SUSE-SU-2017:2150-1: kernel-default&distro=SUSE Linux Enterprise Server 12 SP1-LTSS SUSE Linux Enterprise
Published
Published 11-08-2017Last modified 02-05-2025
Vulnerability summary
SUSE-SU-2017:2150-1 is a vulnerability in kernel-default&distro=SUSE Linux Enterprise Server 12 SP1-LTSS SUSE Linux Enterprise with no CVSS score yet.
Priority
Insufficient evidence
No CVSS vector published; no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?CVSS score
Not scored
010
No CVSS score recordedEPSS scoreNot scoredRisk metrics not yet published.
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Advisory lineage
Upstream 2 · Downstream 0 · Related 2Timeline
- 11-08-2017PublishedVulnerability first disclosed.
- 02-05-2025Last modifiedVulnerability information updated.
Description
Security update for the Linux Kernel The SUSE Linux Enterprise 12 SP1 kernel was updated to 3.12.74 to the following security updates: - CVE-2017-1000111: fix race condition in net-packet code that could be exploited to cause out-of-bounds memory access (bsc#1052365). - CVE-2017-1000112: fix race condition in net-packet code that could have been exploited by unprivileged users to gain root access. (bsc#1052311).
CVSS metrics
Risk metrics not yet published.
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Version check
Known conditions: not stated in public data.
Suse16 products
- kernel-default&distro=SUSE Linux Enterprise Server 12 SP1-LTSS< 3.12.74-60.64.54.1
- kernel-default&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP1< 3.12.74-60.64.54.1
- kernel-default&distro=SUSE OpenStack Cloud 6< 3.12.74-60.64.54.1
- kernel-ec2&distro=SUSE Linux Enterprise Module for Public Cloud 12< 3.12.74-60.64.54.1
- kernel-source&distro=SUSE Linux Enterprise Server 12 SP1-LTSS< 3.12.74-60.64.54.1
- kernel-source&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP1< 3.12.74-60.64.54.1
- kernel-source&distro=SUSE OpenStack Cloud 6< 3.12.74-60.64.54.1
- kernel-syms&distro=SUSE Linux Enterprise Server 12 SP1-LTSS< 3.12.74-60.64.54.1
- kernel-syms&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP1< 3.12.74-60.64.54.1
- kernel-syms&distro=SUSE OpenStack Cloud 6< 3.12.74-60.64.54.1
- kernel-xen&distro=SUSE Linux Enterprise Server 12 SP1-LTSS< 3.12.74-60.64.54.1
- kernel-xen&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP1< 3.12.74-60.64.54.1
- kernel-xen&distro=SUSE OpenStack Cloud 6< 3.12.74-60.64.54.1
- kgraft-patch-SLE12-SP1_Update_19&distro=SUSE Linux Enterprise Server 12 SP1-LTSS< 1-2.1
- kgraft-patch-SLE12-SP1_Update_19&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP1< 1-2.1
- kgraft-patch-SLE12-SP1_Update_19&distro=SUSE OpenStack Cloud 6< 1-2.1
1 vendor · 16 products
References
5 linksRelated vulnerabilities
Insufficient evidenceSUSE-SU-2019:2950-1SUSE Linux Enterprisesuse · kernel-default&distro=SUSE Linux Enterprise Server 12 SP1-LTSS +10 moresuse kernel-default&distro=SUSE Linux Enterprise Server 12 SP1-LTSSSecurity update for the Linux Kernel
The SUSE Linux Enterprise 12 SP1 kernel was updated to receive various security and bugfixes.
The following security bugs were fixed:
- CVE-2018-12207: Untrusted virtual machines on Intel CPUs could exploit a race condition in the Instruction Fetch Unit of the Intel CPU to cause a Machine Exception during Page Size Change, causing the CPU core to be non-functional.
The Linux Kernel KVM hypervisor was adjusted to avoid page size changes in executable pages by splitting / merging huge pages into small pages as needed.
More information can be found on https://www.suse.com/support/kb/doc/?id=7023735
- CVE-2019-11135: Aborting an asynchronous TSX operation on Intel CPUs with
Transactional Memory support could be used to facilitate sidechannel
information leaks out of microarchitectural buffers, similar to the previously
described 'Microarchitectural Data Sampling' attack.
The Linux kernel was supplemented with the option to disable TSX operation
altogether (requiring CPU Microcode updates on older systems) and better
flushing of microarchitectural buffers (VERW).
The set of options available is described in our TID at https://www.suse.com/support/kb/doc/?id=7024251
- CVE-2019-16233: drivers/scsi/qla2xxx/qla_os.c did not check the
alloc_workqueue return value, leading to a NULL pointer dereference.
(bsc#1150457).
- CVE-2019-10220: Added sanity checks on the pathnames passed to the user
space. (bsc#1144903).
- CVE-2019-16232: Fix a potential NULL pointer dereference in the Marwell
libertas driver (bsc#1150465).
- CVE-2019-16234: iwlwifi pcie driver did not check the alloc_workqueue return
value, leading to a NULL pointer dereference. (bsc#1150452).
- CVE-2019-17055: The AF_ISDN network module in the Linux kernel did not
enforce CAP_NET_RAW, which meant that unprivileged users could create a raw
socket (bnc#1152782).
- CVE-2019-17056: The AF_NFC network module did not enforce CAP_NET_RAW, which
meant that unprivileged users could create a raw socket (bsc#1152788).
- CVE-2019-16413: The 9p filesystem did not protect i_size_write() properly,
which caused an i_size_read() infinite loop and denial of service on SMP
systems (bnc#1151347).
- CVE-2019-15902: A backporting issue was discovered that re-introduced the
Spectre vulnerability it had aimed to eliminate. This occurred because the
backport process depends on cherry picking specific commits, and because two
(correctly ordered) code lines were swapped (bnc#1149376).
- CVE-2019-15291: Fixed a NULL pointer dereference issue that could be caused
by a malicious USB device (bnc#11465).
- CVE-2019-15807: Fixed a memory leak in the SCSI module that could be abused
to cause denial of service (bnc#1148938).
- CVE-2019-14821: An out-of-bounds access issue was fixed in the kernel's KVM
hypervisor. An unprivileged host user or process with access to '/dev/kvm'
device could use this flaw to crash the host kernel, resulting in a denial of
service or potentially escalating privileges on the system (bnc#1151350).
- CVE-2019-15505: An out-of-bounds issue had been fixed that could be caused by
crafted USB device traffic (bnc#1147122).
- CVE-2017-18595: A double free in allocate_trace_buffer was fixed
(bnc#1149555).
- CVE-2019-14835: A buffer overflow flaw was found in the kernel's vhost
functionality that translates virtqueue buffers to IOVs. A privileged guest
user able to pass descriptors with invalid length to the host could use this
flaw to increase their privileges on the host (bnc#1150112).
- CVE-2019-15216: A NULL pointer dereference was fixed that could be malicious
USB device (bnc#1146361).
- CVE-2019-9456: An out-of-bounds write in the USB monitor driver has been
fixed. This issue could lead to local escalation of privilege with System
execution privileges needed. (bnc#1150025).
- CVE-2019-15926: An out-of-bounds access was fixed in the
drivers/net/wireless/ath/ath6kl module. (bnc#1149527).
- CVE-2019-15927: An out-of-bounds access was fixed in the sound/usb/mixer
module (bnc#1149522).
- CVE-2019-15219: A NULL pointer dereference was fixed that could be abused by
a malicious USB device (bnc#1146524).
- CVE-2019-15220: A use-after-free issue was fixed that could be caused by a
malicious USB device (bnc#1146526).
- CVE-2019-15221: A NULL pointer dereference was fixed that could be caused by
a malicious USB device (bnc#1146529).
- CVE-2019-14814: A heap-based buffer overflow was fixed in the marvell wifi
chip driver. That issue allowed local users to cause a denial of service
(system crash) or possibly execute arbitrary code (bnc#1146512).
- CVE-2019-14815: A missing length check while parsing WMM IEs was fixed
(bsc#1146512, bsc#1146514, bsc#1146516).
- CVE-2019-14816: A heap-based buffer overflow in the marvell wifi chip driver
was fixed. Local users would have abused this issue to cause a denial of
service (system crash) or possibly execute arbitrary code (bnc#1146516).
- CVE-2017-18509: An issue in net/ipv6 as fixed. By setting a specific socket
option, an attacker could control a pointer in kernel land and cause an
inet_csk_listen_stop general protection fault, or potentially execute
arbitrary code under certain circumstances. The issue can be triggered as
root (e.g., inside a default LXC container or with the CAP_NET_ADMIN
capability) or after namespace unsharing. (bnc#1145477)
- CVE-2019-9506: The Bluetooth BR/EDR specification used to permit sufficiently
low encryption key length and did not prevent an attacker from influencing
the key length negotiation. This allowed practical brute-force attacks (aka
'KNOB') that could decrypt traffic and inject arbitrary ciphertext without
the victim noticing (bnc#1137865).
- CVE-2019-15098: A NULL pointer dereference in drivers/net/wireless/ath was
fixed (bnc#1146378).
- CVE-2019-15290: A NULL pointer dereference in ath6kl_usb_alloc_urb_from_pipe
was fixed (bsc#1146378).
- CVE-2019-15212: A double-free issue was fixed in drivers/usb driver
(bnc#1146391).
- CVE-2016-10906: A use-after-free issue was fixed in drivers/net/ethernet/arc
(bnc#1146584).
- CVE-2019-15217: A a NULL pointer dereference issue caused by a malicious USB
device was fixed in the drivers/media/usb/zr364xx driver (bnc#1146519).
- CVE-2019-15218: A NULL pointer dereference caused by a malicious USB device
was fixed in the drivers/media/usb/siano driver (bnc#1146413).
- CVE-2019-15215: A use-after-free issue caused by a malicious USB device was
fixed in the drivers/media/usb/cpia2 driver (bnc#1146425).
- CVE-2018-20976: A use-after-free issue was fixed in the fs/xfs driver
(bnc#1146285).
- CVE-2017-18551: An out-of-bounds write was fixed in the drivers/i2c driver
(bnc#1146163).
- CVE-2019-10207: Add checks for missing tty operations to prevent unprivileged
user to execute 0x0 address (bsc#1142857 bsc#1123959)
- CVE-2019-15118: ALSA: usb-audio: Fix a stack buffer overflow bug in check_input_term
leading to kernel stack exhaustion (bsc#1145922).
The following non-security bugs were fixed:
- array_index_nospec: Sanitize speculative array (bsc#1155671)
- hpsa: move lockup_detected attribute to host attr (bsc#999278, bsc#1153119).
- ib/core: Add mitigation for Spectre V1 (bsc#1155671)
- kvm: Convert kvm_lock to a mutex (bsc#1117665).
- kvm: MMU: drop read-only large sptes when creating lower level sptes (bsc#1117665).
- kvm: vmx, svm: always run with EFER.NXE=1 when shadow paging is active (bsc#1117665).
- kvm: x86: make FNAME(fetch) and __direct_map more similar (bsc#1117665).
- media: smsusb: better handle optional alignment (bsc#1146413).
- mwifiex: Fix heap overflow in mwifiex_uap_parse_tail_ies() (bsc#1137944).
- netfilter: nf_nat: do not bug when mapping already exists (bsc#1146612).
- tcp: Be more careful in tcp_fragment() (bsc#1137586 bsc#1139751).CVSSUnscoredInsufficient evidenceSUSE-SU-2019:2262-1SUSE Linux Enterprisesuse · kernel-default&distro=SUSE Linux Enterprise Server 12 SP1-LTSS +10 moresuse kernel-default&distro=SUSE Linux Enterprise Server 12 SP1-LTSSSecurity update for the Linux Kernel
The SUSE Linux Enterprise 12 SP1 kernel was updated to receive various security and bugfixes.
The following security bugs were fixed:
- CVE-2019-1125: Enable Spectre v1 swapgs mitigations (bsc#1139358).
- CVE-2018-20855: An issue was discovered in create_qp_common in drivers/infiniband/hw/mlx5/qp.c, mlx5_ib_create_qp_resp was never initialized, resulting in a leak of stack memory to userspace (bsc#1143045).
- CVE-2019-14284: The drivers/block/floppy.c allowed a denial of service by setup_format_params division-by-zero. Two consecutive ioctls can trigger the bug: the first one should set the drive geometry with .sect and .rate values that make F_SECT_PER_TRACK be zero. Next, the floppy format operation should be called. It can be triggered by an unprivileged local user even when a floppy disk has not been inserted. NOTE: QEMU creates the floppy device by default (bsc#1143189).
- CVE-2019-14283: The function set_geometry in drivers/block/floppy.c did not validate the sect and head fields, as demonstrated by an integer overflow and out-of-bounds read. It can be triggered by an unprivileged local user when a floppy disk has been inserted. NOTE: QEMU creates the floppy device by default (bsc#1143191).
- CVE-2019-11810: A NULL pointer dereference can occur when megasas_create_frame_pool() fails in megasas_alloc_cmds() in drivers/scsi/megaraid/megaraid_sas_base.c. This causes a Denial of Service, related to a use-after-free (bsc#1134399).
- CVE-2019-13648: In the Linux kernel on the powerpc platform, when hardware transactional memory is disabled, a local user can cause a denial of service (TM Bad Thing exception and system crash) via a sigreturn() system call that sends a crafted signal frame. This affects arch/powerpc/kernel/signal_32.c and arch/powerpc/kernel/signal_64.c (bnc#1142254).
- CVE-2019-13631: In parse_hid_report_descriptor in drivers/input/tablet/gtco.c, a malicious USB device can send an HID report that triggers an out-of-bounds write during generation of debugging messages (bsc#1142023).
The following non-security bugs were fixed:
- bcache: Revert 'bcache: fix high CPU occupancy during journal' (bsc#1140652, bsc#1144288).
- bcache: Revert 'bcache: free heap cache_set->flush_btree in bch_journal_free' (bsc#1140652, bsc#1144288).
- bcache: add reclaimed_journal_buckets to struct cache_set (bsc#1140652, bsc#1144288).
- bcache: fix race in btree_flush_write() (bsc#1140652, bsc#1144288).
- bcache: fix stack corruption by PRECEDING_KEY() (bsc#1130972, bsc#1144257).
- bcache: only set BCACHE_DEV_WB_RUNNING when cached device attached (bsc#1130972, bsc#1144273).
- bcache: performance improvement for btree_flush_write() (bsc#1140652, bsc#1144288).
- bcache: remove retry_flush_write from struct cache_set (bsc#1140652, bsc#1144288).
- mm: check VMA flags to avoid invalid PROT_NONE NUMA balancing (bsc#1142098).
- powerpc/watchpoint: Restore NV GPRs while returning from exception (bsc#1140945, bsc#1141401, bsc#1141402, bsc#1141452, bsc#1141453, bsc#1141454).
- xen-netfront: use napi_complete() correctly to prevent Rx stalling (bsc#1138744).CVSSUnscoredInsufficient evidenceSUSE-SU-2019:1870-1SUSE Linux Enterprisesuse · kernel-default&distro=SUSE Linux Enterprise Server 12 SP1-LTSS +10 moresuse kernel-default&distro=SUSE Linux Enterprise Server 12 SP1-LTSSSecurity update for the Linux Kernel
The SUSE Linux Enterprise 12 SP1 kernel was updated to receive various security and bugfixes.
The following security bugs were fixed:
- CVE-2018-5390 aka 'SegmentSmack': A remote attacker even with relatively low bandwidth could have caused lots of CPU usage
by triggering the worst case scenario during IP and/or TCP fragment reassembly (bsc#1102340)
- CVE-2018-7191: In the tun subsystem in the Linux kernel, dev_get_valid_name was not called before register_netdevice. This allowed local users to cause a denial of service (NULL pointer dereference and panic) via an ioctl(TUNSETIFF) call with a dev name containing a / character. (bnc#1135603)
- CVE-2018-20836: A race condition in smp_task_timedout() and smp_task_done() in drivers/scsi/libsas/sas_expander.c, could have lead to a use-after-free. (bnc#1134395)
- CVE-2019-12614: An unchecked kstrdup might have allowed an attacker to cause denial of service (a NULL pointer dereference and system crash). (bnc#1137194)
- CVE-2019-12818: The nfc_llcp_build_tlv function in net/nfc/llcp_commands.c may have returned NULL. If the caller did not check for this, it would trigger a NULL pointer dereference. This would cause denial of service. (bnc#1138293)
- CVE-2019-12456: An issue in the MPT3COMMAND case in _ctl_ioctl_main() allowed local users to cause a denial of service or possibly have unspecified other impact by changing the value of ioc_number between two kernel reads of that value, aka a 'double fetch' vulnerability. (bsc#1136922)
- CVE-2019-11487: An attacker could have triggered use-after-free via page reference count overflow on slow filesystems with at least of 140 GiB of RAM available. (bnc#1133190)
The following non-security bugs were fixed:
- fuse: Don't access pipe->buffers without pipe_lock() (Prerequisity for CVE-2019-11487, bsc#1133190).
- fuse: call pipe_buf_release() under pipe lock (Prerequisity for CVE-2019-11487, bsc#1133190).
- mm: /proc/pid/maps: Check permissions when opening proc pid maps (bsc#1130159).
- pipe: add pipe_buf_get() helper (Prerequisity for CVE-2019-11487, bsc#1133190).
- tcp: refine memory limit test in tcp_fragment() after CVE-2019-11478 fix (bsc#1139751).
- x86/bugs: do not default to IBRS even on SKL (bsc#1112824).CVSSUnscoredInsufficient evidenceSUSE-SU-2019:1533-1SUSE Linux Enterprisesuse · kernel-default&distro=SUSE Linux Enterprise Server 12 SP1-LTSS +10 moresuse kernel-default&distro=SUSE Linux Enterprise Server 12 SP1-LTSSSecurity update for the Linux Kernel
The SUSE Linux Enterprise 12 SP1 kernel version 3.12.74 was updated to to
receive various security and bugfixes.
The following security bugs were fixed:
- CVE-2019-11477: A sequence of SACKs may have been crafted by a remote
attacker such that one can trigger an integer overflow, leading to a kernel
panic. (bsc#1137586).
- CVE-2019-11478: It is possible to send a crafted sequence of SACKs which
will fragment the TCP retransmission queue. A remote attacker may be able to
further exploit the fragmented queue to cause an expensive linked-list walk
for subsequent SACKs received for that same TCP connection.
- CVE-2019-11479: It was possible to send a crafted sequence of SACKs which
will fragment the RACK send map. A remote attacker may be able to further
exploit the fragmented send map to cause an expensive linked-list walk for
subsequent SACKs received for that same TCP connection. This would have
resulted in excess resource consumption due to low mss values.
- CVE-2019-3846: A flaw that allowed an attacker to corrupt memory and possibly
escalate privileges was found in the mwifiex kernel module while connecting
to a malicious wireless network. (bnc#1136424)
- CVE-2019-5489: The mincore() implementation in mm/mincore.c in the Linux
kernel allowed local attackers to observe page cache access patterns of other
processes on the same system, potentially allowing sniffing of secret
information. (Fixing this affects the output of the fincore program.) Limited
remote exploitation may be possible, as demonstrated by latency differences
in accessing public files from an Apache HTTP Server. (bnc#1120843)
- CVE-2019-11833: fs/ext4/extents.c in the Linux kernel did not zero out the
unused memory region in the extent tree block, which might allow local users
to obtain sensitive information by reading uninitialized data in the
filesystem. (bnc#1135281)
- CVE-2019-11190: The Linux kernel allowed local users to bypass ASLR on setuid
programs (such as /bin/su) because install_exec_creds() is called too late in
load_elf_binary() in fs/binfmt_elf.c, and thus the ptrace_may_access() check
has a race condition when reading /proc/pid/stat. (bnc#1131543)
- CVE-2019-11884: The do_hidp_sock_ioctl function in net/bluetooth/hidp/sock.c
in the Linux kernel allowed a local user to obtain potentially sensitive
information from kernel stack memory via a HIDPCONNADD command, because a
name field may not end with a '\0' character. (bnc#1134848)
- CVE-2018-17972: An issue was discovered in the proc_pid_stack function in
fs/proc/base.c in the Linux kernel It did not ensure that only root may
inspect the kernel stack of an arbitrary task, allowing a local attacker to
exploit racy stack unwinding and leak kernel task stack contents.
(bnc#1110785)
The following non-security bugs were fixed:
- kabi: drop LINUX_MIB_TCPWQUEUETOOBIG snmp counter (bsc#1137586).
- kvm: x86: Fix the duplicated failure path handling in vmx_init (bsc#1104367).
- lib: add 'on'/'off' support to strtobool (bsc#1125931).
- powerpc/tm: Add commandline option to disable hardware transactional memory (bsc#1125580).
- powerpc/tm: Add TM Unavailable Exception (bsc#1125580).
- powerpc/tm: Flip the HTM switch default to disabled (bsc#1125580).
- powerpc/vdso32: fix CLOCK_MONOTONIC on PPC64 (bsc#1131587).
- powerpc/vdso64: Fix CLOCK_MONOTONIC inconsistencies across Y2038 (bsc#1131587).
- tcp: add tcp_min_snd_mss sysctl (bsc#1137586).
- tcp: enforce tcp_min_snd_mss in tcp_mtu_probing() (bsc#1137586).
- tcp: limit payload size of sacked skbs (bsc#1137586).
- tcp: tcp_fragment() should apply sane memory limits (bsc#1137586).CVSSUnscoredInsufficient evidenceSUSE-SU-2019:1289-1SUSE Linux Enterprisesuse · kernel-default&distro=SUSE Linux Enterprise Server 12 SP1-LTSS +12 moresuse kernel-default&distro=SUSE Linux Enterprise Server 12 SP1-LTSSSecurity update for the Linux Kernel
The SUSE Linux Enterprise 12 SP1 LTSS kernel was updated to receive various security and bugfixes.
Four new speculative execution information leak issues have been identified in Intel CPUs. (bsc#1111331)
- CVE-2018-12126: Microarchitectural Store Buffer Data Sampling (MSBDS)
- CVE-2018-12127: Microarchitectural Fill Buffer Data Sampling (MFBDS)
- CVE-2018-12130: Microarchitectural Load Port Data Samling (MLPDS)
- CVE-2019-11091: Microarchitectural Data Sampling Uncacheable Memory (MDSUM)
This kernel update contains software mitigations for these issues, which also utilize CPU microcode updates shipped in parallel.
For more information on this set of information leaks, check out https://www.suse.com/support/kb/doc/?id=7023736
The following security bugs were fixed:
- CVE-2016-10741: fs/xfs/xfs_aops.c allowed local users to cause a denial of service (system crash) because there is a race condition between direct and memory-mapped I/O (associated with a hole) that is handled with BUG_ON instead of an I/O failure (bnc#1114920 bnc#1124010).
- CVE-2017-1000407: By flooding the diagnostic port 0x80 an exception can be triggered leading to a kernel panic (bnc#1071021).
- CVE-2017-16533: The usbhid_parse function in drivers/hid/usbhid/hid-core.c allowed local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066674).
- CVE-2017-7273: The cp_report_fixup function in drivers/hid/hid-cypress.c allowed physically proximate attackers to cause a denial of service (integer underflow) or possibly have unspecified other impact via a crafted HID report (bnc#1031240).
- CVE-2017-7472: The KEYS subsystem allowed local users to cause a denial of service (memory consumption) via a series of KEY_REQKEY_DEFL_THREAD_KEYRING keyctl_set_reqkey_keyring calls (bnc#1034862).
- CVE-2018-14633: A security flaw was found in the chap_server_compute_md5() function in the ISCSI target code in the Linux kernel in a way an authentication request from an ISCSI initiator is processed. An unauthenticated remote attacker can cause a stack buffer overflow and smash up to 17 bytes of the stack. The attack requires the iSCSI target to be enabled on the victim host. Depending on how the target's code was built (i.e. depending on a compiler, compile flags and hardware architecture) an attack may lead to a system crash and thus to a denial-of-service or possibly to a non-authorized access to data exported by an iSCSI target. (bnc#1107829).
- CVE-2018-15572: The spectre_v2_select_mitigation function in arch/x86/kernel/cpu/bugs.c did not always fill RSB upon a context switch, which made it easier for attackers to conduct userspace-userspace spectreRSB attacks (bnc#1102517 bnc#1105296).
- CVE-2018-16884: NFS41+ shares mounted in different network namespaces at the same time can make bc_svc_process() use wrong back-channel IDs and cause a use-after-free vulnerability. Thus a malicious container user can cause a host kernel memory corruption and a system panic. Due to the nature of the flaw, privilege escalation cannot be fully ruled out (bnc#1119946).
- CVE-2018-18281: The mremap() syscall performed TLB flushes after dropping pagetable locks. If a syscall such as ftruncate() removes entries from the pagetables of a task that is in the middle of mremap(), a stale TLB entry can remain for a short time that permits access to a physical page after it has been released back to the page allocator and reused. (bnc#1113769).
- CVE-2018-18386: drivers/tty/n_tty.c allowed local attackers (who are able to access pseudo terminals) to hang/block further usage of any pseudo terminal devices due to an EXTPROC versus ICANON confusion in TIOCINQ (bnc#1094825).
- CVE-2018-18690: A local attacker able to set attributes on an xfs filesystem could make this filesystem non-operational until the next mount by triggering an unchecked error condition during an xfs attribute change, because xfs_attr_shortform_addname in fs/xfs/libxfs/xfs_attr.c mishandled ATTR_REPLACE operations with conversion of an attr from short to long form (bnc#1105025).
- CVE-2018-18710: An information leak in cdrom_ioctl_select_disc in drivers/cdrom/cdrom.c could be used by local attackers to read kernel memory because a cast from unsigned long to int interferes with bounds checking. This is similar to CVE-2018-10940 and CVE-2018-16658 (bnc#1113751).
- CVE-2018-19407: The vcpu_scan_ioapic function in arch/x86/kvm/x86.c allowed local users to cause a denial of service (NULL pointer dereference and BUG) via crafted system calls that reach a situation where ioapic is uninitialized (bnc#1116841).
- CVE-2018-19824: A local user could exploit a use-after-free in the ALSA driver by supplying a malicious USB Sound device (with zero interfaces) that is mishandled in usb_audio_probe in sound/usb/card.c (bnc#1118152).
- CVE-2018-19985: The function hso_get_config_data in drivers/net/usb/hso.c read if_num from the USB device (as a u8) and uses it to index a small array, resulting in an object out-of-bounds (OOB) read that potentially allowed arbitrary read in the kernel address space (bnc#1120743).
- CVE-2018-20169: The USB subsystem mishandled size checks during the reading of an extra descriptor, related to __usb_get_extra_descriptor in drivers/usb/core/usb.c (bnc#1119714).
- CVE-2018-5391: The Linux kernel was vulnerable to a denial of service attack with low rates of specially modified packets targeting IP fragment re-assembly. An attacker may cause a denial of service condition by sending specially crafted IP fragments. Various vulnerabilities in IP fragmentation have been discovered and fixed over the years. The current vulnerability (CVE-2018-5391) became exploitable in the Linux kernel with the increase of the IP fragment reassembly queue size (bnc#1103097).
- CVE-2018-9516: In hid_debug_events_read of drivers/hid/hid-debug.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. (bnc#1108498).
- CVE-2018-9568: In sk_clone_lock of sock.c, there is a possible memory corruption due to type confusion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. (bnc#1118319).
- CVE-2019-11486: The Siemens R3964 line discipline driver in drivers/tty/n_r3964.c had multiple race conditions (bnc#1133188). The line discipline was disabled.
- CVE-2019-3459: A heap address information leak while using L2CAP_GET_CONF_OPT was discovered (bnc#1120758).
- CVE-2019-3460: A heap data infoleak in multiple locations including L2CAP_PARSE_CONF_RSP was found (bnc#1120758).
- CVE-2019-3882: A flaw was found vfio interface implementation that permitted violation of the user's locked memory limit. If a device is bound to a vfio driver, such as vfio-pci, and the local attacker is administratively granted ownership of the device, it may cause a system memory exhaustion and thus a denial of service (DoS). (bnc#1131416 bnc#1131427).
- CVE-2019-6974: kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandled reference counting because of a race condition, leading to a use-after-free (bnc#1124728).
- CVE-2019-7221: The KVM implementation had a Use-after-Free (bnc#1124732).
- CVE-2019-7222: The KVM implementation had an Information Leak (bnc#1124735).
- CVE-2019-9213: expand_downwards in mm/mmap.c lacked a check for the mmap minimum address, which made it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task (bnc#1128166).
- CVE-2019-9503: Multiple brcmfmac frame validation bypasses have been fixed (bnc#1132828).
The following non-security bugs were fixed:
- cifs: Check for timeout on Negotiate stage (bsc#1091171 bsc#1126890).
- fix pgd underflow (bnc#1104475) (bsc#1104475, bsc#1110768).
- kvm: x86: Report STIBP on GET_SUPPORTED_CPUID (bsc#1111331).
- locking/atomics, asm-generic: Move some macros from <linux/bitops.h> to a new <linux/bits.h> file (bsc#1111331).
- net: ipv4: do not handle duplicate fragments as overlapping (bsc#1116345).
- sched/core: Optimize SCHED_SMT (bsc#1111331)
- sched/smt: Expose sched_smt_present static key (bsc#1106913).
- sched/smt: Make sched_smt_present track topology (bsc#1106913).
- sched/smt: Update sched_smt_present at runtime (bsc#1111331)
- tcp: prevent bogus FRTO undos with non-SACK flows (bsc#1086535).
- x86/bugs: Rename SSBD_NO to SSB_NO (bsc#1111331)
- x86/cpu: Sanitize FAM6_ATOM naming (bsc#1111331).
- x86/kvm: Expose X86_FEATURE_MD_CLEAR to guests (bsc#1111331).
- x86/kvm/vmx: Add MDS protection when L1D Flush is not active (bsc#1111331).
- x86/mce: Improve error message when kernel cannot recover, p2 (bsc#1114648).
- x86/msr-index: Cleanup bit defines (bsc#1111331).
- x86/spec_ctrl: Fix spec_ctrl reporting (bsc#1106913, bsc#1111516).
- x86/speculation: Apply IBPB more strictly to avoid cross-process data leak (bsc#1106913).
- x86/speculation: Consolidate CPU whitelists (bsc#1111331).
- x86/speculation: Enable cross-hyperthread spectre v2 STIBP mitigation (bsc#1106913).
- x86/speculation/mds: Add basic bug infrastructure for MDS (bsc#1111331).
- x86/speculation/mds: Add BUG_MSBDS_ONLY (bsc#1111331).
- x86/speculation/mds: Add mds_clear_cpu_buffers() (bsc#1111331).
- x86/speculation/mds: Add mitigation control for MDS (bsc#1111331).
- x86/speculation/mds: Add mitigation mode VMWERV (bsc#1111331).
- x86/speculation/mds: Add sysfs reporting for MDS (bsc#1111331).
- x86/speculation/mds: Clear CPU buffers on exit to user (bsc#1111331).
- x86/speculation/mds: Conditionally clear CPU buffers on idle entry (bsc#1111331).
- x86/speculation: Remove redundant arch_smt_update() invocation (bsc#1111331).
- x86/speculation: Rework SMT state change (bsc#1111331).
- x86/speculation: Simplify the CPU bug detection logic (bsc#1111331).
- x86/uaccess: Do not leak the AC flag into __put_user() value evaluation (bsc#1114648).
- xfs: do not BUG() on mixed direct and mapped I/O (bsc#1114920).
- xfs: fix quotacheck dquot id overflow infinite loop (bsc#1121621).
- xfs: stop searching for free slots in an inode chunk when there are none (bsc#1115007).
- xfs: xfs_iget_check_free_state: Use correct sign for errors (bsc#1122015, bsc#1100001).
- xfs: validate sb_logsunit is a multiple of the fs blocksize (bsc#1115038).CVSSUnscoredInsufficient evidenceSUSE-SU-2018:2908-1SUSE Linux Enterprisesuse · kernel-default&distro=SUSE Linux Enterprise Server 12 SP1-LTSS +4 moresuse kernel-default&distro=SUSE Linux Enterprise Server 12 SP1-LTSSSecurity update for the Linux Kernel
The SUSE Linux Enterprise 12 SP1 kernel was updated receive various security and bugfixes.
The following security bugs were fixed:
- CVE-2018-14634: Prevent integer overflow in create_elf_tables that allowed a
local attacker to exploit this vulnerability via a SUID-root binary and obtain
full root privileges (bsc#1108912)
- CVE-2018-14617: Prevent NULL pointer dereference and panic in
hfsplus_lookup() when opening a file (that is purportedly a hard link) in an
hfs+ filesystem that has malformed catalog data, and is mounted read-only
without a metadata directory (bsc#1102870)
- CVE-2018-16276: Incorrect bounds checking in the yurex USB driver in
yurex_read allowed local attackers to use user access read/writes to crash the
kernel or potentially escalate privileges (bsc#1106095)
- CVE-2018-12896: Prevent integer overflow in the POSIX timer code that was
caused by the way the overrun accounting works. Depending on interval and
expiry time values, the overrun can be larger than INT_MAX, but the accounting
is int based. This basically made the accounting values, which are visible to
user space via timer_getoverrun(2) and siginfo::si_overrun, random. This
allowed a local user to cause a denial of service (signed integer overflow) via
crafted mmap, futex, timer_create, and timer_settime system calls (bnc#1099922)
- CVE-2018-13093: Prevent NULL pointer dereference and panic in lookup_slow()
on a NULL inode->i_ops pointer when doing pathwalks on a corrupted xfs image.
This occured because of a lack of proper validation that cached inodes are free
during allocation (bnc#1100001)
- CVE-2018-10940: The cdrom_ioctl_media_changed function allowed local
attackers to use a incorrect bounds check in the CDROM driver
CDROM_MEDIA_CHANGED ioctl to read out kernel memory (bsc#1092903)
- CVE-2018-16658: Prevent information leak in cdrom_ioctl_drive_status that
could have been used by local attackers to read kernel memory (bnc#1107689)
- CVE-2018-6555: The irda_setsockopt function allowed local users to cause a
denial of service (ias_object use-after-free and system crash) or possibly have
unspecified other impact via an AF_IRDA socket (bnc#1106511)
- CVE-2018-6554: Prevent memory leak in the irda_bind function that allowed
local users to cause a denial of service (memory consumption) by repeatedly
binding an AF_IRDA socket (bnc#1106509)
- CVE-2018-10902: Protect against concurrent access to prevent double realloc
(double free) in snd_rawmidi_input_params() and snd_rawmidi_output_status(). A
malicious local attacker could have used this for privilege escalation
(bnc#1105322)
- CVE-2018-10879: A local user could have caused a use-after-free in
ext4_xattr_set_entry function and a denial of service or unspecified other
impact by renaming a file in a crafted ext4 filesystem image (bsc#1099844)
- CVE-2018-10883: A local user could have caused an out-of-bounds write in
jbd2_journal_dirty_metadata(), a denial of service, and a system crash by
mounting and operating on a crafted ext4 filesystem image (bsc#1099863)
- CVE-2018-10880: Prevent stack-out-of-bounds write in the ext4 filesystem code
when mounting and writing to a crafted ext4 image in ext4_update_inline_data().
An attacker could have used this to cause a system crash and a denial of
service (bsc#1099845)
- CVE-2018-10882: A local user could have caused an out-of-bound write, a
denial of service, and a system crash by unmounting a crafted ext4 filesystem
image (bsc#1099849)
- CVE-2018-10881: A local user could have caused an out-of-bound access in
ext4_get_group_info function, a denial of service, and a system crash by
mounting and operating on a crafted ext4 filesystem image (bsc#1099864)
- CVE-2018-10877: Prevent out-of-bound access in the ext4_ext_drop_refs()
function when operating on a crafted ext4 filesystem image (bsc#1099846)
- CVE-2018-10876: A use-after-free was possible in ext4_ext_remove_space()
function when mounting and operating a crafted ext4 image (bsc#1099811)
- CVE-2018-10878: A local user could have caused an out-of-bounds write and a
denial of service or unspecified other impact by mounting and operating a
crafted ext4 filesystem image (bsc#1099813)
- CVE-2018-10853: The KVM hypervisor did not check current privilege(CPL) level
while emulating unprivileged instructions. An unprivileged guest user/process
could have used this flaw to potentially escalate privileges inside guest
(bsc#1097104).
The following non-security bugs were fixed:
- KEYS: prevent creating a different user's keyrings (bnc#1065999).
- KVM: MMU: always terminate page walks at level 1 (bsc#1062604).
- KVM: MMU: simplify last_pte_bitmap (bsc#1062604).
- KVM: VMX: Work around kABI breakage in 'enum vmx_l1d_flush_state' (bsc#1106369).
- KVM: VMX: fixes for vmentry_l1d_flush module parameter (bsc#1106369).
- KVM: nVMX: update last_nonleaf_level when initializing nested EPT (bsc#1062604).
- Refresh patches.xen/xen3-x86-l1tf-04-protect-PROT_NONE-ptes.patch (bsc#1105100).
- Do not report CPU affected by L1TF when ARCH_CAP_RDCL_NO bit is set (bsc#1104906).
- Revert '- Disable patches.arch/x86-mm-Simplify-p-g4um-d_page-macros.patch' (bnc#1104818)
- bcache: avoid unncessary cache prefetch bch_btree_node_get().
- bcache: calculate the number of incremental GC nodes according to the total of btree nodes.
- bcache: display rate debug parameters to 0 when writeback is not running.
- bcache: do not check return value of debugfs_create_dir().
- bcache: finish incremental GC.
- bcache: fix I/O significant decline while backend devices registering.
- bcache: fix error setting writeback_rate through sysfs interface (bsc#1064233).
- bcache: free heap cache_set->flush_btree in bch_journal_free.
- bcache: make the pr_err statement used for ENOENT only in sysfs_attatch section.
- bcache: release dc->writeback_lock properly in bch_writeback_thread().
- bcache: set max writeback rate when I/O request is idle (bsc#1064233).
- bcache: simplify the calculation of the total amount of flash dirty data.
- cifs: Fix infinite loop when using hard mount option (bsc#1091171).
- ext4: check for allocation block validity with block group locked (bsc#1104495).
- ext4: do not update checksum of new initialized bitmaps (bnc#1012382).
- ext4: fix check to prevent initializing reserved inodes (bsc#1104319).
- ext4: fix false negatives *and* false positives in ext4_check_descriptors() (bsc#1103445).
- restore cond_resched() in shrink_dcache_parent().
- usbip: vhci_sysfs: fix potential Spectre v1 (bsc#1096547).
- x86, l1tf: Protect PROT_NONE PTEs against speculation fixup (bnc#1104818).
- x86/speculation: Use ARCH_CAPABILITIES to skip L1D flush on vmentry (bsc#1106369).
- xen, x86, l1tf: Protect PROT_NONE PTEs against speculation fixup (bnc#1104818).
- xfs: Remove dead code from inode recover function (bsc#1105396).
- xfs: convert XFS_AGFL_SIZE to a helper function (bsc#1090955, bsc#1090534).
- xfs: detect agfl count corruption and reset agfl (bsc#1090955, bsc#1090534).
- xfs: do not log/recover swapext extent owner changes for deleted inodes (bsc#1090955).
- xfs: protect inode ->di_dmstate with a spinlock (bsc#1024788).
- xfs: repair malformed inode items during log recovery (bsc#1105396).CVSSUnscored