What Are You Looking For?

Sign Up
   SUSE Security Update: Security update for the Linux Kernel
______________________________________________________________________________

Announcement ID:    SUSE-SU-2018:3618-1
Rating:             important
References:         #1099922 #1102870 #1106095 #1107829 #1108227 
                    #1109967 #1110247 #1113337 #905299 
Cross-References:   CVE-2018-12896 CVE-2018-14617 CVE-2018-14633
                    CVE-2018-16276
Affected Products:
                    SUSE Linux Enterprise Server 11-SP3-LTSS
                    SUSE Linux Enterprise Server 11-EXTRA
                    SUSE Linux Enterprise Point of Sale 11-SP3
                    SUSE Linux Enterprise Debuginfo 11-SP3
______________________________________________________________________________

   An update that solves four vulnerabilities and has 5 fixes
   is now available.

Description:



   The SUSE Linux Enterprise 11 SP3 LTSS kernel was updated to receive
   various security and bugfixes.

   The following security bugs were fixed:

   - CVE-2018-14633: A security flaw was found in the
     chap_server_compute_md5() function in the ISCSI target code in a way an
     authentication request from an ISCSI initiator is processed. An
     unauthenticated remote attacker can cause a stack buffer overflow and
     smash up to 17 bytes of the stack. The attack requires the iSCSI target
     to be enabled on the victim host. Depending on how the target's code was
     built (i.e. depending on a compiler, compile flags and hardware
     architecture) an attack may lead to a system crash and thus to a
     denial-of-service or possibly to a non-authorized access to data
     exported by an iSCSI target. Due to the nature of the flaw, privilege
     escalation cannot be fully ruled out, although we believe it is highly
     unlikely. (bnc#1107829).
   - CVE-2018-14617: There is a NULL pointer dereference and panic in
     hfsplus_lookup() in fs/hfsplus/dir.c when opening a file (that is
     purportedly a hard link) in an hfs+ filesystem that has malformed
     catalog data, and is mounted read-only without a metadata directory
     (bnc#1102870).
   - CVE-2018-16276: An issue was discovered in yurex_read in
     drivers/usb/misc/yurex.c where local attackers could use user access
     read/writes with incorrect bounds checking in the yurex USB driver to
     crash the kernel or potentially escalate privileges (bnc#1106095).
   - CVE-2018-12896: An Integer Overflow in kernel/time/posix-timers.c in the
     POSIX timer code is caused by the way the overrun accounting works.
     Depending on interval and expiry time values, the overrun can be larger
     than INT_MAX, but the accounting is int based. This basically made the
     accounting values, which are visible to user space via
     timer_getoverrun(2) and siginfo::si_overrun, random. For example, a
     local user can cause a denial of service (signed integer overflow) via
     crafted mmap, futex, timer_create, and timer_settime system calls
     (bnc#1099922).

   The following non-security bugs were fixed:

   - net: fix neighbours after MAC change (bnc#905299).
   - powerpc: Fix smp_mb__before_spinlock() (bsc#1110247).
   - x86/fpu: Do not do __thread_fpu_end() if use_eager_fpu() (bnc#1109967).
   - x86/fpu: fix signal handling with eager FPU switching (ia32)
     (bsc#1108227).
   - retpoline: Introduce start/end markers of indirect thunk (bsc#1113337).


Special Instructions and Notes:

   Please reboot the system after installing this update.

Patch Instructions:

   To install this SUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Server 11-SP3-LTSS:

      zypper in -t patch slessp3-kernel-source-13855=1

   - SUSE Linux Enterprise Server 11-EXTRA:

      zypper in -t patch slexsp3-kernel-source-13855=1

   - SUSE Linux Enterprise Point of Sale 11-SP3:

      zypper in -t patch sleposp3-kernel-source-13855=1

   - SUSE Linux Enterprise Debuginfo 11-SP3:

      zypper in -t patch dbgsp3-kernel-source-13855=1



Package List:

   - SUSE Linux Enterprise Server 11-SP3-LTSS (i586 s390x x86_64):

      kernel-default-3.0.101-0.47.106.56.1
      kernel-default-base-3.0.101-0.47.106.56.1
      kernel-default-devel-3.0.101-0.47.106.56.1
      kernel-source-3.0.101-0.47.106.56.1
      kernel-syms-3.0.101-0.47.106.56.1
      kernel-trace-3.0.101-0.47.106.56.1
      kernel-trace-base-3.0.101-0.47.106.56.1
      kernel-trace-devel-3.0.101-0.47.106.56.1

   - SUSE Linux Enterprise Server 11-SP3-LTSS (i586 x86_64):

      kernel-ec2-3.0.101-0.47.106.56.1
      kernel-ec2-base-3.0.101-0.47.106.56.1
      kernel-ec2-devel-3.0.101-0.47.106.56.1
      kernel-xen-3.0.101-0.47.106.56.1
      kernel-xen-base-3.0.101-0.47.106.56.1
      kernel-xen-devel-3.0.101-0.47.106.56.1

   - SUSE Linux Enterprise Server 11-SP3-LTSS (x86_64):

      kernel-bigsmp-3.0.101-0.47.106.56.1
      kernel-bigsmp-base-3.0.101-0.47.106.56.1
      kernel-bigsmp-devel-3.0.101-0.47.106.56.1

   - SUSE Linux Enterprise Server 11-SP3-LTSS (s390x):

      kernel-default-man-3.0.101-0.47.106.56.1

   - SUSE Linux Enterprise Server 11-SP3-LTSS (i586):

      kernel-pae-3.0.101-0.47.106.56.1
      kernel-pae-base-3.0.101-0.47.106.56.1
      kernel-pae-devel-3.0.101-0.47.106.56.1

   - SUSE Linux Enterprise Server 11-EXTRA (i586 ia64 ppc64 s390x x86_64):

      kernel-default-extra-3.0.101-0.47.106.56.1

   - SUSE Linux Enterprise Server 11-EXTRA (i586 x86_64):

      kernel-xen-extra-3.0.101-0.47.106.56.1

   - SUSE Linux Enterprise Server 11-EXTRA (x86_64):

      kernel-bigsmp-extra-3.0.101-0.47.106.56.1
      kernel-trace-extra-3.0.101-0.47.106.56.1

   - SUSE Linux Enterprise Server 11-EXTRA (ppc64):

      kernel-ppc64-extra-3.0.101-0.47.106.56.1

   - SUSE Linux Enterprise Server 11-EXTRA (i586):

      kernel-pae-extra-3.0.101-0.47.106.56.1

   - SUSE Linux Enterprise Point of Sale 11-SP3 (i586):

      kernel-default-3.0.101-0.47.106.56.1
      kernel-default-base-3.0.101-0.47.106.56.1
      kernel-default-devel-3.0.101-0.47.106.56.1
      kernel-ec2-3.0.101-0.47.106.56.1
      kernel-ec2-base-3.0.101-0.47.106.56.1
      kernel-ec2-devel-3.0.101-0.47.106.56.1
      kernel-pae-3.0.101-0.47.106.56.1
      kernel-pae-base-3.0.101-0.47.106.56.1
      kernel-pae-devel-3.0.101-0.47.106.56.1
      kernel-source-3.0.101-0.47.106.56.1
      kernel-syms-3.0.101-0.47.106.56.1
      kernel-trace-3.0.101-0.47.106.56.1
      kernel-trace-base-3.0.101-0.47.106.56.1
      kernel-trace-devel-3.0.101-0.47.106.56.1
      kernel-xen-3.0.101-0.47.106.56.1
      kernel-xen-base-3.0.101-0.47.106.56.1
      kernel-xen-devel-3.0.101-0.47.106.56.1

   - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 s390x x86_64):

      kernel-default-debuginfo-3.0.101-0.47.106.56.1
      kernel-default-debugsource-3.0.101-0.47.106.56.1
      kernel-trace-debuginfo-3.0.101-0.47.106.56.1
      kernel-trace-debugsource-3.0.101-0.47.106.56.1

   - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 x86_64):

      kernel-ec2-debuginfo-3.0.101-0.47.106.56.1
      kernel-ec2-debugsource-3.0.101-0.47.106.56.1
      kernel-xen-debuginfo-3.0.101-0.47.106.56.1
      kernel-xen-debugsource-3.0.101-0.47.106.56.1

   - SUSE Linux Enterprise Debuginfo 11-SP3 (x86_64):

      kernel-bigsmp-debuginfo-3.0.101-0.47.106.56.1
      kernel-bigsmp-debugsource-3.0.101-0.47.106.56.1

   - SUSE Linux Enterprise Debuginfo 11-SP3 (i586):

      kernel-pae-debuginfo-3.0.101-0.47.106.56.1
      kernel-pae-debugsource-3.0.101-0.47.106.56.1


References:

   https://www.suse.com/security/cve/CVE-2018-12896.html
   https://www.suse.com/security/cve/CVE-2018-14617.html
   https://www.suse.com/security/cve/CVE-2018-14633.html
   https://www.suse.com/security/cve/CVE-2018-16276.html
   https://bugzilla.suse.com/1099922
   https://bugzilla.suse.com/1102870
   https://bugzilla.suse.com/1106095
   https://bugzilla.suse.com/1107829
   https://bugzilla.suse.com/1108227
   https://bugzilla.suse.com/1109967
   https://bugzilla.suse.com/1110247
   https://bugzilla.suse.com/1113337
   https://bugzilla.suse.com/905299

_______________________________________________
sle-security-updates mailing list
sle-security-updates@lists.suse.com
https://lists.suse.com/mailman/listinfo/sle-security-updates

SUSE: 2018:3618-1 important: the Linux Kernel

November 5, 2018
An update that solves four vulnerabilities and has 5 fixes is now available

Summary

The SUSE Linux Enterprise 11 SP3 LTSS kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2018-14633: A security flaw was found in the chap_server_compute_md5() function in the ISCSI target code in a way an authentication request from an ISCSI initiator is processed. An unauthenticated remote attacker can cause a stack buffer overflow and smash up to 17 bytes of the stack. The attack requires the iSCSI target to be enabled on the victim host. Depending on how the target's code was built (i.e. depending on a compiler, compile flags and hardware architecture) an attack may lead to a system crash and thus to a denial-of-service or possibly to a non-authorized access to data exported by an iSCSI target. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is highly unlikely. (bnc#1107829). - CVE-2018-14617: There is a NULL pointer dereference and panic in hfsplus_lookup() in fs/hfsplus/dir.c when opening a file (that is purportedly a hard link) in an hfs+ filesystem that has malformed catalog data, and is mounted read-only without a metadata directory (bnc#1102870). - CVE-2018-16276: An issue was discovered in yurex_read in drivers/usb/misc/yurex.c where local attackers could use user access read/writes with incorrect bounds checking in the yurex USB driver to crash the kernel or potentially escalate privileges (bnc#1106095). - CVE-2018-12896: An Integer Overflow in kernel/time/posix-timers.c in the POSIX timer code is caused by the way the overrun accounting works. Depending on interval and expiry time values, the overrun can be larger than INT_MAX, but the accounting is int based. This basically made the accounting values, which are visible to user space via timer_getoverrun(2) and siginfo::si_overrun, random. For example, a local user can cause a denial of service (signed integer overflow) via crafted mmap, futex, timer_create, and timer_settime system calls (bnc#1099922). The following non-security bugs were fixed: - net: fix neighbours after MAC change (bnc#905299). - powerpc: Fix smp_mb__before_spinlock() (bsc#1110247). - x86/fpu: Do not do __thread_fpu_end() if use_eager_fpu() (bnc#1109967). - x86/fpu: fix signal handling with eager FPU switching (ia32) (bsc#1108227). - retpoline: Introduce start/end markers of indirect thunk (bsc#1113337).

References

#1099922 #1102870 #1106095 #1107829 #1108227

#1109967 #1110247 #1113337 #905299

Cross- CVE-2018-12896 CVE-2018-14617 CVE-2018-14633

CVE-2018-16276

Affected Products:

SUSE Linux Enterprise Server 11-SP3-LTSS

SUSE Linux Enterprise Server 11-EXTRA

SUSE Linux Enterprise Point of Sale 11-SP3

SUSE Linux Enterprise Debuginfo 11-SP3

https://www.suse.com/security/cve/CVE-2018-12896.html

https://www.suse.com/security/cve/CVE-2018-14617.html

https://www.suse.com/security/cve/CVE-2018-14633.html

https://www.suse.com/security/cve/CVE-2018-16276.html

https://bugzilla.suse.com/1099922

https://bugzilla.suse.com/1102870

https://bugzilla.suse.com/1106095

https://bugzilla.suse.com/1107829

https://bugzilla.suse.com/1108227

https://bugzilla.suse.com/1109967

https://bugzilla.suse.com/1110247

https://bugzilla.suse.com/1113337

https://bugzilla.suse.com/905299

Severity
Announcement ID: SUSE-SU-2018:3618-1
Rating: important

Related News

Security Highlights from KubeCon + CloudNativeCon 2023

Nov 18, 2023

Kubernetes Security on AWS: A Practical Guide

Nov 18, 2023

Nitrux 3.2.0 Linux Distro Released with Enhanced Security and New Features

Nov 28, 2023

Kinsing Hackers Exploit Apache ActiveMQ Vulnerability to Deploy Linux Rootkits

Nov 25, 2023

News

Advisories

HOWTOs

Features

Unlocking the Future of Authentication: Passkeys vs. Passwords
Empowering MSPs with Straightforward Linux Device Management
A Complete Guide to Torrenting Safely in 2024
Cloud Security Basics for Small Businesses
Scanning and Defending Networks with Nmap

About Us

Powered By

Footer Logo