Security update for the Linux Kernel (Live Patch 15 for SLE 12 SP2)
This update for the Linux Kernel 4.4.90-92_50 fixes several issues.
The following security issue was fixed:
- CVE-2017-18075: crypto/pcrypt.c in the Linux kernel mishandled freeing instances, allowing a local user able to access the AF_ALG-based AEAD interface (CONFIG_CRYPTO_USER_API_AEAD) and pcrypt (CONFIG_CRYPTO_PCRYPT) to cause a denial of service (kfree of an incorrect pointer) or possibly have unspecified other impact by executing a crafted sequence of system calls (bsc#1077404).
Non-security issue fixed:
- btrfs: account for pinned bytes in should_alloc_chunk (bsc#1077268)
Security update for the Linux Kernel (Live Patch 15 for SLE 12 SP2)
This update for the Linux Kernel 4.4.90-92_50 fixes one issue.
The following security issue was fixed:
- CVE-2017-17712: The raw_sendmsg() function had a race condition that lead to uninitialized stack pointer usage. This allowed a local user to execute code and gain privileges (bsc#1073230).
The SUSE Linux Enterprise 12 SP2 kernel was updated to receive various security and bugfixes.
The following security bugs were fixed:
- CVE-2017-1000405: A bug in the THP CoW support could be used by local attackers to corrupt memory of other processes and cause them to crash (bnc#1069496).
- CVE-2017-16939: The XFRM dump policy implementation in net/xfrm/xfrm_user.c in the Linux kernel allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages (bnc#1069702).
The following non-security bugs were fixed:
Fix a b