SUSE-SU-2014:1105-1: moderate: Security update for the Linux Kernel
sle-security-updates at lists.suse.com
sle-security-updates at lists.suse.com
Tue Sep 9 17:06:56 MDT 2014
SUSE Security Update: Security update for the Linux Kernel
______________________________________________________________________________
Announcement ID: SUSE-SU-2014:1105-1
Rating: moderate
References: #846404 #864464 #866911 #870173 #870576 #871676
#871797 #871854 #872634 #873374 #876590 #877257
#877775 #878115 #878509 #879921 #880484 #881051
#882804 #883724 #883795 #885422 #885725 #886474
#889173 #889324
Cross-References: CVE-2013-4299 CVE-2014-0055 CVE-2014-0077
CVE-2014-1739 CVE-2014-2706 CVE-2014-2851
CVE-2014-3144 CVE-2014-3145 CVE-2014-3917
CVE-2014-4508 CVE-2014-4652 CVE-2014-4653
CVE-2014-4654 CVE-2014-4655 CVE-2014-4656
CVE-2014-4667 CVE-2014-4699 CVE-2014-5077
Affected Products:
SUSE Linux Enterprise Server 11 SP2 LTSS
SLE 11 SERVER Unsupported Extras
______________________________________________________________________________
An update that solves 18 vulnerabilities and has 8 fixes is
now available. It includes one version update.
Description:
The SUSE Linux Enterprise Server 11 SP2 LTSS received a roll up update to
fix several security and non-security issues.
The following security issues have been fixed:
* CVE-2014-0055: The get_rx_bufs function in drivers/vhost/net.c in
the vhost-net subsystem in the Linux kernel package before
2.6.32-431.11.2 on Red Hat Enterprise Linux (RHEL) 6 does not
properly handle vhost_get_vq_desc errors, which allows guest OS
users to cause a denial of service (host OS crash) via unspecified
vectors. (bnc#870173)
* CVE-2014-0077: drivers/vhost/net.c in the Linux kernel before
3.13.10, when mergeable buffers are disabled, does not properly
validate packet lengths, which allows guest OS users to cause a
denial of service (memory corruption and host OS crash) or possibly
gain privileges on the host OS via crafted packets, related to the
handle_rx and get_rx_bufs functions. (bnc#870576)
* CVE-2014-1739: The media_device_enum_entities function in
drivers/media/media-device.c in the Linux kernel before 3.14.6 does
not initialize a certain data structure, which allows local users to
obtain sensitive information from kernel memory by leveraging
/dev/media0 read access for a MEDIA_IOC_ENUM_ENTITIES ioctl call.
(bnc#882804)
* CVE-2014-2706: Race condition in the mac80211 subsystem in the Linux
kernel before 3.13.7 allows remote attackers to cause a denial of
service (system crash) via network traffic that improperly interacts
with the WLAN_STA_PS_STA state (aka power-save mode), related to
sta_info.c and tx.c. (bnc#871797)
* CVE-2014-2851: Integer overflow in the ping_init_sock function in
net/ipv4/ping.c in the Linux kernel through 3.14.1 allows local
users to cause a denial of service (use-after-free and system crash)
or possibly gain privileges via a crafted application that leverages
an improperly managed reference counter. (bnc#873374)
* CVE-2014-3144: The (1) BPF_S_ANC_NLATTR and (2)
BPF_S_ANC_NLATTR_NEST extension implementations in the sk_run_filter
function in net/core/filter.c in the Linux kernel through 3.14.3 do
not check whether a certain length value is sufficiently large,
which allows local users to cause a denial of service (integer
underflow and system crash) via crafted BPF instructions. NOTE: the
affected code was moved to the __skb_get_nlattr and
__skb_get_nlattr_nest functions before the vulnerability was
announced. (bnc#877257)
* CVE-2014-3145: The BPF_S_ANC_NLATTR_NEST extension implementation in
the sk_run_filter function in net/core/filter.c in the Linux kernel
through 3.14.3 uses the reverse order in a certain subtraction,
which allows local users to cause a denial of service (over-read and
system crash) via crafted BPF instructions. NOTE: the affected code
was moved to the __skb_get_nlattr_nest function before the
vulnerability was announced. (bnc#877257)
* CVE-2014-3917: kernel/auditsc.c in the Linux kernel through 3.14.5,
when CONFIG_AUDITSYSCALL is enabled with certain syscall rules,
allows local users to obtain potentially sensitive single-bit values
from kernel memory or cause a denial of service (OOPS) via a large
value of a syscall number. (bnc#880484)
* CVE-2014-4508: arch/x86/kernel/entry_32.S in the Linux kernel
through 3.15.1 on 32-bit x86 platforms, when syscall auditing is
enabled and the sep CPU feature flag is set, allows local users to
cause a denial
of service (OOPS and system crash) via an invalid syscall number, as
demonstrated by number 1000. (bnc#883724)
* CVE-2014-4652: Race condition in the tlv handler functionality in
the snd_ctl_elem_user_tlv function in sound/core/control.c in the
ALSA control implementation in the Linux kernel before 3.15.2 allows
local users to obtain sensitive information from kernel memory by
leveraging /dev/snd/controlCX access. (bnc#883795)
* CVE-2014-4653: sound/core/control.c in the ALSA control
implementation in the Linux kernel before 3.15.2 does not ensure
possession of a read/write lock, which allows local users to cause a
denial of service (use-after-free) and obtain sensitive information
from kernel memory by leveraging /dev/snd/controlCX access.
(bnc#883795)
* CVE-2014-4654: The snd_ctl_elem_add function in sound/core/control.c
in the ALSA control implementation in the Linux kernel before 3.15.2
does not check authorization for SNDRV_CTL_IOCTL_ELEM_REPLACE
commands, which allows local users to remove kernel controls and
cause a denial of service (use-after-free and system crash) by
leveraging /dev/snd/controlCX access for an ioctl call. (bnc#883795)
* CVE-2014-4655: The snd_ctl_elem_add function in sound/core/control.c
in the ALSA control implementation in the Linux kernel before 3.15.2
does not properly maintain the user_ctl_count value, which allows
local users to cause a denial of service (integer overflow and limit
bypass) by leveraging /dev/snd/controlCX access for a large number
of SNDRV_CTL_IOCTL_ELEM_REPLACE ioctl calls. (bnc#883795)
* CVE-2014-4656: Multiple integer overflows in sound/core/control.c in
the ALSA control implementation in the Linux kernel before 3.15.2
allow local users to cause a denial of service by leveraging
/dev/snd/controlCX access, related to (1) index values in the
snd_ctl_add function and (2) numid values in the
snd_ctl_remove_numid_conflict function. (bnc#883795)
* CVE-2014-4667: The sctp_association_free function in
net/sctp/associola.c in the Linux kernel before 3.15.2 does not
properly manage a certain backlog value, which allows remote
attackers to cause a denial of service (socket outage) via a crafted
SCTP packet. (bnc#885422)
* CVE-2014-4699: The Linux kernel before 3.15.4 on Intel processors
does not properly restrict use of a non-canonical value for the
saved RIP address in the case of a system call that does not use
IRET, which allows local users to leverage a race condition and gain
privileges, or cause a denial of service (double fault), via a
crafted application that makes ptrace and fork system calls.
(bnc#885725)
* CVE-2014-5077: The sctp_assoc_update function in
net/sctp/associola.c in the Linux kernel through 3.15.8, when SCTP
authentication is enabled, allows remote attackers to cause a denial
of service (NULL pointer dereference and OOPS) by starting to
establish an association between two endpoints immediately after an
exchange of INIT and INIT ACK chunks to establish an earlier
association between these endpoints in the opposite direction.
(bnc#889173)
* CVE-2013-4299: Interpretation conflict in
drivers/md/dm-snap-persistent.c in the Linux kernel through 3.11.6
allows remote authenticated users to obtain sensitive information or
modify data via a crafted mapping to a snapshot block device.
(bnc#846404)
The following bugs have been fixed:
* pagecachelimit: reduce lru_lock contention for heavy parallel
reclaim (bnc#878509, bnc#864464).
* pagecachelimit: reduce lru_lock contention for heavy parallel
reclaim kabi fixup (bnc#878509, bnc#864464).
* ACPI / PAD: call schedule() when need_resched() is true (bnc#866911).
* kabi: Fix breakage due to addition of user_ctl_lock (bnc#883795).
* cpuset: Fix memory allocator deadlock (bnc#876590).
* tcp: allow to disable cwnd moderation in TCP_CA_Loss state
(bnc#879921).
* tcp: adapt selected parts of RFC 5682 and PRR logic (bnc#879921).
* vlan: more careful checksum features handling (bnc#872634).
* bonding: fix vlan_features computing (bnc#872634).
* NFSv4: Minor cleanups for nfs4_handle_exception and
nfs4_async_handle_error (bnc#889324).
* NFS: Do not lose sockets when nfsd shutdown races with connection
timeout (bnc#871854).
* reiserfs: call truncate_setsize under tailpack mutex (bnc#878115).
* reiserfs: drop vmtruncate (bnc#878115).
* megaraid_sas: mask off flags in ioctl path (bnc#886474).
* block: fix race between request completion and timeout handling
(bnc#881051).
* drivers/rtc/interface.c: fix infinite loop in initializing the alarm
(bnc#871676).
* xfrm: check peer pointer for null before calling inet_putpeer()
(bnc#877775).
* supported.conf: Add firewire/nosy as supported. This driver is the
replacement for the ieee1394/pcilynx driver, which was supported.
Security Issues:
* CVE-2013-4299
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4299>
* CVE-2014-0055
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0055>
* CVE-2014-0077
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0077>
* CVE-2014-1739
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1739>
* CVE-2014-2706
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2706>
* CVE-2014-2851
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2851>
* CVE-2014-3144
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3144>
* CVE-2014-3145
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3145>
* CVE-2014-3917
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3917>
* CVE-2014-4508
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4508>
* CVE-2014-4652
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4652>
* CVE-2014-4653
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4653>
* CVE-2014-4654
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4654>
* CVE-2014-4655
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4655>
* CVE-2014-4656
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4656>
* CVE-2014-4667
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4667>
* CVE-2014-4699
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4699>
* CVE-2014-5077
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5077>
Indications:
Everyone using the Linux Kernel on x86_64 architecture should update.
Special Instructions and Notes:
Please reboot the system after installing this update.
Patch Instructions:
To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:
- SUSE Linux Enterprise Server 11 SP2 LTSS:
zypper in -t patch slessp2-kernel-9630 slessp2-kernel-9631 slessp2-kernel-9632
To bring your system up-to-date, use "zypper patch".
Package List:
- SUSE Linux Enterprise Server 11 SP2 LTSS (i586 s390x x86_64) [New Version: 3.0.101]:
kernel-default-3.0.101-0.7.23.1
kernel-default-base-3.0.101-0.7.23.1
kernel-default-devel-3.0.101-0.7.23.1
kernel-source-3.0.101-0.7.23.1
kernel-syms-3.0.101-0.7.23.1
kernel-trace-3.0.101-0.7.23.1
kernel-trace-base-3.0.101-0.7.23.1
kernel-trace-devel-3.0.101-0.7.23.1
- SUSE Linux Enterprise Server 11 SP2 LTSS (i586 x86_64) [New Version: 3.0.101]:
kernel-ec2-3.0.101-0.7.23.1
kernel-ec2-base-3.0.101-0.7.23.1
kernel-ec2-devel-3.0.101-0.7.23.1
kernel-xen-3.0.101-0.7.23.1
kernel-xen-base-3.0.101-0.7.23.1
kernel-xen-devel-3.0.101-0.7.23.1
xen-kmp-default-4.1.6_06_3.0.101_0.7.23-0.5.30
xen-kmp-trace-4.1.6_06_3.0.101_0.7.23-0.5.30
- SUSE Linux Enterprise Server 11 SP2 LTSS (s390x) [New Version: 3.0.101]:
kernel-default-man-3.0.101-0.7.23.1
- SUSE Linux Enterprise Server 11 SP2 LTSS (i586) [New Version: 3.0.101]:
kernel-pae-3.0.101-0.7.23.1
kernel-pae-base-3.0.101-0.7.23.1
kernel-pae-devel-3.0.101-0.7.23.1
xen-kmp-pae-4.1.6_06_3.0.101_0.7.23-0.5.30
- SLE 11 SERVER Unsupported Extras (i586 s390x x86_64):
kernel-default-extra-3.0.101-0.7.23.1
- SLE 11 SERVER Unsupported Extras (i586 x86_64):
kernel-xen-extra-3.0.101-0.7.23.1
- SLE 11 SERVER Unsupported Extras (i586):
kernel-pae-extra-3.0.101-0.7.23.1
References:
http://support.novell.com/security/cve/CVE-2013-4299.html
http://support.novell.com/security/cve/CVE-2014-0055.html
http://support.novell.com/security/cve/CVE-2014-0077.html
http://support.novell.com/security/cve/CVE-2014-1739.html
http://support.novell.com/security/cve/CVE-2014-2706.html
http://support.novell.com/security/cve/CVE-2014-2851.html
http://support.novell.com/security/cve/CVE-2014-3144.html
http://support.novell.com/security/cve/CVE-2014-3145.html
http://support.novell.com/security/cve/CVE-2014-3917.html
http://support.novell.com/security/cve/CVE-2014-4508.html
http://support.novell.com/security/cve/CVE-2014-4652.html
http://support.novell.com/security/cve/CVE-2014-4653.html
http://support.novell.com/security/cve/CVE-2014-4654.html
http://support.novell.com/security/cve/CVE-2014-4655.html
http://support.novell.com/security/cve/CVE-2014-4656.html
http://support.novell.com/security/cve/CVE-2014-4667.html
http://support.novell.com/security/cve/CVE-2014-4699.html
http://support.novell.com/security/cve/CVE-2014-5077.html
https://bugzilla.novell.com/846404
https://bugzilla.novell.com/864464
https://bugzilla.novell.com/866911
https://bugzilla.novell.com/870173
https://bugzilla.novell.com/870576
https://bugzilla.novell.com/871676
https://bugzilla.novell.com/871797
https://bugzilla.novell.com/871854
https://bugzilla.novell.com/872634
https://bugzilla.novell.com/873374
https://bugzilla.novell.com/876590
https://bugzilla.novell.com/877257
https://bugzilla.novell.com/877775
https://bugzilla.novell.com/878115
https://bugzilla.novell.com/878509
https://bugzilla.novell.com/879921
https://bugzilla.novell.com/880484
https://bugzilla.novell.com/881051
https://bugzilla.novell.com/882804
https://bugzilla.novell.com/883724
https://bugzilla.novell.com/883795
https://bugzilla.novell.com/885422
https://bugzilla.novell.com/885725
https://bugzilla.novell.com/886474
https://bugzilla.novell.com/889173
https://bugzilla.novell.com/889324
http://download.suse.com/patch/finder/?keywords=1bdb6880fea42253a50653414920422e
http://download.suse.com/patch/finder/?keywords=218ba78474014b91211cb482f9ce7a3a
http://download.suse.com/patch/finder/?keywords=3fe24f0ad52cbb8be44e129fa1f0497a
http://download.suse.com/patch/finder/?keywords=41c4d735ff2c6886df2aa7dfcce0107b
http://download.suse.com/patch/finder/?keywords=4d4557738b3fb3592211aa4ebb60e887
http://download.suse.com/patch/finder/?keywords=4de705ad690dac2ee164aea48d16db9a
More information about the sle-security-updates
mailing list