Security update for Linux Kernel Live Patch 0 for SLE 12 SP1

Announcement ID:	SUSE-SU-2016:3094-1
Rating:	important
References:	bsc#1003253 bsc#1012183 bsc#1012759
Cross-References:	CVE-2016-7117 CVE-2016-8655 CVE-2016-9555
CVSS scores:	CVE-2016-7117 ( SUSE ): 8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2016-7117 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2016-7117 ( NVD ): 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2016-8655 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2016-8655 ( NVD ): 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2016-9555 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2016-9555 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2016-9555 ( NVD ): 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products:	SUSE Linux Enterprise High Performance Computing 12 SP2 SUSE Linux Enterprise Live Patching 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Server 12 LTSS 12 SUSE Linux Enterprise Server 12 SP1 SUSE Linux Enterprise Server 12 SP2 SUSE Linux Enterprise Server for SAP Applications 12 SUSE Linux Enterprise Server for SAP Applications 12 SP1 SUSE Linux Enterprise Server for SAP Applications 12 SP2

An update that solves three vulnerabilities can now be installed.

Description:

This update for the Linux Kernel 3.12.49-11 fixes several issues.

The following security bugs were fixed: - CVE-2016-8655: A race condition in the af_packet packet_set_ring function could be used by local attackers to crash the kernel or gain privileges (bsc#1012759). - CVE-2016-9555: The sctp_sf_ootb function in net/sctp/sm_statefuns.c in the Linux kernel lacks chunk-length checking for the first chunk, which allowed remote attackers to cause a denial of service (out-of-bounds slab access) or possibly have unspecified other impact via crafted SCTP data (bsc#1012183). - CVE-2016-7117: Use-after-free vulnerability in the __sys_recvmmsg function in net/socket.c in the Linux kernel allowed remote attackers to execute arbitrary code via vectors involving a recvmmsg system call that is mishandled during error processing (bsc#1003253).

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• SUSE Linux Enterprise Live Patching 12
  zypper in -t patch SUSE-SLE-Live-Patching-12-2016-1797=1 SUSE-SLE-Live-Patching-12-2016-1798=1 SUSE-SLE-Live-Patching-12-2016-1800=1 SUSE-SLE-Live-Patching-12-2016-1799=1 SUSE-SLE-Live-Patching-12-2016-1801=1
• SUSE Linux Enterprise Server for SAP Applications 12
  zypper in -t patch SUSE-SLE-SAP-12-2016-1809=1 SUSE-SLE-SAP-12-2016-1806=1 SUSE-SLE-SAP-12-2016-1895=1 SUSE-SLE-SAP-12-2016-1814=1 SUSE-SLE-SAP-12-2016-1807=1
• SUSE Linux Enterprise Server 12 LTSS 12
  zypper in -t patch SUSE-SLE-SERVER-12-2016-1809=1 SUSE-SLE-SERVER-12-2016-1806=1 SUSE-SLE-SERVER-12-2016-1895=1 SUSE-SLE-SERVER-12-2016-1814=1 SUSE-SLE-SERVER-12-2016-1807=1

Package List:

• SUSE Linux Enterprise Live Patching 12 (x86_64)
  • kgraft-patch-3_12_49-11-default-8-23.2
  • kgraft-patch-3_12_53-60_30-default-6-2.1
  • kgraft-patch-3_12_57-60_35-default-5-2.1
  • kgraft-patch-3_12_49-11-xen-8-23.2
  • kgraft-patch-3_12_51-60_20-xen-8-2.1
  • kgraft-patch-3_12_57-60_35-xen-5-2.1
  • kgraft-patch-3_12_53-60_30-xen-6-2.1
  • kgraft-patch-3_12_51-60_20-default-8-2.1
  • kgraft-patch-3_12_51-60_25-xen-7-2.1
  • kgraft-patch-3_12_51-60_25-default-7-2.1
• SUSE Linux Enterprise Server for SAP Applications 12 (x86_64)
  • kgraft-patch-3_12_55-52_45-xen-4-2.1
  • kgraft-patch-3_12_51-52_34-default-7-2.1
  • kgraft-patch-3_12_51-52_39-xen-6-2.1
  • kgraft-patch-3_12_51-52_39-default-6-2.1
  • kgraft-patch-3_12_51-52_31-xen-7-2.1
  • kgraft-patch-3_12_51-52_34-xen-7-2.1
  • kgraft-patch-3_12_55-52_45-default-4-2.1
  • kgraft-patch-3_12_51-52_31-default-7-2.1
  • kgraft-patch-3_12_55-52_42-xen-4-2.1
  • kgraft-patch-3_12_55-52_42-default-4-2.1
• SUSE Linux Enterprise Server 12 LTSS 12 (x86_64)
  • kgraft-patch-3_12_55-52_45-xen-4-2.1
  • kgraft-patch-3_12_51-52_34-default-7-2.1
  • kgraft-patch-3_12_51-52_39-xen-6-2.1
  • kgraft-patch-3_12_51-52_39-default-6-2.1
  • kgraft-patch-3_12_51-52_31-xen-7-2.1
  • kgraft-patch-3_12_51-52_34-xen-7-2.1
  • kgraft-patch-3_12_55-52_45-default-4-2.1
  • kgraft-patch-3_12_51-52_31-default-7-2.1
  • kgraft-patch-3_12_55-52_42-xen-4-2.1
  • kgraft-patch-3_12_55-52_42-default-4-2.1

References:

• https://www.suse.com/security/cve/CVE-2016-7117.html
• https://www.suse.com/security/cve/CVE-2016-8655.html
• https://www.suse.com/security/cve/CVE-2016-9555.html
• https://bugzilla.suse.com/show_bug.cgi?id=1003253
• https://bugzilla.suse.com/show_bug.cgi?id=1012183
• https://bugzilla.suse.com/show_bug.cgi?id=1012759