SUSE update for the Linux Kernel

1) Out-of-bounds read

EUVDB-ID: #VU92900

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-4439

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the detach_capi_ctr() function in drivers/isdn/capi/kcapi.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Use-after-free

EUVDB-ID: #VU90232

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47103

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to a use-after-free error within the inet6_sk_rx_dst_set(), tcp_v6_do_rcv() and tcp_v6_early_demux() functions in net/ipv6/tcp_ipv6.c, within the udp_sk_rx_dst_set(), __udp4_lib_rcv() and udp_v4_early_demux() functions in net/ipv4/udp.c, within the tcp_v4_do_rcv(), tcp_v4_early_demux(), tcp_prequeue() and inet_sk_rx_dst_set() functions in net/ipv4/tcp_ipv4.c, within the tcp_rcv_established() function in net/ipv4/tcp_input.c, within the tcp_disconnect() function in net/ipv4/tcp.c, within the inet_sock_destruct() function in net/ipv4/af_inet.c. A local user can send specially crafted packets to the system, trigger a use-after-free error and potentially execute arbitrary code.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Out-of-bounds read

EUVDB-ID: #VU90325

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47191

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the resp_readcap16() function in drivers/scsi/scsi_debug.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Memory leak

EUVDB-ID: #VU90008

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47193

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the pm8001_init_ccb_tag(), pm8001_pci_remove() and remove() functions in drivers/scsi/pm8001/pm8001_init.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) NULL pointer dereference

EUVDB-ID: #VU90474

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47267

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the usb_assign_descriptors() function in drivers/usb/gadget/config.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) NULL pointer dereference

EUVDB-ID: #VU90484

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47270

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the tcm_bind() function in drivers/usb/gadget/function/f_tcm.c, within the geth_bind() function in drivers/usb/gadget/function/f_subset.c, within the usb_assign_descriptors() function in drivers/usb/gadget/function/f_sourcesink.c, within the gser_bind() function in drivers/usb/gadget/function/f_serial.c, within the rndis_bind() function in drivers/usb/gadget/function/f_rndis.c, within the usb_assign_descriptors() function in drivers/usb/gadget/function/f_printer.c, within the usb_assign_descriptors() function in drivers/usb/gadget/function/f_loopback.c, within the eem_bind() function in drivers/usb/gadget/function/f_eem.c, within the ecm_bind() function in drivers/usb/gadget/function/f_ecm.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Input validation error

EUVDB-ID: #VU94124

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47293

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the tcf_skbmod_act() function in net/sched/act_skbmod.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Resource management error

EUVDB-ID: #VU93279

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47294

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the nr_heartbeat_expiry(), nr_t2timer_expiry(), nr_t4timer_expiry(), nr_idletimer_expiry() and nr_t1timer_expiry() functions in net/netrom/nr_timer.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Use of uninitialized resource

EUVDB-ID: #VU90870

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47297

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the caif_seqpkt_sendmsg() function in net/caif/caif_socket.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Out-of-bounds read

EUVDB-ID: #VU90299

Risk: Low

CVSSv3.1: 3.2 [AV:L/AC:L/PR:L/UI:U/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47309

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the include/net/dst_metadata.h. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Use-after-free

EUVDB-ID: #VU91060

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47328

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the iscsi_prep_bidi_ahs(), iscsi_check_tmf_restrictions(), iscsi_data_in_rsp(), EXPORT_SYMBOL_GPL(), iscsi_exec_task_mgmt_fn(), iscsi_eh_abort(), iscsi_eh_device_reset(), iscsi_session_recovery_timedout(), iscsi_conn_failure(), iscsi_eh_target_reset(), iscsi_session_setup(), iscsi_conn_setup(), iscsi_conn_teardown(), iscsi_conn_start() and iscsi_start_session_recovery() functions in drivers/scsi/libiscsi.c. A local user can escalate privileges on the system.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Improper locking

EUVDB-ID: #VU93454

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47354

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the drm_sched_entity_kill_jobs_cb() function in drivers/gpu/drm/scheduler/sched_entity.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Use-after-free

EUVDB-ID: #VU90136

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47372

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the macb_remove() function in drivers/net/ethernet/cadence/macb_pci.c. A local user can escalate privileges on the system.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Use-after-free

EUVDB-ID: #VU90139

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47379

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the spin_lock_irq() and blkcg_deactivate_policy() functions in block/blk-cgroup.c. A local user can escalate privileges on the system.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) NULL pointer dereference

EUVDB-ID: #VU93054

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47407

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the kvm_arch_free_vm() and kvm_arch_init_vm() functions in arch/x86/kvm/x86.c, within the kvm_page_track_cleanup() function in arch/x86/kvm/mmu/page_track.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) NULL pointer dereference

EUVDB-ID: #VU90505

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47418

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the fifo_set_limit() function in net/sched/sch_fifo.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

17) Buffer overflow

EUVDB-ID: #VU93139

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47434

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the xhci_handle_stopped_cmd_ring() function in drivers/usb/host/xhci-ring.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

18) NULL pointer dereference

EUVDB-ID: #VU90407

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47445

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the msm_edp_ctrl_power() and msm_edp_ctrl_init() functions in drivers/gpu/drm/msm/edp/edp_ctrl.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

19) NULL pointer dereference

EUVDB-ID: #VU90531

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47518

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the nfc_genl_dump_ses_done() function in net/nfc/netlink.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

20) Buffer overflow

EUVDB-ID: #VU93138

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47544

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the include/net/sock.h. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

21) Buffer overflow

EUVDB-ID: #VU93289

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47566

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the read_from_oldmem() function in fs/proc/vmcore.c. A local user can escalate privileges on the system.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

22) Use-after-free

EUVDB-ID: #VU91051

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47571

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the _rtl92e_pci_disconnect() function in drivers/staging/rtl8192e/rtl8192e/rtl_core.c. A local user can escalate privileges on the system.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

23) Use-after-free

EUVDB-ID: #VU92299

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47576

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the resp_mode_select() function in drivers/scsi/scsi_debug.c. A local user can escalate privileges on the system.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

24) Improper locking

EUVDB-ID: #VU92353

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47587

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the tdma_port_write_desc_addr() and bcm_sysport_open() functions in drivers/net/ethernet/broadcom/bcmsysport.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

25) Use-after-free

EUVDB-ID: #VU92300

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47589

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the igbvf_probe() function in drivers/net/ethernet/intel/igbvf/netdev.c. A local user can escalate privileges on the system.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

26) Use-after-free

EUVDB-ID: #VU92303

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47600

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the rebalance_children() function in drivers/md/persistent-data/dm-btree-remove.c. A local user can escalate privileges on the system.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

27) Use of uninitialized resource

EUVDB-ID: #VU92372

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47602

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the ieee80211_sta_tx_wmm_ac_notify() function in net/mac80211/mlme.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

28) Improper locking

EUVDB-ID: #VU92355

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47603

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the kauditd_send_queue() and audit_net_init() functions in kernel/audit.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

29) Buffer overflow

EUVDB-ID: #VU93303

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47609

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the scpi_pm_domain_probe() function in drivers/firmware/scpi_pm_domain.c. A local user can escalate privileges on the system.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

30) Infinite loop

EUVDB-ID: #VU92929

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47617

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop within the pciehp_ist() function in drivers/pci/hotplug/pciehp_hpc.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

31) Input validation error

EUVDB-ID: #VU92925

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48711

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the tipc_mon_rcv() function in net/tipc/monitor.c, within the tipc_link_proto_rcv() function in net/tipc/link.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

32) Resource management error

EUVDB-ID: #VU93180

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48715

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the bnx2fc_l2_rcv_thread() and bnx2fc_recv_frame() functions in drivers/scsi/bnx2fc/bnx2fc_fcoe.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

33) Memory leak

EUVDB-ID: #VU92892

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48722

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the ca8210_async_xmit_complete() function in drivers/net/ieee802154/ca8210.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

34) Off-by-one

EUVDB-ID: #VU92927

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48732

CWE-ID: CWE-193 - Off-by-one Error

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an off-by-one error within the nvbios_addr() function in drivers/gpu/drm/nouveau/nvkm/subdev/bios/base.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

35) Use-after-free

EUVDB-ID: #VU92895

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48733

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the btrfs_wait_delalloc_flush() and btrfs_commit_transaction() functions in fs/btrfs/transaction.c, within the create_snapshot() function in fs/btrfs/ioctl.c. A local user can escalate privileges on the system.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

36) NULL pointer dereference

EUVDB-ID: #VU92909

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48740

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the cond_list_destroy() and cond_read_list() functions in security/selinux/ss/conditional.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

37) Integer underflow

EUVDB-ID: #VU92928

Risk: Low

CVSSv3.1: 6.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48743

CWE-ID: CWE-191 - Integer underflow

Exploit availability: No

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer underflow within the xgbe_rx_buf2_len() function in drivers/net/ethernet/amd/xgbe/xgbe-drv.c. A local user can execute arbitrary code.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

38) Use-after-free

EUVDB-ID: #VU92898

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48754

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the phy_detach() function in drivers/net/phy/phy_device.c. A local user can escalate privileges on the system.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

39) NULL pointer dereference

EUVDB-ID: #VU92915

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48756

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the msm_dsi_phy_driver_unregister() function in drivers/gpu/drm/msm/dsi/phy/dsi_phy.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

40) Resource management error

EUVDB-ID: #VU92960

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48758

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the bnx2fc_bind_pcidev(), bnx2fc_indicate_netevent(), bnx2fc_vport_destroy(), bnx2fc_if_create(), __bnx2fc_destroy(), bnx2fc_destroy_work() and bnx2fc_ulp_exit() functions in drivers/scsi/bnx2fc/bnx2fc_fcoe.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

41) Race condition

EUVDB-ID: #VU92931

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48759

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition within the rpmsg_ctrldev_release_device(), rpmsg_chrdev_probe() and rpmsg_chrdev_remove() functions in drivers/rpmsg/rpmsg_char.c. A local user can escalate privileges on the system.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

42) Buffer overflow

EUVDB-ID: #VU92976

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48760

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the usb_kill_urb() and usb_poison_urb() functions in drivers/usb/core/urb.c, within the __usb_hcd_giveback_urb() function in drivers/usb/core/hcd.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

43) Resource management error

EUVDB-ID: #VU92979

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48761

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the xhci_plat_suspend() function in drivers/usb/host/xhci-plat.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

44) Use-after-free

EUVDB-ID: #VU92899

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48771

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the vmw_kms_helper_buffer_finish() function in drivers/gpu/drm/vmwgfx/vmwgfx_kms.c, within the vmw_fence_event_ioctl() function in drivers/gpu/drm/vmwgfx/vmwgfx_fence.c, within the vmw_execbuf_fence_commands(), vmw_execbuf_copy_fence_user() and vmw_execbuf_process() functions in drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c. A local user can escalate privileges on the system.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

45) NULL pointer dereference

EUVDB-ID: #VU93327

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48772

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the lgdt3306a_probe() function in drivers/media/dvb-frontends/lgdt3306a.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

46) Improper Verification of Cryptographic Signature

EUVDB-ID: #VU83116

Risk: Medium

CVSSv3.1: 6.1 [CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C]

CVE-ID: CVE-2023-24023

CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature

Exploit availability: No

The vulnerability allows a remote attacker to perform a MitM attack.

The vulnerability exists due to improper verification of cryptographic signature in bluetooth implementation. A remote attacker with physical proximity to the system can perform MitM attack and potentially compromise the system.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

47) Buffer overflow

EUVDB-ID: #VU93471

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52622

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the alloc_flex_gd() and ext4_setup_next_flex_gd() functions in fs/ext4/resize.c. A local user can escalate privileges on the system.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

48) NULL pointer dereference

EUVDB-ID: #VU90547

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52675

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the update_events_in_group() function in arch/powerpc/perf/imc-pmu.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

49) Improper locking

EUVDB-ID: #VU90740

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52737

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the extent_fiemap() and unlock_extent() functions in fs/btrfs/extent_io.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

50) Use-after-free

EUVDB-ID: #VU90068

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52752

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the seq_printf() and spin_unlock() functions in fs/smb/client/cifs_debug.c. A local user can escalate privileges on the system.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

51) Input validation error

EUVDB-ID: #VU90854

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52754

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the imon_probe() function in drivers/media/rc/imon.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

52) Use-after-free

EUVDB-ID: #VU90069

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52757

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the alloc_mid() function in fs/smb/client/transport.c, within the __smb2_handle_cancelled_cmd() function in fs/smb/client/smb2misc.c, within the cifs_compose_mount_options(), __release_mid() and cifs_get_tcon_super() functions in fs/smb/client/cifsproto.h. A local user can escalate privileges on the system.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

53) Buffer overflow

EUVDB-ID: #VU93622

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52762

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the virtblk_probe() function in drivers/block/virtio_blk.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

54) Out-of-bounds read

EUVDB-ID: #VU90278

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52764

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the set_flicker() function in drivers/media/usb/gspca/cpia1.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

55) Improper error handling

EUVDB-ID: #VU93650

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52784

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the bond_setup_by_slave() function in drivers/net/bonding/bond_main.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

56) NULL pointer dereference

EUVDB-ID: #VU90420

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52808

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the debugfs_bist_init_v3_hw() and debugfs_init_v3_hw() functions in drivers/scsi/hisi_sas/hisi_sas_v3_hw.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

57) NULL pointer dereference

EUVDB-ID: #VU90419

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52809

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the fc_lport_ptp_setup() function in drivers/scsi/libfc/fc_lport.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

58) Integer overflow

EUVDB-ID: #VU91425

Risk: Low

CVSSv3.1: 6.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52832

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer overflow within the ieee80211_get_tx_power() function in net/mac80211/cfg.c. A local user can execute arbitrary code.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

59) Buffer overflow

EUVDB-ID: #VU93304

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52834

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the atl1c_set_mac_addr(), atl1c_init_ring_ptrs(), atl1c_free_ring_resources(), atl1c_rx_checksum() and atl1c_alloc_rx_buffer() functions in drivers/net/ethernet/atheros/atl1c/atl1c_main.c. A local user can escalate privileges on the system.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

60) Out-of-bounds read

EUVDB-ID: #VU91084

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52835

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the rb_alloc_aux() function in kernel/events/ring_buffer.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

61) Use of uninitialized resource

EUVDB-ID: #VU90868

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52843

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the llc_station_ac_send_test_r() function in net/llc/llc_station.c, within the llc_sap_action_send_test_r() function in net/llc/llc_s_ac.c, within the llc_fixup_skb() function in net/llc/llc_input.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

62) Use of uninitialized resource

EUVDB-ID: #VU90867

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52845

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the net/tipc/netlink.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

63) NULL pointer dereference

EUVDB-ID: #VU90435

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52855

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the drivers/usb/dwc2/hcd.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

64) Spoofing attack

EUVDB-ID: #VU89895

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52881

CWE-ID: CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)

Exploit availability: No

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to an error within the tcp_ack() function in net/ipv4/tcp_input.c, which can result in system accepting ACK responses for bytes that were never sent. A remote attacker can perform spoofing attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

65) Input validation error

EUVDB-ID: #VU89267

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26633

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to an error in NEXTHDR_FRAGMENT handling within the ip6_tnl_parse_tlv_enc_lim() function in net/ipv6/ip6_tunnel.c. A remote attacker can send specially crafted packets to the system and perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

66) Access of Uninitialized Pointer

EUVDB-ID: #VU89396

Risk: Medium

CVSSv3.1: 5.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26641

CWE-ID: CWE-824 - Access of Uninitialized Pointer

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to access to uninitialized data within the __ip6_tnl_rcv() function in net/ipv6/ip6_tunnel.c. A remote attacker can send specially crafted data to the system and perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

67) Improper locking

EUVDB-ID: #VU92044

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26679

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the EXPORT_SYMBOL() function in net/ipv4/af_inet.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

68) Improper locking

EUVDB-ID: #VU92043

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26687

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the shutdown_pirq() and __unbind_from_irq() functions in drivers/xen/events/events_base.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

69) Division by zero

EUVDB-ID: #VU91379

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26720

CWE-ID: CWE-369 - Divide By Zero

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a division by zero error within the wb_dirty_limits() function in mm/page-writeback.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

70) NULL pointer dereference

EUVDB-ID: #VU90588

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26813

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the vfio_platform_set_irq_unmask(), vfio_automasked_irq_handler(), vfio_irq_handler(), vfio_set_trigger(), vfio_platform_set_irq_trigger(), vfio_platform_set_irqs_ioctl(), vfio_platform_irq_init() and vfio_platform_irq_cleanup() functions in drivers/vfio/platform/vfio_platform_irq.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

71) Improper locking

EUVDB-ID: #VU93388

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26845

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the transport_generic_handle_tmr() function in drivers/target/target_core_transport.c, within the transport_lookup_tmr_lun() and rcu_dereference_raw() functions in drivers/target/target_core_device.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

72) Use of uninitialized resource

EUVDB-ID: #VU90877

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26863

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the hsr_get_node() function in net/hsr/hsr_framereg.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

73) Memory leak

EUVDB-ID: #VU90002

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26894

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the acpi_processor_power_exit() function in drivers/acpi/processor_idle.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

74) Use-after-free

EUVDB-ID: #VU90192

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26928

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error within the cifs_debug_files_proc_show() function in fs/smb/client/cifs_debug.c. A remote non-authenticated attacker can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

75) Information disclosure

EUVDB-ID: #VU91360

Risk: Low

CVSSv3.1: 2.9 [AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26973

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to information disclosure within the fat_encode_fh_nostale() function in fs/fat/nfs.c. A local user can gain access to sensitive information.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

76) NULL pointer dereference

EUVDB-ID: #VU89673

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-27399

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dreference error within the l2cap_chan_timeout() function in net/bluetooth/l2cap_core.c. A remote attacker can send specially crafted packets to the system and perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

77) Resource management error

EUVDB-ID: #VU93870

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-27410

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources within the nl80211_set_interface() function in net/wireless/nl80211.c. A local user can manipulate with the interface mesh ID and perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

78) NULL pointer dereference

EUVDB-ID: #VU93122

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35247

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the fpga_region_get(), fpga_region_put(), ATTRIBUTE_GROUPS(), fpga_region_register_full(), ERR_PTR() and EXPORT_SYMBOL_GPL() functions in drivers/fpga/fpga-region.c, within the fpga_region_register_full() function in Documentation/driver-api/fpga/fpga-region.rst. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

79) Resource management error

EUVDB-ID: #VU93270

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35807

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the EXT4_DESC_PER_BLOCK() function in fs/ext4/resize.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

80) Improper locking

EUVDB-ID: #VU93464

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35822

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the usb_ep_queue() function in drivers/usb/gadget/udc/core.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

81) Double free

EUVDB-ID: #VU90923

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35835

CWE-ID: CWE-415 - Double Free

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a double free error within the arfs_create_groups() function in drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

82) Use-after-free

EUVDB-ID: #VU90152

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35862

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error within the smb2_is_network_name_deleted() function in fs/smb/client/smb2ops.c. A remote non-authenticated attacker can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

83) Use-after-free

EUVDB-ID: #VU90151

Risk: Medium

CVSSv3.1: 5 [AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35863

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error within the is_valid_oplock_break() function in fs/smb/client/misc.c. A remote non-authenticated attacker can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

84) Use-after-free

EUVDB-ID: #VU90149

Risk: Medium

CVSSv3.1: 5 [AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35864

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error within the smb2_is_valid_lease_break() function in fs/smb/client/smb2misc.c. A remote non-authenticated attacker can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

85) Use-after-free

EUVDB-ID: #VU90148

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35865

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error within the smb2_is_valid_oplock_break() function in fs/smb/client/smb2misc.c. A remote non-authenticated attacker can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

86) Use-after-free

EUVDB-ID: #VU90154

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35867

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error within the cifs_stats_proc_show() function in fs/smb/client/cifs_debug.c. A remote non-authenticated attacker can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

87) Use-after-free

EUVDB-ID: #VU90155

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35868

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error within the cifs_stats_proc_write() function in fs/smb/client/cifs_debug.c. A remote non-authenticated attacker can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

88) Use-after-free

EUVDB-ID: #VU90158

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35870

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error within the cifs_mark_tcp_ses_conns_for_reconnect() and cifs_find_smb_ses() functions in fs/smb/client/connect.c. A remote non-authenticated attacker can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

89) Infinite loop

EUVDB-ID: #VU91413

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35886

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop within the inet6_dump_fib() function in net/ipv6/ip6_fib.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

90) Out-of-bounds read

EUVDB-ID: #VU90309

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35896

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the do_replace() and compat_do_replace() functions in net/ipv6/netfilter/ip6_tables.c, within the do_replace() and compat_do_replace() functions in net/ipv4/netfilter/ip_tables.c, within the do_replace() and compat_do_replace() functions in net/ipv4/netfilter/arp_tables.c, within the do_replace(), update_counters() and compat_update_counters() functions in net/bridge/netfilter/ebtables.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

91) Division by zero

EUVDB-ID: #VU91372

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35922

CWE-ID: CWE-369 - Divide By Zero

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a division by zero error within the fb_get_mode() and fb_videomode_from_videomode() functions in drivers/video/fbdev/core/fbmon.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

92) Division by zero

EUVDB-ID: #VU91373

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35925

CWE-ID: CWE-369 - Divide By Zero

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a division by zero error within the blk_rq_stat_init() function in block/blk-stat.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

93) Memory leak

EUVDB-ID: #VU89976

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35930

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the lpfc_rcv_padisc() function in drivers/scsi/lpfc/lpfc_nportdisc.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

94) Use-after-free

EUVDB-ID: #VU92212

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35950

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the drm_client_modeset_probe() function in drivers/gpu/drm/drm_client_modeset.c. A local user can escalate privileges on the system.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

95) Information disclosure

EUVDB-ID: #VU91343

Risk: Low

CVSSv3.1: 2.9 [AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35956

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to information disclosure within the btrfs_subvolume_reserve_metadata() function in fs/btrfs/root-tree.c, within the create_subvol() and create_snapshot() functions in fs/btrfs/ioctl.c, within the btrfs_delete_subvolume() and btrfs_end_transaction() functions in fs/btrfs/inode.c. A local user can gain access to sensitive information.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

96) Resource management error

EUVDB-ID: #VU93255

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35958

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the ena_unmap_tx_buff() and ena_free_tx_bufs() functions in drivers/net/ethernet/amazon/ena/ena_netdev.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

97) Improper Initialization

EUVDB-ID: #VU93351

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35960

CWE-ID: CWE-665 - Improper Initialization

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper initialization within the add_rule_fg() function in drivers/net/ethernet/mellanox/mlx5/core/fs_core.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

98) Input validation error

EUVDB-ID: #VU93176

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35962

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the do_replace() and compat_do_replace() functions in net/ipv6/netfilter/ip6_tables.c, within the do_replace() and compat_do_replace() functions in net/ipv4/netfilter/ip_tables.c, within the do_replace() and compat_do_replace() functions in net/ipv4/netfilter/arp_tables.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

99) Out-of-bounds read

EUVDB-ID: #VU90305

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35976

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the xsk_setsockopt() function in net/xdp/xsk.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

100) Use-after-free

EUVDB-ID: #VU90144

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35979

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the raid1_write_request() function in drivers/md/raid1.c. A local user can escalate privileges on the system.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

101) Infinite loop

EUVDB-ID: #VU91412

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35997

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop within the __i2c_hid_command() and i2c_hid_irq() functions in drivers/hid/i2c-hid/i2c-hid-core.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

102) Improper locking

EUVDB-ID: #VU90749

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35998

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the cifs_sync_mid_result() function in fs/smb/client/transport.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

103) Out-of-bounds write

EUVDB-ID: #VU89898

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36016

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error within the gsm0_receive() function in drivers/tty/n_gsm.c. A local user can trigger an out-of-bounds write and execute arbitrary code with elevated privileges.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

104) Out-of-bounds read

EUVDB-ID: #VU93081

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36017

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the do_setvfinfo() function in net/core/rtnetlink.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

105) Off-by-one

EUVDB-ID: #VU91172

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36025

CWE-ID: CWE-193 - Off-by-one Error

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an off-by-one error within the qla_edif_app_getstats() function in drivers/scsi/qla2xxx/qla_edif.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

106) NULL pointer dereference

EUVDB-ID: #VU93123

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36479

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the fpga_bridge_disable(), of_fpga_bridge_get(), fpga_bridge_dev_match(), fpga_bridge_get(), fpga_bridge_put(), ATTRIBUTE_GROUPS(), fpga_bridge_register() and ERR_PTR() functions in drivers/fpga/fpga-bridge.c, within the fpga_bridge_register() function in Documentation/driver-api/fpga/fpga-bridge.rst. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

107) Input validation error

EUVDB-ID: #VU90850

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36880

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the qca_send_pre_shutdown_cmd(), qca_tlv_check_data() and qca_download_firmware() functions in drivers/bluetooth/btqca.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

108) Improper locking

EUVDB-ID: #VU90735

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36894

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the ffs_user_copy_worker() and ffs_epfile_async_io_complete() functions in drivers/usb/gadget/function/f_fs.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

109) Out-of-bounds read

EUVDB-ID: #VU90268

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36915

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the nfc_llcp_setsockopt() function in net/nfc/llcp_sock.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

110) Buffer overflow

EUVDB-ID: #VU92094

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36917

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the blk_ioctl_discard() function in block/ioctl.c. A local user can escalate privileges on the system.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

111) Improper locking

EUVDB-ID: #VU92010

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36919

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the bnx2fc_free_session_resc() function in drivers/scsi/bnx2fc/bnx2fc_tgt.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-rt: before 4.12.14-10.191.1

kernel-rt_debug: before 4.12.14-10.191.1

kernel-devel-rt: before 4.12.14-10.191.1

kernel-source-rt: before 4.12.14-10.191.1

cluster-md-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel: before 4.12.14-10.191.1

kernel-rt-base-debuginfo: before 4.12.14-10.191.1

kernel-rt-devel-debuginfo: before 4.12.14-10.191.1

dlm-kmp-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-debugsource: before 4.12.14-10.191.1

kernel-rt_debug-debuginfo: before 4.12.14-10.191.1

kernel-rt-base: before 4.12.14-10.191.1

kernel-rt-debugsource: before 4.12.14-10.191.1

dlm-kmp-rt: before 4.12.14-10.191.1

kernel-rt-devel: before 4.12.14-10.191.1

ocfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

ocfs2-kmp-rt: before 4.12.14-10.191.1

kernel-rt_debug-devel-debuginfo: before 4.12.14-10.191.1

cluster-md-kmp-rt-debuginfo: before 4.12.14-10.191.1

kernel-syms-rt: before 4.12.14-10.191.1

kernel-rt-debuginfo: before 4.12.14-10.191.1

gfs2-kmp-rt-debuginfo: before 4.12.14-10.191.1

http://www.suse.com/support/update/announcement/2024/suse-su-20242381-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

112) Use of uninitialized resource

EUVDB-ID: #VU90864

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36923

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the v9fs_evict_inode() function in fs/9p/vfs_inode.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Real Time 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5