kernel-devel-6.3.7-1.1 on GA media SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2024:12994 Final 1 1 2024-06-17T21:45:33Z current 2024-06-17T21:45:33Z 2024-06-17T21:45:33Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z kernel-devel-6.3.7-1.1 on GA media These are all security issues fixed in the kernel-devel-6.3.7-1.1 package on the GA media of openSUSE Tumbleweed. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Tumbleweed-2024-12994 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) E-Mail link for openSUSE-SU-2024:12994 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2022-45884/ SUSE CVE CVE-2022-45884 page https://www.suse.com/security/cve/CVE-2022-45885/ SUSE CVE CVE-2022-45885 page https://www.suse.com/security/cve/CVE-2022-45886/ SUSE CVE CVE-2022-45886 page https://www.suse.com/security/cve/CVE-2022-45887/ SUSE CVE CVE-2022-45887 page https://www.suse.com/security/cve/CVE-2022-45919/ SUSE CVE CVE-2022-45919 page https://www.suse.com/security/cve/CVE-2023-1380/ SUSE CVE CVE-2023-1380 page https://www.suse.com/security/cve/CVE-2023-31084/ SUSE CVE CVE-2023-31084 page https://www.suse.com/security/cve/CVE-2023-3141/ SUSE CVE CVE-2023-3141 page openSUSE Tumbleweed kernel-devel-6.3.7-1.1 kernel-macros-6.3.7-1.1 kernel-source-6.3.7-1.1 kernel-source-vanilla-6.3.7-1.1 kernel-devel-6.3.7-1.1 as a component of openSUSE Tumbleweed kernel-macros-6.3.7-1.1 as a component of openSUSE Tumbleweed kernel-source-6.3.7-1.1 as a component of openSUSE Tumbleweed kernel-source-vanilla-6.3.7-1.1 as a component of openSUSE Tumbleweed An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvbdev.c has a use-after-free, related to dvb_register_device dynamically allocating fops. CVE-2022-45884 openSUSE Tumbleweed:kernel-devel-6.3.7-1.1 openSUSE Tumbleweed:kernel-macros-6.3.7-1.1 openSUSE Tumbleweed:kernel-source-6.3.7-1.1 openSUSE Tumbleweed:kernel-source-vanilla-6.3.7-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2022-45884.html CVE-2022-45884 https://bugzilla.suse.com/1205756 SUSE Bug 1205756 An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvb_frontend.c has a race condition that can cause a use-after-free when a device is disconnected. CVE-2022-45885 openSUSE Tumbleweed:kernel-devel-6.3.7-1.1 openSUSE Tumbleweed:kernel-macros-6.3.7-1.1 openSUSE Tumbleweed:kernel-source-6.3.7-1.1 openSUSE Tumbleweed:kernel-source-vanilla-6.3.7-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2022-45885.html CVE-2022-45885 https://bugzilla.suse.com/1205758 SUSE Bug 1205758 An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvb_net.c has a .disconnect versus dvb_device_open race condition that leads to a use-after-free. CVE-2022-45886 openSUSE Tumbleweed:kernel-devel-6.3.7-1.1 openSUSE Tumbleweed:kernel-macros-6.3.7-1.1 openSUSE Tumbleweed:kernel-source-6.3.7-1.1 openSUSE Tumbleweed:kernel-source-vanilla-6.3.7-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2022-45886.html CVE-2022-45886 https://bugzilla.suse.com/1205760 SUSE Bug 1205760 An issue was discovered in the Linux kernel through 6.0.9. drivers/media/usb/ttusb-dec/ttusb_dec.c has a memory leak because of the lack of a dvb_frontend_detach call. CVE-2022-45887 openSUSE Tumbleweed:kernel-devel-6.3.7-1.1 openSUSE Tumbleweed:kernel-macros-6.3.7-1.1 openSUSE Tumbleweed:kernel-source-6.3.7-1.1 openSUSE Tumbleweed:kernel-source-vanilla-6.3.7-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2022-45887.html CVE-2022-45887 https://bugzilla.suse.com/1205762 SUSE Bug 1205762 https://bugzilla.suse.com/1220015 SUSE Bug 1220015 An issue was discovered in the Linux kernel through 6.0.10. In drivers/media/dvb-core/dvb_ca_en50221.c, a use-after-free can occur is there is a disconnect after an open, because of the lack of a wait_event. CVE-2022-45919 openSUSE Tumbleweed:kernel-devel-6.3.7-1.1 openSUSE Tumbleweed:kernel-macros-6.3.7-1.1 openSUSE Tumbleweed:kernel-source-6.3.7-1.1 openSUSE Tumbleweed:kernel-source-vanilla-6.3.7-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2022-45919.html CVE-2022-45919 https://bugzilla.suse.com/1205803 SUSE Bug 1205803 https://bugzilla.suse.com/1208912 SUSE Bug 1208912 https://bugzilla.suse.com/1214128 SUSE Bug 1214128 https://bugzilla.suse.com/1215674 SUSE Bug 1215674 A slab-out-of-bound read problem was found in brcmf_get_assoc_ies in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux Kernel. This issue could occur when assoc_info->req_len data is bigger than the size of the buffer, defined as WL_EXTRA_BUF_MAX, leading to a denial of service. CVE-2023-1380 openSUSE Tumbleweed:kernel-devel-6.3.7-1.1 openSUSE Tumbleweed:kernel-macros-6.3.7-1.1 openSUSE Tumbleweed:kernel-source-6.3.7-1.1 openSUSE Tumbleweed:kernel-source-vanilla-6.3.7-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2023-1380.html CVE-2023-1380 https://bugzilla.suse.com/1209287 SUSE Bug 1209287 An issue was discovered in drivers/media/dvb-core/dvb_frontend.c in the Linux kernel 6.2. There is a blocking operation when a task is in !TASK_RUNNING. In dvb_frontend_get_event, wait_event_interruptible is called; the condition is dvb_frontend_test_event(fepriv,events). In dvb_frontend_test_event, down(&fepriv->sem) is called. However, wait_event_interruptible would put the process to sleep, and down(&fepriv->sem) may block the process. CVE-2023-31084 openSUSE Tumbleweed:kernel-devel-6.3.7-1.1 openSUSE Tumbleweed:kernel-macros-6.3.7-1.1 openSUSE Tumbleweed:kernel-source-6.3.7-1.1 openSUSE Tumbleweed:kernel-source-vanilla-6.3.7-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2023-31084.html CVE-2023-31084 https://bugzilla.suse.com/1210783 SUSE Bug 1210783 A use-after-free flaw was found in r592_remove in drivers/memstick/host/r592.c in media access in the Linux Kernel. This flaw allows a local attacker to crash the system at device disconnect, possibly leading to a kernel information leak. CVE-2023-3141 openSUSE Tumbleweed:kernel-devel-6.3.7-1.1 openSUSE Tumbleweed:kernel-macros-6.3.7-1.1 openSUSE Tumbleweed:kernel-source-6.3.7-1.1 openSUSE Tumbleweed:kernel-source-vanilla-6.3.7-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2023-3141.html CVE-2023-3141 https://bugzilla.suse.com/1212129 SUSE Bug 1212129 https://bugzilla.suse.com/1215674 SUSE Bug 1215674