{"modified": "2015-09-08T00:00:00", "id": "SOL17244", "title": "SOL17244 - Linux kernel vulnerability CVE-2015-1593", "published": "2015-09-08T00:00:00", "viewCount": 3, "objectVersion": "1.2", "history": [], "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "lastseen": "2016-03-19T09:01:58", "description": "**Note**: As of February 17, 2015, AskF5 Security Advisory articles include the Severity value. Security Advisory articles published before this date do not list a Severity value.\n\n* In BIG-IP 10.x, some platforms are running 32-bit Linux kernel and some platforms are running 64-bit, depending on their hardware capabilities. To determine if your BIG-IP 10.x system is running 32-bit or 64-bit Linux kernel, you can enter the **uname -i **command from the command line and observe the output. If the output contains the **x86_64** string, the system is running 64-bit Linux kernel and is vulnerable to this issue. If the output contains the **i386** string, the system is running 32-bit Linux kernel and is not vulnerable to this issue. \n\n\nRecommended Action\n\nIf the previous table lists a version in the **Versions known to be not vulnerable** column, you can eliminate this vulnerability by upgrading to the listed version. If the listed version is older than the version you are currently running, or if the table does not list any version in the column, then no upgrade candidate currently exists.\n\nF5 responds to vulnerabilities in accordance with the Severity values published in the previous table. The Severity values and other security vulnerability parameters are defined in SOL4602: Overview of the F5 security vulnerability response policy.\n\nTo mitigate this vulnerability for affected F5 products, you should only permit management access to F5 products over a secure network and limit shell access to trusted users. For more information about securing access to BIG-IP and Enterprise Manager systems, refer to SOL13309: Restricting access to the Configuration utility by source IP address (11.x) and SOL13092: Overview of securing access to the BIG-IP system.\n\nSupplemental Information\n\n * SOL9970: Subscribing to email notifications regarding F5 products\n * SOL9957: Creating a custom RSS feed to view new and updated documents\n * SOL4602: Overview of the F5 security vulnerability response policy\n * SOL4918: Overview of the F5 critical issue hotfix policy\n * SOL167: Downloading software and firmware from F5\n", "href": "http://support.f5.com/kb/en-us/solutions/public/17000/200/sol17244.html", "hash": "ad1927f1bd4dd90990239f06c1044f5ef523c08e97c9968339141fbfe6eae45f", "edition": 1, "reporter": "f5", "references": ["https://support.f5.com/kb/en-us/solutions/public/9000/900/sol9970.html", "https://support.f5.com/kb/en-us/solutions/public/4000/900/sol4918.html", "https://support.f5.com/kb/en-us/solutions/public/4000/600/sol4602.html", "https://support.f5.com/kb/en-us/solutions/public/0000/100/sol167.html", "https://support.f5.com/kb/en-us/solutions/public/9000/900/sol9957.html"], "bulletinFamily": "software", "type": "f5", "cvelist": ["CVE-2015-1593"], "enchantments": {"vulnersScore": 8.3}}

{"result": {"cve": [{"id": "CVE-2015-1593", "type": "cve", "title": "CVE-2015-1593", "description": "The stack randomization feature in the Linux kernel before 3.19.1 on 64-bit platforms uses incorrect data types for the results of bitwise left-shift operations, which makes it easier for attackers to bypass the ASLR protection mechanism by predicting the address of the top of the stack, related to the randomize_stack_top function in fs/binfmt_elf.c and the stack_maxrandom_size function in arch/x86/mm/mmap.c.", "published": "2015-03-16T06:59:07", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1593", "cvelist": ["CVE-2015-1593"], "lastseen": "2018-01-05T11:51:34"}], "f5": [{"id": "F5:K17244", "type": "f5", "title": "Linux kernel vulnerability CVE-2015-1593", "description": " \n\n\nThe stack randomization feature in the Linux kernel before 3.19.1 on 64-bit platforms uses incorrect data types for the results of bitwise left-shift operations, which makes it easier for attackers to bypass the ASLR protection mechanism by predicting the address of the top of the stack, related to the randomize_stack_top function in fs/binfmt_elf.c and the stack_maxrandom_size function in arch/x86/mm/mmap.c. ([CVE-2015-1593](<https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1593>)) \n\n\nImpact \n\n\nA local authenticated attacker may be able to bypass the Address Space Layout Randomization (ASLR) protection mechanism on 64-bit systems. \n\n\nIf the previous table lists a version in the **Versions known to be not vulnerable** column, you can eliminate this vulnerability by upgrading to the listed version. If the listed version is older than the version you are currently running, or if the table does not list any version in the column, then no upgrade candidate currently exists.\n\nF5 responds to vulnerabilities in accordance with the Severity values published in the previous table. The Severity values and other security vulnerability parameters are defined in [K4602: Overview of the F5 security vulnerability response policy](<https://support.f5.com/csp/article/K4602>).\n\nTo mitigate this vulnerability for affected F5 products, you should only permit management access to F5 products over a secure network and limit shell access to trusted users. For more information about securing access to BIG-IP and Enterprise Manager systems, refer to [K13309: Restricting access to the Configuration utility by source IP address (11.x)](<https://support.f5.com/csp/article/K13309>) and [K13092: Overview of securing access to the BIG-IP system](<https://support.f5.com/csp/article/K13092>).\n\n * [K9970: Subscribing to email notifications regarding F5 products](<https://support.f5.com/csp/article/K9970>)\n * [K9957: Creating a custom RSS feed to view new and updated documents](<https://support.f5.com/csp/article/K9957>)\n * [K4602: Overview of the F5 security vulnerability response policy](<https://support.f5.com/csp/article/K4602>)\n * [K4918: Overview of the F5 critical issue hotfix policy](<https://support.f5.com/csp/article/K4918>)\n * [K167: Downloading software and firmware from F5](<https://support.f5.com/csp/article/K167>)\n", "published": "2015-09-08T21:39:00", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "href": "https://support.f5.com/csp/article/K17244", "cvelist": ["CVE-2015-1593"], "lastseen": "2017-10-12T02:11:11"}], "nessus": [{"id": "ALA_ALAS-2015-491.NASL", "type": "nessus", "title": "Amazon Linux AMI : kernel (ALAS-2015-491)", "description": "It was reported that stack address is not properly randomized on some 64 bit architectures due to an integer overflow. The stack entropy of the processes is reduced by four.", "published": "2015-03-17T00:00:00", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=81827", "cvelist": ["CVE-2015-1593"], "lastseen": "2018-04-19T07:52:20"}, {"id": "ORACLEVM_OVMSA-2015-0072.NASL", "type": "nessus", "title": "OracleVM 3.3 : kernel-uek (OVMSA-2015-0072)", "description": "The remote OracleVM system is missing necessary patches to address critical security updates :\n\n - x86/asm/entry/64: Remove a bogus 'ret_from_fork' optimization (Andy Lutomirski) [Orabug: 21308309] (CVE-2015-2830)\n\n - x86, mm/ASLR: Fix stack randomization on 64-bit systems (Hector Marco-Gisbert) [Orabug: 21307919] (CVE-2015-1593) (CVE-2015-1593)", "published": "2015-06-25T00:00:00", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=84390", "cvelist": ["CVE-2015-2830", "CVE-2015-1593"], "lastseen": "2017-10-29T13:35:48"}, {"id": "ORACLELINUX_ELSA-2015-3047.NASL", "type": "nessus", "title": "Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2015-3047)", "description": "Description of changes:\n\nkernel-uek [2.6.32-400.37.6.el6uek]\n- x86/asm/entry/64: Remove a bogus 'ret_from_fork' optimization (Andy Lutomirski) [Orabug: 21308307] {CVE-2015-2830}\n- x86, mm/ASLR: Fix stack randomization on 64-bit systems (Hector Marco-Gisbert) [Orabug: 21307917] {CVE-2015-1593} {CVE-2015-1593}", "published": "2015-06-26T00:00:00", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=84419", "cvelist": ["CVE-2015-2830", "CVE-2015-1593"], "lastseen": "2017-10-29T13:37:24"}, {"id": "ORACLELINUX_ELSA-2015-3046.NASL", "type": "nessus", "title": "Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2015-3046)", "description": "Description of changes:\n\n[2.6.39-400.250.6.el6uek]\n- x86/asm/entry/64: Remove a bogus 'ret_from_fork' optimization (Andy Lutomirski) [Orabug: 21308308] {CVE-2015-2830}\n- x86, mm/ASLR: Fix stack randomization on 64-bit systems (Hector Marco-Gisbert) [Orabug: 21307918] {CVE-2015-1593} {CVE-2015-1593}", "published": "2015-06-25T00:00:00", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=84389", "cvelist": ["CVE-2015-2830", "CVE-2015-1593"], "lastseen": "2017-10-29T13:45:32"}, {"id": "ORACLELINUX_ELSA-2015-3045.NASL", "type": "nessus", "title": "Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2015-3045)", "description": "Description of changes:\n\nkernel-uek [3.8.13-68.3.3.el7uek]\n- x86/asm/entry/64: Remove a bogus 'ret_from_fork' optimization (Andy Lutomirski) [Orabug: 21308309] {CVE-2015-2830}\n- x86, mm/ASLR: Fix stack randomization on 64-bit systems (Hector Marco-Gisbert) [Orabug: 21307919] {CVE-2015-1593} {CVE-2015-1593}", "published": "2015-06-25T00:00:00", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=84388", "cvelist": ["CVE-2015-2830", "CVE-2015-1593"], "lastseen": "2017-10-29T13:36:28"}, {"id": "FEDORA_2015-3011.NASL", "type": "nessus", "title": "Fedora 21 : kernel-3.18.8-201.fc21 (2015-3011)", "description": "Update to latest upstream stable release, Linux v3.18.8. Numerous bugfixes across the tree.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "published": "2015-03-10T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=81717", "cvelist": ["CVE-2015-1593", "CVE-2015-1421", "CVE-2015-0275"], "lastseen": "2017-10-29T13:42:30"}, {"id": "UBUNTU_USN-2565-1.NASL", "type": "nessus", "title": "Ubuntu 14.10 : linux vulnerabilities (USN-2565-1)", "description": "An integer overflow was discovered in the stack randomization feature of the Linux kernel on 64 bit platforms. A local attacker could exploit this flaw to bypass the Address Space Layout Randomization (ASLR) protection mechanism. (CVE-2015-1593)\n\nAn information leak was discovered in the Linux Kernel's handling of userspace configuration of the link layer control (LLC). A local user could exploit this flaw to read data from other sysctl settings.\n(CVE-2015-2041)\n\nAn information leak was discovered in how the Linux kernel handles setting the Reliable Datagram Sockets (RDS) settings. A local user could exploit this flaw to read data from other sysctl settings.\n(CVE-2015-2042).\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "published": "2015-04-10T00:00:00", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=82696", "cvelist": ["CVE-2015-1593", "CVE-2015-2041", "CVE-2015-2042"], "lastseen": "2017-10-29T13:39:40"}, {"id": "FEDORA_2015-3594.NASL", "type": "nessus", "title": "Fedora 20 : kernel-3.18.9-100.fc20 (2015-3594)", "description": "The 3.18.9 stable update contains a number of important fixes across the tree. Update to the latest stable upstream release, Linux v3.18.8.\nNumerous fixes across the tree.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "published": "2015-03-17T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=81863", "cvelist": ["CVE-2015-1593", "CVE-2015-1421", "CVE-2015-0275"], "lastseen": "2017-10-29T13:39:39"}, {"id": "UBUNTU_USN-2560-1.NASL", "type": "nessus", "title": "Ubuntu 12.04 LTS : linux vulnerabilities (USN-2560-1)", "description": "An integer overflow was discovered in the stack randomization feature of the Linux kernel on 64 bit platforms. A local attacker could exploit this flaw to bypass the Address Space Layout Randomization (ASLR) protection mechanism. (CVE-2015-1593)\n\nAn information leak was discovered in the Linux Kernel's handling of userspace configuration of the link layer control (LLC). A local user could exploit this flaw to read data from other sysctl settings.\n(CVE-2015-2041)\n\nAn information leak was discovered in how the Linux kernel handles setting the Reliable Datagram Sockets (RDS) settings. A local user could exploit this flaw to read data from other sysctl settings.\n(CVE-2015-2042).\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "published": "2015-04-09T00:00:00", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=82660", "cvelist": ["CVE-2015-1593", "CVE-2015-2041", "CVE-2015-2042"], "lastseen": "2017-10-29T13:45:38"}, {"id": "UBUNTU_USN-2564-1.NASL", "type": "nessus", "title": "Ubuntu 14.04 LTS : linux-lts-utopic vulnerabilities (USN-2564-1)", "description": "An integer overflow was discovered in the stack randomization feature of the Linux kernel on 64 bit platforms. A local attacker could exploit this flaw to bypass the Address Space Layout Randomization (ASLR) protection mechanism. (CVE-2015-1593)\n\nAn information leak was discovered in the Linux Kernel's handling of userspace configuration of the link layer control (LLC). A local user could exploit this flaw to read data from other sysctl settings.\n(CVE-2015-2041)\n\nAn information leak was discovered in how the Linux kernel handles setting the Reliable Datagram Sockets (RDS) settings. A local user could exploit this flaw to read data from other sysctl settings.\n(CVE-2015-2042).\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "published": "2015-04-10T00:00:00", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=82695", "cvelist": ["CVE-2015-1593", "CVE-2015-2041", "CVE-2015-2042"], "lastseen": "2017-10-29T13:43:00"}], "amazon": [{"id": "ALAS-2015-491", "type": "amazon", "title": "Low: kernel", "description": "**Issue Overview:**\n\nIt was reported that stack address is not properly randomized on some 64 bit architectures due to an integer overflow. The stack entropy of the processes is reduced by four.\n\n \n**Affected Packages:** \n\n\nkernel\n\n \n**Issue Correction:** \nRun _yum clean all_ followed by _yum update kernel_ to update your system. You will need to reboot your system in order for the new kernel to be running. \n\n \n**New Packages:**\n \n \n i686: \n kernel-headers-3.14.35-28.38.amzn1.i686 \n kernel-tools-debuginfo-3.14.35-28.38.amzn1.i686 \n perf-debuginfo-3.14.35-28.38.amzn1.i686 \n kernel-debuginfo-3.14.35-28.38.amzn1.i686 \n kernel-debuginfo-common-i686-3.14.35-28.38.amzn1.i686 \n kernel-tools-devel-3.14.35-28.38.amzn1.i686 \n kernel-3.14.35-28.38.amzn1.i686 \n kernel-tools-3.14.35-28.38.amzn1.i686 \n kernel-devel-3.14.35-28.38.amzn1.i686 \n perf-3.14.35-28.38.amzn1.i686 \n \n noarch: \n kernel-doc-3.14.35-28.38.amzn1.noarch \n \n src: \n kernel-3.14.35-28.38.amzn1.src \n \n x86_64: \n kernel-tools-devel-3.14.35-28.38.amzn1.x86_64 \n kernel-devel-3.14.35-28.38.amzn1.x86_64 \n perf-debuginfo-3.14.35-28.38.amzn1.x86_64 \n kernel-debuginfo-3.14.35-28.38.amzn1.x86_64 \n kernel-headers-3.14.35-28.38.amzn1.x86_64 \n kernel-tools-3.14.35-28.38.amzn1.x86_64 \n kernel-debuginfo-common-x86_64-3.14.35-28.38.amzn1.x86_64 \n kernel-tools-debuginfo-3.14.35-28.38.amzn1.x86_64 \n kernel-3.14.35-28.38.amzn1.x86_64 \n perf-3.14.35-28.38.amzn1.x86_64 \n \n \n", "published": "2015-03-13T02:34:00", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "href": "https://alas.aws.amazon.com/ALAS-2015-491.html", "cvelist": ["CVE-2015-1593"], "lastseen": "2016-09-28T21:04:11"}], "openvas": [{"id": "OPENVAS:1361412562310120165", "type": "openvas", "title": "Amazon Linux Local Check: ALAS-2015-491", "description": "Amazon Linux Local Security Checks", "published": "2015-09-08T00:00:00", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310120165", "cvelist": ["CVE-2015-1593"], "lastseen": "2017-07-24T12:52:20"}, {"id": "OPENVAS:1361412562310123092", "type": "openvas", "title": "Oracle Linux Local Check: ELSA-2015-3045", "description": "Oracle Linux Local Security Checks ELSA-2015-3045", "published": "2015-10-06T00:00:00", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310123092", "cvelist": ["CVE-2015-2830", "CVE-2015-1593"], "lastseen": "2017-07-24T12:53:56"}, {"id": "OPENVAS:1361412562310123091", "type": "openvas", "title": "Oracle Linux Local Check: ELSA-2015-3046", "description": "Oracle Linux Local Security Checks ELSA-2015-3046", "published": "2015-10-06T00:00:00", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310123091", "cvelist": ["CVE-2015-2830", "CVE-2015-1593"], "lastseen": "2017-07-24T12:53:27"}, {"id": "OPENVAS:1361412562310123093", "type": "openvas", "title": "Oracle Linux Local Check: ELSA-2015-3047", "description": "Oracle Linux Local Security Checks ELSA-2015-3047", "published": "2015-10-06T00:00:00", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310123093", "cvelist": ["CVE-2015-2830", "CVE-2015-1593"], "lastseen": "2017-07-24T12:52:22"}, {"id": "OPENVAS:1361412562310842165", "type": "openvas", "title": "Ubuntu Update for linux USN-2565-1", "description": "Check the version of linux", "published": "2015-04-10T00:00:00", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310842165", "cvelist": ["CVE-2015-1593", "CVE-2015-2041", "CVE-2015-2042"], "lastseen": "2017-12-04T11:23:43"}, {"id": "OPENVAS:1361412562310842159", "type": "openvas", "title": "Ubuntu Update for linux USN-2560-1", "description": "Check the version of linux", "published": "2015-04-09T00:00:00", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310842159", "cvelist": ["CVE-2015-1593", "CVE-2015-2041", "CVE-2015-2042"], "lastseen": "2017-12-04T11:23:22"}, {"id": "OPENVAS:1361412562310842166", "type": "openvas", "title": "Ubuntu Update for linux-lts-utopic USN-2564-1", "description": "Check the version of linux-lts-utopic", "published": "2015-04-10T00:00:00", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310842166", "cvelist": ["CVE-2015-1593", "CVE-2015-2041", "CVE-2015-2042"], "lastseen": "2017-12-04T11:23:20"}, {"id": "OPENVAS:1361412562310842161", "type": "openvas", "title": "Ubuntu Update for linux-lts-trusty USN-2562-1", "description": "Check the version of linux-lts-trusty", "published": "2015-04-09T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310842161", "cvelist": ["CVE-2015-1593", "CVE-2015-1421", "CVE-2015-1465", "CVE-2015-2041", "CVE-2015-2042"], "lastseen": "2017-12-04T11:24:16"}, {"id": "OPENVAS:1361412562310871389", "type": "openvas", "title": "RedHat Update for kernel RHSA-2015:1221-01", "description": "Check the version of kernel", "published": "2015-07-15T00:00:00", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310871389", "cvelist": ["CVE-2015-2830", "CVE-2015-1593", "CVE-2015-2922", "CVE-2011-5321", "CVE-2015-3636"], "lastseen": "2017-07-27T10:52:36"}, {"id": "OPENVAS:1361412562310842163", "type": "openvas", "title": "Ubuntu Update for linux-ti-omap4 USN-2561-1", "description": "Check the version of linux-ti-omap4", "published": "2015-04-09T00:00:00", "cvss": {"score": 6.9, "vector": "AV:LOCAL/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310842163", "cvelist": ["CVE-2015-1593", "CVE-2014-8159", "CVE-2015-2041", "CVE-2015-2042"], "lastseen": "2017-12-04T11:24:44"}], "oraclelinux": [{"id": "ELSA-2015-3046", "type": "oraclelinux", "title": "Unbreakable Enterprise kernel security update", "description": "[2.6.39-400.250.6]\n- x86/asm/entry/64: Remove a bogus 'ret_from_fork' optimization (Andy Lutomirski) [Orabug: 21308308] {CVE-2015-2830}\n- x86, mm/ASLR: Fix stack randomization on 64-bit systems (Hector Marco-Gisbert) [Orabug: 21307918] {CVE-2015-1593} {CVE-2015-1593}", "published": "2015-06-24T00:00:00", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "href": "http://linux.oracle.com/errata/ELSA-2015-3046.html", "cvelist": ["CVE-2015-2830", "CVE-2015-1593"], "lastseen": "2016-09-04T11:16:04"}, {"id": "ELSA-2015-3047", "type": "oraclelinux", "title": "Unbreakable Enterprise kernel security update", "description": "kernel-uek\n[2.6.32-400.37.6]\n- x86/asm/entry/64: Remove a bogus 'ret_from_fork' optimization (Andy Lutomirski) [Orabug: 21308307] {CVE-2015-2830}\n- x86, mm/ASLR: Fix stack randomization on 64-bit systems (Hector Marco-Gisbert) [Orabug: 21307917] {CVE-2015-1593} {CVE-2015-1593}", "published": "2015-06-24T00:00:00", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "href": "http://linux.oracle.com/errata/ELSA-2015-3047.html", "cvelist": ["CVE-2015-2830", "CVE-2015-1593"], "lastseen": "2016-09-04T11:17:12"}, {"id": "ELSA-2015-3045", "type": "oraclelinux", "title": "Unbreakable Enterprise kernel security update", "description": "kernel-uek\n[3.8.13-68.3.3]\n- x86/asm/entry/64: Remove a bogus 'ret_from_fork' optimization (Andy Lutomirski) [Orabug: 21308309] {CVE-2015-2830}\n- x86, mm/ASLR: Fix stack randomization on 64-bit systems (Hector Marco-Gisbert) [Orabug: 21307919] {CVE-2015-1593} {CVE-2015-1593}", "published": "2015-06-24T00:00:00", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "href": "http://linux.oracle.com/errata/ELSA-2015-3045.html", "cvelist": ["CVE-2015-2830", "CVE-2015-1593"], "lastseen": "2016-09-04T11:16:43"}, {"id": "ELSA-2015-1221", "type": "oraclelinux", "title": "kernel security, bug fix, and enhancement update", "description": "[2.6.32-504.30.3]\n- [redhat] spec: Update dracut dependency to pull in drbg module (Frantisek Hrbata) [1241517 1241338]\n[2.6.32-504.30.2]\n- [crypto] rng: Remove krng (Herbert Xu) [1233512 1226418]\n- [crypto] drbg: Add stdrng alias and increase priority (Herbert Xu) [1233512 1226418]\n- [crypto] seqiv: Move IV seeding into init function (Herbert Xu) [1233512 1226418]\n- [crypto] eseqiv: Move IV seeding into init function (Herbert Xu) [1233512 1226418]\n- [crypto] chainiv: Move IV seeding into init function (Herbert Xu) [1233512 1226418]\n[2.6.32-504.30.1]\n- [net] Fix checksum features handling in netif_skb_features() (Vlad Yasevich) [1231690 1220247]\n[2.6.32-504.29.1]\n- [net] gso: fix skb_segment for non-offset skb pointers (Jiri Benc) [1229586 1200533]\n[2.6.32-504.28.1]\n- [fs] pipe: fix pipe corruption and iovec overrun on partial copy (Seth Jennings) [1202860 1185166] {CVE-2015-1805}\n- [net] ipv4: Missing sk_nulls_node_init in ping_unhash (Denys Vlasenko) [1218102 1218103] {CVE-2015-3636}\n- [net] conntrack: RFC5961 challenge ACK confuse conntrack LAST-ACK transition (Jesper Brouer) [1227467 1227468 1212801 1200541]\n- [net] tcp: Restore RFC5961-compliant behavior for SYN packets (Jesper Brouer) [1227467 1227468 1212801 1200541]\n- [x86] kernel: ignore NMI IOCK when in kdump kernel (Jerry Snitselaar) [1225054 1196263]\n- [x86] asm/entry/64: Remove a bogus 'ret_from_fork' optimization (Mateusz Guzik) [1209232 1209233] {CVE-2015-2830}\n- [fs] gfs2: try harder to obtain journal lock during recovery (Abhijith Das) [1222588 1110846]\nfor core_pmu (Jiri Olsa) [1219149 1188336]\n- [x86] mm: Linux stack ASLR implementation (Jacob Tanenbaum) [1195682 1195683] {CVE-2015-1593}\n- [fs] xfs: DIO write completion size updates race (Brian Foster) [1218499 1198440]\n- [net] ipv6: Don't reduce hop limit for an interface (Denys Vlasenko) [1208492 1208493]\n- [net] vlan: more careful checksum features handling (Vlad Yasevich) [1221844 1212384]\n- [kernel] tracing: Export tracing clock functions (Jerry Snitselaar) [1217986 1212502]\n- [edac] sb_edac: fix corruption/crash on imbalanced Haswell home agents (Seth Jennings) [1213468 1210148]\n- [netdrv] tun: Fix csum_start with VLAN acceleration (Jason Wang) [1217189 1036482]\n- [netdrv] tun: unbreak truncated packet signalling (Jason Wang) [1217189 1036482]\n- [netdrv] tuntap: hardware vlan tx support (Jason Wang) [1217189 1036482]\n- [vhost] vhost-net: fix handle_rx buffer size (Jason Wang) [1217189 1036482]\n- [netdrv] ixgbe: fix X540 Completion timeout (John Greene) [1215855 1150343]\n- [char] tty: drop driver reference in tty_open fail path (Mateusz Guzik) [1201893 1201894]\n- [netdrv] macvtap: Fix csum_start when VLAN tags are present (Vlad Yasevich) [1215914 1123697]\n- [netdrv] macvtap: signal truncated packets (Vlad Yasevich) [1215914 1123697]\n- [netdrv] macvtap: restore vlan header on user read (Vlad Yasevich) [1215914 1123697]\n- [netdrv] macvlan: Initialize vlan_features to turn on offload support (Vlad Yasevich) [1215914 1123697]\n- [netdrv] macvlan: Add support for 'always_on' offload features (Vlad Yasevich) [1215914 1123697]\n- [netdrv] mactap: Fix checksum errors for non-gso packets in bridge mode (Vlad Yasevich) [1215914 1123697]\n- [netdrv] revert 'macvlan: fix checksums error when we are in bridge mode' (Vlad Yasevich) [1215914 1123697]\n- [net] core: Correctly set segment mac_len in skb_segment() (Vlad Yasevich) [1215914 1123697]\n- [net] core: generalize skb_segment() (Vlad Yasevich) [1215914 1123697]\n- [net] core: Add skb_headers_offset_update helper function (Vlad Yasevich) [1215914 1123697]\n- [netdrv] ixgbe: Correctly disable VLAN filter in promiscuous mode (Vlad Yasevich) [1215914 1123697]\n- [netdrv] ixgbe: remove vlan_filter_disable and enable functions (Vlad Yasevich) [1215914 1123697]\n- [netdrv] qlge: Fix TSO for non-accelerated vlan traffic (Vlad Yasevich) [1215914 1123697]\n- [netdrv] i40evf: Fix TSO and hw checksums for non-accelerated vlan packets (Vlad Yasevich) [1215914 1123697]\n- [netdrv] i40e: Fix TSO and hw checksums for non-accelerated vlan packets (Vlad Yasevich) [1215914 1123697]\n- [netdrv] ehea: Fix TSO and hw checksums with non-accelerated vlan packets (Vlad Yasevich) [1215914 1123697]\n- [netdrv] e1000: Fix TSO for non-accelerated vlan traffic (Vlad Yasevich) [1215914 1123697]\n- [kernel] ipc: sysv shared memory limited to 8TiB (George Beshers) [1224301 1171218]\n- [mm] hugetlb: improve page-fault scalability (Larry Woodman) [1212300 1120365]\n- [netdrv] hyperv: Fix the total_data_buflen in send path (Jason Wang) [1222556 1132918]\n- [crypto] drbg: fix maximum value checks on 32 bit systems (Herbert Xu) [1225950 1219907]\n- [crypto] drbg: remove configuration of fixed values (Herbert Xu) [1225950 1219907]\n[2.6.32-504.27.1]\n- [netdrv] mlx4_en: current_mac isn't updated in port up (Amir Vadai) [1224383 1081667]\n- [netdrv] mlx4_en: Fix mac_hash database inconsistency (Amir Vadai) [1224383 1081667]\n- [netdrv] mlx4_en: Protect MAC address modification with the state_lock mutex (Amir Vadai) [1224383 1081667]\n- [netdrv] mlx4_en: Fix errors in MAC address changing when port is down (Amir Vadai) [1224383 1081667]\n- [netdrv] mlx4: Verify port number in __mlx4_unregister_mac (Amir Vadai) [1224383 1081667]\n- [netdrv] mlx4_en: Adding missing initialization of perm_addr (Amir Vadai) [1225489 1120930]\n[2.6.32-504.26.1]\n- [kernel] sched: Fix clock_gettime(CLOCK_[PROCESS/THREAD]_CPUTIME_ID) monotonicity (Seth Jennings) [1219501 1140024]\n- [kernel] sched: Replace use of entity_key() (Larry Woodman) [1219123 1124603]\n[2.6.32-504.25.1]\n- [net] ipvs: allow rescheduling of new connections when port reuse is detected (Marcelo Leitner) [1222771 1108514]\n- [net] ipvs: Fix reuse connection if real server is dead (Marcelo Leitner) [1222771 1108514]\n- [netdrv] bonding: fix locking in enslave failure path (Nikolay Aleksandrov) [1222483 1221856]\n- [netdrv] bonding: primary_slave & curr_active_slave are not cleaned on enslave failure (Nikolay Aleksandrov) [1222483 1221856]\n- [netdrv] bonding: vlans don't get deleted on enslave failure (Nikolay Aleksandrov) [1222483 1221856]\n- [netdrv] bonding: mc addresses don't get deleted on enslave failure (Nikolay Aleksandrov) [1222483 1221856]\n- [netdrv] bonding: IFF_BONDING is not stripped on enslave failure (Nikolay Aleksandrov) [1222483 1221856]\n- [netdrv] bonding: fix error handling if slave is busy v2 (Nikolay Aleksandrov) [1222483 1221856]\n[2.6.32-504.24.1]\n- [mm] readahead: get back a sensible upper limit (Rafael Aquini) [1215755 1187940]", "published": "2015-07-14T00:00:00", "cvss": {"score": 7.2, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://linux.oracle.com/errata/ELSA-2015-1221.html", "cvelist": ["CVE-2015-2830", "CVE-2015-1593", "CVE-2015-2922", "CVE-2011-5321", "CVE-2015-3636", "CVE-2015-1805"], "lastseen": "2016-09-04T11:16:42"}, {"id": "ELSA-2015-1137", "type": "oraclelinux", "title": "kernel security and bug fix update", "description": "[3.10.0-229.7.2]\n- Oracle Linux certificates (Alexey Petrenko)\n[3.10.0-229.7.2]\n- [fs] pipe: fix pipe corruption and iovec overrun on partial copy (Seth Jennings) [1202861 1198843] {CVE-2015-1805}\n[3.10.0-229.7.1]\n- [scsi] storvsc: get rid of overly verbose warning messages (Vitaly Kuznetsov) [1215770 1206437]\n- [scsi] storvsc: force discovery of LUNs that may have been removed (Vitaly Kuznetsov) [1215770 1206437]\n- [scsi] storvsc: in responce to a scan event, scan the host (Vitaly Kuznetsov) [1215770 1206437]\n- [scsi] storvsc: NULL pointer dereference fix (Vitaly Kuznetsov) [1215770 1206437]\n- [virtio] defer config changed notifications (David Gibson) [1220278 1196009]\n- [virtio] unify config_changed handling (David Gibson) [1220278 1196009]\n- [x86] kernel: Remove a bogus 'ret_from_fork' optimization (Mateusz Guzik) [1209234 1209235] {CVE-2015-2830}\n- [kernel] futex: Mention key referencing differences between shared and private futexes (Larry Woodman) [1219169 1205862]\n- [kernel] futex: Ensure get_futex_key_refs() always implies a barrier (Larry Woodman) [1219169 1205862]\n- [scsi] megaraid_sas: revert: Add release date and update driver version (Tomas Henzl) [1216213 1207175]\n- [kernel] module: set nx before marking module MODULE_STATE_COMING (Hendrik Brueckner) [1214788 1196977]\n- [kernel] module: Clean up ro/nx after early module load failures (Pratyush Anand) [1214403 1202866]\n- [drm] radeon: fix kernel segfault in hwmonitor (Jerome Glisse) [1213467 1187817]\n- [fs] btrfs: make xattr replace operations atomic (Eric Sandeen) [1205086 1205873]\n- [x86] mm: Linux stack ASLR implementation (Jacob Tanenbaum) [1195684 1195685] {CVE-2015-1593}\n- [net] netfilter: nf_tables: fix flush ruleset chain dependencies (Jiri Pirko) [1192880 1192881] {CVE-2015-1573}\n- [fs] isofs: Fix unchecked printing of ER records (Mateusz Guzik) [1180482 1180483] {CVE-2014-9584}\n- [security] keys: memory corruption or panic during key garbage collection (Jacob Tanenbaum) [1179851 1179852] {CVE-2014-9529}\n- [fs] isofs: infinite loop in CE record entries (Jacob Tanenbaum) [1175246 1175248] {CVE-2014-9420}\n[3.10.0-229.6.1]\n- [net] tcp: abort orphan sockets stalling on zero window probes (Florian Westphal) [1215924 1151756]\n- [x86] crypto: aesni - fix memory usage in GCM decryption (Kurt Stutsman) [1213331 1212178] {CVE-2015-3331}\n[3.10.0-229.5.1]\n- [powerpc] mm: thp: Add tracepoints to track hugepage invalidate (Gustavo Duarte) [1212977 1199016]\n- [powerpc] mm: Use read barrier when creating real_pte (Gustavo Duarte) [1212977 1199016]\n- [powerpc] mm: thp: Use ACCESS_ONCE when loading pmdp (Gustavo Duarte) [1212977 1199016]\n- [powerpc] mm: thp: Invalidate with vpn in loop (Gustavo Duarte) [1212977 1199016]\n- [powerpc] mm: thp: Handle combo pages in invalidate (Gustavo Duarte) [1212977 1199016]\n- [powerpc] mm: thp: Invalidate old 64K based hash page mapping before insert of 4k pte (Gustavo Duarte) [1212977 1199016]\n- [powerpc] mm: thp: Don't recompute vsid and ssize in loop on invalidate (Gustavo Duarte) [1212977 1199016]\n- [powerpc] mm: thp: Add write barrier after updating the valid bit (Gustavo Duarte) [1212977 1199016]", "published": "2015-06-23T00:00:00", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://linux.oracle.com/errata/ELSA-2015-1137.html", "cvelist": ["CVE-2015-2830", "CVE-2014-9529", "CVE-2014-9420", "CVE-2015-1593", "CVE-2015-3331", "CVE-2014-9584", "CVE-2015-1573", "CVE-2015-1805"], "lastseen": "2016-09-04T11:17:06"}], "ubuntu": [{"id": "USN-2560-1", "type": "ubuntu", "title": "Linux kernel vulnerabilities", "description": "An integer overflow was discovered in the stack randomization feature of the Linux kernel on 64 bit platforms. A local attacker could exploit this flaw to bypass the Address Space Layout Randomization (ASLR) protection mechanism. (CVE-2015-1593)\n\nAn information leak was discovered in the Linux Kernel\u2019s handling of userspace configuration of the link layer control (LLC). A local user could exploit this flaw to read data from other sysctl settings. (CVE-2015-2041)\n\nAn information leak was discovered in how the Linux kernel handles setting the Reliable Datagram Sockets (RDS) settings. A local user could exploit this flaw to read data from other sysctl settings. (CVE-2015-2042)", "published": "2015-04-08T00:00:00", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "href": "https://usn.ubuntu.com/2560-1/", "cvelist": ["CVE-2015-1593", "CVE-2015-2041", "CVE-2015-2042"], "lastseen": "2018-03-29T18:17:04"}, {"id": "USN-2565-1", "type": "ubuntu", "title": "Linux kernel vulnerabilities", "description": "An integer overflow was discovered in the stack randomization feature of the Linux kernel on 64 bit platforms. A local attacker could exploit this flaw to bypass the Address Space Layout Randomization (ASLR) protection mechanism. (CVE-2015-1593)\n\nAn information leak was discovered in the Linux Kernel\u2019s handling of userspace configuration of the link layer control (LLC). A local user could exploit this flaw to read data from other sysctl settings. (CVE-2015-2041)\n\nAn information leak was discovered in how the Linux kernel handles setting the Reliable Datagram Sockets (RDS) settings. A local user could exploit this flaw to read data from other sysctl settings. (CVE-2015-2042)\n\nA memory corruption flaw was discovered in the Linux kernel\u2019s scsi subsystem. A local attacker could potentially exploit this flaw to cause a denial of service (system crash). (CVE-2015-4036)", "published": "2015-04-09T00:00:00", "cvss": {"score": 7.2, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://usn.ubuntu.com/2565-1/", "cvelist": ["CVE-2015-1593", "CVE-2015-2041", "CVE-2015-4036", "CVE-2015-2042"], "lastseen": "2018-03-29T18:18:55"}, {"id": "USN-2563-1", "type": "ubuntu", "title": "Linux kernel vulnerabilities", "description": "Sun Baoliang discovered a use after free flaw in the Linux kernel\u2019s SCTP (Stream Control Transmission Protocol) subsystem during INIT collisions. A remote attacker could exploit this flaw to cause a denial of service (system crash) or potentially escalate their privileges on the system. (CVE-2015-1421)\n\nMarcelo Leitner discovered a flaw in the Linux kernel\u2019s routing of packets to too many different dsts/too fast. A remote attacker on the same subnet can exploit this flaw to cause a denial of service (system crash). (CVE-2015-1465)\n\nAn integer overflow was discovered in the stack randomization feature of the Linux kernel on 64 bit platforms. A local attacker could exploit this flaw to bypass the Address Space Layout Randomization (ASLR) protection mechanism. (CVE-2015-1593)\n\nAn information leak was discovered in the Linux Kernel\u2019s handling of userspace configuration of the link layer control (LLC). A local user could exploit this flaw to read data from other sysctl settings. (CVE-2015-2041)\n\nAn information leak was discovered in how the Linux kernel handles setting the Reliable Datagram Sockets (RDS) settings. A local user could exploit this flaw to read data from other sysctl settings. (CVE-2015-2042)", "published": "2015-04-08T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://usn.ubuntu.com/2563-1/", "cvelist": ["CVE-2015-1593", "CVE-2015-1421", "CVE-2015-1465", "CVE-2015-2041", "CVE-2015-2042"], "lastseen": "2018-03-29T18:19:08"}, {"id": "USN-2562-1", "type": "ubuntu", "title": "Linux kernel (Trusty HWE) vulnerabilities", "description": "Sun Baoliang discovered a use after free flaw in the Linux kernel\u2019s SCTP (Stream Control Transmission Protocol) subsystem during INIT collisions. A remote attacker could exploit this flaw to cause a denial of service (system crash) or potentially escalate their privileges on the system. (CVE-2015-1421)\n\nMarcelo Leitner discovered a flaw in the Linux kernel\u2019s routing of packets to too many different dsts/too fast. A remote attacker on the same subnet can exploit this flaw to cause a denial of service (system crash). (CVE-2015-1465)\n\nAn integer overflow was discovered in the stack randomization feature of the Linux kernel on 64 bit platforms. A local attacker could exploit this flaw to bypass the Address Space Layout Randomization (ASLR) protection mechanism. (CVE-2015-1593)\n\nAn information leak was discovered in the Linux Kernel\u2019s handling of userspace configuration of the link layer control (LLC). A local user could exploit this flaw to read data from other sysctl settings. (CVE-2015-2041)\n\nAn information leak was discovered in how the Linux kernel handles setting the Reliable Datagram Sockets (RDS) settings. A local user could exploit this flaw to read data from other sysctl settings. (CVE-2015-2042)", "published": "2015-04-08T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://usn.ubuntu.com/2562-1/", "cvelist": ["CVE-2015-1593", "CVE-2015-1421", "CVE-2015-1465", "CVE-2015-2041", "CVE-2015-2042"], "lastseen": "2018-03-29T18:17:54"}, {"id": "USN-2561-1", "type": "ubuntu", "title": "Linux kernel (OMAP4) vulnerabilities", "description": "It was discovered that the Linux kernel\u2019s Infiniband subsystem did not properly sanitize its input parameters while registering memory regions from userspace. A local user could exploit this flaw to cause a denial of service (system crash) or to potentially gain administrative privileges. (CVE-2014-8159)\n\nAn integer overflow was discovered in the stack randomization feature of the Linux kernel on 64 bit platforms. A local attacker could exploit this flaw to bypass the Address Space Layout Randomization (ASLR) protection mechanism. (CVE-2015-1593)\n\nAn information leak was discovered in the Linux Kernel\u2019s handling of userspace configuration of the link layer control (LLC). A local user could exploit this flaw to read data from other sysctl settings. (CVE-2015-2041)\n\nAn information leak was discovered in how the Linux kernel handles setting the Reliable Datagram Sockets (RDS) settings. A local user could exploit this flaw to read data from other sysctl settings. (CVE-2015-2042)", "published": "2015-04-08T00:00:00", "cvss": {"score": 6.9, "vector": "AV:LOCAL/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://usn.ubuntu.com/2561-1/", "cvelist": ["CVE-2015-1593", "CVE-2014-8159", "CVE-2015-2041", "CVE-2015-2042"], "lastseen": "2018-03-29T18:20:36"}, {"id": "USN-2564-1", "type": "ubuntu", "title": "Linux kernel (Utopic HWE) vulnerabilities", "description": "An integer overflow was discovered in the stack randomization feature of the Linux kernel on 64 bit platforms. A local attacker could exploit this flaw to bypass the Address Space Layout Randomization (ASLR) protection mechanism. (CVE-2015-1593)\n\nAn information leak was discovered in the Linux Kernel\u2019s handling of userspace configuration of the link layer control (LLC). A local user could exploit this flaw to read data from other sysctl settings. (CVE-2015-2041)\n\nAn information leak was discovered in how the Linux kernel handles setting the Reliable Datagram Sockets (RDS) settings. A local user could exploit this flaw to read data from other sysctl settings. (CVE-2015-2042)\n\nA memory corruption flaw was discovered in the Linux kernel\u2019s scsi subsystem. A local attacker could potentially exploit this flaw to cause a denial of service (system crash). (CVE-2015-4036)", "published": "2015-04-09T00:00:00", "cvss": {"score": 7.2, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://usn.ubuntu.com/2564-1/", "cvelist": ["CVE-2015-1593", "CVE-2015-2041", "CVE-2015-4036", "CVE-2015-2042"], "lastseen": "2018-03-29T18:19:42"}], "redhat": [{"id": "RHSA-2015:1221", "type": "redhat", "title": "(RHSA-2015:1221) Moderate: kernel security, bug fix, and enhancement update", "description": "The kernel packages contain the Linux kernel, the core of any Linux\noperating system.\n\n* A NULL pointer dereference flaw was found in the way the Linux kernel's\nvirtual console implementation handled reference counting when accessing\npseudo-terminal device files (/dev/pts/*). A local, unprivileged attacker\ncould use this flaw to crash the system. (CVE-2011-5321, Moderate)\n\n* It was found that the Linux kernel's ping socket implementation did not\nproperly handle socket unhashing during spurious disconnects, which could\nlead to a use-after-free flaw. On x86-64 architecture systems, a local user\nable to create ping sockets could use this flaw to crash the system.\nOn non-x86-64 architecture systems, a local user able to create ping\nsockets could use this flaw to escalate their privileges on the system.\n(CVE-2015-3636, Moderate)\n\n* An integer overflow flaw was found in the way the Linux kernel randomized\nthe stack for processes on certain 64-bit architecture systems, such as\nx86-64, causing the stack entropy to be reduced by four. (CVE-2015-1593,\nLow)\n\n* A flaw was found in the way the Linux kernel's 32-bit emulation\nimplementation handled forking or closing of a task with an 'int80' entry.\nA local user could potentially use this flaw to escalate their privileges\non the system. (CVE-2015-2830, Low)\n\n* It was found that the Linux kernel's TCP/IP protocol suite implementation\nfor IPv6 allowed the Hop Limit value to be set to a smaller value than the\ndefault one. An attacker on a local network could use this flaw to prevent\nsystems on that network from sending or receiving network packets.\n(CVE-2015-2922, Low)\n\nThese updated kernel packages also include numerous bug fixes and one\nenhancement. Space precludes documenting all of these changes in this\nadvisory. For information on the most significant of these changes, users\nare directed to the following article on the Red Hat Customer Portal:\n\nhttps://access.redhat.com/articles/1506133\n\nAll kernel users are advised to upgrade to these updated packages, which\ncontain backported patches to correct these issues and add this\nenhancement. The system must be rebooted for this update to take effect.\n", "published": "2015-07-14T04:00:00", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "href": "https://access.redhat.com/errata/RHSA-2015:1221", "cvelist": ["CVE-2015-2830", "CVE-2015-1593", "CVE-2015-2922", "CVE-2011-5321", "CVE-2015-3636"], "lastseen": "2017-03-06T21:18:48"}, {"id": "RHSA-2015:1137", "type": "redhat", "title": "(RHSA-2015:1137) Important: kernel security and bug fix update", "description": "The kernel packages contain the Linux kernel, the core of any Linux\noperating system.\n\n* It was found that the Linux kernel's implementation of vectored pipe read\nand write functionality did not take into account the I/O vectors that were\nalready processed when retrying after a failed atomic access operation,\npotentially resulting in memory corruption due to an I/O vector array\noverrun. A local, unprivileged user could use this flaw to crash the system\nor, potentially, escalate their privileges on the system. (CVE-2015-1805,\nImportant)\n\n* A race condition flaw was found in the way the Linux kernel keys\nmanagement subsystem performed key garbage collection. A local attacker\ncould attempt accessing a key while it was being garbage collected, which\nwould cause the system to crash. (CVE-2014-9529, Moderate)\n\n* A flaw was found in the way the Linux kernel's 32-bit emulation\nimplementation handled forking or closing of a task with an 'int80' entry.\nA local user could potentially use this flaw to escalate their privileges\non the system. (CVE-2015-2830, Low)\n\n* It was found that the Linux kernel's ISO file system implementation did\nnot correctly limit the traversal of Rock Ridge extension Continuation\nEntries (CE). An attacker with physical access to the system could use this\nflaw to trigger an infinite loop in the kernel, resulting in a denial of\nservice. (CVE-2014-9420, Low)\n\n* An information leak flaw was found in the way the Linux kernel's ISO9660\nfile system implementation accessed data on an ISO9660 image with RockRidge\nExtension Reference (ER) records. An attacker with physical access to the\nsystem could use this flaw to disclose up to 255 bytes of kernel memory.\n(CVE-2014-9584, Low)\n\n* A flaw was found in the way the nft_flush_table() function of the Linux\nkernel's netfilter tables implementation flushed rules that were\nreferencing deleted chains. A local user who has the CAP_NET_ADMIN\ncapability could use this flaw to crash the system. (CVE-2015-1573, Low)\n\n* An integer overflow flaw was found in the way the Linux kernel randomized\nthe stack for processes on certain 64-bit architecture systems, such as\nx86-64, causing the stack entropy to be reduced by four. (CVE-2015-1593,\nLow)\n\nRed Hat would like to thank Carl Henrik Lunde for reporting CVE-2014-9420\nand CVE-2014-9584. The security impact of the CVE-2015-1805 issue was\ndiscovered by Red Hat.\n\nThis update also fixes several bugs. Documentation for these changes is\navailable from the following Knowledgebase article:\nhttps://access.redhat.com/articles/1469163\n\nAll kernel users are advised to upgrade to these updated packages, which\ncontain backported patches to correct these issues. The system must be\nrebooted for this update to take effect.\n", "published": "2015-06-23T04:00:00", "cvss": {"score": 7.2, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://access.redhat.com/errata/RHSA-2015:1137", "cvelist": ["CVE-2014-9420", "CVE-2014-9529", "CVE-2014-9584", "CVE-2015-1573", "CVE-2015-1593", "CVE-2015-1805", "CVE-2015-2830"], "lastseen": "2018-04-15T16:22:08"}, {"id": "RHSA-2015:1138", "type": "redhat", "title": "(RHSA-2015:1138) Important: kernel-rt security, bug fix, and enhancement update", "description": "The kernel-rt packages contain the Linux kernel, the core of any Linux\noperating system.\n\n* It was found that the Linux kernel's implementation of vectored pipe read\nand write functionality did not take into account the I/O vectors that were\nalready processed when retrying after a failed atomic access operation,\npotentially resulting in memory corruption due to an I/O vector array\noverrun. A local, unprivileged user could use this flaw to crash the system\nor, potentially, escalate their privileges on the system. (CVE-2015-1805,\nImportant)\n\n* A race condition flaw was found in the way the Linux kernel keys\nmanagement subsystem performed key garbage collection. A local attacker\ncould attempt accessing a key while it was being garbage collected, which\nwould cause the system to crash. (CVE-2014-9529, Moderate)\n\n* A flaw was found in the way the Linux kernel's 32-bit emulation\nimplementation handled forking or closing of a task with an 'int80' entry.\nA local user could potentially use this flaw to escalate their privileges\non the system. (CVE-2015-2830, Low)\n\n* It was found that the Linux kernel's ISO file system implementation did\nnot correctly limit the traversal of Rock Ridge extension Continuation\nEntries (CE). An attacker with physical access to the system could use this\nflaw to trigger an infinite loop in the kernel, resulting in a denial of\nservice. (CVE-2014-9420, Low)\n\n* An information leak flaw was found in the way the Linux kernel's ISO9660\nfile system implementation accessed data on an ISO9660 image with RockRidge\nExtension Reference (ER) records. An attacker with physical access to the\nsystem could use this flaw to disclose up to 255 bytes of kernel memory.\n(CVE-2014-9584, Low)\n\n* A flaw was found in the way the nft_flush_table() function of the Linux\nkernel's netfilter tables implementation flushed rules that were\nreferencing deleted chains. A local user who has the CAP_NET_ADMIN\ncapability could use this flaw to crash the system. (CVE-2015-1573, Low)\n\n* An integer overflow flaw was found in the way the Linux kernel randomized\nthe stack for processes on certain 64-bit architecture systems, such as\nx86-64, causing the stack entropy to be reduced by four. (CVE-2015-1593,\nLow)\n\nRed Hat would like to thank Carl Henrik Lunde for reporting CVE-2014-9420\nand CVE-2014-9584. The security impact of CVE-2015-1805 was discovered by\nRed Hat.\n\nThis update provides a build of the kernel-rt package for Red Hat\nEnterprise MRG 2.5 that is layered on Red Hat Enterprise Linux 6, and\nfixes the following issues:\n\n* storvsc: get rid of overly verbose warning messages\n* storvsc: force discovery of LUNs that may have been removed\n* storvsc: in responce to a scan event, scan the hos\n* storvsc: NULL pointer dereference fix\n* futex: Mention key referencing differences between shared and private\nfutexes\n* futex: Ensure get_futex_key_refs() always implies a barrier\n* kernel module: set nx before marking module MODULE_STATE_COMING\n* kernel module: Clean up ro/nx after early module load failures\n* btrfs: make xattr replace operations atomic\n* megaraid_sas: revert: Add release date and update driver version\n* radeon: fix kernel segfault in hwmonitor\n\n(BZ#1223077)\n\nBug fix:\n\n* There is an XFS optimization that depended on a spinlock to disable\npreemption using the preempt_disable() function. When CONFIG_PREEMPT_RT is\nenabled on realtime kernels, spinlocks do not disable preemption while\nheld, so the XFS critical section was not protected from preemption.\nSystems on the Realtime kernel-rt could lock up in this XFS optimization\nwhen a task that locked all the counters was then preempted by a realtime\ntask, causing all callers of that lock to block indefinitely. This update\ndisables the optimization when building a kernel with\nCONFIG_PREEMPT_RT_FULL enabled. (BZ#1217849)\n\nAll kernel-rt users are advised to upgrade to these updated packages, which\ncorrect these issues and add these enhancements. The system must be\nrebooted for this update to take effect.\n", "published": "2015-06-23T04:00:00", "cvss": {"score": 7.2, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://access.redhat.com/errata/RHSA-2015:1138", "cvelist": ["CVE-2015-2830", "CVE-2014-9529", "CVE-2014-9420", "CVE-2015-1593", "CVE-2014-9584", "CVE-2015-1573", "CVE-2015-1805"], "lastseen": "2017-03-03T19:18:36"}, {"id": "RHSA-2015:1139", "type": "redhat", "title": "(RHSA-2015:1139) Important: kernel-rt security, bug fix, and enhancement update", "description": "The kernel-rt packages contain the Linux kernel, the core of any Linux\noperating system.\n\n* It was found that the Linux kernel's implementation of vectored pipe read\nand write functionality did not take into account the I/O vectors that were\nalready processed when retrying after a failed atomic access operation,\npotentially resulting in memory corruption due to an I/O vector array\noverrun. A local, unprivileged user could use this flaw to crash the system\nor, potentially, escalate their privileges on the system. (CVE-2015-1805,\nImportant)\n\n* A race condition flaw was found in the way the Linux kernel keys\nmanagement subsystem performed key garbage collection. A local attacker\ncould attempt accessing a key while it was being garbage collected, which\nwould cause the system to crash. (CVE-2014-9529, Moderate)\n\n* A flaw was found in the way the Linux kernel's 32-bit emulation\nimplementation handled forking or closing of a task with an 'int80' entry.\nA local user could potentially use this flaw to escalate their privileges\non the system. (CVE-2015-2830, Low)\n\n* It was found that the Linux kernel's ISO file system implementation did\nnot correctly limit the traversal of Rock Ridge extension Continuation\nEntries (CE). An attacker with physical access to the system could use this\nflaw to trigger an infinite loop in the kernel, resulting in a denial of\nservice. (CVE-2014-9420, Low)\n\n* An information leak flaw was found in the way the Linux kernel's ISO9660\nfile system implementation accessed data on an ISO9660 image with RockRidge\nExtension Reference (ER) records. An attacker with physical access to the\nsystem could use this flaw to disclose up to 255 bytes of kernel memory.\n(CVE-2014-9584, Low)\n\n* A flaw was found in the way the nft_flush_table() function of the Linux\nkernel's netfilter tables implementation flushed rules that were\nreferencing deleted chains. A local user who has the CAP_NET_ADMIN\ncapability could use this flaw to crash the system. (CVE-2015-1573, Low)\n\n* An integer overflow flaw was found in the way the Linux kernel randomized\nthe stack for processes on certain 64-bit architecture systems, such as\nx86-64, causing the stack entropy to be reduced by four. (CVE-2015-1593,\nLow)\n\nRed Hat would like to thank Carl Henrik Lunde for reporting CVE-2014-9420\nand CVE-2014-9584. The security impact of CVE-2015-1805 was discovered by\nRed Hat.\n\nThe kernel-rt packages have been upgraded to version 3.10.0-229.7.2, which\nprovides a number of bug fixes and enhancements over the previous version,\nincluding:\n\n* storvsc: get rid of overly verbose warning messages\n* storvsc: force discovery of LUNs that may have been removed\n* storvsc: in responce to a scan event, scan the hos\n* storvsc: NULL pointer dereference fix\n* futex: Mention key referencing differences between shared and private\nfutexes\n* futex: Ensure get_futex_key_refs() always implies a barrier\n* kernel module: set nx before marking module MODULE_STATE_COMING\n* kernel module: Clean up ro/nx after early module load failures\n* btrfs: make xattr replace operations atomic\n* megaraid_sas: revert: Add release date and update driver version\n* radeon: fix kernel segfault in hwmonitor\n\n(BZ#1223955)\n\nBug fix:\n\n* There is an XFS optimization that depended on a spinlock to disable\npreemption using the preempt_disable() function. When CONFIG_PREEMPT_RT is\nenabled on realtime kernels, spinlocks do not disable preemption while\nheld, so the XFS critical section was not protected from preemption.\nSystems on the Realtime kernel-rt could lock up in this XFS optimization\nwhen a task that locked all the counters was then preempted by a realtime\ntask, causing all callers of that lock to block indefinitely. This update\ndisables the optimization when building a kernel with\nCONFIG_PREEMPT_RT_FULL enabled. (BZ#1223955)\n\nAll kernel-rt users are advised to upgrade to these updated packages, which\ncorrect these issues and add these enhancements. The system must be\nrebooted for this update to take effect.", "published": "2015-05-20T14:22:57", "cvss": {"score": 7.2, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://access.redhat.com/errata/RHSA-2015:1139", "cvelist": ["CVE-2014-9420", "CVE-2014-9529", "CVE-2014-9584", "CVE-2015-1573", "CVE-2015-1593", "CVE-2015-1805", "CVE-2015-2830"], "lastseen": "2018-03-28T02:40:30"}], "centos": [{"id": "CESA-2015:1221", "type": "centos", "title": "kernel, perf, python security update", "description": "**CentOS Errata and Security Advisory** CESA-2015:1221\n\n\nThe kernel packages contain the Linux kernel, the core of any Linux\noperating system.\n\n* A NULL pointer dereference flaw was found in the way the Linux kernel's\nvirtual console implementation handled reference counting when accessing\npseudo-terminal device files (/dev/pts/*). A local, unprivileged attacker\ncould use this flaw to crash the system. (CVE-2011-5321, Moderate)\n\n* It was found that the Linux kernel's ping socket implementation did not\nproperly handle socket unhashing during spurious disconnects, which could\nlead to a use-after-free flaw. On x86-64 architecture systems, a local user\nable to create ping sockets could use this flaw to crash the system.\nOn non-x86-64 architecture systems, a local user able to create ping\nsockets could use this flaw to escalate their privileges on the system.\n(CVE-2015-3636, Moderate)\n\n* An integer overflow flaw was found in the way the Linux kernel randomized\nthe stack for processes on certain 64-bit architecture systems, such as\nx86-64, causing the stack entropy to be reduced by four. (CVE-2015-1593,\nLow)\n\n* A flaw was found in the way the Linux kernel's 32-bit emulation\nimplementation handled forking or closing of a task with an 'int80' entry.\nA local user could potentially use this flaw to escalate their privileges\non the system. (CVE-2015-2830, Low)\n\n* It was found that the Linux kernel's TCP/IP protocol suite implementation\nfor IPv6 allowed the Hop Limit value to be set to a smaller value than the\ndefault one. An attacker on a local network could use this flaw to prevent\nsystems on that network from sending or receiving network packets.\n(CVE-2015-2922, Low)\n\nThese updated kernel packages also include numerous bug fixes and one\nenhancement. Space precludes documenting all of these changes in this\nadvisory. For information on the most significant of these changes, users\nare directed to the following article on the Red Hat Customer Portal:\n\nhttps://access.redhat.com/articles/1506133\n\nAll kernel users are advised to upgrade to these updated packages, which\ncontain backported patches to correct these issues and add this\nenhancement. The system must be rebooted for this update to take effect.\n\n\n**Merged security bulletin from advisories:**\nhttp://lists.centos.org/pipermail/centos-announce/2015-July/021242.html\n\n**Affected packages:**\nkernel\nkernel-abi-whitelists\nkernel-debug\nkernel-debug-devel\nkernel-devel\nkernel-doc\nkernel-firmware\nkernel-headers\nperf\npython-perf\n\n**Upstream details at:**\nhttps://rhn.redhat.com/errata/RHSA-2015-1221.html", "published": "2015-07-15T15:04:33", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "href": "http://lists.centos.org/pipermail/centos-announce/2015-July/021242.html", "cvelist": ["CVE-2015-2830", "CVE-2015-1593", "CVE-2015-2922", "CVE-2011-5321", "CVE-2015-3636"], "lastseen": "2017-10-03T18:26:04"}, {"id": "CESA-2015:1137", "type": "centos", "title": "kernel, perf, python security update", "description": "**CentOS Errata and Security Advisory** CESA-2015:1137\n\n\nThe kernel packages contain the Linux kernel, the core of any Linux\noperating system.\n\n* It was found that the Linux kernel's implementation of vectored pipe read\nand write functionality did not take into account the I/O vectors that were\nalready processed when retrying after a failed atomic access operation,\npotentially resulting in memory corruption due to an I/O vector array\noverrun. A local, unprivileged user could use this flaw to crash the system\nor, potentially, escalate their privileges on the system. (CVE-2015-1805,\nImportant)\n\n* A race condition flaw was found in the way the Linux kernel keys\nmanagement subsystem performed key garbage collection. A local attacker\ncould attempt accessing a key while it was being garbage collected, which\nwould cause the system to crash. (CVE-2014-9529, Moderate)\n\n* A flaw was found in the way the Linux kernel's 32-bit emulation\nimplementation handled forking or closing of a task with an 'int80' entry.\nA local user could potentially use this flaw to escalate their privileges\non the system. (CVE-2015-2830, Low)\n\n* It was found that the Linux kernel's ISO file system implementation did\nnot correctly limit the traversal of Rock Ridge extension Continuation\nEntries (CE). An attacker with physical access to the system could use this\nflaw to trigger an infinite loop in the kernel, resulting in a denial of\nservice. (CVE-2014-9420, Low)\n\n* An information leak flaw was found in the way the Linux kernel's ISO9660\nfile system implementation accessed data on an ISO9660 image with RockRidge\nExtension Reference (ER) records. An attacker with physical access to the\nsystem could use this flaw to disclose up to 255 bytes of kernel memory.\n(CVE-2014-9584, Low)\n\n* A flaw was found in the way the nft_flush_table() function of the Linux\nkernel's netfilter tables implementation flushed rules that were\nreferencing deleted chains. A local user who has the CAP_NET_ADMIN\ncapability could use this flaw to crash the system. (CVE-2015-1573, Low)\n\n* An integer overflow flaw was found in the way the Linux kernel randomized\nthe stack for processes on certain 64-bit architecture systems, such as\nx86-64, causing the stack entropy to be reduced by four. (CVE-2015-1593,\nLow)\n\nRed Hat would like to thank Carl Henrik Lunde for reporting CVE-2014-9420\nand CVE-2014-9584. The security impact of the CVE-2015-1805 issue was\ndiscovered by Red Hat.\n\nThis update also fixes several bugs. Documentation for these changes is\navailable from the following Knowledgebase article:\nhttps://access.redhat.com/articles/1469163\n\nAll kernel users are advised to upgrade to these updated packages, which\ncontain backported patches to correct these issues. The system must be\nrebooted for this update to take effect.\n\n\n**Merged security bulletin from advisories:**\nhttp://lists.centos.org/pipermail/centos-announce/2015-June/021215.html\n\n**Affected packages:**\nkernel\nkernel-abi-whitelists\nkernel-debug\nkernel-debug-devel\nkernel-devel\nkernel-doc\nkernel-headers\nkernel-tools\nkernel-tools-libs\nkernel-tools-libs-devel\nperf\npython-perf\n\n**Upstream details at:**\nhttps://rhn.redhat.com/errata/RHSA-2015-1137.html", "published": "2015-06-24T03:36:55", "cvss": {"score": 7.2, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://lists.centos.org/pipermail/centos-announce/2015-June/021215.html", "cvelist": ["CVE-2015-2830", "CVE-2014-9529", "CVE-2014-9420", "CVE-2015-1593", "CVE-2014-9584", "CVE-2015-1573", "CVE-2015-1805"], "lastseen": "2017-10-03T18:24:50"}], "debian": [{"id": "DSA-3170", "type": "debian", "title": "linux -- security update", "description": "Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service, information leaks or privilege escalation.\n\n * [CVE-2013-7421](<https://security-tracker.debian.org/tracker/CVE-2013-7421>) / [CVE-2014-9644](<https://security-tracker.debian.org/tracker/CVE-2014-9644>)\n\nIt was discovered that the Crypto API allowed unprivileged users to load arbitrary kernel modules. A local user can use this flaw to exploit vulnerabilities in modules that would not normally be loaded.\n\n * [CVE-2014-7822](<https://security-tracker.debian.org/tracker/CVE-2014-7822>)\n\nAkira Fujita found that the splice() system call did not validate the given file offset and length. A local unprivileged user can use this flaw to cause filesystem corruption on ext4 filesystems, or possibly other effects.\n\n * [CVE-2014-8160](<https://security-tracker.debian.org/tracker/CVE-2014-8160>)\n\nFlorian Westphal discovered that a netfilter (iptables/ip6tables) rule accepting packets to a specific SCTP, DCCP, GRE or UDPlite port/endpoint could result in incorrect connection tracking state. If only the generic connection tracking module (nf_conntrack) was loaded, and not the protocol-specific connection tracking module, this would allow access to any port/endpoint of the specified protocol.\n\n * [CVE-2014-8559](<https://security-tracker.debian.org/tracker/CVE-2014-8559>)\n\nIt was found that kernel functions that iterate over a directory tree can dead-lock or live-lock in case some of the directory entries were recently deleted or dropped from the cache. A local unprivileged user can use this flaw for denial of service.\n\n * [CVE-2014-9585](<https://security-tracker.debian.org/tracker/CVE-2014-9585>)\n\nAndy Lutomirski discovered that address randomisation for the vDSO in 64-bit processes is extremely biased. A local unprivileged user could potentially use this flaw to bypass the ASLR protection mechanism.\n\n * [CVE-2014-9683](<https://security-tracker.debian.org/tracker/CVE-2014-9683>)\n\nDmitry Chernenkov discovered that eCryptfs writes past the end of the allocated buffer during encrypted filename decoding, resulting in local denial of service.\n\n * [CVE-2015-0239](<https://security-tracker.debian.org/tracker/CVE-2015-0239>)\n\nIt was found that KVM did not correctly emulate the x86 SYSENTER instruction. An unprivileged user within a guest system that has not enabled SYSENTER, for example because the emulated CPU vendor is AMD, could potentially use this flaw to cause a denial of service or privilege escalation in that guest.\n\n * [CVE-2015-1420](<https://security-tracker.debian.org/tracker/CVE-2015-1420>)\n\nIt was discovered that the open_by_handle_at() system call reads the handle size from user memory a second time after validating it. A local user with the CAP_DAC_READ_SEARCH capability could use this flaw for privilege escalation.\n\n * [CVE-2015-1421](<https://security-tracker.debian.org/tracker/CVE-2015-1421>)\n\nIt was found that the SCTP implementation could free an authentication state while it was still in use, resulting in heap corruption. This could allow remote users to cause a denial of service or privilege escalation.\n\n * [CVE-2015-1593](<https://security-tracker.debian.org/tracker/CVE-2015-1593>)\n\nIt was found that address randomisation for the initial stack in 64-bit processes was limited to 20 rather than 22 bits of entropy. A local unprivileged user could potentially use this flaw to bypass the ASLR protection mechanism.\n\nFor the stable distribution (wheezy), these problems have been fixed in version 3.2.65-1+deb7u2. Additionally this update fixes regressions introduced in versions 3.2.65-1 and 3.2.65-1+deb7u1.\n\nFor the upcoming stable distribution (jessie), these problems will be fixed soon (a subset is fixed already).\n\nFor the unstable distribution (sid), these problems will be fixed soon (a subset is fixed already).\n\nWe recommend that you upgrade your linux packages.", "published": "2015-02-23T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://www.debian.org/security/dsa-3170", "cvelist": ["CVE-2014-9644", "CVE-2014-7822", "CVE-2015-1420", "CVE-2015-1593", "CVE-2014-8160", "CVE-2015-1421", "CVE-2014-8559", "CVE-2015-0239", "CVE-2013-7421", "CVE-2014-9683", "CVE-2014-9585"], "lastseen": "2018-01-08T16:57:49"}, {"id": "DLA-155", "type": "debian", "title": "linux-2.6 -- LTS security update", "description": "This update fixes the CVEs described below.\n\nA further issue, [CVE-2014-9419](<https://security-tracker.debian.org/tracker/CVE-2014-9419>), was considered, but appears to require extensive changes with a consequent high risk of regression. It is now unlikely to be fixed in squeeze-lts.\n\n * [CVE-2013-6885](<https://security-tracker.debian.org/tracker/CVE-2013-6885>)\n\nIt was discovered that under specific circumstances, a combination of write operations to write-combined memory and locked CPU instructions may cause a core hang on AMD 16h 00h through 0Fh processors. A local user can use this flaw to mount a denial of service (system hang) via a crafted application.\n\nFor more information please refer to the AMD CPU erratum 793 in <http://support.amd.com/TechDocs/51810_16h_00h-0Fh_Rev_Guide.pdf>\n\n * [CVE-2014-7822](<https://security-tracker.debian.org/tracker/CVE-2014-7822>)\n\nIt was found that the splice() system call did not validate the given file offset and length. A local unprivileged user can use this flaw to cause filesystem corruption on ext4 filesystems, or possibly other effects.\n\n * [CVE-2014-8133](<https://security-tracker.debian.org/tracker/CVE-2014-8133>)\n\nIt was found that the espfix functionality can be bypassed by installing a 16-bit RW data segment into GDT instead of LDT (which espfix checks for) and using it for stack. A local unprivileged user could potentially use this flaw to leak kernel stack addresses.\n\n * [CVE-2014-8134](<https://security-tracker.debian.org/tracker/CVE-2014-8134>)\n\nIt was found that the espfix functionality is wrongly disabled in a 32-bit KVM guest. A local unprivileged user could potentially use this flaw to leak kernel stack addresses.\n\n * [CVE-2014-8160](<https://security-tracker.debian.org/tracker/CVE-2014-8160>)\n\nIt was found that a netfilter (iptables or ip6tables) rule accepting packets to a specific SCTP, DCCP, GRE or UDPlite port/endpoint could result in incorrect connection tracking state. If only the generic connection tracking module (nf_conntrack) was loaded, and not the protocol-specific connection tracking module, this would allow access to any port/endpoint of the specified protocol.\n\n * [CVE-2014-9420](<https://security-tracker.debian.org/tracker/CVE-2014-9420>)\n\nIt was found that the ISO-9660 filesystem implementation (isofs) follows arbitrarily long chains, including loops, of Continuation Entries (CEs). This allows local users to mount a denial of service via a crafted disc image.\n\n * [CVE-2014-9584](<https://security-tracker.debian.org/tracker/CVE-2014-9584>)\n\nIt was found that the ISO-9660 filesystem implementation (isofs) does not validate a length value in the Extensions Reference (ER) System Use Field, which allows local users to obtain sensitive information from kernel memory via a crafted disc image.\n\n * [CVE-2014-9585](<https://security-tracker.debian.org/tracker/CVE-2014-9585>)\n\nIt was discovered that address randomisation for the vDSO in 64-bit processes is extremely biassed. A local unprivileged user could potentially use this flaw to bypass the ASLR protection mechanism.\n\n * [CVE-2015-1421](<https://security-tracker.debian.org/tracker/CVE-2015-1421>)\n\nIt was found that the SCTP implementation could free authentication state while it was still in use, resulting in heap corruption. This could allow remote users to cause a denial of service or privilege escalation.\n\n * [CVE-2015-1593](<https://security-tracker.debian.org/tracker/CVE-2015-1593>)\n\nIt was found that address randomisation for the initial stack in 64-bit processes was limited to 20 rather than 22 bits of entropy. A local unprivileged user could potentially use this flaw to bypass the ASLR protection mechanism.\n\nFor Debian 6 Squeeze, these issues have been fixed in linux-2.6 version 2.6.32-48squeeze11", "published": "2015-02-18T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://www.debian.org/security/2015/dla-155", "cvelist": ["CVE-2014-7822", "CVE-2014-8134", "CVE-2014-9420", "CVE-2015-1593", "CVE-2014-8160", "CVE-2015-1421", "CVE-2014-9584", "CVE-2013-6885", "CVE-2014-8133", "CVE-2014-9585"], "lastseen": "2016-09-02T12:56:45"}], "suse": [{"id": "OPENSUSE-SU-2015:0714-1", "type": "suse", "title": "Security update for the Linux Kernel (important)", "description": "The Linux kernel was updated to fix various bugs and security issues.\n\n Following security issues were fixed:\n - CVE-2014-8173: A NULL pointer dereference flaw was found in the way the\n Linux kernels madvise MADV_WILLNEED functionality handled page table\n locking. A local, unprivileged user could have used this flaw to crash\n the system.\n\n - CVE-2015-1593: A integer overflow reduced the effectiveness of the stack\n randomization on 64-bit systems.\n\n - CVE-2014-7822: A flaw was found in the way the Linux kernels splice()\n system call validated its parameters. On certain file systems, a local,\n unprivileged user could have used this flaw to write past the maximum\n file size, and thus crash the system.\n\n - CVE-2014-9419: The __switch_to function in arch/x86/kernel/process_64.c\n in the Linux kernel did not ensure that Thread Local Storage (TLS)\n descriptors are loaded before proceeding with other steps, which made it\n easier for local users to bypass the ASLR protection mechanism via a\n crafted application that reads a TLS base address.\n\n - CVE-2014-8134: The paravirt_ops_setup function in arch/x86/kernel/kvm.c\n in the Linux kernel used an improper paravirt_enabled setting for KVM\n guest kernels, which made it easier for guest OS users to bypass the\n ASLR protection mechanism via a crafted application that reads a 16-bit\n value.\n\n - CVE-2014-8160: net/netfilter/nf_conntrack_proto_generic.c in the Linux\n kernel generated incorrect conntrack entries during handling of certain\n iptables rule sets for the SCTP, DCCP, GRE, and UDP-Lite protocols,\n which allowed remote attackers to bypass intended access restrictions\n via packets with disallowed port numbers.\n\n - CVE-2014-9529: Race condition in the key_gc_unused_keys function in\n security/keys/gc.c in the Linux kernel allowed local users to cause a\n denial of service (memory corruption or panic) or possibly have\n unspecified other impact via keyctl commands that trigger access to a\n key structure member during garbage collection of a key.\n\n - CVE-2014-8559: The d_walk function in fs/dcache.c in the Linux kernel\n through did not properly maintain the semantics of rename_lock, which\n allowed local users to cause a denial of service (deadlock and system\n hang) via a crafted application.\n\n - CVE-2014-9420: The rock_continue function in fs/isofs/rock.c in the\n Linux kernel did not restrict the number of Rock Ridge continuation\n entries, which allowed local users to cause a denial of service\n (infinite loop, and system crash or hang) via a crafted iso9660 image.\n\n - CVE-2014-9584: The parse_rock_ridge_inode_internal function in\n fs/isofs/rock.c in the Linux kernel did not validate a length value in\n the Extensions Reference (ER) System Use Field, which allowed local\n users to obtain sensitive information from kernel memory via a crafted\n iso9660 image.\n\n - CVE-2014-9585: The vdso_addr function in arch/x86/vdso/vma.c in the\n Linux kernel did not properly choose memory locations for the vDSO area,\n which made it easier for local users to bypass the ASLR protection\n mechanism by guessing a location at the end of a PMD.\n\n Following bugs were fixed:\n - HID: usbhid: enable always-poll quirk for Elan Touchscreen 0103\n (bnc#920901).\n - HID: usbhid: enable always-poll quirk for Elan Touchscreen 016f\n (bnc#920901).\n - HID: usbhid: enable always-poll quirk for Elan Touchscreen 009b\n (bnc#920901).\n - HID: usbhid: add another mouse that needs QUIRK_ALWAYS_POLL (bnc#920901).\n - HID: usbhid: fix PIXART optical mouse (bnc#920901).\n - HID: usbhid: enable always-poll quirk for Elan Touchscreen (bnc#920901).\n - HID: usbhid: add always-poll quirk (bnc#920901).\n\n - storvsc: ring buffer failures may result in I/O freeze (bnc#914175).\n\n - mm, vmscan: prevent kswapd livelock due to pfmemalloc-throttled process\n being killed (VM Functionality bnc#910150).\n\n - Input: evdev - fix EVIOCG{type} ioctl (bnc#904899).\n\n - mnt: Implicitly add MNT_NODEV on remount when it was implicitly added by\n mount (bsc#907988).\n\n - DocBook: Do not exceed argument list limit.\n - DocBook: Make mandocs parallel-safe.\n\n - mm: free compound page with correct order (bnc#913695).\n\n - udf: Check component length before reading it.\n - udf: Check path length when reading symlink.\n - udf: Verify symlink size before loading it.\n - udf: Verify i_size when loading inode.\n\n - xfs: remote attribute overwrite causes transaction overrun.\n\n", "published": "2015-04-13T14:17:21", "cvss": {"score": 7.2, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00009.html", "cvelist": ["CVE-2014-9529", "CVE-2014-7822", "CVE-2014-8134", "CVE-2014-9420", "CVE-2015-1593", "CVE-2014-8160", "CVE-2014-8173", "CVE-2014-8559", "CVE-2014-9584", "CVE-2014-9419", "CVE-2014-9585"], "lastseen": "2016-09-04T12:23:18"}, {"id": "OPENSUSE-SU-2015:0713-1", "type": "suse", "title": "Security update for Linux Kernel (important)", "description": "The Linux kernel was updated to fix bugs and security issues:\n\n Following security issues were fixed:\n - CVE-2015-1421: Use-after-free vulnerability in the sctp_assoc_update\n function in net/sctp/associola.c in the Linux kernel allowed remote\n attackers to cause a denial of service (slab corruption and panic) or\n possibly have unspecified other impact by triggering an INIT collision\n that leads to improper handling of shared-key data.\n\n - CVE-2015-2150: XSA-120: Guests were permitted to modify all bits of the\n PCI command register of passed through cards, which could lead to Host\n system crashes.\n\n - CVE-2015-0777: The XEN usb backend could leak information to the guest\n system due to copying uninitialized memory.\n\n - CVE-2015-1593: A integer overflow reduced the effectiveness of the stack\n randomization on 64-bit systems.\n\n - CVE-2014-9419: The __switch_to function in arch/x86/kernel/process_64.c\n in the Linux kernel did not ensure that Thread Local Storage (TLS)\n descriptors are loaded before proceeding with other steps, which made it\n easier for local users to bypass the ASLR protection mechanism via a\n crafted application that reads a TLS base address.\n\n - CVE-2014-9428: The batadv_frag_merge_packets function in\n net/batman-adv/fragmentation.c in the B.A.T.M.A.N. implementation in the\n Linux kernel used an incorrect length field during a calculation of an\n amount of memory, which allowed remote attackers to cause a denial of\n service (mesh-node system crash) via fragmented packets.\n\n - CVE-2014-8160: net/netfilter/nf_conntrack_proto_generic.c in the Linux\n kernel generated incorrect conntrack entries during handling of certain\n iptables rule sets for the SCTP, DCCP, GRE, and UDP-Lite protocols,\n which allowed remote attackers to bypass intended access restrictions\n via packets with disallowed port numbers.\n\n - CVE-2014-9529: Race condition in the key_gc_unused_keys function in\n security/keys/gc.c in the Linux kernel allowed local users to cause a\n denial of service (memory corruption or panic) or possibly have\n unspecified other impact via keyctl commands that trigger access to a\n key structure member during garbage collection of a key.\n\n - CVE-2014-9420: The rock_continue function in fs/isofs/rock.c in the\n Linux kernel did not restrict the number of Rock Ridge continuation\n entries, which allowed local users to cause a denial of service\n (infinite loop, and system crash or hang) via a crafted iso9660 image.\n\n - CVE-2014-9584: The parse_rock_ridge_inode_internal function in\n fs/isofs/rock.c in the Linux kernel did not validate a length value in\n the Extensions Reference (ER) System Use Field, which allowed local\n users to obtain sensitive information from kernel memory via a crafted\n iso9660 image.\n\n - CVE-2014-9585: The vdso_addr function in arch/x86/vdso/vma.c in the\n Linux kernel did not properly choose memory locations for the vDSO area,\n which made it easier for local users to bypass the ASLR protection\n mechanism by guessing a location at the end of a PMD.\n\n - CVE-2014-8559: The d_walk function in fs/dcache.c in the Linux kernel\n through did not properly maintain the semantics of rename_lock, which\n allowed local users to cause a denial of service (deadlock and system\n hang) via a crafted application.\n\n - CVE-2014-8134: The paravirt_ops_setup function in arch/x86/kernel/kvm.c\n in the Linux kernel used an improper paravirt_enabled setting for KVM\n guest kernels, which made it easier for guest OS users to bypass the\n ASLR protection mechanism via a crafted application that reads a 16-bit\n value.\n\n Following bugs were fixed:\n - powerpc/pci: Fix IO space breakage after of_pci_range_to_resource()\n change (bnc#922542).\n\n - cifs: fix use-after-free bug in find_writable_file (bnc#909477).\n\n - usb: Do not allow usb_alloc_streams on unconfigured devices (bsc#920581).\n\n - fuse: honour max_read and max_write in direct_io mode (bnc#918954).\n\n - switch iov_iter_get_pages() to passing maximal number of pages\n (bnc#918954).\n\n - bcache: fix a livelock in btree lock v2 (bnc#910440) (bnc#910440).\n Updated because another version went upstream\n\n - drm/i915: Initialise userptr mmu_notifier serial to 1 (bnc#918970).\n\n - NFS: Don't try to reclaim delegation open state if recovery failed\n (boo#909634).\n - NFSv4: Ensure that we call FREE_STATEID when NFSv4.x stateids are\n revoked (boo#909634).\n - NFSv4: Fix races between nfs_remove_bad_delegation() and delegation\n return (boo#909634).\n - NFSv4: Ensure that we remove NFSv4.0 delegations when state has expired\n (boo#909634).\n - Fixing lease renewal (boo#909634).\n\n - bcache: Fix a bug when detaching (bsc#908582).\n\n - fix a leak in bch_cached_dev_run() (bnc#910440).\n - bcache: unregister reboot notifier when bcache fails to register a block\n device (bnc#910440).\n - bcache: fix a livelock in btree lock (bnc#910440).\n - bcache: [BUG] clear BCACHE_DEV_UNLINK_DONE flag when attaching a backing\n device (bnc#910440).\n - bcache: Add a cond_resched() call to gc (bnc#910440).\n\n - storvsc: ring buffer failures may result in I/O freeze (bnc#914175).\n\n - ALSA: seq-dummy: remove deadlock-causing events on close (boo#916608).\n - ALSA: pcm: Zero-clear reserved fields of PCM status ioctl in compat mode\n (boo#916608).\n - ALSA: bebob: Uninitialized id returned by saffirepro_both_clk_src_get\n (boo#916608).\n - ALSA: hda - Fix built-in mic on Compaq Presario CQ60 (bnc#920604).\n - ALSA: hda - Fix regression of HD-audio controller fallback modes\n (bsc#921313).\n\n - [media] sound: Update au0828 quirks table (boo#916608).\n - [media] sound: simplify au0828 quirk table (boo#916608).\n\n - ALSA: usb-audio: Add mic volume fix quirk for Logitech Webcam C210\n (boo#916608).\n - ALSA: usb-audio: extend KEF X300A FU 10 tweak to Arcam rPAC (boo#916608).\n - ALSA: usb-audio: Add ctrl message delay quirk for Marantz/Denon devices\n (boo#916608).\n - ALSA: usb-audio: Fix memory leak in FTU quirk (boo#916608).\n - ALSA: usb-audio: Fix device_del() sysfs warnings at disconnect\n (boo#916608).\n\n - ALSA: hda - Add new GPU codec ID 0x10de0072 to snd-hda (boo#916608).\n - ALSA: hda - Fix wrong gpio_dir &amp; gpio_mask hint setups for IDT/STAC\n codecs (boo#916608).\n - ALSA: hda/realtek - New codec support for ALC298 (boo#916608).\n - ALSA: hda/realtek - New codec support for ALC256 (boo#916608).\n - ALSA: hda/realtek - Add new Dell desktop for ALC3234 headset mode\n (boo#916608).\n - ALSA: hda - Add EAPD fixup for ASUS Z99He laptop (boo#916608).\n - ALSA: hda - Fix built-in mic at resume on Lenovo Ideapad S210\n (boo#916608).\n - ALSA: hda/realtek - Add headset Mic support for new Dell machine\n (boo#916608).\n - ALSA: hda_intel: Add DeviceIDs for Sunrise Point-LP (boo#916608).\n - ALSA: hda_intel: Add Device IDs for Intel Sunrise Point PCH (boo#916608).\n - ALSA: hda - add codec ID for Braswell display audio codec (boo#916608).\n - ALSA: hda - add PCI IDs for Intel Braswell (boo#916608).\n - ALSA: hda - Add dock support for Thinkpad T440 (17aa:2212) (boo#916608).\n\n - ALSA: hda - Set up GPIO for Toshiba Satellite S50D (bnc#915858).\n\n - rpm/kernel-binary.spec.in: Fix build if there is no *.crt file\n\n - mm, vmscan: prevent kswapd livelock due to pfmemalloc-throttled process\n being killed (VM Functionality bnc#910150).\n\n - Input: evdev - fix EVIOCG{type} ioctl (bnc#904899).\n\n - mnt: Implicitly add MNT_NODEV on remount when it was implicitly added by\n mount (bsc#907988).\n\n - Btrfs: fix scrub race leading to use-after-free (bnc#915456).\n - Btrfs: fix setup_leaf_for_split() to avoid leaf corruption (bnc#915454).\n - Btrfs: fix fsync log replay for inodes with a mix of regular refs and\n extrefs (bnc#915425).\n - Btrfs: fix fsync when extend references are added to an inode\n (bnc#915425).\n - Btrfs: fix directory inconsistency after fsync log replay (bnc#915425).\n - Btrfs: make xattr replace operations atomic (bnc#913466).\n - Btrfs: fix directory recovery from fsync log (bnc#895797).\n\n - bcache: add mutex lock for bch_is_open (bnc#908612).\n - bcache: Correct printing of btree_gc_max_duration_ms (bnc#908610).\n - bcache: fix crash with incomplete cache set (bnc#908608).\n - bcache: fix memory corruption in init error path (bnc#908606).\n - bcache: Fix more early shutdown bugs (bnc#908605).\n - bcache: fix use-after-free in btree_gc_coalesce() (bnc#908604).\n - bcache: Fix an infinite loop in journal replay (bnc#908603).\n - bcache: fix typo in bch_bkey_equal_header (bnc#908598).\n - bcache: Make sure to pass GFP_WAIT to mempool_alloc() (bnc#908596).\n - bcache: fix crash on shutdown in passthrough mode (bnc#908594).\n - bcache: fix lockdep warnings on shutdown (bnc#908593).\n - bcache allocator: send discards with correct size (bnc#908592).\n - bcache: Fix to remove the rcu_sched stalls (bnc#908589).\n - bcache: Fix a journal replay bug (bnc#908588).\n\n - Update x86_64 config files: CONFIG_SENSORS_NCT6683=m The nct6683 driver\n is already enabled on i386 and history suggests that it not being\n enabled on x86_64 is by mistake.\n\n - rpm/kernel-binary.spec.in: Own the modules directory in the devel\n package (bnc#910322)\n\n - Revert &quot;iwlwifi: mvm: treat EAPOLs like mgmt frames wrt rate&quot;\n (bnc#900811).\n\n - mm: free compound page with correct order (bnc#913695).\n\n - drm/i915: More cautious with pch fifo underruns (boo#907039).\n\n - Refresh patches.arch/arm64-0039-generic-pci.patch (fix PCI bridge\n support)\n\n - x86/microcode/intel: Fish out the stashed microcode for the BSP\n (bsc#903589).\n - x86, microcode: Reload microcode on resume (bsc#903589).\n - x86, microcode: Don't initialize microcode code on paravirt (bsc#903589).\n - x86, microcode, intel: Drop unused parameter (bsc#903589).\n - x86, microcode, AMD: Do not use smp_processor_id() in preemtible context\n (bsc#903589).\n - x86, microcode: Update BSPs microcode on resume (bsc#903589).\n - x86, microcode, AMD: Fix ucode patch stashing on 32-bit (bsc#903589).\n - x86, microcode: Fix accessing dis_ucode_ldr on 32-bit (bsc#903589).\n - x86, microcode, AMD: Fix early ucode loading on 32-bit (bsc#903589).\n\n - Bluetooth: Add support for Broadcom BCM20702A0 variants firmware\n download (bnc#911311).\n\n - drm/radeon: fix sad_count check for dce3 (bnc#911356).\n\n - drm/i915: Don't call intel_prepare_page_flip() multiple times\n on gen2-4 (bnc#911835).\n\n - udf: Check component length before reading it.\n - udf: Check path length when reading symlink.\n - udf: Verify symlink size before loading it.\n - udf: Verify i_size when loading inode.\n\n - arm64: Enable DRM\n\n - arm64: Enable generic PHB driver (bnc#912061).\n\n - ACPI / video: Add some Samsung models to disable_native_backlight list\n (boo#905681).\n\n - asus-nb-wmi: Add another wapf=4 quirk (boo#911438).\n - asus-nb-wmi: Add wapf4 quirk for the X550VB (boo#911438).\n - asus-nb-wmi: Add wapf4 quirk for the U32U (boo#911438).\n - asus-nb-wmi: Add wapf4 quirk for the X550CC (boo#911438).\n - asus-nb-wmi: Constify asus_quirks DMI table (boo#911438).\n - asus-nb-wmi: Add wapf4 quirk for the X550CL (boo#911438).\n - asus-nb-wmi.c: Rename x401u quirk to wapf4 (boo#911438).\n - asus-nb-wmi: Add ASUSTeK COMPUTER INC. X200CA (boo#911438).\n - WAPF 4 for ASUSTeK COMPUTER INC. X75VBP WLAN ON (boo#911438).\n\n - Input: synaptics - gate forcepad support by DMI check (bnc#911578).\n\n - ext4: introduce aging to extent status tree (bnc#893428).\n - ext4: cleanup flag definitions for extent status tree (bnc#893428).\n - ext4: limit number of scanned extents in status tree shrinker\n (bnc#893428).\n - ext4: move handling of list of shrinkable inodes into extent status code\n (bnc#893428).\n - ext4: change LRU to round-robin in extent status tree shrinker\n (bnc#893428).\n - ext4: cache extent hole in extent status tree for ext4_da_map_blocks()\n (bnc#893428).\n - ext4: fix block reservation for bigalloc filesystems (bnc#893428).\n - ext4: track extent status tree shrinker delay statictics (bnc#893428).\n - ext4: improve extents status tree trace point (bnc#893428).\n\n - rpm/kernel-binary.spec.in: Provide name-version-release for kgraft\n packages (bnc#901925)\n\n - rpm/kernel-binary.spec.in: Fix including the secure boot cert in\n /etc/uefi/certs\n\n - doc/README.SUSE: update Solid Driver team contacts\n\n - rpm/kernel-binary.spec.in: Do not sign firmware files (bnc#867199)\n\n - Port module signing changes from SLE11-SP3 (fate#314508)\n\n - doc/README.PATCH-POLICY.SUSE: add patch policy / best practices document\n after installation.\n\n", "published": "2015-04-13T14:04:48", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00008.html", "cvelist": ["CVE-2014-9529", "CVE-2014-8134", "CVE-2014-9420", "CVE-2015-1593", "CVE-2014-8160", "CVE-2015-1421", "CVE-2014-8559", "CVE-2015-0777", "CVE-2014-9584", "CVE-2015-2150", "CVE-2014-9428", "CVE-2014-9419", "CVE-2014-9585"], "lastseen": "2016-09-04T12:23:18"}, {"id": "SUSE-SU-2015:0581-1", "type": "suse", "title": "Security update for the Linux Kernel (important)", "description": "The SUSE Linux Enterprise 11 SP3 kernel has been updated to receive\n various security and bugfixes.\n\n New features enabled:\n\n * The Ceph and rbd remote network block device drivers are now enabled\n and supported, to serve as client for SUSE Enterprise Storage 1.0.\n (FATE#318328)\n * Support to selected Bay Trail CPUs used in Point of Service Hardware\n was enabled. (FATE#317933)\n * Broadwell Legacy Audio, HDMI Audio and DisplayPort Audio support\n (Audio Driver: HD-A HDMI/DP Audio/HDA Analog/DSP) was enabled.\n (FATE#317347)\n\n The following security bugs have been fixed:\n\n * CVE-2015-1593: An integer overflow in the stack randomization on\n 64-bit systems lead to less effective stack ASLR on those systems.\n (bsc#917839)\n * CVE-2014-8160: iptables rules could be bypassed if the specific\n network protocol module was not loaded, allowing e.g. SCTP to bypass\n the firewall if the sctp protocol was not enabled. (bsc#913059)\n * CVE-2014-7822: A flaw was found in the way the Linux kernels\n splice() system call validated its parameters. On certain file\n systems, a local, unprivileged user could have used this flaw to\n write past the maximum file size, and thus crash the system.\n (bnc#915322)\n * CVE-2014-9419: The __switch_to function in\n arch/x86/kernel/process_64.c in the Linux kernel did not ensure that\n Thread Local Storage (TLS) descriptors are loaded before proceeding\n with other steps, which made it easier for local users to bypass the\n ASLR protection mechanism via a crafted application that reads a TLS\n base address (bnc#911326).\n * CVE-2014-9584: The parse_rock_ridge_inode_internal function in\n fs/isofs/rock.c in the Linux kernel did not validate a length value\n in the Extensions Reference (ER) System Use Field, which allowed\n local users to obtain sensitive information from kernel memory via a\n crafted iso9660 image (bnc#912654).\n * CVE-2014-9585: The vdso_addr function in arch/x86/vdso/vma.c in the\n Linux kernel did not properly choose memory locations for the vDSO\n area, which made it easier for local users to bypass the ASLR\n protection mechanism by guessing a location at the end of a PMD\n (bnc#912705).\n * CVE-2014-8559: The d_walk function in fs/dcache.c in the Linux\n kernel did not properly maintain the semantics of rename_lock, which\n allowed local users to cause a denial of service (deadlock and\n system hang) via a crafted application (bnc#903640).\n * CVE-2014-9420: The rock_continue function in fs/isofs/rock.c in the\n Linux kernel did not restrict the number of Rock Ridge continuation\n entries, which allowed local users to cause a denial of service\n (infinite loop, and system crash or hang) via a crafted iso9660\n image (bsc#911325).\n * CVE-2014-8134: The paravirt_ops_setup function in\n arch/x86/kernel/kvm.c in the Linux kernel used an improper\n paravirt_enabled setting for KVM guest kernels, which made it easier\n for guest OS users to bypass the ASLR protection mechanism via a\n crafted application that reads a 16-bit value (bnc#907818 909077\n 909078).\n * CVE-2014-8369: The kvm_iommu_map_pages function in virt/kvm/iommu.c\n in the Linux kernel miscalculated the number of pages during the\n handling of a mapping failure, which allowed guest OS users to cause\n a denial of service (host OS page unpinning) or possibly have\n unspecified other impact by leveraging guest OS privileges. NOTE:\n this vulnerability exists because of an incorrect fix for\n CVE-2014-3601 (bsc#902675).\n * CVE-2014-3690: arch/x86/kvm/vmx.c in the KVM subsystem in the Linux\n kernel on Intel processors did not ensure that the value in the CR4\n control register remains the same after a VM entry, which allowed\n host OS users to kill arbitrary processes or cause a denial of\n service (system disruption) by leveraging /dev/kvm access, as\n demonstrated by PR_SET_TSC prctl calls within a modified copy of\n QEMU (bnc#902232).\n * CVE-2014-7842: Race condition in arch/x86/kvm/x86.c in the Linux\n kernel allowed guest OS users to cause a denial of service (guest OS\n crash) via a crafted application that performs an MMIO transaction\n or a PIO transaction to trigger a guest userspace emulation error\n report, a similar issue to CVE-2010-5313 (bnc#905312).\n * CVE-2014-0181: The Netlink implementation in the Linux kernel did\n not provide a mechanism for authorizing socket operations based on\n the\n opener of a socket, which allowed local users to bypass intended\n access restrictions and modify network configurations by using a Netlink\n socket for the (1) stdout or (2) stderr of a setuid program (bnc#875051).\n * CVE-2014-3688: The SCTP implementation in the Linux kernel allowed\n remote attackers to cause a denial of service (memory consumption)\n by triggering a large number of chunks in an associations output\n queue, as demonstrated by ASCONF probes, related to\n net/sctp/inqueue.c and net/sctp/sm_statefuns.c (bnc#902351).\n * CVE-2014-7970: The pivot_root implementation in fs/namespace.c in\n the Linux kernel did not properly interact with certain locations of\n a chroot directory, which allowed local users to cause a denial of\n service (mount-tree loop) via . (dot) values in both arguments to\n the pivot_root system call (bnc#900644).\n * CVE-2014-3687: The sctp_assoc_lookup_asconf_ack function in\n net/sctp/associola.c in the SCTP implementation in the Linux kernel\n allowed remote attackers to cause a denial of service (panic) via\n duplicate ASCONF chunks that trigger an incorrect uncork within the\n side-effect interpreter (bnc#902349, bnc#904899).\n\n The following non-security bugs have been fixed:\n\n * ACPI idle: permit sparse C-state sub-state numbers\n (bnc#908550,FATE#317933).\n * ALSA : hda - not use assigned converters for all unused pins\n (FATE#317933).\n * ALSA: hda - Add Device IDs for Intel Wildcat Point-LP PCH\n (FATE#317347).\n * ALSA: hda - Fix onboard audio on Intel H97/Z97 chipsets\n (FATE#317347).\n * ALSA: hda - add PCI IDs for Intel BayTrail (FATE#317347).\n * ALSA: hda - add PCI IDs for Intel Braswell (FATE#317347).\n * ALSA: hda - add codec ID for Braswell display audio codec\n (FATE#317933).\n * ALSA: hda - add codec ID for Broadwell display audio codec\n (FATE#317933).\n * ALSA: hda - add codec ID for Valleyview2 display codec (FATE#317933).\n * ALSA: hda - define is_haswell() to check if a display audio codec is\n Haswell (FATE#317933).\n * ALSA: hda - hdmi: Re-setup pin and infoframe on plug-in on all\n codecs (FATE#317933).\n * ALSA: hda - not choose assigned converters for unused pins of\n Valleyview (FATE#317933).\n * ALSA: hda - rename function not_share_unassigned_cvt() (FATE#317933).\n * ALSA: hda - unmute pin amplifier in infoframe setup for Haswell\n (FATE#317933).\n * ALSA: hda - verify pin:converter connection on unsol event for HSW\n and VLV (FATE#317933).\n * ALSA: hda - verify pin:cvt connection on preparing a stream for\n Intel HDMI codec (FATE#317933).\n * ALSA: hda/hdmi - apply Valleyview fix-ups to Cherryview display\n codec (FATE#317933).\n * ALSA: hda/hdmi - apply all Haswell fix-ups to Broadwell display\n codec (FATE#317933).\n * ALSA: hda_intel: Add Device IDs for Intel Sunrise Point PCH\n (FATE#317347).\n * ALSA: hda_intel: Add DeviceIDs for Sunrise Point-LP (FATE#317347).\n * Add support for AdvancedSilicon HID multitouch screen (2149:36b1)\n (FATE#317933).\n * Disable switching to bootsplash at oops/panic (bnc#877593).\n * Do not trigger congestion wait on dirty-but-not-writeout pages (VM\n Performance, bnc#909093, bnc#910517).\n * Fix HDIO_DRIVE_* ioctl() regression (bnc#833588, bnc#905799)\n * Fix Module.supported handling for external modules (bnc#905304).\n * Fix zero freq if frequency is requested too quickly in a row\n (bnc#908572).\n * Fix zero freq if frequency is requested too quickly in a row\n (bnc#908572).\n * Fixup kABI after\n patches.fixes/writeback-do-not-sync-data-dirtied-after-sync-start.patch (bn\n c#833820).\n * Force native backlight for HP POS machines (bnc#908551,FATE#317933).\n * HID: use multi input quirk for 22b9:2968 (FATE#317933).\n * IPoIB: Use a private hash table for path lookup in xmit path\n (bsc#907196).\n * Import kabi files from kernel 3.0.101-0.40\n * KEYS: Fix stale key registration at error path (bnc#908163).\n * NFS: Add sequence_priviliged_ops for nfs4_proc_sequence()\n (bnc#864401).\n * NFS: do not use STABLE writes during writeback (bnc#816099).\n * NFSv4.1 handle DS stateid errors (bnc#864401).\n * NFSv4.1: Do not decode skipped layoutgets (bnc#864411).\n * NFSv4.1: Fix a race in the pNFS return-on-close code (bnc#864409).\n * NFSv4.1: Fix an ABBA locking issue with session and state\n serialisation (bnc#864409).\n * NFSv4.1: We must release the sequence id when we fail to get a\n session slot (bnc#864401).\n * NFSv4: Do not accept delegated opens when a delegation recall is in\n effect (bnc#864409).\n * NFSv4: Ensure correct locking when accessing the &quot;^a&quot; list\n (bnc#864401).\n * NFSv4: Fix another reboot recovery race (bnc#916982).\n * Preserve kabi checksum of path_is_under().\n * Refresh patches.drivers/HID-multitouch-add-support-for-Atmel-212c.\n Fix the non-working touchsreen (bnc#909740)\n * Revert &quot;drm/i915: Calculate correct stolen size for GEN7+&quot;\n (bnc#908550,FATE#317933).\n * SUNRPC: Do not allow low priority tasks to pre-empt higher priority\n ones (bnc#864401).\n * SUNRPC: When changing the queue priority, ensure that we change the\n owner (bnc#864401).\n * Setting rbd and libceph as supported drivers (bsc#917884)\n * audit: efficiency fix 1: only wake up if queue shorter than backlog\n limit (bnc#908393).\n * audit: efficiency fix 2: request exclusive wait since all need same\n resource (bnc#908393).\n * audit: fix endless wait in audit_log_start() (bnc#908393).\n * audit: make use of remaining sleep time from wait_for_auditd\n (bnc#908393).\n * audit: refactor hold queue flush (bnc#908393).\n * audit: reset audit backlog wait time after error recovery\n (bnc#908393).\n * audit: wait_for_auditd() should use TASK_UNINTERRUPTIBLE\n (bnc#908393).\n * block: rbd: use NULL instead of 0 (FATE#318328 bsc#917884).\n * block: replace strict_strtoul() with kstrtoul() (FATE#318328\n bsc#917884).\n * bonding: propagate LRO disabling down to slaves (bnc#829110\n bnc#891277 bnc#904053).\n * cciss: fix broken mutex usage in ioctl (bnc#910013).\n * ceph: Add necessary clean up if invalid reply received in\n handle_reply() (FATE#318328 bsc#917884).\n * ceph: remove bogus extern (FATE#318328 bsc#917884).\n * config: Disable CONFIG_RCU_FAST_NO_HZ (bnc#884817) This option has\n been verified to be racy vs hotplug, and is irrelevant to SLE in any\n case.\n * coredump: ensure the fpu state is flushed for proper multi-threaded\n core dump (bnc#904671).\n * crush: CHOOSE_LEAF -&gt; CHOOSELEAF throughout (FATE#318328 bsc#917884).\n * crush: add SET_CHOOSE_TRIES rule step (FATE#318328 bsc#917884).\n * crush: add note about r in recursive choose (FATE#318328 bsc#917884).\n * crush: add set_choose_local_[fallback_]tries steps (FATE#318328\n bsc#917884).\n * crush: apply chooseleaf_tries to firstn mode too (FATE#318328\n bsc#917884).\n * crush: attempts -&gt; tries (FATE#318328 bsc#917884).\n * crush: clarify numrep vs endpos (FATE#318328 bsc#917884).\n * crush: eliminate CRUSH_MAX_SET result size limitation (FATE#318328\n bsc#917884).\n * crush: factor out (trivial) crush_destroy_rule() (FATE#318328\n bsc#917884).\n * crush: fix crush_choose_firstn comment (FATE#318328 bsc#917884).\n * crush: fix some comments (FATE#318328 bsc#917884).\n * crush: generalize descend_once (FATE#318328 bsc#917884).\n * crush: new SET_CHOOSE_LEAF_TRIES command (FATE#318328 bsc#917884).\n * crush: pass parent r value for indep call (FATE#318328 bsc#917884).\n * crush: pass weight vector size to map function (FATE#318328\n bsc#917884).\n * crush: reduce scope of some local variables (FATE#318328 bsc#917884).\n * crush: return CRUSH_ITEM_UNDEF for failed placements with indep\n (FATE#318328 bsc#917884).\n * crush: strip firstn conditionals out of crush_choose, rename\n (FATE#318328 bsc#917884).\n * crush: use breadth-first search for indep mode (FATE#318328\n bsc#917884).\n * crypto: add missing crypto module aliases (bsc#914423).\n * crypto: include crypto- module prefix in template (bsc#914423).\n * crypto: kernel oops at insmod of the z90crypt device driver\n (bnc#909088, LTC#119591).\n * crypto: prefix module autoloading with &quot;crypto-&quot; (bsc#914423).\n * dm raid: add region_size parameter (bnc#895841).\n * do not do blind d_drop() in nfs_prime_dcache() (bnc#908069\n bnc#896484).\n * drm/cirrus: Fix cirrus drm driver for fbdev + qemu\n (bsc#909846,bnc#856760).\n * drm/i915: split PCI IDs out into i915_drm.h v4\n (bnc#908550,FATE#317933).\n * fix dcache exit scaling (bnc#876594).\n * infiniband: ipoib: Sanitize neighbour handling in ipoib_main.c\n (bsc#907196).\n * iommu/vt-d: Fix an off-by-one bug in __domain_mapping() (bsc#908825).\n * ipoib: Convert over to dev_lookup_neigh_skb() (bsc#907196).\n * ipoib: Need to do dst_neigh_lookup_skb() outside of priv-&gt;lock\n (bsc#907196).\n * ipv6: fix net reference leak in IPv6 conntrack reassembly\n (bnc#865419).\n * isofs: Fix unchecked printing of ER records.\n * kABI: protect console include in consolemap.\n * kabi fix (bnc#864404).\n * kabi, mm: prevent endless growth of anon_vma hierarchy (bnc#904242).\n * kernel/audit.c: avoid negative sleep durations (bnc#908393).\n * kernel: 3215 tty close crash (bnc#915209, LTC#120873).\n * kernel: incorrect clock_gettime result (bnc#915209, LTC#121184).\n * kvm: Do not expose MONITOR cpuid as available (bnc#887597)\n * kvm: iommu: Add cond_resched to legacy device assignment code\n (bnc#910159).\n * libceph: CEPH_OSD_FLAG_* enum update (FATE#318328 bsc#917884).\n * libceph: add ceph_kv{malloc,free}() and switch to them (FATE#318328\n bsc#917884).\n * libceph: add ceph_pg_pool_by_id() (FATE#318328 bsc#917884).\n * libceph: add function to ensure notifies are complete (FATE#318328\n bsc#917884).\n * libceph: add process_one_ticket() helper (FATE#318328 bsc#917884).\n * libceph: all features fields must be u64 (FATE#318328 bsc#917884).\n * libceph: block I/O when PAUSE or FULL osd map flags are set\n (FATE#318328 bsc#917884).\n * libceph: call r_unsafe_callback when unsafe reply is received\n (FATE#318328 bsc#917884).\n * libceph: create_singlethread_workqueue() does not return ERR_PTRs\n (FATE#318328 bsc#917884).\n * libceph: do not hard code max auth ticket len (FATE#318328\n bsc#917884).\n * libceph: dout() is missing a newline (FATE#318328 bsc#917884).\n * libceph: factor out logic from ceph_osdc_start_request()\n (FATE#318328 bsc#917884).\n * libceph: fix error handling in ceph_osdc_init() (FATE#318328\n bsc#917884).\n * libceph: fix preallocation check in get_reply() (FATE#318328\n bsc#917884).\n * libceph: fix safe completion (FATE#318328 bsc#917884).\n * libceph: follow redirect replies from osds (FATE#318328 bsc#917884).\n * libceph: follow {read,write}_tier fields on osd request submission\n (FATE#318328 bsc#917884).\n * libceph: gracefully handle large reply messages from the mon\n (FATE#318328 bsc#917884).\n * libceph: introduce and start using oid abstraction (FATE#318328\n bsc#917884).\n * libceph: rename MAX_OBJ_NAME_SIZE to CEPH_MAX_OID_NAME_LEN\n (FATE#318328 bsc#917884).\n * libceph: rename ceph_msg::front_max to front_alloc_len (FATE#318328\n bsc#917884).\n * libceph: rename ceph_osd_request::r_{oloc,oid} to r_base_{oloc,oid}\n (FATE#318328 bsc#917884).\n * libceph: rename front to front_len in get_reply() (FATE#318328\n bsc#917884).\n * libceph: replace ceph_calc_ceph_pg() with ceph_oloc_oid_to_pg()\n (FATE#318328 bsc#917884).\n * libceph: resend all writes after the osdmap loses the full flag\n (FATE#318328 bsc#917884).\n * libceph: start using oloc abstraction (FATE#318328 bsc#917884).\n * libceph: take map_sem for read in handle_reply() (FATE#318328\n bsc#917884).\n * libceph: update ceph_features.h (FATE#318328 bsc#917884).\n * libceph: use CEPH_MON_PORT when the specified port is 0 (FATE#318328\n bsc#917884).\n * libiscsi: Added new boot entries in the session sysfs (FATE#316723\n bsc#914355)\n * mei: ME hardware reset needs to be synchronized (bnc#876086).\n * mei: add 9 series PCH mei device ids (bnc#876086).\n * mei: add hw start callback (bnc#876086).\n * mei: cancel stall timers in mei_reset (bnc#876086).\n * mei: do not have to clean the state on power up (bnc#876086).\n * mei: limit the number of consecutive resets (bnc#876086).\n * mei: me: add Lynx Point Wellsburg work station device id\n (bnc#876086).\n * mei: me: clear interrupts on the resume path (bnc#876086).\n * mei: me: do not load the driver if the FW does not support MEI\n interface (bnc#876086).\n * mei: me: fix hardware reset flow (bnc#876086).\n * mei: me: read H_CSR after asserting reset (bnc#876086).\n * mm, vmscan: prevent kswapd livelock due to pfmemalloc-throttled\n process being killed (VM Functionality bnc#910150).\n * mm: fix BUG in __split_huge_page_pmd (bnc#906586).\n * mm: fix corner case in anon_vma endless growing prevention\n (bnc#904242).\n * mm: prevent endless growth of anon_vma hierarchy (bnc#904242).\n * mm: vmscan: count only dirty pages as congested (VM Performance,\n bnc#910517).\n * net, sunrpc: suppress allocation warning in rpc_malloc()\n (bnc#904659).\n * net: 8021q/bluetooth/bridge/can/ceph: Remove extern from function\n prototypes (FATE#318328 bsc#917884).\n * net: handle more general stacking in dev_disable_lro() (bnc#829110\n bnc#891277 bnc#904053).\n * netfilter: do not drop packet on insert collision (bnc#907611).\n * nf_conntrack: avoid reference leak in __ipv6_conntrack_in()\n (bnc#865419).\n * nfs_prime_dcache needs fh to be set (bnc#908069 bnc#896484).\n * nfsd: fix EXDEV checking in rename (bnc#915791).\n * pnfs: defer release of pages in layoutget (bnc#864411).\n * proc_sys_revalidate: fix Oops on NULL nameidata (bnc#907551).\n * qlge: fix an &quot;&amp;&amp;&quot; vs &quot;||&quot; bug (bsc#912171).\n * rbd: Fix error recovery in rbd_obj_read_sync() (FATE#318328\n bsc#917884).\n * rbd: Use min_t() to fix comparison of distinct pointer types warning\n (FATE#318328 bsc#917884).\n * rbd: add &quot;minor&quot; sysfs rbd device attribute (FATE#318328 bsc#917884).\n * rbd: add support for single-major device number allocation scheme\n (FATE#318328 bsc#917884).\n * rbd: clean up a few things in the refresh path (FATE#318328\n bsc#917884).\n * rbd: complete notifies before cleaning up osd_client and rbd_dev\n (FATE#318328 bsc#917884).\n * rbd: do not destroy ceph_opts in rbd_add() (FATE#318328 bsc#917884).\n * rbd: do not hold ctl_mutex to get/put device (FATE#318328\n bsc#917884).\n * rbd: drop an unsafe assertion (FATE#318328 bsc#917884).\n * rbd: drop original request earlier for existence check (FATE#318328\n bsc#917884).\n * rbd: enable extended devt in single-major mode (FATE#318328\n bsc#917884).\n * rbd: fetch object order before using it (FATE#318328 bsc#917884).\n * rbd: fix I/O error propagation for reads (FATE#318328 bsc#917884).\n * rbd: fix a couple warnings (FATE#318328 bsc#917884).\n * rbd: fix buffer size for writes to images with snapshots\n (FATE#318328 bsc#917884).\n * rbd: fix cleanup in rbd_add() (FATE#318328 bsc#917884).\n * rbd: fix error handling from rbd_snap_name() (FATE#318328\n bsc#917884).\n * rbd: fix error paths in rbd_img_request_fill() (FATE#318328\n bsc#917884).\n * rbd: fix null dereference in dout (FATE#318328 bsc#917884).\n * rbd: fix use-after free of rbd_dev-&gt;disk (FATE#318328 bsc#917884).\n * rbd: flush dcache after zeroing page data (FATE#318328 bsc#917884).\n * rbd: ignore unmapped snapshots that no longer exist (FATE#318328\n bsc#917884).\n * rbd: introduce rbd_dev_header_unwatch_sync() and switch to it\n (FATE#318328 bsc#917884).\n * rbd: make rbd_obj_notify_ack() synchronous (FATE#318328 bsc#917884).\n * rbd: protect against concurrent unmaps (FATE#318328 bsc#917884).\n * rbd: protect against duplicate client creation (FATE#318328\n bsc#917884).\n * rbd: rbd_device::dev_id is an int, format it as such (FATE#318328\n bsc#917884).\n * rbd: refactor rbd_init() a bit (FATE#318328 bsc#917884).\n * rbd: send snapshot context with writes (FATE#318328 bsc#917884).\n * rbd: set removing flag while holding list lock (FATE#318328\n bsc#917884).\n * rbd: switch to ida for rbd id assignments (FATE#318328 bsc#917884).\n * rbd: take a little credit (FATE#318328 bsc#917884).\n * rbd: tear down watch request if rbd_dev_device_setup() fails\n (FATE#318328 bsc#917884).\n * rbd: tweak &quot;loaded&quot; message and module description (FATE#318328\n bsc#917884).\n * rbd: use reference counts for image requests (FATE#318328\n bsc#917884).\n * rbd: use rwsem to protect header updates (FATE#318328 bsc#917884).\n * rbd: use the correct length for format 2 object names (FATE#318328\n bsc#917884).\n * rpm/kernel-binary.spec.in: Own the modules directory in the devel\n package (bnc#910322)\n * scsi_dh_alua: add missing hunk in alua_set_params() (bnc#846656).\n * scsifront: avoid acquiring same lock twice if ring is full.\n * sd: medium access timeout counter fails to reset (bnc#894213).\n * storvsc: ring buffer failures may result in I/O freeze\n * swap: fix shmem swapping when more than 8 areas (bnc#903096).\n * timekeeping: Avoid possible deadlock from clock_was_set_delayed\n (bsc#771619).\n * tty: Fix memory leak in virtual console when enable unicode\n translation (bnc#916515).\n * udf: Check component length before reading it.\n * udf: Check path length when reading symlink.\n * udf: Verify i_size when loading inode.\n * udf: Verify symlink size before loading it.\n * udp: Add MIB counters for rcvbuferrors (bnc#909565).\n * usb: xhci: rework root port wake bits if controller is not allowed\n to wakeup (bsc#909264).\n * virtio_net: drop dst reference before transmitting a packet\n (bnc#882470).\n * vt: push the tty_lock down into the map handling (bnc#915826).\n * workqueue: Make rescuer thread process more works (bnc#900279).\n * x86, xsave: remove thread_has_fpu() bug check in\n __sanitize_i387_state() (bnc#904671).\n * x86-64/MCE: flip CPU and bank numbers in log message.\n * x86/UV: Fix NULL pointer dereference in uv_flush_tlb_others() if the\n &quot;^a&quot; boot option is used (bsc#909092).\n * x86/UV: Fix conditional in gru_exit() (bsc#909095).\n * x86/early quirk: use gen6 stolen detection for VLV\n (bnc#908550,FATE#317933).\n * x86/gpu: Print the Intel graphics stolen memory range (bnc#908550).\n * x86/hpet: Make boot_hpet_disable extern (bnc#908550,FATE#317933).\n * x86/intel: Add quirk to disable HPET for the Baytrail platform\n (bnc#908550,FATE#317933).\n * x86/uv: Fix UV2 BAU legacy mode (bsc#909092).\n * x86/uv: Fix the UV BAU destination timeout period (bsc#909092).\n * x86/uv: Implement UV BAU runtime enable and disable control via\n /proc/sgi_uv/ (bsc#909092).\n * x86/uv: Update the UV3 TLB shootdown logic (bsc#909092).\n * x86/uv: Work around UV2 BAU hangs (bsc#909092).\n * x86: UV BAU: Avoid NULL pointer reference in ptc_seq_show\n (bsc#911181).\n * x86: UV BAU: Increase maximum CPUs per socket/hub (bsc#911181).\n * x86: add early quirk for reserving Intel graphics stolen memory v5\n (bnc#908550,FATE#317933).\n * x86: irq: Check for valid irq descriptor in\n check_irq_vectors_for_cpu_disable (bnc#914726).\n * xen-privcmd-hcall-preemption: Fix EFLAGS.IF access.\n * xfs: re-enable non-blocking behaviour in xfs_map_blocks (bnc#900279).\n * xfs: recheck buffer pinned status after push trylock failure\n (bnc#907338).\n * xfs: remove log force from xfs_buf_trylock() (bnc#907338).\n * xhci: fix incorrect type in assignment in\n handle_device_notification() (bsc#910321).\n * zcrypt: Number of supported ap domains is not retrievable\n (bnc#915209, LTC#120788).\n\n Security Issues:\n\n * CVE-2013-7263\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7263\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7263</a>&gt;\n * CVE-2014-0181\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0181\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0181</a>&gt;\n * CVE-2014-3687\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3687\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3687</a>&gt;\n * CVE-2014-3688\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3688\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3688</a>&gt;\n * CVE-2014-3690\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3690\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3690</a>&gt;\n * CVE-2014-4608\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4608\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4608</a>&gt;\n * CVE-2014-7822\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7822\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7822</a>&gt;\n * CVE-2014-7842\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7842\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7842</a>&gt;\n * CVE-2014-7970\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7970\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7970</a>&gt;\n * CVE-2014-8133\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8133\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8133</a>&gt;\n * CVE-2014-8134\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8134\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8134</a>&gt;\n * CVE-2014-8160\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8160\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8160</a>&gt;\n * CVE-2014-8369\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8369\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8369</a>&gt;\n * CVE-2014-8559\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8559\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8559</a>&gt;\n * CVE-2014-9090\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9090\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9090</a>&gt;\n * CVE-2014-9322\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9322\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9322</a>&gt;\n * CVE-2014-9419\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9419\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9419</a>&gt;\n * CVE-2014-9420\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9420\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9420</a>&gt;\n * CVE-2014-9584\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9584\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9584</a>&gt;\n * CVE-2014-9585\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9585\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9585</a>&gt;\n * CVE-2015-1593\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1593\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1593</a>&gt;\n", "published": "2015-03-24T07:04:48", "cvss": {"score": 7.8, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:COMPLETE/"}, "href": "http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00028.html", "cvelist": ["CVE-2014-8369", "CVE-2010-5313", "CVE-2014-7822", "CVE-2014-8134", "CVE-2014-9420", "CVE-2015-1593", "CVE-2014-9090", "CVE-2014-3688", "CVE-2014-8160", "CVE-2014-9322", "CVE-2014-8559", "CVE-2014-3601", "CVE-2014-4608", "CVE-2014-9584", "CVE-2013-7263", "CVE-2014-0181", "CVE-2014-3690", "CVE-2014-8133", "CVE-2014-9419", "CVE-2014-7842", "CVE-2014-9585", "CVE-2014-3687", "CVE-2014-7970"], "lastseen": "2016-09-04T12:08:20"}, {"id": "SUSE-SU-2015:0736-1", "type": "suse", "title": "Security update for Real Time Linux Kernel (important)", "description": "The SUSE Linux Enterprise 11 SP3 Realtime kernel was updated to receive\n various security and bugfixes.\n\n The following security bugs have been fixed:\n\n *\n\n CVE-2015-1593: An integer overflow in the stack randomization on\n 64-bit systems lead to less effective stack ASLR on those systems.\n (bsc#917839)\n\n *\n\n CVE-2014-8160: iptables rules could be bypassed if the specific\n network protocol module was not loaded, allowing e.g. SCTP to bypass the\n firewall if the sctp protocol was not enabled. (bsc#913059)\n\n *\n\n CVE-2014-7822: A flaw was found in the way the Linux kernels\n splice() system call validated its parameters. On certain file systems, a\n local, unprivileged user could have used this flaw to write past the\n maximum file size, and thus crash the system. (bnc#915322)\n\n *\n\n CVE-2014-9419: The __switch_to function in\n arch/x86/kernel/process_64.c in the Linux kernel did not ensure that\n Thread Local Storage (TLS) descriptors are loaded before proceeding with\n other steps, which made it easier for local users to bypass the ASLR\n protection mechanism via a crafted application that reads a TLS base\n address (bnc#911326).\n\n *\n\n CVE-2014-9584: The parse_rock_ridge_inode_internal function in\n fs/isofs/rock.c in the Linux kernel did not validate a length value in the\n Extensions Reference (ER) System Use Field, which allowed local users to\n obtain sensitive information from kernel memory via a crafted iso9660\n image (bnc#912654).\n\n *\n\n CVE-2014-9585: The vdso_addr function in arch/x86/vdso/vma.c in the\n Linux kernel did not properly choose memory locations for the vDSO area,\n which made it easier for local users to bypass the ASLR protection\n mechanism by guessing a location at the end of a PMD (bnc#912705).\n\n *\n\n CVE-2014-8559: The d_walk function in fs/dcache.c in the Linux\n kernel did not properly maintain the semantics of rename_lock, which\n allowed local users to cause a denial of service (deadlock and system\n hang) via a crafted application (bnc#903640).\n\n *\n\n CVE-2014-9420: The rock_continue function in fs/isofs/rock.c in the\n Linux kernel did not restrict the number of Rock Ridge continuation\n entries, which allowed local users to cause a denial of service (infinite\n loop, and system crash or hang) via a crafted iso9660 image (bsc#911325).\n\n *\n\n CVE-2014-8134: The paravirt_ops_setup function in\n arch/x86/kernel/kvm.c in the Linux kernel used an improper\n paravirt_enabled setting for KVM guest kernels, which made it easier for\n guest OS users to bypass the ASLR protection mechanism via a crafted\n application that reads a 16-bit value (bnc#907818 909077 909078).\n\n *\n\n CVE-2014-8369: The kvm_iommu_map_pages function in virt/kvm/iommu.c\n in the Linux kernel miscalculated the number of pages during the handling\n of a mapping failure, which allowed guest OS users to cause a denial of\n service (host OS page unpinning) or possibly have unspecified other impact\n by leveraging guest OS privileges. NOTE: this vulnerability exists because\n of an incorrect fix for CVE-2014-3601 (bsc#902675).\n\n *\n\n CVE-2014-3690: arch/x86/kvm/vmx.c in the KVM subsystem in the Linux\n kernel on Intel processors did not ensure that the value in the CR4\n control register remains the same after a VM entry, which allowed host OS\n users to kill arbitrary processes or cause a denial of service (system\n disruption) by leveraging /dev/kvm access, as demonstrated by PR_SET_TSC\n prctl calls within a modified copy of QEMU (bnc#902232).\n\n *\n\n CVE-2014-7842: Race condition in arch/x86/kvm/x86.c in the Linux\n kernel allowed guest OS users to cause a denial of service (guest OS\n crash) via a crafted application that performs an MMIO transaction or a\n PIO transaction to trigger a guest userspace emulation error report, a\n similar issue to CVE-2010-5313 (bnc#905312).\n\n *\n\n CVE-2014-0181: The Netlink implementation in the Linux kernel did\n not provide a mechanism for authorizing socket operations based on the\n opener of a socket, which allowed local users to bypass intended\n access restrictions and modify network configurations by using a Netlink\n socket for the (1) stdout or (2) stderr of a setuid program (bnc#875051).\n\n *\n\n CVE-2014-3688: The SCTP implementation in the Linux kernel allowed\n remote attackers to cause a denial of service (memory consumption) by\n triggering a large number of chunks in an associations output queue, as\n demonstrated by ASCONF probes, related to net/sctp/inqueue.c and\n net/sctp/sm_statefuns.c (bnc#902351).\n\n *\n\n CVE-2014-7970: The pivot_root implementation in fs/namespace.c in\n the Linux kernel did not properly interact with certain locations of a\n chroot directory, which allowed local users to cause a denial of service\n (mount-tree loop) via . (dot) values in both arguments to the pivot_root\n system call (bnc#900644).\n\n *\n\n CVE-2014-3687: The sctp_assoc_lookup_asconf_ack function in\n net/sctp/associola.c in the SCTP implementation in the Linux kernel\n allowed remote attackers to cause a denial of service (panic) via\n duplicate ASCONF chunks that trigger an incorrect uncork within the\n side-effect interpreter (bnc#902349 904899).\n\n The following non-security bugs have been fixed:\n\n * ACPI idle: permit sparse C-state sub-state numbers\n (bnc#908550,FATE#317933).\n * ALSA : hda - not use assigned converters for all unused pins\n (FATE#317933).\n * ALSA: hda - Add Device IDs for Intel Wildcat Point-LP PCH\n (FATE#317347).\n * ALSA: hda - Fix onboard audio on Intel H97/Z97 chipsets\n (FATE#317347).\n * ALSA: hda - add PCI IDs for Intel BayTrail (FATE#317347).\n * ALSA: hda - add PCI IDs for Intel Braswell (FATE#317347).\n * ALSA: hda - add codec ID for Braswell display audio codec\n (FATE#317933).\n * ALSA: hda - add codec ID for Broadwell display audio codec\n (FATE#317933).\n * ALSA: hda - add codec ID for Valleyview2 display codec (FATE#317933).\n * ALSA: hda - define is_haswell() to check if a display audio codec is\n Haswell (FATE#317933).\n * ALSA: hda - hdmi: Re-setup pin and infoframe on plug-in on all\n codecs (FATE#317933).\n * ALSA: hda - not choose assigned converters for unused pins of\n Valleyview (FATE#317933).\n * ALSA: hda - rename function not_share_unassigned_cvt() (FATE#317933).\n * ALSA: hda - unmute pin amplifier in infoframe setup for Haswell\n (FATE#317933).\n * ALSA: hda - verify pin:converter connection on unsol event for HSW\n and VLV (FATE#317933).\n * ALSA: hda - verify pin:cvt connection on preparing a stream for\n Intel HDMI codec (FATE#317933).\n * ALSA: hda/hdmi - apply Valleyview fix-ups to Cherryview display\n codec (FATE#317933).\n * ALSA: hda/hdmi - apply all Haswell fix-ups to Broadwell display\n codec (FATE#317933).\n * ALSA: hda_intel: Add Device IDs for Intel Sunrise Point PCH\n (FATE#317347).\n * ALSA: hda_intel: Add DeviceIDs for Sunrise Point-LP (FATE#317347).\n * Add support for AdvancedSilicon HID multitouch screen (2149:36b1)\n (FATE#317933).\n * Disable switching to bootsplash at oops/panic (bnc#877593).\n * Do not trigger congestion wait on dirty-but-not-writeout pages (VM\n Performance, bnc#909093, bnc#910517).\n * Fix HDIO_DRIVE_* ioctl() regression (bnc#833588, bnc#905799)\n * Fix Module.supported handling for external modules (bnc#905304).\n * Fix zero freq if frequency is requested too quickly in a row\n (bnc#908572).\n * Fix zero freq if frequency is requested too quickly in a row\n (bnc#908572).\n * Fixup kABI after\n patches.fixes/writeback-do-not-sync-data-dirtied-after-sync-start.patch (bn\n c#833820).\n * Force native backlight for HP POS machines (bnc#908551,FATE#317933).\n * HID: use multi input quirk for 22b9:2968 (FATE#317933).\n * IPoIB: Use a private hash table for path lookup in xmit path\n (bsc#907196).\n * Import kabi files from kernel 3.0.101-0.40\n * KEYS: Fix stale key registration at error path (bnc#908163).\n * NFS: Add sequence_priviliged_ops for nfs4_proc_sequence()\n (bnc#864401).\n * NFS: do not use STABLE writes during writeback (bnc#816099).\n * NFSv4.1 handle DS stateid errors (bnc#864401).\n * NFSv4.1: Do not decode skipped layoutgets (bnc#864411).\n * NFSv4.1: Fix a race in the pNFS return-on-close code (bnc#864409).\n * NFSv4.1: Fix an ABBA locking issue with session and state\n serialisation (bnc#864409).\n * NFSv4.1: We must release the sequence id when we fail to get a\n session slot (bnc#864401).\n * NFSv4: Do not accept delegated opens when a delegation recall is in\n effect (bnc#864409).\n * NFSv4: Ensure correct locking when accessing the &quot;^a&quot; list\n (bnc#864401).\n * NFSv4: Fix another reboot recovery race (bnc#916982).\n * Preserve kabi checksum of path_is_under().\n * Refresh patches.drivers/HID-multitouch-add-support-for-Atmel-212c.\n Fix the non-working touchsreen (bnc#909740)\n * Revert &quot;drm/i915: Calculate correct stolen size for GEN7+&quot;\n (bnc#908550,FATE#317933).\n * SUNRPC: Do not allow low priority tasks to pre-empt higher priority\n ones (bnc#864401).\n * SUNRPC: When changing the queue priority, ensure that we change the\n owner (bnc#864401).\n * Setting rbd and libceph as supported drivers (bsc#917884)\n * The bug number in\n patches.fixes/timekeeping-avoid-possible-deadlock-from-clock_was_set.patch\n changed from bsc#771619 to bsc#915335.\n * audit: efficiency fix 1: only wake up if queue shorter than backlog\n limit (bnc#908393).\n * audit: efficiency fix 2: request exclusive wait since all need same\n resource (bnc#908393).\n * audit: fix endless wait in audit_log_start() (bnc#908393).\n * audit: make use of remaining sleep time from wait_for_auditd\n (bnc#908393).\n * audit: refactor hold queue flush (bnc#908393).\n * audit: reset audit backlog wait time after error recovery\n (bnc#908393).\n * audit: wait_for_auditd() should use TASK_UNINTERRUPTIBLE\n (bnc#908393).\n * block: rbd: use NULL instead of 0 (FATE#318328 bsc#917884).\n * block: replace strict_strtoul() with kstrtoul() (FATE#318328\n bsc#917884).\n * bonding: propagate LRO disabling down to slaves (bnc#829110\n bnc#891277 bnc#904053).\n * cciss: fix broken mutex usage in ioctl (bnc#910013).\n * ceph: Add necessary clean up if invalid reply received in\n handle_reply() (FATE#318328 bsc#917884).\n * ceph: remove bogus extern (FATE#318328 bsc#917884).\n * config: Disable CONFIG_RCU_FAST_NO_HZ (bnc#884817) This option has\n been verified to be racy vs hotplug, and is irrelevant to SLE in any\n case.\n * coredump: ensure the fpu state is flushed for proper multi-threaded\n core dump (bnc#904671).\n * crush: CHOOSE_LEAF -&gt; CHOOSELEAF throughout (FATE#318328 bsc#917884).\n * crush: add SET_CHOOSE_TRIES rule step (FATE#318328 bsc#917884).\n * crush: add note about r in recursive choose (FATE#318328 bsc#917884).\n * crush: add set_choose_local_[fallback_]tries steps (FATE#318328\n bsc#917884).\n * crush: apply chooseleaf_tries to firstn mode too (FATE#318328\n bsc#917884).\n * crush: attempts -&gt; tries (FATE#318328 bsc#917884).\n * crush: clarify numrep vs endpos (FATE#318328 bsc#917884).\n * crush: eliminate CRUSH_MAX_SET result size limitation (FATE#318328\n bsc#917884).\n * crush: factor out (trivial) crush_destroy_rule() (FATE#318328\n bsc#917884).\n * crush: fix crush_choose_firstn comment (FATE#318328 bsc#917884).\n * crush: fix some comments (FATE#318328 bsc#917884).\n * crush: generalize descend_once (FATE#318328 bsc#917884).\n * crush: new SET_CHOOSE_LEAF_TRIES command (FATE#318328 bsc#917884).\n * crush: pass parent r value for indep call (FATE#318328 bsc#917884).\n * crush: pass weight vector size to map function (FATE#318328\n bsc#917884).\n * crush: reduce scope of some local variables (FATE#318328 bsc#917884).\n * crush: return CRUSH_ITEM_UNDEF for failed placements with indep\n (FATE#318328 bsc#917884).\n * crush: strip firstn conditionals out of crush_choose, rename\n (FATE#318328 bsc#917884).\n * crush: use breadth-first search for indep mode (FATE#318328\n bsc#917884).\n * crypto: add missing crypto module aliases (bsc#914423).\n * crypto: include crypto- module prefix in template (bsc#914423).\n * crypto: kernel oops at insmod of the z90crypt device driver\n (bnc#909088, LTC#119591).\n * crypto: prefix module autoloading with &quot;crypto-&quot; (bsc#914423).\n * dm raid: add region_size parameter (bnc#895841).\n * do not do blind d_drop() in nfs_prime_dcache() (bnc#908069\n bnc#896484).\n * drm/cirrus: Fix cirrus drm driver for fbdev + qemu\n (bsc#909846,bnc#856760).\n * drm/i915: split PCI IDs out into i915_drm.h v4\n (bnc#908550,FATE#317933).\n * fix dcache exit scaling (bnc#876594).\n * infiniband: ipoib: Sanitize neighbour handling in ipoib_main.c\n (bsc#907196).\n * iommu/vt-d: Fix an off-by-one bug in __domain_mapping() (bsc#908825).\n * ipoib: Convert over to dev_lookup_neigh_skb() (bsc#907196).\n * ipoib: Need to do dst_neigh_lookup_skb() outside of priv-&gt;lock\n (bsc#907196).\n * ipv6: fix net reference leak in IPv6 conntrack reassembly\n (bnc#865419).\n * isofs: Fix unchecked printing of ER records.\n * kABI: protect console include in consolemap.\n * kabi fix (bnc#864404).\n * kabi, mm: prevent endless growth of anon_vma hierarchy (bnc#904242).\n * kernel/audit.c: avoid negative sleep durations (bnc#908393).\n * kernel: 3215 tty close crash (bnc#915209, LTC#120873).\n * kernel: incorrect clock_gettime result (bnc#915209, LTC#121184).\n * kvm: Do not expose MONITOR cpuid as available (bnc#887597)\n * kvm: iommu: Add cond_resched to legacy device assignment code\n (bnc#910159).\n * libceph: CEPH_OSD_FLAG_* enum update (FATE#318328 bsc#917884).\n * libceph: add ceph_kv{malloc,free}() and switch to them (FATE#318328\n bsc#917884).\n * libceph: add ceph_pg_pool_by_id() (FATE#318328 bsc#917884).\n * libceph: add function to ensure notifies are complete (FATE#318328\n bsc#917884).\n * libceph: add process_one_ticket() helper (FATE#318328 bsc#917884).\n * libceph: all features fields must be u64 (FATE#318328 bsc#917884).\n * libceph: block I/O when PAUSE or FULL osd map flags are set\n (FATE#318328 bsc#917884).\n * libceph: call r_unsafe_callback when unsafe reply is received\n (FATE#318328 bsc#917884).\n * libceph: create_singlethread_workqueue() does not return ERR_PTRs\n (FATE#318328 bsc#917884).\n * libceph: do not hard code max auth ticket len (FATE#318328\n bsc#917884).\n * libceph: dout() is missing a newline (FATE#318328 bsc#917884).\n * libceph: factor out logic from ceph_osdc_start_request()\n (FATE#318328 bsc#917884).\n * libceph: fix error handling in ceph_osdc_init() (FATE#318328\n bsc#917884).\n * libceph: fix preallocation check in get_reply() (FATE#318328\n bsc#917884).\n * libceph: fix safe completion (FATE#318328 bsc#917884).\n * libceph: follow redirect replies from osds (FATE#318328 bsc#917884).\n * libceph: follow {read,write}_tier fields on osd request submission\n (FATE#318328 bsc#917884).\n * libceph: gracefully handle large reply messages from the mon\n (FATE#318328 bsc#917884).\n * libceph: introduce and start using oid abstraction (FATE#318328\n bsc#917884).\n * libceph: rename MAX_OBJ_NAME_SIZE to CEPH_MAX_OID_NAME_LEN\n (FATE#318328 bsc#917884).\n * libceph: rename ceph_msg::front_max to front_alloc_len (FATE#318328\n bsc#917884).\n * libceph: rename ceph_osd_request::r_{oloc,oid} to r_base_{oloc,oid}\n (FATE#318328 bsc#917884).\n * libceph: rename front to front_len in get_reply() (FATE#318328\n bsc#917884).\n * libceph: replace ceph_calc_ceph_pg() with ceph_oloc_oid_to_pg()\n (FATE#318328 bsc#917884).\n * libceph: resend all writes after the osdmap loses the full flag\n (FATE#318328 bsc#917884).\n * libceph: start using oloc abstraction (FATE#318328 bsc#917884).\n * libceph: take map_sem for read in handle_reply() (FATE#318328\n bsc#917884).\n * libceph: update ceph_features.h (FATE#318328 bsc#917884).\n * libceph: use CEPH_MON_PORT when the specified port is 0 (FATE#318328\n bsc#917884).\n * libiscsi: Added new boot entries in the session sysfs (FATE#316723\n bsc#914355)\n * mei: ME hardware reset needs to be synchronized (bnc#876086).\n * mei: add 9 series PCH mei device ids (bnc#876086).\n * mei: add hw start callback (bnc#876086).\n * mei: cancel stall timers in mei_reset (bnc#876086).\n * mei: do not have to clean the state on power up (bnc#876086).\n * mei: limit the number of consecutive resets (bnc#876086).\n * mei: me: add Lynx Point Wellsburg work station device id\n (bnc#876086).\n * mei: me: clear interrupts on the resume path (bnc#876086).\n * mei: me: do not load the driver if the FW does not support MEI\n interface (bnc#876086).\n * mei: me: fix hardware reset flow (bnc#876086).\n * mei: me: read H_CSR after asserting reset (bnc#876086).\n * mm, vmscan: prevent kswapd livelock due to pfmemalloc-throttled\n process being killed (VM Functionality bnc#910150).\n * mm: fix BUG in __split_huge_page_pmd (bnc#906586).\n * mm: fix corner case in anon_vma endless growing prevention\n (bnc#904242).\n * mm: prevent endless growth of anon_vma hierarchy (bnc#904242).\n * mm: vmscan: count only dirty pages as congested (VM Performance,\n bnc#910517).\n * net, sunrpc: suppress allocation warning in rpc_malloc()\n (bnc#904659).\n * net: 8021q/bluetooth/bridge/can/ceph: Remove extern from function\n prototypes (FATE#318328 bsc#917884).\n * net: handle more general stacking in dev_disable_lro() (bnc#829110\n bnc#891277 bnc#904053).\n * netfilter: do not drop packet on insert collision (bnc#907611).\n * nf_conntrack: avoid reference leak in __ipv6_conntrack_in()\n (bnc#865419).\n * nfs_prime_dcache needs fh to be set (bnc#908069 bnc#896484).\n * nfsd: fix EXDEV checking in rename (bnc#915791).\n * pnfs: defer release of pages in layoutget (bnc#864411).\n * proc_sys_revalidate: fix Oops on NULL nameidata (bnc#907551).\n * qlge: fix an &quot;&amp;&amp;&quot; vs &quot;||&quot; bug (bsc#912171).\n * rbd: Fix error recovery in rbd_obj_read_sync() (FATE#318328\n bsc#917884).\n * rbd: Use min_t() to fix comparison of distinct pointer types warning\n (FATE#318328 bsc#917884).\n * rbd: add &quot;minor&quot; sysfs rbd device attribute (FATE#318328 bsc#917884).\n * rbd: add support for single-major device number allocation scheme\n (FATE#318328 bsc#917884).\n * rbd: clean up a few things in the refresh path (FATE#318328\n bsc#917884).\n * rbd: complete notifies before cleaning up osd_client and rbd_dev\n (FATE#318328 bsc#917884).\n * rbd: do not destroy ceph_opts in rbd_add() (FATE#318328 bsc#917884).\n * rbd: do not hold ctl_mutex to get/put device (FATE#318328\n bsc#917884).\n * rbd: drop an unsafe assertion (FATE#318328 bsc#917884).\n * rbd: drop original request earlier for existence check (FATE#318328\n bsc#917884).\n * rbd: enable extended devt in single-major mode (FATE#318328\n bsc#917884).\n * rbd: fetch object order before using it (FATE#318328 bsc#917884).\n * rbd: fix I/O error propagation for reads (FATE#318328 bsc#917884).\n * rbd: fix a couple warnings (FATE#318328 bsc#917884).\n * rbd: fix buffer size for writes to images with snapshots\n (FATE#318328 bsc#917884).\n * rbd: fix cleanup in rbd_add() (FATE#318328 bsc#917884).\n * rbd: fix error handling from rbd_snap_name() (FATE#318328\n bsc#917884).\n * rbd: fix error paths in rbd_img_request_fill() (FATE#318328\n bsc#917884).\n * rbd: fix null dereference in dout (FATE#318328 bsc#917884).\n * rbd: fix use-after free of rbd_dev-&gt;disk (FATE#318328 bsc#917884).\n * rbd: flush dcache after zeroing page data (FATE#318328 bsc#917884).\n * rbd: ignore unmapped snapshots that no longer exist (FATE#318328\n bsc#917884).\n * rbd: introduce rbd_dev_header_unwatch_sync() and switch to it\n (FATE#318328 bsc#917884).\n * rbd: make rbd_obj_notify_ack() synchronous (FATE#318328 bsc#917884).\n * rbd: protect against concurrent unmaps (FATE#318328 bsc#917884).\n * rbd: protect against duplicate client creation (FATE#318328\n bsc#917884).\n * rbd: rbd_device::dev_id is an int, format it as such (FATE#318328\n bsc#917884).\n * rbd: refactor rbd_init() a bit (FATE#318328 bsc#917884).\n * rbd: send snapshot context with writes (FATE#318328 bsc#917884).\n * rbd: set removing flag while holding list lock (FATE#318328\n bsc#917884).\n * rbd: switch to ida for rbd id assignments (FATE#318328 bsc#917884).\n * rbd: take a little credit (FATE#318328 bsc#917884).\n * rbd: tear down watch request if rbd_dev_device_setup() fails\n (FATE#318328 bsc#917884).\n * rbd: tweak &quot;loaded&quot; message and module description (FATE#318328\n bsc#917884).\n * rbd: use reference counts for image requests (FATE#318328\n bsc#917884).\n * rbd: use rwsem to protect header updates (FATE#318328 bsc#917884).\n * rbd: use the correct length for format 2 object names (FATE#318328\n bsc#917884).\n * rpm/kernel-binary.spec.in: Own the modules directory in the devel\n package (bnc#910322)\n * scsi_dh_alua: add missing hunk in alua_set_params() (bnc#846656).\n * scsifront: avoid acquiring same lock twice if ring is full.\n * sd: medium access timeout counter fails to reset (bnc#894213).\n * storvsc: ring buffer failures may result in I/O freeze\n * swap: fix shmem swapping when more than 8 areas (bnc#903096).\n * timekeeping: Avoid possible deadlock from clock_was_set_delayed\n (bsc#771619).\n * tty: Fix memory leak in virtual console when enable unicode\n translation (bnc#916515).\n * udf: Check component length before reading it.\n * udf: Check path length when reading symlink.\n * udf: Verify i_size when loading inode.\n * udf: Verify symlink size before loading it.\n * udp: Add MIB counters for rcvbuferrors (bnc#909565).\n * usb: xhci: rework root port wake bits if controller is not allowed\n to wakeup (bsc#909264).\n * virtio_net: drop dst reference before transmitting a packet\n (bnc#882470).\n * vt: push the tty_lock down into the map handling (bnc#915826).\n * workqueue: Make rescuer thread process more works (bnc#900279).\n * x86, xsave: remove thread_has_fpu() bug check in\n __sanitize_i387_state() (bnc#904671).\n * x86-64/MCE: flip CPU and bank numbers in log message.\n * x86/UV: Fix NULL pointer dereference in uv_flush_tlb_others() if the\n &quot;^a&quot; boot option is used (bsc#909092).\n * x86/UV: Fix conditional in gru_exit() (bsc#909095).\n * x86/early quirk: use gen6 stolen detection for VLV\n (bnc#908550,FATE#317933).\n * x86/gpu: Print the Intel graphics stolen memory range (bnc#908550).\n * x86/hpet: Make boot_hpet_disable extern (bnc#908550,FATE#317933).\n * x86/intel: Add quirk to disable HPET for the Baytrail platform\n (bnc#908550,FATE#317933).\n * x86/uv: Fix UV2 BAU legacy mode (bsc#909092).\n * x86/uv: Fix the UV BAU destination timeout period (bsc#909092).\n * x86/uv: Implement UV BAU runtime enable and disable control via\n /proc/sgi_uv/ (bsc#909092).\n * x86/uv: Update the UV3 TLB shootdown logic (bsc#909092).\n * x86/uv: Work around UV2 BAU hangs (bsc#909092).\n * x86: UV BAU: Avoid NULL pointer reference in ptc_seq_show\n (bsc#911181).\n * x86: UV BAU: Increase maximum CPUs per socket/hub (bsc#911181).\n * x86: add early quirk for reserving Intel graphics stolen memory v5\n (bnc#908550,FATE#317933).\n * x86: irq: Check for valid irq descriptor in\n check_irq_vectors_for_cpu_disable (bnc#914726).\n * xen-privcmd-hcall-preemption: Fix EFLAGS.IF access.\n * xfs: re-enable non-blocking behaviour in xfs_map_blocks (bnc#900279).\n * xfs: recheck buffer pinned status after push trylock failure\n (bnc#907338).\n * xfs: remove log force from xfs_buf_trylock() (bnc#907338).\n * xhci: fix incorrect type in assignment in\n handle_device_notification() (bsc#910321).\n * zcrypt: Number of supported ap domains is not retrievable\n (bnc#915209, LTC#120788).\n\n Security Issues:\n\n * CVE-2013-7263\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7263\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7263</a>&gt;\n * CVE-2014-0181\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0181\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0181</a>&gt;\n * CVE-2014-3687\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3687\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3687</a>&gt;\n * CVE-2014-3688\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3688\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3688</a>&gt;\n * CVE-2014-3690\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3690\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3690</a>&gt;\n * CVE-2014-4608\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4608\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4608</a>&gt;\n * CVE-2014-7822\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7822\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7822</a>&gt;\n * CVE-2014-7842\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7842\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7842</a>&gt;\n * CVE-2014-7970\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7970\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7970</a>&gt;\n * CVE-2014-8133\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8133\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8133</a>&gt;\n * CVE-2014-8134\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8134\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8134</a>&gt;\n * CVE-2014-8160\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8160\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8160</a>&gt;\n * CVE-2014-8369\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8369\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8369</a>&gt;\n * CVE-2014-8559\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8559\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8559</a>&gt;\n * CVE-2014-9090\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9090\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9090</a>&gt;\n * CVE-2014-9322\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9322\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9322</a>&gt;\n * CVE-2014-9419\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9419\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9419</a>&gt;\n * CVE-2014-9420\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9420\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9420</a>&gt;\n * CVE-2014-9584\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9584\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9584</a>&gt;\n * CVE-2014-9585\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9585\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9585</a>&gt;\n * CVE-2015-1593\n &lt;<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1593\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1593</a>&gt;\n", "published": "2015-04-20T21:05:00", "cvss": {"score": 7.8, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:COMPLETE/"}, "href": "http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00015.html", "cvelist": ["CVE-2014-8369", "CVE-2010-5313", "CVE-2014-7822", "CVE-2014-8134", "CVE-2014-9420", "CVE-2015-1593", "CVE-2014-9090", "CVE-2014-3688", "CVE-2014-8160", "CVE-2014-9322", "CVE-2014-8559", "CVE-2014-3601", "CVE-2014-4608", "CVE-2014-9584", "CVE-2013-7263", "CVE-2014-0181", "CVE-2014-3690", "CVE-2014-8133", "CVE-2014-9419", "CVE-2014-7842", "CVE-2014-9585", "CVE-2014-3687", "CVE-2014-7970"], "lastseen": "2016-09-04T11:48:25"}]}}