[LU-17750] kernel update [SLES15 SP4 5.14.21-150400.24.100.2]

• Type: Improvement
• Resolution: Unresolved
• Priority: Minor
• Fix Version/s: Lustre 2.16.0, Lustre 2.15.5
• Affects Version/s: Lustre 2.16.0, Lustre 2.15.5
• Severity: 3
• Assignee: Jian Yu
• Reporter: Jian Yu

Description

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security
and bugfixes.

The following security bugs were fixed:

• CVE-2023-6176: Fixed a denial of service in the cryptographic algorithm
  scatterwalk functionality (bsc#1217332).
• CVE-2023-2006: Fixed a race condition in the RxRPC network protocol
  (bsc#1210447).
• CVE-2023-39197: Fixed a out-of-bounds read in nf_conntrack_dccp_packet()
  (bsc#1216976).
• CVE-2023-4244: Fixed a use-after-free in the nf_tables component, which
  could be exploited to achieve local privilege escalation (bsc#1215420).
• CVE-2023-6039: Fixed a use-after-free in lan78xx_disconnect in
  drivers/net/usb/lan78xx.c (bsc#1217068).
• CVE-2023-45863: Fixed a out-of-bounds write in fill_kobj_path()
  (bsc#1216058).
• CVE-2023-5158: Fixed a denial of service in vringh_kiov_advance() in
  drivers/vhost/vringh.c in the host side of a virtio ring (bsc#1215710).
• CVE-2023-45871: Fixed an issue in the IGB driver, where the buffer size may
  not be adequate for frames larger than the MTU (bsc#1216259).
• CVE-2023-5717: Fixed a heap out-of-bounds write vulnerability in the
  Performance Events component (bsc#1216584).
• CVE-2023-39198: Fixed a race condition leading to use-after-free in
  qxl_mode_dumb_create() (bsc#1216965).
• CVE-2023-25775: Fixed improper access control in the Intel Ethernet
  Controller RDMA driver (bsc#1216959).
• CVE-2023-46862: Fixed a NULL pointer dereference in io_uring_show_fdinfo()
  (bsc#1216693).

The following non-security bugs were fixed:
https://lists.suse.com/pipermail/sle-security-updates/2023-December/017341.html

Issue Links

• is related to: LU-17221 kernel update [SLES15 SP4 5.14.21-150400.24.92.1]