{"schema_version":"1.7.2","id":"OESA-2023-1634","modified":"2023-09-15T11:05:55Z","published":"2023-09-15T11:05:55Z","upstream":["CVE-2023-32247","CVE-2023-3777","CVE-2023-4015","CVE-2023-4206","CVE-2023-4207","CVE-2023-4208","CVE-2023-4622"],"summary":"kernel security update","details":"The Linux Kernel, the operating system core itself.\r\n\r\nSecurity Fix(es):\r\n\r\nA flaw was found in the Linux kernel\u0026apos;s ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the handling of SMB2_SESSION_SETUP commands. The issue results from the lack of control of resource consumption. An attacker can leverage this vulnerability to create a denial-of-service condition on the system.(CVE-2023-32247)\r\n\r\nA use-after-free vulnerability in the Linux kernel\u0026apos;s netfilter: nf_tables component can be exploited to achieve local privilege escalation.\r\n\r\nWhen nf_tables_delrule() is flushing table rules, it is not checked whether the chain is bound and the chain\u0026apos;s owner rule can also release the objects in certain circumstances.\r\n\r\nWe recommend upgrading past commit 6eaf41e87a223ae6f8e7a28d6e78384ad7e407f8.\r\n\r\n(CVE-2023-3777)\r\n\r\nA use-after-free vulnerability in the Linux kernel\u0026apos;s netfilter: nf_tables component can be exploited to achieve local privilege escalation.\r\n\r\nOn an error when building a nftables rule, deactivating immediate expressions in nft_immediate_deactivate() can lead unbinding the chain and objects be deactivated but later used.\r\n\r\nWe recommend upgrading past commit 0a771f7b266b02d262900c75f1e175c7fe76fec2.\r\n\r\n(CVE-2023-4015)\r\n\r\nA use-after-free vulnerability in the Linux kernel\u0026apos;s net/sched: cls_route component can be exploited to achieve local privilege escalation.\r\n\r\nWhen route4_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter. This causes a problem when updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-free.\r\n\r\nWe recommend upgrading past commit b80b829e9e2c1b3f7aae34855e04d8f6ecaf13c8.\r\n\r\n(CVE-2023-4206)\r\n\r\nA use-after-free vulnerability in the Linux kernel\u0026apos;s net/sched: cls_fw component can be exploited to achieve local privilege escalation.\r\n\r\nWhen fw_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter. This causes a problem when updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-free.\r\n\r\nWe recommend upgrading past commit 76e42ae831991c828cffa8c37736ebfb831ad5ec.\r\n\r\n(CVE-2023-4207)\r\n\r\nA use-after-free vulnerability in the Linux kernel\u0026apos;s net/sched: cls_u32 component can be exploited to achieve local privilege escalation.\r\n\r\nWhen u32_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter. This causes a problem when updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-free.\r\n\r\nWe recommend upgrading past commit 3044b16e7c6fe5d24b1cdbcf1bd0a9d92d1ebd81.\r\n\r\n(CVE-2023-4208)\r\n\r\nA use-after-free vulnerability in the Linux kernel\u0026apos;s af_unix component can be exploited to achieve local privilege escalation.\r\n\r\nThe unix_stream_sendpage() function tries to add data to the last skb in the peer\u0026apos;s recv queue without locking the queue. Thus there is a race where unix_stream_sendpage() could access an skb locklessly that is being released by garbage collection, resulting in use-after-free.\r\n\r\nWe recommend upgrading past commit 790c2f9d15b594350ae9bca7b236f2b1859de02c.\r\n\r\n(CVE-2023-4622)","affected":[{"package":{"ecosystem":"openEuler:22.03-LTS","name":"kernel","purl":"pkg:rpm/openEuler/kernel\u0026distro=openEuler-22.03-LTS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.0-60.111.0.138.oe2203"}]}],"ecosystem_specific":{"aarch64":["kernel-tools-devel-5.10.0-60.111.0.138.oe2203.aarch64.rpm","bpftool-debuginfo-5.10.0-60.111.0.138.oe2203.aarch64.rpm","kernel-tools-5.10.0-60.111.0.138.oe2203.aarch64.rpm","kernel-debuginfo-5.10.0-60.111.0.138.oe2203.aarch64.rpm","kernel-devel-5.10.0-60.111.0.138.oe2203.aarch64.rpm","perf-debuginfo-5.10.0-60.111.0.138.oe2203.aarch64.rpm","kernel-5.10.0-60.111.0.138.oe2203.aarch64.rpm","kernel-tools-debuginfo-5.10.0-60.111.0.138.oe2203.aarch64.rpm","python3-perf-5.10.0-60.111.0.138.oe2203.aarch64.rpm","kernel-source-5.10.0-60.111.0.138.oe2203.aarch64.rpm","perf-5.10.0-60.111.0.138.oe2203.aarch64.rpm","bpftool-5.10.0-60.111.0.138.oe2203.aarch64.rpm","python3-perf-debuginfo-5.10.0-60.111.0.138.oe2203.aarch64.rpm","kernel-headers-5.10.0-60.111.0.138.oe2203.aarch64.rpm","kernel-debugsource-5.10.0-60.111.0.138.oe2203.aarch64.rpm"],"src":["kernel-5.10.0-60.111.0.138.oe2203.src.rpm"],"x86_64":["kernel-devel-5.10.0-60.111.0.138.oe2203.x86_64.rpm","kernel-5.10.0-60.111.0.138.oe2203.x86_64.rpm","python3-perf-5.10.0-60.111.0.138.oe2203.x86_64.rpm","perf-5.10.0-60.111.0.138.oe2203.x86_64.rpm","kernel-headers-5.10.0-60.111.0.138.oe2203.x86_64.rpm","kernel-debugsource-5.10.0-60.111.0.138.oe2203.x86_64.rpm","kernel-tools-devel-5.10.0-60.111.0.138.oe2203.x86_64.rpm","bpftool-debuginfo-5.10.0-60.111.0.138.oe2203.x86_64.rpm","kernel-tools-debuginfo-5.10.0-60.111.0.138.oe2203.x86_64.rpm","bpftool-5.10.0-60.111.0.138.oe2203.x86_64.rpm","python3-perf-debuginfo-5.10.0-60.111.0.138.oe2203.x86_64.rpm","kernel-tools-5.10.0-60.111.0.138.oe2203.x86_64.rpm","kernel-source-5.10.0-60.111.0.138.oe2203.x86_64.rpm","kernel-debuginfo-5.10.0-60.111.0.138.oe2203.x86_64.rpm","perf-debuginfo-5.10.0-60.111.0.138.oe2203.x86_64.rpm"]}}],"references":[{"type":"ADVISORY","url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1634"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-32247"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-3777"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4015"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4206"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4207"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4208"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4622"}],"database_specific":{"severity":"High"}}