SUSE-SU-2023:4351-1

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-3777: Fixed a use-after-free vulnerability in netfilter: nf_tables component can be exploited to achieve local privilege escalation. (bsc#1215095)
• CVE-2023-46813: Fixed a local privilege escalation with user-space programs that have access to MMIO regions (bsc#1212649).
• CVE-2023-31085: Fixed a divide-by-zero error in do_div(sz,mtd->erasesize) that could cause a local DoS. (bsc#1210778)
• CVE-2023-45862: Fixed an issue in the ENE UB6250 reader driver whwere an object could potentially extend beyond the end of an allocation causing. (bsc#1216051)
• CVE-2023-5178: Fixed an UAF in queue intialization setup. (bsc#1215768)
• CVE-2023-2163: Fixed an incorrect verifier pruning in BPF that could lead to unsafe code paths being incorrectly marked as safe, resulting in arbitrary read/write in kernel memory, lateral privilege escalation, and container escape. (bsc#1215518)
• CVE-2023-34324: Fixed a possible deadlock in Linux kernel event handling. (bsc#1215745).
• CVE-2023-39189: Fixed a flaw in the Netfilter subsystem that could allow a local privileged (CAPNETADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure. (bsc#1216046)

The following non-security bugs were fixed:

• 9p: virtio: make sure 'offs' is initialized in zc_request (git-fixes).
• ACPI: irq: Fix incorrect return value in acpiregistergsi() (git-fixes).
• ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CBA (git-fixes).
• ALSA: hda/realtek: Change model for Intel RVP board (git-fixes).
• ALSA: hda: Disable power save for solving pop issue on Lenovo ThinkCentre M70q (git-fixes).
• ALSA: usb-audio: Fix microphone sound on Opencomm2 Headset (git-fixes).
• ASoC: codecs: wcd938x-sdw: fix runtime PM imbalance on probe errors (git-fixes).
• ASoC: codecs: wcd938x-sdw: fix use after free on driver unbind (git-fixes).
• ASoC: codecs: wcd938x: drop bogus bind error handling (git-fixes).
• ASoC: codecs: wcd938x: fix unbind tear down order (git-fixes).
• ASoC: fsl: imx-pcm-rpmsg: Add SNDRVPCMINFO_BATCH flag (git-fixes).
• ASoC: imx-rpmsg: Set ignorepmdowntime for dai_link (git-fixes).
• ASoC: pxa: fix a memory leak in probe() (git-fixes).
• Bluetooth: Avoid redundant authentication (git-fixes).
• Bluetooth: Fix a refcnt underflow problem for hci_conn (git-fixes).
• Bluetooth: Reject connection with the device which has same BD_ADDR (git-fixes).
• Bluetooth: avoid memcmp() out of bounds warning (git-fixes).
• Bluetooth: btusb: add shutdown function for QCA6174 (git-fixes).
• Bluetooth: hci_event: Fix coding style (git-fixes).
• Bluetooth: hci_event: Fix using memcmp when comparing keys (git-fixes).
• Bluetooth: hci_event: Ignore NULL link key (git-fixes).
• Bluetooth: hcisock: Correctly bounds check and pad HCIMONNEWINDEX name (git-fixes).
• Bluetooth: hcisock: fix slab oob read in createmonitor_event (git-fixes).
• Bluetooth: vhci: Fix race when opening vhci device (git-fixes).
• Documentation: qat: change kernel version (PED-6401).
• Documentation: qat: rewrite description (PED-6401).
• Drivers: hv: vmbus: Call hvsynicfree() if hvsynicalloc() fails (git-fixes).
• Drivers: hv: vmbus: Fix vmbuswaitfor_unload() to scan present CPUs (git-fixes).
• Fix metadata references
• HID: holtek: fix slab-out-of-bounds Write in holtekkbdinput_event (git-fixes).
• HID: intel-ish-hid: ipc: Disable and reenable ACPI GPE bit (git-fixes).
• HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect (git-fixes).
• HID: multitouch: Add required quirk for Synaptics 0xcd7e device (git-fixes).
• HID: sony: Fix a potential memory leak in sony_probe() (git-fixes).
• HID: sony: remove duplicate NULL check before calling usbfreeurb() (git-fixes).
• IB/mlx4: Fix the size of a buffer in addportentries() (git-fixes)
• Input: goodix - ensure int GPIO is in input for gpiocount == 1 && gpioint_idx == 0 case (git-fixes).
• Input: powermate - fix use-after-free in powermateconfigcomplete (git-fixes).
• Input: psmouse - fix fast_reconnect function for PS/2 mode (git-fixes).
• Input: xpad - add PXN V900 support (git-fixes).
• KVM: SVM: Do not kill SEV guest if SMAP erratum triggers in usermode (git-fixes).
• KVM: s390: fix gisa destroy operation might lead to cpu stalls (git-fixes bsc#1216512).
• KVM: x86/mmu: Reconstruct shadow page root if the guest PDPTEs is changed (git-fixes).
• KVM: x86: Fix clang -Wimplicit-fallthrough in dohostcpuid() (git-fixes).
• KVM: x86: Move open-coded CPUID leaf 0x80000021 EAX bit propagation code (bsc#1213772).
• KVM: x86: Propagate the AMD Automatic IBRS feature to the guest (bsc#1213772).
• KVM: x86: add support for CPUID leaf 0x80000021 (bsc#1213772).
• KVM: x86: synthesize CPUID leaf 0x80000021h if useful (bsc#1213772).
• KVM: x86: work around QEMU issue with synthetic CPUID leaves (git-fixes).
• RDMA/cma: Fix truncation compilation warning in makecmaports (git-fixes)
• RDMA/cma: Initialize ibsamulticast structure to 0 when join (git-fixes)
• RDMA/core: Require admin capabilities to set system parameters (git-fixes)
• RDMA/cxgb4: Check skb value for failure to allocate (git-fixes)
• RDMA/mlx5: Fix NULL string error (git-fixes)
• RDMA/siw: Fix connection failure handling (git-fixes)
• RDMA/srp: Do not call scsidone() from srpabort() (git-fixes)
• RDMA/uverbs: Fix typo of sizeof argument (git-fixes)
• Revert 'pinctrl: avoid unsafe code pattern in find_pinctrl()' (git-fixes).
• Revert 'tty: ngsm: fix UAF in gsmcleanup_mux' (git-fixes).
• USB: serial: option: add Fibocom to DELL custom modem FM101R-GL (git-fixes).
• USB: serial: option: add Telit LE910C4-WWX 0x1035 composition (git-fixes).
• USB: serial: option: add entry for Sierra EM9191 with new firmware (git-fixes).
• ata: libata-core: Do not register PM operations for SAS ports (git-fixes).
• ata: libata-core: Fix ataportrequest_pm() locking (git-fixes).
• ata: libata-core: Fix port and device removal (git-fixes).
• ata: libata-sata: increase PMP SRST timeout to 10s (git-fixes).
• ata: libata-scsi: ignore reserved bits for REPORT SUPPORTED OPERATION CODES (git-fixes).
• blk-cgroup: Fix NULL deref caused by blkgpolicydata being installed before init (bsc#1216062).
• blk-cgroup: support to track if policy is online (bsc#1216062).
• bpf: propagate precision in ALU/ALU64 operations (git-fixes).
• bus: ti-sysc: Fix missing AM35xx SoC matching (git-fixes).
• bus: ti-sysc: Use fsleep() instead of usleeprange() in syscreset() (git-fixes).
• cgroup/cpuset: Change references of cpusetmutex to cpusetrwsem (bsc#1215955).
• cgroup: Remove duplicates in cgroup v1 tasks file (bsc#1211307).
• clk: tegra: fix error return case for recalc_rate (git-fixes).
• counter: microchip-tcb-capture: Fix the use of internal GCLK logic (git-fixes).
• crypto: qat - Include algapi.h for low-level Crypto API (PED-6401).
• crypto: qat - Remove unused function declarations (PED-6401).
• crypto: qat - add fw_counters debugfs file (PED-6401).
• crypto: qat - add heartbeat counters check (PED-6401).
• crypto: qat - add heartbeat feature (PED-6401).
• crypto: qat - add internal timer for qat 4xxx (PED-6401).
• crypto: qat - add measure clock frequency (PED-6401).
• crypto: qat - add missing function declaration in adf_dbgfs.h (PED-6401).
• crypto: qat - add qatzlibdeflate (PED-6401).
• crypto: qat - add support for 402xx devices (PED-6401).
• crypto: qat - change value of default idle filter (PED-6401).
• crypto: qat - delay sysfs initialization (PED-6401).
• crypto: qat - do not export adfinitadmin_pm() (PED-6401).
• crypto: qat - drop log level of msg in getinstancenode() (PED-6401).
• crypto: qat - drop obsolete heartbeat interface (PED-6401).
• crypto: qat - drop redundant adfenableaer() (PED-6401).
• crypto: qat - expose pmidleenabled through sysfs (PED-6401).
• crypto: qat - extend buffer list logic interface (PED-6401).
• crypto: qat - extend configuration for 4xxx (PED-6401).
• crypto: qat - fix apply custom thread-service mapping for dc service (PED-6401).
• crypto: qat - fix concurrency issue when device state changes (PED-6401).
• crypto: qat - fix crypto capability detection for 4xxx (PED-6401).
• crypto: qat - fix spelling mistakes from 'bufer' to 'buffer' (PED-6401).
• crypto: qat - make fw images name constant (PED-6401).
• crypto: qat - make state machine functions static (PED-6401).
• crypto: qat - move dbgfs init to separate file (PED-6401).
• crypto: qat - move returns to default case (PED-6401).
• crypto: qat - refactor device restart logic (PED-6401).
• crypto: qat - refactor fw config logic for 4xxx (PED-6401).
• crypto: qat - remove ADFSTATUSPF_RUNNING flag from probe (PED-6401).
• crypto: qat - replace state machine calls (PED-6401).
• crypto: qat - replace the if statement with min() (PED-6401).
• crypto: qat - set deprecated capabilities as reserved (PED-6401).
• crypto: qat - unmap buffer before free for DH (PED-6401).
• crypto: qat - unmap buffers before free for RSA (PED-6401).
• crypto: qat - update slice mask for 4xxx devices (PED-6401).
• crypto: qat - use kfree_sensitive instead of memset/kfree() (PED-6401).
• dmaengine: idxd: use spinlockirqsave before waiteventlock_irq (git-fixes).
• dmaengine: mediatek: Fix deadlock caused by synchronize_irq() (git-fixes).
• dmaengine: stm32-mdma: abort resume if no ongoing transfer (git-fixes).
• drm/amd/display: Do not check registers, if using AUX BL control (git-fixes).
• drm/amd/display: Do not set dpms_off for seamless boot (git-fixes).
• drm/amdgpu: Handle null atom context in VBIOS info ioctl (git-fixes).
• drm/amdgpu: add missing NULL check (git-fixes).
• drm/i915: Retry gtt fault when out of fence registers (git-fixes).
• drm/msm/dp: do not reinitialize phy unless retry during link training (git-fixes).
• drm/msm/dpu: change dpuplanecalcbw() to use u64 to avoid overflow (git-fixes).
• drm/msm/dsi: fix irqofparseandmap() error checking (git-fixes).
• drm/msm/dsi: skip the wait for video mode done if not applicable (git-fixes).
• drm/vmwgfx: fix typo of sizeof argument (git-fixes).
• drm: panel-orientation-quirks: Add quirk for One Mix 2S (git-fixes).
• firmware: armffa: Do not set the memory region attributes for MEMLEND (git-fixes).
• firmware: imx-dsp: Fix an error handling path in imxdspsetup_channels() (git-fixes).
• gpio: aspeed: fix the GPIO number passed to pinctrlgpioset_config() (git-fixes).
• gpio: pmic-eic-sprd: Add can_sleep flag for PMIC EIC chip (git-fixes).
• gpio: pxa: disable pinctrl calls for MMP_GPIO (git-fixes).
• gpio: tb10x: Fix an error handling path in tb10xgpioprobe() (git-fixes).
• gpio: timberdale: Fix potential deadlock on &tgpio->lock (git-fixes).
• gpio: vf610: set value before the direction to avoid a glitch (git-fixes).
• gve: Do not fully free QPL pages on prefill errors (git-fixes).
• i2c: i801: unregister tcopdev in i801probe() error path (git-fixes).
• i2c: mux: Avoid potential false error message in i2cmuxadd_adapter (git-fixes).
• i2c: mux: demux-pinctrl: check the return value of devm_kstrdup() (git-fixes).
• i2c: mux: gpio: Add missing fwnodehandleput() (git-fixes).
• i2c: mux: gpio:�Replace custom acpigetlocal_address() (git-fixes).
• i2c: npcm7xx: Fix callback completion ordering (git-fixes).
• ieee802154: ca8210: Fix a potential UAF in ca8210_probe (git-fixes).
• iio: pressure: bmp280: Fix NULL pointer exception (git-fixes).
• iio: pressure: dps310: Adjust Timeout Settings (git-fixes).
• iio: pressure: ms5611: ms5611promis_valid false negative bug (git-fixes).
• iommu/amd/io-pgtable: Implement mappages iopgtable_ops callback (bsc#1212423).
• iommu/amd/io-pgtable: Implement unmappages iopgtable_ops callback (bsc#1212423).
• iommu/amd: Add map/unmappages() iommudomain_ops callback support (bsc#1212423).
• kabi: blkcgpolicydata fix KABI (bsc#1216062).
• kabi: workaround for enum nfttransphase (bsc#1215104).
• kprobes: Prohibit probing on CFI preamble symbol (git-fixes).
• leds: Drop BUGON check for LEDCOLORIDMULTI (git-fixes).
• mm, memcg: reconsider kmem.limitinbytes deprecation (bsc#1208788 bsc#1213705).
• mmc: core: Capture correct oemid-bits for eMMC cards (git-fixes).
• mmc: core: sdio: hold retuning if sdio in 1-bit mode (git-fixes).
• mmc: mtk-sd: Use readlpolltimeoutatomic in msdcreset_hw (git-fixes).
• mtd: physmap-core: Restore map_rom fallback (git-fixes).
• mtd: rawnand: arasan: Ensure program page operations are successful (git-fixes).
• mtd: rawnand: marvell: Ensure program page operations are successful (git-fixes).
• mtd: rawnand: pl353: Ensure program page operations are successful (git-fixes).
• mtd: rawnand: qcom: Unmap the right resource upon probe failure (git-fixes).
• mtd: spinand: micron: correct bitmask for ecc status (git-fixes).
• net/sched: fix netdevice reference leaks in attachdefaultqdiscs() (git-fixes).
• net: mana: Fix TX CQE error handling (bsc#1215986).
• net: mana: Fix oversized sge0 for GSO packets (bsc#1215986).
• net: nfc: llcp: Add lock when modifying device list (git-fixes).
• net: rfkill: gpio: prevent value glitch during probe (git-fixes).
• net: sched: add barrier to fix packet stuck problem for lockless qdisc (bsc#1216345).
• net: sched: fixed barrier to prevent skbuff sticking in qdisc backlog (bsc#1216345).
• net: usb: dm9601: fix uninitialized variable use in dm9601mdioread (git-fixes).
• net: usb: smsc75xx: Fix uninit-value access in _smsc75xxread_reg (git-fixes).
• net: usb: smsc95xx: Fix an error code in smsc95xx_reset() (git-fixes).
• netfilter: nftables: add NFTTRANSPREPAREERROR to deal with bound set/chain (git-fixes).
• netfilter: nf_tables: unbind non-anonymous set if rule construction fails (git-fixes).
• nfc: nci: assert requested protocol is valid (git-fixes).
• nfc: nci: fix possible NULL pointer dereference in send_acknowledge() (git-fixes).
• nilfs2: fix potential use after free in nilfsgccachesubmitreaddata() (git-fixes).
• nvme-fc: Prevent null pointer dereference in nvmefcio_getuuid() (bsc#1214842).
• phy: mapphone-mdm6600: Fix pinctrl_pm handling for sleep pins (git-fixes).
• phy: mapphone-mdm6600: Fix runtime PM for remove (git-fixes).
• phy: mapphone-mdm6600: Fix runtime disable on probe (git-fixes).
• pinctrl: avoid unsafe code pattern in find_pinctrl() (git-fixes).
• pinctrl: renesas: rzn1: Enable missing PINMUX (git-fixes).
• platform/surface: platform_profile: Propagate error if profile registration fails (git-fixes).
• platform/x86: asus-wmi: Change ASUSWMIBRN_DOWN code from 0x20 to 0x2e (git-fixes).
• platform/x86: asus-wmi: Map 0x2a code, Ignore 0x2b and 0x2c events (git-fixes).
• platform/x86: think-lmi: Fix reference leak (git-fixes).
• platform/x86: touchscreen_dmi: Add info for the Positivo C4128B (git-fixes).
• power: supply: ucs1002: fix error code in ucs1002getproperty() (git-fixes).
• quota: Fix slow quotaoff (bsc#1216621).
• r8152: check budget for r8152_poll() (git-fixes).
• regmap: fix NULL deref on lookup (git-fixes).
• regmap: rbtree: Fix wrong register marked as in-cache when creating new node (git-fixes).
• ring-buffer: Avoid softlockup in ringbufferresize() (git-fixes).
• ring-buffer: Do not attempt to read past 'commit' (git-fixes).
• ring-buffer: Fix bytes info in per_cpu buffer stats (git-fixes).
• ring-buffer: Update 'shortest_full' in polling (git-fixes).
• s390/cio: fix a memleak in cssallocsubchannel (git-fixes bsc#1216510).
• s390/pci: fix iommu bitmap allocation (git-fixes bsc#1216511).
• s390: add z16 elf platform (git-fixes LTC#203789 bsc#1215956 LTC#203788 bsc#1215957).
• sched/cpuset: Bring back cpuset_mutex (bsc#1215955).
• sched/deadline,rt: Remove unused parameter from picknext[rt|dl]_entity() (git fixes (sched)).
• sched/rt: Fix live lock between selectfallbackrq() and RT push (git fixes (sched)).
• sched/rt: Fix sysctlschedrr_timeslice intial value (git fixes (sched)).
• serial: 8250_port: Check IRQ data before use (git-fixes).
• soc: imx8m: Enable OCOTP clock for imx8mm before reading registers (git-fixes).
• spi: nxp-fspi: reset the FLSHxCR1 registers (git-fixes).
• spi: stm32: add a delay before SPI disable (git-fixes).
• spi: sun6i: fix race between DMA RX transfer completion and RX FIFO drain (git-fixes).
• spi: sun6i: reduce DMA RX transfer width to single byte (git-fixes).
• thunderbolt: Check that lane 1 is in CL0 before enabling lane bonding (git-fixes).
• thunderbolt: Workaround an IOMMU fault on certain systems with Intel Maple Ridge (git-fixes).
• tracing: Have current_trace inc the trace array ref count (git-fixes).
• tracing: Have event inject files inc the trace array ref count (git-fixes).
• tracing: Have option files inc the trace array ref count (git-fixes).
• tracing: Have tracingmaxlatency inc the trace array ref count (git-fixes).
• tracing: Increase trace array ref count on enable and filter files (git-fixes).
• tracing: Make tracemarker{,raw} stream-like (git-fixes).
• usb: cdnsp: Fixes issue with dequeuing not queued requests (git-fixes).
• usb: dwc3: Soft reset phy on probe for host (git-fixes).
• usb: gadget: ncm: Handle decoding of multiple NTB's in unwrap call (git-fixes).
• usb: gadget: udc-xilinx: replace memcpy with memcpy_toio (git-fixes).
• usb: musb: Get the musbqh poniter after musbgiveback (git-fixes).
• usb: musb: Modify the 'HWVers' register address (git-fixes).
• usb: typec: altmodes/displayport: Signal hpd low when exiting mode (git-fixes).
• usb: xhci: xhci-ring: Use sysdev for mapping bounce buffer (git-fixes).
• vmbus_testing: fix wrong python syntax for integer value comparison (git-fixes).
• vringh: do not use vringhkiovadvance() in vringhiovxfer() (git-fixes).
• watchdog: iTCO_wdt: No need to stop the timer in probe (git-fixes).
• watchdog: iTCOwdt: Set NOREBOOT if the watchdog is not already running (git-fixes).
• wifi: cfg80211: Fix 6GHz scan configuration (git-fixes).
• wifi: cfg80211: avoid leaking stack data into trace (git-fixes).
• wifi: iwlwifi: Ensure ack flag is properly cleared (git-fixes).
• wifi: iwlwifi: dbg_ini: fix structure packing (git-fixes).
• wifi: iwlwifi: mvm: Fix a memory corruption issue (git-fixes).
• wifi: mac80211: allow transmitting EAPOL frames with tainted key (git-fixes).
• wifi: mt76: mt76x02: fix MT76x0 external LNA gain handling (git-fixes).
• wifi: mwifiex: Fix oob check condition in mwifiexprocessrx_packet (git-fixes).
• wifi: mwifiex: Fix tlvbufleft calculation (git-fixes).
• wifi: mwifiex: Sanity check tlvlen and tlvbitmap_len (git-fixes).
• x86/cpu, kvm: Add the NONESTEDDATA_BP feature (bsc#1213772).
• x86/cpu, kvm: Add the Null Selector Clears Base feature (bsc#1213772).
• x86/cpu, kvm: Add the SMM_CTL MSR not present feature (bsc#1213772).
• x86/cpu, kvm: Move X86FEATURELFENCE_RDTSC to its native leaf (bsc#1213772).
• x86/cpu: Enable STIBP on AMD if Automatic IBRS is enabled (bsc#1213772).
• x86/cpu: Support AMD Automatic IBRS (bsc#1213772).
• x86/sev: Check IOBM for IOIO exceptions from user-space (bsc#1212649).
• x86/sev: Check for user-space IOIO pointing to kernel space (bsc#1212649).
• x86/sev: Disable MMIO emulation from user mode (bsc#1212649).
• xen-netback: use default TX queue size for vifs (git-fixes).