SuSE: 2015:1376-1: important: the Real Time Linux Kernel
Summary
The SUSE Linux Enterprise 11 Service Pack 3 RealTime Extension kernel was
updated to fix various bugs and security issues.
The following vulnerabilities have been fixed:
CVE-2015-3636: A missing sk_nulls_node_init() in ping_unhash() inside the
ipv4 stack can cause crashes if a disconnect is followed by another
connect() attempt. (bnc#929525)
CVE-2015-3339: Race condition in the prepare_binprm function in fs/exec.c
in the Linux kernel before 3.19.6 allows local users to gain privileges by
executing a setuid program at a time instant when a chown to root is in
progress, and the ownership is changed but the setuid bit is not yet
stripped. (bnc#928130)
CVE-2015-3331: The __driver_rfc4106_decrypt function in
arch/x86/crypto/aesni-intel_glue.c in the Linux kernel before 3.19.3 does
not properly determine the memory locations used for encrypted data, which
allows context-dependent attackers to cause a denial of service (buffer
overflow and system crash) or possibly execute arbitrary code by
triggering a crypto API call, as demonstrated by use of a libkcapi test
program with an AF_ALG(aead) socket. (bnc#927257)
CVE-2015-2922: The ndisc_router_discovery function in net/ipv6/ndisc.c in
the Neighbor Discovery (ND) protocol implementation in the IPv6 stack in
the Linux kernel before 3.19.6 allows remote attackers to reconfigure a
hop-limit setting via a small hop_limit value in a Router Advertisement
(RA) message. (bnc#922583)
CVE-2015-2830: arch/x86/kernel/entry_64.S in the Linux kernel before
3.19.2 does not prevent the TS_COMPAT flag from reaching a user-mode task,
which might allow local users to bypass the seccomp or audit protection
mechanism via a crafted application that uses the (1) fork or (2) close
system call, as demonstrated by an attack against seccomp before 3.16.
(bnc#926240)
CVE-2015-2150: XSA-120: Xen 3.3.x through 4.5.x and the Linux kernel
through 3.19.1 do not properly restrict access to PCI command registers,
which might allow local guest users to cause a denial of service
(non-maskable interrupt and host crash) by disabling the (1) memory or (2)
I/O decoding for a PCI Express device and then accessing the device, which
triggers an Unsupported Request (UR) response. (bnc#919463)
CVE-2015-2042: net/rds/sysctl.c in the Linux kernel before 3.19 uses an
incorrect data type in a sysctl table, which allows local users to obtain
potentially sensitive information from kernel memory or possibly have
unspecified other impact by accessing a sysctl entry. (bnc#919018)
CVE-2015-2041: net/llc/sysctl_net_llc.c in the Linux kernel before 3.19
uses an incorrect data type in a sysctl table, which allows local users to
obtain potentially sensitive information from kernel memory or possibly
have unspecified other impact by accessing a sysctl entry. (bnc#919007)
CVE-2015-1421: Use-after-free vulnerability in the sctp_assoc_update
function in net/sctp/associola.c in the Linux kernel before 3.18.8 allows
remote attackers to cause a denial of service (slab corruption and panic)
or possibly have unspecified other impact by triggering an INIT collision
that leads to improper handling of shared-key data. (bnc#915577)
CVE-2015-0777: drivers/xen/usbback/usbback.c in linux-2.6.18-xen-3.4.0
(aka the Xen 3.4.x support patches for the Linux kernel 2.6.18), as used
in the Linux kernel 2.6.x and 3.x in SUSE Linux distributions, allows
guest OS users to obtain sensitive information from uninitialized
locations in host OS kernel memory via unspecified vectors. (bnc#917830)
CVE-2014-9683: Off-by-one error in the ecryptfs_decode_from_filename
function in fs/ecryptfs/crypto.c in the eCryptfs subsystem in the Linux
kernel before 3.18.2 allows local users to cause a denial of service
(buffer overflow and system crash) or possibly gain privileges via a
crafted filename. (bnc#918333)
CVE-2014-9529: Race condition in the key_gc_unused_keys function in
security/keys/gc.c in the Linux kernel through 3.18.2 allows local users to cause a denial of service (memory corruption or panic) or possibly have
unspecified other impact via keyctl commands that trigger access to a key
structure member during garbage collection of a key. (bnc#912202)
CVE-2014-9419: The __switch_to function in arch/x86/kernel/process_64.c in
the Linux kernel through 3.18.1 does not ensure that Thread Local Storage
(TLS) descriptors are loaded before proceeding with other steps, which
makes it easier for local users to bypass the ASLR protection mechanism
via a crafted application that reads a TLS base address. (bnc#911326)
CVE-2014-8159: The InfiniBand (IB) implementation in the Linux kernel does
not properly restrict use of User Verbs for registration of memory
regions, which allows local users to access arbitrary physical memory
locations, and consequently cause a denial of service (system crash) or
gain privileges, by leveraging permissions on a uverbs device under
/dev/infiniband/. (bnc#914742)
CVE-2014-8086: Race condition in the ext4_file_write_iter function in
fs/ext4/file.c in the Linux kernel through 3.17 allows local users to
cause a denial of service (file unavailability) via a combination of a
write action and an F_SETFL fcntl operation for the O_DIRECT flag.
(bnc#900881)
The following non-security bugs have been fixed:
* mm: exclude reserved pages from dirtyable memory (bnc#931015,
bnc#930788).
* mm: fix calculation of dirtyable memory (bnc#931015, bnc#930788).
* mm/page-writeback.c: fix dirty_balance_reserve subtraction from
dirtyable memory (bnc#931015, bnc#930788).
* mm, oom: fix and cleanup oom score calculations (bnc#930171).
* mm: fix anon_vma->degree underflow in anon_vma endless growing
prevention (bnc#904242).
* mm, slab: lock the correct nodelist after reenabling irqs
(bnc#926439).
* x86: irq: Check for valid irq descriptor
incheck_irq_vectors_for_cpu_disable (bnc#914726).
* x86/mce: Introduce mce_gather_info() (bsc#914987).
* x86/mce: Fix mce regression from recent cleanup (bsc#914987).
* x86/mce: Update MCE severity condition check (bsc#914987).
* x86, kvm: Remove incorrect redundant assembly constraint
(bnc#931850).
* x86/reboot: Fix a warning message triggered by stop_other_cpus()
(bnc#930284).
* x86/apic/uv: Update the UV APIC HUB check (bsc#929145).
* x86/apic/uv: Update the UV APIC driver check (bsc#929145).
* x86/apic/uv: Update the APIC UV OEM check (bsc#929145).
* kabi: invalidate removed sys_elem_dir::children (bnc#919589).
* kabi: fix for changes in the sysfs_dirent structure (bnc#919589).
* iommu/amd: Correctly encode huge pages in iommu page tables
(bsc#931014).
* iommu/amd: Optimize amd_iommu_iova_to_phys for new fetch_pte
interface (bsc#931014).
* iommu/amd: Optimize alloc_new_range for new fetch_pte interface
(bsc#931014).
* iommu/amd: Optimize iommu_unmap_page for new fetch_pte interface
(bsc#931014).
* iommu/amd: Return the pte page-size in fetch_pte (bsc#931014).
* rtc: Prevent the automatic reboot after powering off the system
(bnc#930145)
* rtc: Restore the RTC alarm time to the configured alarm time in BIOS
Setup (bnc#930145, bnc#927262).
* rtc: Add more TGCS models for alarm disable quirk (bnc#927262).
* kernel: Fix IA64 kernel/kthread.c build woes. Hide #include
References
#831029 #877456 #889221 #891212 #891641 #900881
#902286 #904242 #904883 #904901 #906027 #908706
#909309 #909312 #909477 #909684 #910517 #911326
#912202 #912741 #913080 #913598 #914726 #914742
#914818 #914987 #915045 #915200 #915577 #916521
#916848 #917093 #917120 #917648 #917684 #917830
#917839 #918333 #919007 #919018 #919357 #919463
#919589 #919682 #919808 #921769 #922583 #923344
#924142 #924271 #924333 #924340 #925012 #925370
#925443 #925567 #925729 #926016 #926240 #926439
#926767 #927190 #927257 #927262 #927338 #928122
#928130 #928142 #928333 #928970 #929145 #929148
#929283 #929525 #929647 #930145 #930171 #930226
#930284 #930401 #930669 #930786 #930788 #931014
#931015 #931850
Cross- CVE-2014-8086 CVE-2014-8159 CVE-2014-9419
CVE-2014-9529 CVE-2014-9683 CVE-2015-0777
CVE-2015-1421 CVE-2015-2041 CVE-2015-2042
CVE-2015-2150 CVE-2015-2830 CVE-2015-2922
CVE-2015-3331 CVE-2015-3339 CVE-2015-3636
Affected Products:
SUSE Linux Enterprise Real Time Extension 11 SP3
https://www.suse.com/security/cve/CVE-2014-8086.html
https://www.suse.com/security/cve/CVE-2014-8159.html
https://www.suse.com/security/cve/CVE-2014-9419.html
https://www.suse.com/security/cve/CVE-2014-9529.html
https://www.suse.com/security/cve/CVE-2014-9683.html
https://www.suse.com/security/cve/CVE-2015-0777.html
https://www.suse.com/security/cve/CVE-2015-1421.html
https://www.suse.com/security/cve/CVE-2015-2041.html
https://www.suse.com/security/cve/CVE-2015-2042.html
https://www.suse.com/security/cve/CVE-2015-2150.html
https://www.suse.com/security/cve/CVE-2015-2830.html
https://www.suse.com/security/cve/CVE-2015-2922.html
https://www.suse.com/security/cve/CVE-2015-3331.html
https://www.suse.com/security/cve/CVE-2015-3339.html
https://www.suse.com/security/cve/CVE-2015-3636.html
https://bugzilla.suse.com/831029
https://bugzilla.suse.com/877456
https://bugzilla.suse.com/889221
https://bugzilla.suse.com/891212
https://bugzilla.suse.com/891641
https://bugzilla.suse.com/900881
https://bugzilla.suse.com/902286
https://bugzilla.suse.com/904242
https://bugzilla.suse.com/904883
https://bugzilla.suse.com/904901
https://bugzilla.suse.com/906027
https://bugzilla.suse.com/908706
https://bugzilla.suse.com/909309
https://bugzilla.suse.com/909312
https://bugzilla.suse.com/909477
https://bugzilla.suse.com/909684
https://bugzilla.suse.com/910517
https://bugzilla.suse.com/911326
https://bugzilla.suse.com/912202
https://bugzilla.suse.com/912741
https://bugzilla.suse.com/913080
https://bugzilla.suse.com/913598
https://bugzilla.suse.com/914726
https://bugzilla.suse.com/914742
https://bugzilla.suse.com/914818
https://bugzilla.suse.com/914987
https://bugzilla.suse.com/915045
https://bugzilla.suse.com/915200
https://bugzilla.suse.com/915577
https://bugzilla.suse.com/916521
https://bugzilla.suse.com/916848
https://bugzilla.suse.com/917093
https://bugzilla.suse.com/917120
https://bugzilla.suse.com/917648
https://bugzilla.suse.com/917684
https://bugzilla.suse.com/917830
https://bugzilla.suse.com/917839
https://bugzilla.suse.com/918333
https://bugzilla.suse.com/919007
https://bugzilla.suse.com/919018
https://bugzilla.suse.com/919357
https://bugzilla.suse.com/919463
https://bugzilla.suse.com/919589
https://bugzilla.suse.com/919682
https://bugzilla.suse.com/919808
https://bugzilla.suse.com/921769
https://bugzilla.suse.com/922583
https://bugzilla.suse.com/923344
https://bugzilla.suse.com/924142
https://bugzilla.suse.com/924271
https://bugzilla.suse.com/924333
https://bugzilla.suse.com/924340
https://bugzilla.suse.com/925012
https://bugzilla.suse.com/925370
https://bugzilla.suse.com/925443
https://bugzilla.suse.com/925567
https://bugzilla.suse.com/925729
https://bugzilla.suse.com/926016
https://bugzilla.suse.com/926240
https://bugzilla.suse.com/926439
https://bugzilla.suse.com/926767
https://bugzilla.suse.com/927190
https://bugzilla.suse.com/927257
https://bugzilla.suse.com/927262
https://bugzilla.suse.com/927338
https://bugzilla.suse.com/928122
https://bugzilla.suse.com/928130
https://bugzilla.suse.com/928142
https://bugzilla.suse.com/928333
https://bugzilla.suse.com/928970
https://bugzilla.suse.com/929145
https://bugzilla.suse.com/929148
https://bugzilla.suse.com/929283
https://bugzilla.suse.com/929525
https://bugzilla.suse.com/929647
https://bugzilla.suse.com/930145
https://bugzilla.suse.com/930171
https://bugzilla.suse.com/930226
https://bugzilla.suse.com/930284
https://bugzilla.suse.com/930401
https://bugzilla.suse.com/930669
https://bugzilla.suse.com/930786
https://bugzilla.suse.com/930788
https://bugzilla.suse.com/931014
https://bugzilla.suse.com/931015
https://bugzilla.suse.com/931850
https://scc.suse.com:443/patches/