Security update for the Linux Kernel (Live Patch 10 for SLE 15)
This update for the Linux Kernel 4.12.14-150_17 fixes several issues.
The following security issues were fixed:
- CVE-2019-11477: Jonathan Looney discovered that the TCP_SKB_CB(skb)->tcp_gso_segs value was subject to an integer overflow when handling TCP Selective Acknowledgments (SACKs). A remote attacker could use this to cause a denial of service. (bsc#1137586)
- CVE-2019-11478: Jonathan Looney discovered that the TCP retransmission queue implementation in tcp_fragment could be fragmented when handling certain TCP Selective Acknowledgment (SACK) sequences. A remote attacker could use this to cause a denial of service. (bsc#1137586)
- CVE
Security update for the Linux Kernel (Live Patch 6 for SLE 15)
This update for the Linux Kernel 4.12.14-25_22 fixes several issues.
The following security issues were fixed:
- CVE-2019-3846: A flaw that allowed an attacker to corrupt memory and possibly escalate privileges was found in the mwifiex kernel module while connecting to a malicious wireless network (bsc#1136446).
- CVE-2019-11477: A sequence of SACKs may have been crafted by a remote attacker such that one can trigger an integer overflow, leading to a kernel panic. (bsc#1137586).
- CVE-2019-11478: It was possible to send a crafted sequence of SACKs which would fragment the TCP retransmission queue. A remote attacker may have been able to fur
Security update for the Linux Kernel (Live Patch 1 for SLE 15)
This update for the Linux Kernel 4.12.14-25_3 fixes one issue.
The following security issue was fixed:
- CVE-2018-14734: drivers/infiniband/core/ucma.c allowed ucma_leave_multicast to access a certain data structure after a cleanup step in ucma_process_join, which allows attackers to cause a denial of service (use-after-free) (bsc#1131390).
Security update for the Linux Kernel (Live Patch 1 for SLE 15)
This update for the Linux Kernel 4.12.14-25_3 fixes several issues.
The following security issues were fixed:
- CVE-2019-9213: Expand_downwards in mm/mmap.c lacked a check for the mmap minimum address, which made it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task (bsc#1128378).
- CVE-2019-8912: af_alg_release() in crypto/af_alg.c neglected to set a NULL value for a certain structure member, which could have led to a use-after-free in sockfs_setattr (bsc#1126284).
- CVE-2018-12232: In net/socket.c there was a race condition between fchownat and c
Security update for the Linux Kernel (Live Patch 0 for SLE 15)
This update for the Linux Kernel 4.12.14-23 fixes one issue.
The following security issue was fixed:
- CVE-2018-16884: A flaw was found in the Linux kernel's NFS41+ subsystem. NFS41+ shares mounted in different network namespaces at the same time could make bc_svc_process() use wrong back-channel IDs and cause a use-after-free vulnerability. Thus a malicious container user can cause a host kernel memory corruption and a system panic. Due to the nature of the flaw, privilege escalation cannot be fully ruled out (bsc#1119947).
Security update for the Linux Kernel (Live Patch 2 for SLE 15)
This update for the Linux Kernel 4.12.14-25_6 fixes one issue.
The following security issue was fixed:
- CVE-2018-5391: Fixed a denial of service attack with low rates of specially modified packets targeting IP fragment re-assembly. An attacker may have caused a denial of service condition by sending specially crafted IP fragments. The current vulnerability (CVE-2018-5391) became exploitable in the Linux kernel with the increase of the IP fragment reassembly queue size (bsc#1103098).
Security update for the Linux Kernel (Live Patch 0 for SLE 15)
This update for the Linux Kernel 4.12.14-23 fixes several issues.
The following security issues were fixed:
- CVE-2018-17182: The vmacache_flush_all function in mm/vmacache.c mishandled sequence number overflows. An attacker can trigger a use-after-free (and possibly gain privileges) via certain thread creation, map, unmap, invalidation, and dereference operations (bsc#1110233).
- CVE-2018-14633: A security flaw was found in the chap_server_compute_md5() function in the ISCSI target code in a way an authentication request from an ISCSI initiator is processed. An unauthenticated remote attacker can cause a stack buffer overflow and smash up
Security update for the Linux Kernel (Live Patch 1 for SLE 15)
This update for the Linux Kernel 4.12.14-25_3 fixes several issues.
The following security issues were fixed:
- CVE-2018-10938: It was found that a crafted network packet sent remotely by an attacker may force the kernel to enter an infinite loop in the cipso_v4_optptr() function in net/ipv4/cipso_ipv4.c leading to a denial-of-service. A certain non-default configuration of LSM (Linux Security Module) and NetLabel should be set up on a system an attacker could leverage this flaw.
- CVE-2018-10902: It was found that the raw midi kernel driver did not protect against concurrent access which lead to a double realloc (double free) in snd_rawmid
Security update for the Linux Kernel (Live Patch 0 for SLE 15)
This update for the Linux Kernel 4.12.14-23 fixes one issue.
The following security issue was fixed:
- CVE-2018-15471: An issue was discovered in xenvif_set_hash_mapping in drivers/net/xen-netback/hash.c. The Linux netback driver allowed frontends to control mapping of requests to request queues. When processing a request to set or change this mapping, some input validation (e.g., for an integer overflow) was missing or flawed, leading to OOB access in hash handling. A malicious or buggy frontend may cause the (usually privileged) backend to make out of bounds memory accesses, potentially resulting in one or more of privilege escalation, De
Security update for the Linux Kernel (Live Patch 1 for SLE 15)
This update for the Linux Kernel 4.12.14-25_3 fixes several issues.
The following security issues were fixed:
- CVE-2018-5390: Linux kernel versions 4.9+ can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service (bsc#1102682).
- CVE-2018-3646: Local attackers in virtualized guest systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data, even from other virtual machines or the host system (bsc#1099306).
The SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes.
The following new feature was added:
- NVDIMM memory error notification (ACPI 6.2)
The following security bugs were fixed:
- CVE-2018-13406: An integer overflow in the uvesafb_setcmap function could
have result in local attackers being able to crash the kernel or potentially
elevate privileges because kmalloc_array is not used (bnc#1100418)
- CVE-2018-13053: The alarm_timer_nsleep function had an integer overflow via a
large relative timeout because ktime_add_safe was not used (bnc#1099924)
- CVE-2018-9385: Prevent overread of the 'driver_over