SUSE-SU-2015:2090-1: kgraft-patch-SLE12_Update_3&distro=SUSE Linux Enterprise Live Patching 12 SUSE Linux Enterprise
Published
Published 24-11-2015Last modified 04-02-2026
Vulnerability summary
SUSE-SU-2015:2090-1 is a vulnerability in kgraft-patch-SLE12_Update_3&distro=SUSE Linux Enterprise Live Patching 12 SUSE Linux Enterprise with no CVSS score yet.
Priority
Insufficient evidence
No CVSS vector published; no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?CVSS score
Not scored
010
No CVSS score recordedEPSS scoreNot scoredRisk metrics not yet published.
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Advisory lineage
Upstream 2 · Downstream 0 · Related 2Timeline
- 24-11-2015PublishedVulnerability first disclosed.
- 04-02-2026Last modifiedVulnerability information updated.
Description
Security update for Linux Kernel Live Patch 3 This kernel live patch for Linux Kernel 3.12.38-44.1 fixes two security issues: - CVE-2015-7613: A race condition in the IPC object implementation in the Linux kernel allowed local users to gain privileges by triggering an ipc_addid call that leads to uid and gid comparisons against uninitialized data, related to msg.c, shm.c, and util.c. (bsc#948701 bsc#948536) - CVE-2015-5707: Integer overflow in the sg_start_req function in drivers/scsi/sg.c in the Linux kernel allowed local users to cause a denial of service or possibly have unspecified other impact via a large iov_count value in a write request. (bsc#940342 bsc#940338)
CVSS metrics
Risk metrics not yet published.
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Version check
Known conditions: not stated in public data.
Suse1 product
- kgraft-patch-SLE12_Update_3&distro=SUSE Linux Enterprise Live Patching 12< 3-2.1
1 vendor · 1 product
References
7 links- bugzilla.suse.com/940338REPORT
- bugzilla.suse.com/940342REPORT
- bugzilla.suse.com/948536REPORT
- bugzilla.suse.com/948701REPORT
Related vulnerabilities
Insufficient evidenceSUSE-SU-2016:0745-1SUSE Linux Enterprisesuse · kgraft-patch-SLE12_Update_3&distro=SUSE Linux Enterprise Live Patching 12suse kgraft-patch-SLE12_Update_3&distro=SUSE Linux Enterprise Live Patching 12Security update for kernel live patch 3
This kernel live patch for Linux Kernel 3.12.38-44.1 fixes two security
issues:
Fixes:
- CVE-2016-0728: A reference leak in keyring handling with
join_session_keyring() could lead to local attackers gain root
privileges. (bsc#962078).
- CVE-2013-7446: Use-after-free vulnerability in net/unix/af_unix.c in
the Linux kernel allowed local users to bypass intended AF_UNIX socket
permissions or cause a denial of service (panic) via crafted epoll_ctl
calls. (bsc#955837)CVSSUnscoredInsufficient evidenceSUSE-SU-2016:0380-1SUSE Linux Enterprisesuse · kgraft-patch-SLE12_Update_3&distro=SUSE Linux Enterprise Live Patching 12suse kgraft-patch-SLE12_Update_3&distro=SUSE Linux Enterprise Live Patching 12Security update for kernel live patch 3
This kernel live patch for Linux Kernel 3.12.38-44.1 fixes security issues and bugs:
Security issues fixed:
- CVE-2015-8539: A negatively instantiated user key could have been used
by a local user to leverage privileges (bnc#958601).
- CVE-2015-6937: A NULL pointer dereference flaw was found in the Reliable
Datagram Sockets (RDS) implementation allowing a local user to cause
system DoS. A verification was missing that the underlying transport
exists when a connection was created. (bsc#953052)
- CVE-2015-7990: RDS: Verify the underlying transport exists before
creating a connection, preventing possible DoS (bsc#953052).
- CVE-2015-7872: Possible crash when trying to garbage collect an
uninstantiated keyring (bsc#951542).
- CVE-2015-2925: The prepend_path function in fs/dcache.c in the Linux
kernel did not properly handle rename actions inside a bind mount, which
allowed local users to bypass an intended container protection mechanism
by renaming a directory, related to a 'double-chroot attack (bnc#951625).
Non-security bugfix were also done:
- xfs: Fix lost direct IO write in the last block (bsc#954005).
- simple fix in kallsyms initialization (bsc#940342 bsc#916225)CVSSUnscoredInsufficient evidenceSUSE-SU-2015:1487-1SUSE Linux Enterprisesuse · kgraft-patch-SLE12_Update_3&distro=SUSE Linux Enterprise Live Patching 12suse kgraft-patch-SLE12_Update_3&distro=SUSE Linux Enterprise Live Patching 12Live patch for the Linux Kernel
This update contains a kernel live patch for the 3.12.38-44 SUSE Linux Enterprise
Server 12 Kernel, fixing following security issues.
- CVE-2015-3339: A race condition in the prepare_binprm function in
fs/exec.c in the Linux kernel allowed local users to gain privileges
by executing a setuid program at a time instant when a chown to root
is in progress, and the ownership is changed but the setuid bit is not
yet stripped. (bsc#939263 bsc#939044)
- CVE-2015-3636: The ping_unhash function in net/ipv4/ping.c in the
Linux kernel did not initialize a certain list data structure during an
unhash operation, which allowed local users to gain privileges or cause
a denial of service (use-after-free and system crash) by leveraging the
ability to make a SOCK_DGRAM socket system call for the IPPROTO_ICMP
or IPPROTO_ICMPV6 protocol, and then making a connect system call after
a disconnect. (bsc#939277)
- CVE-2015-5364/CVE-2015-5366: Two denial of service attacks via a flood
of UDP packets with invalid checksums were fixed that could be used
by remote attackers to delay execution. (bsc#939276)
- CVE-2015-1805: The (1) pipe_read and (2) pipe_write implementations in
fs/pipe.c in the Linux kernel did not properly consider the side effects
of failed __copy_to_user_inatomic and __copy_from_user_inatomic calls,
which allowed local users to cause a denial of service (system crash)
or possibly gain privileges via a crafted application, aka an 'I/O vector
array overrun.' (bsc#939270)
- CVE-2015-4700: A BPF Jit optimization flaw could allow local users
to panic the kernel. (bsc#939273)
- CVE-2015-3331: The __driver_rfc4106_decrypt function in
arch/x86/crypto/aesni-intel_glue.c in the Linux kernel did not properly
determine the memory locations used for encrypted data, which allowed
context-dependent attackers to cause a denial of service (buffer overflow
and system crash) or possibly execute arbitrary code by triggering a
crypto API call, as demonstrated by use of a libkcapi test program with
an AF_ALG(aead) socket. (bsc#939262)
- CVE-2014-8159: The InfiniBand (IB) implementation in the Linux kernel
did not properly restrict use of User Verbs for registration of memory
regions, which allowed local users to access arbitrary physical memory
locations, and consequently cause a denial of service (system crash)
or gain privileges, by leveraging permissions on a uverbs device under
/dev/infiniband/. (bsc#939241)CVSSUnscoredInsufficient evidenceSUSE-SU-2015:0529-1SUSE Linux Enterprisesuse · kernel-default&distro=SUSE Linux Enterprise Desktop 12 +16 moresuse kernel-default&distro=SUSE Linux Enterprise Desktop 12Security update for the Linux Kernel
The SUSE Linux Enterprise 12 kernel was updated to 3.12.38 to receive
various security and bugfixes.
This update contains the following feature enablements:
- The remote block device (rbd) and ceph drivers have been enabled and
are now supported. (FATE#318350)
These can be used e.g. for accessing the SUSE Enterprise Storage product
services.
- Support for Intel Select Bay trail CPUs has been added. (FATE#316038)
Following security issues were fixed:
- CVE-2014-9419: The __switch_to function in arch/x86/kernel/process_64.c
in the Linux kernel through 3.18.1 did not ensure that Thread Local
Storage (TLS) descriptors were loaded before proceeding with other steps,
which made it easier for local users to bypass the ASLR protection
mechanism via a crafted application that reads a TLS base address
(bnc#911326).
- CVE-2014-7822: A flaw was found in the way the Linux kernels splice()
system call validated its parameters. On certain file systems, a local,
unprivileged user could have used this flaw to write past the maximum
file size, and thus crash the system.
- CVE-2014-8160: The connection tracking module could be bypassed if a specific
protocol module was not loaded, e.g. allowing SCTP traffic while the firewall
should have filtered it.
- CVE-2014-9584: The parse_rock_ridge_inode_internal function in
fs/isofs/rock.c in the Linux kernel before 3.18.2 did not validate a
length value in the Extensions Reference (ER) System Use Field, which
allowed local users to obtain sensitive information from kernel memory
via a crafted iso9660 image (bnc#912654).
The following non-security bugs were fixed:
- audit: Allow login in non-init namespaces (bnc#916107).
- btrfs: avoid unnecessary switch of path locks to blocking mode.
- btrfs: fix directory inconsistency after fsync log replay (bnc#915425).
- btrfs: fix fsync log replay for inodes with a mix of regular refs and
extrefs (bnc#915425).
- btrfs: fix fsync race leading to ordered extent memory leaks (bnc#917128).
- btrfs: fix fsync when extend references are added to an inode (bnc#915425).
- btrfs: fix missing error handler if submiting re-read bio fails.
- btrfs: fix race between transaction commit and empty block group removal (bnc#915550).
- btrfs: fix scrub race leading to use-after-free (bnc#915456).
- btrfs: fix setup_leaf_for_split() to avoid leaf corruption (bnc#915454).
- btrfs: improve free space cache management and space allocation.
- btrfs: make btrfs_search_forward return with nodes unlocked.
- btrfs: scrub, fix sleep in atomic context (bnc#915456).
- btrfs: unlock nodes earlier when inserting items in a btree.
- drm/i915: On G45 enable cursor plane briefly after enabling the display plane (bnc#918161).
- Fix Module.supported handling for external modules (bnc#905304).
- keys: close race between key lookup and freeing (bnc#912202).
- msi: also reject resource with flags all clear.
- pci: Add ACS quirk for Emulex NICs (bug#917089).
- pci: Add ACS quirk for Intel 10G NICs (bug#917089).
- pci: Add ACS quirk for Solarflare SFC9120 & SFC9140 (bug#917089).
- Refresh other Xen patches (bsc#909829).
- Update patches.suse/btrfs-8177-improve-free-space-cache-management-and-space-.patch (bnc#895805).
- be2net: avoid flashing SH-B0 UFI image on SH-P2 chip (bug#908322).
- be2net: refactor code that checks flash file compatibility (bug#908322).
- ceph: Add necessary clean up if invalid reply received in handle_reply() (bsc#918255).
- crush: CHOOSE_LEAF -> CHOOSELEAF throughout (bsc#918255).
- crush: add SET_CHOOSE_TRIES rule step (bsc#918255).
- crush: add note about r in recursive choose (bsc#918255).
- crush: add set_choose_local_[fallback_]tries steps (bsc#918255).
- crush: apply chooseleaf_tries to firstn mode too (bsc#918255).
- crush: attempts -> tries (bsc#918255).
- crush: clarify numrep vs endpos (bsc#918255).
- crush: eliminate CRUSH_MAX_SET result size limitation (bsc#918255).
- crush: factor out (trivial) crush_destroy_rule() (bsc#918255).
- crush: fix crush_choose_firstn comment (bsc#918255).
- crush: fix some comments (bsc#918255).
- crush: generalize descend_once (bsc#918255).
- crush: new SET_CHOOSE_LEAF_TRIES command (bsc#918255).
- crush: pass parent r value for indep call (bsc#918255).
- crush: pass weight vector size to map function (bsc#918255).
- crush: reduce scope of some local variables (bsc#918255).
- crush: return CRUSH_ITEM_UNDEF for failed placements with indep (bsc#918255).
- crush: strip firstn conditionals out of crush_choose, rename (bsc#918255).
- crush: use breadth-first search for indep mode (bsc#918255).
- crypto: drbg - panic on continuous self test error (bsc#905482).
- dasd: List corruption in error recovery (bnc#914291, LTC#120865).
- epoll: optimize setting task running after blocking (epoll-performance).
- fips: We need to activate gcm(aes) in FIPS mode, RFCs 4106 and 4543 (bsc#914126,bsc#914457).
- fips: __driver-gcm-aes-aesni needs to be listed explicitly inside the testmgr.c file (bsc#914457).
- flow_dissector: add tipc support (bnc#916513).
- hotplug, powerpc, x86: Remove cpu_hotplug_driver_lock() (bsc#907069).
- hyperv: Add support for vNIC hot removal.
- kernel: incorrect clock_gettime result (bnc#914291, LTC#121184).
- kvm: iommu: Add cond_resched to legacy device assignment code (bsc#898687).
- libceph: CEPH_OSD_FLAG_* enum update (bsc#918255).
- libceph: add ceph_kv{malloc,free}() and switch to them (bsc#918255).
- libceph: add ceph_pg_pool_by_id() (bsc#918255).
- libceph: all features fields must be u64 (bsc#918255).
- libceph: dout() is missing a newline (bsc#918255).
- libceph: factor out logic from ceph_osdc_start_request() (bsc#918255).
- libceph: fix error handling in ceph_osdc_init() (bsc#918255).
- libceph: follow redirect replies from osds (bsc#918255).
- libceph: follow {read,write}_tier fields on osd request submission (bsc#918255).
- libceph: introduce and start using oid abstraction (bsc#918255).
- libceph: rename MAX_OBJ_NAME_SIZE to CEPH_MAX_OID_NAME_LEN (bsc#918255).
- libceph: rename ceph_osd_request::r_{oloc,oid} to r_base_{oloc,oid} (bsc#918255).
- libceph: replace ceph_calc_ceph_pg() with ceph_oloc_oid_to_pg() (bsc#918255).
- libceph: start using oloc abstraction (bsc#918255).
- libceph: take map_sem for read in handle_reply() (bsc#918255).
- libceph: update ceph_features.h (bsc#918255).
- libceph: use CEPH_MON_PORT when the specified port is 0 (bsc#918255).
- locking/mutex: Explicitly mark task as running after wakeup (mutex scalability).
- locking/osq: No need for load/acquire when acquire-polling (mutex scalability).
- locking/rtmutex: Optimize setting task running after being blocked (mutex scalability).
- mm/compaction: fix wrong order check in compact_finished() (VM Performance, bnc#904177).
- mm/compaction: stop the isolation when we isolate enough freepage (VM Performance, bnc#904177).
- mm: fix negative nr_isolated counts (VM Performance).
- mutex-debug: Always clear owner field upon mutex_unlock() (mutex bugfix).
- net: 8021q/bluetooth/bridge/can/ceph: Remove extern from function prototypes (bsc#918255).
- net: allow macvlans to move to net namespace (bnc#915660).
- net:socket: set msg_namelen to 0 if msg_name is passed as NULL in msghdr struct from userland (bnc#900270).
- nfs_prime_dcache needs fh to be set (bnc#908069 bnc#896484).
- ocfs2: remove filesize checks for sync I/O journal commit (bnc#800255). Update references.
- powerpc/xmon: Fix another endiannes issue in RTAS call from xmon (bsc#915188).
- pvscsi: support suspend/resume (bsc#902286).
- random: account for entropy loss due to overwrites (bsc#904883,bsc#904901).
- random: allow fractional bits to be tracked (bsc#904883,bsc#904901).
- random: statically compute poolbitshift, poolbytes, poolbits (bsc#904883,bsc#904901).
- rbd: add '^A' sysfs rbd device attribute (bsc#918255).
- rbd: add support for single-major device number allocation scheme (bsc#918255).
- rbd: enable extended devt in single-major mode (bsc#918255).
- rbd: introduce rbd_dev_header_unwatch_sync() and switch to it (bsc#918255).
- rbd: rbd_device::dev_id is an int, format it as such (bsc#918255).
- rbd: refactor rbd_init() a bit (bsc#918255).
- rbd: switch to ida for rbd id assignments (bsc#918255).
- rbd: tear down watch request if rbd_dev_device_setup() fails (bsc#918255).
- rbd: tweak 'loaded' message and module description (bsc#918255).
- rbd: wire up is_visible() sysfs callback for rbd bus (bsc#918255).
- rpm/kernel-binary.spec.in: Own the modules directory in the devel package (bnc#910322)
- s390/dasd: fix infinite loop during format (bnc#914291, LTC#120608).
- s390/dasd: remove unused code (bnc#914291, LTC#120608).
- sched/Documentation: Remove unneeded word (mutex scalability).
- sched/completion: Add lock-free checking of the blocking case (scheduler scalability).
- scsifront: avoid acquiring same lock twice if ring is full.
- scsifront: do not use bitfields for indicators modified under different locks.
- swiotlb: Warn on allocation failure in swiotlb_alloc_coherent (bsc#905783).
- uas: Add NO_ATA_1X for VIA VL711 devices (bnc#914254).
- uas: Add US_FL_NO_ATA_1X for 2 more Seagate disk enclosures (bnc#914254).
- uas: Add US_FL_NO_ATA_1X for Seagate devices with usb-id 0bc2:a013 (bnc#914254).
- uas: Add US_FL_NO_ATA_1X quirk for 1 more Seagate model (bnc#914254).
- uas: Add US_FL_NO_ATA_1X quirk for 2 more Seagate models (bnc#914254).
- uas: Add US_FL_NO_ATA_1X quirk for Seagate (0bc2:ab20) drives (bnc#914254).
- uas: Add a quirk for rejecting ATA_12 and ATA_16 commands (bnc#914254).
- uas: Add missing le16_to_cpu calls to asm1051 / asm1053 usb-id check (bnc#914294).
- uas: Add no-report-opcodes quirk (bnc#914254).
- uas: Disable uas on ASM1051 devices (bnc#914294).
- uas: Do not blacklist ASM1153 disk enclosures (bnc#914294).
- uas: Use streams on upcoming 10Gbps / 3.1 USB (bnc#914464).
- uas: disable UAS on Apricorn SATA dongles (bnc#914300).
- usb-storage: support for more than 8 LUNs (bsc#906196).
- x86, crash: Allocate enough low-mem when crashkernel=high (bsc#905783).
- x86, crash: Allocate enough low-mem when crashkernel=high (bsc#905783).
- x86, swiotlb: Try coherent allocations with __GFP_NOWARN (bsc#905783).
- x86/hpet: Make boot_hpet_disable extern (bnc#916646).
- x86/intel: Add quirk to disable HPET for the Baytrail platform (bnc#916646).
- x86: irq: Check for valid irq descriptor incheck_irq_vectors_for_cpu_disable (bnc#914726).
- x86: irq: Check for valid irq descriptor in check_irq_vectors_for_cpu_disable (bnc#914726).
- xhci: Add broken-streams quirk for Fresco Logic FL1000G xhci controllers (bnc#914112).
- zcrypt: Number of supported ap domains is not retrievable (bnc#914291, LTC#120788).CVSSUnscored