SUSE: 2019:2950-1 important: the Linux Kernel

    Date12 Nov 2019
    CategorySuSE
    237
    Posted ByLinuxSecurity Advisories
    An update that solves 40 vulnerabilities and has 9 fixes is now available.
    
       SUSE Security Update: Security update for the Linux Kernel
    ______________________________________________________________________________
    
    Announcement ID:    SUSE-SU-2019:2950-1
    Rating:             important
    References:         #1117665 #1123959 #1137586 #1137865 #1137944 
                        #1139073 #1139751 #1142857 #1144903 #1145477 
                        #1145922 #1146042 #1146163 #1146285 #1146361 
                        #1146378 #1146391 #1146413 #1146425 #1146512 
                        #1146514 #1146516 #1146519 #1146524 #1146526 
                        #1146529 #1146540 #1146543 #1146547 #1146584 
                        #1146612 #1147122 #1148938 #1149376 #1149522 
                        #1149527 #1149555 #1150025 #1150112 #1150452 
                        #1150457 #1150465 #1151347 #1151350 #1152782 
                        #1152788 #1153119 #1155671 #999278 
    Cross-References:   CVE-2016-10906 CVE-2017-18509 CVE-2017-18551
                        CVE-2017-18595 CVE-2018-12207 CVE-2018-20976
                        CVE-2019-10207 CVE-2019-10220 CVE-2019-11135
                        CVE-2019-11477 CVE-2019-14814 CVE-2019-14815
                        CVE-2019-14816 CVE-2019-14821 CVE-2019-14835
                        CVE-2019-15098 CVE-2019-15118 CVE-2019-15212
                        CVE-2019-15215 CVE-2019-15216 CVE-2019-15217
                        CVE-2019-15218 CVE-2019-15219 CVE-2019-15220
                        CVE-2019-15221 CVE-2019-15290 CVE-2019-15291
                        CVE-2019-15505 CVE-2019-15807 CVE-2019-15902
                        CVE-2019-15926 CVE-2019-15927 CVE-2019-16232
                        CVE-2019-16233 CVE-2019-16234 CVE-2019-16413
                        CVE-2019-17055 CVE-2019-17056 CVE-2019-9456
                        CVE-2019-9506
    Affected Products:
                        SUSE Linux Enterprise Server for SAP 12-SP1
                        SUSE Linux Enterprise Server 12-SP1-LTSS
                        SUSE Linux Enterprise Module for Public Cloud 12
    ______________________________________________________________________________
    
       An update that solves 40 vulnerabilities and has 9 fixes is
       now available.
    
    Description:
    
    
    
       The SUSE Linux Enterprise 12 SP1 kernel was updated to receive various
       security and bugfixes.
    
    
       The following security bugs were fixed:
    
       - CVE-2018-12207: Untrusted virtual machines on Intel CPUs could exploit a
         race condition in the Instruction Fetch Unit of the Intel CPU to cause a
         Machine Exception during Page Size Change, causing the CPU core to be
         non-functional.
    
       The Linux Kernel KVM hypervisor was adjusted to avoid page size changes in
       executable pages by splitting / merging huge pages into small pages as
       needed. More information can be found on
       https://www.suse.com/support/kb/doc/?id=7023735
    
       - CVE-2019-11135: Aborting an asynchronous TSX operation on Intel CPUs
         with Transactional Memory support could be used to facilitate
         sidechannel information leaks out of microarchitectural buffers, similar
         to the previously described "Microarchitectural Data Sampling" attack.
    
       The Linux kernel was supplemented with the option to disable TSX operation
       altogether (requiring CPU Microcode updates on older systems) and better
       flushing of microarchitectural buffers (VERW).
    
       The set of options available is described in our TID at
       https://www.suse.com/support/kb/doc/?id=7024251
    
       - CVE-2019-16233: drivers/scsi/qla2xxx/qla_os.c did not check the
         alloc_workqueue return value, leading to a NULL pointer dereference.
         (bsc#1150457).
    
       - CVE-2019-10220: Added sanity checks on the pathnames passed to the user
         space. (bsc#1144903).
    
       - CVE-2019-16232: Fix a potential NULL pointer dereference in the Marwell
         libertas driver (bsc#1150465).
    
       - CVE-2019-16234: iwlwifi pcie driver did not check the alloc_workqueue
         return value, leading to a NULL pointer dereference. (bsc#1150452).
    
       - CVE-2019-17055: The AF_ISDN network module in the Linux kernel did not
         enforce CAP_NET_RAW, which meant that unprivileged users could create a
         raw socket (bnc#1152782).
    
       - CVE-2019-17056: The AF_NFC network module did not enforce CAP_NET_RAW,
         which meant that unprivileged users could create a raw socket
         (bsc#1152788).
    
       - CVE-2019-16413: The 9p filesystem did not protect i_size_write()
         properly, which caused an i_size_read() infinite loop and denial of
         service on SMP systems (bnc#1151347).
    
       - CVE-2019-15902: A backporting issue was discovered that re-introduced
         the Spectre vulnerability it had aimed to eliminate. This occurred
         because the backport process depends on cherry picking specific commits,
         and because two (correctly ordered) code lines were swapped
         (bnc#1149376).
    
       - CVE-2019-15291: Fixed a NULL pointer dereference issue that could be
         caused by a malicious USB device (bnc#11465).
    
       - CVE-2019-15807: Fixed a memory leak in the SCSI module that could be
         abused to cause denial of service (bnc#1148938).
    
       - CVE-2019-14821: An out-of-bounds access issue was fixed in the kernel's
         KVM hypervisor. An unprivileged host user or process with access to
         '/dev/kvm' device could use this flaw to crash the host kernel,
         resulting in a denial of service or potentially escalating privileges on
         the system (bnc#1151350).
    
       - CVE-2019-15505: An out-of-bounds issue had been fixed that could be
         caused by crafted USB device traffic (bnc#1147122).
    
       - CVE-2017-18595: A double free in allocate_trace_buffer was fixed
         (bnc#1149555).
    
       - CVE-2019-14835: A buffer overflow flaw was found in the kernel's vhost
         functionality that translates virtqueue buffers to IOVs. A privileged
         guest user able to pass descriptors with invalid length to the host
         could use this flaw to increase their privileges on the host
         (bnc#1150112).
    
       - CVE-2019-15216: A NULL pointer dereference was fixed that could be
         malicious USB device (bnc#1146361).
    
       - CVE-2019-9456: An out-of-bounds write in the USB monitor driver has been
         fixed. This issue could lead to local escalation of privilege with
         System execution privileges needed. (bnc#1150025).
    
       - CVE-2019-15926: An out-of-bounds access was fixed in the
         drivers/net/wireless/ath/ath6kl module. (bnc#1149527).
    
       - CVE-2019-15927: An out-of-bounds access was fixed in the sound/usb/mixer
         module (bnc#1149522).
    
       - CVE-2019-15219: A NULL pointer dereference was fixed that could be
         abused by a malicious USB device (bnc#1146524).
    
       - CVE-2019-15220: A use-after-free issue was fixed that could be caused by
         a malicious USB device (bnc#1146526).
    
       - CVE-2019-15221: A NULL pointer dereference was fixed that could be
         caused by a malicious USB device (bnc#1146529).
    
       - CVE-2019-14814: A heap-based buffer overflow was fixed in the marvell
         wifi chip driver. That issue allowed local users to cause a denial of
         service (system crash) or possibly execute arbitrary code (bnc#1146512).
    
       - CVE-2019-14815: A missing length check while parsing WMM IEs was fixed
         (bsc#1146512, bsc#1146514, bsc#1146516).
    
       - CVE-2019-14816: A heap-based buffer overflow in the marvell wifi chip
         driver was fixed. Local users would have abused this issue to cause a
         denial of service (system crash) or possibly execute arbitrary code
         (bnc#1146516).
    
       - CVE-2017-18509: An issue in net/ipv6 as fixed. By setting a specific
         socket
         option, an attacker could control a pointer in kernel land and cause an
          inet_csk_listen_stop general protection fault, or potentially execute
          arbitrary code under certain circumstances. The issue can be triggered
          as root (e.g., inside a default LXC container or with the CAP_NET_ADMIN
          capability) or after namespace unsharing. (bnc#1145477)
    
       - CVE-2019-9506: The Bluetooth BR/EDR specification used to permit
         sufficiently low encryption key length and did not prevent an attacker
         from influencing the key length negotiation. This allowed practical
         brute-force attacks (aka "KNOB") that could decrypt traffic and inject
         arbitrary ciphertext without the victim noticing (bnc#1137865).
    
       - CVE-2019-15098: A NULL pointer dereference in drivers/net/wireless/ath
         was fixed (bnc#1146378).
    
       - CVE-2019-15290: A NULL pointer dereference in
         ath6kl_usb_alloc_urb_from_pipe was fixed (bsc#1146378).
    
       - CVE-2019-15212: A double-free issue was fixed in drivers/usb driver
         (bnc#1146391).
    
       - CVE-2016-10906: A use-after-free issue was fixed in
         drivers/net/ethernet/arc (bnc#1146584).
    
       - CVE-2019-15217: A a NULL pointer dereference issue caused by a malicious
         USB device was fixed in the drivers/media/usb/zr364xx driver
         (bnc#1146519).
    
       - CVE-2019-15218: A NULL pointer dereference caused by a malicious USB
         device was fixed in the drivers/media/usb/siano driver (bnc#1146413).
    
       - CVE-2019-15215: A use-after-free issue caused by a malicious USB device
         was fixed in the drivers/media/usb/cpia2 driver (bnc#1146425).
    
       - CVE-2018-20976: A use-after-free issue was fixed in the fs/xfs driver
         (bnc#1146285).
    
       - CVE-2017-18551: An out-of-bounds write was fixed in the drivers/i2c
         driver (bnc#1146163).
    
       - CVE-2019-10207: Add checks for missing tty operations to prevent
         unprivileged user to  execute 0x0 address (bsc#1142857 bsc#1123959)
    
       - CVE-2019-15118: ALSA: usb-audio: Fix a stack buffer overflow bug in
         check_input_term leading to kernel stack exhaustion (bsc#1145922).
    
       The following non-security bugs were fixed:
    
       - array_index_nospec: Sanitize speculative array (bsc#1155671)
       - hpsa: move lockup_detected attribute to host attr (bsc#999278,
         bsc#1153119).
       - ib/core: Add mitigation for Spectre V1 (bsc#1155671)
       - kvm: Convert kvm_lock to a mutex (bsc#1117665).
       - kvm: MMU: drop read-only large sptes when creating lower level sptes
         (bsc#1117665).
       - kvm: vmx, svm: always run with EFER.NXE=1 when shadow paging is active
         (bsc#1117665).
       - kvm: x86: make FNAME(fetch) and __direct_map more similar (bsc#1117665).
       - media: smsusb: better handle optional alignment (bsc#1146413).
       - mwifiex: Fix heap overflow in mwifiex_uap_parse_tail_ies() (bsc#1137944).
       - netfilter: nf_nat: do not bug when mapping already exists (bsc#1146612).
       - tcp: Be more careful in tcp_fragment() (bsc#1137586 bsc#1139751).
    
    
    Special Instructions and Notes:
    
       Please reboot the system after installing this update.
    
    Patch Instructions:
    
       To install this SUSE Security Update use the SUSE recommended installation methods
       like YaST online_update or "zypper patch".
    
       Alternatively you can run the command listed for your product:
    
       - SUSE Linux Enterprise Server for SAP 12-SP1:
    
          zypper in -t patch SUSE-SLE-SAP-12-SP1-2019-2950=1
    
       - SUSE Linux Enterprise Server 12-SP1-LTSS:
    
          zypper in -t patch SUSE-SLE-SERVER-12-SP1-2019-2950=1
    
       - SUSE Linux Enterprise Module for Public Cloud 12:
    
          zypper in -t patch SUSE-SLE-Module-Public-Cloud-12-2019-2950=1
    
    
    
    Package List:
    
       - SUSE Linux Enterprise Server for SAP 12-SP1 (x86_64):
    
          kernel-default-3.12.74-60.64.124.1
          kernel-default-base-3.12.74-60.64.124.1
          kernel-default-base-debuginfo-3.12.74-60.64.124.1
          kernel-default-debuginfo-3.12.74-60.64.124.1
          kernel-default-debugsource-3.12.74-60.64.124.1
          kernel-default-devel-3.12.74-60.64.124.1
          kernel-syms-3.12.74-60.64.124.1
          kernel-xen-3.12.74-60.64.124.1
          kernel-xen-base-3.12.74-60.64.124.1
          kernel-xen-base-debuginfo-3.12.74-60.64.124.1
          kernel-xen-debuginfo-3.12.74-60.64.124.1
          kernel-xen-debugsource-3.12.74-60.64.124.1
          kernel-xen-devel-3.12.74-60.64.124.1
          kgraft-patch-3_12_74-60_64_124-default-1-2.3.1
          kgraft-patch-3_12_74-60_64_124-xen-1-2.3.1
    
       - SUSE Linux Enterprise Server for SAP 12-SP1 (noarch):
    
          kernel-devel-3.12.74-60.64.124.1
          kernel-macros-3.12.74-60.64.124.1
          kernel-source-3.12.74-60.64.124.1
    
       - SUSE Linux Enterprise Server 12-SP1-LTSS (ppc64le s390x x86_64):
    
          kernel-default-3.12.74-60.64.124.1
          kernel-default-base-3.12.74-60.64.124.1
          kernel-default-base-debuginfo-3.12.74-60.64.124.1
          kernel-default-debuginfo-3.12.74-60.64.124.1
          kernel-default-debugsource-3.12.74-60.64.124.1
          kernel-default-devel-3.12.74-60.64.124.1
          kernel-syms-3.12.74-60.64.124.1
    
       - SUSE Linux Enterprise Server 12-SP1-LTSS (noarch):
    
          kernel-devel-3.12.74-60.64.124.1
          kernel-macros-3.12.74-60.64.124.1
          kernel-source-3.12.74-60.64.124.1
    
       - SUSE Linux Enterprise Server 12-SP1-LTSS (x86_64):
    
          kernel-xen-3.12.74-60.64.124.1
          kernel-xen-base-3.12.74-60.64.124.1
          kernel-xen-base-debuginfo-3.12.74-60.64.124.1
          kernel-xen-debuginfo-3.12.74-60.64.124.1
          kernel-xen-debugsource-3.12.74-60.64.124.1
          kernel-xen-devel-3.12.74-60.64.124.1
          kgraft-patch-3_12_74-60_64_124-default-1-2.3.1
          kgraft-patch-3_12_74-60_64_124-xen-1-2.3.1
    
       - SUSE Linux Enterprise Server 12-SP1-LTSS (s390x):
    
          kernel-default-man-3.12.74-60.64.124.1
    
       - SUSE Linux Enterprise Module for Public Cloud 12 (x86_64):
    
          kernel-ec2-3.12.74-60.64.124.1
          kernel-ec2-debuginfo-3.12.74-60.64.124.1
          kernel-ec2-debugsource-3.12.74-60.64.124.1
          kernel-ec2-devel-3.12.74-60.64.124.1
          kernel-ec2-extra-3.12.74-60.64.124.1
          kernel-ec2-extra-debuginfo-3.12.74-60.64.124.1
    
    
    References:
    
       https://www.suse.com/security/cve/CVE-2016-10906.html
       https://www.suse.com/security/cve/CVE-2017-18509.html
       https://www.suse.com/security/cve/CVE-2017-18551.html
       https://www.suse.com/security/cve/CVE-2017-18595.html
       https://www.suse.com/security/cve/CVE-2018-12207.html
       https://www.suse.com/security/cve/CVE-2018-20976.html
       https://www.suse.com/security/cve/CVE-2019-10207.html
       https://www.suse.com/security/cve/CVE-2019-10220.html
       https://www.suse.com/security/cve/CVE-2019-11135.html
       https://www.suse.com/security/cve/CVE-2019-11477.html
       https://www.suse.com/security/cve/CVE-2019-14814.html
       https://www.suse.com/security/cve/CVE-2019-14815.html
       https://www.suse.com/security/cve/CVE-2019-14816.html
       https://www.suse.com/security/cve/CVE-2019-14821.html
       https://www.suse.com/security/cve/CVE-2019-14835.html
       https://www.suse.com/security/cve/CVE-2019-15098.html
       https://www.suse.com/security/cve/CVE-2019-15118.html
       https://www.suse.com/security/cve/CVE-2019-15212.html
       https://www.suse.com/security/cve/CVE-2019-15215.html
       https://www.suse.com/security/cve/CVE-2019-15216.html
       https://www.suse.com/security/cve/CVE-2019-15217.html
       https://www.suse.com/security/cve/CVE-2019-15218.html
       https://www.suse.com/security/cve/CVE-2019-15219.html
       https://www.suse.com/security/cve/CVE-2019-15220.html
       https://www.suse.com/security/cve/CVE-2019-15221.html
       https://www.suse.com/security/cve/CVE-2019-15290.html
       https://www.suse.com/security/cve/CVE-2019-15291.html
       https://www.suse.com/security/cve/CVE-2019-15505.html
       https://www.suse.com/security/cve/CVE-2019-15807.html
       https://www.suse.com/security/cve/CVE-2019-15902.html
       https://www.suse.com/security/cve/CVE-2019-15926.html
       https://www.suse.com/security/cve/CVE-2019-15927.html
       https://www.suse.com/security/cve/CVE-2019-16232.html
       https://www.suse.com/security/cve/CVE-2019-16233.html
       https://www.suse.com/security/cve/CVE-2019-16234.html
       https://www.suse.com/security/cve/CVE-2019-16413.html
       https://www.suse.com/security/cve/CVE-2019-17055.html
       https://www.suse.com/security/cve/CVE-2019-17056.html
       https://www.suse.com/security/cve/CVE-2019-9456.html
       https://www.suse.com/security/cve/CVE-2019-9506.html
       https://bugzilla.suse.com/1117665
       https://bugzilla.suse.com/1123959
       https://bugzilla.suse.com/1137586
       https://bugzilla.suse.com/1137865
       https://bugzilla.suse.com/1137944
       https://bugzilla.suse.com/1139073
       https://bugzilla.suse.com/1139751
       https://bugzilla.suse.com/1142857
       https://bugzilla.suse.com/1144903
       https://bugzilla.suse.com/1145477
       https://bugzilla.suse.com/1145922
       https://bugzilla.suse.com/1146042
       https://bugzilla.suse.com/1146163
       https://bugzilla.suse.com/1146285
       https://bugzilla.suse.com/1146361
       https://bugzilla.suse.com/1146378
       https://bugzilla.suse.com/1146391
       https://bugzilla.suse.com/1146413
       https://bugzilla.suse.com/1146425
       https://bugzilla.suse.com/1146512
       https://bugzilla.suse.com/1146514
       https://bugzilla.suse.com/1146516
       https://bugzilla.suse.com/1146519
       https://bugzilla.suse.com/1146524
       https://bugzilla.suse.com/1146526
       https://bugzilla.suse.com/1146529
       https://bugzilla.suse.com/1146540
       https://bugzilla.suse.com/1146543
       https://bugzilla.suse.com/1146547
       https://bugzilla.suse.com/1146584
       https://bugzilla.suse.com/1146612
       https://bugzilla.suse.com/1147122
       https://bugzilla.suse.com/1148938
       https://bugzilla.suse.com/1149376
       https://bugzilla.suse.com/1149522
       https://bugzilla.suse.com/1149527
       https://bugzilla.suse.com/1149555
       https://bugzilla.suse.com/1150025
       https://bugzilla.suse.com/1150112
       https://bugzilla.suse.com/1150452
       https://bugzilla.suse.com/1150457
       https://bugzilla.suse.com/1150465
       https://bugzilla.suse.com/1151347
       https://bugzilla.suse.com/1151350
       https://bugzilla.suse.com/1152782
       https://bugzilla.suse.com/1152788
       https://bugzilla.suse.com/1153119
       https://bugzilla.suse.com/1155671
       https://bugzilla.suse.com/999278
    
    _______________________________________________
    sle-security-updates mailing list
    This email address is being protected from spambots. You need JavaScript enabled to view it.
    http://lists.suse.com/mailman/listinfo/sle-security-updates
    
    You are not authorised to post comments.

    Comments powered by CComment

    LinuxSecurity Poll

    What do you think of the articles on LinuxSecurity?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/24-what-do-you-think-of-the-quality-of-the-articles-on-linuxsecurity?task=poll.vote&format=json
    24
    radio
    [{"id":"87","title":"Excellent, don't change a thing!","votes":"66","type":"x","order":"1","pct":57.39,"resources":[]},{"id":"88","title":"Should be more technical","votes":"15","type":"x","order":"2","pct":13.04,"resources":[]},{"id":"89","title":"Should include more HOWTOs","votes":"34","type":"x","order":"3","pct":29.57,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.