openSUSE Security Update: Security update for the Linux Kernel
______________________________________________________________________________

Announcement ID:    openSUSE-SU-2017:1215-1
Rating:             important
References:         #1012829 #1012876 #1028415 #1030213 #1031003 
                    #1031052 #1031440 #1031579 #1032435 #1033336 
                    #1033340 #1033518 #1034670 #930399 #970083 
                    
Cross-References:   CVE-2016-10318 CVE-2017-2671 CVE-2017-7187
                    CVE-2017-7261 CVE-2017-7294 CVE-2017-7308
                    CVE-2017-7616 CVE-2017-7618
Affected Products:
                    openSUSE Leap 42.1
______________________________________________________________________________

   An update that solves 8 vulnerabilities and has 7 fixes is
   now available.

Description:



   The openSUSE Leap 42.1 kernel was updated to receive various security and
   bugfixes.


   The following security bugs were fixed:

   - CVE-2017-7618: crypto/ahash.c in the Linux kernel allowed attackers to
     cause a denial of service (API operation calling its own callback, and
     infinite recursion) by triggering EBUSY on a full queue (bnc#1033340).
   - CVE-2016-10318: A missing authorization check in the
     fscrypt_process_policy function in fs/crypto/policy.c in the ext4 and
     f2fs filesystem encryption support in the Linux kernel allowed a user to
     assign an encryption policy to a directory owned by a different user,
     potentially creating a denial of service (bnc#1032435).
   - CVE-2017-7616: Incorrect error handling in the set_mempolicy and mbind
     compat syscalls in mm/mempolicy.c in the Linux kernel allowed local
     users to obtain sensitive information from uninitialized stack data by
     triggering failure of a certain bitmap operation (bnc#1033336).
   - CVE-2017-7308: The packet_set_ring function in net/packet/af_packet.c in
     the Linux kernel did not properly validate certain block-size data,
     which allowed local users to cause a denial of service (overflow) or
     possibly have unspecified other impact via crafted system calls
     (bnc#1031579).
   - CVE-2017-2671: The ping_unhash function in net/ipv4/ping.c in the Linux
     kernel is too late in obtaining a certain lock and consequently cannot
     ensure that disconnect function calls are safe, which allowed local
     users to cause a denial of service (panic) by leveraging access to the
     protocol value of IPPROTO_ICMP in a socket system call (bnc#1031003).
   - CVE-2017-7294: The vmw_surface_define_ioctl function in
     drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not
     validate addition of certain levels data, which allowed local users to
     trigger an integer overflow and out-of-bounds write, and cause a denial
     of service (system hang or crash) or possibly gain privileges, via a
     crafted ioctl call for a /dev/dri/renderD* device (bnc#1031440).
   - CVE-2017-7261: The vmw_surface_define_ioctl function in
     drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not
     check for a zero value of certain levels data, which allowed local users     to cause a denial of service (ZERO_SIZE_PTR dereference, and GPF and
     possibly panic) via a crafted ioctl call for a /dev/dri/renderD* device
     (bnc#1031052).
   - CVE-2017-7187: The sg_ioctl function in drivers/scsi/sg.c in the Linux
     kernel allowed local users to cause a denial of service (stack-based
     buffer overflow) or possibly have unspecified other impact via a large
     command size in an SG_NEXT_CMD_LEN ioctl call, leading to out-of-bounds
     write access in the sg_write function (bnc#1030213).

   The following non-security bugs were fixed:

   - ata: ahci_xgene: free structure returned by acpi_get_object_info()
     (bsc#1033518).
   - doc/README.SUSE: update links to KMP manual
   - ext4: do not perform data journaling when data is encrypted
     (bsc#1012876).
   - ext4: fix use-after-iput when fscrypt contexts are inconsistent
     (bsc#1012829).
   - ext4: mark inode dirty after converting inline directory (bsc#1012876).
   - ext4: reject inodes with negative size (bsc#1012876).
   - fs, seqfile: always allow oom killer (bsc#1012876).
   - ipv6: make ECMP route replacement less greedy (bsc#930399).
   - l2tp: hold tunnel socket when handling control frames in l2tp_ip and
     l2tp_ip6 (bsc#1028415).
   - mm: filemap: do not plant shadow entries without radix tree node
     (bsc#1012876).
   - netfilter: allow logging from non-init namespaces (bsc#970083).
   - nfsd4: minor NFSv2/v3 write decoding cleanup (bsc#1034670 CVE#2017-7645).
   - nfsd: check for oversized NFSv2/v3 arguments (bsc#1034670 CVE#2017-7645).
   - nfsd: stricter decoding of write-like NFSv2/v3 ops (bsc#1034670
     CVE#2017-7645).


Patch Instructions:

   To install this openSUSE Security Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   - openSUSE Leap 42.1:

      zypper in -t patch openSUSE-2017-562=1

   To bring your system up-to-date, use "zypper patch".


Package List:

   - openSUSE Leap 42.1 (i686 x86_64):

      kernel-debug-4.1.39-56.1
      kernel-debug-base-4.1.39-56.1
      kernel-debug-base-debuginfo-4.1.39-56.1
      kernel-debug-debuginfo-4.1.39-56.1
      kernel-debug-debugsource-4.1.39-56.1
      kernel-debug-devel-4.1.39-56.1
      kernel-debug-devel-debuginfo-4.1.39-56.1
      kernel-ec2-4.1.39-56.1
      kernel-ec2-base-4.1.39-56.1
      kernel-ec2-base-debuginfo-4.1.39-56.1
      kernel-ec2-debuginfo-4.1.39-56.1
      kernel-ec2-debugsource-4.1.39-56.1
      kernel-ec2-devel-4.1.39-56.1
      kernel-pv-4.1.39-56.1
      kernel-pv-base-4.1.39-56.1
      kernel-pv-base-debuginfo-4.1.39-56.1
      kernel-pv-debuginfo-4.1.39-56.1
      kernel-pv-debugsource-4.1.39-56.1
      kernel-pv-devel-4.1.39-56.1
      kernel-vanilla-4.1.39-56.1
      kernel-vanilla-debuginfo-4.1.39-56.1
      kernel-vanilla-debugsource-4.1.39-56.1
      kernel-vanilla-devel-4.1.39-56.1
      kernel-xen-4.1.39-56.1
      kernel-xen-base-4.1.39-56.1
      kernel-xen-base-debuginfo-4.1.39-56.1
      kernel-xen-debuginfo-4.1.39-56.1
      kernel-xen-debugsource-4.1.39-56.1
      kernel-xen-devel-4.1.39-56.1

   - openSUSE Leap 42.1 (i586 x86_64):

      kernel-default-4.1.39-56.1
      kernel-default-base-4.1.39-56.1
      kernel-default-base-debuginfo-4.1.39-56.1
      kernel-default-debuginfo-4.1.39-56.1
      kernel-default-debugsource-4.1.39-56.1
      kernel-default-devel-4.1.39-56.1
      kernel-obs-build-4.1.39-56.3
      kernel-obs-build-debugsource-4.1.39-56.3
      kernel-obs-qa-4.1.39-56.1
      kernel-syms-4.1.39-56.1

   - openSUSE Leap 42.1 (noarch):

      kernel-devel-4.1.39-56.1
      kernel-docs-4.1.39-56.2
      kernel-docs-html-4.1.39-56.2
      kernel-docs-pdf-4.1.39-56.2
      kernel-macros-4.1.39-56.1
      kernel-source-4.1.39-56.1
      kernel-source-vanilla-4.1.39-56.1

   - openSUSE Leap 42.1 (i686):

      kernel-pae-4.1.39-56.1
      kernel-pae-base-4.1.39-56.1
      kernel-pae-base-debuginfo-4.1.39-56.1
      kernel-pae-debuginfo-4.1.39-56.1
      kernel-pae-debugsource-4.1.39-56.1
      kernel-pae-devel-4.1.39-56.1


References:

   https://www.suse.com/security/cve/CVE-2016-10318.html
   https://www.suse.com/security/cve/CVE-2017-2671.html
   https://www.suse.com/security/cve/CVE-2017-7187.html
   https://www.suse.com/security/cve/CVE-2017-7261.html
   https://www.suse.com/security/cve/CVE-2017-7294.html
   https://www.suse.com/security/cve/CVE-2017-7308.html
   https://www.suse.com/security/cve/CVE-2017-7616.html
   https://www.suse.com/security/cve/CVE-2017-7618.html
   https://bugzilla.suse.com/1012829
   https://bugzilla.suse.com/1012876
   https://bugzilla.suse.com/1028415
   https://bugzilla.suse.com/1030213
   https://bugzilla.suse.com/1031003
   https://bugzilla.suse.com/1031052
   https://bugzilla.suse.com/1031440
   https://bugzilla.suse.com/1031579
   https://bugzilla.suse.com/1032435
   https://bugzilla.suse.com/1033336
   https://bugzilla.suse.com/1033340
   https://bugzilla.suse.com/1033518
   https://bugzilla.suse.com/1034670
   https://bugzilla.suse.com/930399
   https://bugzilla.suse.com/970083