Security update for the Linux Kernel (Live Patch 0 for SLE 15)
SUSE Security Update: Security update for the Linux Kernel (Live Patch 0 for SLE 15)
Announcement ID: | SUSE-SU-2018:3880-1 |
Rating: | important |
References: | #1103098 #1112039 |
Cross-References: | CVE-2018-18386 CVE-2018-5391 |
Affected Products: |
|
An update that fixes two vulnerabilities is now available.
Description:
This update for the Linux Kernel 4.12.14-23 fixes several issues.
The following security issues were fixed:
- CVE-2018-5391: Fixed a denial of service attack with low rates of specially modified packets targeting IP fragment re-assembly. An attacker may have caused a denial of service condition by sending specially crafted IP fragments. The current vulnerability (CVE-2018-5391) became exploitable in the Linux kernel with the increase of the IP fragment reassembly queue size (bsc#1103098).
- CVE-2018-18386: The drivers/tty/n_tty.c allowed local attackers (who are able to access pseudo terminals) to hang/block further usage of any pseudo terminal devices due to an EXTPROC versus ICANON confusion in TIOCINQ (bsc#1112039).
Patch Instructions:
To install this SUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- SUSE Linux Enterprise Module for Live Patching 15:
zypper in -t patch SUSE-SLE-Module-Live-Patching-15-2018-2768=1
Package List:
- SUSE Linux Enterprise Module for Live Patching 15 (ppc64le x86_64):
- kernel-livepatch-4_12_14-23-default-6-16.2
- kernel-livepatch-4_12_14-23-default-debuginfo-6-16.2
- kernel-livepatch-SLE15_Update_0-debugsource-6-16.2