers Module 15-SP5 * openSUSE Leap 15.5 * openSUSE Leap 15.6 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that solves four vulnerabilities and has four security fixes can now be installed. ## Description: This update for kubernetes1.24 fixes the following issues: * CVE-2023-39325: go1.20: excessive resource consumption when dealing with rapid stream resets. (bsc#1229869) * CVE-2023-44487: google.golang.org/grpc, kube-apiserver: HTTP/2 rapid reset vulnerability. (bsc#1229869) * CVE-2023-45288: golang.org/x/net: excessive CPU consumption when processing unlimited sets of headers. (bsc#1229869) * CVE-2024-24786: github.com/golang/protobuf: infinite loop when unmarshaling invalid JSON. (bsc#1229867) Bug fixes: * Update go to version 1.22.5 in build requirements. (bsc#1229858) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch SUSE-2024-3342=1 openSUSE-SLE-15.5-2024-3342=1 * openSUSE Leap 15.6 zypper in -t patch openSUSE-SLE-15.6-2024-3342=1 * Containers Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Containers-15-SP5-2024-3342=1 ## Package List: * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * kubernetes1.24-apiserver-1.24.17-150500.3.22.1 * kubernetes1.24-proxy-1.24.17-150500.3.22.1 * kubernetes1.24-kubelet-1.24.17-150500.3.22.1 * kubernetes1.24-kubelet-common-1.24.17-150500.3.22.1 * kubernetes1.24-client-common-1.24.17-150500.3.22.1 * kubernetes1.24-kubeadm-1.24.17-150500.3.22.1 * kubernetes1.24-scheduler-1.24.17-150500.3.22.1 * kubernetes1.24-client-1.24.17-150500.3.22.1 * kubernetes1.24-controller-manager-1.24.17-150500.3.22.1 * openSUSE Leap 15.5 (noarch) * kubernetes1.24-client-fish-completion-1.24.17-150500.3.22.1 * kubernetes1.24-client-bash-completion-1.24.17-150500.3.22.1 * openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64) * kubernetes1.24-apiserver-1.24.17-150500.3.22.1 * kubernetes1.24-proxy-1.24.17-150500.3.22.1 * kubernetes1.24-kubelet-1.24.17-150500.3.22.1 * kubernetes1.24-kubelet-common-1.24.17-150500.3.22.1 * kubernetes1.24-client-common-1.24.17-150500.3.22.1 * kubernetes1.24-kubeadm-1.24.17-150500.3.22.1 * kubernetes1.24-scheduler-1.24.17-150500.3.22.1 * kubernetes1.24-client-1.24.17-150500.3.22.1 * kubernetes1.24-controller-manager-1.24.17-150500.3.22.1 * openSUSE Leap 15.6 (noarch) * kubernetes1.24-client-fish-completion-1.24.17-150500.3.22.1 * kubernetes1.24-client-bash-completion-1.24.17-150500.3.22.1 * Containers Module 15-SP5 (aarch64 ppc64le s390x x86_64) * kubernetes1.24-client-1.24.17-150500.3.22.1 * kubernetes1.24-client-common-1.24.17-150500.3.22.1 ## References: * https://www.suse.com/security/cve/CVE-2023-39325.html * https://www.suse.com/security/cve/CVE-2023-44487.html * https://www.suse.com/security/cve/CVE-2023-45288.html * https://www.suse.com/security/cve/CVE-2024-24786.html * https://bugzilla.suse.com/show_bug.cgi?id=1216109 * https://bugzilla.suse.com/show_bug.cgi?id=1216123 * https://bugzilla.suse.com/show_bug.cgi?id=1221400 * https://bugzilla.suse.com/show_bug.cgi?id=1226136 * https://bugzilla.suse.com/show_bug.cgi?id=1229858 * https://bugzilla.suse.com/show_bug.cgi?id=1229867 * https://bugzilla.suse.com/show_bug.cgi?id=1229869 * https://bugzilla.suse.com/show_bug.cgi?id=1230323

1 0

SUSE-SU-2024:3343-1: important: Security update for kubernetes1.24
by OPENSUSE-UPDATES 19 Sep '24

19 Sep '24

# Security update for kubernetes1.24 Announcement ID: SUSE-SU-2024:3343-1 Rating: important References: * bsc#1062303 * bsc#1194400 * bsc#1211630 * bsc#1211631 * bsc#1214406 * bsc#1216109 * bsc#1216123 * bsc#1219964 * bsc#1221400 * bsc#1222539 * bsc#1226136 * bsc#1229858 * bsc#1229867 * bsc#1229869 * bsc#1230323 Cross-References: * CVE-2021-25743 * CVE-2023-2727 * CVE-2023-2728 * CVE-2023-39325 * CVE-2023-44487 * CVE-2023-45288 * CVE-2024-0793 * CVE-2024-24786 * CVE-2024-3177 CVSS scores: * CVE-2021-25743 ( SUSE ): 4.0 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N * CVE-2021-25743 ( NVD ): 3.0 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N * CVE-2023-2727 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N * CVE-2023-2727 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N * CVE-2023-2728 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N * CVE-2023-2728 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N * CVE-2023-39325 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-39325 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-44487 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-44487 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-45288 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2024-0793 ( SUSE ): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H * CVE-2024-24786 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2024-3177 ( SUSE ): 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N * CVE-2024-3177 ( NVD ): 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N Affected Products: * openSUSE Leap 15.3 * SUSE Enterprise Storage 7.1 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 * SUSE Linux Enterprise Server 15 SP3 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 An update that solves nine vulnerabilities and has six security fixes can now be installed. ## Description: This update for kubernetes1.24 fixes the following issues: * CVE-2021-25743: escape, meta and control sequences in raw data output to terminal not neutralized. (bsc#1194400) * CVE-2023-2727: bypass of policies imposed by the ImagePolicyWebhook admission plugin. (bsc#1211630) * CVE-2023-2728: bypass of the mountable secrets policy enforced by the ServiceAccount admission plugin. (bsc#1211631) * CVE-2023-39325: go1.20: excessive resource consumption when dealing with rapid stream resets. (bsc#1229869) * CVE-2023-44487: google.golang.org/grpc, kube-apiserver: HTTP/2 rapid reset vulnerability. (bsc#1229869) * CVE-2023-45288: golang.org/x/net: excessive CPU consumption when processing unlimited sets of headers. (bsc#1229869) * CVE-2024-0793: kube-controller-manager pod crash when processing malformed HPA v1 manifests. (bsc#1219964) * CVE-2024-3177: bypass of the mountable secrets policy enforced by the ServiceAccount admission plugin. (bsc#1222539) * CVE-2024-24786: github.com/golang/protobuf: infinite loop when unmarshaling invalid JSON. (bsc#1229867) Bug fixes: * Use -trimpath in non-DBG mode for reproducible builds. (bsc#1062303) * Fix multiple issues for successful `kubeadm init` run. (bsc#1214406) * Update go to version 1.22.5 in build requirements. (bsc#1229858) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.3 zypper in -t patch SUSE-2024-3343=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2024-3343=1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2024-3343=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2024-3343=1 * SUSE Enterprise Storage 7.1 zypper in -t patch SUSE-Storage-7.1-2024-3343=1 ## Package List: * openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64) * kubernetes1.24-proxy-1.24.17-150300.7.6.1 * kubernetes1.24-kubeadm-1.24.17-150300.7.6.1 * kubernetes1.24-client-common-1.24.17-150300.7.6.1 * kubernetes1.24-kubelet-common-1.24.17-150300.7.6.1 * kubernetes1.24-scheduler-1.24.17-150300.7.6.1 * kubernetes1.24-client-1.24.17-150300.7.6.1 * kubernetes1.24-kubelet-1.24.17-150300.7.6.1 * kubernetes1.24-controller-manager-1.24.17-150300.7.6.1 * kubernetes1.24-apiserver-1.24.17-150300.7.6.1 * openSUSE Leap 15.3 (noarch) * kubernetes1.24-client-fish-completion-1.24.17-150300.7.6.1 * kubernetes1.24-client-bash-completion-1.24.17-150300.7.6.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (aarch64 x86_64) * kubernetes1.24-client-1.24.17-150300.7.6.1 * kubernetes1.24-client-common-1.24.17-150300.7.6.1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (aarch64 ppc64le s390x x86_64) * kubernetes1.24-client-1.24.17-150300.7.6.1 * kubernetes1.24-client-common-1.24.17-150300.7.6.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (ppc64le x86_64) * kubernetes1.24-client-1.24.17-150300.7.6.1 * kubernetes1.24-client-common-1.24.17-150300.7.6.1 * SUSE Enterprise Storage 7.1 (aarch64 x86_64) * kubernetes1.24-client-1.24.17-150300.7.6.1 * kubernetes1.24-client-common-1.24.17-150300.7.6.1 ## References: * https://www.suse.com/security/cve/CVE-2021-25743.html * https://www.suse.com/security/cve/CVE-2023-2727.html * https://www.suse.com/security/cve/CVE-2023-2728.html * https://www.suse.com/security/cve/CVE-2023-39325.html * https://www.suse.com/security/cve/CVE-2023-44487.html * https://www.suse.com/security/cve/CVE-2023-45288.html * https://www.suse.com/security/cve/CVE-2024-0793.html * https://www.suse.com/security/cve/CVE-2024-24786.html * https://www.suse.com/security/cve/CVE-2024-3177.html * https://bugzilla.suse.com/show_bug.cgi?id=1062303 * https://bugzilla.suse.com/show_bug.cgi?id=1194400 * https://bugzilla.suse.com/show_bug.cgi?id=1211630 * https://bugzilla.suse.com/show_bug.cgi?id=1211631 * https://bugzilla.suse.com/show_bug.cgi?id=1214406 * https://bugzilla.suse.com/show_bug.cgi?id=1216109 * https://bugzilla.suse.com/show_bug.cgi?id=1216123 * https://bugzilla.suse.com/show_bug.cgi?id=1219964 * https://bugzilla.suse.com/show_bug.cgi?id=1221400 * https://bugzilla.suse.com/show_bug.cgi?id=1222539 * https://bugzilla.suse.com/show_bug.cgi?id=1226136 * https://bugzilla.suse.com/show_bug.cgi?id=1229858 * https://bugzilla.suse.com/show_bug.cgi?id=1229867 * https://bugzilla.suse.com/show_bug.cgi?id=1229869 * https://bugzilla.suse.com/show_bug.cgi?id=1230323

1 0

SUSE-SU-2024:3344-1: important: Security update for kubernetes1.25
by OPENSUSE-UPDATES 19 Sep '24

19 Sep '24

# Security update for kubernetes1.25 Announcement ID: SUSE-SU-2024:3344-1 Rating: important References: * bsc#1216109 * bsc#1216123 * bsc#1221400 * bsc#1226136 * bsc#1229858 * bsc#1229867 * bsc#1229869 * bsc#1230323 Cross-References: * CVE-2023-39325 * CVE-2023-44487 * CVE-2023-45288 * CVE-2024-24786 CVSS scores: * CVE-2023-39325 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-39325 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-44487 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-44487 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-45288 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2024-24786 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: * Containers Module 15-SP5 * Containers Module 15-SP6 * openSUSE Leap 15.4 * openSUSE Leap 15.5 * openSUSE Leap 15.6 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Real Time 15 SP6 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 An update that solves four vulnerabilities and has four security fixes can now be installed. ## Description: This update for kubernetes1.25 fixes the following issues: * CVE-2023-45288: golang.org/x/net: excessive CPU consumption when processing unlimited sets of headers. (bsc#1229869) * CVE-2023-44487: google.golang.org/grpc, kube-apiserver: HTTP/2 rapid reset vulnerability. (bsc#1229869) * CVE-2024-24786: github.com/golang/protobuf: infinite loop when unmarshaling invalid JSON. (bsc#1229867) Bug fixes: * Update go to version 1.22.5 in build requirements. (bsc#1229858) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2024-3344=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2024-3344=1 * openSUSE Leap 15.4 zypper in -t patch SUSE-2024-3344=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-3344=1 * openSUSE Leap 15.6 zypper in -t patch openSUSE-SLE-15.6-2024-3344=1 * Containers Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Containers-15-SP5-2024-3344=1 * Containers Module 15-SP6 zypper in -t patch SUSE-SLE-Module-Containers-15-SP6-2024-3344=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2024-3344=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2024-3344=1 ## Package List: * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (aarch64 ppc64le s390x x86_64) * kubernetes1.25-client-common-1.25.16-150400.9.16.1 * kubernetes1.25-client-1.25.16-150400.9.16.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (ppc64le x86_64) * kubernetes1.25-client-common-1.25.16-150400.9.16.1 * kubernetes1.25-client-1.25.16-150400.9.16.1 * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64) * kubernetes1.25-client-common-1.25.16-150400.9.16.1 * kubernetes1.25-kubelet-1.25.16-150400.9.16.1 * kubernetes1.25-proxy-1.25.16-150400.9.16.1 * kubernetes1.25-kubelet-common-1.25.16-150400.9.16.1 * kubernetes1.25-client-1.25.16-150400.9.16.1 * kubernetes1.25-kubeadm-1.25.16-150400.9.16.1 * kubernetes1.25-scheduler-1.25.16-150400.9.16.1 * kubernetes1.25-apiserver-1.25.16-150400.9.16.1 * kubernetes1.25-controller-manager-1.25.16-150400.9.16.1 * openSUSE Leap 15.4 (noarch) * kubernetes1.25-client-bash-completion-1.25.16-150400.9.16.1 * kubernetes1.25-client-fish-completion-1.25.16-150400.9.16.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * kubernetes1.25-client-common-1.25.16-150400.9.16.1 * kubernetes1.25-client-1.25.16-150400.9.16.1 * openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64) * kubernetes1.25-client-common-1.25.16-150400.9.16.1 * kubernetes1.25-kubelet-1.25.16-150400.9.16.1 * kubernetes1.25-proxy-1.25.16-150400.9.16.1 * kubernetes1.25-kubelet-common-1.25.16-150400.9.16.1 * kubernetes1.25-client-1.25.16-150400.9.16.1 * kubernetes1.25-kubeadm-1.25.16-150400.9.16.1 * kubernetes1.25-scheduler-1.25.16-150400.9.16.1 * kubernetes1.25-apiserver-1.25.16-150400.9.16.1 * kubernetes1.25-controller-manager-1.25.16-150400.9.16.1 * openSUSE Leap 15.6 (noarch) * kubernetes1.25-client-bash-completion-1.25.16-150400.9.16.1 * kubernetes1.25-client-fish-completion-1.25.16-150400.9.16.1 * Containers Module 15-SP5 (aarch64 ppc64le s390x x86_64) * kubernetes1.25-client-common-1.25.16-150400.9.16.1 * kubernetes1.25-client-1.25.16-150400.9.16.1 * Containers Module 15-SP6 (aarch64 ppc64le s390x x86_64) * kubernetes1.25-client-common-1.25.16-150400.9.16.1 * kubernetes1.25-client-1.25.16-150400.9.16.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64 x86_64) * kubernetes1.25-client-common-1.25.16-150400.9.16.1 * kubernetes1.25-client-1.25.16-150400.9.16.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64 x86_64) * kubernetes1.25-client-common-1.25.16-150400.9.16.1 * kubernetes1.25-client-1.25.16-150400.9.16.1 ## References: * https://www.suse.com/security/cve/CVE-2023-39325.html * https://www.suse.com/security/cve/CVE-2023-44487.html * https://www.suse.com/security/cve/CVE-2023-45288.html * https://www.suse.com/security/cve/CVE-2024-24786.html * https://bugzilla.suse.com/show_bug.cgi?id=1216109 * https://bugzilla.suse.com/show_bug.cgi?id=1216123 * https://bugzilla.suse.com/show_bug.cgi?id=1221400 * https://bugzilla.suse.com/show_bug.cgi?id=1226136 * https://bugzilla.suse.com/show_bug.cgi?id=1229858 * https://bugzilla.suse.com/show_bug.cgi?id=1229867 * https://bugzilla.suse.com/show_bug.cgi?id=1229869 * https://bugzilla.suse.com/show_bug.cgi?id=1230323

1 0