SUSE-SU-2017:2142-1: kernel-default&distro=SUSE Linux Enterprise Server 12-LTSS SUSE Linux Enterprise
Published
Published 11-08-2017Last modified 04-02-2026
Vulnerability summary
SUSE-SU-2017:2142-1 is a vulnerability in kernel-default&distro=SUSE Linux Enterprise Server 12-LTSS SUSE Linux Enterprise with no CVSS score yet.
Priority
Insufficient evidence
No CVSS vector published; no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?CVSS score
Not scored
010
No CVSS score recordedEPSS scoreNot scoredRisk metrics not yet published.
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Advisory lineage
Upstream 2 · Downstream 0 · Related 2Timeline
- 11-08-2017PublishedVulnerability first disclosed.
- 04-02-2026Last modifiedVulnerability information updated.
Description
Security update for the Linux Kernel The SUSE Linux Enterprise 12 kernel was updated to 3.12.61 to the following security updates: - CVE-2017-1000111: fix race condition in net-packet code that could be exploited to cause out-of-bounds memory access (bsc#1052365). - CVE-2017-1000112: fix race condition in net-packet code that could have been exploited by unprivileged users to gain root access. (bsc#1052311).
CVSS metrics
Risk metrics not yet published.
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Version check
Known conditions: not stated in public data.
Suse11 products
- kernel-default&distro=SUSE Linux Enterprise Server 12-LTSS< 3.12.61-52.86.1
- kernel-default&distro=SUSE Linux Enterprise Server for SAP Applications 12< 3.12.61-52.86.1
- kernel-ec2&distro=SUSE Linux Enterprise Module for Public Cloud 12< 3.12.61-52.86.1
- kernel-source&distro=SUSE Linux Enterprise Server 12-LTSS< 3.12.61-52.86.1
- kernel-source&distro=SUSE Linux Enterprise Server for SAP Applications 12< 3.12.61-52.86.1
- kernel-syms&distro=SUSE Linux Enterprise Server 12-LTSS< 3.12.61-52.86.1
- kernel-syms&distro=SUSE Linux Enterprise Server for SAP Applications 12< 3.12.61-52.86.1
- kernel-xen&distro=SUSE Linux Enterprise Server 12-LTSS< 3.12.61-52.86.1
- kernel-xen&distro=SUSE Linux Enterprise Server for SAP Applications 12< 3.12.61-52.86.1
- kgraft-patch-SLE12_Update_25&distro=SUSE Linux Enterprise Server 12-LTSS< 1-2.1
- kgraft-patch-SLE12_Update_25&distro=SUSE Linux Enterprise Server for SAP Applications 12< 1-2.1
1 vendor · 11 products
References
5 linksRelated vulnerabilities
Insufficient evidenceSUSE-SU-2019:1692-1SUSE Linux Enterprisesuse · kernel-default&distro=SUSE Linux Enterprise Server 12-LTSS +5 moresuse kernel-default&distro=SUSE Linux Enterprise Server 12-LTSSSecurity update for the Linux Kernel
The SUSE Linux Enterprise 12 kernel version 3.12.61 was updated to receive
various security and bugfixes.
The following security bugs were fixed:
- CVE-2019-11477: A sequence of SACKs may have been crafted by a remote
attacker such that one can trigger an integer overflow, leading to a kernel
panic. (bsc#1137586).
- CVE-2019-11478: It was possible to send a crafted sequence of SACKs which
would fragment the TCP retransmission queue. A remote attacker may have been
able to further exploit the fragmented queue to cause an expensive linked-list
walk for subsequent SACKs received for that same TCP connection.
- CVE-2019-11479: It was possible to send a crafted sequence of SACKs which
would fragment the RACK send map. A remote attacker may have been able to further
exploit the fragmented send map to cause an expensive linked-list walk for
subsequent SACKs received for that same TCP connection. This would have
resulted in excess resource consumption due to low mss values.
- CVE-2019-3846: A flaw that allowed an attacker to corrupt memory and possibly
escalate privileges was found in the mwifiex kernel module while connecting
to a malicious wireless network. (bnc#1136424)
- CVE-2019-5489: The mincore() implementation in mm/mincore.c in the Linux
kernel allowed local attackers to observe page cache access patterns of other
processes on the same system, potentially allowing sniffing of secret
information. (Fixing this affects the output of the fincore program.) Limited
remote exploitation may have been possible, as demonstrated by latency differences
in accessing public files from an Apache HTTP Server. (bnc#1120843)
- CVE-2019-11833: fs/ext4/extents.c in the Linux kernel did not zero out the
unused memory region in the extent tree block, which might have allowed local users
to obtain sensitive information by reading uninitialized data in the
filesystem. (bnc#1135281)
- CVE-2019-11190: The Linux kernel allowed local users to bypass ASLR on setuid
programs (such as /bin/su) because install_exec_creds() is called too late in
load_elf_binary() in fs/binfmt_elf.c, and thus the ptrace_may_access() check
has a race condition when reading /proc/pid/stat. (bnc#1131543)
- CVE-2019-11884: The do_hidp_sock_ioctl function in net/bluetooth/hidp/sock.c
in the Linux kernel allowed a local user to obtain potentially sensitive
information from kernel stack memory via a HIDPCONNADD command, because a
name field may not end with a '\0' character. (bnc#1134848)
- CVE-2018-17972: An issue was discovered in the proc_pid_stack function in
fs/proc/base.c in the Linux kernel It did not ensure that only root may
inspect the kernel stack of an arbitrary task, allowing a local attacker to
exploit racy stack unwinding and leak kernel task stack contents.
(bnc#1110785)
The following non-security bugs were fixed:
- kabi: drop LINUX_MIB_TCPWQUEUETOOBIG snmp counter (bsc#1137586).
- lib: add 'on'/'off' support to strtobool (bsc#1125931).
- powerpc/tm: Add commandline option to disable hardware transactional memory (bsc#1125580).
- powerpc/tm: Add TM Unavailable Exception (bsc#1125580).
- powerpc/tm: Flip the HTM switch default to disabled (bsc#1125580).
- powerpc/vdso32: fix CLOCK_MONOTONIC on PPC64 (bsc#1131587).
- powerpc/vdso64: Fix CLOCK_MONOTONIC inconsistencies across Y2038 (bsc#1131587).
- tcp: add tcp_min_snd_mss sysctl (bsc#1137586).
- tcp: enforce tcp_min_snd_mss in tcp_mtu_probing() (bsc#1137586).
- tcp: limit payload size of sacked skbs (bsc#1137586).
- tcp: tcp_fragment() should apply sane memory limits (bsc#1137586).CVSSUnscoredInsufficient evidenceSUSE-SU-2018:3083-1SUSE Linux Enterprisesuse · kernel-default&distro=SUSE Linux Enterprise Server 12-LTSS +5 moresuse kernel-default&distro=SUSE Linux Enterprise Server 12-LTSSSecurity update for the Linux Kernel
The SUSE Linux Enterprise 12 kernel was updated to receive various security and bugfixes.
The following security bugs were fixed:
- CVE-2018-14634: Prevent integer overflow in create_elf_tables that allowed a
local attacker to exploit this vulnerability via a SUID-root binary and obtain
full root privileges (bsc#1108912)
- CVE-2018-14617: Prevent NULL pointer dereference and panic in
hfsplus_lookup() when opening a file (that is purportedly a hard link) in an
hfs+ filesystem that has malformed catalog data, and is mounted read-only
without a metadata directory (bsc#1102870)
- CVE-2018-16276: Incorrect bounds checking in the yurex USB driver in
yurex_read allowed local attackers to use user access read/writes to crash the
kernel or potentially escalate privileges (bsc#1106095)
- CVE-2018-12896: Prevent integer overflow in the POSIX timer code that was
caused by the way the overrun accounting works. Depending on interval and
expiry time values, the overrun can be larger than INT_MAX, but the accounting
is int based. This basically made the accounting values, which are visible to
user space via timer_getoverrun(2) and siginfo::si_overrun, random. This
allowed a local user to cause a denial of service (signed integer overflow) via
crafted mmap, futex, timer_create, and timer_settime system calls (bnc#1099922)
- CVE-2018-13093: Prevent NULL pointer dereference and panic in lookup_slow()
on a NULL inode->i_ops pointer when doing pathwalks on a corrupted xfs image.
This occured because of a lack of proper validation that cached inodes are free
during allocation (bnc#1100001)
- CVE-2018-10940: The cdrom_ioctl_media_changed function allowed local
attackers to use a incorrect bounds check in the CDROM driver
CDROM_MEDIA_CHANGED ioctl to read out kernel memory (bsc#1092903)
- CVE-2018-16658: Prevent information leak in cdrom_ioctl_drive_status that
could have been used by local attackers to read kernel memory (bnc#1107689)
- CVE-2018-6555: The irda_setsockopt function allowed local users to cause a
denial of service (ias_object use-after-free and system crash) or possibly have
unspecified other impact via an AF_IRDA socket (bnc#1106511)
- CVE-2018-6554: Prevent memory leak in the irda_bind function that allowed
local users to cause a denial of service (memory consumption) by repeatedly
binding an AF_IRDA socket (bnc#1106509)
- CVE-2018-10853: The KVM hypervisor did not check current privilege(CPL) level
while emulating unprivileged instructions. An unprivileged guest user/process
could have used this flaw to potentially escalate privileges inside guest
(bsc#1097104)
- CVE-2018-10902: Protect against concurrent access to prevent double realloc
(double free) in snd_rawmidi_input_params() and snd_rawmidi_output_status(). A
malicious local attacker could have used this for privilege escalation
(bnc#1105322).
- CVE-2018-10879: A local user could have caused a use-after-free in
ext4_xattr_set_entry function and a denial of service or unspecified other
impact by renaming a file in a crafted ext4 filesystem image (bsc#1099844)
- CVE-2018-10883: A local user could have caused an out-of-bounds write in
jbd2_journal_dirty_metadata(), a denial of service, and a system crash by
mounting and operating on a crafted ext4 filesystem image (bsc#1099863)
- CVE-2018-10880: Prevent stack-out-of-bounds write in the ext4 filesystem code
when mounting and writing to a crafted ext4 image in ext4_update_inline_data().
An attacker could have used this to cause a system crash and a denial of
service (bsc#1099845)
- CVE-2018-10882: A local user could have caused an out-of-bound write, a
denial of service, and a system crash by unmounting a crafted ext4 filesystem
image (bsc#1099849)
- CVE-2018-10881: A local user could have caused an out-of-bound access in
ext4_get_group_info function, a denial of service, and a system crash by
mounting and operating on a crafted ext4 filesystem image (bsc#1099864)
- CVE-2018-10877: Prevent out-of-bound access in the ext4_ext_drop_refs()
function when operating on a crafted ext4 filesystem image (bsc#1099846)
- CVE-2018-10876: A use-after-free was possible in ext4_ext_remove_space()
function when mounting and operating a crafted ext4 image (bsc#1099811)
- CVE-2018-10878: A local user could have caused an out-of-bounds write and a
denial of service or unspecified other impact by mounting and operating a
crafted ext4 filesystem image (bsc#1099813)
- CVE-2018-17182: An issue was discovered in the Linux kernel The
vmacache_flush_all function in mm/vmacache.c mishandled sequence number
overflows. An attacker can trigger a use-after-free (and possibly gain
privileges) via certain thread creation, map, unmap, invalidation,
and dereference operations (bnc#1108399).
The following non-security bugs were fixed:
- bcache: avoid unncessary cache prefetch bch_btree_node_get().
- bcache: calculate the number of incremental GC nodes according to the total of btree nodes.
- bcache: display rate debug parameters to 0 when writeback is not running.
- bcache: do not check return value of debugfs_create_dir().
- bcache: finish incremental GC.
- bcache: fix error setting writeback_rate through sysfs interface (bsc#1064232).
- bcache: fix I/O significant decline while backend devices registering.
- bcache: free heap cache_set->flush_btree in bch_journal_free.
- bcache: make the pr_err statement used for ENOENT only in sysfs_attatch section.
- bcache: release dc->writeback_lock properly in bch_writeback_thread().
- bcache: set max writeback rate when I/O request is idle (bsc#1064232).
- bcache: simplify the calculation of the total amount of flash dirty data.
- Do not report CPU affected by L1TF when ARCH_CAP_RDCL_NO bit is set (bsc#1104906).
- ext4: check for allocation block validity with block group locked (bsc#1104495).
- ext4: do not update checksum of new initialized bitmaps (bnc#1012382).
- ext4: fix check to prevent initializing reserved inodes (bsc#1104319).
- ext4: fix false negatives *and* false positives in ext4_check_descriptors() (bsc#1103445).
- kABI: protect struct x86_emulate_ops (kabi).
- KEYS: prevent creating a different user's keyrings (bnc#1065999).
- KVM: MMU: always terminate page walks at level 1 (bsc#1062604).
- KVM: MMU: simplify last_pte_bitmap (bsc#1062604).
- KVM: nVMX: update last_nonleaf_level when initializing nested EPT (bsc#1062604).
- KVM: VMX: fixes for vmentry_l1d_flush module parameter (bsc#1106369).
- KVM: VMX: Work around kABI breakage in 'enum vmx_l1d_flush_state' (bsc#1106369).
- updated sssbd handling (bsc#1093215, bsc#1105412).
- usbip: vhci_sysfs: fix potential Spectre v1 (bsc#1096547).
- x86/speculation: Use ARCH_CAPABILITIES to skip L1D flush on vmentry (bsc#1106369).
- sched/sysctl: Check user input value of sysctl_sched_time_avg (bsc#1100089).CVSSUnscoredInsufficient evidenceSUSE-SU-2018:2362-1SUSE Linux Enterprisesuse · kernel-default&distro=SUSE Linux Enterprise Server 12-LTSS +6 moresuse kernel-default&distro=SUSE Linux Enterprise Server 12-LTSSSecurity update for the Linux Kernel
The SUSE Linux Enterprise 12 GA LTSS kernel was updated to receive various security and bugfixes.
The following security bugs were fixed:
- CVE-2018-13053: The alarm_timer_nsleep function in kernel/time/alarmtimer.c had an integer overflow via a large relative timeout because ktime_add_safe is not used (bnc#1099924).
- CVE-2018-13405: The inode_init_owner function in fs/inode.c allowed local users to create files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of that group. Here, the non-member can trigger creation of a plain file whose group ownership is that group. The intended behavior was that the non-member can trigger creation of a directory (but not a plain file) whose group ownership is that group. The non-member can escalate privileges by making the plain file executable and SGID (bnc#1100416).
- CVE-2018-13406: An integer overflow in the uvesafb_setcmap function in drivers/video/fbdev/uvesafb.c could result in local attackers being able to crash the kernel or potentially elevate privileges because kmalloc_array is not used (bnc#1098016 bnc#1100418).
- CVE-2018-14734: drivers/infiniband/core/ucma.c allowed ucma_leave_multicast to access a certain data structure after a cleanup step in ucma_process_join, which allowed attackers to cause a denial of service (use-after-free) (bnc#1103119).
- CVE-2018-3620: Local attackers on baremetal systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data. (bnc#1087081).
- CVE-2018-3646: Local attackers in virtualized guest systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data, even from other virtual machines or the host system. (bnc#1089343).
The following non-security bugs were fixed:
- bcache: Add __printf annotation to __bch_check_keys() (bsc#1064232).
- bcache: Annotate switch fall-through (bsc#1064232).
- bcache: Fix a compiler warning in bcache_device_init() (bsc#1064232).
- bcache: Fix indentation (bsc#1064232).
- bcache: Fix kernel-doc warnings (bsc#1064232).
- bcache: Fix, improve efficiency of closure_sync() (bsc#1064232).
- bcache: Reduce the number of sparse complaints about lock imbalances (bsc#1064232).
- bcache: Remove an unused variable (bsc#1064232).
- bcache: Suppress more warnings about set-but-not-used variables (bsc#1064232).
- bcache: Use PTR_ERR_OR_ZERO() (bsc#1064232).
- bcache: add CACHE_SET_IO_DISABLE to struct cache_set flags (bsc#1064232).
- bcache: add backing_request_endio() for bi_end_io (bsc#1064232).
- bcache: add io_disable to struct cached_dev (bsc#1064232).
- bcache: add journal statistic (bsc#1064232).
- bcache: add stop_when_cache_set_failed option to backing device (bsc#1064232).
- bcache: add wait_for_kthread_stop() in bch_allocator_thread() (bsc#1064232).
- bcache: closures: move control bits one bit right (bsc#1064232).
- bcache: correct flash only vols (check all uuids) (bsc#1064232).
- bcache: count backing device I/O error for writeback I/O (bsc#1064232).
- bcache: do not attach backing with duplicate UUID (bsc#1064232).
- bcache: fix cached_dev->count usage for bch_cache_set_error() (bsc#1064232).
- bcache: fix crashes in duplicate cache device register (bsc#1064232).
- bcache: fix error return value in memory shrink (bsc#1064232).
- bcache: fix for allocator and register thread race (bsc#1064232).
- bcache: fix for data collapse after re-attaching an attached device (bsc#1064232).
- bcache: fix high CPU occupancy during journal (bsc#1064232).
- bcache: fix incorrect sysfs output value of strip size (bsc#1064232).
- bcache: fix kcrashes with fio in RAID5 backend dev (bsc#1064232).
- bcache: fix misleading error message in bch_count_io_errors() (bsc#1064232).
- bcache: fix using of loop variable in memory shrink (bsc#1064232).
- bcache: fix writeback target calc on large devices (bsc#1064232).
- bcache: fix wrong return value in bch_debug_init() (bsc#1064232).
- bcache: mark closure_sync() __sched (bsc#1064232).
- bcache: move closure debug file into debug directory (bsc#1064232).
- bcache: properly set task state in bch_writeback_thread() (bsc#1064232).
- bcache: quit dc->writeback_thread when BCACHE_DEV_DETACHING is set (bsc#1064232).
- bcache: reduce cache_set devices iteration by devices_max_used (bsc#1064232).
- bcache: ret IOERR when read meets metadata error (bsc#1064232).
- bcache: return 0 from bch_debug_init() if CONFIG_DEBUG_FS=n (bsc#1064232).
- bcache: return attach error when no cache set exist (bsc#1064232).
- bcache: segregate flash only volume write streams (bsc#1064232).
- bcache: set CACHE_SET_IO_DISABLE in bch_cached_dev_error() (bsc#1064232).
- bcache: set dc->io_disable to true in conditional_stop_bcache_device() (bsc#1064232).
- bcache: set error_limit correctly (bsc#1064232).
- bcache: set writeback_rate_update_seconds in range [1, 60] seconds (bsc#1064232).
- bcache: stop bcache device when backing device is offline (bsc#1064232).
- bcache: stop dc->writeback_rate_update properly (bsc#1064232).
- bcache: stop writeback thread after detaching (bsc#1064232).
- bcache: store disk name in struct cache and struct cached_dev (bsc#1064232).
- bcache: use pr_info() to inform duplicated CACHE_SET_IO_DISABLE set (bsc#1064232).
- cpu/hotplug: Add sysfs state interface (bsc#1089343).
- cpu/hotplug: Provide knobs to control SMT (bsc#1089343).
- cpu/hotplug: Provide knobs to control SMT (bsc#1089343).
- cpu/hotplug: Split do_cpu_down() (bsc#1089343).
- x86/CPU/AMD: Do not check CPUID max ext level before parsing SMP info (bsc#1089343).
- x86/CPU/AMD: Move TOPOEXT reenablement before reading smp_num_siblings (bsc#1089343).
- x86/Xen: disable IBRS around CPU stopper function invocation (none so far).
- x86/cpu/AMD: Evaluate smp_num_siblings early (bsc#1089343).
- x86/cpu/AMD: Evaluate smp_num_siblings early (bsc#1089343).
- x86/cpu/AMD: Remove the pointless detect_ht() call (bsc#1089343).
- x86/cpu/common: Provide detect_ht_early() (bsc#1089343).
- x86/cpu/intel: Evaluate smp_num_siblings early (bsc#1089343).
- x86/cpu/topology: Provide detect_extended_topology_early() (bsc#1089343).
- x86/cpu: Remove the pointless CPU printout (bsc#1089343).
- x86/cpufeatures: Add X86_BUG_SPECTRE_V[12] (bnc#1012382).
- x86/mm: Simplify p[g4um]xen: d_page() macros (bnc#1087081).
- x86/smp: Provide topology_is_primary_thread() (bsc#1089343).
- x86/smpboot: Do not use smp_num_siblings in __max_logical_packages calculation (bsc#1089343).
- x86/topology: Add topology_max_smt_threads() (bsc#1089343).
- x86/topology: Provide topology_smt_supported() (bsc#1089343).
- xen/x86/cpu/common: Provide detect_ht_early() (bsc#1089343).
- xen/x86/cpu/topology: Provide detect_extended_topology_early() (bsc#1089343).
- xen/x86/cpu: Remove the pointless CPU printout (bsc#1089343).
- xen/x86/cpufeatures: Add X86_BUG_CPU_INSECURE (bnc#1012382).
- xen/x86/cpufeatures: Make CPU bugs sticky (bnc#1012382).
- xen/x86/entry: Add a function to overwrite the RSB (bsc#1068032).
- xen/x86/entry: Stuff RSB for entry to kernel for non-SMEP platform (bsc#1068032).
- xen/x86/entry: Use IBRS on entry to kernel space (bsc#1068032).
- xen/x86/mm: Set IBPB upon context switch (bsc#1068032).
- xen/x86/pti: Rename BUG_CPU_INSECURE to BUG_CPU_MELTDOWN (bnc#1012382).CVSSUnscoredInsufficient evidenceSUSE-SU-2018:1762-1SUSE Linux Enterprisesuse · kernel-default&distro=SUSE Linux Enterprise Server 12-LTSS +5 moresuse kernel-default&distro=SUSE Linux Enterprise Server 12-LTSSSecurity update for the Linux Kernel
The SUSE Linux Enterprise 12 GA LTSS kernel was updated to receive various security and bugfixes.
The following security bugs were fixed:
- CVE-2018-3665: Prevent disclosure of FPU registers (including XMM and AVX
registers) between processes. These registers might contain encryption keys
when doing SSE accelerated AES enc/decryption (bsc#1087086)
- CVE-2018-5848: In the function wmi_set_ie(), the length validation code did
not handle unsigned integer overflow properly. As a result, a large value of
the 'ie_len' argument could have caused a buffer overflow (bnc#1097356)
- CVE-2018-1000204: Prevent infoleak caused by incorrect handling of the SG_IO
ioctl (bsc#1096728)
- CVE-2017-13305: Prevent information disclosure vulnerability in
encrypted-keys (bsc#1094353)
- CVE-2018-1094: The ext4_fill_super function did not always initialize the
crc32c checksum driver, which allowed attackers to cause a denial of service
(ext4_xattr_inode_hash NULL pointer dereference and system crash) via a crafted
ext4 image (bsc#1087007)
- CVE-2018-1093: The ext4_valid_block_bitmap function allowed attackers to
cause a denial of service (out-of-bounds read and system crash) via a crafted
ext4 image because balloc.c and ialloc.c do not validate bitmap block numbers
(bsc#1087095)
- CVE-2018-1092: The ext4_iget function mishandled the case of a root directory
with a zero i_links_count, which allowed attackers to cause a denial of service
(ext4_process_freed_data NULL pointer dereference and OOPS) via a crafted ext4
image (bsc#1087012)
- CVE-2018-1130: NULL pointer dereference in dccp_write_xmit() function that
allowed a local user to cause a denial of service by a number of certain
crafted system calls (bsc#1092904)
- CVE-2018-5803: Prevent error in the '_sctp_make_chunk()' function when
handling SCTP packets length that could have been exploited to cause a kernel
crash (bnc#1083900)
- CVE-2018-7492: Prevent NULL pointer dereference in the net/rds/rdma.c
__rds_rdma_map() function that allowed local attackers to cause a system panic
and a denial-of-service, related to RDS_GET_MR and RDS_GET_MR_FOR_DEST
(bsc#1082962)
The following non-security bugs were fixed:
- Fix excessive newline in /proc/*/status (bsc#1094823).
- KVM: x86: Sync back MSR_IA32_SPEC_CTRL to VCPU data structure (bsc#1096242, bsc#1096281).
- ipv6: add mtu lock check in __ip6_rt_update_pmtu (bsc#1092552).
- kABI: work around BPF SSBD removal (bsc#1087082).
- kgraft/bnx2fc: Do not block kGraft in bnx2fc_l2_rcv kthread (bsc#1094033).
- mm, page_alloc: do not break __GFP_THISNODE by zonelist reset (bsc#1079152).
- usbip: usbip_host: fix NULL-ptr deref and use-after-free errors (bsc#1096480).
- usbip: usbip_host: fix bad unlock balance during stub_probe() (bsc#1096480).
- x86/boot: Fix early command-line parsing when matching at end (bsc#1096281).
- x86/boot: Fix early command-line parsing when partial word matches (bsc#1096281).
- x86/bugs: spec_ctrl must be cleared from cpu_caps_set when being disabled (bsc#1096140).
- x86/kaiser: export symbol kaiser_set_shadow_pgd() (bsc#1092813)
- xen-netfront: fix req_prod check to avoid RX hang when index wraps (bsc#1046610).CVSSUnscoredInsufficient evidenceSUSE-SU-2018:1374-1SUSE Linux Enterprisesuse · kernel-default&distro=SUSE Linux Enterprise Server 12-LTSS +5 moresuse kernel-default&distro=SUSE Linux Enterprise Server 12-LTSSSecurity update for the Linux Kernel
The SUSE Linux Enterprise 12 GA LTSS kernel was updated to receive several security fixes.
The following security bugs were fixed:
- CVE-2018-3639: Information leaks using 'Memory Disambiguation' feature
in modern CPUs were mitigated, aka 'Spectre Variant 4' (bnc#1087082).
A new boot commandline option was introduced,
'spec_store_bypass_disable', which can have following values:
- auto: Kernel detects whether your CPU model contains an implementation
of Speculative Store Bypass and picks the most appropriate mitigation.
- on: disable Speculative Store Bypass
- off: enable Speculative Store Bypass
- prctl: Control Speculative Store Bypass per thread via
prctl. Speculative Store Bypass is enabled for a process by default. The
state of the control is inherited on fork.
- seccomp: Same as 'prctl' above, but all seccomp threads will disable
SSB unless they explicitly opt out.
The default is 'seccomp', meaning programs need explicit opt-in into the mitigation.
Status can be queried via the /sys/devices/system/cpu/vulnerabilities/spec_store_bypass file, containing:
- 'Vulnerable'
- 'Mitigation: Speculative Store Bypass disabled'
- 'Mitigation: Speculative Store Bypass disabled via prctl'
- 'Mitigation: Speculative Store Bypass disabled via prctl and seccomp'
- CVE-2018-1000199: An address corruption flaw was discovered while
modifying a h/w breakpoint via 'modify_user_hw_breakpoint' routine, an
unprivileged user/process could use this flaw to crash the system kernel
resulting in DoS OR to potentially escalate privileges on a the system. (bsc#1089895)
- CVE-2018-10675: The do_get_mempolicy function in mm/mempolicy.c allowed
local users to cause a denial of service (use-after-free) or possibly
have unspecified other impact via crafted system calls (bnc#1091755).
The following non-security bugs were fixed:
- x86/bugs: Make sure that _TIF_SSBD does not end up in _TIF_ALLWORK_MASK (bsc#1093215).
- x86/bugs: correctly force-disable IBRS on !SKL systems (bsc#1092497).
- x86/cpu/intel: Introduce macros for Intel family numbers (bsc#985025).
- x86/cpu/intel: Introduce macros for Intel family numbers (bsc985025).
- x86/speculation: Remove Skylake C2 from Speculation Control microcode blacklist (bsc#1087845).CVSSUnscoredInsufficient evidenceSUSE-SU-2018:1221-1SUSE Linux Enterprisesuse · kernel-default&distro=SUSE Linux Enterprise Server 12-LTSS +5 moresuse kernel-default&distro=SUSE Linux Enterprise Server 12-LTSSSecurity update for the Linux Kernel
The SUSE Linux Enterprise 12 GA LTSS kernel was updated to receive various security and bugfixes.
The following security bugs were fixed:
- CVE-2018-1087: And an unprivileged KVM guest user could use this flaw to potentially escalate their privileges inside a guest. (bsc#1087088)
- CVE-2018-8897: An unprivileged system user could use incorrect set up interrupt stacks to crash the Linux kernel resulting in DoS issue. (bsc#1087088)
- CVE-2018-8781: The udl_fb_mmap function in drivers/gpu/drm/udl/udl_fb.c had an integer-overflow vulnerability allowing local users with access to the udldrmfb driver to obtain full read and write permissions on kernel physical pages, resulting in a code execution in kernel space (bnc#1090643).
- CVE-2018-10124: The kill_something_info function in kernel/signal.c might allow local users to cause a denial of service via an INT_MIN argument (bnc#1089752).
- CVE-2018-10087: The kernel_wait4 function in kernel/exit.c might allow local users to cause a denial of service by triggering an attempted use of the -INT_MIN value (bnc#1089608).
- CVE-2018-7757: Memory leak in the sas_smp_get_phy_events function in drivers/scsi/libsas/sas_expander.c allowed local users to cause a denial of service (memory consumption) via many read accesses to files in the /sys/class/sas_phy directory, as demonstrated by the /sys/class/sas_phy/phy-1:0:12/invalid_dword_count file (bnc#1084536 1087209).
- CVE-2017-13220: An elevation of privilege vulnerability in the Upstream kernel bluez was fixed. (bnc#1076537).
- CVE-2017-11089: A buffer overread was observed in nl80211_set_station when user space application sends attribute NL80211_ATTR_LOCAL_MESH_POWER_MODE with data of size less than 4 bytes (bnc#1088261).
- CVE-2017-0861: Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem allowed attackers to gain privileges via unspecified vectors (bnc#1088260).
- CVE-2018-8822: Incorrect buffer length handling in the ncp_read_kernel function in fs/ncpfs/ncplib_kernel.c could be exploited by malicious NCPFS servers to crash the kernel or execute code (bnc#1086162).
- CVE-2017-18203: The dm_get_from_kobject function in drivers/md/dm.c allow local users to cause a denial of service (BUG) by leveraging a race condition with __dm_destroy during creation and removal of DM devices (bnc#1083242).
The following non-security bugs were fixed:
- Integrate fixes resulting from bsc#1088147 More info in the respective commit messages.
- KABI: x86/kaiser: properly align trampoline stack (bsc#1087260).
- kGraft: fix small race in reversion code (bsc#1083125).
- kabi/severities: Ignore kgr_shadow_* kABI changes
- kvm/x86: fix icebp instruction handling (bsc#1087088).
- livepatch: Allow to call a custom callback when freeing shadow variables (bsc#1082299 fate#313296).
- livepatch: Initialize shadow variables safely by a custom callback (bsc#1082299 fate#313296).
- x86/entry/64: Do not use IST entry for #BP stack (bsc#1087088).
- x86/kaiser: properly align trampoline stack (bsc#1087260).
- x86/retpoline: do not perform thunk calls in ring3 vsyscall code (bsc#1085331).CVSSUnscored