SUSE SLES12 Security Update : kernel (SUSE-SU-2023:3349-1)

high Nessus Plugin ID 179970

Language:

Synopsis

The remote SUSE host is missing one or more security updates.

Description

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3349-1 advisory.

- Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis, aka Speculative Store Bypass (SSB), Variant 4. (CVE-2018-3639)

- Information exposure through microarchitectural state after transient execution in certain vector execution units for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. (CVE-2022-40982)

- Copy_from_user on 64-bit versions of the Linux kernel does not implement the __uaccess_begin_nospec allowing a user to bypass the access_ok check and pass a kernel pointer to copy_from_user(). This would allow an attacker to leak information. We recommend upgrading beyond commit 74e19ef0ff8061ef55957c3abd71614ef0f42f47 (CVE-2023-0459)

- A side channel vulnerability on some of the AMD CPUs may allow an attacker to influence the return address prediction. This may result in speculative execution at an attacker-controlled?address, potentially leading to information disclosure. (CVE-2023-20569)

- An issue in Zen 2 CPUs, under specific microarchitectural circumstances, may allow an attacker to potentially access sensitive information. (CVE-2023-20593)

- A use after free flaw was found in hfsplus_put_super in fs/hfsplus/super.c in the Linux Kernel. This flaw could allow a local user to cause a denial of service problem. (CVE-2023-2985)

- Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm register contents when CAP_NET_ADMIN is in any user or network namespace (CVE-2023-35001)

- A use-after-free flaw was found in vcs_read in drivers/tty/vt/vc_screen.c in vc_screen in the Linux Kernel. This flaw allows an attacker with local user access to cause a system crash or leak internal kernel information. (CVE-2023-3567)

- A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation. If tcf_change_indev() fails, u32_set_parms() will immediately return an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability. We recommend upgrading past commit 04c55383fa5689357bcdd2c8036725a55ed632bc.
(CVE-2023-3609)

- An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation. The qfq_change_agg() function in net/sched/sch_qfq.c allows an out- of-bounds write because lmax is updated according to packet sizes without bounds checks. We recommend upgrading past commit 3e337087c3b5805fe0b8a46ba622a962880b5d64. (CVE-2023-3611)

- A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to achieve local privilege escalation. If tcf_change_indev() fails, fw_set_parms() will immediately return an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability. We recommend upgrading past commit 0323bce598eea038714f941ce2b22541c46d488f.
(CVE-2023-3776)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

See Also

https://bugzilla.suse.com/1087082

https://bugzilla.suse.com/1150305

https://bugzilla.suse.com/1173438

https://bugzilla.suse.com/1188885

https://bugzilla.suse.com/1202670

https://bugzilla.suse.com/1202716

https://bugzilla.suse.com/1205496

https://bugzilla.suse.com/1206418

https://bugzilla.suse.com/1207526

https://bugzilla.suse.com/1207528

https://bugzilla.suse.com/1207561

https://bugzilla.suse.com/1207617

https://bugzilla.suse.com/1207620

https://bugzilla.suse.com/1207629

https://bugzilla.suse.com/1207630

https://bugzilla.suse.com/1207633

https://bugzilla.suse.com/1207634

https://bugzilla.suse.com/1207653

https://bugzilla.suse.com/1208788

https://bugzilla.suse.com/1210584

https://bugzilla.suse.com/1210765

https://bugzilla.suse.com/1210766

https://bugzilla.suse.com/1210771

https://bugzilla.suse.com/1211738

https://bugzilla.suse.com/1211867

https://bugzilla.suse.com/1212266

https://bugzilla.suse.com/1212301

https://bugzilla.suse.com/1212657

https://bugzilla.suse.com/1212741

https://bugzilla.suse.com/1212835

https://bugzilla.suse.com/1212871

https://bugzilla.suse.com/1212905

https://bugzilla.suse.com/1212986

https://bugzilla.suse.com/1212987

https://bugzilla.suse.com/1212988

https://bugzilla.suse.com/1212989

https://bugzilla.suse.com/1212990

https://bugzilla.suse.com/1213010

https://bugzilla.suse.com/1213011

https://bugzilla.suse.com/1213012

https://bugzilla.suse.com/1213013

https://bugzilla.suse.com/1213014

https://bugzilla.suse.com/1213015

https://bugzilla.suse.com/1213017

https://bugzilla.suse.com/1213018

https://bugzilla.suse.com/1213019

https://bugzilla.suse.com/1213020

https://bugzilla.suse.com/1213021

https://bugzilla.suse.com/1213022

https://bugzilla.suse.com/1213023

https://bugzilla.suse.com/1213024

https://bugzilla.suse.com/1213025

https://bugzilla.suse.com/1213032

https://bugzilla.suse.com/1213033

https://bugzilla.suse.com/1213034

https://bugzilla.suse.com/1213035

https://bugzilla.suse.com/1213825

https://bugzilla.suse.com/1213827

https://lists.suse.com/pipermail/sle-updates/2023-August/031064.html

https://www.suse.com/security/cve/CVE-2018-3639

https://www.suse.com/security/cve/CVE-2022-40982

https://www.suse.com/security/cve/CVE-2023-0459

https://www.suse.com/security/cve/CVE-2023-20569

https://www.suse.com/security/cve/CVE-2023-20593

https://www.suse.com/security/cve/CVE-2023-2985

https://www.suse.com/security/cve/CVE-2023-35001

https://www.suse.com/security/cve/CVE-2023-3567

https://www.suse.com/security/cve/CVE-2023-3609

https://www.suse.com/security/cve/CVE-2023-3611

https://www.suse.com/security/cve/CVE-2023-3776

https://bugzilla.suse.com/1213036

https://bugzilla.suse.com/1213037

https://bugzilla.suse.com/1213038

https://bugzilla.suse.com/1213039

https://bugzilla.suse.com/1213040

https://bugzilla.suse.com/1213041

https://bugzilla.suse.com/1213042

https://bugzilla.suse.com/1213059

https://bugzilla.suse.com/1213133

https://bugzilla.suse.com/1213167

https://bugzilla.suse.com/1213215

https://bugzilla.suse.com/1213218

https://bugzilla.suse.com/1213221

https://bugzilla.suse.com/1213286

https://bugzilla.suse.com/1213287

https://bugzilla.suse.com/1213344

https://bugzilla.suse.com/1213346

https://bugzilla.suse.com/1213350

https://bugzilla.suse.com/1213525

https://bugzilla.suse.com/1213585

https://bugzilla.suse.com/1213586

https://bugzilla.suse.com/1213588

https://bugzilla.suse.com/1213705

https://bugzilla.suse.com/1213747

https://bugzilla.suse.com/1213766

https://bugzilla.suse.com/1213819

https://bugzilla.suse.com/1213823

Plugin Details

Severity: High

ID: 179970

File Name: suse_SU-2023-3349-1.nasl

Version: 1.0

Type: local

Agent: unix

Published: 8/18/2023

Updated: 8/18/2023

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Low

Base Score: 2.1

Temporal Score: 1.6

Vector: CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N

CVSS Score Source: CVE-2018-3639

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 7

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS Score Source: CVE-2023-3776

Vulnerability Information

CPE: cpe:/o:novell:suse_linux:12, p-cpe:/a:novell:suse_linux:kernel-source-azure, p-cpe:/a:novell:suse_linux:kernel-syms-azure, p-cpe:/a:novell:suse_linux:kernel-azure-base, p-cpe:/a:novell:suse_linux:kernel-azure-devel, p-cpe:/a:novell:suse_linux:kernel-devel-azure, p-cpe:/a:novell:suse_linux:kernel-azure

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 8/17/2023

Vulnerability Publication Date: 5/21/2018

Reference Information

CVE: CVE-2018-3639, CVE-2022-40982, CVE-2023-0459, CVE-2023-20569, CVE-2023-20593, CVE-2023-2985, CVE-2023-35001, CVE-2023-3567, CVE-2023-3609, CVE-2023-3611, CVE-2023-3776

SuSE: SUSE-SU-2023:3349-1