SUSE releases Live Patch 5 for Linux Kernel 6.4.0-150600_23_25, addressing critical CVEs like CVE-2025-21680 (CVSS 8.5). Learn how to patch your SUSE/openSUSE systems and mitigate risks.
Key Security Vulnerabilities Patched
This high-priority update resolves four critical vulnerabilities affecting Linux Kernel 6.4.0, including:
CVE-2025-21680 (CVSS 8.5) – Out-of-bounds access in
pktgen(bsc#1236701).CVE-2024-57996 (CVSS 8.5) – Network scheduling flaw in
sch_sfq(bsc#1239077).CVE-2024-58013 (CVSS 7.8) – Bluetooth MGMT slab-use-after-free (bsc#1239096).
CVE-2024-49855 (CVSS 7.3) – Race condition in NBD timeout handling (bsc#1232900).
Affected Systems:
SUSE Linux Enterprise Server 15 SP6
openSUSE Leap 15.6
SUSE Real Time 15 SP6
SUSE Linux Enterprise Live Patching
Why This Update Matters for Enterprise Security
Linux kernel vulnerabilities can lead to privilege escalation, data leaks, or system crashes. This patch:
Mitigates remote and local attack vectors.
Addresses high-severity CVSS 4.0/3.1-rated flaws.
Ensures compliance with enterprise security policies.
Pro Tip: Kernel live patching minimizes downtime—critical for SAP, real-time, and cloud workloads.
Step-by-Step Patch Installation Guide
For openSUSE Leap 15.6:
zypper in -t patch SUSE-2025-1934=1 SUSE-2025-1932=1 SUSE-2025-1933=1 SUSE-2025-1937=1
For SUSE Linux Enterprise Live Patching 15-SP6:
zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP6-2025-1937=1 SUSE-SLE-Module-Live-Patching-15-SP6-2025-1934=1
Alternative Methods:
Use YaST Online Update for GUI-based patching.
Schedule patches during maintenance windows to avoid disruptions.
Technical Deep Dive: Exploit Analysis
| CVE ID | CVSS Score | Impact | Component |
|---|---|---|---|
| CVE-2025-21680 | 8.5 (High) | DoS/RCE | pktgen |
| CVE-2024-57996 | 8.5 (High) | Traffic Manipulation | net_sched |
| CVE-2024-58013 | 7.8 (High) | Memory Corruption | Bluetooth MGMT |
| CVE-2024-49855 | 7.3 (Medium) | Data Corruption | NBD Driver |
Advisory References:
FAQ: Linux Kernel Patching Best Practices
Q: Can I delay this update?
A: Not recommended—these vulnerabilities are actively exploitable.
Q: Does this require a reboot?
A: Live patching avoids reboots, but full kernel updates may need one.
Q: How to verify the patch?
rpm -qa | grep kernel-livepatch
Nenhum comentário:
Postar um comentário