Security update for the Linux Kernel (Live Patch 0 for SLE 15 SP4) SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2023:0637-1 Final 1 1 2023-03-07T11:27:25Z current 2023-03-07T11:27:25Z 2023-03-07T11:27:25Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for the Linux Kernel (Live Patch 0 for SLE 15 SP4) This update for the Linux Kernel 5.14.21-150400_22 fixes several issues. The following security issues were fixed: - CVE-2022-3564: Fixed use-after-free in l2cap_core.c of the Bluetooth component (bsc#1206314). - CVE-2023-0179: Fixed incorrect arithmetics when fetching VLAN header bits (bsc#1207139). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2023-637,SUSE-SLE-Module-Live-Patching-15-SP4-2023-637 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2023/suse-su-20230637-1/ Link for SUSE-SU-2023:0637-1 https://lists.suse.com/pipermail/sle-security-updates/2023-March/013980.html E-Mail link for SUSE-SU-2023:0637-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1206314 SUSE Bug 1206314 https://bugzilla.suse.com/1207139 SUSE Bug 1207139 https://www.suse.com/security/cve/CVE-2022-3564/ SUSE CVE CVE-2022-3564 page https://www.suse.com/security/cve/CVE-2023-0179/ SUSE CVE CVE-2023-0179 page SUSE Linux Enterprise Live Patching 15 SP4 kernel-livepatch-5_14_21-150400_22-default-11-150400.7.2 kernel-livepatch-5_14_21-150400_22-default-11-150400.7.2 as a component of SUSE Linux Enterprise Live Patching 15 SP4 A vulnerability classified as critical was found in Linux Kernel. Affected by this vulnerability is the function l2cap_reassemble_sdu of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211087. CVE-2022-3564 SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_22-default-11-150400.7.2 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20230637-1/ https://www.suse.com/security/cve/CVE-2022-3564.html CVE-2022-3564 https://bugzilla.suse.com/1206073 SUSE Bug 1206073 https://bugzilla.suse.com/1206314 SUSE Bug 1206314 https://bugzilla.suse.com/1208030 SUSE Bug 1208030 https://bugzilla.suse.com/1208044 SUSE Bug 1208044 https://bugzilla.suse.com/1208085 SUSE Bug 1208085 A buffer overflow vulnerability was found in the Netfilter subsystem in the Linux Kernel. This issue could allow the leakage of both stack and heap addresses, and potentially allow Local Privilege Escalation to the root user via arbitrary code execution. CVE-2023-0179 SUSE Linux Enterprise Live Patching 15 SP4:kernel-livepatch-5_14_21-150400_22-default-11-150400.7.2 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20230637-1/ https://www.suse.com/security/cve/CVE-2023-0179.html CVE-2023-0179 https://bugzilla.suse.com/1207034 SUSE Bug 1207034 https://bugzilla.suse.com/1207139 SUSE Bug 1207139 https://bugzilla.suse.com/1215208 SUSE Bug 1215208