Security update for the Linux Kernel (Live Patch 17 for SLE 12 SP2)
This update for the Linux Kernel 4.4.103-92_56 fixes several issues.
The following security issue was fixed:
- CVE-2017-18075: crypto/pcrypt.c in the Linux kernel mishandled freeing instances, allowing a local user able to access the AF_ALG-based AEAD interface (CONFIG_CRYPTO_USER_API_AEAD) and pcrypt (CONFIG_CRYPTO_PCRYPT) to cause a denial of service (kfree of an incorrect pointer) or possibly have unspecified other impact by executing a crafted sequence of system calls (bsc#1077404).
Non security issue fixed:
- btrfs: account for pinned bytes in should_alloc_chunk (bsc#1077268)
Security update for the Linux Kernel (Live Patch 17 for SLE 12 SP2)
This update for the Linux Kernel 4.4.103-92_56 fixes one issue.
The following security issue was fixed:
- CVE-2017-17712: The raw_sendmsg() function had a race condition that lead to uninitialized stack pointer usage. This allowed a local user to execute code and gain privileges (bsc#1073230).
The SUSE Linux Enterprise 12 SP2 kernel was updated to receive various security and bugfixes.
This update adds mitigations for various side channel attacks against
modern CPUs that could disclose content of otherwise unreadable memory
(bnc#1068032).
- CVE-2017-5753 / 'SpecŧreAttack': Local attackers on systems with
modern CPUs featuring deep instruction pipelining could use attacker
controllable speculative execution over code patterns in the Linux
Kernel to leak content from otherwise not readable memory in the same
address space, allowing retrieval of passwords, cryptographic keys
and other secrets.
This problem is mitigate