suse-su-2024:3370-1
Vulnerability from csaf_suse
Published
2024-09-23 03:37
Modified
2024-09-23 03:37
Summary
Security update for the Linux Kernel (Live Patch 0 for SLE 15 SP6)

Notes

Title of the patch
Security update for the Linux Kernel (Live Patch 0 for SLE 15 SP6)
Description of the patch
This update for the Linux Kernel 6.4.0-150600_21 fixes several issues. The following security issues were fixed: - CVE-2023-52846: Prevent use after free in prp_create_tagged_frame() (bsc#1225099). - CVE-2024-35817: Set gtt bound flag in amdgpu_ttm_gart_bind (bsc#1225313). - CVE-2024-36921: Guard against invalid STA ID on removal. (bsc#1225769) - CVE-2023-52772: Fixed use-after-free in unix_stream_read_actor() (bsc#1224991). - CVE-2024-26923: Fixed false-positive lockdep splat for spin_lock() in __unix_gc() (bsc#1223683). - CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1225013). - CVE-2024-35950: Fully protect modes with dev->mode_config.mutex (bsc#1225310).
Patchnames
SUSE-2024-3370,SUSE-SLE-Module-Live-Patching-15-SP6-2024-3370
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for the Linux Kernel (Live Patch 0 for SLE 15 SP6)",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for the Linux Kernel 6.4.0-150600_21 fixes several issues.\n\nThe following security issues were fixed:\n\n- CVE-2023-52846: Prevent use after free in prp_create_tagged_frame() (bsc#1225099).\n- CVE-2024-35817: Set gtt bound flag in amdgpu_ttm_gart_bind (bsc#1225313).\n- CVE-2024-36921: Guard against invalid STA ID on removal. (bsc#1225769)\n- CVE-2023-52772: Fixed use-after-free in unix_stream_read_actor()  (bsc#1224991).\n- CVE-2024-26923: Fixed false-positive lockdep splat for spin_lock() in __unix_gc() (bsc#1223683).\n- CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1225013).\n- CVE-2024-35950: Fully protect modes with dev-\u003emode_config.mutex (bsc#1225310).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2024-3370,SUSE-SLE-Module-Live-Patching-15-SP6-2024-3370",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2024_3370-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2024:3370-1",
        "url": "https://www.suse.com/support/update/announcement/2024/suse-su-20243370-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2024:3370-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2024-September/019487.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1223683",
        "url": "https://bugzilla.suse.com/1223683"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1224991",
        "url": "https://bugzilla.suse.com/1224991"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1225013",
        "url": "https://bugzilla.suse.com/1225013"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1225099",
        "url": "https://bugzilla.suse.com/1225099"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1225310",
        "url": "https://bugzilla.suse.com/1225310"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1225313",
        "url": "https://bugzilla.suse.com/1225313"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1225850",
        "url": "https://bugzilla.suse.com/1225850"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-52772 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-52772/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-52846 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-52846/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-26923 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-26923/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-27398 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-27398/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-35817 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-35817/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-35950 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-35950/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-36921 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-36921/"
      }
    ],
    "title": "Security update for the Linux Kernel (Live Patch 0 for SLE 15 SP6)",
    "tracking": {
      "current_release_date": "2024-09-23T03:37:52Z",
      "generator": {
        "date": "2024-09-23T03:37:52Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2024:3370-1",
      "initial_release_date": "2024-09-23T03:37:52Z",
      "revision_history": [
        {
          "date": "2024-09-23T03:37:52Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.ppc64le",
                "product": {
                  "name": "kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.ppc64le",
                  "product_id": "kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.s390x",
                "product": {
                  "name": "kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.s390x",
                  "product_id": "kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.x86_64",
                "product": {
                  "name": "kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.x86_64",
                  "product_id": "kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Live Patching 15 SP6",
                "product": {
                  "name": "SUSE Linux Enterprise Live Patching 15 SP6",
                  "product_id": "SUSE Linux Enterprise Live Patching 15 SP6",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-module-live-patching:15:sp6"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.ppc64le as component of SUSE Linux Enterprise Live Patching 15 SP6",
          "product_id": "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.ppc64le"
        },
        "product_reference": "kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Live Patching 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.s390x as component of SUSE Linux Enterprise Live Patching 15 SP6",
          "product_id": "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.s390x"
        },
        "product_reference": "kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Live Patching 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.x86_64 as component of SUSE Linux Enterprise Live Patching 15 SP6",
          "product_id": "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.x86_64"
        },
        "product_reference": "kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Live Patching 15 SP6"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-52772",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-52772"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In the Linux kernel, the following vulnerability has been resolved:\n\naf_unix: fix use-after-free in unix_stream_read_actor()\n\nsyzbot reported the following crash [1]\n\nAfter releasing unix socket lock, u-\u003eoob_skb can be changed\nby another thread. We must temporarily increase skb refcount\nto make sure this other thread will not free the skb under us.\n\n[1]\n\nBUG: KASAN: slab-use-after-free in unix_stream_read_actor+0xa7/0xc0 net/unix/af_unix.c:2866\nRead of size 4 at addr ffff88801f3b9cc4 by task syz-executor107/5297\n\nCPU: 1 PID: 5297 Comm: syz-executor107 Not tainted 6.6.0-syzkaller-15910-gb8e3a87a627b #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023\nCall Trace:\n\u003cTASK\u003e\n__dump_stack lib/dump_stack.c:88 [inline]\ndump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106\nprint_address_description mm/kasan/report.c:364 [inline]\nprint_report+0xc4/0x620 mm/kasan/report.c:475\nkasan_report+0xda/0x110 mm/kasan/report.c:588\nunix_stream_read_actor+0xa7/0xc0 net/unix/af_unix.c:2866\nunix_stream_recv_urg net/unix/af_unix.c:2587 [inline]\nunix_stream_read_generic+0x19a5/0x2480 net/unix/af_unix.c:2666\nunix_stream_recvmsg+0x189/0x1b0 net/unix/af_unix.c:2903\nsock_recvmsg_nosec net/socket.c:1044 [inline]\nsock_recvmsg+0xe2/0x170 net/socket.c:1066\n____sys_recvmsg+0x21f/0x5c0 net/socket.c:2803\n___sys_recvmsg+0x115/0x1a0 net/socket.c:2845\n__sys_recvmsg+0x114/0x1e0 net/socket.c:2875\ndo_syscall_x64 arch/x86/entry/common.c:51 [inline]\ndo_syscall_64+0x3f/0x110 arch/x86/entry/common.c:82\nentry_SYSCALL_64_after_hwframe+0x63/0x6b\nRIP: 0033:0x7fc67492c559\nCode: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007fc6748ab228 EFLAGS: 00000246 ORIG_RAX: 000000000000002f\nRAX: ffffffffffffffda RBX: 000000000000001c RCX: 00007fc67492c559\nRDX: 0000000040010083 RSI: 0000000020000140 RDI: 0000000000000004\nRBP: 00007fc6749b6348 R08: 00007fc6748ab6c0 R09: 00007fc6748ab6c0\nR10: 0000000000000000 R11: 0000000000000246 R12: 00007fc6749b6340\nR13: 00007fc6749b634c R14: 00007ffe9fac52a0 R15: 00007ffe9fac5388\n\u003c/TASK\u003e\n\nAllocated by task 5295:\nkasan_save_stack+0x33/0x50 mm/kasan/common.c:45\nkasan_set_track+0x25/0x30 mm/kasan/common.c:52\n__kasan_slab_alloc+0x81/0x90 mm/kasan/common.c:328\nkasan_slab_alloc include/linux/kasan.h:188 [inline]\nslab_post_alloc_hook mm/slab.h:763 [inline]\nslab_alloc_node mm/slub.c:3478 [inline]\nkmem_cache_alloc_node+0x180/0x3c0 mm/slub.c:3523\n__alloc_skb+0x287/0x330 net/core/skbuff.c:641\nalloc_skb include/linux/skbuff.h:1286 [inline]\nalloc_skb_with_frags+0xe4/0x710 net/core/skbuff.c:6331\nsock_alloc_send_pskb+0x7e4/0x970 net/core/sock.c:2780\nsock_alloc_send_skb include/net/sock.h:1884 [inline]\nqueue_oob net/unix/af_unix.c:2147 [inline]\nunix_stream_sendmsg+0xb5f/0x10a0 net/unix/af_unix.c:2301\nsock_sendmsg_nosec net/socket.c:730 [inline]\n__sock_sendmsg+0xd5/0x180 net/socket.c:745\n____sys_sendmsg+0x6ac/0x940 net/socket.c:2584\n___sys_sendmsg+0x135/0x1d0 net/socket.c:2638\n__sys_sendmsg+0x117/0x1e0 net/socket.c:2667\ndo_syscall_x64 arch/x86/entry/common.c:51 [inline]\ndo_syscall_64+0x3f/0x110 arch/x86/entry/common.c:82\nentry_SYSCALL_64_after_hwframe+0x63/0x6b\n\nFreed by task 5295:\nkasan_save_stack+0x33/0x50 mm/kasan/common.c:45\nkasan_set_track+0x25/0x30 mm/kasan/common.c:52\nkasan_save_free_info+0x2b/0x40 mm/kasan/generic.c:522\n____kasan_slab_free mm/kasan/common.c:236 [inline]\n____kasan_slab_free+0x15b/0x1b0 mm/kasan/common.c:200\nkasan_slab_free include/linux/kasan.h:164 [inline]\nslab_free_hook mm/slub.c:1800 [inline]\nslab_free_freelist_hook+0x114/0x1e0 mm/slub.c:1826\nslab_free mm/slub.c:3809 [inline]\nkmem_cache_free+0xf8/0x340 mm/slub.c:3831\nkfree_skbmem+0xef/0x1b0 net/core/skbuff.c:1015\n__kfree_skb net/core/skbuff.c:1073 [inline]\nconsume_skb net/core/skbuff.c:1288 [inline]\nconsume_skb+0xdf/0x170 net/core/skbuff.c:1282\nqueue_oob net/unix/af_unix.c:2178 [inline]\nu\n---truncated---",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.ppc64le",
          "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.s390x",
          "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-52772",
          "url": "https://www.suse.com/security/cve/CVE-2023-52772"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1224989 for CVE-2023-52772",
          "url": "https://bugzilla.suse.com/1224989"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1224991 for CVE-2023-52772",
          "url": "https://bugzilla.suse.com/1224991"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.ppc64le",
            "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.s390x",
            "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.ppc64le",
            "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.s390x",
            "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-09-23T03:37:52Z",
          "details": "important"
        }
      ],
      "title": "CVE-2023-52772"
    },
    {
      "cve": "CVE-2023-52846",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-52846"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nhsr: Prevent use after free in prp_create_tagged_frame()\n\nThe prp_fill_rct() function can fail.  In that situation, it frees the\nskb and returns NULL.  Meanwhile on the success path, it returns the\noriginal skb.  So it\u0027s straight forward to fix bug by using the returned\nvalue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.ppc64le",
          "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.s390x",
          "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-52846",
          "url": "https://www.suse.com/security/cve/CVE-2023-52846"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1225098 for CVE-2023-52846",
          "url": "https://bugzilla.suse.com/1225098"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1225099 for CVE-2023-52846",
          "url": "https://bugzilla.suse.com/1225099"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.ppc64le",
            "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.s390x",
            "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.ppc64le",
            "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.s390x",
            "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-09-23T03:37:52Z",
          "details": "important"
        }
      ],
      "title": "CVE-2023-52846"
    },
    {
      "cve": "CVE-2024-26923",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-26923"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In the Linux kernel, the following vulnerability has been resolved:\n\naf_unix: Fix garbage collector racing against connect()\n\nGarbage collector does not take into account the risk of embryo getting\nenqueued during the garbage collection. If such embryo has a peer that\ncarries SCM_RIGHTS, two consecutive passes of scan_children() may see a\ndifferent set of children. Leading to an incorrectly elevated inflight\ncount, and then a dangling pointer within the gc_inflight_list.\n\nsockets are AF_UNIX/SOCK_STREAM\nS is an unconnected socket\nL is a listening in-flight socket bound to addr, not in fdtable\nV\u0027s fd will be passed via sendmsg(), gets inflight count bumped\n\nconnect(S, addr)\tsendmsg(S, [V]); close(V)\t__unix_gc()\n----------------\t-------------------------\t-----------\n\nNS = unix_create1()\nskb1 = sock_wmalloc(NS)\nL = unix_find_other(addr)\nunix_state_lock(L)\nunix_peer(S) = NS\n\t\t\t// V count=1 inflight=0\n\n \t\t\tNS = unix_peer(S)\n \t\t\tskb2 = sock_alloc()\n\t\t\tskb_queue_tail(NS, skb2[V])\n\n\t\t\t// V became in-flight\n\t\t\t// V count=2 inflight=1\n\n\t\t\tclose(V)\n\n\t\t\t// V count=1 inflight=1\n\t\t\t// GC candidate condition met\n\n\t\t\t\t\t\tfor u in gc_inflight_list:\n\t\t\t\t\t\t  if (total_refs == inflight_refs)\n\t\t\t\t\t\t    add u to gc_candidates\n\n\t\t\t\t\t\t// gc_candidates={L, V}\n\n\t\t\t\t\t\tfor u in gc_candidates:\n\t\t\t\t\t\t  scan_children(u, dec_inflight)\n\n\t\t\t\t\t\t// embryo (skb1) was not\n\t\t\t\t\t\t// reachable from L yet, so V\u0027s\n\t\t\t\t\t\t// inflight remains unchanged\n__skb_queue_tail(L, skb1)\nunix_state_unlock(L)\n\t\t\t\t\t\tfor u in gc_candidates:\n\t\t\t\t\t\t  if (u.inflight)\n\t\t\t\t\t\t    scan_children(u, inc_inflight_move_tail)\n\n\t\t\t\t\t\t// V count=1 inflight=2 (!)\n\nIf there is a GC-candidate listening socket, lock/unlock its state. This\nmakes GC wait until the end of any ongoing connect() to that socket. After\nflipping the lock, a possibly SCM-laden embryo is already enqueued. And if\nthere is another embryo coming, it can not possibly carry SCM_RIGHTS. At\nthis point, unix_inflight() can not happen because unix_gc_lock is already\ntaken. Inflight graph remains unaffected.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.ppc64le",
          "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.s390x",
          "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-26923",
          "url": "https://www.suse.com/security/cve/CVE-2024-26923"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1223384 for CVE-2024-26923",
          "url": "https://bugzilla.suse.com/1223384"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1223683 for CVE-2024-26923",
          "url": "https://bugzilla.suse.com/1223683"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.ppc64le",
            "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.s390x",
            "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.ppc64le",
            "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.s390x",
            "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-09-23T03:37:52Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-26923"
    },
    {
      "cve": "CVE-2024-27398",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-27398"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: Fix use-after-free bugs caused by sco_sock_timeout\n\nWhen the sco connection is established and then, the sco socket\nis releasing, timeout_work will be scheduled to judge whether\nthe sco disconnection is timeout. The sock will be deallocated\nlater, but it is dereferenced again in sco_sock_timeout. As a\nresult, the use-after-free bugs will happen. The root cause is\nshown below:\n\n    Cleanup Thread               |      Worker Thread\nsco_sock_release                 |\n  sco_sock_close                 |\n    __sco_sock_close             |\n      sco_sock_set_timer         |\n        schedule_delayed_work    |\n  sco_sock_kill                  |    (wait a time)\n    sock_put(sk) //FREE          |  sco_sock_timeout\n                                 |    sock_hold(sk) //USE\n\nThe KASAN report triggered by POC is shown below:\n\n[   95.890016] ==================================================================\n[   95.890496] BUG: KASAN: slab-use-after-free in sco_sock_timeout+0x5e/0x1c0\n[   95.890755] Write of size 4 at addr ffff88800c388080 by task kworker/0:0/7\n...\n[   95.890755] Workqueue: events sco_sock_timeout\n[   95.890755] Call Trace:\n[   95.890755]  \u003cTASK\u003e\n[   95.890755]  dump_stack_lvl+0x45/0x110\n[   95.890755]  print_address_description+0x78/0x390\n[   95.890755]  print_report+0x11b/0x250\n[   95.890755]  ? __virt_addr_valid+0xbe/0xf0\n[   95.890755]  ? sco_sock_timeout+0x5e/0x1c0\n[   95.890755]  kasan_report+0x139/0x170\n[   95.890755]  ? update_load_avg+0xe5/0x9f0\n[   95.890755]  ? sco_sock_timeout+0x5e/0x1c0\n[   95.890755]  kasan_check_range+0x2c3/0x2e0\n[   95.890755]  sco_sock_timeout+0x5e/0x1c0\n[   95.890755]  process_one_work+0x561/0xc50\n[   95.890755]  worker_thread+0xab2/0x13c0\n[   95.890755]  ? pr_cont_work+0x490/0x490\n[   95.890755]  kthread+0x279/0x300\n[   95.890755]  ? pr_cont_work+0x490/0x490\n[   95.890755]  ? kthread_blkcg+0xa0/0xa0\n[   95.890755]  ret_from_fork+0x34/0x60\n[   95.890755]  ? kthread_blkcg+0xa0/0xa0\n[   95.890755]  ret_from_fork_asm+0x11/0x20\n[   95.890755]  \u003c/TASK\u003e\n[   95.890755]\n[   95.890755] Allocated by task 506:\n[   95.890755]  kasan_save_track+0x3f/0x70\n[   95.890755]  __kasan_kmalloc+0x86/0x90\n[   95.890755]  __kmalloc+0x17f/0x360\n[   95.890755]  sk_prot_alloc+0xe1/0x1a0\n[   95.890755]  sk_alloc+0x31/0x4e0\n[   95.890755]  bt_sock_alloc+0x2b/0x2a0\n[   95.890755]  sco_sock_create+0xad/0x320\n[   95.890755]  bt_sock_create+0x145/0x320\n[   95.890755]  __sock_create+0x2e1/0x650\n[   95.890755]  __sys_socket+0xd0/0x280\n[   95.890755]  __x64_sys_socket+0x75/0x80\n[   95.890755]  do_syscall_64+0xc4/0x1b0\n[   95.890755]  entry_SYSCALL_64_after_hwframe+0x67/0x6f\n[   95.890755]\n[   95.890755] Freed by task 506:\n[   95.890755]  kasan_save_track+0x3f/0x70\n[   95.890755]  kasan_save_free_info+0x40/0x50\n[   95.890755]  poison_slab_object+0x118/0x180\n[   95.890755]  __kasan_slab_free+0x12/0x30\n[   95.890755]  kfree+0xb2/0x240\n[   95.890755]  __sk_destruct+0x317/0x410\n[   95.890755]  sco_sock_release+0x232/0x280\n[   95.890755]  sock_close+0xb2/0x210\n[   95.890755]  __fput+0x37f/0x770\n[   95.890755]  task_work_run+0x1ae/0x210\n[   95.890755]  get_signal+0xe17/0xf70\n[   95.890755]  arch_do_signal_or_restart+0x3f/0x520\n[   95.890755]  syscall_exit_to_user_mode+0x55/0x120\n[   95.890755]  do_syscall_64+0xd1/0x1b0\n[   95.890755]  entry_SYSCALL_64_after_hwframe+0x67/0x6f\n[   95.890755]\n[   95.890755] The buggy address belongs to the object at ffff88800c388000\n[   95.890755]  which belongs to the cache kmalloc-1k of size 1024\n[   95.890755] The buggy address is located 128 bytes inside of\n[   95.890755]  freed 1024-byte region [ffff88800c388000, ffff88800c388400)\n[   95.890755]\n[   95.890755] The buggy address belongs to the physical page:\n[   95.890755] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800c38a800 pfn:0xc388\n[   95.890755] head: order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0\n[   95.890755] ano\n---truncated---",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.ppc64le",
          "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.s390x",
          "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-27398",
          "url": "https://www.suse.com/security/cve/CVE-2024-27398"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1224174 for CVE-2024-27398",
          "url": "https://bugzilla.suse.com/1224174"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1225013 for CVE-2024-27398",
          "url": "https://bugzilla.suse.com/1225013"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.ppc64le",
            "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.s390x",
            "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.ppc64le",
            "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.s390x",
            "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-09-23T03:37:52Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-27398"
    },
    {
      "cve": "CVE-2024-35817",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-35817"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: amdgpu_ttm_gart_bind set gtt bound flag\n\nOtherwise after the GTT bo is released, the GTT and gart space is freed\nbut amdgpu_ttm_backend_unbind will not clear the gart page table entry\nand leave valid mapping entry pointing to the stale system page. Then\nif GPU access the gart address mistakely, it will read undefined value\ninstead page fault, harder to debug and reproduce the real issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.ppc64le",
          "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.s390x",
          "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-35817",
          "url": "https://www.suse.com/security/cve/CVE-2024-35817"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1224736 for CVE-2024-35817",
          "url": "https://bugzilla.suse.com/1224736"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1225313 for CVE-2024-35817",
          "url": "https://bugzilla.suse.com/1225313"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.ppc64le",
            "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.s390x",
            "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.ppc64le",
            "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.s390x",
            "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-09-23T03:37:52Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-35817"
    },
    {
      "cve": "CVE-2024-35950",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-35950"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/client: Fully protect modes[] with dev-\u003emode_config.mutex\n\nThe modes[] array contains pointers to modes on the connectors\u0027\nmode lists, which are protected by dev-\u003emode_config.mutex.\nThus we need to extend modes[] the same protection or by the\ntime we use it the elements may already be pointing to\nfreed/reused memory.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.ppc64le",
          "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.s390x",
          "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-35950",
          "url": "https://www.suse.com/security/cve/CVE-2024-35950"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1224703 for CVE-2024-35950",
          "url": "https://bugzilla.suse.com/1224703"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1225310 for CVE-2024-35950",
          "url": "https://bugzilla.suse.com/1225310"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.ppc64le",
            "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.s390x",
            "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.ppc64le",
            "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.s390x",
            "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-09-23T03:37:52Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-35950"
    },
    {
      "cve": "CVE-2024-36921",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-36921"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mvm: guard against invalid STA ID on removal\n\nGuard against invalid station IDs in iwl_mvm_mld_rm_sta_id as that would\nresult in out-of-bounds array accesses. This prevents issues should the\ndriver get into a bad state during error handling.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.ppc64le",
          "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.s390x",
          "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-36921",
          "url": "https://www.suse.com/security/cve/CVE-2024-36921"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1225769 for CVE-2024-36921",
          "url": "https://bugzilla.suse.com/1225769"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1225850 for CVE-2024-36921",
          "url": "https://bugzilla.suse.com/1225850"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.ppc64le",
            "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.s390x",
            "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.ppc64le",
            "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.s390x",
            "SUSE Linux Enterprise Live Patching 15 SP6:kernel-livepatch-6_4_0-150600_21-default-4-150600.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-09-23T03:37:52Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-36921"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.