SUSE-SU-2018:2092-1

SUSE-SU-2018:2092-1 · Security update for the Linux Kernel

Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.

Diese Seite zeigt ausgewählte Angaben aus den Quellen. Die vollständige Beschreibung und betroffene Versionen finden Sie in den verlinkten Sicherheitshinweisen.

The SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes. The following new feature was added: - NVDIMM memory error notification (ACPI 6.2) The following security bugs were fixed: - CVE-2018-13406: An integer overflow in the uvesafb_setcmap function could have result in local attackers being able to crash the kernel or potentially elevate privileges because kmalloc_array is not used (bnc#1100418) - CVE-2018-13053: The alarm_timer_nsleep function had an integer overflow via a large relative timeout because ktime_add_safe was not used (bnc#1099924) - CVE-2018-9385: Prevent overread of the 'driver_override' buffer (bsc#1100491) - CVE-2018-13405: The inode_init_owner function allowed local users to create files with an unintended group ownership allowing attackers to escalate privileges by making a plain file executable and SGID (bnc#1100416) - CVE-2017-5753: Systems with microprocessors utilizing speculative execution and branch prediction may have allowed unauthorized disclosure of information to an attacker with local user access via a side-channel analysis (bsc#1068032) - CVE-2018-1118: Linux kernel vhost did not properly initialize memory in messages passed between virtual guests and the host operating system. This could have allowed local privileged users to read some kernel memory contents when reading from the /dev/vhost-net device file (bsc#1092472) - CVE-2018-12233: A memory corruption bug in JFS could have been triggered by calling setxattr twice with two different extended attribute names on the same file. This vulnerability could be triggered by an unprivileged user with the ability to create files and execute programs (bsc#1097234) - CVE-2018-5848: In the function wmi_set_ie(), the length validation code did not handle unsigned integer overflow properly. As a result, a large value of the 'ie_len' argument could have caused a buffer overflow (bnc#1097356) - CVE-2018-1000204: Prevent infoleak caused by incorrect handling of the SG_IO ioctl (bsc#1096728) - CVE-2018-3639: Systems with microprocessors utilizing speculative execution and speculative execution of memory reads the addresses of all prior memory writes are known may have allowed unauthorized disclosure of information to an attacker with local user access via a side-channel analysis, aka Speculative Store Bypass (SSB), Variant 4 (bsc#1087082) - CVE-2018-1120: By mmap()ing a FUSE-backed file onto a process's memory containing command line arguments (or environment strings), an attacker could have caused utilities from psutils or procps (such as ps, w) to block indefinitely (denial of service) or for some controlled time (as a synchronization primitive for other attacks) (bsc#1093158) - CVE-2018-1094: The ext4_fill_super function did not always initialize the crc32c checksum driver, which allowed attackers to cause a denial of service (ext4_xattr_inode_hash NULL pointer dereference and system crash) via a crafted ext4 image (bsc#1087007) - CVE-2018-1092: The ext4_iget function mishandled the case of a root directory with a zero i_links_count, which allowed attackers to cause a denial of service (ext4_process_freed_data NULL pointer dereference and OOPS) via a crafted ext4 image (bsc#1087012) - 1093: The ext4_valid_block_bitmap function allowed attackers to cause a denial of service (out-of-bounds read and system crash) via a crafted ext4 image because balloc.c and ialloc.c do not validate bitmap block numbers (bsc#1087095) - CVE-2018-1000200: Prevent NULL pointer dereference which could have resulted in an out of memory (OOM) killing of large mlocked processes (bsc#1090150) - CVE-2018-1130: NULL pointer dereference in dccp_write_xmit() function that allowed a local user to cause a denial of service by a number of certain crafted system calls (bsc#1092904) - CVE-2018-5803: Prevent error in the '_sctp_make_chunk()' function when handling SCTP packets length that could have been exploited to cause a kernel crash (bnc#1083900) - CVE-2018-7492: Prevent NULL pointer dereference in the net/rds/rdma.c __rds_rdma_map() function that allowed local attackers to cause a system panic and a denial-of-service, related to RDS_GET_MR and RDS_GET_MR_FOR_DEST (bsc#1082962) - CVE-2018-8781: The udl_fb_mmap function had an integer-overflow vulnerability allowing local users with access to the udldrmfb driver to obtain full read and write permissions on kernel physical pages, resulting in a code execution in kernel space (bsc#1090643) - CVE-2018-10124: The kill_something_info function in kernel/signal.c might have allowed local users to cause a denial of service via an INT_MIN argument (bnc#1089752) - CVE-2018-10087: The kernel_wait4 function in kernel/exit.c might have allowed local users to cause a denial of service by triggering an attempted use of the -INT_MIN value (bnc#1089608) - CVE-2017-5715: Prevent unauthorized disclosure of information to an attacker with local user access caused by speculative execution and indirect branch prediction (bsc#1068032) The following non-security bugs were fixed: - Fix copy_in_user() declaration (bsc#1052766). - 1wire: family module autoload fails because of upper/lower case mismatch (bsc#1051510). - 8021q: fix a memory leak for VLAN 0 device (networking-stable-18_01_12). - 8139too: Use disable_irq_nosync() in rtl8139_poll_controller() (networking-stable-18_05_15). - 8139too: revisit napi_complete_done() usage (networking-stable-17_10_09). - 9p/trans_virtio: discard zero-length reply (bsc#1052766). - ACPI / APEI: Replace ioremap_page_range() with fixmap (bsc#1051510). - ACPI / LPSS: Add missing prv_offset setting for byt/cht PWM devices (bsc#1051510). - ACPI / NUMA: ia64: Parse all entries of SRAT memory affinity table (bnc#1088796). - ACPI / bus: Do not call _STA on battery devices with unmet dependencies (bsc#1051510). - ACPI / button: make module loadable when booted in non-ACPI mode (bsc#1051510). - ACPI / hotplug / PCI: Check presence of slot itself in get_slot_status() (bsc#1051510). - ACPI / scan: Initialize watchdog before PNP (bsc#1073960). - ACPI / scan: Send change uevent with offine environmental data (bsc#1082485). - ACPI / scan: Use acpi_bus_get_status() to initialize ACPI_TYPE_DEVICE devs (bsc#1051510). - ACPI / video: Add quirk to force acpi-video backlight on Samsung 670Z5E (bsc#1051510). - ACPI / video: Default lcd_only to true on Win8-ready and newer machines (bsc#1051510). - ACPI / video: Only default only_lcd to true on Win8-ready _desktops_ (bsc#1051510). - ACPI / watchdog: Prefer iTCO_wdt on Lenovo Z50-70 (bsc#1051510). - ACPI / watchdog: properly initialize resources (bsc#1051510). - ACPI: EC: Fix debugfs_create_*() usage (bsc#1051510). - ACPI: acpi_pad: Fix memory leak in power saving threads (bsc#1051510). - ACPI: processor_perflib: Do not send _PPC change notification if not ready (bsc#1051510). - ACPI: sysfs: Make ACPI GPE mask kernel parameter cover all GPEs (bsc#1051510). - ACPICA: ACPI 6.0A: Changes to the NFIT ACPI table (bsc#1091424). - ACPICA: Events: add a return on failure from acpi_hw_register_read (bsc#1051510). - ACPICA: Fix memory leak on unusual memory leak (bsc#1051510). - ACPICA: acpi: acpica: fix acpi operand cache leak in nseval.c (bsc#1051510). - ALSA: aloop: Add missing cable lock to ctl API callbacks (bsc#1051510). - ALSA: aloop: Mark paused device as inactive (bsc#1051510). - ALSA: asihpi: Hardening for potential Spectre v1 (bsc#1051510). - ALSA: caiaq: Add yet more sanity checks for invalid EPs (bsc#1051510). - ALSA: control: Hardening for potential Spectre v1 (bsc#1051510). - ALSA: control: fix a redundant-copy issue (bsc#1051510). - ALSA: core: Report audio_tstamp in snd_pcm_sync_ptr (bsc#1051510). - ALSA: dice: fix OUI for TC group (bsc#1051510). - ALSA: dice: fix error path to destroy initialized stream data (bsc#1051510). - ALSA: dice: fix kernel NULL pointer dereference due to

Korrektur verfügbar

Veröffentlicht

2018-07-27T13:37:02Z

Aktualisiert

2026-02-04T03:49:27.231289Z

Technologie-Stack: system

Prüfen Sie Ihren Server →