SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2015:0529-1)

2015-05-20T00:00:00
ID SUSE_SU-2015-0529-1.NASL
Type nessus
Reporter Tenable
Modified 2017-12-28T00:00:00

Description

The SUSE Linux Enterprise 12 kernel was updated to 3.12.38 to receive various security and bugfixes.

This update contains the following feature enablements :

  • The remote block device (rbd) and ceph drivers have been enabled and are now supported. (FATE#318350) These can be used e.g. for accessing the SUSE Enterprise Storage product services.

  • Support for Intel Select Bay trail CPUs has been added. (FATE#316038)

Following security issues were fixed :

  • CVE-2014-9419: The __switch_to function in arch/x86/kernel/process_64.c in the Linux kernel through 3.18.1 did not ensure that Thread Local Storage (TLS) descriptors were loaded before proceeding with other steps, which made it easier for local users to bypass the ASLR protection mechanism via a crafted application that reads a TLS base address (bnc#911326).

  • CVE-2014-7822: A flaw was found in the way the Linux kernels splice() system call validated its parameters. On certain file systems, a local, unprivileged user could have used this flaw to write past the maximum file size, and thus crash the system.

  • CVE-2014-8160: The connection tracking module could be bypassed if a specific protocol module was not loaded, e.g. allowing SCTP traffic while the firewall should have filtered it.

  • CVE-2014-9584: The parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel before 3.18.2 did not validate a length value in the Extensions Reference (ER) System Use Field, which allowed local users to obtain sensitive information from kernel memory via a crafted iso9660 image (bnc#912654).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

                                        
                                            #
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from SUSE update advisory SUSE-SU-2015:0529-1.
# The text itself is copyright (C) SUSE.
#

include("compat.inc");

if (description)
{
  script_id(83702);
  script_version("$Revision: 2.9 $");
  script_cvs_date("$Date: 2017/12/28 14:55:14 $");

  script_cve_id("CVE-2014-3673", "CVE-2014-3687", "CVE-2014-7822", "CVE-2014-7841", "CVE-2014-8160", "CVE-2014-8559", "CVE-2014-9419", "CVE-2014-9584");
  script_bugtraq_id(70766, 70854, 70883, 71081, 71794, 71883, 72061, 72347);
  script_osvdb_id(113724, 113727, 114044, 114575, 116259, 116767, 117131, 117810);

  script_name(english:"SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2015:0529-1)");
  script_summary(english:"Checks rpm output for the updated packages.");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote SUSE host is missing one or more security updates."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"The SUSE Linux Enterprise 12 kernel was updated to 3.12.38 to receive
various security and bugfixes.

This update contains the following feature enablements :

  - The remote block device (rbd) and ceph drivers have been
    enabled and are now supported. (FATE#318350) These can
    be used e.g. for accessing the SUSE Enterprise Storage
    product services.

  - Support for Intel Select Bay trail CPUs has been added.
    (FATE#316038)

Following security issues were fixed :

  - CVE-2014-9419: The __switch_to function in
    arch/x86/kernel/process_64.c in the Linux kernel through
    3.18.1 did not ensure that Thread Local Storage (TLS)
    descriptors were loaded before proceeding with other
    steps, which made it easier for local users to bypass
    the ASLR protection mechanism via a crafted application
    that reads a TLS base address (bnc#911326).

  - CVE-2014-7822: A flaw was found in the way the Linux
    kernels splice() system call validated its parameters.
    On certain file systems, a local, unprivileged user
    could have used this flaw to write past the maximum file
    size, and thus crash the system.

  - CVE-2014-8160: The connection tracking module could be
    bypassed if a specific protocol module was not loaded,
    e.g. allowing SCTP traffic while the firewall should
    have filtered it.

  - CVE-2014-9584: The parse_rock_ridge_inode_internal
    function in fs/isofs/rock.c in the Linux kernel before
    3.18.2 did not validate a length value in the Extensions
    Reference (ER) System Use Field, which allowed local
    users to obtain sensitive information from kernel memory
    via a crafted iso9660 image (bnc#912654).

The update package also includes non-security fixes. See advisory for
details.

Note that Tenable Network Security has extracted the preceding
description block directly from the SUSE security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2014-3673.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2014-3687.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2014-7822.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2014-7841.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2014-8160.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2014-8559.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2014-9419.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://support.novell.com/security/cve/CVE-2014-9584.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/799216"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/800255"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/860346"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/875220"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/877456"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/884407"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/895805"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/896484"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/897736"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/898687"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/900270"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/902286"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/902346"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/902349"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/903640"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/904177"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/904883"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/904899"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/904901"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/905100"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/905304"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/905329"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/905482"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/905783"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/906196"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/907069"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/908069"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/908322"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/908825"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/908904"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/909829"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/910322"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/911326"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/912202"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/912654"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/912705"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/913059"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/914112"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/914126"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/914254"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/914291"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/914294"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/914300"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/914457"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/914464"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/914726"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/915188"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/915322"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/915335"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/915425"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/915454"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/915456"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/915550"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/915660"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/916107"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/916513"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/916646"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/917089"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/917128"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/918161"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/918255"
  );
  # https://www.suse.com/support/update/announcement/2015/suse-su-20150529-1.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?75cca7a0"
  );
  script_set_attribute(
    attribute:"solution", 
    value:
"To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product :

SUSE Linux Enterprise Workstation Extension 12 :

zypper in -t patch SUSE-SLE-WE-12-2015-130=1

SUSE Linux Enterprise Software Development Kit 12 :

zypper in -t patch SUSE-SLE-SDK-12-2015-130=1

SUSE Linux Enterprise Server 12 :

zypper in -t patch SUSE-SLE-SERVER-12-2015-130=1

SUSE Linux Enterprise Module for Public Cloud 12 :

zypper in -t patch SUSE-SLE-Module-Public-Cloud-12-2015-130=1

SUSE Linux Enterprise Live Patching 12 :

zypper in -t patch SUSE-SLE-Live-Patching-12-2015-130=1

SUSE Linux Enterprise Desktop 12 :

zypper in -t patch SUSE-SLE-DESKTOP-12-2015-130=1

To bring your system up-to-date, use 'zypper patch'."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:kernel-default");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:kernel-default-base");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:kernel-default-base-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:kernel-default-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:kernel-default-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:kernel-default-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:kernel-default-extra");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:kernel-default-extra-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:kernel-default-man");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:kernel-syms");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:kernel-xen");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:kernel-xen-base");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:kernel-xen-base-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:kernel-xen-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:kernel-xen-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:kernel-xen-devel");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:12");

  script_set_attribute(attribute:"patch_publication_date", value:"2015/02/20");
  script_set_attribute(attribute:"plugin_publication_date", value:"2015/05/20");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2015-2017 Tenable Network Security, Inc.");
  script_family(english:"SuSE Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/SuSE/release");
if (isnull(release) || release !~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "SUSE");
os_ver = eregmatch(pattern: "^(SLE(S|D)\d+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "SUSE");
os_ver = os_ver[1];
if (! ereg(pattern:"^(SLED12|SLES12)$", string:os_ver)) audit(AUDIT_OS_NOT, "SUSE SLED12 / SLES12", "SUSE " + os_ver);

if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if (cpu !~ "^i[3-6]86$" && "x86_64" >!< cpu && "s390x" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "SUSE " + os_ver, cpu);

sp = get_kb_item("Host/SuSE/patchlevel");
if (isnull(sp)) sp = "0";
if (os_ver == "SLES12" && (! ereg(pattern:"^(0)$", string:sp))) audit(AUDIT_OS_NOT, "SLES12 SP0", os_ver + " SP" + sp);
if (os_ver == "SLED12" && (! ereg(pattern:"^(0)$", string:sp))) audit(AUDIT_OS_NOT, "SLED12 SP0", os_ver + " SP" + sp);


flag = 0;
if (rpm_check(release:"SLES12", sp:"0", cpu:"x86_64", reference:"kernel-xen-3.12.38-44.1")) flag++;
if (rpm_check(release:"SLES12", sp:"0", cpu:"x86_64", reference:"kernel-xen-base-3.12.38-44.1")) flag++;
if (rpm_check(release:"SLES12", sp:"0", cpu:"x86_64", reference:"kernel-xen-base-debuginfo-3.12.38-44.1")) flag++;
if (rpm_check(release:"SLES12", sp:"0", cpu:"x86_64", reference:"kernel-xen-debuginfo-3.12.38-44.1")) flag++;
if (rpm_check(release:"SLES12", sp:"0", cpu:"x86_64", reference:"kernel-xen-debugsource-3.12.38-44.1")) flag++;
if (rpm_check(release:"SLES12", sp:"0", cpu:"x86_64", reference:"kernel-xen-devel-3.12.38-44.1")) flag++;
if (rpm_check(release:"SLES12", sp:"0", cpu:"s390x", reference:"kernel-default-man-3.12.38-44.1")) flag++;
if (rpm_check(release:"SLES12", sp:"0", reference:"kernel-default-3.12.38-44.1")) flag++;
if (rpm_check(release:"SLES12", sp:"0", reference:"kernel-default-base-3.12.38-44.1")) flag++;
if (rpm_check(release:"SLES12", sp:"0", reference:"kernel-default-base-debuginfo-3.12.38-44.1")) flag++;
if (rpm_check(release:"SLES12", sp:"0", reference:"kernel-default-debuginfo-3.12.38-44.1")) flag++;
if (rpm_check(release:"SLES12", sp:"0", reference:"kernel-default-debugsource-3.12.38-44.1")) flag++;
if (rpm_check(release:"SLES12", sp:"0", reference:"kernel-default-devel-3.12.38-44.1")) flag++;
if (rpm_check(release:"SLES12", sp:"0", reference:"kernel-syms-3.12.38-44.1")) flag++;
if (rpm_check(release:"SLED12", sp:"0", cpu:"x86_64", reference:"kernel-default-3.12.38-44.1")) flag++;
if (rpm_check(release:"SLED12", sp:"0", cpu:"x86_64", reference:"kernel-default-debuginfo-3.12.38-44.1")) flag++;
if (rpm_check(release:"SLED12", sp:"0", cpu:"x86_64", reference:"kernel-default-debugsource-3.12.38-44.1")) flag++;
if (rpm_check(release:"SLED12", sp:"0", cpu:"x86_64", reference:"kernel-default-devel-3.12.38-44.1")) flag++;
if (rpm_check(release:"SLED12", sp:"0", cpu:"x86_64", reference:"kernel-default-extra-3.12.38-44.1")) flag++;
if (rpm_check(release:"SLED12", sp:"0", cpu:"x86_64", reference:"kernel-default-extra-debuginfo-3.12.38-44.1")) flag++;
if (rpm_check(release:"SLED12", sp:"0", cpu:"x86_64", reference:"kernel-syms-3.12.38-44.1")) flag++;
if (rpm_check(release:"SLED12", sp:"0", cpu:"x86_64", reference:"kernel-xen-3.12.38-44.1")) flag++;
if (rpm_check(release:"SLED12", sp:"0", cpu:"x86_64", reference:"kernel-xen-debuginfo-3.12.38-44.1")) flag++;
if (rpm_check(release:"SLED12", sp:"0", cpu:"x86_64", reference:"kernel-xen-debugsource-3.12.38-44.1")) flag++;
if (rpm_check(release:"SLED12", sp:"0", cpu:"x86_64", reference:"kernel-xen-devel-3.12.38-44.1")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
  else security_hole(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "kernel");
}