SUSE SLED15 / SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2024:0160-1)

high Nessus Plugin ID 189207

Language:

Synopsis

The remote SUSE host is missing one or more security updates.

Description

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0160-1 advisory.

- Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B through 5.2 may permit an unauthenticated nearby device to spoof the BD_ADDR of the peer device to complete pairing without knowledge of the PIN. (CVE-2020-26555)

- An out-of-bounds read vulnerability was found in the NVMe-oF/TCP subsystem in the Linux kernel. This issue may allow a remote attacker to send a crafted TCP packet, triggering a heap-based buffer overflow that results in kmalloc data being printed and potentially leaked to the kernel ring buffer (dmesg).
(CVE-2023-6121)

- A race condition was found in the GSM 0710 tty multiplexor in the Linux kernel. This issue occurs when two threads execute the GSMIOC_SETCONF ioctl on the same tty file descriptor with the gsm line discipline enabled, and can lead to a use-after-free problem on a struct gsm_dlci while restarting the gsm mux. This could allow a local unprivileged user to escalate their privileges on the system. (CVE-2023-6546)

- An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.
(CVE-2023-6606)

- An out-of-bounds read vulnerability was found in smb2_dump_detail in fs/smb/client/smb2ops.c in the Linux Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.
(CVE-2023-6610)

- A null pointer dereference vulnerability was found in nft_dynset_init() in net/netfilter/nft_dynset.c in nf_tables in the Linux kernel. This issue may allow a local attacker with CAP_NET_ADMIN user privilege to trigger a denial of service. (CVE-2023-6622)

- A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be exploited to achieve local privilege escalation. A perf_event's read_size can overflow, leading to an heap out-of-bounds increment or write in perf_read_group(). We recommend upgrading past commit 382c27f4ed28f803b1f1473ac2d8db0afc795a1b. (CVE-2023-6931)

- A use-after-free vulnerability in the Linux kernel's ipv4: igmp component can be exploited to achieve local privilege escalation. A race condition can be exploited to cause a timer be mistakenly registered on a RCU read locked object which is freed by another thread. We recommend upgrading past commit e2b706c691905fe78468c361aaabc719d0a496f1. (CVE-2023-6932)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

See Also

https://bugzilla.suse.com/1179610

https://bugzilla.suse.com/1183045

https://bugzilla.suse.com/1211162

https://bugzilla.suse.com/1211226

https://bugzilla.suse.com/1212139

https://bugzilla.suse.com/1212584

https://bugzilla.suse.com/1214117

https://bugzilla.suse.com/1214158

https://bugzilla.suse.com/1214747

https://bugzilla.suse.com/1214823

https://bugzilla.suse.com/1215237

https://bugzilla.suse.com/1215696

https://bugzilla.suse.com/1215885

https://bugzilla.suse.com/1215952

https://bugzilla.suse.com/1216032

https://bugzilla.suse.com/1216057

https://bugzilla.suse.com/1216559

https://bugzilla.suse.com/1216776

https://bugzilla.suse.com/1217036

https://bugzilla.suse.com/1217217

https://bugzilla.suse.com/1217250

https://bugzilla.suse.com/1217602

https://bugzilla.suse.com/1217692

https://bugzilla.suse.com/1217790

https://bugzilla.suse.com/1217801

https://bugzilla.suse.com/1217822

https://bugzilla.suse.com/1217927

https://bugzilla.suse.com/1217933

https://bugzilla.suse.com/1217938

https://bugzilla.suse.com/1217946

https://bugzilla.suse.com/1217947

https://bugzilla.suse.com/1217980

https://bugzilla.suse.com/1217981

https://bugzilla.suse.com/1217982

https://bugzilla.suse.com/1218056

https://bugzilla.suse.com/1218092

https://bugzilla.suse.com/1218139

https://bugzilla.suse.com/1218184

https://bugzilla.suse.com/1218229

https://bugzilla.suse.com/1218234

https://bugzilla.suse.com/1218253

https://bugzilla.suse.com/1218258

https://bugzilla.suse.com/1218335

https://bugzilla.suse.com/1218357

https://bugzilla.suse.com/1218397

https://bugzilla.suse.com/1218447

https://bugzilla.suse.com/1218461

https://bugzilla.suse.com/1218515

https://bugzilla.suse.com/1218559

https://bugzilla.suse.com/1218569

https://bugzilla.suse.com/1218643

https://bugzilla.suse.com/1218738

http://www.nessus.org/u?34dcd097

https://www.suse.com/security/cve/CVE-2020-26555

https://www.suse.com/security/cve/CVE-2023-51779

https://www.suse.com/security/cve/CVE-2023-6121

https://www.suse.com/security/cve/CVE-2023-6531

https://www.suse.com/security/cve/CVE-2023-6546

https://www.suse.com/security/cve/CVE-2023-6606

https://www.suse.com/security/cve/CVE-2023-6610

https://www.suse.com/security/cve/CVE-2023-6622

https://www.suse.com/security/cve/CVE-2023-6931

https://www.suse.com/security/cve/CVE-2023-6932

Plugin Details

Severity: High

ID: 189207

File Name: suse_SU-2024-0160-1.nasl

Version: 1.3

Type: local

Agent: unix

Published: 1/19/2024

Updated: 6/17/2024

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: High

Score: 8.9

CVSS v2

Risk Factor: Medium

Base Score: 4.8

Temporal Score: 4.2

Vector: CVSS2#AV:A/AC:L/Au:N/C:P/I:P/A:N

CVSS Score Source: CVE-2020-26555

CVSS v3

Risk Factor: High

Base Score: 7.1

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C

CVSS Score Source: CVE-2023-6610

Vulnerability Information

CPE: p-cpe:/a:novell:suse_linux:kernel-macros, p-cpe:/a:novell:suse_linux:kernel-zfcpdump, p-cpe:/a:novell:suse_linux:kernel-64kb-devel, p-cpe:/a:novell:suse_linux:ocfs2-kmp-default, p-cpe:/a:novell:suse_linux:dlm-kmp-default, p-cpe:/a:novell:suse_linux:kernel-default-base, p-cpe:/a:novell:suse_linux:kernel-default-livepatch, p-cpe:/a:novell:suse_linux:kernel-default-devel, p-cpe:/a:novell:suse_linux:kernel-devel, p-cpe:/a:novell:suse_linux:gfs2-kmp-default, p-cpe:/a:novell:suse_linux:kernel-syms, p-cpe:/a:novell:suse_linux:kernel-default-extra, cpe:/o:novell:suse_linux:15, p-cpe:/a:novell:suse_linux:kernel-livepatch-5_14_21-150500_55_44-default, p-cpe:/a:novell:suse_linux:reiserfs-kmp-default, p-cpe:/a:novell:suse_linux:kernel-default-livepatch-devel, p-cpe:/a:novell:suse_linux:cluster-md-kmp-default, p-cpe:/a:novell:suse_linux:kernel-obs-build, p-cpe:/a:novell:suse_linux:kernel-default, p-cpe:/a:novell:suse_linux:kernel-source, p-cpe:/a:novell:suse_linux:kernel-64kb

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 1/18/2024

Vulnerability Publication Date: 5/24/2021

Exploitable With

Core Impact

Reference Information

CVE: CVE-2020-26555, CVE-2023-51779, CVE-2023-6121, CVE-2023-6531, CVE-2023-6546, CVE-2023-6606, CVE-2023-6610, CVE-2023-6622, CVE-2023-6931, CVE-2023-6932

SuSE: SUSE-SU-2024:0160-1