File _patchinfo of Package patchinfo.28428

Overview Repositories Revisions Requests Users Attributes Meta

File _patchinfo of Package patchinfo.28428

<patchinfo incident="28428">
  <issue id="1207190" tracker="bnc">VUL-0: CVE-2023-0266: kernel live patch: Missing locks in SNDRV_CTL_IOCTL_ELEM_{READ|WRITE}32 compat code causing UAF used in the wild</issue>
  <issue id="1208838" tracker="bnc">VUL-0: CVE-2023-1078: kernel live patch: heap out-of-bounds write in rds_rm_zerocopy_callback</issue>
  <issue id="1208909" tracker="bnc">VUL-0: CVE-2023-26545: kernel live patch: double free in net/mpls/af_mpls.c upon an allocation failure</issue>
  <issue id="2023-0266" tracker="cve" />
  <issue id="2023-1078" tracker="cve" />
  <issue id="2023-26545" tracker="cve" />
  <category>security</category>
  <rating>important</rating>
  <packager>nstange</packager>
  <description>This update for the Linux Kernel 5.3.18-150300_59_106 fixes several issues.

The following security issues were fixed:

- CVE-2023-26545: Fixed double free in net/mpls/af_mpls.c upon an allocation failure (bsc#1208700).
- CVE-2023-1078: Fixed a heap out-of-bounds write in rds_rm_zerocopy_callback (bsc#1208838).
- CVE-2023-0266: Fixed a use-after-free vulnerability inside the ALSA PCM package. SNDRV_CTL_IOCTL_ELEM_{READ|WRITE}32 was missing locks that could have been used in a use-after-free that could have resulted in a priviledge escalation to gain ring0 access from the system user (bsc#1207190).
</description>
<summary>Security update for the Linux Kernel (Live Patch 27 for SLE 15 SP3)</summary>
</patchinfo>

Places

File _patchinfo of Package patchinfo.28428

Places