Security update for the Linux Kernel (Live Patch 0 for SLE 15 SP1)
This update for the Linux Kernel 4.12.14-195 fixes several issues.
The following security issue was fixed:
- CVE-2019-14835: A buffer overflow flaw was found in the way vhost functionality, that translates virtqueue buffers to IOVs, logged the buffer descriptors during migration. A privileged guest user able to pass descriptors with invalid length to the host when migration is underway, could use this flaw to increase their privileges on the host (bsc#1151021).
Security update for the Linux Kernel (Live Patch 10 for SLE 15)
This update for the Linux Kernel 4.12.14-150_17 fixes several issues.
The following security issues were fixed:
- CVE-2019-11477: Jonathan Looney discovered that the TCP_SKB_CB(skb)->tcp_gso_segs value was subject to an integer overflow when handling TCP Selective Acknowledgments (SACKs). A remote attacker could use this to cause a denial of service. (bsc#1137586)
- CVE-2019-11478: Jonathan Looney discovered that the TCP retransmission queue implementation in tcp_fragment could be fragmented when handling certain TCP Selective Acknowledgment (SACK) sequences. A remote attacker could use this to cause a denial of service. (bsc#1137586)
- CVE
Security update for the Linux Kernel (Live Patch 6 for SLE 15)
This update for the Linux Kernel 4.12.14-25_22 fixes several issues.
The following security issues were fixed:
- CVE-2019-3846: A flaw that allowed an attacker to corrupt memory and possibly escalate privileges was found in the mwifiex kernel module while connecting to a malicious wireless network (bsc#1136446).
- CVE-2019-11477: A sequence of SACKs may have been crafted by a remote attacker such that one can trigger an integer overflow, leading to a kernel panic. (bsc#1137586).
- CVE-2019-11478: It was possible to send a crafted sequence of SACKs which would fragment the TCP retransmission queue. A remote attacker may have been able to fur
Security update for the Linux Kernel (Live Patch 2 for SLE 15)
This update for the Linux Kernel 4.12.14-25_6 fixes several issues.
The following security issues were fixed:
- CVE-2019-9213: Expand_downwards in mm/mmap.c lacked a check for the mmap minimum address, which made it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task (bsc#1128378).
- CVE-2019-8912: af_alg_release() in crypto/af_alg.c neglected to set a NULL value for a certain structure member, which could have led to a use-after-free in sockfs_setattr (bsc#1126284).
- CVE-2019-7221: Fixed a user-after-free vulnerability in the KVM hypervisor relate
Security update for the Linux Kernel (Live Patch 0 for SLE 15)
This update for the Linux Kernel 4.12.14-23 fixes one issue.
The following security issue was fixed:
- CVE-2018-16884: A flaw was found in the Linux kernel's NFS41+ subsystem. NFS41+ shares mounted in different network namespaces at the same time could make bc_svc_process() use wrong back-channel IDs and cause a use-after-free vulnerability. Thus a malicious container user can cause a host kernel memory corruption and a system panic. Due to the nature of the flaw, privilege escalation cannot be fully ruled out (bsc#1119947).
Security update for the Linux Kernel (Live Patch 0 for SLE 15)
This update for the Linux Kernel 4.12.14-23 fixes several issues.
The following security issues were fixed:
- CVE-2018-17182: The vmacache_flush_all function in mm/vmacache.c mishandled sequence number overflows. An attacker can trigger a use-after-free (and possibly gain privileges) via certain thread creation, map, unmap, invalidation, and dereference operations (bsc#1110233).
- CVE-2018-14633: A security flaw was found in the chap_server_compute_md5() function in the ISCSI target code in a way an authentication request from an ISCSI initiator is processed. An unauthenticated remote attacker can cause a stack buffer overflow and smash up
The SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes.
The following security bugs were fixed:
- CVE-2018-14617: Prevent NULL pointer dereference and panic in
hfsplus_lookup() when opening a file (that is purportedly a hard link) in an
hfs+ filesystem that has malformed catalog data, and is mounted read-only
without a metadata directory (bsc#1102870)
- CVE-2018-14613: Prevent invalid pointer dereference in io_ctl_map_page() when
mounting and operating a crafted btrfs image, caused by a lack of block group
item validation in check_leaf_item (bsc#1102896).
- CVE-2018-10940: The cdrom_ioctl_media_c