ID CVE-2018-1000199
Summary The Linux Kernel version 3.18 contains a dangerous feature vulnerability in modify_user_hw_breakpoint() that can result in crash and possibly memory corruption. This attack appear to be exploitable via local code execution and the ability to use ptrace. This vulnerability appears to have been fixed in git commit f67b15037a7a50c57f72e69a6d59941ad90a0f0f.
References
Vulnerable Configurations
  • Debian Linux 7.0
    cpe:2.3:o:debian:debian_linux:7.0
  • Debian Linux 8.0 (Jessie)
    cpe:2.3:o:debian:debian_linux:8.0
  • Debian Linux 9.0
    cpe:2.3:o:debian:debian_linux:9.0
  • Linux Kernel 3.18
    cpe:2.3:o:linux:linux_kernel:3.18
  • Canonical Ubuntu Linux 12.04 ESM (Extended Security Maintenance)
    cpe:2.3:o:canonical:ubuntu_linux:12.04:-:-:-:esm
  • Canonical Ubuntu Linux 14.04 LTS (Long-Term Support)
    cpe:2.3:o:canonical:ubuntu_linux:14.04:-:-:-:lts
  • Canonical Ubuntu Linux 16.04 LTS (Long-Term Support)
    cpe:2.3:o:canonical:ubuntu_linux:16.04:-:-:-:lts
  • Canonical Ubuntu Linux 17.10
    cpe:2.3:o:canonical:ubuntu_linux:17.10
  • Red Hat Enterprise Linux (RHEL) 7.0 (7)
    cpe:2.3:o:redhat:enterprise_linux:7.0
  • Red Hat Enterprise Linux 7.2
    cpe:2.3:o:redhat:enterprise_linux:7.2
  • Red Hat Enterprise Linux 7.3
    cpe:2.3:o:redhat:enterprise_linux:7.3
  • Red Hat Enterprise Linux 7.4
    cpe:2.3:o:redhat:enterprise_linux:7.4
  • Red Hat Enterprise Linux 7.5
    cpe:2.3:o:redhat:enterprise_linux:7.5
  • RedHat Enterprise Linux Desktop 7.0
    cpe:2.3:o:redhat:enterprise_linux_desktop:7.0
  • RedHat Enterprise Linux Server 7.0
    cpe:2.3:o:redhat:enterprise_linux_server:7.0
  • Red Hat Enterprise Linux Server AUS 7.2
    cpe:2.3:o:redhat:enterprise_linux_server_aus:7.2
  • Red Hat Enterprise Linux Advanced mission critical Update Support (AUS) 7.3
    cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3
  • Red Hat Enterprise Linux Server Advanced mission critical Update Support (AUS) 7.4
    cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4
  • Red Hat Enterprise Linux Server Extended Update Support (EUS) 7.3
    cpe:2.3:o:redhat:enterprise_linux_server_eus:7.3
  • Red Hat Enterprise Linux Server Extended Update Support (EUS) 7.4
    cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4
  • Red Hat Enterprise Linux Server Extended Update Support (EUS) 7.5
    cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5
  • cpe:2.3:o:redhat:enterprise_linux_server_tus:7.2
    cpe:2.3:o:redhat:enterprise_linux_server_tus:7.2
  • RedHat Enterprise Linux Workstation 7.0
    cpe:2.3:o:redhat:enterprise_linux_workstation:7.0
CVSS
Base: 4.9
Impact:
Exploitability:
CWE CWE-388
CAPEC
  • Fuzzing for garnering J2EE/.NET-based stack traces, for application mapping
    An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages. Fuzzing techniques involve sending random or malformed messages to a target and monitoring the target's response. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's desired behavior. In this attack, the purpose of the fuzzing is to cause the targeted application to return an error including a stack trace, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash. The stack trace enumerates the chain of methods that led up to the point where the error was encountered. This can not only reveal the names of the methods (some of which may have known weaknesses) but possibly also the location of class files and libraries as well as parameter values. In some cases, the stack trace might even disclose sensitive configuration or user information.
  • Fuzzing
    Fuzzing is a software testing method that feeds randomly constructed input to the system and looks for an indication that a failure in response to that input has occurred. Fuzzing treats the system as a black box and is totally free from any preconceptions or assumptions about the system. An attacker can leverage fuzzing to try to identify weaknesses in the system. For instance fuzzing can help an attacker discover certain assumptions made in the system about user input. Fuzzing gives an attacker a quick way of potentially uncovering some of these assumptions without really knowing anything about the internals of the system. These assumptions can then be turned against the system by specially crafting user input that may allow an attacker to achieve his goals.
nessus via4
  • NASL family Amazon Linux Local Security Checks
    NASL id AL2_ALAS-2018-1023.NASL
    description A weakness was found in the Linux kernel's implementation of random seed data. Programs, early in the boot sequence, could use the data allocated for the seed before it was sufficiently generated. (CVE-2018-1108) A flaw was found in the way the Linux kernel handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stack switch operation, the processor did not deliver interrupts and exceptions, rather they are delivered once the first instruction after the stack switch is executed. An unprivileged system user could use this flaw to crash the system kernel resulting in the denial of service. (CVE-2018-8897) A flaw was found in the Linux kernel's implementation of 32-bit syscall interface for bridging. This allowed a privileged user to arbitrarily write to a limited range of kernel memory. (CVE-2018-1068) The Linux kernel is vulerable to a use-after-free flaw when Transformation User configuration interface(CONFIG_XFRM_USER) compile-time configuration were enabled. This vulnerability occurs while closing a xfrm netlink socket in xfrm_dump_policy_done. A user/process could abuse this flaw to potentially escalate their privileges on a system. (CVE-2017-16939) A flaw was found in the Linux kernel where a crash can be triggered from unprivileged userspace during core dump on a POWER system with a certain configuration. This is due to a missing processor feature check and an erroneous use of transactional memory (TM) instructions in the core dump path leading to a denial of service.(CVE-2018-1091) An address corruption flaw was discovered in the Linux kernel built with hardware breakpoint (CONFIG_HAVE_HW_BREAKPOINT) support. While modifying a h/w breakpoint via 'modify_user_hw_breakpoint' routine, an unprivileged user/process could use this flaw to crash the system kernel resulting in DoS OR to potentially escalate privileges on a the system.(CVE-2018-1000199) A flaw was found in the way the Linux kernel's KVM hypervisor handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stack switch operation, the processor did not deliver interrupts and exceptions, rather they are delivered once the first instruction after the stack switch is executed. An unprivileged KVM guest user could use this flaw to crash the guest or, potentially, escalate their privileges in the guest.(CVE-2018-1087)
    last seen 2019-02-21
    modified 2018-07-16
    plugin id 110196
    published 2018-05-30
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=110196
    title Amazon Linux 2 : kernel (ALAS-2018-1023)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2018-1355.NASL
    description An update for kernel-rt is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es) : * Kernel: KVM: error in exception handling leads to wrong debug stack value (CVE-2018-1087) * Kernel: error in exception handling leads to DoS (CVE-2018-8897) * Kernel: ipsec: xfrm: use-after-free leading to potential privilege escalation (CVE-2017-16939) * kernel: Out-of-bounds write via userland offsets in ebt_entry struct in netfilter/ebtables.c (CVE-2018-1068) * kernel: ptrace() incorrect error handling leads to corruption and DoS (CVE-2018-1000199) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Red Hat would like to thank Andy Lutomirski for reporting CVE-2018-1087 and CVE-2018-1000199 and Nick Peterson (Everdox Tech LLC) and Andy Lutomirski for reporting CVE-2018-8897. Bug Fix(es) : * The kernel-rt packages have been upgraded to the 3.10.0-862.2.3 source tree, which provides a number of bug fixes over the previous version. (BZ# 1549768)
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 109642
    published 2018-05-09
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109642
    title RHEL 7 : kernel-rt (RHSA-2018:1355)
  • NASL family OracleVM Local Security Checks
    NASL id ORACLEVM_OVMSA-2018-0228.NASL
    description The remote OracleVM system is missing necessary patches to address critical security updates : - netlink: add a start callback for starting a netlink dump (Tom Herbert) [Orabug: 27169581] (CVE-2017-16939) - ipsec: Fix aborted xfrm policy dump crash (Herbert Xu) [Orabug: 27169581] (CVE-2017-16939) - net/rds: prevent RDS connections using stale ARP entries (Wei Lin Guay) [Orabug: 28149101] - net/rds: Avoid stalled connection due to CM REQ retries (Wei Lin Guay) [Orabug: 28068627] - net/rds: use one sided reconnection during a race (Wei Lin Guay) - Revert 'Revert 'net/rds: Revert 'RDS: add reconnect retry scheme for stalled' (Hå kon Bugge) [Orabug: 28068627] - xen-swiotlb: fix the check condition for xen_swiotlb_free_coherent (Joe Jin) [Orabug: 22910685] - net/rds: Assign the correct service level (Wei Lin Guay) [Orabug: 27607213] - target: Re-add missing SCF_ACK_KREF assignment in v4.1.y (Nicholas Bellinger) [Orabug: 27781132] - target: Fix LUN_RESET active I/O handling for ACK_KREF (Nicholas Bellinger) [Orabug: 27781132] - target: Invoke release_cmd callback without holding a spinlock (Bart Van Assche) [Orabug: 27781132] - x86/bugs: Remove the Disabling Spectre v2 mitigation retpoline (Konrad Rzeszutek Wilk) [Orabug: 27897282] - x86/bugs: Report properly retpoline+IBRS (Konrad Rzeszutek Wilk) - x86/bugs: Don't lie when fallback retpoline is engaged (Konrad Rzeszutek Wilk) - fs: aio: fix the increment of aio-nr and counting against aio-max-nr (Mauricio Faria de Oliveira) [Orabug: 28079082] - qla2xxx: Enable buffer boundary check when DIF bundling is on. (Rajan Shanmugavelu) [Orabug: 28130589] - kernel: sys.c: missing break for prctl spec ctrl (Mihai Carabas) - x86/bugs/IBRS: Keep SSBD mitigation in effect if spectre_v2=ibrs is selected (Mihai Carabas) - fs/pstore: update the backend parameter in pstore module (Wang Long) - kvm: vmx: Reinstate support for CPUs without virtual NMI (Paolo Bonzini) [Orabug: 28041210] - dm crypt: add big-endian variant of plain64 IV (Milan Broz) [Orabug: 28043932] - x86/bugs: Rename SSBD_NO to SSB_NO (Konrad Rzeszutek Wilk) [Orabug: 28063992] (CVE-2018-3639) - KVM: SVM: Implement VIRT_SPEC_CTRL support for SSBD (Tom Lendacky) [Orabug: 28063992] [Orabug: 28069548] (CVE-2018-3639) - x86/speculation, KVM: Implement support for VIRT_SPEC_CTRL/LS_CFG (Thomas Gleixner) [Orabug: 28063992] (CVE-2018-3639) - x86/bugs: Rework spec_ctrl base and mask logic (Thomas Gleixner) [Orabug: 28063992] (CVE-2018-3639) - x86/bugs: Expose x86_spec_ctrl_base directly (Thomas Gleixner) [Orabug: 28063992] (CVE-2018-3639) - x86/bugs: Unify x86_spec_ctrl_[set_guest,restore_host] (Borislav Petkov) [Orabug: 28063992] (CVE-2018-3639) - x86/speculation: Rework speculative_store_bypass_update (Thomas Gleixner) [Orabug: 28063992] (CVE-2018-3639) - x86/speculation: Add virtualized speculative store bypass disable support (Tom Lendacky) [Orabug: 28063992] (CVE-2018-3639) - x86/bugs, KVM: Extend speculation control for VIRT_SPEC_CTRL (Thomas Gleixner) [Orabug: 28063992] (CVE-2018-3639) - x86/speculation: Handle HT correctly on AMD (Thomas Gleixner) [Orabug: 28063992] (CVE-2018-3639) - x86/cpufeatures: Add FEATURE_ZEN (Thomas Gleixner) [Orabug: 28063992] (CVE-2018-3639) - x86/cpu/AMD: Fix erratum 1076 (CPB bit) (Borislav Petkov) [Orabug: 28063992] (CVE-2018-3639) - perf/hwbp: Simplify the perf-hwbp code, fix documentation (Linus Torvalds) [Orabug: 27947602] (CVE-2018-1000199) - Revert 'perf/hwbp: Simplify the perf-hwbp code, fix documentation' (Brian Maly) [Orabug: 27947602]
    last seen 2019-02-21
    modified 2018-07-24
    plugin id 110526
    published 2018-06-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=110526
    title OracleVM 3.4 : Unbreakable / etc (OVMSA-2018-0228) (Spectre)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2018-1345.NASL
    description An update for kernel is now available for Red Hat Enterprise Linux 7.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es) : * Kernel: KVM: error in exception handling leads to wrong debug stack value (CVE-2018-1087) * Kernel: error in exception handling leads to DoS (CVE-2018-8897) * kernel: ptrace() incorrect error handling leads to corruption and DoS (CVE-2018-1000199) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Red Hat would like to thank Andy Lutomirski for reporting CVE-2018-1087 and CVE-2018-1000199 and Nick Peterson (Everdox Tech LLC) and Andy Lutomirski for reporting CVE-2018-8897.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 109635
    published 2018-05-09
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109635
    title RHEL 7 : kernel (RHSA-2018:1345)
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2018-4134.NASL
    description Description of changes: kernel-uek [3.8.13-118.21.4.el7uek] - x86/fpu: Make eager FPU default (Mihai Carabas) [Orabug: 28156176] {CVE-2018-3665} [3.8.13-118.21.3.el7uek] - KVM: Fix stack-out-of-bounds read in write_mmio (Wanpeng Li) [Orabug: 27951287] {CVE-2017-17741} {CVE-2017-17741} - xfs: set format back to extents if xfs_bmap_extents_to_btree (Eric Sandeen) [Orabug: 27989498] {CVE-2018-10323} - Bluetooth: Prevent stack info leak from the EFS element. (Ben Seri) [Orabug: 28030520] {CVE-2017-1000410} {CVE-2017-1000410} - ALSA: hrtimer: Fix stall by hrtimer_cancel() (Takashi Iwai) [Orabug: 28058229] {CVE-2016-2549} - ALSA: timer: Harden slave timer list handling (Takashi Iwai) [Orabug: 28058229] {CVE-2016-2547} {CVE-2016-2548} - ALSA: timer: Fix double unlink of active_list (Takashi Iwai) [Orabug: 28058229] {CVE-2016-2545} - ALSA: seq: Fix missing NULL check at remove_events ioctl (Takashi Iwai) [Orabug: 28058229] {CVE-2016-2543} - ALSA: seq: Fix race at timer setup and close (Takashi Iwai) [Orabug: 28058229] {CVE-2016-2544} - ALSA: usb-audio: avoid freeing umidi object twice (Andrey Konovalov) [Orabug: 28058229] {CVE-2016-2384} [3.8.13-118.21.2.el7uek] - perf/hwbp: Simplify the perf-hwbp code, fix documentation (Linus Torvalds) [Orabug: 27947608] {CVE-2018-1000199} - Revert 'perf/hwbp: Simplify the perf-hwbp code, fix documentation' (Brian Maly) [Orabug: 27947608]
    last seen 2019-02-21
    modified 2018-06-18
    plugin id 110583
    published 2018-06-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=110583
    title Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2018-4134)
  • NASL family Huawei Local Security Checks
    NASL id EULEROS_SA-2018-1196.NASL
    description According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A vulnerability was found in the Linux kernel's kernel/events/core.c:perf_cpu_time_max_percent_handler( ) function. Local privileged users could exploit this flaw to cause a denial of service due to integer overflow or possibly have unspecified other impact.(CVE-2017-18255) - The code in the drivers/scsi/libsas/sas_scsi_host.c file in the Linux kernel allow a physically proximate attacker to cause a memory leak in the ATA command queue and, thus, denial of service by triggering certain failure conditions.(CVE-2018-10021) - The kernel_wait4 function in kernel/exit.c in the Linux kernel, when an unspecified architecture and compiler is used, might allow local users to cause a denial of service by triggering an attempted use of the -INT_MIN value.(CVE-2018-10087) - A an integer overflow vulnerability was discovered in the Linux kernel, from version 3.4 through 4.15, in the drivers/gpu/drm/udl/udl_fb.c:udl_fb_mmap() function. An attacker with access to the udldrmfb driver could exploit this to obtain full read and write permissions on kernel physical pages, resulting in a code execution in kernel space.(CVE-2018-8781) - An address corruption flaw was discovered in the Linux kernel built with hardware breakpoint (CONFIG_HAVE_HW_BREAKPOINT) support. While modifying a h/w breakpoint via 'modify_user_hw_breakpoint' routine, an unprivileged user/process could use this flaw to crash the system kernel resulting in DoS OR to potentially escalate privileges on a the system.(CVE-2018-1000199) - An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of Load & Store instructions (a commonly used performance optimization). It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact that memory read from address to which a recent memory write has occurred may see an older value and subsequently cause an update into the microprocessor's data cache even for speculatively executed instructions that never actually commit (retire). As a result, an unprivileged attacker could use this flaw to read privileged memory by conducting targeted cache side-channel attacks.(CVE-2018-3639) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-11-13
    plugin id 110860
    published 2018-07-03
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=110860
    title EulerOS 2.0 SP3 : kernel (EulerOS-SA-2018-1196)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2018-1239-1.NASL
    description This update for the Linux Kernel 4.4.120-92_70 fixes one issue. The following security issue was fixed : - CVE-2018-1000199: A bug in x86 debug register handling of ptrace() could lead to memory corruption, possibly a denial of service or privilege escalation (bsc#1090036). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 109773
    published 2018-05-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109773
    title SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1239-1)
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2018-1318.NASL
    description An update for kernel is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es) : * Kernel: KVM: error in exception handling leads to wrong debug stack value (CVE-2018-1087) * Kernel: error in exception handling leads to DoS (CVE-2018-8897) * Kernel: ipsec: xfrm: use-after-free leading to potential privilege escalation (CVE-2017-16939) * kernel: Out-of-bounds write via userland offsets in ebt_entry struct in netfilter/ebtables.c (CVE-2018-1068) * kernel: ptrace() incorrect error handling leads to corruption and DoS (CVE-2018-1000199) * kernel: guest kernel crash during core dump on POWER9 host (CVE-2018-1091) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Red Hat would like to thank Andy Lutomirski for reporting CVE-2018-1087 and CVE-2018-1000199 and Nick Peterson (Everdox Tech LLC) and Andy Lutomirski for reporting CVE-2018-8897. Bug Fix(es) : These updated kernel packages include also numerous bug fixes. Space precludes documenting all of these bug fixes in this advisory. See the bug fix descriptions in the related Knowledge Article: https://access.redhat.com/ articles/3431641
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 110245
    published 2018-05-31
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=110245
    title CentOS 7 : kernel (CESA-2018:1318)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2018-1855-2.NASL
    description The SUSE Linux Enterprise 12 SP2 LTSS kernel was updated receive various security and bugfixes. The following security bugs were fixed : CVE-2018-5848: In the function wmi_set_ie(), the length validation code did not handle unsigned integer overflow properly. As a result, a large value of the 'ie_len' argument could have caused a buffer overflow (bnc#1097356) CVE-2018-1000204: Prevent infoleak caused by incorrect handling of the SG_IO ioctl (bsc#1096728). CVE-2017-18249: The add_free_nid function did not properly track an allocated nid, which allowed local users to cause a denial of service (race condition) or possibly have unspecified other impact via concurrent threads (bnc#1087036) CVE-2018-3665: Prevent disclosure of FPU registers (including XMM and AVX registers) between processes. These registers might contain encryption keys when doing SSE accelerated AES enc/decryption (bsc#1087086) CVE-2017-18241: Prevent a NULL pointer dereference by using a noflush_merge option that triggers a NULL value for a flush_cmd_control data structure (bnc#1086400) CVE-2017-13305: Prevent information disclosure vulnerability in encrypted-keys (bsc#1094353). CVE-2018-1093: The ext4_valid_block_bitmap function allowed attackers to cause a denial of service (out-of-bounds read and system crash) via a crafted ext4 image because balloc.c and ialloc.c did not validate bitmap block numbers (bsc#1087095). CVE-2018-1094: The ext4_fill_super function did not always initialize the crc32c checksum driver, which allowed attackers to cause a denial of service (ext4_xattr_inode_hash NULL pointer dereference and system crash) via a crafted ext4 image (bsc#1087007). CVE-2018-1092: The ext4_iget function mishandled the case of a root directory with a zero i_links_count, which allowed attackers to cause a denial of service (ext4_process_freed_data NULL pointer dereference and OOPS) via a crafted ext4 image (bsc#1087012). CVE-2018-1130: NULL pointer dereference in dccp_write_xmit() function that allowed a local user to cause a denial of service by a number of certain crafted system calls (bsc#1092904). CVE-2018-1065: The netfilter subsystem mishandled the case of a rule blob that contains a jump but lacks a user-defined chain, which allowed local users to cause a denial of service (NULL pointer dereference) by leveraging the CAP_NET_RAW or CAP_NET_ADMIN capability (bsc#1083650). CVE-2018-5803: Prevent error in the '_sctp_make_chunk()' function when handling SCTP packets length that could have been exploited to cause a kernel crash (bnc#1083900). CVE-2018-7492: Prevent NULL pointer dereference in the net/rds/rdma.c __rds_rdma_map() function that allowed local attackers to cause a system panic and a denial-of-service, related to RDS_GET_MR and RDS_GET_MR_FOR_DEST (bsc#1082962). CVE-2018-1000199: Prevent vulnerability in modify_user_hw_breakpoint() that could have caused a crash and possibly memory corruption (bsc#1089895). The update package also includes non-security fixes. See advisory for details. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 118272
    published 2018-10-22
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=118272
    title SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1855-2)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2018-1855-1.NASL
    description The SUSE Linux Enterprise 12 SP2 LTSS kernel was updated receive various security and bugfixes. The following security bugs were fixed : - CVE-2018-5848: In the function wmi_set_ie(), the length validation code did not handle unsigned integer overflow properly. As a result, a large value of the 'ie_len' argument could have caused a buffer overflow (bnc#1097356) - CVE-2018-1000204: Prevent infoleak caused by incorrect handling of the SG_IO ioctl (bsc#1096728). - CVE-2017-18249: The add_free_nid function did not properly track an allocated nid, which allowed local users to cause a denial of service (race condition) or possibly have unspecified other impact via concurrent threads (bnc#1087036) - CVE-2018-3665: Prevent disclosure of FPU registers (including XMM and AVX registers) between processes. These registers might contain encryption keys when doing SSE accelerated AES enc/decryption (bsc#1087086) - CVE-2017-18241: Prevent a NULL pointer dereference by using a noflush_merge option that triggers a NULL value for a flush_cmd_control data structure (bnc#1086400) - CVE-2017-13305: Prevent information disclosure vulnerability in encrypted-keys (bsc#1094353). - CVE-2018-1093: The ext4_valid_block_bitmap function allowed attackers to cause a denial of service (out-of-bounds read and system crash) via a crafted ext4 image because balloc.c and ialloc.c did not validate bitmap block numbers (bsc#1087095). - CVE-2018-1094: The ext4_fill_super function did not always initialize the crc32c checksum driver, which allowed attackers to cause a denial of service (ext4_xattr_inode_hash NULL pointer dereference and system crash) via a crafted ext4 image (bsc#1087007). - CVE-2018-1092: The ext4_iget function mishandled the case of a root directory with a zero i_links_count, which allowed attackers to cause a denial of service (ext4_process_freed_data NULL pointer dereference and OOPS) via a crafted ext4 image (bsc#1087012). - CVE-2018-1130: NULL pointer dereference in dccp_write_xmit() function that allowed a local user to cause a denial of service by a number of certain crafted system calls (bsc#1092904). - CVE-2018-1065: The netfilter subsystem mishandled the case of a rule blob that contains a jump but lacks a user-defined chain, which allowed local users to cause a denial of service (NULL pointer dereference) by leveraging the CAP_NET_RAW or CAP_NET_ADMIN capability (bsc#1083650). - CVE-2018-5803: Prevent error in the '_sctp_make_chunk()' function when handling SCTP packets length that could have been exploited to cause a kernel crash (bnc#1083900). - CVE-2018-7492: Prevent NULL pointer dereference in the net/rds/rdma.c __rds_rdma_map() function that allowed local attackers to cause a system panic and a denial-of-service, related to RDS_GET_MR and RDS_GET_MR_FOR_DEST (bsc#1082962). - CVE-2018-1000199: Prevent vulnerability in modify_user_hw_breakpoint() that could have caused a crash and possibly memory corruption (bsc#1089895). The update package also includes non-security fixes. See advisory for details. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 110838
    published 2018-07-02
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=110838
    title SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1855-1)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2018-1318.NASL
    description An update for kernel is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es) : * Kernel: KVM: error in exception handling leads to wrong debug stack value (CVE-2018-1087) * Kernel: error in exception handling leads to DoS (CVE-2018-8897) * Kernel: ipsec: xfrm: use-after-free leading to potential privilege escalation (CVE-2017-16939) * kernel: Out-of-bounds write via userland offsets in ebt_entry struct in netfilter/ebtables.c (CVE-2018-1068) * kernel: ptrace() incorrect error handling leads to corruption and DoS (CVE-2018-1000199) * kernel: guest kernel crash during core dump on POWER9 host (CVE-2018-1091) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Red Hat would like to thank Andy Lutomirski for reporting CVE-2018-1087 and CVE-2018-1000199 and Nick Peterson (Everdox Tech LLC) and Andy Lutomirski for reporting CVE-2018-8897. Bug Fix(es) : These updated kernel packages include also numerous bug fixes. Space precludes documenting all of these bug fixes in this advisory. See the bug fix descriptions in the related Knowledge Article: https://access.redhat.com/ articles/3431641
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 109633
    published 2018-05-09
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109633
    title RHEL 7 : kernel (RHSA-2018:1318)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2018-1374-1.NASL
    description The SUSE Linux Enterprise 12 GA LTSS kernel was updated to receive several security fixes. The following security bugs were fixed : - CVE-2018-3639: Information leaks using 'Memory Disambiguation' feature in modern CPUs were mitigated, aka 'Spectre Variant 4' (bnc#1087082). A new boot commandline option was introduced, 'spec_store_bypass_disable', which can have following values : - auto: Kernel detects whether your CPU model contains an implementation of Speculative Store Bypass and picks the most appropriate mitigation. - on: disable Speculative Store Bypass - off: enable Speculative Store Bypass - prctl: Control Speculative Store Bypass per thread via prctl. Speculative Store Bypass is enabled for a process by default. The state of the control is inherited on fork. - seccomp: Same as 'prctl' above, but all seccomp threads will disable SSB unless they explicitly opt out. The default is 'seccomp', meaning programs need explicit opt-in into the mitigation. Status can be queried via the /sys/devices/system/cpu/vulnerabilities/spec_store_bypas s file, containing : - 'Vulnerable' - 'Mitigation: Speculative Store Bypass disabled' - 'Mitigation: Speculative Store Bypass disabled via prctl' - 'Mitigation: Speculative Store Bypass disabled via prctl and seccomp' - CVE-2018-1000199: An address corruption flaw was discovered while modifying a h/w breakpoint via 'modify_user_hw_breakpoint' routine, an unprivileged user/process could use this flaw to crash the system kernel resulting in DoS OR to potentially escalate privileges on a the system. (bsc#1089895) - CVE-2018-10675: The do_get_mempolicy function in mm/mempolicy.c allowed local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted system calls (bnc#1091755). The update package also includes non-security fixes. See advisory for details. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 110039
    published 2018-05-23
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=110039
    title SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1374-1) (Spectre)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2018-1230-1.NASL
    description This update for the Linux Kernel 4.4.74-92_35 fixes several issues. The following security issues were fixed : - CVE-2018-1000199: A bug in x86 debug register handling of ptrace() could lead to memory corruption, possibly a denial of service or privilege escalation (bsc#1090036). - CVE-2017-0861: Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem in the Linux kernel allowed attackers to gain privileges via unspecified vectors (bsc#1088268). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 109765
    published 2018-05-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109765
    title SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1230-1)
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2018-4145.NASL
    description Description of changes: [2.6.39-400.299.3.el6uek] - x86/fpu: Make eager FPU default (Mihai Carabas) [Orabug: 28156175] {CVE-2018-3665} - ALSA: hrtimer: Fix stall by hrtimer_cancel() (Takashi Iwai) [Orabug: 22876528] {CVE-2016-2549} - ALSA: timer: Harden slave timer list handling (Takashi Iwai) [Orabug: 22876528] {CVE-2016-2547} {CVE-2016-2548} - ALSA: timer: Fix double unlink of active_list (Takashi Iwai) [Orabug: 22876528] {CVE-2016-2545} - ALSA: seq: Fix missing NULL check at remove_events ioctl (Takashi Iwai) [Orabug: 22876528] {CVE-2016-2543} - ALSA: seq: Fix race at timer setup and close (Takashi Iwai) [Orabug: 22876528] {CVE-2016-2544} - ALSA: usb-audio: avoid freeing umidi object twice (Andrey Konovalov) [Orabug: 22876528] {CVE-2016-2384} - mlx4_ib: DREQ silently dropped by PF passive side (Venkat Venkatsubra) [Orabug: 25090540] - net: tcpdump fails with EFAULT (Venkat Venkatsubra) [Orabug: 25209691] - x86/spec: Remove rescan_spec_ctrl_feature as it's not needed anymore (Krish Sadhukhan) [Orabug: 27934121] [2.6.39-400.299.2.el6uek] - perf/hwbp: Simplify the perf-hwbp code, fix documentation (Linus Torvalds) [Orabug: 27947612] {CVE-2018-1000199} - Revert 'perf/hwbp: Simplify the perf-hwbp code, fix documentation' (Brian Maly) [Orabug: 27947612]
    last seen 2019-02-21
    modified 2018-06-18
    plugin id 110585
    published 2018-06-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=110585
    title Oracle Linux 6 : Unbreakable Enterprise kernel (ELSA-2018-4145)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-4187.NASL
    description Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. - CVE-2015-9016 Ming Lei reported a race condition in the multiqueue block layer (blk-mq). On a system with a driver using blk-mq (mtip32xx, null_blk, or virtio_blk), a local user might be able to use this for denial of service or possibly for privilege escalation. - CVE-2017-0861 Robb Glasser reported a potential use-after-free in the ALSA (sound) PCM core. We believe this was not possible in practice. - CVE-2017-5715 Multiple researchers have discovered a vulnerability in various processors supporting speculative execution, enabling an attacker controlling an unprivileged process to read memory from arbitrary addresses, including from the kernel and all other processes running on the system. This specific attack has been named Spectre variant 2 (branch target injection) and is mitigated for the x86 architecture (amd64 and i386) by using the 'retpoline' compiler feature which allows indirect branches to be isolated from speculative execution. - CVE-2017-5753 Multiple researchers have discovered a vulnerability in various processors supporting speculative execution, enabling an attacker controlling an unprivileged process to read memory from arbitrary addresses, including from the kernel and all other processes running on the system. This specific attack has been named Spectre variant 1 (bounds-check bypass) and is mitigated by identifying vulnerable code sections (array bounds checking followed by array access) and replacing the array access with the speculation-safe array_index_nospec() function. More use sites will be added over time. - CVE-2017-13166 A bug in the 32-bit compatibility layer of the v4l2 ioctl handling code has been found. Memory protections ensuring user-provided buffers always point to userland memory were disabled, allowing destination addresses to be in kernel space. On a 64-bit kernel a local user with access to a suitable video device can exploit this to overwrite kernel memory, leading to privilege escalation. - CVE-2017-13220 Al Viro reported that the Bluetooth HIDP implementation could dereference a pointer before performing the necessary type check. A local user could use this to cause a denial of service. - CVE-2017-16526 Andrey Konovalov reported that the UWB subsystem may dereference an invalid pointer in an error case. A local user might be able to use this for denial of service. - CVE-2017-16911 Secunia Research reported that the USB/IP vhci_hcd driver exposed kernel heap addresses to local users. This information could aid the exploitation of other vulnerabilities. - CVE-2017-16912 Secunia Research reported that the USB/IP stub driver failed to perform a range check on a received packet header field, leading to an out-of-bounds read. A remote user able to connect to the USB/IP server could use this for denial of service. - CVE-2017-16913 Secunia Research reported that the USB/IP stub driver failed to perform a range check on a received packet header field, leading to excessive memory allocation. A remote user able to connect to the USB/IP server could use this for denial of service. - CVE-2017-16914 Secunia Research reported that the USB/IP stub driver failed to check for an invalid combination of fields in a received packet, leading to a NULL pointer dereference. A remote user able to connect to the USB/IP server could use this for denial of service. - CVE-2017-18017 Denys Fedoryshchenko reported that the netfilter xt_TCPMSS module failed to validate TCP header lengths, potentially leading to a use-after-free. If this module is loaded, it could be used by a remote attacker for denial of service or possibly for code execution. - CVE-2017-18203 Hou Tao reported that there was a race condition in creation and deletion of device-mapper (DM) devices. A local user could potentially use this for denial of service. - CVE-2017-18216 Alex Chen reported that the OCFS2 filesystem failed to hold a necessary lock during nodemanager sysfs file operations, potentially leading to a NULL pointer dereference. A local user could use this for denial of service. - CVE-2017-18232 Jason Yan reported a race condition in the SAS (Serial-Attached SCSI) subsystem, between probing and destroying a port. This could lead to a deadlock. A physically present attacker could use this to cause a denial of service. - CVE-2017-18241 Yunlei He reported that the f2fs implementation does not properly initialise its state if the 'noflush_merge' mount option is used. A local user with access to a filesystem mounted with this option could use this to cause a denial of service. - CVE-2018-1066 Dan Aloni reported to Red Hat that the CIFS client implementation would dereference a NULL pointer if the server sent an invalid response during NTLMSSP setup negotiation. This could be used by a malicious server for denial of service. - CVE-2018-1068 The syzkaller tool found that the 32-bit compatibility layer of ebtables did not sufficiently validate offset values. On a 64-bit kernel, a local user with the CAP_NET_ADMIN capability (in any user namespace) could use this to overwrite kernel memory, possibly leading to privilege escalation. Debian disables unprivileged user namespaces by default. - CVE-2018-1092 Wen Xu reported that a crafted ext4 filesystem image would trigger a null dereference when mounted. A local user able to mount arbitrary filesystems could use this for denial of service. - CVE-2018-5332 Mohamed Ghannam reported that the RDS protocol did not sufficiently validate RDMA requests, leading to an out-of-bounds write. A local attacker on a system with the rds module loaded could use this for denial of service or possibly for privilege escalation. - CVE-2018-5333 Mohamed Ghannam reported that the RDS protocol did not properly handle an error case, leading to a NULL pointer dereference. A local attacker on a system with the rds module loaded could possibly use this for denial of service. - CVE-2018-5750 Wang Qize reported that the ACPI sbshc driver logged a kernel heap address. This information could aid the exploitation of other vulnerabilities. - CVE-2018-5803 Alexey Kodanev reported that the SCTP protocol did not range-check the length of chunks to be created. A local or remote user could use this to cause a denial of service. - CVE-2018-6927 Li Jinyue reported that the FUTEX_REQUEUE operation on futexes did not check for negative parameter values, which might lead to a denial of service or other security impact. - CVE-2018-7492 The syzkaller tool found that the RDS protocol was lacking a null pointer check. A local attacker on a system with the rds module loaded could use this for denial of service. - CVE-2018-7566 Fan LongFei reported a race condition in the ALSA (sound) sequencer core, between write and ioctl operations. This could lead to an out-of-bounds access or use-after-free. A local user with access to a sequencer device could use this for denial of service or possibly for privilege escalation. - CVE-2018-7740 Nic Losby reported that the hugetlbfs filesystem's mmap operation did not properly range-check the file offset. A local user with access to files on a hugetlbfs filesystem could use this to cause a denial of service. - CVE-2018-7757 Jason Yan reported a memory leak in the SAS (Serial-Attached SCSI) subsystem. A local user on a system with SAS devices could use this to cause a denial of service. - CVE-2018-7995 Seunghun Han reported a race condition in the x86 MCE (Machine Check Exception) driver. This is unlikely to have any security impact. - CVE-2018-8781 Eyal Itkin reported that the udl (DisplayLink) driver's mmap operation did not properly range-check the file offset. A local user with access to a udl framebuffer device could exploit this to overwrite kernel memory, leading to privilege escalation. - CVE-2018-8822 Dr Silvio Cesare of InfoSect reported that the ncpfs client implementation did not validate reply lengths from the server. An ncpfs server could use this to cause a denial of service or remote code execution in the client. - CVE-2018-1000004 Luo Quan reported a race condition in the ALSA (sound) sequencer core, between multiple ioctl operations. This could lead to a deadlock or use-after-free. A local user with access to a sequencer device could use this for denial of service or possibly for privilege escalation. - CVE-2018-1000199 Andy Lutomirski discovered that the ptrace subsystem did not sufficiently validate hardware breakpoint settings. Local users can use this to cause a denial of service, or possibly for privilege escalation, on x86 (amd64 and i386) and possibly other architectures.
    last seen 2019-02-21
    modified 2018-11-13
    plugin id 109517
    published 2018-05-02
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109517
    title Debian DSA-4187-1 : linux - security update (Spectre)
  • NASL family OracleVM Local Security Checks
    NASL id ORACLEVM_OVMSA-2018-0237.NASL
    description The remote OracleVM system is missing necessary patches to address critical security updates : - dm: fix race between dm_get_from_kobject and __dm_destroy (Hou Tao) (CVE-2017-18203) - drm: udl: Properly check framebuffer mmap offsets (Greg Kroah-Hartman) [Orabug: 27986407] (CVE-2018-8781) - kernel/exit.c: avoid undefined behaviour when calling wait4 wait4(-2147483648, 0x20, 0, 0xdd0000) triggers: UBSAN: Undefined behaviour in kernel/exit.c:1651:9 (mridula shastry) [Orabug: 27875488] (CVE-2018-10087) - kernel/signal.c: avoid undefined behaviour in kill_something_info When running kill(72057458746458112, 0) in userspace I hit the following issue. (mridula shastry) (CVE-2018-10124) - bluetooth: Validate socket address length in sco_sock_bind. (mlevatic) [Orabug: 28130293] (CVE-2015-8575) - dccp: check sk for closed state in dccp_sendmsg (Alexey Kodanev) [Orabug: 28220402] (CVE-2017-8824) (CVE-2018-1130) - sctp: verify size of a new chunk in _sctp_make_chunk (Alexey Kodanev) [Orabug: 28240075] (CVE-2018-5803) - mm/mempolicy.c: fix error handling in set_mempolicy and mbind. (Chris Salls) [Orabug: 28242478] (CVE-2017-7616) - xfrm: policy: check policy direction value (Vladis Dronov) [Orabug: 28264121] (CVE-2017-11600) (CVE-2017-11600) - x86/fpu: Make eager FPU default (Mihai Carabas) [Orabug: 28156176] (CVE-2018-3665) - KVM: Fix stack-out-of-bounds read in write_mmio (Wanpeng Li) [Orabug: 27951287] (CVE-2017-17741) (CVE-2017-17741) - xfs: set format back to extents if xfs_bmap_extents_to_btree (Eric Sandeen) [Orabug: 27989498] (CVE-2018-10323) - Bluetooth: Prevent stack info leak from the EFS element. (Ben Seri) [Orabug: 28030520] (CVE-2017-1000410) (CVE-2017-1000410) - ALSA: hrtimer: Fix stall by hrtimer_cancel (Takashi Iwai) [Orabug: 28058229] (CVE-2016-2549) - ALSA: timer: Harden slave timer list handling (Takashi Iwai) [Orabug: 28058229] (CVE-2016-2547) (CVE-2016-2548) - ALSA: timer: Fix double unlink of active_list (Takashi Iwai) [Orabug: 28058229] (CVE-2016-2545) - ALSA: seq: Fix missing NULL check at remove_events ioctl (Takashi Iwai) [Orabug: 28058229] (CVE-2016-2543) - ALSA: seq: Fix race at timer setup and close (Takashi Iwai) [Orabug: 28058229] (CVE-2016-2544) - ALSA: usb-audio: avoid freeing umidi object twice (Andrey Konovalov) [Orabug: 28058229] (CVE-2016-2384) - perf/hwbp: Simplify the perf-hwbp code, fix documentation (Linus Torvalds) [Orabug: 27947608] (CVE-2018-1000199) - Revert 'perf/hwbp: Simplify the perf-hwbp code, fix documentation' (Brian Maly) [Orabug: 27947608]
    last seen 2019-02-21
    modified 2018-08-07
    plugin id 111022
    published 2018-07-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=111022
    title OracleVM 3.3 : Unbreakable / etc (OVMSA-2018-0237)
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2018-514.NASL
    description The openSUSE Leap 42.3 kernel was updated to 4.4.132 to receive various security and bugfixes. The following security bugs were fixed : - CVE-2018-3639: Information leaks using 'Memory Disambiguation' feature in modern CPUs were mitigated, aka 'Spectre Variant 4' (bnc#1087082). A new boot commandline option was introduced, 'spec_store_bypass_disable', which can have following values : - auto: Kernel detects whether your CPU model contains an implementation of Speculative Store Bypass and picks the most appropriate mitigation. - on: disable Speculative Store Bypass - off: enable Speculative Store Bypass - prctl: Control Speculative Store Bypass per thread via prctl. Speculative Store Bypass is enabled for a process by default. The state of the control is inherited on fork. - seccomp: Same as 'prctl' above, but all seccomp threads will disable SSB unless they explicitly opt out. The default is 'seccomp', meaning programs need explicit opt-in into the mitigation. Status can be queried via the /sys/devices/system/cpu/vulnerabilities/spec_store_bypas s file, containing : - 'Vulnerable' - 'Mitigation: Speculative Store Bypass disabled' - 'Mitigation: Speculative Store Bypass disabled via prctl' - 'Mitigation: Speculative Store Bypass disabled via prctl and seccomp' - CVE-2017-18257: The __get_data_block function in fs/f2fs/data.c allowed local users to cause a denial of service (integer overflow and loop) via crafted use of the open and fallocate system calls with an FS_IOC_FIEMAP ioctl. (bnc#1088241) - CVE-2018-1130: Linux kernel was vulnerable to a NULL pointer dereference in dccp_write_xmit() function in net/dccp/output.c in that allowed a local user to cause a denial of service by a number of certain crafted system calls (bnc#1092904). - CVE-2018-5803: An error in the _sctp_make_chunk() function when handling SCTP, packet length could have been exploited by a malicious local user to cause a kernel crash and a DoS. (bnc#1083900). - CVE-2018-1065: The netfilter subsystem mishandled the case of a rule blob that contains a jump but lacks a user-defined chain, which allowed local users to cause a denial of service (NULL pointer dereference) by leveraging the CAP_NET_RAW or CAP_NET_ADMIN capability, related to arpt_do_table in net/ipv4/netfilter/arp_tables.c, ipt_do_table in net/ipv4/netfilter/ip_tables.c, and ip6t_do_table in net/ipv6/netfilter/ip6_tables.c (bnc#1083650). - CVE-2018-7492: A NULL pointer dereference was found in the net/rds/rdma.c __rds_rdma_map() function that allowed local attackers to cause a system panic and a denial-of-service, related to RDS_GET_MR and RDS_GET_MR_FOR_DEST (bnc#1082962). - CVE-2018-8781: The udl_fb_mmap function in drivers/gpu/drm/udl/udl_fb.c had an integer-overflow vulnerability allowing local users with access to the udldrmfb driver to obtain full read and write permissions on kernel physical pages, resulting in a code execution in kernel space (bnc#1090643). - CVE-2018-10124: The kill_something_info function in kernel/signal.c might have allowed local users to cause a denial of service via an INT_MIN argument (bnc#1089752). - CVE-2018-10087: The kernel_wait4 function in kernel/exit.c might have allowed local users to cause a denial of service by triggering an attempted use of the -INT_MIN value (bnc#1089608). - CVE-2018-8822: Incorrect buffer length handling in the ncp_read_kernel function in fs/ncpfs/ncplib_kernel.c could be exploited by malicious NCPFS servers to crash the kernel or execute code (bnc#1086162). - CVE-2018-1000199: A bug in x86 debug register handling of ptrace() could lead to memory corruption, possibly a denial of service or privilege escalation (bsc#1089895). The following non-security bugs were fixed : - acpica: Disassembler: Abort on an invalid/unknown AML opcode (bnc#1012382). - acpica: Events: Add runtime stub support for event APIs (bnc#1012382). - acpi / hotplug / PCI: Check presence of slot itself in get_slot_status() (bnc#1012382). - acpi, PCI, irq: remove redundant check for null string pointer (bnc#1012382). - acpi / scan: Send change uevent with offine environmental data (bsc#1082485). - acpi / video: Add quirk to force acpi-video backlight on Samsung 670Z5E (bnc#1012382). - alsa: aloop: Add missing cable lock to ctl API callbacks (bnc#1012382). - alsa: aloop: Mark paused device as inactive (bnc#1012382). - alsa: asihpi: Hardening for potential Spectre v1 (bnc#1012382). - alsa: control: Hardening for potential Spectre v1 (bnc#1012382). - alsa: core: Report audio_tstamp in snd_pcm_sync_ptr (bnc#1012382). - alsa: hda/conexant - Add fixup for HP Z2 G4 workstation (bsc#1092975). - alsa: hda: Hardening for potential Spectre v1 (bnc#1012382). - alsa: hda - New VIA controller suppor no-snoop path (bnc#1012382). - alsa: hda/realtek - Add some fixes for ALC233 (bnc#1012382). - alsa: hdspm: Hardening for potential Spectre v1 (bnc#1012382). - alsa: line6: Use correct endpoint type for midi output (bnc#1012382). - alsa: opl3: Hardening for potential Spectre v1 (bnc#1012382). - alsa: oss: consolidate kmalloc/memset 0 call to kzalloc (bnc#1012382). - alsa: pcm: Avoid potential races between OSS ioctls and read/write (bnc#1012382). - alsa: pcm: Check PCM state at xfern compat ioctl (bnc#1012382). - alsa: pcm: Fix endless loop for XRUN recovery in OSS emulation (bnc#1012382). - alsa: pcm: Fix mutex unbalance in OSS emulation ioctls (bnc#1012382). - alsa: pcm: Fix UAF at PCM release via PCM timer access (bnc#1012382). - alsa: pcm: potential uninitialized return values (bnc#1012382). - alsa: pcm: Return -EBUSY for OSS ioctls changing busy streams (bnc#1012382). - alsa: pcm: Use dma_bytes as size parameter in dma_mmap_coherent() (bnc#1012382). - alsa: pcm: Use ERESTARTSYS instead of EINTR in OSS emulation (bnc#1012382). - alsa: rawmidi: Fix missing input substream checks in compat ioctls (bnc#1012382). - alsa: rme9652: Hardening for potential Spectre v1 (bnc#1012382). - alsa: seq: Fix races at MIDI encoding in snd_virmidi_output_trigger() (bnc#1012382). - alsa: seq: oss: Fix unbalanced use lock for synth MIDI device (bnc#1012382). - alsa: seq: oss: Hardening for potential Spectre v1 (bnc#1012382). - alsa: usb-audio: Skip broken EU on Dell dock USB-audio (bsc#1090658). - arm64: Add ARM_SMCCC_ARCH_WORKAROUND_1 BP hardening support (bsc#1068032). - arm64: avoid overflow in VA_START and PAGE_OFFSET (bnc#1012382). - arm64: capabilities: Handle duplicate entries for a capability (bsc#1068032). - arm64: cpufeature: __this_cpu_has_cap() shouldn't stop early (bsc#1068032). - arm64: Enforce BBM for huge IO/VMAP mappings (bsc#1088313). - arm64: fix smccc compilation (bsc#1068032). - arm64: futex: Fix undefined behaviour with FUTEX_OP_OPARG_SHIFT usage (bnc#1012382). - arm64: Kill PSCI_GET_VERSION as a variant-2 workaround (bsc#1068032). - arm64: kvm: Add SMCCC_ARCH_WORKAROUND_1 fast handling (bsc#1068032). - arm64: kvm: Increment PC after handling an SMC trap (bsc#1068032). - arm64: kvm: Report SMCCC_ARCH_WORKAROUND_1 BP hardening support (bsc#1068032). - arm64: mm: fix thinko in non-global page table attribute check (bsc#1088050). - arm64: Relax ARM_SMCCC_ARCH_WORKAROUND_1 discovery (bsc#1068032). - arm: amba: Do not read past the end of sysfs 'driver_override' buffer (bnc#1012382). - arm: amba: Fix race condition with driver_override (bnc#1012382). - arm: amba: Make driver_override output consistent with other buses (bnc#1012382). - arm/arm64: kvm: Add PSCI_VERSION helper (bsc#1068032). - arm/arm64: kvm: Add smccc accessors to PSCI code (bsc#1068032). - arm/arm64: kvm: Advertise SMCCC v1.1 (bsc#1068032). - arm/arm64: kvm: Consolidate the PSCI include files (bsc#1068032). - arm/arm64: kvm: Implement PSCI 1.0 support (bsc#1068032). - arm/arm64: kvm: Turn kvm_psci_version into a static inline (bsc#1068032). - arm/arm64: smccc: Implement SMCCC v1.1 inline primitive (bsc#1068032). - arm/arm64: smccc: Make function identifiers an unsigned quantity (bsc#1068032). - arm: davinci: da8xx: Create DSP device only when assigned memory (bnc#1012382). - arm: dts: am57xx-beagle-x15-common: Add overide powerhold property (bnc#1012382). - arm: dts: at91: at91sam9g25: fix mux-mask pinctrl property (bnc#1012382). - arm: dts: at91: sama5d4: fix pinctrl compatible string (bnc#1012382). - arm: dts: dra7: Add power hold and power controller properties to palmas (bnc#1012382). - arm: dts: imx53-qsrb: Pulldown PMIC IRQ pin (bnc#1012382). - arm: dts: imx6qdl-wandboard: Fix audio channel swap (bnc#1012382). - arm: dts: ls1021a: add 'fsl,ls1021a-esdhc' compatible string to esdhc node (bnc#1012382). - arm: imx: Add MXC_CPU_IMX6ULL and cpu_is_imx6ull (bnc#1012382). - arp: fix arp_filter on l3slave devices (bnc#1012382). - arp: honour gratuitous ARP _replies_ (bnc#1012382). - ASoC: fsl_esai: Fix divisor calculation failure at lower ratio (bnc#1012382). - ASoC: Intel: cht_bsw_rt5645: Analog Mic support (bnc#1012382). - ASoC: rsnd: SSI PIO adjust to 24bit mode (bnc#1012382). - ASoC: ssm2602: Replace reg_default_raw with reg_default (bnc#1012382). - async_tx: Fix DMA_PREP_FENCE usage in do_async_gen_syndrome() (bnc#1012382). - ata: libahci: properly propagate return value of platform_get_irq() (bnc#1012382). - ath10k: fix rfc1042 header retrieval in QCA4019 with eth decap mode (bnc#1012382). - ath10k: rebuild crypto header in rx data frames (bnc#1012382). - ath5k: fix memory leak on buf on failed eeprom read (bnc#1012382). - ath9k_hw: check if the chip failed to wake up (bnc#1012382). - atm: zatm: Fix potential Spectre v1 (bnc#1012382). - audit: add tty field to LOGIN event (bnc#1012382). - autofs: mount point create should honour passed in mode (bnc#1012382). - bcache: segregate flash only volume write streams (bnc#1012382). - bcache: stop writeback thread after detaching (bnc#1012382). - bdi: Fix oops in wb_workfn() (bnc#1012382). - blacklist.conf: Add an omapdrm entry (bsc#1090708, bsc#1090718) - blk-mq: fix bad clear of RQF_MQ_INFLIGHT in blk_mq_ct_ctx_init() (bsc#1085058). - blk-mq: fix kernel oops in blk_mq_tag_idle() (bnc#1012382). - block: correctly mask out flags in blk_rq_append_bio() (bsc#1085058). - block/loop: fix deadlock after loop_set_status (bnc#1012382). - block: sanity check for integrity intervals (bsc#1091728). - bluetooth: Fix missing encryption refresh on Security Request (bnc#1012382). - bluetooth: Send HCI Set Event Mask Page 2 command only when needed (bnc#1012382). - bna: Avoid reading past end of buffer (bnc#1012382). - bnx2x: Allow vfs to disable txvlan offload (bnc#1012382). - bonding: do not set slave_dev npinfo before slave_enable_netpoll in bond_enslave (bnc#1012382). - bonding: Do not update slave->link until ready to commit (bnc#1012382). - bonding: fix the err path for dev hwaddr sync in bond_enslave (bnc#1012382). - bonding: move dev_mc_sync after master_upper_dev_link in bond_enslave (bnc#1012382). - bonding: process the err returned by dev_set_allmulti properly in bond_enslave (bnc#1012382). - bpf: map_get_next_key to return first key on NULL (bnc#1012382). - btrfs: fix incorrect error return ret being passed to mapping_set_error (bnc#1012382). - btrfs: Fix wrong first_key parameter in replace_path (Followup fix for bsc#1084721). - btrfs: Only check first key for committed tree blocks (bsc#1084721). - btrfs: Validate child tree block's level and first key (bsc#1084721). - bus: brcmstb_gisb: correct support for 64-bit address output (bnc#1012382). - bus: brcmstb_gisb: Use register offsets with writes too (bnc#1012382). - can: kvaser_usb: Increase correct stats counter in kvaser_usb_rx_can_msg() (bnc#1012382). - cdc_ether: flag the Cinterion AHS8 modem by gemalto as WWAN (bnc#1012382). - cdrom: information leak in cdrom_ioctl_media_changed() (bnc#1012382). - ceph: adding protection for showing cap reservation info (bsc#1089115). - ceph: always update atime/mtime/ctime for new inode (bsc#1089115). - ceph: check if mds create snaprealm when setting quota (fate#324665 bsc#1089115). - ceph: do not check quota for snap inode (fate#324665 bsc#1089115). - ceph: fix invalid point dereference for error case in mdsc destroy (bsc#1089115). - ceph: fix root quota realm check (fate#324665 bsc#1089115). - ceph: fix rsize/wsize capping in ceph_direct_read_write() (bsc#1089115). - ceph: quota: add counter for snaprealms with quota (fate#324665 bsc#1089115). - ceph: quota: add initial infrastructure to support cephfs quotas (fate#324665 bsc#1089115). - ceph: quota: cache inode pointer in ceph_snap_realm (fate#324665 bsc#1089115). - ceph: quota: do not allow cross-quota renames (fate#324665 bsc#1089115). - ceph: quota: report root dir quota usage in statfs (fate#324665 bsc#1089115). - ceph: quota: support for ceph.quota.max_bytes (fate#324665 bsc#1089115). - ceph: quota: support for ceph.quota.max_files (fate#324665 bsc#1089115). - ceph: quota: update MDS when max_bytes is approaching (fate#324665 bsc#1089115). - cfg80211: make RATE_INFO_BW_20 the default (bnc#1012382). - ch9200: use skb_cow_head() to deal with cloned skbs (bsc#1088684). - cifs: do not allow creating sockets except with SMB1 posix exensions (bnc#1012382). - cifs: silence compiler warnings showing up with gcc-8.0.0 (bsc#1090734). - cifs: silence lockdep splat in cifs_relock_file() (bnc#1012382). - cifs: Use file_dentry() (bsc#1093008). - clk: bcm2835: De-assert/assert PLL reset signal when appropriate (bnc#1012382). - clk: Fix __set_clk_rates error print-string (bnc#1012382). - clk: mvebu: armada-38x: add support for 1866MHz variants (bnc#1012382). - clk: mvebu: armada-38x: add support for missing clocks (bnc#1012382). - clk: scpi: fix return type of __scpi_dvfs_round_rate (bnc#1012382). - clocksource/drivers/arm_arch_timer: Avoid infinite recursion when ftrace is enabled (bsc#1090225). - cpumask: Add helper cpumask_available() (bnc#1012382). - crypto: af_alg - fix possible uninit-value in alg_bind() (bnc#1012382). - crypto: ahash - Fix early termination in hash walk (bnc#1012382). - crypto: x86/cast5-avx - fix ECB encryption when long sg follows short one (bnc#1012382). - cx25840: fix unchecked return values (bnc#1012382). - cxgb4: fix incorrect cim_la output for T6 (bnc#1012382). - cxgb4: Fix queue free path of ULD drivers (bsc#1022743 FATE#322540). - cxgb4: FW upgrade fixes (bnc#1012382). - cxgb4vf: Fix SGE FL buffer initialization logic for 64K pages (bnc#1012382). - dccp: initialize ireq->ir_mark (bnc#1012382). - dmaengine: at_xdmac: fix rare residue corruption (bnc#1012382). - dmaengine: imx-sdma: Handle return value of clk_prepare_enable (bnc#1012382). - dm ioctl: remove double parentheses (bnc#1012382). - Documentation: pinctrl: palmas: Add ti,palmas-powerhold-override property definition (bnc#1012382). - Do not leak MNT_INTERNAL away from internal mounts (bnc#1012382). - drivers/infiniband/core/verbs.c: fix build with gcc-4.4.4 (FATE#321732). - drivers/infiniband/ulp/srpt/ib_srpt.c: fix build with gcc-4.4.4 (bnc#1024296,FATE#321265). - drivers/misc/vmw_vmci/vmci_queue_pair.c: fix a couple integer overflow tests (bnc#1012382). - drm/omap: fix tiled buffer stride calculations (bnc#1012382). - drm/radeon: Fix PCIe lane width calculation (bnc#1012382). - drm/virtio: fix vq wait_event condition (bnc#1012382). - drm/vmwgfx: Fix a buffer object leak (bnc#1012382). - e1000e: fix race condition around skb_tstamp_tx() (bnc#1012382). - e1000e: Undo e1000e_pm_freeze if __e1000_shutdown fails (bnc#1012382). - EDAC, mv64x60: Fix an error handling path (bnc#1012382). - Enable uinput driver (bsc#1092566). - esp: Fix memleaks on error paths (git-fixes). - ext4: add validity checks for bitmap block numbers (bnc#1012382). - ext4: bugfix for mmaped pages in mpage_release_unused_pages() (bnc#1012382). - ext4: do not allow r/w mounts if metadata blocks overlap the superblock (bnc#1012382). - ext4: do not update checksum of new initialized bitmaps (bnc#1012382). - ext4: fail ext4_iget for root directory if unallocated (bnc#1012382). - ext4: fix bitmap position validation (bnc#1012382). - ext4: fix deadlock between inline_data and ext4_expand_extra_isize_ea() (bnc#1012382). - ext4: Fix hole length detection in ext4_ind_map_blocks() (bsc#1090953). - ext4: fix off-by-one on max nr_pages in ext4_find_unwritten_pgoff() (bnc#1012382). - ext4: prevent right-shifting extents beyond EXT_MAX_BLOCKS (bnc#1012382). - ext4: set h_journal if there is a failure starting a reserved handle (bnc#1012382). - fanotify: fix logic of events on child (bnc#1012382). - firmware/psci: Expose PSCI conduit (bsc#1068032). - firmware/psci: Expose SMCCC version through psci_ops (bsc#1068032). - fix race in drivers/char/random.c:get_reg() (bnc#1012382). - frv: declare jiffies to be located in the .data section (bnc#1012382). - fs: compat: Remove warning from COMPATIBLE_IOCTL (bnc#1012382). - fs/proc: Stop trying to report thread stacks (bnc#1012382). - fs/reiserfs/journal.c: add missing resierfs_warning() arg (bnc#1012382). - genirq: Use cpumask_available() for check of cpumask variable (bnc#1012382). - getname_kernel() needs to make sure that ->name != ->iname in long case (bnc#1012382). - gpio: label descriptors using the device name (bnc#1012382). - gpmi-nand: Handle ECC Errors in erased pages (bnc#1012382). - hdlcdrv: Fix divide by zero in hdlcdrv_ioctl (bnc#1012382). - HID: core: Fix size as type u32 (bnc#1012382). - HID: Fix hid_report_len usage (bnc#1012382). - HID: hidraw: Fix crash on HIDIOCGFEATURE with a destroyed device (bnc#1012382). - HID: i2c-hid: fix size check and type usage (bnc#1012382). - hwmon: (ina2xx) Fix access to uninitialized mutex (git-fixes). - hwmon: (ina2xx) Make calibration register value fixed (bnc#1012382). - hypfs_kill_super(): deal with failed allocations (bnc#1012382). - i40iw: Free IEQ resources (bsc#969476 FATE#319648 bsc#969477 FATE#319816). - IB/core: Fix possible crash to access NULL netdev (bsc#966191 FATE#320230 bsc#966186 FATE#320228). - IB/core: Generate GID change event regardless of RoCE GID table property (bsc#966191 FATE#320230 bsc#966186 FATE#320228). - IB/mlx4: Fix corruption of RoCEv2 IPv4 GIDs (bsc#966191 FATE#320230 bsc#966186 FATE#320228). - IB/mlx4: Include GID type when deleting GIDs from HW table under RoCE (bsc#966191 FATE#320230 bsc#966186 FATE#320228). - IB/mlx5: Avoid passing an invalid QP type to firmware (bsc#1015342 FATE#321688 bsc#1015343 FATE#321689). - IB/mlx5: Fix an error code in __mlx5_ib_modify_qp() (bsc#966170 FATE#320225 bsc#966172 FATE#320226). - IB/mlx5: Fix incorrect size of klms in the memory region (bsc#966170 FATE#320225 bsc#966172 FATE#320226). - IB/mlx5: Fix out-of-bounds read in create_raw_packet_qp_rq (bsc#966170 FATE#320225 bsc#966172 FATE#320226). - IB/mlx5: revisit -Wmaybe-uninitialized warning (bsc#1015342 FATE#321688 bsc#1015343 FATE#321689). - IB/mlx5: Set the default active rate and width to QDR and 4X (bsc#1015342 FATE#321688 bsc#1015343 FATE#321689). - IB/mlx5: Use unlimited rate when static rate is not supported (bnc#1012382). - ibmvnic: Clean actual number of RX or TX pools (bsc#1092289). - ibmvnic: Clear pending interrupt after device reset (bsc#1089644). - ibmvnic: Define vnic_login_client_data name field as unsized array (bsc#1089198). - ibmvnic: Disable irqs before exiting reset from closed state (bsc#1084610). - ibmvnic: Do not notify peers on parameter change resets (bsc#1089198). - ibmvnic: Do not reset CRQ for Mobility driver resets (bsc#1088600). - ibmvnic: Fix DMA mapping mistakes (bsc#1088600). - ibmvnic: Fix failover case for non-redundant configuration (bsc#1088600). - ibmvnic: Fix non-fatal firmware error reset (bsc#1093990). - ibmvnic: Fix reset scheduler error handling (bsc#1088600). - ibmvnic: Fix statistics buffers memory leak (bsc#1093990). - ibmvnic: Free coherent DMA memory if FW map failed (bsc#1093990). - ibmvnic: Handle all login error conditions (bsc#1089198). - ibmvnic: Zero used TX descriptor counter on reset (bsc#1088600). - ib/srp: Fix completion vector assignment algorithm (bnc#1012382). - ib/srp: Fix srp_abort() (bnc#1012382). - ib/srpt: Fix abort handling (bnc#1012382). - ib/srpt: Fix an out-of-bounds stack access in srpt_zerolength_write() (bnc#1024296,FATE#321265). - iio: hi8435: avoid garbage event at first enable (bnc#1012382). - iio: hi8435: cleanup reset gpio (bnc#1012382). - iio: magnetometer: st_magn_spi: fix spi_device_id table (bnc#1012382). - input: ALPS - fix multi-touch decoding on SS4 plus touchpads (git-fixes). - input: ALPS - fix trackstick button handling on V8 devices (git-fixes). - input: ALPS - fix TrackStick support for SS5 hardware (git-fixes). - input: ALPS - fix two-finger scroll breakage in right side on ALPS touchpad (git-fixes). - input: atmel_mxt_ts - add touchpad button mapping for Samsung Chromebook Pro (bnc#1012382). - input: drv260x - fix initializing overdrive voltage (bnc#1012382). - input: elan_i2c - check if device is there before really probing (bnc#1012382). - input: elan_i2c - clear INT before resetting controller (bnc#1012382). - input: elantech - force relative mode on a certain module (bnc#1012382). - input: i8042 - add Lenovo ThinkPad L460 to i8042 reset list (bnc#1012382). - input: i8042 - enable MUX on Sony VAIO VGN-CS series to fix touchpad (bnc#1012382). - input: leds - fix out of bound access (bnc#1012382). - input: mousedev - fix implicit conversion warning (bnc#1012382). - iommu/vt-d: Fix a potential memory leak (bnc#1012382). - ip6_gre: better validate user provided tunnel names (bnc#1012382). - ip6_tunnel: better validate user provided tunnel names (bnc#1012382). - ipc/shm: fix use-after-free of shm file via remap_file_pages() (bnc#1012382). - ipmi: create hardware-independent softdep for ipmi_devintf (bsc#1009062, bsc#1060799). - ipmi_ssif: Fix kernel panic at msg_done_handler (bsc#1088871). - ipsec: check return value of skb_to_sgvec always (bnc#1012382). - ip_tunnel: better validate user provided tunnel names (bnc#1012382). - ipv6: add RTA_TABLE and RTA_PREFSRC to rtm_ipv6_policy (bnc#1012382). - ipv6: avoid dad-failures for addresses with NODAD (bnc#1012382). - ipv6: sit: better validate user provided tunnel names (bnc#1012382). - ipv6: the entire IPv6 header chain must fit the first fragment (bnc#1012382). - ipvs: fix rtnl_lock lockups caused by start_sync_thread (bnc#1012382). - iw_cxgb4: print mapped ports correctly (bsc#321658 FATE#1005778 bsc#321660 FATE#1005780 bsc#321661 FATE#1005781). - jbd2: fix use after free in kjournald2() (bnc#1012382). - jbd2: if the journal is aborted then do not allow update of the log tail (bnc#1012382). - jffs2_kill_sb(): deal with failed allocations (bnc#1012382). - jiffies.h: declare jiffies and jiffies_64 with ____cacheline_aligned_in_smp (bnc#1012382). - kABI: add tty include to audit.c (kabi). - kABI: protect hid report functions (kabi). - kABI: protect jiffies types (kabi). - kABI: protect skb_to_sgvec* (kabi). - kABI: protect sound/timer.h include in sound pcm.c (kabi). - kABI: protect struct ath10k_hw_params (kabi). - kABI: protect struct cstate (kabi). - kABI: protect struct _lowcore (kabi). - kABI: protect tty include in audit.h (kabi). - kabi/severities: Ignore kgr_shadow_* kABI changes - kbuild: provide a __UNIQUE_ID for clang (bnc#1012382). - kexec_file: do not add extra alignment to efi memmap (bsc#1044596). - keys: DNS: limit the length of option strings (bnc#1012382). - kgraft/bnx2fc: Do not block kGraft in bnx2fc_l2_rcv kthread (bsc#1094033, fate#313296). - kGraft: fix small race in reversion code (bsc#1083125). - kobject: do not use WARN for registration failures (bnc#1012382). - kvm: Fix nopvspin static branch init usage (bsc#1056427). - kvm: Introduce nopvspin kernel parameter (bsc#1056427). - kvm: nVMX: Fix handling of lmsw instruction (bnc#1012382). - kvm: PPC: Book3S PR: Check copy_to/from_user return values (bnc#1012382). - kvm: s390: Enable all facility bits that are known good for passthrough (FATE#324071 LTC#158956 bnc#1012382 bsc#1073059 bsc#1076805). - kvm: SVM: do not zero out segment attributes if segment is unusable or not present (bnc#1012382). - l2tp: check sockaddr length in pppol2tp_connect() (bnc#1012382). - l2tp: fix missing print session offset info (bnc#1012382). - lan78xx: Correctly indicate invalid OTP (bnc#1012382). - leds: pca955x: Correct I2C Functionality (bnc#1012382). - libata: Apply NOLPM quirk for SanDisk SD7UB3Q*G1001 SSDs (bnc#1012382). - libceph, ceph: change permission for readonly debugfs entries (bsc#1089115). - libceph: fix misjudgement of maximum monitor number (bsc#1089115). - libceph: reschedule a tick in finish_hunting() (bsc#1089115). - libceph: un-backoff on tick when we have a authenticated session (bsc#1089115). - libceph: validate con->state at the top of try_write() (bsc#1089115). - livepatch: Allow to call a custom callback when freeing shadow variables (bsc#1082299 fate#313296). - livepatch: Initialize shadow variables safely by a custom callback (bsc#1082299 fate#313296). - llc: delete timers synchronously in llc_sk_free() (bnc#1012382). - llc: fix NULL pointer deref for SOCK_ZAPPED (bnc#1012382). - llc: hold llc_sap before release_sock() (bnc#1012382). - llist: clang: introduce member_address_is_nonnull() (bnc#1012382). - lockd: fix lockd shutdown race (bnc#1012382). - lockd: lost rollback of set_grace_period() in lockd_down_net() (git-fixes). - mac80211: Add RX flag to indicate ICV stripped (bnc#1012382). - mac80211: allow not sending MIC up from driver for HW crypto (bnc#1012382). - mac80211: allow same PN for AMSDU sub-frames (bnc#1012382). - mac80211: bail out from prep_connection() if a reconfig is ongoing (bnc#1012382). - mceusb: sporadic RX truncation corruption fix (bnc#1012382). - md: document lifetime of internal rdev pointer (bsc#1056415). - md: fix two problems with setting the 're-add' device state (bsc#1089023). - md: only allow remove_and_add_spares when no sync_thread running (bsc#1056415). - md raid10: fix NULL deference in handle_write_completed() (git-fixes). - md/raid10: reset the 'first' at the end of loop (bnc#1012382). - md/raid5: make use of spin_lock_irq over local_irq_disable + spin_lock (bnc#1012382). - media: v4l2-compat-ioctl32: do not oops on overlay (bnc#1012382). - media: videobuf2-core: do not go out of the buffer range (bnc#1012382). - mei: remove dev_err message on an unsupported ioctl (bnc#1012382). - mISDN: Fix a sleep-in-atomic bug (bnc#1012382). - mlx5: fix bug reading rss_hash_type from CQE (bnc#1012382). - mmc: dw_mmc: Fix the DTO/CTO timeout overflow calculation for 32-bit systems (bsc#1088267). - mmc: jz4740: Fix race condition in IRQ mask update (bnc#1012382). - mm/filemap.c: fix NULL pointer in page_cache_tree_insert() (bnc#1012382). - mm, slab: reschedule cache_reap() on the same CPU (bnc#1012382). - mtd: cfi: cmdset_0001: Do not allow read/write to suspend erase block (bnc#1012382). - mtd: cfi: cmdset_0001: Workaround Micron Erase suspend bug (bnc#1012382). - mtd: cfi: cmdset_0002: Do not allow read/write to suspend erase block (bnc#1012382). - mtd: jedec_probe: Fix crash in jedec_read_mfr() (bnc#1012382). - neighbour: update neigh timestamps iff update is effective (bnc#1012382). - net: af_packet: fix race in PACKET_{R|T}X_RING (bnc#1012382). - net: atm: Fix potential Spectre v1 (bnc#1012382). - net: cavium: liquidio: fix up 'Avoid dma_unmap_single on uninitialized ndata' (bnc#1012382). - net: cdc_ncm: Fix TX zero padding (bnc#1012382). - net: emac: fix reset timeout with AR8035 phy (bnc#1012382). - net: ethernet: ti: cpsw: adjust cpsw fifos depth for fullduplex flow control (bnc#1012382). - netfilter: bridge: ebt_among: add more missing match size checks (bnc#1012382). - netfilter: ctnetlink: fix incorrect nf_ct_put during hash resize (bnc#1012382). - netfilter: ctnetlink: Make some parameters integer to avoid enum mismatch (bnc#1012382). - netfilter: nf_nat_h323: fix logical-not-parentheses warning (bnc#1012382). - netfilter: x_tables: add and use xt_check_proc_name (bnc#1012382). - net: fix deadlock while clearing neighbor proxy table (bnc#1012382). - net: fix possible out-of-bound read in skb_network_protocol() (bnc#1012382). - net: fix rtnh_ok() (bnc#1012382). - net: fix uninit-value in __hw_addr_add_ex() (bnc#1012382). - net: fool proof dev_valid_name() (bnc#1012382). - net: freescale: fix potential NULL pointer dereference (bnc#1012382). - net: hns: Fix ethtool private flags (bnc#1012382 bsc#1085511). - net: hns: Fix ethtool private flags (bsc#1085511). - net: ieee802154: fix net_device reference release too early (bnc#1012382). - net: initialize skb->peeked when cloning (bnc#1012382). - net/ipv6: Fix route leaking between VRFs (bnc#1012382). - net/ipv6: Increment OUTxxx counters after netfilter hook (bnc#1012382). - netlink: fix uninit-value in netlink_sendmsg (bnc#1012382). - netlink: make sure nladdr has correct size in netlink_connect() (bnc#1012382). - net: llc: add lock_sock in llc_ui_bind to avoid a race condition (bnc#1012382). - net/mlx4: Check if Granular QoS per VF has been enabled before updating QP qos_vport (bnc#1012382). - net/mlx4_core: Fix memory leak while delete slave's resources (bsc#966191 FATE#320230 bsc#966186 FATE#320228). - net/mlx4_en: Avoid adding steering rules with invalid ring (bnc#1012382). - net/mlx4_en: Fix mixed PFC and Global pause user control requests (bsc#1015336 FATE#321685 bsc#1015337 FATE#321686 bsc#1015340 FATE#321687). - net/mlx4: Fix the check in attaching steering rules (bnc#1012382). - net/mlx5: avoid build warning for uniprocessor (bnc#1012382). - net/mlx5e: Add error print in ETS init (bsc#966170 FATE#320225 bsc#966172 FATE#320226). - net/mlx5e: Check support before TC swap in ETS init (bsc#966170 FATE#320225 bsc#966172 FATE#320226). - net/mlx5e: E-Switch, Use the name of static array instead of its address (bsc#1015342 FATE#321688 bsc#1015343 FATE#321689). - net/mlx5e: Remove unused define MLX5_MPWRQ_STRIDES_PER_PAGE (bsc#1015342 FATE#321688 bsc#1015343 FATE#321689). - net/mlx5: Fix error handling in load one (bsc#1015342 FATE#321688 bsc#1015343 FATE#321689). - net/mlx5: Fix ingress/egress naming mistake (bsc#1015342 FATE#321688 bsc#1015343 FATE#321689). - net/mlx5: Tolerate irq_set_affinity_hint() failures (bnc#1012382). - net: move somaxconn init from sysctl code (bnc#1012382). - net: phy: avoid genphy_aneg_done() for PHYs without clause 22 support (bnc#1012382). - net: qca_spi: Fix alignment issues in rx path (bnc#1012382). - net sched actions: fix dumping which requires several messages to user space (bnc#1012382). - net/sched: fix NULL dereference in the error path of tcf_bpf_init() (bnc#1012382). - net: usb: qmi_wwan: add support for ublox R410M PID 0x90b2 (bnc#1012382). - net: validate attribute sizes in neigh_dump_table() (bnc#1012382). - net: x25: fix one potential use-after-free issue (bnc#1012382). - net: xfrm: use preempt-safe this_cpu_read() in ipcomp_alloc_tfms() (bnc#1012382). - nfsv4.1: RECLAIM_COMPLETE must handle NFS4ERR_CONN_NOT_BOUND_TO_SESSION (bnc#1012382). - nfsv4.1: Work around a Linux server bug.. (bnc#1012382). - nospec: Kill array_index_nospec_mask_check() (bnc#1012382). - nospec: Move array_index_nospec() parameter checking into separate macro (bnc#1012382). - nvme: target: fix buffer overflow (FATE#321732 FATE#321590 bsc#993388). - ocfs2/dlm: Fix up kABI in dlm_ctxt (bsc#1070404). - ocfs2/dlm: wait for dlm recovery done when migrating all lock resources (bsc#1070404). - ovl: filter trusted xattr for non-admin (bnc#1012382). - packet: fix bitfield update race (bnc#1012382). - parisc: Fix out of array access in match_pci_device() (bnc#1012382). - parport_pc: Add support for WCH CH382L PCI-E single parallel port card (bnc#1012382). - partitions/msdos: Unable to mount UFS 44bsd partitions (bnc#1012382). - PCI/ACPI: Fix bus range comparison in pci_mcfg_lookup() (bsc#1084699). - PCI/cxgb4: Extend T3 PCI quirk to T4+ devices (bsc#981348). - PCI: Make PCI_ROM_ADDRESS_MASK a 32-bit constant (bnc#1012382). - percpu: include linux/sched.h for cond_resched() (bnc#1012382). - perf/core: Correct event creation with PERF_FORMAT_GROUP (bnc#1012382). - perf/core: Fix locking for children siblings group read (git-fixes). - perf/core: Fix possible Spectre-v1 indexing for ->aux_pages[] (bnc#1012382). - perf/core: Fix the perf_cpu_time_max_percent check (bnc#1012382). - perf header: Set proper module name when build-id event found (bnc#1012382). - perf/hwbp: Simplify the perf-hwbp code, fix documentation (bnc#1012382). - perf intel-pt: Fix error recovery from missing TIP packet (bnc#1012382). - perf intel-pt: Fix overlap detection to identify consecutive buffers correctly (bnc#1012382). - perf intel-pt: Fix sync_switch (bnc#1012382). - perf intel-pt: Fix timestamp following overflow (bnc#1012382). - perf probe: Add warning message if there is unexpected event name (bnc#1012382). - perf: Remove superfluous allocation error check (bnc#1012382). - perf report: Ensure the perf DSO mapping matches what libdw sees (bnc#1012382). - perf: Return proper values for user stack errors (bnc#1012382). - perf tests: Decompress kernel module before objdump (bnc#1012382). - perf tools: Fix copyfile_offset update of output offset (bnc#1012382). - perf trace: Add mmap alias for s390 (bnc#1012382). - perf/x86/cstate: Fix possible Spectre-v1 indexing for pkg_msr (bnc#1012382). - perf/x86: Fix possible Spectre-v1 indexing for hw_perf_event cache_* (bnc#1012382). - perf/x86: Fix possible Spectre-v1 indexing for x86_pmu::event_map() (bnc#1012382). - perf/x86/msr: Fix possible Spectre-v1 indexing in the MSR driver (bnc#1012382). - pidns: disable pid allocation if pid_ns_prepare_proc() is failed in alloc_pid() (bnc#1012382). - platform/x86: ideapad-laptop: Add MIIX 720-12IKB to no_hw_rfkill (bsc#1093035). - pNFS/flexfiles: missing error code in ff_layout_alloc_lseg() (bnc#1012382). - powerpc/64: Fix smp_wmb barrier definition use use lwsync consistently (bnc#1012382). - powerpc/64s: Add barrier_nospec (bsc#1068032, bsc#1080157). - powerpc/64s: Add support for ori barrier_nospec patching (bsc#1068032, bsc#1080157). - powerpc/64s: Enable barrier_nospec based on firmware settings (bsc#1068032, bsc#1080157). - powerpc/64s: Enhance the information in cpu_show_meltdown() (bsc#1068032, bsc#1075087, bsc#1091041). - powerpc/64s: Enhance the information in cpu_show_spectre_v1() (bsc#1068032). - powerpc/64s: Fix section mismatch warnings from setup_rfi_flush() (bsc#1068032, bsc#1075087, bsc#1091041). - powerpc/64s: Move cpu_show_meltdown() (bsc#1068032, bsc#1075087, bsc#1091041). - powerpc/64s: Patch barrier_nospec in modules (bsc#1068032, bsc#1080157). - powerpc/64s: Wire up cpu_show_spectre_v1() (bsc#1068032, bsc#1075087, bsc#1091041). - powerpc/64s: Wire up cpu_show_spectre_v2() (bsc#1068032, bsc#1075087, bsc#1091041). - powerpc/64: Use barrier_nospec in syscall entry (bsc#1068032, bsc#1080157). - powerpc: Add security feature flags for Spectre/Meltdown (bsc#1068032, bsc#1075087, bsc#1091041). - powerpc/[booke|4xx]: Do not clobber TCR[WP] when setting TCR[DIE] (bnc#1012382). - powerpc: conditionally compile platform-specific serial drivers (bsc#1066223). - powerpc/crash: Remove the test for cpu_online in the IPI callback (bsc#1088242). - powerpc: Do not send system reset request through the oops path (bsc#1088242). - powerpc/eeh: Fix enabling bridge MMIO windows (bnc#1012382). - powerpc/fadump: Do not use hugepages when fadump is active (bsc#1092772). - powerpc/fadump: exclude memory holes while reserving memory in second kernel (bsc#1092772). - powerpc/lib: Fix off-by-one in alternate feature patching (bnc#1012382). - powerpc/mm: allow memory hotplug into a memoryless node (bsc#1090663). - powerpc/mm: Allow memory hotplug into an offline node (bsc#1090663). - powerpc: Move default security feature flags (bsc#1068032, bsc#1075087, bsc#1091041). - powerpc/powernv: define a standard delay for OPAL_BUSY type retry loops (bnc#1012382). - powerpc/powernv: Fix OPAL NVRAM driver OPAL_BUSY loops (bnc#1012382). - powerpc/powernv: Handle unknown OPAL errors in opal_nvram_write() (bnc#1012382). - powerpc/powernv: Set or clear security feature flags (bsc#1068032, bsc#1075087, bsc#1091041). - powerpc/powernv: Use the security flags in pnv_setup_rfi_flush() (bsc#1068032, bsc#1075087, bsc#1091041). - powerpc/pseries: Add new H_GET_CPU_CHARACTERISTICS flags (bsc#1068032, bsc#1075087, bsc#1091041). - powerpc/pseries: Fix clearing of security feature flags (bsc#1068032, bsc#1075087, bsc#1091041). - powerpc/pseries: Restore default security feature flags on setup (bsc#1068032, bsc#1075087, bsc#1091041). - powerpc/pseries: Set or clear security feature flags (bsc#1068032, bsc#1075087, bsc#1091041). - powerpc/pseries: Use the security flags in pseries_setup_rfi_flush() (bsc#1068032, bsc#1075087, bsc#1091041). - powerpc/rfi-flush: Always enable fallback flush on pseries (bsc#1068032, bsc#1075087, bsc#1091041). - powerpc/rfi-flush: Differentiate enabled and patched flush types (bsc#1068032, bsc#1075087, bsc#1091041). - powerpc/rfi-flush: Make it possible to call setup_rfi_flush() again (bsc#1068032, bsc#1075087, bsc#1091041). - powerpc: signals: Discard transaction state from signal frames (bsc#1094059). - powerpc/spufs: Fix coredump of SPU contexts (bnc#1012382). - powerpc: System reset avoid interleaving oops using die synchronisation (bsc#1088242). - powerpc: Use barrier_nospec in copy_from_user() (bsc#1068032, bsc#1080157). - pppoe: check sockaddr length in pppoe_connect() (bnc#1012382). - pptp: remove a buggy dst release in pptp_connect() (bnc#1012382). - qlge: Avoid reading past end of buffer (bnc#1012382). - r8152: add Linksys USB3GIGV1 id (bnc#1012382). - r8169: fix setting driver_data after register_netdev (bnc#1012382). - radeon: hide pointless #warning when compile testing (bnc#1012382). - random: use a tighter cap in credit_entropy_bits_safe() (bnc#1012382). - random: use lockless method of accessing and updating f->reg_idx (bnc#1012382). - ray_cs: Avoid reading past end of buffer (bnc#1012382). - rdma/core: Avoid that ib_drain_qp() triggers an out-of-bounds stack access (FATE#321732). - rdma/mlx5: Protect from NULL pointer derefence (bsc#1015342 FATE#321688 bsc#1015343 FATE#321689). - rdma/mlx5: Protect from shift operand overflow (bnc#1012382). - rdma/qedr: fix QP's ack timeout configuration (bsc#1022604 FATE#321747). - rdma/qedr: Fix QP state initialization race (bsc#1022604 FATE#321747). - rdma/qedr: Fix rc initialization on CNQ allocation failure (bsc#1022604 FATE#321747). - rdma/rxe: Fix an out-of-bounds read (FATE#322149). - rdma/ucma: Allow resolving address w/o specifying source address (bnc#1012382). - rdma/ucma: Check AF family prior resolving address (bnc#1012382). - rdma/ucma: Check that device exists prior to accessing it (bnc#1012382). - rdma/ucma: Check that device is connected prior to access it (bnc#1012382). - rdma/ucma: Do not allow join attempts for unsupported AF family (bnc#1012382). - rdma/ucma: Do not allow setting RDMA_OPTION_IB_PATH without an RDMA device (bnc#1012382). - rdma/ucma: Ensure that CM_ID exists prior to access it (bnc#1012382). - rdma/ucma: Fix use-after-free access in ucma_close (bnc#1012382). - rdma/ucma: Introduce safer rdma_addr_size() variants (bnc#1012382). - rds; Reset rs->rs_bound_addr in rds_add_bound() failure path (bnc#1012382). - regulator: gpio: Fix some error handling paths in 'gpio_regulator_probe()' (bsc#1091960). - resource: fix integer overflow at reallocation (bnc#1012382). - Revert 'alsa: pcm: Fix mutex unbalance in OSS emulation ioctls' (kabi). - Revert 'alsa: pcm: Return -EBUSY for OSS ioctls changing busy streams' (kabi). - Revert 'arm: dts: am335x-pepper: Fix the audio CODEC's reset pin' (bnc#1012382). - Revert 'arm: dts: omap3-n900: Fix the audio CODEC's reset pin' (bnc#1012382). - Revert 'ath10k: rebuild crypto header in rx data frames' (kabi). - Revert 'ath10k: send (re)assoc peer command when NSS changed' (bnc#1012382). - Revert 'Bluetooth: btusb: Fix quirk for Atheros 1525/QCA6174' (bnc#1012382). - Revert 'cpufreq: Fix governor module removal race' (bnc#1012382). - Revert 'ip6_vti: adjust vti mtu according to mtu of lower device' (bnc#1012382). - Revert 'kvm: Fix stack-out-of-bounds read in write_mmio' (bnc#1083635). - Revert 'mac80211: Add RX flag to indicate ICV stripped' (kabi). - Revert 'mac80211: allow not sending MIC up from driver for HW crypto' (kabi). - Revert 'mac80211: allow same PN for AMSDU sub-frames' (kabi). - Revert 'mtd: cfi: cmdset_0001: Do not allow read/write to suspend erase block.' (kabi). - Revert 'mtd: cfi: cmdset_0001: Workaround Micron Erase suspend bug.' (kabi). - Revert 'mtd: cfi: cmdset_0002: Do not allow read/write to suspend erase block.' (kabi). - Revert 'mtip32xx: use runtime tag to initialize command header' (bnc#1012382). - Revert 'PCI/MSI: Stop disabling MSI/MSI-X in pci_device_shutdown()' (bnc#1012382). - Revert 'perf tests: Decompress kernel module before objdump' (bnc#1012382). - Revert 'xhci: plat: Register shutdown for xhci_plat' (bnc#1012382). - rfkill: gpio: fix memory leak in probe error path (bnc#1012382). - rpc_pipefs: fix double-dput() (bnc#1012382). - rpm/config.sh: build against SP3 in OBS as well. - rtc: interface: Validate alarm-time before handling rollover (bnc#1012382). - rtc: opal: Handle disabled TPO in opal_get_tpo_time() (bnc#1012382). - rtc: snvs: fix an incorrect check of return value (bnc#1012382). - rtl8187: Fix NULL pointer dereference in priv->conf_mutex (bnc#1012382). - rxrpc: check return value of skb_to_sgvec always (bnc#1012382). - s390: add automatic detection of the spectre defense (bnc#1012382). - s390: add optimized array_index_mask_nospec (bnc#1012382). - s390: add options to change branch prediction behaviour for the kernel (bnc#1012382 bsc#1068032). - s390: add sysfs attributes for spectre (bnc#1012382). - s390/alternative: use a copy of the facility bit mask (bnc#1012382). - s390/cio: update chpid descriptor after resource accessibility event (bnc#1012382). - s390: correct module section names for expoline code revert (bnc#1012382). - s390: correct nospec auto detection init order (bnc#1012382). - s390/dasd: fix hanging safe offline (bnc#1012382). - s390/dasd: fix IO error for newly defined devices (bnc#1093144, LTC#167398). - s390: do not bypass BPENTER for interrupt system calls (bnc#1012382). - s390: enable CPU alternatives unconditionally (bnc#1012382). - s390/entry.S: fix spurious zeroing of r0 (bnc#1012382). - s390: introduce execute-trampolines for branches (bnc#1012382). - s390/ipl: ensure loadparm valid flag is set (bnc#1012382). - s390: move nobp parameter functions to nospec-branch.c (bnc#1012382). - s390: move _text symbol to address higher than zero (bnc#1012382). - s390/qdio: do not merge ERROR output buffers (bnc#1012382). - s390/qdio: do not retry EQBS after CCQ 96 (bnc#1012382). - s390/qeth: consolidate errno translation (bnc#1093144, LTC#167507). - s390/qeth: fix MAC address update sequence (bnc#1093144, LTC#167609). - s390/qeth: translate SETVLAN/DELVLAN errors (bnc#1093144, LTC#167507). - s390: Replace IS_ENABLED(EXPOLINE_*) with IS_ENABLED(CONFIG_EXPOLINE_*) (bnc#1012382). - s390: report spectre mitigation via syslog (bnc#1012382). - s390: run user space and KVM guests with modified branch prediction (bnc#1012382). - s390: scrub registers on kernel entry and KVM exit (bnc#1012382). - s390/uprobes: implement arch_uretprobe_is_alive() (bnc#1012382). - sched/numa: Use down_read_trylock() for the mmap_sem (bnc#1012382). - scsi: bnx2fc: fix race condition in bnx2fc_get_host_stats() (bnc#1012382). - scsi: libiscsi: Allow sd_shutdown on bad transport (bnc#1012382). - scsi: libsas: initialize sas_phy status according to response of DISCOVER (bnc#1012382). - scsi: lpfc: Add per io channel NVME IO statistics (bsc#1088865). - scsi: lpfc: Correct missing remoteport registration during link bounces (bsc#1088865). - scsi: lpfc: Correct target queue depth application changes (bsc#1088865). - scsi: lpfc: Enlarge nvmet asynchronous receive buffer counts (bsc#1088865). - scsi: lpfc: Fix Abort request WQ selection (bsc#1088865). - scsi: lpfc: Fix driver not recovering NVME rports during target link faults (bsc#1088865). - scsi: lpfc: Fix lingering lpfc_wq resource after driver unload (bsc#1088865). - scsi: lpfc: Fix multiple PRLI completion error path (bsc#1088865). - scsi: lpfc: Fix NULL pointer access in lpfc_nvme_info_show (bsc#1088865). - scsi: lpfc: Fix NULL pointer reference when resetting adapter (bsc#1088865). - scsi: lpfc: Fix nvme remoteport registration race conditions (bsc#1088865). - scsi: lpfc: Fix WQ/CQ creation for older asic's (bsc#1088865). - scsi: lpfc: update driver version to 11.4.0.7-2 (bsc#1088865). - scsi: mpt3sas: Proper handling of set/clear of 'ATA command pending' flag (bnc#1012382). - scsi: mptsas: Disable WRITE SAME (bnc#1012382). - scsi: sd: Defer spinning up drive while SANITIZE is in progress (bnc#1012382). - sctp: do not check port in sctp_inet6_cmp_addr (bnc#1012382). - sctp: do not leak kernel memory to user space (bnc#1012382). - sctp: fix recursive locking warning in sctp_do_peeloff (bnc#1012382). - sctp: sctp_sockaddr_af must check minimal addr length for AF_INET6 (bnc#1012382). - selftests/powerpc: Fix TM resched DSCR test with some compilers (bnc#1012382). - selinux: do not check open permission on sockets (bnc#1012382). - selinux: Remove redundant check for unknown labeling behavior (bnc#1012382). - selinux: Remove unnecessary check of array base in selinux_set_mapping() (bnc#1012382). - serial: 8250: omap: Disable DMA for console UART (bnc#1012382). - serial: mctrl_gpio: Add missing module license (bnc#1012382). - serial: mctrl_gpio: export mctrl_gpio_disable_ms and mctrl_gpio_init (bnc#1012382). - serial: sh-sci: Fix race condition causing garbage during shutdown (bnc#1012382). - sh_eth: Use platform device for printing before register_netdev() (bnc#1012382). - sit: reload iphdr in ipip6_rcv (bnc#1012382). - skbuff: only inherit relevant tx_flags (bnc#1012382). - skbuff: return -EMSGSIZE in skb_to_sgvec to prevent overflow (bnc#1012382). - sky2: Increase D3 delay to sky2 stops working after suspend (bnc#1012382). - slip: Check if rstate is initialized before uncompressing (bnc#1012382). - soreuseport: initialise timewait reuseport field (bnc#1012382). - sparc64: ldc abort during vds iso boot (bnc#1012382). - spi: davinci: fix up dma_mapping_error() incorrect patch (bnc#1012382). - staging: comedi: ni_mio_common: ack ai fifo error interrupts (bnc#1012382). - staging: ion : Donnot wakeup kswapd in ion system alloc (bnc#1012382). - staging: wlan-ng: prism2mgmt.c: fixed a double endian conversion before calling hfa384x_drvr_setconfig16, also fixes relative sparse warning (bnc#1012382). - stop_machine, sched: Fix migrate_swap() vs. active_balance() deadlock (bsc#1088810). - swap: divide-by-zero when zero length swap file on ssd (bsc#1082153). - tags: honor COMPILED_SOURCE with apart output directory (bnc#1012382). - target: prefer dbroot of /etc/target over /var/target (bsc#1087274). - target: transport should handle st FM/EOM/ILI reads (bsc#1081599). - tcp: better validation of received ack sequences (bnc#1012382). - tcp: do not read out-of-bounds opsize (bnc#1012382). - tcp: fix TCP_REPAIR_QUEUE bound checking (bnc#1012382). - tcp: md5: reject TCP_MD5SIG or TCP_MD5SIG_EXT on established sockets (bnc#1012382). - team: avoid adding twice the same option to the event list (bnc#1012382). - team: fix netconsole setup over team (bnc#1012382). - test_firmware: fix setting old custom fw path back on exit, second try (bnc#1012382). - thermal: imx: Fix race condition in imx_thermal_probe() (bnc#1012382). - thermal: power_allocator: fix one race condition issue for thermal_instances list (bnc#1012382). - thunderbolt: Resume control channel after hibernation image is created (bnc#1012382). - tipc: add policy for TIPC_NLA_NET_ADDR (bnc#1012382). - tracepoint: Do not warn on ENOMEM (bnc#1012382). - tracing: Fix regex_match_front() to not over compare the test string (bnc#1012382). - tracing/uprobe_event: Fix strncpy corner case (bnc#1012382). - tty: Do not call panic() at tty_ldisc_init() (bnc#1012382). - tty: make n_tty_read() always abort if hangup is in progress (bnc#1012382). - tty: n_gsm: Allow ADM response in addition to UA for control dlci (bnc#1012382). - tty: n_gsm: Fix DLCI handling for ADM mode if debug & 2 is not set (bnc#1012382). - tty: n_gsm: Fix long delays with control frame timeouts in ADM mode (bnc#1012382). - tty: provide tty_name() even without CONFIG_TTY (bnc#1012382). - tty: Use __GFP_NOFAIL for tty_ldisc_get() (bnc#1012382). - ubi: fastmap: Do not flush fastmap work on detach (bnc#1012382). - ubi: Fix error for write access (bnc#1012382). - ubifs: Check ubifs_wbuf_sync() return code (bnc#1012382). - ubi: Reject MLC NAND (bnc#1012382). - um: Use POSIX ucontext_t instead of struct ucontext (bnc#1012382). - Update config files, add expoline for s390x (bsc#1089393). - Update patches.fixes/0001-md-raid10-fix-NULL-deference-in-handl e_write_complet.patch (bsc#1056415). - Update patches.fixes/xfs-refactor-log-record-unpack-and-data-pr ocessing.patch (bsc#1043598, bsc#1036215). - Update patches.suse/powerpc-powernv-Support-firmware-disable-of -RFI-flus.patch (bsc#1068032, bsc#1075087, bsc#1091041). - Update patches.suse/powerpc-pseries-Support-firmware-disable-of -RFI-flus.patch (bsc#1068032, bsc#1075087, bsc#1091041). - Update patches.suse/powerpc-rfi-flush-Move-the-logic-to-avoid-a -redo-int.patch (bsc#1068032, bsc#1075087, bsc#1091041). - Update patches.suse/x86-nospectre_v2-means-nospec-too.patch (bsc#1075994 bsc#1075091 bnc#1085958). - usb: Accept bulk endpoints with 1024-byte maxpacket (bnc#1012382 bsc#1092888). - usb: Accept bulk endpoints with 1024-byte maxpacket (bsc#1092888). - usb: chipidea: properly handle host or gadget initialization failure (bnc#1012382). - usb: core: Add quirk for HP v222w 16GB Mini (bnc#1012382). - usb: dwc2: Improve gadget state disconnection handling (bnc#1012382). - usb: dwc3: keystone: check return value (bnc#1012382). - usb: dwc3: pci: Properly cleanup resource (bnc#1012382). - usb: ene_usb6250: fix first command execution (bnc#1012382). - usb: ene_usb6250: fix SCSI residue overwriting (bnc#1012382). - usb:fix USB3 devices behind USB3 hubs not resuming at hibernate thaw (bnc#1012382). - usb: gadget: align buffer size when allocating for OUT endpoint (bnc#1012382). - usb: gadget: change len to size_t on alloc_ep_req() (bnc#1012382). - usb: gadget: define free_ep_req as universal function (bnc#1012382). - usb: gadget: f_hid: fix: Prevent accessing released memory (bnc#1012382). - usb: gadget: fix request length error for isoc transfer (git-fixes). - usb: gadget: fix usb_ep_align_maybe endianness and new usb_ep_align (bnc#1012382). - usb: Increment wakeup count on remote wakeup (bnc#1012382). - usbip: usbip_host: fix to hold parent lock for device_attach() calls (bnc#1012382). - usbip: vhci_hcd: Fix usb device and sockfd leaks (bnc#1012382). - usb: musb: gadget: misplaced out of bounds check (bnc#1012382). - usb: musb: host: fix potential NULL pointer dereference (bnc#1012382). - usb: serial: cp210x: add ELDAT Easywave RX09 id (bnc#1012382). - usb: serial: cp210x: add ID for NI USB serial console (bnc#1012382). - usb: serial: ftdi_sio: add RT Systems VX-8 cable (bnc#1012382). - usb: serial: ftdi_sio: add support for Harman FirmwareHubEmulator (bnc#1012382). - usb: serial: ftdi_sio: use jtag quirk for Arrow USB Blaster (bnc#1012382). - usb: serial: option: adding support for ublox R410M (bnc#1012382). - usb: serial: option: Add support for Quectel EP06 (bnc#1012382). - usb: serial: option: reimplement interface masking (bnc#1012382). - usb: serial: simple: add libtransistor console (bnc#1012382). - usb: serial: visor: handle potential invalid device configuration (bnc#1012382). - vfb: fix video mode and line_length being set when loaded (bnc#1012382). - vfio/pci: Virtualize Maximum Payload Size (bnc#1012382). - vfio/pci: Virtualize Maximum Read Request Size (bnc#1012382). - vfio-pci: Virtualize PCIe & AF FLR (bnc#1012382). - vhost: correctly remove wait queue during poll failure (bnc#1012382). - virtio: add ability to iterate over vqs (bnc#1012382). - virtio_console: free buffers after reset (bnc#1012382). - virtio_net: check return value of skb_to_sgvec always (bnc#1012382). - virtio_net: check return value of skb_to_sgvec in one more location (bnc#1012382). - vlan: also check phy_driver ts_info for vlan's real device (bnc#1012382). - vlan: Fix reading memory beyond skb->tail in skb_vlan_tagged_multi (bnc#1012382). - vmxnet3: ensure that adapter is in proper state during force_close (bnc#1012382). - vrf: Fix use after free and double free in vrf_finish_output (bnc#1012382). - vt: change SGR 21 to follow the standards (bnc#1012382). - vti6: better validate user provided tunnel names (bnc#1012382). - vxlan: dont migrate permanent fdb entries during learn (bnc#1012382). - watchdog: f71808e_wdt: Fix WD_EN register read (bnc#1012382). - watchdog: hpwdt: Remove legacy NMI sourcing (bsc#1085185). - watchdog: sbsa: use 32-bit read for WCV (bsc#1085679). - wl1251: check return from call to wl1251_acx_arp_ip_filter (bnc#1012382). - writeback: fix the wrong congested state variable definition (bnc#1012382). - writeback: safer lock nesting (bnc#1012382). - x86/asm: Do not use RBP as a temporary register in csum_partial_copy_generic() (bnc#1012382). - x86/bugs: correctly force-disable IBRS on !SKL systems (bsc#1092497). - x86/bugs: Make sure that _TIF_SSBD does not end up in _TIF_ALLWORK_MASK (bsc#1093215). - x86/bugs: Respect retpoline command line option (bsc#1068032). - x86/hweight: Do not clobber %rdi (bnc#1012382). - x86/hweight: Get rid of the special calling convention (bnc#1012382). - x86/ipc: Fix x32 version of shmid64_ds and msqid64_ds (bnc#1012382). - x86/platform/UV: Add references to access fixed UV4A HUB MMRs (bsc#1076263 #fate#322814). - x86/platform/uv/BAU: Replace hard-coded values with MMR definitions (bsc#1076263 #fate#322814). - x86/platform/UV: Fix critical UV MMR address error (bsc#1076263 - x86/platform/UV: Fix GAM MMR changes in UV4A (bsc#1076263 #fate#322814). - x86/platform/UV: Fix GAM MMR references in the UV x2apic code (bsc#1076263 #fate#322814). - x86/platform/UV: Fix GAM Range Table entries less than 1GB (bsc#1091325). - x86/platform/UV: Fix UV4A BAU MMRs (bsc#1076263 #fate#322814). - x86/platform/UV: Fix UV4A support on new Intel Processors (bsc#1076263 #fate#322814). - x86/platform/uv: Skip UV runtime services mapping in the efi_runtime_disabled case (bsc#1089925). - x86/platform/UV: Update uv_mmrs.h to prepare for UV4A fixes (bsc#1076263 #fate#322814). - x86/smpboot: Do not use mwait_play_dead() on AMD systems (bnc#1012382). - x86/tsc: Prevent 32bit truncation in calc_hpet_ref() (bnc#1012382). - x86/tsc: Provide 'tsc=unstable' boot parameter (bnc#1012382). - xen: avoid type warning in xchg_xen_ulong (bnc#1012382). - xen-netfront: Fix hang on device removal (bnc#1012382). - xfrm: fix state migration copy replay sequence numbers (bnc#1012382). - xfrm: Refuse to insert 32 bit userspace socket policies on 64 bit systems (bnc#1012382). - xfrm_user: fix return value from xfrm_user_rcv_msg (bnc#1012382). - xfrm_user: uncoditionally validate esn replay attribute struct (bnc#1012382). - xfs: always verify the log tail during recovery (bsc#1036215). - xfs: detect and handle invalid iclog size set by mkfs (bsc#1043598). - xfs: detect and trim torn writes during log recovery (bsc#1036215). - xfs: fix log recovery corruption error due to tail overwrite (bsc#1036215). - xfs: fix recovery failure when log record header wraps log end (bsc#1036215). - xfs: handle -EFSCORRUPTED during head/tail verification (bsc#1036215). - xfs: prevent creating negative-sized file via INSERT_RANGE (bnc#1012382). - xfs: refactor and open code log record crc check (bsc#1036215). - xfs: refactor log record start detection into a new helper (bsc#1036215). - xfs: return start block of first bad log record during recovery (bsc#1036215). - xfs: support a crc verification only log record pass (bsc#1036215). - x86/bugs: make intel_rds_mask() honor X86_FEATURE_SSBD (bsc#1094019). - watchdog: hpwdt: condition early return of NMI handler on iLO5 (bsc#1085185). - watchdog: hpwdt: Modify to use watchdog core (bsc#1085185). - watchdog: hpwdt: Update nmi_panic message (bsc#1085185). - watchdog: hpwdt: Update Module info and copyright (bsc#1085185).
    last seen 2019-02-21
    modified 2018-09-04
    plugin id 110104
    published 2018-05-25
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=110104
    title openSUSE Security Update : the Linux Kernel (openSUSE-2018-514) (Spectre)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2018-1247-1.NASL
    description This update for the Linux Kernel 3.12.61-52_111 fixes several issues. The following security issues were fixed : - CVE-2018-1000199: A bug in x86 debug register handling of ptrace() could lead to memory corruption, possibly a denial of service or privilege escalation (bsc#1090036). - CVE-2017-0861: Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem in the Linux kernel allowed attackers to gain privileges via unspecified vectors (bsc#1088268). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 109779
    published 2018-05-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109779
    title SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1247-1)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2018-1232-1.NASL
    description This update for the Linux Kernel 3.12.74-60_64_69 fixes several issues. The following security issues were fixed : - CVE-2018-1000199: A bug in x86 debug register handling of ptrace() could lead to memory corruption, possibly a denial of service or privilege escalation (bsc#1090036). - CVE-2017-0861: Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem in the Linux kernel allowed attackers to gain privileges via unspecified vectors (bsc#1088268). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 109767
    published 2018-05-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109767
    title SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1232-1)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2018-1227-1.NASL
    description This update for the Linux Kernel 3.12.74-60_64_82 fixes several issues. The following security issues were fixed : - CVE-2018-1000199: A bug in x86 debug register handling of ptrace() could lead to memory corruption, possibly a denial of service or privilege escalation (bsc#1090036). - CVE-2017-0861: Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem in the Linux kernel allowed attackers to gain privileges via unspecified vectors (bsc#1088268). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 109763
    published 2018-05-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109763
    title SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1227-1)
  • NASL family Amazon Linux Local Security Checks
    NASL id ALA_ALAS-2018-1023.NASL
    description A weakness was found in the Linux kernel's implementation of random seed data. Programs, early in the boot sequence, could use the data allocated for the seed before it was sufficiently generated. (CVE-2018-1108) A flaw was found in the way the Linux kernel handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stack switch operation, the processor did not deliver interrupts and exceptions, rather they are delivered once the first instruction after the stack switch is executed. An unprivileged system user could use this flaw to crash the system kernel resulting in the denial of service. (CVE-2018-8897) A flaw was found in the Linux kernel's implementation of 32-bit syscall interface for bridging. This allowed a privileged user to arbitrarily write to a limited range of kernel memory. (CVE-2018-1068) The Linux kernel is vulerable to a use-after-free flaw when Transformation User configuration interface(CONFIG_XFRM_USER) compile-time configuration were enabled. This vulnerability occurs while closing a xfrm netlink socket in xfrm_dump_policy_done. A user/process could abuse this flaw to potentially escalate their privileges on a system. (CVE-2017-16939) A flaw was found in the Linux kernel where a crash can be triggered from unprivileged userspace during core dump on a POWER system with a certain configuration. This is due to a missing processor feature check and an erroneous use of transactional memory (TM) instructions in the core dump path leading to a denial of service.(CVE-2018-1091) An address corruption flaw was discovered in the Linux kernel built with hardware breakpoint (CONFIG_HAVE_HW_BREAKPOINT) support. While modifying a h/w breakpoint via 'modify_user_hw_breakpoint' routine, an unprivileged user/process could use this flaw to crash the system kernel resulting in DoS OR to potentially escalate privileges on a the system.(CVE-2018-1000199) A flaw was found in the way the Linux kernel's KVM hypervisor handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stack switch operation, the processor did not deliver interrupts and exceptions, rather they are delivered once the first instruction after the stack switch is executed. An unprivileged KVM guest user could use this flaw to crash the guest or, potentially, escalate their privileges in the guest.(CVE-2018-1087) A flaw was found in the Linux kernel's skcipher component, which affects the skcipher_recvmsg function. Attackers using a specific input can lead to a privilege escalation.(CVE-2017-13215) The do_get_mempolicy() function in mm/mempolicy.c in the Linux kernel allows local users to hit a use-after-free bug via crafted system calls and thus cause a denial of service (DoS) or possibly have unspecified other impact. Due to the nature of the flaw, privilege escalation cannot be fully ruled out.(CVE-2018-10675) A flaw was found in Linux kernel's KVM virtualization subsystem. The VMX code does not restore the GDT.LIMIT to the previous host value, but instead sets it to 64KB. With a corrupted GDT limit a host's userspace code has an ability to place malicious entries in the GDT, particularly to the per-cpu variables. An attacker can use this to escalate their privileges.(CVE-2018-10901) A race condition in the store_int_with_restart() function in arch/x86/kernel/cpu/mcheck/mce.c in the Linux kernel allows local users to cause a denial of service (panic) by leveraging root access to write to the check_interval file in a /sys/devices/system/machinecheck/machinecheck directory. (CVE-2018-7995)
    last seen 2019-02-21
    modified 2019-01-25
    plugin id 110197
    published 2018-05-30
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=110197
    title Amazon Linux AMI : kernel (ALAS-2018-1023)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2018-1508-1.NASL
    description This update for the Linux Kernel 4.4.121-92_73 fixes one issue. The following security issue was fixed : - CVE-2018-1000199: - CVE-2018-1000199: An address corruption flaw was discovered while modifying a h/w breakpoint via 'modify_user_hw_breakpoint' routine, an unprivileged user/process could use this flaw to crash the system kernel resulting in DoS OR to potentially escalate privileges on a the system. (bsc#1090036). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 110343
    published 2018-06-06
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=110343
    title SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1508-1)
  • NASL family Huawei Local Security Checks
    NASL id EULEROS_SA-2018-1266.NASL
    description According to the version of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - An address corruption flaw was discovered in the Linux kernel built with hardware breakpoint (CONFIG_HAVE_HW_BREAKPOINT) support. While modifying a h/w breakpoint via 'modify_user_hw_breakpoint' routine, an unprivileged user/process could use this flaw to crash the system kernel resulting in DoS OR to potentially escalate privileges on a the system.(CVE-2018-1000199) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-11-13
    plugin id 117575
    published 2018-09-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=117575
    title EulerOS Virtualization 2.5.0 : kernel (EulerOS-SA-2018-1266)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2018-1222-1.NASL
    description This update for the Linux Kernel 3.12.61-52_89 fixes several issues. The following security issues were fixed : - CVE-2018-1000199: A bug in x86 debug register handling of ptrace() could lead to memory corruption, possibly a denial of service or privilege escalation (bsc#1090036). - CVE-2017-0861: Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem in the Linux kernel allowed attackers to gain privileges via unspecified vectors (bsc#1088268). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 109759
    published 2018-05-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109759
    title SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1222-1)
  • NASL family Virtuozzo Local Security Checks
    NASL id VIRTUOZZO_VZA-2018-030.NASL
    description According to the version of the vzkernel package and the readykernel-patch installed, the Virtuozzo installation on the remote host is affected by the following vulnerabilities : - A flaw was found in how KVM handled exceptions delivered after Mov SS or Pop SS instructions have encountered a breakpoint. As a result, exceptions passed to the guest kernel could have wrong values on the stack. An unprivileged KVM guest user could use this flaw to crash the guest kernel or, potentially, escalate their privileges in the guest system. - The implementation of ptrace in the kernel does not handle errors correctly when working with the debug registers. As a result, the hardware breakpoints could become corrupted. An unprivileged user could exploit this flaw to crash the kernel resulting in a denial-of-service, or, potentially, to escalate their privileges in the system. Note that Tenable Network Security has extracted the preceding description block directly from the Virtuozzo security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2019-01-14
    plugin id 109922
    published 2018-05-21
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109922
    title Virtuozzo 7 : readykernel-patch (VZA-2018-030)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2018-1261-1.NASL
    description This update for the Linux Kernel 3.12.61-52_86 fixes several issues. The following security issues were fixed : - CVE-2018-1000199: A bug in x86 debug register handling of ptrace() could lead to memory corruption, possibly a denial of service or privilege escalation (bsc#1090036). - CVE-2017-0861: Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem in the Linux kernel allowed attackers to gain privileges via unspecified vectors (bsc#1088268). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 109789
    published 2018-05-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109789
    title SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1261-1)
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2018-4126.NASL
    description Description of changes: [4.1.12-124.15.4.el7uek] - x86/bugs/IBRS: Keep SSBD mitigation in effect if spectre_v2=ibrs is selected (Mihai Carabas) - fs/pstore: update the backend parameter in pstore module (Wang Long) [Orabug: 27994372] - kvm: vmx: Reinstate support for CPUs without virtual NMI (Paolo Bonzini) [Orabug: 28041210] - dm crypt: add big-endian variant of plain64 IV (Milan Broz) [Orabug: 28043932] - x86/bugs: Rename SSBD_NO to SSB_NO (Konrad Rzeszutek Wilk) [Orabug: 28063992] {CVE-2018-3639} - KVM: SVM: Implement VIRT_SPEC_CTRL support for SSBD (Tom Lendacky) [Orabug: 28063992] [Orabug: 28069548] {CVE-2018-3639} - x86/speculation, KVM: Implement support for VIRT_SPEC_CTRL/LS_CFG (Thomas Gleixner) [Orabug: 28063992] {CVE-2018-3639} - x86/bugs: Rework spec_ctrl base and mask logic (Thomas Gleixner) [Orabug: 28063992] {CVE-2018-3639} - x86/bugs: Expose x86_spec_ctrl_base directly (Thomas Gleixner) [Orabug: 28063992] {CVE-2018-3639} - x86/bugs: Unify x86_spec_ctrl_{set_guest,restore_host} (Borislav Petkov) [Orabug: 28063992] {CVE-2018-3639} - x86/speculation: Rework speculative_store_bypass_update() (Thomas Gleixner) [Orabug: 28063992] {CVE-2018-3639} - x86/speculation: Add virtualized speculative store bypass disable support (Tom Lendacky) [Orabug: 28063992] {CVE-2018-3639} - x86/bugs, KVM: Extend speculation control for VIRT_SPEC_CTRL (Thomas Gleixner) [Orabug: 28063992] {CVE-2018-3639} - x86/speculation: Handle HT correctly on AMD (Thomas Gleixner) [Orabug: 28063992] {CVE-2018-3639} - x86/cpufeatures: Add FEATURE_ZEN (Thomas Gleixner) [Orabug: 28063992] {CVE-2018-3639} - x86/cpu/AMD: Fix erratum 1076 (CPB bit) (Borislav Petkov) [Orabug: 28063992] {CVE-2018-3639} [4.1.12-124.15.3.el7uek] - perf/hwbp: Simplify the perf-hwbp code, fix documentation (Linus Torvalds) [Orabug: 27947602] {CVE-2018-1000199} - Revert 'perf/hwbp: Simplify the perf-hwbp code, fix documentation' (Brian Maly) [Orabug: 27947602]
    last seen 2019-02-21
    modified 2018-09-05
    plugin id 110404
    published 2018-06-08
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=110404
    title Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2018-4126) (Spectre)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2018-1224-1.NASL
    description This update for the Linux Kernel 3.12.61-52_125 fixes several issues. The following security issues were fixed : - CVE-2018-1000199: A bug in x86 debug register handling of ptrace() could lead to memory corruption, possibly a denial of service or privilege escalation (bsc#1090036). - CVE-2017-0861: Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem in the Linux kernel allowed attackers to gain privileges via unspecified vectors (bsc#1088268). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 109761
    published 2018-05-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109761
    title SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1224-1)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2018-1267-1.NASL
    description This update for the Linux Kernel 3.12.61-52_92 fixes several issues. The following security issues were fixed : - CVE-2018-1000199: A bug in x86 debug register handling of ptrace() could lead to memory corruption, possibly a denial of service or privilege escalation (bsc#1090036). - CVE-2017-0861: Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem in the Linux kernel allowed attackers to gain privileges via unspecified vectors (bsc#1088268). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 109793
    published 2018-05-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109793
    title SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1267-1)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2018-1229-1.NASL
    description This update for the Linux Kernel 3.12.74-60_64_63 fixes several issues. The following security issues were fixed : - CVE-2018-1000199: A bug in x86 debug register handling of ptrace() could lead to memory corruption, possibly a denial of service or privilege escalation (bsc#1090036). - CVE-2017-0861: Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem in the Linux kernel allowed attackers to gain privileges via unspecified vectors (bsc#1088268). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 109764
    published 2018-05-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109764
    title SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1229-1)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2018-1243-1.NASL
    description This update for the Linux Kernel 3.12.61-52_72 fixes several issues. The following security issues were fixed : - CVE-2018-1000199: A bug in x86 debug register handling of ptrace() could lead to memory corruption, possibly a denial of service or privilege escalation (bsc#1090036). - CVE-2017-0861: Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem in the Linux kernel allowed attackers to gain privileges via unspecified vectors (bsc#1088268). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 109776
    published 2018-05-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109776
    title SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1243-1)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2018-1262-1.NASL
    description This update for the Linux Kernel 4.4.59-92_24 fixes several issues. The following security issues were fixed : - CVE-2018-1000199: A bug in x86 debug register handling of ptrace() could lead to memory corruption, possibly a denial of service or privilege escalation (bsc#1090036). - CVE-2017-0861: Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem in the Linux kernel allowed attackers to gain privileges via unspecified vectors (bsc#1088268). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 109790
    published 2018-05-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109790
    title SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1262-1)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2018-1233-1.NASL
    description This update for the Linux Kernel 3.12.61-52_80 fixes several issues. The following security issues were fixed : - CVE-2018-1000199: A bug in x86 debug register handling of ptrace() could lead to memory corruption, possibly a denial of service or privilege escalation (bsc#1090036). - CVE-2017-0861: Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem in the Linux kernel allowed attackers to gain privileges via unspecified vectors (bsc#1088268). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 109768
    published 2018-05-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109768
    title SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1233-1)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2018-1253-1.NASL
    description This update for the Linux Kernel 4.4.74-92_29 fixes several issues. The following security issues were fixed : - CVE-2018-1000199: A bug in x86 debug register handling of ptrace() could lead to memory corruption, possibly a denial of service or privilege escalation (bsc#1090036). - CVE-2017-0861: Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem in the Linux kernel allowed attackers to gain privileges via unspecified vectors (bsc#1088268). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 109782
    published 2018-05-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109782
    title SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1253-1)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2018-1264-1.NASL
    description This update for the Linux Kernel 3.12.74-60_64_45 fixes several issues. The following security issues were fixed : - CVE-2018-1000199: A bug in x86 debug register handling of ptrace() could lead to memory corruption, possibly a denial of service or privilege escalation (bsc#1090036). - CVE-2017-0861: Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem in the Linux kernel allowed attackers to gain privileges via unspecified vectors (bsc#1088268). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 109791
    published 2018-05-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109791
    title SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1264-1)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2018-1550-1.NASL
    description This update for the Linux Kernel 4.4.121-92_80 fixes one issue. The following security issue was fixed : - CVE-2018-1000199: A bug in x86 debug register handling of ptrace() could lead to memory corruption, possibly a denial of service or privilege escalation (bsc#1090036). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 110380
    published 2018-06-06
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=110380
    title SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1550-1)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2018-1242-1.NASL
    description This update for the Linux Kernel 4.4.59-92_20 fixes several issues. The following security issues were fixed : - CVE-2018-1000199: A bug in x86 debug register handling of ptrace() could lead to memory corruption, possibly a denial of service or privilege escalation (bsc#1090036). - CVE-2017-0861: Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem in the Linux kernel allowed attackers to gain privileges via unspecified vectors (bsc#1088268). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 109775
    published 2018-05-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109775
    title SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1242-1)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2018-1251-1.NASL
    description This update for the Linux Kernel 3.12.74-60_64_57 fixes several issues. The following security issues were fixed : - CVE-2018-1000199: A bug in x86 debug register handling of ptrace() could lead to memory corruption, possibly a denial of service or privilege escalation (bsc#1090036). - CVE-2017-0861: Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem in the Linux kernel allowed attackers to gain privileges via unspecified vectors (bsc#1088268). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 109781
    published 2018-05-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109781
    title SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1251-1)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DLA-1369.NASL
    description Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. CVE-2017-0861 Robb Glasser reported a potential use-after-free in the ALSA (sound) PCM core. We believe this was not possible in practice. CVE-2017-5715 Multiple researchers have discovered a vulnerability in various processors supporting speculative execution, enabling an attacker controlling an unprivileged process to read memory from arbitrary addresses, including from the kernel and all other processes running on the system. This specific attack has been named Spectre variant 2 (branch target injection) and is mitigated for the x86 architecture (amd64 and i386) by using the 'retpoline' compiler feature which allows indirect branches to be isolated from speculative execution. CVE-2017-13166 A bug in the 32-bit compatibility layer of the v4l2 ioctl handling code has been found. Memory protections ensuring user-provided buffers always point to userland memory were disabled, allowing destination addresses to be in kernel space. On a 64-bit kernel (amd64 flavour) a local user with access to a suitable video device can exploit this to overwrite kernel memory, leading to privilege escalation. CVE-2017-16526 Andrey Konovalov reported that the UWB subsystem may dereference an invalid pointer in an error case. A local user might be able to use this for denial of service. CVE-2017-16911 Secunia Research reported that the USB/IP vhci_hcd driver exposed kernel heap addresses to local users. This information could aid the exploitation of other vulnerabilities. CVE-2017-16912 Secunia Research reported that the USB/IP stub driver failed to perform a range check on a received packet header field, leading to an out-of-bounds read. A remote user able to connect to the USB/IP server could use this for denial of service. CVE-2017-16913 Secunia Research reported that the USB/IP stub driver failed to perform a range check on a received packet header field, leading to excessive memory allocation. A remote user able to connect to the USB/IP server could use this for denial of service. CVE-2017-16914 Secunia Research reported that the USB/IP stub driver failed to check for an invalid combination of fields in a recieved packet, leading to a NULL pointer dereference. A remote user able to connect to the USB/IP server could use this for denial of service. CVE-2017-18017 Denys Fedoryshchenko reported that the netfilter xt_TCPMSS module failed to validate TCP header lengths, potentially leading to a use-after-free. If this module is loaded, it could be used by a remote attacker for denial of service or possibly for code execution. CVE-2017-18203 Hou Tao reported that there was a race condition in creation and deletion of device-mapper (DM) devices. A local user could potentially use this for denial of service. CVE-2017-18216 Alex Chen reported that the OCFS2 filesystem failed to hold a necessary lock during nodemanager sysfs file operations, potentially leading to a NULL pointer dereference. A local user could use this for denial of service. CVE-2018-1068 The syzkaller tool found that the 32-bit compatibility layer of ebtables did not sufficiently validate offset values. On a 64-bit kernel (amd64 flavour), a local user with the CAP_NET_ADMIN capability could use this to overwrite kernel memory, possibly leading to privilege escalation. CVE-2018-1092 Wen Xu reported that a crafted ext4 filesystem image would trigger a null dereference when mounted. A local user able to mount arbitrary filesystems could use this for denial of service. CVE-2018-5332 Mohamed Ghannam reported that the RDS protocol did not sufficiently validate RDMA requests, leading to an out-of-bounds write. A local attacker on a system with the rds module loaded could use this for denial of service or possibly for privilege escalation. CVE-2018-5333 Mohamed Ghannam reported that the RDS protocol did not properly handle an error case, leading to a NULL pointer dereference. A local attacker on a system with the rds module loaded could possibly use this for denial of service. CVE-2018-5750 Wang Qize reported that the ACPI sbshc driver logged a kernel heap address. This information could aid the exploitation of other vulnerabilities. CVE-2018-5803 Alexey Kodanev reported that the SCTP protocol did not range-check the length of chunks to be created. A local or remote user could use this to cause a denial of service. CVE-2018-6927 Li Jinyue reported that the FUTEX_REQUEUE operation on futexes did not check for negative parameter values, which might lead to a denial of service or other security impact. CVE-2018-7492 The syzkaller tool found that the RDS protocol was lacking a NULL pointer check. A local attacker on a system with the rds module loaded could use this for denial of service. CVE-2018-7566 范龙飞 (Fan LongFei) reported a race condition in the ALSA (sound) sequencer core, between write and ioctl operations. This could lead to an out-of-bounds access or use-after-free. A local user with access to a sequencer device could use this for denial of service or possibly for privilege escalation. CVE-2018-7740 Nic Losby reported that the hugetlbfs filesystem's mmap operation did not properly range-check the file offset. A local user with access to files on a hugetlbfs filesystem could use this to cause a denial of service. CVE-2018-7757 Jason Yan reported a memory leak in the SAS (Serial-Attached SCSI) subsystem. A local user on a system with SAS devices could use this to cause a denial of service. CVE-2018-7995 Seunghun Han reported a race condition in the x86 MCE (Machine Check Exception) driver. This is unlikely to have any security impact. CVE-2018-8781 Eyal Itkin reported that the udl (DisplayLink) driver's mmap operation did not properly range-check the file offset. A local user with access to a udl framebuffer device could exploit this to overwrite kernel memory, leading to privilege escalation. CVE-2018-8822 Dr Silvio Cesare of InfoSect reported that the ncpfs client implementation did not validate reply lengths from the server. An ncpfs server could use this to cause a denial of service or remote code execution in the client. CVE-2018-1000004 Luo Quan reported a race condition in the ALSA (sound) sequencer core, between multiple ioctl operations. This could lead to a deadlock or use-after-free. A local user with access to a sequencer device could use this for denial of service or possibly for privilege escalation. CVE-2018-1000199 Andy Lutomirski discovered that the ptrace subsystem did not sufficiently validate hardware breakpoint settings. Local users can use this to cause a denial of service, or possibly for privilege escalation, on x86 (amd64 and i386) and possibly other architectures. Additionally, some mitigations for CVE-2017-5753 are included in this release : CVE-2017-5753 Multiple researchers have discovered a vulnerability in various processors supporting speculative execution, enabling an attacker controlling an unprivileged process to read memory from arbitrary addresses, including from the kernel and all other processes running on the system. This specific attack has been named Spectre variant 1 (bounds-check bypass) and is mitigated by identifying vulnerable code sections (array bounds checking followed by array access) and replacing the array access with the speculation-safe array_index_nospec() function. More use sites will be added over time. For Debian 7 'Wheezy', these problems have been fixed in version 3.2.101-1. This version also includes bug fixes from upstream versions up to and including 3.2.101. It also fixes a regression in the procfs hidepid option in the previous version (Debian bug #887106). We recommend that you upgrade your linux packages. NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-07-06
    plugin id 109531
    published 2018-05-03
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109531
    title Debian DLA-1369-1 : linux security update (Spectre)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-4188.NASL
    description Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. - CVE-2017-5715 Multiple researchers have discovered a vulnerability in various processors supporting speculative execution, enabling an attacker controlling an unprivileged process to read memory from arbitrary addresses, including from the kernel and all other processes running on the system. This specific attack has been named Spectre variant 2 (branch target injection) and is mitigated for the x86 architecture (amd64 and i386) by using the 'retpoline' compiler feature which allows indirect branches to be isolated from speculative execution. - CVE-2017-5753 Multiple researchers have discovered a vulnerability in various processors supporting speculative execution, enabling an attacker controlling an unprivileged process to read memory from arbitrary addresses, including from the kernel and all other processes running on the system. This specific attack has been named Spectre variant 1 (bounds-check bypass) and is mitigated by identifying vulnerable code sections (array bounds checking followed by array access) and replacing the array access with the speculation-safe array_index_nospec() function. More use sites will be added over time. - CVE-2017-17975 Tuba Yavuz reported a use-after-free flaw in the USBTV007 audio-video grabber driver. A local user could use this for denial of service by triggering failure of audio registration. - CVE-2017-18193 Yunlei He reported that the f2fs implementation does not properly handle extent trees, allowing a local user to cause a denial of service via an application with multiple threads. - CVE-2017-18216 Alex Chen reported that the OCFS2 filesystem failed to hold a necessary lock during nodemanager sysfs file operations, potentially leading to a NULL pointer dereference. A local user could use this for denial of service. - CVE-2017-18218 Jun He reported a use-after-free flaw in the Hisilicon HNS ethernet driver. A local user could use this for denial of service. - CVE-2017-18222 It was reported that the Hisilicon Network Subsystem (HNS) driver implementation does not properly handle ethtool private flags. A local user could use this for denial of service or possibly have other impact. - CVE-2017-18224 Alex Chen reported that the OCFS2 filesystem omits the use of a semaphore and consequently has a race condition for access to the extent tree during read operations in DIRECT mode. A local user could use this for denial of service. - CVE-2017-18241 Yunlei He reported that the f2fs implementation does not properly initialise its state if the 'noflush_merge' mount option is used. A local user with access to a filesystem mounted with this option could use this to cause a denial of service. - CVE-2017-18257 It was reported that the f2fs implementation is prone to an infinite loop caused by an integer overflow in the __get_data_block() function. A local user can use this for denial of service via crafted use of the open and fallocate system calls with an FS_IOC_FIEMAP ioctl. - CVE-2018-1065 The syzkaller tool found a NULL pointer dereference flaw in the netfilter subsystem when handling certain malformed iptables rulesets. A local user with the CAP_NET_RAW or CAP_NET_ADMIN capability (in any user namespace) could use this to cause a denial of service. Debian disables unprivileged user namespaces by default. - CVE-2018-1066 Dan Aloni reported to Red Hat that the CIFS client implementation would dereference a NULL pointer if the server sent an invalid response during NTLMSSP setup negotiation. This could be used by a malicious server for denial of service. - CVE-2018-1068 The syzkaller tool found that the 32-bit compatibility layer of ebtables did not sufficiently validate offset values. On a 64-bit kernel, a local user with the CAP_NET_ADMIN capability (in any user namespace) could use this to overwrite kernel memory, possibly leading to privilege escalation. Debian disables unprivileged user namespaces by default. - CVE-2018-1092 Wen Xu reported that a crafted ext4 filesystem image would trigger a null dereference when mounted. A local user able to mount arbitrary filesystems could use this for denial of service. - CVE-2018-1093 Wen Xu reported that a crafted ext4 filesystem image could trigger an out-of-bounds read in the ext4_valid_block_bitmap() function. A local user able to mount arbitrary filesystems could use this for denial of service. - CVE-2018-1108 Jann Horn reported that crng_ready() does not properly handle the crng_init variable states and the RNG could be treated as cryptographically safe too early after system boot. - CVE-2018-5803 Alexey Kodanev reported that the SCTP protocol did not range-check the length of chunks to be created. A local or remote user could use this to cause a denial of service. - CVE-2018-7480 Hou Tao discovered a double-free flaw in the blkcg_init_queue() function in block/blk-cgroup.c. A local user could use this to cause a denial of service or have other impact. - CVE-2018-7566 Fan LongFei reported a race condition in the ALSA (sound) sequencer core, between write and ioctl operations. This could lead to an out-of-bounds access or use-after-free. A local user with access to a sequencer device could use this for denial of service or possibly for privilege escalation. - CVE-2018-7740 Nic Losby reported that the hugetlbfs filesystem's mmap operation did not properly range-check the file offset. A local user with access to files on a hugetlbfs filesystem could use this to cause a denial of service. - CVE-2018-7757 Jason Yan reported a memory leak in the SAS (Serial-Attached SCSI) subsystem. A local user on a system with SAS devices could use this to cause a denial of service. - CVE-2018-7995 Seunghun Han reported a race condition in the x86 MCE (Machine Check Exception) driver. This is unlikely to have any security impact. - CVE-2018-8087 A memory leak flaw was found in the hwsim_new_radio_nl() function in the simulated radio testing tool driver for mac80211, allowing a local user to cause a denial of service. - CVE-2018-8781 Eyal Itkin reported that the udl (DisplayLink) driver's mmap operation did not properly range-check the file offset. A local user with access to a udl framebuffer device could exploit this to overwrite kernel memory, leading to privilege escalation. - CVE-2018-8822 Dr Silvio Cesare of InfoSect reported that the ncpfs client implementation did not validate reply lengths from the server. An ncpfs server could use this to cause a denial of service or remote code execution in the client. - CVE-2018-10323 Wen Xu reported a NULL pointer dereference flaw in the xfs_bmapi_write() function triggered when mounting and operating a crafted xfs filesystem image. A local user able to mount arbitrary filesystems could use this for denial of service. - CVE-2018-1000199 Andy Lutomirski discovered that the ptrace subsystem did not sufficiently validate hardware breakpoint settings. Local users can use this to cause a denial of service, or possibly for privilege escalation, on x86 (amd64 and i386) and possibly other architectures.
    last seen 2019-02-21
    modified 2018-11-13
    plugin id 109518
    published 2018-05-02
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109518
    title Debian DSA-4188-1 : linux - security update (Spectre)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2018-1354.NASL
    description An update for kernel-rt is now available for Red Hat Enterprise MRG 2. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es) : * Kernel: error in exception handling leads to DoS (CVE-2018-8897) * kernel: ptrace() incorrect error handling leads to corruption and DoS (CVE-2018-1000199) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Red Hat would like to thank Nick Peterson (Everdox Tech LLC) and Andy Lutomirski for reporting CVE-2018-8897 and Andy Lutomirski for reporting CVE-2018-1000199.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 109754
    published 2018-05-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109754
    title RHEL 6 : MRG (RHSA-2018:1354)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2018-1237-1.NASL
    description This update for the Linux Kernel 3.12.74-60_64_66 fixes several issues. The following security issues were fixed : - CVE-2018-1000199: A bug in x86 debug register handling of ptrace() could lead to memory corruption, possibly a denial of service or privilege escalation (bsc#1090036). - CVE-2017-0861: Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem in the Linux kernel allowed attackers to gain privileges via unspecified vectors (bsc#1088268). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 109772
    published 2018-05-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109772
    title SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1237-1)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2018-1266-1.NASL
    description This update for the Linux Kernel 3.12.74-60_64_40 fixes several issues. The following security issues were fixed : - CVE-2018-1000199: A bug in x86 debug register handling of ptrace() could lead to memory corruption, possibly a denial of service or privilege escalation (bsc#1090036). - CVE-2017-0861: Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem in the Linux kernel allowed attackers to gain privileges via unspecified vectors (bsc#1088268). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 109792
    published 2018-05-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109792
    title SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1266-1)
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2018-4164.NASL
    description Description of changes: kernel-uek kernel-uek [3.8.13-118.22.1.el7uek] - dm: fix race between dm_get_from_kobject() and __dm_destroy() (Hou Tao) {CVE-2017-18203} - drm: udl: Properly check framebuffer mmap offsets (Greg Kroah-Hartman) [Orabug: 27986407] {CVE-2018-8781} - kernel/exit.c: avoid undefined behaviour when calling wait4() wait4(-2147483648, 0x20, 0, 0xdd0000) triggers: UBSAN: Undefined behaviour in kernel/exit.c:1651:9 (mridula shastry) [Orabug: 27875488] {CVE-2018-10087} - kernel/signal.c: avoid undefined behaviour in kill_something_info When running kill(72057458746458112, 0) in userspace I hit the following issue. (mridula shastry) {CVE-2018-10124} - bluetooth: Validate socket address length in sco_sock_bind(). (mlevatic) [Orabug: 28130293] {CVE-2015-8575} - dccp: check sk for closed state in dccp_sendmsg() (Alexey Kodanev) [Orabug: 28220402] {CVE-2017-8824} {CVE-2018-1130} - sctp: verify size of a new chunk in _sctp_make_chunk() (Alexey Kodanev) [Orabug: 28240075] {CVE-2018-5803} - mm/mempolicy.c: fix error handling in set_mempolicy and mbind. (Chris Salls) [Orabug: 28242478] {CVE-2017-7616} - xfrm: policy: check policy direction value (Vladis Dronov) [Orabug: 28264121] {CVE-2017-11600} {CVE-2017-11600} - x86/fpu: Make eager FPU default (Mihai Carabas) [Orabug: 28156176] {CVE-2018-3665} - KVM: Fix stack-out-of-bounds read in write_mmio (Wanpeng Li) [Orabug: 27951287] {CVE-2017-17741} {CVE-2017-17741} - xfs: set format back to extents if xfs_bmap_extents_to_btree (Eric Sandeen) [Orabug: 27989498] {CVE-2018-10323} - Bluetooth: Prevent stack info leak from the EFS element. (Ben Seri) [Orabug: 28030520] {CVE-2017-1000410} {CVE-2017-1000410} - ALSA: hrtimer: Fix stall by hrtimer_cancel() (Takashi Iwai) [Orabug: 28058229] {CVE-2016-2549} - ALSA: timer: Harden slave timer list handling (Takashi Iwai) [Orabug: 28058229] {CVE-2016-2547} {CVE-2016-2548} - ALSA: timer: Fix double unlink of active_list (Takashi Iwai) [Orabug: 28058229] {CVE-2016-2545} - ALSA: seq: Fix missing NULL check at remove_events ioctl (Takashi Iwai) [Orabug: 28058229] {CVE-2016-2543} - ALSA: seq: Fix race at timer setup and close (Takashi Iwai) [Orabug: 28058229] {CVE-2016-2544} - ALSA: usb-audio: avoid freeing umidi object twice (Andrey Konovalov) [Orabug: 28058229] {CVE-2016-2384} - perf/hwbp: Simplify the perf-hwbp code, fix documentation (Linus Torvalds) [Orabug: 27947608] {CVE-2018-1000199} - Revert 'perf/hwbp: Simplify the perf-hwbp code, fix documentation' (Brian Maly) [Orabug: 27947608]
    last seen 2019-02-21
    modified 2018-07-11
    plugin id 110998
    published 2018-07-11
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=110998
    title Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2018-4164)
  • NASL family Huawei Local Security Checks
    NASL id EULEROS_SA-2018-1263.NASL
    description According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the development of some or all operating-system kernels, resulting in unexpected behavior for #DB exceptions that are deferred by MOV SS or POP SS, as demonstrated by (for example) privilege escalation in Windows, macOS, some Xen configurations, or FreeBSD, or a Linux kernel crash. The MOV to SS and POP SS instructions inhibit interrupts (including NMIs), data breakpoints, and single step trap exceptions until the instruction boundary following the next instruction (SDM Vol. 3A; section 6.8.3). (The inhibited data breakpoints are those on memory accessed by the MOV to SS or POP to SS instruction itself.) Note that debug exceptions are not inhibited by the interrupt enable (EFLAGS.IF) system flag (SDM Vol. 3A; section 2.3). If the instruction following the MOV to SS or POP to SS instruction is an instruction like SYSCALL, SYSENTER, INT 3, etc. that transfers control to the operating system at CPL < 3, the debug exception is delivered after the transfer to CPL < 3 is complete. OS kernels may not expect this order of events and may therefore experience unexpected behavior when it occurs.(CVE-2018-8897) - A null pointer dereference in dccp_write_xmit() function in net/dccp/output.c in the Linux kernel allows a local user to cause a denial of service by a number of certain crafted system calls.(CVE-2018-1130) - The cdrom_ioctl_media_changed function in drivers/cdrom/cdrom.c in the Linux kernel before 4.16.6 allows local attackers to use a incorrect bounds check in the CDROM driver CDROM_MEDIA_CHANGED ioctl to read out kernel memory.(CVE-2018-10940) - An address corruption flaw was discovered in the Linux kernel built with hardware breakpoint (CONFIG_HAVE_HW_BREAKPOINT) support. While modifying a h/w breakpoint via 'modify_user_hw_breakpoint' routine, an unprivileged user/process could use this flaw to crash the system kernel resulting in DoS OR to potentially escalate privileges on a the system.(CVE-2018-1000199) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-11-13
    plugin id 117572
    published 2018-09-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=117572
    title EulerOS Virtualization 2.5.1 : kernel (EulerOS-SA-2018-1263)
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20180508_KERNEL_ON_SL7_X.NASL
    description Security Fix(es) : - Kernel: KVM: error in exception handling leads to wrong debug stack value (CVE-2018-1087) - Kernel: error in exception handling leads to DoS (CVE-2018-8897) - Kernel: ipsec: xfrm: use-after-free leading to potential privilege escalation (CVE-2017-16939) - kernel: Out-of-bounds write via userland offsets in ebt_entry struct in netfilter/ebtables.c (CVE-2018-1068) - kernel: ptrace() incorrect error handling leads to corruption and DoS (CVE-2018-1000199) - kernel: guest kernel crash during core dump on POWER9 host (CVE-2018-1091)
    last seen 2019-02-21
    modified 2018-12-27
    plugin id 109644
    published 2018-05-09
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109644
    title Scientific Linux Security Update : kernel on SL7.x x86_64
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2018-1374.NASL
    description An update for kernel-alt is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The kernel-alt packages provide the Linux kernel version 4.x. Security Fix(es) : * kernel: ptrace() incorrect error handling leads to corruption and DoS (CVE-2018-1000199) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Red Hat would like to thank Andy Lutomirski for reporting this issue. Bug Fix(es) : * Previously, the nfs_commit_inode() function did not respect the FLUSH_SYNC argument and exited even if there were already the in-flight COMMIT requests. As a consequence, the mmap() system call occasionally returned the EBUSY error on NFS, and CPU soft lockups occurred during a writeback on NFS. This update fixes nfs_commit_inode() to respect FLUSH_SYNC. As a result, mmap() does not return EBUSY, and the CPU soft lockups no longer occur during NFS writebacks. (BZ#1559869) * Recent IBM z Systems hardware contains an extension to the time-of-day clock that ensures it will be operational after the year 2042 by avoiding an overflow that would happen without it. However, the KVM hypervisor was previously unable to handle the extension correctly, which lead to guests freezing if their kernel supported the time-of-day clock extension. This update adds support for the extension to the KVM hypervisor, and KVM guests which support it no longer freeze. (BZ#1559871) * This update provides the ability to disable the 'RFI Flush' mitigation mechanism for the Meltdown vulnerability (CVE-2017-5754) in the kernel. The patches that mitigate the effect of Meltdown may have negative impact on performance when the mechanism they provide is enabled, and at the same time your systems may not need this mitigation if they are secured by other means. The vulnerability mitigation remains enabled by default and must be disabled manually; this restores system performance to original levels, but the system then also remains vulnerable to Meltdown. Instructions describing how to disable RFI Flush, as well as additional information, is provided in the following Red Hat Knowledgebase article: https:// access.redhat.com/articles/3311301 (BZ#1561463)
    last seen 2019-02-21
    modified 2018-11-26
    plugin id 109831
    published 2018-05-16
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109831
    title RHEL 7 : kernel-alt (RHSA-2018:1374)
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2018-1318.NASL
    description From Red Hat Security Advisory 2018:1318 : An update for kernel is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es) : * Kernel: KVM: error in exception handling leads to wrong debug stack value (CVE-2018-1087) * Kernel: error in exception handling leads to DoS (CVE-2018-8897) * Kernel: ipsec: xfrm: use-after-free leading to potential privilege escalation (CVE-2017-16939) * kernel: Out-of-bounds write via userland offsets in ebt_entry struct in netfilter/ebtables.c (CVE-2018-1068) * kernel: ptrace() incorrect error handling leads to corruption and DoS (CVE-2018-1000199) * kernel: guest kernel crash during core dump on POWER9 host (CVE-2018-1091) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Red Hat would like to thank Andy Lutomirski for reporting CVE-2018-1087 and CVE-2018-1000199 and Nick Peterson (Everdox Tech LLC) and Andy Lutomirski for reporting CVE-2018-8897. Bug Fix(es) : These updated kernel packages include also numerous bug fixes. Space precludes documenting all of these bug fixes in this advisory. See the bug fix descriptions in the related Knowledge Article: https://access.redhat.com/ articles/3431641
    last seen 2019-02-21
    modified 2018-07-16
    plugin id 109665
    published 2018-05-10
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109665
    title Oracle Linux 7 : kernel (ELSA-2018-1318)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2018-1241-1.NASL
    description This update for the Linux Kernel 4.4.90-92_50 fixes several issues. The following security issues were fixed : - CVE-2018-1000199: A bug in x86 debug register handling of ptrace() could lead to memory corruption, possibly a denial of service or privilege escalation (bsc#1090036). - CVE-2017-0861: Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem in the Linux kernel allowed attackers to gain privileges via unspecified vectors (bsc#1088268). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 109774
    published 2018-05-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109774
    title SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1241-1)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2018-1250-1.NASL
    description This update for the Linux Kernel 4.4.103-92_53 fixes several issues. The following security issues were fixed : - CVE-2018-1000199: A bug in x86 debug register handling of ptrace() could lead to memory corruption, possibly a denial of service or privilege escalation (bsc#1090036). - CVE-2017-0861: Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem in the Linux kernel allowed attackers to gain privileges via unspecified vectors (bsc#1088268). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 109780
    published 2018-05-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109780
    title SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1250-1)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2018-1226-1.NASL
    description This update for the Linux Kernel 3.12.61-52_83 fixes several issues. The following security issues were fixed : - CVE-2018-1000199: A bug in x86 debug register handling of ptrace() could lead to memory corruption, possibly a denial of service or privilege escalation (bsc#1090036). - CVE-2017-0861: Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem in the Linux kernel allowed attackers to gain privileges via unspecified vectors (bsc#1088268). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 109762
    published 2018-05-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109762
    title SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1226-1)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2018-1244-1.NASL
    description This update for the Linux Kernel 3.12.61-52_77 fixes several issues. The following security issues were fixed : - CVE-2018-1000199: A bug in x86 debug register handling of ptrace() could lead to memory corruption, possibly a denial of service or privilege escalation (bsc#1090036). - CVE-2017-0861: Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem in the Linux kernel allowed attackers to gain privileges via unspecified vectors (bsc#1088268). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 109777
    published 2018-05-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109777
    title SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1244-1)
  • NASL family Huawei Local Security Checks
    NASL id EULEROS_SA-2018-1132.NASL
    description According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - ALSA sequencer core initializes the event pool on demand by invoking snd_seq_pool_init() when the first write happens and the pool is empty. A user can reset the pool size manually via ioctl concurrently, and this may lead to UAF or out-of-bound access.(CVE-2018-7566) - The do_get_mempolicy() function in mm/mempolicy.c in the Linux kernel allows local users to hit a use-after-free bug via crafted system calls and thus cause a denial of service (DoS) or possibly have unspecified other impact. Due to the nature of the flaw, privilege escalation cannot be fully ruled out.(CVE-2018-10675) - The Linux kernel has an undefined behavior when an argument of INT_MIN is passed to the kernel/signal.c:kill_something_info() function. A local attacker may be able to exploit this to cause a denial of service.(CVE-2018-10124) - A an integer overflow vulnerability was discovered in the Linux kernel, from version 3.4 through 4.15, in the drivers/gpu/drm/udl/udl_fb.c:udl_fb_mmap() function. An attacker with access to the udldrmfb driver could exploit this to obtain full read and write permissions on kernel physical pages, resulting in a code execution in kernel space.(CVE-2018-8781) - The code in the drivers/scsi/libsas/sas_scsi_host.c file in the Linux kernel allow a physically proximate attacker to cause a memory leak in the ATA command queue and, thus, denial of service by triggering certain failure conditions.(CVE-2018-10021) - A flaw was found in the Linux kernel's implementation of 32-bit syscall interface for bridging. This allowed a privileged user to arbitrarily write to a limited range of kernel memory.(CVE-2018-1068) - A vulnerability was found in the Linux kernel's kernel/events/core.c:perf_cpu_time_max_percent_handler( ) function. Local privileged users could exploit this flaw to cause a denial of service due to integer overflow or possibly have unspecified other impact.(CVE-2017-18255) - The kernel_wait4 function in kernel/exit.c in the Linux kernel, when an unspecified architecture and compiler is used, might allow local users to cause a denial of service by triggering an attempted use of the -INT_MIN value.(CVE-2018-10087) - A null pointer dereference in dccp_write_xmit() function in net/dccp/output.c in the Linux kernel allows a local user to cause a denial of service by a number of certain crafted system calls.(CVE-2018-1130) - An address corruption flaw was discovered in the Linux kernel built with hardware breakpoint (CONFIG_HAVE_HW_BREAKPOINT) support. While modifying a h/w breakpoint via 'modify_user_hw_breakpoint' routine, an unprivileged user/process could use this flaw to crash the system kernel resulting in DoS OR to potentially escalate privileges on a the system.(CVE-2018-1000199) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2019-02-12
    plugin id 110136
    published 2018-05-29
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=110136
    title EulerOS 2.0 SP1 : kernel (EulerOS-SA-2018-1132)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2018-1375-1.NASL
    description The SUSE Linux Enterprise 12 SP1 LTSS kernel was updated to receive various security and bugfixes. The following security bugs were fixed : - CVE-2018-3639: Information leaks using 'Memory Disambiguation' feature in modern CPUs were mitigated, aka 'Spectre Variant 4' (bnc#1087082). A new boot commandline option was introduced, 'spec_store_bypass_disable', which can have following values : - auto: Kernel detects whether your CPU model contains an implementation of Speculative Store Bypass and picks the most appropriate mitigation. - on: disable Speculative Store Bypass - off: enable Speculative Store Bypass - prctl: Control Speculative Store Bypass per thread via prctl. Speculative Store Bypass is enabled for a process by default. The state of the control is inherited on fork. - seccomp: Same as 'prctl' above, but all seccomp threads will disable SSB unless they explicitly opt out. The default is 'seccomp', meaning programs need explicit opt-in into the mitigation. Status can be queried via the /sys/devices/system/cpu/vulnerabilities/spec_store_bypas s file, containing : - 'Vulnerable' - 'Mitigation: Speculative Store Bypass disabled' - 'Mitigation: Speculative Store Bypass disabled via prctl' - 'Mitigation: Speculative Store Bypass disabled via prctl and seccomp' - CVE-2018-1000199: An address corruption flaw was discovered while modifying a h/w breakpoint via 'modify_user_hw_breakpoint' routine, an unprivileged user/process could use this flaw to crash the system kernel resulting in DoS OR to potentially escalate privileges on a the system. (bsc#1089895) - CVE-2018-10675: The do_get_mempolicy function in mm/mempolicy.c allowed local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted system calls (bnc#1091755). The update package also includes non-security fixes. See advisory for details. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 110040
    published 2018-05-23
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=110040
    title SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1375-1) (Spectre)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2018-1376-1.NASL
    description The SUSE Linux Enterprise 11 SP3 LTSS kernel was updated to receive various security and bugfixes. The following security bugs were fixed : - CVE-2018-3639: Information leaks using 'Memory Disambiguation' feature in modern CPUs were mitigated, aka 'Spectre Variant 4' (bnc#1087082). A new boot commandline option was introduced, 'spec_store_bypass_disable', which can have following values : - auto: Kernel detects whether your CPU model contains an implementation of Speculative Store Bypass and picks the most appropriate mitigation. - on: disable Speculative Store Bypass - off: enable Speculative Store Bypass - prctl: Control Speculative Store Bypass per thread via prctl. Speculative Store Bypass is enabled for a process by default. The state of the control is inherited on fork. - seccomp: Same as 'prctl' above, but all seccomp threads will disable SSB unless they explicitly opt out. The default is 'seccomp', meaning programs need explicit opt-in into the mitigation. Status can be queried via the /sys/devices/system/cpu/vulnerabilities/spec_store_bypas s file, containing : - 'Vulnerable' - 'Mitigation: Speculative Store Bypass disabled' - 'Mitigation: Speculative Store Bypass disabled via prctl' - 'Mitigation: Speculative Store Bypass disabled via prctl and seccomp' - CVE-2018-1000199: An address corruption flaw was discovered while modifying a h/w breakpoint via 'modify_user_hw_breakpoint' routine, an unprivileged user/process could use this flaw to crash the system kernel resulting in DoS OR to potentially escalate privileges on a the system. (bsc#1089895) - CVE-2018-10675: The do_get_mempolicy function in mm/mempolicy.c allowed local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted system calls (bnc#1091755). - CVE-2017-5715: The retpoline mitigation for Spectre v2 has been enabled also for 32bit x86. - CVE-2017-5753: Spectre v1 mitigations have been improved by the versions merged from the upstream kernel. The update package also includes non-security fixes. See advisory for details. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 110041
    published 2018-05-23
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=110041
    title SUSE SLES11 Security Update : kernel (SUSE-SU-2018:1376-1) (Spectre)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2018-1368-1.NASL
    description The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes. The following security bugs were fixed : - CVE-2018-3639: Information leaks using 'Memory Disambiguation' feature in modern CPUs were mitigated, aka 'Spectre Variant 4' (bnc#1087082). A new boot commandline option was introduced, 'spec_store_bypass_disable', which can have following values : - auto: Kernel detects whether your CPU model contains an implementation of Speculative Store Bypass and picks the most appropriate mitigation. - on: disable Speculative Store Bypass - off: enable Speculative Store Bypass - prctl: Control Speculative Store Bypass per thread via prctl. Speculative Store Bypass is enabled for a process by default. The state of the control is inherited on fork. - seccomp: Same as 'prctl' above, but all seccomp threads will disable SSB unless they explicitly opt out. The default is 'seccomp', meaning programs need explicit opt-in into the mitigation. Status can be queried via the /sys/devices/system/cpu/vulnerabilities/spec_store_bypas s file, containing : - 'Vulnerable' - 'Mitigation: Speculative Store Bypass disabled' - 'Mitigation: Speculative Store Bypass disabled via prctl' - 'Mitigation: Speculative Store Bypass disabled via prctl and seccomp' - CVE-2018-1000199: An address corruption flaw was discovered while modifying a h/w breakpoint via 'modify_user_hw_breakpoint' routine, an unprivileged user/process could use this flaw to crash the system kernel resulting in DoS OR to potentially escalate privileges on a the system. (bsc#1089895) - CVE-2018-10675: The do_get_mempolicy function in mm/mempolicy.c allowed local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted system calls (bnc#1091755). - CVE-2017-5715: The retpoline mitigation for Spectre v2 has been enabled also for 32bit x86. - CVE-2017-5753: Spectre v1 mitigations have been improved by the versions merged from the upstream kernel. The update package also includes non-security fixes. See advisory for details. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 110035
    published 2018-05-23
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=110035
    title SUSE SLES11 Security Update : kernel (SUSE-SU-2018:1368-1) (Spectre)
  • NASL family OracleVM Local Security Checks
    NASL id ORACLEVM_OVMSA-2018-0231.NASL
    description The remote OracleVM system is missing necessary patches to address critical security updates : - x86/fpu: Make eager FPU default (Mihai Carabas) [Orabug: 28156176] (CVE-2018-3665) - KVM: Fix stack-out-of-bounds read in write_mmio (Wanpeng Li) [Orabug: 27951287] (CVE-2017-17741) (CVE-2017-17741) - xfs: set format back to extents if xfs_bmap_extents_to_btree (Eric Sandeen) [Orabug: 27989498] (CVE-2018-10323) - Bluetooth: Prevent stack info leak from the EFS element. (Ben Seri) [Orabug: 28030520] (CVE-2017-1000410) (CVE-2017-1000410) - ALSA: hrtimer: Fix stall by hrtimer_cancel (Takashi Iwai) [Orabug: 28058229] (CVE-2016-2549) - ALSA: timer: Harden slave timer list handling (Takashi Iwai) [Orabug: 28058229] (CVE-2016-2547) (CVE-2016-2548) - ALSA: timer: Fix double unlink of active_list (Takashi Iwai) [Orabug: 28058229] (CVE-2016-2545) - ALSA: seq: Fix missing NULL check at remove_events ioctl (Takashi Iwai) [Orabug: 28058229] (CVE-2016-2543) - ALSA: seq: Fix race at timer setup and close (Takashi Iwai) [Orabug: 28058229] (CVE-2016-2544) - ALSA: usb-audio: avoid freeing umidi object twice (Andrey Konovalov) [Orabug: 28058229] (CVE-2016-2384) - perf/hwbp: Simplify the perf-hwbp code, fix documentation (Linus Torvalds) [Orabug: 27947608] (CVE-2018-1000199) - Revert 'perf/hwbp: Simplify the perf-hwbp code, fix documentation' (Brian Maly) [Orabug: 27947608]
    last seen 2019-02-21
    modified 2018-07-24
    plugin id 110581
    published 2018-06-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=110581
    title OracleVM 3.3 : Unbreakable / etc (OVMSA-2018-0231)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2018-1347.NASL
    description An update for kernel is now available for Red Hat Enterprise Linux 7.2 Advanced Update Support, Red Hat Enterprise Linux 7.2 Telco Extended Update Support, and Red Hat Enterprise Linux 7.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es) : * Kernel: KVM: error in exception handling leads to wrong debug stack value (CVE-2018-1087) * Kernel: error in exception handling leads to DoS (CVE-2018-8897) * kernel: ptrace() incorrect error handling leads to corruption and DoS (CVE-2018-1000199) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Red Hat would like to thank Andy Lutomirski for reporting CVE-2018-1087 and CVE-2018-1000199 and Nick Peterson (Everdox Tech LLC) and Andy Lutomirski for reporting CVE-2018-8897.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 109637
    published 2018-05-09
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109637
    title RHEL 7 : kernel (RHSA-2018:1347)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2018-1348.NASL
    description An update for kernel is now available for Red Hat Enterprise Linux 7.3 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es) : * Kernel: KVM: error in exception handling leads to wrong debug stack value (CVE-2018-1087) * Kernel: error in exception handling leads to DoS (CVE-2018-8897) * kernel: ptrace() incorrect error handling leads to corruption and DoS (CVE-2018-1000199) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Red Hat would like to thank Andy Lutomirski for reporting CVE-2018-1087 and CVE-2018-1000199 and Nick Peterson (Everdox Tech LLC) and Andy Lutomirski for reporting CVE-2018-8897.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 109638
    published 2018-05-09
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109638
    title RHEL 7 : kernel (RHSA-2018:1348)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2018-1525-1.NASL
    description This update for the Linux Kernel 3.12.61-52_128 fixes one issue. The following security issue was fixed : - CVE-2018-1000199: - CVE-2018-1000199: An address corruption flaw was discovered while modifying a h/w breakpoint via 'modify_user_hw_breakpoint' routine, an unprivileged user/process could use this flaw to crash the system kernel resulting in DoS OR to potentially escalate privileges on a the system. (bsc#1090036). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 110359
    published 2018-06-06
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=110359
    title SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1525-1)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2018-1258-1.NASL
    description This update for the Linux Kernel 4.4.114-92_64 fixes one issue. The following security issue was fixed : - CVE-2018-1000199: A bug in x86 debug register handling of ptrace() could lead to memory corruption, possibly a denial of service or privilege escalation (bsc#1090036). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 109787
    published 2018-05-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109787
    title SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1258-1)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2018-1223-1.NASL
    description This update for the Linux Kernel 4.4.114-92_67 fixes one issue. The following security issue was fixed : - CVE-2018-1000199: A bug in x86 debug register handling of ptrace() could lead to memory corruption, possibly a denial of service or privilege escalation (bsc#1090036). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 109760
    published 2018-05-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109760
    title SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1223-1)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2018-1366-1.NASL
    description The SUSE Linux Enterprise 12 SP3 kernel was updated to 4.4.131 to receive various security and bugfixes. The following security bugs were fixed : - CVE-2018-3639: Information leaks using 'Memory Disambiguation' feature in modern CPUs were mitigated, aka 'Spectre Variant 4' (bnc#1087082). A new boot commandline option was introduced, 'spec_store_bypass_disable', which can have following values : - auto: Kernel detects whether your CPU model contains an implementation of Speculative Store Bypass and picks the most appropriate mitigation. - on: disable Speculative Store Bypass - off: enable Speculative Store Bypass - prctl: Control Speculative Store Bypass per thread via prctl. Speculative Store Bypass is enabled for a process by default. The state of the control is inherited on fork. - seccomp: Same as 'prctl' above, but all seccomp threads will disable SSB unless they explicitly opt out. The default is 'seccomp', meaning programs need explicit opt-in into the mitigation. Status can be queried via the /sys/devices/system/cpu/vulnerabilities/spec_store_bypas s file, containing : - 'Vulnerable' - 'Mitigation: Speculative Store Bypass disabled' - 'Mitigation: Speculative Store Bypass disabled via prctl' - 'Mitigation: Speculative Store Bypass disabled via prctl and seccomp' - CVE-2018-8781: The udl_fb_mmap function in drivers/gpu/drm/udl/udl_fb.c had an integer-overflow vulnerability allowing local users with access to the udldrmfb driver to obtain full read and write permissions on kernel physical pages, resulting in a code execution in kernel space (bnc#1090643). - CVE-2018-10124: The kill_something_info function in kernel/signal.c might have allowed local users to cause a denial of service via an INT_MIN argument (bnc#1089752). - CVE-2018-10087: The kernel_wait4 function in kernel/exit.c might have allowed local users to cause a denial of service by triggering an attempted use of the -INT_MIN value (bnc#1089608). - CVE-2018-1000199: An address corruption flaw was discovered while modifying a h/w breakpoint via 'modify_user_hw_breakpoint' routine, an unprivileged user/process could use this flaw to crash the system kernel resulting in DoS OR to potentially escalate privileges on a the system. (bsc#1089895) - CVE-2018-1130: The Linux kernel was vulnerable to a NULL pointer dereference in dccp_write_xmit() function in net/dccp/output.c in that allowed a local user to cause a denial of service by a number of certain crafted system calls (bnc#1092904). - CVE-2018-5803: An error in the _sctp_make_chunk() function when handling SCTP, packet length could have been exploited by a malicious local user to cause a kernel crash and a DoS. (bnc#1083900). - CVE-2018-1065: The netfilter subsystem mishandled the case of a rule blob that contains a jump but lacks a user-defined chain, which allowed local users to cause a denial of service (NULL pointer dereference) by leveraging the CAP_NET_RAW or CAP_NET_ADMIN capability, related to arpt_do_table in net/ipv4/netfilter/arp_tables.c, ipt_do_table in net/ipv4/netfilter/ip_tables.c, and ip6t_do_table in net/ipv6/netfilter/ip6_tables.c (bnc#1083650 1091925). - CVE-2018-7492: A NULL pointer dereference was found in the net/rds/rdma.c __rds_rdma_map() function allowing local attackers to cause a system panic and a denial-of-service, related to RDS_GET_MR and RDS_GET_MR_FOR_DEST (bnc#1082962). The update package also includes non-security fixes. See advisory for details. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 110033
    published 2018-05-23
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=110033
    title SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2018:1366-1) (Spectre)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2018-1259-1.NASL
    description This update for the Linux Kernel 3.12.74-60_64_54 fixes several issues. The following security issues were fixed : - CVE-2018-1000199: A bug in x86 debug register handling of ptrace() could lead to memory corruption, possibly a denial of service or privilege escalation (bsc#1090036). - CVE-2017-0861: Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem in the Linux kernel allowed attackers to gain privileges via unspecified vectors (bsc#1088268). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 109788
    published 2018-05-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109788
    title SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1259-1)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2018-1254-1.NASL
    description This update for the Linux Kernel 3.12.74-60_64_51 fixes several issues. The following security issues were fixed : - CVE-2018-1000199: A bug in x86 debug register handling of ptrace() could lead to memory corruption, possibly a denial of service or privilege escalation (bsc#1090036). - CVE-2017-0861: Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem in the Linux kernel allowed attackers to gain privileges via unspecified vectors (bsc#1088268). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 109783
    published 2018-05-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109783
    title SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1254-1)
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-3641-1.NASL
    description Nick Peterson discovered that the Linux kernel did not properly handle debug exceptions following a MOV/POP to SS instruction. A local attacker could use this to cause a denial of service (system crash). This issue only affected the amd64 architecture. (CVE-2018-8897) Andy Lutomirski discovered that the KVM subsystem of the Linux kernel did not properly emulate the ICEBP instruction following a MOV/POP to SS instruction. A local attacker in a KVM virtual machine could use this to cause a denial of service (guest VM crash) or possibly escalate privileges inside of the virtual machine. This issue only affected the i386 and amd64 architectures. (CVE-2018-1087) Andy Lutomirski discovered that the Linux kernel did not properly perform error handling on virtualized debug registers. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-1000199). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 109650
    published 2018-05-09
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109650
    title Ubuntu 14.04 LTS / 16.04 LTS / 17.10 : linux, linux-aws, linux-azure, linux-euclid, linux-gcp, linux-hwe, (USN-3641-1)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2018-1236-1.NASL
    description This update for the Linux Kernel 4.4.59-92_17 fixes several issues. The following security issues were fixed : - CVE-2018-1000199: A bug in x86 debug register handling of ptrace() could lead to memory corruption, possibly a denial of service or privilege escalation (bsc#1090036). - CVE-2017-0861: Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem in the Linux kernel allowed attackers to gain privileges via unspecified vectors (bsc#1088268). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 109771
    published 2018-05-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109771
    title SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1236-1)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2018-1255-1.NASL
    description This update for the Linux Kernel 3.12.74-60_64_85 fixes several issues. The following security issues were fixed : - CVE-2018-1000199: A bug in x86 debug register handling of ptrace() could lead to memory corruption, possibly a denial of service or privilege escalation (bsc#1090036). - CVE-2017-0861: Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem in the Linux kernel allowed attackers to gain privileges via unspecified vectors (bsc#1088268). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 109784
    published 2018-05-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109784
    title SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1255-1)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2018-1231-1.NASL
    description This update for the Linux Kernel 3.12.74-60_64_48 fixes several issues. The following security issues were fixed : - CVE-2018-1000199: A bug in x86 debug register handling of ptrace() could lead to memory corruption, possibly a denial of service or privilege escalation (bsc#1090036). - CVE-2017-0861: Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem in the Linux kernel allowed attackers to gain privileges via unspecified vectors (bsc#1088268). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 109766
    published 2018-05-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109766
    title SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1231-1)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2018-1245-1.NASL
    description This update for the Linux Kernel 4.4.90-92_45 fixes several issues. The following security issues were fixed : - CVE-2018-1000199: A bug in x86 debug register handling of ptrace() could lead to memory corruption, possibly a denial of service or privilege escalation (bsc#1090036). - CVE-2017-0861: Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem in the Linux kernel allowed attackers to gain privileges via unspecified vectors (bsc#1088268). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 109778
    published 2018-05-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109778
    title SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1245-1)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2018-1235-1.NASL
    description This update for the Linux Kernel 3.12.61-52_119 fixes several issues. The following security issues were fixed : - CVE-2018-1000199: A bug in x86 debug register handling of ptrace() could lead to memory corruption, possibly a denial of service or privilege escalation (bsc#1090036). - CVE-2017-0861: Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem in the Linux kernel allowed attackers to gain privileges via unspecified vectors (bsc#1088268). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 109770
    published 2018-05-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109770
    title SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1235-1)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2018-1273-1.NASL
    description This update for the Linux Kernel 3.12.61-52_106 fixes several issues. The following security issues were fixed : - CVE-2018-1000199: A bug in x86 debug register handling of ptrace() could lead to memory corruption, possibly a denial of service or privilege escalation (bsc#1090036). - CVE-2017-0861: Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem in the Linux kernel allowed attackers to gain privileges via unspecified vectors (bsc#1088268). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 109797
    published 2018-05-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109797
    title SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1273-1)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2018-1268-1.NASL
    description This update for the Linux Kernel 4.4.74-92_38 fixes several issues. The following security issues were fixed : - CVE-2018-1000199: A bug in x86 debug register handling of ptrace() could lead to memory corruption, possibly a denial of service or privilege escalation (bsc#1090036). - CVE-2017-0861: Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem in the Linux kernel allowed attackers to gain privileges via unspecified vectors (bsc#1088268). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 109794
    published 2018-05-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109794
    title SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1268-1)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2018-1256-1.NASL
    description This update for the Linux Kernel 4.4.103-92_56 fixes several issues. The following security issues were fixed : - CVE-2018-1000199: A bug in x86 debug register handling of ptrace() could lead to memory corruption, possibly a denial of service or privilege escalation (bsc#1090036). - CVE-2017-0861: Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem in the Linux kernel allowed attackers to gain privileges via unspecified vectors (bsc#1088268). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 109785
    published 2018-05-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109785
    title SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1256-1)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2018-1551-1.NASL
    description This update for the Linux Kernel 3.12.74-60_64_88 fixes one issue. The following security issue was fixed : - CVE-2018-1000199: - CVE-2018-1000199: An address corruption flaw was discovered while modifying a h/w breakpoint via 'modify_user_hw_breakpoint' routine, an unprivileged user/process could use this flaw to crash the system kernel resulting in DoS OR to potentially escalate privileges on a the system. (bsc#1090036). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 110381
    published 2018-06-06
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=110381
    title SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1551-1)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2018-1269-1.NASL
    description This update for the Linux Kernel 3.12.74-60_64_60 fixes several issues. The following security issues were fixed : - CVE-2018-1000199: A bug in x86 debug register handling of ptrace() could lead to memory corruption, possibly a denial of service or privilege escalation (bsc#1090036). - CVE-2017-0861: Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem in the Linux kernel allowed attackers to gain privileges via unspecified vectors (bsc#1088268). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 109795
    published 2018-05-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109795
    title SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1269-1)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2018-1272-1.NASL
    description This update for the Linux Kernel 4.4.74-92_32 fixes several issues. The following security issues were fixed : - CVE-2018-1000199: A bug in x86 debug register handling of ptrace() could lead to memory corruption, possibly a denial of service or privilege escalation (bsc#1090036). - CVE-2017-0861: Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem in the Linux kernel allowed attackers to gain privileges via unspecified vectors (bsc#1088268). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 109796
    published 2018-05-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109796
    title SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1272-1)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2018-1257-1.NASL
    description This update for the Linux Kernel 3.12.61-52_122 fixes several issues. The following security issues were fixed : - CVE-2018-1000199: A bug in x86 debug register handling of ptrace() could lead to memory corruption, possibly a denial of service or privilege escalation (bsc#1090036). - CVE-2017-0861: Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem in the Linux kernel allowed attackers to gain privileges via unspecified vectors (bsc#1088268). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 109786
    published 2018-05-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109786
    title SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1257-1)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2018-1234-1.NASL
    description This update for the Linux Kernel 3.12.61-52_101 fixes several issues. The following security issues were fixed : - CVE-2018-1000199: A bug in x86 debug register handling of ptrace() could lead to memory corruption, possibly a denial of service or privilege escalation (bsc#1090036). - CVE-2017-0861: Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem in the Linux kernel allowed attackers to gain privileges via unspecified vectors (bsc#1088268). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 109769
    published 2018-05-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109769
    title SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1234-1)
redhat via4
advisories
  • bugzilla
    id 1568477
    title CVE-2018-1000199 kernel: ptrace() incorrect error handling leads to corruption and DoS
    oval
    AND
    • OR
      • comment Red Hat Enterprise Linux 7 Client is installed
        oval oval:com.redhat.rhba:tst:20150364001
      • comment Red Hat Enterprise Linux 7 Server is installed
        oval oval:com.redhat.rhba:tst:20150364002
      • comment Red Hat Enterprise Linux 7 Workstation is installed
        oval oval:com.redhat.rhba:tst:20150364003
      • comment Red Hat Enterprise Linux 7 ComputeNode is installed
        oval oval:com.redhat.rhba:tst:20150364004
    • OR
      • AND
        • comment kernel is earlier than 0:3.10.0-862.2.3.el7
          oval oval:com.redhat.rhsa:tst:20181318009
        • comment kernel is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20100842006
      • AND
        • comment kernel-abi-whitelists is earlier than 0:3.10.0-862.2.3.el7
          oval oval:com.redhat.rhsa:tst:20181318007
        • comment kernel-abi-whitelists is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20131645028
      • AND
        • comment kernel-bootwrapper is earlier than 0:3.10.0-862.2.3.el7
          oval oval:com.redhat.rhsa:tst:20181318031
        • comment kernel-bootwrapper is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20100842010
      • AND
        • comment kernel-debug is earlier than 0:3.10.0-862.2.3.el7
          oval oval:com.redhat.rhsa:tst:20181318023
        • comment kernel-debug is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20100842012
      • AND
        • comment kernel-debug-devel is earlier than 0:3.10.0-862.2.3.el7
          oval oval:com.redhat.rhsa:tst:20181318019
        • comment kernel-debug-devel is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20100842014
      • AND
        • comment kernel-devel is earlier than 0:3.10.0-862.2.3.el7
          oval oval:com.redhat.rhsa:tst:20181318021
        • comment kernel-devel is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20100842016
      • AND
        • comment kernel-doc is earlier than 0:3.10.0-862.2.3.el7
          oval oval:com.redhat.rhsa:tst:20181318005
        • comment kernel-doc is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20100842024
      • AND
        • comment kernel-headers is earlier than 0:3.10.0-862.2.3.el7
          oval oval:com.redhat.rhsa:tst:20181318025
        • comment kernel-headers is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20100842008
      • AND
        • comment kernel-kdump is earlier than 0:3.10.0-862.2.3.el7
          oval oval:com.redhat.rhsa:tst:20181318011
        • comment kernel-kdump is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20100842018
      • AND
        • comment kernel-kdump-devel is earlier than 0:3.10.0-862.2.3.el7
          oval oval:com.redhat.rhsa:tst:20181318015
        • comment kernel-kdump-devel is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20100842020
      • AND
        • comment kernel-tools is earlier than 0:3.10.0-862.2.3.el7
          oval oval:com.redhat.rhsa:tst:20181318027
        • comment kernel-tools is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20140678010
      • AND
        • comment kernel-tools-libs is earlier than 0:3.10.0-862.2.3.el7
          oval oval:com.redhat.rhsa:tst:20181318029
        • comment kernel-tools-libs is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20140678012
      • AND
        • comment kernel-tools-libs-devel is earlier than 0:3.10.0-862.2.3.el7
          oval oval:com.redhat.rhsa:tst:20181318033
        • comment kernel-tools-libs-devel is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20140678020
      • AND
        • comment perf is earlier than 0:3.10.0-862.2.3.el7
          oval oval:com.redhat.rhsa:tst:20181318013
        • comment perf is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20100842022
      • AND
        • comment python-perf is earlier than 0:3.10.0-862.2.3.el7
          oval oval:com.redhat.rhsa:tst:20181318017
        • comment python-perf is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20111530020
    rhsa
    id RHSA-2018:1318
    released 2018-05-08
    severity Important
    title RHSA-2018:1318: kernel security, bug fix, and enhancement update (Important)
  • bugzilla
    id 1568477
    title CVE-2018-1000199 kernel: ptrace() incorrect error handling leads to corruption and DoS
    oval
    AND
    • OR
      • comment Red Hat Enterprise Linux 7 Client is installed
        oval oval:com.redhat.rhba:tst:20150364001
      • comment Red Hat Enterprise Linux 7 Server is installed
        oval oval:com.redhat.rhba:tst:20150364002
      • comment Red Hat Enterprise Linux 7 Workstation is installed
        oval oval:com.redhat.rhba:tst:20150364003
      • comment Red Hat Enterprise Linux 7 ComputeNode is installed
        oval oval:com.redhat.rhba:tst:20150364004
    • OR
      • AND
        • comment kernel-rt is earlier than 0:3.10.0-862.2.3.rt56.806.el7
          oval oval:com.redhat.rhsa:tst:20181355009
        • comment kernel-rt is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20150727006
      • AND
        • comment kernel-rt-debug is earlier than 0:3.10.0-862.2.3.rt56.806.el7
          oval oval:com.redhat.rhsa:tst:20181355023
        • comment kernel-rt-debug is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20150727014
      • AND
        • comment kernel-rt-debug-devel is earlier than 0:3.10.0-862.2.3.rt56.806.el7
          oval oval:com.redhat.rhsa:tst:20181355019
        • comment kernel-rt-debug-devel is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20150727016
      • AND
        • comment kernel-rt-debug-kvm is earlier than 0:3.10.0-862.2.3.rt56.806.el7
          oval oval:com.redhat.rhsa:tst:20181355007
        • comment kernel-rt-debug-kvm is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20161051024
      • AND
        • comment kernel-rt-devel is earlier than 0:3.10.0-862.2.3.rt56.806.el7
          oval oval:com.redhat.rhsa:tst:20181355021
        • comment kernel-rt-devel is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20150727012
      • AND
        • comment kernel-rt-doc is earlier than 0:3.10.0-862.2.3.rt56.806.el7
          oval oval:com.redhat.rhsa:tst:20181355005
        • comment kernel-rt-doc is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20150727018
      • AND
        • comment kernel-rt-kvm is earlier than 0:3.10.0-862.2.3.rt56.806.el7
          oval oval:com.redhat.rhsa:tst:20181355011
        • comment kernel-rt-kvm is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20161051016
      • AND
        • comment kernel-rt-trace is earlier than 0:3.10.0-862.2.3.rt56.806.el7
          oval oval:com.redhat.rhsa:tst:20181355015
        • comment kernel-rt-trace is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20150727008
      • AND
        • comment kernel-rt-trace-devel is earlier than 0:3.10.0-862.2.3.rt56.806.el7
          oval oval:com.redhat.rhsa:tst:20181355013
        • comment kernel-rt-trace-devel is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20150727010
      • AND
        • comment kernel-rt-trace-kvm is earlier than 0:3.10.0-862.2.3.rt56.806.el7
          oval oval:com.redhat.rhsa:tst:20181355017
        • comment kernel-rt-trace-kvm is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20161051018
    rhsa
    id RHSA-2018:1355
    released 2018-05-08
    severity Important
    title RHSA-2018:1355: kernel-rt security and bug fix update (Important)
  • rhsa
    id RHSA-2018:1345
  • rhsa
    id RHSA-2018:1347
  • rhsa
    id RHSA-2018:1348
  • rhsa
    id RHSA-2018:1354
  • rhsa
    id RHSA-2018:1374
rpms
  • kernel-0:3.10.0-862.2.3.el7
  • kernel-abi-whitelists-0:3.10.0-862.2.3.el7
  • kernel-bootwrapper-0:3.10.0-862.2.3.el7
  • kernel-debug-0:3.10.0-862.2.3.el7
  • kernel-debug-devel-0:3.10.0-862.2.3.el7
  • kernel-devel-0:3.10.0-862.2.3.el7
  • kernel-doc-0:3.10.0-862.2.3.el7
  • kernel-headers-0:3.10.0-862.2.3.el7
  • kernel-kdump-0:3.10.0-862.2.3.el7
  • kernel-kdump-devel-0:3.10.0-862.2.3.el7
  • kernel-tools-0:3.10.0-862.2.3.el7
  • kernel-tools-libs-0:3.10.0-862.2.3.el7
  • kernel-tools-libs-devel-0:3.10.0-862.2.3.el7
  • perf-0:3.10.0-862.2.3.el7
  • python-perf-0:3.10.0-862.2.3.el7
  • kernel-rt-0:3.10.0-862.2.3.rt56.806.el7
  • kernel-rt-debug-0:3.10.0-862.2.3.rt56.806.el7
  • kernel-rt-debug-devel-0:3.10.0-862.2.3.rt56.806.el7
  • kernel-rt-debug-kvm-0:3.10.0-862.2.3.rt56.806.el7
  • kernel-rt-devel-0:3.10.0-862.2.3.rt56.806.el7
  • kernel-rt-doc-0:3.10.0-862.2.3.rt56.806.el7
  • kernel-rt-kvm-0:3.10.0-862.2.3.rt56.806.el7
  • kernel-rt-trace-0:3.10.0-862.2.3.rt56.806.el7
  • kernel-rt-trace-devel-0:3.10.0-862.2.3.rt56.806.el7
  • kernel-rt-trace-kvm-0:3.10.0-862.2.3.rt56.806.el7
refmap via4
debian
  • DSA-4187
  • DSA-4188
mlist
  • [debian-lts-announce] 20180502 [SECURITY] [DLA 1369-1] linux security update
  • [linux-kernel] 20180406 [PATCH 3.18 40/93] perf/hwbp: Simplify the perf-hwbp code, fix documentation
sectrack 1040806
ubuntu
  • USN-3641-1
  • USN-3641-2
Last major update 24-05-2018 - 09:29
Published 24-05-2018 - 09:29
Last modified 27-06-2018 - 07:43
Back to Top