SUSE-SU-2023:4028-1

    Dashboard / Vulnerabilities / SUSE-SU-2023:4028-1

    SUSE-SU-2023:4028-1

    Published: 10 Oct 2023Last Modified: 4 Feb 2026

    Summary: Security update for the Linux Kernel

    Details: The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2023-1077: Fixed a type confusion in pick_next_rt_entity() that could cause memory corruption (bsc#1208600). - CVE-2023-4623: Fixed a use-after-free issue in the HFSC network scheduler which could be exploited to achieve local privilege escalation (bsc#1215115). - CVE-2023-1192: Fixed use-after-free in cifs_demultiplex_thread() (bsc#1208995). - CVE-2023-20588: Fixed a potential data leak that could be triggered through a side channel when division by zero occurred on some AMD processors (bsc#1213927). - CVE-2023-4459: Fixed a NULL pointer dereference flaw in the vmxnet3 driver that may have allowed a local attacker with user privileges to cause a denial of service (bsc#1214451). - CVE-2023-3772: Fixed a flaw in the XFRM subsystem that may have allowed a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer leading to denial of service (bsc#1213666). - CVE-2023-2007: Removed the dpt_i2o driver due to security issues (bsc#1210448, jsc#PED-4579). - CVE-2023-4385: Fixed a NULL pointer dereference flaw in dbFree that may have allowed a local attacker to crash the system due to a missing sanity check (bsc#1214348).

    References: https://www.suse.com/support/update/announcement/2023/suse-su-20234028-1/, https://bugzilla.suse.com/1208600, https://bugzilla.suse.com/1208995, https://bugzilla.suse.com/1210448, https://bugzilla.suse.com/1213666, https://bugzilla.suse.com/1213927, https://bugzilla.suse.com/1214348, https://bugzilla.suse.com/1214451, https://bugzilla.suse.com/1215115, https://www.suse.com/security/cve/CVE-2023-1077, https://www.suse.com/security/cve/CVE-2023-1192, https://www.suse.com/security/cve/CVE-2023-2007, https://www.suse.com/security/cve/CVE-2023-20588, https://www.suse.com/security/cve/CVE-2023-3772, https://www.suse.com/security/cve/CVE-2023-4385, https://www.suse.com/security/cve/CVE-2023-4459, https://www.suse.com/security/cve/CVE-2023-4623

    Affected packages

    Package

    Name: kernel-default

    Purl: pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4%20LTSS%20EXTREME%20CORE

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -3.0.101-108.147.1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    SUSE-SU-2023:4028-1 | CVE-DB