SUSE-SU-2025:20367-1

Vulnerability from csaf_suse - Published: 2025-05-28 10:02 - Updated: 2025-05-28 10:02
Summary
Security update for kernel-livepatch-MICRO-6-0_Update_2

Notes

Title of the patch
Security update for kernel-livepatch-MICRO-6-0_Update_2
Description of the patch
This update for kernel-livepatch-MICRO-6-0_Update_2 fixes the following issues: - CVE-2024-53042: ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_init_flow() (bsc#1233678) - CVE-2024-53156: wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service() (bsc#1234847) - CVE-2024-50115: KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory (bsc#1233019)
Patchnames
SUSE-SLE-Micro-6.1-kernel-28
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for kernel-livepatch-MICRO-6-0_Update_2",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for kernel-livepatch-MICRO-6-0_Update_2 fixes the following issues:\n\n- CVE-2024-53042: ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_init_flow() (bsc#1233678)\n- CVE-2024-53156: wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service() (bsc#1234847)\n- CVE-2024-50115: KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory (bsc#1233019)\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SLE-Micro-6.1-kernel-28",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2025_20367-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2025:20367-1",
        "url": "https://www.suse.com/support/update/announcement/2025/suse-su-202520367-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2025:20367-1",
        "url": "https://lists.suse.com/pipermail/sle-updates/2025-June/039492.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1233019",
        "url": "https://bugzilla.suse.com/1233019"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1233678",
        "url": "https://bugzilla.suse.com/1233678"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1234847",
        "url": "https://bugzilla.suse.com/1234847"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-50115 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-50115/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-53042 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-53042/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-53156 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-53156/"
      }
    ],
    "title": "Security update for kernel-livepatch-MICRO-6-0_Update_2",
    "tracking": {
      "current_release_date": "2025-05-28T10:02:19Z",
      "generator": {
        "date": "2025-05-28T10:02:19Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2025:20367-1",
      "initial_release_date": "2025-05-28T10:02:19Z",
      "revision_history": [
        {
          "date": "2025-05-28T10:02:19Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "kernel-livepatch-6_4_0-19-default-5-1.1.s390x",
                "product": {
                  "name": "kernel-livepatch-6_4_0-19-default-5-1.1.s390x",
                  "product_id": "kernel-livepatch-6_4_0-19-default-5-1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "kernel-livepatch-6_4_0-19-default-5-1.1.x86_64",
                "product": {
                  "name": "kernel-livepatch-6_4_0-19-default-5-1.1.x86_64",
                  "product_id": "kernel-livepatch-6_4_0-19-default-5-1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Micro 6.1",
                "product": {
                  "name": "SUSE Linux Micro 6.1",
                  "product_id": "SUSE Linux Micro 6.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sl-micro:6.1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-livepatch-6_4_0-19-default-5-1.1.s390x as component of SUSE Linux Micro 6.1",
          "product_id": "SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-19-default-5-1.1.s390x"
        },
        "product_reference": "kernel-livepatch-6_4_0-19-default-5-1.1.s390x",
        "relates_to_product_reference": "SUSE Linux Micro 6.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-livepatch-6_4_0-19-default-5-1.1.x86_64 as component of SUSE Linux Micro 6.1",
          "product_id": "SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-19-default-5-1.1.x86_64"
        },
        "product_reference": "kernel-livepatch-6_4_0-19-default-5-1.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Micro 6.1"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-50115",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-50115"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory\n\nIgnore nCR3[4:0] when loading PDPTEs from memory for nested SVM, as bits\n4:0 of CR3 are ignored when PAE paging is used, and thus VMRUN doesn\u0027t\nenforce 32-byte alignment of nCR3.\n\nIn the absolute worst case scenario, failure to ignore bits 4:0 can result\nin an out-of-bounds read, e.g. if the target page is at the end of a\nmemslot, and the VMM isn\u0027t using guard pages.\n\nPer the APM:\n\n  The CR3 register points to the base address of the page-directory-pointer\n  table. The page-directory-pointer table is aligned on a 32-byte boundary,\n  with the low 5 address bits 4:0 assumed to be 0.\n\nAnd the SDM\u0027s much more explicit:\n\n  4:0    Ignored\n\nNote, KVM gets this right when loading PDPTRs, it\u0027s only the nSVM flow\nthat is broken.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-19-default-5-1.1.s390x",
          "SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-19-default-5-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-50115",
          "url": "https://www.suse.com/security/cve/CVE-2024-50115"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1225742 for CVE-2024-50115",
          "url": "https://bugzilla.suse.com/1225742"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1232919 for CVE-2024-50115",
          "url": "https://bugzilla.suse.com/1232919"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1233019 for CVE-2024-50115",
          "url": "https://bugzilla.suse.com/1233019"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-19-default-5-1.1.s390x",
            "SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-19-default-5-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-19-default-5-1.1.s390x",
            "SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-19-default-5-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-05-28T10:02:19Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-50115"
    },
    {
      "cve": "CVE-2024-53042",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-53042"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_init_flow()\n\nThere are code paths from which the function is called without holding\nthe RCU read lock, resulting in a suspicious RCU usage warning [1].\n\nFix by using l3mdev_master_upper_ifindex_by_index() which will acquire\nthe RCU read lock before calling\nl3mdev_master_upper_ifindex_by_index_rcu().\n\n[1]\nWARNING: suspicious RCU usage\n6.12.0-rc3-custom-gac8f72681cf2 #141 Not tainted\n-----------------------------\nnet/core/dev.c:876 RCU-list traversed in non-reader section!!\n\nother info that might help us debug this:\n\nrcu_scheduler_active = 2, debug_locks = 1\n1 lock held by ip/361:\n #0: ffffffff86fc7cb0 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x377/0xf60\n\nstack backtrace:\nCPU: 3 UID: 0 PID: 361 Comm: ip Not tainted 6.12.0-rc3-custom-gac8f72681cf2 #141\nHardware name: Bochs Bochs, BIOS Bochs 01/01/2011\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0xba/0x110\n lockdep_rcu_suspicious.cold+0x4f/0xd6\n dev_get_by_index_rcu+0x1d3/0x210\n l3mdev_master_upper_ifindex_by_index_rcu+0x2b/0xf0\n ip_tunnel_bind_dev+0x72f/0xa00\n ip_tunnel_newlink+0x368/0x7a0\n ipgre_newlink+0x14c/0x170\n __rtnl_newlink+0x1173/0x19c0\n rtnl_newlink+0x6c/0xa0\n rtnetlink_rcv_msg+0x3cc/0xf60\n netlink_rcv_skb+0x171/0x450\n netlink_unicast+0x539/0x7f0\n netlink_sendmsg+0x8c1/0xd80\n ____sys_sendmsg+0x8f9/0xc20\n ___sys_sendmsg+0x197/0x1e0\n __sys_sendmsg+0x122/0x1f0\n do_syscall_64+0xbb/0x1d0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-19-default-5-1.1.s390x",
          "SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-19-default-5-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-53042",
          "url": "https://www.suse.com/security/cve/CVE-2024-53042"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1233540 for CVE-2024-53042",
          "url": "https://bugzilla.suse.com/1233540"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1233678 for CVE-2024-53042",
          "url": "https://bugzilla.suse.com/1233678"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-19-default-5-1.1.s390x",
            "SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-19-default-5-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-19-default-5-1.1.s390x",
            "SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-19-default-5-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-05-28T10:02:19Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-53042"
    },
    {
      "cve": "CVE-2024-53156",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-53156"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath9k: add range check for conn_rsp_epid in htc_connect_service()\n\nI found the following bug in my fuzzer:\n\n  UBSAN: array-index-out-of-bounds in drivers/net/wireless/ath/ath9k/htc_hst.c:26:51\n  index 255 is out of range for type \u0027htc_endpoint [22]\u0027\n  CPU: 0 UID: 0 PID: 8 Comm: kworker/0:0 Not tainted 6.11.0-rc6-dirty #14\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\n  Workqueue: events request_firmware_work_func\n  Call Trace:\n   \u003cTASK\u003e\n   dump_stack_lvl+0x180/0x1b0\n   __ubsan_handle_out_of_bounds+0xd4/0x130\n   htc_issue_send.constprop.0+0x20c/0x230\n   ? _raw_spin_unlock_irqrestore+0x3c/0x70\n   ath9k_wmi_cmd+0x41d/0x610\n   ? mark_held_locks+0x9f/0xe0\n   ...\n\nSince this bug has been confirmed to be caused by insufficient verification\nof conn_rsp_epid, I think it would be appropriate to add a range check for\nconn_rsp_epid to htc_connect_service() to prevent the bug from occurring.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-19-default-5-1.1.s390x",
          "SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-19-default-5-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-53156",
          "url": "https://www.suse.com/security/cve/CVE-2024-53156"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1234846 for CVE-2024-53156",
          "url": "https://bugzilla.suse.com/1234846"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1234847 for CVE-2024-53156",
          "url": "https://bugzilla.suse.com/1234847"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1234853 for CVE-2024-53156",
          "url": "https://bugzilla.suse.com/1234853"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-19-default-5-1.1.s390x",
            "SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-19-default-5-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-19-default-5-1.1.s390x",
            "SUSE Linux Micro 6.1:kernel-livepatch-6_4_0-19-default-5-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-05-28T10:02:19Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-53156"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.