Discover Government News

   SUSE Security Update: Security update for the Linux Kernel (Live Patch 28 for SLE 12)
______________________________________________________________________________

Announcement ID:    SUSE-SU-2017:3307-1
Rating:             important
References:         #1064388 #1064392 #1069708 
Cross-References:   CVE-2017-15649 CVE-2017-16939
Affected Products:
                    SUSE Linux Enterprise Server 12-LTSS
______________________________________________________________________________

   An update that solves two vulnerabilities and has one
   errata is now available.

Description:

   This update for the Linux Kernel 3.12.61-52_101 fixes several issues.

   The following security issues were fixed:

   - CVE-2017-16939: The XFRM dump policy implementation in
     net/xfrm/xfrm_user.c allowed local users to gain privileges or cause a
     denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt
     system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages
     (bsc#1069708).
   - CVE-2017-15649: net/packet/af_packet.c allowed local users to gain
     privileges via crafted system calls that trigger mishandling of
     packet_fanout data structures, because of a race condition (involving
     fanout_add and packet_do_bind) that leads to a use-after-free
     (bsc#1064392).


Patch Instructions:

   To install this SUSE Security Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Server 12-LTSS:

      zypper in -t patch SUSE-SLE-SERVER-12-2017-2061=1

   To bring your system up-to-date, use "zypper patch".


Package List:

   - SUSE Linux Enterprise Server 12-LTSS (x86_64):

      kgraft-patch-3_12_61-52_101-default-2-2.1
      kgraft-patch-3_12_61-52_101-xen-2-2.1


References:

   https://www.suse.com/security/cve/CVE-2017-15649.html
   https://www.suse.com/security/cve/CVE-2017-16939.html
   https://bugzilla.suse.com/1064388
   https://bugzilla.suse.com/1064392
   https://bugzilla.suse.com/1069708

SuSE: 2017:3307-1: important: the Linux Kernel (Live Patch 28 for SLE 12)

December 14, 2017
An update that solves two vulnerabilities and has one An update that solves two vulnerabilities and has one An update that solves two vulnerabilities and has one errata is now avai...

Summary

This update for the Linux Kernel 3.12.61-52_101 fixes several issues. The following security issues were fixed: - CVE-2017-16939: The XFRM dump policy implementation in net/xfrm/xfrm_user.c allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages (bsc#1069708). - CVE-2017-15649: net/packet/af_packet.c allowed local users to gain privileges via crafted system calls that trigger mishandling of packet_fanout data structures, because of a race condition (involving fanout_add and packet_do_bind) that leads to a use-after-free (bsc#1064392). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2017-2061=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 12-LTSS (x86_64): kgraft-patch-3_12_61-52_101-default-2-2.1 kgraft-patch-3_12_61-52_101-xen-2-2.1

References

#1064388 #1064392 #1069708

Cross- CVE-2017-15649 CVE-2017-16939

Affected Products:

SUSE Linux Enterprise Server 12-LTSS

https://www.suse.com/security/cve/CVE-2017-15649.html

https://www.suse.com/security/cve/CVE-2017-16939.html

https://bugzilla.suse.com/1064388

https://bugzilla.suse.com/1064392

https://bugzilla.suse.com/1069708

Severity
Announcement ID: SUSE-SU-2017:3307-1
Rating: important

Related News