csaf_suse - suse-su-2023:1801-1

suse-su-2023:1801-1

Vulnerability from csaf_suse

Published

2023-04-10 08:26

Modified

2023-04-10 08:26

Summary

Security update for the Linux Kernel

Notes

Title of the patch

Security update for the Linux Kernel

Description of the patch

The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2017-5753: Fixed spectre V1 vulnerability on netlink (bsc#1209547). - CVE-2017-5753: Fixed spectre vulnerability in prlimit (bsc#1209256). - CVE-2021-3923: Fixed stack information leak vulnerability that could lead to kernel protection bypass in infiniband RDMA (bsc#1209778). - CVE-2022-20567: Fixed use after free that could lead to a local privilege escalation in pppol2tp_create of l2tp_ppp.c (bsc#1208850). - CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795). - CVE-2023-1076: Fixed incorrect UID assigned to tun/tap sockets (bsc#1208599). - CVE-2023-1095: Fixed a NULL pointer dereference in nf_tables due to zeroed list head (bsc#1208777). - CVE-2023-1281: Fixed use after free that could lead to privilege escalation in tcindex (bsc#1209634). - CVE-2023-1390: Fixed remote DoS vulnerability in tipc_link_xmit() (bsc#1209289). - CVE-2023-1513: Fixed an uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak (bsc#1209532). - CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207036). - CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (bsc#1207125). - CVE-2023-28328: Fixed a denial of service issue in az6027 driver in drivers/media/usb/dev-usb/az6027.c (bsc#1209291). - CVE-2023-28464: Fixed user-after-free that could lead to privilege escalation in hci_conn_cleanup in net/bluetooth/hci_conn.c (bsc#1209052). - CVE-2023-28772: Fixed buffer overflow in seq_buf_putmem_hex in lib/seq_buf.c (bsc#1209549). The following non-security bugs were fixed: - ARM: 8702/1: head-common.S: Clear lr before jumping to start_kernel() (git-fixes) - Bluetooth: btusb: Add VID:PID 13d3:3529 for Realtek RTL8821CE (git-fixes). - Bluetooth: btusb: do not call kfree_skb() under spin_lock_irqsave() (git-fixes). - Input: atmel_mxt_ts - fix double free in mxt_read_info_block (git-fixes). - KVM: arm64: Hide system instruction access to Trace registers (git-fixes) - NFSv4: Fix hangs when recovering open state after a server reboot (git-fixes). - PCI/MSI: Enforce MSI entry updates to be visible (git-fixes). - PCI/MSI: Enforce that MSI-X table entry is masked for update (git-fixes). - PCI/MSI: Mask all unused MSI-X entries (git-fixes). - PCI/MSI: Skip masking MSI-X on Xen PV (git-fixes). - PCI/PM: Always return devices to D0 when thawing (git-fixes). - PCI/PM: Avoid using device_may_wakeup() for runtime PM (git-fixes). - PCI: Add ACS quirk for Intel Root Complex Integrated Endpoints (git-fixes). - PCI: Add ACS quirk for iProc PAXB (git-fixes). - PCI: Avoid FLR for AMD Matisse HD Audio & USB 3.0 (git-fixes). - PCI: Avoid FLR for AMD Starship USB 3.0 (git-fixes). - PCI: Make ACS quirk implementations more uniform (git-fixes). - PCI: PM: Avoid forcing PCI_D0 for wakeup reasons inconsistently (git-fixes). - PCI: PM: Avoid skipping bus-level PM on platforms without ACPI (git-fixes). - PCI: Unify ACS quirk desired vs provided checking (git-fixes). - PCI: Use pci_update_current_state() in pci_enable_device_flags() (git-fixes). - PCI: aardvark: Do not blindly enable ASPM L0s and do not write to read-only register (git-fixes). - PCI: aardvark: Do not rely on jiffies while holding spinlock (git-fixes). - PCI: aardvark: Do not touch PCIe registers if no card connected (git-fixes). - PCI: aardvark: Fix a leaked reference by adding missing of_node_put() (git-fixes). - PCI: aardvark: Fix checking for PIO Non-posted Request (git-fixes). - PCI: aardvark: Fix kernel panic during PIO transfer (git-fixes). - PCI: aardvark: Improve link training (git-fixes). - PCI: aardvark: Indicate error in 'val' when config read fails (git-fixes). - PCI: aardvark: Introduce an advk_pcie_valid_device() helper (git-fixes). - PCI: aardvark: Remove PCIe outbound window configuration (git-fixes). - PCI: aardvark: Train link immediately after enabling training (git-fixes). - PCI: aardvark: Wait for endpoint to be ready before training link (git-fixes). - PCI: endpoint: Cast the page number to phys_addr_t (git-fixes). - PCI: endpoint: Fix for concurrent memory allocation in OB address region (git-fixes). - PCI: hv: Add a per-bus mutex state_lock (bsc#1207001). - PCI: hv: Fix a race condition in hv_irq_unmask() that can cause panic (bsc#1207001). - PCI: hv: Remove the useless hv_pcichild_state from struct hv_pci_dev (bsc#1207001). - PCI: hv: fix a race condition bug in hv_pci_query_relations() (bsc#1207001). - PCI: qcom: Use PHY_REFCLK_USE_PAD only for ipq8064 (git-fixes). - PCI: tegra: Fix OF node reference leak (git-fixes). - PCI: xgene-msi: Fix race in installing chained irq handler (git-fixes). - PM: hibernate: flush swap writer after marking (git-fixes). - README.BRANCH: Adding myself to the maintainer list - Revert 'PCI: hv: Fix a timing issue which causes kdump to fail occasionally' (bsc#1207001). - Revert 'arm64: dts: juno: add dma-ranges property' (git-fixes) - Revert 'mei: me: enable asynchronous probing' (bsc#1208048, bsc#1209126). - SUNRPC: Fix a server shutdown leak (git-fixes). - applicom: Fix PCI device refcount leak in applicom_init() (git-fixes). - arm64/alternatives: do not patch up internal branches (git-fixes) - arm64/alternatives: move length validation inside the subsection (git-fixes) - arm64/alternatives: use subsections for replacement sequences (git-fixes) - arm64/cpufeature: Fix field sign for DIT hwcap detection (git-fixes) - arm64/mm: fix variable 'pud' set but not used (git-fixes) - arm64/mm: return cpu_all_mask when node is NUMA_NO_NODE (git-fixes) - arm64/vdso: Discard .note.gnu.property sections in vDSO (git-fixes) - arm64: Discard .note.GNU-stack section (bsc#1203693 bsc#1209798). - arm64: Do not forget syscall when starting a new thread. (git-fixes) - arm64: Fix compiler warning from pte_unmap() with (git-fixes) - arm64: Mark __stack_chk_guard as __ro_after_init (git-fixes) - arm64: Use test_tsk_thread_flag() for checking TIF_SINGLESTEP (git-fixes) - arm64: cmpxchg_double*: hazard against entire exchange variable (git-fixes) - arm64: cpu_ops: fix a leaked reference by adding missing of_node_put (git-fixes) - arm64: fix oops in concurrently setting insn_emulation sysctls (git-fixes) - arm64: kaslr: Reserve size of ARM64_MEMSTART_ALIGN in linear region (git-fixes) - arm64: kprobe: make page to RO mode when allocate it (git-fixes) - arm64: kpti: ensure patched kernel text is fetched from PoU (git-fixes) - arm64: psci: Avoid printing in cpu_psci_cpu_die() (git-fixes) - arm64: psci: Reduce the waiting time for cpu_psci_cpu_kill() (git-fixes) - arm64: unwind: Prohibit probing on return_address() (git-fixes) - crypto: arm64 - Fix unused variable compilation warnings of (git-fixes) - dt-bindings: reset: meson8b: fix duplicate reset IDs (git-fixes). - ftrace: Fix invalid address access in lookup_rec() when index is 0 (git-fixes). - ima: Fix function name error in comment (git-fixes). - ipv4: route: fix inet_rtm_getroute induced crash (git-fixes). - kabi: PCI: endpoint: Fix for concurrent memory allocation in OB address region (git-fixes). - kfifo: fix ternary sign extension bugs (git-fixes). - kgdb: Drop malformed kernel doc comment (git-fixes). - net: usb: lan78xx: Limit packet length to skb->len (git-fixes). - net: usb: qmi_wwan: Adding support for Cinterion MV31 (git-fixes). - net: usb: smsc75xx: Limit packet length to skb->len (git-fixes). - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (git-fixes). - net: usb: smsc95xx: Limit packet length to skb->len (git-fixes). - powerpc/btext: add missing of_node_put (bsc#1065729). - powerpc/powernv/ioda: Skip unallocated resources when mapping to PE (bsc#1065729). - powerpc/pseries/lpar: add missing RTAS retry status handling (bsc#1109158 ltc#169177 git-fixes). - powerpc/pseries/lparcfg: add missing RTAS retry status handling (bsc#1065729). - powerpc/rtas: ensure 4KB alignment for rtas_data_buf (bsc#1065729). - powerpc/xics: fix refcount leak in icp_opal_init() (bsc#1065729). - ppc64le: HWPOISON_INJECT=m (bsc#1209572). - ring-buffer: remove obsolete comment for free_buffer_page() (git-fixes). - s390/vfio-ap: fix memory leak in vfio_ap device driver (git-fixes). - sbitmap: Avoid lockups when waker gets preempted (bsc#1209118). - scsi: lpfc: Return DID_TRANSPORT_DISRUPTED instead of DID_REQUEUE (bsc#1199837). - scsi: qla2xxx: Synchronize the IOCB count to be in order (bsc#1209292 bsc#1209684 bsc#1209556). - timers/sched_clock: Prevent generic sched_clock wrap caused by tick_freeze() (git-fixes). - timers: Clear timer_base::must_forward_clk with (bsc#1207890) - tracing/hwlat: Replace sched_setaffinity with set_cpus_allowed_ptr (git-fixes). - tracing: Add NULL checks for buffer in ring_buffer_free_read_page() (git-fixes). - usb: chipidea: fix deadlock in ci_otg_del_timer (git-fixes). - usb: dwc3: exynos: Fix remove() function (git-fixes). - usb: dwc3: gadget: Stop processing more requests on IMI (git-fixes). - usb: misc: iowarrior: fix up header size for USB_DEVICE_ID_CODEMERCS_IOW100 (git-fixes). - usb: typec: altmodes/displayport: Fix probe pin assign check (git-fixes). - x86/PCI: Fix PCI IRQ routing table memory leak (git-fixes). - x86/apic: Add name to irq chip (bsc#1206010). - x86/apic: Deinline x2apic functions (bsc#1181001 jsc#ECO-3191). - x86/atomic: Fix smp_mb__{before,after}_atomic() (git-fixes). - x86/build: Add 'set -e' to mkcapflags.sh to delete broken capflags.c (git-fixes). - x86/ia32: Fix ia32_restore_sigcontext() AC leak (git-fixes). - x86/ioapic: Force affinity setup before startup (bsc#1193231). - x86/irq/64: Limit IST stack overflow check to #DB stack (git-fixes). - x86/mm: Remove in_nmi() warning from 64-bit implementation of vmalloc_fault() (git-fixes). - x86/paravirt: Fix callee-saved function ELF sizes (git-fixes). - x86/power: Fix 'nosmt' vs hibernation triple fault during resume (git-fixes). - x86/stacktrace: Prevent infinite loop in arch_stack_walk_user() (git-fixes). - x86/uaccess, signal: Fix AC=1 bloat (git-fixes). - x86/x2apic: Mark set_x2apic_phys_mode() as __init (bsc#1181001 jsc#ECO-3191). - x86/xen: Fix memory leak in xen_init_lock_cpu() (git-fixes). - x86/xen: Fix memory leak in xen_smp_intr_init{_pv}() (git-fixes). - xen-netfront: Fix NULL sring after live migration (git-fixes). - xen-netfront: Fix mismatched rtnl_unlock (git-fixes). - xen-netfront: Fix race between device setup and open (git-fixes). - xen-netfront: Update features after registering netdev (git-fixes). - xen-netfront: enable device after manual module load (git-fixes). - xen-netfront: fix potential deadlock in xennet_remove() (git-fixes). - xen-netfront: wait xenbus state change when load module manually (git-fixes). - xen/netfront: fix waiting for xenbus state change (git-fixes). - xen/netfront: stop tx queues during live migration (git-fixes). - xen/platform-pci: add missing free_irq() in error path (git-fixes).

Patchnames

SUSE-2023-1801,SUSE-SLE-SERVER-12-SP5-2023-1801

CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for the Linux Kernel",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "\nThe SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security and bugfixes.\n\nThe following security bugs were fixed:\n\n- CVE-2017-5753: Fixed spectre V1 vulnerability on netlink (bsc#1209547).\n- CVE-2017-5753: Fixed spectre vulnerability in prlimit (bsc#1209256).\n- CVE-2021-3923: Fixed stack information leak vulnerability that could lead to kernel protection bypass in infiniband RDMA (bsc#1209778).\n- CVE-2022-20567: Fixed use after free that could lead to a local privilege escalation in pppol2tp_create of l2tp_ppp.c (bsc#1208850).\n- CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).\n- CVE-2023-1076: Fixed incorrect UID assigned to tun/tap sockets (bsc#1208599).\n- CVE-2023-1095: Fixed a NULL pointer dereference in nf_tables due to zeroed list head (bsc#1208777).\n- CVE-2023-1281: Fixed use after free that could lead to privilege escalation in tcindex (bsc#1209634).\n- CVE-2023-1390: Fixed remote DoS vulnerability in tipc_link_xmit() (bsc#1209289).\n- CVE-2023-1513: Fixed an uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak (bsc#1209532).\n- CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207036).\n- CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results) (bsc#1207125).\n- CVE-2023-28328: Fixed a denial of service issue in az6027 driver in drivers/media/usb/dev-usb/az6027.c (bsc#1209291).\n- CVE-2023-28464: Fixed user-after-free that could lead to privilege escalation in hci_conn_cleanup in net/bluetooth/hci_conn.c (bsc#1209052).\n- CVE-2023-28772: Fixed buffer overflow in seq_buf_putmem_hex in lib/seq_buf.c (bsc#1209549).\n\nThe following non-security bugs were fixed:\n\n- ARM: 8702/1: head-common.S: Clear lr before jumping to start_kernel() (git-fixes)\n- Bluetooth: btusb: Add VID:PID 13d3:3529 for Realtek RTL8821CE (git-fixes).\n- Bluetooth: btusb: do not call kfree_skb() under spin_lock_irqsave() (git-fixes).\n- Input: atmel_mxt_ts - fix double free in mxt_read_info_block (git-fixes).\n- KVM: arm64: Hide system instruction access to Trace registers (git-fixes)\n- NFSv4: Fix hangs when recovering open state after a server reboot (git-fixes).\n- PCI/MSI: Enforce MSI entry updates to be visible (git-fixes).\n- PCI/MSI: Enforce that MSI-X table entry is masked for update (git-fixes).\n- PCI/MSI: Mask all unused MSI-X entries (git-fixes).\n- PCI/MSI: Skip masking MSI-X on Xen PV (git-fixes).\n- PCI/PM: Always return devices to D0 when thawing (git-fixes).\n- PCI/PM: Avoid using device_may_wakeup() for runtime PM (git-fixes).\n- PCI: Add ACS quirk for Intel Root Complex Integrated Endpoints (git-fixes).\n- PCI: Add ACS quirk for iProc PAXB (git-fixes).\n- PCI: Avoid FLR for AMD Matisse HD Audio \u0026 USB 3.0 (git-fixes).\n- PCI: Avoid FLR for AMD Starship USB 3.0 (git-fixes).\n- PCI: Make ACS quirk implementations more uniform (git-fixes).\n- PCI: PM: Avoid forcing PCI_D0 for wakeup reasons inconsistently (git-fixes).\n- PCI: PM: Avoid skipping bus-level PM on platforms without ACPI (git-fixes).\n- PCI: Unify ACS quirk desired vs provided checking (git-fixes).\n- PCI: Use pci_update_current_state() in pci_enable_device_flags() (git-fixes).\n- PCI: aardvark: Do not blindly enable ASPM L0s and do not write to read-only register (git-fixes).\n- PCI: aardvark: Do not rely on jiffies while holding spinlock (git-fixes).\n- PCI: aardvark: Do not touch PCIe registers if no card connected (git-fixes).\n- PCI: aardvark: Fix a leaked reference by adding missing of_node_put() (git-fixes).\n- PCI: aardvark: Fix checking for PIO Non-posted Request (git-fixes).\n- PCI: aardvark: Fix kernel panic during PIO transfer (git-fixes).\n- PCI: aardvark: Improve link training (git-fixes).\n- PCI: aardvark: Indicate error in \u0027val\u0027 when config read fails (git-fixes).\n- PCI: aardvark: Introduce an advk_pcie_valid_device() helper (git-fixes).\n- PCI: aardvark: Remove PCIe outbound window configuration (git-fixes).\n- PCI: aardvark: Train link immediately after enabling training (git-fixes).\n- PCI: aardvark: Wait for endpoint to be ready before training link (git-fixes).\n- PCI: endpoint: Cast the page number to phys_addr_t (git-fixes).\n- PCI: endpoint: Fix for concurrent memory allocation in OB address region (git-fixes).\n- PCI: hv: Add a per-bus mutex state_lock (bsc#1207001).\n- PCI: hv: Fix a race condition in hv_irq_unmask() that can cause panic (bsc#1207001).\n- PCI: hv: Remove the useless hv_pcichild_state from struct hv_pci_dev (bsc#1207001).\n- PCI: hv: fix a race condition bug in hv_pci_query_relations() (bsc#1207001).\n- PCI: qcom: Use PHY_REFCLK_USE_PAD only for ipq8064 (git-fixes).\n- PCI: tegra: Fix OF node reference leak (git-fixes).\n- PCI: xgene-msi: Fix race in installing chained irq handler (git-fixes).\n- PM: hibernate: flush swap writer after marking (git-fixes).\n- README.BRANCH: Adding myself to the maintainer list\n- Revert \u0027PCI: hv: Fix a timing issue which causes kdump to fail occasionally\u0027 (bsc#1207001).\n- Revert \u0027arm64: dts: juno: add dma-ranges property\u0027 (git-fixes)\n- Revert \u0027mei: me: enable asynchronous probing\u0027 (bsc#1208048, bsc#1209126).\n- SUNRPC: Fix a server shutdown leak (git-fixes).\n- applicom: Fix PCI device refcount leak in applicom_init() (git-fixes).\n- arm64/alternatives: do not patch up internal branches (git-fixes)\n- arm64/alternatives: move length validation inside the subsection (git-fixes)\n- arm64/alternatives: use subsections for replacement sequences (git-fixes)\n- arm64/cpufeature: Fix field sign for DIT hwcap detection (git-fixes)\n- arm64/mm: fix variable \u0027pud\u0027 set but not used (git-fixes)\n- arm64/mm: return cpu_all_mask when node is NUMA_NO_NODE (git-fixes)\n- arm64/vdso: Discard .note.gnu.property sections in vDSO (git-fixes)\n- arm64: Discard .note.GNU-stack section (bsc#1203693 bsc#1209798).\n- arm64: Do not forget syscall when starting a new thread. (git-fixes)\n- arm64: Fix compiler warning from pte_unmap() with (git-fixes)\n- arm64: Mark __stack_chk_guard as __ro_after_init (git-fixes)\n- arm64: Use test_tsk_thread_flag() for checking TIF_SINGLESTEP (git-fixes)\n- arm64: cmpxchg_double*: hazard against entire exchange variable (git-fixes)\n- arm64: cpu_ops: fix a leaked reference by adding missing of_node_put (git-fixes)\n- arm64: fix oops in concurrently setting insn_emulation sysctls (git-fixes)\n- arm64: kaslr: Reserve size of ARM64_MEMSTART_ALIGN in linear region (git-fixes)\n- arm64: kprobe: make page to RO mode when allocate it (git-fixes)\n- arm64: kpti: ensure patched kernel text is fetched from PoU (git-fixes)\n- arm64: psci: Avoid printing in cpu_psci_cpu_die() (git-fixes)\n- arm64: psci: Reduce the waiting time for cpu_psci_cpu_kill() (git-fixes)\n- arm64: unwind: Prohibit probing on return_address() (git-fixes)\n- crypto: arm64 - Fix unused variable compilation warnings of (git-fixes)\n- dt-bindings: reset: meson8b: fix duplicate reset IDs (git-fixes).\n- ftrace: Fix invalid address access in lookup_rec() when index is 0 (git-fixes).\n- ima: Fix function name error in comment (git-fixes).\n- ipv4: route: fix inet_rtm_getroute induced crash (git-fixes).\n- kabi: PCI: endpoint: Fix for concurrent memory allocation in OB address region (git-fixes).\n- kfifo: fix ternary sign extension bugs (git-fixes).\n- kgdb: Drop malformed kernel doc comment (git-fixes).\n- net: usb: lan78xx: Limit packet length to skb-\u003elen (git-fixes).\n- net: usb: qmi_wwan: Adding support for Cinterion MV31 (git-fixes).\n- net: usb: smsc75xx: Limit packet length to skb-\u003elen (git-fixes).\n- net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (git-fixes).\n- net: usb: smsc95xx: Limit packet length to skb-\u003elen (git-fixes).\n- powerpc/btext: add missing of_node_put (bsc#1065729).\n- powerpc/powernv/ioda: Skip unallocated resources when mapping to PE (bsc#1065729).\n- powerpc/pseries/lpar: add missing RTAS retry status handling (bsc#1109158 ltc#169177 git-fixes).\n- powerpc/pseries/lparcfg: add missing RTAS retry status handling (bsc#1065729).\n- powerpc/rtas: ensure 4KB alignment for rtas_data_buf (bsc#1065729).\n- powerpc/xics: fix refcount leak in icp_opal_init() (bsc#1065729).\n- ppc64le: HWPOISON_INJECT=m (bsc#1209572).\n- ring-buffer: remove obsolete comment for free_buffer_page() (git-fixes).\n- s390/vfio-ap: fix memory leak in vfio_ap device driver (git-fixes).\n- sbitmap: Avoid lockups when waker gets preempted (bsc#1209118).\n- scsi: lpfc: Return DID_TRANSPORT_DISRUPTED instead of DID_REQUEUE (bsc#1199837).\n- scsi: qla2xxx: Synchronize the IOCB count to be in order (bsc#1209292 bsc#1209684 bsc#1209556).\n- timers/sched_clock: Prevent generic sched_clock wrap caused by tick_freeze() (git-fixes).\n- timers: Clear timer_base::must_forward_clk with (bsc#1207890)\n- tracing/hwlat: Replace sched_setaffinity with set_cpus_allowed_ptr (git-fixes).\n- tracing: Add NULL checks for buffer in ring_buffer_free_read_page() (git-fixes).\n- usb: chipidea: fix deadlock in ci_otg_del_timer (git-fixes).\n- usb: dwc3: exynos: Fix remove() function (git-fixes).\n- usb: dwc3: gadget: Stop processing more requests on IMI (git-fixes).\n- usb: misc: iowarrior: fix up header size for USB_DEVICE_ID_CODEMERCS_IOW100 (git-fixes).\n- usb: typec: altmodes/displayport: Fix probe pin assign check (git-fixes).\n- x86/PCI: Fix PCI IRQ routing table memory leak (git-fixes).\n- x86/apic: Add name to irq chip (bsc#1206010).\n- x86/apic: Deinline x2apic functions (bsc#1181001 jsc#ECO-3191).\n- x86/atomic: Fix smp_mb__{before,after}_atomic() (git-fixes).\n- x86/build: Add \u0027set -e\u0027 to mkcapflags.sh to delete broken capflags.c (git-fixes).\n- x86/ia32: Fix ia32_restore_sigcontext() AC leak (git-fixes).\n- x86/ioapic: Force affinity setup before startup (bsc#1193231).\n- x86/irq/64: Limit IST stack overflow check to #DB stack (git-fixes).\n- x86/mm: Remove in_nmi() warning from 64-bit implementation of vmalloc_fault() (git-fixes).\n- x86/paravirt: Fix callee-saved function ELF sizes (git-fixes).\n- x86/power: Fix \u0027nosmt\u0027 vs hibernation triple fault during resume (git-fixes).\n- x86/stacktrace: Prevent infinite loop in arch_stack_walk_user() (git-fixes).\n- x86/uaccess, signal: Fix AC=1 bloat (git-fixes).\n- x86/x2apic: Mark set_x2apic_phys_mode() as __init (bsc#1181001 jsc#ECO-3191).\n- x86/xen: Fix memory leak in xen_init_lock_cpu() (git-fixes).\n- x86/xen: Fix memory leak in xen_smp_intr_init{_pv}() (git-fixes).\n- xen-netfront: Fix NULL sring after live migration (git-fixes).\n- xen-netfront: Fix mismatched rtnl_unlock (git-fixes).\n- xen-netfront: Fix race between device setup and open (git-fixes).\n- xen-netfront: Update features after registering netdev (git-fixes).\n- xen-netfront: enable device after manual module load (git-fixes).\n- xen-netfront: fix potential deadlock in xennet_remove() (git-fixes).\n- xen-netfront: wait xenbus state change when load module manually (git-fixes).\n- xen/netfront: fix waiting for xenbus state change (git-fixes).\n- xen/netfront: stop tx queues during live migration (git-fixes).\n- xen/platform-pci: add missing free_irq() in error path (git-fixes).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2023-1801,SUSE-SLE-SERVER-12-SP5-2023-1801",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2023_1801-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2023:1801-1",
        "url": "https://www.suse.com/support/update/announcement/2023/suse-su-20231801-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2023:1801-1",
        "url": "https://lists.suse.com/pipermail/sle-updates/2023-April/028741.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1065729",
        "url": "https://bugzilla.suse.com/1065729"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1076830",
        "url": "https://bugzilla.suse.com/1076830"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1109158",
        "url": "https://bugzilla.suse.com/1109158"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1181001",
        "url": "https://bugzilla.suse.com/1181001"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1193231",
        "url": "https://bugzilla.suse.com/1193231"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1199837",
        "url": "https://bugzilla.suse.com/1199837"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1203693",
        "url": "https://bugzilla.suse.com/1203693"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1206010",
        "url": "https://bugzilla.suse.com/1206010"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1207001",
        "url": "https://bugzilla.suse.com/1207001"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1207036",
        "url": "https://bugzilla.suse.com/1207036"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1207125",
        "url": "https://bugzilla.suse.com/1207125"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1207795",
        "url": "https://bugzilla.suse.com/1207795"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1207890",
        "url": "https://bugzilla.suse.com/1207890"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1208048",
        "url": "https://bugzilla.suse.com/1208048"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1208599",
        "url": "https://bugzilla.suse.com/1208599"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1208777",
        "url": "https://bugzilla.suse.com/1208777"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1208850",
        "url": "https://bugzilla.suse.com/1208850"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1209052",
        "url": "https://bugzilla.suse.com/1209052"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1209118",
        "url": "https://bugzilla.suse.com/1209118"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1209126",
        "url": "https://bugzilla.suse.com/1209126"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1209256",
        "url": "https://bugzilla.suse.com/1209256"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1209289",
        "url": "https://bugzilla.suse.com/1209289"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1209291",
        "url": "https://bugzilla.suse.com/1209291"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1209292",
        "url": "https://bugzilla.suse.com/1209292"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1209532",
        "url": "https://bugzilla.suse.com/1209532"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1209547",
        "url": "https://bugzilla.suse.com/1209547"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1209549",
        "url": "https://bugzilla.suse.com/1209549"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1209556",
        "url": "https://bugzilla.suse.com/1209556"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1209572",
        "url": "https://bugzilla.suse.com/1209572"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1209634",
        "url": "https://bugzilla.suse.com/1209634"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1209684",
        "url": "https://bugzilla.suse.com/1209684"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1209778",
        "url": "https://bugzilla.suse.com/1209778"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1209798",
        "url": "https://bugzilla.suse.com/1209798"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-5753 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-5753/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-3923 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-3923/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-20567 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-20567/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-0590 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-0590/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-1076 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-1076/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-1095 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-1095/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-1281 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-1281/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-1390 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-1390/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-1513 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-1513/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-23454 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-23454/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-23455 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-23455/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-28328 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-28328/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-28464 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-28464/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-28772 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-28772/"
      }
    ],
    "title": "Security update for the Linux Kernel",
    "tracking": {
      "current_release_date": "2023-04-10T08:26:05Z",
      "generator": {
        "date": "2023-04-10T08:26:05Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2023:1801-1",
      "initial_release_date": "2023-04-10T08:26:05Z",
      "revision_history": [
        {
          "date": "2023-04-10T08:26:05Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "kernel-devel-azure-4.12.14-16.130.1.noarch",
                "product": {
                  "name": "kernel-devel-azure-4.12.14-16.130.1.noarch",
                  "product_id": "kernel-devel-azure-4.12.14-16.130.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "kernel-source-azure-4.12.14-16.130.1.noarch",
                "product": {
                  "name": "kernel-source-azure-4.12.14-16.130.1.noarch",
                  "product_id": "kernel-source-azure-4.12.14-16.130.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cluster-md-kmp-azure-4.12.14-16.130.1.x86_64",
                "product": {
                  "name": "cluster-md-kmp-azure-4.12.14-16.130.1.x86_64",
                  "product_id": "cluster-md-kmp-azure-4.12.14-16.130.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "dlm-kmp-azure-4.12.14-16.130.1.x86_64",
                "product": {
                  "name": "dlm-kmp-azure-4.12.14-16.130.1.x86_64",
                  "product_id": "dlm-kmp-azure-4.12.14-16.130.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "gfs2-kmp-azure-4.12.14-16.130.1.x86_64",
                "product": {
                  "name": "gfs2-kmp-azure-4.12.14-16.130.1.x86_64",
                  "product_id": "gfs2-kmp-azure-4.12.14-16.130.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "kernel-azure-4.12.14-16.130.1.x86_64",
                "product": {
                  "name": "kernel-azure-4.12.14-16.130.1.x86_64",
                  "product_id": "kernel-azure-4.12.14-16.130.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "kernel-azure-base-4.12.14-16.130.1.x86_64",
                "product": {
                  "name": "kernel-azure-base-4.12.14-16.130.1.x86_64",
                  "product_id": "kernel-azure-base-4.12.14-16.130.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "kernel-azure-devel-4.12.14-16.130.1.x86_64",
                "product": {
                  "name": "kernel-azure-devel-4.12.14-16.130.1.x86_64",
                  "product_id": "kernel-azure-devel-4.12.14-16.130.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "kernel-azure-extra-4.12.14-16.130.1.x86_64",
                "product": {
                  "name": "kernel-azure-extra-4.12.14-16.130.1.x86_64",
                  "product_id": "kernel-azure-extra-4.12.14-16.130.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "kernel-azure-kgraft-devel-4.12.14-16.130.1.x86_64",
                "product": {
                  "name": "kernel-azure-kgraft-devel-4.12.14-16.130.1.x86_64",
                  "product_id": "kernel-azure-kgraft-devel-4.12.14-16.130.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "kernel-syms-azure-4.12.14-16.130.1.x86_64",
                "product": {
                  "name": "kernel-syms-azure-4.12.14-16.130.1.x86_64",
                  "product_id": "kernel-syms-azure-4.12.14-16.130.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "kselftests-kmp-azure-4.12.14-16.130.1.x86_64",
                "product": {
                  "name": "kselftests-kmp-azure-4.12.14-16.130.1.x86_64",
                  "product_id": "kselftests-kmp-azure-4.12.14-16.130.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "ocfs2-kmp-azure-4.12.14-16.130.1.x86_64",
                "product": {
                  "name": "ocfs2-kmp-azure-4.12.14-16.130.1.x86_64",
                  "product_id": "ocfs2-kmp-azure-4.12.14-16.130.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 12 SP5",
                "product": {
                  "name": "SUSE Linux Enterprise Server 12 SP5",
                  "product_id": "SUSE Linux Enterprise Server 12 SP5",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles:12:sp5"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP5",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP5",
                  "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles_sap:12:sp5"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-azure-4.12.14-16.130.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP5",
          "product_id": "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64"
        },
        "product_reference": "kernel-azure-4.12.14-16.130.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-azure-base-4.12.14-16.130.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP5",
          "product_id": "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64"
        },
        "product_reference": "kernel-azure-base-4.12.14-16.130.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-azure-devel-4.12.14-16.130.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP5",
          "product_id": "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64"
        },
        "product_reference": "kernel-azure-devel-4.12.14-16.130.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-devel-azure-4.12.14-16.130.1.noarch as component of SUSE Linux Enterprise Server 12 SP5",
          "product_id": "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch"
        },
        "product_reference": "kernel-devel-azure-4.12.14-16.130.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-source-azure-4.12.14-16.130.1.noarch as component of SUSE Linux Enterprise Server 12 SP5",
          "product_id": "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch"
        },
        "product_reference": "kernel-source-azure-4.12.14-16.130.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-syms-azure-4.12.14-16.130.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP5",
          "product_id": "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64"
        },
        "product_reference": "kernel-syms-azure-4.12.14-16.130.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-azure-4.12.14-16.130.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64"
        },
        "product_reference": "kernel-azure-4.12.14-16.130.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-azure-base-4.12.14-16.130.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64"
        },
        "product_reference": "kernel-azure-base-4.12.14-16.130.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-azure-devel-4.12.14-16.130.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64"
        },
        "product_reference": "kernel-azure-devel-4.12.14-16.130.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-devel-azure-4.12.14-16.130.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch"
        },
        "product_reference": "kernel-devel-azure-4.12.14-16.130.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-source-azure-4.12.14-16.130.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch"
        },
        "product_reference": "kernel-source-azure-4.12.14-16.130.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-syms-azure-4.12.14-16.130.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64"
        },
        "product_reference": "kernel-syms-azure-4.12.14-16.130.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2017-5753",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-5753"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
          "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
          "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-5753",
          "url": "https://www.suse.com/security/cve/CVE-2017-5753"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1068032 for CVE-2017-5753",
          "url": "https://bugzilla.suse.com/1068032"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1074562 for CVE-2017-5753",
          "url": "https://bugzilla.suse.com/1074562"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1074578 for CVE-2017-5753",
          "url": "https://bugzilla.suse.com/1074578"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1074701 for CVE-2017-5753",
          "url": "https://bugzilla.suse.com/1074701"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1075006 for CVE-2017-5753",
          "url": "https://bugzilla.suse.com/1075006"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1075419 for CVE-2017-5753",
          "url": "https://bugzilla.suse.com/1075419"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1075748 for CVE-2017-5753",
          "url": "https://bugzilla.suse.com/1075748"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1080039 for CVE-2017-5753",
          "url": "https://bugzilla.suse.com/1080039"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1087084 for CVE-2017-5753",
          "url": "https://bugzilla.suse.com/1087084"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1087939 for CVE-2017-5753",
          "url": "https://bugzilla.suse.com/1087939"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1089055 for CVE-2017-5753",
          "url": "https://bugzilla.suse.com/1089055"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1136865 for CVE-2017-5753",
          "url": "https://bugzilla.suse.com/1136865"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1178658 for CVE-2017-5753",
          "url": "https://bugzilla.suse.com/1178658"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1201877 for CVE-2017-5753",
          "url": "https://bugzilla.suse.com/1201877"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1209547 for CVE-2017-5753",
          "url": "https://bugzilla.suse.com/1209547"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-04-10T08:26:05Z",
          "details": "important"
        }
      ],
      "title": "CVE-2017-5753"
    },
    {
      "cve": "CVE-2021-3923",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-3923"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in the Linux kernel\u0027s implementation of RDMA over infiniband. An attacker with a privileged local account can leak kernel stack information when issuing commands to the /dev/infiniband/rdma_cm device node. While this access is unlikely to leak sensitive user information, it can be further used to defeat existing kernel protection mechanisms.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
          "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
          "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-3923",
          "url": "https://www.suse.com/security/cve/CVE-2021-3923"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1209778 for CVE-2021-3923",
          "url": "https://bugzilla.suse.com/1209778"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-04-10T08:26:05Z",
          "details": "low"
        }
      ],
      "title": "CVE-2021-3923"
    },
    {
      "cve": "CVE-2022-20567",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-20567"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In pppol2tp_create of l2tp_ppp.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-186777253References: Upstream kernel",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
          "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
          "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-20567",
          "url": "https://www.suse.com/security/cve/CVE-2022-20567"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1208850 for CVE-2022-20567",
          "url": "https://bugzilla.suse.com/1208850"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-04-10T08:26:05Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2022-20567"
    },
    {
      "cve": "CVE-2023-0590",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-0590"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A use-after-free flaw was found in qdisc_graft in net/sched/sch_api.c in the Linux Kernel due to a race problem. This flaw leads to a denial of service issue. If patch ebda44da44f6 (\"net: sched: fix race condition in qdisc_graft()\") not applied yet, then kernel could be affected.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
          "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
          "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-0590",
          "url": "https://www.suse.com/security/cve/CVE-2023-0590"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1207036 for CVE-2023-0590",
          "url": "https://bugzilla.suse.com/1207036"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1207795 for CVE-2023-0590",
          "url": "https://bugzilla.suse.com/1207795"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1207822 for CVE-2023-0590",
          "url": "https://bugzilla.suse.com/1207822"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1211495 for CVE-2023-0590",
          "url": "https://bugzilla.suse.com/1211495"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1211833 for CVE-2023-0590",
          "url": "https://bugzilla.suse.com/1211833"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-04-10T08:26:05Z",
          "details": "important"
        }
      ],
      "title": "CVE-2023-0590"
    },
    {
      "cve": "CVE-2023-1076",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-1076"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in the Linux Kernel. The tun/tap sockets have their socket UID hardcoded to 0 due to a type confusion in their initialization function. While it will be often correct, as tuntap devices require CAP_NET_ADMIN, it may not always be the case, e.g., a non-root user only having that capability. This would make tun/tap sockets being incorrectly treated in filtering/routing decisions, possibly bypassing network filters.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
          "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
          "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-1076",
          "url": "https://www.suse.com/security/cve/CVE-2023-1076"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1208599 for CVE-2023-1076",
          "url": "https://bugzilla.suse.com/1208599"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1214019 for CVE-2023-1076",
          "url": "https://bugzilla.suse.com/1214019"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-04-10T08:26:05Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2023-1076"
    },
    {
      "cve": "CVE-2023-1095",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-1095"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In nf_tables_updtable, if nf_tables_table_enable returns an error, nft_trans_destroy is called to free the transaction object. nft_trans_destroy() calls list_del(), but the transaction was never placed on a list -- the list head is all zeroes, this results in a NULL pointer dereference.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
          "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
          "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-1095",
          "url": "https://www.suse.com/security/cve/CVE-2023-1095"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1208777 for CVE-2023-1095",
          "url": "https://bugzilla.suse.com/1208777"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-04-10T08:26:05Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2023-1095"
    },
    {
      "cve": "CVE-2023-1281",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-1281"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Use After Free vulnerability in Linux kernel traffic control index filter (tcindex) allows Privilege Escalation.  The imperfect hash area can be updated while packets are traversing, which will cause a use-after-free when \u0027tcf_exts_exec()\u0027 is called with the destroyed tcf_ext.  A local attacker user can use this vulnerability to elevate its privileges to root.\nThis issue affects Linux Kernel: from 4.14 before git commit ee059170b1f7e94e55fa6cadee544e176a6e59c2.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
          "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
          "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-1281",
          "url": "https://www.suse.com/security/cve/CVE-2023-1281"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1209634 for CVE-2023-1281",
          "url": "https://bugzilla.suse.com/1209634"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1209683 for CVE-2023-1281",
          "url": "https://bugzilla.suse.com/1209683"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1210335 for CVE-2023-1281",
          "url": "https://bugzilla.suse.com/1210335"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1210423 for CVE-2023-1281",
          "url": "https://bugzilla.suse.com/1210423"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1211833 for CVE-2023-1281",
          "url": "https://bugzilla.suse.com/1211833"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-04-10T08:26:05Z",
          "details": "important"
        }
      ],
      "title": "CVE-2023-1281"
    },
    {
      "cve": "CVE-2023-1390",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-1390"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A remote denial of service vulnerability was found in the Linux kernel\u0027s TIPC kernel module. The while loop in tipc_link_xmit() hits an unknown state while attempting to parse SKBs, which are not in the queue. Sending two small UDP packets to a system with a UDP bearer results in the CPU utilization for the system to instantly spike to 100%, causing a denial of service condition.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
          "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
          "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-1390",
          "url": "https://www.suse.com/security/cve/CVE-2023-1390"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1209289 for CVE-2023-1390",
          "url": "https://bugzilla.suse.com/1209289"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1210779 for CVE-2023-1390",
          "url": "https://bugzilla.suse.com/1210779"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1211495 for CVE-2023-1390",
          "url": "https://bugzilla.suse.com/1211495"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-04-10T08:26:05Z",
          "details": "important"
        }
      ],
      "title": "CVE-2023-1390"
    },
    {
      "cve": "CVE-2023-1513",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-1513"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in KVM. When calling the KVM_GET_DEBUGREGS ioctl, on 32-bit systems, there might be some uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
          "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
          "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-1513",
          "url": "https://www.suse.com/security/cve/CVE-2023-1513"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1209532 for CVE-2023-1513",
          "url": "https://bugzilla.suse.com/1209532"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-04-10T08:26:05Z",
          "details": "low"
        }
      ],
      "title": "CVE-2023-1513"
    },
    {
      "cve": "CVE-2023-23454",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-23454"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service (slab-out-of-bounds read) because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
          "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
          "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-23454",
          "url": "https://www.suse.com/security/cve/CVE-2023-23454"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1207036 for CVE-2023-23454",
          "url": "https://bugzilla.suse.com/1207036"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1207188 for CVE-2023-23454",
          "url": "https://bugzilla.suse.com/1207188"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1208030 for CVE-2023-23454",
          "url": "https://bugzilla.suse.com/1208030"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1208044 for CVE-2023-23454",
          "url": "https://bugzilla.suse.com/1208044"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1208085 for CVE-2023-23454",
          "url": "https://bugzilla.suse.com/1208085"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1211833 for CVE-2023-23454",
          "url": "https://bugzilla.suse.com/1211833"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-04-10T08:26:05Z",
          "details": "important"
        }
      ],
      "title": "CVE-2023-23454"
    },
    {
      "cve": "CVE-2023-23455",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-23455"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
          "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
          "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-23455",
          "url": "https://www.suse.com/security/cve/CVE-2023-23455"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1207036 for CVE-2023-23455",
          "url": "https://bugzilla.suse.com/1207036"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1207125 for CVE-2023-23455",
          "url": "https://bugzilla.suse.com/1207125"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1207189 for CVE-2023-23455",
          "url": "https://bugzilla.suse.com/1207189"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1211833 for CVE-2023-23455",
          "url": "https://bugzilla.suse.com/1211833"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-04-10T08:26:05Z",
          "details": "important"
        }
      ],
      "title": "CVE-2023-23455"
    },
    {
      "cve": "CVE-2023-28328",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-28328"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A NULL pointer dereference flaw was found in the az6027 driver in drivers/media/usb/dev-usb/az6027.c in the Linux Kernel. The message from user space is not checked properly before transferring into the device. This flaw allows a local user to crash the system or potentially cause a denial of service.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
          "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
          "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-28328",
          "url": "https://www.suse.com/security/cve/CVE-2023-28328"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1209291 for CVE-2023-28328",
          "url": "https://bugzilla.suse.com/1209291"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1222212 for CVE-2023-28328",
          "url": "https://bugzilla.suse.com/1222212"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-04-10T08:26:05Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2023-28328"
    },
    {
      "cve": "CVE-2023-28464",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-28464"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "hci_conn_cleanup in net/bluetooth/hci_conn.c in the Linux kernel through 6.2.9 has a use-after-free (observed in hci_conn_hash_flush) because of calls to hci_dev_put and hci_conn_put. There is a double free that may lead to privilege escalation.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
          "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
          "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-28464",
          "url": "https://www.suse.com/security/cve/CVE-2023-28464"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1209052 for CVE-2023-28464",
          "url": "https://bugzilla.suse.com/1209052"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1211111 for CVE-2023-28464",
          "url": "https://bugzilla.suse.com/1211111"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1220130 for CVE-2023-28464",
          "url": "https://bugzilla.suse.com/1220130"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-04-10T08:26:05Z",
          "details": "important"
        }
      ],
      "title": "CVE-2023-28464"
    },
    {
      "cve": "CVE-2023-28772",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-28772"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An issue was discovered in the Linux kernel before 5.13.3. lib/seq_buf.c has a seq_buf_putmem_hex buffer overflow.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
          "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
          "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-28772",
          "url": "https://www.suse.com/security/cve/CVE-2023-28772"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1209549 for CVE-2023-28772",
          "url": "https://bugzilla.suse.com/1209549"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1211110 for CVE-2023-28772",
          "url": "https://bugzilla.suse.com/1211110"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1214378 for CVE-2023-28772",
          "url": "https://bugzilla.suse.com/1214378"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-base-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-azure-devel-4.12.14-16.130.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-devel-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-source-azure-4.12.14-16.130.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:kernel-syms-azure-4.12.14-16.130.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-04-10T08:26:05Z",
          "details": "important"
        }
      ],
      "title": "CVE-2023-28772"
    }
  ]
}

CVE-2023-28772 (GCVE-0-2023-28772)

Vulnerability from cvelistv5

Published

2023-03-23 00:00

Modified

2025-05-05 16:02

Severity ?

6.7 (Medium) - CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE

Summary

An issue was discovered in the Linux kernel before 5.13.3. lib/seq_buf.c has a seq_buf_putmem_hex buffer overflow.

References

►

URL

Tags

	https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.13.3
	https://github.com/torvalds/linux/commit/d3b16034a24a112bb83aeb669ac5b9b01f744bb7
	https://lore.kernel.org/lkml/20210625122453.5e2fe304%40oasis.local.home/
	https://lkml.kernel.org/r/20210626032156.47889-1-yun.zhou%40windriver.com
	https://security.netapp.com/advisory/ntap-20230427-0005/

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T13:51:37.313Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.13.3"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/torvalds/linux/commit/d3b16034a24a112bb83aeb669ac5b9b01f744bb7"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lore.kernel.org/lkml/20210625122453.5e2fe304%40oasis.local.home/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lkml.kernel.org/r/20210626032156.47889-1-yun.zhou%40windriver.com"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20230427-0005/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 6.7,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "HIGH",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-28772",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-23T13:28:45.975683Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-120",
                "description": "CWE-120 Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-05T16:02:12.798Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered in the Linux kernel before 5.13.3. lib/seq_buf.c has a seq_buf_putmem_hex buffer overflow."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-04-27T00:00:00.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.13.3"
        },
        {
          "url": "https://github.com/torvalds/linux/commit/d3b16034a24a112bb83aeb669ac5b9b01f744bb7"
        },
        {
          "url": "https://lore.kernel.org/lkml/20210625122453.5e2fe304%40oasis.local.home/"
        },
        {
          "url": "https://lkml.kernel.org/r/20210626032156.47889-1-yun.zhou%40windriver.com"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20230427-0005/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-28772",
    "datePublished": "2023-03-23T00:00:00.000Z",
    "dateReserved": "2023-03-23T00:00:00.000Z",
    "dateUpdated": "2025-05-05T16:02:12.798Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-1095 (GCVE-0-2023-1095)

Vulnerability from cvelistv5

Published

2023-02-28 00:00

Modified

2025-03-18 15:14

Severity ?

5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-476

Summary

In nf_tables_updtable, if nf_tables_table_enable returns an error, nft_trans_destroy is called to free the transaction object. nft_trans_destroy() calls list_del(), but the transaction was never placed on a list -- the list head is all zeroes, this results in a NULL pointer dereference.

References

►

URL

Tags

	https://bugzilla.redhat.com/show_bug.cgi?id=2173973
	https://github.com/torvalds/linux/commit/580077855a40741cf511766129702d97ff02f4d9

Impacted products

	Vendor	Product	Version
	n/a	Linux kernel netfilter subsystem.	Version: Fixed in 6.0-rc1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T05:32:46.346Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2173973"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/torvalds/linux/commit/580077855a40741cf511766129702d97ff02f4d9"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-1095",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-10T17:30:41.063971Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-18T15:14:46.858Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Linux kernel netfilter subsystem.",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Fixed in 6.0-rc1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In nf_tables_updtable, if nf_tables_table_enable returns an error, nft_trans_destroy is called to free the transaction object. nft_trans_destroy() calls list_del(), but the transaction was never placed on a list -- the list head is all zeroes, this results in a NULL pointer dereference."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "CWE-476",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-02-28T00:00:00.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2173973"
        },
        {
          "url": "https://github.com/torvalds/linux/commit/580077855a40741cf511766129702d97ff02f4d9"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2023-1095",
    "datePublished": "2023-02-28T00:00:00.000Z",
    "dateReserved": "2023-02-28T00:00:00.000Z",
    "dateUpdated": "2025-03-18T15:14:46.858Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-20567 (GCVE-0-2022-20567)

Vulnerability from cvelistv5

Published

2022-12-16 00:00

Modified

2025-04-21 13:03

Severity ?

7.4 (High) - CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

Elevation of privilege

Summary

In pppol2tp_create of l2tp_ppp.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-186777253References: Upstream kernel

References

►

URL

Tags

https://source.android.com/security/bulletin/pixel/2022-12-01

Impacted products

	Vendor	Product	Version
	n/a	Android	Version: Android kernel

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T02:17:52.887Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.4,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-20567",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-21T13:02:44.115609Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-362",
                "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-21T13:03:10.112Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Android",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Android kernel"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In pppol2tp_create of l2tp_ppp.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-186777253References: Upstream kernel"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Elevation of privilege",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-12-16T00:00:00.000Z",
        "orgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
        "shortName": "google_android"
      },
      "references": [
        {
          "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
    "assignerShortName": "google_android",
    "cveId": "CVE-2022-20567",
    "datePublished": "2022-12-16T00:00:00.000Z",
    "dateReserved": "2021-10-14T00:00:00.000Z",
    "dateUpdated": "2025-04-21T13:03:10.112Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-3923 (GCVE-0-2021-3923)

Vulnerability from cvelistv5

Published

2023-03-27 00:00

Modified

2025-02-24 19:19

Severity ?

2.3 (Low) - CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

CWE

CWE-200

Summary

A flaw was found in the Linux kernel's implementation of RDMA over infiniband. An attacker with a privileged local account can leak kernel stack information when issuing commands to the /dev/infiniband/rdma_cm device node. While this access is unlikely to leak sensitive user information, it can be further used to defeat existing kernel protection mechanisms.

References

►

URL

Tags

	https://bugzilla.redhat.com/show_bug.cgi?id=2019643
	https://lore.kernel.org/all/20220204100036.GA12348%40kili/

Impacted products

	Vendor	Product	Version
	n/a	kernel	Version: unknown

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:09:09.735Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2019643"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lore.kernel.org/all/20220204100036.GA12348%40kili/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "NONE",
              "baseScore": 2.3,
              "baseSeverity": "LOW",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "HIGH",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2021-3923",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-24T19:18:29.423811Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-24T19:19:01.209Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "kernel",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in the Linux kernel\u0027s implementation of RDMA over infiniband. An attacker with a privileged local account can leak kernel stack information when issuing commands to the /dev/infiniband/rdma_cm device node. While this access is unlikely to leak sensitive user information, it can be further used to defeat existing kernel protection mechanisms."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-03-27T00:00:00.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2019643"
        },
        {
          "url": "https://lore.kernel.org/all/20220204100036.GA12348%40kili/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2021-3923",
    "datePublished": "2023-03-27T00:00:00.000Z",
    "dateReserved": "2021-11-03T00:00:00.000Z",
    "dateUpdated": "2025-02-24T19:19:01.209Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-28328 (GCVE-0-2023-28328)

Vulnerability from cvelistv5

Published

2023-04-19 00:00

Modified

2025-03-19 15:34

Severity ?

5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-476

Summary

A NULL pointer dereference flaw was found in the az6027 driver in drivers/media/usb/dev-usb/az6027.c in the Linux Kernel. The message from user space is not checked properly before transferring into the device. This flaw allows a local user to crash the system or potentially cause a denial of service.

References

►

URL

Tags

	https://bugzilla.redhat.com/show_bug.cgi?id=2177389
	https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html	mailing-list
	https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html	mailing-list

Impacted products

	Vendor	Product	Version
	n/a	Linux	Version: Linux Kernel prior to kernel 6.2 RC1 < 6.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T12:38:24.551Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2177389"
          },
          {
            "name": "[debian-lts-announce] 20230502 [SECURITY] [DLA 3404-1] linux-5.10 security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html"
          },
          {
            "name": "[debian-lts-announce] 20230503 [SECURITY] [DLA 3403-1] linux security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-28328",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-06T15:56:15.597754Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-19T15:34:25.493Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Linux",
          "vendor": "n/a",
          "versions": [
            {
              "lessThan": "6.2",
              "status": "affected",
              "version": "Linux Kernel prior to kernel 6.2 RC1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A NULL pointer dereference flaw was found in the az6027 driver in drivers/media/usb/dev-usb/az6027.c in the Linux Kernel. The message from user space is not checked properly before transferring into the device. This flaw allows a local user to crash the system or potentially cause a denial of service."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "CWE-476",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-07-12T19:06:05.518Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2177389"
        },
        {
          "name": "[debian-lts-announce] 20230502 [SECURITY] [DLA 3404-1] linux-5.10 security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html"
        },
        {
          "name": "[debian-lts-announce] 20230503 [SECURITY] [DLA 3403-1] linux security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2023-28328",
    "datePublished": "2023-04-19T00:00:00.000Z",
    "dateReserved": "2023-03-14T00:00:00.000Z",
    "dateUpdated": "2025-03-19T15:34:25.493Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-23454 (GCVE-0-2023-23454)

Vulnerability from cvelistv5

Published

2023-01-12 00:00

Modified

2025-03-20 20:55

Severity ?

5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE

Summary

cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service (slab-out-of-bounds read) because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results).

References

►

URL

Tags

	https://www.openwall.com/lists/oss-security/2023/01/10/1
	https://www.openwall.com/lists/oss-security/2023/01/10/4
	https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=caa4b35b4317d5147b3ab0fbdc9c075c7d2e9c12
	https://www.debian.org/security/2023/dsa-5324	vendor-advisory
	https://lists.debian.org/debian-lts-announce/2023/03/msg00000.html	mailing-list
	https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html	mailing-list

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T10:28:40.976Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.openwall.com/lists/oss-security/2023/01/10/1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.openwall.com/lists/oss-security/2023/01/10/4"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=caa4b35b4317d5147b3ab0fbdc9c075c7d2e9c12"
          },
          {
            "name": "DSA-5324",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2023/dsa-5324"
          },
          {
            "name": "[debian-lts-announce] 20230302 [SECURITY] [DLA 3349-1] linux-5.10 security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/03/msg00000.html"
          },
          {
            "name": "[debian-lts-announce] 20230503 [SECURITY] [DLA 3403-1] linux security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-23454",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-06T15:57:34.523485Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-843",
                "description": "CWE-843 Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-20T20:55:38.435Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service (slab-out-of-bounds read) because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results)."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-05-03T00:00:00.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://www.openwall.com/lists/oss-security/2023/01/10/1"
        },
        {
          "url": "https://www.openwall.com/lists/oss-security/2023/01/10/4"
        },
        {
          "url": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=caa4b35b4317d5147b3ab0fbdc9c075c7d2e9c12"
        },
        {
          "name": "DSA-5324",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2023/dsa-5324"
        },
        {
          "name": "[debian-lts-announce] 20230302 [SECURITY] [DLA 3349-1] linux-5.10 security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/03/msg00000.html"
        },
        {
          "name": "[debian-lts-announce] 20230503 [SECURITY] [DLA 3403-1] linux security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-23454",
    "datePublished": "2023-01-12T00:00:00.000Z",
    "dateReserved": "2023-01-12T00:00:00.000Z",
    "dateUpdated": "2025-03-20T20:55:38.435Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-1076 (GCVE-0-2023-1076)

Vulnerability from cvelistv5

Published

2023-03-27 00:00

Modified

2025-02-24 17:04

Severity ?

5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

CWE

CWE-791

Summary

A flaw was found in the Linux Kernel. The tun/tap sockets have their socket UID hardcoded to 0 due to a type confusion in their initialization function. While it will be often correct, as tuntap devices require CAP_NET_ADMIN, it may not always be the case, e.g., a non-root user only having that capability. This would make tun/tap sockets being incorrectly treated in filtering/routing decisions, possibly bypassing network filters.

References

►

URL

Tags

	https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=66b2c338adce580dfce2199591e65e2bab889cff
	https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=a096ccca6e503a5c575717ff8a36ace27510ab0a
	https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html	mailing-list

Impacted products

	Vendor	Product	Version
	n/a	Linux kernel	Version: unknown

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T05:32:46.361Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=66b2c338adce580dfce2199591e65e2bab889cff"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=a096ccca6e503a5c575717ff8a36ace27510ab0a"
          },
          {
            "name": "[debian-lts-announce] 20230502 [SECURITY] [DLA 3404-1] linux-5.10 security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "NONE",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-1076",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-24T17:04:00.621102Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-24T17:04:30.565Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Linux kernel",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in the Linux Kernel. The tun/tap sockets have their socket UID hardcoded to 0 due to a type confusion in their initialization function. While it will be often correct, as tuntap devices require CAP_NET_ADMIN, it may not always be the case, e.g., a non-root user only having that capability. This would make tun/tap sockets being incorrectly treated in filtering/routing decisions, possibly bypassing network filters."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-791",
              "description": "CWE-791",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-05-03T00:00:00.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "url": "https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=66b2c338adce580dfce2199591e65e2bab889cff"
        },
        {
          "url": "https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=a096ccca6e503a5c575717ff8a36ace27510ab0a"
        },
        {
          "name": "[debian-lts-announce] 20230502 [SECURITY] [DLA 3404-1] linux-5.10 security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2023-1076",
    "datePublished": "2023-03-27T00:00:00.000Z",
    "dateReserved": "2023-02-27T00:00:00.000Z",
    "dateUpdated": "2025-02-24T17:04:30.565Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-1281 (GCVE-0-2023-1281)

Vulnerability from cvelistv5

Published

2023-03-22 13:18

Modified

2025-03-05 19:22

Severity ?

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-416 - Use After Free

Summary

Use After Free vulnerability in Linux kernel traffic control index filter (tcindex) allows Privilege Escalation. The imperfect hash area can be updated while packets are traversing, which will cause a use-after-free when 'tcf_exts_exec()' is called with the destroyed tcf_ext. A local attacker user can use this vulnerability to elevate its privileges to root. This issue affects Linux Kernel: from 4.14 before git commit ee059170b1f7e94e55fa6cadee544e176a6e59c2.

References

►

URL

Tags

	https://kernel.dance/#ee059170b1f7e94e55fa6cadee544e176a6e59c2
	https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ee059170b1f7e94e55fa6cadee544e176a6e59c2
	http://www.openwall.com/lists/oss-security/2023/04/11/3
	https://security.netapp.com/advisory/ntap-20230427-0004/
	https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html
	https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html

Impacted products

	Vendor	Product	Version
	Linux	Linux Kernel	Version: 4.14 <

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T05:40:59.846Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://kernel.dance/#ee059170b1f7e94e55fa6cadee544e176a6e59c2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ee059170b1f7e94e55fa6cadee544e176a6e59c2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2023/04/11/3"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20230427-0004/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-1281",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-05T18:43:38.013720Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-05T19:22:29.884Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "kernel",
          "product": "Linux Kernel",
          "repo": "https://git.kernel.org",
          "vendor": "Linux",
          "versions": [
            {
              "lessThanOrEqual": "6.2",
              "status": "affected",
              "version": "4.14",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "valis"
        }
      ],
      "datePublic": "2023-02-09T15:37:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Use After Free vulnerability in Linux kernel traffic control index filter (tcindex) allows Privilege Escalation.\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eThe imperfect hash area can be updated while packets are traversing, which will cause a use-after-free when \u0027tcf_exts_exec()\u0027 is called with the destroyed tcf_ext.\u003c/span\u003e\u0026nbsp;\u003cspan style=\"background-color: var(--wht);\"\u003eA local attacker user can use this vulnerability to elevate its privileges to root.\u003cbr\u003e\u003c/span\u003e\u003cp\u003eThis issue affects Linux Kernel: from 4.14 before git commit ee059170b1f7e94e55fa6cadee544e176a6e59c2.\u003c/p\u003e"
            }
          ],
          "value": "Use After Free vulnerability in Linux kernel traffic control index filter (tcindex) allows Privilege Escalation.\u00a0The imperfect hash area can be updated while packets are traversing, which will cause a use-after-free when \u0027tcf_exts_exec()\u0027 is called with the destroyed tcf_ext.\u00a0A local attacker user can use this vulnerability to elevate its privileges to root.\nThis issue affects Linux Kernel: from 4.14 before git commit ee059170b1f7e94e55fa6cadee544e176a6e59c2."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-233",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-233 Privilege Escalation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "CWE-416 Use After Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-05-03T13:06:53.041Z",
        "orgId": "14ed7db2-1595-443d-9d34-6215bf890778",
        "shortName": "Google"
      },
      "references": [
        {
          "url": "https://kernel.dance/#ee059170b1f7e94e55fa6cadee544e176a6e59c2"
        },
        {
          "url": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ee059170b1f7e94e55fa6cadee544e176a6e59c2"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2023/04/11/3"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20230427-0004/"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "UAF in Linux kernel\u0027s tcindex (traffic control index filter) implementation",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "14ed7db2-1595-443d-9d34-6215bf890778",
    "assignerShortName": "Google",
    "cveId": "CVE-2023-1281",
    "datePublished": "2023-03-22T13:18:55.460Z",
    "dateReserved": "2023-03-08T20:18:23.204Z",
    "dateUpdated": "2025-03-05T19:22:29.884Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-0590 (GCVE-0-2023-0590)

Vulnerability from cvelistv5

Published

2023-03-23 00:00

Modified

2024-08-02 05:17

Severity ?

CWE

CWE-416

Summary

A use-after-free flaw was found in qdisc_graft in net/sched/sch_api.c in the Linux Kernel due to a race problem. This flaw leads to a denial of service issue. If patch ebda44da44f6 ("net: sched: fix race condition in qdisc_graft()") not applied yet, then kernel could be affected.

References

►

URL

Tags

	https://lore.kernel.org/all/20221018203258.2793282-1-edumazet%40google.com/
	https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html	mailing-list

Impacted products

	Vendor	Product	Version
	n/a	Kernel	Version: Linux kernel 6.1-rc2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T05:17:49.847Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lore.kernel.org/all/20221018203258.2793282-1-edumazet%40google.com/"
          },
          {
            "name": "[debian-lts-announce] 20240111 [SECURITY] [DLA 3710-1] linux security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Kernel",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Linux kernel 6.1-rc2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A use-after-free flaw was found in qdisc_graft in net/sched/sch_api.c in the Linux Kernel due to a race problem. This flaw leads to a denial of service issue. If patch ebda44da44f6 (\"net: sched: fix race condition in qdisc_graft()\") not applied yet, then kernel could be affected."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "CWE-416",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-01-11T19:06:27.652362",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "url": "https://lore.kernel.org/all/20221018203258.2793282-1-edumazet%40google.com/"
        },
        {
          "name": "[debian-lts-announce] 20240111 [SECURITY] [DLA 3710-1] linux security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2023-0590",
    "datePublished": "2023-03-23T00:00:00",
    "dateReserved": "2023-01-31T00:00:00",
    "dateUpdated": "2024-08-02T05:17:49.847Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-1390 (GCVE-0-2023-1390)

Vulnerability from cvelistv5

Published

2023-03-16 00:00

Modified

2025-04-23 16:23

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-1050

Summary

A remote denial of service vulnerability was found in the Linux kernel’s TIPC kernel module. The while loop in tipc_link_xmit() hits an unknown state while attempting to parse SKBs, which are not in the queue. Sending two small UDP packets to a system with a UDP bearer results in the CPU utilization for the system to instantly spike to 100%, causing a denial of service condition.

References

►

URL

Tags

	https://gist.github.com/netspooky/bee2d07022f6350bb88eaa48e571d9b5
	https://infosec.exchange/%40_mattata/109427999461122360
	https://github.com/torvalds/linux/commit/b77413446408fdd256599daf00d5be72b5f3e7c6
	https://security.netapp.com/advisory/ntap-20230420-0001/

Impacted products

	Vendor	Product	Version
	n/a	Linux kernel (TIPC kernel module)	Version: Fixed in kernel 5.11-rc4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T05:49:11.042Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://gist.github.com/netspooky/bee2d07022f6350bb88eaa48e571d9b5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://infosec.exchange/%40_mattata/109427999461122360"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/torvalds/linux/commit/b77413446408fdd256599daf00d5be72b5f3e7c6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20230420-0001/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-1390",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-23T13:26:35.899836Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-23T16:23:37.728Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Linux kernel (TIPC kernel module)",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Fixed in kernel 5.11-rc4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A remote denial of service vulnerability was found in the Linux kernel\u2019s TIPC kernel module. The while loop in tipc_link_xmit() hits an unknown state while attempting to parse SKBs, which are not in the queue. Sending two small UDP packets to a system with a UDP bearer results in the CPU utilization for the system to instantly spike to 100%, causing a denial of service condition."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1050",
              "description": "CWE-1050",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-04-20T00:00:00.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "url": "https://gist.github.com/netspooky/bee2d07022f6350bb88eaa48e571d9b5"
        },
        {
          "url": "https://infosec.exchange/%40_mattata/109427999461122360"
        },
        {
          "url": "https://github.com/torvalds/linux/commit/b77413446408fdd256599daf00d5be72b5f3e7c6"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20230420-0001/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2023-1390",
    "datePublished": "2023-03-16T00:00:00.000Z",
    "dateReserved": "2023-03-14T00:00:00.000Z",
    "dateUpdated": "2025-04-23T16:23:37.728Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-23455 (GCVE-0-2023-23455)

Vulnerability from cvelistv5

Published

2023-01-12 00:00

Modified

2025-03-20 20:54

Severity ?

5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE

Summary

atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results).

References

►

URL

Tags

	https://www.openwall.com/lists/oss-security/2023/01/10/1
	https://www.openwall.com/lists/oss-security/2023/01/10/4
	https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a2965c7be0522eaa18808684b7b82b248515511b
	https://www.debian.org/security/2023/dsa-5324	vendor-advisory
	https://lists.debian.org/debian-lts-announce/2023/03/msg00000.html	mailing-list
	https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html	mailing-list

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T10:28:40.920Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.openwall.com/lists/oss-security/2023/01/10/1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.openwall.com/lists/oss-security/2023/01/10/4"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a2965c7be0522eaa18808684b7b82b248515511b"
          },
          {
            "name": "DSA-5324",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2023/dsa-5324"
          },
          {
            "name": "[debian-lts-announce] 20230302 [SECURITY] [DLA 3349-1] linux-5.10 security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/03/msg00000.html"
          },
          {
            "name": "[debian-lts-announce] 20230503 [SECURITY] [DLA 3403-1] linux security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-23455",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-06T15:57:31.738543Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-843",
                "description": "CWE-843 Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-20T20:54:48.320Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results)."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-05-03T00:00:00.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://www.openwall.com/lists/oss-security/2023/01/10/1"
        },
        {
          "url": "https://www.openwall.com/lists/oss-security/2023/01/10/4"
        },
        {
          "url": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a2965c7be0522eaa18808684b7b82b248515511b"
        },
        {
          "name": "DSA-5324",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2023/dsa-5324"
        },
        {
          "name": "[debian-lts-announce] 20230302 [SECURITY] [DLA 3349-1] linux-5.10 security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/03/msg00000.html"
        },
        {
          "name": "[debian-lts-announce] 20230503 [SECURITY] [DLA 3403-1] linux security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-23455",
    "datePublished": "2023-01-12T00:00:00.000Z",
    "dateReserved": "2023-01-12T00:00:00.000Z",
    "dateUpdated": "2025-03-20T20:54:48.320Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-28464 (GCVE-0-2023-28464)

Vulnerability from cvelistv5

Published

2023-03-31 00:00

Modified

2024-08-02 12:38

Severity ?

CWE

Summary

hci_conn_cleanup in net/bluetooth/hci_conn.c in the Linux kernel through 6.2.9 has a use-after-free (observed in hci_conn_hash_flush) because of calls to hci_dev_put and hci_conn_put. There is a double free that may lead to privilege escalation.

References

►

URL

Tags

	https://lore.kernel.org/lkml/20230309074645.74309-1-wzhmmmmm%40gmail.com/
	https://www.openwall.com/lists/oss-security/2023/03/28/2
	https://www.openwall.com/lists/oss-security/2023/03/28/3
	https://security.netapp.com/advisory/ntap-20230517-0004/

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T12:38:25.326Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lore.kernel.org/lkml/20230309074645.74309-1-wzhmmmmm%40gmail.com/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.openwall.com/lists/oss-security/2023/03/28/2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.openwall.com/lists/oss-security/2023/03/28/3"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20230517-0004/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "hci_conn_cleanup in net/bluetooth/hci_conn.c in the Linux kernel through 6.2.9 has a use-after-free (observed in hci_conn_hash_flush) because of calls to hci_dev_put and hci_conn_put. There is a double free that may lead to privilege escalation."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-05-17T00:00:00",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://lore.kernel.org/lkml/20230309074645.74309-1-wzhmmmmm%40gmail.com/"
        },
        {
          "url": "https://www.openwall.com/lists/oss-security/2023/03/28/2"
        },
        {
          "url": "https://www.openwall.com/lists/oss-security/2023/03/28/3"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20230517-0004/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-28464",
    "datePublished": "2023-03-31T00:00:00",
    "dateReserved": "2023-03-15T00:00:00",
    "dateUpdated": "2024-08-02T12:38:25.326Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-1513 (GCVE-0-2023-1513)

Vulnerability from cvelistv5

Published

2023-03-23 00:00

Modified

2025-02-25 19:33

Severity ?

3.3 (Low) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CWE

CWE-665

Summary

A flaw was found in KVM. When calling the KVM_GET_DEBUGREGS ioctl, on 32-bit systems, there might be some uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak.

References

►

URL

Tags

	https://bugzilla.redhat.com/show_bug.cgi?id=2179892
	https://lore.kernel.org/kvm/20230214103304.3689213-1-gregkh%40linuxfoundation.org/
	https://github.com/torvalds/linux/commit/2c10b61421a28e95a46ab489fd56c0f442ff6952
	https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html	mailing-list
	https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html	mailing-list

Impacted products

	Vendor	Product	Version
	n/a	Linux kernel (KVM)	Version: Fixed in kernel 6.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T05:49:11.667Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2179892"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lore.kernel.org/kvm/20230214103304.3689213-1-gregkh%40linuxfoundation.org/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/torvalds/linux/commit/2c10b61421a28e95a46ab489fd56c0f442ff6952"
          },
          {
            "name": "[debian-lts-announce] 20230502 [SECURITY] [DLA 3404-1] linux-5.10 security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html"
          },
          {
            "name": "[debian-lts-announce] 20230503 [SECURITY] [DLA 3403-1] linux security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "NONE",
              "baseScore": 3.3,
              "baseSeverity": "LOW",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-1513",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-25T19:33:05.156310Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-665",
                "description": "CWE-665 Improper Initialization",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-25T19:33:10.636Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Linux kernel (KVM)",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Fixed in kernel 6.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in KVM. When calling the KVM_GET_DEBUGREGS ioctl, on 32-bit systems, there might be some uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-665",
              "description": "CWE-665",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-05-03T13:06:58.798Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2179892"
        },
        {
          "url": "https://lore.kernel.org/kvm/20230214103304.3689213-1-gregkh%40linuxfoundation.org/"
        },
        {
          "url": "https://github.com/torvalds/linux/commit/2c10b61421a28e95a46ab489fd56c0f442ff6952"
        },
        {
          "name": "[debian-lts-announce] 20230502 [SECURITY] [DLA 3404-1] linux-5.10 security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html"
        },
        {
          "name": "[debian-lts-announce] 20230503 [SECURITY] [DLA 3403-1] linux security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2023-1513",
    "datePublished": "2023-03-23T00:00:00.000Z",
    "dateReserved": "2023-03-20T00:00:00.000Z",
    "dateUpdated": "2025-02-25T19:33:10.636Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-5753 (GCVE-0-2017-5753)

Vulnerability from cvelistv5

Published

2018-01-04 13:00

Modified

2024-09-16 22:24

Severity ?

CWE

Information Disclosure

Summary

Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis.

References

►

URL

Tags

	http://nvidia.custhelp.com/app/answers/detail/a_id/4609	x_refsource_CONFIRM
	https://lists.debian.org/debian-lts-announce/2018/07/msg00015.html	mailing-list, x_refsource_MLIST
	https://www.debian.org/security/2018/dsa-4187	vendor-advisory, x_refsource_DEBIAN
	https://usn.ubuntu.com/3542-2/	vendor-advisory, x_refsource_UBUNTU
	https://security.gentoo.org/glsa/201810-06	vendor-advisory, x_refsource_GENTOO
	https://usn.ubuntu.com/3540-2/	vendor-advisory, x_refsource_UBUNTU
	https://access.redhat.com/security/vulnerabilities/speculativeexecution	x_refsource_CONFIRM
	https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV180002	x_refsource_CONFIRM
	https://usn.ubuntu.com/3597-1/	vendor-advisory, x_refsource_UBUNTU
	https://lists.debian.org/debian-lts-announce/2018/07/msg00016.html	mailing-list, x_refsource_MLIST
	http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00008.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00007.html	vendor-advisory, x_refsource_SUSE
	http://nvidia.custhelp.com/app/answers/detail/a_id/4611	x_refsource_CONFIRM
	https://security.googleblog.com/2018/01/todays-cpu-vulnerability-what-you-need.html	x_refsource_MISC
	https://cert.vde.com/en-us/advisories/vde-2018-002	x_refsource_CONFIRM
	https://usn.ubuntu.com/3580-1/	vendor-advisory, x_refsource_UBUNTU
	https://support.f5.com/csp/article/K91229003	x_refsource_CONFIRM
	http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00014.html	vendor-advisory, x_refsource_SUSE
	https://www.debian.org/security/2018/dsa-4188	vendor-advisory, x_refsource_DEBIAN
	https://access.redhat.com/errata/RHSA-2018:0292	vendor-advisory, x_refsource_REDHAT
	http://xenbits.xen.org/xsa/advisory-254.html	x_refsource_CONFIRM
	https://security.netapp.com/advisory/ntap-20180104-0001/	x_refsource_CONFIRM
	https://www.synology.com/support/security/Synology_SA_18_01	x_refsource_CONFIRM
	http://packetstormsecurity.com/files/145645/Spectre-Information-Disclosure-Proof-Of-Concept.html	x_refsource_MISC
	http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-001.txt	x_refsource_CONFIRM
	https://lists.debian.org/debian-lts-announce/2018/07/msg00020.html	mailing-list, x_refsource_MLIST
	https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability	x_refsource_CONFIRM
	http://www.kb.cert.org/vuls/id/584653	third-party-advisory, x_refsource_CERT-VN
	https://www.kb.cert.org/vuls/id/180049	third-party-advisory, x_refsource_CERT-VN
	https://cert.vde.com/en-us/advisories/vde-2018-003	x_refsource_CONFIRM
	https://help.ecostruxureit.com/display/public/UADCO8x/StruxureWare+Data+Center+Operation+Software+Vulnerability+Fixes	x_refsource_CONFIRM
	http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html	x_refsource_CONFIRM
	https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03805en_us	x_refsource_CONFIRM
	https://www.mitel.com/en-ca/support/security-advisories/mitel-product-security-advisory-18-0001	x_refsource_CONFIRM
	https://cert-portal.siemens.com/productcert/pdf/ssa-505225.pdf	x_refsource_CONFIRM
	https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03871en_us	x_refsource_CONFIRM
	https://usn.ubuntu.com/3549-1/	vendor-advisory, x_refsource_UBUNTU
	https://www.suse.com/c/suse-addresses-meltdown-spectre-vulnerabilities/	x_refsource_CONFIRM
	https://support.citrix.com/article/CTX231399	x_refsource_CONFIRM
	https://spectreattack.com/	x_refsource_MISC
	https://aws.amazon.com/de/security/security-bulletins/AWS-2018-013/	x_refsource_CONFIRM
	https://blog.mozilla.org/security/2018/01/03/mitigations-landing-new-class-timing-attack/	x_refsource_CONFIRM
	http://www.securitytracker.com/id/1040071	vdb-entry, x_refsource_SECTRACK
	http://www.securityfocus.com/bid/102371	vdb-entry, x_refsource_BID
	https://usn.ubuntu.com/3597-2/	vendor-advisory, x_refsource_UBUNTU
	http://nvidia.custhelp.com/app/answers/detail/a_id/4614	x_refsource_CONFIRM
	http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00006.html	vendor-advisory, x_refsource_SUSE
	https://usn.ubuntu.com/3540-1/	vendor-advisory, x_refsource_UBUNTU
	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180104-cpusidechannel	vendor-advisory, x_refsource_CISCO
	https://usn.ubuntu.com/usn/usn-3516-1/	vendor-advisory, x_refsource_UBUNTU
	https://www.vmware.com/us/security/advisories/VMSA-2018-0002.html	x_refsource_CONFIRM
	https://www.exploit-db.com/exploits/43427/	exploit, x_refsource_EXPLOIT-DB
	https://usn.ubuntu.com/3541-1/	vendor-advisory, x_refsource_UBUNTU
	https://usn.ubuntu.com/3541-2/	vendor-advisory, x_refsource_UBUNTU
	https://usn.ubuntu.com/3542-1/	vendor-advisory, x_refsource_UBUNTU
	https://googleprojectzero.blogspot.com/2018/01/reading-privileged-memory-with-side.html	x_refsource_MISC
	https://support.lenovo.com/us/en/solutions/LEN-18282	x_refsource_CONFIRM
	http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00016.html	vendor-advisory, x_refsource_SUSE
	http://nvidia.custhelp.com/app/answers/detail/a_id/4613	x_refsource_CONFIRM
	https://lists.debian.org/debian-lts-announce/2019/03/msg00034.html	mailing-list, x_refsource_MLIST
	https://lists.debian.org/debian-lts-announce/2019/04/msg00004.html	mailing-list, x_refsource_MLIST
	https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html	x_refsource_MISC
	https://seclists.org/bugtraq/2019/Jun/36	mailing-list, x_refsource_BUGTRAQ
	http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2019-003.txt	x_refsource_CONFIRM
	https://cert-portal.siemens.com/productcert/pdf/ssa-608355.pdf	x_refsource_CONFIRM
	https://cdrdv2.intel.com/v1/dl/getContent/685359	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	Intel Corporation	Most Modern Operating Systems	Version: All

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T15:11:48.670Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://nvidia.custhelp.com/app/answers/detail/a_id/4609"
          },
          {
            "name": "[debian-lts-announce] 20180714 [SECURITY] [DLA 1422-1] linux security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00015.html"
          },
          {
            "name": "DSA-4187",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2018/dsa-4187"
          },
          {
            "name": "USN-3542-2",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3542-2/"
          },
          {
            "name": "GLSA-201810-06",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201810-06"
          },
          {
            "name": "USN-3540-2",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3540-2/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/security/vulnerabilities/speculativeexecution"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV180002"
          },
          {
            "name": "USN-3597-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3597-1/"
          },
          {
            "name": "[debian-lts-announce] 20180715 [SECURITY] [DLA 1422-2] linux security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00016.html"
          },
          {
            "name": "SUSE-SU-2018:0012",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00008.html"
          },
          {
            "name": "SUSE-SU-2018:0011",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00007.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://nvidia.custhelp.com/app/answers/detail/a_id/4611"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://security.googleblog.com/2018/01/todays-cpu-vulnerability-what-you-need.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://cert.vde.com/en-us/advisories/vde-2018-002"
          },
          {
            "name": "USN-3580-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3580-1/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.f5.com/csp/article/K91229003"
          },
          {
            "name": "openSUSE-SU-2018:0022",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00014.html"
          },
          {
            "name": "DSA-4188",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2018/dsa-4188"
          },
          {
            "name": "RHSA-2018:0292",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:0292"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://xenbits.xen.org/xsa/advisory-254.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20180104-0001/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.synology.com/support/security/Synology_SA_18_01"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/145645/Spectre-Information-Disclosure-Proof-Of-Concept.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-001.txt"
          },
          {
            "name": "[debian-lts-announce] 20180718 [SECURITY] [DLA 1423-1] linux-4.9 new package",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00020.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability"
          },
          {
            "name": "VU#584653",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT-VN",
              "x_transferred"
            ],
            "url": "http://www.kb.cert.org/vuls/id/584653"
          },
          {
            "name": "VU#180049",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT-VN",
              "x_transferred"
            ],
            "url": "https://www.kb.cert.org/vuls/id/180049"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://cert.vde.com/en-us/advisories/vde-2018-003"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://help.ecostruxureit.com/display/public/UADCO8x/StruxureWare+Data+Center+Operation+Software+Vulnerability+Fixes"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03805en_us"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mitel.com/en-ca/support/security-advisories/mitel-product-security-advisory-18-0001"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-505225.pdf"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbhf03871en_us"
          },
          {
            "name": "USN-3549-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3549-1/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.suse.com/c/suse-addresses-meltdown-spectre-vulnerabilities/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.citrix.com/article/CTX231399"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://spectreattack.com/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://aws.amazon.com/de/security/security-bulletins/AWS-2018-013/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://blog.mozilla.org/security/2018/01/03/mitigations-landing-new-class-timing-attack/"
          },
          {
            "name": "1040071",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1040071"
          },
          {
            "name": "102371",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/102371"
          },
          {
            "name": "USN-3597-2",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3597-2/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://nvidia.custhelp.com/app/answers/detail/a_id/4614"
          },
          {
            "name": "SUSE-SU-2018:0010",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00006.html"
          },
          {
            "name": "USN-3540-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3540-1/"
          },
          {
            "name": "20180104 CPU Side-Channel Information Disclosure Vulnerabilities",
            "tags": [
              "vendor-advisory",
              "x_refsource_CISCO",
              "x_transferred"
            ],
            "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180104-cpusidechannel"
          },
          {
            "name": "USN-3516-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/usn/usn-3516-1/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.vmware.com/us/security/advisories/VMSA-2018-0002.html"
          },
          {
            "name": "43427",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/43427/"
          },
          {
            "name": "USN-3541-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3541-1/"
          },
          {
            "name": "USN-3541-2",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3541-2/"
          },
          {
            "name": "USN-3542-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3542-1/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://googleprojectzero.blogspot.com/2018/01/reading-privileged-memory-with-side.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.lenovo.com/us/en/solutions/LEN-18282"
          },
          {
            "name": "openSUSE-SU-2018:0023",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00016.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://nvidia.custhelp.com/app/answers/detail/a_id/4613"
          },
          {
            "name": "[debian-lts-announce] 20190327 [SECURITY] [DLA 1731-1] linux security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2019/03/msg00034.html"
          },
          {
            "name": "[debian-lts-announce] 20190401 [SECURITY] [DLA 1731-2] linux regression update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2019/04/msg00004.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"
          },
          {
            "name": "20190624 [SECURITY] [DSA 4469-1] libvirt security update",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "https://seclists.org/bugtraq/2019/Jun/36"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2019-003.txt"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-608355.pdf"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://cdrdv2.intel.com/v1/dl/getContent/685359"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Most Modern Operating Systems",
          "vendor": "Intel Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "All"
            }
          ]
        }
      ],
      "datePublic": "2018-01-03T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Information Disclosure",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-11-19T17:48:07",
        "orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
        "shortName": "intel"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://nvidia.custhelp.com/app/answers/detail/a_id/4609"
        },
        {
          "name": "[debian-lts-announce] 20180714 [SECURITY] [DLA 1422-1] linux security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00015.html"
        },
        {
          "name": "DSA-4187",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2018/dsa-4187"
        },
        {
          "name": "USN-3542-2",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3542-2/"
        },
        {
          "name": "GLSA-201810-06",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201810-06"
        },
        {
          "name": "USN-3540-2",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3540-2/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://access.redhat.com/security/vulnerabilities/speculativeexecution"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV180002"
        },
        {
          "name": "USN-3597-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3597-1/"
        },
        {
          "name": "[debian-lts-announce] 20180715 [SECURITY] [DLA 1422-2] linux security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00016.html"
        },
        {
          "name": "SUSE-SU-2018:0012",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00008.html"
        },
        {
          "name": "SUSE-SU-2018:0011",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00007.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://nvidia.custhelp.com/app/answers/detail/a_id/4611"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://security.googleblog.com/2018/01/todays-cpu-vulnerability-what-you-need.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://cert.vde.com/en-us/advisories/vde-2018-002"
        },
        {
          "name": "USN-3580-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3580-1/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.f5.com/csp/article/K91229003"
        },
        {
          "name": "openSUSE-SU-2018:0022",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00014.html"
        },
        {
          "name": "DSA-4188",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2018/dsa-4188"
        },
        {
          "name": "RHSA-2018:0292",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:0292"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://xenbits.xen.org/xsa/advisory-254.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20180104-0001/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.synology.com/support/security/Synology_SA_18_01"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/145645/Spectre-Information-Disclosure-Proof-Of-Concept.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-001.txt"
        },
        {
          "name": "[debian-lts-announce] 20180718 [SECURITY] [DLA 1423-1] linux-4.9 new package",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00020.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability"
        },
        {
          "name": "VU#584653",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT-VN"
          ],
          "url": "http://www.kb.cert.org/vuls/id/584653"
        },
        {
          "name": "VU#180049",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT-VN"
          ],
          "url": "https://www.kb.cert.org/vuls/id/180049"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://cert.vde.com/en-us/advisories/vde-2018-003"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://help.ecostruxureit.com/display/public/UADCO8x/StruxureWare+Data+Center+Operation+Software+Vulnerability+Fixes"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03805en_us"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mitel.com/en-ca/support/security-advisories/mitel-product-security-advisory-18-0001"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-505225.pdf"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbhf03871en_us"
        },
        {
          "name": "USN-3549-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3549-1/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.suse.com/c/suse-addresses-meltdown-spectre-vulnerabilities/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.citrix.com/article/CTX231399"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://spectreattack.com/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://aws.amazon.com/de/security/security-bulletins/AWS-2018-013/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://blog.mozilla.org/security/2018/01/03/mitigations-landing-new-class-timing-attack/"
        },
        {
          "name": "1040071",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1040071"
        },
        {
          "name": "102371",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/102371"
        },
        {
          "name": "USN-3597-2",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3597-2/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://nvidia.custhelp.com/app/answers/detail/a_id/4614"
        },
        {
          "name": "SUSE-SU-2018:0010",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00006.html"
        },
        {
          "name": "USN-3540-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3540-1/"
        },
        {
          "name": "20180104 CPU Side-Channel Information Disclosure Vulnerabilities",
          "tags": [
            "vendor-advisory",
            "x_refsource_CISCO"
          ],
          "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180104-cpusidechannel"
        },
        {
          "name": "USN-3516-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/usn/usn-3516-1/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.vmware.com/us/security/advisories/VMSA-2018-0002.html"
        },
        {
          "name": "43427",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/43427/"
        },
        {
          "name": "USN-3541-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3541-1/"
        },
        {
          "name": "USN-3541-2",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3541-2/"
        },
        {
          "name": "USN-3542-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3542-1/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://googleprojectzero.blogspot.com/2018/01/reading-privileged-memory-with-side.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.lenovo.com/us/en/solutions/LEN-18282"
        },
        {
          "name": "openSUSE-SU-2018:0023",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00016.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://nvidia.custhelp.com/app/answers/detail/a_id/4613"
        },
        {
          "name": "[debian-lts-announce] 20190327 [SECURITY] [DLA 1731-1] linux security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2019/03/msg00034.html"
        },
        {
          "name": "[debian-lts-announce] 20190401 [SECURITY] [DLA 1731-2] linux regression update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2019/04/msg00004.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"
        },
        {
          "name": "20190624 [SECURITY] [DSA 4469-1] libvirt security update",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "https://seclists.org/bugtraq/2019/Jun/36"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2019-003.txt"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-608355.pdf"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://cdrdv2.intel.com/v1/dl/getContent/685359"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@intel.com",
          "DATE_PUBLIC": "2018-01-03T00:00:00",
          "ID": "CVE-2017-5753",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Most Modern Operating Systems",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "All"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Intel Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Information Disclosure"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://nvidia.custhelp.com/app/answers/detail/a_id/4609",
              "refsource": "CONFIRM",
              "url": "http://nvidia.custhelp.com/app/answers/detail/a_id/4609"
            },
            {
              "name": "[debian-lts-announce] 20180714 [SECURITY] [DLA 1422-1] linux security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00015.html"
            },
            {
              "name": "DSA-4187",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2018/dsa-4187"
            },
            {
              "name": "USN-3542-2",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3542-2/"
            },
            {
              "name": "GLSA-201810-06",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201810-06"
            },
            {
              "name": "USN-3540-2",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3540-2/"
            },
            {
              "name": "https://access.redhat.com/security/vulnerabilities/speculativeexecution",
              "refsource": "CONFIRM",
              "url": "https://access.redhat.com/security/vulnerabilities/speculativeexecution"
            },
            {
              "name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV180002",
              "refsource": "CONFIRM",
              "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV180002"
            },
            {
              "name": "USN-3597-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3597-1/"
            },
            {
              "name": "[debian-lts-announce] 20180715 [SECURITY] [DLA 1422-2] linux security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00016.html"
            },
            {
              "name": "SUSE-SU-2018:0012",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00008.html"
            },
            {
              "name": "SUSE-SU-2018:0011",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00007.html"
            },
            {
              "name": "http://nvidia.custhelp.com/app/answers/detail/a_id/4611",
              "refsource": "CONFIRM",
              "url": "http://nvidia.custhelp.com/app/answers/detail/a_id/4611"
            },
            {
              "name": "https://security.googleblog.com/2018/01/todays-cpu-vulnerability-what-you-need.html",
              "refsource": "MISC",
              "url": "https://security.googleblog.com/2018/01/todays-cpu-vulnerability-what-you-need.html"
            },
            {
              "name": "https://cert.vde.com/en-us/advisories/vde-2018-002",
              "refsource": "CONFIRM",
              "url": "https://cert.vde.com/en-us/advisories/vde-2018-002"
            },
            {
              "name": "USN-3580-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3580-1/"
            },
            {
              "name": "https://support.f5.com/csp/article/K91229003",
              "refsource": "CONFIRM",
              "url": "https://support.f5.com/csp/article/K91229003"
            },
            {
              "name": "openSUSE-SU-2018:0022",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00014.html"
            },
            {
              "name": "DSA-4188",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2018/dsa-4188"
            },
            {
              "name": "RHSA-2018:0292",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:0292"
            },
            {
              "name": "http://xenbits.xen.org/xsa/advisory-254.html",
              "refsource": "CONFIRM",
              "url": "http://xenbits.xen.org/xsa/advisory-254.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20180104-0001/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20180104-0001/"
            },
            {
              "name": "https://www.synology.com/support/security/Synology_SA_18_01",
              "refsource": "CONFIRM",
              "url": "https://www.synology.com/support/security/Synology_SA_18_01"
            },
            {
              "name": "http://packetstormsecurity.com/files/145645/Spectre-Information-Disclosure-Proof-Of-Concept.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/145645/Spectre-Information-Disclosure-Proof-Of-Concept.html"
            },
            {
              "name": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-001.txt",
              "refsource": "CONFIRM",
              "url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-001.txt"
            },
            {
              "name": "[debian-lts-announce] 20180718 [SECURITY] [DLA 1423-1] linux-4.9 new package",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00020.html"
            },
            {
              "name": "https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability",
              "refsource": "CONFIRM",
              "url": "https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability"
            },
            {
              "name": "VU#584653",
              "refsource": "CERT-VN",
              "url": "http://www.kb.cert.org/vuls/id/584653"
            },
            {
              "name": "VU#180049",
              "refsource": "CERT-VN",
              "url": "https://www.kb.cert.org/vuls/id/180049"
            },
            {
              "name": "https://cert.vde.com/en-us/advisories/vde-2018-003",
              "refsource": "CONFIRM",
              "url": "https://cert.vde.com/en-us/advisories/vde-2018-003"
            },
            {
              "name": "https://help.ecostruxureit.com/display/public/UADCO8x/StruxureWare+Data+Center+Operation+Software+Vulnerability+Fixes",
              "refsource": "CONFIRM",
              "url": "https://help.ecostruxureit.com/display/public/UADCO8x/StruxureWare+Data+Center+Operation+Software+Vulnerability+Fixes"
            },
            {
              "name": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html"
            },
            {
              "name": "https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03805en_us",
              "refsource": "CONFIRM",
              "url": "https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03805en_us"
            },
            {
              "name": "https://www.mitel.com/en-ca/support/security-advisories/mitel-product-security-advisory-18-0001",
              "refsource": "CONFIRM",
              "url": "https://www.mitel.com/en-ca/support/security-advisories/mitel-product-security-advisory-18-0001"
            },
            {
              "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-505225.pdf",
              "refsource": "CONFIRM",
              "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-505225.pdf"
            },
            {
              "name": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbhf03871en_us",
              "refsource": "CONFIRM",
              "url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbhf03871en_us"
            },
            {
              "name": "USN-3549-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3549-1/"
            },
            {
              "name": "https://www.suse.com/c/suse-addresses-meltdown-spectre-vulnerabilities/",
              "refsource": "CONFIRM",
              "url": "https://www.suse.com/c/suse-addresses-meltdown-spectre-vulnerabilities/"
            },
            {
              "name": "https://support.citrix.com/article/CTX231399",
              "refsource": "CONFIRM",
              "url": "https://support.citrix.com/article/CTX231399"
            },
            {
              "name": "https://spectreattack.com/",
              "refsource": "MISC",
              "url": "https://spectreattack.com/"
            },
            {
              "name": "https://aws.amazon.com/de/security/security-bulletins/AWS-2018-013/",
              "refsource": "CONFIRM",
              "url": "https://aws.amazon.com/de/security/security-bulletins/AWS-2018-013/"
            },
            {
              "name": "https://blog.mozilla.org/security/2018/01/03/mitigations-landing-new-class-timing-attack/",
              "refsource": "CONFIRM",
              "url": "https://blog.mozilla.org/security/2018/01/03/mitigations-landing-new-class-timing-attack/"
            },
            {
              "name": "1040071",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1040071"
            },
            {
              "name": "102371",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/102371"
            },
            {
              "name": "USN-3597-2",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3597-2/"
            },
            {
              "name": "http://nvidia.custhelp.com/app/answers/detail/a_id/4614",
              "refsource": "CONFIRM",
              "url": "http://nvidia.custhelp.com/app/answers/detail/a_id/4614"
            },
            {
              "name": "SUSE-SU-2018:0010",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00006.html"
            },
            {
              "name": "USN-3540-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3540-1/"
            },
            {
              "name": "20180104 CPU Side-Channel Information Disclosure Vulnerabilities",
              "refsource": "CISCO",
              "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180104-cpusidechannel"
            },
            {
              "name": "USN-3516-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/usn/usn-3516-1/"
            },
            {
              "name": "https://www.vmware.com/us/security/advisories/VMSA-2018-0002.html",
              "refsource": "CONFIRM",
              "url": "https://www.vmware.com/us/security/advisories/VMSA-2018-0002.html"
            },
            {
              "name": "43427",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/43427/"
            },
            {
              "name": "USN-3541-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3541-1/"
            },
            {
              "name": "USN-3541-2",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3541-2/"
            },
            {
              "name": "USN-3542-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3542-1/"
            },
            {
              "name": "https://googleprojectzero.blogspot.com/2018/01/reading-privileged-memory-with-side.html",
              "refsource": "MISC",
              "url": "https://googleprojectzero.blogspot.com/2018/01/reading-privileged-memory-with-side.html"
            },
            {
              "name": "https://support.lenovo.com/us/en/solutions/LEN-18282",
              "refsource": "CONFIRM",
              "url": "https://support.lenovo.com/us/en/solutions/LEN-18282"
            },
            {
              "name": "openSUSE-SU-2018:0023",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00016.html"
            },
            {
              "name": "http://nvidia.custhelp.com/app/answers/detail/a_id/4613",
              "refsource": "CONFIRM",
              "url": "http://nvidia.custhelp.com/app/answers/detail/a_id/4613"
            },
            {
              "name": "[debian-lts-announce] 20190327 [SECURITY] [DLA 1731-1] linux security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2019/03/msg00034.html"
            },
            {
              "name": "[debian-lts-announce] 20190401 [SECURITY] [DLA 1731-2] linux regression update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2019/04/msg00004.html"
            },
            {
              "name": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"
            },
            {
              "name": "20190624 [SECURITY] [DSA 4469-1] libvirt security update",
              "refsource": "BUGTRAQ",
              "url": "https://seclists.org/bugtraq/2019/Jun/36"
            },
            {
              "name": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2019-003.txt",
              "refsource": "CONFIRM",
              "url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2019-003.txt"
            },
            {
              "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-608355.pdf",
              "refsource": "CONFIRM",
              "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-608355.pdf"
            },
            {
              "name": "https://cdrdv2.intel.com/v1/dl/getContent/685359",
              "refsource": "CONFIRM",
              "url": "https://cdrdv2.intel.com/v1/dl/getContent/685359"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
    "assignerShortName": "intel",
    "cveId": "CVE-2017-5753",
    "datePublished": "2018-01-04T13:00:00Z",
    "dateReserved": "2017-02-01T00:00:00",
    "dateUpdated": "2024-09-16T22:24:53.960Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

suse-su-2023:1801-1

Vulnerability from csaf_suse

CVE-2023-28772 (GCVE-0-2023-28772)

Vulnerability from cvelistv5

CVE-2023-1095 (GCVE-0-2023-1095)

Vulnerability from cvelistv5

CVE-2022-20567 (GCVE-0-2022-20567)

Vulnerability from cvelistv5

CVE-2021-3923 (GCVE-0-2021-3923)

Vulnerability from cvelistv5

CVE-2023-28328 (GCVE-0-2023-28328)

Vulnerability from cvelistv5

CVE-2023-23454 (GCVE-0-2023-23454)

Vulnerability from cvelistv5

CVE-2023-1076 (GCVE-0-2023-1076)

Vulnerability from cvelistv5

CVE-2023-1281 (GCVE-0-2023-1281)

Vulnerability from cvelistv5

CVE-2023-0590 (GCVE-0-2023-0590)

Vulnerability from cvelistv5

CVE-2023-1390 (GCVE-0-2023-1390)

Vulnerability from cvelistv5

CVE-2023-23455 (GCVE-0-2023-23455)

Vulnerability from cvelistv5

CVE-2023-28464 (GCVE-0-2023-28464)

Vulnerability from cvelistv5

CVE-2023-1513 (GCVE-0-2023-1513)

Vulnerability from cvelistv5

CVE-2017-5753 (GCVE-0-2017-5753)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature