Security update for the Linux Kernel (Live Patch 10 for SLE 15)
This update for the Linux Kernel 4.12.14-150_17 fixes several issues.
The following security issues were fixed:
- CVE-2019-11477: Jonathan Looney discovered that the TCP_SKB_CB(skb)->tcp_gso_segs value was subject to an integer overflow when handling TCP Selective Acknowledgments (SACKs). A remote attacker could use this to cause a denial of service. (bsc#1137586)
- CVE-2019-11478: Jonathan Looney discovered that the TCP retransmission queue implementation in tcp_fragment could be fragmented when handling certain TCP Selective Acknowledgment (SACK) sequences. A remote attacker could use this to cause a denial of service. (bsc#1137586)
- CVE
Security update for the Linux Kernel (Live Patch 6 for SLE 15)
This update for the Linux Kernel 4.12.14-25_22 fixes several issues.
The following security issues were fixed:
- CVE-2019-3846: A flaw that allowed an attacker to corrupt memory and possibly escalate privileges was found in the mwifiex kernel module while connecting to a malicious wireless network (bsc#1136446).
- CVE-2019-11477: A sequence of SACKs may have been crafted by a remote attacker such that one can trigger an integer overflow, leading to a kernel panic. (bsc#1137586).
- CVE-2019-11478: It was possible to send a crafted sequence of SACKs which would fragment the TCP retransmission queue. A remote attacker may have been able to fur
Security update for the Linux Kernel (Live Patch 2 for SLE 15)
This update for the Linux Kernel 4.12.14-25_6 fixes several issues.
The following security issues were fixed:
- CVE-2019-9213: Expand_downwards in mm/mmap.c lacked a check for the mmap minimum address, which made it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task (bsc#1128378).
- CVE-2019-8912: af_alg_release() in crypto/af_alg.c neglected to set a NULL value for a certain structure member, which could have led to a use-after-free in sockfs_setattr (bsc#1126284).
- CVE-2019-7221: Fixed a user-after-free vulnerability in the KVM hypervisor relate
Security update for the Linux Kernel (Live Patch 0 for SLE 15)
This update for the Linux Kernel 4.12.14-23 fixes one issue.
The following security issue was fixed:
- CVE-2018-16884: A flaw was found in the Linux kernel's NFS41+ subsystem. NFS41+ shares mounted in different network namespaces at the same time could make bc_svc_process() use wrong back-channel IDs and cause a use-after-free vulnerability. Thus a malicious container user can cause a host kernel memory corruption and a system panic. Due to the nature of the flaw, privilege escalation cannot be fully ruled out (bsc#1119947).
Security update for the Linux Kernel (Live Patch 2 for SLE 15)
This update for the Linux Kernel 4.12.14-25_6 fixes one issue.
The following security issue was fixed:
- CVE-2018-5391: Fixed a denial of service attack with low rates of specially modified packets targeting IP fragment re-assembly. An attacker may have caused a denial of service condition by sending specially crafted IP fragments. The current vulnerability (CVE-2018-5391) became exploitable in the Linux kernel with the increase of the IP fragment reassembly queue size (bsc#1103098).
Security update for the Linux Kernel (Live Patch 0 for SLE 15)
This update for the Linux Kernel 4.12.14-23 fixes several issues.
The following security issues were fixed:
- CVE-2018-17182: The vmacache_flush_all function in mm/vmacache.c mishandled sequence number overflows. An attacker can trigger a use-after-free (and possibly gain privileges) via certain thread creation, map, unmap, invalidation, and dereference operations (bsc#1110233).
- CVE-2018-14633: A security flaw was found in the chap_server_compute_md5() function in the ISCSI target code in a way an authentication request from an ISCSI initiator is processed. An unauthenticated remote attacker can cause a stack buffer overflow and smash up
Security update for the Linux Kernel (Live Patch 2 for SLE 15)
This update for the Linux Kernel 4.12.14-25_6 fixes one issue.
The following security issue was fixed:
- CVE-2018-10938: It was found that a crafted network packet sent remotely by an attacker may force the kernel to enter an infinite loop in the cipso_v4_optptr() function in net/ipv4/cipso_ipv4.c leading to a denial-of-service. A certain non-default configuration of LSM (Linux Security Module) and NetLabel should be set up on a system an attacker could leverage this flaw (bsc#1106191).
Security update for the Linux Kernel (Live Patch 2 for SLE 15)
This update for the Linux Kernel 4.12.14-25_6 fixes several issues.
The following security issues were fixed:
- CVE-2018-15471: An issue was discovered in xenvif_set_hash_mapping in drivers/net/xen-netback/hash.c. The Linux netback driver allowed frontends to control mapping of requests to request queues. When processing a request to set or change this mapping, some input validation (e.g., for an integer overflow) was missing or flawed, leading to OOB access in hash handling. A malicious or buggy frontend may cause the (usually privileged) backend to make out of bounds memory accesses, potentially resulting in one or more of privilege escal
Security update for the Linux Kernel (Live Patch 2 for SLE 15)
This update for the Linux Kernel 4.12.14-25_6 fixes one issue.
The following security issue was fixed:
- CVE-2018-3646: Local attackers in virtualized guest systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data, even from other virtual machines or the host system (bsc#1099306).
The SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes.
The following security bugs were fixed:
CVE-2018-5390 aka SegmentSmack:
A remote attacker even with relatively low bandwidth could have caused lots of CPU usage
by triggering the worst case scenario during IP and/or TCP fragment reassembly (bsc#1102340)
CVE-2017-18344:
The timer_create syscall implementation didn't properly validate input, which could have lead to out-of-bounds access.
This allowed userspace applications to read arbitrary kernel memory in some setups. (bsc#1102851)
The following non-security bugs were fixed:
- acpi, apei, e