SUSE-SU-2023:0410-1

    Dashboard / Vulnerabilities / SUSE-SU-2023:0410-1

    SUSE-SU-2023:0410-1

    Published: 14 Feb 2023Last Modified: 4 Feb 2026

    Summary: Security update for the Linux Kernel

    Details: The SUSE Linux Enterprise 15 SP1 kernel was updated receive various security and bugfixes. The following security bugs were fixed: - CVE-2022-3107: Fixed missing check of return value of kvmalloc_array() (bnc#1206395). - CVE-2022-3108: Fixed missing check of return value of kmemdup() (bnc#1206389). - CVE-2022-3564: Fixed use-after-free in l2cap_core.c of the Bluetooth component (bnc#1206073). - CVE-2022-4662: Fixed incorrect access control in the USB core subsystem that could lead a local user to crash the system (bnc#1206664). - CVE-2022-47929: Fixed NULL pointer dereference bug in the traffic control subsystem (bnc#1207237). - CVE-2023-23454: Fixed denial or service in cbq_classify in net/sched/sch_cbq.c (bnc#1207036). The following non-security bugs were fixed: - Added support for enabling livepatching related packages on -RT (jsc#PED-1706). - Added suse-kernel-rpm-scriptlets to kmp buildreqs (boo#1205149). - HID: betop: check shape of output reports (git-fixes, bsc#1207186). - HID: betop: fix slab-out-of-bounds Write in betop_probe (git-fixes, bsc#1207186). - HID: check empty report_list in hid_validate_values() (git-fixes, bsc#1206784). - Reverted 'constraints: increase disk space for all architectures' (bsc#1203693) - net: sched: atm: dont intepret cls results when asked to drop (bsc#1207036). - net: sched: cbq: dont intepret cls results when asked to drop (bsc#1207036). - sctp: fail if no bound addresses can be used for a given scope (bsc#1206677).

    References: https://www.suse.com/support/update/announcement/2023/suse-su-20230410-1/, https://bugzilla.suse.com/1203693, https://bugzilla.suse.com/1205149, https://bugzilla.suse.com/1206073, https://bugzilla.suse.com/1206389, https://bugzilla.suse.com/1206395, https://bugzilla.suse.com/1206664, https://bugzilla.suse.com/1206677, https://bugzilla.suse.com/1206784, https://bugzilla.suse.com/1207036, https://bugzilla.suse.com/1207186, https://bugzilla.suse.com/1207237, https://www.suse.com/security/cve/CVE-2022-3107, https://www.suse.com/security/cve/CVE-2022-3108, https://www.suse.com/security/cve/CVE-2022-3564, https://www.suse.com/security/cve/CVE-2022-4662, https://www.suse.com/security/cve/CVE-2022-47929, https://www.suse.com/security/cve/CVE-2023-23454

    Affected packages

    Package

    Name: kernel-default

    Purl: pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Live%20Patching%2015%20SP1

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -4.12.14-150100.197.134.1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    SUSE-SU-2023:0410-1 | CVE-DB