1210715 – (CVE-2023-2194) VUL-0: CVE-2023-2194: kernel-source,kernel-source-azure,kernel-source-rt: i2c: out-of-bounds write in xgene_slimpro_i2c_xfer()

Bug 1210715 (CVE-2023-2194) - VUL-0: CVE-2023-2194: kernel-source,kernel-source-azure,kernel-source-rt: i2c: out-of-bounds write in xgene_slimpro_i2c_xfer()

Summary: VUL-0: CVE-2023-2194: kernel-source,kernel-source-azure,kernel-source-rt: i2c...

Status:	RESOLVED FIXED

Alias:	CVE-2023-2194

Product:	SUSE Security Incidents
Classification:	Novell Products
Component:	Incidents (show other bugs)
Version:	unspecified
Hardware:	Other Other

Priority:	P3 - Medium Severity: Normal
Target Milestone:	---
Assignee:	Security Team bot
QA Contact:	Security Team bot

URL:	https://smash.suse.de/issue/364113/
Whiteboard:	CVSSv3.1:SUSE:CVE-2023-2194:6.1:(AV:L...
Keywords:

Depends on:
Blocks:

Clone This Bug

Reported:	2023-04-21 07:19 UTC by Thomas Leroy
Modified:	2024-05-06 12:45 UTC (History)
CC List:	5 users (show)

See Also:
Found By:	Security Response Team
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Thomas Leroy 2023-04-21 07:19:12 UTC

CVE-2023-2194

An out-of-bounds write vulnerability was found in the Linux kernel's SLIMpro I2C
device driver. The userspace "data->block[0]" variable was not capped to a
number between 0-255 and was used as the size of a memcpy, possibly writing
beyond the end of dma_buffer. This flaw could allow a local privileged user to
crash the system or potentially achieve code execution.

Upstream commit:
https://github.com/torvalds/linux/commit/92fbb6d1296f

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-2194
https://bugzilla.redhat.com/show_bug.cgi?id=2188396
https://www.cve.org/CVERecord?id=CVE-2023-2194

Comment 1 Thomas Leroy 2023-04-21 07:21:42 UTC

Affected:
- cve/linux-4.12
- cve/linux-4.4
- cve/linux-5.3

stable, master and SLE15-SP{4,5} are already fixed

Comment 2 Joey Lee 2023-04-21 09:40:21 UTC

(In reply to Thomas Leroy from comment #1)
> Affected:
> - cve/linux-4.12
> - cve/linux-4.4
> - cve/linux-5.3
> 
> stable, master and SLE15-SP{4,5} are already fixed

Thanks! I will backport it.

Comment 5 Joey Lee 2023-05-18 12:31:31 UTC

(In reply to Thomas Leroy from comment #1)
> Affected:
> - cve/linux-4.12
> - cve/linux-4.4
> - cve/linux-5.3
> 
> stable, master and SLE15-SP{4,5} are already fixed

I have backported 92fbb6d1296 patch to 

- cve/linux-4.12 [sent]
- cve/linux-4.4  [sent]
- cve/linux-5.3  [sent]

waiting to be merged.

Comment 6 Joey Lee 2023-05-24 06:21:52 UTC

(In reply to Joey Lee from comment #5)
> (In reply to Thomas Leroy from comment #1)
> > Affected:
> > - cve/linux-4.12
> > - cve/linux-4.4
> > - cve/linux-5.3
> > 
> > stable, master and SLE15-SP{4,5} are already fixed
> 
> I have backported 92fbb6d1296 patch to 
> 
> - cve/linux-4.12 [sent]
> - cve/linux-4.4  [sent]
> - cve/linux-5.3  [sent]
> 
> waiting to be merged.

- cve/linux-4.12 [OK]
- cve/linux-4.4  [OK]
- cve/linux-5.3  [OK]

backporting patch be merged. Reset assigner.

Comment 20 Maintenance Automation 2023-06-13 16:30:10 UTC

SUSE-SU-2023:2502-1: An update that solves 21 vulnerabilities and has four fixes can now be installed.

Category: security (important)
Bug References: 1199636, 1204405, 1205756, 1205758, 1205760, 1205762, 1205803, 1206024, 1208474, 1208604, 1209287, 1209779, 1210715, 1210783, 1210940, 1211037, 1211043, 1211105, 1211131, 1211186, 1211203, 1211590, 1211592, 1211596, 1211622
CVE References: CVE-2020-36694, CVE-2022-3566, CVE-2022-4269, CVE-2022-45884, CVE-2022-45885, CVE-2022-45886, CVE-2022-45887, CVE-2022-45919, CVE-2023-1079, CVE-2023-1380, CVE-2023-1637, CVE-2023-2156, CVE-2023-2194, CVE-2023-23586, CVE-2023-2483, CVE-2023-2513, CVE-2023-31084, CVE-2023-31436, CVE-2023-32233, CVE-2023-32269, CVE-2023-33288
Sources used:
SUSE Real Time Module 15-SP3 (src): kernel-syms-rt-5.3.18-150300.130.1, kernel-source-rt-5.3.18-150300.130.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 21 Maintenance Automation 2023-06-13 16:30:21 UTC

SUSE-SU-2023:2501-1: An update that solves 16 vulnerabilities and has 22 fixes can now be installed.

Category: security (important)
Bug References: 1065729, 1118212, 1129770, 1154048, 1204405, 1205756, 1205758, 1205760, 1205762, 1205803, 1206878, 1209287, 1209366, 1209857, 1210544, 1210629, 1210715, 1210783, 1210806, 1210940, 1211037, 1211044, 1211105, 1211186, 1211275, 1211360, 1211361, 1211362, 1211363, 1211364, 1211365, 1211366, 1211466, 1211592, 1211622, 1211801, 1211816, 1211960
CVE References: CVE-2022-3566, CVE-2022-45884, CVE-2022-45885, CVE-2022-45886, CVE-2022-45887, CVE-2022-45919, CVE-2023-1380, CVE-2023-2176, CVE-2023-2194, CVE-2023-2269, CVE-2023-2483, CVE-2023-2513, CVE-2023-28466, CVE-2023-31084, CVE-2023-31436, CVE-2023-32269
Sources used:
SUSE Linux Enterprise Real Time 12 SP5 (src): kernel-syms-rt-4.12.14-10.127.1, kernel-source-rt-4.12.14-10.127.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 22 Maintenance Automation 2023-06-14 08:30:10 UTC

SUSE-SU-2023:2507-1: An update that solves 15 vulnerabilities and has 28 fixes can now be installed.

Category: security (important)
Bug References: 1065729, 1118212, 1129770, 1154048, 1172073, 1191731, 1199046, 1204405, 1205756, 1205758, 1205760, 1205762, 1205803, 1206878, 1209287, 1209366, 1209857, 1210544, 1210629, 1210715, 1210783, 1210791, 1210806, 1210940, 1211044, 1211089, 1211105, 1211186, 1211275, 1211360, 1211361, 1211362, 1211363, 1211364, 1211365, 1211366, 1211466, 1211592, 1211622, 1211796, 1211801, 1211816, 1211960
CVE References: CVE-2022-3566, CVE-2022-45884, CVE-2022-45885, CVE-2022-45886, CVE-2022-45887, CVE-2022-45919, CVE-2023-1380, CVE-2023-2176, CVE-2023-2194, CVE-2023-2269, CVE-2023-2513, CVE-2023-28466, CVE-2023-31084, CVE-2023-31436, CVE-2023-32269
Sources used:
SUSE Linux Enterprise Server for SAP Applications 12 SP5 (src): kernel-syms-azure-4.12.14-16.136.1, kernel-source-azure-4.12.14-16.136.1
SUSE Linux Enterprise High Performance Computing 12 SP5 (src): kernel-syms-azure-4.12.14-16.136.1, kernel-source-azure-4.12.14-16.136.1
SUSE Linux Enterprise Server 12 SP5 (src): kernel-syms-azure-4.12.14-16.136.1, kernel-source-azure-4.12.14-16.136.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 23 Maintenance Automation 2023-06-19 08:30:03 UTC

SUSE-SU-2023:2537-1: An update that solves 13 vulnerabilities and has three fixes can now be installed.

Category: security (important)
Bug References: 1204405, 1205756, 1205758, 1205760, 1205762, 1205803, 1206878, 1209287, 1210629, 1210715, 1210783, 1210940, 1211105, 1211186, 1211260, 1211592
CVE References: CVE-2022-3566, CVE-2022-45884, CVE-2022-45885, CVE-2022-45886, CVE-2022-45887, CVE-2022-45919, CVE-2023-1380, CVE-2023-2176, CVE-2023-2194, CVE-2023-2513, CVE-2023-31084, CVE-2023-31436, CVE-2023-32269
Sources used:
SUSE Linux Enterprise Server for SAP Applications 12 SP4 (src): kernel-source-4.12.14-95.128.1, kernel-syms-4.12.14-95.128.1
SUSE Linux Enterprise Server 12 SP4 ESPOS 12-SP4 (src): kernel-source-4.12.14-95.128.1, kernel-syms-4.12.14-95.128.1
SUSE Linux Enterprise Server 12 SP4 LTSS 12-SP4 (src): kernel-source-4.12.14-95.128.1, kernel-syms-4.12.14-95.128.1
SUSE OpenStack Cloud 9 (src): kernel-source-4.12.14-95.128.1, kernel-syms-4.12.14-95.128.1
SUSE OpenStack Cloud Crowbar 9 (src): kernel-source-4.12.14-95.128.1, kernel-syms-4.12.14-95.128.1
SUSE Linux Enterprise Live Patching 12-SP4 (src): kgraft-patch-SLE12-SP4_Update_36-1-6.3.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 24 Maintenance Automation 2023-06-19 08:30:14 UTC

SUSE-SU-2023:2534-1: An update that solves 16 vulnerabilities and has 10 fixes can now be installed.

Category: security (important)
Bug References: 1172073, 1191731, 1199046, 1204405, 1205756, 1205758, 1205760, 1205762, 1205803, 1206878, 1208600, 1209287, 1209366, 1210629, 1210715, 1210783, 1210791, 1210940, 1211037, 1211089, 1211105, 1211186, 1211519, 1211592, 1211622, 1211796
CVE References: CVE-2022-3566, CVE-2022-45884, CVE-2022-45885, CVE-2022-45886, CVE-2022-45887, CVE-2022-45919, CVE-2023-1077, CVE-2023-1380, CVE-2023-2176, CVE-2023-2194, CVE-2023-2483, CVE-2023-2513, CVE-2023-28466, CVE-2023-31084, CVE-2023-31436, CVE-2023-32269
Sources used:
SUSE Linux Enterprise Live Patching 15-SP1 (src): kernel-livepatch-SLE15-SP1_Update_41-1-150100.3.3.1
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1 (src): kernel-syms-4.12.14-150100.197.148.1, kernel-obs-build-4.12.14-150100.197.148.1, kernel-source-4.12.14-150100.197.148.1
SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 (src): kernel-syms-4.12.14-150100.197.148.1, kernel-obs-build-4.12.14-150100.197.148.1, kernel-source-4.12.14-150100.197.148.1
SUSE Linux Enterprise Server for SAP Applications 15 SP1 (src): kernel-syms-4.12.14-150100.197.148.1, kernel-obs-build-4.12.14-150100.197.148.1, kernel-source-4.12.14-150100.197.148.1
SUSE CaaS Platform 4.0 (src): kernel-syms-4.12.14-150100.197.148.1, kernel-obs-build-4.12.14-150100.197.148.1, kernel-source-4.12.14-150100.197.148.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 25 Maintenance Automation 2023-06-19 12:30:11 UTC

SUSE-SU-2023:2538-1: An update that solves 15 vulnerabilities and has 22 fixes can now be installed.

Category: security (important)
Bug References: 1065729, 1118212, 1129770, 1154048, 1204405, 1205756, 1205758, 1205760, 1205762, 1205803, 1206878, 1209287, 1209366, 1209857, 1210544, 1210629, 1210715, 1210783, 1210806, 1210940, 1211044, 1211105, 1211186, 1211275, 1211360, 1211361, 1211362, 1211363, 1211364, 1211365, 1211366, 1211466, 1211592, 1211622, 1211801, 1211816, 1211960
CVE References: CVE-2022-3566, CVE-2022-45884, CVE-2022-45885, CVE-2022-45886, CVE-2022-45887, CVE-2022-45919, CVE-2023-1380, CVE-2023-2176, CVE-2023-2194, CVE-2023-2269, CVE-2023-2513, CVE-2023-28466, CVE-2023-31084, CVE-2023-31436, CVE-2023-32269
Sources used:
SUSE Linux Enterprise Live Patching 12-SP5 (src): kgraft-patch-SLE12-SP5_Update_44-1-8.3.1
SUSE Linux Enterprise Software Development Kit 12 SP5 (src): kernel-obs-build-4.12.14-122.162.1
SUSE Linux Enterprise High Performance Computing 12 SP5 (src): kernel-syms-4.12.14-122.162.1, kernel-source-4.12.14-122.162.1
SUSE Linux Enterprise Server 12 SP5 (src): kernel-syms-4.12.14-122.162.1, kernel-source-4.12.14-122.162.1
SUSE Linux Enterprise Server for SAP Applications 12 SP5 (src): kernel-syms-4.12.14-122.162.1, kernel-source-4.12.14-122.162.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 26 Maintenance Automation 2023-06-22 08:30:10 UTC

SUSE-SU-2023:2611-1: An update that solves 22 vulnerabilities and has four fixes can now be installed.

Category: security (important)
Bug References: 1184208, 1199636, 1204405, 1205756, 1205758, 1205760, 1205762, 1205803, 1206024, 1208474, 1208604, 1209287, 1209779, 1210715, 1210783, 1210940, 1211037, 1211043, 1211105, 1211131, 1211186, 1211203, 1211590, 1211592, 1211596, 1211622
CVE References: CVE-2020-36694, CVE-2021-29650, CVE-2022-3566, CVE-2022-4269, CVE-2022-45884, CVE-2022-45885, CVE-2022-45886, CVE-2022-45887, CVE-2022-45919, CVE-2023-1079, CVE-2023-1380, CVE-2023-1637, CVE-2023-2156, CVE-2023-2194, CVE-2023-23586, CVE-2023-2483, CVE-2023-2513, CVE-2023-31084, CVE-2023-31436, CVE-2023-32233, CVE-2023-32269, CVE-2023-33288
Sources used:
SUSE Linux Enterprise Live Patching 15-SP3 (src): kernel-livepatch-SLE15-SP3_Update_33-1-150300.7.3.1
SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (src): kernel-syms-5.3.18-150300.59.124.1, kernel-obs-build-5.3.18-150300.59.124.1, kernel-default-base-5.3.18-150300.59.124.1.150300.18.72.1, kernel-source-5.3.18-150300.59.124.1
SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (src): kernel-syms-5.3.18-150300.59.124.1, kernel-obs-build-5.3.18-150300.59.124.1, kernel-default-base-5.3.18-150300.59.124.1.150300.18.72.1, kernel-source-5.3.18-150300.59.124.1
SUSE Linux Enterprise Real Time 15 SP3 (src): kernel-syms-5.3.18-150300.59.124.1, kernel-obs-build-5.3.18-150300.59.124.1, kernel-default-base-5.3.18-150300.59.124.1.150300.18.72.1, kernel-source-5.3.18-150300.59.124.1
SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (src): kernel-syms-5.3.18-150300.59.124.1, kernel-obs-build-5.3.18-150300.59.124.1, kernel-default-base-5.3.18-150300.59.124.1.150300.18.72.1, kernel-source-5.3.18-150300.59.124.1
SUSE Linux Enterprise Server for SAP Applications 15 SP3 (src): kernel-syms-5.3.18-150300.59.124.1, kernel-obs-build-5.3.18-150300.59.124.1, kernel-default-base-5.3.18-150300.59.124.1.150300.18.72.1, kernel-source-5.3.18-150300.59.124.1
SUSE Manager Proxy 4.2 (src): kernel-default-base-5.3.18-150300.59.124.1.150300.18.72.1, kernel-source-5.3.18-150300.59.124.1
SUSE Manager Retail Branch Server 4.2 (src): kernel-default-base-5.3.18-150300.59.124.1.150300.18.72.1, kernel-source-5.3.18-150300.59.124.1
SUSE Manager Server 4.2 (src): kernel-default-base-5.3.18-150300.59.124.1.150300.18.72.1, kernel-source-5.3.18-150300.59.124.1
SUSE Enterprise Storage 7.1 (src): kernel-syms-5.3.18-150300.59.124.1, kernel-obs-build-5.3.18-150300.59.124.1, kernel-default-base-5.3.18-150300.59.124.1.150300.18.72.1, kernel-source-5.3.18-150300.59.124.1
SUSE Linux Enterprise Micro 5.1 (src): kernel-default-base-5.3.18-150300.59.124.1.150300.18.72.1
SUSE Linux Enterprise Micro 5.2 (src): kernel-default-base-5.3.18-150300.59.124.1.150300.18.72.1
SUSE Linux Enterprise Micro for Rancher 5.2 (src): kernel-default-base-5.3.18-150300.59.124.1.150300.18.72.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 27 Maintenance Automation 2023-06-27 12:30:36 UTC

SUSE-SU-2023:2651-1: An update that solves 22 vulnerabilities and has 10 fixes can now be installed.

Category: security (important)
Bug References: 1172073, 1184208, 1191731, 1199046, 1204405, 1205756, 1205758, 1205760, 1205762, 1205803, 1206024, 1208474, 1208604, 1209287, 1209779, 1210498, 1210715, 1210783, 1210791, 1210940, 1211037, 1211043, 1211089, 1211105, 1211186, 1211187, 1211260, 1211590, 1211592, 1211596, 1211622, 1211796
CVE References: CVE-2020-36694, CVE-2021-29650, CVE-2022-3566, CVE-2022-4269, CVE-2022-45884, CVE-2022-45885, CVE-2022-45886, CVE-2022-45887, CVE-2022-45919, CVE-2023-1079, CVE-2023-1380, CVE-2023-1637, CVE-2023-2124, CVE-2023-2194, CVE-2023-23586, CVE-2023-2483, CVE-2023-2513, CVE-2023-31084, CVE-2023-31436, CVE-2023-32233, CVE-2023-32269, CVE-2023-33288
Sources used:
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (src): kernel-obs-build-5.3.18-150200.24.154.1, kernel-source-5.3.18-150200.24.154.1, kernel-syms-5.3.18-150200.24.154.1, kernel-default-base-5.3.18-150200.24.154.1.150200.9.75.1
SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (src): kernel-obs-build-5.3.18-150200.24.154.1, kernel-source-5.3.18-150200.24.154.1, kernel-syms-5.3.18-150200.24.154.1, kernel-default-base-5.3.18-150200.24.154.1.150200.9.75.1
SUSE Linux Enterprise Server for SAP Applications 15 SP2 (src): kernel-obs-build-5.3.18-150200.24.154.1, kernel-source-5.3.18-150200.24.154.1, kernel-syms-5.3.18-150200.24.154.1, kernel-default-base-5.3.18-150200.24.154.1.150200.9.75.1
SUSE Enterprise Storage 7 (src): kernel-obs-build-5.3.18-150200.24.154.1, kernel-source-5.3.18-150200.24.154.1, kernel-syms-5.3.18-150200.24.154.1, kernel-default-base-5.3.18-150200.24.154.1.150200.9.75.1
SUSE Linux Enterprise Live Patching 15-SP2 (src): kernel-livepatch-SLE15-SP2_Update_37-1-150200.5.3.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 31 Maintenance Automation 2023-07-11 08:37:07 UTC

SUSE-SU-2023:2805-1: An update that solves 38 vulnerabilities and has four fixes can now be installed.

Category: security (important)
Bug References: 1126703, 1204405, 1205756, 1205758, 1205760, 1205762, 1205803, 1206878, 1207036, 1207125, 1207168, 1207795, 1208600, 1208777, 1208837, 1209008, 1209039, 1209052, 1209256, 1209287, 1209289, 1209291, 1209532, 1209549, 1209687, 1209871, 1210329, 1210336, 1210337, 1210498, 1210506, 1210647, 1210715, 1210940, 1211105, 1211186, 1211449, 1212128, 1212129, 1212154, 1212501, 1212842
CVE References: CVE-2017-5753, CVE-2018-20784, CVE-2022-3566, CVE-2022-45884, CVE-2022-45885, CVE-2022-45886, CVE-2022-45887, CVE-2022-45919, CVE-2023-0590, CVE-2023-1077, CVE-2023-1095, CVE-2023-1118, CVE-2023-1249, CVE-2023-1380, CVE-2023-1390, CVE-2023-1513, CVE-2023-1611, CVE-2023-1670, CVE-2023-1989, CVE-2023-1990, CVE-2023-1998, CVE-2023-2124, CVE-2023-2162, CVE-2023-2194, CVE-2023-23454, CVE-2023-23455, CVE-2023-2513, CVE-2023-28328, CVE-2023-28464, CVE-2023-28772, CVE-2023-30772, CVE-2023-3090, CVE-2023-3141, CVE-2023-31436, CVE-2023-3159, CVE-2023-3161, CVE-2023-32269, CVE-2023-35824
Sources used:
SUSE Linux Enterprise Server 12 SP2 BCL 12-SP2 (src): kernel-syms-4.4.121-92.205.1, kernel-source-4.4.121-92.205.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 32 Robert Frohl 2024-05-06 12:45:55 UTC

done, closing