Lucene search

K
osvGoogleOSV:SUSE-SU-2024:3467-1
HistorySep 27, 2024 - 10:20 a.m.

Security update for the Linux Kernel

2024-09-2710:20:00
Google
osv.dev
suse linux enterprise
kernel update
security bugfixes
use-after-free
double free race
page content initialization
race condition
toctou vulnerability

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.2

Confidence

Low

The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

  • CVE-2022-48791: Fix use-after-free for aborted TMF sas_task (bsc#1228002)
  • CVE-2022-48919: Fix double free race when mount fails in cifs_get_root() (bsc#1229657).
  • CVE-2024-44947: Initialize beyond-EOF page contents before setting uptodate (bsc#1229454).
  • CVE-2024-43883: Do not drop references before new references are gained (bsc#1229707).
  • CVE-2024-43882: Fixed ToCToU between perm check and set-uid/gid usage. (bsc#1229503)
  • CVE-2024-42232: Fixed a race between delayed_work() and ceph_monc_stop(). (bsc#1228959)

The following non-security bugs were fixed:

  • fuse: fix SetPageUptodate() condition in STORE (bsc#1229456).
  • reiserfs: fix ‘new_insert_key may be used uninitialized …’ (bsc#1228938).
  • scsi: pm80xx: Fix TMF task completion race condition (bsc#1228002)

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.2

Confidence

Low