Security update for the Linux Kernel (Live Patch 42 for SLE 15 SP1) SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2023:4321-1 Final 1 1 2023-10-31T17:03:44Z current 2023-10-31T17:03:44Z 2023-10-31T17:03:44Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for the Linux Kernel (Live Patch 42 for SLE 15 SP1) This update for the Linux Kernel 4.12.14-150100_197_151 fixes one issue. The following security issue was fixed: - CVE-2023-4623: Fixed a use-after-free issue in the HFSC network scheduler which could be exploited to achieve local privilege escalation (bsc#1215440). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2023-4321,SUSE-SLE-Live-Patching-12-SP5-2023-4324,SUSE-SLE-Module-Live-Patching-15-SP1-2023-4321 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2023/suse-su-20234321-1/ Link for SUSE-SU-2023:4321-1 https://lists.suse.com/pipermail/sle-security-updates/2023-October/016961.html E-Mail link for SUSE-SU-2023:4321-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1215440 SUSE Bug 1215440 https://www.suse.com/security/cve/CVE-2023-4623/ SUSE CVE CVE-2023-4623 page SUSE Linux Enterprise Live Patching 12 SP5 SUSE Linux Enterprise Live Patching 15 SP1 kernel-livepatch-4_12_14-150100_197_151-default-4-150100.2.2 kgraft-patch-4_12_14-122_159-default-6-2.2 kgraft-patch-4_12_14-122_159-default-6-2.2 as a component of SUSE Linux Enterprise Live Patching 12 SP5 kernel-livepatch-4_12_14-150100_197_151-default-4-150100.2.2 as a component of SUSE Linux Enterprise Live Patching 15 SP1 A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control) component can be exploited to achieve local privilege escalation. If a class with a link-sharing curve (i.e. with the HFSC_FSC flag set) has a parent without a link-sharing curve, then init_vf() will call vttree_insert() on the parent, but vttree_remove() will be skipped in update_vf(). This leaves a dangling pointer that can cause a use-after-free. We recommend upgrading past commit b3d26c5702c7d6c45456326e56d2ccf3f103e60f. CVE-2023-4623 SUSE Linux Enterprise Live Patching 12 SP5:kgraft-patch-4_12_14-122_159-default-6-2.2 SUSE Linux Enterprise Live Patching 15 SP1:kernel-livepatch-4_12_14-150100_197_151-default-4-150100.2.2 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20234321-1/ https://www.suse.com/security/cve/CVE-2023-4623.html CVE-2023-4623 https://bugzilla.suse.com/1215115 SUSE Bug 1215115 https://bugzilla.suse.com/1215440 SUSE Bug 1215440 https://bugzilla.suse.com/1217444 SUSE Bug 1217444 https://bugzilla.suse.com/1217531 SUSE Bug 1217531 https://bugzilla.suse.com/1219698 SUSE Bug 1219698 https://bugzilla.suse.com/1221578 SUSE Bug 1221578 https://bugzilla.suse.com/1221598 SUSE Bug 1221598