Security update for the Linux Kernel (Live Patch 44 for SLE 15 SP3) SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2024:2149-1 Final 1 1 2024-06-21T14:03:54Z current 2024-06-21T14:03:54Z 2024-06-21T14:03:54Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for the Linux Kernel (Live Patch 44 for SLE 15 SP3) This update for the Linux Kernel 5.3.18-150300_59_161 fixes one issue. The following security issue was fixed: - CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210619). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2024-2149,SUSE-2024-2150,SUSE-SLE-Module-Live-Patching-15-SP2-2024-2149,SUSE-SLE-Module-Live-Patching-15-SP3-2024-2150 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2024/suse-su-20242149-1/ Link for SUSE-SU-2024:2149-1 https://lists.suse.com/pipermail/sle-updates/2024-June/035687.html E-Mail link for SUSE-SU-2024:2149-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1210619 SUSE Bug 1210619 https://www.suse.com/security/cve/CVE-2023-1829/ SUSE CVE CVE-2023-1829 page SUSE Linux Enterprise Live Patching 15 SP2 SUSE Linux Enterprise Live Patching 15 SP3 kernel-livepatch-5_3_18-150200_24_191-default-2-150200.5.6.2 kernel-livepatch-5_3_18-150200_24_191-preempt-2-150200.5.6.2 kernel-livepatch-5_3_18-150300_59_161-default-2-150300.7.6.2 kernel-livepatch-5_3_18-150300_59_161-preempt-2-150300.7.6.2 kernel-livepatch-5_3_18-150200_24_191-default-2-150200.5.6.2 as a component of SUSE Linux Enterprise Live Patching 15 SP2 kernel-livepatch-5_3_18-150300_59_161-default-2-150300.7.6.2 as a component of SUSE Linux Enterprise Live Patching 15 SP3 A use-after-free vulnerability in the Linux Kernel traffic control index filter (tcindex) can be exploited to achieve local privilege escalation. The tcindex_delete function which does not properly deactivate filters in case of a perfect hashes while deleting the underlying structure which can later lead to double freeing the structure. A local attacker user can use this vulnerability to elevate its privileges to root. We recommend upgrading past commit 8c710f75256bb3cf05ac7b1672c82b92c43f3d28. CVE-2023-1829 SUSE Linux Enterprise Live Patching 15 SP2:kernel-livepatch-5_3_18-150200_24_191-default-2-150200.5.6.2 SUSE Linux Enterprise Live Patching 15 SP3:kernel-livepatch-5_3_18-150300_59_161-default-2-150300.7.6.2 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20242149-1/ https://www.suse.com/security/cve/CVE-2023-1829.html CVE-2023-1829 https://bugzilla.suse.com/1210335 SUSE Bug 1210335 https://bugzilla.suse.com/1210619 SUSE Bug 1210619 https://bugzilla.suse.com/1217444 SUSE Bug 1217444 https://bugzilla.suse.com/1217531 SUSE Bug 1217531 https://bugzilla.suse.com/1220886 SUSE Bug 1220886 https://bugzilla.suse.com/1228311 SUSE Bug 1228311