SUSE update for the Linux Kernel

1) Security features bypass

EUVDB-ID: #VU53579

Risk: Low

CVSSv3.1: 4.7 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-26558

CWE-ID: CWE-254 - Security Features

Exploit availability: No

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to an impersonation in the Passkey Entry protocol flaw. A remote attacker on the local network can perform a man-in-the-middle (MITM) attack and impersonate the initiating device without any previous knowledge.

Note: This vulnerability affects the following specifications:

• BR/EDR Secure Simple Pairing in Bluetooth Core Specifications 2.1 through 5.2
• BR/EDR Secure Connections Pairing in Bluetooth Core Specifications 4.1 through 5.2 
• LE Secure Connections Pairing in Bluetooth Core Specifications 4.2 through 5.2

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Improper access control

EUVDB-ID: #VU54202

Risk: Low

CVSSv3.1: 5.6 [CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-0129

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. A remote authenticated attacker on the local network can bypass implemented security restrictions and enable information disclosure

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Improper error handling

EUVDB-ID: #VU93654

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47145

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the link_to_fixup_dir() function in fs/btrfs/tree-log.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Out-of-bounds read

EUVDB-ID: #VU90325

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47191

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the resp_readcap16() function in drivers/scsi/scsi_debug.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Improper initialization

EUVDB-ID: #VU92392

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47194

CWE-ID: CWE-665 - Improper Initialization

Exploit availability: No

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to improper initialization error within the cfg80211_change_iface() function in net/wireless/util.c. A local user can execute arbitrary code.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) NULL pointer dereference

EUVDB-ID: #VU93057

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47197

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the mlx5_debug_cq_remove() function in drivers/net/ethernet/mellanox/mlx5/core/debugfs.c, within the mlx5_core_destroy_cq() function in drivers/net/ethernet/mellanox/mlx5/core/cq.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Resource management error

EUVDB-ID: #VU92971

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47201

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the iavf_disable_vf() function in drivers/net/ethernet/intel/iavf/iavf_main.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Out-of-bounds read

EUVDB-ID: #VU90324

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47219

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the resp_report_tgtpgs() function in drivers/scsi/scsi_debug.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) NULL pointer dereference

EUVDB-ID: #VU93052

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47275

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the cached_dev_cache_miss() function in drivers/md/bcache/request.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Memory leak

EUVDB-ID: #VU89955

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47295

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the tcindex_filter_result_init() and tcindex_partial_destroy_work() functions in net/sched/cls_tcindex.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Use-after-free

EUVDB-ID: #VU90140

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47388

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the ieee80211_crypto_ccmp_decrypt() and ieee80211_crypto_gcmp_decrypt() functions in net/mac80211/wpa.c. A local user can escalate privileges on the system.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Resource management error

EUVDB-ID: #VU93467

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47395

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the ieee80211_parse_tx_radiotap() function in net/mac80211/tx.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) NULL pointer dereference

EUVDB-ID: #VU90502

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47399

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the ixgbe_xdp_setup() function in drivers/net/ethernet/intel/ixgbe/ixgbe_main.c, within the ixgbe_max_channels() function in drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Memory leak

EUVDB-ID: #VU91623

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47403

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the ipoctal_port_activate() and ipoctal_cleanup() functions in drivers/ipack/devices/ipoctal.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) Memory leak

EUVDB-ID: #VU89966

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47405

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the hid_ctrl() and usbhid_stop() functions in drivers/hid/usbhid/hid-core.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) Memory leak

EUVDB-ID: #VU89935

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47438

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the mlx5_core_destroy_cq() function in drivers/net/ethernet/mellanox/mlx5/core/cq.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

17) Out-of-bounds read

EUVDB-ID: #VU90277

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47441

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the MLXSW_THERMAL_TEMP_SCORE_MAX GENMASK(), mlxsw_thermal_set_cur_state() and mlxsw_thermal_init() functions in drivers/net/ethernet/mellanox/mlxsw/core_thermal.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

18) Improper locking

EUVDB-ID: #VU92012

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47468

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the nj_release() function in drivers/isdn/hardware/mISDN/netjet.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

19) Resource management error

EUVDB-ID: #VU92964

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47498

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the dm_mq_queue_rq() function in drivers/md/dm-rq.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

20) NULL pointer dereference

EUVDB-ID: #VU90392

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47501

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the i40e_dbg_dump_desc() function in drivers/net/ethernet/intel/i40e/i40e_debugfs.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

21) Memory leak

EUVDB-ID: #VU89924

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47516

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the nfp_cpp_area_cache_add() function in drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

22) Use-after-free

EUVDB-ID: #VU91053

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47520

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the pch_can_rx_normal() function in drivers/net/can/pch_can.c. A local user can escalate privileges on the system.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

23) NULL pointer dereference

EUVDB-ID: #VU90396

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47542

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the qlcnic_83xx_add_rings() function in drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

24) Out-of-bounds read

EUVDB-ID: #VU91080

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47547

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the mii_get_phy() function in drivers/net/ethernet/dec/tulip/de4x5.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

25) NULL pointer dereference

EUVDB-ID: #VU90532

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47559

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the smc_link_down_work() and smc_vlan_by_tcpsk() functions in net/smc/smc_core.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

26) Out-of-bounds read

EUVDB-ID: #VU92318

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47580

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the p_fill_from_dev_buffer(), resp_inquiry(), resp_requests(), resp_mode_sense(), resp_ie_l_pg(), resp_log_sense() and resp_report_zones() functions in drivers/scsi/scsi_debug.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

27) Resource management error

EUVDB-ID: #VU93277

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47582

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the usbdev_release(), do_proc_control() and do_proc_bulk() functions in drivers/usb/core/devio.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

28) Integer underflow

EUVDB-ID: #VU92374

Risk: Low

CVSSv3.1: 6.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47588

CWE-ID: CWE-191 - Integer underflow

Exploit availability: No

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer underflow within the sit_init_net() function in net/ipv6/sit.c. A local user can execute arbitrary code.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

29) Use of uninitialized resource

EUVDB-ID: #VU92934

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47597

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the inet_sk_diag_fill() function in net/ipv4/inet_diag.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

30) Double free

EUVDB-ID: #VU93763

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47599

CWE-ID: CWE-415 - Double Free

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a double free error within the btrfs_unfreeze() function in fs/btrfs/super.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

31) Improper locking

EUVDB-ID: #VU92356

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47606

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the netlink_sendmsg() function in net/netlink/af_netlink.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

32) NULL pointer dereference

EUVDB-ID: #VU92919

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47619

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the i40e_get_lump() function in drivers/net/ethernet/intel/i40e/i40e_main.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

33) Out-of-bounds read

EUVDB-ID: #VU67473

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-20368

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary condition within the packet_recvmsg() function in Linux kernel. A local user can trigger an out-of-bounds read error and potentially escalate privileges on the system.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

34) Memory leak

EUVDB-ID: #VU63419

Risk: Low

CVSSv3.1: 4.6 [CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-28748

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows an attacker to gain access to sensitive information.

The vulnerability exists due memory leak when working with ax88179_178a devices. An attacker with physical access to the system can inject a malicious USB-drive and remotely obtain data from kernel memory.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

35) Out-of-bounds write

EUVDB-ID: #VU67811

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-2964

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error within the ASIX AX88179_178A-based USB 2.0/3.0 Gigabit Ethernet Devices driver in Linux kernel. A local user can trigger an out-of-bounds write and execute arbitrary code with elevated privileges.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

36) Memory leak

EUVDB-ID: #VU94408

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48775

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the vmbus_add_channel_kobj() function in drivers/hv/vmbus_drv.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

37) Use-after-free

EUVDB-ID: #VU94420

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48792

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the mpi_ssp_completion() and mpi_sata_completion() functions in drivers/scsi/pm8001/pm80xx_hwi.c. A local user can escalate privileges on the system.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

38) Memory leak

EUVDB-ID: #VU94406

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48794

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the at86rf230_async_error_recover_complete() and at86rf230_async_error_recover() functions in drivers/net/ieee802154/at86rf230.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

39) Out-of-bounds read

EUVDB-ID: #VU94431

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48804

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the vt_ioctl() function in drivers/tty/vt/vt_ioctl.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

40) Out-of-bounds read

EUVDB-ID: #VU94432

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48805

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the ax88179_rx_fixup() function in drivers/net/usb/ax88179_178a.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

41) Improper locking

EUVDB-ID: #VU94453

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48810

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the ip6mr_rules_init() function in net/ipv6/ip6mr.c, within the ipmr_rules_init() function in net/ipv4/ipmr.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

42) NULL pointer dereference

EUVDB-ID: #VU94444

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48811

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the init_crq_queue(), __ibmvnic_open() and ibmvnic_open() functions in drivers/net/ethernet/ibm/ibmvnic.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

43) Incorrect calculation

EUVDB-ID: #VU94488

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48823

CWE-ID: CWE-682 - Incorrect Calculation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to incorrect calculation within the qedf_initiate_cleanup() function in drivers/scsi/qedf/qedf_io.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

44) Improper locking

EUVDB-ID: #VU94451

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48826

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the vc4_dsi_host_attach() and vc4_dsi_dev_remove() functions in drivers/gpu/drm/vc4/vc4_dsi.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

45) Buffer overflow

EUVDB-ID: #VU94479

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48827

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the nfsd4_encode_read() and nfsd4_encode_read_plus() functions in fs/nfsd/nfs4xdr.c, within the nfsd4_read() function in fs/nfsd/nfs4proc.c, within the nfsd3_proc_read() function in fs/nfsd/nfs3proc.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

46) Integer underflow

EUVDB-ID: #VU94466

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48828

CWE-ID: CWE-191 - Integer underflow

Exploit availability: No

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer underflow within the nfsd_setattr() function in fs/nfsd/vfs.c. A local user can execute arbitrary code.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

47) Input validation error

EUVDB-ID: #VU94492

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48829

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the svcxdr_decode_sattr3() function in fs/nfsd/nfs3xdr.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

48) Improper locking

EUVDB-ID: #VU94447

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48836

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the aiptek_probe() function in drivers/input/tablet/aiptek.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

49) Memory leak

EUVDB-ID: #VU94392

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48839

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the tpacket_rcv() and packet_recvmsg() functions in net/packet/af_packet.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

50) NULL pointer dereference

EUVDB-ID: #VU94437

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48850

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the speed_show() function in net/core/net-sysfs.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

51) Use of uninitialized resource

EUVDB-ID: #VU94464

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48855

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the inet_diag_msg_sctpasoc_fill() and inet_sctp_diag_fill() functions in net/sctp/sctp_diag.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

52) Use-after-free

EUVDB-ID: #VU94412

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48857

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the nfc_digital_free_device() function in drivers/nfc/port100.c. A local user can escalate privileges on the system.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

53) Memory leak

EUVDB-ID: #VU94394

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48860

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the xemaclite_of_probe() function in drivers/net/ethernet/xilinx/xilinx_emaclite.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

54) Memory leak

EUVDB-ID: #VU94393

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48863

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the dsp_pipeline_destroy() and dsp_pipeline_build() functions in drivers/isdn/mISDN/dsp_pipeline.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

55) Use-after-free

EUVDB-ID: #VU82306

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-4244

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the Linux kernel netfilter: nf_tables component. A local user can trigger a use-after-free error and execute arbitrary code with elevated privileges.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

56) Buffer overflow

EUVDB-ID: #VU87748

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52435

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error within the skb_segment() function. A local user can trigger memory corruption and crash the kernel.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

57) Out-of-bounds read

EUVDB-ID: #VU90350

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52507

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the nci_activate_target() function in net/nfc/nci/core.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

58) Out-of-bounds read

EUVDB-ID: #VU90343

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52594

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the ath9k_htc_txstatus() function in drivers/net/wireless/ath/ath9k/htc_drv_txrx.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

59) Buffer overflow

EUVDB-ID: #VU91314

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52612

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the scomp_acomp_comp_decomp() function in crypto/scompress.c. A local user can escalate privileges on the system.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

60) Improper locking

EUVDB-ID: #VU90798

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52615

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the rng_get_data() and rng_dev_read() functions in drivers/char/hw_random/core.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

61) Buffer overflow

EUVDB-ID: #VU93668

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52619

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the ramoops_init_przs() function in fs/pstore/ram.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

62) Improper locking

EUVDB-ID: #VU92046

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52623

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the xprt_iter_current_entry() and rpc_xprt_switch_has_addr() functions in net/sunrpc/xprtmultipath.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

63) Out-of-bounds read

EUVDB-ID: #VU91423

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52669

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the ctr_paes_crypt() function in arch/s390/crypto/paes_s390.c, within the ctr_aes_crypt() function in arch/s390/crypto/aes_s390.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

64) Integer overflow

EUVDB-ID: #VU91424

Risk: Low

CVSSv3.1: 6.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52683

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer overflow within the lpit_update_residency() function in drivers/acpi/acpi_lpit.c. A local user can execute arbitrary code.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

65) Use of uninitialized resource

EUVDB-ID: #VU91678

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52693

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the acpi_video_dev_register_backlight() function in drivers/acpi/acpi_video.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

66) Resource management error

EUVDB-ID: #VU93184

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52743

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the ice_module_init() function in drivers/net/ethernet/intel/ice/ice_main.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

67) NULL pointer dereference

EUVDB-ID: #VU91226

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52753

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the dc_stream_get_vblank_counter() and dc_stream_get_scanoutpos() functions in drivers/gpu/drm/amd/display/dc/core/dc_stream.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

68) NULL pointer dereference

EUVDB-ID: #VU90432

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52817

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the amdgpu_debugfs_regs_smc_read() and amdgpu_debugfs_regs_smc_write() functions in drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

69) Out-of-bounds read

EUVDB-ID: #VU90289

Risk: Low

CVSSv3.1: 3.2 [AV:L/AC:L/PR:L/UI:U/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52818

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the drivers/gpu/drm/amd/include/pptable.h, drivers/gpu/drm/amd/powerplay/hwmgr/pptable_v1_0.h. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

70) Out-of-bounds read

EUVDB-ID: #VU90288

Risk: Low

CVSSv3.1: 3.2 [AV:L/AC:L/PR:L/UI:U/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52819

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the drivers/gpu/drm/amd/powerplay/hwmgr/pptable_v1_0.h. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

71) Use-after-free

EUVDB-ID: #VU94326

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52885

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the svc_tcp_listen_data_ready() function in net/sunrpc/svcsock.c. A local user can escalate privileges on the system.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

72) NULL pointer dereference

EUVDB-ID: #VU90627

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26615

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the __smc_diag_dump() function in net/smc/smc_diag.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

73) Use of uninitialized resource

EUVDB-ID: #VU90880

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26635

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the cpu_to_be16() function in net/llc/llc_core.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

74) Input validation error

EUVDB-ID: #VU90859

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26636

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the llc_ui_sendmsg() function in net/llc/af_llc.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

75) Buffer overflow

EUVDB-ID: #VU93244

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26659

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the process_isoc_td() function in drivers/usb/host/xhci-ring.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

76) NULL pointer dereference

EUVDB-ID: #VU92073

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26663

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the tipc_nl_bearer_add() function in net/tipc/bearer.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

77) Use-after-free

EUVDB-ID: #VU90215

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26735

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the seg6_init() function in net/ipv6/seg6.c. A local user can escalate privileges on the system.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

78) Input validation error

EUVDB-ID: #VU94135

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26830

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the i40e_check_vf_permission() and i40e_vc_del_mac_addr_msg() functions in drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

79) Use of uninitialized resource

EUVDB-ID: #VU90877

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26863

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the hsr_get_node() function in net/hsr/hsr_framereg.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

80) Resource management error

EUVDB-ID: #VU92988

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26880

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the __dm_internal_suspend() and __dm_internal_resume() functions in drivers/md/dm.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

81) Buffer overflow

EUVDB-ID: #VU93805

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26920

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the register_snapshot_trigger() function in kernel/trace/trace_events_trigger.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

82) Resource management error

EUVDB-ID: #VU89055

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26924

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources within the nft_pipapo_remove() function in net/netfilter/nft_set_pipapo.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

83) Race condition within a thread

EUVDB-ID: #VU91431

Risk: Low

CVSSv3.1: 4.1 [AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-27019

CWE-ID: CWE-366 - Race Condition within a Thread

Exploit availability: No

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to a data race within the __nft_obj_type_get() and nft_obj_type_get() functions in net/netfilter/nf_tables_api.c. A local user can gain access to sensitive information.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

84) Race condition within a thread

EUVDB-ID: #VU91432

Risk: Low

CVSSv3.1: 6.1 [AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-27020

CWE-ID: CWE-366 - Race Condition within a Thread

Exploit availability: No

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to a data race within the __nft_expr_type_get() and nft_expr_type_get() functions in net/netfilter/nf_tables_api.c. A local user can execute arbitrary code.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

85) Improper error handling

EUVDB-ID: #VU93453

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-27025

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the nbd_genl_status() function in drivers/block/nbd.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

86) Resource management error

EUVDB-ID: #VU93202

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-27437

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the vfio_intx_set_signal() function in drivers/vfio/pci/vfio_pci_intrs.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

87) Improper locking

EUVDB-ID: #VU91519

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35805

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the dm_exception_table_exit() function in drivers/md/dm-snap.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

88) Improper locking

EUVDB-ID: #VU90755

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35806

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the qm_congestion_task() and qman_create_cgr() functions in drivers/soc/fsl/qbman/qman.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

89) Improper locking

EUVDB-ID: #VU91448

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35819

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the qman_create_portal(), qm_congestion_task(), qman_create_cgr(), qman_delete_cgr() and qman_update_cgr() functions in drivers/soc/fsl/qbman/qman.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

90) Memory leak

EUVDB-ID: #VU90447

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35828

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the lbs_allocate_cmd_buffer() function in drivers/net/wireless/marvell/libertas/cmd.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

91) Use of uninitialized resource

EUVDB-ID: #VU93435

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35837

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the mvpp2_bm_pool_cleanup() and mvpp2_bm_init() functions in drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

92) Use-after-free

EUVDB-ID: #VU90159

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35887

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the ax25_dev_device_down() function in net/ax25/ax25_dev.c. A local user can escalate privileges on the system.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

93) Memory leak

EUVDB-ID: #VU93609

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35893

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the tcf_skbmod_dump() function in net/sched/act_skbmod.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

94) Improper locking

EUVDB-ID: #VU92020

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35934

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the smc_pnet_create_pnetids_list() function in net/smc/smc_pnet.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

95) Improper error handling

EUVDB-ID: #VU93468

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35947

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an error within the ddebug_tokenize() function in lib/dynamic_debug.c. A local user can crash the OS kernel.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

96) Out-of-bounds read

EUVDB-ID: #VU91391

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35949

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the __btrfs_check_leaf() and __btrfs_check_node() functions in fs/btrfs/tree-checker.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

97) Out-of-bounds read

EUVDB-ID: #VU90306

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35966

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the rfcomm_sock_setsockopt_old() and rfcomm_sock_setsockopt() functions in net/bluetooth/rfcomm/sock.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

98) Out-of-bounds read

EUVDB-ID: #VU90303

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35967

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the sco_sock_setsockopt() function in net/bluetooth/sco.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

99) Memory leak

EUVDB-ID: #VU89973

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35978

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the hci_req_sync_complete() function in net/bluetooth/hci_request.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

100) Buffer overflow

EUVDB-ID: #VU92955

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35995

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the show_cppc_data(), acpi_cppc_processor_probe(), cpc_read() and cpc_write() functions in drivers/acpi/cppc_acpi.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

101) Resource management error

EUVDB-ID: #VU93281

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36004

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the i40e_init_module() function in drivers/net/ethernet/intel/i40e/i40e_main.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

102) NULL pointer dereference

EUVDB-ID: #VU89897

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36014

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error within the malidp_mw_connector_reset() function in drivers/gpu/drm/arm/malidp_mw.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

103) Infinite loop

EUVDB-ID: #VU93062

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36288

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop within the gss_read_proxy_verf() function in net/sunrpc/auth_gss/svcauth_gss.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

104) NULL pointer dereference

EUVDB-ID: #VU91224

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36901

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the ip6_output() function in net/ipv6/ip6_output.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

105) NULL pointer dereference

EUVDB-ID: #VU91222

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36902

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the __fib6_rule_action() function in net/ipv6/fib6_rules.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

106) Improper locking

EUVDB-ID: #VU92010

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36919

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the bnx2fc_free_session_resc() function in drivers/scsi/bnx2fc/bnx2fc_tgt.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

107) Improper locking

EUVDB-ID: #VU90734

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36924

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the lpfc_set_rrq_active() and lpfc_sli_post_recovery_event() functions in drivers/scsi/lpfc/lpfc_sli.c, within the lpfc_dev_loss_tmo_callbk() function in drivers/scsi/lpfc/lpfc_hbadisc.c, within the lpfc_els_retry_delay() function in drivers/scsi/lpfc/lpfc_els.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

108) Improper error handling

EUVDB-ID: #VU92054

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36939

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the nfs_net_init() function in fs/nfs/inode.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

109) NULL pointer dereference

EUVDB-ID: #VU90528

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36941

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the nl80211_set_coalesce() function in net/wireless/nl80211.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

110) Race condition

EUVDB-ID: #VU91463

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36952

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition within the lpfc_vport_delete() function in drivers/scsi/lpfc/lpfc_vport.c. A local user can escalate privileges on the system.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

111) Input validation error

EUVDB-ID: #VU94117

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-38558

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input when parsing ICMPv6 packets within the parse_icmpv6() function in net/openvswitch/flow.c. A remote attacker can send specially crafted packets to the system and perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

112) Out-of-bounds read

EUVDB-ID: #VU92327

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-38560

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the bfad_debugfs_write_regrd() and bfad_debugfs_write_regwr() functions in drivers/scsi/bfa/bfad_debugfs.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

113) Out-of-bounds read

EUVDB-ID: #VU92320

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-38598

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the __acquires() function in drivers/md/md-bitmap.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

114) Use of uninitialized resource

EUVDB-ID: #VU93082

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-38619

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the short_pack() and alauda_check_media() functions in drivers/usb/storage/alauda.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

115) Use-after-free

EUVDB-ID: #VU93021

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-38630

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the cpu5wdt_exit() function in drivers/watchdog/cpu5wdt.c. A local user can escalate privileges on the system.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

116) Use of uninitialized resource

EUVDB-ID: #VU93337

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-39301

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the p9_fcall_init() function in net/9p/client.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

117) Division by zero

EUVDB-ID: #VU93828

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-39475

CWE-ID: CWE-369 - Divide By Zero

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a division by zero error within the savagefb_probe() function in drivers/video/fbdev/savage/savagefb_driver.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

118) Out-of-bounds read

EUVDB-ID: #VU93889

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-39487

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the bond_option_arp_ip_targets_set() function in drivers/net/bonding/bond_options.c. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

119) Improper error handling

EUVDB-ID: #VU94087

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-39488

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the arch/arm64/include/asm/asm-bug.h. A local user can perform a denial of service (DoS) attack.

Update the affected package the Linux Kernel to the latest version.

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

kernel-source-azure: before 4.12.14-16.194.1

kernel-devel-azure: before 4.12.14-16.194.1

kernel-azure-debuginfo: before 4.12.14-16.194.1

kernel-syms-azure: before 4.12.14-16.194.1

kernel-azure-base-debuginfo: before 4.12.14-16.194.1

kernel-azure-base: before 4.12.14-16.194.1

kernel-azure-devel: before 4.12.14-16.194.1

kernel-azure-debugsource: before 4.12.14-16.194.1

kernel-azure: before 4.12.14-16.194.1

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:

http://www.suse.com/support/update/announcement/2024/suse-su-20242901-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

120) Memory leak