Security update for the Linux Kernel

Announcement ID: SUSE-SU-2018:0534-1
Rating: important
References:
Cross-References:
CVSS scores:
  • CVE-2017-13166 ( SUSE ): 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2017-13166 ( NVD ): 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2017-15951 ( SUSE ): 3.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
  • CVE-2017-15951 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2017-15951 ( NVD ): 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2017-16644 ( SUSE ): 4.6 CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  • CVE-2017-16644 ( NVD ): 6.6 CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2017-16912 ( SUSE ): 6.2 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  • CVE-2017-16912 ( NVD ): 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
  • CVE-2017-16913 ( SUSE ): 6.2 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  • CVE-2017-16913 ( NVD ): 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
  • CVE-2017-17975 ( SUSE ): 3.5 CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
  • CVE-2017-17975 ( NVD ): 5.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  • CVE-2017-18174 ( SUSE ): 5.3 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L
  • CVE-2017-18174 ( NVD ): 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • CVE-2017-18208 ( SUSE ): 6.2 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  • CVE-2017-18208 ( NVD ): 5.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  • CVE-2018-1000026 ( SUSE ): 7.7 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
  • CVE-2018-1000026 ( NVD ): 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
  • CVE-2018-1000026 ( NVD ): 7.7 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
  • CVE-2018-1068 ( SUSE ): 8.4 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • CVE-2018-1068 ( NVD ): 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
  • CVE-2018-1068 ( NVD ): 6.7 CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
  • CVE-2018-8087 ( SUSE ): 5.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  • CVE-2018-8087 ( NVD ): 5.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected Products:
  • SUSE Container as a Service Platform 1.0
  • SUSE Container as a Service Platform 2.0
  • SUSE Linux Enterprise Desktop 12 SP3
  • SUSE Linux Enterprise High Availability Extension 12 SP3
  • SUSE Linux Enterprise High Performance Computing 12 SP3
  • SUSE Linux Enterprise Live Patching 12-SP3
  • SUSE Linux Enterprise Server 12 SP3
  • SUSE Linux Enterprise Server for SAP Applications 12 SP3
  • SUSE Linux Enterprise Software Bootstrap Kit 12 12-SP3
  • SUSE Linux Enterprise Software Development Kit 12 SP3
  • SUSE Linux Enterprise Workstation Extension 12 12-SP3

An update that solves 11 vulnerabilities and has 116 security fixes can now be installed.

Description:

The SUSE Linux Enterprise 12 SP3 kernel was updated to 4.4.120 to receive various security and bugfixes.

The following security bugs were fixed:

  • CVE-2017-13166: An elevation of privilege vulnerability in the v4l2 video driver. (bnc#1072865).
  • CVE-2017-15951: The KEYS subsystem did not correctly synchronize the actions of updating versus finding a key in the "negative" state to avoid a race condition, which allowed local users to cause a denial of service or possibly have unspecified other impact via crafted system calls (bnc#1062840 bnc#1065615).
  • CVE-2017-16644: The hdpvr_probe function in drivers/media/usb/hdpvr/hdpvr-core.c allowed local users to cause a denial of service (improper error handling and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1067118).
  • CVE-2017-16912: The "get_pipe()" function (drivers/usb/usbip/stub_rx.c) allowed attackers to cause a denial of service (out-of-bounds read) via a specially crafted USB over IP packet (bnc#1078673).
  • CVE-2017-16913: The "stub_recv_cmd_submit()" function (drivers/usb/usbip/stub_rx.c) when handling CMD_SUBMIT packets allowed attackers to cause a denial of service (arbitrary memory allocation) via a specially crafted USB over IP packet (bnc#1078672).
  • CVE-2017-17975: Use-after-free in the usbtv_probe function in drivers/media/usb/usbtv/usbtv-core.c allowed attackers to cause a denial of service (system crash) or possibly have unspecified other impact by triggering failure of audio registration, because a kfree of the usbtv data structure occurs during a usbtv_video_free call, but the usbtv_video_fail label's code attempts to both access and free this data structure (bnc#1074426).
  • CVE-2017-18174: The amd_gpio_remove function in drivers/pinctrl/pinctrl-amd.c calls the pinctrl_unregister function, leading to a double free (bnc#1080533).
  • CVE-2017-18208: The madvise_willneed function in mm/madvise.c allowed local users to cause a denial of service (infinite loop) by triggering use of MADVISE_WILLNEED for a DAX mapping (bnc#1083494).
  • CVE-2018-1000026: A insufficient input validation vulnerability in bnx2x network card driver could result in DoS: Network card firmware assertion takes card off-line. This attack appear to be exploitable via An attacker on a must pass a very large, specially crafted packet to the bnx2x card. This can be done from an untrusted guest VM. (bnc#1079384).
  • CVE-2018-8087: Memory leak in the hwsim_new_radio_nl function in drivers/net/wireless/mac80211_hwsim.c allowed local users to cause a denial of service (memory consumption) by triggering an out-of-array error case (bnc#1085053).
  • CVE-2018-1068: Insufficient user provided offset checking in the ebtables compat code allowed local attackers to overwrite kernel memory and potentially execute code. (bsc#1085107)

The following non-security bugs were fixed:

  • acpi / bus: Leave modalias empty for devices which are not present (bnc#1012382).
  • acpi, nfit: fix health event notification (FATE#321135, FATE#321217, FATE#321256, FATE#321391, FATE#321393).
  • acpi, nfit: fix register dimm error handling (FATE#321135, FATE#321217, FATE#321256, FATE#321391, FATE#321393).
  • acpi: sbshc: remove raw pointer from printk() message (bnc#1012382).
  • Add delay-init quirk for Corsair K70 RGB keyboards (bnc#1012382).
  • add ip6_make_flowinfo helper (bsc#1042286).
  • ahci: Add Intel Cannon Lake PCH-H PCI ID (bnc#1012382).
  • ahci: Add PCI ids for Intel Bay Trail, Cherry Trail and Apollo Lake AHCI (bnc#1012382).
  • ahci: Annotate PCI ids for mobile Intel chipsets as such (bnc#1012382).
  • alpha: fix crash if pthread_create races with signal delivery (bnc#1012382).
  • alpha: fix reboot on Avanti platform (bnc#1012382).
  • alsa: hda/ca0132 - fix possible NULL pointer use (bnc#1012382).
  • alsa: hda - Fix headset mic detection problem for two Dell machines (bnc#1012382).
  • alsa: hda/realtek - Add headset mode support for Dell laptop (bsc#1031717).
  • alsa: hda/realtek: PCI quirk for Fujitsu U7x7 (bnc#1012382).
  • alsa: hda - Reduce the suspend time consumption for ALC256 (bsc#1031717).
  • alsa: hda - Use IS_REACHABLE() for dependency on input (bsc#1031717).
  • alsa: seq: Fix racy pool initializations (bnc#1012382).
  • alsa: seq: Fix regression by incorrect ioctl_mutex usages (bnc#1012382).
  • alsa: usb-audio: add implicit fb quirk for Behringer UFX1204 (bnc#1012382).
  • alsa: usb-audio: Fix UAC2 get_ctl request with a RANGE attribute (bnc#1012382).
  • amd-xgbe: Fix unused suspend handlers build warning (bnc#1012382).
  • arm64: add PTE_ADDR_MASK (bsc#1068032).
  • arm64: barrier: Add CSDB macros to control data-value prediction (bsc#1068032).
  • arm64: define BUG() instruction without CONFIG_BUG (bnc#1012382).
  • arm64: Disable unhandled signal log messages by default (bnc#1012382).
  • arm64: dts: add #cooling-cells to CPU nodes (bnc#1012382).
  • arm64: entry: Apply BP hardening for high-priority synchronous exceptions (bsc#1068032).
  • arm64: entry: Apply BP hardening for suspicious interrupts from EL0 (bsc#1068032).
  • arm64: entry: Ensure branch through syscall table is bounded under speculation (bsc#1068032).
  • arm64: entry: Reword comment about post_ttbr_update_workaround (bsc#1068032).
  • arm64: Force KPTI to be disabled on Cavium ThunderX (bsc#1068032).
  • arm64: futex: Mask __user pointers prior to dereference (bsc#1068032).
  • arm64: idmap: Use "awx" flags for .idmap.text .pushsection directives (bsc#1068032).
  • arm64: Implement array_index_mask_nospec() (bsc#1068032).
  • arm64: Kconfig: select COMPAT_BINFMT_ELF only when BINFMT_ELF is set (bnc#1012382).
  • arm64: kpti: Add ->enable callback to remap swapper using nG mappings (bsc#1068032).
  • arm64: kpti: Make use of nG dependent on arm64_kernel_unmapped_at_el0() (bsc#1068032).
  • arm64: Make USER_DS an inclusive limit (bsc#1068032).
  • arm64: mm: Permit transitioning from Global to Non-Global without BBM (bsc#1068032).
  • arm64: move TASK_* definitions to <asm/processor.h> (bsc#1068032).
  • arm64: Run enable method for errata work arounds on late CPUs (bsc#1085045).
  • arm64: uaccess: Do not bother eliding access_ok checks in __{get, put}_user (bsc#1068032).
  • arm64: uaccess: Mask __user pointers for __arch_{clear, copy_*}_user (bsc#1068032).
  • arm64: uaccess: Prevent speculative use of the current addr_limit (bsc#1068032).
  • arm64: Use pointer masking to limit uaccess speculation (bsc#1068032).
  • arm: 8731/1: Fix csum_partial_copy_from_user() stack mismatch (bnc#1012382).
  • arm: AM33xx: PRM: Remove am33xx_pwrdm_read_prev_pwrst function (bnc#1012382).
  • arm: dts: am4372: Correct the interrupts_properties of McASP (bnc#1012382).
  • arm: dts: Fix omap4 hang with GPS connected to USB by using wakeupgen (bnc#1012382).
  • arm: dts: ls1021a: fix incorrect clock references (bnc#1012382).
  • arm: dts: s5pv210: add interrupt-parent for ohci (bnc#1012382).
  • arm: dts: STi: Add gpio polarity for "hdmi,hpd-gpio" property (bnc#1012382).
  • arm: kvm: Fix SMCCC handling of unimplemented SMC/HVC calls (bnc#1012382).
  • arm: OMAP2+: Fix SRAM virt to phys translation for save_secure_ram_context (bnc#1012382).
  • arm: omap2: hide omap3_save_secure_ram on non-OMAP3 builds (git-fixes).
  • arm: pxa/tosa-bt: add MODULE_LICENSE tag (bnc#1012382).
  • arm: spear13xx: Fix dmas cells (bnc#1012382).
  • arm: spear13xx: Fix spics gpio controller's warning (bnc#1012382).
  • arm: spear600: Add missing interrupt-parent of rtc (bnc#1012382).
  • arm: tegra: select USB_ULPI from EHCI rather than platform (bnc#1012382).
  • asoc: au1x: Fix timeout tests in au1xac97c_ac97_read() (bsc#1031717).
  • asoc: Intel: Kconfig: fix build when ACPI is not enabled (bnc#1012382).
  • asoc: Intel: sst: Fix the return value of 'sst_send_byte_stream_mrfld()' (bsc#1031717).
  • asoc: mediatek: add i2c dependency (bnc#1012382).
  • asoc: nuc900: Fix a loop timeout test (bsc#1031717).
  • asoc: pcm512x: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE (bnc#1012382).
  • asoc: rockchip: disable clock on error (bnc#1012382).
  • asoc: rsnd: avoid duplicate free_irq() (bnc#1012382).
  • asoc: rsnd: do not call free_irq() on Parent SSI (bnc#1012382).
  • asoc: simple-card: Fix misleading error message (bnc#1012382).
  • asoc: ux500: add MODULE_LICENSE tag (bnc#1012382).
  • ata: ahci_xgene: free structure returned by acpi_get_object_info() (bsc#1082979).
  • ata: pata_artop: remove redundant initialization of pio (bsc#1082979).
  • ata: sata_dwc_460ex: remove incorrect locking (bsc#1082979).
  • b2c2: flexcop: avoid unused function warnings (bnc#1012382).
  • binder: add missing binder_unlock() (bnc#1012382).
  • binder: check for binder_thread allocation failure in binder_poll() (bnc#1012382).
  • binfmt_elf: compat: avoid unused function warning (bnc#1012382).
  • blk-mq: add warning to __blk_mq_run_hw_queue() for ints disabled (bsc#1084772).
  • blk-mq: stop 'delayed_run_work' in blk_mq_stop_hw_queue() (bsc#1084967).
  • blk-mq: turn WARN_ON in __blk_mq_run_hw_queue into printk (bsc#1084772).
  • blktrace: fix unlocked registration of tracepoints (bnc#1012382).
  • block: fix an error code in add_partition() (bsc#1082979).
  • block: Fix __bio_integrity_endio() documentation (bsc#1082979).
  • bluetooth: btsdio: Do not bind to non-removable BCM43341 (bnc#1012382).
  • bluetooth: btusb: Restore QCA Rome suspend/resume fix with a "rewritten" version (bnc#1012382).
  • bnx2x: Improve reliability in case of nested PCI errors (bnc#1012382).
  • bnxt_en: Fix the 'Invalid VF' id check in bnxt_vf_ndo_prep routine (bnc#1012382).
  • bpf: arsh is not supported in 32 bit alu thus reject it (bnc#1012382).
  • bpf: avoid false sharing of map refcount with max_entries (bnc#1012382).
  • bpf: fix 32-bit divide by zero (bnc#1012382).
  • bpf: fix bpf_tail_call() x64 JIT (bnc#1012382).
  • bpf: fix divides by zero (bnc#1012382).
  • bpf: introduce BPF_JIT_ALWAYS_ON config (bnc#1012382).
  • bpf: reject stores into ctx via st and xadd (bnc#1012382).
  • bridge: implement missing ndo_uninit() (bsc#1042286).
  • bridge: move bridge multicast cleanup to ndo_uninit (bsc#1042286).
  • btrfs: copy fsid to super_block s_uuid (bsc#1080774).
  • btrfs: fix crash due to not cleaning up tree log block's dirty bits (bnc#1012382).
  • btrfs: fix deadlock in run_delalloc_nocow (bnc#1012382).
  • btrfs: fix deadlock when writing out space cache (bnc#1012382).
  • btrfs: Fix possible off-by-one in btrfs_search_path_in_tree (bnc#1012382).
  • btrfs: Fix quota reservation leak on preallocated files (bsc#1079989).
  • btrfs: fix unexpected -EEXIST when creating new inode (bnc#1012382).
  • btrfs: Handle btrfs_set_extent_delalloc failure in fixup worker (bnc#1012382).
  • can: flex_can: Correct the checking for frame length in flexcan_start_xmit() (bnc#1012382).
  • cdrom: turn off autoclose by default (bsc#1080813).
  • ceph: fix incorrect snaprealm when adding caps (bsc#1081735).
  • ceph: fix un-balanced fsc->writeback_count update (bsc#1081735).
  • cfg80211: check dev_set_name() return value (bnc#1012382).
  • cfg80211: fix cfg80211_beacon_dup (bnc#1012382).
  • cifs: dump IPC tcon in debug proc file (bsc#1071306).
  • cifs: Fix autonegotiate security settings mismatch (bnc#1012382).
  • cifs: Fix missing put_xid in cifs_file_strict_mmap (bnc#1012382).
  • cifs: make IPC a regular tcon (bsc#1071306).
  • cifs: use tcon_ipc instead of use_ipc parameter of SMB2_ioctl (bsc#1071306).
  • cifs: zero sensitive data when freeing (bnc#1012382).
  • clk: fix a panic error caused by accessing NULL pointer (bnc#1012382).
  • console/dummy: leave .con_font_get set to NULL (bnc#1012382).
  • cpufreq: Add Loongson machine dependencies (bnc#1012382).
  • crypto: aesni - handle zero length dst buffer (bnc#1012382).
  • crypto: af_alg - whitelist mask and type (bnc#1012382).
  • crypto: caam - fix endless loop when DECO acquire fails (bnc#1012382).
  • crypto: cryptd - pass through absence of ->setkey() (bnc#1012382).
  • crypto: hash - introduce crypto_hash_alg_has_setkey() (bnc#1012382).
  • crypto: poly1305 - remove ->setkey() method (bnc#1012382).
  • crypto: s5p-sss - Fix kernel Oops in AES-ECB mode (bnc#1012382).
  • crypto: tcrypt - fix S/G table for test_aead_speed() (bnc#1012382). (bnc#1012382).
  • crypto: x86/twofish-3way - Fix %rbp usage (bnc#1012382).
  • cw1200: fix bogus maybe-uninitialized warning (bnc#1012382).
  • dccp: limit sk_filter trim to payload (bsc#1042286).
  • dell-wmi, dell-laptop: depends DMI (bnc#1012382).
  • direct-io: Fix sleep in atomic due to sync AIO (bsc#1084888).
  • dlm: fix double list_del() (bsc#1082795).
  • dlm: fix NULL pointer dereference in send_to_sock() (bsc#1082795).
  • dmaengine: at_hdmac: fix potential NULL pointer dereference in atc_prep_dma_interleaved (bnc#1012382).
  • dmaengine: dmatest: fix container_of member in dmatest_callback (bnc#1012382).
  • dmaengine: ioat: Fix error handling path (bnc#1012382).
  • dmaengine: jz4740: disable/unprepare clk if probe fails (bnc#1012382).
  • dmaengine: zx: fix build warning (bnc#1012382).
  • dm: correctly handle chained bios in dec_pending() (bnc#1012382).
  • dn_getsockoptdecnet: move nf_{get/set}sockopt outside sock lock (bnc#1012382).
  • do not put symlink bodies in pagecache into highmem (bnc#1012382).
  • dpt_i2o: fix build warning (bnc#1012382).
  • driver-core: use 'dev' argument in dev_dbg_ratelimited stub (bnc#1012382).
  • drivers: hv: balloon: Correctly update onlined page count (fate#315887, bsc#1082632).
  • drivers: hv: balloon: Initialize last_post_time on startup (fate#315887, bsc#1082632).
  • drivers: hv: balloon: Show the max dynamic memory assigned (fate#315887, bsc#1082632).
  • drivers: hv: kvp: Use MAX_ADAPTER_ID_SIZE for translating adapter id (fate#315887, bsc#1082632).
  • drivers: hv: Turn off write permission on the hypercall page (fate#315887, bsc#1082632).
  • drivers: hv: vmbus: Fix rescind handling (fate#315887, bsc#1082632).
  • drivers: hv: vmbus: Fix rescind handling issues (fate#315887, bsc#1082632).
  • drivers/net: fix eisa_driver probe section mismatch (bnc#1012382).
  • drm/amdgpu: Avoid leaking PM domain on driver unbind (v2) (bnc#1012382).
  • drm/amdgpu: Fix SDMA load/unload sequence on HWS disabled mode (bnc#1012382).
  • drm/amdkfd: Fix SDMA oversubsription handling (bnc#1012382).
  • drm/amdkfd: Fix SDMA ring buffer size calculation (bnc#1012382).
  • drm/armada: fix leak of crtc structure (bnc#1012382).
  • drm/edid: Add 6 bpc quirk for CPT panel in Asus UX303LA (bnc#1012382).
  • drm/gma500: remove helper function (bnc#1012382).
  • drm/gma500: Sanity-check pipe index (bnc#1012382).
  • drm/nouveau: hide gcc-4.9 -Wmaybe-uninitialized (bnc#1012382).
  • drm/nouveau/pci: do a msi rearm on init (bnc#1012382).
  • drm/radeon: adjust tested variable (bnc#1012382).
  • drm: rcar-du: Fix race condition when disabling planes at CRTC stop (bnc#1012382).
  • drm: rcar-du: Use the VBK interrupt for vblank events (bnc#1012382).
  • drm: Require __GFP_NOFAIL for the legacy drm_modeset_lock_all (bnc#1012382).
  • drm/ttm: check the return value of kzalloc (bnc#1012382).
  • drm/vmwgfx: use *_32_bits() macros (bnc#1012382).
  • Drop SUSE-specific qla2xxx patches (bsc#1043726)
  • e1000: fix disabling already-disabled warning (bnc#1012382).
  • edac, octeon: Fix an uninitialized variable warning (bnc#1012382).
  • em28xx: only use mt9v011 if camera support is enabled (bnc#1012382).
  • enable DST_CACHE in non-vanilla configs except s390x/zfcpdump
  • ext4: correct documentation for grpid mount option (bnc#1012382).
  • ext4: do not unnecessarily allocate buffer in recently_deleted() (bsc#1080344).
  • ext4: Fix data exposure after failed AIO DIO (bsc#1069135 bsc#1082864).
  • ext4: save error to disk in __ext4_grp_locked_error() (bnc#1012382).
  • f2fs: fix a bug caused by NULL extent tree (bsc#1082478). Does not affect SLE