This update for dpdk to version 16.11.8 provides the following security fix:
- CVE-2018-1059: restrict untrusted guest to misuse virtio to corrupt host application (ovs-dpdk) memory which could have lead all VM to lose connectivity (bsc#1089638)
and following non-security fixes:
- Enable the broadcom chipset family Broadcom NetXtreme II BCM57810 (bsc#1073363)
- Fix a latency problem by using cond_resched rather than schedule_timeout_interruptible (bsc#1069601)
- Fix a syntax error affecting csh environment configuration (bsc#1102310)
- Fixes in net/bnxt:
* Fix HW Tx checksum offload check
* Fix incorrect IO address handling in
The SUSE Linux Enterprise 12 SP3 kernel was updated to 4.4.143 to receive various security and bugfixes.
The following security bugs were fixed:
- CVE-2018-5390 aka 'SegmentSmack': Linux kernel could be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service (bnc#1102340).
- CVE-2018-14734: drivers/infiniband/core/ucma.c in the Linux kernel allowed ucma_leave_multicast to access a certain data structure after a cleanup step in ucma_process_join, which allowed attackers to cause a denial of service (use-after-free) (bnc#1103119).
- CVE-2017-18
This update fixes the following issues:
- CVE-2018-1059: The DPDK vhost-user interface does not check to verify that all the requested guest
physical range is mapped and contiguous when performing Guest Physical Addresses to Host Virtual Addresses
translations. This may lead to a malicious guest exposing vhost-user backend process memory.
All versions before 18.02.1 are vulnerable. (bsc#1089638).