Bug 1203329 (CVE-2022-40133)

Summary: VUL-0: CVE-2022-40133: kernel: use-after-free in 'vmw_execbuf_tie_context' in vmxgfx
Product: [Novell Products] SUSE Security Incidents Reporter: Robert Frohl <rfrohl>
Component: IncidentsAssignee: Security Team bot <security-team>
Status: RESOLVED FIXED QA Contact: Security Team bot <security-team>
Severity: Normal    
Priority: P3 - Medium CC: abergmann, jack, meissner, mhocko, mkoutny, pmladek, security-team, tiwai, vasant.karasulli
Version: unspecified   
Target Milestone: ---   
Hardware: Other   
OS: Other   
URL: https://smash.suse.de/issue/341974/
See Also: https://bugzilla.suse.com/show_bug.cgi?id=1203330
https://bugzilla.suse.com/show_bug.cgi?id=1203331
https://bugzilla.suse.com/show_bug.cgi?id=1203332
https://bugzilla.suse.com/show_bug.cgi?id=1203517
Whiteboard: CVSSv3.1:SUSE:CVE-2022-40133:5.5:(AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Found By: Security Response Team Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---
Bug Depends on:    
Bug Blocks: 1203330    

Description Robert Frohl 2022-09-12 08:47:11 UTC 
CVE-2022-40133

A use-after-free(UAF) vulnerability was found in function
'vmw_execbuf_tie_context' in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in Linux
kernel's vmwgfx driver with device file '/dev/dri/renderD128 (or Dxxx)'. This
flaw allows a local attacker with a user account on the system to gain
privilege, causing a denial of service(DoS).

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-40133
https://www.cve.org/CVERecord?id=CVE-2022-40133
https://bugzilla.openanolis.cn/show_bug.cgi?id=2075
Comment 3 Petr Mladek 2022-09-19 10:57:11 UTC 
Thomas, this seems to be in your area. Please, handle the bug or eventually assign it to a more appropriate person.
Comment 4 Thomas Zimmermann 2022-09-23 07:20:52 UTC 
Hi

(In reply to Petr Mladek from comment #3)
> Thomas, this seems to be in your area. Please, handle the bug or eventually
> assign it to a more appropriate person.

I keep it on my radar, together with these other CVEs. But there's little information available. (?) The upstream trees for the driver don't have a patch yet.

I cannot access the bug tracked at openalolis.cn. Do we have a login to it?
Comment 5 Jan Kara 2022-10-12 16:34:42 UTC 
Thomas, by any chance did you notice anything that could match the CVE description?
Comment 6 Thomas Zimmermann 2022-10-13 11:34:20 UTC 
Hi

(In reply to Jan Kara from comment #5)
> Thomas, by any chance did you notice anything that could match the CVE
> description?

Neither for this CVE nor for the others against the vmwgfx driver. The code has not been touched in years and there's nothing on the mailing lists about these CVEs.

I'll reach out to the dev at VMware and ask for his opinion on the matter.
Comment 7 Petr Mladek 2022-11-16 09:03:51 UTC 
Is there any progress in fixing the bugs in upstream, please?
Comment 8 Thomas Zimmermann 2022-11-16 10:14:28 UTC 
(In reply to Petr Mladek from comment #7)
> Is there any progress in fixing the bugs in upstream, please?

No. It still stands as it is.
Comment 18 Jan Kara 2023-08-31 11:25:34 UTC 
Thomas, can you please have a look? The bug didn't get a serious attention since February... As Michal writes in comment 17, it would be good to at least understand whether this is a real issue or not and ideally whether commit a309c7194e8a ("drm/vmwgfx: Remove rcu locks from user resources") mentioned in comment 16 fixes the issue. I can see Takashi has already ported the commit to SLE15-SP5 so Takashi if you have any idea please speak up as well :)
Comment 19 Jan Kara 2023-08-31 11:36:33 UTC 
Oh, now I've reread also comment 12 so it seems the backport isn't really feasible. So can we just close this as WONTFIX? Upstream isn't going to help here in any way...
Comment 20 Thomas Zimmermann 2023-08-31 12:38:25 UTC 
Sorry, I've been away for several weeks.

(In reply to Jan Kara from comment #18)
> Thomas, can you please have a look? The bug didn't get a serious attention
> since February... As Michal writes in comment 17, it would be good to at
> least understand whether this is a real issue or not and ideally whether
> commit a309c7194e8a ("drm/vmwgfx: Remove rcu locks from user resources")
> mentioned in comment 16 fixes the issue. I can see Takashi has already
> ported the commit to SLE15-SP5 so Takashi if you have any idea please speak
> up as well :)

If Takashi backported that fix, I assume that it resolves the problem.

As I mention in comment #12, the upstream commit depends on a larger refactoring. So Takashi's patch is probably heavily modified. (?)

Without a clear reproducer, I cannot tell if the bug is really gone. Let's reference the bug report and the CVE from the patchfile and call it FIXED.

Do we need the backport in anything other than SLE15-SP5?
Comment 21 Jan Kara 2023-08-31 14:07:11 UTC 
Yeah, so the commit a309c7194e8a got backported because of bug 1213632 which apparently started to trigger due to backport of other commits you mention in comment 12 as part of git-fixes process. None of these changes seem to be in SLE15-SP4 or older branches, likely because SP4 doesn't have 8afa13a0583f ("drm/vmwgfx: Implement DRIVER_GEM") which got to SP5 based on a feature request during development.

Strictly speaking, since this is a security issue, we should be backporting the fix to all affected codestreams. Given the older code streams don't have 8afa13a0583f ("drm/vmwgfx: Implement DRIVER_GEM") it is even questionable whether they are affected by this security issue (given the time of report my guess would be the crash started triggering by this rewrite) or whether a backport is feasible. Up to you to ultimately decide. My uneducated guess would be to mark only codestreams with 8afa13a0583f as affected, add proper CVE reference to backport of a309c7194e8a and be done with this.
Comment 22 Thomas Zimmermann 2023-08-31 14:15:50 UTC 
(In reply to Jan Kara from comment #21)
> Yeah, so the commit a309c7194e8a got backported because of bug 1213632 which
> apparently started to trigger due to backport of other commits you mention
> in comment 12 as part of git-fixes process. None of these changes seem to be
> in SLE15-SP4 or older branches, likely because SP4 doesn't have 8afa13a0583f
> ("drm/vmwgfx: Implement DRIVER_GEM") which got to SP5 based on a feature
> request during development.

Without GEM, this would maybe be an even greater challenge to backport. GEM is the standard interface (ioctls + internals) for DRM memory management. For a long time, vmwgfx did its own thing. VMware finally ported the driver to the GEM interfaces a few kernel releases ago. It was the last driver without GEM support.

> 
> Strictly speaking, since this is a security issue, we should be backporting
> the fix to all affected codestreams. Given the older code streams don't have
> 8afa13a0583f ("drm/vmwgfx: Implement DRIVER_GEM") it is even questionable
> whether they are affected by this security issue (given the time of report
> my guess would be the crash started triggering by this rewrite) or whether a
> backport is feasible. Up to you to ultimately decide. My uneducated guess
> would be to mark only codestreams with 8afa13a0583f as affected, add proper
> CVE reference to backport of a309c7194e8a and be done with this.

I agree.
Comment 23 Thomas Zimmermann 2023-09-05 08:08:03 UTC 
I have updated the patch file for bug 1213632 in SLE15-SP5 with the number and CVE of this bug report. I consider this issue fixed.
Comment 28 Maintenance Automation 2023-09-14 12:30:57 UTC 
SUSE-SU-2023:3599-1: An update that solves 20 vulnerabilities, contains eight features and has 53 security fixes can now be installed.

Category: security (important)
Bug References: 1023051, 1120059, 1177719, 1188885, 1193629, 1194869, 1203329, 1203330, 1205462, 1206453, 1208902, 1208949, 1209284, 1209799, 1210048, 1210448, 1211220, 1212091, 1212142, 1212423, 1212526, 1212857, 1212873, 1213026, 1213123, 1213546, 1213580, 1213601, 1213666, 1213733, 1213757, 1213759, 1213916, 1213921, 1213927, 1213946, 1213949, 1213968, 1213970, 1213971, 1214000, 1214019, 1214073, 1214120, 1214149, 1214180, 1214233, 1214238, 1214285, 1214297, 1214299, 1214305, 1214350, 1214368, 1214370, 1214371, 1214372, 1214380, 1214386, 1214392, 1214393, 1214397, 1214404, 1214428, 1214451, 1214659, 1214661, 1214727, 1214729, 1214742, 1214743, 1214756, 1214976
CVE References: CVE-2022-38457, CVE-2022-40133, CVE-2023-2007, CVE-2023-20588, CVE-2023-34319, CVE-2023-3610, CVE-2023-37453, CVE-2023-3772, CVE-2023-3863, CVE-2023-40283, CVE-2023-4128, CVE-2023-4133, CVE-2023-4134, CVE-2023-4147, CVE-2023-4194, CVE-2023-4273, CVE-2023-4387, CVE-2023-4459, CVE-2023-4563, CVE-2023-4569
Jira References: PED-3924, PED-4579, PED-4759, PED-4927, PED-4929, PED-5738, PED-6003, PED-6004
Sources used:
openSUSE Leap 15.5 (src): kernel-syms-rt-5.14.21-150500.13.14.1, kernel-livepatch-SLE15-SP5-RT_Update_4-1-150500.11.3.1, kernel-source-rt-5.14.21-150500.13.14.1
SUSE Linux Enterprise Live Patching 15-SP5 (src): kernel-livepatch-SLE15-SP5-RT_Update_4-1-150500.11.3.1
SUSE Real Time Module 15-SP5 (src): kernel-syms-rt-5.14.21-150500.13.14.1, kernel-source-rt-5.14.21-150500.13.14.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 29 Maintenance Automation 2023-09-18 16:30:20 UTC 
SUSE-SU-2023:3656-1: An update that solves 20 vulnerabilities, contains eight features and has 54 security fixes can now be installed.

Category: security (important)
Bug References: 1023051, 1120059, 1177719, 1188885, 1193629, 1194869, 1203329, 1203330, 1205462, 1206453, 1208902, 1208949, 1209284, 1209799, 1210048, 1210448, 1211220, 1212091, 1212142, 1212423, 1212526, 1212857, 1212873, 1213026, 1213123, 1213546, 1213580, 1213601, 1213666, 1213733, 1213757, 1213759, 1213916, 1213921, 1213927, 1213946, 1213949, 1213968, 1213970, 1213971, 1214000, 1214019, 1214073, 1214120, 1214149, 1214180, 1214233, 1214238, 1214285, 1214297, 1214299, 1214305, 1214350, 1214368, 1214370, 1214371, 1214372, 1214380, 1214386, 1214392, 1214393, 1214397, 1214404, 1214428, 1214451, 1214659, 1214661, 1214727, 1214729, 1214742, 1214743, 1214756, 1214760, 1214976
CVE References: CVE-2022-38457, CVE-2022-40133, CVE-2023-2007, CVE-2023-20588, CVE-2023-34319, CVE-2023-3610, CVE-2023-37453, CVE-2023-3772, CVE-2023-3863, CVE-2023-40283, CVE-2023-4128, CVE-2023-4133, CVE-2023-4134, CVE-2023-4147, CVE-2023-4194, CVE-2023-4273, CVE-2023-4387, CVE-2023-4459, CVE-2023-4563, CVE-2023-4569
Jira References: PED-3924, PED-4579, PED-4759, PED-4927, PED-4929, PED-5738, PED-6003, PED-6004
Sources used:
openSUSE Leap 15.5 (src): kernel-source-azure-5.14.21-150500.33.17.1, kernel-syms-azure-5.14.21-150500.33.17.1
Public Cloud Module 15-SP5 (src): kernel-source-azure-5.14.21-150500.33.17.1, kernel-syms-azure-5.14.21-150500.33.17.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 30 Maintenance Automation 2023-09-20 12:30:17 UTC 
SUSE-SU-2023:3704-1: An update that solves 20 vulnerabilities, contains eight features and has 53 security fixes can now be installed.

Category: security (important)
Bug References: 1023051, 1120059, 1177719, 1188885, 1193629, 1194869, 1203329, 1203330, 1205462, 1206453, 1208902, 1208949, 1209284, 1209799, 1210048, 1210448, 1211220, 1212091, 1212142, 1212423, 1212526, 1212857, 1212873, 1213026, 1213123, 1213546, 1213580, 1213601, 1213666, 1213733, 1213757, 1213759, 1213916, 1213921, 1213927, 1213946, 1213949, 1213968, 1213970, 1213971, 1214000, 1214019, 1214073, 1214120, 1214149, 1214180, 1214233, 1214238, 1214285, 1214297, 1214299, 1214305, 1214350, 1214368, 1214370, 1214371, 1214372, 1214380, 1214386, 1214392, 1214393, 1214397, 1214404, 1214428, 1214451, 1214659, 1214661, 1214727, 1214729, 1214742, 1214743, 1214756, 1214976
CVE References: CVE-2022-38457, CVE-2022-40133, CVE-2023-2007, CVE-2023-20588, CVE-2023-34319, CVE-2023-3610, CVE-2023-37453, CVE-2023-3772, CVE-2023-3863, CVE-2023-40283, CVE-2023-4128, CVE-2023-4133, CVE-2023-4134, CVE-2023-4147, CVE-2023-4194, CVE-2023-4273, CVE-2023-4387, CVE-2023-4459, CVE-2023-4563, CVE-2023-4569
Jira References: PED-3924, PED-4579, PED-4759, PED-4927, PED-4929, PED-5738, PED-6003, PED-6004
Sources used:
openSUSE Leap 15.5 (src): kernel-livepatch-SLE15-SP5_Update_4-1-150500.11.3.1, kernel-obs-build-5.14.21-150500.55.22.1, kernel-syms-5.14.21-150500.55.22.1, kernel-obs-qa-5.14.21-150500.55.22.1, kernel-source-5.14.21-150500.55.22.1, kernel-default-base-5.14.21-150500.55.22.1.150500.6.8.1
Basesystem Module 15-SP5 (src): kernel-source-5.14.21-150500.55.22.1, kernel-default-base-5.14.21-150500.55.22.1.150500.6.8.1
Development Tools Module 15-SP5 (src): kernel-syms-5.14.21-150500.55.22.1, kernel-obs-build-5.14.21-150500.55.22.1, kernel-source-5.14.21-150500.55.22.1
SUSE Linux Enterprise Live Patching 15-SP5 (src): kernel-livepatch-SLE15-SP5_Update_4-1-150500.11.3.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 31 Maintenance Automation 2023-09-21 12:30:04 UTC 
SUSE-SU-2023:3599-2: An update that solves 20 vulnerabilities, contains eight features and has 53 security fixes can now be installed.

Category: security (important)
Bug References: 1023051, 1120059, 1177719, 1188885, 1193629, 1194869, 1203329, 1203330, 1205462, 1206453, 1208902, 1208949, 1209284, 1209799, 1210048, 1210448, 1211220, 1212091, 1212142, 1212423, 1212526, 1212857, 1212873, 1213026, 1213123, 1213546, 1213580, 1213601, 1213666, 1213733, 1213757, 1213759, 1213916, 1213921, 1213927, 1213946, 1213949, 1213968, 1213970, 1213971, 1214000, 1214019, 1214073, 1214120, 1214149, 1214180, 1214233, 1214238, 1214285, 1214297, 1214299, 1214305, 1214350, 1214368, 1214370, 1214371, 1214372, 1214380, 1214386, 1214392, 1214393, 1214397, 1214404, 1214428, 1214451, 1214659, 1214661, 1214727, 1214729, 1214742, 1214743, 1214756, 1214976
CVE References: CVE-2022-38457, CVE-2022-40133, CVE-2023-2007, CVE-2023-20588, CVE-2023-34319, CVE-2023-3610, CVE-2023-37453, CVE-2023-3772, CVE-2023-3863, CVE-2023-40283, CVE-2023-4128, CVE-2023-4133, CVE-2023-4134, CVE-2023-4147, CVE-2023-4194, CVE-2023-4273, CVE-2023-4387, CVE-2023-4459, CVE-2023-4563, CVE-2023-4569
Jira References: PED-3924, PED-4579, PED-4759, PED-4927, PED-4929, PED-5738, PED-6003, PED-6004
Sources used:
openSUSE Leap 15.5 (src): kernel-syms-rt-5.14.21-150500.13.14.1, kernel-source-rt-5.14.21-150500.13.14.1, kernel-livepatch-SLE15-SP5-RT_Update_4-1-150500.11.3.1
SUSE Linux Enterprise Live Patching 15-SP5 (src): kernel-livepatch-SLE15-SP5-RT_Update_4-1-150500.11.3.1
SUSE Real Time Module 15-SP5 (src): kernel-syms-rt-5.14.21-150500.13.14.1, kernel-source-rt-5.14.21-150500.13.14.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 32 Maintenance Automation 2023-09-21 12:30:56 UTC 
SUSE-SU-2023:3704-2: An update that solves 20 vulnerabilities, contains eight features and has 53 security fixes can now be installed.

Category: security (important)
Bug References: 1023051, 1120059, 1177719, 1188885, 1193629, 1194869, 1203329, 1203330, 1205462, 1206453, 1208902, 1208949, 1209284, 1209799, 1210048, 1210448, 1211220, 1212091, 1212142, 1212423, 1212526, 1212857, 1212873, 1213026, 1213123, 1213546, 1213580, 1213601, 1213666, 1213733, 1213757, 1213759, 1213916, 1213921, 1213927, 1213946, 1213949, 1213968, 1213970, 1213971, 1214000, 1214019, 1214073, 1214120, 1214149, 1214180, 1214233, 1214238, 1214285, 1214297, 1214299, 1214305, 1214350, 1214368, 1214370, 1214371, 1214372, 1214380, 1214386, 1214392, 1214393, 1214397, 1214404, 1214428, 1214451, 1214659, 1214661, 1214727, 1214729, 1214742, 1214743, 1214756, 1214976
CVE References: CVE-2022-38457, CVE-2022-40133, CVE-2023-2007, CVE-2023-20588, CVE-2023-34319, CVE-2023-3610, CVE-2023-37453, CVE-2023-3772, CVE-2023-3863, CVE-2023-40283, CVE-2023-4128, CVE-2023-4133, CVE-2023-4134, CVE-2023-4147, CVE-2023-4194, CVE-2023-4273, CVE-2023-4387, CVE-2023-4459, CVE-2023-4563, CVE-2023-4569
Jira References: PED-3924, PED-4579, PED-4759, PED-4927, PED-4929, PED-5738, PED-6003, PED-6004
Sources used:
openSUSE Leap 15.5 (src): kernel-livepatch-SLE15-SP5_Update_4-1-150500.11.3.1, kernel-obs-build-5.14.21-150500.55.22.1, kernel-syms-5.14.21-150500.55.22.1, kernel-obs-qa-5.14.21-150500.55.22.1, kernel-source-5.14.21-150500.55.22.1, kernel-default-base-5.14.21-150500.55.22.1.150500.6.8.1
Basesystem Module 15-SP5 (src): kernel-source-5.14.21-150500.55.22.1, kernel-default-base-5.14.21-150500.55.22.1.150500.6.8.1
Development Tools Module 15-SP5 (src): kernel-syms-5.14.21-150500.55.22.1, kernel-obs-build-5.14.21-150500.55.22.1, kernel-source-5.14.21-150500.55.22.1
SUSE Linux Enterprise Live Patching 15-SP5 (src): kernel-livepatch-SLE15-SP5_Update_4-1-150500.11.3.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 33 Maintenance Automation 2023-10-04 16:30:04 UTC 
SUSE-SU-2023:3971-1: An update that solves 20 vulnerabilities, contains eight features and has 58 security fixes can now be installed.

Category: security (important)
Bug References: 1023051, 1120059, 1177719, 1188885, 1193629, 1194869, 1203329, 1203330, 1205462, 1206453, 1208902, 1208949, 1209284, 1209799, 1210048, 1210448, 1211220, 1212091, 1212142, 1212423, 1212526, 1212857, 1212873, 1213026, 1213123, 1213546, 1213580, 1213601, 1213666, 1213733, 1213757, 1213759, 1213916, 1213921, 1213927, 1213946, 1213949, 1213968, 1213970, 1213971, 1214000, 1214019, 1214073, 1214120, 1214149, 1214180, 1214233, 1214238, 1214285, 1214297, 1214299, 1214305, 1214350, 1214368, 1214370, 1214371, 1214372, 1214380, 1214386, 1214392, 1214393, 1214397, 1214404, 1214428, 1214451, 1214635, 1214659, 1214661, 1214727, 1214729, 1214742, 1214743, 1214756, 1214976, 1215522, 1215523, 1215552, 1215553
CVE References: CVE-2022-38457, CVE-2022-40133, CVE-2023-2007, CVE-2023-20588, CVE-2023-34319, CVE-2023-3610, CVE-2023-37453, CVE-2023-3772, CVE-2023-3863, CVE-2023-40283, CVE-2023-4128, CVE-2023-4133, CVE-2023-4134, CVE-2023-4147, CVE-2023-4194, CVE-2023-4273, CVE-2023-4387, CVE-2023-4459, CVE-2023-4563, CVE-2023-4569
Jira References: PED-3924, PED-4579, PED-4759, PED-4927, PED-4929, PED-5738, PED-6003, PED-6004
Sources used:
openSUSE Leap 15.5 (src): kernel-obs-build-5.14.21-150500.55.28.1, kernel-obs-qa-5.14.21-150500.55.28.1, kernel-syms-5.14.21-150500.55.28.1, kernel-source-5.14.21-150500.55.28.1, kernel-default-base-5.14.21-150500.55.28.1.150500.6.11.2, kernel-livepatch-SLE15-SP5_Update_5-1-150500.11.5.1
SUSE Linux Enterprise Micro 5.5 (src): kernel-default-base-5.14.21-150500.55.28.1.150500.6.11.2
Basesystem Module 15-SP5 (src): kernel-default-base-5.14.21-150500.55.28.1.150500.6.11.2, kernel-source-5.14.21-150500.55.28.1
Development Tools Module 15-SP5 (src): kernel-obs-build-5.14.21-150500.55.28.1, kernel-syms-5.14.21-150500.55.28.1, kernel-source-5.14.21-150500.55.28.1
SUSE Linux Enterprise Live Patching 15-SP5 (src): kernel-livepatch-SLE15-SP5_Update_5-1-150500.11.5.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 34 Maintenance Automation 2023-10-05 16:29:12 UTC 
SUSE-SU-2023:3988-1: An update that solves 24 vulnerabilities, contains 10 features and has 64 security fixes can now be installed.

Category: security (important)
Bug References: 1023051, 1065729, 1120059, 1177719, 1187236, 1188885, 1193629, 1194869, 1203329, 1203330, 1205462, 1206453, 1208902, 1208949, 1208995, 1209284, 1209799, 1210048, 1210169, 1210448, 1210643, 1211220, 1212091, 1212142, 1212423, 1212526, 1212857, 1212873, 1213026, 1213123, 1213546, 1213580, 1213601, 1213666, 1213733, 1213757, 1213759, 1213916, 1213921, 1213927, 1213946, 1213949, 1213968, 1213970, 1213971, 1214000, 1214019, 1214073, 1214120, 1214149, 1214180, 1214233, 1214238, 1214285, 1214297, 1214299, 1214305, 1214350, 1214368, 1214370, 1214371, 1214372, 1214380, 1214386, 1214392, 1214393, 1214397, 1214404, 1214428, 1214451, 1214635, 1214659, 1214661, 1214727, 1214729, 1214742, 1214743, 1214756, 1214813, 1214873, 1214928, 1214976, 1214988, 1215123, 1215124, 1215148, 1215221, 1215523
CVE References: CVE-2022-38457, CVE-2022-40133, CVE-2023-1192, CVE-2023-1859, CVE-2023-2007, CVE-2023-20588, CVE-2023-2177, CVE-2023-34319, CVE-2023-3610, CVE-2023-37453, CVE-2023-3772, CVE-2023-3863, CVE-2023-40283, CVE-2023-4128, CVE-2023-4133, CVE-2023-4134, CVE-2023-4147, CVE-2023-4194, CVE-2023-4273, CVE-2023-4387, CVE-2023-4459, CVE-2023-4563, CVE-2023-4569, CVE-2023-4881
Jira References: PED-2023, PED-2025, PED-3924, PED-4579, PED-4759, PED-4927, PED-4929, PED-5738, PED-6003, PED-6004
Sources used:
SUSE Real Time Module 15-SP5 (src): kernel-syms-rt-5.14.21-150500.13.18.1, kernel-source-rt-5.14.21-150500.13.18.1
openSUSE Leap 15.5 (src): kernel-syms-rt-5.14.21-150500.13.18.1, kernel-livepatch-SLE15-SP5-RT_Update_5-1-150500.11.3.1, kernel-source-rt-5.14.21-150500.13.18.1
SUSE Linux Enterprise Live Patching 15-SP5 (src): kernel-livepatch-SLE15-SP5-RT_Update_5-1-150500.11.3.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 36 Robert Frohl 2023-10-26 09:09:18 UTC 
done