Bug 1214120 (CVE-2023-4273) - VUL-0: CVE-2023-4273: kernel: exFAT: stack overflow in exfat_get_uniname_from_ext_entry
Summary: VUL-0: CVE-2023-4273: kernel: exFAT: stack overflow in exfat_get_uniname_from...
Status: RESOLVED FIXED
Alias: CVE-2023-4273
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/374794/
Whiteboard: CVSSv3.1:SUSE:CVE-2023-4273:7.8:(AV:L...
Keywords:
Depends on:
Blocks:
 
Reported: 2023-08-09 14:31 UTC by Robert Frohl
Modified: 2024-11-06 06:47 UTC (History)
2 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Robert Frohl 2023-08-09 14:31:53 UTC 
CVE-2023-4273

A flaw was found in the exFAT driver of the Linux kernel. The vulnerability exists in the implementation of the file name reconstruction function, which is responsible for reading file name entries from a directory index, merging file name parts belonging to one file into a single, long file name.

In particular, there is a stack overflow in the exfat_get_uniname_from_ext_entry() function. This function iterates over a set of entries (in a directory index) looking for those belonging to a file name. And for each file name entry encountered in the current set, it calls the exfat_extract_uni_name() function, which copies characters from a given file name entry into the "uniname" variable. This variable is actually defined on the stack of the exfat_readdir() function. According to the definition of the "exfat_uni_name" type, the file name limit is 258 characters, but the
exfat_get_uniname_from_ext_entry() function can write more characters, because it iterates until the limit defined by the "es.num_entries" field is hit (e.g., if there are 100 file name entries, the maximum number of file name characters stored in the set is 1500, so the overflow is 1242 characters, or 2484 bytes; this situation is a file system format violation, because file names longer than 255 characters are forbidden, but the current code works this way).

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-4273
https://bugzilla.redhat.com/show_bug.cgi?id=2221609
Comment 22 Maintenance Automation 2023-09-14 12:30:31 UTC 
SUSE-SU-2023:3600-1: An update that solves 16 vulnerabilities, contains seven features and has 44 security fixes can now be installed.

Category: security (important)
Bug References: 1023051, 1120059, 1177719, 1188885, 1193629, 1194869, 1205462, 1208902, 1208949, 1209284, 1209799, 1210048, 1210448, 1212091, 1212142, 1212526, 1212857, 1212873, 1213026, 1213123, 1213546, 1213580, 1213601, 1213666, 1213757, 1213759, 1213916, 1213921, 1213927, 1213946, 1213968, 1213970, 1213971, 1214000, 1214019, 1214120, 1214149, 1214180, 1214238, 1214285, 1214297, 1214299, 1214350, 1214368, 1214370, 1214371, 1214372, 1214380, 1214386, 1214392, 1214393, 1214397, 1214428, 1214451, 1214659, 1214661, 1214729, 1214742, 1214743, 1214756
CVE References: CVE-2023-2007, CVE-2023-20588, CVE-2023-34319, CVE-2023-3610, CVE-2023-37453, CVE-2023-3772, CVE-2023-3863, CVE-2023-4128, CVE-2023-4133, CVE-2023-4134, CVE-2023-4147, CVE-2023-4194, CVE-2023-4273, CVE-2023-4387, CVE-2023-4459, CVE-2023-4569
Jira References: PED-4579, PED-4759, PED-4927, PED-4929, PED-5738, PED-6003, PED-6004
Sources used:
openSUSE Leap 15.4 (src): kernel-source-rt-5.14.21-150400.15.49.1, kernel-syms-rt-5.14.21-150400.15.49.1
SUSE Linux Enterprise Live Patching 15-SP4 (src): kernel-livepatch-SLE15-SP4-RT_Update_12-1-150400.1.3.1
SUSE Real Time Module 15-SP4 (src): kernel-source-rt-5.14.21-150400.15.49.1, kernel-syms-rt-5.14.21-150400.15.49.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 23 Maintenance Automation 2023-09-14 12:31:09 UTC 
SUSE-SU-2023:3599-1: An update that solves 20 vulnerabilities, contains eight features and has 53 security fixes can now be installed.

Category: security (important)
Bug References: 1023051, 1120059, 1177719, 1188885, 1193629, 1194869, 1203329, 1203330, 1205462, 1206453, 1208902, 1208949, 1209284, 1209799, 1210048, 1210448, 1211220, 1212091, 1212142, 1212423, 1212526, 1212857, 1212873, 1213026, 1213123, 1213546, 1213580, 1213601, 1213666, 1213733, 1213757, 1213759, 1213916, 1213921, 1213927, 1213946, 1213949, 1213968, 1213970, 1213971, 1214000, 1214019, 1214073, 1214120, 1214149, 1214180, 1214233, 1214238, 1214285, 1214297, 1214299, 1214305, 1214350, 1214368, 1214370, 1214371, 1214372, 1214380, 1214386, 1214392, 1214393, 1214397, 1214404, 1214428, 1214451, 1214659, 1214661, 1214727, 1214729, 1214742, 1214743, 1214756, 1214976
CVE References: CVE-2022-38457, CVE-2022-40133, CVE-2023-2007, CVE-2023-20588, CVE-2023-34319, CVE-2023-3610, CVE-2023-37453, CVE-2023-3772, CVE-2023-3863, CVE-2023-40283, CVE-2023-4128, CVE-2023-4133, CVE-2023-4134, CVE-2023-4147, CVE-2023-4194, CVE-2023-4273, CVE-2023-4387, CVE-2023-4459, CVE-2023-4563, CVE-2023-4569
Jira References: PED-3924, PED-4579, PED-4759, PED-4927, PED-4929, PED-5738, PED-6003, PED-6004
Sources used:
openSUSE Leap 15.5 (src): kernel-syms-rt-5.14.21-150500.13.14.1, kernel-livepatch-SLE15-SP5-RT_Update_4-1-150500.11.3.1, kernel-source-rt-5.14.21-150500.13.14.1
SUSE Linux Enterprise Live Patching 15-SP5 (src): kernel-livepatch-SLE15-SP5-RT_Update_4-1-150500.11.3.1
SUSE Real Time Module 15-SP5 (src): kernel-syms-rt-5.14.21-150500.13.14.1, kernel-source-rt-5.14.21-150500.13.14.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 24 Maintenance Automation 2023-09-18 16:30:31 UTC 
SUSE-SU-2023:3656-1: An update that solves 20 vulnerabilities, contains eight features and has 54 security fixes can now be installed.

Category: security (important)
Bug References: 1023051, 1120059, 1177719, 1188885, 1193629, 1194869, 1203329, 1203330, 1205462, 1206453, 1208902, 1208949, 1209284, 1209799, 1210048, 1210448, 1211220, 1212091, 1212142, 1212423, 1212526, 1212857, 1212873, 1213026, 1213123, 1213546, 1213580, 1213601, 1213666, 1213733, 1213757, 1213759, 1213916, 1213921, 1213927, 1213946, 1213949, 1213968, 1213970, 1213971, 1214000, 1214019, 1214073, 1214120, 1214149, 1214180, 1214233, 1214238, 1214285, 1214297, 1214299, 1214305, 1214350, 1214368, 1214370, 1214371, 1214372, 1214380, 1214386, 1214392, 1214393, 1214397, 1214404, 1214428, 1214451, 1214659, 1214661, 1214727, 1214729, 1214742, 1214743, 1214756, 1214760, 1214976
CVE References: CVE-2022-38457, CVE-2022-40133, CVE-2023-2007, CVE-2023-20588, CVE-2023-34319, CVE-2023-3610, CVE-2023-37453, CVE-2023-3772, CVE-2023-3863, CVE-2023-40283, CVE-2023-4128, CVE-2023-4133, CVE-2023-4134, CVE-2023-4147, CVE-2023-4194, CVE-2023-4273, CVE-2023-4387, CVE-2023-4459, CVE-2023-4563, CVE-2023-4569
Jira References: PED-3924, PED-4579, PED-4759, PED-4927, PED-4929, PED-5738, PED-6003, PED-6004
Sources used:
openSUSE Leap 15.5 (src): kernel-source-azure-5.14.21-150500.33.17.1, kernel-syms-azure-5.14.21-150500.33.17.1
Public Cloud Module 15-SP5 (src): kernel-source-azure-5.14.21-150500.33.17.1, kernel-syms-azure-5.14.21-150500.33.17.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 25 Maintenance Automation 2023-09-19 16:30:21 UTC 
SUSE-SU-2023:3684-1: An update that solves 17 vulnerabilities, contains two features and has four security fixes can now be installed.

Category: security (important)
Bug References: 1023051, 1203517, 1210448, 1213272, 1213546, 1213601, 1213666, 1213916, 1213927, 1213968, 1213969, 1213970, 1213971, 1214019, 1214120, 1214149, 1214275, 1214297, 1214348, 1214350, 1214451
CVE References: CVE-2022-36402, CVE-2023-2007, CVE-2023-20588, CVE-2023-21400, CVE-2023-34319, CVE-2023-3772, CVE-2023-3863, CVE-2023-4128, CVE-2023-4132, CVE-2023-4133, CVE-2023-4134, CVE-2023-4147, CVE-2023-4194, CVE-2023-4273, CVE-2023-4385, CVE-2023-4387, CVE-2023-4459
Jira References: PED-4579, PED-5738
Sources used:
SUSE Linux Enterprise Live Patching 15-SP3 (src): kernel-livepatch-SLE15-SP3_Update_36-1-150300.7.3.1
SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (src): kernel-default-base-5.3.18-150300.59.133.1.150300.18.78.1, kernel-source-5.3.18-150300.59.133.1, kernel-syms-5.3.18-150300.59.133.1, kernel-obs-build-5.3.18-150300.59.133.1
SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (src): kernel-default-base-5.3.18-150300.59.133.1.150300.18.78.1, kernel-source-5.3.18-150300.59.133.1, kernel-syms-5.3.18-150300.59.133.1, kernel-obs-build-5.3.18-150300.59.133.1
SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (src): kernel-default-base-5.3.18-150300.59.133.1.150300.18.78.1, kernel-source-5.3.18-150300.59.133.1, kernel-syms-5.3.18-150300.59.133.1, kernel-obs-build-5.3.18-150300.59.133.1
SUSE Linux Enterprise Server for SAP Applications 15 SP3 (src): kernel-default-base-5.3.18-150300.59.133.1.150300.18.78.1, kernel-source-5.3.18-150300.59.133.1, kernel-syms-5.3.18-150300.59.133.1, kernel-obs-build-5.3.18-150300.59.133.1
SUSE Manager Proxy 4.2 (src): kernel-default-base-5.3.18-150300.59.133.1.150300.18.78.1, kernel-source-5.3.18-150300.59.133.1
SUSE Manager Retail Branch Server 4.2 (src): kernel-default-base-5.3.18-150300.59.133.1.150300.18.78.1, kernel-source-5.3.18-150300.59.133.1
SUSE Manager Server 4.2 (src): kernel-default-base-5.3.18-150300.59.133.1.150300.18.78.1, kernel-source-5.3.18-150300.59.133.1
SUSE Enterprise Storage 7.1 (src): kernel-default-base-5.3.18-150300.59.133.1.150300.18.78.1, kernel-source-5.3.18-150300.59.133.1, kernel-syms-5.3.18-150300.59.133.1, kernel-obs-build-5.3.18-150300.59.133.1
SUSE Linux Enterprise Micro 5.1 (src): kernel-default-base-5.3.18-150300.59.133.1.150300.18.78.1
SUSE Linux Enterprise Micro 5.2 (src): kernel-default-base-5.3.18-150300.59.133.1.150300.18.78.1
SUSE Linux Enterprise Micro for Rancher 5.2 (src): kernel-default-base-5.3.18-150300.59.133.1.150300.18.78.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 26 Maintenance Automation 2023-09-19 16:30:38 UTC 
SUSE-SU-2023:3683-1: An update that solves 16 vulnerabilities, contains seven features and has 44 security fixes can now be installed.

Category: security (important)
Bug References: 1023051, 1120059, 1177719, 1188885, 1193629, 1194869, 1205462, 1208902, 1208949, 1209284, 1209799, 1210048, 1210448, 1212091, 1212142, 1212526, 1212857, 1212873, 1213026, 1213123, 1213546, 1213580, 1213601, 1213666, 1213757, 1213759, 1213916, 1213921, 1213927, 1213946, 1213968, 1213970, 1213971, 1214000, 1214019, 1214120, 1214149, 1214180, 1214238, 1214285, 1214297, 1214299, 1214350, 1214368, 1214370, 1214371, 1214372, 1214380, 1214386, 1214392, 1214393, 1214397, 1214428, 1214451, 1214659, 1214661, 1214729, 1214742, 1214743, 1214756
CVE References: CVE-2023-2007, CVE-2023-20588, CVE-2023-34319, CVE-2023-3610, CVE-2023-37453, CVE-2023-3772, CVE-2023-3863, CVE-2023-4128, CVE-2023-4133, CVE-2023-4134, CVE-2023-4147, CVE-2023-4194, CVE-2023-4273, CVE-2023-4387, CVE-2023-4459, CVE-2023-4569
Jira References: PED-4579, PED-4759, PED-4927, PED-4929, PED-5738, PED-6003, PED-6004
Sources used:
openSUSE Leap 15.4 (src): kernel-syms-5.14.21-150400.24.84.1, kernel-source-5.14.21-150400.24.84.1, kernel-default-base-5.14.21-150400.24.84.1.150400.24.37.1, kernel-obs-build-5.14.21-150400.24.84.1, kernel-livepatch-SLE15-SP4_Update_17-1-150400.9.3.1, kernel-obs-qa-5.14.21-150400.24.84.1
SUSE Linux Enterprise Micro for Rancher 5.3 (src): kernel-default-base-5.14.21-150400.24.84.1.150400.24.37.1
SUSE Linux Enterprise Micro 5.3 (src): kernel-default-base-5.14.21-150400.24.84.1.150400.24.37.1
SUSE Linux Enterprise Micro for Rancher 5.4 (src): kernel-default-base-5.14.21-150400.24.84.1.150400.24.37.1
SUSE Linux Enterprise Micro 5.4 (src): kernel-default-base-5.14.21-150400.24.84.1.150400.24.37.1
Basesystem Module 15-SP4 (src): kernel-default-base-5.14.21-150400.24.84.1.150400.24.37.1, kernel-source-5.14.21-150400.24.84.1
Development Tools Module 15-SP4 (src): kernel-syms-5.14.21-150400.24.84.1, kernel-obs-build-5.14.21-150400.24.84.1, kernel-source-5.14.21-150400.24.84.1
SUSE Linux Enterprise Live Patching 15-SP4 (src): kernel-livepatch-SLE15-SP4_Update_17-1-150400.9.3.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 27 Maintenance Automation 2023-09-19 16:30:58 UTC 
SUSE-SU-2023:3682-1: An update that solves 16 vulnerabilities, contains seven features and has 45 security fixes can now be installed.

Category: security (important)
Bug References: 1023051, 1120059, 1177719, 1188885, 1193629, 1194869, 1205462, 1208902, 1208949, 1209284, 1209799, 1210048, 1210448, 1212091, 1212142, 1212526, 1212857, 1212873, 1213026, 1213123, 1213546, 1213580, 1213601, 1213666, 1213757, 1213759, 1213916, 1213921, 1213927, 1213946, 1213968, 1213970, 1213971, 1214000, 1214019, 1214120, 1214149, 1214180, 1214238, 1214285, 1214297, 1214299, 1214350, 1214368, 1214370, 1214371, 1214372, 1214380, 1214386, 1214392, 1214393, 1214397, 1214428, 1214451, 1214659, 1214661, 1214729, 1214742, 1214743, 1214756, 1214760
CVE References: CVE-2023-2007, CVE-2023-20588, CVE-2023-34319, CVE-2023-3610, CVE-2023-37453, CVE-2023-3772, CVE-2023-3863, CVE-2023-4128, CVE-2023-4133, CVE-2023-4134, CVE-2023-4147, CVE-2023-4194, CVE-2023-4273, CVE-2023-4387, CVE-2023-4459, CVE-2023-4569
Jira References: PED-4579, PED-4759, PED-4927, PED-4929, PED-5738, PED-6003, PED-6004
Sources used:
openSUSE Leap 15.4 (src): kernel-syms-azure-5.14.21-150400.14.66.1, kernel-source-azure-5.14.21-150400.14.66.1
Public Cloud Module 15-SP4 (src): kernel-syms-azure-5.14.21-150400.14.66.1, kernel-source-azure-5.14.21-150400.14.66.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 28 Maintenance Automation 2023-09-19 20:30:02 UTC 
SUSE-SU-2023:3687-1: An update that solves 13 vulnerabilities can now be installed.

Category: security (important)
Bug References: 1203517, 1210448, 1213272, 1213601, 1213666, 1213927, 1213969, 1213971, 1214120, 1214149, 1214348, 1214350, 1214451
CVE References: CVE-2022-36402, CVE-2023-2007, CVE-2023-20588, CVE-2023-21400, CVE-2023-3772, CVE-2023-3863, CVE-2023-4128, CVE-2023-4132, CVE-2023-4134, CVE-2023-4273, CVE-2023-4385, CVE-2023-4387, CVE-2023-4459
Sources used:
SUSE Linux Enterprise Live Patching 15-SP2 (src): kernel-livepatch-SLE15-SP2_Update_40-1-150200.5.3.1
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (src): kernel-syms-5.3.18-150200.24.163.1, kernel-obs-build-5.3.18-150200.24.163.1, kernel-default-base-5.3.18-150200.24.163.1.150200.9.81.1, kernel-source-5.3.18-150200.24.163.1
SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (src): kernel-syms-5.3.18-150200.24.163.1, kernel-obs-build-5.3.18-150200.24.163.1, kernel-default-base-5.3.18-150200.24.163.1.150200.9.81.1, kernel-source-5.3.18-150200.24.163.1
SUSE Linux Enterprise Server for SAP Applications 15 SP2 (src): kernel-syms-5.3.18-150200.24.163.1, kernel-obs-build-5.3.18-150200.24.163.1, kernel-default-base-5.3.18-150200.24.163.1.150200.9.81.1, kernel-source-5.3.18-150200.24.163.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 29 Maintenance Automation 2023-09-20 12:30:30 UTC 
SUSE-SU-2023:3704-1: An update that solves 20 vulnerabilities, contains eight features and has 53 security fixes can now be installed.

Category: security (important)
Bug References: 1023051, 1120059, 1177719, 1188885, 1193629, 1194869, 1203329, 1203330, 1205462, 1206453, 1208902, 1208949, 1209284, 1209799, 1210048, 1210448, 1211220, 1212091, 1212142, 1212423, 1212526, 1212857, 1212873, 1213026, 1213123, 1213546, 1213580, 1213601, 1213666, 1213733, 1213757, 1213759, 1213916, 1213921, 1213927, 1213946, 1213949, 1213968, 1213970, 1213971, 1214000, 1214019, 1214073, 1214120, 1214149, 1214180, 1214233, 1214238, 1214285, 1214297, 1214299, 1214305, 1214350, 1214368, 1214370, 1214371, 1214372, 1214380, 1214386, 1214392, 1214393, 1214397, 1214404, 1214428, 1214451, 1214659, 1214661, 1214727, 1214729, 1214742, 1214743, 1214756, 1214976
CVE References: CVE-2022-38457, CVE-2022-40133, CVE-2023-2007, CVE-2023-20588, CVE-2023-34319, CVE-2023-3610, CVE-2023-37453, CVE-2023-3772, CVE-2023-3863, CVE-2023-40283, CVE-2023-4128, CVE-2023-4133, CVE-2023-4134, CVE-2023-4147, CVE-2023-4194, CVE-2023-4273, CVE-2023-4387, CVE-2023-4459, CVE-2023-4563, CVE-2023-4569
Jira References: PED-3924, PED-4579, PED-4759, PED-4927, PED-4929, PED-5738, PED-6003, PED-6004
Sources used:
openSUSE Leap 15.5 (src): kernel-livepatch-SLE15-SP5_Update_4-1-150500.11.3.1, kernel-obs-build-5.14.21-150500.55.22.1, kernel-syms-5.14.21-150500.55.22.1, kernel-obs-qa-5.14.21-150500.55.22.1, kernel-source-5.14.21-150500.55.22.1, kernel-default-base-5.14.21-150500.55.22.1.150500.6.8.1
Basesystem Module 15-SP5 (src): kernel-source-5.14.21-150500.55.22.1, kernel-default-base-5.14.21-150500.55.22.1.150500.6.8.1
Development Tools Module 15-SP5 (src): kernel-syms-5.14.21-150500.55.22.1, kernel-obs-build-5.14.21-150500.55.22.1, kernel-source-5.14.21-150500.55.22.1
SUSE Linux Enterprise Live Patching 15-SP5 (src): kernel-livepatch-SLE15-SP5_Update_4-1-150500.11.3.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 30 Maintenance Automation 2023-09-21 12:30:17 UTC 
SUSE-SU-2023:3599-2: An update that solves 20 vulnerabilities, contains eight features and has 53 security fixes can now be installed.

Category: security (important)
Bug References: 1023051, 1120059, 1177719, 1188885, 1193629, 1194869, 1203329, 1203330, 1205462, 1206453, 1208902, 1208949, 1209284, 1209799, 1210048, 1210448, 1211220, 1212091, 1212142, 1212423, 1212526, 1212857, 1212873, 1213026, 1213123, 1213546, 1213580, 1213601, 1213666, 1213733, 1213757, 1213759, 1213916, 1213921, 1213927, 1213946, 1213949, 1213968, 1213970, 1213971, 1214000, 1214019, 1214073, 1214120, 1214149, 1214180, 1214233, 1214238, 1214285, 1214297, 1214299, 1214305, 1214350, 1214368, 1214370, 1214371, 1214372, 1214380, 1214386, 1214392, 1214393, 1214397, 1214404, 1214428, 1214451, 1214659, 1214661, 1214727, 1214729, 1214742, 1214743, 1214756, 1214976
CVE References: CVE-2022-38457, CVE-2022-40133, CVE-2023-2007, CVE-2023-20588, CVE-2023-34319, CVE-2023-3610, CVE-2023-37453, CVE-2023-3772, CVE-2023-3863, CVE-2023-40283, CVE-2023-4128, CVE-2023-4133, CVE-2023-4134, CVE-2023-4147, CVE-2023-4194, CVE-2023-4273, CVE-2023-4387, CVE-2023-4459, CVE-2023-4563, CVE-2023-4569
Jira References: PED-3924, PED-4579, PED-4759, PED-4927, PED-4929, PED-5738, PED-6003, PED-6004
Sources used:
openSUSE Leap 15.5 (src): kernel-syms-rt-5.14.21-150500.13.14.1, kernel-source-rt-5.14.21-150500.13.14.1, kernel-livepatch-SLE15-SP5-RT_Update_4-1-150500.11.3.1
SUSE Linux Enterprise Live Patching 15-SP5 (src): kernel-livepatch-SLE15-SP5-RT_Update_4-1-150500.11.3.1
SUSE Real Time Module 15-SP5 (src): kernel-syms-rt-5.14.21-150500.13.14.1, kernel-source-rt-5.14.21-150500.13.14.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 31 Maintenance Automation 2023-09-21 12:30:40 UTC 
SUSE-SU-2023:3600-2: An update that solves 16 vulnerabilities, contains seven features and has 44 security fixes can now be installed.

Category: security (important)
Bug References: 1023051, 1120059, 1177719, 1188885, 1193629, 1194869, 1205462, 1208902, 1208949, 1209284, 1209799, 1210048, 1210448, 1212091, 1212142, 1212526, 1212857, 1212873, 1213026, 1213123, 1213546, 1213580, 1213601, 1213666, 1213757, 1213759, 1213916, 1213921, 1213927, 1213946, 1213968, 1213970, 1213971, 1214000, 1214019, 1214120, 1214149, 1214180, 1214238, 1214285, 1214297, 1214299, 1214350, 1214368, 1214370, 1214371, 1214372, 1214380, 1214386, 1214392, 1214393, 1214397, 1214428, 1214451, 1214659, 1214661, 1214729, 1214742, 1214743, 1214756
CVE References: CVE-2023-2007, CVE-2023-20588, CVE-2023-34319, CVE-2023-3610, CVE-2023-37453, CVE-2023-3772, CVE-2023-3863, CVE-2023-4128, CVE-2023-4133, CVE-2023-4134, CVE-2023-4147, CVE-2023-4194, CVE-2023-4273, CVE-2023-4387, CVE-2023-4459, CVE-2023-4569
Jira References: PED-4579, PED-4759, PED-4927, PED-4929, PED-5738, PED-6003, PED-6004
Sources used:
openSUSE Leap 15.4 (src): kernel-syms-rt-5.14.21-150400.15.49.1, kernel-source-rt-5.14.21-150400.15.49.1
SUSE Linux Enterprise Live Patching 15-SP4 (src): kernel-livepatch-SLE15-SP4-RT_Update_12-1-150400.1.3.1
SUSE Real Time Module 15-SP4 (src): kernel-syms-rt-5.14.21-150400.15.49.1, kernel-source-rt-5.14.21-150400.15.49.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 32 Maintenance Automation 2023-09-21 12:31:09 UTC 
SUSE-SU-2023:3704-2: An update that solves 20 vulnerabilities, contains eight features and has 53 security fixes can now be installed.

Category: security (important)
Bug References: 1023051, 1120059, 1177719, 1188885, 1193629, 1194869, 1203329, 1203330, 1205462, 1206453, 1208902, 1208949, 1209284, 1209799, 1210048, 1210448, 1211220, 1212091, 1212142, 1212423, 1212526, 1212857, 1212873, 1213026, 1213123, 1213546, 1213580, 1213601, 1213666, 1213733, 1213757, 1213759, 1213916, 1213921, 1213927, 1213946, 1213949, 1213968, 1213970, 1213971, 1214000, 1214019, 1214073, 1214120, 1214149, 1214180, 1214233, 1214238, 1214285, 1214297, 1214299, 1214305, 1214350, 1214368, 1214370, 1214371, 1214372, 1214380, 1214386, 1214392, 1214393, 1214397, 1214404, 1214428, 1214451, 1214659, 1214661, 1214727, 1214729, 1214742, 1214743, 1214756, 1214976
CVE References: CVE-2022-38457, CVE-2022-40133, CVE-2023-2007, CVE-2023-20588, CVE-2023-34319, CVE-2023-3610, CVE-2023-37453, CVE-2023-3772, CVE-2023-3863, CVE-2023-40283, CVE-2023-4128, CVE-2023-4133, CVE-2023-4134, CVE-2023-4147, CVE-2023-4194, CVE-2023-4273, CVE-2023-4387, CVE-2023-4459, CVE-2023-4563, CVE-2023-4569
Jira References: PED-3924, PED-4579, PED-4759, PED-4927, PED-4929, PED-5738, PED-6003, PED-6004
Sources used:
openSUSE Leap 15.5 (src): kernel-livepatch-SLE15-SP5_Update_4-1-150500.11.3.1, kernel-obs-build-5.14.21-150500.55.22.1, kernel-syms-5.14.21-150500.55.22.1, kernel-obs-qa-5.14.21-150500.55.22.1, kernel-source-5.14.21-150500.55.22.1, kernel-default-base-5.14.21-150500.55.22.1.150500.6.8.1
Basesystem Module 15-SP5 (src): kernel-source-5.14.21-150500.55.22.1, kernel-default-base-5.14.21-150500.55.22.1.150500.6.8.1
Development Tools Module 15-SP5 (src): kernel-syms-5.14.21-150500.55.22.1, kernel-obs-build-5.14.21-150500.55.22.1, kernel-source-5.14.21-150500.55.22.1
SUSE Linux Enterprise Live Patching 15-SP5 (src): kernel-livepatch-SLE15-SP5_Update_4-1-150500.11.3.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 33 Maintenance Automation 2023-09-21 12:31:35 UTC 
SUSE-SU-2023:3683-2: An update that solves 16 vulnerabilities, contains seven features and has 44 security fixes can now be installed.

Category: security (important)
Bug References: 1023051, 1120059, 1177719, 1188885, 1193629, 1194869, 1205462, 1208902, 1208949, 1209284, 1209799, 1210048, 1210448, 1212091, 1212142, 1212526, 1212857, 1212873, 1213026, 1213123, 1213546, 1213580, 1213601, 1213666, 1213757, 1213759, 1213916, 1213921, 1213927, 1213946, 1213968, 1213970, 1213971, 1214000, 1214019, 1214120, 1214149, 1214180, 1214238, 1214285, 1214297, 1214299, 1214350, 1214368, 1214370, 1214371, 1214372, 1214380, 1214386, 1214392, 1214393, 1214397, 1214428, 1214451, 1214659, 1214661, 1214729, 1214742, 1214743, 1214756
CVE References: CVE-2023-2007, CVE-2023-20588, CVE-2023-34319, CVE-2023-3610, CVE-2023-37453, CVE-2023-3772, CVE-2023-3863, CVE-2023-4128, CVE-2023-4133, CVE-2023-4134, CVE-2023-4147, CVE-2023-4194, CVE-2023-4273, CVE-2023-4387, CVE-2023-4459, CVE-2023-4569
Jira References: PED-4579, PED-4759, PED-4927, PED-4929, PED-5738, PED-6003, PED-6004
Sources used:
openSUSE Leap 15.4 (src): kernel-syms-5.14.21-150400.24.84.1, kernel-source-5.14.21-150400.24.84.1, kernel-default-base-5.14.21-150400.24.84.1.150400.24.37.1, kernel-obs-build-5.14.21-150400.24.84.1, kernel-livepatch-SLE15-SP4_Update_17-1-150400.9.3.1, kernel-obs-qa-5.14.21-150400.24.84.1
SUSE Linux Enterprise Micro for Rancher 5.3 (src): kernel-default-base-5.14.21-150400.24.84.1.150400.24.37.1
SUSE Linux Enterprise Micro 5.3 (src): kernel-default-base-5.14.21-150400.24.84.1.150400.24.37.1
SUSE Linux Enterprise Micro for Rancher 5.4 (src): kernel-default-base-5.14.21-150400.24.84.1.150400.24.37.1
SUSE Linux Enterprise Micro 5.4 (src): kernel-default-base-5.14.21-150400.24.84.1.150400.24.37.1
Basesystem Module 15-SP4 (src): kernel-default-base-5.14.21-150400.24.84.1.150400.24.37.1, kernel-source-5.14.21-150400.24.84.1
Development Tools Module 15-SP4 (src): kernel-syms-5.14.21-150400.24.84.1, kernel-obs-build-5.14.21-150400.24.84.1, kernel-source-5.14.21-150400.24.84.1
SUSE Linux Enterprise Live Patching 15-SP4 (src): kernel-livepatch-SLE15-SP4_Update_17-1-150400.9.3.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 34 Maintenance Automation 2023-09-26 12:30:13 UTC 
SUSE-SU-2023:3785-1: An update that solves 17 vulnerabilities, contains two features and has four security fixes can now be installed.

Category: security (important)
Bug References: 1023051, 1203517, 1210448, 1213272, 1213546, 1213601, 1213666, 1213916, 1213927, 1213968, 1213969, 1213970, 1213971, 1214019, 1214120, 1214149, 1214275, 1214297, 1214348, 1214350, 1214451
CVE References: CVE-2022-36402, CVE-2023-2007, CVE-2023-20588, CVE-2023-21400, CVE-2023-34319, CVE-2023-3772, CVE-2023-3863, CVE-2023-4128, CVE-2023-4132, CVE-2023-4133, CVE-2023-4134, CVE-2023-4147, CVE-2023-4194, CVE-2023-4273, CVE-2023-4385, CVE-2023-4387, CVE-2023-4459
Jira References: PED-4579, PED-5738
Sources used:

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 35 Maintenance Automation 2023-10-04 08:31:33 UTC 
SUSE-SU-2023:3964-1: An update that solves 16 vulnerabilities, contains seven features and has 49 security fixes can now be installed.

Category: security (important)
Bug References: 1023051, 1120059, 1177719, 1188885, 1193629, 1194869, 1205462, 1208902, 1208949, 1209284, 1209799, 1210048, 1210448, 1212091, 1212142, 1212526, 1212857, 1212873, 1213026, 1213123, 1213546, 1213580, 1213601, 1213666, 1213757, 1213759, 1213916, 1213921, 1213927, 1213946, 1213968, 1213970, 1213971, 1214000, 1214019, 1214120, 1214149, 1214180, 1214238, 1214285, 1214297, 1214299, 1214350, 1214368, 1214370, 1214371, 1214372, 1214380, 1214386, 1214392, 1214393, 1214397, 1214428, 1214451, 1214635, 1214659, 1214661, 1214729, 1214742, 1214743, 1214756, 1215522, 1215523, 1215552, 1215553
CVE References: CVE-2023-2007, CVE-2023-20588, CVE-2023-34319, CVE-2023-3610, CVE-2023-37453, CVE-2023-3772, CVE-2023-3863, CVE-2023-4128, CVE-2023-4133, CVE-2023-4134, CVE-2023-4147, CVE-2023-4194, CVE-2023-4273, CVE-2023-4387, CVE-2023-4459, CVE-2023-4569
Jira References: PED-4579, PED-4759, PED-4927, PED-4929, PED-5738, PED-6003, PED-6004
Sources used:
openSUSE Leap 15.4 (src): kernel-source-rt-5.14.21-150400.15.53.1, kernel-syms-rt-5.14.21-150400.15.53.1
SUSE Linux Enterprise Live Patching 15-SP4 (src): kernel-livepatch-SLE15-SP4-RT_Update_13-1-150400.1.3.1
SUSE Real Time Module 15-SP4 (src): kernel-source-rt-5.14.21-150400.15.53.1, kernel-syms-rt-5.14.21-150400.15.53.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 36 Maintenance Automation 2023-10-04 16:30:21 UTC 
SUSE-SU-2023:3971-1: An update that solves 20 vulnerabilities, contains eight features and has 58 security fixes can now be installed.

Category: security (important)
Bug References: 1023051, 1120059, 1177719, 1188885, 1193629, 1194869, 1203329, 1203330, 1205462, 1206453, 1208902, 1208949, 1209284, 1209799, 1210048, 1210448, 1211220, 1212091, 1212142, 1212423, 1212526, 1212857, 1212873, 1213026, 1213123, 1213546, 1213580, 1213601, 1213666, 1213733, 1213757, 1213759, 1213916, 1213921, 1213927, 1213946, 1213949, 1213968, 1213970, 1213971, 1214000, 1214019, 1214073, 1214120, 1214149, 1214180, 1214233, 1214238, 1214285, 1214297, 1214299, 1214305, 1214350, 1214368, 1214370, 1214371, 1214372, 1214380, 1214386, 1214392, 1214393, 1214397, 1214404, 1214428, 1214451, 1214635, 1214659, 1214661, 1214727, 1214729, 1214742, 1214743, 1214756, 1214976, 1215522, 1215523, 1215552, 1215553
CVE References: CVE-2022-38457, CVE-2022-40133, CVE-2023-2007, CVE-2023-20588, CVE-2023-34319, CVE-2023-3610, CVE-2023-37453, CVE-2023-3772, CVE-2023-3863, CVE-2023-40283, CVE-2023-4128, CVE-2023-4133, CVE-2023-4134, CVE-2023-4147, CVE-2023-4194, CVE-2023-4273, CVE-2023-4387, CVE-2023-4459, CVE-2023-4563, CVE-2023-4569
Jira References: PED-3924, PED-4579, PED-4759, PED-4927, PED-4929, PED-5738, PED-6003, PED-6004
Sources used:
openSUSE Leap 15.5 (src): kernel-obs-build-5.14.21-150500.55.28.1, kernel-obs-qa-5.14.21-150500.55.28.1, kernel-syms-5.14.21-150500.55.28.1, kernel-source-5.14.21-150500.55.28.1, kernel-default-base-5.14.21-150500.55.28.1.150500.6.11.2, kernel-livepatch-SLE15-SP5_Update_5-1-150500.11.5.1
SUSE Linux Enterprise Micro 5.5 (src): kernel-default-base-5.14.21-150500.55.28.1.150500.6.11.2
Basesystem Module 15-SP5 (src): kernel-default-base-5.14.21-150500.55.28.1.150500.6.11.2, kernel-source-5.14.21-150500.55.28.1
Development Tools Module 15-SP5 (src): kernel-obs-build-5.14.21-150500.55.28.1, kernel-syms-5.14.21-150500.55.28.1, kernel-source-5.14.21-150500.55.28.1
SUSE Linux Enterprise Live Patching 15-SP5 (src): kernel-livepatch-SLE15-SP5_Update_5-1-150500.11.5.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 37 Maintenance Automation 2023-10-04 16:30:48 UTC 
SUSE-SU-2023:3969-1: An update that solves 16 vulnerabilities, contains seven features and has 49 security fixes can now be installed.

Category: security (important)
Bug References: 1023051, 1120059, 1177719, 1188885, 1193629, 1194869, 1205462, 1208902, 1208949, 1209284, 1209799, 1210048, 1210448, 1212091, 1212142, 1212526, 1212857, 1212873, 1213026, 1213123, 1213546, 1213580, 1213601, 1213666, 1213757, 1213759, 1213916, 1213921, 1213927, 1213946, 1213968, 1213970, 1213971, 1214000, 1214019, 1214120, 1214149, 1214180, 1214238, 1214285, 1214297, 1214299, 1214350, 1214368, 1214370, 1214371, 1214372, 1214380, 1214386, 1214392, 1214393, 1214397, 1214428, 1214451, 1214635, 1214659, 1214661, 1214729, 1214742, 1214743, 1214756, 1215522, 1215523, 1215552, 1215553
CVE References: CVE-2023-2007, CVE-2023-20588, CVE-2023-34319, CVE-2023-3610, CVE-2023-37453, CVE-2023-3772, CVE-2023-3863, CVE-2023-4128, CVE-2023-4133, CVE-2023-4134, CVE-2023-4147, CVE-2023-4194, CVE-2023-4273, CVE-2023-4387, CVE-2023-4459, CVE-2023-4569
Jira References: PED-4579, PED-4759, PED-4927, PED-4929, PED-5738, PED-6003, PED-6004
Sources used:
openSUSE Leap 15.4 (src): kernel-source-5.14.21-150400.24.88.1, kernel-livepatch-SLE15-SP4_Update_18-1-150400.9.3.1, kernel-syms-5.14.21-150400.24.88.1, kernel-obs-qa-5.14.21-150400.24.88.1, kernel-obs-build-5.14.21-150400.24.88.1, kernel-default-base-5.14.21-150400.24.88.1.150400.24.40.1
SUSE Linux Enterprise Micro for Rancher 5.3 (src): kernel-default-base-5.14.21-150400.24.88.1.150400.24.40.1
SUSE Linux Enterprise Micro 5.3 (src): kernel-default-base-5.14.21-150400.24.88.1.150400.24.40.1
SUSE Linux Enterprise Micro for Rancher 5.4 (src): kernel-default-base-5.14.21-150400.24.88.1.150400.24.40.1
SUSE Linux Enterprise Micro 5.4 (src): kernel-default-base-5.14.21-150400.24.88.1.150400.24.40.1
Basesystem Module 15-SP4 (src): kernel-source-5.14.21-150400.24.88.1, kernel-default-base-5.14.21-150400.24.88.1.150400.24.40.1
Development Tools Module 15-SP4 (src): kernel-obs-build-5.14.21-150400.24.88.1, kernel-source-5.14.21-150400.24.88.1, kernel-syms-5.14.21-150400.24.88.1
SUSE Linux Enterprise Live Patching 15-SP4 (src): kernel-livepatch-SLE15-SP4_Update_18-1-150400.9.3.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 38 Maintenance Automation 2023-10-05 16:29:23 UTC 
SUSE-SU-2023:3988-1: An update that solves 24 vulnerabilities, contains 10 features and has 64 security fixes can now be installed.

Category: security (important)
Bug References: 1023051, 1065729, 1120059, 1177719, 1187236, 1188885, 1193629, 1194869, 1203329, 1203330, 1205462, 1206453, 1208902, 1208949, 1208995, 1209284, 1209799, 1210048, 1210169, 1210448, 1210643, 1211220, 1212091, 1212142, 1212423, 1212526, 1212857, 1212873, 1213026, 1213123, 1213546, 1213580, 1213601, 1213666, 1213733, 1213757, 1213759, 1213916, 1213921, 1213927, 1213946, 1213949, 1213968, 1213970, 1213971, 1214000, 1214019, 1214073, 1214120, 1214149, 1214180, 1214233, 1214238, 1214285, 1214297, 1214299, 1214305, 1214350, 1214368, 1214370, 1214371, 1214372, 1214380, 1214386, 1214392, 1214393, 1214397, 1214404, 1214428, 1214451, 1214635, 1214659, 1214661, 1214727, 1214729, 1214742, 1214743, 1214756, 1214813, 1214873, 1214928, 1214976, 1214988, 1215123, 1215124, 1215148, 1215221, 1215523
CVE References: CVE-2022-38457, CVE-2022-40133, CVE-2023-1192, CVE-2023-1859, CVE-2023-2007, CVE-2023-20588, CVE-2023-2177, CVE-2023-34319, CVE-2023-3610, CVE-2023-37453, CVE-2023-3772, CVE-2023-3863, CVE-2023-40283, CVE-2023-4128, CVE-2023-4133, CVE-2023-4134, CVE-2023-4147, CVE-2023-4194, CVE-2023-4273, CVE-2023-4387, CVE-2023-4459, CVE-2023-4563, CVE-2023-4569, CVE-2023-4881
Jira References: PED-2023, PED-2025, PED-3924, PED-4579, PED-4759, PED-4927, PED-4929, PED-5738, PED-6003, PED-6004
Sources used:
SUSE Real Time Module 15-SP5 (src): kernel-syms-rt-5.14.21-150500.13.18.1, kernel-source-rt-5.14.21-150500.13.18.1
openSUSE Leap 15.5 (src): kernel-syms-rt-5.14.21-150500.13.18.1, kernel-livepatch-SLE15-SP5-RT_Update_5-1-150500.11.3.1, kernel-source-rt-5.14.21-150500.13.18.1
SUSE Linux Enterprise Live Patching 15-SP5 (src): kernel-livepatch-SLE15-SP5-RT_Update_5-1-150500.11.3.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 43 Robert Frohl 2024-05-23 08:36:35 UTC 
done, closing