SUSE SLES12: cluster-md-kmp-rt / dlm-kmp-rt / gfs2-kmp-rt / kernel-devel-rt / etc (SUSE-SU-2024:3566-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3566-1 advisory. The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security bugfixes. The following security bugs were fixed: -...

Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security bugfixes. The following security bugs were fixed: CVE-2024-46854: net: dpaa: Pad packets to ETHZLEN bsc1231084. CVE-2024-46770: ice: Add netifdeviceattach/detach into PF reset flow bsc1230763. CVE-2024-41073: nvme:...

SUSE CVE-2024-46853

In the Linux kernel, the following vulnerability has been resolved: spi: nxp-fspi: fix the KASAN report out-of-bounds bug Change the memcpy length to fix the out-of-bounds issue when writing the data that is not 4 byte aligned to TX FIFO. To reproduce the issue, write 3 bytes data to NOR chip. dd...

CVE-2024-46853

In the Linux kernel, the following vulnerability has been resolved: spi: nxp-fspi: fix the KASAN report out-of-bounds bug Change the memcpy length to fix the out-of-bounds issue when writing the data that is not 4 byte aligned to TX FIFO. To reproduce the issue, write 3 bytes data to NOR chip. dd...

CVE-2024-46853

In the Linux kernel, the following vulnerability has been resolved: spi: nxp-fspi: fix the KASAN report out-of-bounds bug Change the memcpy length to fix the out-of-bounds issue when writing the data that is not 4 byte aligned to TX FIFO. To reproduce the issue, write 3 bytes data to NOR chip. dd...

DEBIAN-CVE-2024-46853

In the Linux kernel, the following vulnerability has been resolved: spi: nxp-fspi: fix the KASAN report out-of-bounds bug Change the memcpy length to fix the out-of-bounds issue when writing the data that is not 4 byte aligned to TX FIFO. To reproduce the issue, write 3 bytes data to NOR chip. dd...

AZL-49983 CVE-2024-46853 affecting package kernel for versions less than 5.15.176.3-1

In the Linux kernel, the following vulnerability has been resolved: spi: nxp-fspi: fix the KASAN report out-of-bounds bug Change the memcpy length to fix the out-of-bounds issue when writing the data that is not 4 byte aligned to TX FIFO. To reproduce the issue, write 3 bytes data to NOR chip. dd...

AZL-49945 CVE-2024-46853 affecting package kernel for versions less than 6.6.56.1-5

In the Linux kernel, the following vulnerability has been resolved: spi: nxp-fspi: fix the KASAN report out-of-bounds bug Change the memcpy length to fix the out-of-bounds issue when writing the data that is not 4 byte aligned to TX FIFO. To reproduce the issue, write 3 bytes data to NOR chip. dd...

UBUNTU-CVE-2024-46853

In the Linux kernel, the following vulnerability has been resolved: spi: nxp-fspi: fix the KASAN report out-of-bounds bug Change the memcpy length to fix the out-of-bounds issue when writing the data that is not 4 byte aligned to TX FIFO. To reproduce the issue, write 3 bytes data to NOR chip. dd...

CVE-2024-46853

CVE-2024-46853 is a Linux kernel issue corrected by updating to a patched kernel. The vulnerability stems from a KASAN slab-out-of-bounds bug in the nxp-fspi driver (spi/nxp-fspi) when handling data not aligned to 4 bytes written to TX FIFO. The issue could cause a read beyond the allocated regio...

CVE-2024-46853 spi: nxp-fspi: fix the KASAN report out-of-bounds bug

In the Linux kernel, the following vulnerability has been resolved: spi: nxp-fspi: fix the KASAN report out-of-bounds bug Change the memcpy length to fix the out-of-bounds issue when writing the data that is not 4 byte aligned to TX FIFO. To reproduce the issue, write 3 bytes data to NOR chip. dd...

CVE-2024-46853 spi: nxp-fspi: fix the KASAN report out-of-bounds bug

In the Linux kernel, the following vulnerability has been resolved: spi: nxp-fspi: fix the KASAN report out-of-bounds bug Change the memcpy length to fix the out-of-bounds issue when writing the data that is not 4 byte aligned to TX FIFO. To reproduce the issue, write 3 bytes data to NOR chip. dd...

PT-2024-7180

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.11.0-rc5-gc7b0e37c8434 Description The vulnerability is related to an out-of-bounds issue in the nxp fspi exec op function when writing data that is not 4 byte aligned to TX FIFO. This can be reproduced by...

CVE-2024-38532

The NXP Data Co-Processor DCP is a built-in hardware module for specific NXP SoCs¹ that implements a dedicated AES cryptographic engine for encryption/decryption operations. The dcptool reference implementation included in the repository selected the test key, regardless of its -t argument. This...

CVE-2024-38532 TEST_KEY used in example dcp_tool reference implementation

The NXP Data Co-Processor DCP is a built-in hardware module for specific NXP SoCs¹ that implements a dedicated AES cryptographic engine for encryption/decryption operations. The dcptool reference implementation included in the repository selected the test key, regardless of its -t argument. This...

CVE-2024-38532

The CVE-2024-38532 issue affects the NXP Data Co-Processor (DCP) used in specific NXP SoCs, where the dcp_tool reference implementation selected a test key regardless of the -t argument. This root cause is addressed by patch commit 26a7. Connected sources describe the vulnerability as tied to the...

CVE-2024-38532 TEST_KEY used in example dcp_tool reference implementation

The NXP Data Co-Processor DCP is a built-in hardware module for specific NXP SoCs¹ that implements a dedicated AES cryptographic engine for encryption/decryption operations. The dcptool reference implementation included in the repository selected the test key, regardless of its -t argument. This...

CVE-2024-38532 TEST_KEY used in example dcp_tool reference implementation

The NXP Data Co-Processor DCP is a built-in hardware module for specific NXP SoCs¹ that implements a dedicated AES cryptographic engine for encryption/decryption operations. The dcptool reference implementation included in the repository selected the test key, regardless of its -t argument. This...

NXP Data Co-Processor Security Vulnerability

The NXP Data Co-Processor NXP DCP is a built-in hardware module for a SoC from NXP. A dedicated AES encryption engine used to implement encryption/decryption operations. A security vulnerability exists in NXP Data Co-Processor that originates from the selection of a test key by the dcptool...

CVE-2024-38594 net: stmmac: move the EST lock to struct stmmac_priv

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: move the EST lock to struct stmmacpriv Reinitialize the whole EST structure would also reset the mutex lock which is embedded in the EST structure, and then trigger the following warning. To address this, move the lo...