SB2023031726 - SUSE update for the Linux Kernel

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) NULL pointer dereference (CVE-ID: CVE-2022-3606)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error within the find_prog_by_sec_insn() function in tools/lib/bpf/libbpf.c of the BPF component. A local user can perform a denial of service (DoS) attack.

2) Integer overflow (CVE-ID: CVE-2023-0179)

The vulnerability allows a local  user to escalate privileges on the system.

The vulnerability exists due to an integer overflow within the nft_payload_copy_vlan() function in Linux kernel Netfilter. A local user can trigger an integer overflow and execute arbitrary code with elevated privileges.

Remediation

Install update from vendor's website.

References

• https://www.suse.com/support/update/announcement/2023/suse-su-20230409-1/