{"cve": [{"lastseen": "2020-12-09T20:13:21", "description": "The assoc_array_insert_into_terminal_node function in lib/assoc_array.c in the Linux kernel before 4.13.11 mishandles node splitting, which allows local users to cause a denial of service (NULL pointer dereference and panic) via a crafted application, as demonstrated by the keyring key type, and key addition and link creation operations.", "edition": 18, "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "baseScore": 5.5, "privilegesRequired": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "userInteraction": "NONE", "version": "3.0"}, "impactScore": 3.6}, "published": "2017-11-22T18:29:00", "title": "CVE-2017-12193", "type": "cve", "cwe": ["CWE-476"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "COMPLETE", "integrityImpact": "NONE", "baseScore": 4.9, "vectorString": "AV:L/AC:L/Au:N/C:N/I:N/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 6.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-12193"], "modified": "2018-07-13T01:29:00", "cpe": [], "id": "CVE-2017-12193", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-12193", "cvss": {"score": 4.9, "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"}, "cpe23": []}], "f5": [{"lastseen": "2019-06-28T14:42:42", "bulletinFamily": "software", "cvelist": ["CVE-2017-12193"], "description": "\nF5 Product Development has evaluated the currently supported releases for potential vulnerability, and no F5 products were found to be vulnerable.\n\nNone\n\n * [K9970: Subscribing to email notifications regarding F5 products](<https://support.f5.com/csp/article/K9970>)\n * [K9957: Creating a custom RSS feed to view new and updated documents](<https://support.f5.com/csp/article/K9957>)\n * [K4602: Overview of the F5 security vulnerability response policy](<https://support.f5.com/csp/article/K4602>)\n * [K4918: Overview of the F5 critical issue hotfix policy](<https://support.f5.com/csp/article/K4918>)\n", "edition": 1, "modified": "2018-01-29T22:42:00", "published": "2018-01-29T22:42:00", "id": "F5:K89434121", "href": "https://support.f5.com/csp/article/K89434121", "title": "Linux kernel vulnerability CVE-2017-12193", "type": "f5", "cvss": {"score": 4.9, "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"}}], "virtuozzo": [{"lastseen": "2019-11-05T11:27:54", "bulletinFamily": "unix", "cvelist": ["CVE-2017-12193"], "description": "The cumulative Virtuozzo ReadyKernel patch was updated with security and stability fixes. The patch applies to Virtuozzo kernel 3.10.0-514.26.1.vz7.33.22 (Virtuozzo 7.0.5).\n**Vulnerability id:** CVE-2017-12193\nA flaw was found in the implementation of associative arrays in the Linux kernel. A null pointer dereference could happen in assoc_array_apply_edit() due to incorrect node splitting.\n\n", "edition": 1, "modified": "2017-11-10T00:00:00", "published": "2017-11-10T00:00:00", "id": "VZA-2017-102", "href": "https://help.virtuozzo.com/customer/portal/articles/2901382", "title": "Kernel security update: CVE-2017-12193; Virtuozzo ReadyKernel patch 37.1 for Virtuozzo 7.0.5", "type": "virtuozzo", "cvss": {"score": 4.9, "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2019-11-05T11:27:42", "bulletinFamily": "unix", "cvelist": ["CVE-2017-12193"], "description": "The cumulative Virtuozzo ReadyKernel patch was updated with security and stability fixes. The patch applies to Virtuozzo kernels 3.10.0-327.18.2.vz7.15.2 (Virtuozzo 7.0.0), 3.10.0-327.37.1.vz7.18.7 (Virtuozzo 7.0.1), 3.10.0-327.37.1.vz7.20.18 (Virtuozzo 7.0.3), 3.10.0-514.16.1.vz7.30.10 (Virtuozzo 7.0.4), and 3.10.0-514.16.1.vz7.30.15 (Virtuozzo 7.0.4 HF3).\n**Vulnerability id:** CVE-2017-12193\nA flaw was found in the implementation of associative arrays in the Linux kernel. A null pointer dereference could happen in assoc_array_apply_edit() due to incorrect node splitting.\n\n", "edition": 1, "modified": "2017-11-10T00:00:00", "published": "2017-11-10T00:00:00", "id": "VZA-2017-101", "href": "https://help.virtuozzo.com/customer/portal/articles/2901381", "title": "Kernel security update: CVE-2017-12193; Virtuozzo ReadyKernel patch 37.1 for Virtuozzo 7.0.0, 7.0.1, 7.0.3, 7.0.4, and 7.0.4 HF3", "type": "virtuozzo", "cvss": {"score": 4.9, "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"}}], "openvas": [{"lastseen": "2019-05-29T18:34:46", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-12193"], "description": "The remote host is missing an update for the ", "modified": "2019-03-15T00:00:00", "published": "2017-11-08T00:00:00", "id": "OPENVAS:1361412562310873576", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310873576", "type": "openvas", "title": "Fedora Update for kernel FEDORA-2017-9fbb35aeda", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_fedora_2017_9fbb35aeda_kernel_fc26.nasl 14223 2019-03-15 13:49:35Z cfischer $\n#\n# Fedora Update for kernel FEDORA-2017-9fbb35aeda\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2017 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.873576\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2017-11-08 10:31:19 +0100 (Wed, 08 Nov 2017)\");\n script_cve_id(\"CVE-2017-12193\");\n script_tag(name:\"cvss_base\", value:\"4.9\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:L/AC:L/Au:N/C:N/I:N/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Fedora Update for kernel FEDORA-2017-9fbb35aeda\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'kernel'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"affected\", value:\"kernel on Fedora 26\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_xref(name:\"FEDORA\", value:\"2017-9fbb35aeda\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNCETCHNLS4FIWTF5GTQU5MFMNRNIZHV\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2017 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC26\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC26\")\n{\n\n if ((res = isrpmvuln(pkg:\"kernel\", rpm:\"kernel~4.13.11~200.fc26\", rls:\"FC26\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 4.9, "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2019-05-29T18:34:46", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-12193"], "description": "The remote host is missing an update for the ", "modified": "2019-03-15T00:00:00", "published": "2017-11-08T00:00:00", "id": "OPENVAS:1361412562310873575", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310873575", "type": "openvas", "title": "Fedora Update for kernel FEDORA-2017-38b37120a2", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_fedora_2017_38b37120a2_kernel_fc25.nasl 14223 2019-03-15 13:49:35Z cfischer $\n#\n# Fedora Update for kernel FEDORA-2017-38b37120a2\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2017 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.873575\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2017-11-08 10:31:17 +0100 (Wed, 08 Nov 2017)\");\n script_cve_id(\"CVE-2017-12193\");\n script_tag(name:\"cvss_base\", value:\"4.9\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:L/AC:L/Au:N/C:N/I:N/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Fedora Update for kernel FEDORA-2017-38b37120a2\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'kernel'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"affected\", value:\"kernel on Fedora 25\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_xref(name:\"FEDORA\", value:\"2017-38b37120a2\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RPXU25MW67DK6VA3RGTR7FUNNGLOFCOC\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2017 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC25\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC25\")\n{\n\n if ((res = isrpmvuln(pkg:\"kernel\", rpm:\"kernel~4.13.11~100.fc25\", rls:\"FC25\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 4.9, "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2019-05-29T18:34:50", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-12193", "CVE-2017-16939", "CVE-2017-16643", "CVE-2017-1000405"], "description": "The remote host is missing an update for the ", "modified": "2019-03-13T00:00:00", "published": "2017-12-15T00:00:00", "id": "OPENVAS:1361412562310843403", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310843403", "type": "openvas", "title": "Ubuntu Update for linux-lts-xenial USN-3509-4", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_ubuntu_USN_3509_4.nasl 14140 2019-03-13 12:26:09Z cfischer $\n#\n# Ubuntu Update for linux-lts-xenial USN-3509-4\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2017 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.843403\");\n script_version(\"$Revision: 14140 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-13 13:26:09 +0100 (Wed, 13 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2017-12-15 12:41:42 +0100 (Fri, 15 Dec 2017)\");\n script_cve_id(\"CVE-2017-16939\", \"CVE-2017-1000405\", \"CVE-2017-12193\", \"CVE-2017-16643\");\n script_tag(name:\"cvss_base\", value:\"7.2\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Ubuntu Update for linux-lts-xenial USN-3509-4\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'linux-lts-xenial'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"insight\", value:\"USN-3509-2 fixed vulnerabilities in the\n Linux Hardware Enablement kernel for Ubuntu 14.04 LTS. Unfortunately, it also\n introduced a regression that prevented the Ceph network filesystem from being\n used. This update fixes the problem. We apologize for the inconvenience.\n Original advisory details: Mohamed Ghannam discovered that a use-after-free\n vulnerability existed in the Netlink subsystem (XFRM) in the Linux kernel. A\n local attacker could use this to cause a denial of service (system crash) or\n possibly execute arbitrary code. (CVE-2017-16939) It was discovered that the\n Linux kernel did not properly handle copy-on- write of transparent huge pages. A\n local attacker could use this to cause a denial of service (application crashes)\n or possibly gain administrative privileges. (CVE-2017-1000405) Fan Wu, Haoran\n Qiu, and Shixiong Zhao discovered that the associative array implementation in\n the Linux kernel sometimes did not properly handle adding a new entry. A local\n attacker could use this to cause a denial of service (system crash).\n (CVE-2017-12193) Andrey Konovalov discovered an out-of-bounds read in the GTCO\n digitizer USB driver for the Linux kernel. A physically proximate attacker could\n use this to cause a denial of service (system crash) or possibly execute\n arbitrary code. (CVE-2017-16643)\");\n script_tag(name:\"affected\", value:\"linux-lts-xenial on Ubuntu 14.04 LTS\");\n script_tag(name:\"solution\", value:\"Please Install the Updated Packages.\");\n\n script_xref(name:\"USN\", value:\"3509-4\");\n script_xref(name:\"URL\", value:\"http://www.ubuntu.com/usn/usn-3509-4/\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2017 Greenbone Networks GmbH\");\n script_family(\"Ubuntu Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/ubuntu_linux\", \"ssh/login/packages\", re:\"ssh/login/release=UBUNTU14\\.04 LTS\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nrelease = dpkg_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"UBUNTU14.04 LTS\")\n{\n\n if ((res = isdpkgvuln(pkg:\"linux-image-4.4.0-1006-aws\", ver:\"4.4.0-1006.6\", rls:\"UBUNTU14.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-4.4.0-104-generic\", ver:\"4.4.0-104.127~14.04.1\", rls:\"UBUNTU14.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-4.4.0-104-generic-lpae\", ver:\"4.4.0-104.127~14.04.1\", rls:\"UBUNTU14.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-4.4.0-104-lowlatency\", ver:\"4.4.0-104.127~14.04.1\", rls:\"UBUNTU14.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-4.4.0-104-powerpc-e500mc\", ver:\"4.4.0-104.127~14.04.1\", rls:\"UBUNTU14.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-4.4.0-104-powerpc-smp\", ver:\"4.4.0-104.127~14.04.1\", rls:\"UBUNTU14.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-4.4.0-104-powerpc64-emb\", ver:\"4.4.0-104.127~14.04.1\", rls:\"UBUNTU14.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-4.4.0-104-powerpc64-smp\", ver:\"4.4.0-104.127~14.04.1\", rls:\"UBUNTU14.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-aws\", ver:\"4.4.0.1006.6\", rls:\"UBUNTU14.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-generic-lpae-lts-xenial\", ver:\"4.4.0.104.87\", rls:\"UBUNTU14.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-generic-lts-xenial\", ver:\"4.4.0.104.87\", rls:\"UBUNTU14.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-lowlatency-lts-xenial\", ver:\"4.4.0.104.87\", rls:\"UBUNTU14.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-powerpc-e500mc-lts-xenial\", ver:\"4.4.0.104.87\", rls:\"UBUNTU14.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-powerpc-smp-lts-xenial\", ver:\"4.4.0.104.87\", rls:\"UBUNTU14.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-powerpc64-emb-lts-xenial\", ver:\"4.4.0.104.87\", rls:\"UBUNTU14.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-powerpc64-smp-lts-xenial\", ver:\"4.4.0.104.87\", rls:\"UBUNTU14.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-05-29T18:34:50", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-12193", "CVE-2017-16939", "CVE-2017-16643", "CVE-2017-1000405"], "description": "The remote host is missing an update for the ", "modified": "2019-03-13T00:00:00", "published": "2017-12-08T00:00:00", "id": "OPENVAS:1361412562310843398", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310843398", "type": "openvas", "title": "Ubuntu Update for linux USN-3509-1", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_ubuntu_USN_3509_1.nasl 14140 2019-03-13 12:26:09Z cfischer $\n#\n# Ubuntu Update for linux USN-3509-1\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2017 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.843398\");\n script_version(\"$Revision: 14140 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-13 13:26:09 +0100 (Wed, 13 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2017-12-08 07:04:55 +0100 (Fri, 08 Dec 2017)\");\n script_cve_id(\"CVE-2017-16939\", \"CVE-2017-1000405\", \"CVE-2017-12193\", \"CVE-2017-16643\");\n script_tag(name:\"cvss_base\", value:\"7.2\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Ubuntu Update for linux USN-3509-1\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'linux'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"insight\", value:\"Mohamed Ghannam discovered that a\n use-after-free vulnerability existed in the Netlink subsystem (XFRM) in the\n Linux kernel. A local attacker could use this to cause a denial of service\n (system crash) or possibly execute arbitrary code. (CVE-2017-16939) It was\n discovered that the Linux kernel did not properly handle copy-on- write of\n transparent huge pages. A local attacker could use this to cause a denial of\n service (application crashes) or possibly gain administrative privileges.\n (CVE-2017-1000405) Fan Wu, Haoran Qiu, and Shixiong Zhao discovered that the\n associative array implementation in the Linux kernel sometimes did not properly\n handle adding a new entry. A local attacker could use this to cause a denial of\n service (system crash). (CVE-2017-12193) Andrey Konovalov discovered an\n out-of-bounds read in the GTCO digitizer USB driver for the Linux kernel. A\n physically proximate attacker could use this to cause a denial of service\n (system crash) or possibly execute arbitrary code. (CVE-2017-16643)\");\n script_tag(name:\"affected\", value:\"linux on Ubuntu 16.04 LTS\");\n script_tag(name:\"solution\", value:\"Please Install the Updated Packages.\");\n\n script_xref(name:\"USN\", value:\"3509-1\");\n script_xref(name:\"URL\", value:\"http://www.ubuntu.com/usn/usn-3509-1/\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2017 Greenbone Networks GmbH\");\n script_family(\"Ubuntu Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/ubuntu_linux\", \"ssh/login/packages\", re:\"ssh/login/release=UBUNTU16\\.04 LTS\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nrelease = dpkg_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"UBUNTU16.04 LTS\")\n{\n\n if ((res = isdpkgvuln(pkg:\"linux-image-4.4.0-1012-kvm\", ver:\"4.4.0-1012.17\", rls:\"UBUNTU16.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-4.4.0-103-generic\", ver:\"4.4.0-103.126\", rls:\"UBUNTU16.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-4.4.0-103-generic-lpae\", ver:\"4.4.0-103.126\", rls:\"UBUNTU16.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-4.4.0-103-lowlatency\", ver:\"4.4.0-103.126\", rls:\"UBUNTU16.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-4.4.0-103-powerpc-e500mc\", ver:\"4.4.0-103.126\", rls:\"UBUNTU16.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-4.4.0-103-powerpc-smp\", ver:\"4.4.0-103.126\", rls:\"UBUNTU16.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-4.4.0-103-powerpc64-emb\", ver:\"4.4.0-103.126\", rls:\"UBUNTU16.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-4.4.0-103-powerpc64-smp\", ver:\"4.4.0-103.126\", rls:\"UBUNTU16.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-4.4.0-1043-aws\", ver:\"4.4.0-1043.52\", rls:\"UBUNTU16.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-4.4.0-1079-raspi2\", ver:\"4.4.0-1079.87\", rls:\"UBUNTU16.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-4.4.0-1081-snapdragon\", ver:\"4.4.0-1081.86\", rls:\"UBUNTU16.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-aws\", ver:\"4.4.0.1043.45\", rls:\"UBUNTU16.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-generic\", ver:\"4.4.0.103.108\", rls:\"UBUNTU16.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-generic-lpae\", ver:\"4.4.0.103.108\", rls:\"UBUNTU16.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-kvm\", ver:\"4.4.0.1012.12\", rls:\"UBUNTU16.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-lowlatency\", ver:\"4.4.0.103.108\", rls:\"UBUNTU16.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-powerpc-e500mc\", ver:\"4.4.0.103.108\", rls:\"UBUNTU16.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-powerpc-smp\", ver:\"4.4.0.103.108\", rls:\"UBUNTU16.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-powerpc64-emb\", ver:\"4.4.0.103.108\", rls:\"UBUNTU16.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-powerpc64-smp\", ver:\"4.4.0.103.108\", rls:\"UBUNTU16.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-raspi2\", ver:\"4.4.0.1079.79\", rls:\"UBUNTU16.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-snapdragon\", ver:\"4.4.0.1081.73\", rls:\"UBUNTU16.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-05-29T18:34:51", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-12193", "CVE-2017-16939", "CVE-2017-16643", "CVE-2017-1000405"], "description": "The remote host is missing an update for the ", "modified": "2019-03-13T00:00:00", "published": "2017-12-15T00:00:00", "id": "OPENVAS:1361412562310843402", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310843402", "type": "openvas", "title": "Ubuntu Update for linux USN-3509-3", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_ubuntu_USN_3509_3.nasl 14140 2019-03-13 12:26:09Z cfischer $\n#\n# Ubuntu Update for linux USN-3509-3\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2017 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.843402\");\n script_version(\"$Revision: 14140 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-13 13:26:09 +0100 (Wed, 13 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2017-12-15 12:41:32 +0100 (Fri, 15 Dec 2017)\");\n script_cve_id(\"CVE-2017-16939\", \"CVE-2017-1000405\", \"CVE-2017-12193\", \"CVE-2017-16643\");\n script_tag(name:\"cvss_base\", value:\"7.2\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Ubuntu Update for linux USN-3509-3\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'linux'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"insight\", value:\"USN-3509-1 fixed vulnerabilities in the\n Linux kernel for Ubuntu 16.04 LTS. Unfortunately, it also introduced a\n regression that prevented the Ceph network filesystem from being used. This\n update fixes the problem. We apologize for the inconvenience. Original advisory\n details: Mohamed Ghannam discovered that a use-after-free vulnerability existed\n in the Netlink subsystem (XFRM) in the Linux kernel. A local attacker could use\n this to cause a denial of service (system crash) or possibly execute arbitrary\n code. (CVE-2017-16939) It was discovered that the Linux kernel did not properly\n handle copy-on- write of transparent huge pages. A local attacker could use this\n to cause a denial of service (application crashes) or possibly gain\n administrative privileges. (CVE-2017-1000405) Fan Wu, Haoran Qiu, and Shixiong\n Zhao discovered that the associative array implementation in the Linux kernel\n sometimes did not properly handle adding a new entry. A local attacker could use\n this to cause a denial of service (system crash). (CVE-2017-12193) Andrey\n Konovalov discovered an out-of-bounds read in the GTCO digitizer USB driver for\n the Linux kernel. A physically proximate attacker could use this to cause a\n denial of service (system crash) or possibly execute arbitrary code.\n (CVE-2017-16643)\");\n script_tag(name:\"affected\", value:\"linux on Ubuntu 16.04 LTS\");\n script_tag(name:\"solution\", value:\"Please Install the Updated Packages.\");\n\n script_xref(name:\"USN\", value:\"3509-3\");\n script_xref(name:\"URL\", value:\"http://www.ubuntu.com/usn/usn-3509-3/\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2017 Greenbone Networks GmbH\");\n script_family(\"Ubuntu Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/ubuntu_linux\", \"ssh/login/packages\", re:\"ssh/login/release=UBUNTU16\\.04 LTS\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nrelease = dpkg_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"UBUNTU16.04 LTS\")\n{\n\n if ((res = isdpkgvuln(pkg:\"linux-image-4.4.0-1013-kvm\", ver:\"4.4.0-1013.18\", rls:\"UBUNTU16.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-4.4.0-104-generic\", ver:\"4.4.0-104.127\", rls:\"UBUNTU16.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-4.4.0-104-generic-lpae\", ver:\"4.4.0-104.127\", rls:\"UBUNTU16.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-4.4.0-104-lowlatency\", ver:\"4.4.0-104.127\", rls:\"UBUNTU16.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-4.4.0-104-powerpc-e500mc\", ver:\"4.4.0-104.127\", rls:\"UBUNTU16.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-4.4.0-104-powerpc-smp\", ver:\"4.4.0-104.127\", rls:\"UBUNTU16.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-4.4.0-104-powerpc64-emb\", ver:\"4.4.0-104.127\", rls:\"UBUNTU16.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-4.4.0-104-powerpc64-smp\", ver:\"4.4.0-104.127\", rls:\"UBUNTU16.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-4.4.0-1044-aws\", ver:\"4.4.0-1044.53\", rls:\"UBUNTU16.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-4.4.0-1080-raspi2\", ver:\"4.4.0-1080.88\", rls:\"UBUNTU16.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-aws\", ver:\"4.4.0.1044.46\", rls:\"UBUNTU16.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-generic\", ver:\"4.4.0.104.109\", rls:\"UBUNTU16.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-generic-lpae\", ver:\"4.4.0.104.109\", rls:\"UBUNTU16.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-kvm\", ver:\"4.4.0.1013.13\", rls:\"UBUNTU16.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-lowlatency\", ver:\"4.4.0.104.109\", rls:\"UBUNTU16.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-powerpc-e500mc\", ver:\"4.4.0.104.109\", rls:\"UBUNTU16.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-powerpc-smp\", ver:\"4.4.0.104.109\", rls:\"UBUNTU16.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-powerpc64-emb\", ver:\"4.4.0.104.109\", rls:\"UBUNTU16.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-powerpc64-smp\", ver:\"4.4.0.104.109\", rls:\"UBUNTU16.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-raspi2\", ver:\"4.4.0.1080.80\", rls:\"UBUNTU16.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-05-29T18:34:50", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-12193", "CVE-2017-16939", "CVE-2017-16643", "CVE-2017-1000405"], "description": "The remote host is missing an update for the ", "modified": "2019-03-13T00:00:00", "published": "2017-12-09T00:00:00", "id": "OPENVAS:1361412562310843400", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310843400", "type": "openvas", "title": "Ubuntu Update for linux-aws USN-3509-2", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_ubuntu_USN_3509_2.nasl 14140 2019-03-13 12:26:09Z cfischer $\n#\n# Ubuntu Update for linux-aws USN-3509-2\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2017 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.843400\");\n script_version(\"$Revision: 14140 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-13 13:26:09 +0100 (Wed, 13 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2017-12-09 07:39:26 +0100 (Sat, 09 Dec 2017)\");\n script_cve_id(\"CVE-2017-16939\", \"CVE-2017-1000405\", \"CVE-2017-12193\", \"CVE-2017-16643\");\n script_tag(name:\"cvss_base\", value:\"7.2\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Ubuntu Update for linux-aws USN-3509-2\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'linux-aws'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"insight\", value:\"USN-3509-1 fixed vulnerabilities in the\n Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding\n updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for\n Ubuntu 14.04 LTS. Mohamed Ghannam discovered that a use-after-free vulnerability\n existed in the Netlink subsystem (XFRM) in the Linux kernel. A local attacker\n could use this to cause a denial of service (system crash) or possibly execute\n arbitrary code. (CVE-2017-16939) It was discovered that the Linux kernel did not\n properly handle copy-on- write of transparent huge pages. A local attacker could\n use this to cause a denial of service (application crashes) or possibly gain\n administrative privileges. (CVE-2017-1000405) Fan Wu, Haoran Qiu, and Shixiong\n Zhao discovered that the associative array implementation in the Linux kernel\n sometimes did not properly handle adding a new entry. A local attacker could use\n this to cause a denial of service (system crash). (CVE-2017-12193) Andrey\n Konovalov discovered an out-of-bounds read in the GTCO digitizer USB driver for\n the Linux kernel. A physically proximate attacker could use this to cause a\n denial of service (system crash) or possibly execute arbitrary code.\n (CVE-2017-16643)\");\n script_tag(name:\"affected\", value:\"linux-aws on Ubuntu 14.04 LTS\");\n script_tag(name:\"solution\", value:\"Please Install the Updated Packages.\");\n\n script_xref(name:\"USN\", value:\"3509-2\");\n script_xref(name:\"URL\", value:\"http://www.ubuntu.com/usn/usn-3509-2/\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2017 Greenbone Networks GmbH\");\n script_family(\"Ubuntu Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/ubuntu_linux\", \"ssh/login/packages\", re:\"ssh/login/release=UBUNTU14\\.04 LTS\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nrelease = dpkg_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"UBUNTU14.04 LTS\")\n{\n\n if ((res = isdpkgvuln(pkg:\"linux-image-4.4.0-1005-aws\", ver:\"4.4.0-1005.5\", rls:\"UBUNTU14.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-4.4.0-103-generic\", ver:\"4.4.0-103.126~14.04.1\", rls:\"UBUNTU14.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-4.4.0-103-generic-lpae\", ver:\"4.4.0-103.126~14.04.1\", rls:\"UBUNTU14.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-4.4.0-103-lowlatency\", ver:\"4.4.0-103.126~14.04.1\", rls:\"UBUNTU14.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-4.4.0-103-powerpc-e500mc\", ver:\"4.4.0-103.126~14.04.1\", rls:\"UBUNTU14.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-4.4.0-103-powerpc-smp\", ver:\"4.4.0-103.126~14.04.1\", rls:\"UBUNTU14.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-4.4.0-103-powerpc64-emb\", ver:\"4.4.0-103.126~14.04.1\", rls:\"UBUNTU14.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-4.4.0-103-powerpc64-smp\", ver:\"4.4.0-103.126~14.04.1\", rls:\"UBUNTU14.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-aws\", ver:\"4.4.0.1005.5\", rls:\"UBUNTU14.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-generic-lpae-lts-xenial\", ver:\"4.4.0.103.86\", rls:\"UBUNTU14.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-generic-lts-xenial\", ver:\"4.4.0.103.86\", rls:\"UBUNTU14.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-lowlatency-lts-xenial\", ver:\"4.4.0.103.86\", rls:\"UBUNTU14.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-powerpc-e500mc-lts-xenial\", ver:\"4.4.0.103.86\", rls:\"UBUNTU14.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-powerpc-smp-lts-xenial\", ver:\"4.4.0.103.86\", rls:\"UBUNTU14.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-powerpc64-emb-lts-xenial\", ver:\"4.4.0.103.86\", rls:\"UBUNTU14.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-powerpc64-smp-lts-xenial\", ver:\"4.4.0.103.86\", rls:\"UBUNTU14.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-01-27T18:39:53", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-12193", "CVE-2017-15115", "CVE-2017-15102", "CVE-2017-1000410", "CVE-2017-12190"], "description": "The remote host is missing an update for the Huawei EulerOS\n ", "modified": "2020-01-23T00:00:00", "published": "2020-01-23T00:00:00", "id": "OPENVAS:1361412562311220171318", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562311220171318", "type": "openvas", "title": "Huawei EulerOS: Security Advisory for kernel (EulerOS-SA-2017-1318)", "sourceData": "# Copyright (C) 2020 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.1.2.2017.1318\");\n script_version(\"2020-01-23T11:06:51+0000\");\n script_cve_id(\"CVE-2017-1000410\", \"CVE-2017-12190\", \"CVE-2017-12193\", \"CVE-2017-15102\", \"CVE-2017-15115\");\n script_tag(name:\"cvss_base\", value:\"7.2\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2020-01-23 11:06:51 +0000 (Thu, 23 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2020-01-23 11:06:51 +0000 (Thu, 23 Jan 2020)\");\n script_name(\"Huawei EulerOS: Security Advisory for kernel (EulerOS-SA-2017-1318)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2020 Greenbone Networks GmbH\");\n script_family(\"Huawei EulerOS Local Security Checks\");\n script_dependencies(\"gb_huawei_euleros_consolidation.nasl\");\n script_mandatory_keys(\"ssh/login/euleros\", \"ssh/login/rpms\", re:\"ssh/login/release=EULEROS-2\\.0SP1\");\n\n script_xref(name:\"EulerOS-SA\", value:\"2017-1318\");\n script_xref(name:\"URL\", value:\"https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2017-1318\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the Huawei EulerOS\n 'kernel' package(s) announced via the EulerOS-SA-2017-1318 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"A flaw was found in the processing of incoming L2CAP bluetooth commands. Uninitialized stack variables can be sent to an attacker leaking data in kernel address space.(CVE-2017-1000410)\n\nThe assoc_array_insert_into_terminal_node function in lib/assoc_array.c in the Linux kernel before 4.13.11 mishandles node splitting, which allows local users to cause a denial of service (NULL pointer dereference and panic) via a crafted application, as demonstrated by the keyring key type, and key addition and link creation operations.(CVE-2017-12193)\n\nThe bio_map_user_iov and bio_unmap_user functions in block/bio.c in the Linux kernel before 4.13.8 do unbalanced refcounting when a SCSI I/O vector has small consecutive buffers belonging to the same page. The bio_add_pc_page function merges them into one, but the page reference is never dropped. This causes a memory leak and possible system lockup (exploitable against the host OS by a guest OS user, if a SCSI disk is passed through to a virtual machine) due to an out-of-memory condition.(CVE-2017-12190)\n\nThe tower_probe function in drivers/usb/misc/legousbtower.c in the Linux kernel before 4.8.1 allows local users (who are physically proximate for inserting a crafted USB device) to gain privileges by leveraging a write-what-where condition that occurs after a race condition and a NULL pointer dereference.(CVE-2017-15102)\n\nThe sctp_do_peeloff function in net/sctp/socket.c in the Linux kernel before 4.14 does not check whether the intended netns is used in a peel-off action, which allows local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via crafted system calls.(CVE-2017-15115)\");\n\n script_tag(name:\"affected\", value:\"'kernel' package(s) on Huawei EulerOS V2.0SP1.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"EULEROS-2.0SP1\") {\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel\", rpm:\"kernel~3.10.0~229.49.1.157\", rls:\"EULEROS-2.0SP1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-debug\", rpm:\"kernel-debug~3.10.0~229.49.1.157\", rls:\"EULEROS-2.0SP1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-debuginfo\", rpm:\"kernel-debuginfo~3.10.0~229.49.1.157\", rls:\"EULEROS-2.0SP1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-debuginfo-common-x86_64\", rpm:\"kernel-debuginfo-common-x86_64~3.10.0~229.49.1.157\", rls:\"EULEROS-2.0SP1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-devel\", rpm:\"kernel-devel~3.10.0~229.49.1.157\", rls:\"EULEROS-2.0SP1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-headers\", rpm:\"kernel-headers~3.10.0~229.49.1.157\", rls:\"EULEROS-2.0SP1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-tools\", rpm:\"kernel-tools~3.10.0~229.49.1.157\", rls:\"EULEROS-2.0SP1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"kernel-tools-libs\", rpm:\"kernel-tools-libs~3.10.0~229.49.1.157\", rls:\"EULEROS-2.0SP1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"perf\", rpm:\"perf~3.10.0~229.49.1.157\", rls:\"EULEROS-2.0SP1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"python-perf\", rpm:\"python-perf~3.10.0~229.49.1.157\", rls:\"EULEROS-2.0SP1\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-05-29T18:34:50", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-15306", "CVE-2017-15299", "CVE-2017-12193", "CVE-2017-15951", "CVE-2017-16939", "CVE-2017-1000405"], "description": "The remote host is missing an update for the ", "modified": "2019-03-13T00:00:00", "published": "2017-12-08T00:00:00", "id": "OPENVAS:1361412562310843395", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310843395", "type": "openvas", "title": "Ubuntu Update for linux-gcp USN-3507-2", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_ubuntu_USN_3507_2.nasl 14140 2019-03-13 12:26:09Z cfischer $\n#\n# Ubuntu Update for linux-gcp USN-3507-2\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2017 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.843395\");\n script_version(\"$Revision: 14140 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-13 13:26:09 +0100 (Wed, 13 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2017-12-08 07:04:27 +0100 (Fri, 08 Dec 2017)\");\n script_cve_id(\"CVE-2017-16939\", \"CVE-2017-1000405\", \"CVE-2017-12193\",\n \"CVE-2017-15299\", \"CVE-2017-15306\", \"CVE-2017-15951\");\n script_tag(name:\"cvss_base\", value:\"7.2\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Ubuntu Update for linux-gcp USN-3507-2\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'linux-gcp'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"insight\", value:\"Mohamed Ghannam discovered that a\n use-after-free vulnerability existed in the Netlink subsystem (XFRM) in the\n Linux kernel. A local attacker could use this to cause a denial of service\n (system crash) or possibly execute arbitrary code. (CVE-2017-16939) It was\n discovered that the Linux kernel did not properly handle copy-on- write of\n transparent huge pages. A local attacker could use this to cause a denial of\n service (application crashes) or possibly gain administrative privileges.\n (CVE-2017-1000405) Fan Wu, Haoran Qiu, and Shixiong Zhao discovered that the\n associative array implementation in the Linux kernel sometimes did not properly\n handle adding a new entry. A local attacker could use this to cause a denial of\n service (system crash). (CVE-2017-12193) Eric Biggers discovered that the key\n management subsystem in the Linux kernel did not properly restrict adding a key\n that already exists but is uninstantiated. A local attacker could use this to\n cause a denial of service (system crash) or possibly execute arbitrary code.\n (CVE-2017-15299) It was discovered that a null pointer dereference error existed\n in the PowerPC KVM implementation in the Linux kernel. A local attacker could\n use this to cause a denial of service (system crash). (CVE-2017-15306) Eric\n Biggers discovered a race condition in the key management subsystem of the Linux\n kernel around keys in a negative state. A local attacker could use this to cause\n a denial of service (system crash) or possibly execute arbitrary code.\n (CVE-2017-15951)\");\n script_tag(name:\"affected\", value:\"linux-gcp on Ubuntu 16.04 LTS\");\n script_tag(name:\"solution\", value:\"Please Install the Updated Packages.\");\n\n script_xref(name:\"USN\", value:\"3507-2\");\n script_xref(name:\"URL\", value:\"http://www.ubuntu.com/usn/usn-3507-2/\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2017 Greenbone Networks GmbH\");\n script_family(\"Ubuntu Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/ubuntu_linux\", \"ssh/login/packages\", re:\"ssh/login/release=UBUNTU16\\.04 LTS\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nrelease = dpkg_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"UBUNTU16.04 LTS\")\n{\n\n if ((res = isdpkgvuln(pkg:\"linux-image-4.13.0-1002-gcp\", ver:\"4.13.0-1002.5\", rls:\"UBUNTU16.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-gcp\", ver:\"4.13.0.1002.4\", rls:\"UBUNTU16.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-gke\", ver:\"4.13.0.1002.4\", rls:\"UBUNTU16.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-05-29T18:34:50", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-15306", "CVE-2017-15299", "CVE-2017-12193", "CVE-2017-16535", "CVE-2017-15951", "CVE-2017-16939", "CVE-2017-16643", "CVE-2017-1000405"], "description": "The remote host is missing an update for the ", "modified": "2019-03-13T00:00:00", "published": "2017-12-09T00:00:00", "id": "OPENVAS:1361412562310843399", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310843399", "type": "openvas", "title": "Ubuntu Update for linux USN-3507-1", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_ubuntu_USN_3507_1.nasl 14140 2019-03-13 12:26:09Z cfischer $\n#\n# Ubuntu Update for linux USN-3507-1\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2017 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.843399\");\n script_version(\"$Revision: 14140 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-13 13:26:09 +0100 (Wed, 13 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2017-12-09 07:39:06 +0100 (Sat, 09 Dec 2017)\");\n script_cve_id(\"CVE-2017-16939\", \"CVE-2017-1000405\", \"CVE-2017-12193\", \"CVE-2017-15299\",\n \"CVE-2017-15306\", \"CVE-2017-15951\", \"CVE-2017-16535\", \"CVE-2017-16643\");\n script_tag(name:\"cvss_base\", value:\"7.2\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Ubuntu Update for linux USN-3507-1\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'linux'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"insight\", value:\"Mohamed Ghannam discovered that a\n use-after-free vulnerability existed in the Netlink subsystem (XFRM) in the\n Linux kernel. A local attacker could use this to cause a denial of service\n (system crash) or possibly execute arbitrary code. (CVE-2017-16939) It was\n discovered that the Linux kernel did not properly handle copy-on- write of\n transparent huge pages. A local attacker could use this to cause a denial of\n service (application crashes) or possibly gain administrative privileges.\n (CVE-2017-1000405) Fan Wu, Haoran Qiu, and Shixiong Zhao discovered that the\n associative array implementation in the Linux kernel sometimes did not properly\n handle adding a new entry. A local attacker could use this to cause a denial of\n service (system crash). (CVE-2017-12193) Eric Biggers discovered that the key\n management subsystem in the Linux kernel did not properly restrict adding a key\n that already exists but is uninstantiated. A local attacker could use this to\n cause a denial of service (system crash) or possibly execute arbitrary code.\n (CVE-2017-15299) It was discovered that a null pointer dereference error existed\n in the PowerPC KVM implementation in the Linux kernel. A local attacker could\n use this to cause a denial of service (system crash). (CVE-2017-15306) Eric\n Biggers discovered a race condition in the key management subsystem of the Linux\n kernel around keys in a negative state. A local attacker could use this to cause\n a denial of service (system crash) or possibly execute arbitrary code.\n (CVE-2017-15951) Andrey Konovalov discovered that the USB subsystem in the Linux\n kernel did not properly validate USB BOS metadata. A physically proximate\n attacker could use this to cause a denial of service (system crash).\n (CVE-2017-16535) Andrey Konovalov discovered an out-of-bounds read in the GTCO\n digitizer USB driver for the Linux kernel. A physically proximate attacker could\n use this to cause a denial of service (system crash) or possibly execute\n arbitrary code. (CVE-2017-16643)\");\n script_tag(name:\"affected\", value:\"linux on Ubuntu 17.10\");\n script_tag(name:\"solution\", value:\"Please Install the Updated Packages.\");\n\n script_xref(name:\"USN\", value:\"3507-1\");\n script_xref(name:\"URL\", value:\"http://www.ubuntu.com/usn/usn-3507-1/\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2017 Greenbone Networks GmbH\");\n script_family(\"Ubuntu Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/ubuntu_linux\", \"ssh/login/packages\", re:\"ssh/login/release=UBUNTU17\\.10\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nrelease = dpkg_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"UBUNTU17.10\")\n{\n\n if ((res = isdpkgvuln(pkg:\"linux-image-4.13.0-1008-raspi2\", ver:\"4.13.0-1008.8\", rls:\"UBUNTU17.10\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-4.13.0-19-generic\", ver:\"4.13.0-19.22\", rls:\"UBUNTU17.10\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-4.13.0-19-generic-lpae\", ver:\"4.13.0-19.22\", rls:\"UBUNTU17.10\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-4.13.0-19-lowlatency\", ver:\"4.13.0-19.22\", rls:\"UBUNTU17.10\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-generic\", ver:\"4.13.0.19.20\", rls:\"UBUNTU17.10\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-generic-lpae\", ver:\"4.13.0.19.20\", rls:\"UBUNTU17.10\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-lowlatency\", ver:\"4.13.0.19.20\", rls:\"UBUNTU17.10\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"linux-image-raspi2\", ver:\"4.13.0.1008.6\", rls:\"UBUNTU17.10\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-05-29T18:33:26", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-7472", "CVE-2017-5753", "CVE-2017-5754", "CVE-2017-12193", "CVE-2017-15649", "CVE-2017-5715", "CVE-2017-12192", "CVE-2015-8539"], "description": "Check the version of kernel", "modified": "2019-03-08T00:00:00", "published": "2018-01-26T00:00:00", "id": "OPENVAS:1361412562310882836", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310882836", "type": "openvas", "title": "CentOS Update for kernel CESA-2018:0151 centos7", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_CESA-2018_0151_kernel_centos7.nasl 14058 2019-03-08 13:25:52Z cfischer $\n#\n# CentOS Update for kernel CESA-2018:0151 centos7\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2018 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.882836\");\n script_version(\"$Revision: 14058 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-08 14:25:52 +0100 (Fri, 08 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2018-01-26 07:45:54 +0100 (Fri, 26 Jan 2018)\");\n script_cve_id(\"CVE-2015-8539\", \"CVE-2017-7472\", \"CVE-2017-12192\", \"CVE-2017-12193\",\n \"CVE-2017-15649\", \"CVE-2017-5715\", \"CVE-2017-5753\", \"CVE-2017-5754\");\n script_tag(name:\"cvss_base\", value:\"7.2\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"CentOS Update for kernel CESA-2018:0151 centos7\");\n script_tag(name:\"summary\", value:\"Check the version of kernel\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"insight\", value:\"The kernel packages contain the Linux kernel,\nthe core of any Linux operating system.\n\nSecurity Fix(es):\n\nAn industry-wide issue was found in the way many modern microprocessor\ndesigns have implemented speculative execution of instructions (a commonly\nused performance optimization). There are three primary variants of the\nissue which differ in the way the speculative execution can be exploited.\n\nNote: This issue is present in hardware and cannot be fully fixed via\nsoftware update. The updated kernel packages provide software mitigation\nfor this hardware issue at a cost of potential performance penalty. Please\nrefer to References section for further information about this issue and\nthe performance impact.\n\nIn this update initial mitigations for IBM Power (PowerPC) and IBM zSeries\n(S390) architectures are provided.\n\n * Variant CVE-2017-5715 triggers the speculative execution by utilizing\nbranch target injection. It relies on the presence of a precisely-defined\ninstruction sequence in the privileged code as well as the fact that memory\naccesses may cause allocation into the microprocessor's data cache even for\nspeculatively executed instructions that never actually commit (retire). As\na result, an unprivileged attacker could use this flaw to cross the syscall\nand guest/host boundaries and read privileged memory by conducting targeted\ncache side-channel attacks. This fix specifically addresses S390\nprocessors. (CVE-2017-5715, Important)\n\n * Variant CVE-2017-5753 triggers the speculative execution by performing a\nbounds-check bypass. It relies on the presence of a precisely-defined\ninstruction sequence in the privileged code as well as the fact that memory\naccesses may cause allocation into the microprocessor's data cache even for\nspeculatively executed instructions that never actually commit (retire). As\na result, an unprivileged attacker could use this flaw to cross the syscall\nboundary and read privileged memory by conducting targeted cache\nside-channel attacks. This fix specifically addresses S390 and PowerPC\nprocessors. (CVE-2017-5753, Important)\n\n * Variant CVE-2017-5754 relies on the fact that, on impacted\nmicroprocessors, during speculative execution of instruction permission\nfaults, exception generation triggered by a faulting access is suppressed\nuntil the retirement of the whole instruction block. In a combination with\nthe fact that memory accesses may populate the cache even when the block is\nbeing dropped and never committed (executed), an unprivileged local\nattacker could use this flaw to read privileged (kernel space) memory by\nconducting targeted cache side-channel attacks. Note: CVE-2017- ...\n\n Description truncated, please see the referenced URL(s) for more information.\");\n script_tag(name:\"affected\", value:\"kernel on CentOS 7\");\n script_tag(name:\"solution\", value:\"Please Install the Updated Packages.\");\n\n script_xref(name:\"CESA\", value:\"2018:0151\");\n script_xref(name:\"URL\", value:\"http://lists.centos.org/pipermail/centos-announce/2018-January/022730.html\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2018 Greenbone Networks GmbH\");\n script_family(\"CentOS Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/centos\", \"ssh/login/rpms\", re:\"ssh/login/release=CentOS7\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"CentOS7\")\n{\n\n if ((res = isrpmvuln(pkg:\"kernel\", rpm:\"kernel~3.10.0~693.17.1.el7\", rls:\"CentOS7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-abi-whitelists\", rpm:\"kernel-abi-whitelists~3.10.0~693.17.1.el7\", rls:\"CentOS7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-debug\", rpm:\"kernel-debug~3.10.0~693.17.1.el7\", rls:\"CentOS7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-debug-devel\", rpm:\"kernel-debug-devel~3.10.0~693.17.1.el7\", rls:\"CentOS7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-devel\", rpm:\"kernel-devel~3.10.0~693.17.1.el7\", rls:\"CentOS7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-doc\", rpm:\"kernel-doc~3.10.0~693.17.1.el7\", rls:\"CentOS7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-headers\", rpm:\"kernel-headers~3.10.0~693.17.1.el7\", rls:\"CentOS7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-tools\", rpm:\"kernel-tools~3.10.0~693.17.1.el7\", rls:\"CentOS7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-tools-libs\", rpm:\"kernel-tools-libs~3.10.0~693.17.1.el7\", rls:\"CentOS7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"kernel-tools-libs-devel\", rpm:\"kernel-tools-libs-devel~3.10.0~693.17.1.el7\", rls:\"CentOS7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"perf\", rpm:\"perf~3.10.0~693.17.1.el7\", rls:\"CentOS7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"python-perf\", rpm:\"python-perf~3.10.0~693.17.1.el7\", rls:\"CentOS7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}], "fedora": [{"lastseen": "2020-12-21T08:17:54", "bulletinFamily": "unix", "cvelist": ["CVE-2017-12193"], "description": "The kernel meta package ", "modified": "2017-11-07T23:42:04", "published": "2017-11-07T23:42:04", "id": "FEDORA:AD702611860E", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 25 Update: kernel-4.13.11-100.fc25", "cvss": {"score": 4.9, "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2020-12-21T08:17:54", "bulletinFamily": "unix", "cvelist": ["CVE-2017-12193"], "description": "The kernel meta package ", "modified": "2017-11-11T13:54:37", "published": "2017-11-11T13:54:37", "id": "FEDORA:18F546317D8C", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 27 Update: kernel-4.13.11-300.fc27", "cvss": {"score": 4.9, "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2020-12-21T08:17:54", "bulletinFamily": "unix", "cvelist": ["CVE-2017-1000405", "CVE-2017-12193", "CVE-2017-15115", "CVE-2017-16532", "CVE-2017-16538", "CVE-2017-16644", "CVE-2017-16647", "CVE-2017-16649", "CVE-2017-16650", "CVE-2017-17448", "CVE-2017-17449", "CVE-2017-17450", "CVE-2017-17558", "CVE-2017-17712", "CVE-2017-17741", "CVE-2017-17852", "CVE-2017-17853", "CVE-2017-17854", "CVE-2017-17855", "CVE-2017-17857", "CVE-2017-17862", "CVE-2017-17863", "CVE-2017-17864", "CVE-2017-18232", "CVE-2017-8824", "CVE-2018-1000004", "CVE-2018-1000026", "CVE-2018-10021", "CVE-2018-1065", "CVE-2018-5332", "CVE-2018-5333", "CVE-2018-5344", "CVE-2018-5750", "CVE-2018-5803", "CVE-2018-7757", "CVE-2018-7995", "CVE-2018-8043"], "description": "The kernel meta package ", "modified": "2018-04-18T01:31:51", "published": "2018-04-18T01:31:51", "id": "FEDORA:74245604D4DA", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 27 Update: kernel-4.15.17-300.fc27", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-12-21T08:17:54", "bulletinFamily": "unix", "cvelist": ["CVE-2017-1000405", "CVE-2017-12193", "CVE-2017-15115", "CVE-2017-16532", "CVE-2017-16538", "CVE-2017-16644", "CVE-2017-16647", "CVE-2017-16649", "CVE-2017-16650", "CVE-2017-17448", "CVE-2017-17449", "CVE-2017-17450", "CVE-2017-17558", "CVE-2017-17712", "CVE-2017-17741", "CVE-2017-17852", "CVE-2017-17853", "CVE-2017-17854", "CVE-2017-17855", "CVE-2017-17857", "CVE-2017-17862", "CVE-2017-17863", "CVE-2017-17864", "CVE-2017-18232", "CVE-2017-8824", "CVE-2018-1000004", "CVE-2018-1000026", "CVE-2018-10021", "CVE-2018-1065", "CVE-2018-1108", "CVE-2018-5332", "CVE-2018-5333", "CVE-2018-5344", "CVE-2018-5750", "CVE-2018-5803", "CVE-2018-7757", "CVE-2018-7995", "CVE-2018-8043"], "description": "The kernel meta package ", "modified": "2018-04-29T05:16:13", "published": "2018-04-29T05:16:13", "id": "FEDORA:AB52460321C9", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 27 Update: kernel-4.16.4-200.fc27", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-12-21T08:17:54", "bulletinFamily": "unix", "cvelist": ["CVE-2017-1000405", "CVE-2017-12193", "CVE-2017-15115", "CVE-2017-16532", "CVE-2017-16538", "CVE-2017-16644", "CVE-2017-16647", "CVE-2017-16649", "CVE-2017-16650", "CVE-2017-17448", "CVE-2017-17449", "CVE-2017-17450", "CVE-2017-17558", "CVE-2017-17712", "CVE-2017-17741", "CVE-2017-17852", "CVE-2017-17853", "CVE-2017-17854", "CVE-2017-17855", "CVE-2017-17857", "CVE-2017-17862", "CVE-2017-17863", "CVE-2017-17864", "CVE-2017-18232", "CVE-2017-8824", "CVE-2018-1000004", "CVE-2018-1000026", "CVE-2018-10021", "CVE-2018-10322", "CVE-2018-10323", "CVE-2018-1065", "CVE-2018-1108", "CVE-2018-1120", "CVE-2018-3639", "CVE-2018-5332", "CVE-2018-5333", "CVE-2018-5344", "CVE-2018-5750", "CVE-2018-5803", "CVE-2018-7757", "CVE-2018-7995", "CVE-2018-8043"], "description": "The kernel meta package ", "modified": "2018-05-25T15:46:24", "published": "2018-05-25T15:46:24", "id": "FEDORA:08D3760E6566", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 27 Update: kernel-4.16.11-200.fc27", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-12-21T08:17:54", "bulletinFamily": "unix", "cvelist": ["CVE-2017-1000405", "CVE-2017-12193", "CVE-2017-15115", "CVE-2017-16532", "CVE-2017-16538", "CVE-2017-16644", "CVE-2017-16647", "CVE-2017-16649", "CVE-2017-16650", "CVE-2017-17448", "CVE-2017-17449", "CVE-2017-17450", "CVE-2017-17558", "CVE-2017-17712", "CVE-2017-17741", "CVE-2017-17852", "CVE-2017-17853", "CVE-2017-17854", "CVE-2017-17855", "CVE-2017-17857", "CVE-2017-17862", "CVE-2017-17863", "CVE-2017-17864", "CVE-2017-18232", "CVE-2017-8824", "CVE-2018-1000004", "CVE-2018-1000026", "CVE-2018-10021", "CVE-2018-10322", "CVE-2018-10323", "CVE-2018-1065", "CVE-2018-10840", "CVE-2018-10853", "CVE-2018-1108", "CVE-2018-1120", "CVE-2018-11506", "CVE-2018-3639", "CVE-2018-5332", "CVE-2018-5333", "CVE-2018-5344", "CVE-2018-5750", "CVE-2018-5803", "CVE-2018-7757", "CVE-2018-7995", "CVE-2018-8043"], "description": "The kernel meta package ", "modified": "2018-06-17T19:45:35", "published": "2018-06-17T19:45:35", "id": "FEDORA:DF5176048167", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 27 Update: kernel-4.16.15-200.fc27", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-12-21T08:17:54", "bulletinFamily": "unix", "cvelist": ["CVE-2017-1000405", "CVE-2017-12193", "CVE-2017-15115", "CVE-2017-16532", "CVE-2017-16538", "CVE-2017-16644", "CVE-2017-16647", "CVE-2017-16649", "CVE-2017-16650", "CVE-2017-17448", "CVE-2017-17449", "CVE-2017-17450", "CVE-2017-17558", "CVE-2017-17712", "CVE-2017-17741", "CVE-2017-17852", "CVE-2017-17853", "CVE-2017-17854", "CVE-2017-17855", "CVE-2017-17857", "CVE-2017-17862", "CVE-2017-17863", "CVE-2017-17864", "CVE-2017-18232", "CVE-2017-8824", "CVE-2018-1000004", "CVE-2018-1000026", "CVE-2018-10021", "CVE-2018-10322", "CVE-2018-10323", "CVE-2018-1065", "CVE-2018-10840", "CVE-2018-1108", "CVE-2018-1120", "CVE-2018-11506", "CVE-2018-3639", "CVE-2018-5332", "CVE-2018-5333", "CVE-2018-5344", "CVE-2018-5750", "CVE-2018-5803", "CVE-2018-7757", "CVE-2018-7995", "CVE-2018-8043"], "description": "The kernel meta package ", "modified": "2018-06-05T14:11:50", "published": "2018-06-05T14:11:50", "id": "FEDORA:4832F6079717", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 27 Update: kernel-4.16.13-200.fc27", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-12-21T08:17:54", "bulletinFamily": "unix", "cvelist": ["CVE-2017-1000405", "CVE-2017-12193", "CVE-2017-15115", "CVE-2017-16532", "CVE-2017-16538", "CVE-2017-16644", "CVE-2017-16647", "CVE-2017-16649", "CVE-2017-16650", "CVE-2017-17448", "CVE-2017-17449", "CVE-2017-17450", "CVE-2017-17558", "CVE-2017-17712", "CVE-2017-17741", "CVE-2017-17852", "CVE-2017-17853", "CVE-2017-17854", "CVE-2017-17855", "CVE-2017-17857", "CVE-2017-17862", "CVE-2017-17863", "CVE-2017-17864", "CVE-2017-18232", "CVE-2017-8824", "CVE-2018-1000004", "CVE-2018-1000026", "CVE-2018-10021", "CVE-2018-10322", "CVE-2018-10323", "CVE-2018-1065", "CVE-2018-10840", "CVE-2018-1108", "CVE-2018-1120", "CVE-2018-3639", "CVE-2018-5332", "CVE-2018-5333", "CVE-2018-5344", "CVE-2018-5750", "CVE-2018-5803", "CVE-2018-7757", "CVE-2018-7995", "CVE-2018-8043"], "description": "The kernel meta package ", "modified": "2018-05-29T11:50:44", "published": "2018-05-29T11:50:44", "id": "FEDORA:E6F08605DCE7", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 27 Update: kernel-4.16.12-200.fc27", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-12-21T08:17:54", "bulletinFamily": "unix", "cvelist": ["CVE-2017-1000405", "CVE-2017-12193", "CVE-2017-15115", "CVE-2017-16532", "CVE-2017-16538", "CVE-2017-16644", "CVE-2017-16647", "CVE-2017-16649", "CVE-2017-16650", "CVE-2017-17448", "CVE-2017-17449", "CVE-2017-17450", "CVE-2017-17558", "CVE-2017-17712", "CVE-2017-17741", "CVE-2017-17852", "CVE-2017-17853", "CVE-2017-17854", "CVE-2017-17855", "CVE-2017-17857", "CVE-2017-17862", "CVE-2017-17863", "CVE-2017-17864", "CVE-2017-18232", "CVE-2017-8824", "CVE-2018-1000004", "CVE-2018-1000026", "CVE-2018-10021", "CVE-2018-10322", "CVE-2018-10323", "CVE-2018-1065", "CVE-2018-10840", "CVE-2018-10853", "CVE-2018-1108", "CVE-2018-1120", "CVE-2018-11506", "CVE-2018-12232", "CVE-2018-12633", "CVE-2018-3639", "CVE-2018-5332", "CVE-2018-5333", "CVE-2018-5344", "CVE-2018-5750", "CVE-2018-5803", "CVE-2018-7757", "CVE-2018-7995", "CVE-2018-8043"], "description": "The kernel meta package ", "modified": "2018-07-01T01:37:15", "published": "2018-07-01T01:37:15", "id": "FEDORA:909D360491BF", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 27 Update: kernel-4.17.3-100.fc27", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-12-21T08:17:54", "bulletinFamily": "unix", "cvelist": ["CVE-2017-1000405", "CVE-2017-12193", "CVE-2017-15115", "CVE-2017-16532", "CVE-2017-16538", "CVE-2017-16644", "CVE-2017-16647", "CVE-2017-16649", "CVE-2017-16650", "CVE-2017-17448", "CVE-2017-17449", "CVE-2017-17450", "CVE-2017-17558", "CVE-2017-17712", "CVE-2017-17741", "CVE-2017-17852", "CVE-2017-17853", "CVE-2017-17854", "CVE-2017-17855", "CVE-2017-17857", "CVE-2017-17862", "CVE-2017-17863", "CVE-2017-17864", "CVE-2017-18232", "CVE-2017-8824", "CVE-2018-1000004", "CVE-2018-1000026", "CVE-2018-10021", "CVE-2018-10322", "CVE-2018-10323", "CVE-2018-1065", "CVE-2018-10840", "CVE-2018-10853", "CVE-2018-1108", "CVE-2018-1120", "CVE-2018-11506", "CVE-2018-12232", "CVE-2018-3639", "CVE-2018-5332", "CVE-2018-5333", "CVE-2018-5344", "CVE-2018-5750", "CVE-2018-5803", "CVE-2018-7757", "CVE-2018-7995", "CVE-2018-8043"], "description": "The kernel meta package ", "modified": "2018-06-22T14:12:17", "published": "2018-06-22T14:12:17", "id": "FEDORA:10F7D6255145", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 27 Update: kernel-4.16.16-200.fc27", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}], "nessus": [{"lastseen": "2021-01-07T10:12:36", "description": "The 4.13.11 update contains a number of important fixes across the\ntree.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.", "edition": 19, "cvss3": {"score": 5.5, "vector": "AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}, "published": "2017-11-08T00:00:00", "title": "Fedora 26 : kernel (2017-9fbb35aeda)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-12193"], "modified": "2017-11-08T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:kernel", "cpe:/o:fedoraproject:fedora:26"], "id": "FEDORA_2017-9FBB35AEDA.NASL", "href": "https://www.tenable.com/plugins/nessus/104448", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory FEDORA-2017-9fbb35aeda.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(104448);\n script_version(\"3.7\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2017-12193\");\n script_xref(name:\"FEDORA\", value:\"2017-9fbb35aeda\");\n\n script_name(english:\"Fedora 26 : kernel (2017-9fbb35aeda)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The 4.13.11 update contains a number of important fixes across the\ntree.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bodhi.fedoraproject.org/updates/FEDORA-2017-9fbb35aeda\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected kernel package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:kernel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:26\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/11/22\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/11/07\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/11/08\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2017-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"linux_alt_patch_detect.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\ninclude(\"ksplice.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = pregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^26([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 26\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nif (get_one_kb_item(\"Host/ksplice/kernel-cves\"))\n{\n rm_kb_item(name:\"Host/uptrack-uname-r\");\n cve_list = make_list(\"CVE-2017-12193\");\n if (ksplice_cves_check(cve_list))\n {\n audit(AUDIT_PATCH_INSTALLED, \"KSplice hotfix for FEDORA-2017-9fbb35aeda\");\n }\n else\n {\n __rpm_report = ksplice_reporting_text();\n }\n}\n\nflag = 0;\nif (rpm_check(release:\"FC26\", reference:\"kernel-4.13.11-200.fc26\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kernel\");\n}\n", "cvss": {"score": 4.9, "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2021-01-06T09:13:17", "description": "According to the version of the vzkernel package and the\nreadykernel-patch installed, the Virtuozzo installation on the remote\nhost is affected by the following vulnerability :\n\n - A flaw was found in the implementation of associative\n arrays in the Linux kernel. A null pointer dereference\n could happen in assoc_array_apply_edit() due to\n incorrect node splitting.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Virtuozzo security advisory.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.", "edition": 33, "cvss3": {"score": 5.5, "vector": "AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}, "published": "2017-11-13T00:00:00", "title": "Virtuozzo 7 : readykernel-patch (VZA-2017-101)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-12193"], "modified": "2017-11-13T00:00:00", "cpe": ["cpe:/o:virtuozzo:virtuozzo:7", "p-cpe:/a:virtuozzo:virtuozzo:readykernel"], "id": "VIRTUOZZO_VZA-2017-101.NASL", "href": "https://www.tenable.com/plugins/nessus/104499", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(104499);\n script_version(\"3.9\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/04\");\n\n script_cve_id(\n \"CVE-2017-12193\"\n );\n\n script_name(english:\"Virtuozzo 7 : readykernel-patch (VZA-2017-101)\");\n script_summary(english:\"Checks the readykernel output for the updated patch.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Virtuozzo host is missing a security update.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the version of the vzkernel package and the\nreadykernel-patch installed, the Virtuozzo installation on the remote\nhost is affected by the following vulnerability :\n\n - A flaw was found in the implementation of associative\n arrays in the Linux kernel. A null pointer dereference\n could happen in assoc_array_apply_edit() due to\n incorrect node splitting.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Virtuozzo security advisory.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://help.virtuozzo.com/customer/portal/articles/2901381\");\n # https://readykernel.com/patch/Virtuozzo-7/readykernel-patch-15.2-37.1-1.vl7/\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?408ba87a\");\n # https://readykernel.com/patch/Virtuozzo-7/readykernel-patch-18.7-37.1-1.vl7/\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?e0521332\");\n # https://readykernel.com/patch/Virtuozzo-7/readykernel-patch-20.18-37.1-1.vl7/\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?5dcaf8d9\");\n # https://readykernel.com/patch/Virtuozzo-7/readykernel-patch-30.10-37.1-1.vl7/\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?c91b264e\");\n # https://readykernel.com/patch/Virtuozzo-7/readykernel-patch-30.15-37.1-1.vl7/\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?b40e0384\");\n script_set_attribute(attribute:\"solution\", value:\"Update the readykernel patch.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/11/10\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/11/13\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:virtuozzo:virtuozzo:readykernel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:virtuozzo:virtuozzo:7\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Virtuozzo Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2017-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Virtuozzo/release\", \"Host/Virtuozzo/rpm-list\", \"Host/readykernel-info\");\n\n exit(0);\n}\n\ninclude(\"global_settings.inc\");\ninclude(\"readykernel.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/Virtuozzo/release\");\nif (isnull(release) || \"Virtuozzo\" >!< release) audit(AUDIT_OS_NOT, \"Virtuozzo\");\nos_ver = pregmatch(pattern: \"Virtuozzo Linux release ([0-9]+\\.[0-9])(\\D|$)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Virtuozzo\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^7([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Virtuozzo 7.x\", \"Virtuozzo \" + os_ver);\n\nif (!get_kb_item(\"Host/Virtuozzo/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Virtuozzo\", cpu);\n\nrk_info = get_kb_item(\"Host/readykernel-info\");\nif (empty_or_null(rk_info)) audit(AUDIT_UNKNOWN_APP_VER, \"Virtuozzo\");\n\nchecks = make_list2(\n make_array(\n \"kernel\",\"vzkernel-3.10.0-327.18.2.vz7.15.2\",\n \"patch\",\"readykernel-patch-15.2-37.1-1.vl7\"\n ),\n make_array(\n \"kernel\",\"vzkernel-3.10.0-327.37.1.vz7.18.7\",\n \"patch\",\"readykernel-patch-18.7-37.1-1.vl7\"\n ),\n make_array(\n \"kernel\",\"vzkernel-3.10.0-327.37.1.vz7.20.18\",\n \"patch\",\"readykernel-patch-20.18-37.1-1.vl7\"\n ),\n make_array(\n \"kernel\",\"vzkernel-3.10.0-514.16.1.vz7.30.10\",\n \"patch\",\"readykernel-patch-30.10-37.1-1.vl7\"\n ),\n make_array(\n \"kernel\",\"vzkernel-3.10.0-514.16.1.vz7.30.15\",\n \"patch\",\"readykernel-patch-30.15-37.1-1.vl7\"\n )\n);\nreadykernel_execute_checks(checks:checks, severity:SECURITY_WARNING, release:\"Virtuozzo-7\");\n", "cvss": {"score": 4.9, "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2021-01-07T10:14:32", "description": "The 4.13.11 update contains a number of important fixes across the\ntree.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.", "edition": 17, "cvss3": {"score": 5.5, "vector": "AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}, "published": "2018-01-15T00:00:00", "title": "Fedora 27 : kernel (2017-ef58cbde27)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-12193"], "modified": "2018-01-15T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:kernel", "cpe:/o:fedoraproject:fedora:27"], "id": "FEDORA_2017-EF58CBDE27.NASL", "href": "https://www.tenable.com/plugins/nessus/105996", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory FEDORA-2017-ef58cbde27.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(105996);\n script_version(\"1.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2017-12193\");\n script_xref(name:\"FEDORA\", value:\"2017-ef58cbde27\");\n\n script_name(english:\"Fedora 27 : kernel (2017-ef58cbde27)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The 4.13.11 update contains a number of important fixes across the\ntree.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bodhi.fedoraproject.org/updates/FEDORA-2017-ef58cbde27\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected kernel package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:kernel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:27\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/11/22\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/11/11\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/01/15\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2018-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"linux_alt_patch_detect.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\ninclude(\"ksplice.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = pregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^27([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 27\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nif (get_one_kb_item(\"Host/ksplice/kernel-cves\"))\n{\n rm_kb_item(name:\"Host/uptrack-uname-r\");\n cve_list = make_list(\"CVE-2017-12193\");\n if (ksplice_cves_check(cve_list))\n {\n audit(AUDIT_PATCH_INSTALLED, \"KSplice hotfix for FEDORA-2017-ef58cbde27\");\n }\n else\n {\n __rpm_report = ksplice_reporting_text();\n }\n}\n\nflag = 0;\nif (rpm_check(release:\"FC27\", reference:\"kernel-4.13.11-300.fc27\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kernel\");\n}\n", "cvss": {"score": 4.9, "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2021-01-06T09:13:17", "description": "According to the version of the vzkernel package and the\nreadykernel-patch installed, the Virtuozzo installation on the remote\nhost is affected by the following vulnerability :\n\n - A flaw was found in the implementation of associative\n arrays in the Linux kernel. A null pointer dereference\n could happen in assoc_array_apply_edit() due to\n incorrect node splitting.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Virtuozzo security advisory.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.", "edition": 33, "cvss3": {"score": 5.5, "vector": "AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}, "published": "2017-11-13T00:00:00", "title": "Virtuozzo 7 : readykernel-patch (VZA-2017-102)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-12193"], "modified": "2017-11-13T00:00:00", "cpe": ["cpe:/o:virtuozzo:virtuozzo:7", "p-cpe:/a:virtuozzo:virtuozzo:readykernel"], "id": "VIRTUOZZO_VZA-2017-102.NASL", "href": "https://www.tenable.com/plugins/nessus/104500", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(104500);\n script_version(\"3.9\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/04\");\n\n script_cve_id(\n \"CVE-2017-12193\"\n );\n\n script_name(english:\"Virtuozzo 7 : readykernel-patch (VZA-2017-102)\");\n script_summary(english:\"Checks the readykernel output for the updated patch.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Virtuozzo host is missing a security update.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the version of the vzkernel package and the\nreadykernel-patch installed, the Virtuozzo installation on the remote\nhost is affected by the following vulnerability :\n\n - A flaw was found in the implementation of associative\n arrays in the Linux kernel. A null pointer dereference\n could happen in assoc_array_apply_edit() due to\n incorrect node splitting.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Virtuozzo security advisory.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://help.virtuozzo.com/customer/portal/articles/2901382\");\n # https://readykernel.com/patch/Virtuozzo-7/readykernel-patch-33.22-37.1-1.vl7/\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?efc7da2a\");\n script_set_attribute(attribute:\"solution\", value:\"Update the readykernel patch.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/11/10\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/11/13\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:virtuozzo:virtuozzo:readykernel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:virtuozzo:virtuozzo:7\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Virtuozzo Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2017-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Virtuozzo/release\", \"Host/Virtuozzo/rpm-list\", \"Host/readykernel-info\");\n\n exit(0);\n}\n\ninclude(\"global_settings.inc\");\ninclude(\"readykernel.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/Virtuozzo/release\");\nif (isnull(release) || \"Virtuozzo\" >!< release) audit(AUDIT_OS_NOT, \"Virtuozzo\");\nos_ver = pregmatch(pattern: \"Virtuozzo Linux release ([0-9]+\\.[0-9])(\\D|$)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Virtuozzo\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^7([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Virtuozzo 7.x\", \"Virtuozzo \" + os_ver);\n\nif (!get_kb_item(\"Host/Virtuozzo/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Virtuozzo\", cpu);\n\nrk_info = get_kb_item(\"Host/readykernel-info\");\nif (empty_or_null(rk_info)) audit(AUDIT_UNKNOWN_APP_VER, \"Virtuozzo\");\n\nchecks = make_list2(\n make_array(\n \"kernel\",\"vzkernel-3.10.0-514.26.1.vz7.33.22\",\n \"patch\",\"readykernel-patch-33.22-37.1-1.vl7\"\n )\n);\nreadykernel_execute_checks(checks:checks, severity:SECURITY_WARNING, release:\"Virtuozzo-7\");\n", "cvss": {"score": 4.9, "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2021-01-12T10:15:53", "description": "The 4.13.11 update contains a number of important fixes across the\ntree.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.", "edition": 19, "cvss3": {"score": 5.5, "vector": "AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}, "published": "2017-11-08T00:00:00", "title": "Fedora 25 : kernel (2017-38b37120a2)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-12193"], "modified": "2017-11-08T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:kernel", "cpe:/o:fedoraproject:fedora:25"], "id": "FEDORA_2017-38B37120A2.NASL", "href": "https://www.tenable.com/plugins/nessus/104444", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory FEDORA-2017-38b37120a2.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(104444);\n script_version(\"3.7\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2017-12193\");\n script_xref(name:\"FEDORA\", value:\"2017-38b37120a2\");\n\n script_name(english:\"Fedora 25 : kernel (2017-38b37120a2)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The 4.13.11 update contains a number of important fixes across the\ntree.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bodhi.fedoraproject.org/updates/FEDORA-2017-38b37120a2\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected kernel package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:kernel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:25\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/11/22\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/11/07\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/11/08\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2017-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"linux_alt_patch_detect.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\ninclude(\"ksplice.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = pregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^25([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 25\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nif (get_one_kb_item(\"Host/ksplice/kernel-cves\"))\n{\n rm_kb_item(name:\"Host/uptrack-uname-r\");\n cve_list = make_list(\"CVE-2017-12193\");\n if (ksplice_cves_check(cve_list))\n {\n audit(AUDIT_PATCH_INSTALLED, \"KSplice hotfix for FEDORA-2017-38b37120a2\");\n }\n else\n {\n __rpm_report = ksplice_reporting_text();\n }\n}\n\nflag = 0;\nif (rpm_check(release:\"FC25\", reference:\"kernel-4.13.11-100.fc25\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kernel\");\n}\n", "cvss": {"score": 4.9, "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2020-09-09T05:39:00", "description": "USN-3509-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04\nLTS. This update provides the corresponding updates for the Linux\nHardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu\n14.04 LTS.\n\nMohamed Ghannam discovered that a use-after-free vulnerability existed\nin the Netlink subsystem (XFRM) in the Linux kernel. A local attacker\ncould use this to cause a denial of service (system crash) or possibly\nexecute arbitrary code. (CVE-2017-16939)\n\nIt was discovered that the Linux kernel did not properly handle\ncopy-on- write of transparent huge pages. A local attacker could use\nthis to cause a denial of service (application crashes) or possibly\ngain administrative privileges. (CVE-2017-1000405)\n\nFan Wu, Haoran Qiu, and Shixiong Zhao discovered that the associative\narray implementation in the Linux kernel sometimes did not properly\nhandle adding a new entry. A local attacker could use this to cause a\ndenial of service (system crash). (CVE-2017-12193)\n\nAndrey Konovalov discovered an out-of-bounds read in the GTCO\ndigitizer USB driver for the Linux kernel. A physically proximate\nattacker could use this to cause a denial of service (system crash) or\npossibly execute arbitrary code. (CVE-2017-16643).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 22, "cvss3": {"score": 7.8, "vector": "AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "published": "2017-12-08T00:00:00", "title": "Ubuntu 14.04 LTS : linux-lts-xenial, linux-aws vulnerabilities (USN-3509-2) (Dirty COW)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-12193", "CVE-2017-16939", "CVE-2017-16643", "CVE-2017-1000405"], "modified": "2017-12-08T00:00:00", "cpe": ["p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-aws", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-lowlatency", "p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lpae-lts-xenial", "p-cpe:/a:canonical:ubuntu_linux:linux-image-lowlatency-lts-xenial", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-generic-lpae", "p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lts-xenial", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-generic", "p-cpe:/a:canonical:ubuntu_linux:linux-image-aws", "cpe:/o:canonical:ubuntu_linux:14.04"], "id": "UBUNTU_USN-3509-2.NASL", "href": "https://www.tenable.com/plugins/nessus/105105", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-3509-2. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(105105);\n script_version(\"3.9\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/09/04\");\n\n script_cve_id(\"CVE-2017-1000405\", \"CVE-2017-12193\", \"CVE-2017-16643\", \"CVE-2017-16939\");\n script_xref(name:\"USN\", value:\"3509-2\");\n\n script_name(english:\"Ubuntu 14.04 LTS : linux-lts-xenial, linux-aws vulnerabilities (USN-3509-2) (Dirty COW)\");\n script_summary(english:\"Checks dpkg output for updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\n\"The remote Ubuntu host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"USN-3509-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04\nLTS. This update provides the corresponding updates for the Linux\nHardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu\n14.04 LTS.\n\nMohamed Ghannam discovered that a use-after-free vulnerability existed\nin the Netlink subsystem (XFRM) in the Linux kernel. A local attacker\ncould use this to cause a denial of service (system crash) or possibly\nexecute arbitrary code. (CVE-2017-16939)\n\nIt was discovered that the Linux kernel did not properly handle\ncopy-on- write of transparent huge pages. A local attacker could use\nthis to cause a denial of service (application crashes) or possibly\ngain administrative privileges. (CVE-2017-1000405)\n\nFan Wu, Haoran Qiu, and Shixiong Zhao discovered that the associative\narray implementation in the Linux kernel sometimes did not properly\nhandle adding a new entry. A local attacker could use this to cause a\ndenial of service (system crash). (CVE-2017-12193)\n\nAndrey Konovalov discovered an out-of-bounds read in the GTCO\ndigitizer USB driver for the Linux kernel. A physically proximate\nattacker could use this to cause a denial of service (system crash) or\npossibly execute arbitrary code. (CVE-2017-16643).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://usn.ubuntu.com/3509-2/\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-aws\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-generic\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-generic-lpae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-lowlatency\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-aws\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lpae-lts-xenial\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lts-xenial\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-lowlatency-lts-xenial\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:14.04\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/11/07\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/12/07\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/12/08\");\n script_set_attribute(attribute:\"in_the_news\", value:\"true\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"Ubuntu Security Notice (C) 2017-2020 Canonical, Inc. / NASL script (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"linux_alt_patch_detect.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"ubuntu.inc\");\ninclude(\"ksplice.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/Ubuntu/release\");\nif ( isnull(release) ) audit(AUDIT_OS_NOT, \"Ubuntu\");\nrelease = chomp(release);\nif (! preg(pattern:\"^(14\\.04)$\", string:release)) audit(AUDIT_OS_NOT, \"Ubuntu 14.04\", \"Ubuntu \" + release);\nif ( ! get_kb_item(\"Host/Debian/dpkg-l\") ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Ubuntu\", cpu);\n\nif (get_one_kb_item(\"Host/ksplice/kernel-cves\"))\n{\n rm_kb_item(name:\"Host/uptrack-uname-r\");\n cve_list = make_list(\"CVE-2017-1000405\", \"CVE-2017-12193\", \"CVE-2017-16643\", \"CVE-2017-16939\");\n if (ksplice_cves_check(cve_list))\n {\n audit(AUDIT_PATCH_INSTALLED, \"KSplice hotfix for USN-3509-2\");\n }\n else\n {\n _ubuntu_report = ksplice_reporting_text();\n }\n}\n\nflag = 0;\n\nif (ubuntu_check(osver:\"14.04\", pkgname:\"linux-image-4.4.0-1005-aws\", pkgver:\"4.4.0-1005.5\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"linux-image-4.4.0-103-generic\", pkgver:\"4.4.0-103.126~14.04.1\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"linux-image-4.4.0-103-generic-lpae\", pkgver:\"4.4.0-103.126~14.04.1\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"linux-image-4.4.0-103-lowlatency\", pkgver:\"4.4.0-103.126~14.04.1\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"linux-image-aws\", pkgver:\"4.4.0.1005.5\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"linux-image-generic-lpae-lts-xenial\", pkgver:\"4.4.0.103.86\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"linux-image-generic-lts-xenial\", pkgver:\"4.4.0.103.86\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"linux-image-lowlatency-lts-xenial\", pkgver:\"4.4.0.103.86\")) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"linux-image-4.4-aws / linux-image-4.4-generic / etc\");\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-09-09T05:39:02", "description": "USN-3509-2 fixed vulnerabilities in the Linux Hardware Enablement\nkernel for Ubuntu 14.04 LTS. Unfortunately, it also introduced a\nregression that prevented the Ceph network filesystem from being used.\nThis update fixes the problem.\n\nWe apologize for the inconvenience.\n\nMohamed Ghannam discovered that a use-after-free vulnerability existed\nin the Netlink subsystem (XFRM) in the Linux kernel. A local attacker\ncould use this to cause a denial of service (system crash) or possibly\nexecute arbitrary code. (CVE-2017-16939)\n\nIt was discovered that the Linux kernel did not properly\nhandle copy-on- write of transparent huge pages. A local\nattacker could use this to cause a denial of service\n(application crashes) or possibly gain administrative\nprivileges. (CVE-2017-1000405)\n\nFan Wu, Haoran Qiu, and Shixiong Zhao discovered that the\nassociative array implementation in the Linux kernel\nsometimes did not properly handle adding a new entry. A\nlocal attacker could use this to cause a denial of service\n(system crash). (CVE-2017-12193)\n\nAndrey Konovalov discovered an out-of-bounds read in the\nGTCO digitizer USB driver for the Linux kernel. A physically\nproximate attacker could use this to cause a denial of\nservice (system crash) or possibly execute arbitrary code.\n(CVE-2017-16643).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 21, "cvss3": {"score": 7.8, "vector": "AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "published": "2017-12-18T00:00:00", "title": "Ubuntu 14.04 LTS : linux-lts-xenial, linux-aws regression (USN-3509-4) (Dirty COW)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-12193", "CVE-2017-16939", "CVE-2017-16643", "CVE-2017-1000405"], "modified": "2017-12-18T00:00:00", "cpe": ["p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-aws", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-lowlatency", "p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lpae-lts-xenial", "p-cpe:/a:canonical:ubuntu_linux:linux-image-lowlatency-lts-xenial", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-generic-lpae", "p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lts-xenial", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-generic", "p-cpe:/a:canonical:ubuntu_linux:linux-image-aws", "cpe:/o:canonical:ubuntu_linux:14.04"], "id": "UBUNTU_USN-3509-4.NASL", "href": "https://www.tenable.com/plugins/nessus/105355", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-3509-4. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(105355);\n script_version(\"3.8\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/09/04\");\n\n script_cve_id(\"CVE-2017-1000405\", \"CVE-2017-12193\", \"CVE-2017-16643\", \"CVE-2017-16939\");\n script_xref(name:\"USN\", value:\"3509-4\");\n\n script_name(english:\"Ubuntu 14.04 LTS : linux-lts-xenial, linux-aws regression (USN-3509-4) (Dirty COW)\");\n script_summary(english:\"Checks dpkg output for updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\n\"The remote Ubuntu host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"USN-3509-2 fixed vulnerabilities in the Linux Hardware Enablement\nkernel for Ubuntu 14.04 LTS. Unfortunately, it also introduced a\nregression that prevented the Ceph network filesystem from being used.\nThis update fixes the problem.\n\nWe apologize for the inconvenience.\n\nMohamed Ghannam discovered that a use-after-free vulnerability existed\nin the Netlink subsystem (XFRM) in the Linux kernel. A local attacker\ncould use this to cause a denial of service (system crash) or possibly\nexecute arbitrary code. (CVE-2017-16939)\n\nIt was discovered that the Linux kernel did not properly\nhandle copy-on- write of transparent huge pages. A local\nattacker could use this to cause a denial of service\n(application crashes) or possibly gain administrative\nprivileges. (CVE-2017-1000405)\n\nFan Wu, Haoran Qiu, and Shixiong Zhao discovered that the\nassociative array implementation in the Linux kernel\nsometimes did not properly handle adding a new entry. A\nlocal attacker could use this to cause a denial of service\n(system crash). (CVE-2017-12193)\n\nAndrey Konovalov discovered an out-of-bounds read in the\nGTCO digitizer USB driver for the Linux kernel. A physically\nproximate attacker could use this to cause a denial of\nservice (system crash) or possibly execute arbitrary code.\n(CVE-2017-16643).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://usn.ubuntu.com/3509-4/\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-aws\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-generic\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-generic-lpae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-lowlatency\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-aws\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lpae-lts-xenial\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lts-xenial\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-lowlatency-lts-xenial\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:14.04\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/11/07\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/12/15\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/12/18\");\n script_set_attribute(attribute:\"in_the_news\", value:\"true\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"Ubuntu Security Notice (C) 2017-2020 Canonical, Inc. / NASL script (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"linux_alt_patch_detect.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"ubuntu.inc\");\ninclude(\"ksplice.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/Ubuntu/release\");\nif ( isnull(release) ) audit(AUDIT_OS_NOT, \"Ubuntu\");\nrelease = chomp(release);\nif (! preg(pattern:\"^(14\\.04)$\", string:release)) audit(AUDIT_OS_NOT, \"Ubuntu 14.04\", \"Ubuntu \" + release);\nif ( ! get_kb_item(\"Host/Debian/dpkg-l\") ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Ubuntu\", cpu);\n\nif (get_one_kb_item(\"Host/ksplice/kernel-cves\"))\n{\n rm_kb_item(name:\"Host/uptrack-uname-r\");\n cve_list = make_list(\"CVE-2017-1000405\", \"CVE-2017-12193\", \"CVE-2017-16643\", \"CVE-2017-16939\");\n if (ksplice_cves_check(cve_list))\n {\n audit(AUDIT_PATCH_INSTALLED, \"KSplice hotfix for USN-3509-4\");\n }\n else\n {\n _ubuntu_report = ksplice_reporting_text();\n }\n}\n\nflag = 0;\n\nif (ubuntu_check(osver:\"14.04\", pkgname:\"linux-image-4.4.0-1006-aws\", pkgver:\"4.4.0-1006.6\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"linux-image-4.4.0-104-generic\", pkgver:\"4.4.0-104.127~14.04.1\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"linux-image-4.4.0-104-generic-lpae\", pkgver:\"4.4.0-104.127~14.04.1\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"linux-image-4.4.0-104-lowlatency\", pkgver:\"4.4.0-104.127~14.04.1\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"linux-image-aws\", pkgver:\"4.4.0.1006.6\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"linux-image-generic-lpae-lts-xenial\", pkgver:\"4.4.0.104.87\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"linux-image-generic-lts-xenial\", pkgver:\"4.4.0.104.87\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"linux-image-lowlatency-lts-xenial\", pkgver:\"4.4.0.104.87\")) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"linux-image-4.4-aws / linux-image-4.4-generic / etc\");\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-09-09T05:39:00", "description": "Mohamed Ghannam discovered that a use-after-free vulnerability existed\nin the Netlink subsystem (XFRM) in the Linux kernel. A local attacker\ncould use this to cause a denial of service (system crash) or possibly\nexecute arbitrary code. (CVE-2017-16939)\n\nIt was discovered that the Linux kernel did not properly handle\ncopy-on- write of transparent huge pages. A local attacker could use\nthis to cause a denial of service (application crashes) or possibly\ngain administrative privileges. (CVE-2017-1000405)\n\nFan Wu, Haoran Qiu, and Shixiong Zhao discovered that the associative\narray implementation in the Linux kernel sometimes did not properly\nhandle adding a new entry. A local attacker could use this to cause a\ndenial of service (system crash). (CVE-2017-12193)\n\nAndrey Konovalov discovered an out-of-bounds read in the GTCO\ndigitizer USB driver for the Linux kernel. A physically proximate\nattacker could use this to cause a denial of service (system crash) or\npossibly execute arbitrary code. (CVE-2017-16643).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 23, "cvss3": {"score": 7.8, "vector": "AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "published": "2017-12-08T00:00:00", "title": "Ubuntu 16.04 LTS : linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities (USN-3509-1) (Dirty COW)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-12193", "CVE-2017-16939", "CVE-2017-16643", "CVE-2017-1000405"], "modified": "2017-12-08T00:00:00", "cpe": ["p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-kvm", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-aws", "p-cpe:/a:canonical:ubuntu_linux:linux-image-kvm", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-lowlatency", "p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lpae", "p-cpe:/a:canonical:ubuntu_linux:linux-image-raspi2", "cpe:/o:canonical:ubuntu_linux:16.04", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-generic-lpae", "p-cpe:/a:canonical:ubuntu_linux:linux-image-snapdragon", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-raspi2", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-snapdragon", "p-cpe:/a:canonical:ubuntu_linux:linux-image-lowlatency", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-generic", "p-cpe:/a:canonical:ubuntu_linux:linux-image-aws", "p-cpe:/a:canonical:ubuntu_linux:linux-image-generic"], "id": "UBUNTU_USN-3509-1.NASL", "href": "https://www.tenable.com/plugins/nessus/105104", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-3509-1. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(105104);\n script_version(\"3.10\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/09/04\");\n\n script_cve_id(\"CVE-2017-1000405\", \"CVE-2017-12193\", \"CVE-2017-16643\", \"CVE-2017-16939\");\n script_xref(name:\"USN\", value:\"3509-1\");\n\n script_name(english:\"Ubuntu 16.04 LTS : linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities (USN-3509-1) (Dirty COW)\");\n script_summary(english:\"Checks dpkg output for updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\n\"The remote Ubuntu host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"Mohamed Ghannam discovered that a use-after-free vulnerability existed\nin the Netlink subsystem (XFRM) in the Linux kernel. A local attacker\ncould use this to cause a denial of service (system crash) or possibly\nexecute arbitrary code. (CVE-2017-16939)\n\nIt was discovered that the Linux kernel did not properly handle\ncopy-on- write of transparent huge pages. A local attacker could use\nthis to cause a denial of service (application crashes) or possibly\ngain administrative privileges. (CVE-2017-1000405)\n\nFan Wu, Haoran Qiu, and Shixiong Zhao discovered that the associative\narray implementation in the Linux kernel sometimes did not properly\nhandle adding a new entry. A local attacker could use this to cause a\ndenial of service (system crash). (CVE-2017-12193)\n\nAndrey Konovalov discovered an out-of-bounds read in the GTCO\ndigitizer USB driver for the Linux kernel. A physically proximate\nattacker could use this to cause a denial of service (system crash) or\npossibly execute arbitrary code. (CVE-2017-16643).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://usn.ubuntu.com/3509-1/\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-aws\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-generic\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-generic-lpae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-kvm\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-lowlatency\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-raspi2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-snapdragon\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-aws\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-generic\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lpae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-kvm\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-lowlatency\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-raspi2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-snapdragon\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:16.04\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/11/07\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/12/07\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/12/08\");\n script_set_attribute(attribute:\"in_the_news\", value:\"true\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"Ubuntu Security Notice (C) 2017-2020 Canonical, Inc. / NASL script (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"linux_alt_patch_detect.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"ubuntu.inc\");\ninclude(\"ksplice.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/Ubuntu/release\");\nif ( isnull(release) ) audit(AUDIT_OS_NOT, \"Ubuntu\");\nrelease = chomp(release);\nif (! preg(pattern:\"^(16\\.04)$\", string:release)) audit(AUDIT_OS_NOT, \"Ubuntu 16.04\", \"Ubuntu \" + release);\nif ( ! get_kb_item(\"Host/Debian/dpkg-l\") ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Ubuntu\", cpu);\n\nif (get_one_kb_item(\"Host/ksplice/kernel-cves\"))\n{\n rm_kb_item(name:\"Host/uptrack-uname-r\");\n cve_list = make_list(\"CVE-2017-1000405\", \"CVE-2017-12193\", \"CVE-2017-16643\", \"CVE-2017-16939\");\n if (ksplice_cves_check(cve_list))\n {\n audit(AUDIT_PATCH_INSTALLED, \"KSplice hotfix for USN-3509-1\");\n }\n else\n {\n _ubuntu_report = ksplice_reporting_text();\n }\n}\n\nflag = 0;\n\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.4.0-1012-kvm\", pkgver:\"4.4.0-1012.17\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.4.0-103-generic\", pkgver:\"4.4.0-103.126\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.4.0-103-generic-lpae\", pkgver:\"4.4.0-103.126\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.4.0-103-lowlatency\", pkgver:\"4.4.0-103.126\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.4.0-1043-aws\", pkgver:\"4.4.0-1043.52\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.4.0-1079-raspi2\", pkgver:\"4.4.0-1079.87\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.4.0-1081-snapdragon\", pkgver:\"4.4.0-1081.86\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-aws\", pkgver:\"4.4.0.1043.45\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-generic\", pkgver:\"4.4.0.103.108\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-generic-lpae\", pkgver:\"4.4.0.103.108\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-kvm\", pkgver:\"4.4.0.1012.12\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-lowlatency\", pkgver:\"4.4.0.103.108\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-raspi2\", pkgver:\"4.4.0.1079.79\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-snapdragon\", pkgver:\"4.4.0.1081.73\")) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"linux-image-4.4-aws / linux-image-4.4-generic / etc\");\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-09-09T05:39:02", "description": "USN-3509-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04\nLTS. Unfortunately, it also introduced a regression that prevented the\nCeph network filesystem from being used. This update fixes the\nproblem.\n\nWe apologize for the inconvenience.\n\nMohamed Ghannam discovered that a use-after-free vulnerability existed\nin the Netlink subsystem (XFRM) in the Linux kernel. A local attacker\ncould use this to cause a denial of service (system crash) or possibly\nexecute arbitrary code. (CVE-2017-16939)\n\nIt was discovered that the Linux kernel did not properly\nhandle copy-on- write of transparent huge pages. A local\nattacker could use this to cause a denial of service\n(application crashes) or possibly gain administrative\nprivileges. (CVE-2017-1000405)\n\nFan Wu, Haoran Qiu, and Shixiong Zhao discovered that the\nassociative array implementation in the Linux kernel\nsometimes did not properly handle adding a new entry. A\nlocal attacker could use this to cause a denial of service\n(system crash). (CVE-2017-12193)\n\nAndrey Konovalov discovered an out-of-bounds read in the\nGTCO digitizer USB driver for the Linux kernel. A physically\nproximate attacker could use this to cause a denial of\nservice (system crash) or possibly execute arbitrary code.\n(CVE-2017-16643).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 21, "cvss3": {"score": 7.8, "vector": "AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "published": "2017-12-18T00:00:00", "title": "Ubuntu 16.04 LTS : linux, linux-aws, linux-kvm, linux-raspi2 regression (USN-3509-3) (Dirty COW)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-12193", "CVE-2017-16939", "CVE-2017-16643", "CVE-2017-1000405"], "modified": "2017-12-18T00:00:00", "cpe": ["p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-kvm", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-aws", "p-cpe:/a:canonical:ubuntu_linux:linux-image-kvm", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-lowlatency", "p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lpae", "p-cpe:/a:canonical:ubuntu_linux:linux-image-raspi2", "cpe:/o:canonical:ubuntu_linux:16.04", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-generic-lpae", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-raspi2", "p-cpe:/a:canonical:ubuntu_linux:linux-image-lowlatency", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-generic", "p-cpe:/a:canonical:ubuntu_linux:linux-image-aws", "p-cpe:/a:canonical:ubuntu_linux:linux-image-generic"], "id": "UBUNTU_USN-3509-3.NASL", "href": "https://www.tenable.com/plugins/nessus/105354", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-3509-3. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(105354);\n script_version(\"3.8\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/09/04\");\n\n script_cve_id(\"CVE-2017-1000405\", \"CVE-2017-12193\", \"CVE-2017-16643\", \"CVE-2017-16939\");\n script_xref(name:\"USN\", value:\"3509-3\");\n\n script_name(english:\"Ubuntu 16.04 LTS : linux, linux-aws, linux-kvm, linux-raspi2 regression (USN-3509-3) (Dirty COW)\");\n script_summary(english:\"Checks dpkg output for updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\n\"The remote Ubuntu host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"USN-3509-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04\nLTS. Unfortunately, it also introduced a regression that prevented the\nCeph network filesystem from being used. This update fixes the\nproblem.\n\nWe apologize for the inconvenience.\n\nMohamed Ghannam discovered that a use-after-free vulnerability existed\nin the Netlink subsystem (XFRM) in the Linux kernel. A local attacker\ncould use this to cause a denial of service (system crash) or possibly\nexecute arbitrary code. (CVE-2017-16939)\n\nIt was discovered that the Linux kernel did not properly\nhandle copy-on- write of transparent huge pages. A local\nattacker could use this to cause a denial of service\n(application crashes) or possibly gain administrative\nprivileges. (CVE-2017-1000405)\n\nFan Wu, Haoran Qiu, and Shixiong Zhao discovered that the\nassociative array implementation in the Linux kernel\nsometimes did not properly handle adding a new entry. A\nlocal attacker could use this to cause a denial of service\n(system crash). (CVE-2017-12193)\n\nAndrey Konovalov discovered an out-of-bounds read in the\nGTCO digitizer USB driver for the Linux kernel. A physically\nproximate attacker could use this to cause a denial of\nservice (system crash) or possibly execute arbitrary code.\n(CVE-2017-16643).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://usn.ubuntu.com/3509-3/\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-aws\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-generic\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-generic-lpae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-kvm\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-lowlatency\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-raspi2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-aws\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-generic\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lpae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-kvm\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-lowlatency\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-raspi2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:16.04\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/11/07\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/12/15\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/12/18\");\n script_set_attribute(attribute:\"in_the_news\", value:\"true\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"Ubuntu Security Notice (C) 2017-2020 Canonical, Inc. / NASL script (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"linux_alt_patch_detect.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"ubuntu.inc\");\ninclude(\"ksplice.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/Ubuntu/release\");\nif ( isnull(release) ) audit(AUDIT_OS_NOT, \"Ubuntu\");\nrelease = chomp(release);\nif (! preg(pattern:\"^(16\\.04)$\", string:release)) audit(AUDIT_OS_NOT, \"Ubuntu 16.04\", \"Ubuntu \" + release);\nif ( ! get_kb_item(\"Host/Debian/dpkg-l\") ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Ubuntu\", cpu);\n\nif (get_one_kb_item(\"Host/ksplice/kernel-cves\"))\n{\n rm_kb_item(name:\"Host/uptrack-uname-r\");\n cve_list = make_list(\"CVE-2017-1000405\", \"CVE-2017-12193\", \"CVE-2017-16643\", \"CVE-2017-16939\");\n if (ksplice_cves_check(cve_list))\n {\n audit(AUDIT_PATCH_INSTALLED, \"KSplice hotfix for USN-3509-3\");\n }\n else\n {\n _ubuntu_report = ksplice_reporting_text();\n }\n}\n\nflag = 0;\n\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.4.0-1013-kvm\", pkgver:\"4.4.0-1013.18\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.4.0-104-generic\", pkgver:\"4.4.0-104.127\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.4.0-104-generic-lpae\", pkgver:\"4.4.0-104.127\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.4.0-104-lowlatency\", pkgver:\"4.4.0-104.127\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.4.0-1044-aws\", pkgver:\"4.4.0-1044.53\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.4.0-1080-raspi2\", pkgver:\"4.4.0-1080.88\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-aws\", pkgver:\"4.4.0.1044.46\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-generic\", pkgver:\"4.4.0.104.109\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-generic-lpae\", pkgver:\"4.4.0.104.109\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-kvm\", pkgver:\"4.4.0.1013.13\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-lowlatency\", pkgver:\"4.4.0.104.109\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-raspi2\", pkgver:\"4.4.0.1080.80\")) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"linux-image-4.4-aws / linux-image-4.4-generic / etc\");\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-01-07T08:52:47", "description": "According to the versions of the kernel packages installed, the\nEulerOS installation on the remote host is affected by the following\nvulnerabilities :\n\n - A flaw was found in the processing of incoming L2CAP\n bluetooth commands. Uninitialized stack variables can\n be sent to an attacker leaking data in kernel address\n space.(CVE-2017-1000410)\n\n - The assoc_array_insert_into_terminal_node function in\n lib/assoc_array.c in the Linux kernel before 4.13.11\n mishandles node splitting, which allows local users to\n cause a denial of service (NULL pointer dereference and\n panic) via a crafted application, as demonstrated by\n the keyring key type, and key addition and link\n creation operations.(CVE-2017-12193)\n\n - The bio_map_user_iov and bio_unmap_user functions in\n block/bio.c in the Linux kernel before 4.13.8 do\n unbalanced refcounting when a SCSI I/O vector has small\n consecutive buffers belonging to the same page. The\n bio_add_pc_page function merges them into one, but the\n page reference is never dropped. This causes a memory\n leak and possible system lockup (exploitable against\n the host OS by a guest OS user, if a SCSI disk is\n passed through to a virtual machine) due to an\n out-of-memory condition.(CVE-2017-12190)\n\n - The tower_probe function in\n drivers/usb/misc/legousbtower.c in the Linux kernel\n before 4.8.1 allows local users (who are physically\n proximate for inserting a crafted USB device) to gain\n privileges by leveraging a write-what-where condition\n that occurs after a race condition and a NULL pointer\n dereference.(CVE-2017-15102)\n\n - The sctp_do_peeloff function in net/sctp/socket.c in\n the Linux kernel before 4.14 does not check whether the\n intended netns is used in a peel-off action, which\n allows local users to cause a denial of service\n (use-after-free and system crash) or possibly have\n unspecified other impact via crafted system\n calls.(CVE-2017-15115)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 24, "cvss3": {"score": 7.8, "vector": "AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "published": "2017-12-07T00:00:00", "title": "EulerOS 2.0 SP1 : kernel (EulerOS-SA-2017-1318)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-12193", "CVE-2017-15115", "CVE-2017-15102", "CVE-2017-1000410", "CVE-2017-12190"], "modified": "2017-12-07T00:00:00", "cpe": ["p-cpe:/a:huawei:euleros:kernel-tools", "p-cpe:/a:huawei:euleros:kernel", "p-cpe:/a:huawei:euleros:perf", "p-cpe:/a:huawei:euleros:kernel-headers", "p-cpe:/a:huawei:euleros:kernel-debuginfo-common-x86_64", "p-cpe:/a:huawei:euleros:kernel-devel", "p-cpe:/a:huawei:euleros:kernel-debug", "p-cpe:/a:huawei:euleros:python-perf", "p-cpe:/a:huawei:euleros:kernel-tools-libs", "p-cpe:/a:huawei:euleros:kernel-debuginfo", "cpe:/o:huawei:euleros:2.0"], "id": "EULEROS_SA-2017-1318.NASL", "href": "https://www.tenable.com/plugins/nessus/105046", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(105046);\n script_version(\"3.14\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\n \"CVE-2017-1000410\",\n \"CVE-2017-12190\",\n \"CVE-2017-12193\",\n \"CVE-2017-15102\",\n \"CVE-2017-15115\"\n );\n\n script_name(english:\"EulerOS 2.0 SP1 : kernel (EulerOS-SA-2017-1318)\");\n script_summary(english:\"Checks the rpm output for the updated packages.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote EulerOS host is missing multiple security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the versions of the kernel packages installed, the\nEulerOS installation on the remote host is affected by the following\nvulnerabilities :\n\n - A flaw was found in the processing of incoming L2CAP\n bluetooth commands. Uninitialized stack variables can\n be sent to an attacker leaking data in kernel address\n space.(CVE-2017-1000410)\n\n - The assoc_array_insert_into_terminal_node function in\n lib/assoc_array.c in the Linux kernel before 4.13.11\n mishandles node splitting, which allows local users to\n cause a denial of service (NULL pointer dereference and\n panic) via a crafted application, as demonstrated by\n the keyring key type, and key addition and link\n creation operations.(CVE-2017-12193)\n\n - The bio_map_user_iov and bio_unmap_user functions in\n block/bio.c in the Linux kernel before 4.13.8 do\n unbalanced refcounting when a SCSI I/O vector has small\n consecutive buffers belonging to the same page. The\n bio_add_pc_page function merges them into one, but the\n page reference is never dropped. This causes a memory\n leak and possible system lockup (exploitable against\n the host OS by a guest OS user, if a SCSI disk is\n passed through to a virtual machine) due to an\n out-of-memory condition.(CVE-2017-12190)\n\n - The tower_probe function in\n drivers/usb/misc/legousbtower.c in the Linux kernel\n before 4.8.1 allows local users (who are physically\n proximate for inserting a crafted USB device) to gain\n privileges by leveraging a write-what-where condition\n that occurs after a race condition and a NULL pointer\n dereference.(CVE-2017-15102)\n\n - The sctp_do_peeloff function in net/sctp/socket.c in\n the Linux kernel before 4.14 does not check whether the\n intended netns is used in a peel-off action, which\n allows local users to cause a denial of service\n (use-after-free and system crash) or possibly have\n unspecified other impact via crafted system\n calls.(CVE-2017-15115)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2017-1318\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?e1964858\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected kernel packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/12/07\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/12/07\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-debug\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-debuginfo-common-x86_64\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-headers\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-tools-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:perf\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:python-perf\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:huawei:euleros:2.0\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Huawei Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2017-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/EulerOS/release\", \"Host/EulerOS/rpm-list\", \"Host/EulerOS/sp\");\n script_exclude_keys(\"Host/EulerOS/uvp_version\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/EulerOS/release\");\nif (isnull(release) || release !~ \"^EulerOS\") audit(AUDIT_OS_NOT, \"EulerOS\");\nif (release !~ \"^EulerOS release 2\\.0(\\D|$)\") audit(AUDIT_OS_NOT, \"EulerOS 2.0\");\n\nsp = get_kb_item(\"Host/EulerOS/sp\");\nif (isnull(sp) || sp !~ \"^(1)$\") audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP1\");\n\nuvp = get_kb_item(\"Host/EulerOS/uvp_version\");\nif (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP1\", \"EulerOS UVP \" + uvp);\n\nif (!get_kb_item(\"Host/EulerOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"aarch64\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"EulerOS\", cpu);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_ARCH_NOT, \"i686 / x86_64\", cpu);\n\nflag = 0;\n\npkgs = [\"kernel-3.10.0-229.49.1.157\",\n \"kernel-debug-3.10.0-229.49.1.157\",\n \"kernel-debuginfo-3.10.0-229.49.1.157\",\n \"kernel-debuginfo-common-x86_64-3.10.0-229.49.1.157\",\n \"kernel-devel-3.10.0-229.49.1.157\",\n \"kernel-headers-3.10.0-229.49.1.157\",\n \"kernel-tools-3.10.0-229.49.1.157\",\n \"kernel-tools-libs-3.10.0-229.49.1.157\",\n \"perf-3.10.0-229.49.1.157\",\n \"python-perf-3.10.0-229.49.1.157\"];\n\nforeach (pkg in pkgs)\n if (rpm_check(release:\"EulerOS-2.0\", sp:\"1\", reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kernel\");\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}], "ubuntu": [{"lastseen": "2020-07-02T11:38:13", "bulletinFamily": "unix", "cvelist": ["CVE-2017-12193", "CVE-2017-16939", "CVE-2017-16643", "CVE-2017-1000405"], "description": "Mohamed Ghannam discovered that a use-after-free vulnerability existed in \nthe Netlink subsystem (XFRM) in the Linux kernel. A local attacker could \nuse this to cause a denial of service (system crash) or possibly execute \narbitrary code. (CVE-2017-16939)\n\nIt was discovered that the Linux kernel did not properly handle copy-on- \nwrite of transparent huge pages. A local attacker could use this to cause a \ndenial of service (application crashes) or possibly gain administrative \nprivileges. (CVE-2017-1000405)\n\nFan Wu, Haoran Qiu, and Shixiong Zhao discovered that the associative array \nimplementation in the Linux kernel sometimes did not properly handle adding \na new entry. A local attacker could use this to cause a denial of service \n(system crash). (CVE-2017-12193)\n\nAndrey Konovalov discovered an out-of-bounds read in the GTCO digitizer USB \ndriver for the Linux kernel. A physically proximate attacker could use this \nto cause a denial of service (system crash) or possibly execute arbitrary \ncode. (CVE-2017-16643)", "edition": 6, "modified": "2017-12-07T00:00:00", "published": "2017-12-07T00:00:00", "id": "USN-3509-1", "href": "https://ubuntu.com/security/notices/USN-3509-1", "title": "Linux kernel vulnerabilities", "type": "ubuntu", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-07-02T11:37:56", "bulletinFamily": "unix", "cvelist": ["CVE-2017-12193", "CVE-2017-16939", "CVE-2017-16643", "CVE-2017-1000405"], "description": "USN-3509-2 fixed vulnerabilities in the Linux Hardware Enablement \nkernel for Ubuntu 14.04 LTS. Unfortunately, it also introduced a \nregression that prevented the Ceph network filesystem from being \nused. This update fixes the problem.\n\nWe apologize for the inconvenience.\n\nOriginal advisory details:\n\nMohamed Ghannam discovered that a use-after-free vulnerability existed in \nthe Netlink subsystem (XFRM) in the Linux kernel. A local attacker could \nuse this to cause a denial of service (system crash) or possibly execute \narbitrary code. (CVE-2017-16939)\n\nIt was discovered that the Linux kernel did not properly handle copy-on- \nwrite of transparent huge pages. A local attacker could use this to cause a \ndenial of service (application crashes) or possibly gain administrative \nprivileges. (CVE-2017-1000405)\n\nFan Wu, Haoran Qiu, and Shixiong Zhao discovered that the associative array \nimplementation in the Linux kernel sometimes did not properly handle adding \na new entry. A local attacker could use this to cause a denial of service \n(system crash). (CVE-2017-12193)\n\nAndrey Konovalov discovered an out-of-bounds read in the GTCO digitizer USB \ndriver for the Linux kernel. A physically proximate attacker could use this \nto cause a denial of service (system crash) or possibly execute arbitrary \ncode. (CVE-2017-16643)", "edition": 6, "modified": "2017-12-15T00:00:00", "published": "2017-12-15T00:00:00", "id": "USN-3509-4", "href": "https://ubuntu.com/security/notices/USN-3509-4", "title": "Linux kernel (Xenial HWE) regression", "type": "ubuntu", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-07-02T11:40:18", "bulletinFamily": "unix", "cvelist": ["CVE-2017-12193", "CVE-2017-16939", "CVE-2017-16643", "CVE-2017-1000405"], "description": "USN-3509-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 \nLTS. This update provides the corresponding updates for the Linux \nHardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu \n14.04 LTS.\n\nMohamed Ghannam discovered that a use-after-free vulnerability existed in \nthe Netlink subsystem (XFRM) in the Linux kernel. A local attacker could \nuse this to cause a denial of service (system crash) or possibly execute \narbitrary code. (CVE-2017-16939)\n\nIt was discovered that the Linux kernel did not properly handle copy-on- \nwrite of transparent huge pages. A local attacker could use this to cause a \ndenial of service (application crashes) or possibly gain administrative \nprivileges. (CVE-2017-1000405)\n\nFan Wu, Haoran Qiu, and Shixiong Zhao discovered that the associative array \nimplementation in the Linux kernel sometimes did not properly handle adding \na new entry. A local attacker could use this to cause a denial of service \n(system crash). (CVE-2017-12193)\n\nAndrey Konovalov discovered an out-of-bounds read in the GTCO digitizer USB \ndriver for the Linux kernel. A physically proximate attacker could use this \nto cause a denial of service (system crash) or possibly execute arbitrary \ncode. (CVE-2017-16643)", "edition": 6, "modified": "2017-12-07T00:00:00", "published": "2017-12-07T00:00:00", "id": "USN-3509-2", "href": "https://ubuntu.com/security/notices/USN-3509-2", "title": "Linux kernel (Xenial HWE) vulnerabilities", "type": "ubuntu", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-07-02T11:34:43", "bulletinFamily": "unix", "cvelist": ["CVE-2017-12193", "CVE-2017-16939", "CVE-2017-16643", "CVE-2017-1000405"], "description": "USN-3509-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 \nLTS. Unfortunately, it also introduced a regression that prevented the \nCeph network filesystem from being used. This update fixes the problem.\n\nWe apologize for the inconvenience.\n\nOriginal advisory details:\n\nMohamed Ghannam discovered that a use-after-free vulnerability existed in \nthe Netlink subsystem (XFRM) in the Linux kernel. A local attacker could \nuse this to cause a denial of service (system crash) or possibly execute \narbitrary code. (CVE-2017-16939)\n\nIt was discovered that the Linux kernel did not properly handle copy-on- \nwrite of transparent huge pages. A local attacker could use this to cause a \ndenial of service (application crashes) or possibly gain administrative \nprivileges. (CVE-2017-1000405)\n\nFan Wu, Haoran Qiu, and Shixiong Zhao discovered that the associative array \nimplementation in the Linux kernel sometimes did not properly handle adding \na new entry. A local attacker could use this to cause a denial of service \n(system crash). (CVE-2017-12193)\n\nAndrey Konovalov discovered an out-of-bounds read in the GTCO digitizer USB \ndriver for the Linux kernel. A physically proximate attacker could use this \nto cause a denial of service (system crash) or possibly execute arbitrary \ncode. (CVE-2017-16643)", "edition": 6, "modified": "2017-12-15T00:00:00", "published": "2017-12-15T00:00:00", "id": "USN-3509-3", "href": "https://ubuntu.com/security/notices/USN-3509-3", "title": "Linux kernel regression", "type": "ubuntu", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-07-15T01:41:53", "bulletinFamily": "unix", "cvelist": ["CVE-2017-15306", "CVE-2017-15299", "CVE-2017-12193", "CVE-2017-15951", "CVE-2017-16939", "CVE-2017-1000405"], "description": "Mohamed Ghannam discovered that a use-after-free vulnerability existed in \nthe Netlink subsystem (XFRM) in the Linux kernel. A local attacker could \nuse this to cause a denial of service (system crash) or possibly execute \narbitrary code. (CVE-2017-16939)\n\nIt was discovered that the Linux kernel did not properly handle copy-on- \nwrite of transparent huge pages. A local attacker could use this to cause a \ndenial of service (application crashes) or possibly gain administrative \nprivileges. (CVE-2017-1000405)\n\nFan Wu, Haoran Qiu, and Shixiong Zhao discovered that the associative array \nimplementation in the Linux kernel sometimes did not properly handle adding \na new entry. A local attacker could use this to cause a denial of service \n(system crash). (CVE-2017-12193)\n\nEric Biggers discovered that the key management subsystem in the Linux \nkernel did not properly restrict adding a key that already exists but is \nuninstantiated. A local attacker could use this to cause a denial of \nservice (system crash) or possibly execute arbitrary code. (CVE-2017-15299)\n\nIt was discovered that a null pointer dereference error existed in the \nPowerPC KVM implementation in the Linux kernel. A local attacker could use \nthis to cause a denial of service (system crash). (CVE-2017-15306)\n\nEric Biggers discovered a race condition in the key management subsystem of \nthe Linux kernel around keys in a negative state. A local attacker could \nuse this to cause a denial of service (system crash) or possibly execute \narbitrary code. (CVE-2017-15951)", "edition": 6, "modified": "2017-12-08T00:00:00", "published": "2017-12-08T00:00:00", "id": "USN-3507-2", "href": "https://ubuntu.com/security/notices/USN-3507-2", "title": "Linux kernel (GCP) vulnerabilities", "type": "ubuntu", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-07-09T00:25:07", "bulletinFamily": "unix", "cvelist": ["CVE-2017-15306", "CVE-2017-15299", "CVE-2017-12193", "CVE-2017-16535", "CVE-2017-15951", "CVE-2017-16939", "CVE-2017-16643", "CVE-2017-1000405"], "description": "Mohamed Ghannam discovered that a use-after-free vulnerability existed in \nthe Netlink subsystem (XFRM) in the Linux kernel. A local attacker could \nuse this to cause a denial of service (system crash) or possibly execute \narbitrary code. (CVE-2017-16939)\n\nIt was discovered that the Linux kernel did not properly handle copy-on- \nwrite of transparent huge pages. A local attacker could use this to cause a \ndenial of service (application crashes) or possibly gain administrative \nprivileges. (CVE-2017-1000405)\n\nFan Wu, Haoran Qiu, and Shixiong Zhao discovered that the associative array \nimplementation in the Linux kernel sometimes did not properly handle adding \na new entry. A local attacker could use this to cause a denial of service \n(system crash). (CVE-2017-12193)\n\nEric Biggers discovered that the key management subsystem in the Linux \nkernel did not properly restrict adding a key that already exists but is \nuninstantiated. A local attacker could use this to cause a denial of \nservice (system crash) or possibly execute arbitrary code. (CVE-2017-15299)\n\nIt was discovered that a null pointer dereference error existed in the \nPowerPC KVM implementation in the Linux kernel. A local attacker could use \nthis to cause a denial of service (system crash). (CVE-2017-15306)\n\nEric Biggers discovered a race condition in the key management subsystem of \nthe Linux kernel around keys in a negative state. A local attacker could \nuse this to cause a denial of service (system crash) or possibly execute \narbitrary code. (CVE-2017-15951)\n\nAndrey Konovalov discovered that the USB subsystem in the Linux kernel did \nnot properly validate USB BOS metadata. A physically proximate attacker \ncould use this to cause a denial of service (system crash). \n(CVE-2017-16535)\n\nAndrey Konovalov discovered an out-of-bounds read in the GTCO digitizer USB \ndriver for the Linux kernel. A physically proximate attacker could use this \nto cause a denial of service (system crash) or possibly execute arbitrary \ncode. (CVE-2017-16643)", "edition": 6, "modified": "2017-12-07T00:00:00", "published": "2017-12-07T00:00:00", "id": "USN-3507-1", "href": "https://ubuntu.com/security/notices/USN-3507-1", "title": "Linux kernel vulnerabilities", "type": "ubuntu", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-07-02T11:38:09", "bulletinFamily": "unix", "cvelist": ["CVE-2017-15265", "CVE-2018-7755", "CVE-2017-12193", "CVE-2018-6927", "CVE-2018-7757", "CVE-2018-1130", "CVE-2018-3665", "CVE-2018-5750", "CVE-2017-12154", "CVE-2018-5803"], "description": "It was discovered that the nested KVM implementation in the Linux kernel in \nsome situations did not properly prevent second level guests from reading \nand writing the hardware CR8 register. A local attacker in a guest could \nuse this to cause a denial of service (system crash). (CVE-2017-12154)\n\nFan Wu, Haoran Qiu, and Shixiong Zhao discovered that the associative array \nimplementation in the Linux kernel sometimes did not properly handle adding \na new entry. A local attacker could use this to cause a denial of service \n(system crash). (CVE-2017-12193)\n\nIt was discovered that a race condition existed in the ALSA subsystem of \nthe Linux kernel when creating and deleting a port via ioctl(). A local \nattacker could use this to cause a denial of service (system crash) or \npossibly execute arbitrary code. (CVE-2017-15265)\n\nIt was discovered that a null pointer dereference vulnerability existed in \nthe DCCP protocol implementation in the Linux kernel. A local attacker \ncould use this to cause a denial of service (system crash). (CVE-2018-1130)\n\nJulian Stecklina and Thomas Prescher discovered that FPU register states \n(such as MMX, SSE, and AVX registers) which are lazily restored are \npotentially vulnerable to a side channel attack. A local attacker could use \nthis to expose sensitive information. (CVE-2018-3665)\n\nWang Qize discovered that an information disclosure vulnerability existed \nin the SMBus driver for ACPI Embedded Controllers in the Linux kernel. A \nlocal attacker could use this to expose sensitive information (kernel \npointer addresses). (CVE-2018-5750)\n\nIt was discovered that the SCTP Protocol implementation in the Linux kernel \ndid not properly validate userspace provided payload lengths in some \nsituations. A local attacker could use this to cause a denial of service \n(system crash). (CVE-2018-5803)\n\nIt was discovered that an integer overflow error existed in the futex \nimplementation in the Linux kernel. A local attacker could use this to \ncause a denial of service (system crash). (CVE-2018-6927)\n\nIt was discovered that an information leak vulnerability existed in the \nfloppy driver in the Linux kernel. A local attacker could use this to \nexpose sensitive information (kernel memory). (CVE-2018-7755)\n\nIt was discovered that a memory leak existed in the SAS driver subsystem of \nthe Linux kernel. A local attacker could use this to cause a denial of \nservice (memory exhaustion). (CVE-2018-7757)", "edition": 5, "modified": "2018-07-02T00:00:00", "published": "2018-07-02T00:00:00", "id": "USN-3698-1", "href": "https://ubuntu.com/security/notices/USN-3698-1", "title": "Linux kernel vulnerabilities", "type": "ubuntu", "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-07-02T11:41:49", "bulletinFamily": "unix", "cvelist": ["CVE-2017-15265", "CVE-2018-7755", "CVE-2017-12193", "CVE-2018-6927", "CVE-2018-7757", "CVE-2018-1130", "CVE-2018-3665", "CVE-2018-5750", "CVE-2017-12154", "CVE-2018-5803"], "description": "USN-3698-1 fixed vulnerabilities in the Linux kernel for Ubuntu 14.04 \nLTS. This update provides the corresponding updates for the Linux \nHardware Enablement (HWE) kernel from Ubuntu 14.04 LTS for Ubuntu \n12.04 ESM.\n\nIt was discovered that the nested KVM implementation in the Linux kernel in \nsome situations did not properly prevent second level guests from reading \nand writing the hardware CR8 register. A local attacker in a guest could \nuse this to cause a denial of service (system crash). (CVE-2017-12154)\n\nFan Wu, Haoran Qiu, and Shixiong Zhao discovered that the associative array \nimplementation in the Linux kernel sometimes did not properly handle adding \na new entry. A local attacker could use this to cause a denial of service \n(system crash). (CVE-2017-12193)\n\nIt was discovered that a race condition existed in the ALSA subsystem of \nthe Linux kernel when creating and deleting a port via ioctl(). A local \nattacker could use this to cause a denial of service (system crash) or \npossibly execute arbitrary code. (CVE-2017-15265)\n\nIt was discovered that a null pointer dereference vulnerability existed in \nthe DCCP protocol implementation in the Linux kernel. A local attacker \ncould use this to cause a denial of service (system crash). (CVE-2018-1130)\n\nJulian Stecklina and Thomas Prescher discovered that FPU register states \n(such as MMX, SSE, and AVX registers) which are lazily restored are \npotentially vulnerable to a side channel attack. A local attacker could use \nthis to expose sensitive information. (CVE-2018-3665)\n\nWang Qize discovered that an information disclosure vulnerability existed \nin the SMBus driver for ACPI Embedded Controllers in the Linux kernel. A \nlocal attacker could use this to expose sensitive information (kernel \npointer addresses). (CVE-2018-5750)\n\nIt was discovered that the SCTP Protocol implementation in the Linux kernel \ndid not properly validate userspace provided payload lengths in some \nsituations. A local attacker could use this to cause a denial of service \n(system crash). (CVE-2018-5803)\n\nIt was discovered that an integer overflow error existed in the futex \nimplementation in the Linux kernel. A local attacker could use this to \ncause a denial of service (system crash). (CVE-2018-6927)\n\nIt was discovered that an information leak vulnerability existed in the \nfloppy driver in the Linux kernel. A local attacker could use this to \nexpose sensitive information (kernel memory). (CVE-2018-7755)\n\nIt was discovered that a memory leak existed in the SAS driver subsystem of \nthe Linux kernel. A local attacker could use this to cause a denial of \nservice (memory exhaustion). (CVE-2018-7757)", "edition": 6, "modified": "2018-07-02T00:00:00", "published": "2018-07-02T00:00:00", "id": "USN-3698-2", "href": "https://ubuntu.com/security/notices/USN-3698-2", "title": "Linux kernel (Trusty HWE) vulnerabilities", "type": "ubuntu", "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}}], "cloudfoundry": [{"lastseen": "2019-05-29T18:32:45", "bulletinFamily": "software", "cvelist": ["CVE-2017-12193", "CVE-2017-16939", "CVE-2017-16643", "CVE-2017-1000405"], "description": "# \n\n# Severity\n\nUnspecified\n\n# Vendor\n\nCanonical Ubuntu\n\n# Versions Affected\n\n * Canonical Ubuntu 14.04\n\n# Description\n\nUSN-3509-2 fixed vulnerabilities in the Linux Hardware Enablement kernel for Ubuntu 14.04 LTS. Unfortunately, it also introduced a regression that prevented the Ceph network filesystem from being used. This update fixes the problem.\n\nWe apologize for the inconvenience.\n\nOriginal advisory details:\n\nMohamed Ghannam discovered that a use-after-free vulnerability existed in the Netlink subsystem (XFRM) in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-16939)\n\nIt was discovered that the Linux kernel did not properly handle copy-on- write of transparent huge pages. A local attacker could use this to cause a denial of service (application crashes) or possibly gain administrative privileges. (CVE-2017-1000405)\n\nFan Wu, Haoran Qiu, and Shixiong Zhao discovered that the associative array implementation in the Linux kernel sometimes did not properly handle adding a new entry. A local attacker could use this to cause a denial of service (system crash). (CVE-2017-12193)\n\nAndrey Konovalov discovered an out-of-bounds read in the GTCO digitizer USB driver for the Linux kernel. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-16643)\n\n# Affected Cloud Foundry Products and Versions\n\n_Severity is unspecified unless otherwise noted._\n\n * Cloud Foundry BOSH trusty-stemcells are vulnerable, including: \n * 3312.x versions prior to 3312.49\n * 3363.x versions prior to 3363.45\n * 3421.x versions prior to 3421.35\n * 3445.x versions prior to 3445.21\n * 3468.x versions prior to 3468.16\n * All other stemcells not listed.\n\n# Mitigation\n\nOSS users are strongly encouraged to follow one of the mitigations below:\n\n * The Cloud Foundry project recommends upgrading the following BOSH trusty-stemcells: \n * Upgrade 3312.x versions to 3312.49\n * Upgrade 3363.x versions to 3363.45\n * Upgrade 3421.x versions to 3421.35\n * Upgrade 3445.x versions to 3445.21\n * Upgrade 3468.x versions to 3468.16\n * All other stemcells should be upgraded to the latest version available on [bosh.io](<https://bosh.io/stemcells/#ubuntu-trusty>).\n\n# References\n\n * [USN-3509-4](<https://usn.ubuntu.com/3509-4>)\n", "edition": 2, "modified": "2017-12-16T00:00:00", "published": "2017-12-16T00:00:00", "id": "CFOUNDRY:74EC63FE794662FC4DFD36709B39475A", "href": "https://www.cloudfoundry.org/blog/usn-3509-4/", "title": "USN-3509-4: Linux kernel (Xenial HWE) regression | Cloud Foundry", "type": "cloudfoundry", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-05-29T18:32:38", "bulletinFamily": "software", "cvelist": ["CVE-2017-12193", "CVE-2017-16939", "CVE-2017-16643", "CVE-2017-1000405"], "description": "# \n\n# Severity\n\nHigh\n\n# Vendor\n\nCanonical Ubuntu\n\n# Versions Affected\n\n * Canonical Ubuntu 14.04\n\n# Description\n\nUSN-3509-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS.\n\nMohamed Ghannam discovered that a use-after-free vulnerability existed in the Netlink subsystem (XFRM) in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. ([CVE-2017-16939](<http://people.ubuntu.com/~ubuntu-security/cve/CVE-2017-16939>))\n\nIt was discovered that the Linux kernel did not properly handle copy-on- write of transparent huge pages. A local attacker could use this to cause a denial of service (application crashes) or possibly gain administrative privileges. ([CVE-2017-1000405](<http://people.ubuntu.com/~ubuntu-security/cve/CVE-2017-1000405>)) Please note: this CVE is also known colloquially as \u201chuge dirty cow\u201d.\n\nFan Wu, Haoran Qiu, and Shixiong Zhao discovered that the associative array implementation in the Linux kernel sometimes did not properly handle adding a new entry. A local attacker could use this to cause a denial of service (system crash). ([CVE-2017-12193](<http://people.ubuntu.com/~ubuntu-security/cve/CVE-2017-12193>))\n\nAndrey Konovalov discovered an out-of-bounds read in the GTCO digitizer USB driver for the Linux kernel. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. ([CVE-2017-16643](<http://people.ubuntu.com/~ubuntu-security/cve/CVE-2017-16643>))\n\n# Affected Cloud Foundry Products and Versions\n\n_Severity is high unless otherwise noted._\n\n * Cloud Foundry BOSH stemcells are vulnerable, including: \n * 3421.x versions prior to 3421.34\n * 3445.x versions prior to 3445.19\n * 3468.x versions prior to 3468.13\n * All other stemcells not listed.\n\n# Mitigation\n\nOSS users are strongly encouraged to follow one of the mitigations below:\n\n * The Cloud Foundry project recommends upgrading the following BOSH stemcells: \n * Upgrade 3421.x versions prior to 3421.34\n * Upgrade 3445.x versions prior to 3445.19\n * Upgrade 3468.x versions prior to 3468.13\n * All other stemcells should be upgraded to the latest version available on [bosh.io](<https://bosh.io>).\n\n# References\n\n * [USN-3509-2](<http://www.ubuntu.com/usn/usn-3509-2/>)\n * [CVE-2017-16939](<http://people.ubuntu.com/~ubuntu-security/cve/CVE-2017-16939>)\n * [CVE-2017-1000405](<http://people.ubuntu.com/~ubuntu-security/cve/CVE-2017-1000405>)\n * [CVE-2017-12193](<http://people.ubuntu.com/~ubuntu-security/cve/CVE-2017-12193>)\n * [CVE-2017-16643](<http://people.ubuntu.com/~ubuntu-security/cve/CVE-2017-16643>)\n", "edition": 5, "modified": "2017-12-08T00:00:00", "published": "2017-12-08T00:00:00", "id": "CFOUNDRY:0BD4290D520A235B05B93F0ACF4B7C2B", "href": "https://www.cloudfoundry.org/blog/usn-3509-2/", "title": "USN-3509-2: Linux kernel (Xenial HWE) vulnerabilities | Cloud Foundry", "type": "cloudfoundry", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}], "amazon": [{"lastseen": "2020-11-10T12:34:49", "bulletinFamily": "unix", "cvelist": ["CVE-2017-15299", "CVE-2017-12193", "CVE-2017-15951", "CVE-2017-1000255", "CVE-2017-12190"], "description": "**Issue Overview:**\n\nIncorrect updates of uninstantiated keys crash the kernel \nA vulnerability was found in the key management subsystem of the Linux kernel. An update on an uninstantiated key could cause a kernel panic, leading to denial of service (DoS). ([CVE-2017-15299 __](<https://access.redhat.com/security/cve/CVE-2017-15299>))\n\nMemory leak when merging buffers in SCSI IO vectors \nIt was found that in the Linux kernel through v4.14-rc5, bio_map_user_iov() and bio_unmap_user() in 'block/bio.c' do unbalanced pages refcounting if IO vector has small consecutive buffers belonging to the same page. bio_add_pc_page() merges them into one, but the page reference is never dropped, causing a memory leak and possible system lockup due to out-of-memory condition. ([CVE-2017-12190 __](<https://access.redhat.com/security/cve/CVE-2017-12190>))\n\nNull pointer dereference due to incorrect node-splitting in assoc_array implementation \nA flaw was found in the Linux kernel's implementation of associative arrays introduced in 3.13. This functionality was backported to the 3.10 kernels in Red Hat Enterprise Linux 7. The flaw involved a null pointer dereference in assoc_array_apply_edit() due to incorrect node-splitting in assoc_array implementation. This affects the keyring key type and thus key addition and link creation operations may cause the kernel to panic. ([CVE-2017-12193 __](<https://access.redhat.com/security/cve/CVE-2017-12193>))\n\nArbitrary stack overwrite causing oops via crafted signal frame \nA flaw was found in the Linux kernel's handling of signal frame on PowerPC systems. A malicious local user process could craft a signal frame allowing an attacker to corrupt memory. ([CVE-2017-1000255 __](<https://access.redhat.com/security/cve/CVE-2017-1000255>))\n\nRace condition in the KEYS subsystem \nThe KEYS subsystem in the Linux kernel before 4.13.10 does not correctly synchronize the actions of updating versus finding a key in the "negative" state to avoid a race condition, which allows local users to cause a denial of service or possibly have unspecified other impact via crafted system calls. ([CVE-2017-15951 __](<https://access.redhat.com/security/cve/CVE-2017-15951>))\n\n \n**Affected Packages:** \n\n\nkernel\n\n \n**Issue Correction:** \nRun _yum update kernel_ to update your system. \n\n\n \n\n\n**New Packages:**\n \n \n i686: \n perf-debuginfo-4.9.62-21.56.amzn1.i686 \n kernel-tools-devel-4.9.62-21.56.amzn1.i686 \n kernel-debuginfo-4.9.62-21.56.amzn1.i686 \n kernel-devel-4.9.62-21.56.amzn1.i686 \n perf-4.9.62-21.56.amzn1.i686 \n kernel-headers-4.9.62-21.56.amzn1.i686 \n kernel-debuginfo-common-i686-4.9.62-21.56.amzn1.i686 \n kernel-4.9.62-21.56.amzn1.i686 \n kernel-tools-4.9.62-21.56.amzn1.i686 \n kernel-tools-debuginfo-4.9.62-21.56.amzn1.i686 \n \n noarch: \n kernel-doc-4.9.62-21.56.amzn1.noarch \n \n src: \n kernel-4.9.62-21.56.amzn1.src \n \n x86_64: \n kernel-debuginfo-4.9.62-21.56.amzn1.x86_64 \n kernel-headers-4.9.62-21.56.amzn1.x86_64 \n kernel-tools-debuginfo-4.9.62-21.56.amzn1.x86_64 \n kernel-debuginfo-common-x86_64-4.9.62-21.56.amzn1.x86_64 \n perf-debuginfo-4.9.62-21.56.amzn1.x86_64 \n kernel-tools-devel-4.9.62-21.56.amzn1.x86_64 \n kernel-4.9.62-21.56.amzn1.x86_64 \n kernel-devel-4.9.62-21.56.amzn1.x86_64 \n perf-4.9.62-21.56.amzn1.x86_64 \n kernel-tools-4.9.62-21.56.amzn1.x86_64 \n \n \n", "edition": 5, "modified": "2017-11-18T02:03:00", "published": "2017-11-18T02:03:00", "id": "ALAS-2017-925", "href": "https://alas.aws.amazon.com/ALAS-2017-925.html", "title": "Medium: kernel", "type": "amazon", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}], "redhat": [{"lastseen": "2019-12-11T13:31:34", "bulletinFamily": "unix", "cvelist": ["CVE-2015-8539", "CVE-2017-12192", "CVE-2017-12193", "CVE-2017-15649", "CVE-2017-7472"], "description": "The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.\n\nSecurity Fix(es):\n\n* A flaw was found in the Linux kernel's key management system where it was possible for an attacker to escalate privileges or crash the machine. If a user key gets negatively instantiated, an error code is cached in the payload area. A negatively instantiated key may be then be positively instantiated by updating it with valid data. However, the ->update key type method must be aware that the error code may be there. (CVE-2015-8539, Important)\n\n* It was found that fanout_add() in 'net/packet/af_packet.c' in the Linux kernel, before version 4.13.6, allows local users to gain privileges via crafted system calls that trigger mishandling of packet_fanout data structures, because of a race condition (involving fanout_add and packet_do_bind) that leads to a use-after-free bug. (CVE-2017-15649, Important)\n\n* A vulnerability was found in the Linux kernel where the keyctl_set_reqkey_keyring() function leaks the thread keyring. This allows an unprivileged local user to exhaust kernel memory and thus cause a DoS. (CVE-2017-7472, Moderate)\n\nRed Hat would like to thank Dmitry Vyukov of Google engineering for reporting CVE-2015-8539.\n\nBug Fix(es):\n\n* The kernel-rt packages have been upgraded to 3.10.0-693.15.1 source tree, which provides a number of bug fixes over the previous version. (BZ#1519506)", "modified": "2018-03-23T18:26:20", "published": "2018-01-25T14:24:01", "id": "RHSA-2018:0152", "href": "https://access.redhat.com/errata/RHSA-2018:0152", "type": "redhat", "title": "(RHSA-2018:0152) Important: kernel-rt security and bug fix update", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-12-11T13:32:30", "bulletinFamily": "unix", "cvelist": ["CVE-2015-8539", "CVE-2017-12192", "CVE-2017-12193", "CVE-2017-15649", "CVE-2017-7472"], "description": "The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.\n\nSecurity Fix(es):\n\n* A flaw was found in the Linux kernel's key management system where it was possible for an attacker to escalate privileges or crash the machine. If a user key gets negatively instantiated, an error code is cached in the payload area. A negatively instantiated key may be then be positively instantiated by updating it with valid data. However, the ->update key type method must be aware that the error code may be there. (CVE-2015-8539, Important)\n\n* It was found that fanout_add() in 'net/packet/af_packet.c' in the Linux kernel, before version 4.13.6, allows local users to gain privileges via crafted system calls that trigger mishandling of packet_fanout data structures, because of a race condition (involving fanout_add and packet_do_bind) that leads to a use-after-free bug. (CVE-2017-15649, Important)\n\n* A vulnerability was found in the Linux kernel where the keyctl_set_reqkey_keyring() function leaks the thread keyring. This allows an unprivileged local user to exhaust kernel memory and thus cause a DoS. (CVE-2017-7472, Moderate)\n\nRed Hat would like to thank Dmitry Vyukov of Google engineering for reporting CVE-2015-8539.\n\nBug Fix(es):\n\n* The mlx5 driver has a number of configuration options, including the selective support for network protocols, such as InfiniBand and Ethernet. Due to a regression in the configuration of the MRG-RT kernel, the Ethernet mode of the driver was turned off. The regression has been resolved by enabling the mlx5 Ethernet mode, making the Ethernet protocol to work again. (BZ#1422778)\n\n* The migrate_disable/enable() kernel operations are used to pin a thread to a CPU temporarily. This method is a kernel-rt specific. To keep RHEL-RT's kernel up-to-date with the latest real-time kernel, the migrate_disable/enable routine was updated to the version present on kernel v4.9-rt. However, this version showed to be problematic. The changes in the migrate_disable/enabled have been thus reverted to a stable version, avoiding the kernel BUG. (BZ#1507831)\n\n* The kernel-rt packages have been upgraded to version 3.10.0-693.15.1.rt56.601, which provides a number of security and bug fixes over the previous version. (BZ#1519504)", "modified": "2019-03-13T02:26:07", "published": "2018-01-25T16:09:51", "id": "RHSA-2018:0181", "href": "https://access.redhat.com/errata/RHSA-2018:0181", "type": "redhat", "title": "(RHSA-2018:0181) Important: kernel-rt security and bug fix update", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-12-11T13:31:25", "bulletinFamily": "unix", "cvelist": ["CVE-2015-8539", "CVE-2017-12192", "CVE-2017-12193", "CVE-2017-15649", "CVE-2017-5715", "CVE-2017-5753", "CVE-2017-5754", "CVE-2017-7472"], "description": "The kernel packages contain the Linux kernel, the core of any Linux operating system.\n\nSecurity Fix(es):\n\nAn industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of instructions (a commonly used performance optimization). There are three primary variants of the issue which differ in the way the speculative execution can be exploited.\n\nNote: This issue is present in hardware and cannot be fully fixed via software update. The updated kernel packages provide software mitigation for this hardware issue at a cost of potential performance penalty. Please refer to References section for further information about this issue and the performance impact.\n\nIn this update initial mitigations for IBM Power (PowerPC) and IBM zSeries (S390) architectures are provided.\n\n* Variant CVE-2017-5715 triggers the speculative execution by utilizing branch target injection. It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact that memory accesses may cause allocation into the microprocessor's data cache even for speculatively executed instructions that never actually commit (retire). As a result, an unprivileged attacker could use this flaw to cross the syscall and guest/host boundaries and read privileged memory by conducting targeted cache side-channel attacks. This fix specifically addresses S390 processors. (CVE-2017-5715, Important)\n\n* Variant CVE-2017-5753 triggers the speculative execution by performing a bounds-check bypass. It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact that memory accesses may cause allocation into the microprocessor's data cache even for speculatively executed instructions that never actually commit (retire). As a result, an unprivileged attacker could use this flaw to cross the syscall boundary and read privileged memory by conducting targeted cache side-channel attacks. This fix specifically addresses S390 and PowerPC processors. (CVE-2017-5753, Important)\n\n* Variant CVE-2017-5754 relies on the fact that, on impacted microprocessors, during speculative execution of instruction permission faults, exception generation triggered by a faulting access is suppressed until the retirement of the whole instruction block. In a combination with the fact that memory accesses may populate the cache even when the block is being dropped and never committed (executed), an unprivileged local attacker could use this flaw to read privileged (kernel space) memory by conducting targeted cache side-channel attacks. Note: CVE-2017-5754 affects Intel x86-64 microprocessors. AMD x86-64 microprocessors are not affected by this issue. This fix specifically addresses PowerPC processors. (CVE-2017-5754, Important)\n\nRed Hat would like to thank Google Project Zero for reporting CVE-2017-5715, CVE-2017-5753, and CVE-2017-5754.\n\nThis update also fixes the following security issues and bugs:\n\nSpace precludes documenting all of the bug fixes and enhancements included in this advisory. To see the complete list of bug fixes and enhancements, refer to the following KnowledgeBase article: https://access.redhat.com/articles/3327131.", "modified": "2018-04-12T03:32:37", "published": "2018-01-25T14:23:46", "id": "RHSA-2018:0151", "href": "https://access.redhat.com/errata/RHSA-2018:0151", "type": "redhat", "title": "(RHSA-2018:0151) Important: kernel security and bug fix update", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}], "oraclelinux": [{"lastseen": "2019-05-29T18:35:17", "bulletinFamily": "unix", "cvelist": ["CVE-2017-5754", "CVE-2017-12193", "CVE-2017-0861", "CVE-2017-15115", "CVE-2017-14140", "CVE-2017-17712", "CVE-2017-8824"], "description": "[4.1.12-112.14.14]\n- drivers/char/mem.c: deny access in open operation when securelevel is set (Ethan Zhao) [Orabug: 27234850] [Orabug: 27234850] \n- hugetlb: fix nr_pmds accounting with shared page tables (Kirill A. Shutemov) [Orabug: 26988581] \n- x86/IBRS: Drop unnecessary WRITE_ONCE (Boris Ostrovsky) [Orabug: 27416198] \n- x86/IBRS: Dont try to change IBRS mode if IBRS is not available (Boris Ostrovsky) [Orabug: 27416198] \n- x86/IBRS: Remove support for IBRS_ENABLED_USER mode (Boris Ostrovsky) [Orabug: 27416198] \n- x86: Include linux/device.h in bugs_64.c (Boris Ostrovsky) [Orabug: 27418896] \n- x86/spectre: Drop the warning about ibrs being obsolete. (Konrad Rzeszutek Wilk) \n- x86/spec: Dont print the Missing arguments for option spectre_v2. (Konrad Rzeszutek Wilk) \n- x86/spec: Also print IBRS if IBPB is disabled. (Konrad Rzeszutek Wilk) \n- x86/IBPB: Provide debugfs interface for changing IBPB mode (Boris Ostrovsky) [Orabug: 27449065] \n- xen: Make PV Dom0 Linux kernel NUMA aware (Elena Ufimtseva) \n- net/rds: Fix incorrect error handling (Hakon Bugge) [Orabug: 26848729] \n- net/rds: use multiple sge than buddy allocation in congestion code (Wei Lin Guay) [Orabug: 26848729] \n- Revert RDS: fix the sg allocation based on actual message size (Wei Lin Guay) [Orabug: 26848729] \n- Revert RDS: avoid large pages for sg allocation for TCP transport (Wei Lin Guay) [Orabug: 26848729] \n- Revert net/rds: Reduce memory footprint in rds_sendmsg (Wei Lin Guay) [Orabug: 26848729] \n- net/rds: reduce memory footprint during ib_post_recv in IB transport (Wei Lin Guay) [Orabug: 26848729] \n- net/rds: reduce memory footprint during rds_sendmsg with IB transport (Wei Lin Guay) [Orabug: 26848729] \n- net/rds: set the rds_ib_init_frag based on supported sge (Wei Lin Guay) [Orabug: 26848729] \n- bnxt_en: Fix possible corrupted NVRAM parameters from firmware response. (Michael Chan) [Orabug: 27199588] \n- x86, kasan: Fix build failure on KASAN=y && KMEMCHECK=y kernels (Andrey Ryabinin) [Orabug: 27255122] \n- x86, efi, kasan: Fix build failure on !KASAN && KMEMCHECK=y kernels (Andrey Ryabinin) [Orabug: 27255122] \n- x86, efi, kasan: #undef memset/memcpy/memmove per arch (Andrey Ryabinin) [Orabug: 27255122] \n- Revert Makefile: Build with -Werror=date-time if the compiler supports it (Gayatri Vasudevan) [Orabug: 27255122] \n- dccp: CVE-2017-8824: use-after-free in DCCP code (Mohamed Ghannam) [Orabug: 27290300] {CVE-2017-8824} \n- x86/efi: Initialize and display UEFI secure boot state a bit later during init (Daniel Kiper) [Orabug: 27309477] \n- x86/espfix: Init espfix on the boot CPU side (Zhu Guihua) [Orabug: 27344552] \n- x86/espfix: Add cpu parameter to init_espfix_ap() (Zhu Guihua) [Orabug: 27344552] \n- ALSA: pcm: prevent UAF in snd_pcm_info (Robb Glasser) [Orabug: 27344841] {CVE-2017-0861} {CVE-2017-0861} \n- fs/ocfs2: remove page cache for converted direct write (Wengang Wang) \n- Revert ocfs2: code clean up for direct io (Wengang Wang) \n- assoc_array: Fix a buggy node-splitting case (David Howells) [Orabug: 27364592] {CVE-2017-12193} {CVE-2017-12193} \n- Sanitize move_pages() permission checks (Linus Torvalds) [Orabug: 27364690] {CVE-2017-14140} \n- pti: compile fix for when PTI is disabled (Pavel Tatashin) [Orabug: 27383147] {CVE-2017-5754} \n- sctp: do not peel off an assoc from one netns to another one (Xin Long) [Orabug: 27386999] {CVE-2017-15115} \n- net: ipv4: fix for a race condition in raw_sendmsg (Mohamed Ghannam) [Orabug: 27390682] {CVE-2017-17712} \n- mlx4: add mstflint secure boot access kernel support (Qing Huang) [Orabug: 27404202] \n- x86: Move STUFF_RSB in to the idt macro (Konrad Rzeszutek Wilk) \n- x86/spec: STUFF_RSB _before_ ENABLE_IBRS (Konrad Rzeszutek Wilk) \n- x86: Move ENABLE_IBRS in the interrupt macro. (Konrad Rzeszutek Wilk) [Orabug: 27449045]", "edition": 4, "modified": "2018-02-07T00:00:00", "published": "2018-02-07T00:00:00", "id": "ELSA-2018-4025", "href": "http://linux.oracle.com/errata/ELSA-2018-4025.html", "title": "Unbreakable Enterprise kernel security update", "type": "oraclelinux", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-05-29T18:38:48", "bulletinFamily": "unix", "cvelist": ["CVE-2017-7472", "CVE-2017-5753", "CVE-2017-5754", "CVE-2017-12193", "CVE-2017-15649", "CVE-2017-5715", "CVE-2017-12192", "CVE-2015-8539"], "description": "- [3.10.0-693.17.1.OL7]\n- Oracle Linux certificates (Alexey Petrenko)\n- Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenko@oracle.com)\n- Update x509.genkey [bug 24817676]\n[3.10.0-693.17.1]\n- [s390] locking/barriers: remove old gmb() macro definition (Denys Vlasenko) [1519788 1519786]\n[3.10.0-693.16.1]\n- [x86] smpboot: Do not use smp_num_siblings in __max_logical_packages calculation (Prarit Bhargava) [1533022 1519503]\n- [x86] topology: Add topology_max_smt_threads() (Prarit Bhargava) [1533022 1519503]\n- [powerpc] spinlock: add gmb memory barrier (Jon Masters) [1519788 1519786] {CVE-2017-5753}\n- [powerpc] Prevent Meltdown attack with L1-D$ flush (Jon Masters) [1519800 1519801] {CVE-2017-5754}\n- [s390] add ppa to system call and program check path (Jon Masters) [1519795 1519798] {CVE-2017-5715}\n- [s390] spinlock: add gmb memory barrier (Jon Masters) [1519788 1519786] {CVE-2017-5753}\n- [s390] introduce CPU alternatives (Jon Masters) [1519795 1519798] {CVE-2017-5715}\n- [x86] spec_ctrl: move vmexit rmb in the last branch before IBRS (Andrea Arcangeli) [1533373 1533250]\n- [x86] spec_ctrl: satisfy the barrier like semantics of IBRS (Andrea Arcangeli) [1533373 1533250]\n- [fs] userfaultfd: clear the vma->vm_userfaultfd_ctx if UFFD_EVENT_FORK fails (Andrea Arcangeli) [1533372 1531287]\n- [x86] kaiser/efi: unbreak tboot (Andrea Arcangeli) [1519795 1532989 1519798 1531559] {CVE-2017-5715}\n- [x86] spec_ctrl: don't call ptrace_has_cap in the IBPB ctx switch optimization (Andrea Arcangeli) [1519795 1519798] {CVE-2017-5715}\n- [x86] kaiser/efi: unbreak EFI old_memmap (Andrea Arcangeli) [1519795 1519798] {CVE-2017-5715}\n- [x86] cpuidle_idle_call: fix double local_irq_enable() (Andrea Arcangeli) [1519795 1519798] {CVE-2017-5715}\n- [x86] entry: Invoke TRACE_IRQS_IRETQ in paranoid_userspace_restore_all (Andrea Arcangeli) [1519795 1519798] {CVE-2017-5715}\n- [x86] cpu: fix get_scattered_cpu_leaf sorting part #2 (Andrea Arcangeli) [1519795 1519798] {CVE-2017-5715}\n- [x86] spec_ctrl: show added cpuid flags in /proc/cpuinfo after late microcode update (Andrea Arcangeli) [1519795 1519798] {CVE-2017-5715}\n- [x86] cpu: fix get_scattered_cpu_leaf for IBPB feature (Paolo Bonzini) [1519795 1519798]", "edition": 4, "modified": "2018-01-25T00:00:00", "published": "2018-01-25T00:00:00", "id": "ELSA-2018-0151", "href": "http://linux.oracle.com/errata/ELSA-2018-0151.html", "title": "kernel security and bug fix update", "type": "oraclelinux", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-05-29T18:34:41", "bulletinFamily": "unix", "cvelist": ["CVE-2016-9191", "CVE-2017-5753", "CVE-2017-5754", "CVE-2017-12193", "CVE-2017-7518", "CVE-2017-16532", "CVE-2017-16649", "CVE-2017-15115", "CVE-2017-14140", "CVE-2017-17712", "CVE-2017-8824", "CVE-2017-16646", "CVE-2017-15537", "CVE-2017-5715", "CVE-2017-1000407", "CVE-2017-17052", "CVE-2018-1068"], "description": "[4.1.12-124.14.1]\n- ctf: drop the run-as-root error (Nick Alcock) [Orabug: 27852654] \n- rds: Node crashes when trace buffer is opened (Ka-Cheong Poon) [Orabug: 27846191] \n- xfs: fix accidental reversion of aa6a6227435cb (Darrick J. Wong) [Orabug: 27845869]\n[4.1.12-124.13.1]\n- net: cdc_ether: fix divide by 0 on bad descriptors (Bjorn Mork) [Orabug: 27841392] {CVE-2017-16649}\n- sysctl: Drop reference added by grab_header in proc_sys_readdir (Zhou Chengming) [Orabug: 27841944] {CVE-2016-9191} {CVE-2016-9191} {CVE-2016-9191}\n- Revert 'sysctl: Drop reference added by grab_header in proc_sys_readdir' (Jack Vogel)\n[4.1.12-124.12.1]\n- xfs: remove 'no-allocation' reservations for file creations (Darrick J. Wong) [Orabug: 27609439] \n- xfs: dont print warnings when xfs_log_force fails (Christoph Hellwig) [Orabug: 27609404] \n- xfs: Properly retry failed dquot items in case of error during buffer writeback (Carlos Maiolino) [Orabug: 27609404] \n- xfs: Properly retry failed inode items in case of error during buffer writeback (Carlos Maiolino) [Orabug: 27609404] \n- xfs: Add infrastructure needed for error propagation during buffer IO failure (Carlos Maiolino) [Orabug: 27609404] \n- xfs: remove xfs_trans_ail_delete_bulk (Christoph Hellwig) [Orabug: 27609404] \n- xfs: fix and streamline error handling in xfs_end_io (Darrick J. Wong) [Orabug: 27609404] \n- xfs: dont leave EFIs on AIL on mount failure (Brian Foster) [Orabug: 27609404] \n- xfs: use EFI refcount consistently in log recovery (Brian Foster) [Orabug: 27609404] \n- xfs: ensure EFD trans aborts on log recovery extent free failure (Brian Foster) [Orabug: 27609404] \n- xfs: fix efi/efd error handling to avoid fs shutdown hangs (Brian Foster) [Orabug: 27609404] \n- xfs: return committed status from xfs_trans_roll() (Brian Foster) [Orabug: 27609404] \n- xfs: disentagle EFI release from the extent count (Brian Foster) [Orabug: 27609404]\n[4.1.12-124.11.1]\n- netfilter: ebtables: CONFIG_COMPAT: dont trust userland offsets (Florian Westphal) [Orabug: 27774012] {CVE-2018-1068}\n- ACPI / PAD: dont register acpi_pad driver if running as Xen dom0 (Juergen Gross) [Orabug: 27796473] \n- sched/fair: Fix typo in sync_throttle() (Xunlei Pang) [Orabug: 27787518] \n- sched/fair: Do not announce throttled next buddy in dequeue_task_fair() (Konstantin Khlebnikov) [Orabug: 27787518] \n- sched/fair: Initialize and rework throttle_count for new task-groups (Peter Zijlstra) [Orabug: 27787518] \n- perf tools: Move syscall number fallbacks from perf-sys.h to tools/arch/x86/include/asm/ (Arnaldo Carvalho de Melo) [Orabug: 27240053] \n- crypto: FIPS - allow tests to be disabled in FIPS mode (Stephan Mueller) [Orabug: 27809271] \n- crypto: xts - consolidate sanity check for keys (Stephan Mueller) [Orabug: 27809271] \n- crypto: rng - Zero seed in crypto_rng_reset (Herbert Xu) [Orabug: 27809271] \n- enic: set IG desc cache flag in open (Govindarajulu Varadarajan) [Orabug: 27587345]\n[4.1.12-124.10.1]\n- Drivers: hv: utils: fix crash when device is removed from host side (Vitaly Kuznetsov) [Orabug: 27426102] \n- Drivers: hv: utils: introduce HVUTIL_TRANSPORT_DESTROY mode (Vitaly Kuznetsov) [Orabug: 27426102] \n- Drivers: hv: utils: rename outmsg_lock (Vitaly Kuznetsov) [Orabug: 27426102] \n- Drivers: hv: utils: fix memory leak on on_msg() failure (Vitaly Kuznetsov) [Orabug: 27426102] \n- Drivers: hv: utils: use memdup_user in hvt_op_write (Olaf Hering) [Orabug: 27426102] \n- hv: util: checking the wrong variable (Dan Carpenter) [Orabug: 27426102] \n- net/rds: Avoid copy overhead if send buff is full (Gerd Rausch) [Orabug: 27747165] \n- ext4: fix ->put_link panic (Junxiao Bi) [Orabug: 27498770] \n- KVM/VMX: Clear spec_ctrl status when resetting vcpu (Patrick Colp) \n- mlx4: change the ICM table allocations to lowest needed size (Daniel Jurgens) [Orabug: 27718303] \n- Revert 'Drivers: hv: utils: fix a race on userspace daemons registration' (Jack Vogel) [Orabug: 27673755]\n[4.1.12-124.9.1]\n- crypto: af_alg - Avoid sock_graft call warning (Herbert Xu) [Orabug: 26895616] \n- iscsi-target: Fix initial login PDU asynchronous socket close OOPs (Nicholas Bellinger) [Orabug: 27701211] \n- target/iscsi: Fix indentation in iscsi_target_start_negotiation() (Bart Van Assche) [Orabug: 27701211] \n- iscsi-target: Fix early sk_data_ready LOGIN_FLAGS_READY race (Nicholas Bellinger) [Orabug: 27701211] \n- iscsi-target: Fix rx_login_comp hang after login failure (Nicholas Bellinger) [Orabug: 27701211] \n- KVM: x86: fix singlestepping over syscall (Paolo Bonzini) [Orabug: 27669904] {CVE-2017-7518} {CVE-2017-7518}\n- nfs: system crashes after NFS4ERR_MOVED recovery (Bill.Baker@oracle.com) [Orabug: 27679350] \n- NFS: Clean up nfs4_set_client() (Anna Schumaker) [Orabug: 27679350] \n- NFS4: Avoid migration loops (Benjamin Coddington) [Orabug: 27679350] \n- mstflint: update Makefile and Kconfig (Qing Huang) [Orabug: 27707445] \n- target: add inquiry_product module param to override LIO default (Kyle Fortin) [Orabug: 27679431] \n- target: add inquiry_vendor module param to override LIO-ORG (Kyle Fortin) [Orabug: 27679431] \n- IB/core: Avoid calling ib_query_device (Or Gerlitz) [Orabug: 27687711] \n- IB/core: Save the device attributes on the device structure (Ira Weiny) [Orabug: 27687711]\n[4.1.12-124.8.1]\n- nvme: fix uninitialized prp2 value on small transfers (Jan H. Schonherr) [Orabug: 27624149] \n- bnxt_en: initialize bnxt_pf_wq (Brian Maly) [Orabug: 27674029] \n- x86/spectre_v2: Fix cpu offlining with IPBP. (Konrad Rzeszutek Wilk)\n[4.1.12-124.7.1]\n- retpoline: selectively disable IBRS in disable_ibrs_and_friends() (Chuck Anderson) [Orabug: 27665263]\n[4.1.12-124.6.1]\n- bnxt_en: Add cache line size setting to optimize performance. (Michael Chan) [Orabug: 27648355] \n- bnxt_en: Forward VF MAC address to the PF. (Vasundhara Volam) [Orabug: 27648355] \n- bnxt_en: Add BCM5745X NPAR device IDs (Vasundhara Volam) [Orabug: 27648355] \n- bnxt_en: Expand bnxt_check_rings() to check all resources. (Michael Chan) [Orabug: 27648355] \n- bnxt_en: Implement new method for the PF to assign SRIOV resources. (Michael Chan) [Orabug: 27648355] \n- bnxt_en: Reserve resources for RFS. (Michael Chan) [Orabug: 27648355] \n- bnxt_en: Implement new method to reserve rings. (Michael Chan) [Orabug: 27648355] \n- bnxt_en: Set initial default RX and TX ring numbers the same in combined mode. (Michael Chan) [Orabug: 27648355] \n- bnxt_en: Add the new firmware API to query hardware resources. (Michael Chan) [Orabug: 27648355] \n- bnxt_en: Refactor hardware resource data structures. (Michael Chan) [Orabug: 27648355] \n- bnxt_en: Restore MSIX after disabling SRIOV. (Michael Chan) [Orabug: 27648355] \n- bnxt_en: Refactor bnxt_close_nic(). (Michael Chan) [Orabug: 27648355] \n- bnxt_en: Update firmware interface to 1.9.0. (Michael Chan) [Orabug: 27648355] \n- bnxt_en: Fix the 'Invalid VF' id check in bnxt_vf_ndo_prep routine. (Venkat Duvvuru) [Orabug: 27648355] \n- bnxt_en: Fix sources of spurious netpoll warnings (Calvin Owens) [Orabug: 27648355] \n- bnxt_en: Dont print 'Link speed -1 no longer supported' messages. (Michael Chan) [Orabug: 27648355] \n- bnxt_en: Fix a variable scoping in bnxt_hwrm_do_send_msg() (Vasundhara Volam) [Orabug: 27648355] \n- bnxt_en: Need to unconditionally shut down RoCE in bnxt_shutdown (Ray Jui) [Orabug: 27648355] \n- bnxt_en: Fix an error handling path in 'bnxt_get_module_eeprom()' (Christophe JAILLET) [Orabug: 27648355] \n- bnxt: fix bnxt_hwrm_fw_set_time for y2038 (Arnd Bergmann) [Orabug: 27648355] \n- bnxt_en: Fix IRQ coalescing regression. (Michael Chan) [Orabug: 27648355] \n- bnxt_en: fix typo in bnxt_set_coalesce (Andy Gospodarek) [Orabug: 27648355] \n- bnxt_en: Refactor and simplify coalescing code. (Michael Chan) [Orabug: 27648355] \n- bnxt_en: Reorganize the coalescing parameters. (Michael Chan) [Orabug: 27648355] \n- bnxt_en: Add ethtool reset method (Vasundhara Volam) [Orabug: 27648355] \n- bnxt_en: Optimize .ndo_set_mac_address() for VFs. (Michael Chan) [Orabug: 27648355] \n- bnxt_en: Get firmware package version one time. (Michael Chan) [Orabug: 27648355] \n- bnxt_en: Check for zero length value in bnxt_get_nvram_item(). (Michael Chan) [Orabug: 27648355] \n- bnxt_en: adding PCI ID for SMARTNIC VF support (Rob Miller) [Orabug: 27648355] \n- bnxt_en: Add PCIe device ID for bcm58804 (Ray Jui) [Orabug: 27648355] \n- bnxt_en: Update firmware interface to 1.8.3.1 (Michael Chan) [Orabug: 27648355] \n- bnxt_en: Fix possible corruption in DCB parameters from firmware. (Sankar Patchineelam) [Orabug: 27648355] \n- bnxt_en: Fix VF resource checking. (Michael Chan) [Orabug: 27648355] \n- bnxt_en: Fix VF PCIe link speed and width logic. (Vasundhara Volam) [Orabug: 27648355] \n- bnxt_en: Dont use rtnl lock to protect link change logic in workqueue. (Michael Chan) [Orabug: 27648355] \n- bnxt_en: Improve VF/PF link change logic. (Michael Chan) [Orabug: 27648355] \n- bnxt_en: Remove redundant unlikely() (Tobias Klauser) [Orabug: 27648355] \n- drivers: net: bnxt: use setup_timer() helper. (Allen Pais) [Orabug: 27648355] \n- bnxt_en: Reduce default rings on multi-port cards. (Michael Chan) [Orabug: 27648355] \n- bnxt_en: Improve -ENOMEM logic in NAPI poll loop. (Michael Chan) [Orabug: 27648355] \n- bnxt: initialize board_info values with proper enums (Scott Branden) [Orabug: 27648355] \n- bnxt: Add PCIe device IDs for bcm58802/bcm58808 (Ray Jui) [Orabug: 27648355] \n- bnxt_en: assign CPU affinity hints to bnxt_en IRQs (Vasundhara Volam) [Orabug: 27648355] \n- bnxt_en: Improve tx ring reservation logic. (Michael Chan) [Orabug: 27648355] \n- bnxt_en: Update firmware interface spec. to 1.8.1.4. (Michael Chan) [Orabug: 27648355] \n- bnxt_en: Do not setup MAC address in bnxt_hwrm_func_qcaps(). (Michael Chan) [Orabug: 27648355] \n- bnxt_en: Free MSIX vectors when unregistering the device from bnxt_re. (Michael Chan) [Orabug: 27648355] \n- bnxt_en: Fix .ndo_setup_tc() to include XDP rings. (Michael Chan) [Orabug: 27648355] \n- bnxt: fix unused variable warnings (stephen hemminger) [Orabug: 27648355] \n- bnxt: fix unsigned comparsion with 0 (stephen hemminger) [Orabug: 27648355] \n- bnxt_en: Use SWITCHDEV_SET_OPS(). (David S. Miller) [Orabug: 27648355] \n- bnxt_en: Set ETS min_bw parameter for older firmware. (Michael Chan) [Orabug: 27648355] \n- dccp/tcp: fix routing redirect race (Jon Maxwell) [Orabug: 27661864] \n- Revert 'RDS: dont commit to queue till transport connection is up' (Santosh Shilimkar) [Orabug: 27606911] \n- be2net: locking/atomics: COCCINELLE/treewide: Convert trivial ACCESS_ONCE() patterns to READ_ONCE()/WRITE_ONCE() (Mark Rutland) [Orabug: 27615319] \n- be2net: Handle transmit completion errors in Lancer (Suresh Reddy) [Orabug: 27615319] \n- be2net: Fix HW stall issue in Lancer (Suresh Reddy) [Orabug: 27615319] \n- be2net: remove redundant initialization of 'head' and pointer txq (Colin Ian King) [Orabug: 27615319] \n- be2net: networking block comments dont use an empty /* line (Rohit Visavalia) [Orabug: 27615319] \n- be2net: restore properly promisc mode after queues reconfiguration (Ivan Vecera) [Orabug: 27615319] \n- be2net: use ARRAY_SIZE for array sizing calculation on array cmd_priv_map (Colin Ian King) [Orabug: 27615319] \n- RDS: IB: Fix null pointer issue (Guanglei Li) [Orabug: 27636711] \n- xen/acpi: upload _PSD info for non-dom0 CPUs too (Joao Martins) [Orabug: 27655759] \n- scsi: lpfc: Update 11.4.0.7 modified files for 2018 Copyright (James Smart) [Orabug: 27631736] \n- scsi: lpfc: update driver version to 11.4.0.7 (James Smart) [Orabug: 27631736] \n- scsi: lpfc: Treat SCSI Write operation Underruns as an error (James Smart) [Orabug: 27631736] \n- scsi: lpfc: Fix SCSI io host reset causing kernel crash (James Smart) [Orabug: 27631736] \n- scsi: lpfc: Fix issue_lip if link is disabled (James Smart) [Orabug: 27631736] \n- scsi: lpfc: Fix soft lockup in lpfc worker thread during LIP testing (James Smart) [Orabug: 27631736] \n- scsi: lpfc: Allow set of maximum outstanding SCSI cmd limit for a target (James Smart) [Orabug: 27631736] \n- scsi: lpfc: Fix PRLI handling when topology type changes (James Smart) [Orabug: 27631736] \n- scsi: lpfc: fix a couple of minor indentation issues (Colin Ian King) [Orabug: 27631736] \n- scsi: lpfc: update driver version to 11.4.0.6 (James Smart) [Orabug: 27631736] \n- scsi: lpfc: update driver version to 11.4.0.5 (James Smart) [Orabug: 27631736] \n- scsi: lpfc: FLOGI failures are reported when connected to a private loop. (James Smart) [Orabug: 27631736] \n- scsi: lpfc: Fix ndlp ref count for pt2pt mode issue RSCN (James Smart) [Orabug: 27631736] \n- scsi: lpfc: Linux LPFC driver does not process all RSCNs (James Smart) [Orabug: 27631736] \n- scsi: lpfc: Driver fails to detect direct attach storage array (James Smart) [Orabug: 27631736] \n- scsi: lpfc: Fix crash after bad bar setup on driver attachment (James Smart) [Orabug: 27631736] \n- scsi: lpfc: Fix hard lock up NMI in els timeout handling. (Dick Kennedy) [Orabug: 27631736] \n- scsi: lpfc: change version to 11.4.0.4 (Dick Kennedy) [Orabug: 27631736] \n- scsi: lpfc: Extend RDP support (Dick Kennedy) [Orabug: 27631736] \n- scsi: lpfc: Fix secure firmware updates (Dick Kennedy) [Orabug: 27631736] \n- scsi: lpfc: PLOGI failures during NPIV testing (Dick Kennedy) [Orabug: 27631736] \n- scsi: lpfc: Fix crash receiving ELS while detaching driver (Dick Kennedy) [Orabug: 27631736] \n- scsi: lpfc: fix pci hot plug crash in list_add call (Dick Kennedy) [Orabug: 27631736] \n- scsi: lpfc: fix pci hot plug crash in timer management routines (Dick Kennedy) [Orabug: 27631736] \n- scsi: lpfc: remove redundant null check on eqe (Colin Ian King) [Orabug: 27631736] \n- scsi: lpfc: lpfc version bump 11.4.0.3 (Dick Kennedy) [Orabug: 27631736] \n- scsi: lpfc: fix 'integer constant too large' error on 32bit archs (Maurizio Lombardi) [Orabug: 27631736] \n- scsi: lpfc: Add Buffer to Buffer credit recovery support (James Smart) [Orabug: 27631736] \n- scsi: lpfc: Correct issues with FAWWN and FDISCs (Dick Kennedy) [Orabug: 27631736] \n- scsi: lpfc: Fix rediscovery on switch blade pull (Dick Kennedy) [Orabug: 27631736] \n- scsi: lpfc: remove useless code in lpfc_sli4_bsg_link_diag_test (Gustavo A. R. Silva) [Orabug: 27631736] \n- scsi: lpfc: Fix plogi collision that causes illegal state transition (Dick Kennedy) [Orabug: 27631736] \n- lpfc: Fix Express lane queue creation (Maurizio Lombardi) [Orabug: 27631736] \n- Cosmetic updates to arch/x86/kernel/cpu/microcode/xen.c to pass checkpatch.pl and match UEK5 code. (Aaron Young) [Orabug: 27640697] \n- Incorporate arch/x86/kernel/cpu/microcode/xen.c into cpu microcode driver. (Aaron Young) [Orabug: 27640697] \n- 1. Move arch/x86/kernel/microcode_xen.c file to proper cpu microcode driver location and rename to arch/x86/kernel/cpu/microcode/xen.c. (Aaron Young) [Orabug: 27640697] \n- fork: fix incorrect fput of ->exe_file causing use-after-free (Eric Biggers) [Orabug: 27648200] {CVE-2017-17052}\n- scsi: megaraid_sas: Do not use 32-bit atomic request descriptor for Ventura controllers (Shivasharan S) [Orabug: 27625001] \n- scsi: megaraid_sas: NVMe passthrough command support (Shivasharan S) [Orabug: 27625001] \n- scsi: megaraid: use ktime_get_real for firmware time (Arnd Bergmann) [Orabug: 27625001] \n- scsi: megaraid_sas: driver version upgrade (Shivasharan S) [Orabug: 27625001] \n- scsi: megaraid_sas: re-work DCMD refire code (Shivasharan S) [Orabug: 27625001] \n- scsi: megaraid_sas: Expose fw_cmds_outstanding through sysfs (Shivasharan S) [Orabug: 27625001] \n- scsi: megaraid_sas: Selectively apply stream detection based on IO type (Shivasharan S) [Orabug: 27625001] \n- scsi: megaraid_sas: Update LD map after populating drv_map driver map copy (Shivasharan S) [Orabug: 27625001] \n- scsi: megaraid_sas: Use megasas_wait_for_adapter_operational to detect controller state in IOCTL path (Shivasharan S) [Orabug: 27625001] \n- scsi: megaraid_sas: Avoid firing DCMDs while OCR is in progress (Shivasharan S) [Orabug: 27625001] \n- scsi: megaraid_sas: unload flag should be set after scsi_remove_host is called (Shivasharan S) [Orabug: 27625001] \n- scsi: megaraid_sas: Error handling for invalid ldcount provided by firmware in RAID map (Shivasharan S) [Orabug: 27625001] \n- scsi: megaraid_sas: Reset ldio_outstanding in megasas_resume (Sumit Saxena) [Orabug: 27625001] \n- scsi: megaraid_sas: Return the DCMD status from megasas_get_seq_num (Shivasharan S) [Orabug: 27625001] \n- scsi: megaraid_sas: memset IOC INIT frame using correct size (Shivasharan S) [Orabug: 27625001] \n- scsi: megaraid_sas: zero out IOC INIT and stream detection memory (Shivasharan S) [Orabug: 27625001] \n- scsi: megaraid_sas: fix spelling mistake: 'thershold' -> 'threshold' (Colin Ian King) [Orabug: 27625001] \n- scsi: megaraid: Remove redundant code in megasas_alloc_cmds (Yisheng Xie) [Orabug: 27625001] \n- License cleanup: add SPDX GPL-2.0 license identifier to files with no license (Greg Kroah-Hartman) [Orabug: 27625001] \n- scsi: megaraid_sas: driver version upgrade (Shivasharan S) [Orabug: 27625001] \n- scsi: megaraid_sas: Add support for 64bit consistent DMA (Sumit Saxena) [Orabug: 27625001] \n- scsi: megaraid_sas: Do not limit queue_depth to 1k in non-RDPQ mode (Shivasharan S) [Orabug: 27625001] \n- scsi: megaraid_sas: Retry with reduced queue depth when alloc fails for higher QD (Shivasharan S) [Orabug: 27625001] \n- scsi: megaraid_sas: Incorrect processing of IOCTL frames for SMP/STP commands (Shivasharan S) [Orabug: 27625001] \n- scsi: megaraid_sas: Resize MFA frame used for IOC INIT to 4k (Shivasharan S) [Orabug: 27625001] \n- scsi: megaraid_sas: Update current host time to FW during IOC Init (Shivasharan S) [Orabug: 27625001] \n- scsi: megaraid_sas: Move controller memory allocations and DMA mask settings from probe to megasas_init_fw (Sumit Saxena) [Orabug: 27625001] \n- scsi: megaraid_sas: Move initialization of instance parameters inside newly created function megasas_init_ctrl_params (Shivasharan S) [Orabug: 27625001] \n- scsi: megaraid_sas: remove instance->ctrl_info (Sumit Saxena) [Orabug: 27625001] \n- scsi: megaraid_sas: Pre-allocate frequently used DMA buffers (Shivasharan S) [Orabug: 27625001] \n- scsi: megaraid_sas: Create separate functions for allocating and freeing controller DMA buffers (Sumit Saxena) [Orabug: 27625001] \n- scsi: megaraid_sas: Create separate functions to allocate ctrl memory (Shivasharan S) [Orabug: 27625001] \n- scsi: megaraid_sas: reduce size of fusion_context and use kmalloc for allocation (Sumit Saxena) [Orabug: 27625001] \n- scsi: megaraid_sas: replace is_ventura with adapter_type checks (Sumit Saxena) [Orabug: 27625001] \n- scsi: megaraid_sas: Remove redundant checks for ctrl_context (Shivasharan S) [Orabug: 27625001] \n- scsi: megaraid_sas: replace instance->ctrl_context checks with instance->adapter_type (Sumit Saxena) [Orabug: 27625001] \n- scsi: megaraid_sas: Add support for Crusader controllers (Shivasharan S) [Orabug: 27625001] \n- scsi: megaraid_sas: use adapter_type for all gen controllers (Shivasharan S) [Orabug: 27625001] \n- scsi: megaraid_sas: driver version upgrade (Shivasharan S) [Orabug: 27625001] \n- scsi: megaraid_sas: call megasas_dump_frame with correct IO frame size (Shivasharan S) [Orabug: 27625001] \n- scsi: megaraid_sas: modified few prints in OCR and IOC INIT path (Shivasharan S) [Orabug: 27625001] \n- scsi: megaraid_sas: replace internal FALSE/TRUE definitions with false/true (Shivasharan S) [Orabug: 27625001] \n- scsi: megaraid_sas: Return pended IOCTLs with cmd_status MFI_STAT_WRONG_STATE in case adapter is dead (Shivasharan S) [Orabug: 27625001] \n- scsi: megaraid_sas: use vmalloc for crash dump buffers and drivers local RAID map (Shivasharan S) [Orabug: 27625001] \n- scsi: megaraid_sas: Use SMID for Task abort case only (Shivasharan S) [Orabug: 27625001] \n- scsi: megaraid_sas: Check valid aen class range to avoid kernel panic (Shivasharan S) [Orabug: 27625001] \n- scsi: megaraid_sas: Fix endianness issues in DCMD handling (Shivasharan S) [Orabug: 27625001] \n- scsi: megaraid_sas: Do not re-fire shutdown DCMD after OCR (Shivasharan S) [Orabug: 27625001] \n- scsi: megaraid_sas: Call megasas_complete_cmd_dpc_fusion every 1 second while there are pending commands (Shivasharan S) [Orabug: 27625001] \n- scsi: megaraid_sas: Use synchronize_irq in target reset case (Shivasharan S) [Orabug: 27625001] \n- scsi: megaraid_sas: set minimum value of resetwaittime to be 1 secs (Shivasharan S) [Orabug: 27625001] \n- scsi: megaraid_sas: mismatch of allocated MFI frame size and length exposed in MFI MPT pass through command (Shivasharan S) [Orabug: 27625001] \n- scsi: megaraid_sas: fix error handle in megasas_probe_one (weiping zhang) [Orabug: 27625001] \n- scsi: megaraid_sas: fix allocate instance->pd_info twice (weiping) [Orabug: 27625001] \n- scsi: remove DRIVER_ATTR() usage (Greg Kroah-Hartman) [Orabug: 27625001] \n- scsi: megaraid: Replace PCI pool old API (Romain Perier) [Orabug: 27625001] \n- scsi: megaraid_sas: fix memleak in megasas_alloc_cmdlist_fusion (Shu Wang) [Orabug: 27625001] \n- scsi: megaraid: Fix a sleep-in-atomic bug (Jia-Ju Bai) [Orabug: 27625001] \n- drivers/scsi/megaraid: remove expensive inline from megasas_return_cmd (Andi Kleen) [Orabug: 27625001] \n- megaraid_sas: remove redundant code initialzing *pDevHandle with MR_DEVHANDLE_INVALID (Sumit Saxena) [Orabug: 27625001] \n- usb: usbtest: fix NULL pointer dereference (Alan Stern) [Orabug: 27602322] {CVE-2017-16532}\n- rds: Incorrect reference counting in TCP socket creation (Ka-Cheong Poon) [Orabug: 27602824] \n- enic: enable rq before updating rq descriptors (Govindarajulu Varadarajan) [Orabug: 27587345] \n- enic: add sw timestamp support (Govindarajulu Varadarajan) [Orabug: 27587345] \n- enic: add wq clean up budget (Govindarajulu Varadarajan) [Orabug: 27587345] \n- enic: Add support for 'ethtool -g/-G' (Parvi Kaustubhi) [Orabug: 27587345] \n- enic: reset fetch index (Parvi Kaustubhi) [Orabug: 27587345] \n- drivers: net: enic: use setup_timer() helper. (Allen Pais) [Orabug: 27587345] \n- drivers: net: enic: use setup_timer() helper. (Allen Pais) [Orabug: 27587345] \n- enic: update enic maintainers (Govindarajulu Varadarajan) [Orabug: 27587345] \n- cisco: enic: Fic an error handling path in 'vnic_dev_init_devcmd2()' (Christophe Jaillet) [Orabug: 27587345] \n- enic: Fix format truncation warning (Govindarajulu Varadarajan) [Orabug: 27587345] \n- enic: add devcmds for vxlan offload (Govindarajulu Varadarajan) [Orabug: 27587345] \n- enic: increment devcmd2 result ring in case of timeout (Sandeep Pillai) [Orabug: 27587345] \n- scsi: fnic: use kzalloc in fnic_fcoe_process_vlan_resp (Rasmus Villemoes) [Orabug: 27587343] \n- scsi: fnic: add a space after %p in printf format (Nicolas Iooss) [Orabug: 27587343] \n- scsi: fnic: Fix coccinelle warnings (Vasyl Gomonovych) [Orabug: 27587343] \n- scsi: fnic: do not call host reset from command abort (Hannes Reinecke) [Orabug: 27587343] \n- scsi: fnic: fix format string overflow warning (Arnd Bergmann) [Orabug: 27587343] \n- scsi: fnic: correct speed display and add support for 25,40 and 100G (Satish Kharat) [Orabug: 27587343] \n- scsi: fnic: added timestamp reporting in fnic debug stats (Satish Kharat) [Orabug: 27587343] \n- scsi: fnic: Zero io_cmpl_skip on fw reset completion (Satish Kharat) [Orabug: 27587343] \n- scsi: fnic: Ratelimit printks to avoid flooding when vlan is not set by the switch.i (Satish Kharat) [Orabug: 27587343] \n- scsi: fnic: use kernels '%pM' format option to print MAC (Andy Shevchenko) [Orabug: 27587343] \n- fnic: pci_dma_mapping_error() doesnt return an error code (Dan Carpenter) [Orabug: 27587343] \n- fnic: move printk()s outside of the critical code section. (Maurizio Lombardi) [Orabug: 27587343] \n- fnic: check pci_map_single() return value (Maurizio Lombardi) [Orabug: 27587343] \n- retpoline: move setting of sysctl_ibrs_enabled and sysctl_ibpb_enabled to where SPEC_CTRL_IBRS_INUSE and SPEC_CTRL_IBPB_INUSE are set (Chuck Anderson) [Orabug: 27625404] \n- retpoline: set IBRS and IBPB in use only on the boot CPU call to init_scattered_cpuid_features() (Chuck Anderson) [Orabug: 27625404] \n- retpoline: display IBPB feature status along with IBRS status (Chuck Anderson) [Orabug: 27625404] \n- retpoline: move lock/unlock of spec_ctrl_mutex to check_modinfo() (Chuck Anderson) [Orabug: 27625404] \n- retpoline: call clear_retpoline_fallback() with boot parm spectre_v2_heuristics=off (Chuck Anderson) [Orabug: 27625404] \n- retpoline: add brackets to check_ibrs_inuse() and clear_ibpb_inuse() (Chuck Anderson) [Orabug: 27625404] \n- retpoline/module: do not enable IBRS/IPBP if SPEC_CTRL_IBRS_ADMIN_DISABLED/SPEC_CTRL_IBPB_ADMIN_DISABLED is set (Chuck Anderson) [Orabug: 27625353] \n- retpoline: microcode incorrectly reported as broken during early boot (Chuck Anderson) [Orabug: 27625404] \n- retpoline: move lock/unlock of spec_ctrl_mutex into init_scattered_cpuid_features() (Chuck Anderson) [Orabug: 27625404] \n- retpoline/module: fall back to another spectre mitigation when disabling retpoline (Chuck Anderson) [Orabug: 27457549] \n- retpoline/module: add bit defs for use_ibpb (Chuck Anderson) [Orabug: 27457549] \n- x86/spectre_v2: Fix the documentation to say the right thing. (Konrad Rzeszutek Wilk) \n- x86/spectre_v2: Dont check bad microcode versions when running under hypervisors. (Konrad Rzeszutek Wilk) [Orabug: 27601736] \n- x86/speculation: Use IBRS if available before calling into firmware (David Woodhouse) [Orabug: 27516477] \n- Revert 'x86/spec_ctrl: Add 'nolfence' knob to disable fallback for spectre_v2 mitigation' (Konrad Rzeszutek Wilk) [Orabug: 27601789] \n- Revert 'x86/spec: Add 'lfence_enabled' in sysfs' (Konrad Rzeszutek Wilk) \n- KVM: Disable irq while unregistering user notifier (Ignacio Alvarado) \n- dtrace: increase instruction limit for FBT entry probe detection (Kris Van Hees) [Orabug: 27410742]\n[4.1.12-124.5.1]\n- trace: declare blk_add_trace_rq non-static on OL6 (Todd Vierling) [Orabug: 27578618] \n- x86/ia32/syscall: RESTORE_EXTRA_REGS when returning from syscall (Ankur Arora) [Orabug: 27461990] {CVE-2017-5715}\n- x86/ia32/syscall: dont do RESTORE_EXTRA_REGS prematurely (Ankur Arora) [Orabug: 27461990] {CVE-2017-5715}\n- firmware: dmi_scan: add SBMIOS entry and DMI tables (Ivan Khoronzhuk) [Orabug: 27586223] \n- uek-rpm: enable USERFAULTFD in debug kernels (UEK4 QU7) (Mike Kravetz) [Orabug: 27579702] \n- vmxnet3: repair memory leak (Neil Horman) [Orabug: 27479086] \n- bonding: attempt to better support longer hw addresses (Jarod Wilson) [Orabug: 27542370] \n- scsi: Make __scsi_remove_device go straight from BLOCKED to DEL (Bart Van Assche) [Orabug: 27546768] \n- scsi: Protect SCSI device state changes with a mutex (Bart Van Assche) [Orabug: 27546768] \n- scsi: Introduce scsi_start_queue() (Bart Van Assche) [Orabug: 27546768] \n- scsi: avoid a permanent stop of the scsi devices request queue (Wei Fang) [Orabug: 27546768] \n- IB/ipoib: ioctls IPOIBACLNADD and IPOIBACLNGET do not work correctly (Ka-Cheong Poon) [Orabug: 27533123] \n- x86/spectre: move microcode check before kernel ibrs flags are set (Daniel Jordan) [Orabug: 27542331] {CVE-2017-5715}\n[4.1.12-124.4.1]\n- x86: make HAVE_FENTRY dependent on !SIMULATE_GCC44_KABI (Todd Vierling) [Orabug: 27540463] \n- x86/spectre_v2: Only use IBRS when ibrs_inuse tells us to (Konrad Rzeszutek Wilk) \n- kernel: on OL6 only, simulate the gcc 4.4 kABI for __stack_chk_fail() (Todd Vierling) [Orabug: 27509351] \n- uek-rpm: configs: Dont set HAVE_FENTRY on OL6 builds. (Todd Vierling) [Orabug: 27509351] \n- KVM/VMX: Allow direct access to MSR_IA32_SPEC_CTRL (KarimAllah Ahmed) [Orabug: 27525575] \n- x86/spectre_v2: Disable IBRS if spectre_v2=off (Konrad Rzeszutek Wilk) \n- xenbus: track caller request id (Joao Martins) [Orabug: 27472576] \n- x86/spectre_v2: Remove 0xc2 from spectre_bad_microcodes (Darren Kenny) [Orabug: 27523393] \n- x86/speculation: Use Indirect Branch Prediction Barrier in context switch (Tim Chen) [Orabug: 27524608] \n- Fix typo IBRS_ATT, which should be IBRS_ALL (redux) (Konrad Rzeszutek Wilk) [Orabug: 27477743] {CVE-2017-5715}\n- x86/spectre_v2: Add spectre_v2_heuristics= (Konrad Rzeszutek Wilk) [Orabug: 27477743] {CVE-2017-5715}\n- x86/spectre_v2: Do not disable IBPB when disabling IBRS (Konrad Rzeszutek Wilk) [Orabug: 27477743] {CVE-2017-5715}\n- x86/scattered: Fix the order. (Konrad Rzeszutek Wilk) [Orabug: 27477743] {CVE-2017-5715}\n- x86/spectre: Favor IBRS on Skylake over retpoline (Konrad Rzeszutek Wilk) [Orabug: 27477743] {CVE-2017-5715}\n- x86/speculation: Fix typo IBRS_ATT, which should be IBRS_ALL (Darren Kenny) [Orabug: 27477743] {CVE-2017-5715}\n- x86/spectre: Now that we expose 'stbibp' make sure it is correct. (Konrad Rzeszutek Wilk) [Orabug: 27477743] {CVE-2017-5715}\n- x86/cpufeatures: Clean up Spectre v2 related CPUID flags (David Woodhouse) [Orabug: 27477743] {CVE-2017-5715}\n- x86/speculation: Add basic IBPB (Indirect Branch Prediction Barrier) support (David Woodhouse) [Orabug: 27477743] {CVE-2017-5715}\n- x86/bugs: Drop one 'mitigation' from dmesg (Borislav Petkov) [Orabug: 27477743] {CVE-2017-5715}\n- x86/nospec: Fix header guards names (Borislav Petkov) [Orabug: 27477743] {CVE-2017-5715}\n- x86/spectre_v2: Dont spam the console with these: (Konrad Rzeszutek Wilk) [Orabug: 27477743] {CVE-2017-5715}\n- x86/cpufeature: Blacklist SPEC_CTRL/PRED_CMD on early Spectre v2 microcodes (David Woodhouse) [Orabug: 27477743] {CVE-2017-5715}\n- x86/cpu: Keep model defines sorted by model number (Andy Shevchenko) [Orabug: 27477743] {CVE-2017-5715}\n- x86/pti: Do not enable PTI on CPUs which are not vulnerable to Meltdown (David Woodhouse) [Orabug: 27477743] {CVE-2017-5715}\n- x86/msr: Add definitions for new speculation control MSRs (David Woodhouse) [Orabug: 27477743] {CVE-2017-5715}\n- x86/cpufeatures: Add AMD feature bits for Speculation Control (David Woodhouse) [Orabug: 27477743] {CVE-2017-5715}\n- x86/spectre_v2: Print what options are available. (Konrad Rzeszutek Wilk) [Orabug: 27477743] {CVE-2017-5715}\n- x86/spectre_v2: Add VMEXIT_FILL_RSB instead of RETPOLINE (Konrad Rzeszutek Wilk) [Orabug: 27477743] {CVE-2017-5715}\n- x86/spectre: If IBRS is enabled disable 'Filling RSB on context switch' (Konrad Rzeszutek Wilk) [Orabug: 27477743] {CVE-2017-5715}\n- KVM: VMX: Allow direct access to MSR_IA32_SPEC_CTRL (Konrad Rzeszutek Wilk) [Orabug: 27477743] {CVE-2017-5715}\n- x86/spectre_v2: Dont allow {ibrs,ipbp,lfence}_enabled to be toggled if retpoline (Konrad Rzeszutek Wilk) [Orabug: 27477743] {CVE-2017-5715}\n- x86/spectre: Fix retpoline_enabled (Konrad Rzeszutek Wilk) [Orabug: 27477743] {CVE-2017-5715}\n- x86/spectre: Update sysctl values if toggled only by set_{ibrs,ibpb}_disabled (Konrad Rzeszutek Wilk) [Orabug: 27477743] {CVE-2017-5715}\n- retpoline/module: Taint kernel for missing retpoline in module (Andi Kleen) [Orabug: 27477743] {CVE-2017-5715}\n- x86/retpoline: Fill RSB on context switch for affected CPUs (David Woodhouse) [Orabug: 27477743] {CVE-2017-5715}\n- x86/retpoline: Optimize inline assembler for vmexit_fill_RSB (Andi Kleen) [Orabug: 27477743] {CVE-2017-5715}\n- kprobes/x86: Disable optimizing on the function jumps to indirect thunk (Masami Hiramatsu) [Orabug: 27477743] {CVE-2017-5715}\n- kprobes/x86: Blacklist indirect thunk functions for kprobes (Masami Hiramatsu) [Orabug: 27477743] {CVE-2017-5715}\n- retpoline: Introduce start/end markers of indirect thunk (Masami Hiramatsu) [Orabug: 27477743] {CVE-2017-5715}\n- x86/mce: Make machine check speculation protected (Thomas Gleixner) [Orabug: 27477743] {CVE-2017-5715}\n- kbuild: modversions for EXPORT_SYMBOL() for asm (Nicholas Piggin) [Orabug: 27477743] {CVE-2017-5715}\n- x86/retpoline: Add LFENCE to the retpoline/RSB filling RSB macros (Tom Lendacky) [Orabug: 27477743] {CVE-2017-5715}\n- x86/retpoline: Remove compile time warning (Thomas Gleixner) [Orabug: 27477743] {CVE-2017-5715}\n- x86/retpoline: Fill return stack buffer on vmexit (David Woodhouse) [Orabug: 27477743] {CVE-2017-5715}\n- x86/retpoline/irq32: Convert assembler indirect jumps (Andi Kleen) [Orabug: 27477743] {CVE-2017-5715}\n- x86/retpoline/checksum32: Convert assembler indirect jumps (David Woodhouse) [Orabug: 27477743] {CVE-2017-5715}\n- x86/retpoline/xen: Convert Xen hypercall indirect jumps (David Woodhouse) [Orabug: 27477743] {CVE-2017-5715}\n- x86/retpoline/hyperv: Convert assembler indirect jumps (David Woodhouse) [Orabug: 27477743] {CVE-2017-5715}\n- x86/retpoline/ftrace: Convert ftrace assembler indirect jumps (David Woodhouse) [Orabug: 27477743] {CVE-2017-5715}\n- x86/retpoline/entry: Convert entry assembler indirect jumps (David Woodhouse) [Orabug: 27477743] {CVE-2017-5715}\n- x86/retpoline/crypto: Convert crypto assembler indirect jumps (David Woodhouse) [Orabug: 27477743] {CVE-2017-5715}\n- x86/spectre_v2: Add disable_ibrs_and_friends (Konrad Rzeszutek Wilk) [Orabug: 27477743] {CVE-2017-5715}\n- x86/spectre_v2: Figure out if STUFF_RSB macro needs to be used. (Konrad Rzeszutek Wilk) [Orabug: 27477743] {CVE-2017-5715}\n- x86/spectre_v2: Figure out when to use IBRS. (Konrad Rzeszutek Wilk) [Orabug: 27477743] {CVE-2017-5715}\n- x86/spectre: Add IBRS option. (Konrad Rzeszutek Wilk) [Orabug: 27477743] {CVE-2017-5715}\n- x86/spectre: Add boot time option to select Spectre v2 mitigation (David Woodhouse) [Orabug: 27477743] {CVE-2017-5715}\n- x86/retpoline: Add initial retpoline support (David Woodhouse) [Orabug: 27477743] {CVE-2017-5715}\n- kconfig.h: use __is_defined() to check if MODULE is defined (Masahiro Yamada) [Orabug: 27477743] {CVE-2017-5715}\n- EXPORT_SYMBOL() for asm (Al Viro) [Orabug: 27477743] {CVE-2017-5715}\n- x86/asm: Make asm/alternative.h safe from assembly (Andy Lutomirski) [Orabug: 27477743] {CVE-2017-5715}\n- x86/kbuild: enable modversions for symbols exported from asm (Adam Borowski) [Orabug: 27477743] {CVE-2017-5715}\n- x86/asm: Use register variable to get stack pointer value (Andrey Ryabinin) [Orabug: 27477743] {CVE-2017-5715}\n- x86/mm/32: Move setup_clear_cpu_cap(X86_FEATURE_PCID) earlier (Andy Lutomirski) [Orabug: 27477743] {CVE-2017-5715}\n- x86/alternatives: Add missing '\n' at end of ALTERNATIVE inline asm (David Woodhouse) [Orabug: 27477743] {CVE-2017-5715}\n- x86/alternatives: Fix optimize_nops() checking (Borislav Petkov) [Orabug: 27477743] {CVE-2017-5715}\n- block: Check for gaps on front and back merges (Jens Axboe) [Orabug: 27484719] \n- block: Copy a user iovec if it includes gaps (Sagi Grimberg) [Orabug: 27484719] \n- block: Replace SG_GAPS with new queue limits mask (Keith Busch) [Orabug: 27484719] \n- Revert 'block: Copy a user iovec if it includes gaps' (Ashok Vairavan) [Orabug: 27484719] \n- Revert 'block: Check for gaps on front and back merges' (Ashok Vairavan) [Orabug: 27484719] \n- Revert 'blk: [Partial] Replace SG_GAPGS with new queue limits mask' (Ashok Vairavan) [Orabug: 27484719] \n- qlcnic: fix deadlock bug (Junxiao Bi) [Orabug: 27496907] \n- x86/entry: RESTORE_IBRS needs to be done under kernel CR3 (Ankur Arora) [Orabug: 27501734]\n[4.1.12-124.3.1]\n- rds: Fix NULL pointer dereference in __rds_rdma_map (Hakon Bugge) [Orabug: 27477010] \n- Btrfs: fix unexpected EEXIST from btrfs_get_extent (Liu Bo) [Orabug: 27446668] \n- Btrfs: fix incorrect block_len in merge_extent_mapping (Liu Bo) [Orabug: 27446668] \n- Btrfs: add WARN_ONCE to detect unexpected error from merge_extent_mapping (Liu Bo) [Orabug: 27446668] \n- Btrfs: deal with existing encompassing extent map in btrfs_get_extent() (Omar Sandoval) [Orabug: 27446668] \n- Btrfs: deal with duplciates during extent_map insertion in btrfs_get_extent (Chris Mason) [Orabug: 27446668] \n- x86/spec: Fix spectre_v1 bug and mitigation indicators (John Haxby) [Orabug: 27470687] \n- Drivers: hv: util: Backup: Fix a rescind processing issue (K. Y. Srinivasan) [Orabug: 27426063] \n- Drivers: hv: vss: Operation timeouts should match host expectation (Alex Ng) [Orabug: 27426063] \n- Drivers: hv: vss: Improve log messages. (Alex Ng) [Orabug: 27426063] \n- Drivers: hv: utils: Check VSS daemon is listening before a hot backup (Alex Ng) [Orabug: 27426063] \n- Drivers: hv: utils: Continue to poll VSS channel after handling requests. (Alex Ng) [Orabug: 27426063] \n- Drivers: hv: utils: fix a race on userspace daemons registration (Vitaly Kuznetsov) [Orabug: 27426063] \n- Drivers: hv: util: catch allocation errors (Olaf Hering) [Orabug: 27426063] \n- Drivers: hv: vss: run only on supported host versions (Olaf Hering) [Orabug: 27426063] \n- Drivers: hv: utils: unify driver registration reporting (Vitaly Kuznetsov) [Orabug: 27426063] \n- drivers/char/mem.c: deny access in open operation when securelevel is set (Ethan Zhao) [Orabug: 26943864] [Orabug: 27465736] \n- rds: Calling getsockname() on unbounded socket generates seg fault (Ka-Cheong Poon) [Orabug: 27463484] \n- rds: Second bind() can overwrite the first bind() (Ka-Cheong Poon) [Orabug: 27463500] \n- rds: Un-connected socket sendmsg() with a NULL destination does not fail (Ka-Cheong Poon) [Orabug: 27463507] \n- x86/mitigation/spectre_v2: Add reporting of 'lfence' (Konrad Rzeszutek Wilk) \n- x86/spec: Add 'lfence_enabled' in sysfs (Konrad Rzeszutek Wilk) \n- x86/spec_ctrl: Add 'nolfence' knob to disable fallback for spectre_v2 mitigation (Konrad Rzeszutek Wilk) \n- x86: Fix compile issues if CONFIG_XEN not defined (Konrad Rzeszutek Wilk) \n- hugetlb: fix nr_pmds accounting with shared page tables (Kirill A. Shutemov) [Orabug: 27451809] \n- net/mlx4_core: allow QPs with enable_smi_admin enabled (Zhu Yanjun) [Orabug: 27452072] \n- net/rds: Fix incorrect error handling (Hakon Bugge) [Orabug: 27469760]\n[4.1.12-124.2.1]\n- x86: Move STUFF_RSB in to the idt macro (Konrad Rzeszutek Wilk) \n- x86/spectre: Drop the warning about ibrs being obsolete. (Konrad Rzeszutek Wilk) \n- x86/spec: STUFF_RSB _before_ ENABLE_IBRS (Konrad Rzeszutek Wilk) \n- x86/spec: Dont print the Missing arguments for option spectre_v2. (Konrad Rzeszutek Wilk) \n- x86: Move ENABLE_IBRS in the interrupt macro. (Konrad Rzeszutek Wilk) \n- x86/IBRS: Dont try to change IBRS mode if IBRS is not available (Boris Ostrovsky) [Orabug: 27448280] \n- x86/IBRS: Remove support for IBRS_ENABLED_USER mode (Boris Ostrovsky) [Orabug: 27448280] \n- x86: Use PRED_CMD MSR when ibpb is enabled (Konrad Rzeszutek Wilk) \n- x86/IBRS: Drop unnecessary WRITE_ONCE (Boris Ostrovsky) [Orabug: 27448280] \n- x86/IBRS/IBPB: Remove procfs interface to ibrs/ibpb_enable (Boris Ostrovsky) [Orabug: 27448280] \n- x86/IBPB: Provide debugfs interface for changing IBPB mode (Boris Ostrovsky) [Orabug: 27448313] \n- x86/spec: Also print IBRS if IBPB is disabled. (Konrad Rzeszutek Wilk) \n- x86: Include linux/device.h in bugs_64.c (Boris Ostrovsky) [Orabug: 27448330] \n- fs/ocfs2: remove page cache for converted direct write (Wengang Wang) \n- Revert 'ocfs2: code clean up for direct io' (Wengang Wang) \n- mlx4: add mstflint secure boot access kernel support (Qing Huang) [Orabug: 27424392] \n- x86/microcode/intel: Extend BDW late-loading with a revision check (Jia Zhang) [Orabug: 27343609] \n- x86/microcode/intel: Disable late loading on model 79 (Borislav Petkov) [Orabug: 27343609] \n- autofs: use dentry flags to block walks during expire (Ian Kent) [Orabug: 26032471] \n- autofs races (Al Viro) [Orabug: 26032471] \n- Revert 'kernel.spec: Require the new microcode_ctl.' (Brian Maly)\n[4.1.12-124.1.1]\n- dtrace: revive dtrace_gethrtime() (Tomas Jedlicka) [Orabug: 27409933]\n[4.1.12-124]\n- x86: Clean up IBRS functionality resident in common code (Kanth Ghatraju) [Orabug: 27353383] \n- x86: Display correct settings for the SPECTRE_V2 bug (Kanth Ghatraju) [Orabug: 27353383] \n- Set CONFIG_GENERIC_CPU_VULNERABILITIES flag (Kanth Ghatraju) [Orabug: 27353383] \n- x86/cpu: Implement CPU vulnerabilites sysfs functions (Thomas Gleixner) [Orabug: 27353383] \n- sysfs/cpu: Fix typos in vulnerability documentation (David Woodhouse) [Orabug: 27353383] \n- sysfs/cpu: Add vulnerability folder (Thomas Gleixner) [Orabug: 27353383] \n- x86/cpufeatures: Add X86_BUG_SPECTRE_V[12] (David Woodhouse) [Orabug: 27353383] \n- x86/cpufeatures: Add X86_BUG_CPU_MELTDOWN (Kanth Ghatraju) [Orabug: 27353383] \n- KVM: x86: Add memory barrier on vmcs field lookup (Andrew Honig) {CVE-2017-5753}\n- KVM: VMX: remove I/O port 0x80 bypass on Intel hosts (Andrew Honig) [Orabug: 27206805] {CVE-2017-1000407} {CVE-2017-1000407}\n- ixgbevf: handle mbox_api_13 in ixgbevf_change_mtu (Joao Martins) [Orabug: 27397028] \n- xen-blkback: add pending_req allocation stats (Ankur Arora) [Orabug: 26670475] \n- xen-blkback: move indirect req allocation out-of-line (Ankur Arora) [Orabug: 26670475] \n- xen-blkback: pull nseg validation out in a function (Ankur Arora) [Orabug: 26670475] \n- xen-blkback: make struct pending_req less monolithic (Ankur Arora) [Orabug: 26670475] \n- x86/fpu: Dont let userspace set bogus xcomp_bv (Tim Tianyang Chen) [Orabug: 27050688] {CVE-2017-15537}\n- sctp: do not peel off an assoc from one netns to another one (Xin Long) [Orabug: 27386997] {CVE-2017-15115}\n- media: dib0700: fix invalid dvb_detach argument (Andrey Konovalov) [Orabug: 27215141] {CVE-2017-16646}\n- Sanitize 'move_pages()' permission checks (Linus Torvalds) [Orabug: 27364683] {CVE-2017-14140}\n- assoc_array: Fix a buggy node-splitting case (David Howells) [Orabug: 27364588] {CVE-2017-12193} {CVE-2017-12193}\n- net: ipv4: fix for a race condition in raw_sendmsg (Mohamed Ghannam) [Orabug: 27390679] {CVE-2017-17712}\n[4.1.12-123]\n- x86/pti/efi: broken conversion from efi to kernel page table (Pavel Tatashin) [Orabug: 27378516] [Orabug: 27333760] {CVE-2017-5754}\n- x86/spec: Always set IBRS to guest value on VMENTER and host on VMEXIT (redux) (Konrad Rzeszutek Wilk) [Orabug: 27378451] \n- x86/IBRS: Make sure we restore MSR_IA32_SPEC_CTRL to a valid value (Boris Ostrovsky) [Orabug: 27378102] \n- x86/IBRS/IBPB: Set sysctl_ibrs/ibpb_enabled properly (Boris Ostrovsky) [Orabug: 27382723] \n- x86/spec_ctrl: Add missing 'lfence' when IBRS is not supported. (Konrad Rzeszutek Wilk) [Orabug: 27344012] {CVE-2017-5715}\n- x86/entry_64: TRACE_IRQS_OFF before re-enabling. (Jamie Iles) [Orabug: 27344012] {CVE-2017-5715}\n- ptrace: remove unlocked RCU dereference. (Jamie Iles) [Orabug: 27344012] {CVE-2017-5715}\n- x86/ia32: Adds code hygiene for 32bit SYSCALL instruction entry. (Konrad Rzeszutek Wilk) [Orabug: 27344012] {CVE-2017-5715}\n- x86/ia32: dont save registers on audit call (Konrad Rzeszutek Wilk) [Orabug: 27344012] {CVE-2017-5715}\n- x86/spec/ia32: Sprinkle IBRS and RSB at the 32-bit SYSCALL (Konrad Rzeszutek Wilk) [Orabug: 27344012] {CVE-2017-5715}\n- x86/ia32: Move STUFF_RSB And ENABLE_IBRS (Konrad Rzeszutek Wilk) [Orabug: 27344012] {CVE-2017-5715}\n- x86/spec: Always set IBRS to guest value on VMENTER and host on VMEXIT. (Konrad Rzeszutek Wilk) [Orabug: 27365575] {CVE-2017-5715}\n- x86/ia32: save and clear registers on syscall. (Jamie Iles) [Orabug: 27365431] {CVE-2017-5754}\n- x86/IBRS: Save current status of MSR_IA32_SPEC_CTRL (Boris Ostrovsky) [Orabug: 27365419] \n- pti: Rename X86_FEATURE_KAISER to X86_FEATURE_PTI (Pavel Tatashin) [Orabug: 27333760] {CVE-2017-5754}\n- x86/spec_ctrl: Add missing IBRS_DISABLE (Konrad Rzeszutek Wilk) [Orabug: 27365403] \n- Make use of ibrs_inuse consistent. (Jun Nakajima) [Orabug: 27365390] \n- x86/kvm: Set IBRS on VMEXIT if guest disabled it. (Konrad Rzeszutek Wilk) [Orabug: 27364900] \n- Re-introduce clearing of r12-15, rbp, rbx (Kris Van Hees) [Orabug: 27344012] {CVE-2017-5715}\n- x86: more ibrs/pti fixes (Pavel Tatashin) [Orabug: 27333760] {CVE-2017-5754}\n- x86/spec: Actually do the check for in_use on ENABLE_IBRS (Konrad Rzeszutek Wilk) [Orabug: 27344012] {CVE-2017-5715}\n- kvm: svm: Expose the CPUID.0x80000008 ebx flag. (Konrad Rzeszutek Wilk) [Orabug: 27344012] {CVE-2017-5715}\n- x86/spec_ctrl: Provide the sysfs version of the ibrs_enabled (Konrad Rzeszutek Wilk) [Orabug: 27344012] {CVE-2017-5715}\n- x86: Use better #define for FEATURE_ENABLE_IBRS and 0 (Konrad Rzeszutek Wilk) [Orabug: 27344012] {CVE-2017-5715}\n- x86: Instead of 0x2, 0x4, and 0x1 use #defines. (Konrad Rzeszutek Wilk) [Orabug: 27344012] {CVE-2017-5715}\n- kpti: Disable when running under Xen PV (Konrad Rzeszutek Wilk) [Orabug: 27333760] {CVE-2017-5754}\n- x86: Dont ENABLE_IBRS in nmi when we are still running on user cr3 (Konrad Rzeszutek Wilk) [Orabug: 27344012] {CVE-2017-5715}\n- x86/enter: Use IBRS on syscall and interrupts - fix ia32 path (Konrad Rzeszutek Wilk) [Orabug: 27344012] {CVE-2017-5715}\n- x86: Fix spectre/kpti integration (Konrad Rzeszutek Wilk) [Orabug: 27333760] {CVE-2017-5754}\n- PTI: unbreak EFI old_memmap (Jiri Kosina) [Orabug: 27333760] {CVE-2017-5754}\n- KAISER KABI tweaks. (Martin K. Petersen) [Orabug: 27333760] {CVE-2017-5754}\n- x86/ldt: fix crash in ldt freeing. (Jamie Iles) [Orabug: 27333760] {CVE-2017-5754}\n- x86/entry: Define 'cpu_current_top_of_stack' for 64-bit code (Denys Vlasenko) [Orabug: 27333760] {CVE-2017-5754}\n- x86/entry: Remove unused 'kernel_stack' per-cpu variable (Denys Vlasenko) [Orabug: 27333760] {CVE-2017-5754}\n- x86/entry: Stop using PER_CPU_VAR(kernel_stack) (Denys Vlasenko) [Orabug: 27333760] {CVE-2017-5754}\n- kaiser: Set _PAGE_NX only if supported (Guenter Roeck) [Orabug: 27333760] {CVE-2017-5754}\n- x86/vdso: Get pvclock data from the vvar VMA instead of the fixmap (Andy Lutomirski) [Orabug: 27333760] {CVE-2017-5754}\n- KPTI: Report when enabled (Kees Cook) [Orabug: 27333760] {CVE-2017-5754}\n- KPTI: Rename to PAGE_TABLE_ISOLATION (Kees Cook) [Orabug: 27333760] {CVE-2017-5754}\n- x86/kaiser: Move feature detection up (Borislav Petkov) [Orabug: 27333760] {CVE-2017-5754}\n- x86/kaiser: Reenable PARAVIRT (Borislav Petkov) [Orabug: 27333760] {CVE-2017-5754}\n- x86/paravirt: Dont patch flush_tlb_single (Thomas Gleixner) [Orabug: 27333760] {CVE-2017-5754}\n- kaiser: kaiser_flush_tlb_on_return_to_user() check PCID (Hugh Dickins) [Orabug: 27333760] {CVE-2017-5754}\n- kaiser: asm/tlbflush.h handle noPGE at lower level (Hugh Dickins) [Orabug: 27333760] {CVE-2017-5754}\n- kaiser: drop is_atomic arg to kaiser_pagetable_walk() (Hugh Dickins) [Orabug: 27333760] {CVE-2017-5754}\n- kaiser: use ALTERNATIVE instead of x86_cr3_pcid_noflush (Hugh Dickins) [Orabug: 27333760] {CVE-2017-5754}\n- x86/kaiser: Check boottime cmdline params (Borislav Petkov) [Orabug: 27333760] {CVE-2017-5754}\n- x86/kaiser: Rename and simplify X86_FEATURE_KAISER handling (Borislav Petkov) [Orabug: 27333760] {CVE-2017-5754}\n- kaiser: add 'nokaiser' boot option, using ALTERNATIVE (Hugh Dickins) [Orabug: 27333760] {CVE-2017-5754}\n- kaiser: fix unlikely error in alloc_ldt_struct() (Hugh Dickins) [Orabug: 27333760] {CVE-2017-5754}\n- kaiser: _pgd_alloc() without __GFP_REPEAT to avoid stalls (Hugh Dickins) [Orabug: 27333760] {CVE-2017-5754}\n- kaiser: paranoid_entry pass cr3 need to paranoid_exit (Hugh Dickins) [Orabug: 27333760] {CVE-2017-5754}\n- kaiser: x86_cr3_pcid_noflush and x86_cr3_pcid_user (Hugh Dickins) [Orabug: 27333760] {CVE-2017-5754}\n- kaiser: PCID 0 for kernel and 128 for user (Hugh Dickins) [Orabug: 27333760] {CVE-2017-5754}\n- kaiser: load_new_mm_cr3() let SWITCH_USER_CR3 flush user (Hugh Dickins) [Orabug: 27333760] {CVE-2017-5754}\n- kaiser: enhanced by kernel and user PCIDs (Dave Hansen) [Orabug: 27333760] {CVE-2017-5754}\n- kaiser: vmstat show NR_KAISERTABLE as nr_overhead (Hugh Dickins) [Orabug: 27333760] {CVE-2017-5754}\n- kaiser: delete KAISER_REAL_SWITCH option (Hugh Dickins) [Orabug: 27333760] {CVE-2017-5754}\n- kaiser: name that 0x1000 KAISER_SHADOW_PGD_OFFSET (Hugh Dickins) [Orabug: 27333760] {CVE-2017-5754}\n- kaiser: cleanups while trying for gold link (Hugh Dickins) [Orabug: 27333760] {CVE-2017-5754}\n- kaiser: kaiser_remove_mapping() move along the pgd (Hugh Dickins) [Orabug: 27333760] {CVE-2017-5754}\n- kaiser: tidied up kaiser_add/remove_mapping slightly (Hugh Dickins) [Orabug: 27333760] {CVE-2017-5754}\n- kaiser: tidied up asm/kaiser.h somewhat (Hugh Dickins) [Orabug: 27333760] {CVE-2017-5754}\n- kaiser: ENOMEM if kaiser_pagetable_walk() NULL (Hugh Dickins) [Orabug: 27333760] {CVE-2017-5754}\n- kaiser: fix perf crashes (Hugh Dickins) [Orabug: 27333760] {CVE-2017-5754}\n- kaiser: fix regs to do_nmi() ifndef CONFIG_KAISER (Hugh Dickins) [Orabug: 27333760] {CVE-2017-5754}\n- kaiser: KAISER depends on SMP (Hugh Dickins) [Orabug: 27333760] {CVE-2017-5754}\n- kaiser: fix build and FIXME in alloc_ldt_struct() (Hugh Dickins) [Orabug: 27333760] {CVE-2017-5754}\n- kaiser: stack map PAGE_SIZE at THREAD_SIZE-PAGE_SIZE (Hugh Dickins) [Orabug: 27333760] {CVE-2017-5754}\n- kaiser: do not set _PAGE_NX on pgd_none (Hugh Dickins) [Orabug: 27333760] {CVE-2017-5754}\n- kaiser: merged update (Dave Hansen) [Orabug: 27333760] {CVE-2017-5754}\n- KAISER: Kernel Address Isolation (Richard Fellner) [Orabug: 27333760] {CVE-2017-5754}\n- x86/boot: Add early cmdline parsing for options with arguments (Tom Lendacky) [Orabug: 27333760] {CVE-2017-5754}\n- x86/mm/64: Fix reboot interaction with CR4.PCIDE (Andy Lutomirski) [Orabug: 27333760] {CVE-2017-5754}\n- x86/mm: Enable CR4.PCIDE on supported systems (Andy Lutomirski) [Orabug: 27333760] {CVE-2017-5754}\n- x86/mm: Add the 'nopcid' boot option to turn off PCID (Andy Lutomirski) [Orabug: 27333760] {CVE-2017-5754}\n- x86/mm: Disable PCID on 32-bit kernels (Andy Lutomirski) [Orabug: 27333760] {CVE-2017-5754}\n- x86/mm: Remove the UP asm/tlbflush.h code, always use the (formerly) SMP code (Andy Lutomirski) [Orabug: 27333760] {CVE-2017-5754}\n- x86/mm: Reimplement flush_tlb_page() using flush_tlb_mm_range() (Andy Lutomirski) [Orabug: 27333760] {CVE-2017-5754}\n- x86/mm: Make flush_tlb_mm_range() more predictable (Andy Lutomirski) [Orabug: 27333760] {CVE-2017-5754}\n- x86/mm: Remove flush_tlb() and flush_tlb_current_task() (Andy Lutomirski) [Orabug: 27333760] {CVE-2017-5754}\n- x86/vm86/32: Switch to flush_tlb_mm_range() in mark_screen_rdonly() (Andy Lutomirski) [Orabug: 27333760] {CVE-2017-5754}\n- x86/irq: Do not substract irq_tlb_count from irq_call_count (Aaron Lu) [Orabug: 27333760] {CVE-2017-5754}\n- sched/core: Idle_task_exit() shouldnt use switch_mm_irqs_off() (Andy Lutomirski) [Orabug: 27333760] {CVE-2017-5754}\n- ARM: Hide finish_arch_post_lock_switch() from modules (Steven Rostedt) [Orabug: 27333760] {CVE-2017-5754}\n- x86/mm, sched/core: Turn off IRQs in switch_mm() (Andy Lutomirski) [Orabug: 27333760] {CVE-2017-5754}\n- x86/mm, sched/core: Uninline switch_mm() (Andy Lutomirski) [Orabug: 27333760] {CVE-2017-5754}\n- x86/mm: Build arch/x86/mm/tlb.c even on !SMP (Andy Lutomirski) [Orabug: 27333760] {CVE-2017-5754}\n- sched/core: Add switch_mm_irqs_off() and use it in the scheduler (Andy Lutomirski) [Orabug: 27333760] {CVE-2017-5754}\n- mm/mmu_context, sched/core: Fix mmu_context.h assumption (Ingo Molnar) [Orabug: 27333760] {CVE-2017-5754}\n- x86/mm: If INVPCID is available, use it to flush global mappings (Andy Lutomirski) [Orabug: 27333760] {CVE-2017-5754}\n- x86/mm: Add a 'noinvpcid' boot option to turn off INVPCID (Andy Lutomirski) [Orabug: 27333760] {CVE-2017-5754}\n- x86/mm: Fix INVPCID asm constraint (Borislav Petkov) [Orabug: 27333760] {CVE-2017-5754}\n- x86/mm: Add INVPCID helpers (Andy Lutomirski) [Orabug: 27333760] {CVE-2017-5754}\n- x86/ibrs: Remove 'ibrs_dump' and remove the pr_debug (Konrad Rzeszutek Wilk) [Orabug: 27351274] \n- kABI: Revert kABI: Make the boot_cpu_data look normal (Konrad Rzeszutek Wilk) [Orabug: 27344012] {CVE-2017-5715}\n- userns: prevent speculative execution (Elena Reshetova) [Orabug: 27340445] {CVE-2017-5753}\n- udf: prevent speculative execution (Elena Reshetova) [Orabug: 27340445] {CVE-2017-5753}\n- net: mpls: prevent speculative execution (Elena Reshetova) [Orabug: 27340445] {CVE-2017-5753}\n- fs: prevent speculative execution (Elena Reshetova) [Orabug: 27340445] {CVE-2017-5753}\n- ipv6: prevent speculative execution (Elena Reshetova) [Orabug: 27340445] {CVE-2017-5753}\n- ipv4: prevent speculative execution (Elena Reshetova) [Orabug: 27340445] {CVE-2017-5753}\n- Thermal/int340x: prevent speculative execution (Elena Reshetova) [Orabug: 27340445] {CVE-2017-5753}\n- cw1200: prevent speculative execution (Elena Reshetova) [Orabug: 27340445] {CVE-2017-5753}\n- qla2xxx: prevent speculative execution (Elena Reshetova) [Orabug: 27340445] {CVE-2017-5753}\n- p54: prevent speculative execution (Elena Reshetova) [Orabug: 27340445] {CVE-2017-5753}\n- carl9170: prevent speculative execution (Elena Reshetova) [Orabug: 27340445] {CVE-2017-5753}\n- uvcvideo: prevent speculative execution (Elena Reshetova) [Orabug: 27340445] {CVE-2017-5753}\n- bpf: prevent speculative execution in eBPF interpreter (Elena Reshetova) [Orabug: 27340445] {CVE-2017-5753}\n- locking/barriers: introduce new observable speculation barrier (Elena Reshetova) [Orabug: 27340445] {CVE-2017-5753}\n- x86/cpu/AMD: Remove now unused definition of MFENCE_RDTSC feature (Elena Reshetova) [Orabug: 27340445] {CVE-2017-5753}\n- x86/cpu/AMD: Make the LFENCE instruction serialized (Elena Reshetova) [Orabug: 27340445] {CVE-2017-5753}\n- kABI: Make the boot_cpu_data look normal. (Konrad Rzeszutek Wilk) [Orabug: 27344012] {CVE-2017-5715}\n- kernel.spec: Require the new microcode_ctl. (Konrad Rzeszutek Wilk) [Orabug: 27344012] {CVE-2017-5715} {CVE-2017-5715}\n- x86/microcode/AMD: Add support for fam17h microcode loading (Tom Lendacky) [Orabug: 27344012] {CVE-2017-5715}\n- x86/spec_ctrl: Disable if running as Xen PV guest. (Konrad Rzeszutek Wilk) [Orabug: 27344012] {CVE-2017-5715}\n- Set IBPB when running a different VCPU (Dave Hansen) [Orabug: 27344012] {CVE-2017-5715}\n- Clear the host registers after setbe (Jun Nakajima) [Orabug: 27344012] {CVE-2017-5715}\n- Use the ibpb_inuse variable. (Jun Nakajima) [Orabug: 27344012] {CVE-2017-5715}\n- KVM: x86: add SPEC_CTRL to MSR and CPUID lists (Andrea Arcangeli) [Orabug: 27344012] {CVE-2017-5715}\n- kvm: vmx: add MSR_IA32_SPEC_CTRL and MSR_IA32_PRED_CMD (Paolo Bonzini) [Orabug: 27344012] {CVE-2017-5715}\n- Use the 'ibrs_inuse' variable. (Jun Nakajima) [Orabug: 27344012] {CVE-2017-5715}\n- kvm: svm: add MSR_IA32_SPEC_CTRL and MSR_IA32_PRED_CMD (Andrea Arcangeli) [Orabug: 27344012] {CVE-2017-5715}\n- x86/svm: Set IBPB when running a different VCPU (Paolo Bonzini) [Orabug: 27344012] {CVE-2017-5715}\n- x86/kvm: Pad RSB on VM transition (Tim Chen) [Orabug: 27344012] {CVE-2017-5715}\n- x86/cpu/AMD: Add speculative control support for AMD (Tom Lendacky) [Orabug: 27344012] {CVE-2017-5715}\n- x86/microcode: Recheck IBRS and IBPB feature on microcode reload (Tim Chen) [Orabug: 27344012] {CVE-2017-5715}\n- x86: Move IBRS/IBPB feature detection to scattered.c (Tim Chen) [Orabug: 27344012] {CVE-2017-5715}\n- x86/spec_ctrl: Add lock to serialize changes to ibrs and ibpb control (Tim Chen) [Orabug: 27344012] {CVE-2017-5715}\n- x86/spec_ctrl: Add sysctl knobs to enable/disable SPEC_CTRL feature (Konrad Rzeszutek Wilk) [Orabug: 27344012] {CVE-2017-5715}\n- x86/kvm: clear registers on VM exit (Tom Lendacky) [Orabug: 27344012] {CVE-2017-5715}\n- x86/kvm: Set IBPB when switching VM (Tim Chen) [Orabug: 27344012] {CVE-2017-5715}\n- *INCOMPLETE* x86/syscall: Clear unused extra registers on syscall entrance (Konrad Rzeszutek Wilk) [Orabug: 27344012] {CVE-2017-5715}\n- x86/entry: Stuff RSB for entry to kernel for non-SMEP platform (Konrad Rzeszutek Wilk) [Orabug: 27344012] {CVE-2017-5715}\n- x86/mm: Only set IBPB when the new thread cannot ptrace current thread (Konrad Rzeszutek Wilk) [Orabug: 27344012] {CVE-2017-5715}\n- x86/mm: Set IBPB upon context switch (Tim Chen) [Orabug: 27344012] {CVE-2017-5715}\n- x86/idle: Disable IBRS when offlining cpu and re-enable on wakeup (Tim Chen) [Orabug: 27344012] {CVE-2017-5715}\n- x86/idle: Disable IBRS entering idle and enable it on wakeup (Tim Chen) [Orabug: 27344012] {CVE-2017-5715}\n- x86/spec_ctrl: save IBRS MSR value in paranoid_entry (Andrea Arcangeli) [Orabug: 27344012] {CVE-2017-5715}\n- *Scaffolding* x86/spec_ctrl: Add sysctl knobs to enable/disable SPEC_CTRL feature (Tim Chen) [Orabug: 27344012] {CVE-2017-5715}\n- x86/enter: Use IBRS on syscall and interrupts (Tim Chen) [Orabug: 27344012] {CVE-2017-5715}\n- x86: Add macro that does not save rax, rcx, rdx on stack to disable IBRS (Tim Chen) [Orabug: 27344012] {CVE-2017-5715}\n- x86/enter: MACROS to set/clear IBRS and set IBP (Tim Chen) [Orabug: 27344012] {CVE-2017-5715}\n- x86/feature: Report presence of IBPB and IBRS control (Tim Chen) [Orabug: 27344012] {CVE-2017-5715}\n- x86: Add STIBP feature enumeration (Konrad Rzeszutek Wilk) [Orabug: 27344012] {CVE-2017-5715}\n- x86/cpufeature: Add X86_FEATURE_IA32_ARCH_CAPS and X86_FEATURE_IBRS_ATT (Konrad Rzeszutek Wilk) [Orabug: 27344012] {CVE-2017-5715}\n- x86/feature: Enable the x86 feature to control (Tim Chen) [Orabug: 27344012] {CVE-2017-5715}\n- dccp: CVE-2017-8824: use-after-free in DCCP code (Mohamed Ghannam) [Orabug: 27290292] {CVE-2017-8824}\n- negotiate_mq should happen in all cases of a new VBD being discovered by xen-blkfront, whether called through _probe() or a hot-attached new VBD from dom-0 via xenstore. Otherwise, hot-attached new VBDs are left configured without multi-queue. (Patrick Colp) [Orabug: 27180421] \n- e1000: avoid null pointer dereference on invalid stat type (Colin Ian King) [Orabug: 27069012] \n- e1000: fix race condition between e1000_down() and e1000_watchdog (Vincenzo Maffione) [Orabug: 27069012] \n- e1000e: Be drop monitor friendly (Florian Fainelli) [Orabug: 27069012] \n- e1000e: apply burst mode settings only on default (Willem de Bruijn) [Orabug: 27069012] \n- e1000e: fix buffer overrun while the I219 is processing DMA transactions (Sasha Neftin) [Orabug: 27069012] \n- e1000e: Avoid receiver overrun interrupt bursts (Benjamin Poirier) [Orabug: 27069012] \n- e1000e: Separate signaling for link check/link up (Benjamin Poirier) [Orabug: 27069012] \n- e1000e: Fix return value test (Benjamin Poirier) [Orabug: 27069012] \n- e1000e: Fix wrong comment related to link detection (Benjamin Poirier) [Orabug: 27069012] \n- e1000e: Fix error path in link detection (Benjamin Poirier) [Orabug: 27069012] \n- drivers: net: e1000e: use setup_timer() helper. (Allen Pais) [Orabug: 27069012] \n- e1000e: Initial Support for IceLake (Sasha Neftin) [Orabug: 27069012] \n- e1000e: add check on e1e_wphy() return value (Gustavo A R Silva) [Orabug: 27069012] \n- e1000e: Undo e1000e_pm_freeze if __e1000_shutdown fails (Chris Wilson) [Orabug: 27069012]", "edition": 71, "modified": "2018-04-18T00:00:00", "published": "2018-04-18T00:00:00", "id": "ELSA-2018-4071", "href": "http://linux.oracle.com/errata/ELSA-2018-4071.html", "title": "Unbreakable Enterprise kernel security update", "type": "oraclelinux", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}], "centos": [{"lastseen": "2020-12-08T03:36:51", "bulletinFamily": "unix", "cvelist": ["CVE-2017-7472", "CVE-2017-5753", "CVE-2017-5754", "CVE-2017-12193", "CVE-2017-15649", "CVE-2017-5715", "CVE-2017-12192", "CVE-2015-8539"], "description": "**CentOS Errata and Security Advisory** CESA-2018:0151\n\n\nThe kernel packages contain the Linux kernel, the core of any Linux operating system.\n\nSecurity Fix(es):\n\nAn industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of instructions (a commonly used performance optimization). There are three primary variants of the issue which differ in the way the speculative execution can be exploited.\n\nNote: This issue is present in hardware and cannot be fully fixed via software update. The updated kernel packages provide software mitigation for this hardware issue at a cost of potential performance penalty. Please refer to References section for further information about this issue and the performance impact.\n\nIn this update initial mitigations for IBM Power (PowerPC) and IBM zSeries (S390) architectures are provided.\n\n* Variant CVE-2017-5715 triggers the speculative execution by utilizing branch target injection. It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact that memory accesses may cause allocation into the microprocessor's data cache even for speculatively executed instructions that never actually commit (retire). As a result, an unprivileged attacker could use this flaw to cross the syscall and guest/host boundaries and read privileged memory by conducting targeted cache side-channel attacks. This fix specifically addresses S390 processors. (CVE-2017-5715, Important)\n\n* Variant CVE-2017-5753 triggers the speculative execution by performing a bounds-check bypass. It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact that memory accesses may cause allocation into the microprocessor's data cache even for speculatively executed instructions that never actually commit (retire). As a result, an unprivileged attacker could use this flaw to cross the syscall boundary and read privileged memory by conducting targeted cache side-channel attacks. This fix specifically addresses S390 and PowerPC processors. (CVE-2017-5753, Important)\n\n* Variant CVE-2017-5754 relies on the fact that, on impacted microprocessors, during speculative execution of instruction permission faults, exception generation triggered by a faulting access is suppressed until the retirement of the whole instruction block. In a combination with the fact that memory accesses may populate the cache even when the block is being dropped and never committed (executed), an unprivileged local attacker could use this flaw to read privileged (kernel space) memory by conducting targeted cache side-channel attacks. Note: CVE-2017-5754 affects Intel x86-64 microprocessors. AMD x86-64 microprocessors are not affected by this issue. This fix specifically addresses PowerPC processors. (CVE-2017-5754, Important)\n\nRed Hat would like to thank Google Project Zero for reporting CVE-2017-5715, CVE-2017-5753, and CVE-2017-5754.\n\nThis update also fixes the following security issues and bugs:\n\nSpace precludes documenting all of the bug fixes and enhancements included in this advisory. To see the complete list of bug fixes and enhancements, refer to the following KnowledgeBase article: https://access.redhat.com/articles/3327131.\n\n**Merged security bulletin from advisories:**\nhttp://lists.centos.org/pipermail/centos-announce/2018-January/034768.html\n\n**Affected packages:**\nkernel\nkernel-abi-whitelists\nkernel-debug\nkernel-debug-devel\nkernel-devel\nkernel-doc\nkernel-headers\nkernel-tools\nkernel-tools-libs\nkernel-tools-libs-devel\nperf\npython-perf\n\n**Upstream details at:**\n", "edition": 6, "modified": "2018-01-26T01:28:35", "published": "2018-01-26T01:28:35", "id": "CESA-2018:0151", "href": "http://lists.centos.org/pipermail/centos-announce/2018-January/034768.html", "title": "kernel, perf, python security update", "type": "centos", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}], "suse": [{"lastseen": "2017-12-08T21:45:39", "bulletinFamily": "unix", "cvelist": ["CVE-2017-16525", "CVE-2014-0038", "CVE-2017-12193", "CVE-2017-16649", "CVE-2017-16535", "CVE-2017-16537", "CVE-2017-16527", "CVE-2017-16536", "CVE-2017-15102", "CVE-2017-16939", "CVE-2017-16529", "CVE-2017-16650", "CVE-2017-16531", "CVE-2017-1000405"], "description": "The SUSE Linux Enterprise 12 kernel was updated to 3.12.61 to receive\n various security and bugfixes.\n\n The following security bugs were fixed:\n\n - CVE-2017-16939: The XFRM dump policy implementation in\n net/xfrm/xfrm_user.c in the Linux kernel allowed local users to gain\n privileges or cause a denial of service (use-after-free) via a crafted\n SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY\n Netlink messages (bnc#1069702 1069708).\n - CVE-2017-1000405: The Linux Kernel had a problematic use of\n pmd_mkdirty() in the touch_pmd() function inside the THP implementation.\n touch_pmd() could be reached by get_user_pages(). In such case, the pmd\n would become dirty. This scenario breaks the new\n can_follow_write_pmd()'s logic - pmd could become dirty without going\n through a COW cycle. This bug was not as severe as the original "Dirty\n cow" because an ext4 file (or any other regular file) could not be\n mapped using THP. Nevertheless, it did allow us to overwrite read-only\n huge pages. For example, the zero huge page and sealed shmem files could\n be overwritten (since their mapping could be populated using THP). Note\n that after the first write page-fault to the zero page, it will be\n replaced with a new fresh (and zeroed) thp (bnc#1069496 1070307).\n - CVE-2017-16649: The usbnet_generic_cdc_bind function in\n drivers/net/usb/cdc_ether.c in the Linux kernel allowed local users to\n cause a denial of service (divide-by-zero error and system crash) or\n possibly have unspecified other impact via a crafted USB device\n (bnc#1067085).\n - CVE-2014-0038: The compat_sys_recvmmsg function in net/compat.c in the\n Linux kernel, when CONFIG_X86_X32 is enabled, allowed local users to\n gain privileges via a recvmmsg system call with a crafted timeout\n pointer parameter (bnc#860993).\n - CVE-2017-16650: The qmi_wwan_bind function in drivers/net/usb/qmi_wwan.c\n in the Linux kernel allowed local users to cause a denial of service\n (divide-by-zero error and system crash) or possibly have unspecified\n other impact via a crafted USB device (bnc#1067086).\n - CVE-2017-16535: The usb_get_bos_descriptor function in\n drivers/usb/core/config.c in the Linux kernel allowed local users to\n cause a denial of service (out-of-bounds read and system crash) or\n possibly have unspecified other impact via a crafted USB device\n (bnc#1066700).\n - CVE-2017-15102: The tower_probe function in\n drivers/usb/misc/legousbtower.c in the Linux kernel allowed local users\n (who are physically proximate for inserting a crafted USB device) to\n gain privileges by leveraging a write-what-where condition that occurs\n after a race condition and a NULL pointer dereference (bnc#1066705).\n - CVE-2017-16531: drivers/usb/core/config.c in the Linux kernel allowed\n local users to cause a denial of service (out-of-bounds read and system\n crash) or possibly have unspecified other impact via a crafted USB\n device, related to the USB_DT_INTERFACE_ASSOCIATION descriptor\n (bnc#1066671).\n - CVE-2017-12193: The assoc_array_insert_into_terminal_node function in\n lib/assoc_array.c in the Linux kernel mishandled node splitting, which\n allowed local users to cause a denial of service (NULL pointer\n dereference and panic) via a crafted application, as demonstrated by the\n keyring key type, and key addition and link creation operations\n (bnc#1066192).\n - CVE-2017-16529: The snd_usb_create_streams function in sound/usb/card.c\n in the Linux kernel allowed local users to cause a denial of service\n (out-of-bounds read and system crash) or possibly have unspecified other\n impact via a crafted USB device (bnc#1066650).\n - CVE-2017-16525: The usb_serial_console_disconnect function in\n drivers/usb/serial/console.c in the Linux kernel allowed local users to\n cause a denial of service (use-after-free and system crash) or possibly\n have unspecified other impact via a crafted USB device, related to\n disconnection and failed setup (bnc#1066618).\n - CVE-2017-16537: The imon_probe function in drivers/media/rc/imon.c in\n the Linux kernel allowed local users to cause a denial of service (NULL\n pointer dereference and system crash) or possibly have unspecified other\n impact via a crafted USB device (bnc#1066573).\n - CVE-2017-16536: The cx231xx_usb_probe function in\n drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux kernel allowed\n local users to cause a denial of service (NULL pointer dereference and\n system crash) or possibly have unspecified other impact via a crafted\n USB device (bnc#1066606).\n - CVE-2017-16527: sound/usb/mixer.c in the Linux kernel allowed local\n users to cause a denial of service (snd_usb_mixer_interrupt\n use-after-free and system crash) or possibly have unspecified other\n impact via a crafted USB device (bnc#1066625).\n\n The following non-security bugs were fixed:\n\n - Define sock_efree (bsc#1067997).\n - bcache: Add bch_keylist_init_single() (bsc#1047626).\n - bcache: Add btree_map() functions (bsc#1047626).\n - bcache: Add on error panic/unregister setting (bsc#1047626).\n - bcache: Convert gc to a kthread (bsc#1047626).\n - bcache: Delete some slower inline asm (bsc#1047626).\n - bcache: Drop unneeded blk_sync_queue() calls (bsc#1047626).\n - bcache: Fix a bug recovering from unclean shutdown (bsc#1047626).\n - bcache: Fix a journalling reclaim after recovery bug (bsc#1047626).\n - bcache: Fix a null ptr deref in journal replay (bsc#1047626).\n - bcache: Fix an infinite loop in journal replay (bsc#1047626).\n - bcache: Fix bch_ptr_bad() (bsc#1047626).\n - bcache: Fix discard granularity (bsc#1047626).\n - bcache: Fix for can_attach_cache() (bsc#1047626).\n - bcache: Fix heap_peek() macro (bsc#1047626).\n - bcache: Fix moving_pred() (bsc#1047626).\n - bcache: Fix to remove the rcu_sched stalls (bsc#1047626).\n - bcache: Improve bucket_prio() calculation (bsc#1047626).\n - bcache: Improve priority_stats (bsc#1047626).\n - bcache: Minor btree cache fix (bsc#1047626).\n - bcache: Move keylist out of btree_op (bsc#1047626).\n - bcache: New writeback PD controller (bsc#1047626).\n - bcache: PRECEDING_KEY() (bsc#1047626).\n - bcache: Performance fix for when journal entry is full (bsc#1047626).\n - bcache: Remove redundant block_size assignment (bsc#1047626).\n - bcache: Remove redundant parameter for cache_alloc() (bsc#1047626).\n - bcache: Remove/fix some header dependencies (bsc#1047626).\n - bcache: Trivial error handling fix (bsc#1047626).\n - bcache: Use ida for bcache block dev minor (bsc#1047626).\n - bcache: allows use of register in udev to avoid "device_busy" error\n (bsc#1047626).\n - bcache: bch_allocator_thread() is not freezable (bsc#1047626).\n - bcache: bch_gc_thread() is not freezable (bsc#1047626).\n - bcache: bugfix - gc thread now gets woken when cache is full\n (bsc#1047626).\n - bcache: bugfix - moving_gc now moves only correct buckets (bsc#1047626).\n - bcache: cleaned up error handling around register_cache() (bsc#1047626).\n - bcache: clear BCACHE_DEV_UNLINK_DONE flag when attaching a backing\n device (bsc#1047626).\n - bcache: defensively handle format strings (bsc#1047626).\n - bcache: fix BUG_ON due to integer overflow with GC_SECTORS_USED\n (bsc#1047626).\n - bcache: fix a livelock when we cause a huge number of cache misses\n (bsc#1047626).\n - bcache: fix crash in bcache_btree_node_alloc_fail tracepoint\n (bsc#1047626).\n - bcache: fix for gc and writeback race (bsc#1047626).\n - bcache: fix for gc crashing when no sectors are used (bsc#1047626).\n - bcache: kill index() (bsc#1047626).\n - bcache: only recovery I/O error for writethrough mode (bsc#1043652).\n - bcache: register_bcache(): call blkdev_put() when cache_alloc() fails\n (bsc#1047626).\n - bcache: stop moving_gc marking buckets that can't be moved (bsc#1047626).\n - mac80211: do not compare TKIP TX MIC key in reinstall prevention\n (bsc#1066472).\n - mac80211: use constant time comparison with keys (bsc#1066471).\n - powerpc/powernv: Remove OPAL v1 takeover (bsc#1070781).\n - powerpc/vdso64: Use double word compare on pointers\n - powerpc: Convert cmp to cmpd in idle enter sequence\n\n", "edition": 1, "modified": "2017-12-08T18:11:43", "published": "2017-12-08T18:11:43", "href": "http://lists.opensuse.org/opensuse-security-announce/2017-12/msg00023.html", "id": "SUSE-SU-2017:3249-1", "title": "Security update for the Linux Kernel (important)", "type": "suse", "cvss": {"score": 7.2, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-12-04T19:02:55", "bulletinFamily": "unix", "cvelist": ["CVE-2017-16525", "CVE-2014-0038", "CVE-2017-12193", "CVE-2017-16649", "CVE-2017-16535", "CVE-2017-16537", "CVE-2017-16527", "CVE-2017-16536", "CVE-2017-15102", "CVE-2017-16939", "CVE-2017-16529", "CVE-2017-16650", "CVE-2017-16531", "CVE-2017-1000405"], "description": "The SUSE Linux Enterprise 12 SP1 kernel was updated to receive various\n security and bugfixes.\n\n The following security bugs were fixed:\n\n - CVE-2017-16939: The XFRM dump policy implementation in\n net/xfrm/xfrm_user.c in the Linux kernel allowed local users to gain\n privileges or cause a denial of service (use-after-free) via a crafted\n SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY\n Netlink messages. (bnc#1069702)\n - CVE-2017-1000405: mm, thp: do not dirty huge pages on read fault\n (bnc#1069496).\n - CVE-2017-16649: The usbnet_generic_cdc_bind function in\n drivers/net/usb/cdc_ether.c in the Linux kernel allowed local users to\n cause a denial of service (divide-by-zero error and system crash) or\n possibly have unspecified other impact via a crafted USB device.\n (bnc#1067085)\n - CVE-2014-0038: The compat_sys_recvmmsg function in net/compat.c, when\n CONFIG_X86_X32 is enabled, allowed local users to gain privileges via a\n recvmmsg system call with a crafted timeout pointer parameter\n (bnc#860993).\n - CVE-2017-16650: The qmi_wwan_bind function in drivers/net/usb/qmi_wwan.c\n in the Linux kernel allowed local users to cause a denial of service\n (divide-by-zero error and system crash) or possibly have unspecified\n other impact via a crafted USB device. (bnc#1067086)\n - CVE-2017-16535: The usb_get_bos_descriptor function in\n drivers/usb/core/config.c in the Linux kernel allowed local users to\n cause a denial of service (out-of-bounds read and system crash) or\n possibly have unspecified other impact via a crafted USB device.\n (bnc#1066700)\n - CVE-2017-15102: The tower_probe function in\n drivers/usb/misc/legousbtower.c in the Linux kernel allowed local users\n (who are physically proximate for inserting a crafted USB device) to\n gain privileges by leveraging a write-what-where condition that occurs\n after a race condition and a NULL pointer dereference. (bnc#1066705)\n - CVE-2017-16531: drivers/usb/core/config.c in the Linux kernel allowed\n local users to cause a denial of service (out-of-bounds read and system\n crash) or possibly have unspecified other impact via a crafted USB\n device, related to the USB_DT_INTERFACE_ASSOCIATION descriptor.\n (bnc#1066671)\n - CVE-2017-12193: The assoc_array_insert_into_terminal_node function in\n lib/assoc_array.c in the Linux kernel mishandled node splitting, which\n allowed local users to cause a denial of service (NULL pointer\n dereference and panic) via a crafted application, as demonstrated by the\n keyring key type, and key addition and link creation operations.\n (bnc#1066192)\n - CVE-2017-16529: The snd_usb_create_streams function in sound/usb/card.c\n in the Linux kernel allowed local users to cause a denial of service\n (out-of-bounds read and system crash) or possibly have unspecified other\n impact via a crafted USB device. (bnc#1066650)\n - CVE-2017-16525: The usb_serial_console_disconnect function in\n drivers/usb/serial/console.c in the Linux kernel allowed local users to\n cause a denial of service (use-after-free and system crash) or possibly\n have unspecified other impact via a crafted USB device, related to\n disconnection and failed setup. (bnc#1066618)\n - CVE-2017-16537: The imon_probe function in drivers/media/rc/imon.c in\n the Linux kernel allowed local users to cause a denial of service (NULL\n pointer dereference and system crash) or possibly have unspecified other\n impact via a crafted USB device. (bnc#1066573)\n - CVE-2017-16536: The cx231xx_usb_probe function in\n drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux kernel allowed\n local users to cause a denial of service (NULL pointer dereference and\n system crash) or possibly have unspecified other impact via a crafted\n USB device. (bnc#1066606)\n - CVE-2017-16527: sound/usb/mixer.c in the Linux kernel allowed local\n users to cause a denial of service (snd_usb_mixer_interrupt\n use-after-free and system crash) or possibly have unspecified other\n impact via a crafted USB device. (bnc#1066625)\n\n The following non-security bugs were fixed:\n\n - NVMe: No lock while DMA mapping data (bsc#975788).\n - bcache: Add bch_keylist_init_single() (bsc#1047626).\n - bcache: Add btree_map() functions (bsc#1047626).\n - bcache: Add on error panic/unregister setting (bsc#1047626).\n - bcache: Convert gc to a kthread (bsc#1047626).\n - bcache: Delete some slower inline asm (bsc#1047626).\n - bcache: Drop unneeded blk_sync_queue() calls (bsc#1047626).\n - bcache: Fix a bug recovering from unclean shutdown (bsc#1047626).\n - bcache: Fix a journalling reclaim after recovery bug (bsc#1047626).\n - bcache: Fix a null ptr deref in journal replay (bsc#1047626).\n - bcache: Fix an infinite loop in journal replay (bsc#1047626).\n - bcache: Fix bch_ptr_bad() (bsc#1047626).\n - bcache: Fix discard granularity (bsc#1047626).\n - bcache: Fix for can_attach_cache() (bsc#1047626).\n - bcache: Fix heap_peek() macro (bsc#1047626).\n - bcache: Fix moving_pred() (bsc#1047626).\n - bcache: Fix to remove the rcu_sched stalls (bsc#1047626).\n - bcache: Improve bucket_prio() calculation (bsc#1047626).\n - bcache: Improve priority_stats (bsc#1047626).\n - bcache: Minor btree cache fix (bsc#1047626).\n - bcache: Move keylist out of btree_op (bsc#1047626).\n - bcache: New writeback PD controller (bsc#1047626).\n - bcache: PRECEDING_KEY() (bsc#1047626).\n - bcache: Performance fix for when journal entry is full (bsc#1047626).\n - bcache: Remove redundant block_size assignment (bsc#1047626).\n - bcache: Remove redundant parameter for cache_alloc() (bsc#1047626).\n - bcache: Remove/fix some header dependencies (bsc#1047626).\n - bcache: Trivial error handling fix (bsc#1047626).\n - bcache: Use ida for bcache block dev minor (bsc#1047626).\n - bcache: allows use of register in udev to avoid "device_busy" error\n (bsc#1047626).\n - bcache: bch_allocator_thread() is not freezable (bsc#1047626).\n - bcache: bch_gc_thread() is not freezable (bsc#1047626).\n - bcache: bugfix - gc thread now gets woken when cache is full\n (bsc#1047626).\n - bcache: bugfix - moving_gc now moves only correct buckets (bsc#1047626).\n - bcache: cleaned up error handling around register_cache() (bsc#1047626).\n - bcache: clear BCACHE_DEV_UNLINK_DONE flag when attaching a backing\n device (bsc#1047626).\n - bcache: defensively handle format strings (bsc#1047626).\n - bcache: fix BUG_ON due to integer overflow with GC_SECTORS_USED\n (bsc#1047626).\n - bcache: fix a livelock when we cause a huge number of cache misses\n (bsc#1047626).\n - bcache: fix crash in bcache_btree_node_alloc_fail tracepoint\n (bsc#1047626).\n - bcache: fix for gc and writeback race (bsc#1047626).\n - bcache: fix for gc crashing when no sectors are used (bsc#1047626).\n - bcache: kill index() (bsc#1047626).\n - bcache: register_bcache(): call blkdev_put() when cache_alloc() fails\n (bsc#1047626).\n - bcache: stop moving_gc marking buckets that can't be moved (bsc#1047626).\n - mac80211: do not compare TKIP TX MIC key in reinstall prevention\n (bsc#1066472).\n - mac80211: use constant time comparison with keys (bsc#1066471).\n - packet: fix use-after-free in fanout_add()\n - scsi: ILLEGAL REQUEST + ASC==27 produces target failure (bsc#1059465).\n\n", "edition": 1, "modified": "2017-12-04T15:07:06", "published": "2017-12-04T15:07:06", "href": "http://lists.opensuse.org/opensuse-security-announce/2017-12/msg00005.html", "id": "SUSE-SU-2017:3210-1", "title": "Security update for the Linux Kernel (important)", "type": "suse", "cvss": {"score": 7.2, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-12-21T21:35:35", "bulletinFamily": "unix", "cvelist": ["CVE-2017-17450", "CVE-2017-12193", "CVE-2017-16537", "CVE-2017-15115", "CVE-2017-8824", "CVE-2017-16994", "CVE-2017-17448", "CVE-2017-16646", "CVE-2017-16536", "CVE-2017-7482", "CVE-2017-1000410", "CVE-2017-17449", "CVE-2017-11600", "CVE-2017-16528", "CVE-2017-16645"], "description": "The SUSE Linux Enterprise 12 SP3 kernel was updated to 4.4.103 to receive\n various security and bugfixes.\n\n The following security bugs were fixed:\n\n - CVE-2017-1000410: The Linux kernel was affected by an information lea\n that lies in the processing of incoming L2CAP commands - ConfigRequest,\n and ConfigResponse messages. (bnc#1070535).\n - CVE-2017-11600: net/xfrm/xfrm_policy.c in the Linux kernel did not\n ensure that the dir value of xfrm_userpolicy_id is XFRM_POLICY_MAX or\n less, which allowed local users to cause a denial of service\n (out-of-bounds access) or possibly have unspecified other impact via an\n XFRM_MSG_MIGRATE xfrm Netlink message (bnc#1050231).\n - CVE-2017-12193: The assoc_array_insert_into_terminal_node function in\n lib/assoc_array.c in the Linux kernel mishandled node splitting, which\n allowed local users to cause a denial of service (NULL pointer\n dereference and panic) via a crafted application, as demonstrated by the\n keyring key type, and key addition and link creation operations\n (bnc#1066192).\n - CVE-2017-15115: The sctp_do_peeloff function in net/sctp/socket.c in the\n Linux kernel did not check whether the intended netns is used in a\n peel-off action, which allowed local users to cause a denial of service\n (use-after-free and system crash) or possibly have unspecified other\n impact via crafted system calls (bnc#1068671).\n - CVE-2017-16528: sound/core/seq_device.c in the Linux kernel allowed\n local users to cause a denial of service (snd_rawmidi_dev_seq_free\n use-after-free and system crash) or possibly have unspecified other\n impact via a crafted USB device (bnc#1066629).\n - CVE-2017-16536: The cx231xx_usb_probe function in\n drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux kernel allowed\n local users to cause a denial of service (NULL pointer dereference and\n system crash) or possibly have unspecified other impact via a crafted\n USB device (bnc#1066606).\n - CVE-2017-16537: The imon_probe function in drivers/media/rc/imon.c in\n the Linux kernel allowed local users to cause a denial of service (NULL\n pointer dereference and system crash) or possibly have unspecified other\n impact via a crafted USB device (bnc#1066573).\n - CVE-2017-16645: The ims_pcu_get_cdc_union_desc function in\n drivers/input/misc/ims-pcu.c in the Linux kernel allowed local users to\n cause a denial of service (ims_pcu_parse_cdc_data out-of-bounds read and\n system crash) or possibly have unspecified other impact via a crafted\n USB device (bnc#1067132).\n - CVE-2017-16646: drivers/media/usb/dvb-usb/dib0700_devices.c in the Linux\n kernel allowed local users to cause a denial of service (BUG and system\n crash) or possibly have unspecified other impact via a crafted USB\n device (bnc#1067105).\n - CVE-2017-16994: The walk_hugetlb_range function in mm/pagewalk.c in the\n Linux kernel mishandled holes in hugetlb ranges, which allowed local\n users to obtain sensitive information from uninitialized kernel memory\n via crafted use of the mincore() system call (bnc#1069996).\n - CVE-2017-17448: net/netfilter/nfnetlink_cthelper.c in the Linux kernel\n did not require the CAP_NET_ADMIN capability for new, get, and del\n operations, which allowed local users to bypass intended access\n restrictions because the nfnl_cthelper_list data structure is shared\n across all net namespaces (bnc#1071693).\n - CVE-2017-17449: The __netlink_deliver_tap_skb function in\n net/netlink/af_netlink.c in the Linux kernel did not restrict\n observations of Netlink messages to a single net namespace, which\n allowed local users to obtain sensitive information by leveraging the\n CAP_NET_ADMIN capability to sniff an nlmon interface for all Netlink\n activity on the system (bnc#1071694).\n - CVE-2017-17450: net/netfilter/xt_osf.c in the Linux kernel did not\n require the CAP_NET_ADMIN capability for add_callback and\n remove_callback operations, which allowed local users to bypass intended\n access restrictions because the xt_osf_fingers data structure is shared\n across all net namespaces (bnc#1071695).\n - CVE-2017-7482: Fixed an overflow when decoding a krb5 principal.\n (bnc#1046107).\n - CVE-2017-8824: The dccp_disconnect function in net/dccp/proto.c in the\n Linux kernel allowed local users to gain privileges or cause a denial of\n service (use-after-free) via an AF_UNSPEC connect system call during the\n DCCP_LISTEN state (bnc#1070771).\n\n The following non-security bugs were fixed:\n\n - acpi / APD: Add clock frequency for ThunderX2 I2C controller\n (bsc#1067225).\n - Add references (bsc#1062941, bsc#1037404, bsc#1012523, bsc#1038299) The\n scsi_devinfo patches are relevant for all bugs related to HITACHI OPEN-V:\n - adm80211: return an error if adm8211_alloc_rings() fails (bsc#1031717).\n - adv7604: Initialize drive strength to default when using DT\n (bnc#1012382).\n - af_netlink: ensure that NLMSG_DONE never fails in dumps (bnc#1012382).\n - alsa: caiaq: Fix stray URB at probe error path (bnc#1012382).\n - alsa: hda: Abort capability probe at invalid register read (bsc#1048356).\n - alsa: hda: Add Raven PCI ID (bnc#1012382).\n - alsa: hda - Apply ALC269_FIXUP_NO_SHUTUP on HDA_FIXUP_ACT_PROBE\n (bnc#1012382).\n - alsa: hda/ca0132 - Fix memory leak at error path (bsc#1031717).\n - alsa: hda - fix headset mic problem for Dell machines with alc236\n (bnc#1012382).\n - alsa: hda - No loopback on ALC299 codec (git-fixes).\n - alsa: hda/realtek: Add headset mic support for Intel NUC Skull Canyon\n (bsc#1031717).\n - alsa: hda/realtek - Add new codec ID ALC299 (bnc#1012382).\n - alsa: hda/realtek - Add support for ALC236/ALC3204 (bnc#1012382).\n - alsa: hda/realtek - Fix ALC700 family no sound issue (bsc#1031717).\n - alsa: hda: Remove superfluous '-' added by printk conversion\n (bnc#1012382).\n - alsa: hda: Workaround for KBL codec power control\n (bsc#1048356,bsc#1047989,bsc#1055272,bsc#1058413).\n - alsa: line6: Fix leftover URB at error-path during probe (bnc#1012382).\n - alsa: pcm: update tstamp only if audio_tstamp changed (bsc#1031717).\n - alsa: seq: Avoid invalid lockdep class warning (bsc#1031717).\n - alsa: seq: Enable 'use' locking in all configurations (bnc#1012382).\n - alsa: seq: Fix copy_from_user() call inside lock (bnc#1012382).\n - alsa: seq: Fix nested rwsem annotation for lockdep splat (bnc#1012382).\n - alsa: seq: Fix OSS sysex delivery in OSS emulation (bnc#1012382).\n - alsa: timer: Add missing mutex lock for compat ioctls (bnc#1012382).\n - alsa: timer: Remove kernel warning at compat ioctl error paths\n (bsc#1031717).\n - alsa: usb-audio: Add native DSD support for Pro-Ject Pre Box S2 Digital\n (bnc#1012382).\n - alsa: usb-audio: Add sanity checks in v2 clock parsers (bsc#1031717).\n - alsa: usb-audio: Add sanity checks to FE parser (bsc#1031717).\n - alsa: usb-audio: Fix potential out-of-bound access at parsing SU\n (bsc#1031717).\n - alsa: usb-audio: Kill stray URB at exiting (bnc#1012382).\n - alsa: usb-audio: uac1: Invalidate ctl on interrupt (bsc#1031717).\n - alsa: vx: Do not try to update capture stream before running\n (bnc#1012382).\n - alsa: vx: Fix possible transfer overflow (bnc#1012382).\n - Apply generic ppc build fixes to vanilla (bsc#1070805)\n - arm64: dts: NS2: reserve memory for Nitro firmware (bnc#1012382).\n - arm64: ensure __dump_instr() checks addr_limit (bnc#1012382).\n - arm: 8715/1: add a private asm/unaligned.h (bnc#1012382).\n - arm: 8720/1: ensure dump_instr() checks addr_limit (bnc#1012382).\n - arm: 8721/1: mm: dump: check hardware RO bit for LPAE (bnc#1012382).\n - arm: 8722/1: mm: make STRICT_KERNEL_RWX effective for LPAE (bnc#1012382).\n - arm: crypto: reduce priority of bit-sliced AES cipher (bnc#1012382).\n - arm: dts: Fix am335x and dm814x scm syscon to probe children\n (bnc#1012382).\n - arm: dts: Fix compatible for ti81xx uarts for 8250 (bnc#1012382).\n - arm: dts: Fix omap3 off mode pull defines (bnc#1012382).\n - arm: dts: mvebu: pl310-cache disable double-linefill (bnc#1012382).\n - arm: OMAP2+: Fix init for multiple quirks for the same SoC (bnc#1012382).\n - arm: omap2plus_defconfig: Fix probe errors on UARTs 5 and 6\n (bnc#1012382).\n - arm: pxa: Do not rely on public mmc header to include leds.h\n (bnc#1012382).\n - asm/sections: add helpers to check for section data (bsc#1063026).\n - asoc: adau17x1: Workaround for noise bug in ADC (bnc#1012382).\n - asoc: cs42l56: Fix reset GPIO name in example DT binding (bsc#1031717).\n - asoc: davinci-mcasp: Fix an error handling path in\n 'davinci_mcasp_probe()' (bsc#1031717).\n - asoc: rsnd: do not double free kctrl (bnc#1012382).\n - asoc: samsung: Fix possible double iounmap on s3c24xx driver probe\n failure (bsc#1031717).\n - asoc: wm_adsp: Do not overrun firmware file buffer when reading region\n data (bnc#1012382).\n - ata: ATA_BMDMA should depend on HAS_DMA (bnc#1012382).\n - ata: fixes kernel crash while tracing ata_eh_link_autopsy event\n (bnc#1012382).\n - ata: SATA_HIGHBANK should depend on HAS_DMA (bnc#1012382).\n - ata: SATA_MV should depend on HAS_DMA (bnc#1012382).\n - ath10k: convert warning about non-existent OTP board id to debug message\n (git-fixes).\n - ath10k: fix a warning during channel switch with multiple vaps\n (bsc#1031717).\n - ath10k: fix board data fetch error message (bsc#1031717).\n - ath10k: fix diag_read to collect data for larger memory (bsc#1031717).\n - ath10k: fix incorrect txpower set by P2P_DEVICE interface (bnc#1012382).\n - ath10k: fix potential memory leak in ath10k_wmi_tlv_op_pull_fw_stats()\n (bnc#1012382).\n - ath10k: free cached fw bin contents when get board id fails\n (bsc#1031717).\n - ath10k: ignore configuring the incorrect board_id (bnc#1012382).\n - ath10k: set CTS protection VDEV param only if VDEV is up (bnc#1012382).\n - ath9k_htc: check for underflow in ath9k_htc_rx_msg() (bsc#1031717).\n - ath9k: off by one in ath9k_hw_nvram_read_array() (bsc#1031717).\n - autofs: do not fail mount for transient error (bsc#1065180).\n - backlight: adp5520: Fix error handling in adp5520_bl_probe()\n (bnc#1012382).\n - backlight: lcd: Fix race condition during register (bnc#1012382).\n - bcache: check ca->alloc_thread initialized before wake up it\n (bnc#1012382).\n - bio-integrity: bio_integrity_advance must update integrity seed\n (bsc#1046054).\n - bio-integrity: bio_trim should truncate integrity vector accordingly\n (bsc#1046054).\n - bio-integrity: Do not allocate integrity context for bio w/o data\n (bsc#1046054).\n - bio-integrity: fix interface for bio_integrity_trim (bsc#1046054).\n - bio: partially revert 'fix interface for bio_integrity_trim'\n (bsc#1046054).\n - blacklist.conf: Add ath10k, mmc and rtl8192u commits (bsc#1031717)\n - blacklist.conf: Add drm/i915 blacklist (bsc#1031717)\n - blacklist.conf: added misc commits (bsc#1031717)\n - blacklist.conf: Add misc entries (bsc#1031717)\n - blacklist.conf: Add non-applicable commit ID (bsc#1066812)\n - blacklist.conf: Add non-applicable commits (bsc#1066812)\n - blacklist.conf: blacklisted 16af97dc5a89 (bnc#1053919)\n - blacklist.conf: Blacklist two commits (bbb3be170ac2 and ccf1e0045eea).\n - blacklist.conf: Update blacklist (bsc#1031717)\n - blacklist.conf: Update iwlwifi blacklist (bsc#1031717)\n - blacklist.conf: yet another serial entry (bsc#1031717)\n - block: Fix a race between blk_cleanup_queue() and timeout handling\n (FATE#319965, bsc#964944).\n - block: Make q_usage_counter also track legacy requests (bsc#1057820).\n - bluetooth: btusb: fix QCA Rome suspend/resume (bnc#1012382).\n - bnxt_en: Do not use rtnl lock to protect link change logic in workqueue\n (bsc#1020412 FATE#321671).\n - bnxt_en: Fix a variable scoping in bnxt_hwrm_do_send_msg() (bsc#1053309).\n - bnxt_en: Fix possible corrupted NVRAM parameters from firmware response\n (bsc#1020412 FATE#321671).\n - bnxt_en: Fix possible corruption in DCB parameters from firmware\n (bsc#1020412 FATE#321671).\n - bnxt_en: Fix VF PCIe link speed and width logic (bsc#1020412\n FATE#321671).\n - bnxt_en: Need to unconditionally shut down RoCE in bnxt_shutdown\n (bsc#1053309).\n - bnxt_re: Make room for mapping beyond 32 entries (bsc#1056596).\n - bonding: discard lowest hash bit for 802.3ad layer3+4 (bnc#1012382).\n - bpf: one perf event close won't free bpf program attached by another\n perf event (bnc#1012382).\n - bpf/verifier: reject BPF_ALU64|BPF_END (bnc#1012382).\n - brcmfmac: add length check in brcmf_cfg80211_escan_handler()\n (bnc#1012382).\n - brcmfmac: remove setting IBSS mode when stopping AP (bnc#1012382).\n - brcmsmac: make some local variables 'static const' to reduce stack size\n (bnc#1012382).\n - bt8xx: fix memory leak (bnc#1012382).\n - btrfs: return the actual error value from from btrfs_uuid_tree_iterate\n (bnc#1012382).\n - bus: mbus: fix window size calculation for 4GB windows (bnc#1012382).\n - can: c_can: do not indicate triple sampling support for D_CAN\n (bnc#1012382).\n - can: esd_usb2: Fix can_dlc value for received RTR, frames (bnc#1012382).\n - can: gs_usb: fix busy loop if no more TX context is available\n (bnc#1012382).\n - can: kvaser_usb: Correct return value in printout (bnc#1012382).\n - can: kvaser_usb: Ignore CMD_FLUSH_QUEUE_REPLY messages (bnc#1012382).\n - can: sun4i: fix loopback mode (bnc#1012382).\n - can: sun4i: handle overrun in RX FIFO (bnc#1012382).\n - cdc_ncm: Set NTB format again after altsetting switch for Huawei devices\n (bnc#1012382).\n - ceph: clean up unsafe d_parent accesses in build_dentry_path\n (FATE#322288 bnc#1012382).\n - ceph: disable cached readdir after dropping positive dentry\n (bsc#1069277).\n - ceph: -EINVAL on decoding failure in ceph_mdsc_handle_fsmap()\n (bsc#1069277).\n - ceph: present consistent fsid, regardless of arch endianness\n (bsc#1069277).\n - ceph: unlock dangling spinlock in try_flush_caps() (bsc#1065639).\n - cgroup, net_cls: iterate the fds of only the tasks which are being\n migrated (bnc#1064926).\n - cifs: check MaxPathNameComponentLength != 0 before using it\n (bnc#1012382).\n - cifs: fix circular locking dependency (bsc#1064701).\n - cifs: Reconnect expired SMB sessions (bnc#1012382).\n - clk: ti: dra7-atl-clock: fix child-node lookups (bnc#1012382).\n - clk: ti: dra7-atl-clock: Fix of_node reference counting (bnc#1012382).\n - clockevents/drivers/cs5535: Improve resilience to spurious interrupts\n (bnc#1012382).\n - cma: fix calculation of aligned offset (VM Functionality, bsc#1050060).\n - coda: fix 'kernel memory exposure attempt' in fsync (bnc#1012382).\n - cpufreq: CPPC: add acpi_PROCESSOR dependency (bnc#1012382).\n - crypto: dh - Do not permit 'key' or 'g' size longer than 'p'\n (bsc#1048317).\n - crypto: dh - Do not permit 'p' to be 0 (bsc#1048317).\n - crypto: dh - Fix double free of ctx->p (bsc#1048317).\n - crypto: dh - fix memleak in setkey (bsc#1048317).\n - crypto: rsa - fix buffer overread when stripping leading zeroes\n (bsc#1048317).\n - crypto: shash - Fix zero-length shash ahash digest crash (bnc#1012382).\n - crypto: vmx - disable preemption to enable vsx in aes_ctr.c\n (bnc#1012382).\n - crypto: x86/sha1-mb - fix panic due to unaligned access (bnc#1012382).\n - crypto: xts - Add ECB dependency (bnc#1012382).\n - cx231xx: Fix I2C on Internal Master 3 Bus (bnc#1012382).\n - cxgb4: Fix error codes in c4iw_create_cq() (bsc#1048327).\n - cxl: Fix DAR check & use REGION_ID instead of opencoding (bsc#1066223).\n - cxl: Fix leaking pid refs in some error paths (bsc#1066223).\n - cxl: Force context lock during EEH flow (bsc#1066223).\n - cxl: Prevent adapter reset if an active context exists (bsc#1066223).\n - cxl: Route eeh events to all drivers in cxl_pci_error_detected()\n (bsc#1066223).\n - direct-io: Prevent NULL pointer access in submit_page_section\n (bnc#1012382).\n - Disable IPMI fix patches due to regression (bsc#1071833)\n - Disable\n patches.kernel.org/4.4.93-022-fix-unbalanced-page-refcounting-in-bio_map_us\n e.patch (bsc#1070767)\n - dmaengine: dmatest: warn user when dma test times out (bnc#1012382).\n - dmaengine: edma: Align the memcpy acnt array size with the transfer\n (bnc#1012382).\n - dmaengine: zx: set DMA_CYCLIC cap_mask bit (bnc#1012382).\n - dm bufio: fix integer overflow when limiting maximum cache size\n (bnc#1012382).\n - dm: fix race between dm_get_from_kobject() and __dm_destroy()\n (bnc#1012382).\n - dm mpath: remove annoying message of 'blk_get_request() returned -11'\n (bsc#1066812).\n - dm raid: fix NULL pointer dereference for raid1 without bitmap\n (bsc#1042957, FATE#321488).\n - dm rq: Avoid that request processing stalls sporadically (bsc#1042978).\n - drivers: base: cacheinfo: fix x86 with CONFIG_OF enabled (bsc#1070001).\n - drivers: dma-mapping: Do not leave an invalid area->pages pointer in\n dma_common_contiguous_remap() (Git-fixes, bsc#1065692).\n - drivers/fbdev/efifb: Allow BAR to be moved instead of claiming it\n (bsc#1051987).\n - drivers: of: Fix of_pci.h header guard (bsc#1065959).\n - drm/amdgpu: when dpm disabled, also need to stop/start vce (bnc#1012382).\n - drm/amdkfd: NULL dereference involving create_process() (bsc#1031717).\n - drm: Apply range restriction after color adjustment when allocation\n (bnc#1012382).\n - drm/armada: Fix compile fail (bnc#1012382).\n - drm: drm_minor_register(): Clean up debugfs on failure (bnc#1012382).\n - drm: gma500: fix logic error (bsc#1031717).\n - drm/i915/bxt: set min brightness from VBT (bsc#1031717).\n - drm/i915: Do not try indexed reads to alternate slave addresses\n (bsc#1031717).\n - drm/i915: fix backlight invert for non-zero minimum brightness\n (bsc#1031717).\n - drm/i915: Prevent zero length "index" write (bsc#1031717).\n - drm/i915: Read timings from the correct transcoder in\n intel_crtc_mode_get() (bsc#1031717).\n - drm/msm: fix an integer overflow test (bnc#1012382).\n - drm/msm: Fix potential buffer overflow issue (bnc#1012382).\n - drm/nouveau/bsp/g92: disable by default (bnc#1012382).\n - drm/nouveau/gr: fallback to legacy paths during firmware lookup\n (bsc#1031717).\n - drm/nouveau/mmu: flush tlbs before deleting page tables (bnc#1012382).\n - drm/omap: Fix error handling path in 'omap_dmm_probe()' (bsc#1031717).\n - drm/panel: simple: Add missing panel_simple_unprepare() calls\n (bsc#1031717).\n - drm/radeon: Avoid double gpu reset by adding a timeout on IB ring tests\n (bsc#1066175).\n - drm/sti: sti_vtg: Handle return NULL error from devm_ioremap_nocache\n (bnc#1012382).\n - drm/vc4: Fix leak of HDMI EDID (bsc#1031717).\n - drm/vmwgfx: Fix Ubuntu 17.10 Wayland black screen issue (bnc#1012382).\n - Drop obsolete patch (bsc#1067734)\n - e1000e: Avoid receiver overrun interrupt bursts (bsc#969470 FATE#319819).\n - e1000e: Fix error path in link detection (bnc#1012382).\n - e1000e: Fix return value test (bnc#1012382).\n - e1000e: Separate signaling for link check/link up (bnc#1012382).\n - ecryptfs: fix dereference of NULL user_key_payload (bnc#1012382).\n - eCryptfs: use after free in ecryptfs_release_messaging() (bsc#1070404).\n - epoll: avoid calling ep_call_nested() from ep_poll_safewake()\n (bsc#1056427).\n - epoll: remove ep_call_nested() from ep_eventpoll_poll() (bsc#1056427).\n - ext4: cleanup goto next group (bsc#1066285).\n - ext4: do not use stripe_width if it is not set (bnc#1012382).\n - ext4: fix fault handling when mounted with -o dax,ro (bsc#1069484).\n - ext4: fix interaction between i_size, fallocate, and delalloc after a\n crash (bnc#1012382).\n - ext4: fix stripe-unaligned allocations (bnc#1012382).\n - ext4: in ext4_seek_{hole,data}, return -ENXIO for negative offsets\n (bnc#1012382).\n - ext4: prevent data corruption with inline data + DAX (bsc#1064591).\n - ext4: prevent data corruption with journaling + DAX (bsc#1064591).\n - ext4: reduce lock contention in __ext4_new_inode (bsc#1066285).\n - extcon: palmas: Check the parent instance to prevent the NULL\n (bnc#1012382).\n - exynos4-is: fimc-is: Unmap region obtained by of_iomap() (bnc#1012382).\n - f2fs crypto: add missing locking for keyring_key access (bnc#1012382).\n - f2fs crypto: replace some BUG_ON()'s with error checks (bnc#1012382).\n - f2fs: do not wait for writeback in write_begin (bnc#1012382).\n - fealnx: Fix building error on MIPS (bnc#1012382).\n - fix a page leak in vhost_scsi_iov_to_sgl() error recovery (bnc#1012382).\n - Fix tracing sample code warning (bnc#1012382).\n - fix unbalanced page refcounting in bio_map_user_iov (bnc#1012382).\n - Fixup\n patches.fixes/block-Make-q_usage_counter-also-track-legacy-request.patch. (\n bsc#1062496)\n - fm10k: Use smp_rmb rather than read_barrier_depends (bnc#1012382).\n - fs/9p: Compare qid.path in v9fs_test_inode (bsc#1070404).\n - fs-cache: fix dereference of NULL user_key_payload (bnc#1012382).\n - fscrypt: fix dereference of NULL user_key_payload (bnc#1012382).\n - fscrypt: lock mutex before checking for bounce page pool (bnc#1012382).\n - fscrypto: require write access to mount to set encryption policy\n (bnc#1012382).\n - fuse: fix READDIRPLUS skipping an entry (bnc#1012382).\n - gpu: drm: mgag200: mgag200_main:- Handle error from pci_iomap\n (bnc#1012382).\n - hid: elo: clear BTN_LEFT mapping (bsc#1065866).\n - hid: usbhid: fix out-of-bounds bug (bnc#1012382).\n - hsi: ssi_protocol: double free in ssip_pn_xmit() (bsc#1031717).\n - hwmon: (xgene) Fix up error handling path mixup in 'xgene_hwmon_probe()'\n (bsc#).\n - i2c: at91: ensure state is restored after suspending (bnc#1012382).\n - i2c: bcm2835: Add support for dynamic clock (bsc#1066660).\n - i2c: bcm2835: Add support for Repeated Start Condition (bsc#1066660).\n - i2c: bcm2835: Avoid possible NULL ptr dereference (bsc#1066660).\n - i2c: bcm2835: Can't support I2C_M_IGNORE_NAK (bsc#1066660).\n - i2c: bcm2835: Do not complain on -EPROBE_DEFER from getting our clock\n (bsc#1066660).\n - i2c: bcm2835: Fix hang for writing messages larger than 16 bytes\n (bsc#1066660).\n - i2c: bcm2835: Protect against unexpected TXW/RXR interrupts\n (bsc#1066660).\n - i2c: bcm2835: Support i2c-dev ioctl I2C_TIMEOUT (bsc#1066660).\n - i2c: bcm2835: Use dev_dbg logging on transfer errors (bsc#1066660).\n - i2c: cadance: fix ctrl/addr reg write order (bsc#1031717).\n - i2c: imx: Use correct function to write to register (bsc#1031717).\n - i2c: ismt: Separate I2C block read from SMBus block read (bnc#1012382).\n - i2c: riic: correctly finish transfers (bnc#1012382).\n - i2c: riic: fix restart condition (git-fixes).\n - i2c: xlp9xx: Enable HWMON class probing for xlp9xx (bsc#1067225).\n - i2c: xlp9xx: Get clock frequency with clk API (bsc#1067225).\n - i2c: xlp9xx: Handle I2C_M_RECV_LEN in msg->flags (bsc#1067225).\n - i40e: Fix incorrect use of tx_itr_setting when checking for Rx ITR setup\n (bsc#1024346 FATE#321239 bsc#1024373 FATE#321247).\n - i40e: fix the calculation of VFs mac addresses (bsc#1024346 FATE#321239\n bsc#1024373 FATE#321247).\n - i40e: only redistribute MSI-X vectors when needed (bsc#1024346\n FATE#321239 bsc#1024373 FATE#321247).\n - i40e: Use smp_rmb rather than read_barrier_depends (bnc#1012382).\n - i40evf: Use smp_rmb rather than read_barrier_depends (bnc#1012382).\n - i40iw: Remove UDA QP from QoS list if creation fails (bsc#1024376\n FATE#321249).\n - ib/core: Fix calculation of maximum RoCE MTU (bsc#1022595 FATE#322350).\n - ib/core: Fix unable to change lifespan entry for hw_counters\n (FATE#321231 FATE#321473).\n - ib/core: Namespace is mandatory input for address resolution\n (bsc#1022595 FATE#322350).\n - ib/hfi1: Add MODULE_FIRMWARE statements (bsc#1036800).\n - ib/ipoib: Clean error paths in add port (bsc#1022595 FATE#322350).\n - ib/ipoib: Prevent setting negative values to max_nonsrq_conn_qp\n (bsc#1022595 FATE#322350).\n - ib/ipoib: Remove double pointer assigning (bsc#1022595 FATE#322350).\n - ib/ipoib: Set IPOIB_NEIGH_TBL_FLUSH after flushed completion\n initialization (bsc#1022595 FATE#322350).\n - ib/mlx5: Fix RoCE Address Path fields (bsc#966170 FATE#320225 bsc#966172\n FATE#320226).\n - ibmvnic: Add netdev_dbg output for debugging (fate#323285).\n - ibmvnic: Add vnic client data to login buffer (bsc#1069942).\n - ibmvnic: Convert vnic server reported statistics to cpu endian\n (fate#323285).\n - ibmvnic: Enable scatter-gather support (bsc#1066382).\n - ibmvnic: Enable TSO support (bsc#1066382).\n - ibmvnic: Feature implementation of Vital Product Data (VPD) for the\n ibmvnic driver (bsc#1069942).\n - ibmvnic: Fix calculation of number of TX header descriptors\n (bsc#1066382).\n - ibmvnic: fix dma_mapping_error call (bsc#1069942).\n - ibmvnic: Fix failover error path for non-fatal resets (bsc#1066382).\n - ibmvnic: Implement .get_channels (fate#323285).\n - ibmvnic: Implement .get_ringparam (fate#323285).\n - ibmvnic: Implement per-queue statistics reporting (fate#323285).\n - ibmvnic: Let users change net device features (bsc#1066382).\n - ibmvnic: Update reset infrastructure to support tunable parameters\n (bsc#1066382).\n - ib/rxe: check for allocation failure on elem (FATE#322149).\n - ib/rxe: do not crash, if allocation of crc algorithm failed\n (bsc#1051635).\n - ib/rxe: put the pool on allocation failure (FATE#322149).\n - ib/srp: Avoid that a cable pull can trigger a kernel crash (bsc#1022595\n FATE#322350).\n - ib/srpt: Do not accept invalid initiator port names (bnc#1012382).\n - ib/uverbs: Fix device cleanup (bsc#1022595 FATE#322350).\n - ib/uverbs: Fix NULL pointer dereference during device removal\n (bsc#1022595 FATE#322350).\n - igb: close/suspend race in netif_device_detach (bnc#1012382).\n - igb: Fix hw_dbg logging in igb_update_flash_i210 (bnc#1012382).\n - igb: reset the PHY before reading the PHY ID (bnc#1012382).\n - igb: Use smp_rmb rather than read_barrier_depends (bnc#1012382).\n - igbvf: Use smp_rmb rather than read_barrier_depends (bnc#1012382).\n - iio: adc: xilinx: Fix error handling (bnc#1012382).\n - iio: dummy: events: Add missing break (bsc#1031717).\n - iio: light: fix improper return value (bnc#1012382).\n - iio: trigger: free trigger resource correctly (bnc#1012382).\n - ima: do not update security.ima if appraisal status is not\n INTEGRITY_PASS (bnc#1012382).\n - input: ar1021_i2c - fix too long name in driver's device table\n (bsc#1031717).\n - input: edt-ft5x06 - fix setting gain, offset, and threshold via device\n tree (bsc#1031717).\n - input: elan_i2c - add ELAN060C to the acpi table (bnc#1012382).\n - input: elan_i2c - add ELAN0611 to the acpi table (bnc#1012382).\n - input: gtco - fix potential out-of-bound access (bnc#1012382).\n - input: mpr121 - handle multiple bits change of status register\n (bnc#1012382).\n - input: mpr121 - set missing event capability (bnc#1012382).\n - input: ti_am335x_tsc - fix incorrect step config for 5 wire touchscreen\n (bsc#1031717).\n - input: twl4030-pwrbutton - use correct device for irq request\n (bsc#1031717).\n - input: ucb1400_ts - fix suspend and resume handling (bsc#1031717).\n - input: uinput - avoid crash when sending FF request to device going away\n (bsc#1031717).\n - iommu/amd: Finish TLB flush in amd_iommu_unmap() (bnc#1012382).\n - iommu/vt-d: Do not register bus-notifier under dmar_global_lock\n (bsc#1069793).\n - ip6_gre: only increase err_count for some certain type icmpv6 in\n ip6gre_err (bnc#1012382).\n - ip6_gre: skb_push ipv6hdr before packing the header in ip6gre_header\n (bnc#1012382).\n - ipip: only increase err_count for some certain type icmp in ipip_err\n (bnc#1012382).\n - ipmi: fix unsigned long underflow (bnc#1012382).\n - ipmi: Pick up slave address from SMBIOS on an acpi device (bsc#1070006).\n - ipmi: Prefer acpi system interfaces over SMBIOS ones (bsc#1070006).\n - ipmi_si: Clean up printks (bsc#1070006).\n - ipmi_si: fix memory leak on new_smi (bsc#1070006).\n - ipsec: do not ignore crypto err in ah4 input (bnc#1012382).\n - ipv6: flowlabel: do not leave opt->tot_len with garbage (bnc#1012382).\n - ipv6: only call ip6_route_dev_notify() once for NETDEV_UNREGISTER\n (bnc#1012382).\n - ipvs: make drop_entry protection effective for SIP-pe (bsc#1056365).\n - irqchip/crossbar: Fix incorrect type of local variables (bnc#1012382).\n - isa: Prevent NULL dereference in isa_bus driver callbacks (bsc#1031717).\n - iscsi-target: Fix non-immediate TMR reference leak (bnc#1012382).\n - isdn/i4l: fetch the ppp_write buffer in one shot (bnc#1012382).\n - isofs: fix timestamps beyond 2027 (bnc#1012382).\n - iwlwifi: mvm: fix the coex firmware API (bsc#1031717).\n - iwlwifi: mvm: return -ENODATA when reading the temperature with the FW\n down (bsc#1031717).\n - iwlwifi: mvm: set the RTS_MIMO_PROT bit in flag mask when sending sta to\n fw (bsc#1031717).\n - iwlwifi: mvm: use IWL_HCMD_NOCOPY for MCAST_FILTER_CMD (bnc#1012382).\n - iwlwifi: split the regulatory rules when the bandwidth flags require it\n (bsc#1031717).\n - ixgbe: add mask for 64 RSS queues (bnc#1012382).\n - ixgbe: do not disable FEC from the driver (bnc#1012382).\n - ixgbe: fix AER error handling (bnc#1012382).\n - ixgbe: Fix skb list corruption on Power systems (bnc#1012382).\n - ixgbe: handle close/suspend race with netif_device_detach/present\n (bnc#1012382).\n - ixgbe: Reduce I2C retry count on X550 devices (bnc#1012382).\n - ixgbevf: Use smp_rmb rather than read_barrier_depends (bnc#1012382).\n - kABI: protect struct l2tp_tunnel (kabi).\n - kABI: protect struct regulator_dev (kabi).\n - kABI: protect structs rt_rq+root_domain (kabi).\n - kABI: protect typedef rds_rdma_cookie_t (kabi).\n - kabi/severities: Ignore drivers/nvme/target (bsc#1063349)\n - kabi/severities: Ignore kABI changes for qla2xxx (bsc#1043017)\n - kernel-docs: unpack the source instead of using kernel-source\n (bsc#1057199).\n - kernel/sysctl_binary.c: check name array length in\n deprecated_sysctl_warning() (FATE#323821).\n - kernel/sysctl.c: remove duplicate UINT_MAX check on\n do_proc_douintvec_conv() (bsc#1066470).\n - kernel/watchdog: Prevent false positives with turbo modes (bnc#1063516).\n - keys: do not let add_key() update an uninstantiated key (bnc#1012382).\n - keys: do not revoke uninstantiated key in request_key_auth_new()\n (bsc#1031717).\n - keys: encrypted: fix dereference of NULL user_key_payload (bnc#1012382).\n - keys: fix cred refcount leak in request_key_auth_new() (bsc#1031717).\n - keys: fix key refcount leak in keyctl_assume_authority() (bsc#1031717).\n - keys: fix key refcount leak in keyctl_read_key() (bsc#1031717).\n - keys: fix NULL pointer dereference during ASN.1 parsing [ver #2]\n (bnc#1012382).\n - keys: fix out-of-bounds read during ASN.1 parsing (bnc#1012382).\n - keys: Fix race between updating and finding a negative key (bnc#1012382).\n - keys: return full count in keyring_read() if buffer is too small\n (bnc#1012382).\n - keys: trusted: fix writing past end of buffer in trusted_read()\n (bnc#1012382).\n - keys: trusted: sanitize all key material (bnc#1012382).\n - kvm: nVMX: fix guest CR4 loading when emulating L2 to L1 exit\n (bnc#1012382).\n - kvm: nVMX: set IDTR and GDTR limits when loading L1 host state\n (bnc#1012382).\n - kvm: PPC: Book 3S: XICS: correct the real mode ICP rejecting counter\n (bnc#1012382).\n - kvm: SVM: obey guest PAT (bnc#1012382).\n - l2tp: Avoid schedule while atomic in exit_net (bnc#1012382).\n - l2tp: check ps->sock before running pppol2tp_session_ioctl()\n (bnc#1012382).\n - l2tp: fix race condition in l2tp_tunnel_delete (bnc#1012382).\n - libceph: do not WARN() if user tries to add invalid key (bsc#1069277).\n - lib/digsig: fix dereference of NULL user_key_payload (bnc#1012382).\n - libertas: Fix lbs_prb_rsp_limit_set() (bsc#1031717).\n - lib/mpi: call cond_resched() from mpi_powm() loop (bnc#1012382).\n - libnvdimm, namespace: fix label initialization to use valid seq numbers\n (bnc#1012382).\n - libnvdimm, namespace: make 'resource' attribute only readable by root\n (bnc#1012382).\n - libnvdimm, pfn: make 'resource' attribute only readable by root\n (FATE#319858).\n - lib/ratelimit.c: use deferred printk() version (bsc#979928).\n - locking/lockdep: Add nest_lock integrity test (bnc#1012382).\n - lpfc: tie in to new dev_loss_tmo interface in nvme transport\n (bsc#1041873).\n - mac80211: agg-tx: call drv_wake_tx_queue in proper context (bsc#1031717).\n - mac80211: do not compare TKIP TX MIC key in reinstall prevention\n (bsc#1066472).\n - mac80211: do not send SMPS action frame in AP mode when not needed\n (bsc#1031717).\n - mac80211: Fix addition of mesh configuration element (git-fixes).\n - mac80211: Fix BW upgrade for TDLS peers (bsc#1031717).\n - mac80211: fix mgmt-tx abort cookie and leak (bsc#1031717).\n - mac80211: fix power saving clients handling in iwlwifi (bnc#1012382).\n - mac80211_hwsim: check HWSIM_ATTR_RADIO_NAME length (bnc#1012382).\n - mac80211_hwsim: Fix memory leak in hwsim_new_radio_nl() (bsc#1031717).\n - mac80211: Remove invalid flag operations in mesh TSF synchronization\n (bnc#1012382).\n - mac80211: Remove unused 'beaconint_us' variable (bsc#1031717).\n - mac80211: Remove unused 'i' variable (bsc#1031717).\n - mac80211: Remove unused 'len' variable (bsc#1031717).\n - mac80211: Remove unused 'rates_idx' variable (bsc#1031717).\n - mac80211: Remove unused 'sband' and 'local' variables (bsc#1031717).\n - mac80211: Remove unused 'struct ieee80211_rx_status' ptr (bsc#1031717).\n - mac80211: Suppress NEW_PEER_CANDIDATE event if no room (bnc#1012382).\n - mac80211: TDLS: always downgrade invalid chandefs (bsc#1031717).\n - mac80211: TDLS: change BW calculation for WIDER_BW peers (bsc#1031717).\n - mac80211: use constant time comparison with keys (bsc#1066471).\n - md/linear: shutup lockdep warnning (FATE#321488 bnc#1012382 bsc#1042977).\n - media: au0828: fix RC_CORE dependency (bsc#1031717).\n - media: Do not do DMA on stack for firmware upload in the AS102 driver\n (bnc#1012382).\n - media: em28xx: calculate left volume level correctly (bsc#1031717).\n - media: mceusb: fix memory leaks in error path (bsc#1031717).\n - media: rc: check for integer overflow (bnc#1012382).\n - media: v4l2-ctrl: Fix flags field on Control events (bnc#1012382).\n - mei: return error on notification request to a disconnected client\n (bnc#1012382).\n - memremap: add scheduling point to devm_memremap_pages (bnc#1057079).\n - mfd: ab8500-sysctrl: Handle probe deferral (bnc#1012382).\n - mfd: axp20x: Fix axp288 PEK_DBR and PEK_DBF irqs being swapped\n (bnc#1012382).\n - misc: panel: properly restore atomic counter on error path (bnc#1012382).\n - mmc: block: return error on failed mmc_blk_get() (bsc#1031717).\n - mmc: core: add driver strength selection when selecting hs400es\n (bsc#1069721).\n - mmc: core: Fix access to HS400-ES devices (bsc#1031717).\n - mmc: core/mmci: restore pre/post_req behaviour (bsc#1031717).\n - mmc: dw_mmc: Fix the DTO timeout calculation (bsc#1069721).\n - mm: check the return value of lookup_page_ext for all call sites\n (bnc#1068982).\n - mmc: host: omap_hsmmc: avoid possible overflow of timeout value\n (bsc#1031717).\n - mmc: host: omap_hsmmc: checking for NULL instead of IS_ERR()\n (bsc#1031717).\n - mmc: mediatek: Fixed size in dma_free_coherent (bsc#1031717).\n - mmc: s3cmci: include linux/interrupt.h for tasklet_struct (bnc#1012382).\n - mmc: sd: limit SD card power limit according to cards capabilities\n (bsc#1031717).\n - mm: distinguish CMA and MOVABLE isolation in has_unmovable_pages\n (bnc#1051406).\n - mm: drop migrate type checks from has_unmovable_pages (bnc#1051406).\n - mm, hwpoison: fixup "mm: check the return value of lookup_page_ext for\n all call sites" (bnc#1012382).\n - mm/madvise.c: fix freeing of locked page with MADV_FREE (bnc#1069152).\n - mm/madvise.c: fix madvise() infinite loop under special circumstances\n (bnc#1070964).\n - mm, memory_hotplug: add scheduling point to __add_pages (bnc#1057079).\n - mm, memory_hotplug: do not fail offlining too early (bnc#1051406).\n - mm, memory_hotplug: remove timeout from __offline_memory (bnc#1051406).\n - mm, page_alloc: add scheduling point to memmap_init_zone (bnc#1057079).\n - mm/page_alloc.c: broken deferred calculation (bnc#1068980).\n - mm, page_alloc: fix potential false positive in __zone_watermark_ok\n (Git-fixes, bsc#1068978).\n - mm/page_ext.c: check if page_ext is not prepared (bnc#1068982).\n - mm/page_owner: avoid null pointer dereference (bnc#1068982).\n - mm/pagewalk.c: report holes in hugetlb ranges (bnc#1012382).\n - mm, sparse: do not swamp log with huge vmemmap allocation failures\n (bnc#1047901).\n - net: 3com: typhoon: typhoon_init_one: fix incorrect return values\n (bnc#1012382).\n - net: 3com: typhoon: typhoon_init_one: make return values more specific\n (bnc#1012382).\n - net/9p: Switch to wait_event_killable() (bnc#1012382).\n - net: Allow IP_MULTICAST_IF to set index to L3 slave (bnc#1012382).\n - net: cdc_ether: fix divide by 0 on bad descriptors (bnc#1012382).\n - net: cdc_ncm: GetNtbFormat endian fix (git-fixes).\n - net: dsa: select NET_SWITCHDEV (bnc#1012382).\n - net: emac: Fix napi poll list corruption (bnc#1012382).\n - netfilter/ipvs: clear ipvs_property flag when SKB net namespace changed\n (bnc#1012382).\n - netfilter: nf_ct_expect: Change __nf_ct_expect_check() return value\n (bnc#1012382).\n - netfilter: nf_tables: fix oob access (bnc#1012382).\n - netfilter: nft_meta: deal with PACKET_LOOPBACK in netdev family\n (bnc#1012382).\n - netfilter: nft_queue: use raw_smp_processor_id() (bnc#1012382).\n - net: ibm: ibmvnic: constify vio_device_id (fate#323285).\n - net: ixgbe: Use new IXGBE_FLAG2_ROOT_RELAXED_ORDERING flag (bsc#1056652).\n - net/mlx4_core: Fix VF overwrite of module param which disables DMFS on\n new probed PFs (FATE#321685 FATE#321686 FATE#321687 bnc#1012382\n bsc#1015336 bsc#1015337 bsc#1015340).\n - net/mlx4_en: fix overflow in mlx4_en_init_timestamp() (FATE#321685\n FATE#321686 FATE#321687 bnc#1012382 bsc#1015336 bsc#1015337 bsc#1015340).\n - net/mlx5: Delay events till mlx5 interface's add complete for pci resume\n (bsc#1015342 FATE#321688 bsc#1015343 FATE#321689).\n - net/mlx5e: Increase Striding RQ minimum size limit to 4 multi-packet\n WQEs (bsc#1015342 FATE#321688 bsc#1015343 FATE#321689).\n - net/mlx5: Fix health work queue spin lock to IRQ safe (bsc#1015342).\n - net/mlx5: Loop over temp list to release delay events (bsc#1015342\n FATE#321688 bsc#1015343 FATE#321689).\n - net: mvneta: fix handling of the Tx descriptor counter (fate#319899).\n - net: mvpp2: release reference to txq_cpu[] entry after unmapping\n (bnc#1012382 bsc#1032150).\n - net: qmi_wwan: fix divide by 0 on bad descriptors (bnc#1012382).\n - net/sctp: Always set scope_id in sctp_inet6_skb_msgname (bnc#1012382).\n - net: Set sk_prot_creator when cloning sockets to the right proto\n (bnc#1012382).\n - net/smc: dev_put for netdev after usage of ib_query_gid() (bsc#1066812).\n - net: thunderx: Fix TCP/UDP checksum offload for IPv4 pkts (bsc#1069583).\n - net: thunderx: Fix TCP/UDP checksum offload for IPv6 pkts (bsc#1069583).\n - net/unix: do not show information about sockets from other namespaces\n (bnc#1012382).\n - netvsc: use refcount_t for keeping track of sub channels (bsc#1062835).\n - nfc: fix device-allocation error return (bnc#1012382).\n - nfsd/callback: Cleanup callback cred on shutdown (bnc#1012382).\n - nfsd: deal with revoked delegations appropriately (bnc#1012382).\n - nfs: Do not disconnect open-owner on NFS4ERR_BAD_SEQID (bsc#989261).\n - nfs: Fix typo in nomigration mount option (bnc#1012382).\n - nfs: Fix ugly referral attributes (bnc#1012382).\n - nilfs2: fix race condition that causes file system corruption\n (bnc#1012382).\n - nl80211: Define policy for packet pattern attributes (bnc#1012382).\n - nvme: add duplicate_connect option (bsc#1067734).\n - nvme: add helper to compare options to controller (bsc#1067734).\n - nvme: add transport SGL definitions (bsc#1057820).\n - nvme: allow controller RESETTING to RECONNECTING transition\n (bsc#1037838).\n - nvme-fabrics: Allow 0 as KATO value (bsc#1067734).\n - nvme-fabrics: kABI fix for duplicate_connect option (bsc#1067734).\n - nvme-fc: add a dev_loss_tmo field to the remoteport (bsc#1037838).\n - nvme-fc: add dev_loss_tmo timeout and remoteport resume support\n (bsc#1037838).\n - nvme-fc: add support for duplicate_connect option (bsc#1067734).\n - nvme-fc: add uevent for auto-connect (bsc#1037838).\n - nvme-fc: change ctlr state assignments during reset/reconnect\n (bsc#1037838).\n - nvme-fc: check connectivity before initiating reconnects (bsc#1037838).\n - nvme-fc: correct io termination handling (bsc#1067734).\n - nvme-fc: correct io timeout behavior (bsc#1067734).\n - nvme-fc: create fc class and transport device (bsc#1037838).\n - nvme-fc: decouple ns references from lldd references (bsc#1067734).\n - nvme-fc: fix iowait hang (bsc#1052384).\n - nvme-fc: fix localport resume using stale values (bsc#1067734).\n - nvme-fcloop: fix port deletes and callbacks (bsc#1037838).\n - nvme-fc: move remote port get/put/free location (bsc#1037838).\n - nvme-fc: on lldd/transport io error, terminate association (bsc#1042268).\n - nvme-fc: Reattach to localports on re-registration (bsc#1052384).\n - nvme-fc: remove NVME_FC_MAX_SEGMENTS (bsc#1067734).\n - nvme-fc: remove unused "queue_size" field (bsc#1042268).\n - nvme-fc: retry initial controller connections 3 times (bsc#1067734).\n - nvme-fc: use transport-specific sgl format (bsc#1057820).\n - nvme: Fix memory order on async queue deletion (bnc#1012382).\n - nvme: fix the definition of the doorbell buffer config support bit\n (bsc#1066812).\n - nvme-rdma: add support for duplicate_connect option (bsc#1067734).\n - nvme/rdma: Kick admin queue when a connection is going down\n (bsc#1059639).\n - nvmet-fc: correct ref counting error when deferred rcv used\n (bsc#1067734).\n - nvmet-fc: fix failing max io queue connections (bsc#1067734).\n - nvmet-fc: on port remove call put outside lock (bsc#1067734).\n - nvmet-fc: simplify sg list handling (bsc#1052384).\n - nvmet: Fix fatal_err_work deadlock (bsc#1063349).\n - ocfs2: fstrim: Fix start offset of first cluster group during fstrim\n (bnc#1012382).\n - ocfs2: should wait dio before inode lock in ocfs2_setattr()\n (bnc#1012382).\n - packet: avoid panic in packet_getsockopt() (bnc#1012382).\n - packet: only test po->has_vnet_hdr once in packet_snd (bnc#1012382).\n - parisc: Avoid trashing sr2 and sr3 in LWS code (bnc#1012382).\n - parisc: Fix double-word compare and exchange in LWS code on 32-bit\n kernels (bnc#1012382).\n - parisc: Fix validity check of pointer size argument in new CAS\n implementation (bnc#1012382).\n - pci: Apply Cavium ThunderX ACS quirk to more Root Ports (bsc#1069250).\n - pci: Apply _HPX settings only to relevant devices (bnc#1012382).\n - pci: Enable Relaxed Ordering for Hisilicon Hip07 chip (bsc#1056652).\n - pci: Mark Cavium CN8xxx to avoid bus reset (bsc#1069250).\n - pci: Set Cavium ACS capability quirk flags to assert RR/CR/SV/UF\n (bsc#1069250).\n - percpu: make this_cpu_generic_read() atomic w.r.t. interrupts\n (bnc#1012382).\n - perf tools: Fix build failure on perl script context (bnc#1012382).\n - perf tools: Only increase index if perf_evsel__new_idx() succeeds\n (bnc#1012382).\n - perf/x86/intel/bts: Fix exclusive event reference leak (git-fixes\n d2878d642a4ed).\n - phy: increase size of MII_BUS_ID_SIZE and bus_id (bnc#1012382).\n - pkcs#7: fix unitialized boolean 'want' (bnc#1012382).\n - pkcs7: Prevent NULL pointer dereference, since sinfo is not always set\n (bnc#1012382).\n - platform/x86: acer-wmi: setup accelerometer when acpi device was found\n (bsc#1031717).\n - platform/x86: hp-wmi: Do not shadow error values (bnc#1012382).\n - platform/x86: hp-wmi: Fix detection for dock and tablet mode\n (bnc#1012382).\n - platform/x86: hp-wmi: Fix error value for hp_wmi_tablet_state\n (bnc#1012382).\n - platform/x86: intel_mid_thermal: Fix module autoload (bnc#1012382).\n - platform/x86: sony-laptop: Fix error handling in sony_nc_setup_rfkill()\n (bsc#1031717).\n - pm / OPP: Add missing of_node_put(np) (bnc#1012382).\n - power: bq27xxx_battery: Fix bq27541 AveragePower register address\n (bsc#1031717).\n - power: bq27xxx: fix reading for bq27000 and bq27010 (bsc#1031717).\n - powerCap: Fix an error code in powercap_register_zone() (bsc#1031717).\n - power: ipaq-micro-battery: freeing the wrong variable (bsc#1031717).\n - powerpc/64: Fix race condition in setting lock bit in idle/wakeup code\n (bsc#1066223).\n - powerpc/64s/hash: Allow MAP_FIXED allocations to cross 128TB boundary\n (bsc#1070169).\n - powerpc/64s/hash: Fix 128TB-512TB virtual address boundary case\n allocation (bsc#1070169).\n - powerpc/64s/hash: Fix 512T hint detection to use >= 128T (bsc#1070169).\n - powerpc/64s/hash: Fix fork() with 512TB process address space\n (bsc#1070169).\n - powerpc/64s/slice: Use addr limit when computing slice mask\n (bsc#1070169).\n - powerpc/bpf/jit: Disable classic BPF JIT on ppc64le (bsc#1066223).\n - powerpc/corenet: explicitly disable the SDHC controller on kmcoge4\n (bnc#1012382).\n - powerpc: Correct instruction code for xxlor instruction (bsc#1066223).\n - powerpc: Fix VSX enabling/flushing to also test MSR_FP and MSR_VEC\n (bsc#1066223).\n - powerpc/hotplug: Improve responsiveness of hotplug change (FATE#322022,\n bsc#1067906).\n - powerpc/mm: Fix check of multiple 16G pages from device tree\n (bsc#1066223).\n - powerpc/mm: Fix virt_addr_valid() etc. on 64-bit hash (bsc#1066223).\n - powerpc/mm/hash64: Fix subpage protection with 4K HPTE config\n (bsc#1010201, bsc#1066223).\n - powerpc/mm/hash: Free the subpage_prot_table correctly (bsc#1066223).\n - powerpc/numa: Fix multiple bugs in memory_hotplug_max() (bsc#1066223).\n - powerpc/numa: Fix whitespace in hot_add_drconf_memory_max()\n (bsc#1066223).\n - powerpc/opal: Fix EBUSY bug in acquiring tokens (bsc#1066223).\n - powerpc/powernv/ioda: Fix endianness when reading TCEs (bsc#1066223).\n - powerpc/powernv: Make opal_event_shutdown() callable from IRQ context\n (bsc#1066223).\n - powerpc/pseries/vio: Dispose of virq mapping on vdevice unregister\n (bsc#1067888).\n - powerpc/signal: Properly handle return value from uprobe_deny_signal()\n (bsc#1066223).\n - powerpc/sysrq: Fix oops whem ppmu is not registered (bsc#1066223).\n - powerpc/vphn: Fix numa update end-loop bug (FATE#322022, bsc#1067906).\n - powerpc/vphn: Improve recognition of PRRN/VPHN (FATE#322022,\n bsc#1067906).\n - powerpc/vphn: Update CPU topology when VPHN enabled (FATE#322022,\n bsc#1067906).\n - power: supply: bq27xxx_battery: Fix register map for BQ27510 and BQ27520\n ("bsc#1069270").\n - power: supply: isp1704: Fix unchecked return value of devm_kzalloc\n (bsc#1031717).\n - power: supply: lp8788: prevent out of bounds array access (bsc#1031717).\n - power_supply: tps65217-charger: Fix NULL deref during property export\n (bsc#1031717).\n - ppp: fix race in ppp device destruction (bnc#1012382).\n - printk/console: Always disable boot consoles that use init memory before\n it is freed (bsc#1063026).\n - printk/console: Enhance the check for consoles using init memory\n (bsc#1063026).\n - printk: include <asm/sections.h> instead of <asm-generic/sections.h>\n (bsc#1063026).\n - printk: Make sure to wake up printk kthread from irq work for pending\n output (bnc#744692, bnc#789311).\n - printk: only unregister boot consoles when necessary (bsc#1063026).\n - qla2xxx: Fix cable swap (bsc#1043017).\n - qla2xxx: Fix notify ack without timeout handling (bsc#1043017).\n - qla2xxx: Fix re-login for Nport Handle in use (bsc#1043017).\n - qla2xxx: fix stale memory access (bsc#1043017).\n - qla2xxx: Login state machine stuck at GPDB (bsc#1043017).\n - qla2xxx: Recheck session state after RSCN (bsc#1043017).\n - qla2xxx: relogin is being triggered too fast (bsc#1043017).\n - qla2xxx: Retry switch command on timed out (bsc#1043017).\n - qla2xxx: Serialize gpnid (bsc#1043017).\n - quota: Check for register_shrinker() failure (bsc#1070404).\n - r8169: Do not increment tx_dropped in TX ring cleaning (bsc#1031717).\n - rbd: set discard_alignment to zero (bsc#1064320).\n - rbd: use GFP_NOIO for parent stat and data requests (bnc#1012382).\n - rcu: Allow for page faults in NMI handlers (bnc#1012382).\n - rdma/uverbs: Prevent leak of reserved field (bsc#1022595 FATE#322350).\n - rds: rdma: return appropriate error on rdma map failures (bnc#1012382).\n - Refresh patches with upstream commit ID (bsc#1067734)\n - regulator: core: Limit propagation of parent voltage count and list\n (bsc#1070145).\n - regulator: fan53555: fix I2C device ids (bnc#1012382).\n - Revert "crypto: xts - Add ECB dependency" (bnc#1012382).\n - Revert "drm: bridge: add DT bindings for TI ths8135" (bnc#1012382).\n - Revert "phy: increase size of MII_BUS_ID_SIZE and bus_id" (kabi).\n - Revert "sctp: do not peel off an assoc from one netns to another one"\n (bnc#1012382).\n - Revert "tty: goldfish: Fix a parameter of a call to free_irq"\n (bnc#1012382).\n - Revert "uapi: fix linux/rds.h userspace compilation errors"\n (bnc#1012382).\n - rpm/kernel-binary.spec.in: add the kernel-binary dependencies to\n kernel-binary-base (bsc#1060333).\n - rpm/kernel-binary.spec.in: Correct supplements for recent SLE products\n (bsc#1067494)\n - rpm/kernel-binary.spec.in: only rewrite modules.dep if non-zero in size\n (bsc#1056979).\n - rpm/package-descriptions:\n - rtc: ds1307: Fix relying on reset value for weekday (bsc#1031717).\n - rtc: ds1374: wdt: Fix issue with timeout scaling from secs to wdt ticks\n (bsc#1031717).\n - rtc: ds1374: wdt: Fix stop/start ioctl always returning -EINVAL\n (bsc#1031717).\n - rtc: rtc-nuc900: fix loop timeout test (bsc#1031717).\n - rtc: sa1100: fix unbalanced clk_prepare_enable/clk_disable_unprepare\n (bsc#1031717).\n - rtlwifi: fix uninitialized rtlhal->last_suspend_sec time (bnc#1012382).\n - rtlwifi: rtl8192ee: Fix memory leak when loading firmware (bnc#1012382).\n - rtlwifi: rtl8821ae: Fix connection lost problem (bnc#1012382).\n - rtlwifi: rtl8821ae: Fix HW_VAR_NAV_UPPER operation (bsc#1031717).\n - s390/dasd: check for device error pointer within state change interrupts\n (bnc#1012382).\n - s390/disassembler: add missing end marker for e7 table (bnc#1012382).\n - s390/disassembler: correct disassembly lines alignment (bsc#1070825).\n - s390/disassembler: increase show_code buffer size (bnc#1070825,\n LTC#161577).\n - s390/disassembler: increase show_code buffer size (LTC#161577\n bnc#1012382 bnc#1070825).\n - s390: fix transactional execution control register handling\n (bnc#1012382).\n - s390/kbuild: enable modversions for symbols exported from asm\n (bnc#1012382).\n - s390/mm: fix write access check in gup_huge_pmd() (bnc#1066974,\n LTC#160551).\n - s390/qeth: allow hsuid configuration in DOWN state (bnc#1070825,\n LTC#161871).\n - s390/qeth: issue STARTLAN as first IPA command (bnc#1012382).\n - s390/qeth: use ip_lock for hsuid configuration (bnc#1070825, LTC#161871).\n - s390/runtime instrumention: fix possible memory corruption (bnc#1012382).\n - sched/autogroup: Fix autogroup_move_group() to never skip\n sched_move_task() (bnc#1012382).\n - sched: Make resched_cpu() unconditional (bnc#1012382).\n - sched/rt: Simplify the IPI based RT balancing logic (bnc#1012382).\n - scsi: aacraid: Check for PCI state of device in a generic way\n (bsc#1022607, FATE#321673).\n - scsi: aacraid: Fix controller initialization failure (FATE#320140).\n - scsi: bfa: fix access to bfad_im_port_s (bsc#1065101).\n - scsi: check for device state in __scsi_remove_target() (bsc#1072589).\n - scsi_devinfo: cleanly zero-pad devinfo strings (bsc#1062941).\n - scsi: fcoe: move fcoe_interface_remove() out of fcoe_interface_cleanup()\n (bsc#1039542).\n - scsi: fcoe: open-code fcoe_destroy_work() for NETDEV_UNREGISTER\n (bsc#1039542).\n - scsi: fcoe: separate out fcoe_vport_remove() (bsc#1039542).\n - scsi: ipr: Fix scsi-mq lockdep issue (bsc#1066213).\n - scsi: ipr: Set no_report_opcodes for RAID arrays (bsc#1066213).\n - scsi: libiscsi: fix shifting of DID_REQUEUE host byte (bsc#1056003).\n - scsi: lpfc: Add Buffer to Buffer credit recovery support (bsc#1052384).\n - scsi: lpfc: Add changes to assist in NVMET debugging (bsc#1041873).\n - scsi: lpfc: Add nvme initiator devloss support (bsc#1041873).\n - scsi: lpfc: Adjust default value of lpfc_nvmet_mrq (bsc#1067735).\n - scsi: lpfc: Break up IO ctx list into a separate get and put list\n (bsc#1045404).\n - scsi: lpfc: change version to 11.4.0.4 (bsc#1067735).\n - scsi: lpfc: convert info messages to standard messages (bsc#1052384).\n - scsi: lpfc: Correct driver deregistrations with host nvme transport\n (bsc#1067735).\n - scsi: lpfc: Correct issues with FAWWN and FDISCs (bsc#1052384).\n - scsi: lpfc: correct nvme sg segment count check (bsc#1067735).\n - scsi: lpfc: correct port registrations with nvme_fc (bsc#1067735).\n - scsi: lpfc: Correct return error codes to align with nvme_fc transport\n (bsc#1052384).\n - scsi: lpfc: Disable NPIV support if NVME is enabled (bsc#1067735).\n - scsi: lpfc: Driver fails to detect direct attach storage array\n (bsc#1067735).\n - scsi: lpfc: Expand WQE capability of every NVME hardware queue\n (bsc#1067735).\n - scsi: lpfc: Extend RDP support (bsc#1067735).\n - scsi: lpfc: Fix a precedence bug in lpfc_nvme_io_cmd_wqe_cmpl()\n (bsc#1056587).\n - scsi: lpfc: Fix bad sgl reposting after 2nd adapter reset (bsc#1052384).\n - scsi: lpfc: fix build issue if NVME_FC_TARGET is not defined\n (bsc#1040073).\n - scsi: lpfc: Fix counters so outstandng NVME IO count is accurate\n (bsc#1041873).\n - scsi: lpfc: Fix crash after bad bar setup on driver attachment\n (bsc#1067735).\n - scsi: lpfc: Fix crash during driver unload with running nvme traffic\n (bsc#1067735).\n - scsi: lpfc: Fix crash in lpfc_nvme_fcp_io_submit during LIP\n (bsc#1067735).\n - scsi: lpfc: Fix crash in lpfc nvmet when fc port is reset (bsc#1052384).\n - scsi: lpfc: Fix crash receiving ELS while detaching driver (bsc#1067735).\n - scsi: lpfc: Fix display for debugfs queInfo (bsc#1067735).\n - scsi: lpfc: Fix driver handling of nvme resources during unload\n (bsc#1067735).\n - scsi: lpfc: Fix duplicate NVME rport entries and namespaces\n (bsc#1052384).\n - scsi: lpfc: Fix FCP hba_wqidx assignment (bsc#1067735).\n - scsi: lpfc: Fix handling of FCP and NVME FC4 types in Pt2Pt topology\n (bsc#1052384).\n - scsi: lpfc: Fix hard lock up NMI in els timeout handling (bsc#1067735).\n - scsi: lpfc: fix "integer constant too large" error on 32bit archs\n (bsc#1052384).\n - scsi: lpfc: Fix loop mode target discovery (bsc#1052384).\n - scsi: lpfc: Fix lpfc nvme host rejecting IO with Not Ready message\n (bsc#1067735).\n - scsi: lpfc: Fix Lun Priority level shown as NA (bsc#1041873).\n - scsi: lpfc: Fix ndlp ref count for pt2pt mode issue RSCN (bsc#1067735).\n - scsi: lpfc: Fix NVME LS abort_xri (bsc#1067735).\n - scsi: lpfc: Fix nvme port role handling in sysfs and debugfs handlers\n (bsc#1041873).\n - scsi: lpfc: Fix NVME PRLI handling during RSCN (bsc#1052384).\n - scsi: lpfc: Fix nvme target failure after 2nd adapter reset\n (bsc#1052384).\n - scsi: lpfc: Fix nvmet node ref count handling (bsc#1041873).\n - scsi: lpfc: Fix oops if nvmet_fc_register_targetport fails (bsc#1067735).\n - scsi: lpfc: Fix oops of nvme host during driver unload (bsc#1067735).\n - scsi: lpfc: Fix oops when NVME Target is discovered in a nonNVME\n environment.\n - scsi: lpfc: fix pci hot plug crash in list_add call (bsc#1067735).\n - scsi: lpfc: fix pci hot plug crash in timer management routines\n (bsc#1067735).\n - scsi: lpfc: Fix plogi collision that causes illegal state transition\n (bsc#1052384).\n - scsi: lpfc: Fix Port going offline after multiple resets (bsc#1041873).\n - scsi: lpfc: Fix PRLI retry handling when target rejects it (bsc#1041873).\n - scsi: lpfc: Fix rediscovery on switch blade pull (bsc#1052384).\n - scsi: lpfc: Fix relative offset error on large nvmet target ios\n (bsc#1052384).\n - scsi: lpfc: Fix return value of board_mode store routine in case of\n online failure (bsc#1041873).\n - scsi: lpfc: Fix secure firmware updates (bsc#1067735).\n - scsi: lpfc: Fix System panic after loading the driver (bsc#1041873).\n - scsi: lpfc: Fix transition nvme-i rport handling to nport only\n (bsc#1041873).\n - scsi: lpfc: Fix vports not logging into target (bsc#1041873).\n - scsi: lpfc: Fix warning messages when NVME_TARGET_FC not defined\n (bsc#1067735).\n - scsi: lpfc: FLOGI failures are reported when connected to a private loop\n (bsc#1067735).\n - scsi: lpfc: Handle XRI_ABORTED_CQE in soft IRQ (bsc#1067735).\n - scsi: lpfc: Limit amount of work processed in IRQ (bsc#1052384).\n - scsi: lpfc: Linux LPFC driver does not process all RSCNs (bsc#1067735).\n - scsi: lpfc: lpfc version bump 11.4.0.3 (bsc#1052384).\n - scsi: lpfc: Make ktime sampling more accurate (bsc#1067735).\n - scsi: lpfc: Move CQ processing to a soft IRQ (bsc#1067735).\n - scsi: lpfc: Null pointer dereference when log_verbose is set to\n 0xffffffff (bsc#1041873).\n - scsi: lpfc: PLOGI failures during NPIV testing (bsc#1067735).\n - scsi: lpfc: Raise maximum NVME sg list size for 256 elements\n (bsc#1067735).\n - scsi: lpfc: Reduce log spew on controller reconnects (bsc#1067735).\n - scsi: lpfc: remove console log clutter (bsc#1052384).\n - scsi: lpfc: Revise NVME module parameter descriptions for better clarity\n (bsc#1067735).\n - scsi: lpfc: Set missing abort context (bsc#1067735).\n - scsi: lpfc: small sg cnt cleanup (bsc#1067735).\n - scsi: lpfc: spin_lock_irq() is not nestable (bsc#1045404).\n - scsi: lpfc: update driver version to 11.4.0.5 (bsc#1067735).\n - scsi: lpfc: update to revision to 11.4.0.0 (bsc#1041873).\n - scsi: megaraid_sas: mismatch of allocated MFI frame size and length\n exposed in MFI MPT pass through command (bsc#1066767).\n - scsi: qla2xxx: Cleanup debug message IDs (bsc#1043017).\n - scsi: qla2xxx: Correction to vha->vref_count timeout (bsc#1066812).\n - scsi: qla2xxx: Fix name server relogin (bsc#1043017).\n - scsi: qla2xxx: Fix path recovery (bsc#1043017).\n - scsi: qla2xxx: Initialize Work element before requesting IRQs\n (bsc#1019675,FATE#321701).\n - scsi: qla2xxx: Replace usage of spin_lock with spin_lock_irqsave\n (bsc#1043017).\n - scsi: qla2xxx: Retain loop test for fwdump length exceeding buffer\n length (bsc#1043017).\n - scsi: qla2xxx: Turn on FW option for exchange check (bsc#1043017).\n - scsi: qla2xxx: Use BIT_6 to acquire FAWWPN from switch (bsc#1066812).\n - scsi: qla2xxx: Use fabric name for Get Port Speed command (bsc#1066812).\n - scsi: qla2xxx: Use flag PFLG_DISCONNECTED (bsc#1043017).\n - scsi: reset wait for IO completion (bsc#996376).\n - scsi: scsi_devinfo: fixup string compare (bsc#1062941). updated\n patches.fixes/scsi_devinfo-fixup-string-compare.patch to the version\n merged upstream.\n - scsi: scsi_devinfo: handle non-terminated strings (bsc#1062941).\n - scsi: scsi_dh_emc: return success in clariion_std_inquiry()\n (bnc#1012382).\n - scsi: sd_zbc: Fix sd_zbc_read_zoned_characteristics() (bsc#1066812).\n - scsi: sg: close race condition in sg_remove_sfp_usercontext()\n (bsc#1064206).\n - scsi: sg: do not return bogus Sg_requests (bsc#1064206).\n - scsi: sg: only check for dxfer_len greater than 256M (bsc#1064206).\n - scsi: sg: Re-fix off by one in sg_fill_request_table() (bnc#1012382).\n - scsi: ufs: add capability to keep auto bkops always enabled\n (bnc#1012382).\n - scsi: ufs-qcom: Fix module autoload (bnc#1012382).\n - scsi: zfcp: fix erp_action use-before-initialize in REC action trace\n (bnc#1012382).\n - sctp: add the missing sock_owned_by_user check in sctp_icmp_redirect\n (bnc#1012382).\n - sctp: do not peel off an assoc from one netns to another one\n (bnc#1012382).\n - sctp: do not peel off an assoc from one netns to another one\n (bnc#1012382).\n - sctp: potential read out of bounds in sctp_ulpevent_type_enabled()\n (bnc#1012382).\n - sctp: reset owner sk for data chunks on out queues when migrating a sock\n (bnc#1012382).\n - security/keys: add CONFIG_KEYS_COMPAT to Kconfig (bnc#1012382).\n - selftests: firmware: add empty string and async tests (bnc#1012382).\n - selftests: firmware: send expected errors to /dev/null (bnc#1012382).\n - serial: 8250_fintek: Fix rs485 disablement on invalid ioctl()\n (bsc#1031717).\n - serial: 8250_uniphier: fix serial port index in private data\n (bsc#1031717).\n - serial: Fix serial console on SNI RM400 machines (bsc#1031717).\n - serial: omap: Fix EFR write on RTS deassertion (bnc#1012382).\n - serial: Remove unused port type (bsc#1066045).\n - serial: sh-sci: Fix register offsets for the IRDA serial port\n (bnc#1012382).\n - slub: do not merge cache if slub_debug contains a never-merge flag\n (bnc#1012382).\n - smb3: Validate negotiate request must always be signed (bsc#1064597).\n - smb: fix leak of validate negotiate info response buffer (bsc#1064597).\n - smb: fix validate negotiate info uninitialised memory use (bsc#1064597).\n - sparc64: Migrate hvcons irq to panicked cpu (bnc#1012382).\n - spi: SPI_FSL_DSPI should depend on HAS_DMA (bnc#1012382).\n - spi: uapi: spidev: add missing ioctl header (bnc#1012382).\n - staging: iio: cdc: fix improper return value (bnc#1012382).\n - staging: lustre: hsm: stack overrun in hai_dump_data_field (bnc#1012382).\n - staging: lustre: llite: do not invoke direct_IO for the EOF case\n (bnc#1012382).\n - staging: lustre: ptlrpc: skip lock if export failed (bnc#1012382).\n - staging: r8712u: Fix Sparse warning in rtl871x_xmit.c (bnc#1012382).\n - staging: rtl8188eu: fix incorrect ERROR tags from logs (bnc#1012382).\n - staging: rtl8712: fixed little endian problem (bnc#1012382).\n - staging: rtl8712u: Fix endian settings for structs describing network\n packets (bnc#1012382).\n - sunrpc: Fix tracepoint storage issues with svc_recv and svc_rqst_status\n (bnc#1012382).\n - supported.conf:\n - supported.conf: add test_syctl to new kselftests-kmp package FATE#323821\n As per FATE#323821 we will require new FATE requests per each new\n selftest driver. We do not want to support these module on production\n runs but we do want to support them for QA / testing uses. The\n compromise is to package them into its own package, this will be the\n kselftests-kmp package. Selftests can also be used as proof of concept\n vehicle for issues by customers or ourselves. Vanilla kernels do not get\n test_sysctl given that driver was using built-in defaults, this also\n means we cannot run sefltests on config/s390x/zfcpdump which does not\n enable modules. Likeweise, since we had to *change* the kernel for\n test_syctl, it it also means we can't test test_syctl with vanilla\n kernels. It should be possible with other selftests drivers if they are\n present in vanilla kernels though.\n - supported.conf: Support spidev (bsc#1066696)\n - sysctl: add unsigned int range support (FATE#323821)\n - target: fix ALUA state file path truncation (bsc#1064606).\n - target: Fix node_acl demo-mode + uncached dynamic shutdown regression\n (bnc#1012382).\n - target: fix PR state file path truncation (bsc#1064606).\n - target: Fix QUEUE_FULL + SCSI task attribute handling (bnc#1012382).\n - target/iscsi: Fix unsolicited data seq_end_offset calculation\n (bnc#1012382 bsc#1036489).\n - target/rbd: handle zero length UNMAP requests early (bsc#1064320).\n - target/rbd: use target_configure_unmap_from_queue() helper (bsc#1064320).\n - tcp/dccp: fix ireq->opt races (bnc#1012382).\n - tcp/dccp: fix lockdep splat in inet_csk_route_req() (bnc#1012382).\n - tcp/dccp: fix other lockdep splats accessing ireq_opt (bnc#1012382).\n - tcp: do not mangle skb->cb[] in tcp_make_synack() (bnc#1012382).\n - tcp: fix tcp_mtu_probe() vs highest_sack (bnc#1012382).\n - test: firmware_class: report errors properly on failure (bnc#1012382).\n - test_sysctl: add dedicated proc sysctl test driver (FATE#323821)\n - test_sysctl: add generic script to expand on tests (FATE#323821)\n - test_sysctl: add simple proc_dointvec() case (FATE#323821).\n - test_sysctl: add simple proc_douintvec() case (bsc#323821).\n - test_sysctl: fix sysctl.sh by making it executable (FATE#323821).\n - test_sysctl: test against int proc_dointvec() array support\n (FATE#323821).\n - test_sysctl: test against PAGE_SIZE for int (FATE#323821)\n - timer: Prevent timer value 0 for MWAITX (bsc#1065717).\n - tipc: fix link attribute propagation bug (bnc#1012382).\n - tipc: use only positive error codes in messages (bnc#1012382).\n - tools: firmware: check for distro fallback udev cancel rule\n (bnc#1012382).\n - tpm: constify transmit data pointers (bsc#1020645, git-fixes).\n - tpm: kabi: do not bother with added const (bsc#1020645, git-fixes).\n - tpm_tis_spi: Use DMA-safe memory for SPI transfers (bsc#1020645,\n git-fixes).\n - tracing/samples: Fix creation and deletion of simple_thread_fn creation\n (bnc#1012382).\n - tun: allow positive return values on dev_get_valid_name() call\n (bnc#1012382).\n - tun: bail out from tun_get_user() if the skb is empty (bnc#1012382).\n - tun: call dev_get_valid_name() before register_netdevice() (bnc#1012382).\n - tun/tap: sanitize TUNSETSNDBUF input (bnc#1012382).\n - uapi: fix linux/mroute6.h userspace compilation errors (bnc#1012382).\n - uapi: fix linux/rds.h userspace compilation error (bnc#1012382).\n - uapi: fix linux/rds.h userspace compilation errors (bnc#1012382).\n - uapi: fix linux/rds.h userspace compilation errors (bnc#1012382).\n - udpv6: Fix the checksum computation when HW checksum does not apply\n (bnc#1012382).\n - Update config files to enable spidev on arm64. (bsc#1066696)\n - Update preliminary FC-NVMe patches to mainline status (bsc#1067734)\n - usb: Add delay-init quirk for Corsair K70 LUX keyboards (bnc#1012382).\n - usb: cdc_acm: Add quirk for Elatec TWN3 (bnc#1012382).\n - usb: core: fix out-of-bounds access bug in usb_get_bos_descriptor()\n (bnc#1012382).\n - usb: devio: Revert "USB: devio: Do not corrupt user memory"\n (bnc#1012382).\n - usb: dummy-hcd: Fix deadlock caused by disconnect detection\n (bnc#1012382).\n - usb: gadget: composite: Fix use-after-free in\n usb_composite_overwrite_options (bnc#1012382).\n - usb: hcd: initialize hcd->flags to 0 when rm hcd (bnc#1012382).\n - usb: hub: Allow reset retry for USB2 devices on connect bounce\n (bnc#1012382).\n - usb: musb: Check for host-mode using is_host_active() on reset interrupt\n (bnc#1012382).\n - usb: musb: sunxi: Explicitly release USB PHY on exit (bnc#1012382).\n - usb: quirks: add quirk for WORLDE MINI MIDI keyboard (bnc#1012382).\n - usb: renesas_usbhs: Fix DMAC sequence for receiving zero-length packet\n (bnc#1012382).\n - usb: serial: console: fix use-after-free after failed setup\n (bnc#1012382).\n - usb: serial: cp210x: add support for ELV TFD500 (bnc#1012382).\n - usb: serial: ftdi_sio: add id for Cypress WICED dev board (bnc#1012382).\n - usb: serial: garmin_gps: fix I/O after failed probe and remove\n (bnc#1012382).\n - usb: serial: garmin_gps: fix memory leak on probe errors (bnc#1012382).\n - usb: serial: metro-usb: add MS7820 device id (bnc#1012382).\n - usb: serial: option: add support for TP-Link LTE module (bnc#1012382).\n - usb: serial: qcserial: add Dell DW5818, DW5819 (bnc#1012382).\n - usb: serial: qcserial: add pid/vid for Sierra Wireless EM7355 fw update\n (bnc#1012382).\n - usb: usbfs: compute urb->actual_length for isochronous (bnc#1012382).\n - usb: usbtest: fix NULL pointer dereference (bnc#1012382).\n - usb: xhci: Handle error condition in xhci_stop_device() (bnc#1012382).\n - vfs: expedite unmount (bsc#1024412).\n - video: fbdev: pmag-ba-fb: Remove bad `__init' annotation (bnc#1012382).\n - video: udlfb: Fix read EDID timeout (bsc#1031717).\n - vlan: fix a use-after-free in vlan_device_event() (bnc#1012382).\n - vsock: use new wait API for vsock_stream_sendmsg() (bnc#1012382).\n - vti: fix use after free in vti_tunnel_xmit/vti6_tnl_xmit (bnc#1012382).\n - watchdog: kempld: fix gcc-4.3 build (bnc#1012382).\n - workqueue: Fix NULL pointer dereference (bnc#1012382).\n - workqueue: replace pool->manager_arb mutex with a flag (bnc#1012382).\n - x86/acpi/cstate: Allow ACPI C1 FFH MWAIT use on AMD systems\n (bsc#1069879).\n - x86/alternatives: Fix alt_max_short macro to really be a max()\n (bnc#1012382).\n - x86/decoder: Add new TEST instruction pattern (bnc#1012382).\n - x86/MCE/AMD: Always give panic severity for UC errors in kernel context\n (git-fixes bf80bbd7dcf5).\n - x86/microcode/AMD: Add support for fam17h microcode loading\n (bsc#1068032).\n - x86/microcode/intel: Disable late loading on model 79 (bnc#1012382).\n - x86/mm: fix use-after-free of vma during userfaultfd fault (Git-fixes,\n bsc#1069916).\n - x86/oprofile/ppro: Do not use __this_cpu*() in preemptible context\n (bnc#1012382).\n - x86/uaccess, sched/preempt: Verify access_ok() context (bnc#1012382).\n - xen: do not print error message in case of missing Xenstore entry\n (bnc#1012382).\n - xen/events: events_fifo: Do not use {get,put}_cpu() in\n xen_evtchn_fifo_init() (bnc#1065600).\n - xen: fix booting ballooned down hvm guest (bnc#1065600).\n - xen/gntdev: avoid out of bounds access in case of partial gntdev_mmap()\n (bnc#1012382).\n - xen/manage: correct return value check on xenbus_scanf() (bnc#1012382).\n - xen-netback: fix error handling output (bnc#1065600).\n - xen: x86: mark xen_find_pt_base as __init (bnc#1065600).\n - xen: xenbus driver must not accept invalid transaction ids (bnc#1012382).\n - zd1211rw: fix NULL-deref at probe (bsc#1031717).\n\n", "edition": 1, "modified": "2017-12-21T18:10:22", "published": "2017-12-21T18:10:22", "href": "http://lists.opensuse.org/opensuse-security-announce/2017-12/msg00083.html", "id": "SUSE-SU-2017:3398-1", "type": "suse", "title": "Security update for the Linux Kernel (important)", "cvss": {"score": 7.2, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-12-22T03:41:10", "bulletinFamily": "unix", "cvelist": ["CVE-2017-17450", "CVE-2017-15265", "CVE-2017-12193", "CVE-2017-16537", "CVE-2017-15115", "CVE-2017-8824", "CVE-2017-16994", "CVE-2017-17448", "CVE-2017-16646", "CVE-2017-16536", "CVE-2017-7482", "CVE-2017-1000410", "CVE-2017-17449", "CVE-2017-11600", "CVE-2017-16528", "CVE-2017-16645"], "description": "The SUSE Linux Enterprise 12 SP2 kernel was updated to 4.4.103 to receive\n various security and bugfixes.\n\n This update enables SMB encryption in the CIFS support in the Linux Kernel\n (fate#324404)\n\n The following security bugs were fixed:\n\n - CVE-2017-1000410: The Linux kernel was affected by an information leak\n in the processing of incoming L2CAP commands - ConfigRequest, and\n ConfigResponse messages. (bnc#1070535).\n - CVE-2017-11600: net/xfrm/xfrm_policy.c in the Linux kernel did not\n ensure that the dir value of xfrm_userpolicy_id is XFRM_POLICY_MAX or\n less, which allowed local users to cause a denial of service\n (out-of-bounds access) or possibly have unspecified other impact via an\n XFRM_MSG_MIGRATE xfrm Netlink message (bnc#1050231).\n - CVE-2017-12193: The assoc_array_insert_into_terminal_node function in\n lib/assoc_array.c in the Linux kernel mishandled node splitting, which\n allowed local users to cause a denial of service (NULL pointer\n dereference and panic) via a crafted application, as demonstrated by the\n keyring key type, and key addition and link creation operations\n (bnc#1066192).\n - CVE-2017-15115: The sctp_do_peeloff function in net/sctp/socket.c in the\n Linux kernel did not check whether the intended netns is used in a\n peel-off action, which allowed local users to cause a denial of service\n (use-after-free and system crash) or possibly have unspecified other\n impact via crafted system calls (bnc#1068671).\n - CVE-2017-15265: Race condition in the ALSA subsystem in the Linux kernel\n allowed local users to cause a denial of service (use-after-free) or\n possibly have unspecified other impact via crafted /dev/snd/seq ioctl\n calls, related to sound/core/seq/seq_clientmgr.c and\n sound/core/seq/seq_ports.c (bnc#1062520).\n - CVE-2017-16528: sound/core/seq_device.c in the Linux kernel allowed\n local users to cause a denial of service (snd_rawmidi_dev_seq_free\n use-after-free and system crash) or possibly have unspecified other\n impact via a crafted USB device (bnc#1066629).\n - CVE-2017-16536: The cx231xx_usb_probe function in\n drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux kernel allowed\n local users to cause a denial of service (NULL pointer dereference and\n system crash) or possibly have unspecified other impact via a crafted\n USB device (bnc#1066606).\n - CVE-2017-16537: The imon_probe function in drivers/media/rc/imon.c in\n the Linux kernel allowed local users to cause a denial of service (NULL\n pointer dereference and system crash) or possibly have unspecified other\n impact via a crafted USB device (bnc#1066573).\n - CVE-2017-16645: The ims_pcu_get_cdc_union_desc function in\n drivers/input/misc/ims-pcu.c in the Linux kernel allowed local users to\n cause a denial of service (ims_pcu_parse_cdc_data out-of-bounds read and\n system crash) or possibly have unspecified other impact via a crafted\n USB device (bnc#1067132).\n - CVE-2017-16646: drivers/media/usb/dvb-usb/dib0700_devices.c in the Linux\n kernel allowed local users to cause a denial of service (BUG and system\n crash) or possibly have unspecified other impact via a crafted USB\n device (bnc#1067105).\n - CVE-2017-16994: The walk_hugetlb_range function in mm/pagewalk.c in the\n Linux kernel mishandled holes in hugetlb ranges, which allowed local\n users to obtain sensitive information from uninitialized kernel memory\n via crafted use of the mincore() system call (bnc#1069996).\n - CVE-2017-17448: net/netfilter/nfnetlink_cthelper.c in the Linux kernel\n did not require the CAP_NET_ADMIN capability for new, get, and del\n operations, which allowed local users to bypass intended access\n restrictions because the nfnl_cthelper_list data structure is shared\n across all net namespaces (bnc#1071693).\n - CVE-2017-17449: The __netlink_deliver_tap_skb function in\n net/netlink/af_netlink.c in the Linux kernel through 4.14.4, when\n CONFIG_NLMON is enabled, did not restrict observations of Netlink\n messages to a single net namespace, which allowed local users to obtain\n sensitive information by leveraging the CAP_NET_ADMIN capability to\n sniff an nlmon interface for all Netlink activity on the system\n (bnc#1071694).\n - CVE-2017-17450: net/netfilter/xt_osf.c in the Linux kernel did not\n require the CAP_NET_ADMIN capability for add_callback and\n remove_callback operations, which allowed local users to bypass intended\n access restrictions because the xt_osf_fingers data structure is shared\n across all net namespaces (bnc#1071695).\n - CVE-2017-7482: Fixed an overflow when decoding a krb5 principal.\n (bnc#1046107).\n - CVE-2017-8824: The dccp_disconnect function in net/dccp/proto.c in the\n Linux kernel allowed local users to gain privileges or cause a denial of\n service (use-after-free) via an AF_UNSPEC connect system call during the\n DCCP_LISTEN state (bnc#1070771).\n\n The following non-security bugs were fixed:\n\n - adm80211: return an error if adm8211_alloc_rings() fails (bsc#1031717).\n - adv7604: Initialize drive strength to default when using DT\n (bnc#1012382).\n - af_netlink: ensure that NLMSG_DONE never fails in dumps (bnc#1012382).\n - alsa: au88x0: avoid theoretical uninitialized access (bnc#1012382).\n - alsa: caiaq: Fix stray URB at probe error path (bnc#1012382).\n - alsa: compress: Remove unused variable (bnc#1012382).\n - alsa: hda: Add Raven PCI ID (bnc#1012382).\n - alsa: hda - Apply ALC269_FIXUP_NO_SHUTUP on HDA_FIXUP_ACT_PROBE\n (bnc#1012382).\n - alsa: hda/ca0132 - Fix memory leak at error path (bsc#1031717).\n - alsa: hda - fix headset mic problem for Dell machines with alc236\n (bnc#1012382).\n - alsa: hda - No loopback on ALC299 codec (git-fixes).\n - alsa: hda/realtek: Add headset mic support for Intel NUC Skull Canyon\n (bsc#1031717).\n - alsa: hda/realtek - Add new codec ID ALC299 (bnc#1012382).\n - alsa: hda/realtek - Add support for ALC236/ALC3204 (bnc#1012382).\n - alsa: hda/realtek - Fix ALC700 family no sound issue (bsc#1031717).\n - alsa: hda: Remove superfluous '-' added by printk conversion\n (bnc#1012382).\n - alsa: line6: Fix leftover URB at error-path during probe (bnc#1012382).\n - alsa: pcm: update tstamp only if audio_tstamp changed (bsc#1031717).\n - alsa: seq: Avoid invalid lockdep class warning (bsc#1031717).\n - alsa: seq: Enable 'use' locking in all configurations (bnc#1012382).\n - alsa: seq: Fix copy_from_user() call inside lock (bnc#1012382).\n - alsa: seq: Fix nested rwsem annotation for lockdep splat (bnc#1012382).\n - alsa: seq: Fix OSS sysex delivery in OSS emulation (bnc#1012382).\n - alsa: timer: Add missing mutex lock for compat ioctls (bnc#1012382).\n - alsa: timer: Remove kernel warning at compat ioctl error paths\n (bsc#1031717).\n - alsa: usb-audio: Add native DSD support for Pro-Ject Pre Box S2 Digital\n (bnc#1012382).\n - alsa: usb-audio: Add sanity checks in v2 clock parsers (bsc#1031717).\n - alsa: usb-audio: Add sanity checks to FE parser (bsc#1031717).\n - alsa: usb-audio: Check out-of-bounds access by corrupted buffer\n descriptor (bnc#1012382).\n - alsa: usb-audio: Fix potential out-of-bound access at parsing SU\n (bsc#1031717).\n - alsa: usb-audio: Kill stray URB at exiting (bnc#1012382).\n - alsa: usb-audio: uac1: Invalidate ctl on interrupt (bsc#1031717).\n - alsa: usx2y: Suppress kernel warning at page allocation failures\n (bnc#1012382).\n - alsa: vx: Do not try to update capture stream before running\n (bnc#1012382).\n - alsa: vx: Fix possible transfer overflow (bnc#1012382).\n - Apply generic ppc build fixes to vanilla (bsc#1070805)\n - arm64: dts: NS2: reserve memory for Nitro firmware (bnc#1012382).\n - arm64: ensure __dump_instr() checks addr_limit (bnc#1012382).\n - arm64: fix dump_instr when PAN and UAO are in use (bnc#1012382).\n - arm: 8635/1: nommu: allow enabling REMAP_VECTORS_TO_RAM (bnc#1012382).\n - arm: 8715/1: add a private asm/unaligned.h (bnc#1012382).\n - arm: 8720/1: ensure dump_instr() checks addr_limit (bnc#1012382).\n - arm: 8721/1: mm: dump: check hardware RO bit for LPAE (bnc#1012382).\n - arm: 8722/1: mm: make STRICT_KERNEL_RWX effective for LPAE (bnc#1012382).\n - arm: crypto: reduce priority of bit-sliced AES cipher (bnc#1012382).\n - arm: dts: Fix am335x and dm814x scm syscon to probe children\n (bnc#1012382).\n - arm: dts: Fix compatible for ti81xx uarts for 8250 (bnc#1012382).\n - arm: dts: Fix omap3 off mode pull defines (bnc#1012382).\n - arm: dts: mvebu: pl310-cache disable double-linefill (bnc#1012382).\n - arm: dts: r8a7790: Use R-Car Gen 2 fallback binding for msiof nodes\n (bnc#1012382).\n - arm: OMAP2+: Fix init for multiple quirks for the same SoC (bnc#1012382).\n - arm: omap2plus_defconfig: Fix probe errors on UARTs 5 and 6\n (bnc#1012382).\n - arm: pxa: Do not rely on public mmc header to include leds.h\n (bnc#1012382).\n - arm: remove duplicate 'const' annotations' (bnc#1012382).\n - asm/sections: add helpers to check for section data (bsc#1063026).\n - asoc: adau17x1: Workaround for noise bug in ADC (bnc#1012382).\n - asoc: cs42l56: Fix reset GPIO name in example DT binding (bsc#1031717).\n - asoc: dapm: fix some pointer error handling (bnc#1012382).\n - asoc: dapm: handle probe deferrals (bnc#1012382).\n - asoc: davinci-mcasp: Fix an error handling path in\n 'davinci_mcasp_probe()' (bsc#1031717).\n - asoc: rsnd: do not double free kctrl (bnc#1012382).\n - asoc: samsung: Fix possible double iounmap on s3c24xx driver probe\n failure (bsc#1031717).\n - asoc: wm_adsp: Do not overrun firmware file buffer when reading region\n data (bnc#1012382).\n - ata: ATA_BMDMA should depend on HAS_DMA (bnc#1012382).\n - ata: fixes kernel crash while tracing ata_eh_link_autopsy event\n (bnc#1012382).\n - ata: SATA_HIGHBANK should depend on HAS_DMA (bnc#1012382).\n - ata: SATA_MV should depend on HAS_DMA (bnc#1012382).\n - ath10k: convert warning about non-existent OTP board id to debug message\n (git-fixes).\n - ath10k: fix a warning during channel switch with multiple vaps\n (bsc#1031717).\n - ath10k: fix board data fetch error message (bsc#1031717).\n - ath10k: fix diag_read to collect data for larger memory (bsc#1031717).\n - ath10k: fix incorrect txpower set by P2P_DEVICE interface (bnc#1012382).\n - ath10k: fix potential memory leak in ath10k_wmi_tlv_op_pull_fw_stats()\n (bnc#1012382).\n - ath10k: free cached fw bin contents when get board id fails\n (bsc#1031717).\n - ath10k: ignore configuring the incorrect board_id (bnc#1012382).\n - ath10k: set CTS protection VDEV param only if VDEV is up (bnc#1012382).\n - ath9k_htc: check for underflow in ath9k_htc_rx_msg() (bsc#1031717).\n - ath9k: off by one in ath9k_hw_nvram_read_array() (bsc#1031717).\n - audit: log 32-bit socketcalls (bnc#1012382).\n - autofs: do not fail mount for transient error (bsc#1065180).\n - backlight: adp5520: Fix error handling in adp5520_bl_probe()\n (bnc#1012382).\n - backlight: lcd: Fix race condition during register (bnc#1012382).\n - bcache: check ca->alloc_thread initialized before wake up it\n (bnc#1012382).\n - block: Fix a race between blk_cleanup_queue() and timeout handling\n (FATE#319965, bsc#964944).\n - bluetooth: btusb: fix QCA Rome suspend/resume (bnc#1012382).\n - bnxt_en: Call firmware to approve the random VF MAC address (bsc#963575\n FATE#320144).\n - bnxt_en: Do not setup MAC address in bnxt_hwrm_func_qcaps() (bsc#963575\n FATE#320144).\n - bnxt_en: Fix possible corrupted NVRAM parameters from firmware response\n (bsc#963575 FATE#320144).\n - bnxt_en: Fix VF PCIe link speed and width logic (bsc#963575 FATE#320144).\n - bnxt_en: Re-arrange bnxt_hwrm_func_qcaps() (bsc#963575 FATE#320144).\n - bnxt_en: use eth_hw_addr_random() (bsc#963575 FATE#320144).\n - bonding: discard lowest hash bit for 802.3ad layer3+4 (bnc#1012382).\n - bpf: one perf event close won't free bpf program attached by another\n perf event (bnc#1012382).\n - bpf/verifier: reject BPF_ALU64|BPF_END (bnc#1012382).\n - brcmfmac: add length check in brcmf_cfg80211_escan_handler()\n (bnc#1012382).\n - brcmfmac: remove setting IBSS mode when stopping AP (bnc#1012382).\n - brcmfmac: setup passive scan if requested by user-space (bnc#1012382).\n - brcmsmac: make some local variables 'static const' to reduce stack size\n (bnc#1012382).\n - bridge: netlink: register netdevice before executing changelink\n (bnc#1012382).\n - bt8xx: fix memory leak (bnc#1012382).\n - btrfs: add a node counter to each of the rbtrees (bsc#974590 bsc#1030061\n bsc#1022914 bsc#1017461).\n - btrfs: add cond_resched() calls when resolving backrefs (bsc#974590\n bsc#1030061 bsc#1022914 bsc#1017461).\n - btrfs: allow backref search checks for shared extents (bsc#974590\n bsc#1030061 bsc#1022914 bsc#1017461).\n - btrfs: backref, add tracepoints for prelim_ref insertion and merging\n (bsc#974590 bsc#1030061 bsc#1022914 bsc#1017461).\n - btrfs: backref, add unode_aux_to_inode_list helper (bsc#974590\n bsc#1030061 bsc#1022914 bsc#1017461).\n - btrfs: backref, cleanup __ namespace abuse (bsc#974590 bsc#1030061\n bsc#1022914 bsc#1017461).\n - btrfs: backref, constify some arguments (bsc#974590 bsc#1030061\n bsc#1022914 bsc#1017461).\n - btrfs: btrfs_check_shared should manage its own transaction (bsc#974590\n bsc#1030061 bsc#1022914 bsc#1017461).\n - btrfs: clean up extraneous computations in add_delayed_refs (bsc#974590\n bsc#1030061 bsc#1022914 bsc#1017461).\n - btrfs: constify tracepoint arguments (bsc#974590 bsc#1030061 bsc#1022914\n bsc#1017461).\n - btrfs: convert prelimary reference tracking to use rbtrees (bsc#974590\n bsc#1030061 bsc#1022914 bsc#1017461).\n - btrfs: fix leak and use-after-free in resolve_indirect_refs (bsc#974590\n bsc#1030061 bsc#1022914 bsc#1017461).\n - btrfs: Fix typo in may_commit_transaction Rather than comparing the\n result of the percpu comparison I was comparing the value of the percpu\n counter against 0 or 1.\n - btrfs: remove ref_tree implementation from backref.c (bsc#974590\n bsc#1030061 bsc#1022914 bsc#1017461).\n - btrfs: return the actual error value from from btrfs_uuid_tree_iterate\n (bnc#1012382).\n - btrfs: struct-funcs, constify readers (bsc#974590 bsc#1030061\n bsc#1022914 bsc#1017461).\n - bus: mbus: fix window size calculation for 4GB windows (bnc#1012382).\n - can: c_can: do not indicate triple sampling support for D_CAN\n (bnc#1012382).\n - can: esd_usb2: Fix can_dlc value for received RTR, frames (bnc#1012382).\n - can: gs_usb: fix busy loop if no more TX context is available\n (bnc#1012382).\n - can: kvaser_usb: Correct return value in printout (bnc#1012382).\n - can: kvaser_usb: Ignore CMD_FLUSH_QUEUE_REPLY messages (bnc#1012382).\n - can: sun4i: fix loopback mode (bnc#1012382).\n - can: sun4i: handle overrun in RX FIFO (bnc#1012382).\n - cdc_ncm: Set NTB format again after altsetting switch for Huawei devices\n (bnc#1012382).\n - ceph: avoid panic in create_session_open_msg() if utsname() returns NULL\n (bsc#1061451).\n - ceph: check negative offsets in ceph_llseek() (bsc#1061451).\n - ceph: clean up unsafe d_parent accesses in build_dentry_path\n (bnc#1012382).\n - ceph: unlock dangling spinlock in try_flush_caps() (bsc#1065639).\n - cgroup, net_cls: iterate the fds of only the tasks which are being\n migrated (bnc#1064926).\n - cifs: add build_path_from_dentry_optional_prefix() (fate#323482)\n - cifs: Add capability to decrypt big read responses (FATE#324404). Allow\n to decrypt transformed packets that are bigger than the big buffer size.\n In particular it is used for read responses that can only exceed the big\n buffer size.\n - cifs: Add capability to transform requests before sending (FATE#324404).\n This will allow us to do protocol specific tranformations of packets\n before sending to the server. For SMB3 it can be used to support\n encryption.\n - cifs: Add copy into pages callback for a read operation (FATE#324404).\n Since we have two different types of reads (pagecache and direct) we\n need to process such responses differently after decryption of a packet.\n The change allows to specify a callback that copies a read payload data\n into preallocated pages.\n - cifs: Add mid handle callback (FATE#324404). We need to process read\n responses differently because the data should go directly into\n preallocated pages. This can be done by specifying a mid handle callback.\n - cifs: Add soft dependencies (FATE#324404). List soft dependencies of\n cifs so that mkinitrd and dracut can include the required helper modules.\n - cifs: Add transform header handling callbacks (FATE#324404). We need to\n recognize and parse transformed packets in demultiplex thread to find a\n corresponsing mid and process it further.\n - cifs: add use_ipc flag to SMB2_ioctl() (fate#323482)\n - cifs: Allow to switch on encryption with seal mount option\n (FATE#324404). This allows users to inforce encryption for SMB3 shares\n if a server supports it.\n - cifs: check MaxPathNameComponentLength != 0 before using it\n (bnc#1012382).\n - cifs: Decrypt and process small encrypted packets (FATE#324404). Allow\n to decrypt transformed packets, find a corresponding mid and process as\n usual further.\n - cifs: do not bother with kmap on read_pages side (FATE#324404). just do\n ITER_BVEC recvmsg\n - cifs: Enable encryption during session setup phase (FATE#324404). In\n order to allow encryption on SMB connection we need to exchange a\n session key and generate encryption and decryption keys.\n - cifs: Encrypt SMB3 requests before sending (FATE#324404). This change\n allows to encrypt packets if it is required by a server for SMB sessions\n or tree connections.\n - cifs: fix circular locking dependency (bsc#1064701).\n - cifs: Fix some return values in case of error in 'crypt_message'\n (fate#324404).\n - cifs: Fix sparse warnings (fate#323482)\n - cifs: implement get_dfs_refer for SMB2+ (fate#323482)\n - cifs: let ses->ipc_tid hold smb2 TreeIds (fate#323482)\n - cifs: Make send_cancel take rqst as argument (FATE#324404).\n - cifs: Make SendReceive2() takes resp iov (FATE#324404). Now SendReceive2\n frees the first iov and returns a response buffer in it that increases a\n code complexity. Simplify this by making a caller responsible for\n freeing request buffer itself and returning a response buffer in a\n separate iov.\n - cifs: move DFS response parsing out of SMB1 code (fate#323482)\n - cifs: no need to wank with copying and advancing iovec on recvmsg side\n either (FATE#324404).\n - cifs: Only select the required crypto modules (FATE#324404). The sha256\n and cmac crypto modules are only needed for SMB2+, so move the select\n statements to config CIFS_SMB2. Also select CRYPTO_AES there as SMB2+\n needs it.\n - cifs: Prepare for encryption support (first part). Add decryption and\n encryption key generation. (FATE#324404).\n - cifs_readv_receive: use cifs_read_from_socket() (FATE#324404).\n - cifs: Reconnect expired SMB sessions (bnc#1012382).\n - cifs: remove any preceding delimiter from prefix_path (fate#323482)\n - cifs: Send RFC1001 length in a separate iov (FATE#324404). In order to\n simplify further encryption support we need to separate RFC1001 length\n and SMB2 header when sending a request. Put the length field in iov[0]\n and the rest of the packet into following iovs.\n - cifs: Separate RFC1001 length processing for SMB2 read (FATE#324404).\n Allocate and initialize SMB2 read request without RFC1001 length field\n to directly call cifs_send_recv() rather than SendReceive2() in a read\n codepath.\n - cifs: Separate SMB2 header structure (FATE#324404). In order to support\n compounding and encryption we need to separate RFC1001 length field and\n SMB2 header structure because the protocol treats them differently. This\n change will allow to simplify parsing of such complex SMB2 packets\n further.\n - cifs: Separate SMB2 sync header processing (FATE#324404). Do not process\n RFC1001 length in smb2_hdr_assemble() because it is not a part of SMB2\n header. This allows to cleanup the code and adds a possibility combine\n several SMB2 packets into one for compounding.\n - cifs: set signing flag in SMB2+ TreeConnect if needed (fate#323482)\n - cifs: Simplify SMB2 and SMB311 dependencies (FATE#324404).\n - clk: ti: dra7-atl-clock: fix child-node lookups (bnc#1012382).\n - clk: ti: dra7-atl-clock: Fix of_node reference counting (bnc#1012382).\n - clockevents/drivers/cs5535: Improve resilience to spurious interrupts\n (bnc#1012382).\n - cma: fix calculation of aligned offset (VM Functionality, bsc#1050060).\n - coda: fix 'kernel memory exposure attempt' in fsync (bnc#1012382).\n - cpufreq: CPPC: add ACPI_PROCESSOR dependency (bnc#1012382).\n - crypto: shash - Fix zero-length shash ahash digest crash (bnc#1012382).\n - crypto: vmx - disable preemption to enable vsx in aes_ctr.c\n (bnc#1012382).\n - crypto: x86/sha1-mb - fix panic due to unaligned access (bnc#1012382).\n - crypto: xts - Add ECB dependency (bnc#1012382).\n - cx231xx: Fix I2C on Internal Master 3 Bus (bnc#1012382).\n - cxgb4: Fix error codes in c4iw_create_cq() (bsc#1021424).\n - cxl: Fix DAR check & use REGION_ID instead of opencoding (bsc#1066223).\n - cxl: Fix leaking pid refs in some error paths (bsc#1066223).\n - cxl: Force context lock during EEH flow (bsc#1066223).\n - cxl: Prevent adapter reset if an active context exists (bsc#1066223).\n - cxl: Route eeh events to all drivers in cxl_pci_error_detected()\n (bsc#1066223).\n - direct-io: Prevent NULL pointer access in submit_page_section\n (bnc#1012382).\n - Disable\n patches.kernel.org/4.4.93-022-fix-unbalanced-page-refcounting-in-bio_map_us\n e.patch (bsc#1070767)\n - dmaengine: dmatest: warn user when dma test times out (bnc#1012382).\n - dmaengine: edma: Align the memcpy acnt array size with the transfer\n (bnc#1012382).\n - dmaengine: zx: set DMA_CYCLIC cap_mask bit (bnc#1012382).\n - dm bufio: fix integer overflow when limiting maximum cache size\n (bnc#1012382).\n - dm: fix race between dm_get_from_kobject() and __dm_destroy()\n (bnc#1012382).\n - driver core: platform: Do not read past the end of "driver_override"\n buffer (bnc#1012382).\n - drivers: dma-mapping: Do not leave an invalid area->pages pointer in\n dma_common_contiguous_remap() (Git-fixes, bsc#1065692).\n - drivers: firmware: psci: drop duplicate const from psci_of_match\n (bnc#1012382).\n - drivers: hv: fcopy: restore correct transfer length (bnc#1012382).\n - drm/amdgpu: when dpm disabled, also need to stop/start vce (bnc#1012382).\n - drm/amdkfd: fix improper return value on error (bnc#1012382).\n - drm/amdkfd: NULL dereference involving create_process() (bsc#1031717).\n - drm: Apply range restriction after color adjustment when allocation\n (bnc#1012382).\n - drm/armada: Fix compile fail (bnc#1012382).\n - drm: bridge: add DT bindings for TI ths8135 (bnc#1012382).\n - drm: drm_minor_register(): Clean up debugfs on failure (bnc#1012382).\n - drm_fourcc: Fix DRM_FORMAT_MOD_LINEAR #define (bnc#1012382).\n - drm: gma500: fix logic error (bsc#1031717).\n - drm/i915/bios: ignore HDMI on port A (bnc#1012382).\n - drm/i915/bxt: set min brightness from VBT (bsc#1031717).\n - drm/i915: Do not try indexed reads to alternate slave addresses\n (bsc#1031717).\n - drm/i915: fix backlight invert for non-zero minimum brightness\n (bsc#1031717).\n - drm/i915: Prevent zero length "index" write (bsc#1031717).\n - drm/i915: Read timings from the correct transcoder in\n intel_crtc_mode_get() (bsc#1031717).\n - drm/msm: fix an integer overflow test (bnc#1012382).\n - drm/msm: Fix potential buffer overflow issue (bnc#1012382).\n - drm/nouveau/bsp/g92: disable by default (bnc#1012382).\n - drm/nouveau/gr: fallback to legacy paths during firmware lookup\n (bsc#1031717).\n - drm/nouveau/mmu: flush tlbs before deleting page tables (bnc#1012382).\n - drm/omap: Fix error handling path in 'omap_dmm_probe()' (bsc#1031717).\n - drm/panel: simple: Add missing panel_simple_unprepare() calls\n (bsc#1031717).\n - drm/sti: sti_vtg: Handle return NULL error from devm_ioremap_nocache\n (bnc#1012382).\n - drm/vc4: Fix leak of HDMI EDID (bsc#1031717).\n - drm/vmwgfx: Fix Ubuntu 17.10 Wayland black screen issue (bnc#1012382).\n - e1000e: Fix error path in link detection (bnc#1012382).\n - e1000e: Fix return value test (bnc#1012382).\n - e1000e: Separate signaling for link check/link up (bnc#1012382).\n - ecryptfs: fix dereference of NULL user_key_payload (bnc#1012382).\n - eCryptfs: use after free in ecryptfs_release_messaging() (bsc#1012829).\n - epoll: avoid calling ep_call_nested() from ep_poll_safewake()\n (bsc#1056427).\n - epoll: remove ep_call_nested() from ep_eventpoll_poll() (bsc#1056427).\n - ext4: cleanup goto next group (bsc#1066285).\n - ext4: do not allow encrypted operations without keys (bnc#1012382).\n patches.drivers/0001-iwlwifi-nvm-fix-up-phy-section-when-reading-it.patch.\n\n - ext4: do not use stripe_width if it is not set (bnc#1012382).\n - ext4: fix interaction between i_size, fallocate, and delalloc after a\n crash (bnc#1012382).\n - ext4: fix stripe-unaligned allocations (bnc#1012382).\n - ext4: in ext4_seek_{hole,data}, return -ENXIO for negative offsets\n (bnc#1012382).\n - ext4: reduce lock contention in __ext4_new_inode (bsc#1066285).\n - extcon: axp288: Use vbus-valid instead of -present to determine cable\n presence (bnc#1012382).\n - extcon: palmas: Check the parent instance to prevent the NULL\n (bnc#1012382).\n - exynos4-is: fimc-is: Unmap region obtained by of_iomap() (bnc#1012382).\n - exynos-gsc: Do not swap cb/cr for semi planar formats (bnc#1012382).\n - f2fs crypto: add missing locking for keyring_key access (bnc#1012382).\n - f2fs crypto: replace some BUG_ON()'s with error checks (bnc#1012382).\n - f2fs: do not wait for writeback in write_begin (bnc#1012382).\n - fealnx: Fix building error on MIPS (bnc#1012382).\n - fix a page leak in vhost_scsi_iov_to_sgl() error recovery (bnc#1012382).\n - Fix serial console on SNI RM400 machines (bsc#1031717).\n - Fix tracing sample code warning (bnc#1012382).\n - fix unbalanced page refcounting in bio_map_user_iov (bnc#1012382).\n - fix whitespace according to upstream commit\n - fm10k: request reset when mbx->state changes (bnc#1012382).\n - fm10k: Use smp_rmb rather than read_barrier_depends (bnc#1012382).\n - fs/9p: Compare qid.path in v9fs_test_inode (bsc#1012829).\n - fs-cache: fix dereference of NULL user_key_payload (bnc#1012382).\n - fscrypt: fix dereference of NULL user_key_payload (bnc#1012382).\n - fscrypt: lock mutex before checking for bounce page pool (bnc#1012382).\n - fscrypto: require write access to mount to set encryption policy\n (bnc#1012382).\n - fs/epoll: cache leftmost node (bsc#1056427).\n - ftrace: Fix kmemleak in unregister_ftrace_graph (bnc#1012382).\n - fuse: fix READDIRPLUS skipping an entry (bnc#1012382).\n - gfs2: Fix reference to ERR_PTR in gfs2_glock_iter_next (bnc#1012382).\n - gpu: drm: mgag200: mgag200_main:- Handle error from pci_iomap\n (bnc#1012382).\n - hid: elo: clear BTN_LEFT mapping (bsc#1065866).\n - hid: i2c-hid: allocate hid buffers for real worst case (bnc#1012382).\n - hid: usbhid: fix out-of-bounds bug (bnc#1012382).\n - hpsa: correct lun data caching bitmap definition (bsc#1028971).\n - hsi: ssi_protocol: double free in ssip_pn_xmit() (bsc#1031717).\n - hwmon: (gl520sm) Fix overflows and crash seen when writing into limit\n attributes (bnc#1012382).\n - i2c: at91: ensure state is restored after suspending (bnc#1012382).\n - i2c: cadance: fix ctrl/addr reg write order (bsc#1031717).\n - i2c: imx: Use correct function to write to register (bsc#1031717).\n - i2c: ismt: Separate I2C block read from SMBus block read (bnc#1012382).\n - i2c: meson: fix wrong variable usage in meson_i2c_put_data (bnc#1012382).\n - i2c: riic: correctly finish transfers (bnc#1012382).\n - i2c: riic: fix restart condition (git-fixes).\n - i40e: Initialize 64-bit statistics TX ring seqcount (bsc#969476\n FATE#319648 bsc#969477 FATE#319816).\n - i40e: Use smp_rmb rather than read_barrier_depends (bnc#1012382).\n - i40evf: Use smp_rmb rather than read_barrier_depends (bnc#1012382).\n - i40iw: Add missing memory barriers (bsc#969476 FATE#319648 bsc#969477\n FATE#319816).\n - i40iw: Fix port number for query QP (bsc#969476 FATE#319648 bsc#969477\n FATE#319816).\n - ib/core: Fix calculation of maximum RoCE MTU (bsc#1022595 FATE#322350).\n - ib/core: Fix for core panic (bsc#1022595 FATE#322350).\n - ib/core: Fix the validations of a multicast LID in attach or detach\n operations (bsc#1022595 FATE#322350).\n - ib/core: Namespace is mandatory input for address resolution\n (bsc#1022595 FATE#322350).\n - ib/i40iw: Fix error code in i40iw_create_cq() (bsc#969476 FATE#319648\n bsc#969477 FATE#319816).\n - ib/ipoib: Change list_del to list_del_init in the tx object\n (bnc#1012382).\n - ib/ipoib: Clean error paths in add port (bsc#1022595 FATE#322350).\n - ib/ipoib: Fix deadlock over vlan_mutex (bnc#1012382).\n - ib/ipoib: Prevent setting negative values to max_nonsrq_conn_qp\n (bsc#1022595 FATE#322350).\n - ib/ipoib: Remove double pointer assigning (bsc#1022595 FATE#322350).\n - ib/ipoib: Replace list_del of the neigh->list with list_del_init\n (bnc#1012382).\n - ib/ipoib: rtnl_unlock can not come after free_netdev (bnc#1012382).\n - ib/ipoib: Set IPOIB_NEIGH_TBL_FLUSH after flushed completion\n initialization (bsc#1022595 FATE#322350).\n - ib/mlx5: Fix Raw Packet QP event handler assignment (bsc#966170\n FATE#320225 bsc#966172 FATE#320226).\n - ib/mlx5: Fix RoCE Address Path fields (bsc#966170 FATE#320225 bsc#966172\n FATE#320226).\n - ibmvnic: Add netdev_dbg output for debugging (fate#323285).\n - ibmvnic: Add vnic client data to login buffer (bsc#1069942).\n - ibmvnic: Convert vnic server reported statistics to cpu endian\n (fate#323285).\n - ibmvnic: Enable scatter-gather support (bsc#1066382).\n - ibmvnic: Enable TSO support (bsc#1066382).\n - ibmvnic: Feature implementation of Vital Product Data (VPD) for the\n ibmvnic driver (bsc#1069942).\n - ibmvnic: Fix calculation of number of TX header descriptors\n (bsc#1066382).\n - ibmvnic: fix dma_mapping_error call (bsc#1069942).\n - ibmvnic: Fix failover error path for non-fatal resets (bsc#1066382).\n - ibmvnic: Implement .get_channels (fate#323285).\n - ibmvnic: Implement .get_ringparam (fate#323285).\n - ibmvnic: Implement per-queue statistics reporting (fate#323285).\n - ibmvnic: Let users change net device features (bsc#1066382).\n - ibmvnic: Set state UP (bsc#1062962).\n - ibmvnic: Update reset infrastructure to support tunable parameters\n (bsc#1066382).\n - ib/qib: fix false-postive maybe-uninitialized warning (bnc#1012382).\n - ib/srp: Avoid that a cable pull can trigger a kernel crash (bsc#1022595\n FATE#322350).\n - ib/srpt: Do not accept invalid initiator port names (bnc#1012382).\n - ib/uverbs: Fix device cleanup (bsc#1022595 FATE#322350).\n - ib/uverbs: Fix NULL pointer dereference during device removal\n (bsc#1022595 FATE#322350).\n - igb: close/suspend race in netif_device_detach (bnc#1012382).\n - igb: Fix hw_dbg logging in igb_update_flash_i210 (bnc#1012382).\n - igb: re-assign hw address pointer on reset after PCI error (bnc#1012382).\n - igb: reset the PHY before reading the PHY ID (bnc#1012382).\n - igb: Use smp_rmb rather than read_barrier_depends (bnc#1012382).\n - igbvf: Use smp_rmb rather than read_barrier_depends (bnc#1012382).\n - iio: ad7793: Fix the serial interface reset (bnc#1012382).\n - iio: adc: axp288: Drop bogus AXP288_ADC_TS_PIN_CTRL register\n modifications (bnc#1012382).\n - iio: adc: hx711: Add DT binding for avia,hx711 (bnc#1012382).\n - iio: adc: mcp320x: Fix oops on module unload (bnc#1012382).\n - iio: adc: mcp320x: Fix readout of negative voltages (bnc#1012382).\n - iio: adc: twl4030: Disable the vusb3v1 rugulator in the error handling\n path of 'twl4030_madc_probe()' (bnc#1012382).\n - iio: adc: twl4030: Fix an error handling path in 'twl4030_madc_probe()'\n (bnc#1012382).\n - iio: adc: xilinx: Fix error handling (bnc#1012382).\n - iio: ad_sigma_delta: Implement a dedicated reset function (bnc#1012382).\n - iio: core: Return error for failed read_reg (bnc#1012382).\n - iio: dummy: events: Add missing break (bsc#1031717).\n - iio: light: fix improper return value (bnc#1012382).\n - iio: trigger: free trigger resource correctly (bnc#1012382).\n - ima: do not update security.ima if appraisal status is not\n INTEGRITY_PASS (bnc#1012382).\n - input: ar1021_i2c - fix too long name in driver's device table\n (bsc#1031717).\n - input: edt-ft5x06 - fix setting gain, offset, and threshold via device\n tree (bsc#1031717).\n - input: elan_i2c - add ELAN060C to the ACPI table (bnc#1012382).\n - input: elan_i2c - add ELAN0611 to the ACPI table (bnc#1012382).\n - input: gtco - fix potential out-of-bound access (bnc#1012382).\n - input: mpr121 - handle multiple bits change of status register\n (bnc#1012382).\n - input: mpr121 - set missing event capability (bnc#1012382).\n - input: ti_am335x_tsc - fix incorrect step config for 5 wire touchscreen\n (bsc#1031717).\n - input: twl4030-pwrbutton - use correct device for irq request\n (bsc#1031717).\n - input: ucb1400_ts - fix suspend and resume handling (bsc#1031717).\n - input: uinput - avoid crash when sending FF request to device going away\n (bsc#1031717).\n - iommu/amd: Finish TLB flush in amd_iommu_unmap() (bnc#1012382).\n - iommu/arm-smmu-v3: Clear prior settings when updating STEs (bnc#1012382).\n - iommu/io-pgtable-arm: Check for leaf entry before dereferencing it\n (bnc#1012382).\n - iommu/vt-d: Do not register bus-notifier under dmar_global_lock\n (bsc#1069793).\n - ip6_gre: only increase err_count for some certain type icmpv6 in\n ip6gre_err (bnc#1012382).\n - ip6_gre: skb_push ipv6hdr before packing the header in ip6gre_header\n (bnc#1012382).\n - ipip: only increase err_count for some certain type icmp in ipip_err\n (bnc#1012382).\n - ipmi: Disable IPMI fix patches due to regression (bsc#1071833)\n - ipmi: fix unsigned long underflow (bnc#1012382).\n - ipmi: Pick up slave address from SMBIOS on an ACPI device (bsc#1070006).\n - ipmi: Prefer ACPI system interfaces over SMBIOS ones (bsc#1070006).\n - ipmi_si: Clean up printks (bsc#1070006).\n - ipmi_si: fix memory leak on new_smi (bsc#1070006).\n - ipsec: do not ignore crypto err in ah4 input (bnc#1012382).\n - ipv6: flowlabel: do not leave opt->tot_len with garbage (bnc#1012382).\n - ipv6: only call ip6_route_dev_notify() once for NETDEV_UNREGISTER\n (bnc#1012382).\n - ipvs: make drop_entry protection effective for SIP-pe (bsc#1056365).\n - irqchip/crossbar: Fix incorrect type of local variables (bnc#1012382).\n - isa: Prevent NULL dereference in isa_bus driver callbacks (bsc#1031717).\n - iscsi-target: Fix non-immediate TMR reference leak (bnc#1012382).\n - isdn/i4l: fetch the ppp_write buffer in one shot (bnc#1012382).\n - isofs: fix timestamps beyond 2027 (bnc#1012382).\n - iwlwifi: add workaround to disable wide channels in 5GHz (bnc#1012382).\n - iwlwifi: mvm: fix the coex firmware API (bsc#1031717).\n - iwlwifi: mvm: return -ENODATA when reading the temperature with the FW\n down (bsc#1031717).\n - iwlwifi: mvm: set the RTS_MIMO_PROT bit in flag mask when sending sta to\n fw (bsc#1031717).\n - iwlwifi: mvm: use IWL_HCMD_NOCOPY for MCAST_FILTER_CMD (bnc#1012382).\n - iwlwifi: split the regulatory rules when the bandwidth flags require it\n (bsc#1031717).\n - ixgbe: add mask for 64 RSS queues (bnc#1012382).\n - ixgbe: do not disable FEC from the driver (bnc#1012382).\n - ixgbe: fix AER error handling (bnc#1012382).\n - ixgbe: Fix incorrect bitwise operations of PTP Rx timestamp flags\n (bsc#969474 FATE#319812 bsc#969475 FATE#319814).\n - ixgbe: Fix skb list corruption on Power systems (bnc#1012382).\n - ixgbe: handle close/suspend race with netif_device_detach/present\n (bnc#1012382).\n - ixgbe: Reduce I2C retry count on X550 devices (bnc#1012382).\n - ixgbevf: Use smp_rmb rather than read_barrier_depends (bnc#1012382).\n - kABI: protect struct l2tp_tunnel (kabi).\n - kABI: protect struct regulator_dev (kabi).\n - kABI: protect struct rm_data_op (kabi).\n - kABI: protect struct sdio_func (kabi).\n - kABI: protect structs rt_rq+root_domain (kabi).\n - kABI: protect typedef rds_rdma_cookie_t (kabi).\n - kernel-docs: unpack the source instead of using kernel-source\n (bsc#1057199).\n - kernel/sysctl.c: remove duplicate UINT_MAX check on\n do_proc_douintvec_conv() (bsc#1066470).\n - kernel/watchdog: Prevent false positives with turbo modes (bnc#1063516).\n - keys: do not let add_key() update an uninstantiated key (bnc#1012382).\n - keys: do not revoke uninstantiated key in request_key_auth_new()\n (bsc#1031717).\n - keys: encrypted: fix dereference of NULL user_key_payload (bnc#1012382).\n - keys: fix cred refcount leak in request_key_auth_new() (bsc#1031717).\n - keys: fix key refcount leak in keyctl_assume_authority() (bsc#1031717).\n - keys: fix key refcount leak in keyctl_read_key() (bsc#1031717).\n - keys: fix NULL pointer dereference during ASN.1 parsing [ver #2]\n (bnc#1012382).\n - keys: fix out-of-bounds read during ASN.1 parsing (bnc#1012382).\n - keys: Fix race between updating and finding a negative key (bnc#1012382).\n - keys: return full count in keyring_read() if buffer is too small\n (bnc#1012382).\n - keys: trusted: fix writing past end of buffer in trusted_read()\n (bnc#1012382).\n - keys: trusted: sanitize all key material (bnc#1012382).\n - kvm: nVMX: fix guest CR4 loading when emulating L2 to L1 exit\n (bnc#1012382).\n - kvm: nVMX: set IDTR and GDTR limits when loading L1 host state\n (bnc#1012382).\n - kvm: PPC: Book 3S: XICS: correct the real mode ICP rejecting counter\n (bnc#1012382).\n - kvm: SVM: obey guest PAT (bnc#1012382).\n - l2tp: Avoid schedule while atomic in exit_net (bnc#1012382).\n - l2tp: check ps->sock before running pppol2tp_session_ioctl()\n (bnc#1012382).\n - l2tp: fix race condition in l2tp_tunnel_delete (bnc#1012382).\n - libata: transport: Remove circular dependency at free time (bnc#1012382).\n - lib/digsig: fix dereference of NULL user_key_payload (bnc#1012382).\n - libertas: Fix lbs_prb_rsp_limit_set() (bsc#1031717).\n - lib/mpi: call cond_resched() from mpi_powm() loop (bnc#1012382).\n - libnvdimm, namespace: fix label initialization to use valid seq numbers\n (bnc#1012382).\n - libnvdimm, namespace: make 'resource' attribute only readable by root\n (bnc#1012382).\n - libnvdimm, pfn: make 'resource' attribute only readable by root\n (FATE#319858).\n - lib/ratelimit.c: use deferred printk() version (bsc#979928).\n - locking/lockdep: Add nest_lock integrity test (bnc#1012382).\n - lsm: fix smack_inode_removexattr and xattr_getsecurity memleak\n (bnc#1012382).\n - mac80211: agg-tx: call drv_wake_tx_queue in proper context (bsc#1031717).\n - mac80211: do not compare TKIP TX MIC key in reinstall prevention\n (bsc#1066472).\n - mac80211: do not send SMPS action frame in AP mode when not needed\n (bsc#1031717).\n - mac80211: Fix addition of mesh configuration element (git-fixes).\n - mac80211: Fix BW upgrade for TDLS peers (bsc#1031717).\n - mac80211: fix mgmt-tx abort cookie and leak (bsc#1031717).\n - mac80211: fix power saving clients handling in iwlwifi (bnc#1012382).\n - mac80211_hwsim: check HWSIM_ATTR_RADIO_NAME length (bnc#1012382).\n - mac80211_hwsim: Fix memory leak in hwsim_new_radio_nl() (bsc#1031717).\n - mac80211: Remove invalid flag operations in mesh TSF synchronization\n (bnc#1012382).\n - mac80211: Remove unused 'beaconint_us' variable (bsc#1031717).\n - mac80211: Remove unused 'i' variable (bsc#1031717).\n - mac80211: Remove unused 'len' variable (bsc#1031717).\n - mac80211: Remove unused 'rates_idx' variable (bsc#1031717).\n - mac80211: Remove unused 'sband' and 'local' variables (bsc#1031717).\n - mac80211: Remove unused 'struct ieee80211_rx_status' ptr (bsc#1031717).\n - mac80211: Suppress NEW_PEER_CANDIDATE event if no room (bnc#1012382).\n - mac80211: TDLS: always downgrade invalid chandefs (bsc#1031717).\n - mac80211: TDLS: change BW calculation for WIDER_BW peers (bsc#1031717).\n - mac80211: use constant time comparison with keys (bsc#1066471).\n - md/linear: shutup lockdep warnning (bnc#1012382).\n - md/raid10: submit bio directly to replacement disk (bnc#1012382).\n - media: au0828: fix RC_CORE dependency (bsc#1031717).\n - media: Do not do DMA on stack for firmware upload in the AS102 driver\n (bnc#1012382).\n - media: em28xx: calculate left volume level correctly (bsc#1031717).\n - media: mceusb: fix memory leaks in error path (bsc#1031717).\n - media: rc: check for integer overflow (bnc#1012382).\n - media: v4l2-ctrl: Fix flags field on Control events (bnc#1012382).\n - megaraid_sas: Do not fire MR_DCMD_PD_LIST_QUERY to controllers which do\n not support it (bsc#1027301).\n - mei: return error on notification request to a disconnected client\n (bnc#1012382).\n - mfd: ab8500-sysctrl: Handle probe deferral (bnc#1012382).\n - mfd: axp20x: Fix axp288 PEK_DBR and PEK_DBF irqs being swapped\n (bnc#1012382).\n - misc: panel: properly restore atomic counter on error path (bnc#1012382).\n - mlx5: Avoid that mlx5_ib_sg_to_klms() overflows the klms array\n (bsc#966170 FATE#320225 bsc#966172 FATE#320226).\n - mm/backing-dev.c: fix an error handling path in 'cgwb_create()'\n (bnc#1063475).\n - mmc: block: return error on failed mmc_blk_get() (bsc#1031717).\n - mmc: core/mmci: restore pre/post_req behaviour (bsc#1031717).\n - mmc: dw_mmc: rockchip: Set the drive phase properly (bsc#1031717).\n - mm: check the return value of lookup_page_ext for all call sites\n (bnc#1068982).\n - mmc: host: omap_hsmmc: avoid possible overflow of timeout value\n (bsc#1031717).\n - mmc: host: omap_hsmmc: checking for NULL instead of IS_ERR()\n (bsc#1031717).\n - mmc: mediatek: Fixed size in dma_free_coherent (bsc#1031717).\n - mm,compaction: serialize waitqueue_active() checks (for real)\n (bsc#971975).\n - mmc: s3cmci: include linux/interrupt.h for tasklet_struct (bnc#1012382).\n - mmc: sdio: fix alignment issue in struct sdio_func (bnc#1012382).\n - mmc: sd: limit SD card power limit according to cards capabilities\n (bsc#1031717).\n - mm: discard memblock data later (bnc#1063460).\n - mm, hwpoison: fixup "mm: check the return value of lookup_page_ext for\n all call sites" (bnc#1012382).\n - mm/madvise.c: fix madvise() infinite loop under special circumstances\n (bnc#1070964).\n - mm/memblock.c: reversed logic in memblock_discard() (bnc#1063460).\n - mm: meminit: mark init_reserved_page as __meminit (bnc#1063509).\n - mm/memory_hotplug: change pfn_to_section_nr/section_nr_to_pfn macro to\n inline function (bnc#1063501).\n - mm/memory_hotplug: define find_{smallest|biggest}_section_pfn as\n unsigned long (bnc#1063520).\n - mm/page_alloc.c: broken deferred calculation (bnc#1068980).\n - mm, page_alloc: fix potential false positive in __zone_watermark_ok\n (Git-fixes, bsc#1068978).\n - mm/page_ext.c: check if page_ext is not prepared (bnc#1068982).\n - mm/page_owner: avoid null pointer dereference (bnc#1068982).\n - mm/pagewalk.c: report holes in hugetlb ranges (bnc#1012382).\n - net: 3com: typhoon: typhoon_init_one: fix incorrect return values\n (bnc#1012382).\n - net: 3com: typhoon: typhoon_init_one: make return values more specific\n (bnc#1012382).\n - net/9p: Switch to wait_event_killable() (bnc#1012382).\n - net: Allow IP_MULTICAST_IF to set index to L3 slave (bnc#1012382).\n - net: cdc_ether: fix divide by 0 on bad descriptors (bnc#1012382).\n - net: cdc_ncm: GetNtbFormat endian fix (git-fixes).\n - net: core: Prevent from dereferencing null pointer when releasing SKB\n (bnc#1012382).\n - net: dsa: select NET_SWITCHDEV (bnc#1012382).\n - net: emac: Fix napi poll list corruption (bnc#1012382).\n - netfilter: invoke synchronize_rcu after set the _hook_ to NULL\n (bnc#1012382).\n - netfilter/ipvs: clear ipvs_property flag when SKB net namespace changed\n (bnc#1012382).\n - netfilter: nf_ct_expect: Change __nf_ct_expect_check() return value\n (bnc#1012382).\n - netfilter: nfnl_cthelper: fix incorrect helper->expect_class_max\n (bnc#1012382).\n - netfilter: nf_tables: fix oob access (bnc#1012382).\n - netfilter: nft_meta: deal with PACKET_LOOPBACK in netdev family\n (bnc#1012382).\n - netfilter: nft_queue: use raw_smp_processor_id() (bnc#1012382).\n - net: ibm: ibmvnic: constify vio_device_id (fate#323285).\n - net/mlx4_core: Enable 4K UAR if SRIOV module parameter is not enabled\n (bsc#966191 FATE#320230 bsc#966186 FATE#320228).\n - net/mlx4_core: Fix VF overwrite of module param which disables DMFS on\n new probed PFs (bnc#1012382).\n - net/mlx4_en: fix overflow in mlx4_en_init_timestamp() (bnc#1012382).\n - net/mlx5e: Fix wrong delay calculation for overflow check scheduling\n (bsc#966170 FATE#320225 bsc#966172 FATE#320226).\n - net/mlx5e: Schedule overflow check work to mlx5e workqueue (bsc#966170\n FATE#320225 bsc#966172 FATE#320226).\n - net/mlx5: Skip mlx5_unload_one if mlx5_load_one fails (bsc#966170\n FATE#320225 bsc#966172 FATE#320226).\n - net: mvpp2: release reference to txq_cpu[] entry after unmapping\n (bnc#1012382).\n - net/packet: check length in getsockopt() called with PACKET_HDRLEN\n (bnc#1012382).\n - net: qmi_wwan: fix divide by 0 on bad descriptors (bnc#1012382).\n - net/sctp: Always set scope_id in sctp_inet6_skb_msgname (bnc#1012382).\n - net: Set sk_prot_creator when cloning sockets to the right proto\n (bnc#1012382).\n - net/unix: do not show information about sockets from other namespaces\n (bnc#1012382).\n - nfc: fix device-allocation error return (bnc#1012382).\n - nfsd/callback: Cleanup callback cred on shutdown (bnc#1012382).\n - nfsd: deal with revoked delegations appropriately (bnc#1012382).\n - nfs: Do not disconnect open-owner on NFS4ERR_BAD_SEQID (bsc#989261).\n - nfs: Fix typo in nomigration mount option (bnc#1012382).\n - nfs: Fix ugly referral attributes (bnc#1012382).\n - nilfs2: fix race condition that causes file system corruption\n (bnc#1012382).\n - nl80211: Define policy for packet pattern attributes (bnc#1012382).\n - nvme: Fix memory order on async queue deletion (bnc#1012382).\n - nvme: protect against simultaneous shutdown invocations (FATE#319965\n bnc#1012382 bsc#964944).\n - ocfs2: fstrim: Fix start offset of first cluster group during fstrim\n (bnc#1012382).\n - ocfs2: should wait dio before inode lock in ocfs2_setattr()\n (bnc#1012382).\n - packet: avoid panic in packet_getsockopt() (bnc#1012382).\n - packet: only test po->has_vnet_hdr once in packet_snd (bnc#1012382).\n - parisc: Avoid trashing sr2 and sr3 in LWS code (bnc#1012382).\n - parisc: Fix double-word compare and exchange in LWS code on 32-bit\n kernels (bnc#1012382).\n - parisc: Fix validity check of pointer size argument in new CAS\n implementation (bnc#1012382).\n - parisc: perf: Fix potential NULL pointer dereference (bnc#1012382).\n - partitions/efi: Fix integer overflow in GPT size calculation\n (bnc#1012382).\n - pci: Apply _HPX settings only to relevant devices (bnc#1012382).\n - pci: mvebu: Handle changes to the bridge windows while enabled\n (bnc#1012382).\n - percpu: make this_cpu_generic_read() atomic w.r.t. interrupts\n (bnc#1012382).\n - perf tools: Fix build failure on perl script context (bnc#1012382).\n - perf tools: Only increase index if perf_evsel__new_idx() succeeds\n (bnc#1012382).\n - perf/x86/intel/bts: Fix exclusive event reference leak (git-fixes\n d2878d642a4ed).\n - phy: increase size of MII_BUS_ID_SIZE and bus_id (bnc#1012382).\n - pkcs#7: fix unitialized boolean 'want' (bnc#1012382).\n - pkcs7: Prevent NULL pointer dereference, since sinfo is not always set\n (bnc#1012382).\n - platform/x86: acer-wmi: setup accelerometer when ACPI device was found\n (bsc#1031717).\n - platform/x86: hp-wmi: Do not shadow error values (bnc#1012382).\n - platform/x86: hp-wmi: Fix detection for dock and tablet mode\n (bnc#1012382).\n - platform/x86: hp-wmi: Fix error value for hp_wmi_tablet_state\n (bnc#1012382).\n - platform/x86: intel_mid_thermal: Fix module autoload (bnc#1012382).\n - platform/x86: sony-laptop: Fix error handling in sony_nc_setup_rfkill()\n (bsc#1031717).\n - pm / OPP: Add missing of_node_put(np) (bnc#1012382).\n - power: bq27xxx_battery: Fix bq27541 AveragePower register address\n (bsc#1031717).\n - power: bq27xxx: fix reading for bq27000 and bq27010 (bsc#1031717).\n - powerCap: Fix an error code in powercap_register_zone() (bsc#1031717).\n - power: ipaq-micro-battery: freeing the wrong variable (bsc#1031717).\n - powerpc/64: Fix race condition in setting lock bit in idle/wakeup code\n (bsc#1066223).\n - powerpc/bpf/jit: Disable classic BPF JIT on ppc64le (bsc#1066223).\n - powerpc/corenet: explicitly disable the SDHC controller on kmcoge4\n (bnc#1012382).\n - powerpc: Correct instruction code for xxlor instruction (bsc#1066223).\n - powerpc: Fix VSX enabling/flushing to also test MSR_FP and MSR_VEC\n (bsc#1066223).\n - powerpc/mm: Fix check of multiple 16G pages from device tree\n (bsc#1066223).\n - powerpc/mm: Fix virt_addr_valid() etc. on 64-bit hash (bsc#1066223).\n - powerpc/mm/hash64: Fix subpage protection with 4K HPTE config\n (bsc#1010201, bsc#1066223).\n - powerpc/mm/hash: Free the subpage_prot_table correctly (bsc#1066223).\n - powerpc/numa: Fix multiple bugs in memory_hotplug_max() (bsc#1066223).\n - powerpc/numa: Fix whitespace in hot_add_drconf_memory_max()\n (bsc#1066223).\n - powerpc/opal: Fix EBUSY bug in acquiring tokens (bsc#1066223).\n - powerpc/perf: Remove PPMU_HAS_SSLOT flag for Power8 (bsc#1066223).\n - powerpc/powernv/ioda: Fix endianness when reading TCEs (bsc#1066223).\n - powerpc/powernv: Make opal_event_shutdown() callable from IRQ context\n (bsc#1066223).\n - powerpc/pseries/vio: Dispose of virq mapping on vdevice unregister\n (bsc#1067888).\n - powerpc/pseries/vio: Dispose of virq mapping on vdevice unregister\n (bsc#1067888).\n - powerpc/signal: Properly handle return value from uprobe_deny_signal()\n (bsc#1066223).\n - powerpc/sysrq: Fix oops whem ppmu is not registered (bsc#1066223).\n - power: supply: bq27xxx_battery: Fix register map for BQ27510 and BQ27520\n ("bsc#1069270").\n - power: supply: isp1704: Fix unchecked return value of devm_kzalloc\n (bsc#1031717).\n - power: supply: lp8788: prevent out of bounds array access (bsc#1031717).\n - power_supply: tps65217-charger: Fix NULL deref during property export\n (bsc#1031717).\n - ppp: fix race in ppp device destruction (bnc#1012382).\n - printk/console: Always disable boot consoles that use init memory before\n it is freed (bsc#1063026).\n - printk/console: Enhance the check for consoles using init memory\n (bsc#1063026).\n - printk: include <asm/sections.h> instead of <asm-generic/sections.h>\n (bsc#1063026).\n - printk: only unregister boot consoles when necessary (bsc#1063026).\n - qed: Fix stack corruption on probe (bsc#966318 FATE#320158 bsc#966316\n FATE#320159).\n - quota: Check for register_shrinker() failure (bsc#1012829).\n - r8169: Do not increment tx_dropped in TX ring cleaning (bsc#1031717).\n - rbd: use GFP_NOIO for parent stat and data requests (bnc#1012382).\n - rcu: Allow for page faults in NMI handlers (bnc#1012382).\n - rdma/uverbs: Prevent leak of reserved field (bsc#1022595 FATE#322350).\n - rds: ib: add error handle (bnc#1012382).\n - rds: rdma: Fix the composite message user notification (bnc#1012382).\n - rds: rdma: return appropriate error on rdma map failures (bnc#1012382).\n - regulator: core: Limit propagation of parent voltage count and list\n (bsc#1070145).\n - regulator: fan53555: fix I2C device ids (bnc#1012382).\n - Revert "bpf: one perf event close won't free bpf program attached by\n another perf event" (kabi).\n - Revert "bsg-lib: do not free job in bsg_prepare_job" (bnc#1012382).\n - Revert "crypto: xts - Add ECB dependency" (bnc#1012382).\n - Revert "drm: bridge: add DT bindings for TI ths8135" (bnc#1012382).\n - Revert "KEYS: Fix race between updating and finding a negative key"\n (kabi).\n - Revert "phy: increase size of MII_BUS_ID_SIZE and bus_id" (kabi).\n - Revert "sctp: do not peel off an assoc from one netns to another one"\n (bnc#1012382).\n - Revert "tty: goldfish: Fix a parameter of a call to free_irq"\n (bnc#1012382).\n - Revert "uapi: fix linux/rds.h userspace compilation errors"\n (bnc#1012382).\n - rpm/kernel-binary.spec.in: add the kernel-binary dependencies to\n kernel-binary-base (bsc#1060333).\n - rpm/kernel-binary.spec.in: Correct supplements for recent SLE products\n (bsc#1067494)\n - rpm/kernel-binary.spec.in: only rewrite modules.dep if non-zero in size\n (bsc#1056979).\n - rtc: ds1307: Fix relying on reset value for weekday (bsc#1031717).\n - rtc: ds1374: wdt: Fix issue with timeout scaling from secs to wdt ticks\n (bsc#1031717).\n - rtc: ds1374: wdt: Fix stop/start ioctl always returning -EINVAL\n (bsc#1031717).\n - rtc: rtc-nuc900: fix loop timeout test (bsc#1031717).\n - rtc: sa1100: fix unbalanced clk_prepare_enable/clk_disable_unprepare\n (bsc#1031717).\n - rtlwifi: fix uninitialized rtlhal->last_suspend_sec time (bnc#1012382).\n - rtlwifi: rtl8192ee: Fix memory leak when loading firmware (bnc#1012382).\n - rtlwifi: rtl8821ae: Fix connection lost problem (bnc#1012382).\n - rtlwifi: rtl8821ae: Fix HW_VAR_NAV_UPPER operation (bsc#1031717).\n - s390/dasd: check for device error pointer within state change interrupts\n (bnc#1012382).\n - s390/disassembler: add missing end marker for e7 table (bnc#1012382).\n - s390/disassembler: correct disassembly lines alignment (bsc#1070825).\n - s390/disassembler: increase show_code buffer size (bnc#1012382).\n - s390: fix transactional execution control register handling\n (bnc#1012382).\n - s390/kbuild: enable modversions for symbols exported from asm\n (bnc#1012382).\n - s390/qeth: issue STARTLAN as first IPA command (bnc#1012382).\n - s390/runtime instrumention: fix possible memory corruption (bnc#1012382).\n - sched/autogroup: Fix autogroup_move_group() to never skip\n sched_move_task() (bnc#1012382).\n - sched/cpuset/pm: Fix cpuset vs. suspend-resume bugs (bnc#1012382).\n - sched: Make resched_cpu() unconditional (bnc#1012382).\n - sched/rt: Simplify the IPI based RT balancing logic (bnc#1012382).\n - scsi: aacraid: Process Error for response I/O (bnc#1012382).\n - scsi_devinfo: cleanly zero-pad devinfo strings (bsc#1062941).\n - scsi: hpsa: add 'ctlr_num' sysfs attribute (bsc#1028971).\n - scsi: hpsa: bump driver version (bsc#1022600 fate#321928).\n - scsi: hpsa: change driver version (bsc#1022600 bsc#1028971 fate#321928).\n - scsi: hpsa: Check for null device pointers (bsc#1028971).\n - scsi: hpsa: Check for null devices in ioaccel (bsc#1028971).\n - scsi: hpsa: Check for vpd support before sending (bsc#1028971).\n - scsi: hpsa: cleanup reset handler (bsc#1022600 fate#321928).\n - scsi: hpsa: correct call to hpsa_do_reset (bsc#1028971).\n - scsi: hpsa: correct logical resets (bsc#1028971).\n - scsi: hpsa: correct queue depth for externals (bsc#1022600 fate#321928).\n - scsi: hpsa: correct resets on retried commands (bsc#1022600 fate#321928).\n - scsi: hpsa: correct scsi 6byte lba calculation (bsc#1028971).\n - scsi: hpsa: Determine device external status earlier (bsc#1028971).\n - scsi: hpsa: do not get enclosure info for external devices (bsc#1022600\n fate#321928).\n - scsi: hpsa: do not reset enclosures (bsc#1022600 fate#321928).\n - scsi: hpsa: do not timeout reset operations (bsc#1022600 bsc#1028971\n fate#321928).\n - scsi: hpsa: fallback to use legacy REPORT PHYS command (bsc#1028971).\n - scsi: hpsa: fix volume offline state (bsc#1022600 bsc#1028971\n fate#321928).\n - scsi: hpsa: limit outstanding rescans (bsc#1022600 bsc#1028971\n fate#321928).\n - scsi: hpsa: Prevent sending bmic commands to externals (bsc#1028971).\n - scsi: hpsa: remove abort handler (bsc#1022600 fate#321928).\n - scsi: hpsa: remove coalescing settings for ioaccel2 (bsc#1028971).\n - scsi: hpsa: remove memory allocate failure message (bsc#1028971).\n - scsi: hpsa: Remove unneeded void pointer cast (bsc#1028971).\n - scsi: hpsa: rescan later if reset in progress (bsc#1022600 fate#321928).\n - scsi: hpsa: send ioaccel requests with 0 length down raid path\n (bsc#1022600 fate#321928).\n - scsi: hpsa: separate monitor events from rescan worker (bsc#1022600\n fate#321928).\n - scsi: hpsa: update check for logical volume status (bsc#1022600\n bsc#1028971 fate#321928).\n - scsi: hpsa: update identify physical device structure (bsc#1022600\n fate#321928).\n - scsi: hpsa: update pci ids (bsc#1022600 bsc#1028971 fate#321928).\n - scsi: hpsa: update reset handler (bsc#1022600 fate#321928).\n - scsi: hpsa: use designated initializers (bsc#1028971).\n - scsi: hpsa: use %phN for short hex dumps (bsc#1028971).\n - scsi: ipr: Fix scsi-mq lockdep issue (bsc#1066213).\n - scsi: ipr: Set no_report_opcodes for RAID arrays (bsc#1066213).\n - scsi: libfc: fix a deadlock in fc_rport_work (bsc#1063695).\n - scsi: libiscsi: fix shifting of DID_REQUEUE host byte (bsc#1056003).\n - scsi: lpfc: Add missing memory barrier (bnc#1012382).\n - scsi: lpfc: Clear the VendorVersion in the PLOGI/PLOGI ACC payload\n (bnc#1012382).\n - scsi: lpfc: Correct host name in symbolic_name field (bnc#1012382).\n - scsi: lpfc: Correct issue leading to oops during link reset\n (bnc#1012382).\n - scsi: lpfc: FCoE VPort enable-disable does not bring up the VPort\n (bnc#1012382).\n - scsi: reset wait for IO completion (bsc#996376).\n - scsi: scsi_devinfo: fixup string compare (bsc#1062941). updated\n patches.fixes/scsi_devinfo-fixup-string-compare.patch to the version\n merged upstream.\n - scsi: scsi_devinfo: handle non-terminated strings (bsc#1062941).\n - scsi: scsi_dh_emc: return success in clariion_std_inquiry()\n (bnc#1012382).\n - scsi: scsi_transport_fc: Also check for NOTPRESENT in\n fc_remote_port_add() (bsc#1037890).\n - scsi: scsi_transport_fc: set scsi_target_id upon rescan (bsc#1058135).\n - scsi: sd: Do not override max_sectors_kb sysfs setting (bsc#1025461).\n - scsi: sd: Remove LBPRZ dependency for discards (bsc#1060985).\n - scsi: sg: close race condition in sg_remove_sfp_usercontext()\n (bsc#1064206).\n - scsi: sg: do not return bogus Sg_requests (bsc#1064206).\n - scsi: sg: only check for dxfer_len greater than 256M (bsc#1064206).\n - scsi: sg: Re-fix off by one in sg_fill_request_table() (bnc#1012382).\n - scsi: ufs: add capability to keep auto bkops always enabled\n (bnc#1012382).\n - scsi: ufs-qcom: Fix module autoload (bnc#1012382).\n - scsi: virtio_scsi: let host do exception handling (bsc#1060682).\n - scsi: zfcp: fix erp_action use-before-initialize in REC action trace\n (bnc#1012382).\n - sctp: add the missing sock_owned_by_user check in sctp_icmp_redirect\n (bnc#1012382).\n - sctp: do not peel off an assoc from one netns to another one\n (bnc#1012382).\n - sctp: do not peel off an assoc from one netns to another one\n (bnc#1012382).\n - sctp: potential read out of bounds in sctp_ulpevent_type_enabled()\n (bnc#1012382).\n - sctp: reset owner sk for data chunks on out queues when migrating a sock\n (bnc#1012382).\n - security/keys: add CONFIG_KEYS_COMPAT to Kconfig (bnc#1012382).\n - selftests: firmware: add empty string and async tests (bnc#1012382).\n - selftests: firmware: send expected errors to /dev/null (bnc#1012382).\n - serial: 8250_fintek: Fix rs485 disablement on invalid ioctl()\n (bsc#1031717).\n - serial: 8250_uniphier: fix serial port index in private data\n (bsc#1031717).\n - serial: omap: Fix EFR write on RTS deassertion (bnc#1012382).\n - serial: Remove unused port type (bsc#1066045).\n - serial: sh-sci: Fix register offsets for the IRDA serial port\n (bnc#1012382).\n - sh_eth: use correct name for ECMR_MPDE bit (bnc#1012382).\n - slub: do not merge cache if slub_debug contains a never-merge flag\n (bnc#1012382).\n - smb3: parsing for new snapshot timestamp mount parm (FATE#324404). New\n mount option "snapshot=<time>" to allow mounting an earlier version of\n the remote volume (if such a snapshot exists on the server). Note that\n eventually specifying a snapshot time of 1 will allow the user to mount\n the oldest snapshot. A subsequent patch add the processing for that and\n another for actually specifying the "time warp" create context on\n SMB2/SMB3 open. Check to make sure SMB2 negotiated, and ensure that we\n use a different tcon if mount same share twice but with different\n snaphshot times\n - sparc64: Migrate hvcons irq to panicked cpu (bnc#1012382).\n - spi: SPI_FSL_DSPI should depend on HAS_DMA (bnc#1012382).\n - spi: uapi: spidev: add missing ioctl header (bnc#1012382).\n - staging: iio: ad7192: Fix - use the dedicated reset function avoiding\n dma from stack (bnc#1012382).\n - staging: iio: cdc: fix improper return value (bnc#1012382).\n - staging: lustre: hsm: stack overrun in hai_dump_data_field (bnc#1012382).\n - staging: lustre: llite: do not invoke direct_IO for the EOF case\n (bnc#1012382).\n - staging: lustre: ptlrpc: skip lock if export failed (bnc#1012382).\n - staging: r8712u: Fix Sparse warning in rtl871x_xmit.c (bnc#1012382).\n - staging: rtl8188eu: fix incorrect ERROR tags from logs (bnc#1012382).\n - staging: rtl8712: fixed little endian problem (bnc#1012382).\n - staging: rtl8712u: Fix endian settings for structs describing network\n packets (bnc#1012382).\n - stm class: Fix a use-after-free (bnc#1012382).\n - sunrpc: Fix tracepoint storage issues with svc_recv and svc_rqst_status\n (bnc#1012382).\n - supported.conf: mark hid-multitouch as supported (FATE#323670)\n - target: fix ALUA state file path truncation (bsc#1071231).\n - target: Fix node_acl demo-mode + uncached dynamic shutdown regression\n (bnc#1012382).\n - target: fix PR state file path truncation (bsc#1071231).\n - target: Fix QUEUE_FULL + SCSI task attribute handling (bnc#1012382).\n - target/iscsi: Fix iSCSI task reassignment handling (bnc#1012382).\n - target/iscsi: Fix unsolicited data seq_end_offset calculation\n (bnc#1012382).\n - tcp/dccp: fix ireq->opt races (bnc#1012382).\n - tcp/dccp: fix lockdep splat in inet_csk_route_req() (bnc#1012382).\n - tcp/dccp: fix other lockdep splats accessing ireq_opt (bnc#1012382).\n - tcp: do not mangle skb->cb[] in tcp_make_synack() (bnc#1012382).\n - tcp: fix tcp_mtu_probe() vs highest_sack (bnc#1012382).\n - team: call netdev_change_features out of team lock (bsc#1055567).\n - team: fix memory leaks (bnc#1012382).\n - test: firmware_class: report errors properly on failure (bnc#1012382).\n - timer: Prevent timer value 0 for MWAITX (bsc#1065717).\n - tipc: fix link attribute propagation bug (bnc#1012382).\n - tipc: use only positive error codes in messages (bnc#1012382).\n - tools: firmware: check for distro fallback udev cancel rule\n (bnc#1012382).\n - tpm_tis: Do not fall back to a hardcoded address for TPM2 (bsc#1020645,\n fate#321435, fate#321507, fate#321600, bsc#1034048).\n - tracing/samples: Fix creation and deletion of simple_thread_fn creation\n (bnc#1012382).\n - ttpci: address stringop overflow warning (bnc#1012382).\n - tty: goldfish: Fix a parameter of a call to free_irq (bnc#1012382).\n - tun: allow positive return values on dev_get_valid_name() call\n (bnc#1012382).\n - tun: bail out from tun_get_user() if the skb is empty (bnc#1012382).\n - tun: call dev_get_valid_name() before register_netdevice() (bnc#1012382).\n - tun/tap: sanitize TUNSETSNDBUF input (bnc#1012382).\n - uapi: fix linux/mroute6.h userspace compilation errors (bnc#1012382).\n - uapi: fix linux/rds.h userspace compilation error (bnc#1012382).\n - uapi: fix linux/rds.h userspace compilation errors (bnc#1012382).\n - uapi: fix linux/rds.h userspace compilation errors (bnc#1012382).\n - udpv6: Fix the checksum computation when HW checksum does not apply\n (bnc#1012382).\n - usb: Add delay-init quirk for Corsair K70 LUX keyboards (bnc#1012382).\n - usb: cdc_acm: Add quirk for Elatec TWN3 (bnc#1012382).\n - usb: chipidea: vbus event may exist before starting gadget (bnc#1012382).\n - usb: core: fix out-of-bounds access bug in usb_get_bos_descriptor()\n (bnc#1012382).\n - usb: core: harden cdc_parse_cdc_header (bnc#1012382).\n - usb: devio: Do not corrupt user memory (bnc#1012382).\n - usb: devio: Revert "USB: devio: Do not corrupt user memory"\n (bnc#1012382).\n - usb: dummy-hcd: fix connection failures (wrong speed) (bnc#1012382).\n - usb: dummy-hcd: Fix deadlock caused by disconnect detection\n (bnc#1012382).\n - usb: dummy-hcd: Fix erroneous synchronization change (bnc#1012382).\n - usb: dummy-hcd: fix infinite-loop resubmission bug (bnc#1012382).\n - usb: fix out-of-bounds in usb_set_configuration (bnc#1012382).\n - usb: gadget: composite: Fix use-after-free in\n usb_composite_overwrite_options (bnc#1012382).\n - usb: gadgetfs: fix copy_to_user while holding spinlock (bnc#1012382).\n - usb: gadgetfs: Fix crash caused by inadequate synchronization\n (bnc#1012382).\n - usb: gadget: inode.c: fix unbalanced spin_lock in ep0_write\n (bnc#1012382).\n - usb: gadget: mass_storage: set msg_registered after msg registered\n (bnc#1012382).\n - usb: gadget: udc: atmel: set vbus irqflags explicitly (bnc#1012382).\n - usb: g_mass_storage: Fix deadlock when driver is unbound (bnc#1012382).\n - usb: hcd: initialize hcd->flags to 0 when rm hcd (bnc#1012382).\n - usb: hub: Allow reset retry for USB2 devices on connect bounce\n (bnc#1012382).\n - usb: Increase quirk delay for USB devices (bnc#1012382).\n - usb: musb: Check for host-mode using is_host_active() on reset interrupt\n (bnc#1012382).\n - usb: musb: sunxi: Explicitly release USB PHY on exit (bnc#1012382).\n - usb: pci-quirks.c: Corrected timeout values used in handshake\n (bnc#1012382).\n - usb: plusb: Add support for PL-27A1 (bnc#1012382).\n - usb: quirks: add quirk for WORLDE MINI MIDI keyboard (bnc#1012382).\n - usb: renesas_usbhs: Fix DMAC sequence for receiving zero-length packet\n (bnc#1012382).\n - usb: renesas_usbhs: fix the BCLR setting condition for non-DCP pipe\n (bnc#1012382).\n - usb: renesas_usbhs: fix usbhsf_fifo_clear() for RX direction\n (bnc#1012382).\n - usb: serial: console: fix use-after-free after failed setup\n (bnc#1012382).\n - usb: serial: cp210x: add support for ELV TFD500 (bnc#1012382).\n - usb: serial: ftdi_sio: add id for Cypress WICED dev board (bnc#1012382).\n - usb: serial: garmin_gps: fix I/O after failed probe and remove\n (bnc#1012382).\n - usb: serial: garmin_gps: fix memory leak on probe errors (bnc#1012382).\n - usb: serial: metro-usb: add MS7820 device id (bnc#1012382).\n - usb: serial: mos7720: fix control-message error handling (bnc#1012382).\n - usb: serial: mos7840: fix control-message error handling (bnc#1012382).\n - usb: serial: option: add support for TP-Link LTE module (bnc#1012382).\n - usb: serial: qcserial: add Dell DW5818, DW5819 (bnc#1012382).\n - usb: serial: qcserial: add pid/vid for Sierra Wireless EM7355 fw update\n (bnc#1012382).\n - usb-storage: unusual_devs entry to fix write-access regression for\n Seagate external drives (bnc#1012382).\n - usb: uas: fix bug in handling of alternate settings (bnc#1012382).\n - usb: usbfs: compute urb->actual_length for isochronous (bnc#1012382).\n - usb: usbtest: fix NULL pointer dereference (bnc#1012382).\n - usb: xhci: Handle error condition in xhci_stop_device() (bnc#1012382).\n - uwb: ensure that endpoint is interrupt (bnc#1012382).\n - uwb: properly check kthread_run return value (bnc#1012382).\n - vfs: expedite unmount (bsc#1024412).\n - video: fbdev: pmag-ba-fb: Remove bad `__init' annotation (bnc#1012382).\n - video: udlfb: Fix read EDID timeout (bsc#1031717).\n - vlan: fix a use-after-free in vlan_device_event() (bnc#1012382).\n - vsock: use new wait API for vsock_stream_sendmsg() (bnc#1012382).\n - vti: fix use after free in vti_tunnel_xmit/vti6_tnl_xmit (bnc#1012382).\n - watchdog: kempld: fix gcc-4.3 build (bnc#1012382).\n - workqueue: Fix NULL pointer dereference (bnc#1012382).\n - workqueue: replace pool->manager_arb mutex with a flag (bnc#1012382).\n - x86/alternatives: Fix alt_max_short macro to really be a max()\n (bnc#1012382).\n - x86/decoder: Add new TEST instruction pattern (bnc#1012382).\n - x86/MCE/AMD: Always give panic severity for UC errors in kernel context\n (git-fixes bf80bbd7dcf5).\n - x86/microcode/AMD: Add support for fam17h microcode loading\n (bsc#1068032).\n - x86/microcode/intel: Disable late loading on model 79 (bnc#1012382).\n - x86/oprofile/ppro: Do not use __this_cpu*() in preemptible context\n (bnc#1012382).\n - x86/uaccess, sched/preempt: Verify access_ok() context (bnc#1012382).\n - xen: do not print error message in case of missing Xenstore entry\n (bnc#1012382).\n - xen/events: events_fifo: Do not use {get,put}_cpu() in\n xen_evtchn_fifo_init() (bnc#1065600).\n - xen: fix booting ballooned down hvm guest (bnc#1065600).\n - xen/gntdev: avoid out of bounds access in case of partial gntdev_mmap()\n (bnc#1012382).\n - xen/manage: correct return value check on xenbus_scanf() (bnc#1012382).\n - xen-netback: fix error handling output (bnc#1065600).\n - xen: x86: mark xen_find_pt_base as __init (bnc#1065600).\n - xen: xenbus driver must not accept invalid transaction ids (bnc#1012382).\n - xfs: handle error if xfs_btree_get_bufs fails (bsc#1059863).\n - xfs: remove kmem_zalloc_greedy (bnc#1012382).\n - xhci: fix finding correct bus_state structure for USB 3.1 hosts\n (bnc#1012382).\n - zd1211rw: fix NULL-deref at probe (bsc#1031717).\n\n", "edition": 1, "modified": "2017-12-22T00:07:57", "published": "2017-12-22T00:07:57", "href": "http://lists.opensuse.org/opensuse-security-announce/2017-12/msg00084.html", "id": "SUSE-SU-2017:3410-1", "type": "suse", "title": "Security update for the Linux Kernel (important)", "cvss": {"score": 7.2, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-12-18T14:45:31", "bulletinFamily": "unix", "cvelist": ["CVE-2017-17450", "CVE-2017-12193", "CVE-2017-16537", "CVE-2017-15115", "CVE-2017-8824", "CVE-2017-16994", "CVE-2017-17448", "CVE-2017-16646", "CVE-2017-16536", "CVE-2017-7482", "CVE-2017-16939", "CVE-2017-1000410", "CVE-2017-17449", "CVE-2017-1000405", "CVE-2017-11600", "CVE-2017-16528", "CVE-2017-16645"], "description": "The openSUSE Leap 42.2 kernel was updated to 4.4.102 to receive various\n security and bugfixes.\n\n The following security bugs were fixed:\n\n - CVE-2017-1000405: A bug in the THP CoW support could be used by local\n attackers to corrupt memory of other processes and cause them to crash\n (bnc#1069496).\n - CVE-2017-1000410: The Linux kernel was affected by an information leak\n in the processing of incoming L2CAP commands - ConfigRequest, and\n ConfigResponse messages. (bnc#1070535).\n - CVE-2017-11600: net/xfrm/xfrm_policy.c in the Linux kernel did not\n ensure that the dir value of xfrm_userpolicy_id is XFRM_POLICY_MAX or\n less, which allowed local users to cause a denial of service\n (out-of-bounds access) or possibly have unspecified other impact via an\n XFRM_MSG_MIGRATE xfrm Netlink message (bnc#1050231).\n - CVE-2017-12193: The assoc_array_insert_into_terminal_node function in\n lib/assoc_array.c in the Linux kernel mishandled node splitting, which\n allowed local users to cause a denial of service (NULL pointer\n dereference and panic) via a crafted application, as demonstrated by the\n keyring key type, and key addition and link creation operations\n (bnc#1066192).\n - CVE-2017-15115: The sctp_do_peeloff function in net/sctp/socket.c in the\n Linux kernel did not check whether the intended netns is used in a\n peel-off action, which allowed local users to cause a denial of service\n (use-after-free and system crash) or possibly have unspecified other\n impact via crafted system calls (bnc#1068671).\n - CVE-2017-16528: sound/core/seq_device.c in the Linux kernel allowed\n local users to cause a denial of service (snd_rawmidi_dev_seq_free\n use-after-free and system crash) or possibly have unspecified other\n impact via a crafted USB device (bnc#1066629).\n - CVE-2017-16536: The cx231xx_usb_probe function in\n drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux kernel allowed\n local users to cause a denial of service (NULL pointer dereference and\n system crash) or possibly have unspecified other impact via a crafted\n USB device (bnc#1066606).\n - CVE-2017-16537: The imon_probe function in drivers/media/rc/imon.c in\n the Linux kernel allowed local users to cause a denial of service (NULL\n pointer dereference and system crash) or possibly have unspecified other\n impact via a crafted USB device (bnc#1066573).\n - CVE-2017-16645: The ims_pcu_get_cdc_union_desc function in\n drivers/input/misc/ims-pcu.c in the Linux kernel allowed local users to\n cause a denial of service (ims_pcu_parse_cdc_data out-of-bounds read and\n system crash) or possibly have unspecified other impact via a crafted\n USB device (bnc#1067132).\n - CVE-2017-16646: drivers/media/usb/dvb-usb/dib0700_devices.c in the Linux\n kernel allowed local users to cause a denial of service (BUG and system\n crash) or possibly have unspecified other impact via a crafted USB\n device (bnc#1067105).\n - CVE-2017-16939: The XFRM dump policy implementation in\n net/xfrm/xfrm_user.c in the Linux kernel allowed local users to gain\n privileges or cause a denial of service (use-after-free) via a crafted\n SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY\n Netlink messages (bnc#1069702).\n - CVE-2017-16994: The walk_hugetlb_range function in mm/pagewalk.c in the\n Linux kernel mishandled holes in hugetlb ranges, which allowed local\n users to obtain sensitive information from uninitialized kernel memory\n via crafted use of the mincore() system call (bnc#1069996).\n - CVE-2017-17448: net/netfilter/nfnetlink_cthelper.c in the Linux kernel\n did not require the CAP_NET_ADMIN capability for new, get, and del\n operations, which allowed local users to bypass intended access\n restrictions because the nfnl_cthelper_list data structure is shared\n across all net namespaces (bnc#1071693).\n - CVE-2017-17449: The __netlink_deliver_tap_skb function in\n net/netlink/af_netlink.c in the Linux kernel did not restrict\n observations of Netlink messages to a single net namespace, which\n allowed local users to obtain sensitive information by leveraging the\n CAP_NET_ADMIN capability to sniff an nlmon interface for all Netlink\n activity on the system (bnc#1071694).\n - CVE-2017-17450: net/netfilter/xt_osf.c in the Linux kernel did not\n require the CAP_NET_ADMIN capability for add_callback and\n remove_callback operations, which allowed local users to bypass intended\n access restrictions because the xt_osf_fingers data structure is shared\n across all net namespaces (bnc#1071695).\n - CVE-2017-7482: Fixed an overflow when decoding a krb5 principal.\n (bnc#1046107).\n - CVE-2017-8824: The dccp_disconnect function in net/dccp/proto.c in the\n Linux kernel allowed local users to gain privileges or cause a denial of\n service (use-after-free) via an AF_UNSPEC connect system call during the\n DCCP_LISTEN state (bnc#1070771).\n\n The following non-security bugs were fixed:\n\n - adm80211: return an error if adm8211_alloc_rings() fails (bsc#1031717).\n - adv7604: Initialize drive strength to default when using DT\n (bnc#1012382).\n - af_netlink: ensure that NLMSG_DONE never fails in dumps (bnc#1012382).\n - alsa: caiaq: Fix stray URB at probe error path (bnc#1012382).\n - alsa: hda: Add Raven PCI ID (bnc#1012382).\n - alsa: hda - Apply ALC269_FIXUP_NO_SHUTUP on HDA_FIXUP_ACT_PROBE\n (bnc#1012382).\n - alsa: hda/ca0132 - Fix memory leak at error path (bsc#1031717).\n - alsa: hda - fix headset mic problem for Dell machines with alc236\n (bnc#1012382).\n - alsa: hda - No loopback on ALC299 codec (git-fixes).\n - alsa: hda/realtek: Add headset mic support for Intel NUC Skull Canyon\n (bsc#1031717).\n - alsa: hda/realtek - Add new codec ID ALC299 (bnc#1012382).\n - alsa: hda/realtek - Add support for ALC236/ALC3204 (bnc#1012382).\n - alsa: hda/realtek - Fix ALC700 family no sound issue (bsc#1031717).\n - alsa: hda: Remove superfluous '-' added by printk conversion\n (bnc#1012382).\n - alsa: line6: Fix leftover URB at error-path during probe (bnc#1012382).\n - alsa: pcm: update tstamp only if audio_tstamp changed (bsc#1031717).\n - alsa: seq: Avoid invalid lockdep class warning (bsc#1031717).\n - alsa: seq: Enable 'use' locking in all configurations (bnc#1012382).\n - alsa: seq: Fix copy_from_user() call inside lock (bnc#1012382).\n - alsa: seq: Fix nested rwsem annotation for lockdep splat (bnc#1012382).\n - alsa: seq: Fix OSS sysex delivery in OSS emulation (bnc#1012382).\n - alsa: timer: Add missing mutex lock for compat ioctls (bnc#1012382).\n - alsa: timer: Remove kernel warning at compat ioctl error paths\n (bsc#1031717).\n - alsa: usb-audio: Add native DSD support for Pro-Ject Pre Box S2 Digital\n (bnc#1012382).\n - alsa: usb-audio: Add sanity checks in v2 clock parsers (bsc#1031717).\n - alsa: usb-audio: Add sanity checks to FE parser (bsc#1031717).\n - alsa: usb-audio: Fix potential out-of-bound access at parsing SU\n (bsc#1031717).\n - alsa: usb-audio: Kill stray URB at exiting (bnc#1012382).\n - alsa: usb-audio: uac1: Invalidate ctl on interrupt (bsc#1031717).\n - alsa: vx: Do not try to update capture stream before running\n (bnc#1012382).\n - alsa: vx: Fix possible transfer overflow (bnc#1012382).\n - Apply generic ppc build fixes to vanilla (bsc#1070805)\n - arm64: dts: NS2: reserve memory for Nitro firmware (bnc#1012382).\n - arm64: ensure __dump_instr() checks addr_limit (bnc#1012382).\n - arm64: fix dump_instr when PAN and UAO are in use (bnc#1012382).\n - arm: 8715/1: add a private asm/unaligned.h (bnc#1012382).\n - arm: 8720/1: ensure dump_instr() checks addr_limit (bnc#1012382).\n - arm: 8721/1: mm: dump: check hardware RO bit for LPAE (bnc#1012382).\n - arm: 8722/1: mm: make STRICT_KERNEL_RWX effective for LPAE (bnc#1012382).\n - arm: crypto: reduce priority of bit-sliced AES cipher (bnc#1012382).\n - arm: dts: Fix am335x and dm814x scm syscon to probe children\n (bnc#1012382).\n - arm: dts: Fix compatible for ti81xx uarts for 8250 (bnc#1012382).\n - arm: dts: Fix omap3 off mode pull defines (bnc#1012382).\n - arm: dts: mvebu: pl310-cache disable double-linefill (bnc#1012382).\n - arm: OMAP2+: Fix init for multiple quirks for the same SoC (bnc#1012382).\n - arm: omap2plus_defconfig: Fix probe errors on UARTs 5 and 6\n (bnc#1012382).\n - arm: pxa: Do not rely on public mmc header to include leds.h\n (bnc#1012382).\n - asm/sections: add helpers to check for section data (bsc#1063026).\n - asoc: adau17x1: Workaround for noise bug in ADC (bnc#1012382).\n - asoc: cs42l56: Fix reset GPIO name in example DT binding (bsc#1031717).\n - asoc: davinci-mcasp: Fix an error handling path in\n 'davinci_mcasp_probe()' (bsc#1031717).\n - asoc: rsnd: do not double free kctrl (bnc#1012382).\n - asoc: samsung: Fix possible double iounmap on s3c24xx driver probe\n failure (bsc#1031717).\n - asoc: wm_adsp: Do not overrun firmware file buffer when reading region\n data (bnc#1012382).\n - ata: ATA_BMDMA should depend on HAS_DMA (bnc#1012382).\n - ata: fixes kernel crash while tracing ata_eh_link_autopsy event\n (bnc#1012382).\n - ata: SATA_HIGHBANK should depend on HAS_DMA (bnc#1012382).\n - ata: SATA_MV should depend on HAS_DMA (bnc#1012382).\n - ath10k: convert warning about non-existent OTP board id to debug message\n (git-fixes).\n - ath10k: fix a warning during channel switch with multiple vaps\n (bsc#1031717).\n - ath10k: fix board data fetch error message (bsc#1031717).\n - ath10k: fix diag_read to collect data for larger memory (bsc#1031717).\n - ath10k: fix incorrect txpower set by P2P_DEVICE interface (bnc#1012382).\n - ath10k: fix potential memory leak in ath10k_wmi_tlv_op_pull_fw_stats()\n (bnc#1012382).\n - ath10k: free cached fw bin contents when get board id fails\n (bsc#1031717).\n - ath10k: ignore configuring the incorrect board_id (bnc#1012382).\n - ath10k: set CTS protection VDEV param only if VDEV is up (bnc#1012382).\n - ath9k_htc: check for underflow in ath9k_htc_rx_msg() (bsc#1031717).\n - ath9k: off by one in ath9k_hw_nvram_read_array() (bsc#1031717).\n - autofs: do not fail mount for transient error (bsc#1065180).\n - backlight: adp5520: Fix error handling in adp5520_bl_probe()\n (bnc#1012382).\n - backlight: lcd: Fix race condition during register (bnc#1012382).\n - bcache: check ca->alloc_thread initialized before wake up it\n (bnc#1012382).\n - blacklist 0278b34bf15f spi: spidev_test: Fix buffer overflow in\n unescape() This is a binary built from Documentation and the build logs\n do not show it built\n - blacklist.conf: 79b63f12abcbbd2caf7064b294af648a87de07ff # bsc#1061756\n may break existing setups\n - blacklist.conf: Add ath10k, mmc and rtl8192u commits (bsc#1031717)\n - blacklist.conf: Add drm/i915 blacklist (bsc#1031717)\n - blacklist.conf: added misc commits (bsc#1031717)\n - blacklist.conf: Add misc entries (bsc#1031717)\n - blacklist.conf: Blacklist 33e465ce7cb3 ("percpu_ref: allow operation\n mode switching operations to be called concurrently"). The benefits are\n not worth the possible risks eventually introduced.\n - blacklist.conf: blacklisted 16af97dc5a89 (bnc#1053919)\n - blacklist.conf: blacklist not-applicable patch (bsc#1071231)\n - blacklist.conf: commit fe22cd9b7c980b8b948 ("printk: help pr_debug and\n pr_devel to optimize out arguments") is just a cosmetic change.\n - blacklist.conf: Update blacklist (bsc#1031717)\n - blacklist.conf: Update iwlwifi blacklist (bsc#1031717)\n - blacklist.conf: yet another serial entry (bsc#1031717)\n - block: Fix a race between blk_cleanup_queue() and timeout handling\n (FATE#319965, bsc#964944).\n - bluetooth: btusb: fix QCA Rome suspend/resume (bnc#1012382).\n - bnxt_en: Call firmware to approve the random VF MAC address (bsc#963575\n FATE#320144).\n - bnxt_en: Do not setup MAC address in bnxt_hwrm_func_qcaps() (bsc#963575\n FATE#320144).\n - bnxt_en: Fix possible corrupted NVRAM parameters from firmware response\n (bsc#963575 FATE#320144).\n - bnxt_en: Fix VF PCIe link speed and width logic (bsc#963575 FATE#320144).\n - bnxt_en: Re-arrange bnxt_hwrm_func_qcaps() (bsc#963575 FATE#320144).\n - bnxt_en: use eth_hw_addr_random() (bsc#963575 FATE#320144).\n - bonding: discard lowest hash bit for 802.3ad layer3+4 (bnc#1012382).\n - bpf: one perf event close won't free bpf program attached by another\n perf event (bnc#1012382).\n - bpf/verifier: reject BPF_ALU64|BPF_END (bnc#1012382).\n - brcmfmac: add length check in brcmf_cfg80211_escan_handler()\n (bnc#1012382).\n - brcmfmac: remove setting IBSS mode when stopping AP (bnc#1012382).\n - brcmsmac: make some local variables 'static const' to reduce stack size\n (bnc#1012382).\n - bt8xx: fix memory leak (bnc#1012382).\n - btrfs: add a node counter to each of the rbtrees (bsc#974590 bsc#1030061\n bsc#1022914 bsc#1017461).\n - btrfs: add cond_resched() calls when resolving backrefs (bsc#974590\n bsc#1030061 bsc#1022914 bsc#1017461).\n - btrfs: allow backref search checks for shared extents (bsc#974590\n bsc#1030061 bsc#1022914 bsc#1017461).\n - btrfs: backref, add tracepoints for prelim_ref insertion and merging\n (bsc#974590 bsc#1030061 bsc#1022914 bsc#1017461).\n - btrfs: backref, add unode_aux_to_inode_list helper (bsc#974590\n bsc#1030061 bsc#1022914 bsc#1017461).\n - btrfs: backref, cleanup __ namespace abuse (bsc#974590 bsc#1030061\n bsc#1022914 bsc#1017461).\n - btrfs: backref, constify some arguments (bsc#974590 bsc#1030061\n bsc#1022914 bsc#1017461).\n - btrfs: btrfs_check_shared should manage its own transaction (bsc#974590\n bsc#1030061 bsc#1022914 bsc#1017461).\n - btrfs: clean up extraneous computations in add_delayed_refs (bsc#974590\n bsc#1030061 bsc#1022914 bsc#1017461).\n - btrfs: constify tracepoint arguments (bsc#974590 bsc#1030061 bsc#1022914\n bsc#1017461).\n - btrfs: convert prelimary reference tracking to use rbtrees (bsc#974590\n bsc#1030061 bsc#1022914 bsc#1017461).\n - btrfs: fix leak and use-after-free in resolve_indirect_refs (bsc#974590\n bsc#1030061 bsc#1022914 bsc#1017461).\n - btrfs: Fix typo in may_commit_transaction Rather than comparing the\n result of the percpu comparison I was comparing the value of the percpu\n counter against 0 or 1.\n - btrfs: remove ref_tree implementation from backref.c (bsc#974590\n bsc#1030061 bsc#1022914 bsc#1017461).\n - btrfs: return the actual error value from from btrfs_uuid_tree_iterate\n (bnc#1012382).\n - btrfs: struct-funcs, constify readers (bsc#974590 bsc#1030061\n bsc#1022914 bsc#1017461).\n - bus: mbus: fix window size calculation for 4GB windows (bnc#1012382).\n - can: c_can: do not indicate triple sampling support for D_CAN\n (bnc#1012382).\n - can: esd_usb2: Fix can_dlc value for received RTR, frames (bnc#1012382).\n - can: gs_usb: fix busy loop if no more TX context is available\n (bnc#1012382).\n - can: kvaser_usb: Correct return value in printout (bnc#1012382).\n - can: kvaser_usb: Ignore CMD_FLUSH_QUEUE_REPLY messages (bnc#1012382).\n - can: sun4i: fix loopback mode (bnc#1012382).\n - can: sun4i: handle overrun in RX FIFO (bnc#1012382).\n - cdc_ncm: Set NTB format again after altsetting switch for Huawei devices\n (bnc#1012382).\n - ceph: clean up unsafe d_parent accesses in build_dentry_path\n (bnc#1012382).\n - ceph: unlock dangling spinlock in try_flush_caps() (bsc#1065639).\n - cgroup, net_cls: iterate the fds of only the tasks which are being\n migrated (bnc#1064926).\n - cifs: add build_path_from_dentry_optional_prefix() (fate#323482)\n - cifs: Add capability to decrypt big read responses (FATE#324404). Allow\n to decrypt transformed packets that are bigger than the big buffer size.\n In particular it is used for read responses that can only exceed the big\n buffer size.\n - cifs: Add capability to transform requests before sending (FATE#324404).\n This will allow us to do protocol specific tranformations of packets\n before sending to the server. For SMB3 it can be used to support\n encryption.\n - cifs: Add copy into pages callback for a read operation (FATE#324404).\n Since we have two different types of reads (pagecache and direct) we\n need to process such responses differently after decryption of a packet.\n The change allows to specify a callback that copies a read payload data\n into preallocated pages.\n - cifs: Add mid handle callback (FATE#324404). We need to process read\n responses differently because the data should go directly into\n preallocated pages. This can be done by specifying a mid handle callback.\n - cifs: Add soft dependencies (FATE#324404). List soft dependencies of\n cifs so that mkinitrd and dracut can include the required helper modules.\n - cifs: Add transform header handling callbacks (FATE#324404). We need to\n recognize and parse transformed packets in demultiplex thread to find a\n corresponsing mid and process it further.\n - cifs: add use_ipc flag to SMB2_ioctl() (fate#323482)\n - cifs: Allow to switch on encryption with seal mount option\n (FATE#324404). This allows users to inforce encryption for SMB3 shares\n if a server supports it.\n - cifs: check MaxPathNameComponentLength != 0 before using it\n (bnc#1012382).\n - cifs: Decrypt and process small encrypted packets (FATE#324404). Allow\n to decrypt transformed packets, find a corresponding mid and process as\n usual further.\n - cifs: do not bother with kmap on read_pages side (FATE#324404). just do\n ITER_BVEC recvmsg\n - cifs: Enable encryption during session setup phase (FATE#324404). In\n order to allow encryption on SMB connection we need to exchange a\n session key and generate encryption and decryption keys.\n - cifs: Encrypt SMB3 requests before sending (FATE#324404). This change\n allows to encrypt packets if it is required by a server for SMB sessions\n or tree connections.\n - cifs: fix circular locking dependency (bsc#1064701).\n - cifs: Fix some return values in case of error in 'crypt_message'\n (fate#324404).\n - cifs: Fix sparse warnings (fate#323482)\n - cifs: implement get_dfs_refer for SMB2+ (fate#323482)\n - cifs: let ses->ipc_tid hold smb2 TreeIds (fate#323482)\n - cifs: Make send_cancel take rqst as argument (FATE#324404).\n - cifs: Make SendReceive2() takes resp iov (FATE#324404). Now SendReceive2\n frees the first iov and returns a response buffer in it that increases a\n code complexity. Simplify this by making a caller responsible for\n freeing request buffer itself and returning a response buffer in a\n separate iov.\n - cifs: move DFS response parsing out of SMB1 code (fate#323482)\n - cifs: no need to wank with copying and advancing iovec on recvmsg side\n either (FATE#324404).\n - cifs: Only select the required crypto modules (FATE#324404). The sha256\n and cmac crypto modules are only needed for SMB2+, so move the select\n statements to config CIFS_SMB2. Also select CRYPTO_AES there as SMB2+\n needs it.\n - cifs: Prepare for encryption support (first part). Add decryption and\n encryption key generation. (FATE#324404).\n - cifs_readv_receive: use cifs_read_from_socket() (FATE#324404).\n - cifs: Reconnect expired SMB sessions (bnc#1012382).\n - cifs: remove any preceding delimiter from prefix_path (fate#323482)\n - cifs: Send RFC1001 length in a separate iov (FATE#324404). In order to\n simplify further encryption support we need to separate RFC1001 length\n and SMB2 header when sending a request. Put the length field in iov[0]\n and the rest of the packet into following iovs.\n - cifs: Separate RFC1001 length processing for SMB2 read (FATE#324404).\n Allocate and initialize SMB2 read request without RFC1001 length field\n to directly call cifs_send_recv() rather than SendReceive2() in a read\n codepath.\n - cifs: Separate SMB2 header structure (FATE#324404). In order to support\n compounding and encryption we need to separate RFC1001 length field and\n SMB2 header structure because the protocol treats them differently. This\n change will allow to simplify parsing of such complex SMB2 packets\n further.\n - cifs: Separate SMB2 sync header processing (FATE#324404). Do not process\n RFC1001 length in smb2_hdr_assemble() because it is not a part of SMB2\n header. This allows to cleanup the code and adds a possibility combine\n several SMB2 packets into one for compounding.\n - cifs: set signing flag in SMB2+ TreeConnect if needed (fate#323482)\n - cifs: Simplify SMB2 and SMB311 dependencies (FATE#324404). * CIFS_SMB2\n depends on CIFS, which depends on INET and selects NLS. So these\n dependencies do not need to be repeated for CIFS_SMB2. * CIFS_SMB311\n depends on CIFS_SMB2, which depends on INET. So this dependency does not\n need to be repeated for CIFS_SMB311.\n - cifs: use DFS pathnames in SMB2+ Create requests (fate#323482)\n - clk: ti: dra7-atl-clock: fix child-node lookups (bnc#1012382).\n - clk: ti: dra7-atl-clock: Fix of_node reference counting (bnc#1012382).\n - clockevents/drivers/cs5535: Improve resilience to spurious interrupts\n (bnc#1012382).\n - cma: fix calculation of aligned offset (VM Functionality, bsc#1050060).\n - coda: fix 'kernel memory exposure attempt' in fsync (bnc#1012382).\n - cpufreq: CPPC: add ACPI_PROCESSOR dependency (bnc#1012382).\n - crypto: shash - Fix zero-length shash ahash digest crash (bnc#1012382).\n - crypto: vmx - disable preemption to enable vsx in aes_ctr.c\n (bnc#1012382).\n - crypto: x86/sha1-mb - fix panic due to unaligned access (bnc#1012382).\n - crypto: xts - Add ECB dependency (bnc#1012382).\n - cx231xx: Fix I2C on Internal Master 3 Bus (bnc#1012382).\n - cxgb4: Fix error codes in c4iw_create_cq() (bsc#1021424).\n - cxl: Fix DAR check & use REGION_ID instead of opencoding (bsc#1066223).\n - cxl: Fix leaking pid refs in some error paths (bsc#1066223).\n - cxl: Force context lock during EEH flow (bsc#1066223).\n - cxl: Prevent adapter reset if an active context exists (bsc#1066223).\n - cxl: Route eeh events to all drivers in cxl_pci_error_detected()\n (bsc#1066223).\n - direct-io: Prevent NULL pointer access in submit_page_section\n (bnc#1012382).\n - Disable IPMI fix patches due to regression (bsc#1071833)\n - Disable\n patches.kernel.org/4.4.93-022-fix-unbalanced-page-refcounting-in-bio_map_us\n e.patch (bsc#1070767) Refresh\n patches.drivers/0004-bio-use-offset_in_page-macro.patch.\n - dmaengine: dmatest: warn user when dma test times out (bnc#1012382).\n - dmaengine: edma: Align the memcpy acnt array size with the transfer\n (bnc#1012382).\n - dmaengine: zx: set DMA_CYCLIC cap_mask bit (bnc#1012382).\n - dm bufio: fix integer overflow when limiting maximum cache size\n (bnc#1012382).\n - dm: fix race between dm_get_from_kobject() and __dm_destroy()\n (bnc#1012382).\n - drivers: dma-mapping: Do not leave an invalid area->pages pointer in\n dma_common_contiguous_remap() (Git-fixes, bsc#1065692).\n - drm/amdgpu: when dpm disabled, also need to stop/start vce (bnc#1012382).\n - drm/amdkfd: NULL dereference involving create_process() (bsc#1031717).\n - drm: Apply range restriction after color adjustment when allocation\n (bnc#1012382).\n - drm/armada: Fix compile fail (bnc#1012382).\n - drm: drm_minor_register(): Clean up debugfs on failure (bnc#1012382).\n - drm: gma500: fix logic error (bsc#1031717).\n - drm/i915/bxt: set min brightness from VBT (bsc#1031717).\n - drm/i915: Do not try indexed reads to alternate slave addresses\n (bsc#1031717).\n - drm/i915: fix backlight invert for non-zero minimum brightness\n (bsc#1031717).\n - drm/i915: Prevent zero length "index" write (bsc#1031717).\n - drm/i915: Read timings from the correct transcoder in\n intel_crtc_mode_get() (bsc#1031717).\n - drm/msm: fix an integer overflow test (bnc#1012382).\n - drm/msm: Fix potential buffer overflow issue (bnc#1012382).\n - drm/nouveau/bsp/g92: disable by default (bnc#1012382).\n - drm/nouveau/gr: fallback to legacy paths during firmware lookup\n (bsc#1031717).\n - drm/nouveau/mmu: flush tlbs before deleting page tables (bnc#1012382).\n - drm/omap: Fix error handling path in 'omap_dmm_probe()' (bsc#1031717).\n - drm/panel: simple: Add missing panel_simple_unprepare() calls\n (bsc#1031717).\n - drm/sti: sti_vtg: Handle return NULL error from devm_ioremap_nocache\n (bnc#1012382).\n - drm/vc4: Fix leak of HDMI EDID (bsc#1031717).\n - drm/vmwgfx: Fix Ubuntu 17.10 Wayland black screen issue (bnc#1012382).\n - e1000e: Fix error path in link detection (bnc#1012382).\n - e1000e: Fix return value test (bnc#1012382).\n - e1000e: Separate signaling for link check/link up (bnc#1012382).\n - ecryptfs: fix dereference of NULL user_key_payload (bnc#1012382).\n - eCryptfs: use after free in ecryptfs_release_messaging() (bsc#1012829).\n - epoll: avoid calling ep_call_nested() from ep_poll_safewake()\n (bsc#1056427).\n - epoll: remove ep_call_nested() from ep_eventpoll_poll() (bsc#1056427).\n - ext4: cleanup goto next group (bsc#1066285).\n - ext4: do not use stripe_width if it is not set (bnc#1012382).\n - ext4: fix interaction between i_size, fallocate, and delalloc after a\n crash (bnc#1012382).\n - ext4: fix stripe-unaligned allocations (bnc#1012382).\n - ext4: in ext4_seek_{hole,data}, return -ENXIO for negative offsets\n (bnc#1012382).\n - ext4: reduce lock contention in __ext4_new_inode (bsc#1066285).\n - extcon: palmas: Check the parent instance to prevent the NULL\n (bnc#1012382).\n - exynos4-is: fimc-is: Unmap region obtained by of_iomap() (bnc#1012382).\n - f2fs crypto: add missing locking for keyring_key access (bnc#1012382).\n - f2fs crypto: replace some BUG_ON()'s with error checks (bnc#1012382).\n - f2fs: do not wait for writeback in write_begin (bnc#1012382).\n - fealnx: Fix building error on MIPS (bnc#1012382).\n - fix a page leak in vhost_scsi_iov_to_sgl() error recovery (bnc#1012382).\n - Fix tracing sample code warning (bnc#1012382).\n - fix unbalanced page refcounting in bio_map_user_iov (bnc#1012382).\n - fm10k: request reset when mbx->state changes (bnc#1012382).\n - fm10k: Use smp_rmb rather than read_barrier_depends (bnc#1012382).\n - fs/9p: Compare qid.path in v9fs_test_inode (bsc#1012829).\n - fs-cache: fix dereference of NULL user_key_payload (bnc#1012382).\n - fscrypt: fix dereference of NULL user_key_payload (bnc#1012382).\n - fscrypt: lock mutex before checking for bounce page pool (bnc#1012382).\n - fscrypto: require write access to mount to set encryption policy\n (bnc#1012382).\n - fuse: fix READDIRPLUS skipping an entry (bnc#1012382).\n - gpu: drm: mgag200: mgag200_main:- Handle error from pci_iomap\n (bnc#1012382).\n - hid: elo: clear BTN_LEFT mapping (bsc#1065866).\n - hid: usbhid: fix out-of-bounds bug (bnc#1012382).\n - hsi: ssi_protocol: double free in ssip_pn_xmit() (bsc#1031717).\n - i2c: at91: ensure state is restored after suspending (bnc#1012382).\n - i2c: cadance: fix ctrl/addr reg write order (bsc#1031717).\n - i2c: imx: Use correct function to write to register (bsc#1031717).\n - i2c: ismt: Separate I2C block read from SMBus block read (bnc#1012382).\n - i2c: riic: correctly finish transfers (bnc#1012382).\n - i2c: riic: fix restart condition (git-fixes).\n - i40e: Use smp_rmb rather than read_barrier_depends (bnc#1012382).\n - i40evf: Use smp_rmb rather than read_barrier_depends (bnc#1012382).\n - ib/core: Fix calculation of maximum RoCE MTU (bsc#1022595 FATE#322350).\n - ib/core: Namespace is mandatory input for address resolution\n (bsc#1022595 FATE#322350).\n - ib/ipoib: Change list_del to list_del_init in the tx object\n (bnc#1012382).\n - ib/ipoib: Clean error paths in add port (bsc#1022595 FATE#322350).\n - ib/ipoib: Prevent setting negative values to max_nonsrq_conn_qp\n (bsc#1022595 FATE#322350).\n - ib/ipoib: Remove double pointer assigning (bsc#1022595 FATE#322350).\n - ib/ipoib: Set IPOIB_NEIGH_TBL_FLUSH after flushed completion\n initialization (bsc#1022595 FATE#322350).\n - ib/mlx5: Fix RoCE Address Path fields (bsc#966170 FATE#320225 bsc#966172\n FATE#320226).\n - ibmvnic: Add netdev_dbg output for debugging (fate#323285).\n - ibmvnic: Add vnic client data to login buffer (bsc#1069942).\n - ibmvnic: Convert vnic server reported statistics to cpu endian\n (fate#323285).\n - ibmvnic: Enable scatter-gather support (bsc#1066382).\n - ibmvnic: Enable TSO support (bsc#1066382).\n - ibmvnic: Feature implementation of Vital Product Data (VPD) for the\n ibmvnic driver (bsc#1069942).\n - ibmvnic: Fix calculation of number of TX header descriptors\n (bsc#1066382).\n - ibmvnic: fix dma_mapping_error call (bsc#1069942).\n - ibmvnic: Fix failover error path for non-fatal resets (bsc#1066382).\n - ibmvnic: Implement .get_channels (fate#323285).\n - ibmvnic: Implement .get_ringparam (fate#323285).\n - ibmvnic: Implement per-queue statistics reporting (fate#323285).\n - ibmvnic: Let users change net device features (bsc#1066382).\n - ibmvnic: Update reset infrastructure to support tunable parameters\n (bsc#1066382).\n - ib/srp: Avoid that a cable pull can trigger a kernel crash (bsc#1022595\n FATE#322350).\n - ib/srpt: Do not accept invalid initiator port names (bnc#1012382).\n - ib/uverbs: Fix device cleanup (bsc#1022595 FATE#322350).\n - ib/uverbs: Fix NULL pointer dereference during device removal\n (bsc#1022595 FATE#322350).\n - igb: close/suspend race in netif_device_detach (bnc#1012382).\n - igb: Fix hw_dbg logging in igb_update_flash_i210 (bnc#1012382).\n - igb: reset the PHY before reading the PHY ID (bnc#1012382).\n - igb: Use smp_rmb rather than read_barrier_depends (bnc#1012382).\n - igbvf: Use smp_rmb rather than read_barrier_depends (bnc#1012382).\n - iio: adc: xilinx: Fix error handling (bnc#1012382).\n - iio: dummy: events: Add missing break (bsc#1031717).\n - iio: light: fix improper return value (bnc#1012382).\n - iio: trigger: free trigger resource correctly (bnc#1012382).\n - ima: do not update security.ima if appraisal status is not\n INTEGRITY_PASS (bnc#1012382).\n - input: ar1021_i2c - fix too long name in driver's device table\n (bsc#1031717).\n - input: edt-ft5x06 - fix setting gain, offset, and threshold via device\n tree (bsc#1031717).\n - input: elan_i2c - add ELAN060C to the ACPI table (bnc#1012382).\n - input: elan_i2c - add ELAN0611 to the ACPI table (bnc#1012382).\n - input: gtco - fix potential out-of-bound access (bnc#1012382).\n - input: mpr121 - handle multiple bits change of status register\n (bnc#1012382).\n - input: mpr121 - set missing event capability (bnc#1012382).\n - input: ti_am335x_tsc - fix incorrect step config for 5 wire touchscreen\n (bsc#1031717).\n - input: twl4030-pwrbutton - use correct device for irq request\n (bsc#1031717).\n - input: ucb1400_ts - fix suspend and resume handling (bsc#1031717).\n - input: uinput - avoid crash when sending FF request to device going away\n (bsc#1031717).\n - iommu/amd: Finish TLB flush in amd_iommu_unmap() (bnc#1012382).\n - iommu/arm-smmu-v3: Clear prior settings when updating STEs (bnc#1012382).\n - iommu/vt-d: Do not register bus-notifier under dmar_global_lock\n (bsc#1069793).\n - ip6_gre: only increase err_count for some certain type icmpv6 in\n ip6gre_err (bnc#1012382).\n - ip6_gre: skb_push ipv6hdr before packing the header in ip6gre_header\n (bnc#1012382).\n - ipip: only increase err_count for some certain type icmp in ipip_err\n (bnc#1012382).\n - ipmi: fix unsigned long underflow (bnc#1012382).\n - ipmi: Pick up slave address from SMBIOS on an ACPI device (bsc#1070006).\n - ipmi: Prefer ACPI system interfaces over SMBIOS ones (bsc#1070006).\n - ipmi_si: Clean up printks (bsc#1070006).\n - ipmi_si: fix memory leak on new_smi (bsc#1070006).\n - ipsec: do not ignore crypto err in ah4 input (bnc#1012382).\n - ipv6: flowlabel: do not leave opt->tot_len with garbage (bnc#1012382).\n - ipv6: only call ip6_route_dev_notify() once for NETDEV_UNREGISTER\n (bnc#1012382).\n - ipvs: make drop_entry protection effective for SIP-pe (bsc#1056365).\n - irqchip/crossbar: Fix incorrect type of local variables (bnc#1012382).\n - isa: Prevent NULL dereference in isa_bus driver callbacks (bsc#1031717).\n - iscsi-target: Fix non-immediate TMR reference leak (bnc#1012382).\n - isdn/i4l: fetch the ppp_write buffer in one shot (bnc#1012382).\n - isofs: fix timestamps beyond 2027 (bnc#1012382).\n - iwlwifi: mvm: fix the coex firmware API (bsc#1031717).\n - iwlwifi: mvm: return -ENODATA when reading the temperature with the FW\n down (bsc#1031717).\n - iwlwifi: mvm: set the RTS_MIMO_PROT bit in flag mask when sending sta to\n fw (bsc#1031717).\n - iwlwifi: mvm: use IWL_HCMD_NOCOPY for MCAST_FILTER_CMD (bnc#1012382).\n - iwlwifi: split the regulatory rules when the bandwidth flags require it\n (bsc#1031717).\n - ixgbe: add mask for 64 RSS queues (bnc#1012382).\n - ixgbe: do not disable FEC from the driver (bnc#1012382).\n - ixgbe: fix AER error handling (bnc#1012382).\n - ixgbe: Fix skb list corruption on Power systems (bnc#1012382).\n - ixgbe: handle close/suspend race with netif_device_detach/present\n (bnc#1012382).\n - ixgbe: Reduce I2C retry count on X550 devices (bnc#1012382).\n - ixgbevf: Use smp_rmb rather than read_barrier_depends (bnc#1012382).\n - kABI fix for 4.4.99 net changes (stable-4.4.99).\n - kABI: protect struct l2tp_tunnel (kabi).\n - kABI: protect struct regulator_dev (kabi).\n - kABI: protect structs rt_rq+root_domain (kabi).\n - kABI: protect typedef rds_rdma_cookie_t (kabi).\n - kernel/sysctl.c: remove duplicate UINT_MAX check on\n do_proc_douintvec_conv() (bsc#1066470).\n - kernel/watchdog: Prevent false positives with turbo modes (bnc#1063516).\n - keys: do not let add_key() update an uninstantiated key (bnc#1012382).\n - keys: do not revoke uninstantiated key in request_key_auth_new()\n (bsc#1031717).\n - keys: encrypted: fix dereference of NULL user_key_payload (bnc#1012382).\n - keys: fix cred refcount leak in request_key_auth_new() (bsc#1031717).\n - keys: fix key refcount leak in keyctl_assume_authority() (bsc#1031717).\n - keys: fix key refcount leak in keyctl_read_key() (bsc#1031717).\n - keys: fix NULL pointer dereference during ASN.1 parsing [ver #2]\n (bnc#1012382).\n - keys: fix out-of-bounds read during ASN.1 parsing (bnc#1012382).\n - keys: Fix race between updating and finding a negative key (bnc#1012382).\n - keys: return full count in keyring_read() if buffer is too small\n (bnc#1012382).\n - keys: trusted: fix writing past end of buffer in trusted_read()\n (bnc#1012382).\n - keys: trusted: sanitize all key material (bnc#1012382).\n - KVM: nVMX: fix guest CR4 loading when emulating L2 to L1 exit\n (bnc#1012382).\n - kvm: nVMX: set IDTR and GDTR limits when loading L1 host state\n (bnc#1012382).\n - KVM: PPC: Book 3S: XICS: correct the real mode ICP rejecting counter\n (bnc#1012382).\n - kvm: SVM: obey guest PAT (bnc#1012382).\n - l2tp: Avoid schedule while atomic in exit_net (bnc#1012382).\n - l2tp: check ps->sock before running pppol2tp_session_ioctl()\n (bnc#1012382).\n - l2tp: fix race condition in l2tp_tunnel_delete (bnc#1012382).\n - lib/digsig: fix dereference of NULL user_key_payload (bnc#1012382).\n - libertas: Fix lbs_prb_rsp_limit_set() (bsc#1031717).\n - lib/mpi: call cond_resched() from mpi_powm() loop (bnc#1012382).\n - libnvdimm, namespace: fix label initialization to use valid seq numbers\n (bnc#1012382).\n - libnvdimm, namespace: make 'resource' attribute only readable by root\n (bnc#1012382).\n - libnvdimm, pfn: make 'resource' attribute only readable by root\n (FATE#319858).\n - lib/ratelimit.c: use deferred printk() version (bsc#979928).\n - locking/lockdep: Add nest_lock integrity test (bnc#1012382).\n - mac80211: agg-tx: call drv_wake_tx_queue in proper context (bsc#1031717).\n - mac80211: do not compare TKIP TX MIC key in reinstall prevention\n (bsc#1066472).\n - mac80211: do not send SMPS action frame in AP mode when not needed\n (bsc#1031717).\n - mac80211: Fix addition of mesh configuration element (git-fixes).\n - mac80211: Fix BW upgrade for TDLS peers (bsc#1031717).\n - mac80211: fix mgmt-tx abort cookie and leak (bsc#1031717).\n - mac80211: fix power saving clients handling in iwlwifi (bnc#1012382).\n - mac80211_hwsim: check HWSIM_ATTR_RADIO_NAME length (bnc#1012382).\n - mac80211_hwsim: Fix memory leak in hwsim_new_radio_nl() (bsc#1031717).\n - mac80211: Remove invalid flag operations in mesh TSF synchronization\n (bnc#1012382).\n - mac80211: Remove unused 'beaconint_us' variable (bsc#1031717).\n - mac80211: Remove unused 'i' variable (bsc#1031717).\n - mac80211: Remove unused 'len' variable (bsc#1031717).\n - mac80211: Remove unused 'rates_idx' variable (bsc#1031717).\n - mac80211: Remove unused 'sband' and 'local' variables (bsc#1031717).\n - mac80211: Remove unused 'struct ieee80211_rx_status' ptr (bsc#1031717).\n - mac80211: Suppress NEW_PEER_CANDIDATE event if no room (bnc#1012382).\n - mac80211: TDLS: always downgrade invalid chandefs (bsc#1031717).\n - mac80211: TDLS: change BW calculation for WIDER_BW peers (bsc#1031717).\n - mac80211: use constant time comparison with keys (bsc#1066471).\n - md/linear: shutup lockdep warnning (bnc#1012382).\n - media: au0828: fix RC_CORE dependency (bsc#1031717).\n - media: Do not do DMA on stack for firmware upload in the AS102 driver\n (bnc#1012382).\n - media: em28xx: calculate left volume level correctly (bsc#1031717).\n - media: mceusb: fix memory leaks in error path (bsc#1031717).\n - media: rc: check for integer overflow (bnc#1012382).\n - media: v4l2-ctrl: Fix flags field on Control events (bnc#1012382).\n - megaraid_sas: Do not fire MR_DCMD_PD_LIST_QUERY to controllers which do\n not support it (bsc#1027301).\n - mei: return error on notification request to a disconnected client\n (bnc#1012382).\n - mfd: ab8500-sysctrl: Handle probe deferral (bnc#1012382).\n - mfd: axp20x: Fix axp288 PEK_DBR and PEK_DBF irqs being swapped\n (bnc#1012382).\n - mips: AR7: Defer registration of GPIO (bnc#1012382).\n - mips: AR7: Ensure that serial ports are properly set up (bnc#1012382).\n - mips: BCM47XX: Fix LED inversion for WRT54GSv1 (bnc#1012382).\n - mips: End asm function prologue macros with .insn (bnc#1012382).\n - mips: Fix an n32 core file generation regset support regression\n (bnc#1012382).\n - mips: Fix CM region target definitions (bnc#1012382).\n - mips: Fix race on setting and getting cpu_online_mask (bnc#1012382).\n - mips: init: Ensure bootmem does not corrupt reserved memory\n (bnc#1012382).\n - mips: init: Ensure reserved memory regions are not added to bootmem\n (bnc#1012382).\n - mips: math-emu: Remove pr_err() calls from fpu_emu() (bnc#1012382).\n - mips: microMIPS: Fix incorrect mask in insn_table_MM (bnc#1012382).\n - mips: Netlogic: Exclude netlogic,xlp-pic code from XLR builds\n (bnc#1012382).\n - mips: ralink: Fix MT7628 pinmux (bnc#1012382).\n - mips: ralink: Fix typo in mt7628 pinmux function (bnc#1012382).\n - mips: SMP: Fix deadlock & online race (bnc#1012382).\n - mips: SMP: Use a completion event to signal CPU up (bnc#1012382).\n - misc: panel: properly restore atomic counter on error path (bnc#1012382).\n - mmc: block: return error on failed mmc_blk_get() (bsc#1031717).\n - mmc: core/mmci: restore pre/post_req behaviour (bsc#1031717).\n - mmc: dw_mmc: rockchip: Set the drive phase properly (bsc#1031717).\n - mm: check the return value of lookup_page_ext for all call sites\n (bnc#1068982).\n - mmc: host: omap_hsmmc: avoid possible overflow of timeout value\n (bsc#1031717).\n - mmc: host: omap_hsmmc: checking for NULL instead of IS_ERR()\n (bsc#1031717).\n - mmc: mediatek: Fixed size in dma_free_coherent (bsc#1031717).\n - mmc: s3cmci: include linux/interrupt.h for tasklet_struct (bnc#1012382).\n - mmc: sd: limit SD card power limit according to cards capabilities\n (bsc#1031717).\n - mm, hwpoison: fixup "mm: check the return value of lookup_page_ext for\n all call sites" (bnc#1012382).\n - mm/madvise.c: fix madvise() infinite loop under special circumstances\n (bnc#1070964).\n - mm/page_alloc.c: broken deferred calculation (bnc#1068980).\n - mm, page_alloc: fix potential false positive in __zone_watermark_ok\n (Git-fixes, bsc#1068978).\n - mm/page_ext.c: check if page_ext is not prepared (bnc#1068982).\n - mm/page_owner: avoid null pointer dereference (bnc#1068982).\n - mm/pagewalk.c: report holes in hugetlb ranges (bnc#1012382).\n - net: 3com: typhoon: typhoon_init_one: fix incorrect return values\n (bnc#1012382).\n - net: 3com: typhoon: typhoon_init_one: make return values more specific\n (bnc#1012382).\n - net/9p: Switch to wait_event_killable() (bnc#1012382).\n - net: Allow IP_MULTICAST_IF to set index to L3 slave (bnc#1012382).\n - net: cdc_ether: fix divide by 0 on bad descriptors (bnc#1012382).\n - net: cdc_ncm: GetNtbFormat endian fix (git-fixes).\n - net: dsa: select NET_SWITCHDEV (bnc#1012382).\n - net: emac: Fix napi poll list corruption (bnc#1012382).\n - netfilter/ipvs: clear ipvs_property flag when SKB net namespace changed\n (bnc#1012382).\n - netfilter: nf_ct_expect: Change __nf_ct_expect_check() return value\n (bnc#1012382).\n - netfilter: nf_tables: fix oob access (bnc#1012382).\n - netfilter: nft_meta: deal with PACKET_LOOPBACK in netdev family\n (bnc#1012382).\n - netfilter: nft_queue: use raw_smp_processor_id() (bnc#1012382).\n - net: ibm: ibmvnic: constify vio_device_id (fate#323285).\n - net/mlx4_core: Fix VF overwrite of module param which disables DMFS on\n new probed PFs (bnc#1012382).\n - net/mlx4_en: fix overflow in mlx4_en_init_timestamp() (bnc#1012382).\n - net: mvpp2: release reference to txq_cpu[] entry after unmapping\n (bnc#1012382).\n - net: qmi_wwan: fix divide by 0 on bad descriptors (bnc#1012382).\n - net/sctp: Always set scope_id in sctp_inet6_skb_msgname (bnc#1012382).\n - net: Set sk_prot_creator when cloning sockets to the right proto\n (bnc#1012382).\n - net/unix: do not show information about sockets from other namespaces\n (bnc#1012382).\n - nfc: fix device-allocation error return (bnc#1012382).\n - nfsd/callback: Cleanup callback cred on shutdown (bnc#1012382).\n - nfsd: deal with revoked delegations appropriately (bnc#1012382).\n - nfs: Do not disconnect open-owner on NFS4ERR_BAD_SEQID (bsc#989261).\n - nfs: Fix typo in nomigration mount option (bnc#1012382).\n - nfs: Fix ugly referral attributes (bnc#1012382).\n - nilfs2: fix race condition that causes file system corruption\n (bnc#1012382).\n - nl80211: Define policy for packet pattern attributes (bnc#1012382).\n - nvme: Fix memory order on async queue deletion (bnc#1012382).\n - ocfs2: fstrim: Fix start offset of first cluster group during fstrim\n (bnc#1012382).\n - ocfs2: should wait dio before inode lock in ocfs2_setattr()\n (bnc#1012382).\n - packet: avoid panic in packet_getsockopt() (bnc#1012382).\n - packet: only test po->has_vnet_hdr once in packet_snd (bnc#1012382).\n - parisc: Avoid trashing sr2 and sr3 in LWS code (bnc#1012382).\n - parisc: Fix double-word compare and exchange in LWS code on 32-bit\n kernels (bnc#1012382).\n - parisc: Fix validity check of pointer size argument in new CAS\n implementation (bnc#1012382).\n - pci: Apply _HPX settings only to relevant devices (bnc#1012382).\n - pci: mvebu: Handle changes to the bridge windows while enabled\n (bnc#1012382).\n - percpu: make this_cpu_generic_read() atomic w.r.t. interrupts\n (bnc#1012382).\n - perf tools: Fix build failure on perl script context (bnc#1012382).\n - perf tools: Only increase index if perf_evsel__new_idx() succeeds\n (bnc#1012382).\n - perf/x86/intel/bts: Fix exclusive event reference leak (git-fixes\n d2878d642a4ed).\n - phy: increase size of MII_BUS_ID_SIZE and bus_id (bnc#1012382).\n - pkcs#7: fix unitialized boolean 'want' (bnc#1012382).\n - pkcs7: Prevent NULL pointer dereference, since sinfo is not always set\n (bnc#1012382).\n - platform/x86: acer-wmi: setup accelerometer when ACPI device was found\n (bsc#1031717).\n - platform/x86: hp-wmi: Do not shadow error values (bnc#1012382).\n - platform/x86: hp-wmi: Fix detection for dock and tablet mode\n (bnc#1012382).\n - platform/x86: hp-wmi: Fix error value for hp_wmi_tablet_state\n (bnc#1012382).\n - platform/x86: intel_mid_thermal: Fix module autoload (bnc#1012382).\n - platform/x86: sony-laptop: Fix error handling in sony_nc_setup_rfkill()\n (bsc#1031717).\n - pm / OPP: Add missing of_node_put(np) (bnc#1012382).\n - power: bq27xxx_battery: Fix bq27541 AveragePower register address\n (bsc#1031717).\n - power: bq27xxx: fix reading for bq27000 and bq27010 (bsc#1031717).\n - powercap: Fix an error code in powercap_register_zone() (bsc#1031717).\n - power: ipaq-micro-battery: freeing the wrong variable (bsc#1031717).\n - powerpc/64: Fix race condition in setting lock bit in idle/wakeup code\n (bsc#1066223).\n - powerpc/bpf/jit: Disable classic BPF JIT on ppc64le (bsc#1066223).\n - powerpc/corenet: explicitly disable the SDHC controller on kmcoge4\n (bnc#1012382).\n - powerpc: Correct instruction code for xxlor instruction (bsc#1066223).\n - powerpc: Fix VSX enabling/flushing to also test MSR_FP and MSR_VEC\n (bsc#1066223).\n - powerpc/mm: Fix check of multiple 16G pages from device tree\n (bsc#1066223).\n - powerpc/mm: Fix virt_addr_valid() etc. on 64-bit hash (bsc#1066223).\n - powerpc/mm/hash64: Fix subpage protection with 4K HPTE config\n (bsc#1010201, bsc#1066223).\n - powerpc/mm/hash: Free the subpage_prot_table correctly (bsc#1066223).\n - powerpc/numa: Fix multiple bugs in memory_hotplug_max() (bsc#1066223).\n - powerpc/numa: Fix whitespace in hot_add_drconf_memory_max()\n (bsc#1066223).\n - powerpc/opal: Fix EBUSY bug in acquiring tokens (bsc#1066223).\n - powerpc/perf: Remove PPMU_HAS_SSLOT flag for Power8 (bsc#1066223).\n - powerpc/powernv/ioda: Fix endianness when reading TCEs (bsc#1066223).\n - powerpc/powernv: Make opal_event_shutdown() callable from IRQ context\n (bsc#1066223).\n - powerpc/pseries/vio: Dispose of virq mapping on vdevice unregister\n (bsc#1067888).\n - powerpc/signal: Properly handle return value from uprobe_deny_signal()\n (bsc#1066223).\n - powerpc/sysrq: Fix oops whem ppmu is not registered (bsc#1066223).\n - power: supply: bq27xxx_battery: Fix register map for BQ27510 and BQ27520\n ("bsc#1069270").\n - power: supply: isp1704: Fix unchecked return value of devm_kzalloc\n (bsc#1031717).\n - power: supply: lp8788: prevent out of bounds array access (bsc#1031717).\n - power_supply: tps65217-charger: Fix NULL deref during property export\n (bsc#1031717).\n - ppp: fix race in ppp device destruction (bnc#1012382).\n - printk/console: Always disable boot consoles that use init memory before\n it is freed (bsc#1063026).\n - printk/console: Enhance the check for consoles using init memory\n (bsc#1063026).\n - printk: include <asm/sections.h> instead of <asm-generic/sections.h>\n (bsc#1063026).\n - printk: only unregister boot consoles when necessary (bsc#1063026).\n - quota: Check for register_shrinker() failure (bsc#1012829).\n - r8169: Do not increment tx_dropped in TX ring cleaning (bsc#1031717).\n - rbd: use GFP_NOIO for parent stat and data requests (bnc#1012382).\n - rcu: Allow for page faults in NMI handlers (bnc#1012382).\n - rdma/uverbs: Prevent leak of reserved field (bsc#1022595 FATE#322350).\n - rds: RDMA: return appropriate error on rdma map failures (bnc#1012382).\n - regulator: core: Limit propagation of parent voltage count and list\n (bsc#1070145).\n - regulator: fan53555: fix I2C device ids (bnc#1012382).\n - Revert "bpf: one perf event close won't free bpf program attached by\n another perf event" (kabi).\n - Revert "bsg-lib: do not free job in bsg_prepare_job" (bnc#1012382).\n - Revert "crypto: xts - Add ECB dependency" (bnc#1012382).\n - Revert "drm: bridge: add DT bindings for TI ths8135" (bnc#1012382).\n - Revert "keys: Fix race between updating and finding a negative key"\n (kabi).\n - Revert "phy: increase size of MII_BUS_ID_SIZE and bus_id" (kabi).\n - Revert "sctp: do not peel off an assoc from one netns to another one"\n (bnc#1012382).\n - Revert "tty: goldfish: Fix a parameter of a call to free_irq"\n (bnc#1012382).\n - Revert "uapi: fix linux/rds.h userspace compilation errors"\n (bnc#1012382).\n - rpm/kernel-binary.spec.in: add the kernel-binary dependencies to\n kernel-binary-base (bsc#1060333).\n - rpm/kernel-binary.spec.in: Correct supplements for recent SLE products\n (bsc#1067494)\n - rpm/kernel-binary.spec.in: only rewrite modules.dep if non-zero in size\n (bsc#1056979).\n - rtc: ds1307: Fix relying on reset value for weekday (bsc#1031717).\n - rtc: ds1374: wdt: Fix issue with timeout scaling from secs to wdt ticks\n (bsc#1031717).\n - rtc: ds1374: wdt: Fix stop/start ioctl always returning -EINVAL\n (bsc#1031717).\n - rtc: rtc-nuc900: fix loop timeout test (bsc#1031717).\n - rtc: sa1100: fix unbalanced clk_prepare_enable/clk_disable_unprepare\n (bsc#1031717).\n - rtlwifi: fix uninitialized rtlhal->last_suspend_sec time (bnc#1012382).\n - rtlwifi: rtl8192ee: Fix memory leak when loading firmware (bnc#1012382).\n - rtlwifi: rtl8821ae: Fix connection lost problem (bnc#1012382).\n - rtlwifi: rtl8821ae: Fix HW_VAR_NAV_UPPER operation (bsc#1031717).\n - s390/dasd: check for device error pointer within state change interrupts\n (bnc#1012382).\n - s390/disassembler: add missing end marker for e7 table (bnc#1012382).\n - s390/disassembler: correct disassembly lines alignment (bsc#1070825).\n - s390/disassembler: increase show_code buffer size (bnc#1012382).\n - s390: fix transactional execution control register handling\n (bnc#1012382).\n - s390/kbuild: enable modversions for symbols exported from asm\n (bnc#1012382).\n - s390/qeth: issue STARTLAN as first IPA command (bnc#1012382).\n - s390/runtime instrumention: fix possible memory corruption (bnc#1012382).\n - sched/autogroup: Fix autogroup_move_group() to never skip\n sched_move_task() (bnc#1012382).\n - sched: Make resched_cpu() unconditional (bnc#1012382).\n - sched/rt: Simplify the IPI based RT balancing logic (bnc#1012382).\n - scsi: aacraid: Process Error for response I/O (bnc#1012382).\n - scsi_devinfo: cleanly zero-pad devinfo strings (bsc#1062941).\n - scsi: ipr: Fix scsi-mq lockdep issue (bsc#1066213).\n - scsi: ipr: Set no_report_opcodes for RAID arrays (bsc#1066213).\n - scsi: libiscsi: fix shifting of DID_REQUEUE host byte (bsc#1056003).\n - scsi: lpfc: Add missing memory barrier (bnc#1012382).\n - scsi: lpfc: Clear the VendorVersion in the PLOGI/PLOGI ACC payload\n (bnc#1012382).\n - scsi: lpfc: Correct host name in symbolic_name field (bnc#1012382).\n - scsi: lpfc: Correct issue leading to oops during link reset\n (bnc#1012382).\n - scsi: lpfc: FCoE VPort enable-disable does not bring up the VPort\n (bnc#1012382).\n - scsi: reset wait for IO completion (bsc#996376).\n - scsi: scsi_devinfo: fixup string compare (bsc#1062941). updated\n patches.fixes/scsi_devinfo-fixup-string-compare.patch to the version\n merged upstream.\n - scsi: scsi_devinfo: handle non-terminated strings (bsc#1062941).\n - scsi: scsi_dh_emc: return success in clariion_std_inquiry()\n (bnc#1012382).\n - scsi: scsi_transport_fc: Also check for NOTPRESENT in\n fc_remote_port_add() (bsc#1037890).\n - scsi: scsi_transport_fc: set scsi_target_id upon rescan (bsc#1058135).\n - scsi: sg: Re-fix off by one in sg_fill_request_table() (bnc#1012382).\n - scsi: ufs: add capability to keep auto bkops always enabled\n (bnc#1012382).\n - scsi: ufs-qcom: Fix module autoload (bnc#1012382).\n - scsi: virtio_scsi: let host do exception handling (bsc#1060682).\n - scsi: zfcp: fix erp_action use-before-initialize in REC action trace\n (bnc#1012382).\n - sctp: add the missing sock_owned_by_user check in sctp_icmp_redirect\n (bnc#1012382).\n - sctp: do not peel off an assoc from one netns to another one\n (bnc#1012382).\n - sctp: potential read out of bounds in sctp_ulpevent_type_enabled()\n (bnc#1012382).\n - sctp: reset owner sk for data chunks on out queues when migrating a sock\n (bnc#1012382).\n - security/keys: add CONFIG_KEYS_COMPAT to Kconfig (bnc#1012382).\n - selftests: firmware: add empty string and async tests (bnc#1012382).\n - selftests: firmware: send expected errors to /dev/null (bnc#1012382).\n - serial: 8250_fintek: Fix rs485 disablement on invalid ioctl()\n (bsc#1031717).\n - serial: 8250_uniphier: fix serial port index in private data\n (bsc#1031717).\n - serial: Fix serial console on SNI RM400 machines (bsc#1031717).\n - serial: omap: Fix EFR write on RTS deassertion (bnc#1012382).\n - serial: Remove unused port type (bsc#1066045).\n - serial: sh-sci: Fix register offsets for the IRDA serial port\n (bnc#1012382).\n - slub: do not merge cache if slub_debug contains a never-merge flag\n (bnc#1012382).\n - smb3: parsing for new snapshot timestamp mount parm (FATE#324404). New\n mount option "snapshot=<time>" to allow mounting an earlier version of\n the remote volume (if such a snapshot exists on the server). Note that\n eventually specifying a snapshot time of 1 will allow the user to mount\n the oldest snapshot. A subsequent patch add the processing for that and\n another for actually specifying the "time warp" create context on\n SMB2/SMB3 open. Check to make sure SMB2 negotiated, and ensure that we\n use a different tcon if mount same share twice but with different\n snaphshot times\n - sparc64: Migrate hvcons irq to panicked cpu (bnc#1012382).\n - spi: SPI_FSL_DSPI should depend on HAS_DMA (bnc#1012382).\n - spi: uapi: spidev: add missing ioctl header (bnc#1012382).\n - staging: iio: cdc: fix improper return value (bnc#1012382).\n - staging: lustre: hsm: stack overrun in hai_dump_data_field (bnc#1012382).\n - staging: lustre: llite: do not invoke direct_IO for the EOF case\n (bnc#1012382).\n - staging: lustre: ptlrpc: skip lock if export failed (bnc#1012382).\n - staging: r8712u: Fix Sparse warning in rtl871x_xmit.c (bnc#1012382).\n - staging: rtl8188eu: fix incorrect ERROR tags from logs (bnc#1012382).\n - staging: rtl8712: fixed little endian problem (bnc#1012382).\n - staging: rtl8712u: Fix endian settings for structs describing network\n packets (bnc#1012382).\n - sunrpc: Fix tracepoint storage issues with svc_recv and svc_rqst_status\n (bnc#1012382).\n - target: fix ALUA state file path truncation (bsc#1071231).\n - target: Fix node_acl demo-mode + uncached dynamic shutdown regression\n (bnc#1012382).\n - target: fix PR state file path truncation (bsc#1071231).\n - target: Fix QUEUE_FULL + SCSI task attribute handling (bnc#1012382).\n - target/iscsi: Fix iSCSI task reassignment handling (bnc#1012382).\n - target/iscsi: Fix unsolicited data seq_end_offset calculation\n (bnc#1012382).\n - tcp/dccp: fix ireq->opt races (bnc#1012382).\n - tcp/dccp: fix lockdep splat in inet_csk_route_req() (bnc#1012382).\n - tcp/dccp: fix other lockdep splats accessing ireq_opt (bnc#1012382).\n - tcp: do not mangle skb->cb[] in tcp_make_synack() (bnc#1012382).\n - tcp: fix tcp_mtu_probe() vs highest_sack (bnc#1012382).\n - test: firmware_class: report errors properly on failure (bnc#1012382).\n - timer: Prevent timer value 0 for MWAITX (bsc#1065717).\n - tipc: fix link attribute propagation bug (bnc#1012382).\n - tipc: use only positive error codes in messages (bnc#1012382).\n - tools: firmware: check for distro fallback udev cancel rule\n (bnc#1012382).\n - tracing/samples: Fix creation and deletion of simple_thread_fn creation\n (bnc#1012382).\n - tun: allow positive return values on dev_get_valid_name() call\n (bnc#1012382).\n - tun: bail out from tun_get_user() if the skb is empty (bnc#1012382).\n - tun: call dev_get_valid_name() before register_netdevice() (bnc#1012382).\n - tun/tap: sanitize TUNSETSNDBUF input (bnc#1012382).\n - uapi: fix linux/mroute6.h userspace compilation errors (bnc#1012382).\n - uapi: fix linux/rds.h userspace compilation error (bnc#1012382).\n - uapi: fix linux/rds.h userspace compilation errors (bnc#1012382).\n - udpv6: Fix the checksum computation when HW checksum does not apply\n (bnc#1012382).\n - usb: Add delay-init quirk for Corsair K70 LUX keyboards (bnc#1012382).\n - usb: cdc_acm: Add quirk for Elatec TWN3 (bnc#1012382).\n - usb: core: fix out-of-bounds access bug in usb_get_bos_descriptor()\n (bnc#1012382).\n - usb: devio: Revert "USB: devio: Do not corrupt user memory"\n (bnc#1012382).\n - usb: dummy-hcd: Fix deadlock caused by disconnect detection\n (bnc#1012382).\n - usb: gadget: composite: Fix use-after-free in\n usb_composite_overwrite_options (bnc#1012382).\n - usb: hcd: initialize hcd->flags to 0 when rm hcd (bnc#1012382).\n - usb: hub: Allow reset retry for USB2 devices on connect bounce\n (bnc#1012382).\n - usb: musb: Check for host-mode using is_host_active() on reset interrupt\n (bnc#1012382).\n - usb: musb: sunxi: Explicitly release USB PHY on exit (bnc#1012382).\n - usb: quirks: add quirk for WORLDE MINI MIDI keyboard (bnc#1012382).\n - usb: renesas_usbhs: Fix DMAC sequence for receiving zero-length packet\n (bnc#1012382).\n - usb: serial: console: fix use-after-free after failed setup\n (bnc#1012382).\n - usb: serial: cp210x: add support for ELV TFD500 (bnc#1012382).\n - usb: serial: ftdi_sio: add id for Cypress WICED dev board (bnc#1012382).\n - usb: serial: garmin_gps: fix I/O after failed probe and remove\n (bnc#1012382).\n - usb: serial: garmin_gps: fix memory leak on probe errors (bnc#1012382).\n - usb: serial: metro-usb: add MS7820 device id (bnc#1012382).\n - usb: serial: option: add support for TP-Link LTE module (bnc#1012382).\n - usb: serial: qcserial: add Dell DW5818, DW5819 (bnc#1012382).\n - usb: serial: qcserial: add pid/vid for Sierra Wireless EM7355 fw update\n (bnc#1012382).\n - usb: usbfs: compute urb->actual_length for isochronous (bnc#1012382).\n - usb: usbtest: fix NULL pointer dereference (bnc#1012382).\n - usb: xhci: Handle error condition in xhci_stop_device() (bnc#1012382).\n - vfs: expedite unmount (bsc#1024412).\n - video: fbdev: pmag-ba-fb: Remove bad `__init' annotation (bnc#1012382).\n - video: udlfb: Fix read EDID timeout (bsc#1031717).\n - vlan: fix a use-after-free in vlan_device_event() (bnc#1012382).\n - vsock: use new wait API for vsock_stream_sendmsg() (bnc#1012382).\n - vti: fix use after free in vti_tunnel_xmit/vti6_tnl_xmit (bnc#1012382).\n - watchdog: kempld: fix gcc-4.3 build (bnc#1012382).\n - workqueue: Fix NULL pointer dereference (bnc#1012382).\n - workqueue: replace pool->manager_arb mutex with a flag (bnc#1012382).\n - x86/alternatives: Fix alt_max_short macro to really be a max()\n (bnc#1012382).\n - x86/decoder: Add new TEST instruction pattern (bnc#1012382).\n - x86/MCE/AMD: Always give panic severity for UC errors in kernel context\n (git-fixes bf80bbd7dcf5).\n - x86/microcode/AMD: Add support for fam17h microcode loading\n (bsc#1068032).\n - x86/microcode/intel: Disable late loading on model 79 (bnc#1012382).\n - x86/oprofile/ppro: Do not use __this_cpu*() in preemptible context\n (bnc#1012382).\n - x86/uaccess, sched/preempt: Verify access_ok() context (bnc#1012382).\n - xen: do not print error message in case of missing Xenstore entry\n (bnc#1012382).\n - xen/events: events_fifo: Do not use {get,put}_cpu() in\n xen_evtchn_fifo_init() (bnc#1065600).\n - xen: fix booting ballooned down hvm guest (bnc#1065600).\n - xen/gntdev: avoid out of bounds access in case of partial gntdev_mmap()\n (bnc#1012382).\n - xen/manage: correct return value check on xenbus_scanf() (bnc#1012382).\n - xen-netback: fix error handling output (bnc#1065600).\n - xen: x86: mark xen_find_pt_base as __init (bnc#1065600).\n - xen: xenbus driver must not accept invalid transaction ids (bnc#1012382).\n - zd1211rw: fix NULL-deref at probe (bsc#1031717).\n\n", "edition": 1, "modified": "2017-12-18T12:08:19", "published": "2017-12-18T12:08:19", "href": "http://lists.opensuse.org/opensuse-security-announce/2017-12/msg00078.html", "id": "OPENSUSE-SU-2017:3358-1", "title": "Security update for the Linux Kernel (important)", "type": "suse", "cvss": {"score": 7.2, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-12-18T14:45:31", "bulletinFamily": "unix", "cvelist": ["CVE-2017-17450", "CVE-2017-12193", "CVE-2017-16537", "CVE-2017-15115", "CVE-2017-8824", "CVE-2017-16994", "CVE-2017-17448", "CVE-2017-16646", "CVE-2017-16536", "CVE-2017-7482", "CVE-2017-16939", "CVE-2017-1000410", "CVE-2017-17449", "CVE-2017-1000405", "CVE-2017-11600", "CVE-2017-16528", "CVE-2017-16645"], "description": "The openSUSE Leap 42.3 kernel was updated to 4.4.103 to receive various\n security and bugfixes.\n\n The following security bugs were fixed:\n\n - CVE-2017-1000405: A bug in the THP CoW support could be used by local\n attackers to corrupt memory of other processes and cause them to crash\n (bnc#1069496).\n - CVE-2017-1000410: The Linux kernel was affected by a vulnerability lies\n in the processing of incoming L2CAP commands - ConfigRequest, and\n ConfigResponse messages. This info leak is a result of uninitialized\n stack variables that may be returned to an attacker in their\n uninitialized state. (bnc#1070535).\n - CVE-2017-11600: net/xfrm/xfrm_policy.c in the Linux kernel did not\n ensure that the dir value of xfrm_userpolicy_id is XFRM_POLICY_MAX or\n less, which allowed local users to cause a denial of service\n (out-of-bounds access) or possibly have unspecified other impact via an\n XFRM_MSG_MIGRATE xfrm Netlink message (bnc#1050231).\n - CVE-2017-12193: The assoc_array_insert_into_terminal_node function in\n lib/assoc_array.c in the Linux kernel mishandled node splitting, which\n allowed local users to cause a denial of service (NULL pointer\n dereference and panic) via a crafted application, as demonstrated by the\n keyring key type, and key addition and link creation operations\n (bnc#1066192).\n - CVE-2017-15115: The sctp_do_peeloff function in net/sctp/socket.c in the\n Linux kernel did not check whether the intended netns is used in a\n peel-off action, which allowed local users to cause a denial of service\n (use-after-free and system crash) or possibly have unspecified other\n impact via crafted system calls (bnc#1068671).\n - CVE-2017-16528: sound/core/seq_device.c in the Linux kernel allowed\n local users to cause a denial of service (snd_rawmidi_dev_seq_free\n use-after-free and system crash) or possibly have unspecified other\n impact via a crafted USB device (bnc#1066629).\n - CVE-2017-16536: The cx231xx_usb_probe function in\n drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux kernel allowed\n local users to cause a denial of service (NULL pointer dereference and\n system crash) or possibly have unspecified other impact via a crafted\n USB device (bnc#1066606).\n - CVE-2017-16537: The imon_probe function in drivers/media/rc/imon.c in\n the Linux kernel allowed local users to cause a denial of service (NULL\n pointer dereference and system crash) or possibly have unspecified other\n impact via a crafted USB device (bnc#1066573).\n - CVE-2017-16645: The ims_pcu_get_cdc_union_desc function in\n drivers/input/misc/ims-pcu.c in the Linux kernel allowed local users to\n cause a denial of service (ims_pcu_parse_cdc_data out-of-bounds read and\n system crash) or possibly have unspecified other impact via a crafted\n USB device (bnc#1067132).\n - CVE-2017-16646: drivers/media/usb/dvb-usb/dib0700_devices.c in the Linux\n kernel allowed local users to cause a denial of service (BUG and system\n crash) or possibly have unspecified other impact via a crafted USB\n device (bnc#1067105).\n - CVE-2017-16939: The XFRM dump policy implementation in\n net/xfrm/xfrm_user.c in the Linux kernel allowed local users to gain\n privileges or cause a denial of service (use-after-free) via a crafted\n SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY\n Netlink messages (bnc#1069702).\n - CVE-2017-16994: The walk_hugetlb_range function in mm/pagewalk.c in the\n Linux kernel mishandled holes in hugetlb ranges, which allowed local\n users to obtain sensitive information from uninitialized kernel memory\n via crafted use of the mincore() system call (bnc#1069996).\n - CVE-2017-17448: net/netfilter/nfnetlink_cthelper.c in the Linux kernel\n did not require the CAP_NET_ADMIN capability for new, get, and del\n operations, which allowed local users to bypass intended access\n restrictions because the nfnl_cthelper_list data structure is shared\n across all net namespaces (bnc#1071693).\n - CVE-2017-17449: The __netlink_deliver_tap_skb function in\n net/netlink/af_netlink.c in the Linux kernel did not restrict\n observations of Netlink messages to a single net namespace, which\n allowed local users to obtain sensitive information by leveraging the\n CAP_NET_ADMIN capability to sniff an nlmon interface for all Netlink\n activity on the system (bnc#1071694).\n - CVE-2017-17450: net/netfilter/xt_osf.c in the Linux kernel did not\n require the CAP_NET_ADMIN capability for add_callback and\n remove_callback operations, which allowed local users to bypass intended\n access restrictions because the xt_osf_fingers data structure is shared\n across all net namespaces (bnc#1071695).\n - CVE-2017-7482: Fixed an overflow when decoding a krb5 principal.\n (bnc#1046107).\n - CVE-2017-8824: The dccp_disconnect function in net/dccp/proto.c in the\n Linux kernel allowed local users to gain privileges or cause a denial of\n service (use-after-free) via an AF_UNSPEC connect system call during the\n DCCP_LISTEN state (bnc#1070771).\n\n The following non-security bugs were fixed:\n\n - acpi / apd: Add clock frequency for ThunderX2 I2C controller\n (bsc#1067225).\n - Add references (bsc#1062941, bsc#1037404, bsc#1012523, bsc#1038299) The\n scsi_devinfo patches are relevant for all bugs related to HITACHI OPEN-V.\n - adm80211: return an error if adm8211_alloc_rings() fails (bsc#1031717).\n - adv7604: Initialize drive strength to default when using DT\n (bnc#1012382).\n - af_netlink: ensure that NLMSG_DONE never fails in dumps (bnc#1012382).\n - alsa: caiaq: Fix stray URB at probe error path (bnc#1012382).\n - alsa: hda: Abort capability probe at invalid register read (bsc#1048356).\n - alsa: hda: Add Raven PCI ID (bnc#1012382).\n - alsa: hda - Apply ALC269_FIXUP_NO_SHUTUP on HDA_FIXUP_ACT_PROBE\n (bnc#1012382).\n - alsa: hda/ca0132 - Fix memory leak at error path (bsc#1031717).\n - alsa: hda - fix headset mic problem for Dell machines with alc236\n (bnc#1012382).\n - alsa: hda - No loopback on ALC299 codec (git-fixes).\n - alsa: hda/realtek: Add headset mic support for Intel NUC Skull Canyon\n (bsc#1031717).\n - alsa: hda/realtek - Add new codec ID ALC299 (bnc#1012382).\n - alsa: hda/realtek - Add support for ALC236/ALC3204 (bnc#1012382).\n - alsa: hda/realtek - Fix ALC700 family no sound issue (bsc#1031717).\n - alsa: hda: Remove superfluous '-' added by printk conversion\n (bnc#1012382).\n - alsa: hda: Workaround for KBL codec power control\n (bsc#1048356,bsc#1047989,bsc#1055272,bsc#1058413).\n - alsa: line6: Fix leftover URB at error-path during probe (bnc#1012382).\n - alsa: pcm: update tstamp only if audio_tstamp changed (bsc#1031717).\n - alsa: seq: Avoid invalid lockdep class warning (bsc#1031717).\n - alsa: seq: Enable 'use' locking in all configurations (bnc#1012382).\n - alsa: seq: Fix copy_from_user() call inside lock (bnc#1012382).\n - alsa: seq: Fix nested rwsem annotation for lockdep splat (bnc#1012382).\n - alsa: seq: Fix OSS sysex delivery in OSS emulation (bnc#1012382).\n - alsa: timer: Add missing mutex lock for compat ioctls (bnc#1012382).\n - alsa: timer: Remove kernel warning at compat ioctl error paths\n (bsc#1031717).\n - alsa: usb-audio: Add native DSD support for Pro-Ject Pre Box S2 Digital\n (bnc#1012382).\n - alsa: usb-audio: Add sanity checks in v2 clock parsers (bsc#1031717).\n - alsa: usb-audio: Add sanity checks to FE parser (bsc#1031717).\n - alsa: usb-audio: Fix potential out-of-bound access at parsing SU\n (bsc#1031717).\n - alsa: usb-audio: Kill stray URB at exiting (bnc#1012382).\n - alsa: usb-audio: uac1: Invalidate ctl on interrupt (bsc#1031717).\n - alsa: vx: Do not try to update capture stream before running\n (bnc#1012382).\n - alsa: vx: Fix possible transfer overflow (bnc#1012382).\n - Apply generic ppc build fixes to vanilla (bsc#1070805)\n - arm64: dts: NS2: reserve memory for Nitro firmware (bnc#1012382).\n - arm64: ensure __dump_instr() checks addr_limit (bnc#1012382).\n - arm: 8715/1: add a private asm/unaligned.h (bnc#1012382).\n - arm: 8720/1: ensure dump_instr() checks addr_limit (bnc#1012382).\n - arm: 8721/1: mm: dump: check hardware RO bit for LPAE (bnc#1012382).\n - arm: 8722/1: mm: make STRICT_KERNEL_RWX effective for LPAE (bnc#1012382).\n - arm: crypto: reduce priority of bit-sliced AES cipher (bnc#1012382).\n - arm: dts: Fix am335x and dm814x scm syscon to probe children\n (bnc#1012382).\n - arm: dts: Fix compatible for ti81xx uarts for 8250 (bnc#1012382).\n - arm: dts: Fix omap3 off mode pull defines (bnc#1012382).\n - arm: dts: mvebu: pl310-cache disable double-linefill (bnc#1012382).\n - arm: OMAP2+: Fix init for multiple quirks for the same SoC (bnc#1012382).\n - arm: omap2plus_defconfig: Fix probe errors on UARTs 5 and 6\n (bnc#1012382).\n - arm: pxa: Do not rely on public mmc header to include leds.h\n (bnc#1012382).\n - asm/sections: add helpers to check for section data (bsc#1063026).\n - asoc: adau17x1: Workaround for noise bug in ADC (bnc#1012382).\n - asoc: cs42l56: Fix reset GPIO name in example DT binding (bsc#1031717).\n - asoc: davinci-mcasp: Fix an error handling path in\n 'davinci_mcasp_probe()' (bsc#1031717).\n - ASoC: rsnd: do not double free kctrl (bnc#1012382).\n - asoc: samsung: Fix possible double iounmap on s3c24xx driver probe\n failure (bsc#1031717).\n - ASoC: wm_adsp: Do not overrun firmware file buffer when reading region\n data (bnc#1012382).\n - ata: ATA_BMDMA should depend on HAS_DMA (bnc#1012382).\n - ata: fixes kernel crash while tracing ata_eh_link_autopsy event\n (bnc#1012382).\n - ata: SATA_HIGHBANK should depend on HAS_DMA (bnc#1012382).\n - ata: SATA_MV should depend on HAS_DMA (bnc#1012382).\n - ath10k: convert warning about non-existent OTP board id to debug message\n (git-fixes).\n - ath10k: fix a warning during channel switch with multiple vaps\n (bsc#1031717).\n - ath10k: fix board data fetch error message (bsc#1031717).\n - ath10k: fix diag_read to collect data for larger memory (bsc#1031717).\n - ath10k: fix incorrect txpower set by P2P_DEVICE interface (bnc#1012382).\n - ath10k: fix potential memory leak in ath10k_wmi_tlv_op_pull_fw_stats()\n (bnc#1012382).\n - ath10k: free cached fw bin contents when get board id fails\n (bsc#1031717).\n - ath10k: ignore configuring the incorrect board_id (bnc#1012382).\n - ath10k: set CTS protection VDEV param only if VDEV is up (bnc#1012382).\n - ath9k_htc: check for underflow in ath9k_htc_rx_msg() (bsc#1031717).\n - ath9k: off by one in ath9k_hw_nvram_read_array() (bsc#1031717).\n - autofs: do not fail mount for transient error (bsc#1065180).\n - backlight: adp5520: Fix error handling in adp5520_bl_probe()\n (bnc#1012382).\n - backlight: lcd: Fix race condition during register (bnc#1012382).\n - bcache: check ca->alloc_thread initialized before wake up it\n (bnc#1012382).\n - bio-integrity: bio_integrity_advance must update integrity seed\n (bsc#1046054).\n - bio-integrity: bio_trim should truncate integrity vector accordingly\n (bsc#1046054).\n - bio-integrity: Do not allocate integrity context for bio w/o data\n (bsc#1046054).\n - bio-integrity: fix interface for bio_integrity_trim (bsc#1046054).\n - bio: partially revert 'fix interface for bio_integrity_trim'\n (bsc#1046054).\n - blacklist 85e3f1adcb9d powerpc/64s/radix: Fix 128TB-512TB virtual\n address boundary case allocation\n - blacklist arm64 kaslr fix for 16KB pages\n - blacklist.conf\n - blacklist.conf: add 79b63f12abcbbd2caf7064b294af648a87de07ff #\n bsc#1061756 may break existing setups\n - blacklist.conf: Add ath10k, mmc and rtl8192u commits (bsc#1031717)\n - blacklist.conf: Add drm/i915 blacklist (bsc#1031717)\n - blacklist.conf: added misc commits (bsc#1031717)\n - blacklist.conf: Add misc entries (bsc#1031717)\n - blacklist.conf: Add non-applicable commit ID (bsc#1066812)\n - blacklist.conf: Add non-applicable commits (bsc#1066812)\n - blacklist.conf: add test_kmod blacklist CONFIG_TEST_KMOD=n is currently\n set. When and if we enable it then we will need it, otherwise we do not.\n - blacklist.conf: add two more\n - blacklist.conf: blacklist 0fafdc9f888b\n - blacklist.conf: blacklist 4c578dce5803\n - blacklist.conf: blacklisted 16af97dc5a89 (bnc#1053919)\n - blacklist.conf: Blacklist two commits (bbb3be170ac2 and ccf1e0045eea).\n - blacklist.conf: commit fe22cd9b7c980b8b948 ("printk: help pr_debug and\n pr_devel to optimize out arguments") is just a cosmetic change.\n - blacklist.conf: ignore a broken USB-audio patch\n - blacklist.conf: Update blacklist (bsc#1031717)\n - blacklist.conf: Update iwlwifi blacklist (bsc#1031717)\n - blacklist.conf: yet another serial entry (bsc#1031717)\n - blacklist irrelevant powerpc fixes 6b8cb66a6a7c powerpc: Fix usage of\n _PAGE_RO in hugepage Only relevant on ppc CPUs that have non-zero\n _PAGE_RO a050d20d024d powerpc/64s: Use relon prolog for\n EXC_VIRT_OOL_MASKABLE_HV handlers IPI optimization, hard to backport\n fb479e44a9e2 powerpc/64s: relocation, register save fixes for system\n reset interrupt Fixes PowerNV running relocated. Nobody missed it so\n far. e76ca27790a5 powerpc/sysfs: Fix reference leak of cpu device_nodes\n present at boot Fixes leak of few kobjects created at boot but high risk\n of regression\n - blacklist tpm endian annotation patches.\n - block: Fix a race between blk_cleanup_queue() and timeout handling\n (FATE#319965, bsc#964944).\n - block: Make q_usage_counter also track legacy requests (bsc#1057820).\n - bluetooth: btusb: fix QCA Rome suspend/resume (bnc#1012382).\n - bnxt_en: Do not use rtnl lock to protect link change logic in workqueue\n (bsc#1020412 FATE#321671).\n - bnxt_en: Fix a variable scoping in bnxt_hwrm_do_send_msg() (bsc#1053309).\n - bnxt_en: Fix possible corrupted NVRAM parameters from firmware response\n (bsc#1020412 FATE#321671).\n - bnxt_en: Fix possible corruption in DCB parameters from firmware\n (bsc#1020412 FATE#321671).\n - bnxt_en: Fix VF PCIe link speed and width logic (bsc#1020412\n FATE#321671).\n - bnxt_en: Need to unconditionally shut down RoCE in bnxt_shutdown\n (bsc#1053309).\n - bnxt_re: Make room for mapping beyond 32 entries (bsc#1056596).\n - bonding: discard lowest hash bit for 802.3ad layer3+4 (bnc#1012382).\n - bpf: one perf event close won't free bpf program attached by another\n perf event (bnc#1012382).\n - bpf/verifier: reject BPF_ALU64|BPF_END (bnc#1012382).\n - brcmfmac: add length check in brcmf_cfg80211_escan_handler()\n (bnc#1012382).\n - brcmfmac: remove setting IBSS mode when stopping AP (bnc#1012382).\n - brcmsmac: make some local variables 'static const' to reduce stack size\n (bnc#1012382).\n - bt8xx: fix memory leak (bnc#1012382).\n - btrfs: return the actual error value from from btrfs_uuid_tree_iterate\n (bnc#1012382).\n - bus: mbus: fix window size calculation for 4GB windows (bnc#1012382).\n - can: c_can: do not indicate triple sampling support for D_CAN\n (bnc#1012382).\n - can: esd_usb2: Fix can_dlc value for received RTR, frames (bnc#1012382).\n - can: gs_usb: fix busy loop if no more TX context is available\n (bnc#1012382).\n - can: kvaser_usb: Correct return value in printout (bnc#1012382).\n - can: kvaser_usb: Ignore CMD_FLUSH_QUEUE_REPLY messages (bnc#1012382).\n - can: sun4i: fix loopback mode (bnc#1012382).\n - can: sun4i: handle overrun in RX FIFO (bnc#1012382).\n - cdc_ncm: Set NTB format again after altsetting switch for Huawei devices\n (bnc#1012382).\n - ceph: clean up unsafe d_parent accesses in build_dentry_path\n (FATE#322288 bnc#1012382).\n - ceph: disable cached readdir after dropping positive dentry\n (bsc#1069277).\n - ceph: -EINVAL on decoding failure in ceph_mdsc_handle_fsmap()\n (bsc#1069277).\n - ceph: present consistent fsid, regardless of arch endianness\n (bsc#1069277).\n - ceph: unlock dangling spinlock in try_flush_caps() (bsc#1065639).\n - cgroup, net_cls: iterate the fds of only the tasks which are being\n migrated (bnc#1064926).\n - cifs: check MaxPathNameComponentLength != 0 before using it\n (bnc#1012382).\n - cifs: fix circular locking dependency (bsc#1064701).\n - cifs: Reconnect expired SMB sessions (bnc#1012382).\n - clk: ti: dra7-atl-clock: fix child-node lookups (bnc#1012382).\n - clk: ti: dra7-atl-clock: Fix of_node reference counting (bnc#1012382).\n - clockevents/drivers/cs5535: Improve resilience to spurious interrupts\n (bnc#1012382).\n - cma: fix calculation of aligned offset (VM Functionality, bsc#1050060).\n - coda: fix 'kernel memory exposure attempt' in fsync (bnc#1012382).\n - cpufreq: CPPC: add ACPI_PROCESSOR dependency (bnc#1012382).\n - crypto: dh - Do not permit 'key' or 'g' size longer than 'p'\n (bsc#1048317).\n - crypto: dh - Do not permit 'p' to be 0 (bsc#1048317).\n - crypto: dh - Fix double free of ctx->p (bsc#1048317).\n - crypto: dh - fix memleak in setkey (bsc#1048317).\n - crypto: rsa - fix buffer overread when stripping leading zeroes\n (bsc#1048317).\n - crypto: shash - Fix zero-length shash ahash digest crash (bnc#1012382).\n - crypto: vmx - disable preemption to enable vsx in aes_ctr.c\n (bnc#1012382).\n - crypto: x86/sha1-mb - fix panic due to unaligned access (bnc#1012382).\n - crypto: xts - Add ECB dependency (bnc#1012382).\n - cx231xx: Fix I2C on Internal Master 3 Bus (bnc#1012382).\n - cxgb4: Fix error codes in c4iw_create_cq() (bsc#1048327).\n - cxl: Fix DAR check & use REGION_ID instead of opencoding (bsc#1066223).\n - cxl: Fix leaking pid refs in some error paths (bsc#1066223).\n - cxl: Force context lock during EEH flow (bsc#1066223).\n - cxl: Prevent adapter reset if an active context exists (bsc#1066223).\n - cxl: Route eeh events to all drivers in cxl_pci_error_detected()\n (bsc#1066223).\n - direct-io: Prevent NULL pointer access in submit_page_section\n (bnc#1012382).\n - Disable\n patches.kernel.org/4.4.93-022-fix-unbalanced-page-refcounting-in-bio_map_us\n e.patch (bsc#1070767)\n - dmaengine: dmatest: warn user when dma test times out (bnc#1012382).\n - dmaengine: edma: Align the memcpy acnt array size with the transfer\n (bnc#1012382).\n - dmaengine: zx: set DMA_CYCLIC cap_mask bit (bnc#1012382).\n - dm bufio: fix integer overflow when limiting maximum cache size\n (bnc#1012382).\n - dm: fix race between dm_get_from_kobject() and __dm_destroy()\n (bnc#1012382).\n - dm mpath: remove annoying message of 'blk_get_request() returned -11'\n (bsc#1066812).\n - dm raid: fix NULL pointer dereference for raid1 without bitmap\n (bsc#1042957, FATE#321488).\n - dm rq: Avoid that request processing stalls sporadically (bsc#1042978).\n - drivers: base: cacheinfo: fix x86 with CONFIG_OF enabled (bsc#1070001).\n - drivers: dma-mapping: Do not leave an invalid area->pages pointer in\n dma_common_contiguous_remap() (Git-fixes, bsc#1065692).\n - drivers/fbdev/efifb: Allow BAR to be moved instead of claiming it\n (bsc#1051987).\n - drivers: of: Fix of_pci.h header guard (bsc#1065959).\n - drm/amdgpu: when dpm disabled, also need to stop/start vce (bnc#1012382).\n - drm/amdkfd: NULL dereference involving create_process() (bsc#1031717).\n - drm: Apply range restriction after color adjustment when allocation\n (bnc#1012382).\n - drm/armada: Fix compile fail (bnc#1012382).\n - drm: drm_minor_register(): Clean up debugfs on failure (bnc#1012382).\n - drm: gma500: fix logic error (bsc#1031717).\n - drm/i915/bxt: set min brightness from VBT (bsc#1031717).\n - drm/i915: Do not try indexed reads to alternate slave addresses\n (bsc#1031717).\n - drm/i915: fix backlight invert for non-zero minimum brightness\n (bsc#1031717).\n - drm/i915: Prevent zero length "index" write (bsc#1031717).\n - drm/i915: Read timings from the correct transcoder in\n intel_crtc_mode_get() (bsc#1031717).\n - drm/msm: fix an integer overflow test (bnc#1012382).\n - drm/msm: Fix potential buffer overflow issue (bnc#1012382).\n - drm/nouveau/bsp/g92: disable by default (bnc#1012382).\n - drm/nouveau/gr: fallback to legacy paths during firmware lookup\n (bsc#1031717).\n - drm/nouveau/mmu: flush tlbs before deleting page tables (bnc#1012382).\n - drm/omap: Fix error handling path in 'omap_dmm_probe()' (bsc#1031717).\n - drm/panel: simple: Add missing panel_simple_unprepare() calls\n (bsc#1031717).\n - drm/radeon: Avoid double gpu reset by adding a timeout on IB ring tests\n (bsc#1066175).\n - drm/sti: sti_vtg: Handle return NULL error from devm_ioremap_nocache\n (bnc#1012382).\n - drm/vc4: Fix leak of HDMI EDID (bsc#1031717).\n - drm/vmwgfx: Fix Ubuntu 17.10 Wayland black screen issue (bnc#1012382).\n - e1000e: Avoid receiver overrun interrupt bursts (bsc#969470 FATE#319819).\n - e1000e: Fix error path in link detection (bnc#1012382).\n - e1000e: Fix return value test (bnc#1012382).\n - e1000e: Separate signaling for link check/link up (bnc#1012382).\n - ecryptfs: fix dereference of NULL user_key_payload (bnc#1012382).\n - eCryptfs: use after free in ecryptfs_release_messaging() (bsc#1070404).\n - epoll: avoid calling ep_call_nested() from ep_poll_safewake()\n (bsc#1056427).\n - epoll: remove ep_call_nested() from ep_eventpoll_poll() (bsc#1056427).\n - ext4: cleanup goto next group (bsc#1066285).\n - ext4: do not use stripe_width if it is not set (bnc#1012382).\n - ext4: fix fault handling when mounted with -o dax,ro (bsc#1069484).\n - ext4: fix interaction between i_size, fallocate, and delalloc after a\n crash (bnc#1012382).\n - ext4: fix stripe-unaligned allocations (bnc#1012382).\n - ext4: in ext4_seek_{hole,data}, return -ENXIO for negative offsets\n (bnc#1012382).\n - ext4: prevent data corruption with inline data + DAX (bsc#1064591).\n - ext4: prevent data corruption with journaling + DAX (bsc#1064591).\n - ext4: reduce lock contention in __ext4_new_inode (bsc#1066285).\n - extcon: palmas: Check the parent instance to prevent the NULL\n (bnc#1012382).\n - exynos4-is: fimc-is: Unmap region obtained by of_iomap() (bnc#1012382).\n - f2fs crypto: add missing locking for keyring_key access (bnc#1012382).\n - f2fs crypto: replace some BUG_ON()'s with error checks (bnc#1012382).\n - f2fs: do not wait for writeback in write_begin (bnc#1012382).\n - fealnx: Fix building error on MIPS (bnc#1012382).\n - fix a page leak in vhost_scsi_iov_to_sgl() error recovery (bnc#1012382).\n - fix unbalanced page refcounting in bio_map_user_iov (bnc#1012382).\n - fm10k: Use smp_rmb rather than read_barrier_depends (bnc#1012382).\n - fs/9p: Compare qid.path in v9fs_test_inode (bsc#1070404).\n - FS-Cache: fix dereference of NULL user_key_payload (bnc#1012382).\n - fscrypt: fix dereference of NULL user_key_payload (bnc#1012382).\n - fscrypt: lock mutex before checking for bounce page pool (bnc#1012382).\n - fscrypto: require write access to mount to set encryption policy\n (bnc#1012382).\n - fuse: fix READDIRPLUS skipping an entry (bnc#1012382).\n - gpu: drm: mgag200: mgag200_main:- Handle error from pci_iomap\n (bnc#1012382).\n - hid: elo: clear BTN_LEFT mapping (bsc#1065866).\n - hid: usbhid: fix out-of-bounds bug (bnc#1012382).\n - hsi: ssi_protocol: double free in ssip_pn_xmit() (bsc#1031717).\n - hwmon: (xgene) Fix up error handling path mixup in 'xgene_hwmon_probe()'\n (bsc#).\n - i2c: at91: ensure state is restored after suspending (bnc#1012382).\n - i2c: bcm2835: Add support for dynamic clock (bsc#1066660).\n - i2c: bcm2835: Add support for Repeated Start Condition (bsc#1066660).\n - i2c: bcm2835: Avoid possible NULL ptr dereference (bsc#1066660).\n - i2c: bcm2835: Can't support I2C_M_IGNORE_NAK (bsc#1066660).\n - i2c: bcm2835: Do not complain on -EPROBE_DEFER from getting our clock\n (bsc#1066660).\n - i2c: bcm2835: Fix hang for writing messages larger than 16 bytes\n (bsc#1066660).\n - i2c: bcm2835: Protect against unexpected TXW/RXR interrupts\n (bsc#1066660).\n - i2c: bcm2835: Support i2c-dev ioctl I2C_TIMEOUT (bsc#1066660).\n - i2c: bcm2835: Use dev_dbg logging on transfer errors (bsc#1066660).\n - i2c: cadance: fix ctrl/addr reg write order (bsc#1031717).\n - i2c: imx: Use correct function to write to register (bsc#1031717).\n - i2c: ismt: Separate I2C block read from SMBus block read (bnc#1012382).\n - i2c: riic: correctly finish transfers (bnc#1012382).\n - i2c: riic: fix restart condition (git-fixes).\n - i2c: xlp9xx: Enable HWMON class probing for xlp9xx (bsc#1067225).\n - i2c: xlp9xx: Get clock frequency with clk API (bsc#1067225).\n - i2c: xlp9xx: Handle I2C_M_RECV_LEN in msg->flags (bsc#1067225).\n - i40e: Fix incorrect use of tx_itr_setting when checking for Rx ITR setup\n (bsc#1024346 FATE#321239 bsc#1024373 FATE#321247).\n - i40e: fix the calculation of VFs mac addresses (bsc#1024346 FATE#321239\n bsc#1024373 FATE#321247).\n - i40e: only redistribute MSI-X vectors when needed (bsc#1024346\n FATE#321239 bsc#1024373 FATE#321247).\n - i40e: Use smp_rmb rather than read_barrier_depends (bnc#1012382).\n - i40evf: Use smp_rmb rather than read_barrier_depends (bnc#1012382).\n - i40iw: Remove UDA QP from QoS list if creation fails (bsc#1024376\n FATE#321249).\n - ib/core: Fix calculation of maximum RoCE MTU (bsc#1022595 FATE#322350).\n - ib/core: Fix unable to change lifespan entry for hw_counters\n (FATE#321231 FATE#321473).\n - ib/core: Namespace is mandatory input for address resolution\n (bsc#1022595 FATE#322350).\n - ib/hfi1: Add MODULE_FIRMWARE statements (bsc#1036800).\n - ib/ipoib: Clean error paths in add port (bsc#1022595 FATE#322350).\n - ib/ipoib: Prevent setting negative values to max_nonsrq_conn_qp\n (bsc#1022595 FATE#322350).\n - ib/ipoib: Remove double pointer assigning (bsc#1022595 FATE#322350).\n - ib/ipoib: Set IPOIB_NEIGH_TBL_FLUSH after flushed completion\n initialization (bsc#1022595 FATE#322350).\n - ib/mlx5: Fix RoCE Address Path fields (bsc#966170 FATE#320225 bsc#966172\n FATE#320226).\n - ibmvnic: Add netdev_dbg output for debugging (fate#323285).\n - ibmvnic: Add vnic client data to login buffer (bsc#1069942).\n - ibmvnic: Convert vnic server reported statistics to cpu endian\n (fate#323285).\n - ibmvnic: Enable scatter-gather support (bsc#1066382).\n - ibmvnic: Enable TSO support (bsc#1066382).\n - ibmvnic: Feature implementation of Vital Product Data (VPD) for the\n ibmvnic driver (bsc#1069942).\n - ibmvnic: Fix calculation of number of TX header descriptors\n (bsc#1066382).\n - ibmvnic: fix dma_mapping_error call (bsc#1069942).\n - ibmvnic: Fix failover error path for non-fatal resets (bsc#1066382).\n - ibmvnic: Implement .get_channels (fate#323285).\n - ibmvnic: Implement .get_ringparam (fate#323285).\n - ibmvnic: Implement per-queue statistics reporting (fate#323285).\n - ibmvnic: Let users change net device features (bsc#1066382).\n - ibmvnic: Update reset infrastructure to support tunable parameters\n (bsc#1066382).\n - ib/rxe: check for allocation failure on elem (FATE#322149).\n - ib/rxe: do not crash, if allocation of crc algorithm failed\n (bsc#1051635).\n - ib/rxe: put the pool on allocation failure (FATE#322149).\n - ib/srp: Avoid that a cable pull can trigger a kernel crash (bsc#1022595\n FATE#322350).\n - ib/srpt: Do not accept invalid initiator port names (bnc#1012382).\n - ib/uverbs: Fix device cleanup (bsc#1022595 FATE#322350).\n - ib/uverbs: Fix NULL pointer dereference during device removal\n (bsc#1022595 FATE#322350).\n - igb: close/suspend race in netif_device_detach (bnc#1012382).\n - igb: Fix hw_dbg logging in igb_update_flash_i210 (bnc#1012382).\n - igb: reset the PHY before reading the PHY ID (bnc#1012382).\n - igb: Use smp_rmb rather than read_barrier_depends (bnc#1012382).\n - igbvf: Use smp_rmb rather than read_barrier_depends (bnc#1012382).\n - iio: adc: xilinx: Fix error handling (bnc#1012382).\n - iio: dummy: events: Add missing break (bsc#1031717).\n - iio: light: fix improper return value (bnc#1012382).\n - iio: trigger: free trigger resource correctly (bnc#1012382).\n - ima: do not update security.ima if appraisal status is not\n INTEGRITY_PASS (bnc#1012382).\n - input: ar1021_i2c - fix too long name in driver's device table\n (bsc#1031717).\n - input: edt-ft5x06 - fix setting gain, offset, and threshold via device\n tree (bsc#1031717).\n - input: elan_i2c - add ELAN060C to the ACPI table (bnc#1012382).\n - input: elan_i2c - add ELAN0611 to the ACPI table (bnc#1012382).\n - input: gtco - fix potential out-of-bound access (bnc#1012382).\n - input: mpr121 - handle multiple bits change of status register\n (bnc#1012382).\n - input: mpr121 - set missing event capability (bnc#1012382).\n - input: ti_am335x_tsc - fix incorrect step config for 5 wire touchscreen\n (bsc#1031717).\n - input: twl4030-pwrbutton - use correct device for irq request\n (bsc#1031717).\n - input: ucb1400_ts - fix suspend and resume handling (bsc#1031717).\n - input: uinput - avoid crash when sending FF request to device going away\n (bsc#1031717).\n - iommu/amd: Finish TLB flush in amd_iommu_unmap() (bnc#1012382).\n - iommu/vt-d: Do not register bus-notifier under dmar_global_lock\n (bsc#1069793).\n - ip6_gre: only increase err_count for some certain type icmpv6 in\n ip6gre_err (bnc#1012382).\n - ip6_gre: skb_push ipv6hdr before packing the header in ip6gre_header\n (bnc#1012382).\n - ipip: only increase err_count for some certain type icmp in ipip_err\n (bnc#1012382).\n - ipmi: fix unsigned long underflow (bnc#1012382).\n - ipmi: Pick up slave address from SMBIOS on an ACPI device (bsc#1070006).\n - ipmi: Prefer ACPI system interfaces over SMBIOS ones (bsc#1070006).\n - ipmi_si: Clean up printks (bsc#1070006).\n - ipmi_si: fix memory leak on new_smi (bsc#1070006).\n - ipsec: do not ignore crypto err in ah4 input (bnc#1012382).\n - ipv6: flowlabel: do not leave opt->tot_len with garbage (bnc#1012382).\n - ipv6: only call ip6_route_dev_notify() once for NETDEV_UNREGISTER\n (bnc#1012382).\n - ipvs: make drop_entry protection effective for SIP-pe (bsc#1056365).\n - irqchip/crossbar: Fix incorrect type of local variables (bnc#1012382).\n - isa: Prevent NULL dereference in isa_bus driver callbacks (bsc#1031717).\n - iscsi-target: Fix non-immediate TMR reference leak (bnc#1012382).\n - isdn/i4l: fetch the ppp_write buffer in one shot (bnc#1012382).\n - isofs: fix timestamps beyond 2027 (bnc#1012382).\n - iwlwifi: mvm: fix the coex firmware API (bsc#1031717).\n - iwlwifi: mvm: return -ENODATA when reading the temperature with the FW\n down (bsc#1031717).\n - iwlwifi: mvm: set the RTS_MIMO_PROT bit in flag mask when sending sta to\n fw (bsc#1031717).\n - iwlwifi: mvm: use IWL_HCMD_NOCOPY for MCAST_FILTER_CMD (bnc#1012382).\n - iwlwifi: split the regulatory rules when the bandwidth flags require it\n (bsc#1031717).\n - ixgbe: add mask for 64 RSS queues (bnc#1012382).\n - ixgbe: do not disable FEC from the driver (bnc#1012382).\n - ixgbe: fix AER error handling (bnc#1012382).\n - ixgbe: Fix skb list corruption on Power systems (bnc#1012382).\n - ixgbe: handle close/suspend race with netif_device_detach/present\n (bnc#1012382).\n - ixgbe: Reduce I2C retry count on X550 devices (bnc#1012382).\n - ixgbevf: Use smp_rmb rather than read_barrier_depends (bnc#1012382).\n - kABI fix for 4.4.99 net changes (stable-4.4.99).\n - kABI: protect struct l2tp_tunnel (kabi).\n - kABI: protect struct regulator_dev (kabi).\n - kABI: protect structs rt_rq+root_domain (kabi).\n - kABI: protect typedef rds_rdma_cookie_t (kabi).\n - kabi/severities: Ignore drivers/nvme/target (bsc#1063349)\n - kabi/severities: Ignore kABI changes for qla2xxx (bsc#1043017)\n - kernel-docs: unpack the source instead of using kernel-source\n (bsc#1057199).\n - kernel/sysctl_binary.c: check name array length in\n deprecated_sysctl_warning() (FATE#323821).\n - kernel/sysctl.c: remove duplicate UINT_MAX check on\n do_proc_douintvec_conv() (bsc#1066470).\n - kernel/watchdog: Prevent false positives with turbo modes (bnc#1063516).\n - keys: do not let add_key() update an uninstantiated key (bnc#1012382).\n - keys: do not revoke uninstantiated key in request_key_auth_new()\n (bsc#1031717).\n - keys: encrypted: fix dereference of NULL user_key_payload (bnc#1012382).\n - keys: fix cred refcount leak in request_key_auth_new() (bsc#1031717).\n - keys: fix key refcount leak in keyctl_assume_authority() (bsc#1031717).\n - keys: fix key refcount leak in keyctl_read_key() (bsc#1031717).\n - keys: fix NULL pointer dereference during ASN.1 parsing [ver #2]\n (bnc#1012382).\n - keys: fix out-of-bounds read during ASN.1 parsing (bnc#1012382).\n - keys: Fix race between updating and finding a negative key (bnc#1012382).\n - keys: return full count in keyring_read() if buffer is too small\n (bnc#1012382).\n - keys: trusted: fix writing past end of buffer in trusted_read()\n (bnc#1012382).\n - keys: trusted: sanitize all key material (bnc#1012382).\n - KVM: nVMX: fix guest CR4 loading when emulating L2 to L1 exit\n (bnc#1012382).\n - kvm: nVMX: set IDTR and GDTR limits when loading L1 host state\n (bnc#1012382).\n - KVM: PPC: Book 3S: XICS: correct the real mode ICP rejecting counter\n (bnc#1012382).\n - kvm: SVM: obey guest PAT (bnc#1012382).\n - l2tp: Avoid schedule while atomic in exit_net (bnc#1012382).\n - l2tp: check ps->sock before running pppol2tp_session_ioctl()\n (bnc#1012382).\n - l2tp: fix race condition in l2tp_tunnel_delete (bnc#1012382).\n - libceph: do not WARN() if user tries to add invalid key (bsc#1069277).\n - lib/digsig: fix dereference of NULL user_key_payload (bnc#1012382).\n - libertas: Fix lbs_prb_rsp_limit_set() (bsc#1031717).\n - lib/mpi: call cond_resched() from mpi_powm() loop (bnc#1012382).\n - libnvdimm, namespace: fix label initialization to use valid seq numbers\n (bnc#1012382).\n - libnvdimm, namespace: make 'resource' attribute only readable by root\n (bnc#1012382).\n - libnvdimm, pfn: make 'resource' attribute only readable by root\n (FATE#319858).\n - lib/ratelimit.c: use deferred printk() version (bsc#979928).\n - locking/lockdep: Add nest_lock integrity test (bnc#1012382).\n - lpfc: tie in to new dev_loss_tmo interface in nvme transport\n (bsc#1041873).\n - mac80211: agg-tx: call drv_wake_tx_queue in proper context (bsc#1031717).\n - mac80211: do not compare TKIP TX MIC key in reinstall prevention\n (bsc#1066472).\n - mac80211: do not send SMPS action frame in AP mode when not needed\n (bsc#1031717).\n - mac80211: Fix addition of mesh configuration element (git-fixes).\n - mac80211: Fix BW upgrade for TDLS peers (bsc#1031717).\n - mac80211: fix mgmt-tx abort cookie and leak (bsc#1031717).\n - mac80211: fix power saving clients handling in iwlwifi (bnc#1012382).\n - mac80211_hwsim: check HWSIM_ATTR_RADIO_NAME length (bnc#1012382).\n - mac80211_hwsim: Fix memory leak in hwsim_new_radio_nl() (bsc#1031717).\n - mac80211: Remove invalid flag operations in mesh TSF synchronization\n (bnc#1012382).\n - mac80211: Remove unused 'beaconint_us' variable (bsc#1031717).\n - mac80211: Remove unused 'i' variable (bsc#1031717).\n - mac80211: Remove unused 'len' variable (bsc#1031717).\n - mac80211: Remove unused 'rates_idx' variable (bsc#1031717).\n - mac80211: Remove unused 'sband' and 'local' variables (bsc#1031717).\n - mac80211: Remove unused 'struct ieee80211_rx_status' ptr (bsc#1031717).\n - mac80211: Suppress NEW_PEER_CANDIDATE event if no room (bnc#1012382).\n - mac80211: TDLS: always downgrade invalid chandefs (bsc#1031717).\n - mac80211: TDLS: change BW calculation for WIDER_BW peers (bsc#1031717).\n - mac80211: use constant time comparison with keys (bsc#1066471).\n - md/linear: shutup lockdep warnning (FATE#321488 bnc#1012382 bsc#1042977).\n - media: au0828: fix RC_CORE dependency (bsc#1031717).\n - media: Do not do DMA on stack for firmware upload in the AS102 driver\n (bnc#1012382).\n - media: em28xx: calculate left volume level correctly (bsc#1031717).\n - media: mceusb: fix memory leaks in error path (bsc#1031717).\n - media: rc: check for integer overflow (bnc#1012382).\n - media: v4l2-ctrl: Fix flags field on Control events (bnc#1012382).\n - mei: return error on notification request to a disconnected client\n (bnc#1012382).\n - memremap: add scheduling point to devm_memremap_pages (bnc#1057079).\n - mfd: ab8500-sysctrl: Handle probe deferral (bnc#1012382).\n - mfd: axp20x: Fix axp288 PEK_DBR and PEK_DBF irqs being swapped\n (bnc#1012382).\n - mips: AR7: Defer registration of GPIO (bnc#1012382).\n - mips: AR7: Ensure that serial ports are properly set up (bnc#1012382).\n - mips: BCM47XX: Fix LED inversion for WRT54GSv1 (bnc#1012382).\n - mips: End asm function prologue macros with .insn (bnc#1012382).\n - mips: Fix an n32 core file generation regset support regression\n (bnc#1012382).\n - mips: Fix CM region target definitions (bnc#1012382).\n - mips: Fix race on setting and getting cpu_online_mask (bnc#1012382).\n - mips: init: Ensure bootmem does not corrupt reserved memory\n (bnc#1012382).\n - mips: init: Ensure reserved memory regions are not added to bootmem\n (bnc#1012382).\n - mips: math-emu: Remove pr_err() calls from fpu_emu() (bnc#1012382).\n - mips: microMIPS: Fix incorrect mask in insn_table_MM (bnc#1012382).\n - mips: Netlogic: Exclude netlogic,xlp-pic code from XLR builds\n (bnc#1012382).\n - mips: ralink: Fix MT7628 pinmux (bnc#1012382).\n - mips: ralink: Fix typo in mt7628 pinmux function (bnc#1012382).\n - mips: SMP: Fix deadlock & online race (bnc#1012382).\n - mips: SMP: Use a completion event to signal CPU up (bnc#1012382).\n - misc: panel: properly restore atomic counter on error path (bnc#1012382).\n - mmc: block: return error on failed mmc_blk_get() (bsc#1031717).\n - mmc: core: add driver strength selection when selecting hs400es\n (bsc#1069721).\n - mmc: core: Fix access to HS400-ES devices (bsc#1031717).\n - mmc: core/mmci: restore pre/post_req behaviour (bsc#1031717).\n - mmc: dw_mmc: Fix the DTO timeout calculation (bsc#1069721).\n - mm: check the return value of lookup_page_ext for all call sites\n (bnc#1068982).\n - mmc: host: omap_hsmmc: avoid possible overflow of timeout value\n (bsc#1031717).\n - mmc: host: omap_hsmmc: checking for NULL instead of IS_ERR()\n (bsc#1031717).\n - mmc: mediatek: Fixed size in dma_free_coherent (bsc#1031717).\n - mmc: s3cmci: include linux/interrupt.h for tasklet_struct (bnc#1012382).\n - mmc: sd: limit SD card power limit according to cards capabilities\n (bsc#1031717).\n - mm: distinguish CMA and MOVABLE isolation in has_unmovable_pages\n (bnc#1051406).\n - mm: drop migrate type checks from has_unmovable_pages (bnc#1051406).\n - mm, hwpoison: fixup "mm: check the return value of lookup_page_ext for\n all call sites" (bnc#1012382).\n - mm/madvise.c: fix freeing of locked page with MADV_FREE (bnc#1069152).\n - mm/madvise.c: fix madvise() infinite loop under special circumstances\n (bnc#1070964).\n - mm, memory_hotplug: add scheduling point to __add_pages (bnc#1057079).\n - mm, memory_hotplug: do not fail offlining too early (bnc#1051406).\n - mm, memory_hotplug: remove timeout from __offline_memory (bnc#1051406).\n - mm, page_alloc: add scheduling point to memmap_init_zone (bnc#1057079).\n - mm/page_alloc.c: broken deferred calculation (bnc#1068980).\n - mm, page_alloc: fix potential false positive in __zone_watermark_ok\n (Git-fixes, bsc#1068978).\n - mm/page_ext.c: check if page_ext is not prepared (bnc#1068982).\n - mm/page_owner: avoid null pointer dereference (bnc#1068982).\n - mm/pagewalk.c: report holes in hugetlb ranges (bnc#1012382).\n - mm, sparse: do not swamp log with huge vmemmap allocation failures\n (bnc#1047901).\n - net: 3com: typhoon: typhoon_init_one: fix incorrect return values\n (bnc#1012382).\n - net: 3com: typhoon: typhoon_init_one: make return values more specific\n (bnc#1012382).\n - net/9p: Switch to wait_event_killable() (bnc#1012382).\n - net: Allow IP_MULTICAST_IF to set index to L3 slave (bnc#1012382).\n - net: cdc_ether: fix divide by 0 on bad descriptors (bnc#1012382).\n - net: cdc_ncm: GetNtbFormat endian fix (git-fixes).\n - net: dsa: select NET_SWITCHDEV (bnc#1012382).\n - net: emac: Fix napi poll list corruption (bnc#1012382).\n - netfilter/ipvs: clear ipvs_property flag when SKB net namespace changed\n (bnc#1012382).\n - netfilter: nf_ct_expect: Change __nf_ct_expect_check() return value\n (bnc#1012382).\n - netfilter: nf_tables: fix oob access (bnc#1012382).\n - netfilter: nft_meta: deal with PACKET_LOOPBACK in netdev family\n (bnc#1012382).\n - netfilter: nft_queue: use raw_smp_processor_id() (bnc#1012382).\n - net: ibm: ibmvnic: constify vio_device_id (fate#323285).\n - net: ixgbe: Use new IXGBE_FLAG2_ROOT_RELAXED_ORDERING flag (bsc#1056652).\n - net/mlx4_core: Fix VF overwrite of module param which disables DMFS on\n new probed PFs (FATE#321685 FATE#321686 FATE#321687 bnc#1012382\n bsc#1015336 bsc#1015337 bsc#1015340).\n - net/mlx4_en: fix overflow in mlx4_en_init_timestamp() (FATE#321685\n FATE#321686 FATE#321687 bnc#1012382 bsc#1015336 bsc#1015337 bsc#1015340).\n - net/mlx5: Delay events till mlx5 interface's add complete for pci resume\n (bsc#1015342 FATE#321688 bsc#1015343 FATE#321689).\n - net/mlx5e: Increase Striding RQ minimum size limit to 4 multi-packet\n WQEs (bsc#1015342 FATE#321688 bsc#1015343 FATE#321689).\n - net/mlx5: Fix health work queue spin lock to IRQ safe (bsc#1015342).\n - net/mlx5: Loop over temp list to release delay events (bsc#1015342\n FATE#321688 bsc#1015343 FATE#321689).\n - net: mvneta: fix handling of the Tx descriptor counter (fate#319899).\n - net: mvpp2: release reference to txq_cpu[] entry after unmapping\n (bnc#1012382 bsc#1032150).\n - net: qmi_wwan: fix divide by 0 on bad descriptors (bnc#1012382).\n - net/sctp: Always set scope_id in sctp_inet6_skb_msgname (bnc#1012382).\n - net: Set sk_prot_creator when cloning sockets to the right proto\n (bnc#1012382).\n - net/smc: dev_put for netdev after usage of ib_query_gid() (bsc#1066812).\n - net: thunderx: Fix TCP/UDP checksum offload for IPv4 pkts (bsc#1069583).\n - net: thunderx: Fix TCP/UDP checksum offload for IPv6 pkts (bsc#1069583).\n - net/unix: do not show information about sockets from other namespaces\n (bnc#1012382).\n - netvsc: use refcount_t for keeping track of sub channels (bsc#1062835).\n - nfc: fix device-allocation error return (bnc#1012382).\n - nfsd/callback: Cleanup callback cred on shutdown (bnc#1012382).\n - nfsd: deal with revoked delegations appropriately (bnc#1012382).\n - nfs: Do not disconnect open-owner on NFS4ERR_BAD_SEQID (bsc#989261).\n - nfs: Fix typo in nomigration mount option (bnc#1012382).\n - nfs: Fix ugly referral attributes (bnc#1012382).\n - nilfs2: fix race condition that causes file system corruption\n (bnc#1012382).\n - nl80211: Define policy for packet pattern attributes (bnc#1012382).\n - nvme: add duplicate_connect option (bsc#1067734).\n - nvme: add helper to compare options to controller (bsc#1067734).\n - nvme: add transport SGL definitions (bsc#1057820).\n - nvme: allow controller RESETTING to RECONNECTING transition\n (bsc#1037838).\n - nvme-fabrics: Allow 0 as KATO value (bsc#1067734).\n - nvme-fabrics: kABI fix for duplicate_connect option (bsc#1067734).\n - nvme-fc: add a dev_loss_tmo field to the remoteport (bsc#1037838).\n - nvme-fc: add dev_loss_tmo timeout and remoteport resume support\n (bsc#1037838).\n - nvme-fc: add support for duplicate_connect option (bsc#1067734).\n - nvme-fc: add uevent for auto-connect (bsc#1037838).\n - nvme-fc: change ctlr state assignments during reset/reconnect\n (bsc#1037838).\n - nvme-fc: check connectivity before initiating reconnects (bsc#1037838).\n - nvme-fc: correct io termination handling (bsc#1067734).\n - nvme-fc: correct io timeout behavior (bsc#1067734).\n - nvme-fc: create fc class and transport device (bsc#1037838).\n - nvme-fc: decouple ns references from lldd references (bsc#1067734).\n - nvme-fc: fix iowait hang (bsc#1052384).\n - nvme-fc: fix localport resume using stale values (bsc#1067734).\n - nvme-fcloop: fix port deletes and callbacks (bsc#1037838).\n - nvme-fc: move remote port get/put/free location (bsc#1037838).\n - nvme-fc: on lldd/transport io error, terminate association (bsc#1042268).\n - nvme-fc: Reattach to localports on re-registration (bsc#1052384).\n - nvme-fc: remove NVME_FC_MAX_SEGMENTS (bsc#1067734).\n - nvme-fc: remove unused "queue_size" field (bsc#1042268).\n - nvme-fc: retry initial controller connections 3 times (bsc#1067734).\n - nvme-fc: use transport-specific sgl format (bsc#1057820).\n - nvme: Fix memory order on async queue deletion (bnc#1012382).\n - nvme: fix the definition of the doorbell buffer config support bit\n (bsc#1066812).\n - nvme-rdma: add support for duplicate_connect option (bsc#1067734).\n - nvme/rdma: Kick admin queue when a connection is going down\n (bsc#1059639).\n - nvmet-fc: correct ref counting error when deferred rcv used\n (bsc#1067734).\n - nvmet-fc: fix failing max io queue connections (bsc#1067734).\n - nvmet-fc: on port remove call put outside lock (bsc#1067734).\n - nvmet-fc: simplify sg list handling (bsc#1052384).\n - nvmet: Fix fatal_err_work deadlock (bsc#1063349).\n - ocfs2: fstrim: Fix start offset of first cluster group during fstrim\n (bnc#1012382).\n - ocfs2: should wait dio before inode lock in ocfs2_setattr()\n (bnc#1012382).\n - packet: avoid panic in packet_getsockopt() (bnc#1012382).\n - packet: only test po->has_vnet_hdr once in packet_snd (bnc#1012382).\n - parisc: Avoid trashing sr2 and sr3 in LWS code (bnc#1012382).\n - parisc: Fix double-word compare and exchange in LWS code on 32-bit\n kernels (bnc#1012382).\n - parisc: Fix validity check of pointer size argument in new CAS\n implementation (bnc#1012382).\n - pci: Apply Cavium ThunderX ACS quirk to more Root Ports (bsc#1069250).\n - pci: Apply _HPX settings only to relevant devices (bnc#1012382).\n - pci: Enable Relaxed Ordering for Hisilicon Hip07 chip (bsc#1056652).\n - pci: Mark Cavium CN8xxx to avoid bus reset (bsc#1069250).\n - pci: Set Cavium ACS capability quirk flags to assert RR/CR/SV/UF\n (bsc#1069250).\n - percpu: make this_cpu_generic_read() atomic w.r.t. interrupts\n (bnc#1012382).\n - perf tools: Fix build failure on perl script context (bnc#1012382).\n - perf tools: Only increase index if perf_evsel__new_idx() succeeds\n (bnc#1012382).\n - perf/x86/intel/bts: Fix exclusive event reference leak (git-fixes\n d2878d642a4ed).\n - phy: increase size of MII_BUS_ID_SIZE and bus_id (bnc#1012382).\n - pkcs#7: fix unitialized boolean 'want' (bnc#1012382).\n - pkcs7: Prevent NULL pointer dereference, since sinfo is not always set\n (bnc#1012382).\n - platform/x86: acer-wmi: setup accelerometer when ACPI device was found\n (bsc#1031717).\n - platform/x86: hp-wmi: Do not shadow error values (bnc#1012382).\n - platform/x86: hp-wmi: Fix detection for dock and tablet mode\n (bnc#1012382).\n - platform/x86: hp-wmi: Fix error value for hp_wmi_tablet_state\n (bnc#1012382).\n - platform/x86: intel_mid_thermal: Fix module autoload (bnc#1012382).\n - platform/x86: sony-laptop: Fix error handling in sony_nc_setup_rfkill()\n (bsc#1031717).\n - pm / OPP: Add missing of_node_put(np) (bnc#1012382).\n - power: bq27xxx_battery: Fix bq27541 AveragePower register address\n (bsc#1031717).\n - power: bq27xxx: fix reading for bq27000 and bq27010 (bsc#1031717).\n - powercap: Fix an error code in powercap_register_zone() (bsc#1031717).\n - power: ipaq-micro-battery: freeing the wrong variable (bsc#1031717).\n - powerpc/64: Fix race condition in setting lock bit in idle/wakeup code\n (bsc#1066223).\n - powerpc/64s/hash: Allow MAP_FIXED allocations to cross 128TB boundary\n (bsc#1070169).\n - powerpc/64s/hash: Fix 128TB-512TB virtual address boundary case\n allocation (bsc#1070169).\n - powerpc/64s/hash: Fix 512T hint detection to use >= 128T (bsc#1070169).\n - powerpc/64s/hash: Fix fork() with 512TB process address space\n (bsc#1070169).\n - powerpc/64s/slice: Use addr limit when computing slice mask\n (bsc#1070169).\n - powerpc/bpf/jit: Disable classic BPF JIT on ppc64le (bsc#1066223).\n - powerpc/corenet: explicitly disable the SDHC controller on kmcoge4\n (bnc#1012382).\n - powerpc: Correct instruction code for xxlor instruction (bsc#1066223).\n - powerpc: Fix VSX enabling/flushing to also test MSR_FP and MSR_VEC\n (bsc#1066223).\n - powerpc/hotplug: Improve responsiveness of hotplug change (FATE#322022,\n bsc#1067906).\n - powerpc/mm: Fix check of multiple 16G pages from device tree\n (bsc#1066223).\n - powerpc/mm: Fix virt_addr_valid() etc. on 64-bit hash (bsc#1066223).\n - powerpc/mm/hash64: Fix subpage protection with 4K HPTE config\n (bsc#1010201, bsc#1066223).\n - powerpc/mm/hash: Free the subpage_prot_table correctly (bsc#1066223).\n - powerpc/numa: Fix multiple bugs in memory_hotplug_max() (bsc#1066223).\n - powerpc/numa: Fix whitespace in hot_add_drconf_memory_max()\n (bsc#1066223).\n - powerpc/opal: Fix EBUSY bug in acquiring tokens (bsc#1066223).\n - powerpc/powernv/ioda: Fix endianness when reading TCEs (bsc#1066223).\n - powerpc/powernv: Make opal_event_shutdown() callable from IRQ context\n (bsc#1066223).\n - powerpc/pseries/vio: Dispose of virq mapping on vdevice unregister\n (bsc#1067888).\n - powerpc/signal: Properly handle return value from uprobe_deny_signal()\n (bsc#1066223).\n - powerpc/sysrq: Fix oops whem ppmu is not registered (bsc#1066223).\n - powerpc/vphn: Fix numa update end-loop bug (FATE#322022, bsc#1067906).\n - powerpc/vphn: Improve recognition of PRRN/VPHN (FATE#322022,\n bsc#1067906).\n - powerpc/vphn: Update CPU topology when VPHN enabled (FATE#322022,\n bsc#1067906).\n - power: supply: bq27xxx_battery: Fix register map for BQ27510 and BQ27520\n ("bsc#1069270").\n - power: supply: isp1704: Fix unchecked return value of devm_kzalloc\n (bsc#1031717).\n - power: supply: lp8788: prevent out of bounds array access (bsc#1031717).\n - power_supply: tps65217-charger: Fix NULL deref during property export\n (bsc#1031717).\n - ppp: fix race in ppp device destruction (bnc#1012382).\n - printk/console: Always disable boot consoles that use init memory before\n it is freed (bsc#1063026).\n - printk/console: Enhance the check for consoles using init memory\n (bsc#1063026).\n - printk: include <asm/sections.h> instead of <asm-generic/sections.h>\n (bsc#1063026).\n - printk: Make sure to wake up printk kthread from irq work for pending\n output (bnc#744692, bnc#789311).\n - printk: only unregister boot consoles when necessary (bsc#1063026).\n - qla2xxx: Fix cable swap (bsc#1043017).\n - qla2xxx: Fix notify ack without timeout handling (bsc#1043017).\n - qla2xxx: Fix re-login for Nport Handle in use (bsc#1043017).\n - qla2xxx: fix stale memory access (bsc#1043017).\n - qla2xxx: Login state machine stuck at GPDB (bsc#1043017).\n - qla2xxx: Recheck session state after RSCN (bsc#1043017).\n - qla2xxx: relogin is being triggered too fast (bsc#1043017).\n - qla2xxx: Retry switch command on timed out (bsc#1043017).\n - qla2xxx: Serialize gpnid (bsc#1043017).\n - quota: Check for register_shrinker() failure (bsc#1070404).\n - r8169: Do not increment tx_dropped in TX ring cleaning (bsc#1031717).\n - rbd: set discard_alignment to zero (bsc#1064320).\n - rbd: use GFP_NOIO for parent stat and data requests (bnc#1012382).\n - rcu: Allow for page faults in NMI handlers (bnc#1012382).\n - rdma/uverbs: Prevent leak of reserved field (bsc#1022595 FATE#322350).\n - rds: rdma: return appropriate error on rdma map failures (bnc#1012382).\n - regulator: core: Limit propagation of parent voltage count and list\n (bsc#1070145).\n - regulator: fan53555: fix I2C device ids (bnc#1012382).\n - Revert "bpf: one perf event close won't free bpf program attached by\n another perf event" (kabi).\n - Revert "bsg-lib: do not free job in bsg_prepare_job" (bnc#1012382).\n - Revert "crypto: xts - Add ECB dependency" (bnc#1012382).\n - Revert "drm: bridge: add DT bindings for TI ths8135" (bnc#1012382).\n - Revert "keys: Fix race between updating and finding a negative key"\n (kabi).\n - Revert "phy: increase size of MII_BUS_ID_SIZE and bus_id" (kabi).\n - Revert "sctp: do not peel off an assoc from one netns to another one"\n (bnc#1012382).\n - Revert "tty: goldfish: Fix a parameter of a call to free_irq"\n (bnc#1012382).\n - Revert "uapi: fix linux/rds.h userspace compilation errors"\n (bnc#1012382).\n - rpm/kernel-binary.spec.in: add the kernel-binary dependencies to\n kernel-binary-base (bsc#1060333).\n - rpm/kernel-binary.spec.in: Correct supplements for recent SLE products\n (bsc#1067494)\n - rpm/kernel-binary.spec.in: only rewrite modules.dep if non-zero in size\n (bsc#1056979).\n - rpm/package-descriptions:\n - rtc: ds1307: Fix relying on reset value for weekday (bsc#1031717).\n - rtc: ds1374: wdt: Fix issue with timeout scaling from secs to wdt ticks\n (bsc#1031717).\n - rtc: ds1374: wdt: Fix stop/start ioctl always returning -EINVAL\n (bsc#1031717).\n - rtc: rtc-nuc900: fix loop timeout test (bsc#1031717).\n - rtc: sa1100: fix unbalanced clk_prepare_enable/clk_disable_unprepare\n (bsc#1031717).\n - rtlwifi: fix uninitialized rtlhal->last_suspend_sec time (bnc#1012382).\n - rtlwifi: rtl8192ee: Fix memory leak when loading firmware (bnc#1012382).\n - rtlwifi: rtl8821ae: Fix connection lost problem (bnc#1012382).\n - rtlwifi: rtl8821ae: Fix HW_VAR_NAV_UPPER operation (bsc#1031717).\n - s390/dasd: check for device error pointer within state change interrupts\n (bnc#1012382).\n - s390/disassembler: add missing end marker for e7 table (bnc#1012382).\n - s390/disassembler: correct disassembly lines alignment (bsc#1070825).\n - s390/disassembler: increase show_code buffer size (bnc#1070825,\n LTC#161577).\n - s390/disassembler: increase show_code buffer size (LTC#161577\n bnc#1012382 bnc#1070825).\n - s390: fix transactional execution control register handling\n (bnc#1012382).\n - s390/kbuild: enable modversions for symbols exported from asm\n (bnc#1012382).\n - s390/mm: fix write access check in gup_huge_pmd() (bnc#1066974,\n LTC#160551).\n - s390/qeth: allow hsuid configuration in DOWN state (bnc#1070825,\n LTC#161871).\n - s390/qeth: issue STARTLAN as first IPA command (bnc#1012382).\n - s390/qeth: use ip_lock for hsuid configuration (bnc#1070825, LTC#161871).\n - s390/runtime instrumention: fix possible memory corruption (bnc#1012382).\n - sched/autogroup: Fix autogroup_move_group() to never skip\n sched_move_task() (bnc#1012382).\n - sched: Make resched_cpu() unconditional (bnc#1012382).\n - sched/rt: Simplify the IPI based RT balancing logic (bnc#1012382).\n - scsi: aacraid: Check for PCI state of device in a generic way\n (bsc#1022607, FATE#321673).\n - scsi: aacraid: Fix controller initialization failure (FATE#320140).\n - scsi: bfa: fix access to bfad_im_port_s (bsc#1065101).\n - scsi: check for device state in __scsi_remove_target() (bsc#1072589).\n - scsi_devinfo: cleanly zero-pad devinfo strings (bsc#1062941).\n - scsi: fcoe: move fcoe_interface_remove() out of fcoe_interface_cleanup()\n (bsc#1039542).\n - scsi: fcoe: open-code fcoe_destroy_work() for NETDEV_UNREGISTER\n (bsc#1039542).\n - scsi: fcoe: separate out fcoe_vport_remove() (bsc#1039542).\n - scsi: ipr: Fix scsi-mq lockdep issue (bsc#1066213).\n - scsi: ipr: Set no_report_opcodes for RAID arrays (bsc#1066213).\n - scsi: libiscsi: fix shifting of DID_REQUEUE host byte (bsc#1056003).\n - scsi: lpfc: Add Buffer to Buffer credit recovery support (bsc#1052384).\n - scsi: lpfc: Add changes to assist in NVMET debugging (bsc#1041873).\n - scsi: lpfc: Add nvme initiator devloss support (bsc#1041873).\n - scsi: lpfc: Adjust default value of lpfc_nvmet_mrq (bsc#1067735).\n - scsi: lpfc: Break up IO ctx list into a separate get and put list\n (bsc#1045404).\n - scsi: lpfc: change version to 11.4.0.4 (bsc#1067735).\n - scsi: lpfc: convert info messages to standard messages (bsc#1052384).\n - scsi: lpfc: Correct driver deregistrations with host nvme transport\n (bsc#1067735).\n - scsi: lpfc: Correct issues with FAWWN and FDISCs (bsc#1052384).\n - scsi: lpfc: correct nvme sg segment count check (bsc#1067735).\n - scsi: lpfc: correct port registrations with nvme_fc (bsc#1067735).\n - scsi: lpfc: Correct return error codes to align with nvme_fc transport\n (bsc#1052384).\n - scsi: lpfc: Disable NPIV support if NVME is enabled (bsc#1067735).\n - scsi: lpfc: Driver fails to detect direct attach storage array\n (bsc#1067735).\n - scsi: lpfc: Expand WQE capability of every NVME hardware queue\n (bsc#1067735).\n - scsi: lpfc: Extend RDP support (bsc#1067735).\n - scsi: lpfc: Fix a precedence bug in lpfc_nvme_io_cmd_wqe_cmpl()\n (bsc#1056587).\n - scsi: lpfc: Fix bad sgl reposting after 2nd adapter reset (bsc#1052384).\n - scsi: lpfc: fix build issue if NVME_FC_TARGET is not defined\n (bsc#1040073).\n - scsi: lpfc: Fix counters so outstandng NVME IO count is accurate\n (bsc#1041873).\n - scsi: lpfc: Fix crash after bad bar setup on driver attachment\n (bsc#1067735).\n - scsi: lpfc: Fix crash during driver unload with running nvme traffic\n (bsc#1067735).\n - scsi: lpfc: Fix crash in lpfc_nvme_fcp_io_submit during LIP\n (bsc#1067735).\n - scsi: lpfc: Fix crash in lpfc nvmet when fc port is reset (bsc#1052384).\n - scsi: lpfc: Fix crash receiving ELS while detaching driver (bsc#1067735).\n - scsi: lpfc: Fix display for debugfs queInfo (bsc#1067735).\n - scsi: lpfc: Fix driver handling of nvme resources during unload\n (bsc#1067735).\n - scsi: lpfc: Fix duplicate NVME rport entries and namespaces\n (bsc#1052384).\n - scsi: lpfc: Fix FCP hba_wqidx assignment (bsc#1067735).\n - scsi: lpfc: Fix handling of FCP and NVME FC4 types in Pt2Pt topology\n (bsc#1052384).\n - scsi: lpfc: Fix hard lock up NMI in els timeout handling (bsc#1067735).\n - scsi: lpfc: fix "integer constant too large" error on 32bit archs\n (bsc#1052384).\n - scsi: lpfc: Fix loop mode target discovery (bsc#1052384).\n - scsi: lpfc: Fix lpfc nvme host rejecting IO with Not Ready message\n (bsc#1067735).\n - scsi: lpfc: Fix Lun Priority level shown as NA (bsc#1041873).\n - scsi: lpfc: Fix ndlp ref count for pt2pt mode issue RSCN (bsc#1067735).\n - scsi: lpfc: Fix NVME LS abort_xri (bsc#1067735).\n - scsi: lpfc: Fix nvme port role handling in sysfs and debugfs handlers\n (bsc#1041873).\n - scsi: lpfc: Fix NVME PRLI handling during RSCN (bsc#1052384).\n - scsi: lpfc: Fix nvme target failure after 2nd adapter reset\n (bsc#1052384).\n - scsi: lpfc: Fix nvmet node ref count handling (bsc#1041873).\n - scsi: lpfc: Fix oops if nvmet_fc_register_targetport fails (bsc#1067735).\n - scsi: lpfc: Fix oops of nvme host during driver unload (bsc#1067735).\n - scsi: lpfc: Fix oops when NVME Target is discovered in a nonNVME\n environment.\n - scsi: lpfc: fix pci hot plug crash in list_add call (bsc#1067735).\n - scsi: lpfc: fix pci hot plug crash in timer management routines\n (bsc#1067735).\n - scsi: lpfc: Fix plogi collision that causes illegal state transition\n (bsc#1052384).\n - scsi: lpfc: Fix Port going offline after multiple resets (bsc#1041873).\n - scsi: lpfc: Fix PRLI retry handling when target rejects it (bsc#1041873).\n - scsi: lpfc: Fix rediscovery on switch blade pull (bsc#1052384).\n - scsi: lpfc: Fix relative offset error on large nvmet target ios\n (bsc#1052384).\n - scsi: lpfc: Fix return value of board_mode store routine in case of\n online failure (bsc#1041873).\n - scsi: lpfc: Fix secure firmware updates (bsc#1067735).\n - scsi: lpfc: Fix System panic after loading the driver (bsc#1041873).\n - scsi: lpfc: Fix transition nvme-i rport handling to nport only\n (bsc#1041873).\n - scsi: lpfc: Fix vports not logging into target (bsc#1041873).\n - scsi: lpfc: Fix warning messages when NVME_TARGET_FC not defined\n (bsc#1067735).\n - scsi: lpfc: FLOGI failures are reported when connected to a private loop\n (bsc#1067735).\n - scsi: lpfc: Handle XRI_ABORTED_CQE in soft IRQ (bsc#1067735).\n - scsi: lpfc: Limit amount of work processed in IRQ (bsc#1052384).\n - scsi: lpfc: Linux LPFC driver does not process all RSCNs (bsc#1067735).\n - scsi: lpfc: lpfc version bump 11.4.0.3 (bsc#1052384).\n - scsi: lpfc: Make ktime sampling more accurate (bsc#1067735).\n - scsi: lpfc: Move CQ processing to a soft IRQ (bsc#1067735).\n - scsi: lpfc: Null pointer dereference when log_verbose is set to\n 0xffffffff (bsc#1041873).\n - scsi: lpfc: PLOGI failures during NPIV testing (bsc#1067735).\n - scsi: lpfc: Raise maximum NVME sg list size for 256 elements\n (bsc#1067735).\n - scsi: lpfc: Reduce log spew on controller reconnects (bsc#1067735).\n - scsi: lpfc: remove console log clutter (bsc#1052384).\n - scsi: lpfc: Revise NVME module parameter descriptions for better clarity\n (bsc#1067735).\n - scsi: lpfc: Set missing abort context (bsc#1067735).\n - scsi: lpfc: small sg cnt cleanup (bsc#1067735).\n - scsi: lpfc: spin_lock_irq() is not nestable (bsc#1045404).\n - scsi: lpfc: update driver version to 11.4.0.5 (bsc#1067735).\n - scsi: lpfc: update to revision to 11.4.0.0 (bsc#1041873).\n - scsi: megaraid_sas: mismatch of allocated MFI frame size and length\n exposed in MFI MPT pass through command (bsc#1066767).\n - scsi: qla2xxx: Cleanup debug message IDs (bsc#1043017).\n - scsi: qla2xxx: Correction to vha->vref_count timeout (bsc#1066812).\n - scsi: qla2xxx: Fix name server relogin (bsc#1043017).\n - scsi: qla2xxx: Fix path recovery (bsc#1043017).\n - scsi: qla2xxx: Initialize Work element before requesting IRQs\n (bsc#1019675,FATE#321701).\n - scsi: qla2xxx: Replace usage of spin_lock with spin_lock_irqsave\n (bsc#1043017).\n - scsi: qla2xxx: Retain loop test for fwdump length exceeding buffer\n length (bsc#1043017).\n - scsi: qla2xxx: Turn on FW option for exchange check (bsc#1043017).\n - scsi: qla2xxx: Use BIT_6 to acquire FAWWPN from switch (bsc#1066812).\n - scsi: qla2xxx: Use fabric name for Get Port Speed command (bsc#1066812).\n - scsi: qla2xxx: Use flag PFLG_DISCONNECTED (bsc#1043017).\n - scsi: reset wait for IO completion (bsc#996376).\n - scsi: scsi_devinfo: fixup string compare (bsc#1062941). updated\n patches.fixes/scsi_devinfo-fixup-string-compare.patch to the version\n merged upstream.\n - scsi: scsi_devinfo: handle non-terminated strings (bsc#1062941).\n - scsi: scsi_dh_emc: return success in clariion_std_inquiry()\n (bnc#1012382).\n - scsi: sd_zbc: Fix sd_zbc_read_zoned_characteristics() (bsc#1066812).\n - scsi: sg: close race condition in sg_remove_sfp_usercontext()\n (bsc#1064206).\n - scsi: sg: do not return bogus Sg_requests (bsc#1064206).\n - scsi: sg: only check for dxfer_len greater than 256M (bsc#1064206).\n - scsi: sg: Re-fix off by one in sg_fill_request_table() (bnc#1012382).\n - scsi: ufs: add capability to keep auto bkops always enabled\n (bnc#1012382).\n - scsi: ufs-qcom: Fix module autoload (bnc#1012382).\n - scsi: zfcp: fix erp_action use-before-initialize in REC action trace\n (bnc#1012382).\n - sctp: add the missing sock_owned_by_user check in sctp_icmp_redirect\n (bnc#1012382).\n - sctp: do not peel off an assoc from one netns to another one\n (bnc#1012382).\n - sctp: potential read out of bounds in sctp_ulpevent_type_enabled()\n (bnc#1012382).\n - sctp: reset owner sk for data chunks on out queues when migrating a sock\n (bnc#1012382).\n - security/keys: add CONFIG_KEYS_COMPAT to Kconfig (bnc#1012382).\n - selftests: firmware: add empty string and async tests (bnc#1012382).\n - selftests: firmware: send expected errors to /dev/null (bnc#1012382).\n - serial: 8250_fintek: Fix rs485 disablement on invalid ioctl()\n (bsc#1031717).\n - serial: 8250_uniphier: fix serial port index in private data\n (bsc#1031717).\n - serial: Fix serial console on SNI RM400 machines (bsc#1031717).\n - serial: omap: Fix EFR write on RTS deassertion (bnc#1012382).\n - serial: Remove unused port type (bsc#1066045).\n - serial: sh-sci: Fix register offsets for the IRDA serial port\n (bnc#1012382).\n - slub: do not merge cache if slub_debug contains a never-merge flag\n (bnc#1012382).\n - smb3: Validate negotiate request must always be signed (bsc#1064597).\n - smb: fix leak of validate negotiate info response buffer (bsc#1064597).\n - smb: fix validate negotiate info uninitialised memory use (bsc#1064597).\n - sparc64: Migrate hvcons irq to panicked cpu (bnc#1012382).\n - spi: SPI_FSL_DSPI should depend on HAS_DMA (bnc#1012382).\n - spi: uapi: spidev: add missing ioctl header (bnc#1012382).\n - staging: iio: cdc: fix improper return value (bnc#1012382).\n - staging: lustre: hsm: stack overrun in hai_dump_data_field (bnc#1012382).\n - staging: lustre: llite: do not invoke direct_IO for the EOF case\n (bnc#1012382).\n - staging: lustre: ptlrpc: skip lock if export failed (bnc#1012382).\n - staging: r8712u: Fix Sparse warning in rtl871x_xmit.c (bnc#1012382).\n - staging: rtl8188eu: fix incorrect ERROR tags from logs (bnc#1012382).\n - staging: rtl8712: fixed little endian problem (bnc#1012382).\n - staging: rtl8712u: Fix endian settings for structs describing network\n packets (bnc#1012382).\n - sunrpc: Fix tracepoint storage issues with svc_recv and svc_rqst_status\n (bnc#1012382).\n - supported.conf: Support spidev (bsc#1066696)\n - sysctl: add unsigned int range support (FATE#323821)\n - target: fix ALUA state file path truncation (bsc#1064606).\n - target: Fix node_acl demo-mode + uncached dynamic shutdown regression\n (bnc#1012382).\n - target: fix PR state file path truncation (bsc#1064606).\n - target: Fix QUEUE_FULL + SCSI task attribute handling (bnc#1012382).\n - target/iscsi: Fix unsolicited data seq_end_offset calculation\n (bnc#1012382 bsc#1036489).\n - target/rbd: handle zero length UNMAP requests early (bsc#1064320).\n - target/rbd: use target_configure_unmap_from_queue() helper (bsc#1064320).\n - tcp/dccp: fix ireq->opt races (bnc#1012382).\n - tcp/dccp: fix lockdep splat in inet_csk_route_req() (bnc#1012382).\n - tcp/dccp: fix other lockdep splats accessing ireq_opt (bnc#1012382).\n - tcp: do not mangle skb->cb[] in tcp_make_synack() (bnc#1012382).\n - tcp: fix tcp_mtu_probe() vs highest_sack (bnc#1012382).\n - test: firmware_class: report errors properly on failure (bnc#1012382).\n - test_sysctl: add dedicated proc sysctl test driver (FATE#323821)\n - test_sysctl: add generic script to expand on tests (FATE#323821)\n - test_sysctl: add simple proc_dointvec() case (FATE#323821).\n - test_sysctl: add simple proc_douintvec() case (FATE#323821).\n - test_sysctl: fix sysctl.sh by making it executable (FATE#323821).\n - test_sysctl: test against int proc_dointvec() array support\n (FATE#323821).\n - test_sysctl: test against PAGE_SIZE for int (FATE#323821)\n - timer: Prevent timer value 0 for MWAITX (bsc#1065717).\n - tipc: fix link attribute propagation bug (bnc#1012382).\n - tipc: use only positive error codes in messages (bnc#1012382).\n - tools: firmware: check for distro fallback udev cancel rule\n (bnc#1012382).\n - tpm: constify transmit data pointers (bsc#1020645, git-fixes).\n - tpm: kabi: do not bother with added const (bsc#1020645, git-fixes).\n - tpm_tis_spi: Use DMA-safe memory for SPI transfers (bsc#1020645,\n git-fixes).\n - tracing: Fix tracing sample code warning (bnc#1012382).\n - tracing/samples: Fix creation and deletion of simple_thread_fn creation\n (bnc#1012382).\n - tun: allow positive return values on dev_get_valid_name() call\n (bnc#1012382).\n - tun: bail out from tun_get_user() if the skb is empty (bnc#1012382).\n - tun: call dev_get_valid_name() before register_netdevice() (bnc#1012382).\n - tun/tap: sanitize TUNSETSNDBUF input (bnc#1012382).\n - uapi: fix linux/mroute6.h userspace compilation errors (bnc#1012382).\n - uapi: fix linux/rds.h userspace compilation error (bnc#1012382).\n - uapi: fix linux/rds.h userspace compilation errors (bnc#1012382).\n - udpv6: Fix the checksum computation when HW checksum does not apply\n (bnc#1012382).\n - Update config files to enable spidev on arm64. (bsc#1066696)\n - Update\n patches.drivers/0005-hwmon-xgene-Fix-up-error-handling-path-mixup-in-xgen.p\n atch (bsc#1056652) Correct bugzilla reference.\n - Update patches.fixes/scsi-devinfo-cleanly-zero-pad-devinfo-strings.patch\n (bsc#1062941, bsc#1037404, bsc#1012523, bsc#1038299).\n - Update patches.fixes/scsi_devinfo-fixup-string-compare.patch\n (bsc#1062941, bsc#1037404, bsc#1012523, bsc#1038299).\n - Update patches.fixes/scsi_devinfo-handle-non-terminated-strings.patch\n (bsc#1062941, bsc#1037404, bsc#1012523, bsc#1038299).\n - Update preliminary FC-NVMe patches to mainline status (bsc#1067734)\n - usb: Add delay-init quirk for Corsair K70 LUX keyboards (bnc#1012382).\n - usb: cdc_acm: Add quirk for Elatec TWN3 (bnc#1012382).\n - usb: core: fix out-of-bounds access bug in usb_get_bos_descriptor()\n (bnc#1012382).\n - usb: devio: Revert "USB: devio: Do not corrupt user memory"\n (bnc#1012382).\n - usb: dummy-hcd: Fix deadlock caused by disconnect detection\n (bnc#1012382).\n - usb: gadget: composite: Fix use-after-free in\n usb_composite_overwrite_options (bnc#1012382).\n - usb: hcd: initialize hcd->flags to 0 when rm hcd (bnc#1012382).\n - usb: hub: Allow reset retry for USB2 devices on connect bounce\n (bnc#1012382).\n - usb: musb: Check for host-mode using is_host_active() on reset interrupt\n (bnc#1012382).\n - usb: musb: sunxi: Explicitly release USB PHY on exit (bnc#1012382).\n - usb: quirks: add quirk for WORLDE MINI MIDI keyboard (bnc#1012382).\n - usb: renesas_usbhs: Fix DMAC sequence for receiving zero-length packet\n (bnc#1012382).\n - usb: serial: console: fix use-after-free after failed setup\n (bnc#1012382).\n - usb: serial: cp210x: add support for ELV TFD500 (bnc#1012382).\n - usb: serial: ftdi_sio: add id for Cypress WICED dev board (bnc#1012382).\n - usb: serial: garmin_gps: fix I/O after failed probe and remove\n (bnc#1012382).\n - usb: serial: garmin_gps: fix memory leak on probe errors (bnc#1012382).\n - usb: serial: metro-usb: add MS7820 device id (bnc#1012382).\n - usb: serial: option: add support for TP-Link LTE module (bnc#1012382).\n - usb: serial: qcserial: add Dell DW5818, DW5819 (bnc#1012382).\n - usb: serial: qcserial: add pid/vid for Sierra Wireless EM7355 fw update\n (bnc#1012382).\n - usb: usbfs: compute urb->actual_length for isochronous (bnc#1012382).\n - usb: usbtest: fix NULL pointer dereference (bnc#1012382).\n - usb: xhci: Handle error condition in xhci_stop_device() (bnc#1012382).\n - vfs: expedite unmount (bsc#1024412).\n - video: fbdev: pmag-ba-fb: Remove bad `__init' annotation (bnc#1012382).\n - video: udlfb: Fix read EDID timeout (bsc#1031717).\n - vlan: fix a use-after-free in vlan_device_event() (bnc#1012382).\n - vsock: use new wait API for vsock_stream_sendmsg() (bnc#1012382).\n - vti: fix use after free in vti_tunnel_xmit/vti6_tnl_xmit (bnc#1012382).\n - watchdog: kempld: fix gcc-4.3 build (bnc#1012382).\n - workqueue: Fix NULL pointer dereference (bnc#1012382).\n - workqueue: replace pool->manager_arb mutex with a flag (bnc#1012382).\n - x86/ACPI/cstate: Allow ACPI C1 FFH MWAIT use on AMD systems\n (bsc#1069879).\n - x86/alternatives: Fix alt_max_short macro to really be a max()\n (bnc#1012382).\n - x86/decoder: Add new TEST instruction pattern (bnc#1012382).\n - x86/MCE/AMD: Always give panic severity for UC errors in kernel context\n (git-fixes bf80bbd7dcf5).\n - x86/microcode/AMD: Add support for fam17h microcode loading\n (bsc#1068032).\n - x86/microcode/intel: Disable late loading on model 79 (bnc#1012382).\n - x86/mm: fix use-after-free of vma during userfaultfd fault (Git-fixes,\n bsc#1069916).\n - x86/oprofile/ppro: Do not use __this_cpu*() in preemptible context\n (bnc#1012382).\n - x86/uaccess, sched/preempt: Verify access_ok() context (bnc#1012382).\n - xen: do not print error message in case of missing Xenstore entry\n (bnc#1012382).\n - xen/events: events_fifo: Do not use {get,put}_cpu() in\n xen_evtchn_fifo_init() (bnc#1065600).\n - xen: fix booting ballooned down hvm guest (bnc#1065600).\n - xen/gntdev: avoid out of bounds access in case of partial gntdev_mmap()\n (bnc#1012382).\n - xen/manage: correct return value check on xenbus_scanf() (bnc#1012382).\n - xen-netback: fix error handling output (bnc#1065600).\n - xen: x86: mark xen_find_pt_base as __init (bnc#1065600).\n - xen: xenbus driver must not accept invalid transaction ids (bnc#1012382).\n - zd1211rw: fix NULL-deref at probe (bsc#1031717).\n\n", "edition": 1, "modified": "2017-12-18T12:20:49", "published": "2017-12-18T12:20:49", "href": "http://lists.opensuse.org/opensuse-security-announce/2017-12/msg00079.html", "id": "OPENSUSE-SU-2017:3359-1", "title": "Security update for the Linux Kernel (important)", "type": "suse", "cvss": {"score": 7.2, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-01-25T18:53:44", "bulletinFamily": "unix", "cvelist": ["CVE-2017-5753", "CVE-2017-5754", "CVE-2017-17450", "CVE-2017-12193", "CVE-2017-17805", "CVE-2017-16537", "CVE-2017-15115", "CVE-2017-8824", "CVE-2017-16994", "CVE-2017-17448", "CVE-2017-16646", "CVE-2017-5715", "CVE-2017-16536", "CVE-2017-7482", "CVE-2017-16939", "CVE-2017-1000410", "CVE-2017-17449", "CVE-2017-1000405", "CVE-2017-11600", "CVE-2017-16528", "CVE-2017-16645", "CVE-2017-17806"], "description": "The SUSE Linux Enterprise 12 SP2 Realtime kernel was updated to 4.4.104 to\n receive various security and bugfixes.\n\n This update adds mitigations for various side channel attacks against\n modern CPUs that could disclose content of otherwise unreadable memory\n (bnc#1068032).\n\n - CVE-2017-5753: Local attackers on systems with modern CPUs featuring\n deep instruction pipelining could use attacker controllable speculative\n execution over code patterns in the Linux Kernel to leak content from\n otherwise not readable memory in the same address space, allowing\n retrieval of passwords, cryptographic keys and other secrets.\n\n This problem is mitigated by adding speculative fencing on affected code\n paths throughout the Linux kernel.\n\n - CVE-2017-5715: Local attackers on systems with modern CPUs featuring\n branch prediction could use mispredicted branches to speculatively\n execute code patterns that in turn could be made to leak other\n non-readable content in the same address space, an attack similar to\n CVE-2017-5753.\n\n This problem is mitigated by disabling predictive branches, depending\n on CPU architecture either by firmware updates and/or fixes in the\n user-kernel privilege boundaries.\n\n This is done with help of Linux Kernel fixes on the Intel/AMD x86_64\n architectures. On x86_64, this requires also updates of the CPU microcode\n packages, delivered in seperate updates.\n\n As this feature can have a performance impact, it can be disabled using\n the "nospec" kernel commandline option.\n\n\n - CVE-2017-5754: Local attackers on systems with modern CPUs featuring\n deep instruction pipelining could use code patterns in userspace to\n speculative executive code that would read otherwise read protected\n memory, an attack similar to CVE-2017-5753.\n\n This problem is mitigated by unmapping the Linux Kernel from the user\n address space during user code execution, following a approach called\n "KAISER". The terms used here are "KAISER" / "Kernel Address Isolation"\n and "PTI" / "Page Table Isolation".\n\n\n The following security bugs were fixed:\n\n - CVE-2017-1000405: The Linux Kernel versions had a problematic use of\n pmd_mkdirty() in the touch_pmd() function inside the THP implementation.\n touch_pmd() can be reached by get_user_pages(). In such case, the pmd\n will become dirty. This scenario breaks the new can_follow_write_pmd()'s\n logic - pmd can become dirty without going through a COW cycle. This bug\n is not as severe as the original "Dirty cow" because an ext4 file (or\n any other regular file) cannot be mapped using THP. Nevertheless, it did\n allow us to overwrite read-only huge pages. For example, the zero huge\n page and sealed shmem files can be overwritten (since their mapping can\n be populated using THP). Note that after the first write page-fault to\n the zero page, it will be replaced with a new fresh (and zeroed) thp\n (bnc#1069496).\n - CVE-2017-1000410: The Linux kernel was affected by a vulnerability that\n lies in the processing of incoming L2CAP commands - ConfigRequest, and\n ConfigResponse messages. (bnc#1070535).\n - CVE-2017-11600: net/xfrm/xfrm_policy.c in the Linux kernel did not\n ensure that the dir value of xfrm_userpolicy_id is XFRM_POLICY_MAX or\n less, which allowed local users to cause a denial of service\n (out-of-bounds access) or possibly have unspecified other impact via an\n XFRM_MSG_MIGRATE xfrm Netlink message (bnc#1050231).\n - CVE-2017-12193: The assoc_array_insert_into_terminal_node function in\n lib/assoc_array.c in the Linux kernel mishandled node splitting, which\n allowed local users to cause a denial of service (NULL pointer\n dereference and panic) via a crafted application, as demonstrated by the\n keyring key type, and key addition and link creation operations\n (bnc#1066192).\n - CVE-2017-15115: The sctp_do_peeloff function in net/sctp/socket.c in the\n Linux kernel did not check whether the intended netns is used in a\n peel-off action, which allowed local users to cause a denial of service\n (use-after-free and system crash) or possibly have unspecified other\n impact via crafted system calls (bnc#1068671).\n - CVE-2017-16528: sound/core/seq_device.c in the Linux kernel allowed\n local users to cause a denial of service (snd_rawmidi_dev_seq_free\n use-after-free and system crash) or possibly have unspecified other\n impact via a crafted USB device (bnc#1066629).\n - CVE-2017-16536: The cx231xx_usb_probe function in\n drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux kernel allowed\n local users to cause a denial of service (NULL pointer dereference and\n system crash) or possibly have unspecified other impact via a crafted\n USB device (bnc#1066606).\n - CVE-2017-16537: The imon_probe function in drivers/media/rc/imon.c in\n the Linux kernel allowed local users to cause a denial of service (NULL\n pointer dereference and system crash) or possibly have unspecified other\n impact via a crafted USB device (bnc#1066573).\n - CVE-2017-16645: The ims_pcu_get_cdc_union_desc function in\n drivers/input/misc/ims-pcu.c in the Linux kernel allowed local users to\n cause a denial of service (ims_pcu_parse_cdc_data out-of-bounds read and\n system crash) or possibly have unspecified other impact via a crafted\n USB device (bnc#1067132).\n - CVE-2017-16646: drivers/media/usb/dvb-usb/dib0700_devices.c in the Linux\n kernel allowed local users to cause a denial of service (BUG and system\n crash) or possibly have unspecified other impact via a crafted USB\n device (bnc#1067105).\n - CVE-2017-16939: The XFRM dump policy implementation in\n net/xfrm/xfrm_user.c in the Linux kernel allowed local users to gain\n privileges or cause a denial of service (use-after-free) via a crafted\n SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY\n Netlink messages (bnc#1069702).\n - CVE-2017-16994: The walk_hugetlb_range function in mm/pagewalk.c in the\n Linux kernel mishandled holes in hugetlb ranges, which allowed local\n users to obtain sensitive information from uninitialized kernel memory\n via crafted use of the mincore() system call (bnc#1069996).\n - CVE-2017-17448: net/netfilter/nfnetlink_cthelper.c in the Linux kernel\n did not require the CAP_NET_ADMIN capability for new, get, and del\n operations, which allowed local users to bypass intended access\n restrictions because the nfnl_cthelper_list data structure is shared\n across all net namespaces (bnc#1071693).\n - CVE-2017-17449: The __netlink_deliver_tap_skb function in\n net/netlink/af_netlink.c in the Linux kernel did not restrict\n observations of Netlink messages to a single net namespace, which\n allowed local users to obtain sensitive information by leveraging the\n CAP_NET_ADMIN capability to sniff an nlmon interface for all Netlink\n activity on the system (bnc#1071694).\n - CVE-2017-17450: net/netfilter/xt_osf.c in the Linux kernel did not\n require the CAP_NET_ADMIN capability for add_callback and\n remove_callback operations, which allowed local users to bypass intended\n access restrictions because the xt_osf_fingers data structure is shared\n across all net namespaces (bnc#1071695).\n - CVE-2017-17805: The Salsa20 encryption algorithm in the Linux kernel did\n not correctly handle zero-length inputs, allowing a local attacker able\n to use the AF_ALG-based skcipher interface\n (CONFIG_CRYPTO_USER_API_SKCIPHER) to cause a denial of service\n (uninitialized-memory free and kernel crash) or have unspecified other\n impact by executing a crafted sequence of system calls that use the\n blkcipher_walk API. Both the generic implementation\n (crypto/salsa20_generic.c) and x86 implementation\n (arch/x86/crypto/salsa20_glue.c) of Salsa20 were vulnerable\n (bnc#1073792).\n - CVE-2017-17806: The HMAC implementation (crypto/hmac.c) in the Linux\n kernel did not validate that the underlying cryptographic hash algorithm\n is unkeyed, allowing a local attacker able to use the AF_ALG-based hash\n interface (CONFIG_CRYPTO_USER_API_HASH) and the SHA-3 hash algorithm\n (CONFIG_CRYPTO_SHA3) to cause a kernel stack buffer overflow by\n executing a crafted sequence of system calls that encounter a missing\n SHA-3 initialization (bnc#1073874).\n - CVE-2017-7482: Fixed an overflow when decoding a krb5 principal.\n (bnc#1046107).\n - CVE-2017-8824: The dccp_disconnect function in net/dccp/proto.c in the\n Linux kernel allowed local users to gain privileges or cause a denial of\n service (use-after-free) via an AF_UNSPEC connect system call during the\n DCCP_LISTEN state (bnc#1070771).\n\n The following non-security bugs were fixed:\n\n - Add undefine _unique_build_ids (bsc#964063)\n - adm80211: return an error if adm8211_alloc_rings() fails (bsc#1031717).\n - adv7604: Initialize drive strength to default when using DT\n (bnc#1012382).\n - af_netlink: ensure that NLMSG_DONE never fails in dumps (bnc#1012382).\n - alsa: hda - Add HP ZBook 15u G3 Conexant CX20724 GPIO mute leds\n (bsc#1031717).\n - alsa: hda - Add MIC_NO_PRESENCE fixup for 2 HP machines (bsc#1031717).\n - alsa: hda - Add mute led support for HP EliteBook 840 G3 (bsc#1031717).\n - alsa: hda - Add mute led support for HP ProBook 440 G4 (bsc#1031717).\n - alsa: hda: Add Raven PCI ID (bnc#1012382).\n - alsa: hda - add support for docking station for HP 820 G2 (bsc#1031717).\n - alsa: hda - add support for docking station for HP 840 G3 (bsc#1031717).\n - alsa: hda - Apply ALC269_FIXUP_NO_SHUTUP on HDA_FIXUP_ACT_PROBE\n (bnc#1012382).\n - alsa: hda/ca0132 - Fix memory leak at error path (bsc#1031717).\n - alsa: hda - change the location for one mic on a Lenovo machine\n (bsc#1031717).\n - alsa: hda: Drop useless WARN_ON() (bsc#1031717).\n - alsa: hda - Fix click noises on Samsung Ativ Book 8 (bsc#1031717).\n - alsa: hda - fix headset mic detection issue on a Dell machine\n (bsc#1031717).\n - alsa: hda - fix headset mic problem for Dell machines with alc236\n (bnc#1012382).\n - alsa: hda - fix headset mic problem for Dell machines with alc274\n (bsc#1031717).\n - alsa: hda - Fix headset microphone detection for ASUS N551 and N751\n (bsc#1031717).\n - alsa: hda - Fix mic regression by ASRock mobo fixup (bsc#1031717).\n - alsa: hda - Fix missing COEF init for ALC225/295/299 (bsc#1031717).\n - alsa: hda - Fix surround output pins for ASRock B150M mobo (bsc#1031717).\n - alsa: hda - No loopback on ALC299 codec (git-fixes).\n - alsa: hda - On-board speaker fixup on ACER Veriton (bsc#1031717).\n - alsa: hda/realtek - Add ALC256 HP depop function (bsc#1031717).\n - alsa: hda/realtek - Add default procedure for suspend and resume state\n (bsc#1031717).\n - alsa: hda/realtek: Add headset mic support for Intel NUC Skull Canyon\n (bsc#1031717).\n - alsa: hda/realtek - Add new codec ID ALC299 (bnc#1012382).\n - alsa: hda/realtek - Add support for Acer Aspire E5-475 headset mic\n (bsc#1031717).\n - alsa: hda/realtek - Add support for ALC1220 (bsc#1031717).\n - alsa: hda/realtek - Add support for ALC236/ALC3204 (bnc#1012382).\n - alsa: hda/realtek - Add support for headset MIC for ALC622 (bsc#1031717).\n - alsa: hda/realtek - ALC891 headset mode for Dell (bsc#1031717).\n - alsa: hda/realtek - change the location for one of two front microphones\n (bsc#1031717).\n - alsa: hda/realtek - Enable jack detection function for Intel ALC700\n (bsc#1031717).\n - alsa: hda/realtek - Fix ALC275 no sound issue (bsc#1031717).\n - alsa: hda/realtek - Fix ALC700 family no sound issue (bsc#1031717).\n - alsa: hda/realtek - Fix Dell AIO LineOut issue (bsc#1031717).\n - alsa: hda/realtek - Fix headset and mic on several Asus laptops with\n ALC256 (bsc#1031717).\n - alsa: hda/realtek - Fix headset mic and speaker on Asus X441SA/X441UV\n (bsc#1031717).\n - alsa: hda/realtek - fix headset mic detection for MSI MS-B120\n (bsc#1031717).\n - alsa: hda/realtek - Fix headset mic on several Asus laptops with ALC255\n (bsc#1031717).\n - alsa: hda/realtek - Fix pincfg for Dell XPS 13 9370 (bsc#1031717).\n - alsa: hda/realtek - Fix speaker support for Asus AiO ZN270IE\n (bsc#1031717).\n - alsa: hda/realtek - Fix typo of pincfg for Dell quirk (bsc#1031717).\n - alsa: hda/realtek - New codec device ID for ALC1220 (bsc#1031717).\n - alsa: hda/realtek - New codecs support for ALC215/ALC285/ALC289\n (bsc#1031717).\n - alsa: hda/realtek - New codec support for ALC257 (bsc#1031717).\n - alsa: hda/realtek - New codec support of ALC1220 (bsc#1031717).\n - alsa: hda/realtek - No loopback on ALC225/ALC295 codec (bsc#1031717).\n - alsa: hda/realtek - Remove ALC285 device ID (bsc#1031717).\n - alsa: hda/realtek - Support Dell headset mode for ALC3271 (bsc#1031717).\n - alsa: hda/realtek - Support headset mode for ALC234/ALC274/ALC294\n (bsc#1031717).\n - alsa: hda/realtek - There is no loopback mixer in the ALC234/274/294\n (bsc#1031717).\n - alsa: hda/realtek - Update headset mode for ALC225 (bsc#1031717).\n - alsa: hda/realtek - Update headset mode for ALC298 (bsc#1031717).\n - alsa: hda - Skip Realtek SKU check for Lenovo machines (bsc#1031717).\n - alsa: pcm: prevent UAF in snd_pcm_info (bsc#1031717).\n - alsa: pcm: update tstamp only if audio_tstamp changed (bsc#1031717).\n - alsa: rawmidi: Avoid racy info ioctl via ctl device (bsc#1031717).\n - alsa: seq: Avoid invalid lockdep class warning (bsc#1031717).\n - alsa: seq: Fix nested rwsem annotation for lockdep splat (bnc#1012382).\n - alsa: seq: Fix OSS sysex delivery in OSS emulation (bnc#1012382).\n - alsa: seq: Remove spurious WARN_ON() at timer check (bsc#1031717).\n - alsa: timer: Add missing mutex lock for compat ioctls (bnc#1012382).\n - alsa: timer: Remove kernel warning at compat ioctl error paths\n (bsc#1031717).\n - alsa: usb-audio: Add check return value for usb_string() (bsc#1031717).\n - alsa: usb-audio: Add sanity checks in v2 clock parsers (bsc#1031717).\n - alsa: usb-audio: Add sanity checks to FE parser (bsc#1031717).\n - alsa: usb-audio: Fix out-of-bound error (bsc#1031717).\n - alsa: usb-audio: Fix potential out-of-bound access at parsing SU\n (bsc#1031717).\n - alsa: usb-audio: Fix the missing ctl name suffix at parsing SU\n (bsc#1031717).\n - alsa: usb-audio: uac1: Invalidate ctl on interrupt (bsc#1031717).\n - alsa: vx: Do not try to update capture stream before running\n (bnc#1012382).\n - alsa: vx: Fix possible transfer overflow (bnc#1012382).\n - Always sign validate_negotiate_info reqs (bsc#1071009, fate#324404).\n - apei / ERST: Fix missing error handling in erst_reader() (bsc#1072556).\n - Apply generic ppc build fixes to vanilla (bsc#1070805)\n - arm64: dts: NS2: reserve memory for Nitro firmware (bnc#1012382).\n - arm64: ensure __dump_instr() checks addr_limit (bnc#1012382).\n - arm64: fix dump_instr when PAN and UAO are in use (bnc#1012382).\n - arm: 8715/1: add a private asm/unaligned.h (bnc#1012382).\n - arm: 8720/1: ensure dump_instr() checks addr_limit (bnc#1012382).\n - arm: 8721/1: mm: dump: check hardware RO bit for LPAE (bnc#1012382).\n - arm: 8722/1: mm: make STRICT_KERNEL_RWX effective for LPAE (bnc#1012382).\n - arm: crypto: reduce priority of bit-sliced AES cipher (bnc#1012382).\n - arm: dts: Fix am335x and dm814x scm syscon to probe children\n (bnc#1012382).\n - arm: dts: Fix compatible for ti81xx uarts for 8250 (bnc#1012382).\n - arm: dts: Fix omap3 off mode pull defines (bnc#1012382).\n - arm: dts: mvebu: pl310-cache disable double-linefill (bnc#1012382).\n - arm: dts: omap3: logicpd-torpedo-37xx-devkit: Fix MMC1 cd-gpio\n (bnc#1012382).\n - arm: Hide finish_arch_post_lock_switch() from modules (bsc#1068032).\n - arm: OMAP2+: Fix init for multiple quirks for the same SoC (bnc#1012382).\n - arm: omap2plus_defconfig: Fix probe errors on UARTs 5 and 6\n (bnc#1012382).\n - arm: pxa: Do not rely on public mmc header to include leds.h\n (bnc#1012382).\n - asm/sections: add helpers to check for section data (bsc#1063026).\n - asoc: adau17x1: Workaround for noise bug in ADC (bnc#1012382).\n - asoc: cs42l56: Fix reset GPIO name in example DT binding (bsc#1031717).\n - asoc: davinci-mcasp: Fix an error handling path in\n 'davinci_mcasp_probe()' (bsc#1031717).\n - asoc: fsl_ssi: AC'97 ops need regmap, clock and cleaning up on failure\n (bsc#1031717).\n - asoc: rsnd: do not double free kctrl (bnc#1012382).\n - asoc: samsung: Fix possible double iounmap on s3c24xx driver probe\n failure (bsc#1031717).\n - asoc: twl4030: fix child-node lookup (bsc#1031717).\n - asoc: wm_adsp: Do not overrun firmware file buffer when reading region\n data (bnc#1012382).\n - asoc: wm_adsp: Fix validation of firmware and coeff lengths\n (bsc#1031717).\n - ata: ATA_BMDMA should depend on HAS_DMA (bnc#1012382).\n - ata: fixes kernel crash while tracing ata_eh_link_autopsy event\n (bnc#1012382).\n - ata: SATA_HIGHBANK should depend on HAS_DMA (bnc#1012382).\n - ata: SATA_MV should depend on HAS_DMA (bnc#1012382).\n - ath10k: convert warning about non-existent OTP board id to debug message\n (git-fixes).\n - ath10k: fix a warning during channel switch with multiple vaps\n (bsc#1031717).\n - ath10k: fix board data fetch error message (bsc#1031717).\n - ath10k: fix diag_read to collect data for larger memory (bsc#1031717).\n - ath10k: fix incorrect txpower set by P2P_DEVICE interface (bnc#1012382).\n - ath10k: fix potential memory leak in ath10k_wmi_tlv_op_pull_fw_stats()\n (bnc#1012382).\n - ath10k: free cached fw bin contents when get board id fails\n (bsc#1031717).\n - ath10k: ignore configuring the incorrect board_id (bnc#1012382).\n - ath10k: set CTS protection VDEV param only if VDEV is up (bnc#1012382).\n - ath9k_htc: check for underflow in ath9k_htc_rx_msg() (bsc#1031717).\n - ath9k: off by one in ath9k_hw_nvram_read_array() (bsc#1031717).\n - autofs: do not fail mount for transient error (bsc#1065180).\n - autofs: fix careless error in recent commit (bnc#1012382 bsc#1065180).\n - backlight: adp5520: Fix error handling in adp5520_bl_probe()\n (bnc#1012382).\n - backlight: lcd: Fix race condition during register (bnc#1012382).\n - bcache: check ca->alloc_thread initialized before wake up it\n (bnc#1012382).\n - bcache: Fix building error on MIPS (bnc#1012382).\n - blacklist.conf: Add ath10k, mmc and rtl8192u commits (bsc#1031717)\n - blacklist.conf: Add drm/i915 blacklist (bsc#1031717)\n - blacklist.conf: added misc commits (bsc#1031717)\n - blacklist.conf: Add misc entries (bsc#1031717)\n - blacklist.conf: blacklist not-applicable patch (bsc#1071231)\n - blacklist.conf: Update blacklist (bsc#1031717)\n - blacklist.conf: Update iwlwifi blacklist (bsc#1031717)\n - blacklist.conf: yet another serial entry (bsc#1031717)\n - block: Fix a race between blk_cleanup_queue() and timeout handling\n (FATE#319965, bsc#964944).\n - Bluetooth: btusb: fix QCA Rome suspend/resume (bnc#1012382).\n - bnxt_en: Call firmware to approve the random VF MAC address (bsc#963575\n FATE#320144).\n - bnxt_en: Do not setup MAC address in bnxt_hwrm_func_qcaps() (bsc#963575\n FATE#320144).\n - bnxt_en: Fix possible corrupted NVRAM parameters from firmware response\n (bsc#963575 FATE#320144).\n - bnxt_en: Fix VF PCIe link speed and width logic (bsc#963575 FATE#320144).\n - bnxt_en: Re-arrange bnxt_hwrm_func_qcaps() (bsc#963575 FATE#320144).\n - bnxt_en: use eth_hw_addr_random() (bsc#963575 FATE#320144).\n - bonding: discard lowest hash bit for 802.3ad layer3+4 (bnc#1012382).\n - bpf: prevent speculative execution in eBPF interpreter (bnc#1068032).\n - brcmfmac: remove setting IBSS mode when stopping AP (bnc#1012382).\n - bt8xx: fix memory leak (bnc#1012382).\n - btrfs: clear space cache inode generation always (bnc#1012382).\n - btrfs: Fix typo in may_commit_transaction Rather than comparing the\n result of the percpu comparison I was comparing the value of the percpu\n counter against 0 or 1.\n - btrfs: return the actual error value from from btrfs_uuid_tree_iterate\n (bnc#1012382).\n - can: c_can: do not indicate triple sampling support for D_CAN\n (bnc#1012382).\n - can: kvaser_usb: Correct return value in printout (bnc#1012382).\n - can: kvaser_usb: Ignore CMD_FLUSH_QUEUE_REPLY messages (bnc#1012382).\n - can: sun4i: fix loopback mode (bnc#1012382).\n - can: sun4i: handle overrun in RX FIFO (bnc#1012382).\n - carl9170: prevent speculative execution (bnc#1068032).\n - cdc_ncm: Set NTB format again after altsetting switch for Huawei devices\n (bnc#1012382).\n - ceph: unlock dangling spinlock in try_flush_caps() (bsc#1065639).\n - cgroup, net_cls: iterate the fds of only the tasks which are being\n migrated (bnc#1064926).\n - Check cmdline_find_option() retval properly and use boot_cpu_has().\n - cifs: add build_path_from_dentry_optional_prefix() (fate#323482)\n - cifs: Add capability to decrypt big read responses (FATE#324404). Allow\n to decrypt transformed packets that are bigger than the big buffer size.\n In particular it is used for read responses that can only exceed the big\n buffer size.\n - cifs: Add capability to transform requests before sending (FATE#324404).\n This will allow us to do protocol specific tranformations of packets\n before sending to the server. For SMB3 it can be used to support\n encryption.\n - cifs: Add copy into pages callback for a read operation (FATE#324404).\n Since we have two different types of reads (pagecache and direct) we\n need to process such responses differently after decryption of a packet.\n The change allows to specify a callback that copies a read payload data\n into preallocated pages.\n - cifs: Add mid handle callback (FATE#324404). We need to process read\n responses differently because the data should go directly into\n preallocated pages. This can be done by specifying a mid handle callback.\n - cifs: Add soft dependencies (FATE#324404). List soft dependencies of\n cifs so that mkinitrd and dracut can include the required helper modules.\n - cifs: Add transform header handling callbacks (FATE#324404). We need to\n recognize and parse transformed packets in demultiplex thread to find a\n corresponsing mid and process it further.\n - cifs: add use_ipc flag to SMB2_ioctl() (fate#323482)\n - cifs: Allow to switch on encryption with seal mount option\n (FATE#324404). This allows users to inforce encryption for SMB3 shares\n if a server supports it.\n - cifs: check MaxPathNameComponentLength != 0 before using it\n (bnc#1012382).\n - cifs: Decrypt and process small encrypted packets (FATE#324404). Allow\n to decrypt transformed packets, find a corresponding mid and process as\n usual further.\n - cifs: do not bother with kmap on read_pages side (FATE#324404). just do\n ITER_BVEC recvmsg\n - cifs: Enable encryption during session setup phase (FATE#324404). In\n order to allow encryption on SMB connection we need to exchange a\n session key and generate encryption and decryption keys.\n - cifs: Encrypt SMB3 requests before sending (FATE#324404). This change\n allows to encrypt packets if it is required by a server for SMB sessions\n or tree connections.\n - cifs: Fix some return values in case of error in 'crypt_message'\n (fate#324404).\n - cifs: Fix sparse warnings (fate#323482)\n - cifs: implement get_dfs_refer for SMB2+ (fate#323482)\n - cifs: let ses->ipc_tid hold smb2 TreeIds (fate#323482)\n - cifs: Make send_cancel take rqst as argument (FATE#324404).\n - cifs: Make SendReceive2() takes resp iov (FATE#324404). Now SendReceive2\n frees the first iov and returns a response buffer in it that increases a\n code complexity. Simplify this by making a caller responsible for\n freeing request buffer itself and returning a response buffer in a\n separate iov.\n - cifs: move DFS response parsing out of SMB1 code (fate#323482)\n - cifs: no need to wank with copying and advancing iovec on recvmsg side\n either (FATE#324404).\n - cifs: Only select the required crypto modules (FATE#324404). The sha256\n and cmac crypto modules are only needed for SMB2+, so move the select\n statements to config CIFS_SMB2. Also select CRYPTO_AES there as SMB2+\n needs it.\n - cifs: Prepare for encryption support (first part). Add decryption and\n encryption key generation. (FATE#324404).\n - cifs_readv_receive: use cifs_read_from_socket() (FATE#324404).\n - cifs: remove any preceding delimiter from prefix_path (fate#323482)\n - cifs: Send RFC1001 length in a separate iov (FATE#324404). In order to\n simplify further encryption support we need to separate RFC1001 length\n and SMB2 header when sending a request. Put the length field in iov[0]\n and the rest of the packet into following iovs.\n - cifs: Separate RFC1001 length processing for SMB2 read (FATE#324404).\n Allocate and initialize SMB2 read request without RFC1001 length field\n to directly call cifs_send_recv() rather than SendReceive2() in a read\n codepath.\n - cifs: Separate SMB2 header structure (FATE#324404). In order to support\n compounding and encryption we need to separate RFC1001 length field and\n SMB2 header structure because the protocol treats them differently. This\n change will allow to simplify parsing of such complex SMB2 packets\n further.\n - cifs: Separate SMB2 sync header processing (FATE#324404). Do not process\n RFC1001 length in smb2_hdr_assemble() because it is not a part of SMB2\n header. This allows to cleanup the code and adds a possibility combine\n several SMB2 packets into one for compounding.\n - cifs: set signing flag in SMB2+ TreeConnect if needed (fate#323482)\n - cifs: Simplify SMB2 and SMB311 dependencies (FATE#324404). * CIFS_SMB2\n depends on CIFS, which depends on INET and selects NLS. So these\n dependencies do not need to be repeated for CIFS_SMB2. * CIFS_SMB311\n depends on CIFS_SMB2, which depends on INET. So this dependency does not\n need to be repeated for CIFS_SMB311.\n - cifs: use DFS pathnames in SMB2+ Create requests (fate#323482)\n - clk: ti: dra7-atl-clock: fix child-node lookups (bnc#1012382).\n - clk: ti: dra7-atl-clock: Fix of_node reference counting (bnc#1012382).\n - cma: fix calculation of aligned offset (VM Functionality, bsc#1050060).\n - coda: fix 'kernel memory exposure attempt' in fsync (bnc#1012382).\n - crypto: vmx - disable preemption to enable vsx in aes_ctr.c\n (bnc#1012382).\n - crypto: x86/sha1-mb - fix panic due to unaligned access (bnc#1012382).\n - cw1200: prevent speculative execution (bnc#1068032).\n - cx231xx: Fix I2C on Internal Master 3 Bus (bnc#1012382).\n - cxgb4: Fix error codes in c4iw_create_cq() (bsc#1021424).\n - cxl: Fix DAR check & use REGION_ID instead of opencoding (bsc#1066223).\n - cxl: Fix leaking pid refs in some error paths (bsc#1066223).\n - cxl: Force context lock during EEH flow (bsc#1066223).\n - cxl: Prevent adapter reset if an active context exists (bsc#1066223).\n - cxl: Route eeh events to all drivers in cxl_pci_error_detected()\n (bsc#1066223).\n - Disable IPMI fix patches due to regression (bsc#1071833)\n - dmaengine: dmatest: warn user when dma test times out (bnc#1012382).\n - dmaengine: zx: set DMA_CYCLIC cap_mask bit (bnc#1012382).\n - dm bufio: fix integer overflow when limiting maximum cache size\n (bnc#1012382).\n - dm: fix race between dm_get_from_kobject() and __dm_destroy()\n (bnc#1012382).\n - drivers: dma-mapping: Do not leave an invalid area->pages pointer in\n dma_common_contiguous_remap() (Git-fixes, bsc#1065692).\n - drm/amdgpu: when dpm disabled, also need to stop/start vce (bnc#1012382).\n - drm/amdkfd: NULL dereference involving create_process() (bsc#1031717).\n - drm: Apply range restriction after color adjustment when allocation\n (bnc#1012382).\n - drm/armada: Fix compile fail (bnc#1012382).\n - drm: drm_minor_register(): Clean up debugfs on failure (bnc#1012382).\n - drm: gma500: fix logic error (bsc#1031717).\n - drm/i915/bxt: set min brightness from VBT (bsc#1031717).\n - drm/i915: Do not try indexed reads to alternate slave addresses\n (bsc#1031717).\n - drm/i915: fix backlight invert for non-zero minimum brightness\n (bsc#1031717).\n - drm/i915: Prevent zero length "index" write (bsc#1031717).\n - drm/i915: Read timings from the correct transcoder in\n intel_crtc_mode_get() (bsc#1031717).\n - drm/msm: fix an integer overflow test (bnc#1012382).\n - drm/msm: Fix potential buffer overflow issue (bnc#1012382).\n - drm/nouveau/gr: fallback to legacy paths during firmware lookup\n (bsc#1031717).\n - drm/omap: Fix error handling path in 'omap_dmm_probe()' (bsc#1031717).\n - drm/panel: simple: Add missing panel_simple_unprepare() calls\n (bsc#1031717).\n - drm/radeon: fix atombios on big endian (bnc#1012382).\n - drm/sti: sti_vtg: Handle return NULL error from devm_ioremap_nocache\n (bnc#1012382).\n - drm/vc4: Fix leak of HDMI EDID (bsc#1031717).\n - drm/vmwgfx: Fix Ubuntu 17.10 Wayland black screen issue (bnc#1012382).\n - e1000e: Avoid receiver overrun interrupt bursts (bsc#969470 FATE#319819).\n - e1000e: Fix e1000_check_for_copper_link_ich8lan return value\n (bsc#1073809).\n - e1000e: Fix error path in link detection (bnc#1012382).\n - e1000e: Fix return value test (bnc#1012382).\n - e1000e: Separate signaling for link check/link up (bnc#1012382).\n - ecryptfs: fix dereference of NULL user_key_payload (bnc#1012382).\n - eCryptfs: use after free in ecryptfs_release_messaging() (bsc#1012829).\n - eeprom: at24: check at24_read/write arguments (bnc#1012382).\n - epoll: avoid calling ep_call_nested() from ep_poll_safewake()\n (bsc#1056427).\n - epoll: remove ep_call_nested() from ep_eventpoll_poll() (bsc#1056427).\n - ext4: cleanup goto next group (bsc#1066285).\n - ext4: do not use stripe_width if it is not set (bnc#1012382).\n - ext4: fix interaction between i_size, fallocate, and delalloc after a\n crash (bnc#1012382).\n - ext4: fix stripe-unaligned allocations (bnc#1012382).\n - ext4: reduce lock contention in __ext4_new_inode (bsc#1066285).\n - extcon: palmas: Check the parent instance to prevent the NULL\n (bnc#1012382).\n - exynos4-is: fimc-is: Unmap region obtained by of_iomap() (bnc#1012382).\n - fealnx: Fix building error on MIPS (bnc#1012382).\n - fix a page leak in vhost_scsi_iov_to_sgl() error recovery (bnc#1012382).\n - Fix leak of validate_negotiate_info resp (bsc#1071009, fate#324404).\n - Fix NULL pointer deref in SMB2_tcon() (bsc#1071009, fate#324404).\n - Fix serial console on SNI RM400 machines (bsc#1031717).\n - Fix tracing sample code warning (bnc#1012382).\n - Fix validate_negotiate_info uninitialized mem (bsc#1071009, fate#324404).\n - fm10k: request reset when mbx->state changes (bnc#1012382).\n - fm10k: Use smp_rmb rather than read_barrier_depends (bnc#1012382).\n - fs/9p: Compare qid.path in v9fs_test_inode (bsc#1012829).\n - fscrypt: lock mutex before checking for bounce page pool (bnc#1012382).\n - fs: prevent speculative execution (bnc#1068032).\n - fuse: fix READDIRPLUS skipping an entry (bnc#1012382).\n - genwqe: Take R/W permissions into account when dealing with memory pages\n (bsc#1073090).\n - gpu: drm: mgag200: mgag200_main:- Handle error from pci_iomap\n (bnc#1012382).\n - hid: elo: clear BTN_LEFT mapping (bsc#1065866).\n - hsi: ssi_protocol: double free in ssip_pn_xmit() (bsc#1031717).\n - i2c: cadance: fix ctrl/addr reg write order (bsc#1031717).\n - i2c: imx: Use correct function to write to register (bsc#1031717).\n - i2c: riic: correctly finish transfers (bnc#1012382).\n - i2c: riic: fix restart condition (git-fixes).\n - i40e: Use smp_rmb rather than read_barrier_depends (bnc#1012382).\n - i40evf: Use smp_rmb rather than read_barrier_depends (bnc#1012382).\n - ib/core: Fix calculation of maximum RoCE MTU (bsc#1022595 FATE#322350).\n - ib/core: Namespace is mandatory input for address resolution\n (bsc#1022595 FATE#322350).\n - ib/ipoib: Change list_del to list_del_init in the tx object\n (bnc#1012382).\n - ib/ipoib: Clean error paths in add port (bsc#1022595 FATE#322350).\n - ib/ipoib: Prevent setting negative values to max_nonsrq_conn_qp\n (bsc#1022595 FATE#322350).\n - ib/ipoib: Remove double pointer assigning (bsc#1022595 FATE#322350).\n - ib/ipoib: Set IPOIB_NEIGH_TBL_FLUSH after flushed completion\n initialization (bsc#1022595 FATE#322350).\n - ib/mlx5: Fix RoCE Address Path fields (bsc#966170 FATE#320225 bsc#966172\n FATE#320226).\n - ibmvnic: Add netdev_dbg output for debugging (fate#323285).\n - ibmvnic: Add vnic client data to login buffer (bsc#1069942).\n - ibmvnic: Convert vnic server reported statistics to cpu endian\n (fate#323285).\n - ibmvnic: Enable scatter-gather support (bsc#1066382).\n - ibmvnic: Enable TSO support (bsc#1066382).\n - ibmvnic: Feature implementation of Vital Product Data (VPD) for the\n ibmvnic driver (bsc#1069942).\n - ibmvnic: Fix calculation of number of TX header descriptors\n (bsc#1066382).\n - ibmvnic: fix dma_mapping_error call (bsc#1069942).\n - ibmvnic: Fix failover error path for non-fatal resets (bsc#1066382).\n - ibmvnic: Implement .get_channels (fate#323285).\n - ibmvnic: Implement .get_ringparam (fate#323285).\n - ibmvnic: Implement per-queue statistics reporting (fate#323285).\n - ibmvnic: Include header descriptor support for ARP packets (bsc#1073912).\n - ibmvnic: Increase maximum number of RX/TX queues (bsc#1073912).\n - ibmvnic: Let users change net device features (bsc#1066382).\n - ibmvnic: Rename IBMVNIC_MAX_TX_QUEUES to IBMVNIC_MAX_QUEUES\n (bsc#1073912).\n - ibmvnic: Update reset infrastructure to support tunable parameters\n (bsc#1066382).\n - ib/srp: Avoid that a cable pull can trigger a kernel crash (bsc#1022595\n FATE#322350).\n - ib/srpt: Do not accept invalid initiator port names (bnc#1012382).\n - ib/uverbs: Fix device cleanup (bsc#1022595 FATE#322350).\n - ib/uverbs: Fix NULL pointer dereference during device removal\n (bsc#1022595 FATE#322350).\n - igb: close/suspend race in netif_device_detach (bnc#1012382).\n - igb: Fix hw_dbg logging in igb_update_flash_i210 (bnc#1012382).\n - igb: reset the PHY before reading the PHY ID (bnc#1012382).\n - igb: Use smp_rmb rather than read_barrier_depends (bnc#1012382).\n - igbvf: Use smp_rmb rather than read_barrier_depends (bnc#1012382).\n - iio: dummy: events: Add missing break (bsc#1031717).\n - iio: light: fix improper return value (bnc#1012382).\n - iio: trigger: free trigger resource correctly (bnc#1012382).\n - ima: do not update security.ima if appraisal status is not\n INTEGRITY_PASS (bnc#1012382).\n - input: ar1021_i2c - fix too long name in driver's device table\n (bsc#1031717).\n - input: edt-ft5x06 - fix setting gain, offset, and threshold via device\n tree (bsc#1031717).\n - input: elan_i2c - add ELAN060C to the ACPI table (bnc#1012382).\n - input: elan_i2c - add ELAN0611 to the ACPI table (bnc#1012382).\n - input: gtco - fix potential out-of-bound access (bnc#1012382).\n - input: mpr121 - handle multiple bits change of status register\n (bnc#1012382).\n - input: mpr121 - set missing event capability (bnc#1012382).\n - input: ti_am335x_tsc - fix incorrect step config for 5 wire touchscreen\n (bsc#1031717).\n - input: twl4030-pwrbutton - use correct device for irq request\n (bsc#1031717).\n - input: ucb1400_ts - fix suspend and resume handling (bsc#1031717).\n - input: uinput - avoid crash when sending FF request to device going away\n (bsc#1031717).\n - iommu/arm-smmu-v3: Clear prior settings when updating STEs (bnc#1012382).\n - iommu/vt-d: Do not register bus-notifier under dmar_global_lock\n (bsc#1069793).\n - ip6_gre: only increase err_count for some certain type icmpv6 in\n ip6gre_err (bnc#1012382).\n - ipip: only increase err_count for some certain type icmp in ipip_err\n (bnc#1012382).\n - ipmi: fix unsigned long underflow (bnc#1012382).\n - ipmi: Pick up slave address from SMBIOS on an ACPI device (bsc#1070006).\n - ipmi: Prefer ACPI system interfaces over SMBIOS ones (bsc#1070006).\n - ipmi_si: Clean up printks (bsc#1070006).\n - ipmi_si: fix memory leak on new_smi (bsc#1070006).\n - ipsec: do not ignore crypto err in ah4 input (bnc#1012382).\n - ipv6: flowlabel: do not leave opt->tot_len with garbage (bnc#1012382).\n - ipv6: only call ip6_route_dev_notify() once for NETDEV_UNREGISTER\n (bnc#1012382).\n - ipv6: prevent speculative execution (bnc#1068032).\n - ipvs: make drop_entry protection effective for SIP-pe (bsc#1056365).\n - isa: Prevent NULL dereference in isa_bus driver callbacks (bsc#1031717).\n - iscsi-target: Fix non-immediate TMR reference leak (bnc#1012382).\n - isofs: fix timestamps beyond 2027 (bnc#1012382).\n - iwlwifi: mvm: fix the coex firmware API (bsc#1031717).\n - iwlwifi: mvm: return -ENODATA when reading the temperature with the FW\n down (bsc#1031717).\n - iwlwifi: mvm: set the RTS_MIMO_PROT bit in flag mask when sending sta to\n fw (bsc#1031717).\n - iwlwifi: split the regulatory rules when the bandwidth flags require it\n (bsc#1031717).\n - ixgbe: add mask for 64 RSS queues (bnc#1012382).\n - ixgbe: do not disable FEC from the driver (bnc#1012382).\n - ixgbe: fix AER error handling (bnc#1012382).\n - ixgbe: Fix skb list corruption on Power systems (bnc#1012382).\n - ixgbe: handle close/suspend race with netif_device_detach/present\n (bnc#1012382).\n - ixgbe: Reduce I2C retry count on X550 devices (bnc#1012382).\n - ixgbevf: Use smp_rmb rather than read_barrier_depends (bnc#1012382).\n - kabi fix for new hash_cred function (bsc#1012917).\n - kABI: protect struct regulator_dev (kabi).\n - kABI: protect structs rt_rq+root_domain (kabi).\n - kABI: protect typedef rds_rdma_cookie_t (kabi).\n - kaiser: add "nokaiser" boot option, using ALTERNATIVE.\n - kaiser: align addition to x86/mm/Makefile.\n - kaiser: asm/tlbflush.h handle noPGE at lower level.\n - kaiser: cleanups while trying for gold link.\n - kaiser: Disable on Xen PV.\n - kaiser: do not set _PAGE_NX on pgd_none.\n - kaiser: drop is_atomic arg to kaiser_pagetable_walk().\n - kaiser: enhanced by kernel and user PCIDs.\n - kaiser: ENOMEM if kaiser_pagetable_walk() NULL.\n - kaiser: fix build and FIXME in alloc_ldt_struct().\n - kaiser: fix perf crashes.\n - kaiser: fix regs to do_nmi() ifndef CONFIG_KAISER.\n - kaiser: fix unlikely error in alloc_ldt_struct().\n - kaiser: KAISER depends on SMP.\n - kaiser: kaiser_flush_tlb_on_return_to_user() check PCID.\n - kaiser: kaiser_remove_mapping() move along the pgd.\n - kaiser: Kernel Address Isolation.\n - kaiser: load_new_mm_cr3() let SWITCH_USER_CR3 flush.\n - kaiser: load_new_mm_cr3() let SWITCH_USER_CR3 flush user.\n - kaiser: name that 0x1000 KAISER_SHADOW_PGD_OFFSET.\n - kaiser: paranoid_entry pass cr3 need to paranoid_exit.\n - kaiser: PCID 0 for kernel and 128 for user.\n - kaiser: _pgd_alloc() without __GFP_REPEAT to avoid stalls.\n - kaiser: stack map PAGE_SIZE at THREAD_SIZE-PAGE_SIZE.\n - kaiser: tidied up asm/kaiser.h somewhat.\n - kaiser: tidied up kaiser_add/remove_mapping slightly.\n - kaiser: use ALTERNATIVE instead of x86_cr3_pcid_noflush.\n - kaiser: vmstat show NR_KAISERTABLE as nr_overhead.\n - kaiser: x86_cr3_pcid_noflush and x86_cr3_pcid_user.\n - kernel-docs: unpack the source instead of using kernel-source\n (bsc#1057199).\n - kernel/sysctl.c: remove duplicate UINT_MAX check on\n do_proc_douintvec_conv() (bsc#1066470).\n - kernel/watchdog: Prevent false positives with turbo modes (bnc#1063516).\n - keys: do not revoke uninstantiated key in request_key_auth_new()\n (bsc#1031717).\n - keys: fix cred refcount leak in request_key_auth_new() (bsc#1031717).\n - keys: fix key refcount leak in keyctl_assume_authority() (bsc#1031717).\n - keys: fix key refcount leak in keyctl_read_key() (bsc#1031717).\n - keys: fix NULL pointer dereference during ASN.1 parsing [ver #2]\n (bnc#1012382).\n - keys: fix out-of-bounds read during ASN.1 parsing (bnc#1012382).\n - keys: return full count in keyring_read() if buffer is too small\n (bnc#1012382).\n - keys: trusted: fix writing past end of buffer in trusted_read()\n (bnc#1012382).\n - keys: trusted: sanitize all key material (bnc#1012382).\n - kvm: nVMX: set IDTR and GDTR limits when loading L1 host state\n (bnc#1012382).\n - kvm: PPC: Book 3S: XICS: correct the real mode ICP rejecting counter\n (bnc#1012382).\n - kvm: SVM: Do not intercept new speculative control MSRs (bsc#1068032).\n - kvm: SVM: obey guest PAT (bnc#1012382).\n - kvm: x86: Add speculative control CPUID support for guests (bsc#1068032).\n - kvm: x86: Exit to user-mode on #UD intercept when emulator requires\n (bnc#1012382).\n - kvm: x86: inject exceptions produced by x86_decode_insn (bnc#1012382).\n - kvm: x86: pvclock: Handle first-time write to pvclock-page contains\n random junk (bnc#1012382).\n - l2tp: check ps->sock before running pppol2tp_session_ioctl()\n (bnc#1012382).\n - libertas: Fix lbs_prb_rsp_limit_set() (bsc#1031717).\n - lib/mpi: call cond_resched() from mpi_powm() loop (bnc#1012382).\n - libnvdimm, namespace: fix label initialization to use valid seq numbers\n (bnc#1012382).\n - libnvdimm, namespace: make 'resource' attribute only readable by root\n (bnc#1012382).\n - libnvdimm, pfn: make 'resource' attribute only readable by root\n (FATE#319858).\n - lib/ratelimit.c: use deferred printk() version (bsc#979928).\n - locking/barriers: introduce new memory barrier gmb() (bnc#1068032).\n - mac80211: agg-tx: call drv_wake_tx_queue in proper context (bsc#1031717).\n - mac80211: do not compare TKIP TX MIC key in reinstall prevention\n (bsc#1066472).\n - mac80211: do not send SMPS action frame in AP mode when not needed\n (bsc#1031717).\n - mac80211: Fix addition of mesh configuration element (git-fixes).\n - mac80211: Fix BW upgrade for TDLS peers (bsc#1031717).\n - mac80211: fix mgmt-tx abort cookie and leak (bsc#1031717).\n - mac80211_hwsim: Fix memory leak in hwsim_new_radio_nl() (bsc#1031717).\n - mac80211: Remove invalid flag operations in mesh TSF synchronization\n (bnc#1012382).\n - mac80211: Remove unused 'beaconint_us' variable (bsc#1031717).\n - mac80211: Remove unused 'i' variable (bsc#1031717).\n - mac80211: Remove unused 'len' variable (bsc#1031717).\n - mac80211: Remove unused 'rates_idx' variable (bsc#1031717).\n - mac80211: Remove unused 'sband' and 'local' variables (bsc#1031717).\n - mac80211: Remove unused 'struct ieee80211_rx_status' ptr (bsc#1031717).\n - mac80211: Suppress NEW_PEER_CANDIDATE event if no room (bnc#1012382).\n - mac80211: TDLS: always downgrade invalid chandefs (bsc#1031717).\n - mac80211: TDLS: change BW calculation for WIDER_BW peers (bsc#1031717).\n - mac80211: use constant time comparison with keys (bsc#1066471).\n - media: au0828: fix RC_CORE dependency (bsc#1031717).\n - media: Do not do DMA on stack for firmware upload in the AS102 driver\n (bnc#1012382).\n - media: em28xx: calculate left volume level correctly (bsc#1031717).\n - media: mceusb: fix memory leaks in error path (bsc#1031717).\n - media: rc: check for integer overflow (bnc#1012382).\n - media: v4l2-ctrl: Fix flags field on Control events (bnc#1012382).\n - megaraid_sas: Do not fire MR_DCMD_PD_LIST_QUERY to controllers which do\n not support it (bsc#1027301).\n - mei: return error on notification request to a disconnected client\n (bnc#1012382).\n - mfd: ab8500-sysctrl: Handle probe deferral (bnc#1012382).\n - mfd: axp20x: Fix axp288 PEK_DBR and PEK_DBF irqs being swapped\n (bnc#1012382).\n - misc: panel: properly restore atomic counter on error path (bnc#1012382).\n - mmc: block: return error on failed mmc_blk_get() (bsc#1031717).\n - mmc: core: Do not leave the block driver in a suspended state\n (bnc#1012382).\n - mmc: core/mmci: restore pre/post_req behaviour (bsc#1031717).\n - mmc: dw_mmc: rockchip: Set the drive phase properly (bsc#1031717).\n - mm: check the return value of lookup_page_ext for all call sites\n (bnc#1068982).\n - mmc: host: omap_hsmmc: avoid possible overflow of timeout value\n (bsc#1031717).\n - mmc: host: omap_hsmmc: checking for NULL instead of IS_ERR()\n (bsc#1031717).\n - mmc: mediatek: Fixed size in dma_free_coherent (bsc#1031717).\n - mmc: s3cmci: include linux/interrupt.h for tasklet_struct (bnc#1012382).\n - mmc: sd: limit SD card power limit according to cards capabilities\n (bsc#1031717).\n - mm, hwpoison: fixup "mm: check the return value of lookup_page_ext for\n all call sites" (bnc#1012382).\n - mm/madvise.c: fix madvise() infinite loop under special circumstances\n (bnc#1070964).\n - mm/mmu_context, sched/core: Fix mmu_context.h assumption (bsc#1068032).\n - mm/page_alloc.c: broken deferred calculation (bnc#1068980).\n - mm, page_alloc: fix potential false positive in __zone_watermark_ok\n (Git-fixes, bsc#1068978).\n - mm/page_ext.c: check if page_ext is not prepared (bnc#1068982).\n - mm/page_owner: avoid null pointer dereference (bnc#1068982).\n - mm/pagewalk.c: report holes in hugetlb ranges (bnc#1012382).\n - mtd: nand: Fix writing mtdoops to nand flash (bnc#1012382).\n - net: 3com: typhoon: typhoon_init_one: fix incorrect return values\n (bnc#1012382).\n - net: 3com: typhoon: typhoon_init_one: make return values more specific\n (bnc#1012382).\n - net/9p: Switch to wait_event_killable() (bnc#1012382).\n - net: Allow IP_MULTICAST_IF to set index to L3 slave (bnc#1012382).\n - net: cdc_ether: fix divide by 0 on bad descriptors (bnc#1012382).\n - net: cdc_ncm: GetNtbFormat endian fix (git-fixes).\n - net: dsa: select NET_SWITCHDEV (bnc#1012382).\n - netfilter/ipvs: clear ipvs_property flag when SKB net namespace changed\n (bnc#1012382).\n - netfilter: nf_tables: fix oob access (bnc#1012382).\n - netfilter: nft_meta: deal with PACKET_LOOPBACK in netdev family\n (bnc#1012382).\n - netfilter: nft_queue: use raw_smp_processor_id() (bnc#1012382).\n - net: ibm: ibmvnic: constify vio_device_id (fate#323285).\n - netlink: add a start callback for starting a netlink dump (bnc#1012382).\n - net: mpls: prevent speculative execution (bnc#1068032).\n - net: qmi_wwan: fix divide by 0 on bad descriptors (bnc#1012382).\n - net/sctp: Always set scope_id in sctp_inet6_skb_msgname (bnc#1012382).\n - net/unix: do not show information about sockets from other namespaces\n (bnc#1012382).\n - nfc: fix device-allocation error return (bnc#1012382).\n - nfsd: deal with revoked delegations appropriately (bnc#1012382).\n - nfsd: Fix another OPEN stateid race (bnc#1012382).\n - nfsd: Fix stateid races between OPEN and CLOSE (bnc#1012382).\n - nfsd: Make init_open_stateid() a bit more whole (bnc#1012382).\n - nfs: Do not disconnect open-owner on NFS4ERR_BAD_SEQID (bsc#989261).\n - nfs: Fix typo in nomigration mount option (bnc#1012382).\n - nfs: Fix ugly referral attributes (bnc#1012382).\n - nfs: improve shinking of access cache (bsc#1012917).\n - nfs: revalidate "." etc correctly on "open" (bsc#1068951).\n - nfs: revalidate "." etc correctly on "open" (git-fixes). Fix References\n tag.\n - nfsv4: always set NFS_LOCK_LOST when a lock is lost (bsc#1068951).\n - nilfs2: fix race condition that causes file system corruption\n (bnc#1012382).\n - nvme: Fix memory order on async queue deletion (bnc#1012382).\n - ocfs2: fstrim: Fix start offset of first cluster group during fstrim\n (bnc#1012382).\n - ocfs2: should wait dio before inode lock in ocfs2_setattr()\n (bnc#1012382).\n - p54: prevent speculative execution (bnc#1068032).\n - packet: avoid panic in packet_getsockopt() (bnc#1012382).\n - parisc: Fix validity check of pointer size argument in new CAS\n implementation (bnc#1012382).\n - pci: Apply _HPX settings only to relevant devices (bnc#1012382).\n - pci: mvebu: Handle changes to the bridge windows while enabled\n (bnc#1012382).\n - perf tools: Fix build failure on perl script context (bnc#1012382).\n - perf tools: Only increase index if perf_evsel__new_idx() succeeds\n (bnc#1012382).\n - perf/x86/intel/bts: Fix exclusive event reference leak (git-fixes\n d2878d642a4ed).\n - phy: increase size of MII_BUS_ID_SIZE and bus_id (bnc#1012382).\n - pkcs#7: fix unitialized boolean 'want' (bnc#1012382).\n - platform/x86: acer-wmi: setup accelerometer when ACPI device was found\n (bsc#1031717).\n - platform/x86: hp-wmi: Do not shadow error values (bnc#1012382).\n - platform/x86: hp-wmi: Fix detection for dock and tablet mode\n (bnc#1012382).\n - platform/x86: hp-wmi: Fix error value for hp_wmi_tablet_state\n (bnc#1012382).\n - platform/x86: intel_mid_thermal: Fix module autoload (bnc#1012382).\n - platform/x86: sony-laptop: Fix error handling in sony_nc_setup_rfkill()\n (bsc#1031717).\n - pm / OPP: Add missing of_node_put(np) (bnc#1012382).\n - power: bq27xxx_battery: Fix bq27541 AveragePower register address\n (bsc#1031717).\n - power: bq27xxx: fix reading for bq27000 and bq27010 (bsc#1031717).\n - powercap: Fix an error code in powercap_register_zone() (bsc#1031717).\n - power: ipaq-micro-battery: freeing the wrong variable (bsc#1031717).\n - powerpc/64: Fix race condition in setting lock bit in idle/wakeup code\n (bsc#1066223).\n - powerpc/barrier: add gmb.\n - powerpc/bpf/jit: Disable classic BPF JIT on ppc64le (bsc#1066223).\n - powerpc/corenet: explicitly disable the SDHC controller on kmcoge4\n (bnc#1012382).\n - powerpc: Correct instruction code for xxlor instruction (bsc#1066223).\n - powerpc: Fix VSX enabling/flushing to also test MSR_FP and MSR_VEC\n (bsc#1066223).\n - powerpc/mm: Fix check of multiple 16G pages from device tree\n (bsc#1066223).\n - powerpc/mm: Fix virt_addr_valid() etc. on 64-bit hash (bsc#1066223).\n - powerpc/mm/hash64: Fix subpage protection with 4K HPTE config\n (bsc#1010201, bsc#1066223).\n - powerpc/mm/hash: Free the subpage_prot_table correctly (bsc#1066223).\n - powerpc/numa: Fix multiple bugs in memory_hotplug_max() (bsc#1066223).\n - powerpc/numa: Fix whitespace in hot_add_drconf_memory_max()\n (bsc#1066223).\n - powerpc/opal: Fix EBUSY bug in acquiring tokens (bsc#1066223).\n - powerpc/perf: Remove PPMU_HAS_SSLOT flag for Power8 (bsc#1066223).\n - powerpc/powernv/ioda: Fix endianness when reading TCEs (bsc#1066223).\n - powerpc/powernv: Make opal_event_shutdown() callable from IRQ context\n (bsc#1066223).\n - powerpc/pseries/vio: Dispose of virq mapping on vdevice unregister\n (bsc#1067888).\n - powerpc/pseries/vio: Dispose of virq mapping on vdevice unregister\n (bsc#1067888).\n - powerpc: Secure memory rfi flush (bsc#1068032).\n - powerpc/signal: Properly handle return value from uprobe_deny_signal()\n (bsc#1066223).\n - powerpc/sysrq: Fix oops whem ppmu is not registered (bsc#1066223).\n - power: supply: bq27xxx_battery: Fix register map for BQ27510 and BQ27520\n ("bsc#1069270").\n - power: supply: isp1704: Fix unchecked return value of devm_kzalloc\n (bsc#1031717).\n - power: supply: lp8788: prevent out of bounds array access (bsc#1031717).\n - power_supply: tps65217-charger: Fix NULL deref during property export\n (bsc#1031717).\n - ppp: fix race in ppp device destruction (bnc#1012382).\n - Prevent timer value 0 for MWAITX (bsc#1065717).\n - printk/console: Always disable boot consoles that use init memory before\n it is freed (bsc#1063026).\n - printk/console: Enhance the check for consoles using init memory\n (bsc#1063026).\n - printk: include <asm/sections.h> instead of <asm-generic/sections.h>\n (bsc#1063026).\n - printk: only unregister boot consoles when necessary (bsc#1063026).\n - pti: unbreak EFI (bsc#1074709).\n - ptrace: Add a new thread access check (bsc#1068032).\n - qla2xxx: prevent speculative execution (bnc#1068032).\n - quota: Check for register_shrinker() failure (bsc#1012829).\n - r8169: Do not increment tx_dropped in TX ring cleaning (bsc#1031717).\n - rbd: use GFP_NOIO for parent stat and data requests (bnc#1012382).\n - rdma/uverbs: Prevent leak of reserved field (bsc#1022595 FATE#322350).\n - rds: RDMA: return appropriate error on rdma map failures (bnc#1012382).\n - Redo encryption backport to fix pkt signing (bsc#1071009, fate#324404).\n - regulator: core: Limit propagation of parent voltage count and list\n (bsc#1070145).\n - regulator: fan53555: fix I2C device ids (bnc#1012382).\n - Revert "crypto: xts - Add ECB dependency" (bnc#1012382).\n - Revert "drm: bridge: add DT bindings for TI ths8135" (bnc#1012382).\n - Revert "drm/radeon: dont switch vt on suspend" (bnc#1012382).\n - Revert "ipsec: Fix aborted xfrm policy dump crash" (kabi).\n - Revert "netlink: add a start callback for starting a netlink dump"\n (kabi).\n - Revert "phy: increase size of MII_BUS_ID_SIZE and bus_id" (kabi).\n - Revert "sctp: do not peel off an assoc from one netns to another one"\n (bnc#1012382).\n - Revert "uapi: fix linux/rds.h userspace compilation errors"\n (bnc#1012382).\n - rpm/kernel-binary.spec.in: add the kernel-binary dependencies to\n kernel-binary-base (bsc#1060333).\n - rpm/kernel-binary.spec.in: Correct supplements for recent SLE products\n (bsc#1067494)\n - rpm/kernel-binary.spec.in: only rewrite modules.dep if non-zero in size\n (bsc#1056979).\n - rtc: ds1307: Fix relying on reset value for weekday (bsc#1031717).\n - rtc: ds1374: wdt: Fix issue with timeout scaling from secs to wdt ticks\n (bsc#1031717).\n - rtc: ds1374: wdt: Fix stop/start ioctl always returning -EINVAL\n (bsc#1031717).\n - rtc: rtc-nuc900: fix loop timeout test (bsc#1031717).\n - rtc: sa1100: fix unbalanced clk_prepare_enable/clk_disable_unprepare\n (bsc#1031717).\n - rt/fs/dcache: Convert s_anon_lock to a raw spinlock for RT\n - rtlwifi: fix uninitialized rtlhal->last_suspend_sec time (bnc#1012382).\n - rtlwifi: rtl8192ee: Fix memory leak when loading firmware (bnc#1012382).\n - rtlwifi: rtl8821ae: Fix HW_VAR_NAV_UPPER operation (bsc#1031717).\n - s390: add ppa to system call and program check path (bsc#1068032).\n - s390/dasd: check for device error pointer within state change interrupts\n (bnc#1012382).\n - s390/disassembler: add missing end marker for e7 table (bnc#1012382).\n - s390/disassembler: correct disassembly lines alignment (bsc#1070825).\n - s390/disassembler: increase show_code buffer size (bnc#1012382).\n - s390: fix transactional execution control register handling\n (bnc#1012382).\n - s390: introduce CPU alternatives.\n - s390: introduce CPU alternatives (bsc#1068032).\n - s390/kbuild: enable modversions for symbols exported from asm\n (bnc#1012382).\n - s390/qeth: issue STARTLAN as first IPA command (bnc#1012382).\n - s390/runtime instrumention: fix possible memory corruption (bnc#1012382).\n - s390/spinlock: add gmb memory barrier\n - s390/spinlock: add gmb memory barrier (bsc#1068032).\n - s390/spinlock: add ppa to system call path Signoff the s390 patches.\n - sched/core: Add switch_mm_irqs_off() and use it in the scheduler\n (bsc#1068032).\n - sched/core: Idle_task_exit() shouldn't use switch_mm_irqs_off()\n (bsc#1068032).\n - sched: Make resched_cpu() unconditional (bnc#1012382).\n - sched/rt: Do not pull from current CPU if only one CPU to pull\n (bnc#1022476).\n - sched/rt: Simplify the IPI based RT balancing logic (bnc#1012382).\n - scsi: aacraid: Process Error for response I/O (bnc#1012382).\n - scsi_devinfo: cleanly zero-pad devinfo strings (bsc#1062941).\n - scsi_dh_alua: skip RTPG for devices only supporting active/optimized\n (bsc#1064311).\n - scsi: ipr: Fix scsi-mq lockdep issue (bsc#1066213).\n - scsi: ipr: Set no_report_opcodes for RAID arrays (bsc#1066213).\n - scsi: libiscsi: fix shifting of DID_REQUEUE host byte (bsc#1056003).\n - scsi: lpfc: Add missing memory barrier (bnc#1012382).\n - scsi: lpfc: Clear the VendorVersion in the PLOGI/PLOGI ACC payload\n (bnc#1012382).\n - scsi: lpfc: Correct host name in symbolic_name field (bnc#1012382).\n - scsi: lpfc: Correct issue leading to oops during link reset\n (bnc#1012382).\n - scsi: lpfc: FCoE VPort enable-disable does not bring up the VPort\n (bnc#1012382).\n - scsi_scan: Exit loop if TUR to LUN0 fails with 0x05/0x25 (bsc#1063043).\n This is specific to FUJITSU ETERNUS_DX* targets. They can return\n "Illegal Request - Logical unit not supported" and processing should\n leave the timeout loop in this case.\n - scsi: scsi_devinfo: fixup string compare (bsc#1062941).\n - scsi: scsi_devinfo: handle non-terminated strings (bsc#1062941).\n - scsi: ses: check return code from ses_recv_diag() (bsc#1039616).\n - scsi: ses: Fixup error message 'failed to get diagnostic page\n 0xffffffea' (bsc#1039616).\n - scsi: ses: Fix wrong page error (bsc#1039616).\n - scsi: ses: make page2 support optional (bsc#1039616).\n - scsi: sg: Re-fix off by one in sg_fill_request_table() (bnc#1012382).\n - scsi: ufs: add capability to keep auto bkops always enabled\n (bnc#1012382).\n - scsi: ufs-qcom: Fix module autoload (bnc#1012382).\n - scsi: virtio_scsi: let host do exception handling (bsc#1060682).\n - scsi: zfcp: fix erp_action use-before-initialize in REC action trace\n (bnc#1012382).\n - sctp: add the missing sock_owned_by_user check in sctp_icmp_redirect\n (bnc#1012382).\n - sctp: do not peel off an assoc from one netns to another one\n (bnc#1012382).\n - sctp: do not peel off an assoc from one netns to another one\n (bnc#1012382).\n - sctp: reset owner sk for data chunks on out queues when migrating a sock\n (bnc#1012382).\n - security/keys: add CONFIG_KEYS_COMPAT to Kconfig (bnc#1012382).\n - selftests: firmware: add empty string and async tests (bnc#1012382).\n - selftests: firmware: send expected errors to /dev/null (bnc#1012382).\n - serial: 8250_fintek: Fix rs485 disablement on invalid ioctl()\n (bsc#1031717).\n - serial: 8250_uniphier: fix serial port index in private data\n (bsc#1031717).\n - serial: omap: Fix EFR write on RTS deassertion (bnc#1012382).\n - serial: Remove unused port type (bsc#1066045).\n - serial: sh-sci: Fix register offsets for the IRDA serial port\n (bnc#1012382).\n - smb2: Fix share type handling (bnc#1074392).\n - smb3: parsing for new snapshot timestamp mount parm (FATE#324404). New\n mount option "snapshot=<time>" to allow mounting an earlier version of\n the remote volume (if such a snapshot exists on the server). Note that\n eventually specifying a snapshot time of 1 will allow the user to mount\n the oldest snapshot. A subsequent patch add the processing for that and\n another for actually specifying the "time warp" create context on\n SMB2/SMB3 open. Check to make sure SMB2 negotiated, and ensure that we\n use a different tcon if mount same share twice but with different\n snaphshot times\n - spi: SPI_FSL_DSPI should depend on HAS_DMA (bnc#1012382).\n - spi: uapi: spidev: add missing ioctl header (bnc#1012382).\n - staging: iio: cdc: fix improper return value (bnc#1012382).\n - staging: lustre: hsm: stack overrun in hai_dump_data_field (bnc#1012382).\n - staging: lustre: llite: do not invoke direct_IO for the EOF case\n (bnc#1012382).\n - staging: lustre: ptlrpc: skip lock if export failed (bnc#1012382).\n - staging: r8712u: Fix Sparse warning in rtl871x_xmit.c (bnc#1012382).\n - staging: rtl8188eu: fix incorrect ERROR tags from logs (bnc#1012382).\n - staging: rtl8712: fixed little endian problem (bnc#1012382).\n - staging: rtl8712u: Fix endian settings for structs describing network\n packets (bnc#1012382).\n - sunrpc: add auth_unix hash_cred() function (bsc#1012917).\n - sunrpc: add generic_auth hash_cred() function (bsc#1012917).\n - sunrpc: add hash_cred() function to rpc_authops struct (bsc#1012917).\n - sunrpc: add RPCSEC_GSS hash_cred() function (bsc#1012917).\n - sunrpc: Fix tracepoint storage issues with svc_recv and svc_rqst_status\n (bnc#1012382).\n - sunrpc: replace generic auth_cred hash with auth-specific function\n (bsc#1012917).\n - sunrpc: use supplimental groups in auth hash (bsc#1012917).\n - target: fix ALUA state file path truncation (bsc#1071231).\n - target: Fix node_acl demo-mode + uncached dynamic shutdown regression\n (bnc#1012382).\n - target: fix PR state file path truncation (bsc#1071231).\n - target: Fix QUEUE_FULL + SCSI task attribute handling (bnc#1012382).\n - target/iscsi: Fix iSCSI task reassignment handling (bnc#1012382).\n - tcp/dccp: fix ireq->opt races (bnc#1012382).\n - tcp/dccp: fix lockdep splat in inet_csk_route_req() (bnc#1012382).\n - tcp/dccp: fix other lockdep splats accessing ireq_opt (bnc#1012382).\n - tcp: do not mangle skb->cb[] in tcp_make_synack() (bnc#1012382).\n - tcp: fix tcp_mtu_probe() vs highest_sack (bnc#1012382).\n - test: firmware_class: report errors properly on failure (bnc#1012382).\n - thermal/int340x: prevent speculative execution (bnc#1068032).\n - tipc: fix link attribute propagation bug (bnc#1012382).\n - tools: firmware: check for distro fallback udev cancel rule\n (bnc#1012382).\n - tracing/samples: Fix creation and deletion of simple_thread_fn creation\n (bnc#1012382).\n - tun: allow positive return values on dev_get_valid_name() call\n (bnc#1012382).\n - tun: call dev_get_valid_name() before register_netdevice() (bnc#1012382).\n - tun/tap: sanitize TUNSETSNDBUF input (bnc#1012382).\n - uapi: fix linux/rds.h userspace compilation error (bnc#1012382).\n - uapi: fix linux/rds.h userspace compilation errors (bnc#1012382).\n - udf: prevent speculative execution (bnc#1068032).\n - usb: Add delay-init quirk for Corsair K70 LUX keyboards (bnc#1012382).\n - usb: hcd: initialize hcd->flags to 0 when rm hcd (bnc#1012382).\n - usb: host: fix incorrect updating of offset (bsc#1047487).\n - usb: serial: garmin_gps: fix I/O after failed probe and remove\n (bnc#1012382).\n - usb: serial: garmin_gps: fix memory leak on probe errors (bnc#1012382).\n - usb: serial: qcserial: add pid/vid for Sierra Wireless EM7355 fw update\n (bnc#1012382).\n - usb: usbfs: compute urb->actual_length for isochronous (bnc#1012382).\n - usb: usbtest: fix NULL pointer dereference (bnc#1012382).\n - usb: xhci: Handle error condition in xhci_stop_device() (bnc#1012382).\n - userns: prevent speculative execution (bnc#1068032).\n - uvcvideo: prevent speculative execution (bnc#1068032).\n - vfs: expedite unmount (bsc#1024412).\n - video: fbdev: pmag-ba-fb: Remove bad `__init' annotation (bnc#1012382).\n - video: udlfb: Fix read EDID timeout (bsc#1031717).\n - vlan: fix a use-after-free in vlan_device_event() (bnc#1012382).\n - vsock: use new wait API for vsock_stream_sendmsg() (bnc#1012382).\n - vxlan: correctly handle ipv6.disable module parameter (bsc#1072962).\n - workqueue: Fix NULL pointer dereference (bnc#1012382).\n - workqueue: replace pool->manager_arb mutex with a flag (bnc#1012382).\n - x86/boot: Add early cmdline parsing for options with arguments.\n - x86/CPU/AMD: Add speculative control support for AMD (bsc#1068032).\n - x86/CPU/AMD: Make the LFENCE instruction serialized (bsc#1068032).\n - x86/CPU/AMD: Remove now unused definition of MFENCE_RDTSC feature\n (bsc#1068032).\n - x86/CPU: Check speculation control CPUID bit (bsc#1068032).\n - x86/decoder: Add new TEST instruction pattern (bnc#1012382).\n - x86/efi-bgrt: Fix kernel panic when mapping BGRT data (bnc#1012382).\n - x86/efi-bgrt: Replace early_memremap() with memremap() (bnc#1012382).\n - x86/efi: Build our own page table structures (bnc#1012382).\n - x86/efi: Hoist page table switching code into efi_call_virt()\n (bnc#1012382).\n - x86/enter: Add macros to set/clear IBRS and set IBPB (bsc#1068032).\n - x86/entry: Add a function to overwrite the RSB (bsc#1068032).\n - x86/entry: Stuff RSB for entry to kernel for non-SMEP platform\n (bsc#1068032).\n - x86/entry: Use IBRS on entry to kernel space (bsc#1068032).\n - x86/feature: Enable the x86 feature to control Speculation (bsc#1068032).\n - x86/idle: Disable IBRS when offlining a CPU and re-enable on wakeup\n (bsc#1068032).\n - x86/idle: Toggle IBRS when going idle (bsc#1068032).\n - x86/kaiser: Check boottime cmdline params.\n - x86/kaiser: Move feature detection up (bsc#1068032).\n - x86/kaiser: Reenable PARAVIRT.\n - x86/kaiser: Rename and simplify X86_FEATURE_KAISER handling.\n - x86/kvm: Add MSR_IA32_SPEC_CTRL and MSR_IA32_PRED_CMD to kvm\n (bsc#1068032).\n - x86/kvm: Flush IBP when switching VMs (bsc#1068032).\n - x86/kvm: Pad RSB on VM transition (bsc#1068032).\n - x86/kvm: Toggle IBRS on VM entry and exit (bsc#1068032).\n - x86/MCE/AMD: Always give panic severity for UC errors in kernel context\n (git-fixes bf80bbd7dcf5).\n - x86/microcode/AMD: Add support for fam17h microcode loading\n (bsc#1068032).\n - x86/microcode/intel: Disable late loading on model 79 (bnc#1012382).\n - x86/mm/64: Fix reboot interaction with CR4.PCIDE (bsc#1068032).\n - x86/mm: Add a 'noinvpcid' boot option to turn off INVPCID (bsc#1068032).\n - x86/mm: Add INVPCID helpers (bsc#1068032).\n - x86/mm: Add the 'nopcid' boot option to turn off PCID (bsc#1068032).\n - x86/mm: Build arch/x86/mm/tlb.c even on !SMP (bsc#1068032).\n - x86/mm: Enable CR4.PCIDE on supported systems (bsc#1068032).\n - x86/mm: Fix INVPCID asm constraint (bsc#1068032).\n - x86/mm: If INVPCID is available, use it to flush global mappings\n (bsc#1068032).\n - x86/mm: Make flush_tlb_mm_range() more predictable (bsc#1068032).\n - x86/mm: Only set IBPB when the new thread cannot ptrace current thread\n (bsc#1068032).\n - x86/mm/pat: Ensure cpa->pfn only contains page frame numbers\n (bnc#1012382).\n - x86/mm: Reimplement flush_tlb_page() using flush_tlb_mm_range()\n (bsc#1068032).\n - x86/mm: Remove flush_tlb() and flush_tlb_current_task() (bsc#1068032).\n - x86/mm: Remove the UP asm/tlbflush.h code, always use the (formerly) SMP\n code (bsc#1068032).\n - x86/mm, sched/core: Turn off IRQs in switch_mm() (bsc#1068032).\n - x86/mm, sched/core: Uninline switch_mm() (bsc#1068032).\n - x86/mm: Set IBPB upon context switch (bsc#1068032).\n - x86/MSR: Move native_*msr(.. u64) to msr.h (bsc#1068032).\n - x86/oprofile/ppro: Do not use __this_cpu*() in preemptible context\n (bnc#1012382).\n - x86/paravirt: Dont patch flush_tlb_single (bsc#1068032).\n - x86/spec: Add IBRS control functions (bsc#1068032).\n - x86/spec: Add "nospec" chicken bit (bsc#1068032).\n - x86/spec: Check CPUID direclty post microcode reload to support IBPB\n feature (bsc#1068032).\n - x86/spec_ctrl: Add an Indirect Branch Predictor barrier (bsc#1068032).\n - x86/spec_ctrl: Check whether IBPB is enabled before using it\n (bsc#1068032).\n - x86/spec_ctrl: Check whether IBRS is enabled before using it\n (bsc#1068032).\n - x86/svm: Add code to clear registers on VM exit (bsc#1068032).\n - x86/svm: Clobber the RSB on VM exit (bsc#1068032).\n - x86/svm: Set IBPB when running a different VCPU (bsc#1068032).\n - x86/svm: Set IBRS value on VM entry and exit (bsc#1068032).\n - x86/uaccess, sched/preempt: Verify access_ok() context (bnc#1012382).\n - xen: do not print error message in case of missing Xenstore entry\n (bnc#1012382).\n - xen/events: events_fifo: Do not use {get,put}_cpu() in\n xen_evtchn_fifo_init() (bnc#1065600).\n - xen: fix booting ballooned down hvm guest (bnc#1065600).\n - xen/gntdev: avoid out of bounds access in case of partial gntdev_mmap()\n (bnc#1012382).\n - xen/manage: correct return value check on xenbus_scanf() (bnc#1012382).\n - xen-netback: fix error handling output (bnc#1065600).\n - xen: x86: mark xen_find_pt_base as __init (bnc#1065600).\n - xen: xenbus driver must not accept invalid transaction ids (bnc#1012382).\n - zd1211rw: fix NULL-deref at probe (bsc#1031717).\n\n", "edition": 1, "modified": "2018-01-25T15:08:07", "published": "2018-01-25T15:08:07", "href": "http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00055.html", "id": "SUSE-SU-2018:0213-1", "type": "suse", "title": "Security update for the Linux Kernel (important)", "cvss": {"score": 7.2, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}]}
