SUSE-SU-2019:1532-1

SUSE-SU-2019:1532-1 · Security update for the Linux Kernel

Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.

Cette page présente une partie des faits des sources. Consultez les avis liés pour la description complète et les versions concernées.

The SUSE Linux Enterprise 12 SP3 kernel was updated to 4.4.180 to receive various security and bugfixes. The following security bugs were fixed: - CVE-2019-11477: A sequence of SACKs may have been crafted such that one can trigger an integer overflow, leading to a kernel panic. - CVE-2019-11478: It was possible to send a crafted sequence of SACKs which will fragment the TCP retransmission queue. An attacker may have been able to further exploit the fragmented queue to cause an expensive linked-list walk for subsequent SACKs received for that same TCP connection. - CVE-2019-11479: An attacker could force the Linux kernel to segment its responses into multiple TCP segments. This would drastically increased the bandwidth required to deliver the same amount of data. Further, it would consume additional resources such as CPU and NIC processing power. - CVE-2019-3846: A flaw that allowed an attacker to corrupt memory and possibly escalate privileges was found in the mwifiex kernel module while connecting to a malicious wireless network. (bnc#1136424) - CVE-2019-12382: An issue was discovered in drm_load_edid_firmware in drivers/gpu/drm/drm_edid_load.c in the Linux kernel, there was an unchecked kstrdup of fwstr, which might have allowed an attacker to cause a denial of service (NULL pointer dereference and system crash). (bnc#1136586) - CVE-2019-5489: The mincore() implementation in mm/mincore.c in the Linux kernel allowed local attackers to observe page cache access patterns of other processes on the same system, potentially allowing sniffing of secret information. (Fixing this affects the output of the fincore program.) Limited remote exploitation may have been possible, as demonstrated by latency differences in accessing public files from an Apache HTTP Server. (bnc#1120843) - CVE-2019-11833: fs/ext4/extents.c in the Linux kernel did not zero out the unused memory region in the extent tree block, which might have allowed local users to obtain sensitive information by reading uninitialized data in the filesystem. (bnc#1135281) - CVE-2018-7191: In the tun subsystem in the Linux kernel, dev_get_valid_name was not called before register_netdevice. This allowed local users to cause a denial of service (NULL pointer dereference and panic) via an ioctl(TUNSETIFF) call with a dev name containing a / character. (bnc#1135603) - CVE-2019-11190: The Linux kernel allowed local users to bypass ASLR on setuid programs (such as /bin/su) because install_exec_creds() was called too late in load_elf_binary() in fs/binfmt_elf.c, and thus the ptrace_may_access() check had a race condition when reading /proc/pid/stat. (bnc#1132472) - CVE-2019-11815: An issue was discovered in rds_tcp_kill_sock in net/rds/tcp.c in the Linux kernel There was a race condition leading to a use-after-free, related to net namespace cleanup. (bnc#1134537) - CVE-2019-11884: The do_hidp_sock_ioctl function in net/bluetooth/hidp/sock.c in the Linux kernel allowed a local user to obtain potentially sensitive information from kernel stack memory via a HIDPCONNADD command, because a name field may not end with a '\0' character. (bnc#1134848) - CVE-2018-17972: An issue was discovered in the proc_pid_stack function in fs/proc/base.c in the Linux kernel It did not ensure that only root may inspect the kernel stack of an arbitrary task, allowing a local attacker to exploit racy stack unwinding and leak kernel task stack contents. (bnc#1110785) - CVE-2019-11486: The Siemens R3964 line discipline driver in drivers/tty/n_r3964.c in the Linux kernel had multiple race conditions. (bnc#1133188) The following non-security bugs were fixed: - 9p locks: add mount option for lock retry interval (bnc#1012382). - 9p: do not trust pdu content for stat item size (bnc#1012382). - X.509: unpack RSA signatureValue field from BIT STRING (git-fixes). - acpi / sbs: Fix GPE storm on recent MacBookPro's (bnc#1012382). - alsa: core: Fix card races between register and disconnect (bnc#1012382). - alsa: echoaudio: add a check for ioremap_nocache (bnc#1012382). - alsa: info: Fix racy addition/deletion of nodes (bnc#1012382). - alsa: line6: use dynamic buffers (bnc#1012382). - alsa: opl3: fix mismatch between snd_opl3_drum_switch definition and declaration (bnc#1012382). - alsa: pcm: check if ops are defined before suspending PCM (bnc#1012382). - alsa: sb8: add a check for request_region (bnc#1012382). - alsa: seq: Fix OOB-reads from strlcpy (bnc#1012382). - appletalk: Fix compile regression (bnc#1012382). - appletalk: Fix use-after-free in atalk_proc_exit (bnc#1012382). - arm64/kernel: do not ban ADRP to work around Cortex-A53 erratum #843419 (bsc#1126040). - arm64/kernel: rename module_emit_adrp_veneer->module_emit_veneer_for_adrp (bsc#1126040). - arm64: Add helper to decode register from instruction (bsc#1126040). - arm64: debug: Do not propagate UNKNOWN FAR into si_code for debug signals (bnc#1012382). - arm64: debug: Ensure debug handlers check triggering exception level (bnc#1012382). - arm64: futex: Fix FUTEX_WAKE_OP atomic ops with non-zero result value (bnc#1012382). - arm64: futex: Restore oldval initialization to work around buggy compilers (bnc#1012382). - arm64: module-plts: factor out PLT generation code for ftrace (bsc#1126040). - arm64: module: do not BUG when exceeding preallocated PLT count (bsc#1126040). - arm64: module: split core and init PLT sections (bsc#1126040). - arm: 8833/1: Ensure that NEON code always compiles with Clang (bnc#1012382). - arm: 8839/1: kprobe: make patch_lock a raw_spinlock_t (bnc#1012382). - arm: 8840/1: use a raw_spinlock_t in unwind (bnc#1012382). - arm: avoid Cortex-A9 livelock on tight dmb loops (bnc#1012382). - arm: dts: at91: Fix typo in ISC_D0 on PC9 (bnc#1012382). - arm: dts: pfla02: increase phy reset duration (bnc#1012382). - arm: iop: do not use using 64-bit DMA masks (bnc#1012382). - arm: orion: do not use using 64-bit DMA masks (bnc#1012382). - arm: samsung: Limit SAMSUNG_PM_CHECK config option to non-Exynos platforms (bnc#1012382). - asoc: Intel: avoid Oops if DMA setup fails (bnc#1012382). - asoc: cs4270: Set auto-increment bit for register writes (bnc#1012382). - asoc: fsl-asoc-card: fix object reference leaks in fsl_asoc_card_probe (bnc#1012382). - asoc: fsl_esai: fix channel swap issue when stream starts (bnc#1012382). - asoc: tlv320aic32x4: Fix Common Pins (bnc#1012382). - asoc:soc-pcm:fix a codec fixup issue in TDM case (bnc#1012382). - backlight: lm3630a: Return 0 on success in update_status functions (bsc#1106929) - bcache: Move couple of functions to sysfs.c (bsc#1130972). - bcache: Move couple of string arrays to sysfs.c (bsc#1130972). - bcache: Populate writeback_rate_minimum attribute (bsc#1130972). - bcache: account size of buckets used in uuid write to ca->meta_sectors_written (bsc#1130972). - bcache: add MODULE_DESCRIPTION information (bsc#1130972). - bcache: add a comment in super.c (bsc#1130972). - bcache: add code comments for bset.c (bsc#1130972). - bcache: add comment for cache_set->fill_iter (bsc#1130972). - bcache: add identifier names to arguments of function definitions (bsc#1130972). - bcache: add missing SPDX header (bsc#1130972). - bcache: add separate workqueue for journal_write to avoid deadlock (bsc#1130972). - bcache: add static const prefix to char * array declarations (bsc#1130972). - bcache: add sysfs_strtoul_bool() for setting bit-field variables (bsc#1130972). - bcache: add the missing comments for smp_mb()/smp_wmb() (bsc#1130972). - bcache: cannot set writeback_running via sysfs if no writeback kthread created (bsc#1130972). - bcache: comment on direct access to bvec table (bsc#1130972). - bcache: correct dirty data statistics (bsc#1130972). - bcache: do not assign in if condition in bcache_device_init() (bsc#1130972). - bcache: do not assign in if condition in bcache_init() (bsc#1130972). - bcache: do not assign in if condition register_bcache() (bsc#1130972). - bcache: do not check NULL pointer before calling kmem_cache_destroy (bsc

Correctif disponible

Publication

2019-06-17T17:21:28Z

Mise à jour

2026-02-04T04:15:35.998335Z

Pile logicielle: system

Vérifiez votre serveur →