SUSE SLES12 Security Update : kernel (SUSE-SU-2017:1247-1)

2017-05-12T00:00:00

Description

The SUSE Linux Enterprise 12 GA LTSS - CVE-2015-1350: The VFS subsystem in the Linux kernel - CVE-2016-2117: The atl2_probe function in - CVE-2016-3070: The trace_writeback_dirty_page - CVE-2016-5243: The tipc_nl_compat_link_dump function in - CVE-2016-7117: Use-after-free vulnerability in the __sys_recvmmsg function in net/socket.c in the Linux - CVE-2016-9588: arch/x86/kvm/vmx.c in the Linux kernel - CVE-2016-10044: The aio_mount function in fs/aio.c in - CVE-2016-10200: Race condition in the L2TPv3 IP - CVE-2016-10208: The ext4_fill_super function in - CVE-2017-2671: The ping_unhash function in - CVE-2017-5669: The do_shmat function in ipc/shm.c in the - CVE-2017-5897: The ip6gre_err function in - CVE-2017-5970: The ipv4_pktinfo_prepare function in - CVE-2017-5986: Race condition in the sctp_wait_for_sndbuf - CVE-2017-6074: The dccp_rcv_state_process function in - CVE-2017-6214: The tcp_splice_read function in - CVE-2017-6345: The LLC subsystem in the Linux kernel did - CVE-2017-6346: Race condition in net/packet/af_packet.c - CVE-2017-6348: The hashbin_delete function in - CVE-2017-6353: net/sctp/socket.c in the Linux kernel did - CVE-2017-7187: The sg_ioctl function in - CVE-2017-7261: The vmw_surface_define_ioctl function in - CVE-2017-7294: The vmw_surface_define_ioctl function in - CVE-2017-7308: The packet_set_ring function in - CVE-2017-7616: Incorrect error handling in the The update package also includes non-security Note that Tenable Network Security has extracted kernel was updated to receive various security and bugfixes. The following security bugs were fixed : provided an incomplete set of requirements for setattr operations that underspecifies removing extended privilege attributes, which allowed local users to cause a denial of service (capability stripping) via a failed invocation of a system call, as demonstrated by using chown to remove a capability from the ping or Wireshark dumpcap program (bnc#914939). drivers/net/ethernet/atheros/atlx/atl2.c in the Linux kernel incorrectly enabled scatter/gather I/O, which allowed remote attackers to obtain sensitive information from kernel memory by reading packet data (bnc#968697). implementation in include/trace/events/writeback.h in the Linux kernel improperly interacted with mm/migrate.c, which allowed local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by triggering a certain page move (bnc#979215). net/tipc/netlink_compat.c in the Linux kernel did not properly copy a certain string, which allowed local users to obtain sensitive information from kernel stack memory by reading a Netlink message (bnc#983212). kernel allowed remote attackers to execute arbitrary code via vectors involving a recvmmsg system call that is mishandled during error processing (bnc#1003077). mismanages the #BP and #OF exceptions, which allowed guest OS users to cause a denial of service (guest OS crash) by declining to handle an exception thrown by an L2 guest (bnc#1015703). the Linux kernel did not properly restrict execute access, which made it easier for local users to bypass intended SELinux W^X policy restrictions, and consequently gain privileges, via an io_setup system call (bnc#1023992). Encapsulation feature in the Linux kernel allowed local users to gain privileges or cause a denial of service (use-after-free) by making multiple bind system calls without properly ascertaining whether a socket has the SOCK_ZAPPED status, related to net/l2tp/l2tp_ip.c and net/l2tp/l2tp_ip6.c (bnc#1028415). fs/ext4/super.c in the Linux kernel did not properly validate meta block groups, which allowed physically proximate attackers to cause a denial of service (out-of-bounds read and system crash) via a crafted ext4 image (bnc#1023377). net/ipv4/ping.c in the Linux kernel is too late in obtaining a certain lock and consequently cannot ensure that disconnect function calls are safe, which allowed local users to cause a denial of service (panic) by leveraging access to the protocol value of IPPROTO_ICMP in a socket system call (bnc#1031003). Linux kernel did not restrict the address calculated by a certain rounding operation, which allowed local users to map page zero, and consequently bypass a protection mechanism that exists for the mmap system call, by making crafted shmget and shmat system calls in a privileged context (bnc#1026914). net/ipv6/ip6_gre.c in the Linux kernel allowed remote attackers to have unspecified impact via vectors involving GRE flags in an IPv6 packet, which trigger an out-of-bounds access (bnc#1023762). net/ipv4/ip_sockglue.c in the Linux kernel allowed attackers to cause a denial of service (system crash) via (1) an application that made crafted system calls or possibly (2) IPv4 traffic with invalid IP options (bnc#1024938). function in net/sctp/socket.c in the Linux kernel allowed local users to cause a denial of service (assertion failure and panic) via a multithreaded application that peels off an association in a certain buffer-full state (bnc#1025235). net/dccp/input.c in the Linux kernel mishandled DCCP_PKT_REQUEST packet data structures in the LISTEN state, which allowed local users to obtain root privileges or cause a denial of service (double free) via an application that made an IPV6_RECVPKTINFO setsockopt system call (bnc#1026024). net/ipv4/tcp.c in the Linux kernel allowed remote attackers to cause a denial of service (infinite loop and soft lockup) via vectors involving a TCP packet with the URG flag (bnc#1026722). not ensure that a certain destructor exists in required circumstances, which allowed local users to cause a denial of service (BUG_ON) or possibly have unspecified other impact via crafted system calls (bnc#1027190). in the Linux kernel allowed local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via a multithreaded application that made PACKET_FANOUT setsockopt system calls (bnc#1027189). net/irda/irqueue.c in the Linux kernel improperly managed lock dropping, which allowed local users to cause a denial of service (deadlock) via crafted operations on IrDA devices (bnc#1027178). not properly restrict association peel-off operations during certain wait states, which allowed local users to cause a denial of service (invalid unlock and double free) via a multithreaded application. NOTE: this vulnerability exists because of an incorrect fix for CVE-2017-5986 (bnc#1027066). drivers/scsi/sg.c in the Linux kernel allowed local users to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a large command size in an SG_NEXT_CMD_LEN ioctl call, leading to out-of-bounds write access in the sg_write function (bnc#1030213). drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not check for a zero value of certain levels data, which allowed local users to cause a denial of service (ZERO_SIZE_PTR dereference, and GPF and possibly panic) via a crafted ioctl call for a /dev/dri/renderD* device (bnc#1031052). drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not validate addition of certain levels data, which allowed local users to trigger an integer overflow and out-of-bounds write, and cause a denial of service (system hang or crash) or possibly gain privileges, via a crafted ioctl call for a /dev/dri/renderD* device (bnc#1031440). net/packet/af_packet.c in the Linux kernel did not properly validate certain block-size data, which allowed local users to cause a denial of service (overflow) or possibly have unspecified other impact via crafted system calls (bnc#1031579). set_mempolicy and mbind compat syscalls in mm/mempolicy.c in the Linux kernel allowed local users to obtain sensitive information from uninitialized stack data by triggering failure of a certain bitmap operation (bnc#1033336). fixes. See advisory for details. the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

{"id": "SUSE_SU-2017-1247-1.NASL", "vendorId": null, "type": "nessus", "bulletinFamily": "scanner", "title": "SUSE SLES12 Security Update : kernel (SUSE-SU-2017:1247-1)", "description": "The SUSE Linux Enterprise 12 GA LTSS kernel was updated to receive various security and bugfixes. The following security bugs were fixed :\n\n - CVE-2015-1350: The VFS subsystem in the Linux kernel provided an incomplete set of requirements for setattr operations that underspecifies removing extended privilege attributes, which allowed local users to cause a denial of service (capability stripping) via a failed invocation of a system call, as demonstrated by using chown to remove a capability from the ping or Wireshark dumpcap program (bnc#914939).\n\n - CVE-2016-2117: The atl2_probe function in drivers/net/ethernet/atheros/atlx/atl2.c in the Linux kernel incorrectly enabled scatter/gather I/O, which allowed remote attackers to obtain sensitive information from kernel memory by reading packet data (bnc#968697).\n\n - CVE-2016-3070: The trace_writeback_dirty_page implementation in include/trace/events/writeback.h in the Linux kernel improperly interacted with mm/migrate.c, which allowed local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by triggering a certain page move (bnc#979215).\n\n - CVE-2016-5243: The tipc_nl_compat_link_dump function in net/tipc/netlink_compat.c in the Linux kernel did not properly copy a certain string, which allowed local users to obtain sensitive information from kernel stack memory by reading a Netlink message (bnc#983212).\n\n - CVE-2016-7117: Use-after-free vulnerability in the\n __sys_recvmmsg function in net/socket.c in the Linux kernel allowed remote attackers to execute arbitrary code via vectors involving a recvmmsg system call that is mishandled during error processing (bnc#1003077).\n\n - CVE-2016-9588: arch/x86/kvm/vmx.c in the Linux kernel mismanages the #BP and #OF exceptions, which allowed guest OS users to cause a denial of service (guest OS crash) by declining to handle an exception thrown by an L2 guest (bnc#1015703).\n\n - CVE-2016-10044: The aio_mount function in fs/aio.c in the Linux kernel did not properly restrict execute access, which made it easier for local users to bypass intended SELinux W^X policy restrictions, and consequently gain privileges, via an io_setup system call (bnc#1023992).\n\n - CVE-2016-10200: Race condition in the L2TPv3 IP Encapsulation feature in the Linux kernel allowed local users to gain privileges or cause a denial of service (use-after-free) by making multiple bind system calls without properly ascertaining whether a socket has the SOCK_ZAPPED status, related to net/l2tp/l2tp_ip.c and net/l2tp/l2tp_ip6.c (bnc#1028415).\n\n - CVE-2016-10208: The ext4_fill_super function in fs/ext4/super.c in the Linux kernel did not properly validate meta block groups, which allowed physically proximate attackers to cause a denial of service (out-of-bounds read and system crash) via a crafted ext4 image (bnc#1023377).\n\n - CVE-2017-2671: The ping_unhash function in net/ipv4/ping.c in the Linux kernel is too late in obtaining a certain lock and consequently cannot ensure that disconnect function calls are safe, which allowed local users to cause a denial of service (panic) by leveraging access to the protocol value of IPPROTO_ICMP in a socket system call (bnc#1031003).\n\n - CVE-2017-5669: The do_shmat function in ipc/shm.c in the Linux kernel did not restrict the address calculated by a certain rounding operation, which allowed local users to map page zero, and consequently bypass a protection mechanism that exists for the mmap system call, by making crafted shmget and shmat system calls in a privileged context (bnc#1026914).\n\n - CVE-2017-5897: The ip6gre_err function in net/ipv6/ip6_gre.c in the Linux kernel allowed remote attackers to have unspecified impact via vectors involving GRE flags in an IPv6 packet, which trigger an out-of-bounds access (bnc#1023762).\n\n - CVE-2017-5970: The ipv4_pktinfo_prepare function in net/ipv4/ip_sockglue.c in the Linux kernel allowed attackers to cause a denial of service (system crash) via (1) an application that made crafted system calls or possibly (2) IPv4 traffic with invalid IP options (bnc#1024938).\n\n - CVE-2017-5986: Race condition in the sctp_wait_for_sndbuf function in net/sctp/socket.c in the Linux kernel allowed local users to cause a denial of service (assertion failure and panic) via a multithreaded application that peels off an association in a certain buffer-full state (bnc#1025235).\n\n - CVE-2017-6074: The dccp_rcv_state_process function in net/dccp/input.c in the Linux kernel mishandled DCCP_PKT_REQUEST packet data structures in the LISTEN state, which allowed local users to obtain root privileges or cause a denial of service (double free) via an application that made an IPV6_RECVPKTINFO setsockopt system call (bnc#1026024).\n\n - CVE-2017-6214: The tcp_splice_read function in net/ipv4/tcp.c in the Linux kernel allowed remote attackers to cause a denial of service (infinite loop and soft lockup) via vectors involving a TCP packet with the URG flag (bnc#1026722).\n\n - CVE-2017-6345: The LLC subsystem in the Linux kernel did not ensure that a certain destructor exists in required circumstances, which allowed local users to cause a denial of service (BUG_ON) or possibly have unspecified other impact via crafted system calls (bnc#1027190).\n\n - CVE-2017-6346: Race condition in net/packet/af_packet.c in the Linux kernel allowed local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via a multithreaded application that made PACKET_FANOUT setsockopt system calls (bnc#1027189).\n\n - CVE-2017-6348: The hashbin_delete function in net/irda/irqueue.c in the Linux kernel improperly managed lock dropping, which allowed local users to cause a denial of service (deadlock) via crafted operations on IrDA devices (bnc#1027178).\n\n - CVE-2017-6353: net/sctp/socket.c in the Linux kernel did not properly restrict association peel-off operations during certain wait states, which allowed local users to cause a denial of service (invalid unlock and double free) via a multithreaded application. NOTE: this vulnerability exists because of an incorrect fix for CVE-2017-5986 (bnc#1027066).\n\n - CVE-2017-7187: The sg_ioctl function in drivers/scsi/sg.c in the Linux kernel allowed local users to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a large command size in an SG_NEXT_CMD_LEN ioctl call, leading to out-of-bounds write access in the sg_write function (bnc#1030213).\n\n - CVE-2017-7261: The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not check for a zero value of certain levels data, which allowed local users to cause a denial of service (ZERO_SIZE_PTR dereference, and GPF and possibly panic) via a crafted ioctl call for a /dev/dri/renderD* device (bnc#1031052).\n\n - CVE-2017-7294: The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not validate addition of certain levels data, which allowed local users to trigger an integer overflow and out-of-bounds write, and cause a denial of service (system hang or crash) or possibly gain privileges, via a crafted ioctl call for a /dev/dri/renderD* device (bnc#1031440).\n\n - CVE-2017-7308: The packet_set_ring function in net/packet/af_packet.c in the Linux kernel did not properly validate certain block-size data, which allowed local users to cause a denial of service (overflow) or possibly have unspecified other impact via crafted system calls (bnc#1031579).\n\n - CVE-2017-7616: Incorrect error handling in the set_mempolicy and mbind compat syscalls in mm/mempolicy.c in the Linux kernel allowed local users to obtain sensitive information from uninitialized stack data by triggering failure of a certain bitmap operation (bnc#1033336).\n\nThe update package also includes non-security fixes. See advisory for details.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "published": "2017-05-12T00:00:00", "modified": "2021-01-06T00:00:00", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {"cvssV2": {"version": "2.0", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "accessVector": "NETWORK", "accessComplexity": "LOW", "authentication": "NONE", "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "baseScore": 10.0}, "severity": "HIGH", "exploitabilityScore": 10.0, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}, "cvss3": {"cvssV3": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "exploitabilityScore": 3.9, "impactScore": 5.9}, "href": "https://www.tenable.com/plugins/nessus/100150", "reporter": "This script is Copyright (C) 2017-2021 and is owned by Tenable, Inc. or an Affiliate thereof.", "references": ["https://www.suse.com/security/cve/CVE-2016-2117/", "https://bugzilla.suse.com/show_bug.cgi?id=1021762", "https://www.suse.com/security/cve/CVE-2017-6074/", "https://www.suse.com/security/cve/CVE-2017-5669/", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7294", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7261", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1350", "https://www.suse.com/security/cve/CVE-2017-6345/", "https://bugzilla.suse.com/show_bug.cgi?id=1028895", "https://bugzilla.suse.com/show_bug.cgi?id=1023992", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5897", "https://bugzilla.suse.com/show_bug.cgi?id=1030901", "https://bugzilla.suse.com/show_bug.cgi?id=1023762", "https://bugzilla.suse.com/show_bug.cgi?id=1030118", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5243", "https://www.suse.com/security/cve/CVE-2016-3070/", "https://www.suse.com/security/cve/CVE-2017-5970/", "https://www.suse.com/security/cve/CVE-2017-6348/", "https://www.suse.com/security/cve/CVE-2017-7187/", "https://bugzilla.suse.com/show_bug.cgi?id=1003077", "https://www.suse.com/security/cve/CVE-2017-6353/", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10208", "https://bugzilla.suse.com/show_bug.cgi?id=968697", "https://bugzilla.suse.com/show_bug.cgi?id=1023377", "https://bugzilla.suse.com/show_bug.cgi?id=989056", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7616", "https://www.suse.com/security/cve/CVE-2017-7308/", "https://www.suse.com/security/cve/CVE-2017-5897/", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2671", "https://bugzilla.suse.com/show_bug.cgi?id=1015703", "https://bugzilla.suse.com/show_bug.cgi?id=1033336", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7187", "https://www.suse.com/security/cve/CVE-2017-7294/", "https://www.suse.com/security/cve/CVE-2017-7261/", "https://bugzilla.suse.com/show_bug.cgi?id=1031579", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6345", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2117", "https://bugzilla.suse.com/show_bug.cgi?id=1026722", "https://bugzilla.suse.com/show_bug.cgi?id=1030213", "https://bugzilla.suse.com/show_bug.cgi?id=1031440", "https://bugzilla.suse.com/show_bug.cgi?id=979215", "https://bugzilla.suse.com/show_bug.cgi?id=1032344", "https://bugzilla.suse.com/show_bug.cgi?id=1027066", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5669", "https://bugzilla.suse.com/show_bug.cgi?id=1027149", "https://bugzilla.suse.com/show_bug.cgi?id=1021256", "https://bugzilla.suse.com/show_bug.cgi?id=1027190", "https://bugzilla.suse.com/show_bug.cgi?id=1031052", "https://bugzilla.suse.com/show_bug.cgi?id=1024938", "https://bugzilla.suse.com/show_bug.cgi?id=1027178", "https://bugzilla.suse.com/show_bug.cgi?id=983212", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6214", "https://www.suse.com/security/cve/CVE-2017-6214/", "https://www.suse.com/security/cve/CVE-2015-1350/", "https://bugzilla.suse.com/show_bug.cgi?id=1025235", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7308", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5986", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6074", "https://www.suse.com/security/cve/CVE-2017-5986/", "https://bugzilla.suse.com/show_bug.cgi?id=1031003", "https://bugzilla.suse.com/show_bug.cgi?id=1026024", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6346", "https://bugzilla.suse.com/show_bug.cgi?id=954763", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10200", "https://www.suse.com/security/cve/CVE-2016-9588/", "https://bugzilla.suse.com/show_bug.cgi?id=1027189", "https://www.suse.com/security/cve/CVE-2016-7117/", "https://bugzilla.suse.com/show_bug.cgi?id=1026914", "https://bugzilla.suse.com/show_bug.cgi?id=914939", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9588", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5970", "http://www.nessus.org/u?8f96323f", "https://www.suse.com/security/cve/CVE-2016-10200/", "https://www.suse.com/security/cve/CVE-2017-2671/", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6353", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10044", "https://www.suse.com/security/cve/CVE-2016-10208/", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3070", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7117", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6348", "https://www.suse.com/security/cve/CVE-2017-6346/", "https://bugzilla.suse.com/show_bug.cgi?id=1028415", "https://bugzilla.suse.com/show_bug.cgi?id=1029986", "https://www.suse.com/security/cve/CVE-2016-5243/", "https://www.suse.com/security/cve/CVE-2017-7616/", "https://www.suse.com/security/cve/CVE-2016-10044/"], "cvelist": ["CVE-2015-1350", "CVE-2016-10044", "CVE-2016-10200", "CVE-2016-10208", "CVE-2016-2117", "CVE-2016-3070", "CVE-2016-5243", "CVE-2016-7117", "CVE-2016-9588", "CVE-2017-2671", "CVE-2017-5669", "CVE-2017-5897", "CVE-2017-5970", "CVE-2017-5986", "CVE-2017-6074", "CVE-2017-6214", "CVE-2017-6345", "CVE-2017-6346", "CVE-2017-6348", "CVE-2017-6353", "CVE-2017-7187", "CVE-2017-7261", "CVE-2017-7294", "CVE-2017-7308", "CVE-2017-7616"], "immutableFields": [], "lastseen": "2023-01-20T15:06:29", "viewCount": 31, "enchantments": {"dependencies": {"references": [{"type": "amazon", "idList": ["ALAS-2016-694", "ALAS-2016-726", "ALAS-2017-805", "ALAS-2017-814", "ALAS-2017-828"]}, {"type": "android", "idList": ["ANDROID:CVE-2016-10200", "ANDROID:CVE-2016-7117"]}, {"type": "androidsecurity", "idList": ["ANDROID:2016-10-01", "ANDROID:2017-02-01", "ANDROID:2017-03-01", "ANDROID:2017-07-01", "ANDROID:2017-09-01"]}, {"type": "archlinux", "idList": ["ASA-201702-17", "ASA-201702-18"]}, {"type": "avleonov", "idList": ["AVLEONOV:B1FBE34AF90D9EFE8FB00EA97D833417"]}, {"type": "centos", "idList": ["CESA-2016:2574", "CESA-2016:2962", "CESA-2017:0036", "CESA-2017:0086", "CESA-2017:0293", "CESA-2017:0294", "CESA-2017:0323", "CESA-2017:1308", "CESA-2017:1372", "CESA-2017:1615", "CESA-2017:1842", "CESA-2018:1062", "CESA-2018:1854"]}, {"type": "cloudfoundry", "idList": ["CFOUNDRY:2DD582EFE729277C37B69440AE62247E", "CFOUNDRY:357A3D675E310E16A6C343FB03145CD4", "CFOUNDRY:4A4E5BB1A59DD906E5D792B48A62CB13", "CFOUNDRY:59BA3F002F833C86F9D716E2A3575DCB", "CFOUNDRY:6D0A7CF1EF35A1C96485B4FC10A51978", "CFOUNDRY:897C3471765453EA05465A73CDC16BBB", "CFOUNDRY:DFAB11FD33D131C30AACDE9F4864FC0F", "CFOUNDRY:FC25CD097476B12ED115E08FD50F00D3"]}, {"type": "cve", "idList": ["CVE-2015-1350", "CVE-2016-10044", "CVE-2016-10200", "CVE-2016-10208", "CVE-2016-2117", "CVE-2016-3070", "CVE-2016-5243", "CVE-2016-7117", "CVE-2016-9588", "CVE-2017-15649", "CVE-2017-2671", "CVE-2017-5669", "CVE-2017-5897", "CVE-2017-5970", "CVE-2017-5986", "CVE-2017-6074", "CVE-2017-6214", "CVE-2017-6345", "CVE-2017-6346", "CVE-2017-6348", "CVE-2017-6353", "CVE-2017-7187", "CVE-2017-7261", "CVE-2017-7294", "CVE-2017-7308", "CVE-2017-7616"]}, {"type": "debian", "idList": ["DEBIAN:DLA-1200-1:A0B61", "DEBIAN:DLA-516-1:B66B7", "DEBIAN:DLA-772-1:EB721", "DEBIAN:DLA-833-1:91DAA", "DEBIAN:DLA-849-1:12807", "DEBIAN:DLA-922-1:854C7", "DEBIAN:DSA-3607-1:0BD6E", "DEBIAN:DSA-3607-1:29E1C", "DEBIAN:DSA-3791-1:0D4D5", "DEBIAN:DSA-3791-1:AE0FD", "DEBIAN:DSA-3804-1:0976E", "DEBIAN:DSA-3804-1:E7F94"]}, {"type": "debiancve", "idList": ["DEBIANCVE:CVE-2015-1350", "DEBIANCVE:CVE-2016-10044", "DEBIANCVE:CVE-2016-10200", "DEBIANCVE:CVE-2016-10208", "DEBIANCVE:CVE-2016-2117", "DEBIANCVE:CVE-2016-3070", "DEBIANCVE:CVE-2016-5243", "DEBIANCVE:CVE-2016-7117", "DEBIANCVE:CVE-2016-9588", "DEBIANCVE:CVE-2017-15649", "DEBIANCVE:CVE-2017-2671", "DEBIANCVE:CVE-2017-5669", "DEBIANCVE:CVE-2017-5897", "DEBIANCVE:CVE-2017-5970", "DEBIANCVE:CVE-2017-5986", "DEBIANCVE:CVE-2017-6074", "DEBIANCVE:CVE-2017-6214", "DEBIANCVE:CVE-2017-6345", "DEBIANCVE:CVE-2017-6346", "DEBIANCVE:CVE-2017-6348", "DEBIANCVE:CVE-2017-6353", "DEBIANCVE:CVE-2017-7187", "DEBIANCVE:CVE-2017-7261", "DEBIANCVE:CVE-2017-7294", "DEBIANCVE:CVE-2017-7308", "DEBIANCVE:CVE-2017-7616"]}, {"type": "exploitdb", "idList": ["EDB-ID:41458", "EDB-ID:44654", "EDB-ID:47168"]}, {"type": "exploitpack", "idList": ["EXPLOITPACK:4CB8F52029A7ED20CD5AD83DA63EF19E", "EXPLOITPACK:4EEB4BE9E101A3B6E5FA4A3FC9B06CCD", "EXPLOITPACK:66230DDA8228F7537211A7F78C05A763", "EXPLOITPACK:84D4B1F42D5DCA9623080EFFD17E58E1"]}, {"type": "f5", "idList": ["F5:K08478022", "F5:K11023978", "F5:K30737254", "F5:K31209433", "F5:K51201255", "F5:K60104355", "F5:K63771715", "F5:K68852819", "F5:K81211720", "F5:K82224417", "F5:K82508682", "F5:K92111011", "SOL51201255", "SOL92111011"]}, {"type": "fedora", "idList": ["FEDORA:042FF6294018", "FEDORA:1F466601E823", "FEDORA:25B9E61491E0", "FEDORA:26A1460C6317", "FEDORA:2CC39660F53B", "FEDORA:3D3EF633571E", "FEDORA:553DD615C92C", "FEDORA:5931760652B6", "FEDORA:5ADC96067305", "FEDORA:6437E61257FA", "FEDORA:65FAD61713B3", "FEDORA:76A6A60C79DB", "FEDORA:79A0B6175384", "FEDORA:7ED1D60A8F65", "FEDORA:8CDBE6067306", "FEDORA:B872461491E6", "FEDORA:B9A2260A96D5", "FEDORA:C8F1260321CA", "FEDORA:D953C601BFE1", "FEDORA:F17F2606731A"]}, {"type": "googleprojectzero", "idList": ["GOOGLEPROJECTZERO:9B79D262B5DA61A7E11F5134B546BA63"]}, {"type": "hackerone", "idList": ["H1:347282", "H1:684567"]}, {"type": "ibm", "idList": ["091C926DD3372A48BCEFCA3A598C2A54BAEA4FF0AC1ADA170D539846CF9E0B12", "0C9BE2F3A245999460BB6BC497E21EC27992E79FB4C1D769E6D1CF729AB33300", "0D95BD029EF7D61B7C200E5DCF5114404F54883607A0E5A132C410EA37160E69", "233226C0332001C81596C237819F64BB35F4B49297346F216B4DC90C72D26485", "289F46B747F4C8F26E8F8D17623E34EDE1DB7595184FCDCC87FEDCC356AC9965", "2ABC4CD376C07922A3144CF8116D979F4BDDE16EED9AADA11262FBF58C851DBF", "475B1D5AA0EDB6A4A0012EA2C2D64B9388A6ACC5779414E8E1A98AC9B641F6AF", "61EAA34D5E4645B71F124164E8135272DB3119CF3ABDC2864377B692FCF87527", "6B8D264C112CFCDDCE94E39A330DF7082557BFFF177349A0F825B791060643AF", "A0B51C5217767E75AB974BA93584FB1F969514BA8D7EE9EDD025C20F274C1D2F", "A18DD1594298170A7AF630CBFFA73E78138125D119FBC5D156128BBBD99A03EC", "A9C254F86614D2334E5A1624EEBD7497A5FA74BEC3159FA2530927B6C4A89585", "AF6E3EC9D5A5C3CF688EF87142347E0688A4AE1CB6831F92326966B86BF2D9C1", "B13E9CABE04A3A8E052E5DD7075F194AB2BDBB1AA759BCA55EBEBB657F688C5F", "B7EDA2450D13E204B60C3A3E7379E6FCCD587CB32FEB5041ADDA6CB8E3C44FC3", "CD9B5BF488F3327F1A5D08B8A25E9EF90D7304376F44A16FB3F05E06566E80FF", "F092FBBD34304315E258962CA397F72D24D88CD673A181734FDCE39754098484"]}, {"type": "kitploit", "idList": ["KITPLOIT:4462385753504235463"]}, {"type": "lenovo", "idList": ["LENOVO:PS500107-LENOVO-STORSELECT-DX8200C-HYPERSTORE-USE-AFTER-FREE-IN-THE-IPV6-IMPLEMENTATION-OF-THE-DCCP-PROTOCOL-IN-THE-LINUX-KERNEL-NOSID", "LENOVO:PS500107-NOSID", "LENOVO:PS500321-NOSID"]}, {"type": "mageia", "idList": ["MGAA-2016-0134", "MGASA-2016-0225", "MGASA-2016-0232", "MGASA-2016-0233", "MGASA-2016-0345", "MGASA-2016-0364", "MGASA-2017-0063", "MGASA-2017-0064", "MGASA-2017-0065", "MGASA-2017-0088", "MGASA-2017-0089", "MGASA-2017-0090", "MGASA-2017-0136", "MGASA-2017-0147", "MGASA-2017-0148"]}, {"type": "metasploit", "idList": ["MSF:EXPLOIT-LINUX-LOCAL-AF_PACKET_PACKET_SET_RING_PRIV_ESC-"]}, {"type": "myhack58", "idList": ["MYHACK58:62201783679", "MYHACK58:62201783692", "MYHACK58:62201787550"]}, {"type": "nessus", "idList": ["ALA_ALAS-2016-694.NASL", "ALA_ALAS-2016-726.NASL", "ALA_ALAS-2017-805.NASL", "ALA_ALAS-2017-814.NASL", "ALA_ALAS-2017-828.NASL", "CENTOS_RHSA-2016-2574.NASL", "CENTOS_RHSA-2016-2962.NASL", "CENTOS_RHSA-2017-0036.NASL", "CENTOS_RHSA-2017-0086.NASL", "CENTOS_RHSA-2017-0293.NASL", "CENTOS_RHSA-2017-0294.NASL", "CENTOS_RHSA-2017-0323.NASL", "CENTOS_RHSA-2017-1308.NASL", "CENTOS_RHSA-2017-1372.NASL", "CENTOS_RHSA-2017-1615.NASL", "CENTOS_RHSA-2017-1842.NASL", "CENTOS_RHSA-2018-1062.NASL", "CENTOS_RHSA-2018-1854.NASL", "DEBIAN_DLA-1200.NASL", "DEBIAN_DLA-516.NASL", "DEBIAN_DLA-772.NASL", "DEBIAN_DLA-833.NASL", "DEBIAN_DLA-849.NASL", "DEBIAN_DLA-922.NASL", "DEBIAN_DSA-3607.NASL", "DEBIAN_DSA-3791.NASL", "DEBIAN_DSA-3804.NASL", "EULEROS_SA-2016-1020.NASL", "EULEROS_SA-2016-1051.NASL", "EULEROS_SA-2017-1001.NASL", "EULEROS_SA-2017-1056.NASL", "EULEROS_SA-2017-1057.NASL", "EULEROS_SA-2017-1122.NASL", "EULEROS_SA-2017-1123.NASL", "EULEROS_SA-2017-1271.NASL", "EULEROS_SA-2019-1471.NASL", "EULEROS_SA-2019-1472.NASL", "EULEROS_SA-2019-1474.NASL", "EULEROS_SA-2019-1482.NASL", "EULEROS_SA-2019-1484.NASL", "EULEROS_SA-2019-1486.NASL", "EULEROS_SA-2019-1491.NASL", "EULEROS_SA-2019-1492.NASL", "EULEROS_SA-2019-1496.NASL", "EULEROS_SA-2019-1502.NASL", "EULEROS_SA-2019-1504.NASL", "EULEROS_SA-2019-1505.NASL", "EULEROS_SA-2019-1506.NASL", "EULEROS_SA-2019-1508.NASL", "EULEROS_SA-2019-1516.NASL", "EULEROS_SA-2019-1517.NASL", "EULEROS_SA-2019-1518.NASL", "EULEROS_SA-2019-1519.NASL", "EULEROS_SA-2019-1520.NASL", "EULEROS_SA-2019-1524.NASL", "EULEROS_SA-2019-1525.NASL", "EULEROS_SA-2019-1527.NASL", "EULEROS_SA-2019-1530.NASL", "EULEROS_SA-2019-1533.NASL", "EULEROS_SA-2019-1538.NASL", "EULEROS_SA-2019-2274.NASL", "EULEROS_SA-2019-2353.NASL", "EULEROS_SA-2019-2531.NASL", "EULEROS_SA-2019-2599.NASL", "EULEROS_SA-2019-2693.NASL", "EULEROS_SA-2020-1269.NASL", "EULEROS_SA-2021-2392.NASL", "F5_BIGIP_SOL11023978.NASL", "F5_BIGIP_SOL60104355.NASL", "F5_BIGIP_SOL68852819.NASL", "F5_BIGIP_SOL81211720.NASL", "F5_BIGIP_SOL82224417.NASL", "F5_BIGIP_SOL82508682.NASL", "FEDORA_2016-2B1F91E9BD.NASL", "FEDORA_2016-3DAF782DFA.NASL", "FEDORA_2016-80EDB9D511.NASL", "FEDORA_2016-DD895763AC.NASL", "FEDORA_2016-E0F3FCD7DF.NASL", "FEDORA_2017-0054C7B1F0.NASL", "FEDORA_2017-02174DF32F.NASL", "FEDORA_2017-26C9ECD7A4.NASL", "FEDORA_2017-2E1F3694B2.NASL", "FEDORA_2017-3456BA4C93.NASL", "FEDORA_2017-387FF46A66.NASL", "FEDORA_2017-3A9EC92DD6.NASL", "FEDORA_2017-4B9F61C68D.NASL", "FEDORA_2017-502CF68D68.NASL", "FEDORA_2017-787BC0D5B4.NASL", "FEDORA_2017-8E7549FB91.NASL", "FEDORA_2017-92D84F68CF.NASL", "FEDORA_2017-93DEC9EBA5.NASL", "FEDORA_2017-F519EBB3C4.NASL", "FEDORA_2017-FB89CA752A.NASL", "NEWSTART_CGSL_NS-SA-2019-0004_KERNEL.NASL", "NEWSTART_CGSL_NS-SA-2019-0076_KERNEL-RT.NASL", "NEWSTART_CGSL_NS-SA-2019-0077_KERNEL.NASL", "NEWSTART_CGSL_NS-SA-2019-0113_KERNEL.NASL", "NEWSTART_CGSL_NS-SA-2019-0143_KERNEL.NASL", "NEWSTART_CGSL_NS-SA-2019-0152_KERNEL.NASL", "OPENSUSE-2016-1227.NASL", "OPENSUSE-2016-1426.NASL", "OPENSUSE-2017-1194.NASL", "OPENSUSE-2017-1224.NASL", "OPENSUSE-2017-245.NASL", "OPENSUSE-2017-246.NASL", "OPENSUSE-2017-286.NASL", "OPENSUSE-2017-287.NASL", "OPENSUSE-2017-418.NASL", "OPENSUSE-2017-419.NASL", "OPENSUSE-2017-532.NASL", "OPENSUSE-2017-562.NASL", "ORACLELINUX_ELSA-2016-2574.NASL", "ORACLELINUX_ELSA-2016-2962.NASL", "ORACLELINUX_ELSA-2016-3587.NASL", "ORACLELINUX_ELSA-2016-3588.NASL", "ORACLELINUX_ELSA-2016-3589.NASL", "ORACLELINUX_ELSA-2016-3596.NASL", "ORACLELINUX_ELSA-2016-3644.NASL", "ORACLELINUX_ELSA-2016-3645.NASL", "ORACLELINUX_ELSA-2016-3646.NASL", "ORACLELINUX_ELSA-2016-3655.NASL", "ORACLELINUX_ELSA-2016-3656.NASL", "ORACLELINUX_ELSA-2016-3657.NASL", "ORACLELINUX_ELSA-2017-0036.NASL", "ORACLELINUX_ELSA-2017-0086.NASL", "ORACLELINUX_ELSA-2017-0293.NASL", "ORACLELINUX_ELSA-2017-0294.NASL", "ORACLELINUX_ELSA-2017-0323.NASL", "ORACLELINUX_ELSA-2017-1308-1.NASL", "ORACLELINUX_ELSA-2017-1308.NASL", "ORACLELINUX_ELSA-2017-1372.NASL", "ORACLELINUX_ELSA-2017-1615-1.NASL", "ORACLELINUX_ELSA-2017-1615.NASL", "ORACLELINUX_ELSA-2017-1842-1.NASL", "ORACLELINUX_ELSA-2017-1842.NASL", "ORACLELINUX_ELSA-2017-3520.NASL", "ORACLELINUX_ELSA-2017-3521.NASL", "ORACLELINUX_ELSA-2017-3522.NASL", "ORACLELINUX_ELSA-2017-3533.NASL", "ORACLELINUX_ELSA-2017-3534.NASL", "ORACLELINUX_ELSA-2017-3535.NASL", "ORACLELINUX_ELSA-2017-3539.NASL", "ORACLELINUX_ELSA-2017-3566.NASL", "ORACLELINUX_ELSA-2017-3567.NASL", "ORACLELINUX_ELSA-2017-3579.NASL", "ORACLELINUX_ELSA-2017-3580.NASL", "ORACLELINUX_ELSA-2017-3595.NASL", "ORACLELINUX_ELSA-2017-3605.NASL", "ORACLELINUX_ELSA-2017-3606.NASL", "ORACLELINUX_ELSA-2017-3607.NASL", "ORACLELINUX_ELSA-2017-3609.NASL", "ORACLELINUX_ELSA-2017-3636.NASL", "ORACLELINUX_ELSA-2017-3637.NASL", "ORACLELINUX_ELSA-2017-3651.NASL", "ORACLELINUX_ELSA-2017-3657.NASL", "ORACLELINUX_ELSA-2017-3658.NASL", "ORACLELINUX_ELSA-2017-3659.NASL", "ORACLELINUX_ELSA-2018-0151.NASL", "ORACLELINUX_ELSA-2018-1062.NASL", "ORACLELINUX_ELSA-2018-1854.NASL", "ORACLELINUX_ELSA-2018-4108.NASL", "ORACLELINUX_ELSA-2018-4161.NASL", "ORACLELINUX_ELSA-2018-4164.NASL", "ORACLELINUX_ELSA-2018-4172.NASL", "ORACLELINUX_ELSA-2020-5671.NASL", "ORACLELINUX_ELSA-2021-9486.NASL", "ORACLELINUX_ELSA-2021-9487.NASL", "ORACLELINUX_ELSA-2022-9969.NASL", "ORACLEVM_OVMSA-2016-0091.NASL", "ORACLEVM_OVMSA-2016-0092.NASL", "ORACLEVM_OVMSA-2016-0100.NASL", "ORACLEVM_OVMSA-2016-0158.NASL", "ORACLEVM_OVMSA-2016-0162.NASL", "ORACLEVM_OVMSA-2016-0163.NASL", "ORACLEVM_OVMSA-2016-0167.NASL", "ORACLEVM_OVMSA-2016-0179.NASL", "ORACLEVM_OVMSA-2016-0180.NASL", "ORACLEVM_OVMSA-2016-0181.NASL", "ORACLEVM_OVMSA-2017-0044.NASL", "ORACLEVM_OVMSA-2017-0045.NASL", "ORACLEVM_OVMSA-2017-0046.NASL", "ORACLEVM_OVMSA-2017-0056.NASL", "ORACLEVM_OVMSA-2017-0057.NASL", "ORACLEVM_OVMSA-2017-0058.NASL", "ORACLEVM_OVMSA-2017-0062.NASL", "ORACLEVM_OVMSA-2017-0105.NASL", "ORACLEVM_OVMSA-2017-0106.NASL", "ORACLEVM_OVMSA-2017-0111.NASL", "ORACLEVM_OVMSA-2017-0112.NASL", "ORACLEVM_OVMSA-2017-0126.NASL", "ORACLEVM_OVMSA-2017-0143.NASL", "ORACLEVM_OVMSA-2017-0144.NASL", "ORACLEVM_OVMSA-2017-0145.NASL", "ORACLEVM_OVMSA-2017-0168.NASL", "ORACLEVM_OVMSA-2017-0173.NASL", "ORACLEVM_OVMSA-2017-0174.NASL", "ORACLEVM_OVMSA-2018-0015.NASL", "ORACLEVM_OVMSA-2018-0236.NASL", "ORACLEVM_OVMSA-2018-0237.NASL", "PHOTONOS_PHSA-2017-0006.NASL", "PHOTONOS_PHSA-2017-0006_LINUX.NASL", "PHOTONOS_PHSA-2017-0008.NASL", "PHOTONOS_PHSA-2017-0011.NASL", "PHOTONOS_PHSA-2017-0011_LINUX.NASL", "PHOTONOS_PHSA-2017-0014.NASL", "PHOTONOS_PHSA-2017-0014_LINUX.NASL", "RANCHEROS_0_8_1.NASL", "RANCHEROS_1_1_1.NASL", "REDHAT-RHSA-2016-2574.NASL", "REDHAT-RHSA-2016-2584.NASL", "REDHAT-RHSA-2016-2962.NASL", "REDHAT-RHSA-2017-0031.NASL", "REDHAT-RHSA-2017-0036.NASL", "REDHAT-RHSA-2017-0065.NASL", "REDHAT-RHSA-2017-0086.NASL", "REDHAT-RHSA-2017-0091.NASL", "REDHAT-RHSA-2017-0113.NASL", "REDHAT-RHSA-2017-0196.NASL", "REDHAT-RHSA-2017-0215.NASL", "REDHAT-RHSA-2017-0216.NASL", "REDHAT-RHSA-2017-0217.NASL", "REDHAT-RHSA-2017-0270.NASL", "REDHAT-RHSA-2017-0293.NASL", "REDHAT-RHSA-2017-0294.NASL", "REDHAT-RHSA-2017-0295.NASL", "REDHAT-RHSA-2017-0316.NASL", "REDHAT-RHSA-2017-0323.NASL", "REDHAT-RHSA-2017-0324.NASL", "REDHAT-RHSA-2017-0345.NASL", "REDHAT-RHSA-2017-0346.NASL", "REDHAT-RHSA-2017-0347.NASL", "REDHAT-RHSA-2017-0365.NASL", "REDHAT-RHSA-2017-0366.NASL", "REDHAT-RHSA-2017-0403.NASL", "REDHAT-RHSA-2017-0501.NASL", "REDHAT-RHSA-2017-0932.NASL", "REDHAT-RHSA-2017-1209.NASL", "REDHAT-RHSA-2017-1297.NASL", "REDHAT-RHSA-2017-1298.NASL", "REDHAT-RHSA-2017-1308.NASL", "REDHAT-RHSA-2017-1372.NASL", "REDHAT-RHSA-2017-1615.NASL", "REDHAT-RHSA-2017-1616.NASL", "REDHAT-RHSA-2017-1647.NASL", "REDHAT-RHSA-2017-1842.NASL", "REDHAT-RHSA-2017-2077.NASL", "REDHAT-RHSA-2017-2437.NASL", "REDHAT-RHSA-2017-2444.NASL", "REDHAT-RHSA-2017-2669.NASL", "REDHAT-RHSA-2018-0676.NASL", "REDHAT-RHSA-2018-1062.NASL", "REDHAT-RHSA-2018-1854.NASL", "SL_20161103_KERNEL_ON_SL7_X.NASL", "SL_20161220_KERNEL_ON_SL5_X.NASL", "SL_20170110_KERNEL_ON_SL6_X.NASL", "SL_20170117_KERNEL_ON_SL7_X.NASL", "SL_20170222_KERNEL_ON_SL6_X.NASL", "SL_20170222_KERNEL_ON_SL7_X.NASL", "SL_20170224_KERNEL_ON_SL5_X.NASL", "SL_20170525_KERNEL_ON_SL7_X.NASL", "SL_20170531_KERNEL_ON_SL6_X.NASL", "SL_20170628_KERNEL_ON_SL7_X.NASL", "SL_20170801_KERNEL_ON_SL7_X.NASL", "SL_20180410_KERNEL_ON_SL7_X.NASL", "SL_20180619_KERNEL_ON_SL6_X.NASL", "SUSE_SU-2016-2976-1.NASL", "SUSE_SU-2016-3109-1.NASL", "SUSE_SU-2016-3111-1.NASL", "SUSE_SU-2016-3112-1.NASL", "SUSE_SU-2016-3119-1.NASL", "SUSE_SU-2016-3249-1.NASL", "SUSE_SU-2017-0181-1.NASL", "SUSE_SU-2017-0333-1.NASL", "SUSE_SU-2017-0437-1.NASL", "SUSE_SU-2017-0494-1.NASL", "SUSE_SU-2017-0517-1.NASL", "SUSE_SU-2017-0575-1.NASL", "SUSE_SU-2017-0769-1.NASL", "SUSE_SU-2017-0770-1.NASL", "SUSE_SU-2017-0771-1.NASL", "SUSE_SU-2017-0772-1.NASL", "SUSE_SU-2017-0780-1.NASL", "SUSE_SU-2017-1183-1.NASL", "SUSE_SU-2017-1278-1.NASL", "SUSE_SU-2017-1281-1.NASL", "SUSE_SU-2017-1285-1.NASL", "SUSE_SU-2017-1287-1.NASL", "SUSE_SU-2017-1291-1.NASL", "SUSE_SU-2017-1299-1.NASL", "SUSE_SU-2017-1300-1.NASL", "SUSE_SU-2017-1301-1.NASL", "SUSE_SU-2017-1302-1.NASL", "SUSE_SU-2017-1360-1.NASL", "SUSE_SU-2017-1853-1.NASL", "SUSE_SU-2017-2525-1.NASL", "SUSE_SU-2017-2847-1.NASL", "SUSE_SU-2017-2869-1.NASL", "SUSE_SU-2017-2908-1.NASL", "SUSE_SU-2017-2920-1.NASL", "SUSE_SU-2017-3103-1.NASL", "SUSE_SU-2017-3117-1.NASL", "SUSE_SU-2017-3118-1.NASL", "SUSE_SU-2017-3119-1.NASL", "SUSE_SU-2017-3123-1.NASL", "SUSE_SU-2017-3124-1.NASL", "SUSE_SU-2017-3125-1.NASL", "SUSE_SU-2017-3127-1.NASL", "SUSE_SU-2017-3130-1.NASL", "SUSE_SU-2017-3131-1.NASL", "SUSE_SU-2017-3132-1.NASL", "SUSE_SU-2017-3145-1.NASL", "SUSE_SU-2017-3146-1.NASL", "SUSE_SU-2017-3147-1.NASL", "SUSE_SU-2017-3148-1.NASL", "SUSE_SU-2017-3149-1.NASL", "SUSE_SU-2017-3150-1.NASL", "SUSE_SU-2017-3151-1.NASL", "SUSE_SU-2017-3152-1.NASL", "SUSE_SU-2017-3153-1.NASL", "SUSE_SU-2017-3154-1.NASL", "SUSE_SU-2017-3157-1.NASL", "SUSE_SU-2017-3158-1.NASL", "SUSE_SU-2017-3160-1.NASL", "SUSE_SU-2017-3315-1.NASL", "SUSE_SU-2018-0562-1.NASL", "SUSE_SU-2018-0664-1.NASL", "UBUNTU_USN-2989-1.NASL", "UBUNTU_USN-2998-1.NASL", "UBUNTU_USN-3000-1.NASL", "UBUNTU_USN-3001-1.NASL", "UBUNTU_USN-3002-1.NASL", "UBUNTU_USN-3003-1.NASL", "UBUNTU_USN-3004-1.NASL", "UBUNTU_USN-3005-1.NASL", "UBUNTU_USN-3006-1.NASL", "UBUNTU_USN-3007-1.NASL", "UBUNTU_USN-3034-1.NASL", "UBUNTU_USN-3034-2.NASL", "UBUNTU_USN-3035-1.NASL", "UBUNTU_USN-3035-2.NASL", "UBUNTU_USN-3035-3.NASL", "UBUNTU_USN-3036-1.NASL", "UBUNTU_USN-3037-1.NASL", "UBUNTU_USN-3049-1.NASL", "UBUNTU_USN-3051-1.NASL", "UBUNTU_USN-3052-1.NASL", "UBUNTU_USN-3053-1.NASL", "UBUNTU_USN-3054-1.NASL", "UBUNTU_USN-3055-1.NASL", "UBUNTU_USN-3056-1.NASL", "UBUNTU_USN-3057-1.NASL", "UBUNTU_USN-3126-1.NASL", "UBUNTU_USN-3206-1.NASL", "UBUNTU_USN-3207-1.NASL", "UBUNTU_USN-3207-2.NASL", "UBUNTU_USN-3208-1.NASL", "UBUNTU_USN-3208-2.NASL", "UBUNTU_USN-3209-1.NASL", "UBUNTU_USN-3234-1.NASL", "UBUNTU_USN-3234-2.NASL", "UBUNTU_USN-3256-1.NASL", "UBUNTU_USN-3256-2.NASL", "UBUNTU_USN-3264-1.NASL", "UBUNTU_USN-3264-2.NASL", "UBUNTU_USN-3265-1.NASL", "UBUNTU_USN-3265-2.NASL", "UBUNTU_USN-3266-1.NASL", "UBUNTU_USN-3266-2.NASL", "UBUNTU_USN-3291-1.NASL", "UBUNTU_USN-3291-2.NASL", "UBUNTU_USN-3291-3.NASL", "UBUNTU_USN-3293-1.NASL", "UBUNTU_USN-3312-1.NASL", "UBUNTU_USN-3312-2.NASL", "UBUNTU_USN-3314-1.NASL", "UBUNTU_USN-3335-1.NASL", "UBUNTU_USN-3342-1.NASL", "UBUNTU_USN-3342-2.NASL", "UBUNTU_USN-3343-1.NASL", "UBUNTU_USN-3343-2.NASL", "UBUNTU_USN-3361-1.NASL", "UBUNTU_USN-3406-1.NASL", "UBUNTU_USN-3422-1.NASL", "UBUNTU_USN-3583-1.NASL", "UBUNTU_USN-3754-1.NASL", "UBUNTU_USN-3822-1.NASL", "UBUNTU_USN-4904-1.NASL", "VIRTUOZZO_VZA-2017-007.NASL", "VIRTUOZZO_VZA-2017-010.NASL", "VIRTUOZZO_VZA-2017-017.NASL", "VIRTUOZZO_VZA-2017-025.NASL", "VIRTUOZZO_VZA-2017-027.NASL", "VIRTUOZZO_VZA-2017-029.NASL", "VIRTUOZZO_VZA-2017-032.NASL", "VIRTUOZZO_VZA-2018-041.NASL", "VIRTUOZZO_VZLSA-2017-0036.NASL", "VIRTUOZZO_VZLSA-2017-0086.NASL", "VIRTUOZZO_VZLSA-2017-0293.NASL", "VIRTUOZZO_VZLSA-2017-0294.NASL", "VIRTUOZZO_VZLSA-2017-0323.NASL", "VIRTUOZZO_VZLSA-2017-1308.NASL", "VIRTUOZZO_VZLSA-2017-1372.NASL"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310120715", "OPENVAS:1361412562310703607", "OPENVAS:1361412562310703791", "OPENVAS:1361412562310703804", "OPENVAS:1361412562310808438", "OPENVAS:1361412562310808442", "OPENVAS:1361412562310808459", "OPENVAS:1361412562310842779", "OPENVAS:1361412562310842786", "OPENVAS:1361412562310842787", "OPENVAS:1361412562310842788", "OPENVAS:1361412562310842790", "OPENVAS:1361412562310842791", "OPENVAS:1361412562310842793", "OPENVAS:1361412562310842794", "OPENVAS:1361412562310842796", "OPENVAS:1361412562310842797", "OPENVAS:1361412562310842829", "OPENVAS:1361412562310842830", "OPENVAS:1361412562310842831", "OPENVAS:1361412562310842833", "OPENVAS:1361412562310842835", "OPENVAS:1361412562310842836", "OPENVAS:1361412562310842837", "OPENVAS:1361412562310842850", "OPENVAS:1361412562310842852", "OPENVAS:1361412562310842853", "OPENVAS:1361412562310842854", "OPENVAS:1361412562310842855", "OPENVAS:1361412562310842856", "OPENVAS:1361412562310842857", "OPENVAS:1361412562310842859", "OPENVAS:1361412562310842860", "OPENVAS:1361412562310842945", "OPENVAS:1361412562310842948", "OPENVAS:1361412562310843060", "OPENVAS:1361412562310843061", "OPENVAS:1361412562310843062", "OPENVAS:1361412562310843063", "OPENVAS:1361412562310843064", "OPENVAS:1361412562310843065", "OPENVAS:1361412562310843095", "OPENVAS:1361412562310843096", "OPENVAS:1361412562310843127", "OPENVAS:1361412562310843128", "OPENVAS:1361412562310843137", "OPENVAS:1361412562310843138", "OPENVAS:1361412562310843139", "OPENVAS:1361412562310843140", "OPENVAS:1361412562310843141", "OPENVAS:1361412562310843142", "OPENVAS:1361412562310843164", "OPENVAS:1361412562310843165", "OPENVAS:1361412562310843175", "OPENVAS:1361412562310843176", "OPENVAS:1361412562310843198", "OPENVAS:1361412562310843199", "OPENVAS:1361412562310843200", "OPENVAS:1361412562310843212", "OPENVAS:1361412562310843229", "OPENVAS:1361412562310843232", "OPENVAS:1361412562310843233", "OPENVAS:1361412562310843249", "OPENVAS:1361412562310843297", "OPENVAS:1361412562310843312", "OPENVAS:1361412562310843461", "OPENVAS:1361412562310843628", "OPENVAS:1361412562310843824", "OPENVAS:1361412562310851420", "OPENVAS:1361412562310851489", "OPENVAS:1361412562310851506", "OPENVAS:1361412562310851513", "OPENVAS:1361412562310851515", "OPENVAS:1361412562310851516", "OPENVAS:1361412562310851529", "OPENVAS:1361412562310851530", "OPENVAS:1361412562310851544", "OPENVAS:1361412562310851548", "OPENVAS:1361412562310851632", "OPENVAS:1361412562310851638", "OPENVAS:1361412562310871708", "OPENVAS:1361412562310871730", "OPENVAS:1361412562310871742", "OPENVAS:1361412562310871747", "OPENVAS:1361412562310871761", "OPENVAS:1361412562310871762", "OPENVAS:1361412562310871765", "OPENVAS:1361412562310871823", "OPENVAS:1361412562310871827", "OPENVAS:1361412562310871838", "OPENVAS:1361412562310871855", "OPENVAS:1361412562310872182", "OPENVAS:1361412562310872186", "OPENVAS:1361412562310872371", "OPENVAS:1361412562310872383", "OPENVAS:1361412562310872391", "OPENVAS:1361412562310872392", "OPENVAS:1361412562310872418", "OPENVAS:1361412562310872419", "OPENVAS:1361412562310872473", "OPENVAS:1361412562310872476", "OPENVAS:1361412562310872547", "OPENVAS:1361412562310872548", "OPENVAS:1361412562310872568", "OPENVAS:1361412562310872569", "OPENVAS:1361412562310872575", "OPENVAS:1361412562310872578", "OPENVAS:1361412562310882614", "OPENVAS:1361412562310882629", "OPENVAS:1361412562310882638", "OPENVAS:1361412562310882664", "OPENVAS:1361412562310882665", "OPENVAS:1361412562310882668", "OPENVAS:1361412562310882674", "OPENVAS:1361412562310882725", "OPENVAS:1361412562310882728", "OPENVAS:1361412562310882747", "OPENVAS:1361412562310890833", "OPENVAS:1361412562310890849", "OPENVAS:1361412562310890922", "OPENVAS:1361412562311220161020", "OPENVAS:1361412562311220161051", "OPENVAS:1361412562311220171001", "OPENVAS:1361412562311220171056", "OPENVAS:1361412562311220171057", "OPENVAS:1361412562311220171122", "OPENVAS:1361412562311220171123", "OPENVAS:1361412562311220171271", "OPENVAS:1361412562311220191471", "OPENVAS:1361412562311220191472", "OPENVAS:1361412562311220191474", "OPENVAS:1361412562311220191482", "OPENVAS:1361412562311220191484", "OPENVAS:1361412562311220191486", "OPENVAS:1361412562311220191491", "OPENVAS:1361412562311220191492", "OPENVAS:1361412562311220191496", "OPENVAS:1361412562311220191502", "OPENVAS:1361412562311220191504", "OPENVAS:1361412562311220191505", "OPENVAS:1361412562311220191506", "OPENVAS:1361412562311220191508", "OPENVAS:1361412562311220191516", "OPENVAS:1361412562311220191517", "OPENVAS:1361412562311220191518", "OPENVAS:1361412562311220191519", "OPENVAS:1361412562311220191520", "OPENVAS:1361412562311220191524", "OPENVAS:1361412562311220191525", "OPENVAS:1361412562311220191527", "OPENVAS:1361412562311220191530", "OPENVAS:1361412562311220191533", "OPENVAS:1361412562311220191538", "OPENVAS:1361412562311220192274", "OPENVAS:1361412562311220192353", "OPENVAS:1361412562311220192531", "OPENVAS:1361412562311220192599", "OPENVAS:1361412562311220192693", "OPENVAS:1361412562311220201269", "OPENVAS:703607", "OPENVAS:703791", "OPENVAS:703804"]}, {"type": "oracle", "idList": ["ORACLE:CPUJUL2018"]}, {"type": "oraclelinux", "idList": ["ELSA-2016-2574", "ELSA-2016-2962", "ELSA-2016-2962-1", "ELSA-2016-3587", "ELSA-2016-3588", "ELSA-2016-3589", "ELSA-2016-3596", "ELSA-2016-3644", "ELSA-2016-3645", "ELSA-2016-3646", "ELSA-2016-3655", "ELSA-2016-3656", "ELSA-2016-3657", "ELSA-2017-0036", "ELSA-2017-0086", "ELSA-2017-0293", "ELSA-2017-0294", "ELSA-2017-0294-1", "ELSA-2017-0307", "ELSA-2017-0323", "ELSA-2017-0323-1", "ELSA-2017-0817", "ELSA-2017-0933", "ELSA-2017-1308", "ELSA-2017-1308-1", "ELSA-2017-1372", "ELSA-2017-1615", "ELSA-2017-1615-1", "ELSA-2017-1842", "ELSA-2017-1842-1", "ELSA-2017-3520", "ELSA-2017-3521", "ELSA-2017-3522", "ELSA-2017-3533", "ELSA-2017-3534", "ELSA-2017-3535", "ELSA-2017-3539", "ELSA-2017-3566", "ELSA-2017-3567", "ELSA-2017-3579", "ELSA-2017-3580", "ELSA-2017-3590", "ELSA-2017-3595", "ELSA-2017-3605", "ELSA-2017-3606", "ELSA-2017-3607", "ELSA-2017-3609", "ELSA-2017-3636", "ELSA-2017-3637", "ELSA-2017-3657", "ELSA-2017-3658", "ELSA-2018-1062", "ELSA-2018-1854", "ELSA-2018-4021", "ELSA-2018-4108", "ELSA-2018-4161", "ELSA-2018-4164", "ELSA-2018-4172", "ELSA-2020-5671", "ELSA-2021-9486", "ELSA-2021-9487", "ELSA-2022-9969"]}, {"type": "osv", "idList": ["OSV:DLA-1200-1", "OSV:DLA-516-1", "OSV:DLA-772-1", "OSV:DLA-833-1", "OSV:DLA-849-1", "OSV:DLA-922-1", "OSV:DSA-3607-1", "OSV:DSA-3791-1", "OSV:DSA-3804-1"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:141331", "PACKETSTORM:141339", "PACKETSTORM:142872", "PACKETSTORM:147685"]}, {"type": "photon", "idList": ["PHSA-2016-0007", "PHSA-2017-0011", "PHSA-2017-0014", "PHSA-2017-0016", "PHSA-2017-0035", "PHSA-2017-0038", "PHSA-2017-0041", "PHSA-2018-0031"]}, {"type": "redhat", "idList": ["RHSA-2016:2574", "RHSA-2016:2584", "RHSA-2016:2962", "RHSA-2017:0031", "RHSA-2017:0036", "RHSA-2017:0065", "RHSA-2017:0086", "RHSA-2017:0091", "RHSA-2017:0113", "RHSA-2017:0196", "RHSA-2017:0215", "RHSA-2017:0216", "RHSA-2017:0217", "RHSA-2017:0270", "RHSA-2017:0293", "RHSA-2017:0294", "RHSA-2017:0295", "RHSA-2017:0316", "RHSA-2017:0323", "RHSA-2017:0324", "RHSA-2017:0345", "RHSA-2017:0346", "RHSA-2017:0347", "RHSA-2017:0365", "RHSA-2017:0366", "RHSA-2017:0403", "RHSA-2017:0501", "RHSA-2017:0932", "RHSA-2017:1209", "RHSA-2017:1297", "RHSA-2017:1298", "RHSA-2017:1308", "RHSA-2017:1372", "RHSA-2017:1615", "RHSA-2017:1616", "RHSA-2017:1647", "RHSA-2017:1842", "RHSA-2017:2077", "RHSA-2017:2437", "RHSA-2017:2444", "RHSA-2017:2669", "RHSA-2018:0676", "RHSA-2018:1062", "RHSA-2018:1854"]}, {"type": "redhatcve", "idList": ["RH:CVE-2016-10044", "RH:CVE-2016-10200", "RH:CVE-2016-10208", "RH:CVE-2016-3070", "RH:CVE-2016-5243", "RH:CVE-2016-9588", "RH:CVE-2017-2671", "RH:CVE-2017-5669", "RH:CVE-2017-5897", "RH:CVE-2017-5970", "RH:CVE-2017-5986", "RH:CVE-2017-6214", "RH:CVE-2017-6345", "RH:CVE-2017-6346", "RH:CVE-2017-6348", "RH:CVE-2017-6353", "RH:CVE-2017-7187", "RH:CVE-2017-7261", "RH:CVE-2017-7294", "RH:CVE-2017-7308", "RH:CVE-2017-7616", "RH:CVE-2021-22600"]}, {"type": "seebug", "idList": ["SSV:92700", "SSV:93094"]}, {"type": "suse", "idList": ["OPENSUSE-SU-2016:2625-1", "OPENSUSE-SU-2016:3050-1", "OPENSUSE-SU-2017:0456-1", "OPENSUSE-SU-2017:0458-1", "OPENSUSE-SU-2017:0541-1", "OPENSUSE-SU-2017:0547-1", "OPENSUSE-SU-2017:0906-1", "OPENSUSE-SU-2017:0907-1", "OPENSUSE-SU-2017:1140-1", "OPENSUSE-SU-2017:1215-1", "OPENSUSE-SU-2017:2846-1", "OPENSUSE-SU-2017:2905-1", "SUSE-SU-2016:2976-1", "SUSE-SU-2016:3093-1", "SUSE-SU-2016:3094-1", "SUSE-SU-2016:3098-1", "SUSE-SU-2016:3100-1", "SUSE-SU-2016:3104-1", "SUSE-SU-2016:3109-1", "SUSE-SU-2016:3111-1", "SUSE-SU-2016:3112-1", "SUSE-SU-2016:3119-1", "SUSE-SU-2016:3249-1", "SUSE-SU-2017:0181-1", "SUSE-SU-2017:0333-1", "SUSE-SU-2017:0437-1", "SUSE-SU-2017:0494-1", "SUSE-SU-2017:0517-1", "SUSE-SU-2017:0575-1", "SUSE-SU-2017:0759-1", "SUSE-SU-2017:0760-1", "SUSE-SU-2017:0762-1", "SUSE-SU-2017:0763-1", "SUSE-SU-2017:0764-1", "SUSE-SU-2017:0766-1", "SUSE-SU-2017:0767-1", "SUSE-SU-2017:0768-1", "SUSE-SU-2017:0769-1", "SUSE-SU-2017:0770-1", "SUSE-SU-2017:0771-1", "SUSE-SU-2017:0772-1", "SUSE-SU-2017:0773-1", "SUSE-SU-2017:0774-1", "SUSE-SU-2017:0775-1", "SUSE-SU-2017:0776-1", "SUSE-SU-2017:0777-1", "SUSE-SU-2017:0778-1", "SUSE-SU-2017:0779-1", "SUSE-SU-2017:0780-1", "SUSE-SU-2017:0781-1", "SUSE-SU-2017:0786-1", "SUSE-SU-2017:1059-1", "SUSE-SU-2017:1064-1", "SUSE-SU-2017:1102-1", "SUSE-SU-2017:1183-1", "SUSE-SU-2017:1247-1", "SUSE-SU-2017:1277-1", "SUSE-SU-2017:1278-1", "SUSE-SU-2017:1279-1", "SUSE-SU-2017:1280-1", "SUSE-SU-2017:1281-1", "SUSE-SU-2017:1283-1", "SUSE-SU-2017:1287-1", "SUSE-SU-2017:1289-1", "SUSE-SU-2017:1290-1", "SUSE-SU-2017:1291-1", "SUSE-SU-2017:1293-1", "SUSE-SU-2017:1294-1", "SUSE-SU-2017:1295-1", "SUSE-SU-2017:1297-1", "SUSE-SU-2017:1299-1", "SUSE-SU-2017:1300-1", "SUSE-SU-2017:1301-1", "SUSE-SU-2017:1302-1", "SUSE-SU-2017:1303-1", "SUSE-SU-2017:1308-1", "SUSE-SU-2017:1360-1", "SUSE-SU-2017:1853-1", "SUSE-SU-2017:1990-1", "SUSE-SU-2017:2342-1", "SUSE-SU-2017:2525-1", "SUSE-SU-2017:2847-1", "SUSE-SU-2017:2869-1", "SUSE-SU-2017:2908-1", "SUSE-SU-2017:2920-1", "SUSE-SU-2017:3072-1", "SUSE-SU-2017:3074-1", "SUSE-SU-2017:3076-1", "SUSE-SU-2017:3103-1", "SUSE-SU-2017:3116-1", "SUSE-SU-2017:3117-1", "SUSE-SU-2017:3118-1", "SUSE-SU-2017:3119-1", "SUSE-SU-2017:3120-1", "SUSE-SU-2017:3121-1", "SUSE-SU-2017:3122-1", "SUSE-SU-2017:3123-1", "SUSE-SU-2017:3124-1", "SUSE-SU-2017:3125-1", "SUSE-SU-2017:3126-1", "SUSE-SU-2017:3127-1", "SUSE-SU-2017:3128-1", "SUSE-SU-2017:3129-1", "SUSE-SU-2017:3130-1", "SUSE-SU-2017:3131-1", "SUSE-SU-2017:3132-1", "SUSE-SU-2017:3134-1", "SUSE-SU-2017:3136-1", "SUSE-SU-2017:3139-1", "SUSE-SU-2017:3145-1", "SUSE-SU-2017:3146-1", "SUSE-SU-2017:3147-1", "SUSE-SU-2017:3148-1", "SUSE-SU-2017:3149-1", "SUSE-SU-2017:3150-1", "SUSE-SU-2017:3151-1", "SUSE-SU-2017:3152-1", "SUSE-SU-2017:3153-1", "SUSE-SU-2017:3154-1", "SUSE-SU-2017:3156-1", "SUSE-SU-2017:3157-1", "SUSE-SU-2017:3158-1", "SUSE-SU-2017:3159-1", "SUSE-SU-2017:3160-1", "SUSE-SU-2017:3267-1", "SUSE-SU-2017:3315-1", "SUSE-SU-2018:0562-1", "SUSE-SU-2018:0664-1"]}, {"type": "symantec", "idList": ["SMNTC-1404"]}, {"type": "thn", "idList": ["THN:11E7CC33794D9968747131F3F0AE8716"]}, {"type": "threatpost", "idList": ["THREATPOST:178E0668804E2DA1322D2C1DCF6CA893", "THREATPOST:1EFFF77A39E186D173F6DF0D1259D4DE"]}, {"type": "ubuntu", "idList": ["USN-2989-1", "USN-2998-1", "USN-3000-1", "USN-3001-1", "USN-3002-1", "USN-3003-1", "USN-3004-1", "USN-3005-1", "USN-3006-1", "USN-3007-1", "USN-3034-1", "USN-3034-2", "USN-3035-1", "USN-3035-2", "USN-3035-3", "USN-3036-1", "USN-3037-1", "USN-3049-1", "USN-3050-1", "USN-3051-1", "USN-3052-1", "USN-3053-1", "USN-3054-1", "USN-3055-1", "USN-3056-1", "USN-3057-1", "USN-3126-1", "USN-3126-2", "USN-3206-1", "USN-3207-1", "USN-3207-2", "USN-3208-1", "USN-3208-2", "USN-3209-1", "USN-3234-1", "USN-3234-2", "USN-3256-1", "USN-3256-2", "USN-3264-1", "USN-3264-2", "USN-3265-1", "USN-3265-2", "USN-3266-1", "USN-3266-2", "USN-3291-1", "USN-3291-2", "USN-3291-3", "USN-3293-1", "USN-3312-1", "USN-3312-2", "USN-3314-1", "USN-3342-1", "USN-3342-2", "USN-3343-1", "USN-3343-2", "USN-3361-1", "USN-3406-1", "USN-3406-2", "USN-3422-1", "USN-3422-2", "USN-3583-1", "USN-3583-2", "USN-3754-1", "USN-3822-1", "USN-3822-2", "USN-4904-1"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2015-1350", "UB:CVE-2016-10044", "UB:CVE-2016-10200", "UB:CVE-2016-10208", "UB:CVE-2016-2117", "UB:CVE-2016-3070", "UB:CVE-2016-5243", "UB:CVE-2016-7117", "UB:CVE-2016-9588", "UB:CVE-2017-15649", "UB:CVE-2017-2671", "UB:CVE-2017-5669", "UB:CVE-2017-5897", "UB:CVE-2017-5970", "UB:CVE-2017-5986", "UB:CVE-2017-6074", "UB:CVE-2017-6214", "UB:CVE-2017-6345", "UB:CVE-2017-6346", "UB:CVE-2017-6348", "UB:CVE-2017-6353", "UB:CVE-2017-7187", "UB:CVE-2017-7261", "UB:CVE-2017-7294", "UB:CVE-2017-7308", "UB:CVE-2017-7616"]}, {"type": "virtuozzo", "idList": ["VZA-2017-007", "VZA-2017-010", "VZA-2017-016", "VZA-2017-017", "VZA-2017-024", "VZA-2017-025", "VZA-2017-027", "VZA-2017-029", "VZA-2017-032", "VZA-2018-040", "VZA-2018-041"]}, {"type": "zdt", "idList": ["1337DAY-ID-27133", "1337DAY-ID-27134", "1337DAY-ID-27761", "1337DAY-ID-27914", "1337DAY-ID-30376", "1337DAY-ID-33035"]}]}, "score": {"value": 0.7, "vector": "NONE"}, "backreferences": {"references": [{"type": "amazon", "idList": ["ALAS-2017-814", "ALAS-2017-828"]}, {"type": "android", "idList": ["ANDROID:CVE-2016-10200"]}, {"type": "androidsecurity", "idList": ["ANDROID:2017-02-01", "ANDROID:2017-09-01"]}, {"type": "archlinux", "idList": ["ASA-201702-17"]}, {"type": "centos", "idList": ["CESA-2017:0293", "CESA-2017:0294", "CESA-2017:0323", "CESA-2017:1372", "CESA-2017:1615"]}, {"type": "cloudfoundry", "idList": ["CFOUNDRY:2DD582EFE729277C37B69440AE62247E", "CFOUNDRY:4A4E5BB1A59DD906E5D792B48A62CB13", "CFOUNDRY:59BA3F002F833C86F9D716E2A3575DCB", "CFOUNDRY:DFAB11FD33D131C30AACDE9F4864FC0F", "CFOUNDRY:FC25CD097476B12ED115E08FD50F00D3"]}, {"type": "cve", "idList": ["CVE-2015-1350", "CVE-2016-2117", "CVE-2016-5243", "CVE-2017-5669", "CVE-2017-5970", "CVE-2017-5986", "CVE-2017-6074", "CVE-2017-6214", "CVE-2017-6345", "CVE-2017-6346", "CVE-2017-6348", "CVE-2017-6353", "CVE-2017-7187"]}, {"type": "debian", "idList": ["DEBIAN:DLA-1200-1:A0B61", "DEBIAN:DLA-849-1:12807", "DEBIAN:DSA-3791-1:AE0FD", "DEBIAN:DSA-3804-1:E7F94"]}, {"type": "debiancve", "idList": ["DEBIANCVE:CVE-2015-1350", "DEBIANCVE:CVE-2016-10044", "DEBIANCVE:CVE-2016-10200", "DEBIANCVE:CVE-2016-10208", "DEBIANCVE:CVE-2016-2117", "DEBIANCVE:CVE-2016-3070", "DEBIANCVE:CVE-2016-5243", "DEBIANCVE:CVE-2016-7117", "DEBIANCVE:CVE-2016-9588", "DEBIANCVE:CVE-2017-2671", "DEBIANCVE:CVE-2017-5669", "DEBIANCVE:CVE-2017-5897", "DEBIANCVE:CVE-2017-5970", "DEBIANCVE:CVE-2017-5986", "DEBIANCVE:CVE-2017-6074", "DEBIANCVE:CVE-2017-6214", "DEBIANCVE:CVE-2017-6345", "DEBIANCVE:CVE-2017-6346", "DEBIANCVE:CVE-2017-6348", "DEBIANCVE:CVE-2017-6353", "DEBIANCVE:CVE-2017-7187", "DEBIANCVE:CVE-2017-7261", "DEBIANCVE:CVE-2017-7294", "DEBIANCVE:CVE-2017-7308", "DEBIANCVE:CVE-2017-7616"]}, {"type": "exploitdb", "idList": ["EDB-ID:41457", "EDB-ID:41458", "EDB-ID:44654"]}, {"type": "exploitpack", "idList": ["EXPLOITPACK:66230DDA8228F7537211A7F78C05A763"]}, {"type": "f5", "idList": ["F5:K82508682"]}, {"type": "fedora", "idList": ["FEDORA:042FF6294018", "FEDORA:1F466601E823", "FEDORA:25B9E61491E0", "FEDORA:2CC39660F53B", "FEDORA:3D3EF633571E", "FEDORA:553DD615C92C", "FEDORA:5931760652B6", "FEDORA:5ADC96067305", "FEDORA:6437E61257FA", "FEDORA:65FAD61713B3", "FEDORA:76A6A60C79DB", "FEDORA:79A0B6175384", "FEDORA:8CDBE6067306", "FEDORA:B872461491E6", "FEDORA:C8F1260321CA", "FEDORA:D953C601BFE1", "FEDORA:F17F2606731A"]}, {"type": "googleprojectzero", "idList": ["GOOGLEPROJECTZERO:9B79D262B5DA61A7E11F5134B546BA63"]}, {"type": "hackerone", "idList": ["H1:347282"]}, {"type": "ibm", "idList": ["475B1D5AA0EDB6A4A0012EA2C2D64B9388A6ACC5779414E8E1A98AC9B641F6AF", "6B8D264C112CFCDDCE94E39A330DF7082557BFFF177349A0F825B791060643AF"]}, {"type": "kitploit", "idList": ["KITPLOIT:4462385753504235463"]}, {"type": "lenovo", "idList": ["LENOVO:PS500107-NOSID"]}, {"type": "metasploit", "idList": ["MSF:EXPLOIT/LINUX/LOCAL/AF_PACKET_PACKET_SET_RING_PRIV_ESC"]}, {"type": "myhack58", "idList": ["MYHACK58:62201783679", "MYHACK58:62201783692"]}, {"type": "nessus", "idList": ["CENTOS_RHSA-2017-0293.NASL", "CENTOS_RHSA-2017-0294.NASL", "CENTOS_RHSA-2017-0323.NASL", "DEBIAN_DLA-849.NASL", "DEBIAN_DSA-3791.NASL", "DEBIAN_DSA-3804.NASL", "EULEROS_SA-2020-1269.NASL", "FEDORA_2016-3DAF782DFA.NASL", "FEDORA_2016-80EDB9D511.NASL", "FEDORA_2016-E0F3FCD7DF.NASL", "FEDORA_2017-0054C7B1F0.NASL", "FEDORA_2017-2E1F3694B2.NASL", "FEDORA_2017-387FF46A66.NASL", "FEDORA_2017-4B9F61C68D.NASL", "FEDORA_2017-787BC0D5B4.NASL", "FEDORA_2017-92D84F68CF.NASL", "FEDORA_2017-F519EBB3C4.NASL", "FEDORA_2017-FB89CA752A.NASL", "NEWSTART_CGSL_NS-SA-2019-0143_KERNEL.NASL", "OPENSUSE-2017-286.NASL", "OPENSUSE-2017-287.NASL", "ORACLELINUX_ELSA-2017-0293.NASL", "ORACLELINUX_ELSA-2017-0294.NASL", "ORACLELINUX_ELSA-2017-0323.NASL", "ORACLELINUX_ELSA-2017-3520.NASL", "ORACLELINUX_ELSA-2017-3521.NASL", "ORACLELINUX_ELSA-2017-3522.NASL", "ORACLEVM_OVMSA-2017-0044.NASL", "ORACLEVM_OVMSA-2017-0045.NASL", "ORACLEVM_OVMSA-2017-0046.NASL", "ORACLEVM_OVMSA-2018-0015.NASL", "REDHAT-RHSA-2017-0293.NASL", "REDHAT-RHSA-2017-0294.NASL", "REDHAT-RHSA-2017-0295.NASL", "REDHAT-RHSA-2017-0316.NASL", "REDHAT-RHSA-2017-0323.NASL", "REDHAT-RHSA-2017-0324.NASL", "REDHAT-RHSA-2017-0345.NASL", "REDHAT-RHSA-2017-0346.NASL", "REDHAT-RHSA-2017-0347.NASL", "REDHAT-RHSA-2017-0365.NASL", "REDHAT-RHSA-2017-0366.NASL", "REDHAT-RHSA-2017-0403.NASL", "REDHAT-RHSA-2017-0501.NASL", "SL_20170222_KERNEL_ON_SL6_X.NASL", "SL_20170222_KERNEL_ON_SL7_X.NASL", "SL_20170224_KERNEL_ON_SL5_X.NASL", "SUSE_SU-2017-0517-1.NASL", "SUSE_SU-2017-0769-1.NASL", "SUSE_SU-2017-0770-1.NASL", "SUSE_SU-2017-0771-1.NASL", "SUSE_SU-2017-0772-1.NASL", "SUSE_SU-2017-0780-1.NASL", "UBUNTU_USN-3034-1.NASL", "UBUNTU_USN-3034-2.NASL", "UBUNTU_USN-3035-1.NASL", "UBUNTU_USN-3035-2.NASL", "UBUNTU_USN-3035-3.NASL", "UBUNTU_USN-3036-1.NASL", "UBUNTU_USN-3037-1.NASL", "UBUNTU_USN-3208-1.NASL", "UBUNTU_USN-3208-2.NASL", "UBUNTU_USN-3209-1.NASL", "UBUNTU_USN-3234-1.NASL", "UBUNTU_USN-3234-2.NASL", "UBUNTU_USN-3583-1.NASL"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310843461", "OPENVAS:1361412562310872182", "OPENVAS:1361412562310872186", "OPENVAS:1361412562311220201269"]}, {"type": "oraclelinux", "idList": ["ELSA-2017-0293", "ELSA-2017-0294", "ELSA-2017-0294-1", "ELSA-2017-0323", "ELSA-2017-0323-1", "ELSA-2017-3520", "ELSA-2017-3521", "ELSA-2017-3522", "ELSA-2018-4021"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:141331", "PACKETSTORM:141339"]}, {"type": "photon", "idList": ["PHSA-2017-0014", "PHSA-2017-0016", "PHSA-2017-0035", "PHSA-2017-0038", "PHSA-2017-0041"]}, {"type": "redhat", "idList": ["RHSA-2017:0293", "RHSA-2017:0294", "RHSA-2017:0316", "RHSA-2017:0323", "RHSA-2017:0324", "RHSA-2017:0345", "RHSA-2017:0346", "RHSA-2017:0365", "RHSA-2017:0366", "RHSA-2017:0403"]}, {"type": "redhatcve", "idList": ["RH:CVE-2016-10044", "RH:CVE-2016-10200", "RH:CVE-2016-10208", "RH:CVE-2016-9588", "RH:CVE-2017-2671", "RH:CVE-2017-5669", "RH:CVE-2017-5897", "RH:CVE-2017-5970", "RH:CVE-2017-5986", "RH:CVE-2017-6214", "RH:CVE-2017-6345", "RH:CVE-2017-6346", "RH:CVE-2017-6348", "RH:CVE-2017-6353", "RH:CVE-2017-7187", "RH:CVE-2017-7261", "RH:CVE-2017-7294", "RH:CVE-2017-7308", "RH:CVE-2017-7616"]}, {"type": "seebug", "idList": ["SSV:92700", "SSV:93094"]}, {"type": "suse", "idList": ["OPENSUSE-SU-2017:0541-1", "OPENSUSE-SU-2017:0547-1", "SUSE-SU-2017:0517-1", "SUSE-SU-2017:0759-1", "SUSE-SU-2017:0760-1", "SUSE-SU-2017:0762-1", "SUSE-SU-2017:0763-1", "SUSE-SU-2017:0764-1", "SUSE-SU-2017:0766-1", "SUSE-SU-2017:0767-1", "SUSE-SU-2017:0768-1", "SUSE-SU-2017:0769-1", "SUSE-SU-2017:0770-1", "SUSE-SU-2017:0771-1", "SUSE-SU-2017:0772-1", "SUSE-SU-2017:0773-1", "SUSE-SU-2017:0774-1", "SUSE-SU-2017:0775-1", "SUSE-SU-2017:0776-1", "SUSE-SU-2017:0777-1", "SUSE-SU-2017:0778-1", "SUSE-SU-2017:0779-1", "SUSE-SU-2017:0780-1", "SUSE-SU-2017:0781-1", "SUSE-SU-2017:0786-1", "SUSE-SU-2018:0562-1"]}, {"type": "symantec", "idList": ["SMNTC-1404"]}, {"type": "talos", "idList": ["SAP"]}, {"type": "thn", "idList": ["THN:11E7CC33794D9968747131F3F0AE8716"]}, {"type": "threatpost", "idList": ["THREATPOST:178E0668804E2DA1322D2C1DCF6CA893"]}, {"type": "ubuntu", "idList": ["USN-3208-2", "USN-3209-1", "USN-3256-1", "USN-3256-2", "USN-3264-1", "USN-3264-2", "USN-3265-2", "USN-3266-2", "USN-3291-1", "USN-3291-3", "USN-3314-1", "USN-3342-1", "USN-3343-2"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2016-10044", "UB:CVE-2016-10200", "UB:CVE-2016-10208", "UB:CVE-2016-9588", "UB:CVE-2017-2671", "UB:CVE-2017-5669", "UB:CVE-2017-5897", "UB:CVE-2017-5970", "UB:CVE-2017-5986", "UB:CVE-2017-6074", "UB:CVE-2017-6214", "UB:CVE-2017-6345", "UB:CVE-2017-6346", "UB:CVE-2017-6348", "UB:CVE-2017-6353", "UB:CVE-2017-7187", "UB:CVE-2017-7261", "UB:CVE-2017-7294", "UB:CVE-2017-7308", "UB:CVE-2017-7616"]}, {"type": "virtuozzo", "idList": ["VZA-2017-010", "VZA-2017-016", "VZA-2017-027", "VZA-2017-029", "VZA-2017-032"]}, {"type": "zdt", "idList": ["1337DAY-ID-27133", "1337DAY-ID-27134", "1337DAY-ID-30376"]}]}, "exploitation": null, "vulnersScore": 0.7}, "_state": {"dependencies": 1674227629, "score": 1674228637}, "_internal": {"score_hash": "f4c5a15336fdf788bbbc2b8315cf8d94"}, "pluginID": "100150", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2017:1247-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(100150);\n script_version(\"3.10\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2015-1350\", \"CVE-2016-10044\", \"CVE-2016-10200\", \"CVE-2016-10208\", \"CVE-2016-2117\", \"CVE-2016-3070\", \"CVE-2016-5243\", \"CVE-2016-7117\", \"CVE-2016-9588\", \"CVE-2017-2671\", \"CVE-2017-5669\", \"CVE-2017-5897\", \"CVE-2017-5970\", \"CVE-2017-5986\", \"CVE-2017-6074\", \"CVE-2017-6214\", \"CVE-2017-6345\", \"CVE-2017-6346\", \"CVE-2017-6348\", \"CVE-2017-6353\", \"CVE-2017-7187\", \"CVE-2017-7261\", \"CVE-2017-7294\", \"CVE-2017-7308\", \"CVE-2017-7616\");\n\n script_name(english:\"SUSE SLES12 Security Update : kernel (SUSE-SU-2017:1247-1)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote SUSE host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The SUSE Linux Enterprise 12 GA LTSS kernel was updated to receive\nvarious security and bugfixes. The following security bugs were \nfixed :\n\n - CVE-2015-1350: The VFS subsystem in the Linux kernel\n provided an incomplete set of requirements for setattr\n operations that underspecifies removing extended\n privilege attributes, which allowed local users to cause\n a denial of service (capability stripping) via a failed\n invocation of a system call, as demonstrated by using\n chown to remove a capability from the ping or Wireshark\n dumpcap program (bnc#914939).\n\n - CVE-2016-2117: The atl2_probe function in\n drivers/net/ethernet/atheros/atlx/atl2.c in the Linux\n kernel incorrectly enabled scatter/gather I/O, which\n allowed remote attackers to obtain sensitive information\n from kernel memory by reading packet data (bnc#968697).\n\n - CVE-2016-3070: The trace_writeback_dirty_page\n implementation in include/trace/events/writeback.h in\n the Linux kernel improperly interacted with\n mm/migrate.c, which allowed local users to cause a\n denial of service (NULL pointer dereference and system\n crash) or possibly have unspecified other impact by\n triggering a certain page move (bnc#979215).\n\n - CVE-2016-5243: The tipc_nl_compat_link_dump function in\n net/tipc/netlink_compat.c in the Linux kernel did not\n properly copy a certain string, which allowed local\n users to obtain sensitive information from kernel stack\n memory by reading a Netlink message (bnc#983212).\n\n - CVE-2016-7117: Use-after-free vulnerability in the\n __sys_recvmmsg function in net/socket.c in the Linux\n kernel allowed remote attackers to execute arbitrary\n code via vectors involving a recvmmsg system call that\n is mishandled during error processing (bnc#1003077).\n\n - CVE-2016-9588: arch/x86/kvm/vmx.c in the Linux kernel\n mismanages the #BP and #OF exceptions, which allowed\n guest OS users to cause a denial of service (guest OS\n crash) by declining to handle an exception thrown by an\n L2 guest (bnc#1015703).\n\n - CVE-2016-10044: The aio_mount function in fs/aio.c in\n the Linux kernel did not properly restrict execute\n access, which made it easier for local users to bypass\n intended SELinux W^X policy restrictions, and\n consequently gain privileges, via an io_setup system\n call (bnc#1023992).\n\n - CVE-2016-10200: Race condition in the L2TPv3 IP\n Encapsulation feature in the Linux kernel allowed local\n users to gain privileges or cause a denial of service\n (use-after-free) by making multiple bind system calls\n without properly ascertaining whether a socket has the\n SOCK_ZAPPED status, related to net/l2tp/l2tp_ip.c and\n net/l2tp/l2tp_ip6.c (bnc#1028415).\n\n - CVE-2016-10208: The ext4_fill_super function in\n fs/ext4/super.c in the Linux kernel did not properly\n validate meta block groups, which allowed physically\n proximate attackers to cause a denial of service\n (out-of-bounds read and system crash) via a crafted ext4\n image (bnc#1023377).\n\n - CVE-2017-2671: The ping_unhash function in\n net/ipv4/ping.c in the Linux kernel is too late in\n obtaining a certain lock and consequently cannot ensure\n that disconnect function calls are safe, which allowed\n local users to cause a denial of service (panic) by\n leveraging access to the protocol value of IPPROTO_ICMP\n in a socket system call (bnc#1031003).\n\n - CVE-2017-5669: The do_shmat function in ipc/shm.c in the\n Linux kernel did not restrict the address calculated by\n a certain rounding operation, which allowed local users\n to map page zero, and consequently bypass a protection\n mechanism that exists for the mmap system call, by\n making crafted shmget and shmat system calls in a\n privileged context (bnc#1026914).\n\n - CVE-2017-5897: The ip6gre_err function in\n net/ipv6/ip6_gre.c in the Linux kernel allowed remote\n attackers to have unspecified impact via vectors\n involving GRE flags in an IPv6 packet, which trigger an\n out-of-bounds access (bnc#1023762).\n\n - CVE-2017-5970: The ipv4_pktinfo_prepare function in\n net/ipv4/ip_sockglue.c in the Linux kernel allowed\n attackers to cause a denial of service (system crash)\n via (1) an application that made crafted system calls or\n possibly (2) IPv4 traffic with invalid IP options\n (bnc#1024938).\n\n - CVE-2017-5986: Race condition in the\n sctp_wait_for_sndbuf function in net/sctp/socket.c in\n the Linux kernel allowed local users to cause a denial\n of service (assertion failure and panic) via a\n multithreaded application that peels off an association\n in a certain buffer-full state (bnc#1025235).\n\n - CVE-2017-6074: The dccp_rcv_state_process function in\n net/dccp/input.c in the Linux kernel mishandled\n DCCP_PKT_REQUEST packet data structures in the LISTEN\n state, which allowed local users to obtain root\n privileges or cause a denial of service (double free)\n via an application that made an IPV6_RECVPKTINFO\n setsockopt system call (bnc#1026024).\n\n - CVE-2017-6214: The tcp_splice_read function in\n net/ipv4/tcp.c in the Linux kernel allowed remote\n attackers to cause a denial of service (infinite loop\n and soft lockup) via vectors involving a TCP packet with\n the URG flag (bnc#1026722).\n\n - CVE-2017-6345: The LLC subsystem in the Linux kernel did\n not ensure that a certain destructor exists in required\n circumstances, which allowed local users to cause a\n denial of service (BUG_ON) or possibly have unspecified\n other impact via crafted system calls (bnc#1027190).\n\n - CVE-2017-6346: Race condition in net/packet/af_packet.c\n in the Linux kernel allowed local users to cause a\n denial of service (use-after-free) or possibly have\n unspecified other impact via a multithreaded application\n that made PACKET_FANOUT setsockopt system calls\n (bnc#1027189).\n\n - CVE-2017-6348: The hashbin_delete function in\n net/irda/irqueue.c in the Linux kernel improperly\n managed lock dropping, which allowed local users to\n cause a denial of service (deadlock) via crafted\n operations on IrDA devices (bnc#1027178).\n\n - CVE-2017-6353: net/sctp/socket.c in the Linux kernel did\n not properly restrict association peel-off operations\n during certain wait states, which allowed local users to\n cause a denial of service (invalid unlock and double\n free) via a multithreaded application. NOTE: this\n vulnerability exists because of an incorrect fix for\n CVE-2017-5986 (bnc#1027066).\n\n - CVE-2017-7187: The sg_ioctl function in\n drivers/scsi/sg.c in the Linux kernel allowed local\n users to cause a denial of service (stack-based buffer\n overflow) or possibly have unspecified other impact via\n a large command size in an SG_NEXT_CMD_LEN ioctl call,\n leading to out-of-bounds write access in the sg_write\n function (bnc#1030213).\n\n - CVE-2017-7261: The vmw_surface_define_ioctl function in\n drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux\n kernel did not check for a zero value of certain levels\n data, which allowed local users to cause a denial of\n service (ZERO_SIZE_PTR dereference, and GPF and possibly\n panic) via a crafted ioctl call for a /dev/dri/renderD*\n device (bnc#1031052).\n\n - CVE-2017-7294: The vmw_surface_define_ioctl function in\n drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux\n kernel did not validate addition of certain levels data,\n which allowed local users to trigger an integer overflow\n and out-of-bounds write, and cause a denial of service\n (system hang or crash) or possibly gain privileges, via\n a crafted ioctl call for a /dev/dri/renderD* device\n (bnc#1031440).\n\n - CVE-2017-7308: The packet_set_ring function in\n net/packet/af_packet.c in the Linux kernel did not\n properly validate certain block-size data, which allowed\n local users to cause a denial of service (overflow) or\n possibly have unspecified other impact via crafted\n system calls (bnc#1031579).\n\n - CVE-2017-7616: Incorrect error handling in the\n set_mempolicy and mbind compat syscalls in\n mm/mempolicy.c in the Linux kernel allowed local users\n to obtain sensitive information from uninitialized stack\n data by triggering failure of a certain bitmap operation\n (bnc#1033336).\n\nThe update package also includes non-security fixes. See advisory for\ndetails.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1003077\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1015703\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1021256\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1021762\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1023377\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1023762\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1023992\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1024938\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1025235\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1026024\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1026722\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1026914\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1027066\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1027149\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1027178\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1027189\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1027190\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1028415\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1028895\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1029986\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1030118\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1030213\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1030901\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1031003\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1031052\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1031440\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1031579\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1032344\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1033336\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=914939\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=954763\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=968697\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=979215\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=983212\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=989056\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-1350/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-10044/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-10200/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-10208/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2117/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-3070/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-5243/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-7117/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-9588/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-2671/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-5669/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-5897/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-5970/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-5986/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-6074/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-6214/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-6345/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-6346/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-6348/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-6353/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-7187/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-7261/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-7294/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-7308/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-7616/\"\n );\n # https://www.suse.com/support/update/announcement/2017/suse-su-20171247-1/\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?8f96323f\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"To install this SUSE Security Update use YaST online_update.\nAlternatively you can run the command listed for your product :\n\nSUSE Linux Enterprise Server for SAP 12:zypper in -t patch\nSUSE-SLE-SAP-12-2017-749=1\n\nSUSE Linux Enterprise Server 12-LTSS:zypper in -t patch\nSUSE-SLE-SERVER-12-2017-749=1\n\nSUSE Linux Enterprise Module for Public Cloud 12:zypper in -t patch\nSUSE-SLE-Module-Public-Cloud-12-2017-749=1\n\nTo bring your system up-to-date, use 'zypper patch'.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'AF_PACKET packet_set_ring Privilege Escalation');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-base\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-base-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-man\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-syms\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-xen\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-xen-base\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-xen-base-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-xen-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-xen-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-xen-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kgraft-patch-3_12_61-52_72-default\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kgraft-patch-3_12_61-52_72-xen\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:12\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2016/05/02\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/05/11\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/05/12\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2017-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLES12)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLES12\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES12\" && (! preg(pattern:\"^(0)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES12 SP0\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES12\", sp:\"0\", cpu:\"x86_64\", reference:\"kernel-xen-3.12.61-52.72.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", cpu:\"x86_64\", reference:\"kernel-xen-base-3.12.61-52.72.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", cpu:\"x86_64\", reference:\"kernel-xen-base-debuginfo-3.12.61-52.72.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", cpu:\"x86_64\", reference:\"kernel-xen-debuginfo-3.12.61-52.72.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", cpu:\"x86_64\", reference:\"kernel-xen-debugsource-3.12.61-52.72.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", cpu:\"x86_64\", reference:\"kernel-xen-devel-3.12.61-52.72.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", cpu:\"x86_64\", reference:\"kgraft-patch-3_12_61-52_72-default-1-2.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", cpu:\"x86_64\", reference:\"kgraft-patch-3_12_61-52_72-xen-1-2.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", cpu:\"s390x\", reference:\"kernel-default-man-3.12.61-52.72.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"kernel-default-3.12.61-52.72.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"kernel-default-base-3.12.61-52.72.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"kernel-default-base-debuginfo-3.12.61-52.72.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"kernel-default-debuginfo-3.12.61-52.72.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"kernel-default-debugsource-3.12.61-52.72.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"kernel-default-devel-3.12.61-52.72.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"kernel-syms-3.12.61-52.72.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kernel\");\n}\n", "naslFamily": "SuSE Local Security Checks", "cpe": ["p-cpe:/a:novell:suse_linux:kernel-default", "p-cpe:/a:novell:suse_linux:kernel-default-base", "p-cpe:/a:novell:suse_linux:kernel-default-base-debuginfo", "p-cpe:/a:novell:suse_linux:kernel-default-debuginfo", "p-cpe:/a:novell:suse_linux:kernel-default-debugsource", "p-cpe:/a:novell:suse_linux:kernel-default-devel", "p-cpe:/a:novell:suse_linux:kernel-default-man", "p-cpe:/a:novell:suse_linux:kernel-syms", "p-cpe:/a:novell:suse_linux:kernel-xen", "p-cpe:/a:novell:suse_linux:kernel-xen-base", "p-cpe:/a:novell:suse_linux:kernel-xen-base-debuginfo", "p-cpe:/a:novell:suse_linux:kernel-xen-debuginfo", "p-cpe:/a:novell:suse_linux:kernel-xen-debugsource", "p-cpe:/a:novell:suse_linux:kernel-xen-devel", "p-cpe:/a:novell:suse_linux:kgraft-patch-3_12_61-52_72-default", "p-cpe:/a:novell:suse_linux:kgraft-patch-3_12_61-52_72-xen", "cpe:/o:novell:suse_linux:12"], "solution": "To install this SUSE Security Update use YaST online_update.\nAlternatively you can run the command listed for your product :\n\nSUSE Linux Enterprise Server for SAP 12:zypper in -t patch SUSE-SLE-SAP-12-2017-749=1\n\nSUSE Linux Enterprise Server 12-LTSS:zypper in -t patch SUSE-SLE-SERVER-12-2017-749=1\n\nSUSE Linux Enterprise Module for Public Cloud 12:zypper in -t patch SUSE-SLE-Module-Public-Cloud-12-2017-749=1\n\nTo bring your system up-to-date, use 'zypper patch'.", "nessusSeverity": "Critical", "cvssScoreSource": "", "vendor_cvss2": {"score": 10, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}, "vendor_cvss3": {"score": 9.8, "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "vpr": {"risk factor": "Critical", "score": "9.7"}, "exploitAvailable": true, "exploitEase": "Exploits are available", "patchPublicationDate": "2017-05-11T00:00:00", "vulnerabilityPublicationDate": "2016-05-02T00:00:00", "exploitableWith": ["Core Impact", "Metasploit(AF_PACKET packet_set_ring Privilege Escalation)"]}

{"suse": [{"lastseen": "2017-05-11T19:19:57", "description": "The SUSE Linux Enterprise 12 GA LTSS kernel was updated to receive various\n security and bugfixes.\n\n The following security bugs were fixed:\n\n - CVE-2015-1350: The VFS subsystem in the Linux kernel provided an\n incomplete set of requirements for setattr operations that\n underspecifies removing extended privilege attributes, which allowed\n local users to cause a denial of service (capability stripping) via a\n failed invocation of a system call, as demonstrated by using chown to\n remove a capability from the ping or Wireshark dumpcap program\n (bnc#914939).\n - CVE-2016-2117: The atl2_probe function in\n drivers/net/ethernet/atheros/atlx/atl2.c in the Linux kernel incorrectly\n enabled scatter/gather I/O, which allowed remote attackers to obtain\n sensitive information from kernel memory by reading packet data\n (bnc#968697).\n - CVE-2016-3070: The trace_writeback_dirty_page implementation in\n include/trace/events/writeback.h in the Linux kernel improperly\n interacted with mm/migrate.c, which allowed local users to cause a\n denial of service (NULL pointer dereference and system crash) or\n possibly have unspecified other impact by triggering a certain page move\n (bnc#979215).\n - CVE-2016-5243: The tipc_nl_compat_link_dump function in\n net/tipc/netlink_compat.c in the Linux kernel did not properly copy a\n certain string, which allowed local users to obtain sensitive\n information from kernel stack memory by reading a Netlink message\n (bnc#983212).\n - CVE-2016-7117: Use-after-free vulnerability in the __sys_recvmmsg\n function in net/socket.c in the Linux kernel allowed remote attackers to\n execute arbitrary code via vectors involving a recvmmsg system call that\n is mishandled during error processing (bnc#1003077).\n - CVE-2016-9588: arch/x86/kvm/vmx.c in the Linux kernel mismanages the #BP\n and #OF exceptions, which allowed guest OS users to cause a denial of\n service (guest OS crash) by declining to handle an exception thrown by\n an L2 guest (bnc#1015703).\n - CVE-2016-10044: The aio_mount function in fs/aio.c in the Linux kernel\n did not properly restrict execute access, which made it easier for local\n users to bypass intended SELinux W^X policy restrictions, and\n consequently gain privileges, via an io_setup system call (bnc#1023992).\n - CVE-2016-10200: Race condition in the L2TPv3 IP Encapsulation feature in\n the Linux kernel allowed local users to gain privileges or cause a\n denial of service (use-after-free) by making multiple bind system calls\n without properly ascertaining whether a socket has the SOCK_ZAPPED\n status, related to net/l2tp/l2tp_ip.c and net/l2tp/l2tp_ip6.c\n (bnc#1028415).\n - CVE-2016-10208: The ext4_fill_super function in fs/ext4/super.c in the\n Linux kernel did not properly validate meta block groups, which allowed\n physically proximate attackers to cause a denial of service\n (out-of-bounds read and system crash) via a crafted ext4 image\n (bnc#1023377).\n - CVE-2017-2671: The ping_unhash function in net/ipv4/ping.c in the Linux\n kernel is too late in obtaining a certain lock and consequently cannot\n ensure that disconnect function calls are safe, which allowed local\n users to cause a denial of service (panic) by leveraging access to the\n protocol value of IPPROTO_ICMP in a socket system call (bnc#1031003).\n - CVE-2017-5669: The do_shmat function in ipc/shm.c in the Linux kernel\n did not restrict the address calculated by a certain rounding operation,\n which allowed local users to map page zero, and consequently bypass a\n protection mechanism that exists for the mmap system call, by making\n crafted shmget and shmat system calls in a privileged context\n (bnc#1026914).\n - CVE-2017-5897: The ip6gre_err function in net/ipv6/ip6_gre.c in the\n Linux kernel allowed remote attackers to have unspecified impact via\n vectors involving GRE flags in an IPv6 packet, which trigger an\n out-of-bounds access (bnc#1023762).\n - CVE-2017-5970: The ipv4_pktinfo_prepare function in\n net/ipv4/ip_sockglue.c in the Linux kernel allowed attackers to cause a\n denial of service (system crash) via (1) an application that made\n crafted system calls or possibly (2) IPv4 traffic with invalid IP\n options (bnc#1024938).\n - CVE-2017-5986: Race condition in the sctp_wait_for_sndbuf function in\n net/sctp/socket.c in the Linux kernel allowed local users to cause a\n denial of service (assertion failure and panic) via a multithreaded\n application that peels off an association in a certain buffer-full state\n (bnc#1025235).\n - CVE-2017-6074: The dccp_rcv_state_process function in net/dccp/input.c\n in the Linux kernel mishandled DCCP_PKT_REQUEST packet data structures\n in the LISTEN state, which allowed local users to obtain root privileges\n or cause a denial of service (double free) via an application that made\n an IPV6_RECVPKTINFO setsockopt system call (bnc#1026024).\n - CVE-2017-6214: The tcp_splice_read function in net/ipv4/tcp.c in the\n Linux kernel allowed remote attackers to cause a denial of service\n (infinite loop and soft lockup) via vectors involving a TCP packet with\n the URG flag (bnc#1026722).\n - CVE-2017-6345: The LLC subsystem in the Linux kernel did not ensure that\n a certain destructor exists in required circumstances, which allowed\n local users to cause a denial of service (BUG_ON) or possibly have\n unspecified other impact via crafted system calls (bnc#1027190).\n - CVE-2017-6346: Race condition in net/packet/af_packet.c in the Linux\n kernel allowed local users to cause a denial of service (use-after-free)\n or possibly have unspecified other impact via a multithreaded\n application that made PACKET_FANOUT setsockopt system calls\n (bnc#1027189).\n - CVE-2017-6348: The hashbin_delete function in net/irda/irqueue.c in the\n Linux kernel improperly managed lock dropping, which allowed local users\n to cause a denial of service (deadlock) via crafted operations on IrDA\n devices (bnc#1027178).\n - CVE-2017-6353: net/sctp/socket.c in the Linux kernel did not properly\n restrict association peel-off operations during certain wait states,\n which allowed local users to cause a denial of service (invalid unlock\n and double free) via a multithreaded application. NOTE: this\n vulnerability exists because of an incorrect fix for CVE-2017-5986\n (bnc#1027066).\n - CVE-2017-7187: The sg_ioctl function in drivers/scsi/sg.c in the Linux\n kernel allowed local users to cause a denial of service (stack-based\n buffer overflow) or possibly have unspecified other impact via a large\n command size in an SG_NEXT_CMD_LEN ioctl call, leading to out-of-bounds\n write access in the sg_write function (bnc#1030213).\n - CVE-2017-7261: The vmw_surface_define_ioctl function in\n drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not\n check for a zero value of certain levels data, which allowed local users\n to cause a denial of service (ZERO_SIZE_PTR dereference, and GPF and\n possibly panic) via a crafted ioctl call for a /dev/dri/renderD* device\n (bnc#1031052).\n - CVE-2017-7294: The vmw_surface_define_ioctl function in\n drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not\n validate addition of certain levels data, which allowed local users to\n trigger an integer overflow and out-of-bounds write, and cause a denial\n of service (system hang or crash) or possibly gain privileges, via a\n crafted ioctl call for a /dev/dri/renderD* device (bnc#1031440).\n - CVE-2017-7308: The packet_set_ring function in net/packet/af_packet.c in\n the Linux kernel did not properly validate certain block-size data,\n which allowed local users to cause a denial of service (overflow) or\n possibly have unspecified other impact via crafted system calls\n (bnc#1031579).\n - CVE-2017-7616: Incorrect error handling in the set_mempolicy and mbind\n compat syscalls in mm/mempolicy.c in the Linux kernel allowed local\n users to obtain sensitive information from uninitialized stack data by\n triggering failure of a certain bitmap operation (bnc#1033336).\n\n The following non-security bugs were fixed:\n\n - ext4: fix fencepost in s_first_meta_bg validation (bsc#1029986).\n - hwrng: virtio - ensure reads happen after successful probe (bsc#954763\n bsc#1032344).\n - kgr/module: make a taint flag module-specific (fate#313296).\n - l2tp: fix address test in __l2tp_ip6_bind_lookup() (bsc#1028415).\n - l2tp: fix lookup for sockets not bound to a device in l2tp_ip\n (bsc#1028415).\n - l2tp: fix racy socket lookup in l2tp_ip and l2tp_ip6 bind()\n (bsc#1028415).\n - l2tp: hold socket before dropping lock in l2tp_ip{, 6}_recv()\n (bsc#1028415).\n - l2tp: hold tunnel socket when handling control frames in l2tp_ip and\n l2tp_ip6 (bsc#1028415).\n - l2tp: lock socket before checking flags in connect() (bsc#1028415).\n - mm/huge_memory.c: respect FOLL_FORCE/FOLL_COW for thp (bnc#1030118).\n - module: move add_taint_module() to a header file (fate#313296).\n - netfilter: bridge: Fix the build when IPV6 is disabled (bsc#1027149).\n - nfs: flush out dirty data on file fput() (bsc#1021762).\n - powerpc: Blacklist GCC 5.4 6.1 and 6.2 (boo#1028895).\n - powerpc: Reject binutils 2.24 when building little endian (boo#1028895).\n - revert "procfs: mark thread stack correctly in proc/<pid>/maps"\n (bnc#1030901).\n - taint/module: Clean up global and module taint flags handling\n (fate#313296).\n - usb: serial: kl5kusb105: fix line-state error handling (bsc#1021256).\n - xfs_dmapi: fix the debug compilation of xfs_dmapi (bsc#989056).\n - xfs: fix buffer overflow dm_get_dirattrs/dm_get_dirattrs2 (bsc#989056).\n\n", "cvss3": {}, "published": "2017-05-11T21:09:07", "type": "suse", "title": "Security update for the Linux Kernel (important)", "bulletinFamily": "unix", "cvss2": {}, "cvelist": ["CVE-2016-10208", "CVE-2017-7261", "CVE-2017-6074", "CVE-2016-7117", "CVE-2017-7616", "CVE-2016-3070", "CVE-2017-5970", "CVE-2016-10200", "CVE-2017-2671", "CVE-2017-7294", "CVE-2017-6348", "CVE-2016-5243", "CVE-2017-6214", "CVE-2015-1350", "CVE-2017-7308", "CVE-2017-6345", "CVE-2017-5669", "CVE-2017-5986", "CVE-2017-6346", "CVE-2016-9588", "CVE-2017-6353", "CVE-2017-7187", "CVE-2016-2117", "CVE-2016-10044", "CVE-2017-5897"], "modified": "2017-05-11T21:09:07", "id": "SUSE-SU-2017:1247-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00022.html", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-05-19T17:20:49", "description": "The SUSE Linux Enterprise 12 SP1 kernel was updated to 3.12.74 to receive\n various security and bugfixes.\n\n Notable new/improved features:\n - Improved support for Hyper-V\n - Support for the tcp_westwood TCP scheduling algorithm\n\n The following security bugs were fixed:\n\n - CVE-2017-8106: The handle_invept function in arch/x86/kvm/vmx.c in the\n Linux kernel allowed privileged KVM guest OS users to cause a denial of\n service (NULL pointer dereference and host OS crash) via a\n single-context INVEPT instruction with a NULL EPT pointer (bsc#1035877).\n - CVE-2017-6951: The keyring_search_aux function in\n security/keys/keyring.c in the Linux kernel allowed local users to cause\n a denial of service (NULL pointer dereference and OOPS) via a\n request_key system call for the "dead" type. (bsc#1029850).\n - CVE-2017-2647: The KEYS subsystem in the Linux kernel allowed local\n users to gain privileges or cause a denial of service (NULL pointer\n dereference and system crash) via vectors involving a NULL value for a\n certain match field, related to the keyring_search_iterator function in\n keyring.c. (bsc#1030593)\n - CVE-2016-9604: This fixes handling of keyrings starting with '.' in\n KEYCTL_JOIN_SESSION_KEYRING, which could have allowed local users to\n manipulate privileged keyrings (bsc#1035576)\n - CVE-2017-7616: Incorrect error handling in the set_mempolicy and mbind\n compat syscalls in mm/mempolicy.c in the Linux kernel allowed local\n users to obtain sensitive information from uninitialized stack data by\n triggering failure of a certain bitmap operation. (bnc#1033336).\n - CVE-2017-7645: The NFSv2/NFSv3 server in the nfsd subsystem in the Linux\n kernel allowed remote attackers to cause a denial of service (system\n crash) via a long RPC reply, related to net/sunrpc/svc.c,\n fs/nfsd/nfs3xdr.c, and fs/nfsd/nfsxdr.c. (bsc#1034670).\n - CVE-2017-7308: The packet_set_ring function in net/packet/af_packet.c in\n the Linux kernel did not properly validate certain block-size data,\n which allowed local users to cause a denial of service (overflow) or\n possibly have unspecified other impact via crafted system calls\n (bnc#1031579)\n - CVE-2017-2671: The ping_unhash function in net/ipv4/ping.c in the Linux\n kernel was too late in obtaining a certain lock and consequently could\n not ensure that disconnect function calls are safe, which allowed local\n users to cause a denial of service (panic) by leveraging access to the\n protocol value of IPPROTO_ICMP in a socket system call (bnc#1031003)\n - CVE-2017-7294: The vmw_surface_define_ioctl function in\n drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not\n validate addition of certain levels data, which allowed local users to\n trigger an integer overflow and out-of-bounds write, and cause a denial\n of service (system hang or crash) or possibly gain privileges, via a\n crafted ioctl call for a /dev/dri/renderD* device (bnc#1031440)\n - CVE-2017-7261: The vmw_surface_define_ioctl function in\n drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not\n check for a zero value of certain levels data, which allowed local users\n to cause a denial of service (ZERO_SIZE_PTR dereference, and GPF and\n possibly panic) via a crafted ioctl call for a /dev/dri/renderD* device\n (bnc#1031052)\n - CVE-2017-7187: The sg_ioctl function in drivers/scsi/sg.c in the Linux\n kernel allowed local users to cause a denial of service (stack-based\n buffer overflow) or possibly have unspecified other impact via a large\n command size in an SG_NEXT_CMD_LEN ioctl call, leading to out-of-bounds\n write access in the sg_write function (bnc#1030213)\n - CVE-2016-9588: arch/x86/kvm/vmx.c in the Linux kernel mismanaged the #BP\n and #OF exceptions, which allowed guest OS users to cause a denial of\n service (guest OS crash) by declining to handle an exception thrown by\n an L2 guest (bsc#1015703).\n - CVE-2017-5669: The do_shmat function in ipc/shm.c in the Linux kernel\n did not restrict the address calculated by a certain rounding operation,\n which allowed local users to map page zero, and consequently bypass a\n protection mechanism that exists for the mmap system call, by making\n crafted shmget and shmat system calls in a privileged context\n (bnc#1026914).\n - CVE-2016-10200: Race condition in the L2TPv3 IP Encapsulation feature in\n the Linux kernel allowed local users to gain privileges or cause a\n denial of service (use-after-free) by making multiple bind system calls\n without properly ascertaining whether a socket has the SOCK_ZAPPED\n status, related to net/l2tp/l2tp_ip.c and net/l2tp/l2tp_ip6.c\n (bnc#1028415)\n - CVE-2016-10208: The ext4_fill_super function in fs/ext4/super.c in the\n Linux kernel did not properly validate meta block groups, which allowed\n physically proximate attackers to cause a denial of service\n (out-of-bounds read and system crash) via a crafted ext4 image\n (bnc#1023377).\n - CVE-2017-5897: The ip6gre_err function in net/ipv6/ip6_gre.c in the\n Linux kernel allowed remote attackers to have unspecified impact via\n vectors involving GRE flags in an IPv6 packet, which trigger an\n out-of-bounds access (bsc#1023762).\n - CVE-2017-5986: A race condition in the sctp_wait_for_sndbuf function in\n net/sctp/socket.c in the Linux kernel allowed local users to cause a\n denial of service (assertion failure and panic) via a multithreaded\n application that peels off an association in a certain buffer-full state\n (bsc#1025235).\n - CVE-2017-6074: The dccp_rcv_state_process function in net/dccp/input.c\n in the Linux kernel mishandled DCCP_PKT_REQUEST packet data structures\n in the LISTEN state, which allowed local users to obtain root privileges\n or cause a denial of service (double free) via an application that made\n an IPV6_RECVPKTINFO setsockopt system call (bnc#1026024)\n - CVE-2016-9191: The cgroup offline implementation in the Linux kernel\n mishandled certain drain operations, which allowed local users to cause\n a denial of service (system hang) by leveraging access to a container\n environment for executing a crafted application (bnc#1008842)\n - CVE-2017-6348: The hashbin_delete function in net/irda/irqueue.c in the\n Linux kernel improperly managed lock dropping, which allowed local users\n to cause a denial of service (deadlock) via crafted operations on IrDA\n devices (bnc#1027178).\n - CVE-2016-10044: The aio_mount function in fs/aio.c in the Linux kernel\n did not properly restrict execute access, which made it easier for local\n users to bypass intended SELinux W^X policy restrictions, and\n consequently gain privileges, via an io_setup system call (bnc#1023992).\n - CVE-2016-3070: The trace_writeback_dirty_page implementation in\n include/trace/events/writeback.h in the Linux kernel improperly\n interacts with mm/migrate.c, which allowed local users to cause a denial\n of service (NULL pointer dereference and system crash) or possibly have\n unspecified other impact by triggering a certain page move (bnc#979215).\n - CVE-2016-5243: The tipc_nl_compat_link_dump function in\n net/tipc/netlink_compat.c in the Linux kernel did not properly copy a\n certain string, which allowed local users to obtain sensitive\n information from kernel stack memory by reading a Netlink message\n (bnc#983212).\n - CVE-2017-6345: The LLC subsystem in the Linux kernel did not ensure that\n a certain destructor exists in required circumstances, which allowed\n local users to cause a denial of service (BUG_ON) or possibly have\n unspecified other impact via crafted system calls (bnc#1027190)\n - CVE-2017-6346: Race condition in net/packet/af_packet.c in the Linux\n kernel allowed local users to cause a denial of service (use-after-free)\n or possibly have unspecified other impact via a multithreaded\n application that made PACKET_FANOUT setsockopt system calls (bnc#1027189)\n - CVE-2017-6353: net/sctp/socket.c in the Linux kernel did not properly\n restrict association peel-off operations during certain wait states,\n which allowed local users to cause a denial of service (invalid unlock\n and double free) via a multithreaded application. NOTE: this\n vulnerability exists because of an incorrect fix for CVE-2017-5986\n (bnc#1027066)\n - CVE-2017-5986: Race condition in the sctp_wait_for_sndbuf function in\n net/sctp/socket.c in the Linux kernel allowed local users to cause a\n denial of service (assertion failure and panic) via a multithreaded\n application that peels off an association in a certain buffer-full state\n (bsc#1025235).\n - CVE-2017-6214: The tcp_splice_read function in net/ipv4/tcp.c in the\n Linux kernel allowed remote attackers to cause a denial of service\n (infinite loop and soft lockup) via vectors involving a TCP packet with\n the URG flag (bnc#1026722)\n - CVE-2016-2117: The atl2_probe function in\n drivers/net/ethernet/atheros/atlx/atl2.c in the Linux kernel incorrectly\n enables scatter/gather I/O, which allowed remote attackers to obtain\n sensitive information from kernel memory by reading packet data\n (bnc#968697)\n - CVE-2015-1350: The VFS subsystem in the Linux kernel provided an\n incomplete set of requirements for setattr operations that\n underspecifies removing extended privilege attributes, which allowed\n local users to cause a denial of service (capability stripping) via a\n failed invocation of a system call, as demonstrated by using chown to\n remove a capability from the ping or Wireshark dumpcap program\n (bsc#914939).\n - CVE-2016-7117: Use-after-free vulnerability in the __sys_recvmmsg\n function in net/socket.c in the Linux kernel allowed remote attackers to\n execute arbitrary code via vectors involving a recvmmsg system call that\n is mishandled during error processing (bsc#1003077).\n\n The following non-security bugs were fixed:\n\n - ACPI / APEI: Fix NMI notification handling (bsc#917630).\n - arch: Mass conversion of smp_mb__*() (bsc#1020795).\n - asm-generic: add __smp_xxx wrappers (bsc#1020795).\n - block: remove struct request buffer member (bsc#1020795).\n - block: submit_bio_wait() conversions (bsc#1020795).\n - bonding: Advertize vxlan offload features when supported (bsc#1009682).\n - bonding: handle more gso types (bsc#1009682).\n - bonding: use the correct ether type for alb (bsc#1028595).\n - btrfs: allow unlink to exceed subvolume quota (bsc#1015821).\n - btrfs: Change qgroup_meta_rsv to 64bit (bsc#1015821).\n - btrfs: fix btrfs_compat_ioctl failures on non-compat ioctls\n (bsc#1018100).\n - btrfs: make file clone aware of fatal signals (bsc#1015787).\n - btrfs: qgroups: Retry after commit on getting EDQUOT (bsc#1015821).\n - cancel the setfilesize transation when io error happen (bsc#1028648).\n - cgroup: remove stray references to css_id (bsc#1020795).\n - cpuidle: powernv/pseries: Auto-promotion of snooze to deeper idle state\n (bnc#1023164).\n - dm: add era target (bsc#1020795).\n - dm: allow remove to be deferred (bsc#1020795).\n - dm bitset: only flush the current word if it has been dirtied\n (bsc#1020795).\n - dm btree: add dm_btree_find_lowest_key (bsc#1020795).\n - dm cache: actually resize cache (bsc#1020795).\n - dm cache: add block sizes and total cache blocks to status output\n (bsc#1020795).\n - dm cache: add cache block invalidation support (bsc#1020795).\n - dm cache: add passthrough mode (bsc#1020795).\n - dm cache: add policy name to status output (bsc#1020795).\n - dm cache: add remove_cblock method to policy interface (bsc#1020795).\n - dm cache: be much more aggressive about promoting writes to discarded\n blocks (bsc#1020795).\n - dm cache: cache shrinking support (bsc#1020795).\n - dm cache: do not add migration to completed list before unhooking bio\n (bsc#1020795).\n - dm cache: fix a lock-inversion (bsc#1020795).\n - dm cache: fix truncation bug when mapping I/O to more than 2TB fast\n device (bsc#1020795).\n - dm cache: fix writethrough mode quiescing in cache_map (bsc#1020795).\n - dm cache: improve efficiency of quiescing flag management (bsc#1020795).\n - dm cache: io destined for the cache device can now serve as tick bios\n (bsc#1020795).\n - dm cache: log error message if dm_kcopyd_copy() fails (bsc#1020795).\n - dm cache metadata: check the metadata version when reading the\n superblock (bsc#1020795).\n - dm cache metadata: return bool from __superblock_all_zeroes\n (bsc#1020795).\n - dm cache: move hook_info into common portion of per_bio_data structure\n (bsc#1020795).\n - dm cache: optimize commit_if_needed (bsc#1020795).\n - dm cache policy mq: a few small fixes (bsc#1020795).\n - dm cache policy mq: fix promotions to occur as expected (bsc#1020795).\n - dm cache policy mq: implement writeback_work() and\n mq_{set,clear}_dirty() (bsc#1020795).\n - dm cache policy mq: introduce three promotion threshold tunables\n (bsc#1020795).\n - dm cache policy mq: protect residency method with existing mutex\n (bsc#1020795).\n - dm cache policy mq: reduce memory requirements (bsc#1020795).\n - dm cache policy mq: use list_del_init instead of list_del +\n INIT_LIST_HEAD (bsc#1020795).\n - dm cache policy: remove return from void policy_remove_mapping\n (bsc#1020795).\n - dm cache: promotion optimisation for writes (bsc#1020795).\n - dm cache: resolve small nits and improve Documentation (bsc#1020795).\n - dm cache: return -EINVAL if the user specifies unknown cache policy\n (bsc#1020795).\n - dm cache: use cell_defer() boolean argument consistently (bsc#1020795).\n - dm: change sector_count member in clone_info from sector_t to unsigned\n (bsc#1020795).\n - dm crypt: add TCW IV mode for old CBC TCRYPT containers (bsc#1020795).\n - dm crypt: properly handle extra key string in initialization\n (bsc#1020795).\n - dm delay: use per-bio data instead of a mempool and slab cache\n (bsc#1020795).\n - dm: fix Kconfig indentation (bsc#1020795).\n - dm: fix Kconfig menu indentation (bsc#1020795).\n - dm: make dm_table_alloc_md_mempools static (bsc#1020795).\n - dm mpath: do not call pg_init when it is already running (bsc#1020795).\n - dm mpath: fix lock order inconsistency in multipath_ioctl (bsc#1020795).\n - dm mpath: print more useful warnings in multipath_message()\n (bsc#1020795).\n - dm mpath: push back requests instead of queueing (bsc#1020795).\n - dm mpath: really fix lockdep warning (bsc#1020795).\n - dm mpath: reduce memory pressure when requeuing (bsc#1020795).\n - dm mpath: remove extra nesting in map function (bsc#1020795).\n - dm mpath: remove map_io() (bsc#1020795).\n - dm mpath: remove process_queued_ios() (bsc#1020795).\n - dm mpath: requeue I/O during pg_init (bsc#1020795).\n - dm persistent data: cleanup dm-thin specific references in text\n (bsc#1020795).\n - dm snapshot: call destroy_work_on_stack() to pair with\n INIT_WORK_ONSTACK() (bsc#1020795).\n - dm snapshot: fix metadata corruption (bsc#1020795).\n - dm snapshot: prepare for switch to using dm-bufio (bsc#1020795).\n - dm snapshot: use dm-bufio (bsc#1020795).\n - dm snapshot: use dm-bufio prefetch (bsc#1020795).\n - dm snapshot: use GFP_KERNEL when initializing exceptions (bsc#1020795).\n - dm space map disk: optimise sm_disk_dec_block (bsc#1020795).\n - dm space map metadata: limit errors in sm_metadata_new_block\n (bsc#1020795).\n - dm: stop using bi_private (bsc#1020795).\n - dm table: add dm_table_run_md_queue_async (bsc#1020795).\n - dm table: print error on preresume failure (bsc#1020795).\n - dm table: remove unused buggy code that extends the targets array\n (bsc#1020795).\n - dm thin: add error_if_no_space feature (bsc#1020795).\n - dm thin: add mappings to end of prepared_* lists (bsc#1020795).\n - dm thin: add 'no_space_timeout' dm-thin-pool module param (bsc#1020795).\n - dm thin: add timeout to stop out-of-data-space mode holding IO forever\n (bsc#1020795).\n - dm thin: allow metadata commit if pool is in PM_OUT_OF_DATA_SPACE mode\n (bsc#1020795).\n - dm thin: allow metadata space larger than supported to go unused\n (bsc#1020795).\n - dm thin: cleanup and improve no space handling (bsc#1020795).\n - dm thin: eliminate the no_free_space flag (bsc#1020795).\n - dm thin: ensure user takes action to validate data and metadata\n consistency (bsc#1020795).\n - dm thin: factor out check_low_water_mark and use bools (bsc#1020795).\n - dm thin: fix deadlock in __requeue_bio_list (bsc#1020795).\n - dm thin: fix noflush suspend IO queueing (bsc#1020795).\n - dm thin: fix out of data space handling (bsc#1020795).\n - dm thin: fix pool feature parsing (bsc#1020795).\n - dm thin: fix rcu_read_lock being held in code that can sleep\n (bsc#1020795).\n - dm thin: handle metadata failures more consistently (bsc#1020795).\n - dm thin: irqsave must always be used with the pool->lock spinlock\n (bsc#1020795).\n - dm thin: log info when growing the data or metadata device (bsc#1020795).\n - dm thin: requeue bios to DM core if no_free_space and in read-only mode\n (bsc#1020795).\n - dm thin: return error from alloc_data_block if pool is not in write mode\n (bsc#1020795).\n - dm thin: simplify pool_is_congested (bsc#1020795).\n - dm thin: sort the per thin deferred bios using an rb_tree (bsc#1020795).\n - dm thin: synchronize the pool mode during suspend (bsc#1020795).\n - dm thin: use bool rather than unsigned for flags in structures\n (bsc#1020795).\n - dm thin: use INIT_WORK_ONSTACK in noflush_work to avoid ODEBUG warning\n (bsc#1020795).\n - dm thin: use per thin device deferred bio lists (bsc#1020795).\n - dm: use RCU_INIT_POINTER instead of rcu_assign_pointer in __unbind\n (bsc#1020795).\n - drm/i915: relax uncritical udelay_range() (bsc#1038261).\n - ether: add loopback type ETH_P_LOOPBACK (bsc#1028595).\n - ext4: fix bh leak on error paths in ext4_rename() and\n ext4_cross_rename() (bsc#1012985).\n - ext4: fix fencepost in s_first_meta_bg validation (bsc#1029986).\n - ext4: mark inode dirty after converting inline directory (bsc#1012985).\n - ftrace: Make ftrace_location_range() global (FATE#322421).\n - HID: usbhid: improve handling of Clear-Halt and reset (bsc#1031080).\n - hv: util: catch allocation errors\n - hv: utils: use memdup_user in hvt_op_write\n - hwrng: virtio - ensure reads happen after successful probe (bsc#954763\n bsc#1032344).\n - i40e: avoid null pointer dereference (bsc#922853).\n - i40e/i40evf: Break up xmit_descriptor_count from maybe_stop_tx\n (bsc#985561).\n - i40e/i40evf: Limit TSO to 7 descriptors for payload instead of 8 per\n packet (bsc#985561).\n - i40e/i40evf: Rewrite logic for 8 descriptor per packet check\n (bsc#985561).\n - i40e: Impose a lower limit on gso size (bsc#985561).\n - i40e: Limit TX descriptor count in cases where frag size is greater than\n 16K (bsc#985561).\n - iommu/vt-d: Flush old iommu caches for kdump when the device gets\n context mapped (bsc#1023824).\n - iommu/vt-d: Tylersburg isoch identity map check is done too late\n (bsc#1032125).\n - ipv6: make ECMP route replacement less greedy (bsc#930399).\n - kabi: hide changes in struct sk_buff (bsc#1009682).\n - KABI: Hide new include in arch/powerpc/kernel/process.c (fate#322421).\n - kABI: mask struct xfs_icdinode change (bsc#1024788).\n - kABI: protect struct inet6_dev (kabi).\n - kABI: protect struct iscsi_conn (bsc#103470).\n - kABI: protect struct xfs_buftarg and struct xfs_mount (bsc#1024508).\n - kABI: restore can_rx_register parameters (kabi).\n - kernel/watchdog: use nmi registers snapshot in hardlockup handler\n (bsc#940946, bsc#937444).\n - kgr: Mark eeh_event_handler() kthread safe using a timeout (bsc#1031662).\n - kgr/module: make a taint flag module-specific\n - kgr: remove unneeded kgr_needs_lazy_migration() s390x definition\n - l2tp: fix address test in __l2tp_ip6_bind_lookup() (bsc#1028415).\n - l2tp: fix lookup for sockets not bound to a device in l2tp_ip\n (bsc#1028415).\n - l2tp: fix racy socket lookup in l2tp_ip and l2tp_ip6 bind()\n (bsc#1028415).\n - l2tp: hold socket before dropping lock in l2tp_ip{, 6}_recv()\n (bsc#1028415).\n - l2tp: hold tunnel socket when handling control frames in l2tp_ip and\n l2tp_ip6 (bsc#1028415).\n - l2tp: lock socket before checking flags in connect() (bsc#1028415).\n - livepatch: Allow architectures to specify an alternate ftrace location\n (FATE#322421).\n - locking/semaphore: Add down_interruptible_timeout() (bsc#1031662).\n - md: avoid oops on unload if some process is in poll or select\n (bsc#1020795).\n - md: Convert use of typedef ctl_table to struct ctl_table (bsc#1020795).\n - md: ensure metadata is writen after raid level change (bsc#1020795).\n - md linear: fix a race between linear_add() and linear_congested()\n (bsc#1018446).\n - md: md_clear_badblocks should return an error code on failure\n (bsc#1020795).\n - md: refuse to change shape of array if it is active but read-only\n (bsc#1020795).\n - megaraid_sas: add missing curly braces in ioctl handler (bsc#1023207).\n - megaraid_sas: Fixup tgtid count in megasas_ld_list_query() (bsc#971933).\n - mm/huge_memory.c: respect FOLL_FORCE/FOLL_COW for thp (bnc#1030118).\n - mm, memcg: do not retry precharge charges (bnc#1022559).\n - mm/mempolicy.c: do not put mempolicy before using its nodemask\n (References: VM Performance, bnc#931620).\n - mm/page_alloc: fix nodes for reclaim in fast path (bnc#1031842).\n - module: move add_taint_module() to a header file\n - net: Add skb_gro_postpull_rcsum to udp and vxlan (bsc#1009682).\n - net: add skb_pop_rcv_encapsulation (bsc#1009682).\n - net: Call skb_checksum_init in IPv4 (bsc#1009682).\n - net: Call skb_checksum_init in IPv6 (bsc#1009682).\n - netfilter: allow logging fron non-init netns (bsc#970083).\n - net: Generalize checksum_init functions (bsc#1009682).\n - net: Preserve CHECKSUM_COMPLETE at validation (bsc#1009682).\n - NFS: do not try to cross a mountpount when there isn't one there\n (bsc#1028041).\n - NFS: Expedite unmount of NFS auto-mounts (bnc#1025802).\n - NFS: Fix a performance regression in readdir (bsc#857926).\n - NFS: flush out dirty data on file fput() (bsc#1021762).\n - ocfs2: do not write error flag to user structure we cannot copy from/to\n (bsc#1012985).\n - powerpc: Blacklist GCC 5.4 6.1 and 6.2 (boo#1028895).\n - powerpc: Create a helper for getting the kernel toc value (FATE#322421).\n - powerpc/fadump: Fix the race in crash_fadump() (bsc#1022971).\n - powerpc/fadump: Reserve memory at an offset closer to bottom of RAM\n (bsc#1032141).\n - powerpc/fadump: Update fadump documentation (bsc#1032141).\n - powerpc/ftrace: Add Kconfig & Make glue for mprofile-kernel\n (FATE#322421).\n - powerpc/ftrace: Add support for -mprofile-kernel ftrace ABI\n (FATE#322421).\n - powerpc/ftrace: Use $(CC_FLAGS_FTRACE) when disabling ftrace\n (FATE#322421).\n - powerpc/ftrace: Use generic ftrace_modify_all_code() (FATE#322421).\n - powerpc: introduce TIF_KGR_IN_PROGRESS thread flag (FATE#322421).\n - powerpc/kgraft: Add kgraft header (FATE#322421).\n - powerpc/kgraft: Add kgraft stack to struct thread_info (FATE#322421).\n - powerpc/kgraft: Add live patching support on ppc64le (FATE#322421).\n - powerpc/module: Create a special stub for ftrace_caller() (FATE#322421).\n - powerpc/module: Mark module stubs with a magic value (FATE#322421).\n - powerpc/module: Only try to generate the ftrace_caller() stub once\n (FATE#322421).\n - powerpc/modules: Never restore r2 for a mprofile-kernel style mcount()\n call (FATE#322421).\n - powerpc/prom: Increase minimum RMA size to 512MB (bsc#984530).\n - powerpc/pseries/cpuidle: Remove MAX_IDLE_STATE macro (bnc#1023164).\n - powerpc/pseries/cpuidle: Use cpuidle_register() for initialisation\n (bnc#1023164).\n - powerpc: Reject binutils 2.24 when building little endian (boo#1028895).\n - RAID1: avoid unnecessary spin locks in I/O barrier code\n (bsc#982783,bsc#1020048).\n - raid1: include bio_end_io_list in nr_queued to prevent freeze_array hang\n - remove mpath patches from dmcache backport, for bsc#1035738\n - revert "procfs: mark thread stack correctly in proc/PID/maps"\n (bnc#1030901).\n - Revert "RDMA/core: Fix incorrect structure packing for booleans" (kabi).\n - rtnetlink: allow to register ops without ops->setup set (bsc#1021374).\n - s390/zcrypt: Introduce CEX6 toleration (FATE#321783, LTC#147506,\n bsc#1019514).\n - sched/loadavg: Avoid loadavg spikes caused by delayed NO_HZ accounting\n (bsc#1018419).\n - scsi_error: count medium access timeout only once per EH run\n (bsc#993832, bsc#1032345).\n - scsi: libiscsi: add lock around task lists to fix list corruption\n regression (bsc#1034700).\n - scsi: storvsc: fix SRB_STATUS_ABORTED handling\n - sfc: reduce severity of PIO buffer alloc failures (bsc#1019168).\n - svcrpc: fix gss-proxy NULL dereference in some error cases (bsc#1024309).\n - taint/module: Clean up global and module taint flags handling\n - tcp: abort orphan sockets stalling on zero window probes (bsc#1021913).\n - thp: fix MADV_DONTNEED vs. numa balancing race (bnc#1027974).\n - thp: reduce indentation level in change_huge_pmd() (bnc#1027974).\n - treewide: fix "distingush" typo (bsc#1020795).\n - tree-wide: use reinit_completion instead of INIT_COMPLETION\n (bsc#1020795).\n - usb: dwc3: gadget: Fix incorrect DEPCMD and DGCMD status macros\n (bsc#1035699).\n - usb: host: xhci: print correct command ring address (bnc#1035699).\n - USB: serial: kl5kusb105: fix line-state error handling (bsc#1021256).\n - vfs: Do not exchange "short" filenames unconditionally (bsc#1012985).\n - vfs: split generic splice code from i_mutex locking (bsc#1024788).\n - vmxnet3: segCnt can be 1 for LRO packets (bsc#988065).\n - VSOCK: Detach QP check should filter out non matching QPs (bsc#1036752).\n - vxlan: cancel sock_work in vxlan_dellink() (bsc#1031567).\n - vxlan: Checksum fixes (bsc#1009682).\n - vxlan: GRO support at tunnel layer (bsc#1009682).\n - xen-blkfront: correct maximum segment accounting (bsc#1018263).\n - xen-blkfront: do not call talk_to_blkback when already connected to\n blkback.\n - xen-blkfront: free resources if xlvbd_alloc_gendisk fails.\n - xfs_dmapi: fix the debug compilation of xfs_dmapi (bsc#989056).\n - xfs: do not allow di_size with high bit set (bsc#1024234).\n - xfs: do not assert fail on non-async buffers on ioacct decrement\n (bsc#1024508).\n - xfs: exclude never-released buffers from buftarg I/O accounting\n (bsc#1024508).\n - xfs: fix broken multi-fsb buffer logging (bsc#1024081).\n - xfs: fix buffer overflow dm_get_dirattrs/dm_get_dirattrs2 (bsc#989056).\n - xfs: Fix lock ordering in splice write (bsc#1024788).\n - xfs: fix up xfs_swap_extent_forks inline extent handling (bsc#1023888).\n - xfs: Make xfs_icdinode->di_dmstate atomic_t (bsc#1024788).\n - xfs: pass total block res. as total xfs_bmapi_write() parameter\n (bsc#1029470).\n - xfs: replace global xfslogd wq with per-mount wq (bsc#1024508).\n - xfs: track and serialize in-flight async buffers against unmount\n (bsc#1024508).\n\n", "cvss3": {}, "published": "2017-05-19T18:10:39", "type": "suse", "title": "Security update for the Linux Kernel (important)", "bulletinFamily": "unix", "cvss2": {}, "cvelist": ["CVE-2016-10208", "CVE-2016-9604", "CVE-2016-9191", "CVE-2017-7261", "CVE-2017-6074", "CVE-2016-7117", "CVE-2017-7616", "CVE-2016-3070", "CVE-2017-7645", "CVE-2016-10200", "CVE-2017-2671", "CVE-2017-7294", "CVE-2017-6348", "CVE-2016-5243", "CVE-2017-6214", "CVE-2015-1350", "CVE-2017-7308", "CVE-2017-6345", "CVE-2017-5669", "CVE-2017-6951", "CVE-2017-2647", "CVE-2017-5986", "CVE-2017-6346", "CVE-2016-9588", "CVE-2017-6353", "CVE-2017-8106", "CVE-2017-7187", "CVE-2016-2117", "CVE-2016-10044", "CVE-2017-5897"], "modified": "2017-05-19T18:10:39", "id": "SUSE-SU-2017:1360-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00058.html", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-05-15T21:20:15", "description": "The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various\n security and bugfixes.\n\n Notable new features:\n\n - Toleration of newer crypto hardware for z Systems\n - USB 2.0 Link power management for Haswell-ULT\n\n The following security bugs were fixed:\n\n - CVE-2017-7308: The packet_set_ring function in net/packet/af_packet.c in\n the Linux kernel did not properly validate certain block-size data,\n which allowed local users to cause a denial of service (overflow) or\n possibly have unspecified other impact via crafted system calls\n (bnc#1031579)\n - CVE-2017-2671: The ping_unhash function in net/ipv4/ping.c in the Linux\n kernel was too late in obtaining a certain lock and consequently could\n not ensure that disconnect function calls are safe, which allowed local\n users to cause a denial of service (panic) by leveraging access to the\n protocol value of IPPROTO_ICMP in a socket system call (bnc#1031003)\n - CVE-2017-7184: The xfrm_replay_verify_len function in\n net/xfrm/xfrm_user.c in the Linux kernel did not validate certain size\n data after an XFRM_MSG_NEWAE update, which allowed local users to obtain\n root privileges or cause a denial of service (heap-based out-of-bounds\n access) by leveraging the CAP_NET_ADMIN capability (bsc#1030573).\n - CVE-2017-5970: The ipv4_pktinfo_prepare function in\n net/ipv4/ip_sockglue.c in the Linux kernel allowed attackers to cause a\n denial of service (system crash) via (1) an application that made\n crafted system calls or possibly (2) IPv4 traffic with invalid IP\n options (bsc#1024938).\n - CVE-2017-7616: Incorrect error handling in the set_mempolicy and mbind\n compat syscalls in mm/mempolicy.c in the Linux kernel allowed local\n users to obtain sensitive information from uninitialized stack data by\n triggering failure of a certain bitmap operation (bsc#1033336).\n - CVE-2017-7294: The vmw_surface_define_ioctl function in\n drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not\n validate addition of certain levels data, which allowed local users to\n trigger an integer overflow and out-of-bounds write, and cause a denial\n of service (system hang or crash) or possibly gain privileges, via a\n crafted ioctl call for a /dev/dri/renderD* device (bnc#1031440)\n - CVE-2017-7261: The vmw_surface_define_ioctl function in\n drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not\n check for a zero value of certain levels data, which allowed local users\n to cause a denial of service (ZERO_SIZE_PTR dereference, and GPF and\n possibly panic) via a crafted ioctl call for a /dev/dri/renderD* device\n (bnc#1031052)\n - CVE-2017-7187: The sg_ioctl function in drivers/scsi/sg.c in the Linux\n kernel allowed local users to cause a denial of service (stack-based\n buffer overflow) or possibly have unspecified other impact via a large\n command size in an SG_NEXT_CMD_LEN ioctl call, leading to out-of-bounds\n write access in the sg_write function (bnc#1030213)\n - CVE-2017-6348: The hashbin_delete function in net/irda/irqueue.c in the\n Linux kernel improperly managed lock dropping, which allowed local users\n to cause a denial of service (deadlock) via crafted operations on IrDA\n devices (bnc#1027178)\n - CVE-2017-5669: The do_shmat function in ipc/shm.c in the Linux kernel\n did not restrict the address calculated by a certain rounding operation,\n which allowed local users to map page zero, and consequently bypass a\n protection mechanism that exists for the mmap system call, by making\n crafted shmget and shmat system calls in a privileged context\n (bnc#1026914)\n - CVE-2015-3288: mm/memory.c in the Linux kernel mishandled anonymous\n pages, which allowed local users to gain privileges or cause a denial of\n service (page tainting) via a crafted application that triggers writing\n to page zero (bsc#979021).\n - CVE-2016-10200: Race condition in the L2TPv3 IP Encapsulation feature in\n the Linux kernel allowed local users to gain privileges or cause a\n denial of service (use-after-free) by making multiple bind system calls\n without properly ascertaining whether a socket has the SOCK_ZAPPED\n status, related to net/l2tp/l2tp_ip.c and net/l2tp/l2tp_ip6.c\n (bnc#1028415)\n - CVE-2016-5243: The tipc_nl_compat_link_dump function in\n net/tipc/netlink_compat.c in the Linux kernel did not properly copy a\n certain string, which allowed local users to obtain sensitive\n information from kernel stack memory by reading a Netlink message\n (bnc#983212)\n - CVE-2017-6353: net/sctp/socket.c in the Linux kernel did not properly\n restrict association peel-off operations during certain wait states,\n which allowed local users to cause a denial of service (invalid unlock\n and double free) via a multithreaded application (bnc#1027066)\n - CVE-2017-6214: The tcp_splice_read function in net/ipv4/tcp.c in the\n Linux kernel allowed remote attackers to cause a denial of service\n (infinite loop and soft lockup) via vectors involving a TCP packet with\n the URG flag (bnc#1026722)\n - CVE-2017-6074: The dccp_rcv_state_process function in net/dccp/input.c\n in the Linux kernel mishandled DCCP_PKT_REQUEST packet data structures\n in the LISTEN state, which allowed local users to obtain root privileges\n or cause a denial of service (double free) via an application that made\n an IPV6_RECVPKTINFO setsockopt system call (bnc#1026024)\n - CVE-2017-5986: Race condition in the sctp_wait_for_sndbuf function in\n net/sctp/socket.c in the Linux kernel allowed local users to cause a\n denial of service (assertion failure and panic) via a multithreaded\n application that peels off an association in a certain buffer-full state\n (bsc#1025235)\n - CVE-2015-8970: crypto/algif_skcipher.c in the Linux kernel did not\n verify that a setkey operation has been performed on an AF_ALG socket an\n accept system call is processed, which allowed local users to cause a\n denial of service (NULL pointer dereference and system crash) via a\n crafted application that does not supply a key, related to the lrw_crypt\n function in crypto/lrw.c (bsc#1008374).\n\n The following non-security bugs were fixed:\n\n - NFSD: do not risk using duplicate owner/file/delegation ids\n (bsc#1029212).\n - RAID1: avoid unnecessary spin locks in I/O barrier code (bsc#982783,\n bsc#1026260).\n - SUNRPC: Clean up the slot table allocation (bsc#1013862).\n - SUNRPC: Initalise the struct xprt upon allocation (bsc#1013862).\n - USB: cdc-acm: fix broken runtime suspend (bsc#1033771).\n - USB: cdc-acm: fix open and suspend race (bsc#1033771).\n - USB: cdc-acm: fix potential urb leak and PM imbalance in write\n (bsc#1033771).\n - USB: cdc-acm: fix runtime PM for control messages (bsc#1033771).\n - USB: cdc-acm: fix runtime PM imbalance at shutdown (bsc#1033771).\n - USB: cdc-acm: fix shutdown and suspend race (bsc#1033771).\n - USB: cdc-acm: fix write and resume race (bsc#1033771).\n - USB: cdc-acm: fix write and suspend race (bsc#1033771).\n - USB: hub: Fix crash after failure to read BOS descriptor\n - USB: serial: iuu_phoenix: fix NULL-deref at open (bsc#1033794).\n - USB: serial: kl5kusb105: fix line-state error handling (bsc#1021256).\n - USB: serial: mos7720: fix NULL-deref at open (bsc#1033816).\n - USB: serial: mos7720: fix parallel probe (bsc#1033816).\n - USB: serial: mos7720: fix parport use-after-free on probe errors\n (bsc#1033816).\n - USB: serial: mos7720: fix use-after-free on probe errors (bsc#1033816).\n - USB: serial: mos7840: fix NULL-deref at open (bsc#1034026).\n - USB: xhci-mem: use passed in GFP flags instead of GFP_KERNEL\n (bsc#1023014).\n - Update metadata for serial fixes (bsc#1013070)\n - Use PF_LESS_THROTTLE in loop device thread (bsc#1027101).\n - clocksource: Remove "weak" from clocksource_default_clock() declaration\n (bnc#1013018).\n - dlm: backport "fix lvb invalidation conditions" (bsc#1005651).\n - drm/mgag200: Add support for G200e rev 4 (bnc#995542, comment #81)\n - enic: set skb->hash type properly (bsc#911105).\n - ext4: fix mballoc breakage with 64k block size (bsc#1013018).\n - ext4: fix stack memory corruption with 64k block size (bsc#1013018).\n - ext4: reject inodes with negative size (bsc#1013018).\n - fuse: initialize fc->release before calling it (bsc#1013018).\n - i40e/i40evf: Break up xmit_descriptor_count from maybe_stop_tx\n (bsc#985561).\n - i40e/i40evf: Fix mixed size frags and linearization (bsc#985561).\n - i40e/i40evf: Limit TSO to 7 descriptors for payload instead of 8 per\n packet (bsc#985561).\n - i40e/i40evf: Rewrite logic for 8 descriptor per packet check\n (bsc#985561).\n - i40e: Fix TSO with more than 8 frags per segment issue (bsc#985561).\n - i40e: Impose a lower limit on gso size (bsc#985561).\n - i40e: Limit TX descriptor count in cases where frag size is greater than\n 16K (bsc#985561).\n - i40e: avoid null pointer dereference (bsc#909486).\n - jbd: Fix oops in journal_remove_journal_head() (bsc#1017143).\n - jbd: do not wait (forever) for stale tid caused by wraparound\n (bsc#1020229).\n - kABI: mask struct xfs_icdinode change (bsc#1024788).\n - kabi: Protect xfs_mount and xfs_buftarg (bsc#1024508).\n - kabi: fix (bsc#1008893).\n - lockd: use init_utsname for id encoding (bsc#1033804).\n - lockd: use rpc client's cl_nodename for id encoding (bsc#1033804).\n - md linear: fix a race between linear_add() and linear_congested()\n (bsc#1018446).\n - md/linear: shutup lockdep warnning (bsc#1018446).\n - mm/mempolicy.c: do not put mempolicy before using its nodemask\n (bnc#931620).\n - ocfs2: do not write error flag to user structure we cannot copy from/to\n (bsc#1013018).\n - ocfs2: fix crash caused by stale lvb with fsdlm plugin (bsc#1013800).\n - ocfs2: fix error return code in ocfs2_info_handle_freefrag()\n (bsc#1013018).\n - ocfs2: null deref on allocation error (bsc#1013018).\n - pciback: only check PF if actually dealing with a VF (bsc#999245).\n - pciback: use pci_physfn() (bsc#999245).\n - posix-timers: Fix stack info leak in timer_create() (bnc#1013018).\n - powerpc,cpuidle: Dont toggle CPUIDLE_FLAG_IGNORE while setting\n smt_snooze_delay (bsc#1023163).\n - powerpc/fadump: Fix the race in crash_fadump() (bsc#1022971).\n - powerpc/fadump: Reserve memory at an offset closer to bottom of RAM\n (bsc#1032141).\n - powerpc/fadump: Update fadump documentation (bsc#1032141).\n - powerpc/nvram: Fix an incorrect partition merge (bsc#1016489).\n - powerpc/vdso64: Use double word compare on pointers (bsc#1016489).\n - rcu: Call out dangers of expedited RCU primitives (bsc#1008893).\n - rcu: Direct algorithmic SRCU implementation (bsc#1008893).\n - rcu: Flip ->completed only once per SRCU grace period (bsc#1008893).\n - rcu: Implement a variant of Peter's SRCU algorithm (bsc#1008893).\n - rcu: Increment upper bit only for srcu_read_lock() (bsc#1008893).\n - rcu: Remove fast check path from __synchronize_srcu() (bsc#1008893).\n - s390/kmsg: add missing kmsg descriptions (bnc#1025702).\n - s390/vmlogrdr: fix IUCV buffer allocation (bnc#1025702).\n - s390/zcrypt: Introduce CEX6 toleration\n - sched/core: Fix TASK_DEAD race in finish_task_switch() (bnc#1013018).\n - sched/loadavg: Fix loadavg artifacts on fully idle and on fully loaded\n systems (bnc#1013018).\n - scsi: zfcp: do not trace pure benign residual HBA responses at default\n level (bnc#1025702).\n - scsi: zfcp: fix rport unblock race with LUN recovery (bnc#1025702).\n - scsi: zfcp: fix use-after-"free" in FC ingress path after TMF\n (bnc#1025702).\n - scsi: zfcp: fix use-after-free by not tracing WKA port open/close on\n failed send (bnc#1025702).\n - sfc: reduce severity of PIO buffer alloc failures (bsc#1019168).\n - tcp: abort orphan sockets stalling on zero window probes (bsc#1021913).\n - vfs: split generic splice code from i_mutex locking (bsc#1024788).\n - virtio_scsi: fix memory leak on full queue condition (bsc#1028880).\n - vmxnet3: segCnt can be 1 for LRO packets (bsc#988065, bsc#1029770).\n - xen-blkfront: correct maximum segment accounting (bsc#1018263).\n - xen-blkfront: do not call talk_to_blkback when already connected to\n blkback.\n - xen-blkfront: free resources if xlvbd_alloc_gendisk fails.\n - xfs: Fix lock ordering in splice write (bsc#1024788).\n - xfs: Make xfs_icdinode->di_dmstate atomic_t (bsc#1024788).\n - xfs: do not assert fail on non-async buffers on ioacct decrement\n (bsc#1024508).\n - xfs: exclude never-released buffers from buftarg I/O accounting\n (bsc#1024508).\n - xfs: fix buffer overflow dm_get_dirattrs/dm_get_dirattrs2 (bsc#989056).\n - xfs: fix up xfs_swap_extent_forks inline extent handling (bsc#1023888).\n - xfs: kill xfs_itruncate_start (bsc#1024788).\n - xfs: remove the i_new_size field in struct xfs_inode (bsc#1024788).\n - xfs: remove the i_size field in struct xfs_inode (bsc#1024788).\n - xfs: remove xfs_itruncate_data (bsc#1024788).\n - xfs: replace global xfslogd wq with per-mount wq (bsc#1024508).\n - xfs: split xfs_itruncate_finish (bsc#1024788).\n - xfs: split xfs_setattr (bsc#1024788).\n - xfs: track and serialize in-flight async buffers against unmount\n (bsc#1024508).\n - xfs_dmapi: fix the debug compilation of xfs_dmapi (bsc#989056).\n\n", "cvss3": {}, "published": "2017-05-15T21:33:24", "type": "suse", "title": "Security update for the Linux Kernel (important)", "bulletinFamily": "unix", "cvss2": {}, "cvelist": ["CVE-2017-7261", "CVE-2017-7184", "CVE-2017-6074", "CVE-2017-7616", "CVE-2015-3288", "CVE-2017-5970", "CVE-2016-10200", "CVE-2017-2671", "CVE-2017-7294", "CVE-2017-6348", "CVE-2015-8970", "CVE-2016-5243", "CVE-2017-6214", "CVE-2017-7308", "CVE-2017-5669", "CVE-2017-5986", "CVE-2017-6353", "CVE-2017-7187"], "modified": "2017-05-15T21:33:24", "id": "SUSE-SU-2017:1301-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00043.html", "cvss": {"score": 7.2, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-05-05T13:19:32", "description": "The SUSE Linux Enterprise 12 SP2 kernel was updated to 4.4.58 to receive\n various security and bugfixes.\n\n Notable new/improved features:\n - Improved support for Hyper-V\n - Support for Matrox G200eH3\n - Support for tcp_westwood\n\n The following security bugs were fixed:\n\n - CVE-2017-2671: The ping_unhash function in net/ipv4/ping.c in the Linux\n kernel was too late in obtaining a certain lock and consequently could\n not ensure that disconnect function calls are safe, which allowed local\n users to cause a denial of service (panic) by leveraging access to the\n protocol value of IPPROTO_ICMP in a socket system call (bnc#1031003).\n - CVE-2017-7308: The packet_set_ring function in net/packet/af_packet.c in\n the Linux kernel did not properly validate certain block-size data,\n which allowed local users to cause a denial of service (overflow) or\n possibly have unspecified other impact via crafted system calls\n (bnc#1031579).\n - CVE-2017-7294: The vmw_surface_define_ioctl function in\n drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not\n validate addition of certain levels data, which allowed local users to\n trigger an integer overflow and out-of-bounds write, and cause a denial\n of service (system hang or crash) or possibly gain privileges, via a\n crafted ioctl call for a /dev/dri/renderD* device (bnc#1031440).\n - CVE-2017-7261: The vmw_surface_define_ioctl function in\n drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not\n check for a zero value of certain levels data, which allowed local users\n to cause a denial of service (ZERO_SIZE_PTR dereference, and GPF and\n possibly panic) via a crafted ioctl call for a /dev/dri/renderD* device\n (bnc#1031052).\n - CVE-2017-7187: The sg_ioctl function in drivers/scsi/sg.c in the Linux\n kernel allowed local users to cause a denial of service (stack-based\n buffer overflow) or possibly have unspecified other impact via a large\n command size in an SG_NEXT_CMD_LEN ioctl call, leading to out-of-bounds\n write access in the sg_write function (bnc#1030213).\n - CVE-2017-7374: Use-after-free vulnerability in fs/crypto/ in the Linux\n kernel allowed local users to cause a denial of service (NULL pointer\n dereference) or possibly gain privileges by revoking keyring keys being\n used for ext4, f2fs, or ubifs encryption, causing cryptographic\n transform objects to be freed prematurely (bnc#1032006).\n - CVE-2016-10200: Race condition in the L2TPv3 IP Encapsulation feature in\n the Linux kernel allowed local users to gain privileges or cause a\n denial of service (use-after-free) by making multiple bind system calls\n without properly ascertaining whether a socket has the SOCK_ZAPPED\n status, related to net/l2tp/l2tp_ip.c and net/l2tp/l2tp_ip6.c\n (bnc#1028415).\n - CVE-2017-6345: The LLC subsystem in the Linux kernel did not ensure that\n a certain destructor exists in required circumstances, which allowed\n local users to cause a denial of service (BUG_ON) or possibly have\n unspecified other impact via crafted system calls (bnc#1027190).\n - CVE-2017-6346: Race condition in net/packet/af_packet.c in the Linux\n kernel allowed local users to cause a denial of service (use-after-free)\n or possibly have unspecified other impact via a multithreaded\n application that made PACKET_FANOUT setsockopt system calls\n (bnc#1027189).\n - CVE-2017-6353: net/sctp/socket.c in the Linux kernel did not properly\n restrict association peel-off operations during certain wait states,\n which allowed local users to cause a denial of service (invalid unlock\n and double free) via a multithreaded application. NOTE: this\n vulnerability exists because of an incorrect fix for CVE-2017-5986\n (bnc#1027066).\n - CVE-2017-6214: The tcp_splice_read function in net/ipv4/tcp.c in the\n Linux kernel allowed remote attackers to cause a denial of service\n (infinite loop and soft lockup) via vectors involving a TCP packet with\n the URG flag (bnc#1026722).\n - CVE-2016-2117: The atl2_probe function in\n drivers/net/ethernet/atheros/atlx/atl2.c in the Linux kernel incorrectly\n enables scatter/gather I/O, which allowed remote attackers to obtain\n sensitive information from kernel memory by reading packet data\n (bnc#968697).\n - CVE-2017-6347: The ip_cmsg_recv_checksum function in\n net/ipv4/ip_sockglue.c in the Linux kernel had incorrect expectations\n about skb data layout, which allowed local users to cause a denial of\n service (buffer over-read) or possibly have unspecified other impact via\n crafted system calls, as demonstrated by use of the MSG_MORE flag in\n conjunction with loopback UDP transmission (bnc#1027179).\n - CVE-2016-9191: The cgroup offline implementation in the Linux kernel\n mishandled certain drain operations, which allowed local users to cause\n a denial of service (system hang) by leveraging access to a container\n environment for executing a crafted application (bnc#1008842).\n - CVE-2017-2596: The nested_vmx_check_vmptr function in arch/x86/kvm/vmx.c\n in the Linux kernel improperly emulated the VMXON instruction, which\n allowed KVM L1 guest OS users to cause a denial of service (host OS\n memory consumption) by leveraging the mishandling of page references\n (bnc#1022785).\n - CVE-2017-6074: The dccp_rcv_state_process function in net/dccp/input.c\n in the Linux kernel mishandled DCCP_PKT_REQUEST packet data structures\n in the LISTEN state, which allowed local users to obtain root privileges\n or cause a denial of service (double free) via an application that made\n an IPV6_RECVPKTINFO setsockopt system call (bnc#1026024).\n\n The following non-security bugs were fixed:\n\n - ACPI, ioapic: Clear on-stack resource before using it (bsc#1028819).\n - ACPI: Do not create a platform_device for IOAPIC/IOxAPIC (bsc#1028819).\n - ACPI: Remove platform devices from a bus on removal (bsc#1028819).\n - HID: usbhid: Quirk a AMI virtual mouse and keyboard with ALWAYS_POLL\n (bsc#1022340).\n - NFS: do not try to cross a mountpount when there isn't one there\n (bsc#1028041).\n - NFS: flush out dirty data on file fput() (bsc#1021762).\n - PCI: hv: Fix wslot_to_devfn() to fix warnings on device removal\n (bug#1028217).\n - PCI: hv: Use device serial number as PCI domain (bug#1028217).\n - RAID1: a new I/O barrier implementation to remove resync window\n (bsc#998106,bsc#1020048,bsc#982783).\n - RAID1: avoid unnecessary spin locks in I/O barrier code\n (bsc#998106,bsc#1020048,bsc#982783).\n - Revert "RDMA/core: Fix incorrect structure packing for booleans" (kabi).\n - Revert "give up on gcc ilog2() constant optimizations" (kabi).\n - Revert "net/mlx4_en: Avoid unregister_netdev at shutdown flow"\n (bsc#1028017).\n - Revert "net: introduce device min_header_len" (kabi).\n - Revert "nfit, libnvdimm: fix interleave set cookie calculation" (kabi).\n - Revert "target: Fix NULL dereference during LUN lookup + active I/O\n shutdown" (kabi).\n - acpi, nfit: fix acpi_nfit_flush_probe() crash (bsc#1031717).\n - acpi, nfit: fix extended status translations for ACPI DSMs (bsc#1031717).\n - arm64: Use full path in KBUILD_IMAGE definition (bsc#1010032).\n - arm64: hugetlb: fix the wrong address for several functions\n (bsc#1032681).\n - arm64: hugetlb: fix the wrong return value for\n huge_ptep_set_access_flags (bsc#1032681).\n - arm64: hugetlb: remove the wrong pmd check in find_num_contig()\n (bsc#1032681).\n - arm: Use full path in KBUILD_IMAGE definition (bsc#1010032).\n - bnx2x: allow adding VLANs while interface is down (bsc#1027273).\n - bonding: fix 802.3ad aggregator reselection (bsc#1029514).\n - btrfs: Change qgroup_meta_rsv to 64bit (bsc#1019614).\n - btrfs: allow unlink to exceed subvolume quota (bsc#1019614).\n - btrfs: backref: Fix soft lockup in __merge_refs function (bsc#1017641).\n - btrfs: incremental send, do not delay rename when parent inode is new\n (bsc#1028325).\n - btrfs: incremental send, do not issue invalid rmdir operations\n (bsc#1028325).\n - btrfs: qgroup: Move half of the qgroup accounting time out of commit\n trans (bsc#1017461).\n - btrfs: qgroups: Retry after commit on getting EDQUOT (bsc#1019614).\n - btrfs: send, fix failure to rename top level inode due to name collision\n (bsc#1028325).\n - btrfs: serialize subvolume mounts with potentially mismatching rw flags\n (bsc#951844 bsc#1024015)\n - cgroup/pids: remove spurious suspicious RCU usage warning (bnc#1031831).\n - crypto: algif_hash - avoid zero-sized array (bnc#1007962).\n - cxgb4vf: do not offload Rx checksums for IPv6 fragments (bsc#1026692).\n - device-dax: fix private mapping restriction, permit read-only\n (bsc#1031717).\n - drm/i915: Add intel_uncore_suspend / resume functions (bsc#1011913).\n - drm/i915: Fix crash after S3 resume with DP MST mode change\n (bsc#1029634).\n - drm/i915: Listen for PMIC bus access notifications (bsc#1011913).\n - drm/i915: Only enable hotplug interrupts if the display interrupts are\n enabled (bsc#1031717).\n - drm/mgag200: Added support for the new device G200eH3 (bsc#1007959)\n - ext4: fix fencepost in s_first_meta_bg validation (bsc#1029986).\n - futex: Add missing error handling to FUTEX_REQUEUE_PI (bsc#969755).\n - futex: Fix potential use-after-free in FUTEX_REQUEUE_PI (bsc#969755).\n - hv: export current Hyper-V clocksource (bsc#1031206).\n - hv: util: do not forget to init host_ts.lock (bsc#1031206).\n - hv: vmbus: Prevent sending data on a rescinded channel (bug#1028217).\n - hv_utils: implement Hyper-V PTP source (bsc#1031206).\n - i2c-designware: increase timeout (bsc#1011913).\n - i2c: designware-baytrail: Acquire P-Unit access on bus acquire\n (bsc#1011913).\n - i2c: designware-baytrail: Call pmic_bus_access_notifier_chain\n (bsc#1011913).\n - i2c: designware-baytrail: Fix race when resetting the semaphore\n (bsc#1011913).\n - i2c: designware-baytrail: Only check iosf_mbi_available() for shared\n hosts (bsc#1011913).\n - i2c: designware: Disable pm for PMIC i2c-bus even if there is no _SEM\n method (bsc#1011913).\n - i2c: designware: Never suspend i2c-busses used for accessing the system\n PMIC (bsc#1011913).\n - i2c: designware: Rename accessor_flags to flags (bsc#1011913).\n - iommu/vt-d: Make sure IOMMUs are off when intel_iommu=off (bsc#1031208).\n - kABI: protect struct iscsi_conn (kabi).\n - kABI: protect struct se_node_acl (kabi).\n - kABI: restore can_rx_register parameters (kabi).\n - kgr/module: make a taint flag module-specific\n - kgr: Mark eeh_event_handler() kthread safe using a timeout (bsc#1031662).\n - kgr: remove all arch-specific kgraft header files\n - l2tp: fix address test in __l2tp_ip6_bind_lookup() (bsc#1028415).\n - l2tp: fix lookup for sockets not bound to a device in l2tp_ip\n (bsc#1028415).\n - l2tp: fix racy socket lookup in l2tp_ip and l2tp_ip6 bind()\n (bsc#1028415).\n - l2tp: hold socket before dropping lock in l2tp_ip{, 6}_recv()\n (bsc#1028415).\n - l2tp: hold tunnel socket when handling control frames in l2tp_ip and\n l2tp_ip6 (bsc#1028415).\n - l2tp: lock socket before checking flags in connect() (bsc#1028415).\n - libnvdimm, pfn: fix memmap reservation size versus 4K alignment\n (bsc#1031717).\n - locking/semaphore: Add down_interruptible_timeout() (bsc#1031662).\n - md/raid1: Refactor raid1_make_request\n (bsc#998106,bsc#1020048,bsc#982783).\n - md/raid1: add rcu protection to rdev in fix_read_error (References:\n bsc#998106,bsc#1020048,bsc#982783).\n - md/raid1: fix a use-after-free bug (bsc#998106,bsc#1020048,bsc#982783).\n - md/raid1: handle flush request correctly\n (bsc#998106,bsc#1020048,bsc#982783).\n - mm/huge_memory.c: respect FOLL_FORCE/FOLL_COW for thp (bnc#1030118).\n - mm/memblock.c: fix memblock_next_valid_pfn() (bnc#1031200).\n - mm/page_alloc: Remove useless parameter of __free_pages_boot_core\n (bnc#1027195).\n - mm: fix set pageblock migratetype in deferred struct page init\n (bnc#1027195).\n - mm: page_alloc: skip over regions of invalid pfns where possible\n (bnc#1031200).\n - module: move add_taint_module() to a header file\n - net/ena: change condition for host attribute configuration (bsc#1026509).\n - net/ena: change driver's default timeouts (bsc#1026509).\n - net/ena: fix NULL dereference when removing the driver after device\n reset failed (bsc#1026509).\n - net/ena: fix RSS default hash configuration (bsc#1026509).\n - net/ena: fix ethtool RSS flow configuration (bsc#1026509).\n - net/ena: fix potential access to freed memory during device reset\n (bsc#1026509).\n - net/ena: fix queues number calculation (bsc#1026509).\n - net/ena: reduce the severity of ena printouts (bsc#1026509).\n - net/ena: refactor ena_get_stats64 to be atomic context safe\n (bsc#1026509).\n - net/ena: remove ntuple filter support from device feature list\n (bsc#1026509).\n - net/ena: update driver version to 1.1.2 (bsc#1026509).\n - net/ena: use READ_ONCE to access completion descriptors (bsc#1026509).\n - net/mlx4_core: Avoid command timeouts during VF driver device shutdown\n (bsc#1028017).\n - net/mlx4_core: Avoid delays during VF driver device shutdown\n (bsc#1028017).\n - net/mlx4_core: Fix racy CQ (Completion Queue) free (bsc#1028017).\n - net/mlx4_core: Fix when to save some qp context flags for dynamic VST to\n VGT transitions (bsc#1028017).\n - net/mlx4_core: Use cq quota in SRIOV when creating completion EQs\n (bsc#1028017).\n - net/mlx4_en: Fix bad WQE issue (bsc#1028017).\n - net: ena: Fix error return code in ena_device_init() (bsc#1026509).\n - net: ena: Remove unnecessary pci_set_drvdata() (bsc#1026509).\n - net: ena: change the return type of ena_set_push_mode() to be void\n (bsc#1026509).\n - net: ena: remove superfluous check in ena_remove() (bsc#1026509).\n - net: ena: use setup_timer() and mod_timer() (bsc#1026509).\n - netfilter: allow logging from non-init namespaces (bsc#970083).\n - nvme: Do not suspend admin queue that wasn't created (bsc#1026505).\n - nvme: Suspend all queues before deletion (bsc#1026505).\n - ping: implement proper locking (bsc#1031003).\n - powerpc: Blacklist GCC 5.4 6.1 and 6.2 (boo#1028895).\n - rtlwifi: rtl_usb: Fix missing entry in USB driver's private data\n (bsc#1026462).\n - s390/kmsg: add missing kmsg descriptions (bnc#1025683).\n - s390/mm: fix zone calculation in arch_add_memory() (bnc#1025683).\n - sched/loadavg: Avoid loadavg spikes caused by delayed NO_HZ accounting\n (bsc#1018419).\n - scsi: do not print 'reservation conflict' for TEST UNIT READY\n (bsc#1027054).\n - scsi_dh_alua: Do not modify the interval value for retries (bsc#1012910).\n - softirq: Let ksoftirqd do its job (bsc#1019618).\n - x86, mm: fix gup_pte_range() vs DAX mappings (bsc#1026405).\n - x86/apic/uv: Silence a shift wrapping warning (bsc#1023866).\n - x86/ioapic: Change prototype of acpi_ioapic_add() (bsc#1027153,\n bsc#1027616).\n - x86/ioapic: Fix IOAPIC failing to request resource (bsc#1027153,\n bsc#1027616).\n - x86/ioapic: Fix incorrect pointers in ioapic_setup_resources()\n (bsc#1027153, bsc#1027616).\n - x86/ioapic: Fix lost IOAPIC resource after hot-removal and hotadd\n (bsc#1027153, bsc#1027616).\n - x86/ioapic: Fix setup_res() failing to get resource (bsc#1027153,\n bsc#1027616).\n - x86/ioapic: Ignore root bridges without a companion ACPI device\n (bsc#1027153, bsc#1027616).\n - x86/ioapic: Simplify ioapic_setup_resources() (bsc#1027153, bsc#1027616).\n - x86/ioapic: Support hot-removal of IOAPICs present during boot\n (bsc#1027153, bsc#1027616).\n - x86/ioapic: fix kABI (hide added include) (bsc#1027153, bsc#1027616).\n - x86/mce: Do not print MCEs when mcelog is active (bsc#1013994).\n - x86/mce: Fix copy/paste error in exception table entries\n - x86/mm/gup: Simplify get_user_pages() PTE bit handling (bsc#1026405).\n - x86/platform/UV: Add Support for UV4 Hubless NMIs (bsc#1023866).\n - x86/platform/UV: Add Support for UV4 Hubless systems (bsc#1023866).\n - x86/platform/UV: Add basic CPU NMI health check (bsc#1023866).\n - x86/platform/UV: Clean up the NMI code to match current coding style\n (bsc#1023866).\n - x86/platform/UV: Clean up the UV APIC code (bsc#1023866).\n - x86/platform/UV: Ensure uv_system_init is called when necessary\n (bsc#1023866).\n - x86/platform/UV: Fix 2 socket config problem (bsc#1023866).\n - x86/platform/UV: Fix panic with missing UVsystab support (bsc#1023866).\n - x86/platform/UV: Initialize PCH GPP_D_0 NMI Pin to be NMI source\n (bsc#1023866).\n - x86/platform/UV: Verify NMI action is valid, default is standard\n (bsc#1023866).\n - x86/platform/intel/iosf_mbi: Add a PMIC bus access notifier\n (bsc#1011913).\n - x86/platform/intel/iosf_mbi: Add a mutex for P-Unit access (bsc#1011913).\n - x86/platform: Remove warning message for duplicate NMI handlers\n (bsc#1029220).\n - x86/ras/therm_throt: Do not log a fake MCE for thermal events\n (bsc#1028027).\n - xen-blkfront: correct maximum segment accounting (bsc#1018263).\n - xen-blkfront: do not call talk_to_blkback when already connected to\n blkback.\n - xen-blkfront: free resources if xlvbd_alloc_gendisk fails.\n - xen/blkfront: Fix crash if backend does not follow the right states.\n - xen/netback: set default upper limit of tx/rx queues to 8 (bnc#1019163).\n - xen/netfront: set default upper limit of tx/rx queues to 8 (bnc#1019163).\n - xen: Use machine addresses in /sys/kernel/vmcoreinfo when PV\n (bsc#1014136)\n - xfs: do not take the IOLOCK exclusive for direct I/O page invalidation\n (bsc#1015609).\n - xgene_enet: remove bogus forward declarations (bsc#1032673).\n\n", "cvss3": {}, "published": "2017-05-05T15:11:30", "type": "suse", "title": "Security update for the Linux Kernel (important)", "bulletinFamily": "unix", "cvss2": {}, "cvelist": ["CVE-2016-9191", "CVE-2017-7261", "CVE-2017-6074", "CVE-2016-10200", "CVE-2017-2671", "CVE-2017-7294", "CVE-2017-6214", "CVE-2017-7374", "CVE-2017-7308", "CVE-2017-6345", "CVE-2017-5986", "CVE-2017-6346", "CVE-2017-2596", "CVE-2017-6353", "CVE-2017-7187", "CVE-2016-2117", "CVE-2017-6347"], "modified": "2017-05-05T15:11:30", "id": "SUSE-SU-2017:1183-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00011.html", "cvss": {"score": 7.2, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-04-01T13:17:35", "description": "======================================================================\n Still left to do:\n - Check CVE descriptions. They need to be written in the past tense. They\n are processed automatically, THERE CAN BE ERRORS IN THERE!\n - Remove version numbers from the CVE descriptions\n - Check the capitalization of the subsystems, then sort again\n - For each CVE: Check the corresponding bug if everything is okay\n - If you remove CVEs or bugs: Do not forget to change the meta information\n - Determine which of the bugs after the CVE lines is the right one\n\n ======================================================================\n\n The openSUSE Leap 42.1 kernel was updated to 4.1.39 to receive various\n security and bugfixes.\n\n The following security bugs were fixed:\n\n - CVE-2017-5669: The do_shmat function in ipc/shm.c in the Linux kernel\n did not restrict the address calculated by a certain rounding operation,\n which allowed local users to map page zero, and consequently bypass a\n protection mechanism that exists for the mmap system call, by making\n crafted shmget and shmat system calls in a privileged context\n (bnc#1026914).\n - CVE-2017-6348: The hashbin_delete function in net/irda/irqueue.c in the\n Linux kernel improperly manages lock dropping, which allowed local users\n to cause a denial of service (deadlock) via crafted operations on IrDA\n devices (bnc#1027178).\n - CVE-2017-7184: The xfrm_replay_verify_len function in\n net/xfrm/xfrm_user.c in the Linux kernel did not validate certain size\n data after an XFRM_MSG_NEWAE update, which allowed local users to obtain\n root privileges or cause a denial of service (heap-based out-of-bounds\n access) by leveraging the CAP_NET_ADMIN capability, as demonstrated\n during a Pwn2Own competition at CanSecWest 2017 for the Ubuntu 16.10\n linux-image-* package 4.8.0.41.52 (bnc#1030573).\n - CVE-2016-10200: Race condition in the L2TPv3 IP Encapsulation feature in\n the Linux kernel allowed local users to gain privileges or cause a\n denial of service (use-after-free) by making multiple bind system calls\n without properly ascertaining whether a socket has the SOCK_ZAPPED\n status, related to net/l2tp/l2tp_ip.c and net/l2tp/l2tp_ip6.c\n (bnc#1028415).\n - CVE-2017-2636: Race condition in drivers/tty/n_hdlc.c in the Linux\n kernel allowed local users to gain privileges or cause a denial of\n service (double free) by setting the HDLC line discipline (bnc#1027565).\n - CVE-2017-6345: The LLC subsystem in the Linux kernel did not ensure that\n a certain destructor exists in required circumstances, which allowed\n local users to cause a denial of service (BUG_ON) or possibly have\n unspecified other impact via crafted system calls (bnc#1027190).\n - CVE-2017-6346: Race condition in net/packet/af_packet.c in the Linux\n kernel allowed local users to cause a denial of service (use-after-free)\n or possibly have unspecified other impact via a multithreaded\n application that made PACKET_FANOUT setsockopt system calls\n (bnc#1027189).\n - CVE-2017-6347: The ip_cmsg_recv_checksum function in\n net/ipv4/ip_sockglue.c in the Linux kernel has incorrect expectations\n about skb data layout, which allowed local users to cause a denial of\n service (buffer over-read) or possibly have unspecified other impact via\n crafted system calls, as demonstrated by use of the MSG_MORE flag in\n conjunction with loopback UDP transmission (bnc#1027179).\n - CVE-2017-6353: net/sctp/socket.c in the Linux kernel did not properly\n restrict association peel-off operations during certain wait states,\n which allowed local users to cause a denial of service (invalid unlock\n and double free) via a multithreaded application. NOTE: this\n vulnerability exists because of an incorrect fix for CVE-2017-5986\n (bnc#1025235).\n - CVE-2017-6214: The tcp_splice_read function in net/ipv4/tcp.c in the\n Linux kernel allowed remote attackers to cause a denial of service\n (infinite loop and soft lockup) via vectors involving a TCP packet with\n the URG flag (bnc#1026722).\n - CVE-2016-2117: The atl2_probe function in\n drivers/net/ethernet/atheros/atlx/atl2.c in the Linux kernel incorrectly\n enables scatter/gather I/O, which allowed remote attackers to obtain\n sensitive information from kernel memory by reading packet data\n (bnc#968697).\n - CVE-2016-10208: The ext4_fill_super function in fs/ext4/super.c in the\n Linux kernel did not properly validate meta block groups, which allowed\n physically proximate attackers to cause a denial of service\n (out-of-bounds read and system crash) via a crafted ext4 image\n (bnc#1023377).\n - CVE-2017-2596: The nested_vmx_check_vmptr function in arch/x86/kvm/vmx.c\n in the Linux kernel improperly emulates the VMXON instruction, which\n allowed KVM L1 guest OS users to cause a denial of service (host OS\n memory consumption) by leveraging the mishandling of page references\n (bnc#1022785).\n - CVE-2017-2583: The load_segment_descriptor implementation in\n arch/x86/kvm/emulate.c in the Linux kernel improperly emulates a "MOV\n SS, NULL selector" instruction, which allowed guest OS users to cause a\n denial of service (guest OS crash) or gain guest OS privileges via a\n crafted application (bnc#1020602).\n - CVE-2017-2584: arch/x86/kvm/emulate.c in the Linux kernel allowed local\n users to obtain sensitive information from kernel memory or cause a\n denial of service (use-after-free) via a crafted application that\n leverages instruction emulation for fxrstor, fxsave, sgdt, and sidt\n (bnc#1019851).\n\n The following non-security bugs were fixed:\n\n - Fix kABI breakage of musb struct in 4.1.39 (stable 4.1.39).\n - Revert "ptrace: Capture the ptracer's creds not PT_PTRACE_CAP" (stable\n 4.1.39).\n - ext4: fix fencepost in s_first_meta_bg validation (bsc#1029986).\n - ext4: validate s_first_meta_bg at mount time (bsc#1023377).\n - kabi/severities: Ignore x86/kvm kABI changes for 4.1.39\n - l2tp: fix address test in __l2tp_ip6_bind_lookup() (bsc#1028415).\n - l2tp: fix lookup for sockets not bound to a device in l2tp_ip\n (bsc#1028415).\n - l2tp: fix racy socket lookup in l2tp_ip and l2tp_ip6 bind()\n (bsc#1028415).\n - l2tp: hold socket before dropping lock in l2tp_ip{, 6}_recv()\n (bsc#1028415).\n - l2tp: lock socket before checking flags in connect() (bsc#1028415).\n - mm/huge_memory.c: respect FOLL_FORCE/FOLL_COW for thp (bsc#1030118).\n\n", "cvss3": {}, "published": "2017-04-01T15:07:45", "type": "suse", "title": "Security update for the Linux Kernel (important)", "bulletinFamily": "unix", "cvss2": {}, "cvelist": ["CVE-2016-10208", "CVE-2017-7184", "CVE-2017-2584", "CVE-2016-10200", "CVE-2017-2636", "CVE-2017-6348", "CVE-2017-2583", "CVE-2017-6214", "CVE-2017-6345", "CVE-2017-5669", "CVE-2017-5986", "CVE-2017-6346", "CVE-2017-2596", "CVE-2017-6353", "CVE-2016-2117", "CVE-2017-6347"], "modified": "2017-04-01T15:07:45", "id": "OPENSUSE-SU-2017:0906-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2017-04/msg00000.html", "cvss": {"score": 7.2, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-02-22T21:00:08", "description": "The openSUSE Leap 42.2 kernel was updated to 4.4.49 to receive various\n security and bugfixes.\n\n The following security bugs were fixed:\n\n - CVE-2017-5986: A userlevel triggerable BUG_ON on sctp_wait_for_sndbuf\n was fixed. (bsc#1025235)\n - CVE-2017-5970: The ipv4_pktinfo_prepare function in\n net/ipv4/ip_sockglue.c in the Linux kernel allowed attackers to cause a\n denial of service (system crash) via (1) an application that made\n crafted system calls or possibly (2) IPv4 traffic with invalid IP\n options (bnc#1024938).\n - CVE-2017-5897: A potential remote denial of service within the IPv6 GRE\n protocol was fixed. (bsc#1023762)\n - CVE-2017-6074: The dccp_rcv_state_process function in net/dccp/input.c\n in the Linux kernel mishandled DCCP_PKT_REQUEST packet data structures\n in the LISTEN state, which allowed local users to cause a denial of\n service (invalid free) or possibly have unspecified other impact via an\n application that makes an IPV6_RECVPKTINFO setsockopt system call.\n (bsc#1026024).\n\n The following non-security bugs were fixed:\n\n - btrfs: fix btrfs_compat_ioctl failures on non-compat ioctls\n (bsc#1018100).\n - iwlwifi: Expose the default fallback ucode API to module info\n (boo#1021082, boo#1023884).\n - kabi: protect struct tcp_fastopen_cookie (kabi).\n - md: ensure md devices are freed before module is unloaded (bsc#1022304).\n - md: Fix a regression reported by bsc#1020048 in\n patches.fixes/0003-md-lockless-I-O-submission-for-RAID1.patch\n (bsc#982783,bsc#998106,bsc#1020048).\n - net: ethtool: Initialize buffer when querying device channel settings\n (bsc#969479 FATE#320634).\n - net: implement netif_cond_dbg macro (bsc#1019168).\n - sfc: reduce severity of PIO buffer alloc failures (bsc#1019168).\n - sfc: refactor debug-or-warnings printks (bsc#1019168).\n - xfs_dmapi: fix the debug compilation of xfs_dmapi (bsc#989056).\n - xfs: do not allow di_size with high bit set (bsc#1024234).\n - xfs: exclude never-released buffers from buftarg I/O accounting\n (bsc#1024508).\n - xfs: fix broken multi-fsb buffer logging (bsc#1024081).\n - xfs: fix buffer overflow dm_get_dirattrs/dm_get_dirattrs2 (bsc#989056).\n - xfs: fix up xfs_swap_extent_forks inline extent handling (bsc#1023888).\n - xfs: track and serialize in-flight async buffers against unmount\n (bsc#1024508).\n - xfs: track and serialize in-flight async buffers against unmount - kABI\n (bsc#1024508).\n\n", "cvss3": {}, "published": "2017-02-22T21:10:07", "type": "suse", "title": "Security update for the Linux Kernel (important)", "bulletinFamily": "unix", "cvss2": {}, "cvelist": ["CVE-2017-6074", "CVE-2017-5970", "CVE-2017-5986", "CVE-2017-5897"], "modified": "2017-02-22T21:10:07", "id": "OPENSUSE-SU-2017:0541-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00036.html", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2017-02-22T21:00:08", "description": "The openSUSE Leap 42.1 kernel was updated to receive various security and\n bugfixes.\n\n The following security bugs were fixed:\n\n - CVE-2017-6074: The dccp_rcv_state_process function in net/dccp/input.c\n in the Linux kernel mishandled DCCP_PKT_REQUEST packet data structures\n in the LISTEN state, which allowed local users to cause a denial of\n service (invalid free) or possibly have unspecified other impact via an\n application that made an IPV6_RECVPKTINFO setsockopt system call\n (bnc#1026024).\n - CVE-2017-5986: Race condition in the sctp_wait_for_sndbuf function in\n net/sctp/socket.c in the Linux kernel allowed local users to cause a\n denial of service (assertion failure and panic) via a multithreaded\n application that peels off an association in a certain buffer-full state\n (bnc#1025235).\n - CVE-2017-5970: The ipv4_pktinfo_prepare function in\n net/ipv4/ip_sockglue.c in the Linux kernel allowed attackers to cause a\n denial of service (system crash) via (1) an application that made\n crafted system calls or possibly (2) IPv4 traffic with invalid IP\n options (bnc#1024938).\n - CVE-2017-5897: A potential remote denial of service within the IPv6 GRE\n protocol was fixed. (bsc#1023762)\n\n The following non-security bugs were fixed:\n\n - btrfs: support NFSv2 export (bnc#929871).\n - btrfs: Direct I/O: Fix space accounting (bsc#1025058).\n - btrfs: add RAID 5/6 BTRFS_RBIO_REBUILD_MISSING operation (bsc#1025069).\n - btrfs: bail out if block group has different mixed flag (bsc#1025072).\n - btrfs: be more precise on errors when getting an inode from disk\n (bsc#981038).\n - btrfs: check pending chunks when shrinking fs to avoid corruption\n (bnc#936445).\n - btrfs: check prepare_uptodate_page() error code earlier (bnc#966910).\n - btrfs: do not BUG() during drop snapshot (bsc#1025076).\n - btrfs: do not collect ordered extents when logging that inode exists\n (bsc#977685).\n - btrfs: do not initialize a space info as full to prevent ENOSPC\n (bnc#944001).\n - btrfs: do not leak reloc root nodes on error (bsc#1025074).\n - btrfs: fix block group -&gt;space_info null pointer dereference\n (bnc#935088).\n - btrfs: fix chunk allocation regression leading to transaction abort\n (bnc#938550).\n - btrfs: fix crash on close_ctree() if cleaner starts new transaction\n (bnc#938891).\n - btrfs: fix deadlock between direct IO reads and buffered writes\n (bsc#973855).\n - btrfs: fix deadlock between direct IO write and defrag/readpages\n (bnc#965344).\n - btrfs: fix device replace of a missing RAID 5/6 device (bsc#1025057).\n - btrfs: fix empty symlink after creating symlink and fsync parent dir\n (bsc#977685).\n - btrfs: fix extent accounting for partial direct IO writes (bsc#1025062).\n - btrfs: fix file corruption after cloning inline extents (bnc#942512).\n - btrfs: fix file loss on log replay after renaming a file and fsync\n (bsc#977685).\n - btrfs: fix file read corruption after extent cloning and fsync\n (bnc#946902).\n - btrfs: fix fitrim discarding device area reserved for boot loader's use\n (bsc#904489).\n - btrfs: fix for incorrect directory entries after fsync log replay\n (bsc#957805, bsc#977685).\n - btrfs: fix hang when failing to submit bio of directIO (bnc#942685).\n - btrfs: fix incremental send failure caused by balance (bsc#985850).\n - btrfs: fix invalid page accesses in extent_same (dedup) ioctl\n (bnc#968230).\n - btrfs: fix listxattrs not listing all xattrs packed in the same item\n (bsc#1025063).\n - btrfs: fix loading of orphan roots leading to BUG_ON (bsc#972844).\n - btrfs: fix memory corruption on failure to submit bio for direct IO\n (bnc#942685).\n - btrfs: fix memory leak in do_walk_down (bsc#1025075).\n - btrfs: fix memory leak in reading btree blocks (bsc#1025071).\n - btrfs: fix order by which delayed references are run (bnc#949440).\n - btrfs: fix page reading in extent_same ioctl leading to csum errors\n (bnc#968230).\n - btrfs: fix qgroup rescan worker initialization (bsc#1025077).\n - btrfs: fix qgroup sanity tests (bnc#951615).\n - btrfs: fix race between balance and unused block group deletion\n (bnc#938892).\n - btrfs: fix race between fsync and lockless direct IO writes (bsc#977685).\n - btrfs: fix race waiting for qgroup rescan worker (bnc#960300).\n - btrfs: fix regression running delayed references when using qgroups\n (bnc#951615).\n - btrfs: fix regression when running delayed references (bnc#951615).\n - btrfs: fix relocation incorrectly dropping data references (bsc#990384).\n - btrfs: fix shrinking truncate when the no_holes feature is enabled\n (bsc#1025053).\n - btrfs: fix sleeping inside atomic context in qgroup rescan worker\n (bnc#960300).\n - btrfs: fix stale dir entries after removing a link and fsync\n (bnc#942925).\n - btrfs: fix unreplayable log after snapshot delete + parent dir fsync\n (bsc#977685).\n - btrfs: fix warning in backref walking (bnc#966278).\n - btrfs: fix warning of bytes_may_use (bsc#1025065).\n - btrfs: fix wrong check for btrfs_force_chunk_alloc() (bnc#938550).\n - btrfs: handle quota reserve failure properly (bsc#1005666).\n - btrfs: incremental send, check if orphanized dir inode needs delayed\n rename (bsc#1025049).\n - btrfs: incremental send, do not delay directory renames unnecessarily\n (bsc#1025048).\n - btrfs: incremental send, fix clone operations for compressed extents\n (fate#316463).\n - btrfs: incremental send, fix premature rmdir operations (bsc#1025064).\n - btrfs: keep dropped roots in cache until transaction commit (bnc#935087,\n bnc#945649, bnc#951615).\n - btrfs: remove misleading handling of missing device scrub (bsc#1025055).\n - btrfs: remove unnecessary locking of cleaner_mutex to avoid deadlock\n (bsc#904489).\n - btrfs: return gracefully from balance if fs tree is corrupted\n (bsc#1025073).\n - btrfs: send, do not bug on inconsistent snapshots (bsc#985850).\n - btrfs: send, fix corner case for reference overwrite detection\n (bsc#1025080).\n - btrfs: send, fix file corruption due to incorrect cloning operations\n (bsc#1025060).\n - btrfs: set UNWRITTEN for prealloc'ed extents in fiemap (bsc#1025047).\n - btrfs: test_check_exists: Fix infinite loop when searching for free\n space entries (bsc#987192).\n - btrfs: use btrfs_get_fs_root in resolve_indirect_ref (bnc#935087,\n bnc#945649).\n - btrfs: use received_uuid of parent during send (bsc#1025051).\n - btrfs: wake up extent state waiters on unlock through clear_extent_bits\n (bsc#1025050).\n - btrfs: Add handler for invalidate page (bsc#963193).\n - btrfs: Add qgroup tracing (bnc#935087, bnc#945649).\n - btrfs: Avoid truncate tailing page if fallocate range does not exceed\n inode size (bsc#1025059).\n - btrfs: Continue write in case of can_not_nocow (bsc#1025070).\n - btrfs: Ensure proper sector alignment for btrfs_free_reserved_data_space\n (bsc#1005666).\n - btrfs: Export and move leaf/subtree qgroup helpers to qgroup.c\n (bsc#983087).\n - btrfs: Fix a data space underflow warning (bsc#985562, bsc#975596,\n bsc#984779).\n - btrfs: Handle unaligned length in extent_same (bsc#937609).\n - btrfs: abort transaction on btrfs_reloc_cow_block() (bsc#1025081).\n - btrfs: add missing discards when unpinning extents with -o discard\n (bsc#904489).\n - btrfs: advertise which crc32c implementation is being used on mount\n (bsc#946057).\n - btrfs: allow dedupe of same inode (bsc#1025067).\n - btrfs: backref: Add special time_seq == (u64)-1 case for\n btrfs_find_all_roots() (bnc#935087, bnc#945649).\n - btrfs: backref: Do not merge refs which are not for same block\n (bnc#935087, bnc#945649).\n - btrfs: btrfs_issue_discard ensure offset/length are aligned to sector\n boundaries (bsc#904489).\n - btrfs: change max_inline default to 2048 (bsc#949472).\n - btrfs: delayed-ref: Cleanup the unneeded functions (bnc#935087,\n bnc#945649).\n - btrfs: delayed-ref: Use list to replace the ref_root in ref_head\n (bnc#935087, bnc#945649).\n - btrfs: delayed-ref: double free in btrfs_add_delayed_tree_ref()\n (bsc#1025079).\n - btrfs: delayed_ref: Add new function to record reserved space into\n delayed ref (bsc#963193).\n - btrfs: delayed_ref: release and free qgroup reserved at proper timing\n (bsc#963193).\n - btrfs: disable defrag of tree roots.\n - btrfs: do not create or leak aliased root while cleaning up orphans\n (bsc#994881).\n - btrfs: do not update mtime/ctime on deduped inodes (bsc#937616).\n - btrfs: explictly delete unused block groups in close_ctree and\n ro-remount (bsc#904489).\n - btrfs: extent-tree: Add new version of btrfs_check_data_free_space and\n btrfs_free_reserved_data_space (bsc#963193).\n - btrfs: extent-tree: Add new version of\n btrfs_delalloc_reserve/release_space (bsc#963193).\n - btrfs: extent-tree: Switch to new check_data_free_space and\n free_reserved_data_space (bsc#963193).\n - btrfs: extent-tree: Switch to new delalloc space reserve and release\n (bsc#963193).\n - btrfs: extent-tree: Use ref_node to replace unneeded parameters in\n __inc_extent_ref() and __free_extent() (bnc#935087, bnc#945649).\n - btrfs: extent_io: Introduce needed structure for recoding set/clear bits\n (bsc#963193).\n - btrfs: extent_io: Introduce new function clear_record_extent_bits()\n (bsc#963193).\n - btrfs: extent_io: Introduce new function set_record_extent_bits\n (bsc#963193).\n - btrfs: fallocate: Add support to accurate qgroup reserve (bsc#963193).\n - btrfs: fix btrfs_compat_ioctl failures on non-compat ioctls\n (bsc#1018100).\n - btrfs: fix clone / extent-same deadlocks (bsc#937612).\n - btrfs: fix deadlock with extent-same and readpage (bsc#937612).\n - btrfs: fix resending received snapshot with parent (bsc#1025061).\n - btrfs: handle non-fatal errors in btrfs_qgroup_inherit() (bsc#972951).\n - btrfs: increment ctx-&gt;pos for every emitted or skipped dirent in\n readdir (bsc#981709).\n - btrfs: iterate over unused chunk space in FITRIM (bsc#904489).\n - btrfs: make btrfs_issue_discard return bytes discarded (bsc#904489).\n - btrfs: make file clone aware of fatal signals (bsc#1015787).\n - btrfs: pass unaligned length to btrfs_cmp_data() (bsc#937609).\n - btrfs: properly track when rescan worker is running (bsc#989953).\n - btrfs: provide super_operations-&gt;inode_get_dev (bsc#927455).\n - btrfs: qgroup: Add function qgroup_update_counters() (bnc#935087,\n bnc#945649).\n - btrfs: qgroup: Add function qgroup_update_refcnt() (bnc#935087,\n bnc#945649).\n - btrfs: qgroup: Add handler for NOCOW and inline (bsc#963193).\n - btrfs: qgroup: Add new function to record old_roots (bnc#935087,\n bnc#945649).\n - btrfs: qgroup: Add new qgroup calculation function\n btrfs_qgroup_account_extents() (bnc#935087, bnc#945649).\n - btrfs: qgroup: Add new trace point for qgroup data reserve (bsc#963193).\n - btrfs: qgroup: Add the ability to skip given qgroup for old/new_roots\n (bnc#935087, bnc#945649).\n - btrfs: qgroup: Avoid calling btrfs_free_reserved_data_space in\n clear_bit_hook (bsc#963193).\n - btrfs: qgroup: Check if qgroup reserved space leaked (bsc#963193).\n - btrfs: qgroup: Cleanup old inaccurate facilities (bsc#963193).\n - btrfs: qgroup: Cleanup open-coded old/new_refcnt update and read\n (bnc#935087, bnc#945649).\n - btrfs: qgroup: Cleanup the old ref_node-oriented mechanism (bnc#935087,\n bnc#945649).\n - btrfs: qgroup: Do not copy extent buffer to do qgroup rescan\n (bnc#960300).\n - btrfs: qgroup: Fix a race in delayed_ref which leads to abort trans\n (bsc#963193).\n - btrfs: qgroup: Fix a rebase bug which will cause qgroup double free\n (bsc#963193).\n - btrfs: qgroup: Fix a regression in qgroup reserved space (bnc#935087,\n bnc#945649).\n - btrfs: qgroup: Fix qgroup accounting when creating snapshot (bsc#972993).\n - btrfs: qgroup: Fix qgroup data leaking by using subtree tracing\n (bsc#983087).\n - btrfs: qgroup: Introduce btrfs_qgroup_reserve_data function (bsc#963193).\n - btrfs: qgroup: Introduce functions to release/free qgroup reserve data\n space (bsc#963193).\n - btrfs: qgroup: Introduce new functions to reserve/free metadata\n (bsc#963193).\n - btrfs: qgroup: Make snapshot accounting work with new extent-oriented\n qgroup (bnc#935087, bnc#945649).\n - btrfs: qgroup: Record possible quota-related extent for qgroup\n (bnc#935087, bnc#945649).\n - btrfs: qgroup: Switch rescan to new mechanism (bnc#935087, bnc#945649).\n - btrfs: qgroup: Switch self test to extent-oriented qgroup mechanism\n (bnc#935087, bnc#945649).\n - btrfs: qgroup: Switch to new extent-oriented qgroup mechanism\n (bnc#935087, bnc#945649).\n - btrfs: qgroup: Use new metadata reservation (bsc#963193).\n - btrfs: qgroup: account shared subtree during snapshot delete\n (bnc#935087, bnc#945649).\n - btrfs: qgroup: exit the rescan worker during umount (bnc#960300).\n - btrfs: qgroup: fix quota disable during rescan (bnc#960300).\n - btrfs: remove old tree_root dirent processing in btrfs_real_readdir()\n (bsc#981709).\n - btrfs: serialize subvolume mounts with potentially mismatching rw flags\n (bsc#951844).\n - btrfs: skip superblocks during discard (bsc#904489).\n - btrfs: syslog when quota is disabled.\n - btrfs: syslog when quota is enabled\n - btrfs: ulist: Add ulist_del() function (bnc#935087, bnc#945649).\n - btrfs: use the new VFS super_block_dev (bnc#865869).\n - btrfs: waiting on qgroup rescan should not always be interruptible\n (bsc#992712).\n - fs/super.c: add new super block sub devices super_block_dev (bnc#865869).\n - fs/super.c: fix race between freeze_super() and thaw_super()\n (bsc#1025066).\n - kabi: only use sops-&gt;get_inode_dev with proper fsflag (bsc#927455).\n - qgroup: Prevent qgroup-&gt;reserved from going subzero (bsc#993841).\n - vfs: add super_operations-&gt;get_inode_dev (bsc#927455).\n - xfs: do not allow di_size with high bit set (bsc#1024234).\n - xfs: exclude never-released buffers from buftarg I/O accounting\n (bsc#1024508).\n - xfs: fix broken multi-fsb buffer logging (bsc#1024081).\n - xfs: fix up xfs_swap_extent_forks inline extent handling (bsc#1023888).\n - xfs: track and serialize in-flight async buffers against unmount - kABI\n (bsc#1024508).\n - xfs: track and serialize in-flight async buffers against unmount\n (bsc#1024508).\n\n", "cvss3": {}, "published": "2017-02-22T21:15:53", "type": "suse", "title": "Security update for the Linux Kernel (important)", "bulletinFamily": "unix", "cvss2": {}, "cvelist": ["CVE-2017-6074", "CVE-2017-5970", "CVE-2017-5986", "CVE-2017-5897"], "modified": "2017-02-22T21:15:53", "id": "OPENSUSE-SU-2017:0547-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00037.html", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2017-05-08T19:19:43", "description": "The openSUSE Leap 42.1 kernel was updated to receive various security and\n bugfixes.\n\n\n The following security bugs were fixed:\n\n - CVE-2017-7618: crypto/ahash.c in the Linux kernel allowed attackers to\n cause a denial of service (API operation calling its own callback, and\n infinite recursion) by triggering EBUSY on a full queue (bnc#1033340).\n - CVE-2016-10318: A missing authorization check in the\n fscrypt_process_policy function in fs/crypto/policy.c in the ext4 and\n f2fs filesystem encryption support in the Linux kernel allowed a user to\n assign an encryption policy to a directory owned by a different user,\n potentially creating a denial of service (bnc#1032435).\n - CVE-2017-7616: Incorrect error handling in the set_mempolicy and mbind\n compat syscalls in mm/mempolicy.c in the Linux kernel allowed local\n users to obtain sensitive information from uninitialized stack data by\n triggering failure of a certain bitmap operation (bnc#1033336).\n - CVE-2017-7308: The packet_set_ring function in net/packet/af_packet.c in\n the Linux kernel did not properly validate certain block-size data,\n which allowed local users to cause a denial of service (overflow) or\n possibly have unspecified other impact via crafted system calls\n (bnc#1031579).\n - CVE-2017-2671: The ping_unhash function in net/ipv4/ping.c in the Linux\n kernel is too late in obtaining a certain lock and consequently cannot\n ensure that disconnect function calls are safe, which allowed local\n users to cause a denial of service (panic) by leveraging access to the\n protocol value of IPPROTO_ICMP in a socket system call (bnc#1031003).\n - CVE-2017-7294: The vmw_surface_define_ioctl function in\n drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not\n validate addition of certain levels data, which allowed local users to\n trigger an integer overflow and out-of-bounds write, and cause a denial\n of service (system hang or crash) or possibly gain privileges, via a\n crafted ioctl call for a /dev/dri/renderD* device (bnc#1031440).\n - CVE-2017-7261: The vmw_surface_define_ioctl function in\n drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not\n check for a zero value of certain levels data, which allowed local users\n to cause a denial of service (ZERO_SIZE_PTR dereference, and GPF and\n possibly panic) via a crafted ioctl call for a /dev/dri/renderD* device\n (bnc#1031052).\n - CVE-2017-7187: The sg_ioctl function in drivers/scsi/sg.c in the Linux\n kernel allowed local users to cause a denial of service (stack-based\n buffer overflow) or possibly have unspecified other impact via a large\n command size in an SG_NEXT_CMD_LEN ioctl call, leading to out-of-bounds\n write access in the sg_write function (bnc#1030213).\n\n The following non-security bugs were fixed:\n\n - ata: ahci_xgene: free structure returned by acpi_get_object_info()\n (bsc#1033518).\n - doc/README.SUSE: update links to KMP manual\n - ext4: do not perform data journaling when data is encrypted\n (bsc#1012876).\n - ext4: fix use-after-iput when fscrypt contexts are inconsistent\n (bsc#1012829).\n - ext4: mark inode dirty after converting inline directory (bsc#1012876).\n - ext4: reject inodes with negative size (bsc#1012876).\n - fs, seqfile: always allow oom killer (bsc#1012876).\n - ipv6: make ECMP route replacement less greedy (bsc#930399).\n - l2tp: hold tunnel socket when handling control frames in l2tp_ip and\n l2tp_ip6 (bsc#1028415).\n - mm: filemap: do not plant shadow entries without radix tree node\n (bsc#1012876).\n - netfilter: allow logging from non-init namespaces (bsc#970083).\n - nfsd4: minor NFSv2/v3 write decoding cleanup (bsc#1034670 CVE#2017-7645).\n - nfsd: check for oversized NFSv2/v3 arguments (bsc#1034670 CVE#2017-7645).\n - nfsd: stricter decoding of write-like NFSv2/v3 ops (bsc#1034670\n CVE#2017-7645).\n\n", "cvss3": {}, "published": "2017-05-08T21:09:15", "type": "suse", "title": "Security update for the Linux Kernel (important)", "bulletinFamily": "unix", "cvss2": {}, "cvelist": ["CVE-2017-7261", "CVE-2017-7616", "CVE-2017-7618", "CVE-2017-2671", "CVE-2017-7294", "CVE-2017-7308", "CVE-2016-10318", "CVE-2017-7187"], "modified": "2017-05-08T21:09:15", "id": "OPENSUSE-SU-2017:1215-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00016.html", "cvss": {"score": 7.8, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:COMPLETE/"}}, {"lastseen": "2017-04-01T13:17:35", "description": "The openSUSE Leap 42.2 kernel was updated to 4.4.56 fix various security\n issues and bugs.\n\n The following security bugs were fixed:\n\n - CVE-2017-7184: The xfrm_replay_verify_len function in\n net/xfrm/xfrm_user.c in the Linux kernel did not validate certain size\n data after an XFRM_MSG_NEWAE update, which allowed local users to obtain\n root privileges or cause a denial of service (heap-based out-of-bounds\n access) by leveraging the CAP_NET_ADMIN capability, as demonstrated\n during a Pwn2Own competition at CanSecWest 2017 for the Ubuntu 16.10\n linux-image-* package 4.8.0.41.52 (bnc#1030573).\n - CVE-2016-10200: Race condition in the L2TPv3 IP Encapsulation feature in\n the Linux kernel allowed local users to gain privileges or cause a\n denial of service (use-after-free) by making multiple bind system calls\n without properly ascertaining whether a socket has the SOCK_ZAPPED\n status, related to net/l2tp/l2tp_ip.c and net/l2tp/l2tp_ip6.c\n (bnc#1028415).\n - CVE-2017-2636: Race condition in drivers/tty/n_hdlc.c in the Linux\n kernel allowed local users to gain privileges or cause a denial of\n service (double free) by setting the HDLC line discipline (bnc#1027565).\n - CVE-2017-6345: The LLC subsystem in the Linux kernel did not ensure that\n a certain destructor exists in required circumstances, which allowed\n local users to cause a denial of service (BUG_ON) or possibly have\n unspecified other impact via crafted system calls (bnc#1027190).\n - CVE-2017-6346: Race condition in net/packet/af_packet.c in the Linux\n kernel allowed local users to cause a denial of service (use-after-free)\n or possibly have unspecified other impact via a multithreaded\n application that made PACKET_FANOUT setsockopt system calls\n (bnc#1027189).\n - CVE-2017-6353: net/sctp/socket.c in the Linux kernel did not properly\n restrict association peel-off operations during certain wait states,\n which allowed local users to cause a denial of service (invalid unlock\n and double free) via a multithreaded application. NOTE: this\n vulnerability exists because of an incorrect fix for CVE-2017-5986\n (bnc#1025235).\n - CVE-2017-6214: The tcp_splice_read function in net/ipv4/tcp.c in the\n Linux kernel allowed remote attackers to cause a denial of service\n (infinite loop and soft lockup) via vectors involving a TCP packet with\n the URG flag (bnc#1026722).\n - CVE-2016-2117: The atl2_probe function in\n drivers/net/ethernet/atheros/atlx/atl2.c in the Linux kernel incorrectly\n enables scatter/gather I/O, which allowed remote attackers to obtain\n sensitive information from kernel memory by reading packet data\n (bnc#968697).\n - CVE-2017-6347: The ip_cmsg_recv_checksum function in\n net/ipv4/ip_sockglue.c in the Linux kernel has incorrect expectations\n about skb data layout, which allowed local users to cause a denial of\n service (buffer over-read) or possibly have unspecified other impact via\n crafted system calls, as demonstrated by use of the MSG_MORE flag in\n conjunction with loopback UDP transmission (bnc#1027179).\n - CVE-2016-9191: The cgroup offline implementation in the Linux kernel\n mishandled certain drain operations, which allowed local users to cause\n a denial of service (system hang) by leveraging access to a container\n environment for executing a crafted application, as demonstrated by\n trinity (bnc#1008842).\n - CVE-2017-2596: The nested_vmx_check_vmptr function in arch/x86/kvm/vmx.c\n in the Linux kernel improperly emulates the VMXON instruction, which\n allowed KVM L1 guest OS users to cause a denial of service (host OS\n memory consumption) by leveraging the mishandling of page references\n (bnc#1022785).\n\n The following non-security bugs were fixed:\n\n - ACPI: Do not create a platform_device for IOAPIC/IOxAPIC (bsc#1028819).\n - ACPI, ioapic: Clear on-stack resource before using it (bsc#1028819).\n - ACPI: Remove platform devices from a bus on removal (bsc#1028819).\n - add mainline tag to one hyperv patch\n - bnx2x: allow adding VLANs while interface is down (bsc#1027273).\n - btrfs: backref: Fix soft lockup in __merge_refs function (bsc#1017641).\n - btrfs: incremental send, do not delay rename when parent inode is new\n (bsc#1028325).\n - btrfs: incremental send, do not issue invalid rmdir operations\n (bsc#1028325).\n - btrfs: qgroup: Move half of the qgroup accounting time out of commit\n trans (bsc#1017461).\n - btrfs: send, fix failure to rename top level inode due to name collision\n (bsc#1028325).\n - btrfs: serialize subvolume mounts with potentially mismatching rw flags\n (bsc#951844 bsc#1024015)\n - crypto: algif_hash - avoid zero-sized array (bnc#1007962).\n - cxgb4vf: do not offload Rx checksums for IPv6 fragments (bsc#1026692).\n - drivers: hv: vmbus: Prevent sending data on a rescinded channel\n (fate#320485, bug#1028217).\n - drm/i915: Add intel_uncore_suspend / resume functions (bsc#1011913).\n - drm/i915: Listen for PMIC bus access notifications (bsc#1011913).\n - drm/mgag200: Added support for the new device G200eH3 (bsc#1007959,\n fate#322780)\n - ext4: fix fencepost in s_first_meta_bg validation (bsc#1029986).\n - Fix kABI breakage of dccp in 4.4.56 (stable-4.4.56).\n - futex: Add missing error handling to FUTEX_REQUEUE_PI (bsc#969755).\n - futex: Fix potential use-after-free in FUTEX_REQUEUE_PI (bsc#969755).\n - i2c: designware-baytrail: Acquire P-Unit access on bus acquire\n (bsc#1011913).\n - i2c: designware-baytrail: Call pmic_bus_access_notifier_chain\n (bsc#1011913).\n - i2c: designware-baytrail: Fix race when resetting the semaphore\n (bsc#1011913).\n - i2c: designware-baytrail: Only check iosf_mbi_available() for shared\n hosts (bsc#1011913).\n - i2c: designware: Disable pm for PMIC i2c-bus even if there is no _SEM\n method (bsc#1011913).\n - i2c-designware: increase timeout (bsc#1011913).\n - i2c: designware: Never suspend i2c-busses used for accessing the system\n PMIC (bsc#1011913).\n - i2c: designware: Rename accessor_flags to flags (bsc#1011913).\n - kABI: protect struct iscsi_conn (kabi).\n - kABI: protect struct se_node_acl (kabi).\n - kABI: restore can_rx_register parameters (kabi).\n - kgr/module: make a taint flag module-specific (fate#313296).\n - kgr: remove all arch-specific kgraft header files (fate#313296).\n - l2tp: fix address test in __l2tp_ip6_bind_lookup() (bsc#1028415).\n - l2tp: fix lookup for sockets not bound to a device in l2tp_ip\n (bsc#1028415).\n - l2tp: fix racy socket lookup in l2tp_ip and l2tp_ip6 bind()\n (bsc#1028415).\n - l2tp: hold socket before dropping lock in l2tp_ip{, 6}_recv()\n (bsc#1028415).\n - l2tp: lock socket before checking flags in connect() (bsc#1028415).\n - md/raid1: add rcu protection to rdev in fix_read_error (References:\n bsc#998106,bsc#1020048,bsc#982783).\n - md/raid1: fix a use-after-free bug (bsc#998106,bsc#1020048,bsc#982783).\n - md/raid1: handle flush request correctly\n (bsc#998106,bsc#1020048,bsc#982783).\n - md/raid1: Refactor raid1_make_request\n (bsc#998106,bsc#1020048,bsc#982783).\n - mm: fix set pageblock migratetype in deferred struct page init\n (bnc#1027195).\n - mm/page_alloc: Remove useless parameter of __free_pages_boot_core\n (bnc#1027195).\n - module: move add_taint_module() to a header file (fate#313296).\n - net/ena: change condition for host attribute configuration (bsc#1026509).\n - net/ena: change driver's default timeouts (bsc#1026509).\n - net: ena: change the return type of ena_set_push_mode() to be void\n (bsc#1026509).\n - net: ena: Fix error return code in ena_device_init() (bsc#1026509).\n - net/ena: fix ethtool RSS flow configuration (bsc#1026509).\n - net/ena: fix NULL dereference when removing the driver after device\n reset failed (bsc#1026509).\n - net/ena: fix potential access to freed memory during device reset\n (bsc#1026509).\n - net/ena: fix queues number calculation (bsc#1026509).\n - net/ena: fix RSS default hash configuration (bsc#1026509).\n - net/ena: reduce the severity of ena printouts (bsc#1026509).\n - net/ena: refactor ena_get_stats64 to be atomic context safe\n (bsc#1026509).\n - net/ena: remove ntuple filter support from device feature list\n (bsc#1026509).\n - net: ena: remove superfluous check in ena_remove() (bsc#1026509).\n - net: ena: Remove unnecessary pci_set_drvdata() (bsc#1026509).\n - net/ena: update driver version to 1.1.2 (bsc#1026509).\n - net/ena: use READ_ONCE to access completion descriptors (bsc#1026509).\n - net: ena: use setup_timer() and mod_timer() (bsc#1026509).\n - net/mlx4_core: Avoid command timeouts during VF driver device shutdown\n (bsc#1028017).\n - net/mlx4_core: Avoid delays during VF driver device shutdown\n (bsc#1028017).\n - net/mlx4_core: Fix racy CQ (Completion Queue) free (bsc#1028017).\n - net/mlx4_core: Fix when to save some qp context flags for dynamic VST to\n VGT transitions (bsc#1028017).\n - net/mlx4_core: Use cq quota in SRIOV when creating completion EQs\n (bsc#1028017).\n - net/mlx4_en: Fix bad WQE issue (bsc#1028017).\n - NFS: do not try to cross a mountpount when there isn't one there\n (bsc#1028041).\n - nvme: Do not suspend admin queue that wasn't created (bsc#1026505).\n - nvme: Suspend all queues before deletion (bsc#1026505).\n - PCI: hv: Fix wslot_to_devfn() to fix warnings on device removal\n (fate#320485, bug#1028217).\n - PCI: hv: Use device serial number as PCI domain (fate#320485,\n bug#1028217).\n - powerpc: Blacklist GCC 5.4 6.1 and 6.2 (boo#1028895).\n - RAID1: a new I/O barrier implementation to remove resync window\n (bsc#998106,bsc#1020048,bsc#982783).\n - RAID1: avoid unnecessary spin locks in I/O barrier code\n (bsc#998106,bsc#1020048,bsc#982783).\n - Revert "give up on gcc ilog2() constant optimizations" (kabi).\n - Revert "net: introduce device min_header_len" (kabi).\n - Revert "net/mlx4_en: Avoid unregister_netdev at shutdown flow"\n (bsc#1028017).\n - Revert "nfit, libnvdimm: fix interleave set cookie calculation" (kabi).\n - Revert "RDMA/core: Fix incorrect structure packing for booleans" (kabi).\n - Revert "target: Fix NULL dereference during LUN lookup + active I/O\n shutdown" (kabi).\n - rtlwifi: rtl_usb: Fix missing entry in USB driver's private data\n (bsc#1026462).\n - s390/kmsg: add missing kmsg descriptions (bnc#1025683, LTC#151573).\n - s390/mm: fix zone calculation in arch_add_memory() (bnc#1025683,\n LTC#152318).\n - sched/loadavg: Avoid loadavg spikes caused by delayed NO_HZ accounting\n (bsc#1018419).\n - scsi_dh_alua: Do not modify the interval value for retries (bsc#1012910).\n - scsi: do not print 'reservation conflict' for TEST UNIT READY\n (bsc#1027054).\n - softirq: Let ksoftirqd do its job (bsc#1019618).\n - supported.conf: Add tcp_westwood as supported module (fate#322432)\n - taint/module: Clean up global and module taint flags handling\n (fate#313296).\n - Update mainline reference in\n patches.drivers/drm-ast-Fix-memleaks-in-error-path-in-ast_fb_create.patch S\n ee (bsc#1028158) for the context in which this was discovered upstream.\n - x86/apic/uv: Silence a shift wrapping warning (bsc#1023866).\n - x86/mce: Do not print MCEs when mcelog is active (bsc#1013994).\n - x86, mm: fix gup_pte_range() vs DAX mappings (bsc#1026405).\n - x86/mm/gup: Simplify get_user_pages() PTE bit handling (bsc#1026405).\n - x86/platform/intel/iosf_mbi: Add a mutex for P-Unit access (bsc#1011913).\n - x86/platform/intel/iosf_mbi: Add a PMIC bus access notifier\n (bsc#1011913).\n - x86/platform: Remove warning message for duplicate NMI handlers\n (bsc#1029220).\n - x86/platform/UV: Add basic CPU NMI health check (bsc#1023866).\n - x86/platform/UV: Add Support for UV4 Hubless NMIs (bsc#1023866).\n - x86/platform/UV: Add Support for UV4 Hubless systems (bsc#1023866).\n - x86/platform/UV: Clean up the NMI code to match current coding style\n (bsc#1023866).\n - x86/platform/UV: Clean up the UV APIC code (bsc#1023866).\n - x86/platform/UV: Ensure uv_system_init is called when necessary\n (bsc#1023866).\n - x86/platform/UV: Fix 2 socket config problem (bsc#1023866).\n - x86/platform/UV: Fix panic with missing UVsystab support (bsc#1023866).\n - x86/platform/UV: Initialize PCH GPP_D_0 NMI Pin to be NMI source\n (bsc#1023866).\n - x86/platform/UV: Verify NMI action is valid, default is standard\n (bsc#1023866).\n - xen-blkfront: correct maximum segment accounting (bsc#1018263).\n - xen-blkfront: do not call talk_to_blkback when already connected to\n blkback.\n - xen/blkfront: Fix crash if backend does not follow the right states.\n - xen-blkfront: free resources if xlvbd_alloc_gendisk fails.\n - xen/netback: set default upper limit of tx/rx queues to 8 (bnc#1019163).\n - xen/netfront: set default upper limit of tx/rx queues to 8 (bnc#1019163).\n - xfs: do not take the IOLOCK exclusive for direct I/O page invalidation\n (bsc#1015609).\n\n", "cvss3": {}, "published": "2017-04-01T15:11:17", "type": "suse", "title": "Security update for the Linux Kernel (important)", "bulletinFamily": "unix", "cvss2": {}, "cvelist": ["CVE-2016-9191", "CVE-2017-7184", "CVE-2016-10200", "CVE-2017-2636", "CVE-2017-6214", "CVE-2017-6345", "CVE-2017-5986", "CVE-2017-6346", "CVE-2017-2596", "CVE-2017-6353", "CVE-2016-2117", "CVE-2017-6347"], "modified": "2017-04-01T15:11:17", "id": "OPENSUSE-SU-2017:0907-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2017-04/msg00001.html", "cvss": {"score": 7.2, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-05-01T23:19:19", "description": "The openSUSE Leap 42.2 kernel was updated to 4.4.62 to receive various\n security and bugfixes.\n\n The following security bugs were fixed:\n\n - CVE-2017-7618: crypto/ahash.c in the Linux kernel allowed attackers to\n cause a denial of service (API operation calling its own callback, and\n infinite recursion) by triggering EBUSY on a full queue (bnc#1033340).\n - CVE-2016-4997: The compat IPT_SO_SET_REPLACE and IP6T_SO_SET_REPLACE\n setsockopt implementations in the netfilter subsystem in the Linux\n kernel allowed local users to gain privileges or cause a denial of\n service (memory corruption) by leveraging in-container root access to\n provide a crafted offset value that triggers an unintended decrement\n (bnc#986362).\n - CVE-2016-4998: The IPT_SO_SET_REPLACE setsockopt implementation in the\n netfilter subsystem in the Linux kernel allowed local users to cause a\n denial of service (out-of-bounds read) or possibly obtain sensitive\n information from kernel heap memory by leveraging in-container root\n access to provide a crafted offset value that leads to crossing a\n ruleset blob boundary (bnc#986365).\n - CVE-2017-7616: Incorrect error handling in the set_mempolicy and mbind\n compat syscalls in mm/mempolicy.c in the Linux kernel allowed local\n users to obtain sensitive information from uninitialized stack data by\n triggering failure of a certain bitmap operation (bnc#1033336).\n - CVE-2017-2671: The ping_unhash function in net/ipv4/ping.c in the Linux\n kernel was too late in obtaining a certain lock and consequently cannot\n ensure that disconnect function calls are safe, which allowed local\n users to cause a denial of service (panic) by leveraging access to the\n protocol value of IPPROTO_ICMP in a socket system call (bnc#1031003).\n - CVE-2017-7308: The packet_set_ring function in net/packet/af_packet.c in\n the Linux kernel did not properly validate certain block-size data,\n which allowed local users to cause a denial of service (overflow) or\n possibly have unspecified other impact via crafted system calls\n (bnc#1031579).\n - CVE-2017-7294: The vmw_surface_define_ioctl function in\n drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not\n validate addition of certain levels data, which allowed local users to\n trigger an integer overflow and out-of-bounds write, and cause a denial\n of service (system hang or crash) or possibly gain privileges, via a\n crafted ioctl call for a /dev/dri/renderD* device (bnc#1031440).\n - CVE-2017-7261: The vmw_surface_define_ioctl function in\n drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not\n check for a zero value of certain levels data, which allowed local users\n to cause a denial of service (ZERO_SIZE_PTR dereference, and GPF and\n possibly panic) via a crafted ioctl call for a /dev/dri/renderD* device\n (bnc#1031052).\n - CVE-2017-7187: The sg_ioctl function in drivers/scsi/sg.c in the Linux\n kernel allowed local users to cause a denial of service (stack-based\n buffer overflow) or possibly have unspecified other impact via a large\n command size in an SG_NEXT_CMD_LEN ioctl call, leading to out-of-bounds\n write access in the sg_write function (bnc#1030213).\n - CVE-2017-7374: Use-after-free vulnerability in fs/crypto/ in the Linux\n kernel allowed local users to cause a denial of service (NULL pointer\n dereference) or possibly gain privileges by revoking keyring keys being\n used for ext4, f2fs, or ubifs encryption, causing cryptographic\n transform objects to be freed prematurely (bnc#1032006).\n\n The following non-security bugs were fixed:\n\n - acpi, nfit: fix acpi_nfit_flush_probe() crash (bsc#1031717).\n - acpi, nfit: fix extended status translations for ACPI DSMs (bsc#1031717).\n - arm64: hugetlb: fix the wrong address for several functions\n (bsc#1032681).\n - arm64: hugetlb: fix the wrong return value for\n huge_ptep_set_access_flags (bsc#1032681).\n - arm64: hugetlb: remove the wrong pmd check in find_num_contig()\n (bsc#1032681).\n - arm64: Use full path in KBUILD_IMAGE definition (bsc#1010032).\n - arm: Use full path in KBUILD_IMAGE definition (bsc#1010032).\n - blacklist.conf: 73667e31a153 x86/hyperv: Hide unused label\n - blacklist.conf: Add ed10858 ("scsi: smartpqi: fix time handling") to\n blacklist\n - blacklist.conf: blacklist 9770404a which was subsequently reverted\n - blacklist.conf: Blacklist f2fs fix\n - blacklist.conf: Blacklist unneeded commit, because of a partial backport.\n - blacklist.conf: Split SP2 and SP3 entries to ease merging\n - blacklist: Fix blacklisting of 0c313cb20732\n - block: copy NOMERGE flag from bio to request (bsc#1030070).\n - bonding: fix 802.3ad aggregator reselection (bsc#1029514).\n - btrfs: add transaction space reservation tracepoints (bsc#1012452).\n - btrfs: allow unlink to exceed subvolume quota (bsc#1019614).\n - btrfs: avoid uninitialized variable warning (bsc#1012452).\n - btrfs: __btrfs_buffered_write: Reserve/release extents aligned to block\n size (bsc#1012452).\n - btrfs: btrfs_ioctl_clone: Truncate complete page after performing clone\n operation (bsc#1012452).\n - btrfs: btrfs_page_mkwrite: Reserve space in sectorsized units\n (bsc#1012452).\n - btrfs: btrfs_submit_direct_hook: Handle map_length &lt; bio vector\n length (bsc#1012452).\n - btrfs: change how we update the global block rsv (bsc#1012452).\n - btrfs: Change qgroup_meta_rsv to 64bit (bsc#1019614).\n - btrfs: check reserved when deciding to background flush (bsc#1012452).\n - btrfs: Clean pte corresponding to page straddling i_size (bsc#1012452).\n - btrfs: Compute and look up csums based on sectorsized blocks\n (bsc#1012452).\n - btrfs: csum_tree_block: return proper errno value (bsc#1012452).\n - btrfs: device add and remove: use GFP_KERNEL (bsc#1012452).\n - btrfs: Direct I/O read: Work on sectorsized blocks (bsc#1012452).\n - btrfs: do not write corrupted metadata blocks to disk (bsc#1012452).\n - btrfs: extent same: use GFP_KERNEL for page array allocations\n (bsc#1012452).\n - btrfs: fallback to vmalloc in btrfs_compare_tree (bsc#1012452).\n - btrfs: fallocate: use GFP_KERNEL (bsc#1012452).\n - btrfs: fallocate: Work with sectorsized blocks (bsc#1012452).\n - btrfs: Fix block size returned to user space (bsc#1012452).\n - btrfs: fix build warning (bsc#1012452).\n - btrfs: fix delalloc accounting after copy_from_user faults (bsc#1012452).\n - btrfs: fix extent_same allowing destination offset beyond i_size\n (bsc#1012452).\n - btrfs: fix handling of faults from btrfs_copy_from_user (bsc#1012452).\n - btrfs: fix invalid reference in replace_path (bsc#1012452).\n - btrfs: fix listxattrs not listing all xattrs packed in the same item\n (bsc#1012452).\n - btrfs: fix lockdep deadlock warning due to dev_replace (bsc#1012452).\n - btrfs: fix truncate_space_check (bsc#1012452).\n - btrfs: Improve FL_KEEP_SIZE handling in fallocate (bsc#1012452).\n - btrfs: let callers of btrfs_alloc_root pass gfp flags (bsc#1012452).\n - btrfs: Limit inline extents to root-&gt;sectorsize (bsc#1012452).\n - btrfs: make sure we stay inside the bvec during __btrfs_lookup_bio_sums\n (bsc#1012452).\n - btrfs: Output more info for enospc_debug mount option (bsc#1012452).\n - btrfs: Print Warning only if ENOSPC_DEBUG is enabled (bsc#1012452).\n - btrfs: qgroups: Retry after commit on getting EDQUOT (bsc#1019614).\n - btrfs: reada: add all reachable mirrors into reada device list\n (bsc#1012452).\n - btrfs: reada: Add missed segment checking in reada_find_zone\n (bsc#1012452).\n - btrfs: reada: Avoid many times of empty loop (bsc#1012452).\n - btrfs: reada: avoid undone reada extents in btrfs_reada_wait\n (bsc#1012452).\n - btrfs: reada: bypass adding extent when all zone failed (bsc#1012452).\n - btrfs: reada: Fix a debug code typo (bsc#1012452).\n - btrfs: reada: Fix in-segment calculation for reada (bsc#1012452).\n - btrfs: reada: ignore creating reada_extent for a non-existent device\n (bsc#1012452).\n - btrfs: reada: Jump into cleanup in direct way for __readahead_hook()\n (bsc#1012452).\n - btrfs: reada: limit max works count (bsc#1012452).\n - btrfs: reada: Move is_need_to_readahead contition earlier (bsc#1012452).\n - btrfs: reada: move reada_extent_put to place after __readahead_hook()\n (bsc#1012452).\n - btrfs: reada: Pass reada_extent into __readahead_hook directly\n (bsc#1012452).\n - btrfs: reada: reduce additional fs_info-&gt;reada_lock in\n reada_find_zone (bsc#1012452).\n - btrfs: reada: Remove level argument in severial functions (bsc#1012452).\n - btrfs: reada: simplify dev-&gt;reada_in_flight processing (bsc#1012452).\n - btrfs: reada: Use fs_info instead of root in __readahead_hook's argument\n (bsc#1012452).\n - btrfs: reada: use GFP_KERNEL everywhere (bsc#1012452).\n - btrfs: readdir: use GFP_KERNEL (bsc#1012452).\n - btrfs: remove redundant error check (bsc#1012452).\n - btrfs: Reset IO error counters before start of device replacing\n (bsc#1012452).\n - btrfs: scrub: use GFP_KERNEL on the submission path (bsc#1012452).\n - btrfs: Search for all ordered extents that could span across a page\n (bsc#1012452).\n - btrfs: send: use GFP_KERNEL everywhere (bsc#1012452).\n - btrfs: switch to kcalloc in btrfs_cmp_data_prepare (bsc#1012452).\n - btrfs: Use (eb-&gt;start, seq) as search key for tree modification log\n (bsc#1012452).\n - btrfs: use proper type for failrec in extent_state (bsc#1012452).\n - ceph: fix recursively call between ceph_set_acl and __ceph_setattr\n (bsc#1034902).\n - cgroup/pids: remove spurious suspicious RCU usage warning (bnc#1031831).\n - cxgb4: Add control net_device for configuring PCIe VF (bsc#1021424).\n - cxgb4: Add llseek operation for flash debugfs entry (bsc#1021424).\n - cxgb4: add new routine to get adapter info (bsc#1021424).\n - cxgb4: Add PCI device ID for new adapter (bsc#1021424).\n - cxgb4: Add port description for new cards (bsc#1021424).\n - cxgb4: Add support to enable logging of firmware mailbox commands\n (bsc#1021424).\n - cxgb4: Check for firmware errors in the mailbox command loop\n (bsc#1021424).\n - cxgb4: correct device ID of T6 adapter (bsc#1021424).\n - cxgb4/cxgb4vf: Add set VF mac address support (bsc#1021424).\n - cxgb4/cxgb4vf: Allocate more queues for 25G and 100G adapter\n (bsc#1021424).\n - cxgb4/cxgb4vf: Assign netdev-&gt;dev_port with port ID (bsc#1021424).\n - cxgb4/cxgb4vf: Display 25G and 100G link speed (bsc#1021424).\n - cxgb4/cxgb4vf: Remove deprecated module parameters (bsc#1021424).\n - cxgb4: DCB message handler needs to use correct portid to netdev mapping\n (bsc#1021424).\n - cxgb4: Decode link down reason code obtained from firmware (bsc#1021424).\n - cxgb4: Do not assume FW_PORT_CMD reply is always port info msg\n (bsc#1021424).\n - cxgb4: do not call napi_hash_del() (bsc#1021424).\n - cxgb4: Do not sleep when mbox cmd is issued from interrupt context\n (bsc#1021424).\n - cxgb4: Enable SR-IOV configuration via PCI sysfs interface (bsc#1021424).\n - cxgb4: Fix issue while re-registering VF mgmt netdev (bsc#1021424).\n - cxgb4: MU requested by Chelsio (bsc#1021424).\n - cxgb4: Properly decode port module type (bsc#1021424).\n - cxgb4: Refactor t4_port_init function (bsc#1021424).\n - cxgb4: Reset dcb state machine and tx queue prio only if dcb is enabled\n (bsc#1021424).\n - cxgb4: Support compressed error vector for T6 (bsc#1021424).\n - cxgb4: Synchronize access to mailbox (bsc#1021424).\n - cxgb4: update latest firmware version supported (bsc#1021424).\n - device-dax: fix private mapping restriction, permit read-only\n (bsc#1031717).\n - drivers: hv: util: do not forget to init host_ts.lock (bsc#1031206).\n - drivers: hv: vmbus: Raise retry/wait limits in vmbus_post_msg()\n (fate#320485, bsc#1023287, bsc#1028217).\n - drm/i915: Fix crash after S3 resume with DP MST mode change\n (bsc#1029634).\n - drm/i915: Introduce Kabypoint PCH for Kabylake H/DT (bsc#1032581).\n - drm/i915: Only enable hotplug interrupts if the display interrupts are\n enabled (bsc#1031717).\n - ext4: fix use-after-iput when fscrypt contexts are inconsistent\n (bsc#1012829).\n - hid: usbhid: Quirk a AMI virtual mouse and keyboard with ALWAYS_POLL\n (bsc#1022340).\n - hv: export current Hyper-V clocksource (bsc#1031206).\n - hv_utils: implement Hyper-V PTP source (bsc#1031206).\n - ibmvnic: Allocate number of rx/tx buffers agreed on by firmware\n (fate#322021, bsc#1031512).\n - ibmvnic: Call napi_disable instead of napi_enable in failure path\n (fate#322021, bsc#1031512).\n - ibmvnic: Correct ibmvnic handling of device open/close (fate#322021,\n bsc#1031512).\n - ibmvnic: Fix endian errors in error reporting output (fate#322021,\n bsc#1031512).\n - ibmvnic: Fix endian error when requesting device capabilities\n (fate#322021, bsc#1031512).\n - ibmvnic: Fix initial MTU settings (bsc#1031512).\n - ibmvnic: Fix overflowing firmware/hardware TX queue (fate#322021,\n bsc#1031512).\n - ibmvnic: Free tx/rx scrq pointer array when releasing sub-crqs\n (fate#322021, bsc#1031512).\n - ibmvnic: Handle processing of CRQ messages in a tasklet (fate#322021,\n bsc#1031512).\n - ibmvnic: Initialize completion variables before starting work\n (fate#322021, bsc#1031512).\n - ibmvnic: Make CRQ interrupt tasklet wait for all capabilities crqs\n (fate#322021, bsc#1031512).\n - ibmvnic: Move ibmvnic adapter intialization to its own routine\n (fate#322021, bsc#1031512).\n - ibmvnic: Move login and queue negotiation into ibmvnic_open\n (fate#322021, bsc#1031512).\n - ibmvnic: Move login to its own routine (fate#322021, bsc#1031512).\n - ibmvnic: Use common counter for capabilities checks (fate#322021,\n bsc#1031512).\n - ibmvnic: use max_mtu instead of req_mtu for MTU range check\n (bsc#1031512).\n - iommu/vt-d: Make sure IOMMUs are off when intel_iommu=off (bsc#1031208).\n - iscsi-target: Return error if unable to add network portal (bsc#1032803).\n - kABI: restore ttm_ref_object_add parameters (kabi).\n - kgr: Mark eeh_event_handler() kthread safe using a timeout (bsc#1031662).\n - kvm: svm: add support for RDTSCP (bsc#1033117).\n - l2tp: hold tunnel socket when handling control frames in l2tp_ip and\n l2tp_ip6 (bsc#1028415).\n - libcxgb: add library module for Chelsio drivers (bsc#1021424).\n - libnvdimm, pfn: fix memmap reservation size versus 4K alignment\n (bsc#1031717).\n - locking/semaphore: Add down_interruptible_timeout() (bsc#1031662).\n - md: handle read-only member devices better (bsc#1033281).\n - mem-hotplug: fix node spanned pages when we have a movable node\n (bnc#1034671).\n - mm/huge_memory.c: respect FOLL_FORCE/FOLL_COW for thp (bnc#1030118).\n - mm/memblock.c: fix memblock_next_valid_pfn() (bnc#1031200).\n - mm: page_alloc: skip over regions of invalid pfns where possible\n (bnc#1031200).\n - netfilter: allow logging from non-init namespaces (bsc#970083).\n - net: ibmvnic: Remove unused net_stats member from struct ibmvnic_adapter\n (fate#322021, bsc#1031512).\n - nfs: flush out dirty data on file fput() (bsc#1021762).\n - nvme: Delete created IO queues on reset (bsc#1031717).\n - overlayfs: compat, fix incorrect dentry use in ovl_rename2 (bsc#1032400).\n - overlayfs: compat, use correct dentry to detect compat mode in\n ovl_compat_is_whiteout (bsc#1032400).\n - ping: implement proper locking (bsc#1031003).\n - powerpc/fadump: Reserve memory at an offset closer to bottom of RAM\n (bsc#1032141).\n - powerpc/fadump: Update fadump documentation (bsc#1032141).\n - Revert "btrfs: qgroup: Move half of the qgroup accounting time out of"\n (bsc#1017461 bsc#1033885).\n - Revert "btrfs: qgroup: Move half of the qgroup accounting time out of"\n This reverts commit f69c1d0f6254c73529a48fd2f87815d047ad7288.\n - Revert "Revert "btrfs: qgroup: Move half of the qgroup accounting time"\n This reverts commit 8567943ca56d937acfc417947cba917de653b09c.\n - sbp-target: Fix second argument of percpu_ida_alloc() (bsc#1032803).\n - scsi: cxgb4i: libcxgbi: cxgb4: add T6 iSCSI completion feature\n (bsc#1021424).\n - scsi_error: count medium access timeout only once per EH run\n (bsc#993832, bsc#1032345).\n - scsi: ipr: do not set DID_PASSTHROUGH on CHECK CONDITION (bsc#1034419).\n - scsi: ipr: Driver version 2.6.4 (bsc#1031555, fate#321595).\n - scsi: ipr: Error path locking fixes (bsc#1031555, fate#321595).\n - scsi: ipr: Fix abort path race condition (bsc#1031555, fate#321595).\n - scsi: ipr: Fix missed EH wakeup (bsc#1031555, fate#321595).\n - scsi: ipr: Fix SATA EH hang (bsc#1031555, fate#321595).\n - scsi: ipr: Remove redundant initialization (bsc#1031555, fate#321595).\n - scsi_transport_fc: do not call queue_work under lock (bsc#1013887).\n - scsi_transport_fc: fixup race condition in fc_rport_final_delete()\n (bsc#1013887).\n - scsi_transport_fc: return -EBUSY for deleted vport (bsc#1013887).\n - sysfs: be careful of error returns from ops-&gt;show() (bsc#1028883).\n - thp: fix MADV_DONTNEED vs. numa balancing race (bnc#1027974).\n - thp: reduce indentation level in change_huge_pmd() (bnc#1027974).\n - tpm: fix checks for policy digest existence in tpm2_seal_trusted()\n (bsc#1034048, Pending fixes 2017-04-10).\n - tpm: fix RC value check in tpm2_seal_trusted (bsc#1034048, Pending fixes\n 2017-04-10).\n - tpm: fix: set continueSession attribute for the unseal operation\n (bsc#1034048, Pending fixes 2017-04-10).\n - vmxnet3: segCnt can be 1 for LRO packets (bsc#988065).\n - x86/CPU/AMD: Fix Zen SMT topology (bsc#1027512).\n - x86/ioapic: Change prototype of acpi_ioapic_add() (bsc#1027153,\n bsc#1027616).\n - x86/ioapic: Fix incorrect pointers in ioapic_setup_resources()\n (bsc#1027153, bsc#1027616).\n - x86/ioapic: Fix IOAPIC failing to request resource (bsc#1027153,\n bsc#1027616).\n - x86/ioapic: fix kABI (hide added include) (bsc#1027153, bsc#1027616).\n - x86/ioapic: Fix lost IOAPIC resource after hot-removal and hotadd\n (bsc#1027153, bsc#1027616).\n - x86/ioapic: Fix setup_res() failing to get resource (bsc#1027153,\n bsc#1027616).\n - x86/ioapic: Ignore root bridges without a companion ACPI device\n (bsc#1027153, bsc#1027616).\n - x86/ioapic: Simplify ioapic_setup_resources() (bsc#1027153, bsc#1027616).\n - x86/ioapic: Support hot-removal of IOAPICs present during boot\n (bsc#1027153, bsc#1027616).\n - x86/mce: Fix copy/paste error in exception table entries (fate#319858).\n - x86/platform/uv: Fix calculation of Global Physical Address\n (bsc#1031147).\n - x86/ras/therm_throt: Do not log a fake MCE for thermal events\n (bsc#1028027).\n - xen: Use machine addresses in /sys/kernel/vmcoreinfo when PV\n (bsc#1014136)\n - xgene_enet: remove bogus forward declarations (bsc#1032673).\n\n", "cvss3": {}, "published": "2017-05-02T00:08:50", "type": "suse", "title": "Security update for the Linux Kernel (important)", "bulletinFamily": "unix", "cvss2": {}, "cvelist": ["CVE-2017-7261", "CVE-2017-7616", "CVE-2017-7618", "CVE-2017-2671", "CVE-2017-7294", "CVE-2017-7374", "CVE-2016-4997", "CVE-2017-7308", "CVE-2017-7187", "CVE-2016-4998"], "modified": "2017-05-02T00:08:50", "id": "OPENSUSE-SU-2017:1140-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00000.html", "cvss": {"score": 7.8, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:COMPLETE/"}}, {"lastseen": "2017-07-28T16:49:08", "description": "The SUSE Linux Enterprise 12 SP2 Realtime kernel was updated to 4.4.74 to\n receive various security and bugfixes.\n\n\n The following security bugs were fixed:\n\n\n - CVE-2017-1000364: An issue was discovered in the size of the stack guard\n page on Linux, specifically a 4k stack guard page is not sufficiently\n large and can be "jumped" over (the stack guard page is bypassed), this\n affects Linux Kernel versions 4.11.5 and earlier (the stackguard page\n was introduced in 2010) (bnc#1039348).\n - CVE-2017-1000365: The Linux Kernel imposes a size restriction on the\n arguments and environmental strings passed through\n RLIMIT_STACK/RLIM_INFINITY (1/4 of the size), but did not take the\n argument and environment pointers into account, which allowed attackers\n to bypass this limitation. (bnc#1039354).\n - CVE-2017-1000380: sound/core/timer.c in the Linux kernel is vulnerable\n to a data race in the ALSA /dev/snd/timer driver resulting in local\n users being able to read information belonging to other users, i.e.,\n uninitialized memory contents may be disclosed when a read and an ioctl\n happen at the same time (bnc#1044125).\n - CVE-2017-7346: The vmw_gb_surface_define_ioctl function in\n drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not\n validate certain levels data, which allowed local users to cause a\n denial of service (system hang) via a crafted ioctl call for a\n /dev/dri/renderD* device (bnc#1031796).\n - CVE-2017-9242: The __ip6_append_data function in net/ipv6/ip6_output.c\n in the Linux kernel is too late in checking whether an overwrite of an\n skb data structure may occur, which allowed local users to cause a\n denial of service (system crash) via crafted system calls (bnc#1041431).\n - CVE-2017-9076: The dccp_v6_request_recv_sock function in net/dccp/ipv6.c\n in the Linux kernel mishandled inheritance, which allowed local users to\n cause a denial of service or possibly have unspecified other impact via\n crafted system calls, a related issue to CVE-2017-8890 (bnc#1039885).\n - CVE-2017-9077: The tcp_v6_syn_recv_sock function in net/ipv6/tcp_ipv6.c\n in the Linux kernel mishandled inheritance, which allowed local users to\n cause a denial of service or possibly have unspecified other impact via\n crafted system calls, a related issue to CVE-2017-8890 (bnc#1040069).\n - CVE-2017-9075: The sctp_v6_create_accept_sk function in net/sctp/ipv6.c\n in the Linux kernel mishandled inheritance, which allowed local users to\n cause a denial of service or possibly have unspecified other impact via\n crafted system calls, a related issue to CVE-2017-8890 (bnc#1039883).\n - CVE-2017-9074: The IPv6 fragmentation implementation in the Linux kernel\n did not consider that the nexthdr field may be associated with an\n invalid option, which allowed local users to cause a denial of service\n (out-of-bounds read and BUG) or possibly have unspecified other impact\n via crafted socket and send system calls (bnc#1039882).\n - CVE-2017-7487: The ipxitf_ioctl function in net/ipx/af_ipx.c in the\n Linux kernel mishandled reference counts, which allowed local users to\n cause a denial of service (use-after-free) or possibly have unspecified\n other impact via a failed SIOCGIFADDR ioctl call for an IPX interface\n (bnc#1038879).\n - CVE-2017-8890: The inet_csk_clone_lock function in\n net/ipv4/inet_connection_sock.c in the Linux kernel allowed attackers to\n cause a denial of service (double free) or possibly have unspecified\n other impact by leveraging use of the accept system call (bnc#1038544).\n - CVE-2017-9150: The do_check function in kernel/bpf/verifier.c in the\n Linux kernel did not make the allow_ptr_leaks value available for\n restricting the output of the print_bpf_insn function, which allowed\n local users to obtain sensitive address information via crafted bpf\n system calls (bnc#1040279).\n - CVE-2017-7618: crypto/ahash.c in the Linux kernel allowed attackers to\n cause a denial of service (API operation calling its own callback, and\n infinite recursion) by triggering EBUSY on a full queue (bnc#1033340).\n - CVE-2016-4997: The compat IPT_SO_SET_REPLACE and IP6T_SO_SET_REPLACE\n setsockopt implementations in the netfilter subsystem in the Linux\n kernel allow local users to gain privileges or cause a denial of service\n (memory corruption) by leveraging in-container root access to provide a\n crafted offset value that triggers an unintended decrement (bnc#986362).\n - CVE-2016-4998: The IPT_SO_SET_REPLACE setsockopt implementation in the\n netfilter subsystem in the Linux kernel allowed local users to cause a\n denial of service (out-of-bounds read) or possibly obtain sensitive\n information from kernel heap memory by leveraging in-container root\n access to provide a crafted offset value that leads to crossing a\n ruleset blob boundary (bnc#986365).\n - CVE-2017-7616: Incorrect error handling in the set_mempolicy and mbind\n compat syscalls in mm/mempolicy.c in the Linux kernel allowed local\n users to obtain sensitive information from uninitialized stack data by\n triggering failure of a certain bitmap operation (bnc#1033336).\n - CVE-2017-2671: The ping_unhash function in net/ipv4/ping.c in the Linux\n kernel is too late in obtaining a certain lock and consequently cannot\n ensure that disconnect function calls are safe, which allowed local\n users to cause a denial of service (panic) by leveraging access to the\n protocol value of IPPROTO_ICMP in a socket system call (bnc#1031003).\n - CVE-2017-7184: The xfrm_replay_verify_len function in\n net/xfrm/xfrm_user.c in the Linux kernel did not validate certain size\n data after an XFRM_MSG_NEWAE update, which allowed local users to obtain\n root privileges or cause a denial of service (heap-based out-of-bounds\n access) by leveraging the CAP_NET_ADMIN capability, as demonstrated\n during a Pwn2Own competition at CanSecWest 2017 for the Ubuntu 16.10\n linux-image-* package 4.8.0.41.52 (bnc#1030573).\n - CVE-2017-7308: The packet_set_ring function in net/packet/af_packet.c in\n the Linux kernel did not properly validate certain block-size data,\n which allowed local users to cause a denial of service (integer\n signedness error and out-of-bounds write), or gain privileges (if the\n CAP_NET_RAW capability is held), via crafted system calls (bnc#1031579).\n - CVE-2017-7294: The vmw_surface_define_ioctl function in\n drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not\n validate addition of certain levels data, which allowed local users to\n trigger an integer overflow and out-of-bounds write, and cause a denial\n of service (system hang or crash) or possibly gain privileges, via a\n crafted ioctl call for a /dev/dri/renderD* device (bnc#1031440).\n - CVE-2017-7261: The vmw_surface_define_ioctl function in\n drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not\n check for a zero value of certain levels data, which allowed local users\n to cause a denial of service (ZERO_SIZE_PTR dereference, and GPF and\n possibly panic) via a crafted ioctl call for a /dev/dri/renderD* device\n (bnc#1031052).\n - CVE-2017-7187: The sg_ioctl function in drivers/scsi/sg.c in the Linux\n kernel allowed local users to cause a denial of service (stack-based\n buffer overflow) or possibly have unspecified other impact via a large\n command size in an SG_NEXT_CMD_LEN ioctl call, leading to out-of-bounds\n write access in the sg_write function (bnc#1030213).\n - CVE-2017-7374: Use-after-free vulnerability in fs/crypto/ in the Linux\n kernel allowed local users to cause a denial of service (NULL pointer\n dereference) or possibly gain privileges by revoking keyring keys being\n used for ext4, f2fs, or ubifs encryption, causing cryptographic\n transform objects to be freed prematurely (bnc#1032006).\n - CVE-2016-10200: Race condition in the L2TPv3 IP Encapsulation feature in\n the Linux kernel allowed local users to gain privileges or cause a\n denial of service (use-after-free) by making multiple bind system calls\n without properly ascertaining whether a socket has the SOCK_ZAPPED\n status, related to net/l2tp/l2tp_ip.c and net/l2tp/l2tp_ip6.c\n (bnc#1028415).\n - CVE-2017-2636: Race condition in drivers/tty/n_hdlc.c in the Linux\n kernel allowed local users to gain privileges or cause a denial of\n service (double free) by setting the HDLC line discipline (bnc#1027565).\n - CVE-2017-6345: The LLC subsystem in the Linux kernel did not ensure that\n a certain destructor exists in required circumstances, which allowed\n local users to cause a denial of service (BUG_ON) or possibly have\n unspecified other impact via crafted system calls (bnc#1027190).\n - CVE-2017-6346: Race condition in net/packet/af_packet.c in the Linux\n kernel allowed local users to cause a denial of service (use-after-free)\n or possibly have unspecified other impact via a multithreaded\n application that made PACKET_FANOUT setsockopt system calls\n (bnc#1027189).\n - CVE-2017-6353: net/sctp/socket.c in the Linux kernel did not properly\n restrict association peel-off operations during certain wait states,\n which allowed local users to cause a denial of service (invalid unlock\n and double free) via a multithreaded application. NOTE: this\n vulnerability exists because of an incorrect fix for CVE-2017-5986.\n (bnc#1027066).\n - CVE-2017-6214: The tcp_splice_read function in net/ipv4/tcp.c in the\n Linux kernel allowed remote attackers to cause a denial of service\n (infinite loop and soft lockup) via vectors involving a TCP packet with\n the URG flag (bnc#1026722).\n - CVE-2016-2117: The atl2_probe function in\n drivers/net/ethernet/atheros/atlx/atl2.c in the Linux kernel incorrectly\n enables scatter/gather I/O, which allowed remote attackers to obtain\n sensitive information from kernel memory by reading packet data\n (bnc#968697).\n - CVE-2017-6347: The ip_cmsg_recv_checksum function in\n net/ipv4/ip_sockglue.c in the Linux kernel has incorrect expectations\n about skb data layout, which allowed local users to cause a denial of\n service (buffer over-read) or possibly have unspecified other impact via\n crafted system calls, as demonstrated by use of the MSG_MORE flag in\n conjunction with loopback UDP transmission (bnc#1027179).\n - CVE-2016-9191: The cgroup offline implementation in the Linux kernel\n mishandled certain drain operations, which allowed local users to cause\n a denial of service (system hang) by leveraging access to a container\n environment for executing a crafted application, as demonstrated by\n trinity (bnc#1008842).\n - CVE-2017-2583: The load_segment_descriptor implementation in\n arch/x86/kvm/emulate.c in the Linux kernel improperly emulates a "MOV\n SS, NULL selector" instruction, which allowed guest OS users to cause a\n denial of service (guest OS crash) or gain guest OS privileges via a\n crafted application (bnc#1020602).\n - CVE-2017-2584: arch/x86/kvm/emulate.c in the Linux kernel allowed local\n users to obtain sensitive information from kernel memory or cause a\n denial of service (use-after-free) via a crafted application that\n leverages instruction emulation for fxrstor, fxsave, sgdt, and sidt\n (bnc#1019851).\n - CVE-2017-2596: The nested_vmx_check_vmptr function in arch/x86/kvm/vmx.c\n in the Linux kernel improperly emulates the VMXON instruction, which\n allowed KVM L1 guest OS users to cause a denial of service (host OS\n memory consumption) by leveraging the mishandling of page references\n (bnc#1022785).\n - CVE-2017-6074: The dccp_rcv_state_process function in net/dccp/input.c\n in the Linux kernel mishandled DCCP_PKT_REQUEST packet data structures\n in the LISTEN state, which allowed local users to obtain root privileges\n or cause a denial of service (double free) via an application that made\n an IPV6_RECVPKTINFO setsockopt system call (bnc#1026024).\n - CVE-2017-5986: Race condition in the sctp_wait_for_sndbuf function in\n net/sctp/socket.c in the Linux kernel allowed local users to cause a\n denial of service (assertion failure and panic) via a multithreaded\n application that peels off an association in a certain buffer-full state\n (bnc#1025235).\n - CVE-2017-5970: The ipv4_pktinfo_prepare function in\n net/ipv4/ip_sockglue.c in the Linux kernel allowed attackers to cause a\n denial of service (system crash) via (1) an application that made\n crafted system calls or possibly (2) IPv4 traffic with invalid IP\n options (bnc#1024938).\n - CVE-2017-5897: The ip6gre_err function in net/ipv6/ip6_gre.c in the\n Linux kernel allowed remote attackers to have unspecified impact via\n vectors involving GRE flags in an IPv6 packet, which trigger an\n out-of-bounds access (bnc#1023762).\n - CVE-2016-7117: Use-after-free vulnerability in the __sys_recvmmsg\n function in net/socket.c in the Linux kernel allowed remote attackers to\n execute arbitrary code via vectors involving a recvmmsg system call that\n is mishandled during error processing (bnc#1003077).\n - CVE-2017-5576: Integer overflow in the vc4_get_bcl function in\n drivers/gpu/drm/vc4/vc4_gem.c in the VideoCore DRM driver in the Linux\n kernel allowed local users to cause a denial of service or possibly have\n unspecified other impact via a crafted size value in a VC4_SUBMIT_CL\n ioctl call (bnc#1021294).\n - CVE-2017-5577: The vc4_get_bcl function in drivers/gpu/drm/vc4/vc4_gem.c\n in the VideoCore DRM driver in the Linux kernel did not set an errno\n value upon certain overflow detections, which allowed local users to\n cause a denial of service (incorrect pointer dereference and OOPS) via\n inconsistent size values in a VC4_SUBMIT_CL ioctl call (bnc#1021294).\n - CVE-2017-5551: The simple_set_acl function in fs/posix_acl.c in the\n Linux kernel preserves the setgid bit during a setxattr call involving a\n tmpfs filesystem, which allowed local users to gain group privileges by\n leveraging the existence of a setgid program with restrictions on\n execute permissions. NOTE: this vulnerability exists because of an\n incomplete fix for CVE-2016-7097. (bnc#1021258).\n\n The following non-security bugs were fixed:\n\n - 9p: fix a potential acl leak (4.4.68 stable queue).\n - acpi / APEI: Add missing synchronize_rcu() on NOTIFY_SCI removal\n (bsc#1031717).\n - acpi: Do not create a platform_device for IOAPIC/IOxAPIC (bsc#1028819).\n - acpi, ioapic: Clear on-stack resource before using it (bsc#1028819).\n - acpi, nfit: fix acpi_nfit_flush_probe() crash (bsc#1031717).\n - acpi, nfit: fix bus vs dimm confusion in xlat_status (bsc#1023175).\n - acpi, nfit: fix extended status translations for ACPI DSMs (bsc#1031717).\n - acpi, nfit, libnvdimm: fix / harden ars_status output length handling\n (bsc#1023175).\n - acpi, nfit: validate ars_status output buffer size (bsc#1023175).\n - acpi: Remove platform devices from a bus on removal (bsc#1028819).\n - acpi / scan: Drop support for force_remove (bnc#1029607).\n - ahci: disable correct irq for dummy ports (bsc#1040125).\n - alsa: hda - Fix deadlock of controller device lock at unbinding (4.4.68\n stable queue).\n - arm64: hugetlb: fix the wrong address for several functions\n (bsc#1032681).\n - arm64: hugetlb: fix the wrong return value for\n huge_ptep_set_access_flags (bsc#1032681).\n - arm64: hugetlb: remove the wrong pmd check in find_num_contig()\n (bsc#1032681).\n - arm64/numa: fix incorrect log for memory-less node (bsc#1019631).\n - arm64: Use full path in KBUILD_IMAGE definition (bsc#1010032).\n - arm: 8452/3: PJ4: make coprocessor access sequences buildable in Thumb2\n mode (4.4.68 stable queue).\n - arm: OMAP5 / DRA7: Fix HYP mode boot for thumb2 build (4.4.68 stable\n queue).\n - arm: Use full path in KBUILD_IMAGE definition (bsc#1010032).\n - ASoC: cht_bsw_rt5645: Fix leftover kmalloc (bsc#1010690).\n - ASoC: Intel: Skylake: Uninitialized variable in probe_codec()\n (bsc#1043231).\n - ASoC: rt5640: use msleep() for long delays (bsc#1031717).\n - ASoC: sti: Fix error handling if of_clk_get() fails (bsc#1031717).\n - avoid including "mountproto=" with no protocol in /proc/mounts\n (bsc#1019260).\n - bcache: fix calling ida_simple_remove() with incorrect minor\n (bsc#1038085).\n - bcache: Make gc wakeup sane, remove set_task_state() (bsc#1021260).\n - bcache: partition support: add 16 minors per bcacheN device\n (bsc#1019784).\n - blacklist 61e8a0d5a027 powerpc/pci: Fix endian bug in fixed PHB\n numbering (bsc#989311)\n - blacklist.conf: a04a480d4392 net: Require exact match for TCP socket\n lookups if dif is l3mdev (v4.9-rc4) 10/11 conflicts are with code\n introduced by 74b20582ac38 ("net: l3mdev: Add hook in ip and ipv6",\n v4.7-rc1) which is not present in SP2. I think that either the problem\n was always there or was introduced by 74b20582ac38. If in the first\n case, the fix would have to be implemented differently; if in the second\n case, the fix is not needed in SP2.\n - blacklist.conf: blacklist reverted commit Commit 82486aa6f1b9 ("ipv4:\n restore rt-&gt;fi for reference counting") was later reverted and\n replaced by commit 3fb07daff8e9 ("ipv4: add reference counting to\n metrics"). This solution breaks kABI, though, and I'll need to look into\n it more carefully to see if it can be worked around easily.\n - blk-mq: Allow timeouts to run while queue is freezing (bsc#1020817).\n - blk-mq: Always schedule hctx->next_cpu (bsc#1020817).\n - blk-mq: Avoid memory reclaim when remapping queues (bsc#1020817).\n - blk-mq: do not overwrite rq->mq_ctx (bsc#1020817).\n - blk-mq: Fix failed allocation path when mapping queues (bsc#1020817).\n - blk-mq: improve warning for running a queue on the wrong CPU\n (bsc#1020817).\n - block: Change extern inline to static inline (bsc#1023175).\n - block: copy NOMERGE flag from bio to request (bsc#1030070).\n - block: get rid of blk_integrity_revalidate() (4.4.68 stable queue).\n - bluetooth: btmrvl: fix hung task warning dump (bsc#1018813).\n - bna: add missing per queue ethtool stat (bsc#966321 FATE#320156).\n - bna: avoid writing uninitialized data into hw registers (bsc#966321\n FATE#320156).\n - bna: integer overflow bug in debugfs (bsc#966321 FATE#320156).\n - bnx2x: allow adding VLANs while interface is down (bsc#1027273).\n - bnx2x: Correct ringparam estimate when DOWN (bsc#1020214).\n - bnxt_en: allocate enough space for ->ntp_fltr_bmap (bsc#1020412\n FATE#321671).\n - bonding: avoid defaulting hard_header_len to ETH_HLEN on slave removal\n (bsc#1042286).\n - bonding: do not use stale speed and duplex information (bsc#1042286).\n - bonding: fix 802.3ad aggregator reselection (bsc#1029514).\n - bonding: prevent out of bound accesses (bsc#1042286).\n - bpf, arm64: fix jit branch offset related to ldimm64 (4.4.68 stable\n queue).\n - brcmfmac: add fallback for devices that do not report per-chain values\n (bsc#1043231).\n - brcmfmac: avoid writing channel out of allocated array (bsc#1043231).\n - brcmfmac: Change error print on wlan0 existence (bsc#1000092).\n - brcmfmac: Ensure pointer correctly set if skb data location changes\n (4.4.68 stable queue).\n - brcmfmac: Make skb header writable before use (4.4.68 stable queue).\n - brcmfmac: restore stopping netdev queue when bus clogs up (bsc#1031717).\n - btrfs: add a flags field to btrfs_fs_info (bsc#1012452).\n - btrfs: add ASSERT for block group's memory leak (bsc#1012452).\n - btrfs: add btrfs_trans_handle->fs_info pointer (bsc#1012452).\n - btrfs: add bytes_readonly to the spaceinfo at once (bsc#1012452).\n - btrfs: add check to sysfs handler of label (bsc#1012452).\n - btrfs: add dynamic debug support (bsc#1012452).\n - btrfs: add error handling for extent buffer in print tree (bsc#1012452).\n - btrfs: add missing bytes_readonly attribute file in sysfs (bsc#1012452).\n - btrfs: add missing check for writeback errors on fsync (bsc#1012452).\n - btrfs: add more validation checks for superblock (bsc#1012452).\n - btrfs: Add ratelimit to btrfs printing (bsc#1012452).\n - btrfs: add read-only check to sysfs handler of features (bsc#1012452).\n - btrfs: add semaphore to synchronize direct IO writes with fsync\n (bsc#1012452).\n - btrfs: add support for RENAME_EXCHANGE and RENAME_WHITEOUT (bsc#1020975).\n - btrfs: add tracepoint for adding block groups (bsc#1012452).\n - btrfs: add tracepoints for flush events (bsc#1012452).\n - btrfs: add transaction space reservation tracepoints (bsc#1012452).\n - btrfs: add validadtion checks for chunk loading (bsc#1012452).\n - btrfs: add write protection to SET_FEATURES ioctl (bsc#1012452).\n - btrfs: allow balancing to dup with multi-device (bsc#1012452).\n - btrfs: allow unlink to exceed subvolume quota (bsc#1019614).\n - btrfs: always reserve metadata for delalloc extents (bsc#1012452).\n - btrfs: always use trans-&gt;block_rsv for orphans (bsc#1012452).\n - btrfs: avoid blocking open_ctree from cleaner_kthread (bsc#1012452).\n - btrfs: avoid deadlocks during reservations in btrfs_truncate_block\n (bsc#1012452).\n - btrfs: avoid overflowing f_bfree (bsc#1012452).\n - btrfs: avoid uninitialized variable warning (bsc#1012452).\n - btrfs: backref: Fix soft lockup in __merge_refs function (bsc#1017641).\n - btrfs: btrfs_abort_transaction, drop root parameter (bsc#1012452).\n - btrfs: __btrfs_buffered_write: Pass valid file offset when releasing\n delalloc space (bsc#1012452).\n - btrfs: __btrfs_buffered_write: Reserve/release extents aligned to block\n size (bsc#1012452).\n - btrfs: btrfs_check_super_valid: Allow 4096 as stripesize (bsc#1012452).\n - btrfs: btrfs_debug should consume fs_info when DEBUG is not defined\n (bsc#1012452).\n - btrfs: btrfs_ioctl_clone: Truncate complete page after performing clone\n operation (bsc#1012452).\n - btrfs: btrfs_page_mkwrite: Reserve space in sectorsized units\n (bsc#1012452).\n - btrfs: btrfs_relocate_chunk pass extent_root to btrfs_end_transaction\n (bsc#1012452).\n - btrfs: btrfs_submit_direct_hook: Handle map_length &lt; bio vector\n length (bsc#1012452).\n - btrfs: build fixup for qgroup_account_snapshot (bsc#1012452).\n - btrfs: change BUG_ON()'s to ASSERT()'s in backref_cache_cleanup()\n (bsc#1012452).\n - btrfs: change delayed reservation fallback behavior (bsc#1012452).\n - btrfs: change how we calculate the global block rsv (bsc#1012452).\n - btrfs: change how we update the global block rsv (bsc#1012452).\n - btrfs: Change qgroup_meta_rsv to 64bit (bsc#1019614).\n - btrfs: check btree node's nritems (bsc#1012452).\n - btrfs: check if extent buffer is aligned to sectorsize (bsc#1012452).\n - btrfs: check inconsistence between chunk and block group (bsc#1012452).\n - btrfs: check reserved when deciding to background flush (bsc#1012452).\n - btrfs: clarify do_chunk_alloc()'s return value (bsc#1012452).\n - btrfs: Clean pte corresponding to page straddling i_size (bsc#1012452).\n - btrfs: clean the old superblocks before freeing the device (bsc#1012452).\n - btrfs: clean up and optimize __check_raid_min_device() (bsc#1012452).\n - btrfs: cleanup assigning next active device with a check (bsc#1012452).\n - btrfs: cleanup BUG_ON in merge_bio (bsc#1012452).\n - btrfs: Cleanup compress_file_range() (bsc#1012452).\n - btrfs: cleanup error handling in extent_write_cached_pages (bsc#1012452).\n - btrfs: clear uptodate flags of pages in sys_array eb (bsc#1012452).\n - btrfs: clone: use vmalloc only as fallback for nodesize bufer\n (bsc#1012452).\n - btrfs: Compute and look up csums based on sectorsized blocks\n (bsc#1012452).\n - btrfs: convert nodesize macros to static inlines (bsc#1012452).\n - btrfs: convert printk(KERN_* to use pr_* calls (bsc#1012452).\n - btrfs: convert pr_* to btrfs_* where possible (bsc#1012452).\n - btrfs: convert send's verbose_printk to btrfs_debug (bsc#1012452).\n - btrfs: copy_to_sk drop unused root parameter (bsc#1012452).\n - btrfs: create a helper function to read the disk super (bsc#1012452).\n - btrfs: create example debugfs file only in debugging build (bsc#1012452).\n - btrfs: create helper btrfs_find_device_by_user_input() (bsc#1012452).\n - btrfs: create helper function __check_raid_min_devices() (bsc#1012452).\n - btrfs: csum_tree_block: return proper errno value (bsc#1012452).\n - btrfs: detect corruption when non-root leaf has zero item (bsc#1012452).\n - btrfs: device add and remove: use GFP_KERNEL (bsc#1012452).\n - btrfs: Direct I/O read: Work on sectorsized blocks (bsc#1012452).\n - btrfs: divide btrfs_update_reserved_bytes() into two functions\n (bsc#1012452).\n - btrfs: do not background blkdev_put() (bsc#1012452).\n - btrfs: do not bother kicking async if there's nothing to reclaim\n (bsc#1012452).\n - btrfs: do not BUG_ON() in btrfs_orphan_add (bsc#1012452).\n - btrfs: do not create empty block group if we have allocated data\n (bsc#1012452).\n - btrfs: do not decrease bytes_may_use when replaying extents\n (bsc#1012452).\n - btrfs: do not do nocow check unless we have to (bsc#1012452).\n - btrfs: do not do unnecessary delalloc flushes when relocating\n (bsc#1012452).\n - btrfs: do not force mounts to wait for cleaner_kthread to delete one or\n more subvolumes (bsc#1012452).\n - btrfs: do not wait for unrelated IO to finish before relocation\n (bsc#1012452).\n - btrfs: do not WARN() in btrfs_transaction_abort() for IO errors\n (bsc#1035866).\n - btrfs: do not write corrupted metadata blocks to disk (bsc#1012452).\n - btrfs: end transaction if we abort when creating uuid root (bsc#1012452).\n - btrfs: enhance btrfs_find_device_by_user_input() to check device path\n (bsc#1012452).\n - btrfs: error out if generic_bin_search get invalid arguments\n (bsc#1012452).\n - btrfs: expand cow_file_range() to support in-band dedup and\n subpage-blocksize (bsc#1012452).\n - btrfs: extend btrfs_set_extent_delalloc and its friends to support\n in-band dedupe and subpage size patchset (bsc#1012452).\n - btrfs: extent same: use GFP_KERNEL for page array allocations\n (bsc#1012452).\n - btrfs: fallback to vmalloc in btrfs_compare_tree (bsc#1012452).\n - btrfs: fallocate: use GFP_KERNEL (bsc#1012452).\n - btrfs: fallocate: Work with sectorsized blocks (bsc#1012452).\n - btrfs: fill relocation block rsv after allocation (bsc#1012452).\n - btrfs: fix an integer overflow check (bsc#1012452).\n - btrfs: fix a possible umount deadlock (bsc#1012452).\n - btrfs: Fix block size returned to user space (bsc#1012452).\n - btrfs: fix btrfs_compat_ioctl failures on non-compat ioctls\n (bsc#1018100).\n - btrfs: fix btrfs_no_printk stub helper (bsc#1012452).\n - btrfs: Fix BUG_ON condition in scrub_setup_recheck_block() (bsc#1012452).\n - btrfs: fix BUG_ON in btrfs_mark_buffer_dirty (bsc#1012452).\n - btrfs: fix BUG_ON in btrfs_submit_compressed_write (bsc#1012452).\n - btrfs: fix build warning (bsc#1012452).\n - btrfs: fix callers of btrfs_block_rsv_migrate (bsc#1012452).\n - btrfs: fix check_direct_IO() for non-iovec iterators (bsc#1012452).\n - btrfs: fix check_shared for fiemap ioctl (bsc#1037177).\n - btrfs: fix crash when tracepoint arguments are freed by wq callbacks\n (bsc#1012452).\n - btrfs: fix data loss after truncate when using the no-holes feature\n (bsc#1036214).\n - btrfs: fix deadlock in delayed_ref_async_start (bsc#1012452).\n - btrfs: fix delalloc accounting after copy_from_user faults (bsc#1012452).\n - btrfs: fix delalloc reservation amount tracepoint (bsc#1012452).\n - btrfs: fix disk_i_size update bug when fallocate() fails (bsc#1012452).\n - btrfs: fix divide error upon chunk's stripe_len (bsc#1012452).\n - btrfs: fix double free of fs root (bsc#1012452).\n - btrfs: fix eb memory leak due to readpage failure (bsc#1012452).\n - btrfs: fix em leak in find_first_block_group (bsc#1012452).\n - btrfs: fix emptiness check for dirtied extent buffers at check_leaf()\n (bsc#1012452).\n - btrfs: fix error handling in map_private_extent_buffer (bsc#1012452).\n - btrfs: fix error return code in btrfs_init_test_fs() (bsc#1012452).\n - btrfs: fix extent_same allowing destination offset beyond i_size\n (bsc#1012452).\n - btrfs: fix free space calculation in dump_space_info() (bsc#1012452).\n - btrfs: fix fsfreeze hang caused by delayed iputs deal (bsc#1012452).\n - btrfs: fix fspath error deallocation (bsc#1012452).\n - btrfs: fix handling of faults from btrfs_copy_from_user (bsc#1012452).\n - btrfs: fix inode leak on failure to setup whiteout inode in rename\n (bsc#1020975).\n - btrfs: fix int32 overflow in shrink_delalloc() (bsc#1012452).\n - btrfs: Fix integer overflow when calculating bytes_per_bitmap\n (bsc#1012452).\n - btrfs: fix invalid dereference in btrfs_retry_endio (bsc#1040395).\n - btrfs: fix invalid reference in replace_path (bsc#1012452).\n - btrfs: fix listxattrs not listing all xattrs packed in the same item\n (bsc#1012452).\n - btrfs: fix lockdep deadlock warning due to dev_replace (bsc#1012452).\n - btrfs: fix lockdep warning about log_mutex (bsc#1021455).\n - btrfs: fix lock dep warning, move scratch dev out of device_list_mutex\n and uuid_mutex (bsc#1012452).\n - btrfs: fix lock dep warning move scratch super outside of chunk_mutex\n (bsc#1012452).\n - btrfs: fix lockdep warning on deadlock against an inode's log mutex\n (bsc#1021455).\n - btrfs: fix __MAX_CSUM_ITEMS (bsc#1012452).\n - btrfs: fix memory leak during RAID 5/6 device replacement (bsc#1012452).\n - btrfs: fix memory leak of block group cache (bsc#1012452).\n - btrfs: fix memory leak of reloc_root (bsc#1012452).\n - btrfs: fix mixed block count of available space (bsc#1012452).\n - btrfs: fix number of transaction units for renames with whiteout\n (bsc#1020975).\n - btrfs: fix one bug that process may endlessly wait for ticket in\n wait_reserve_ticket() (bsc#1012452).\n - btrfs: fix panic in balance due to EIO (bsc#1012452).\n - btrfs: fix race between block group relocation and nocow writes\n (bsc#1012452).\n - btrfs: fix race between device replace and block group removal\n (bsc#1012452).\n - btrfs: fix race between device replace and chunk allocation\n (bsc#1012452).\n - btrfs: fix race between device replace and discard (bsc#1012452).\n - btrfs: fix race between device replace and read repair (bsc#1012452).\n - btrfs: fix race between fsync and direct IO writes for prealloc extents\n (bsc#1012452).\n - btrfs: fix race between readahead and device replace/removal\n (bsc#1012452).\n - btrfs: fix race setting block group back to RW mode during device\n replace (bsc#1012452).\n - btrfs: fix race setting block group readonly during device replace\n (bsc#1012452).\n - btrfs: fix read_node_slot to return errors (bsc#1012452).\n - btrfs: fix release reserved extents trace points (bsc#1012452).\n - btrfs: fix segmentation fault when doing dio read (bsc#1040425).\n - btrfs: Fix slab accounting flags (bsc#1012452).\n - btrfs: fix truncate_space_check (bsc#1012452).\n - btrfs: fix unexpected return value of fiemap (bsc#1012452).\n - btrfs: fix unprotected assignment of the left cursor for device replace\n (bsc#1012452).\n - btrfs: fix WARNING in btrfs_select_ref_head() (bsc#1012452).\n - btrfs: flush_space: treat return value of do_chunk_alloc properly\n (bsc#1012452).\n - btrfs: Force stripesize to the value of sectorsize (bsc#1012452).\n - btrfs: free sys_array eb as soon as possible (bsc#1012452).\n - btrfs: GFP_NOFS does not GFP_HIGHMEM (bsc#1012452).\n - btrfs: Handle uninitialised inode eviction (bsc#1012452).\n - btrfs: hide test-only member under ifdef (bsc#1012452).\n - btrfs: improve check_node to avoid reading corrupted nodes (bsc#1012452).\n - btrfs: Improve FL_KEEP_SIZE handling in fallocate (bsc#1012452).\n - btrfs: incremental send, do not delay rename when parent inode is new\n (bsc#1028325).\n - btrfs: incremental send, do not issue invalid rmdir operations\n (bsc#1028325).\n - btrfs: introduce BTRFS_MAX_ITEM_SIZE (bsc#1012452).\n - btrfs: introduce device delete by devid (bsc#1012452).\n - btrfs: introduce raid-type to error-code table, for minimum device\n constraint (bsc#1012452).\n - btrfs: introduce ticketed enospc infrastructure (bsc#1012452).\n - btrfs: introduce tickets_id to determine whether asynchronous metadata\n reclaim work makes progress (bsc#1012452).\n - btrfs: ioctl: reorder exclusive op check in RM_DEV (bsc#1012452).\n - btrfs: kill BUG_ON in do_relocation (bsc#1012452).\n - btrfs: kill BUG_ON in run_delayed_tree_ref (bsc#1012452).\n - btrfs: kill BUG_ON()'s in btrfs_mark_extent_written (bsc#1012452).\n - btrfs: kill invalid ASSERT() in process_all_refs() (bsc#1012452).\n - btrfs: kill the start argument to read_extent_buffer_pages (bsc#1012452).\n - btrfs: kill unused writepage_io_hook callback (bsc#1012452).\n - btrfs: let callers of btrfs_alloc_root pass gfp flags (bsc#1012452).\n - btrfs: Limit inline extents to root-&gt;sectorsize (bsc#1012452).\n - btrfs: make find_workspace always succeed (bsc#1012452).\n - btrfs: make find_workspace warn if there are no workspaces (bsc#1012452).\n - btrfs: make mapping-&gt;writeback_index point to the last written page\n (bsc#1012452).\n - btrfs: make state preallocation more speculative in __set_extent_bit\n (bsc#1012452).\n - btrfs: make sure device is synced before return (bsc#1012452).\n - btrfs: make sure we stay inside the bvec during __btrfs_lookup_bio_sums\n (bsc#1012452).\n - btrfs: make use of btrfs_find_device_by_user_input() (bsc#1012452).\n - btrfs: make use of btrfs_scratch_superblocks() in btrfs_rm_device()\n (bsc#1012452).\n - btrfs: memset to avoid stale content in btree leaf (bsc#1012452).\n - btrfs: memset to avoid stale content in btree node block (bsc#1012452).\n - btrfs: move error handling code together in ctree.h (bsc#1012452).\n - btrfs: optimize check for stale device (bsc#1012452).\n - btrfs: Output more info for enospc_debug mount option (bsc#1012452).\n - btrfs: parent_start initialization cleanup (bsc#1012452).\n - btrfs: pass correct args to btrfs_async_run_delayed_refs() (bsc#1012452).\n - btrfs: pass number of devices to btrfs_check_raid_min_devices\n (bsc#1012452).\n - btrfs: pass the right error code to the btrfs_std_error (bsc#1012452).\n - btrfs: pin log earlier when renaming (bsc#1020975).\n - btrfs: pin logs earlier when doing a rename exchange operation\n (bsc#1020975).\n - btrfs: preallocate compression workspaces (bsc#1012452).\n - btrfs: Print Warning only if ENOSPC_DEBUG is enabled (bsc#1012452).\n - btrfs: qgroup: Move half of the qgroup accounting time out of commit\n trans (bsc#1017461).\n - btrfs: qgroups: Retry after commit on getting EDQUOT (bsc#1019614).\n - btrfs: Ratelimit "no csum found" info message (bsc#1012452).\n - btrfs: reada: add all reachable mirrors into reada device list\n (bsc#1012452).\n - btrfs: reada: Add missed segment checking in reada_find_zone\n (bsc#1012452).\n - btrfs: reada: Avoid many times of empty loop (bsc#1012452).\n - btrfs: reada: avoid undone reada extents in btrfs_reada_wait\n (bsc#1012452).\n - btrfs: reada: bypass adding extent when all zone failed (bsc#1012452).\n - btrfs: reada: Fix a debug code typo (bsc#1012452).\n - btrfs: reada: Fix in-segment calculation for reada (bsc#1012452).\n - btrfs: reada: ignore creating reada_extent for a non-existent device\n (bsc#1012452).\n - btrfs: reada: Jump into cleanup in direct way for __readahead_hook()\n (bsc#1012452).\n - btrfs: reada: limit max works count (bsc#1012452).\n - btrfs: reada: Move is_need_to_readahead contition earlier (bsc#1012452).\n - btrfs: reada: move reada_extent_put to place after __readahead_hook()\n (bsc#1012452).\n - btrfs: reada: Pass reada_extent into __readahead_hook directly\n (bsc#1012452).\n - btrfs: reada: reduce additional fs_info->reada_lock in reada_find_zone\n (bsc#1012452).\n - btrfs: reada: Remove level argument in severial functions (bsc#1012452).\n - btrfs: reada: simplify dev->reada_in_flight processing (bsc#1012452).\n - btrfs: reada: Use fs_info instead of root in __readahead_hook's argument\n (bsc#1012452).\n - btrfs: reada: use GFP_KERNEL everywhere (bsc#1012452).\n - btrfs: readdir: use GFP_KERNEL (bsc#1012452).\n - btrfs: refactor btrfs_dev_replace_start for reuse (bsc#1012452).\n - btrfs: Refactor btrfs_lock_cluster() to kill compiler warning\n (bsc#1012452).\n - btrfs: remove BUG() in raid56 (bsc#1012452).\n - btrfs: remove BUG_ON in start_transaction (bsc#1012452).\n - btrfs: remove BUG_ON()'s in btrfs_map_block (bsc#1012452).\n - btrfs: remove build fixup for qgroup_account_snapshot (bsc#1012452).\n - btrfs: remove redundant error check (bsc#1012452).\n - btrfs: remove save_error_info() (bsc#1012452).\n - btrfs: remove unnecessary btrfs_mark_buffer_dirty in split_leaf\n (bsc#1012452).\n - btrfs: remove unused function btrfs_assert() (bsc#1012452).\n - btrfs: rename and document compression workspace members (bsc#1012452).\n - btrfs: rename btrfs_find_device_by_user_input (bsc#1012452).\n - btrfs: rename btrfs_std_error to btrfs_handle_fs_error (bsc#1012452).\n - btrfs: rename __check_raid_min_devices (bsc#1012452).\n - btrfs: rename flags for vol args v2 (bsc#1012452).\n - btrfs: reorg btrfs_close_one_device() (bsc#1012452).\n - btrfs: Replace -ENOENT by -ERANGE in btrfs_get_acl() (bsc#1012452).\n - btrfs: Reset IO error counters before start of device replacing\n (bsc#1012452).\n - btrfs: reuse existing variable in scrub_stripe, reduce stack usage\n (bsc#1012452).\n - btrfs: s_bdev is not null after missing replace (bsc#1012452).\n - btrfs: scrub: Set bbio to NULL before calling btrfs_map_block\n (bsc#1012452).\n - btrfs: scrub: use GFP_KERNEL on the submission path (bsc#1012452).\n - btrfs: Search for all ordered extents that could span across a page\n (bsc#1012452).\n - btrfs: send, fix failure to rename top level inode due to name collision\n (bsc#1028325).\n - btrfs: send: silence an integer overflow warning (bsc#1012452).\n - btrfs: send: use GFP_KERNEL everywhere (bsc#1012452).\n - btrfs: send: use temporary variable to store allocation size\n (bsc#1012452).\n - btrfs: send: use vmalloc only as fallback for clone_roots (bsc#1012452).\n - btrfs: send: use vmalloc only as fallback for clone_sources_tmp\n (bsc#1012452).\n - btrfs: send: use vmalloc only as fallback for read_buf (bsc#1012452).\n - btrfs: send: use vmalloc only as fallback for send_buf (bsc#1012452).\n - btrfs: serialize subvolume mounts with potentially mismatching rw flags\n (bsc#951844 bsc#1024015)\n - btrfs: Simplify conditions about compress while mapping btrfs flags to\n inode flags (bsc#1012452).\n - btrfs: sink gfp parameter to clear_extent_bits (bsc#1012452).\n - btrfs: sink gfp parameter to clear_extent_dirty (bsc#1012452).\n - btrfs: sink gfp parameter to clear_record_extent_bits (bsc#1012452).\n - btrfs: sink gfp parameter to convert_extent_bit (bsc#1012452).\n - btrfs: sink gfp parameter to set_extent_bits (bsc#1012452).\n - btrfs: sink gfp parameter to set_extent_defrag (bsc#1012452).\n - btrfs: sink gfp parameter to set_extent_delalloc (bsc#1012452).\n - btrfs: sink gfp parameter to set_extent_new (bsc#1012452).\n - btrfs: sink gfp parameter to set_record_extent_bits (bsc#1012452).\n - btrfs: skip commit transaction if we do not have enough pinned bytes\n (bsc#1037186).\n - btrfs: subpage-blocksize: Rate limit scrub error message (bsc#1012452).\n - btrfs: switch to common message helpers in open_ctree, adjust messages\n (bsc#1012452).\n - btrfs: switch to kcalloc in btrfs_cmp_data_prepare (bsc#1012452).\n - btrfs: sysfs: protect reading label by lock (bsc#1012452).\n - btrfs: test_check_exists: Fix infinite loop when searching for free\n space entries (bsc#987192).\n - btrfs: trace pinned extents (bsc#1012452).\n - btrfs: track transid for delayed ref flushing (bsc#1012452).\n - btrfs: uapi/linux/btrfs.h migration, document subvol flags (bsc#1012452).\n - btrfs: uapi/linux/btrfs.h migration, move balance flags (bsc#1012452).\n - btrfs: uapi/linux/btrfs.h migration, move BTRFS_LABEL_SIZE (bsc#1012452).\n - btrfs: uapi/linux/btrfs.h migration, move feature flags (bsc#1012452).\n - btrfs: uapi/linux/btrfs.h migration, move struct\n btrfs_ioctl_defrag_range_args (bsc#1012452).\n - btrfs: uapi/linux/btrfs.h migration, qgroup limit flags (bsc#1012452).\n - btrfs: uapi/linux/btrfs_tree.h migration, item types and defines\n (bsc#1012452).\n - btrfs: uapi/linux/btrfs_tree.h, use __u8 and __u64 (bsc#1012452).\n - btrfs: unpin log if rename operation fails (bsc#1020975).\n - btrfs: unpin logs if rename exchange operation fails (bsc#1020975).\n - btrfs: unsplit printed strings (bsc#1012452).\n - btrfs: untangle gotos a bit in __clear_extent_bit (bsc#1012452).\n - btrfs: untangle gotos a bit in convert_extent_bit (bsc#1012452).\n - btrfs: untangle gotos a bit in __set_extent_bit (bsc#1012452).\n - btrfs: update btrfs_space_info's bytes_may_use timely (bsc#1012452).\n - btrfs: Use correct format specifier (bsc#1012452).\n - btrfs: use correct offset for reloc_inode in\n prealloc_file_extent_cluster() (bsc#1012452).\n - btrfs: use dynamic allocation for root item in create_subvol\n (bsc#1012452).\n - btrfs: Use (eb-&gt;start, seq) as search key for tree modification log\n (bsc#1012452).\n - btrfs: use existing device constraints table btrfs_raid_array\n (bsc#1012452).\n - btrfs: use FLUSH_LIMIT for relocation in reserve_metadata_bytes\n (bsc#1012452).\n - btrfs: use fs_info directly (bsc#1012452).\n - btrfs: use new error message helper in qgroup_account_snapshot\n (bsc#1012452).\n - btrfs: use proper type for failrec in extent_state (bsc#1012452).\n - btrfs: use root when checking need_async_flush (bsc#1012452).\n - btrfs: use the correct struct for BTRFS_IOC_LOGICAL_INO (bsc#1012452).\n - btrfs: Use __u64 in exported linux/btrfs.h (bsc#1012452).\n - btrfs: warn_on for unaccounted spaces (bsc#1012452).\n - ceph: check i_nlink while converting a file handle to dentry\n (bsc#1039864).\n - ceph: Check that the new inode size is within limits in ceph_fallocate()\n (bsc#1037969).\n - ceph: Correctly return NXIO errors from ceph_llseek (git-fixes).\n - ceph: fix bad endianness handling in parse_reply_info_extra\n (bsc#1020488).\n - ceph: fix file open flags on ppc64 (bsc#1022266).\n - ceph: fix memory leak in __ceph_setxattr() (bsc#1036763).\n - ceph: fix potential use-after-free (bsc#1043371).\n - ceph: fix recursively call between ceph_set_acl and __ceph_setattr\n (bsc#1034902).\n - ceph: memory leak in ceph_direct_read_write callback (bsc#1041810).\n - cfq-iosched: fix the delay of cfq_group's vdisktime under iops mode\n (bsc#1012829).\n - cgroup/pids: remove spurious suspicious RCU usage warning (bnc#1031831).\n - cgroup: remove redundant cleanup in css_create (bsc#1012829).\n - cifs: backport prepath matching fix (bsc#799133).\n - cifs: small underflow in cnvrtDosUnixTm() (bnc#1043935).\n - clk: Make x86/ conditional on CONFIG_COMMON_CLK (4.4.68 stable queue).\n - clk: xgene: Add PMD clock (bsc#1019351).\n - clk: xgene: Do not call __pa on ioremaped address (bsc#1019351).\n - clk: xgene: Remove CLK_IS_ROOT (bsc#1019351).\n - config: enable Ceph kernel client modules for ppc64le (fate#321098)\n - config: enable Ceph kernel client modules for s390x (fate#321098)\n - cpupower: Fix turbo frequency reporting for pre-Sandy Bridge cores\n (4.4.68 stable queue).\n - crypto: algif_aead - Require setkey before accept(2) (bsc#1031717).\n - crypto: algif_hash - avoid zero-sized array (bnc#1007962).\n - crypto: drbg - do not call drbg_instantiate in healt test (bsc#1018913).\n - crypto: drbg - remove FIPS 140-2 continuous test (bsc#1018913).\n - crypto: FIPS - allow tests to be disabled in FIPS mode (bsc#1018913).\n - crypto: qat - fix bar discovery for c62x (bsc#1021251).\n - crypto: qat - zero esram only for DH85x devices (1021248).\n - crypto: rsa - allow keys >= 2048 bits in FIPS mode (bsc#1018913).\n - crypto: sha-mb - Fix load failure (bsc#1037384).\n - crypto: xts - consolidate sanity check for keys (bsc#1018913).\n - crypto: xts - fix compile errors (bsc#1018913).\n - cxgb4: Add control net_device for configuring PCIe VF (bsc#1021424).\n - cxgb4: Add llseek operation for flash debugfs entry (bsc#1021424).\n - cxgb4: add new routine to get adapter info (bsc#1021424).\n - cxgb4: Add PCI device ID for new adapter (bsc#1021424).\n - cxgb4: Add port description for new cards (bsc#1021424).\n - cxgb4: Add support to enable logging of firmware mailbox commands\n (bsc#1021424).\n - cxgb4: Check for firmware errors in the mailbox command loop\n (bsc#1021424).\n - cxgb4: correct device ID of T6 adapter (bsc#1021424).\n - cxgb4/cxgb4vf: Add set VF mac address support (bsc#1021424).\n - cxgb4/cxgb4vf: Allocate more queues for 25G and 100G adapter\n (bsc#1021424).\n - cxgb4/cxgb4vf: Assign netdev->dev_port with port ID (bsc#1021424).\n - cxgb4/cxgb4vf: Display 25G and 100G link speed (bsc#1021424).\n - cxgb4/cxgb4vf: Remove deprecated module parameters (bsc#1021424).\n - cxgb4: DCB message handler needs to use correct portid to netdev mapping\n (bsc#1021424).\n - cxgb4: Decode link down reason code obtained from firmware (bsc#1021424).\n - cxgb4: Do not assume FW_PORT_CMD reply is always port info msg\n (bsc#1021424).\n - cxgb4: do not call napi_hash_del() (bsc#1021424).\n - cxgb4: Do not sleep when mbox cmd is issued from interrupt context\n (bsc#1021424).\n - cxgb4: Enable SR-IOV configuration via PCI sysfs interface (bsc#1021424).\n - cxgb4: Fix issue while re-registering VF mgmt netdev (bsc#1021424).\n - cxgb4: MU requested by Chelsio (bsc#1021424).\n - cxgb4: Properly decode port module type (bsc#1021424).\n - cxgb4: Refactor t4_port_init function (bsc#1021424).\n - cxgb4: Reset dcb state machine and tx queue prio only if dcb is enabled\n (bsc#1021424).\n - cxgb4: Support compressed error vector for T6 (bsc#1021424).\n - cxgb4: Synchronize access to mailbox (bsc#1021424).\n - cxgb4: update latest firmware version supported (bsc#1021424).\n - cxgb4vf: do not offload Rx checksums for IPv6 fragments (bsc#1026692).\n - dax: fix deadlock with DAX 4k holes (bsc#1012829).\n - dax: fix device-dax region base (bsc#1023175).\n - Delete previous two fixes for i915 (bsc#1019061). These upstream fixes\n brought some regressions, so better to revert for now.\n - dell-laptop: Adds support for keyboard backlight timeout AC settings\n (bsc#1013561).\n - device-dax: check devm_nsio_enable() return value (bsc#1023175).\n - device-dax: fail all private mapping attempts (bsc#1023175).\n - device-dax: fix percpu_ref_exit ordering (bsc#1023175).\n - device-dax: fix private mapping restriction, permit read-only\n (bsc#1031717).\n - Disable CONFIG_POWER_SUPPLY_DEBUG in debug kernel (bsc#1031500).\n - dmaengine: dw: fix typo in Kconfig (bsc#1031717).\n - dm: fix dm_target_io leak if clone_bio() returns an error (bsc#1040125).\n - dm-mpath: fix race window in do_end_io() (bsc#1011044).\n - dm round robin: do not use this_cpu_ptr() without having preemption\n disabled (bsc#1040125).\n - dm verity fec: fix block calculation (bsc#1040125).\n - dm verity fec: fix bufio leaks (bsc#1040125).\n - dm verity fec: limit error correction recursion (bsc#1040125).\n - drivers: base: dma-mapping: Fix typo in dmam_alloc_non_coherent comments\n (bsc#1031717).\n - drivers: hv: util: do not forget to init host_ts.lock (bsc#1031206).\n - drivers: hv: vmbus: finally fix hv_need_to_signal_on_read()\n (fate#320485, bug#1018385).\n - drivers: hv: vmbus: Prevent sending data on a rescinded channel\n (fate#320485, bug#1028217).\n - drivers: hv: vmbus: Raise retry/wait limits in vmbus_post_msg()\n (fate#320485, bsc#1023287, bsc#1028217).\n - drivers: net: phy: mdio-xgene: Add hardware dependency (bsc#1019351).\n - drivers: net: phy: xgene: Fix 'remove' function (bsc#1019351).\n - drivers: net: xgene: Add change_mtu function (bsc#1019351).\n - drivers: net: xgene: Add flow control configuration (bsc#1019351).\n - drivers: net: xgene: Add flow control initialization (bsc#1019351).\n - drivers: net: xgene: Add helper function (bsc#1019351).\n - drivers: net: xgene: Add support for Jumbo frame (bsc#1019351).\n - drivers: net: xgene: Configure classifier with pagepool (bsc#1019351).\n - drivers: net: xgene: fix build after change_mtu function change\n (bsc#1019351).\n - drivers: net: xgene: fix: Coalescing values for v2 hardware\n (bsc#1019351).\n - drivers: net: xgene: fix: Disable coalescing on v1 hardware\n (bsc#1019351).\n - drivers: net: xgene: Fix MSS programming (bsc#1019351).\n - drivers: net: xgene: fix: RSS for non-TCP/UDP (bsc#1019351).\n - drivers: net: xgene: fix: Use GPIO to get link status (bsc#1019351).\n - drivers: net: xgene: uninitialized variable in\n xgene_enet_free_pagepool() (bsc#1019351).\n - drivers/tty: 8250: only call fintek_8250_probe when doing port I/O\n (bsc#1031717).\n - drm: Fix broken VT switch with video=1366x768 option (bsc#1018358).\n - drm/i915: Add intel_uncore_suspend / resume functions (bsc#1011913).\n - drm/i915: Disable tv output on i9x5gm (bsc#1039700).\n - drm/i915: Do not init hpd polling for vlv and chv from runtime_suspend()\n (bsc#1014120).\n - drm/i915: Do not touch NULL sg on i915_gem_object_get_pages_gtt() error\n (bsc#1031717).\n - drm-i915-dp-Restore-PPS-HW-state-from-the-encoder-re\n - drm/i915/dp: Restore PPS HW state from the encoder resume hook\n (bsc#1019061).\n - drm/i915: Fix crash after S3 resume with DP MST mode change\n (bsc#1029634).\n - drm/i915: Fix mismatched INIT power domain disabling during suspend\n (bsc#1031717).\n - drm/i915: Fix watermarks for VLV/CHV (bsc#1011176).\n - drm/i915: Force VDD off on the new power seqeuencer before starting to\n use it (bsc#1009674).\n - drm/i915/gen9: Fix PCODE polling during CDCLK change notification\n (bsc#1015367).\n - drm/i915: Introduce Kabypoint PCH for Kabylake H/DT (bsc#1032581).\n - drm/i915: Listen for PMIC bus access notifications (bsc#1011913).\n - drm/i915: Mark CPU cache as dirty when used for rendering (bsc#1015367).\n - drm/i915: Mark i915_hpd_poll_init_work as static (bsc#1014120).\n - drm/i915: Nuke debug messages from the pipe update critical section\n (bsc#1031717).\n - drm/i915: Only enable hotplug interrupts if the display interrupts are\n enabled (bsc#1031717).\n - drm-i915-Prevent-PPS-stealing-from-a-normal-DP-port\n - drm/i915: Prevent PPS stealing from a normal DP port on VLV/CHV\n (bsc#1019061).\n - drm/i915: Program iboost settings for HDMI/DVI on SKL (bsc#1031717).\n - drm/i915: relax uncritical udelay_range() (bsc#1031717).\n - drm/i915: relax uncritical udelay_range() settings (bsc#1031717).\n - drm/i915: Use pagecache write to prepopulate shmemfs from pwrite-ioctl\n (bsc#1040463).\n - drm/i915/vlv: Prevent enabling hpd polling in late suspend (bsc#1014120).\n - drm/i915: Workaround for DP DPMS D3 on Dell monitor (bsc#1019061).\n - drm/mgag200: Added support for the new device G200eH3 (bsc#1007959,\n fate#322780)\n - drm/mgag200: Fix to always set HiPri for G200e4 (bsc#1015452,\n bsc#995542).\n - drm/nouveau/tmr: fully separate alarm execution/pending lists\n (bsc#1043467).\n - drm/ttm: fix use-after-free races in vm fault handling (4.4.68 stable\n queue).\n - drm/vc4: Fix an integer overflow in temporary allocation layout\n (bsc#1021294).\n - drm-vc4-Fix-an-integer-overflow-in-temporary-allocation-layout.patch\n - drm/vc4: Return -EINVAL on the overflow checks failing (bsc#1021294).\n - drm-vc4-Return-EINVAL-on-the-overflow-checks-failing.patch\n - drm: virtio-gpu: get the fb from the plane state for atomic updates\n (bsc#1023101).\n - e1000e: Do not return uninitialized stats (bug#1034635).\n - edac, xgene: Fix spelling mistake in error messages (bsc#1019351).\n - efi: Do not issue error message when booted under Xen (bnc#1036638).\n - enic: set skb->hash type properly (bsc#922871 fate#318754).\n - ext4: fix data corruption for mmap writes (bsc#1012829).\n - ext4: fix data corruption with EXT4_GET_BLOCKS_ZERO (bsc#1012829).\n - ext4: fix fencepost in s_first_meta_bg validation (bsc#1029986).\n - ext4: fix use-after-iput when fscrypt contexts are inconsistent\n (bsc#1012829).\n - f2fs: fix bad prefetchw of NULL page (bsc#1012829).\n - f2fs: sanity check segment count (4.4.68 stable queue).\n - Fix a regression reported by bsc#1020048 in\n patches.fixes/0003-md-lockless-I-O-submission-for-RAID1.patch\n (bsc#982783,bsc#998106,bsc#1020048).\n - fnic: Return 'DID_IMM_RETRY' if rport is not ready (bsc#1035920).\n - fs/block_dev: always invalidate cleancache in invalidate_bdev()\n (git-fixes).\n - fs: fix data invalidation in the cleancache during direct IO (git-fixes).\n - fs/xattr.c: zero out memory copied to userspace in getxattr (git-fixes).\n - ftrace: Make ftrace_location_range() global (FATE#322421).\n - fuse: fix clearing suid, sgid for chown() (bsc#1012829).\n - futex: Add missing error handling to FUTEX_REQUEUE_PI (bsc#969755).\n - futex: Fix potential use-after-free in FUTEX_REQUEUE_PI (bsc#969755).\n - gpio: xgene: make explicitly non-modular (bsc#1019351).\n - hid: usbhid: Quirk a AMI virtual mouse and keyboard with ALWAYS_POLL\n (bsc#1022340).\n - hv: do not reset hv_context.tsc_page on crash (fate#320485, bnc#1007729).\n - hv: export current Hyper-V clocksource (bsc#1031206).\n - hv_utils: implement Hyper-V PTP source (bsc#1031206).\n - i2c: designware-baytrail: Acquire P-Unit access on bus acquire\n (bsc#1011913).\n - i2c: designware-baytrail: Call pmic_bus_access_notifier_chain\n (bsc#1011913).\n - i2c: designware-baytrail: Fix race when resetting the semaphore\n (bsc#1011913).\n - i2c: designware-baytrail: Only check iosf_mbi_available() for shared\n hosts (bsc#1011913).\n - i2c: designware: Disable pm for PMIC i2c-bus even if there is no _SEM\n method (bsc#1011913).\n - i2c: designware: fix wrong Tx/Rx FIFO for ACPI (bsc#1019351).\n - i2c: designware: Implement support for SMBus block read and write\n (bsc#1019351).\n - i2c-designware: increase timeout (bsc#1011913).\n - i2c: designware: Never suspend i2c-busses used for accessing the system\n PMIC (bsc#1011913).\n - i2c: designware: Rename accessor_flags to flags (bsc#1011913).\n - i2c: xgene: Fix missing code of DTB support (bsc#1019351).\n - i40e: Be much more verbose about what we can and cannot offload\n (bsc#985561).\n - ib/addr: Fix setting source address in addr6_resolve() (bsc#1044082).\n - ib/core: Fix kernel crash during fail to initialize device (bsc#1022595\n FATE#322350).\n - ib/core: For multicast functions, verify that LIDs are multicast LIDs\n (bsc#1022595 FATE#322350).\n - ib/core: If the MGID/MLID pair is not on the list return an error\n (bsc#1022595 FATE#322350).\n - ib/ipoib: Fix deadlock between ipoib_stop and mcast join flow\n (bsc#1022595 FATE#322350).\n - ib/mlx5: Assign DSCP for R-RoCE QPs Address Path (bsc#966170 bsc#966172\n bsc#966191).\n - ib/mlx5: Check supported flow table size (bsc#966170 bsc#966172\n bsc#966191).\n - ib/mlx5: Enlarge autogroup flow table (bsc#966170 bsc#966172 bsc#966191).\n - ib/mlx5: Fix kernel to user leak prevention logic (bsc#966170 bsc#966172\n bsc#966191).\n - ibmveth: calculate gso_segs for large packets (bsc#1019148).\n - ibmveth: check return of skb_linearize in ibmveth_start_xmit\n (bsc#1019148).\n - ibmveth: consolidate kmalloc of array, memset 0 to kcalloc (bsc#1019148).\n - ibmveth: set correct gso_size and gso_type (bsc#1019148).\n - ibmvnic: Activate disabled RX buffer pools on reset (bsc#1044767).\n - ibmvnic: Add set_link_state routine for setting adapter link state\n (fate#322021, bsc#1031512).\n - ibmvnic: Allocate number of rx/tx buffers agreed on by firmware\n (fate#322021, bsc#1031512).\n - ibmvnic: Allocate zero-filled memory for sub crqs (fate#322021,\n bsc#1031512).\n - ibmvnic: Call napi_disable instead of napi_enable in failure path\n (fate#322021, bsc#1031512).\n - ibmvnic: Check adapter state during ibmvnic_poll (fate#322021,\n bsc#1040855).\n - ibmvnic: Check for driver reset first in ibmvnic_xmit (fate#322021,\n bsc#1038297).\n - ibmvnic: Cleanup failure path in ibmvnic_open (fate#322021, bsc#1031512).\n - ibmvnic: Clean up tx pools when closing (fate#322021, bsc#1038297).\n - ibmvnic: Client-initiated failover (bsc#1043990).\n - ibmvnic: Continue skb processing after skb completion error\n (fate#322021, bsc#1038297).\n - ibmvnic: Correct crq and resource releasing (fate#322021, bsc#1031512).\n - ibmvnic: Correct ibmvnic handling of device open/close (fate#322021,\n bsc#1031512).\n - ibmvnic: Create init and release routines for the bounce buffer\n (fate#322021, bsc#1031512).\n - ibmvnic: Create init and release routines for the rx pool (fate#322021,\n bsc#1031512).\n - ibmvnic: Create init and release routines for the tx pool (fate#322021,\n bsc#1031512).\n - ibmvnic: Create init/release routines for stats token (fate#322021,\n bsc#1031512).\n - ibmvnic: Deactivate RX pool buffer replenishment on H_CLOSED\n (fate#322021, bsc#1040855).\n - ibmvnic: Delete napi's when releasing driver resources (fate#322021,\n bsc#1038297).\n - ibmvnic: Disable irq prior to close (fate#322021, bsc#1031512).\n - ibmvnic: Do not disable IRQ after scheduling tasklet (fate#322021,\n bsc#1031512).\n - ibmvnic: driver initialization for kdump/kexec (bsc#1044772).\n - ibmvnic: Ensure that TX queues are disabled in __ibmvnic_close\n (bsc#1044767).\n - ibmvnic: Exit polling routine correctly during adapter reset\n (bsc#1044767).\n - ibmvnic: Fix cleanup of SKB's on driver close (fate#322021, bsc#1040855).\n - ibmvnic: Fix endian errors in error reporting output (fate#322021,\n bsc#1031512).\n - ibmvnic: Fix endian error when requesting device capabilities\n (fate#322021, bsc#1031512).\n - ibmvnic: Fix ibmvnic_change_mac_addr struct format (fate#322021,\n bsc#1031512).\n - ibmvnic: Fix initial MTU settings (bsc#1031512).\n - ibmvnic: fix missing unlock on error in __ibmvnic_reset() (fate#322021,\n bsc#1038297, Fixes: ed651a10875f).\n - ibmvnic: Fix overflowing firmware/hardware TX queue (fate#322021,\n bsc#1031512).\n - ibmvnic: Fixup atomic API usage (fate#322021, bsc#1031512).\n - ibmvnic: Free skb's in cases of failure in transmit (fate#322021,\n bsc#1031512).\n - ibmvnic: Free tx/rx scrq pointer array when releasing sub-crqs\n (fate#322021, bsc#1031512).\n - ibmvnic: Halt TX and report carrier off on H_CLOSED return code\n (fate#322021, bsc#1040855).\n - ibmvnic: Handle failover after failed init crq (fate#322021,\n bsc#1040855).\n - ibmvnic: Handle processing of CRQ messages in a tasklet (fate#322021,\n bsc#1031512).\n - ibmvnic: Initialize completion variables before starting work\n (fate#322021, bsc#1031512).\n - ibmvnic: Insert header on VLAN tagged received frame (fate#322021,\n bsc#1031512).\n - ibmvnic: Make CRQ interrupt tasklet wait for all capabilities crqs\n (fate#322021, bsc#1031512).\n - ibmvnic: Merge the two release_sub_crq_queue routines (fate#322021,\n bsc#1031512).\n - ibmvnic: Move ibmvnic adapter intialization to its own routine\n (fate#322021, bsc#1031512).\n - ibmvnic: Move initialization of sub crqs to ibmvnic_init (fate#322021,\n bsc#1031512).\n - ibmvnic: Move initialization of the stats token to ibmvnic_open\n (fate#322021, bsc#1031512).\n - ibmvnic: Move login and queue negotiation into ibmvnic_open\n (fate#322021, bsc#1031512).\n - ibmvnic: Move login to its own routine (fate#322021, bsc#1031512).\n - ibmvnic: Move queue restarting in ibmvnic_tx_complete (fate#322021,\n bsc#1038297).\n - ibmvnic: Move resource initialization to its own routine (fate#322021,\n bsc#1038297).\n - ibmvnic: Non-fatal error handling (fate#322021, bsc#1040855).\n - ibmvnic: Only retrieve error info if present (fate#322021, bsc#1031512).\n - ibmvnic: Record SKB RX queue during poll (fate#322021, bsc#1038297).\n - ibmvnic: Remove debugfs support (fate#322021, bsc#1031512).\n - ibmvnic: Remove inflight list (fate#322021, bsc#1031512).\n - ibmvnic: Remove netdev notify for failover resets (bsc#1044120).\n - ibmvnic: Remove unused bouce buffer (fate#322021, bsc#1031512).\n - ibmvnic: Remove VNIC_CLOSING check from pending_scrq (bsc#1044767).\n - ibmvnic: Replace is_closed with state field (fate#322021, bsc#1038297).\n - ibmvnic: Report errors when failing to release sub-crqs (fate#322021,\n bsc#1031512).\n - ibmvnic: Reset sub-crqs during driver reset (fate#322021, bsc#1040855).\n - ibmvnic: Reset the CRQ queue during driver reset (fate#322021,\n bsc#1040855).\n - ibmvnic: Reset tx/rx pools on driver reset (fate#322021, bsc#1040855).\n - ibmvnic: Return failure on attempted mtu change (bsc#1043236).\n - ibmvnic: Sanitize entire SCRQ buffer on reset (bsc#1044767).\n - ibmvnic: Send gratuitous arp on reset (fate#322021, bsc#1040855).\n - ibmvnic: Set real number of rx queues (fate#322021, bsc#1031512).\n - ibmvnic: Split initialization of scrqs to its own routine (fate#322021,\n bsc#1031512).\n - ibmvnic: Track state of adapter napis (fate#322021, bsc#1040855).\n - ibmvnic: Unmap longer term buffer before free (fate#322021, bsc#1031512).\n - ibmvnic: Updated reset handling (fate#322021, bsc#1038297).\n - ibmvnic: Update main crq initialization and release (fate#322021,\n bsc#1031512).\n - ibmvnic: Use common counter for capabilities checks (fate#322021,\n bsc#1031512).\n - ibmvnic: use max_mtu instead of req_mtu for MTU range check\n (bsc#1031512).\n - ibmvnic: Validate napi exist before disabling them (fate#322021,\n bsc#1031512).\n - ibmvnic: Wait for any pending scrqs entries at driver close\n (fate#322021, bsc#1038297).\n - ibmvnic: Whitespace correction in release_rx_pools (fate#322021,\n bsc#1038297).\n - iio: hid-sensor: Store restore poll and hysteresis on S3 (bsc#1031717).\n - infiniband: avoid dereferencing uninitialized dst on error path\n (git-fixes).\n - iommu/arm-smmu: Disable stalling faults for all endpoints (bsc#1038843).\n - iommu/dma: Respect IOMMU aperture when allocating (bsc#1038842).\n - iommu/exynos: Block SYSMMU while invalidating FLPD cache (bsc#1038848).\n - iommu: Handle default domain attach failure (bsc#1038846).\n - iommu/vt-d: Do not over-free page table directories (bsc#1038847).\n - iommu/vt-d: Make sure IOMMUs are off when intel_iommu=off (bsc#1031208).\n - ipv4, ipv6: ensure raw socket message is big enough to hold an IP header\n (4.4.68 stable queue).\n - ipv6: Do not use ufo handling on later transformed packets (bsc#1042286).\n - ipv6: fix endianness error in icmpv6_err (bsc#1042286).\n - ipv6: initialize route null entry in addrconf_init() (4.4.68 stable\n queue).\n - ipv6: release dst on error in ip6_dst_lookup_tail (git-fixes).\n - ipv6: reorder ip6_route_dev_notifier after ipv6_dev_notf (4.4.68 stable\n queue).\n - isa: Call isa_bus_init before dependent ISA bus drivers register\n (bsc#1031717).\n - iscsi-target: Return error if unable to add network portal (bsc#1032803).\n - iw_cxgb4: Guard against null cm_id in dump_ep/qp (bsc#1026570).\n - iwlwifi: Expose the default fallback ucode API to module info\n (boo#1021082, boo#1023884).\n - jump label: fix passing kbuild_cflags when checking for asm goto support\n (git-fixes).\n - kabi: Hide new include in arch/powerpc/kernel/process.c (fate#322421).\n - kABI: move and hide new cxgbi device owner field (bsc#1018885).\n - kABI: protect cgroup include in kernel/kthread (kabi).\n - kABI: protect struct fib_info (kabi).\n - kABI: protect struct iscsi_conn (kabi).\n - kABI: protect struct mnt_namespace (kabi).\n - kABI: protect struct musb_platform_ops (kabi).\n - kABI: protect struct pglist_data (kabi).\n - kABI: protect struct se_node_acl (kabi).\n - kABI: protect struct snd_fw_async_midi_port (kabi).\n - kABI: protect struct tcp_fastopen_cookie (kabi).\n - kABI: protect struct user_fpsimd_state (kabi).\n - kABI: protect struct wake_irq (kabi).\n - kABI: protect struct xhci_hcd (kabi).\n - kABI: protect struct xlog (bsc#1043598).\n - kABI: restore can_rx_register parameters (kabi).\n - kABI: restore ttm_ref_object_add parameters (kabi).\n - kABI workaround 4.4.65 adding #include <linux/mount.h> to kernel/sysctl.c\n - kabi workaround for net: ipv6: Fix processing of RAs in presence of VRF\n (bsc#1042286).\n - kernel-binary.spec: Propagate MAKE_ARGS to %build (bsc#1012422)\n - kernel: Fix invalid domain response handling (bnc#1009718, LTC#149851).\n - kgraft/iscsi-target: Do not block kGraft in iscsi_np kthread\n (bsc#1010612, fate#313296).\n - kgraft/xen: Do not block kGraft in xenbus kthread (bsc#1017410,\n fate#313296).\n - kgr: Mark eeh_event_handler() kthread safe using a timeout (bsc#1031662).\n - kgr/module: make a taint flag module-specific (fate#313296).\n - kgr: remove all arch-specific kgraft header files (fate#313296).\n - kprobes/x86: Fix kernel panic when certain exception-handling addresses\n are probed (4.4.68 stable queue).\n - kvm: better MWAIT emulation for guests (bsc#1031142).\n - kvm: nVMX: do not leak PML full vmexit to L1 (4.4.68 stable queue).\n - kvm: nVMX: initialize PML fields in vmcs02 (4.4.68 stable queue).\n - kvm: svm: add support for RDTSCP (bsc#1033117).\n - l2tp: fix address test in __l2tp_ip6_bind_lookup() (bsc#1028415).\n - l2tp: fix lookup for sockets not bound to a device in l2tp_ip\n (bsc#1028415).\n - l2tp: fix race in l2tp_recv_common() (bsc#1042286).\n - l2tp: fix racy socket lookup in l2tp_ip and l2tp_ip6 bind()\n (bsc#1028415).\n - l2tp: hold socket before dropping lock in l2tp_ip{, 6}_recv()\n (bsc#1028415).\n - l2tp: hold tunnel socket when handling control frames in l2tp_ip and\n l2tp_ip6 (bsc#1028415).\n - l2tp: lock socket before checking flags in connect() (bsc#1028415).\n - leds: ktd2692: avoid harmless maybe-uninitialized warning (4.4.68 stable\n queue).\n - libata-scsi: Fixup ata_gen_passthru_sense() (bsc#1040125).\n - libceph: NULL deref on crush_decode() error path (bsc#1044015).\n - libcxgb: add library module for Chelsio drivers (bsc#1021424).\n - lib/mpi: mpi_read_raw_data(): fix nbits calculation (bsc#1003581).\n - lib/mpi: mpi_read_raw_data(): purge redundant clearing of nbits\n (bsc#1003581).\n - lib/mpi: mpi_read_raw_from_sgl(): do not include leading zero SGEs in\n nbytes (bsc#1003581).\n - lib/mpi: mpi_read_raw_from_sgl(): fix nbits calculation (bsc#1003581).\n - lib/mpi: mpi_read_raw_from_sgl(): fix out-of-bounds buffer access\n (bsc#1003581).\n - lib/mpi: mpi_read_raw_from_sgl(): purge redundant clearing of nbits\n (bsc#1003581).\n - lib/mpi: mpi_read_raw_from_sgl(): replace len argument by nbytes\n (bsc#1003581).\n - lib/mpi: mpi_read_raw_from_sgl(): sanitize meaning of indices\n (bsc#1003581).\n - libnvdimm, pfn: fix align attribute (bsc#1023175).\n - libnvdimm, pfn: fix memmap reservation size versus 4K alignment\n (bsc#1031717).\n - libnvdimm, pfn: fix 'npfns' vs section alignment (bsc#1040125).\n - livepatch: Allow architectures to specify an alternate ftrace location\n (FATE#322421).\n - locking/semaphore: Add down_interruptible_timeout() (bsc#1031662).\n - locking/ww_mutex: Fix compilation of __WW_MUTEX_INITIALIZER\n (bsc#1031717).\n - lpfc: remove incorrect lockdep assertion (bsc#1040125).\n - mailbox: xgene-slimpro: Fix wrong test for devm_kzalloc (bsc#1019351).\n - md: allow creation of mdNNN arrays via md_mod/parameters/new_array\n (bsc#1032339).\n - md.c:didn't unlock the mddev before return EINVAL in array_size_store\n (bsc#1038143).\n - md-cluster: convert the completion to wait queue (fate#316335).\n - md-cluster: fix potential lock issue in add_new_disk (bsc#1041087).\n - md-cluster: protect md_find_rdev_nr_rcu with rcu lock (fate#316335).\n - md: ensure md devices are freed before module is unloaded (bsc#1022304).\n - md: fix refcount problem on mddev when stopping array (bsc#1022304).\n - md: handle read-only member devices better (bsc#1033281).\n - md linear: fix a race between linear_add() and linear_congested()\n (bsc#1018446).\n - md: MD_CLOSING needs to be cleared after called md_set_readonly or\n do_md_stop (bsc#1038142).\n - md/raid1: add rcu protection to rdev in fix_read_error (References:\n bsc#998106,bsc#1020048,bsc#982783).\n - md/raid1: avoid reusing a resync bio after error handling (Fate#311379).\n - md/raid1: fix a use-after-free bug (bsc#998106,bsc#1020048,bsc#982783).\n - md/raid1: handle flush request correctly\n (bsc#998106,bsc#1020048,bsc#982783).\n - md/raid1: Refactor raid1_make_request\n (bsc#998106,bsc#1020048,bsc#982783).\n - md: support disabling of create-on-open semantics (bsc#1032339).\n - media: am437x-vpfe: fix an uninitialized variable bug (bsc#1031717).\n - media: b2c2: use IS_REACHABLE() instead of open-coding it (bsc#1031717).\n - media: c8sectpfe: Rework firmware loading mechanism (bsc#1031717).\n - media: cx231xx-audio: fix NULL-deref at probe (bsc#1031717).\n - media: cx231xx-cards: fix NULL-deref at probe (bsc#1031717).\n - media: cx23885: uninitialized variable in cx23885_av_work_handler()\n (bsc#1031717).\n - media: DaVinci-VPBE: Check return value of a setup_if_config() call in\n vpbe_set_output() (bsc#1031717).\n - media: DaVinci-VPFE-Capture: fix error handling (bsc#1031717).\n - media: dib0700: fix NULL-deref at probe (bsc#1031717).\n - media: dvb-usb: avoid link error with dib3000m{b,c| (bsc#1031717).\n - media: exynos4-is: fix a format string bug (bsc#1031717).\n - media: gspca: konica: add missing endpoint sanity check (bsc#1031717).\n - media: lirc_imon: do not leave imon_probe() with mutex held\n (bsc#1031717).\n - media: pvrusb2: reduce stack usage pvr2_eeprom_analyze() (bsc#1031717).\n - media: rc: allow rc modules to be loaded if rc-main is not a module\n (bsc#1031717).\n - media: s5p-mfc: Fix unbalanced call to clock management (bsc#1031717).\n - media: sh-vou: clarify videobuf2 dependency (bsc#1031717).\n - media: staging: media: davinci_vpfe: unlock on error in vpfe_reqbufs()\n (bsc#1031717).\n - media: usbvision: fix NULL-deref at probe (bsc#1031717).\n - media: uvcvideo: Fix empty packet statistic (bsc#1031717).\n - media: uvcvideo: uvc_scan_fallback() for webcams with broken chain\n (bsc#1021474).\n - media: vb2: Fix an off by one error in 'vb2_plane_vaddr' (bsc#1043231).\n - mem-hotplug: fix node spanned pages when we have a movable node\n (bnc#1034671).\n - mips: R2-on-R6 MULTU/MADDU/MSUBU emulation bugfix (4.4.68 stable queue).\n - mlx4: Fix memory leak after mlx4_en_update_priv() (bsc#966170 bsc#966172\n bsc#966191).\n - mmc: debugfs: correct wrong voltage value (bsc#1031717).\n - mmc: Downgrade error level (bsc#1042536).\n - mm,compaction: serialize waitqueue_active() checks (bsc#971975).\n - mmc: sdhci-of-arasan: Remove no-hispd and no-cmd23 quirks for\n sdhci-arasan4.9a (bsc#1019351).\n - mmc: sdhci-pxav3: fix higher speed mode capabilities (bsc#1031717).\n - mmc: sdhci: restore behavior when setting VDD via external regulator\n (bsc#1031717).\n - mm: fix <linux/pagemap.h> stray kernel-doc notation (bnc#971975 VM --\n git fixes).\n - mm: fix set pageblock migratetype in deferred struct page init\n (bnc#1027195).\n - mm/huge_memory.c: respect FOLL_FORCE/FOLL_COW for thp (bnc#1030118).\n - mm/hugetlb: check for reserved hugepages during memory offline\n (bnc#971975 VM -- git fixes).\n - mm/hugetlb: fix incorrect hugepages count during mem hotplug (bnc#971975\n VM -- git fixes).\n - mm/memblock.c: fix memblock_next_valid_pfn() (bnc#1031200).\n - mm, memcg: do not retry precharge charges (bnc#1022559).\n - mm, page_alloc: fix check for NULL preferred_zone (bnc#971975 VM\n performance -- page allocator).\n - mm, page_alloc: fix fast-path race with cpuset update or removal\n (bnc#971975 VM performance -- page allocator).\n - mm, page_alloc: fix premature OOM when racing with cpuset mems update\n (bnc#971975 VM performance -- page allocator).\n - mm, page_alloc: keep pcp count and list contents in sync if struct page\n is corrupted (bnc#971975 VM performance -- page allocator).\n - mm, page_alloc: move cpuset seqcount checking to slowpath (bnc#971975 VM\n performance -- page allocator).\n - mm/page_alloc: Remove useless parameter of __free_pages_boot_core\n (bnc#1027195).\n - mm: page_alloc: skip over regions of invalid pfns where possible\n (bnc#1031200).\n - module: fix memory leak on early load_module() failures (bsc#1043014).\n - module: move add_taint_module() to a header file (fate#313296).\n - mountproto.patch: Add commit id\n - mwifiex: add missing check for PCIe8997 chipset (bsc#1018813).\n - mwifiex: Avoid skipping WEP key deletion for AP (4.4.68 stable queue).\n - mwifiex: debugfs: Fix (sometimes) off-by-1 SSID print (4.4.68 stable\n queue).\n - mwifiex: fix IBSS data path issue (bsc#1018813).\n - mwifiex: fix PCIe register information for 8997 chipset (bsc#1018813).\n - mwifiex: pcie: fix cmd_buf use-after-free in remove/reset (bsc#1031717).\n - mwifiex: Removed unused 'pkt_type' variable (bsc#1031717).\n - mwifiex: remove redundant dma padding in AMSDU (4.4.68 stable queue).\n - mwifiex: Remove unused 'bcd_usb' variable (bsc#1031717).\n - mwifiex: Remove unused 'chan_num' variable (bsc#1031717).\n - mwifiex: Remove unused 'pm_flag' variable (bsc#1031717).\n - mwifiex: Remove unused 'sta_ptr' variable (bsc#1031717).\n - net/af_iucv: do not use paged skbs for TX on HiperSockets (bnc#1020945,\n LTC#150566).\n - net: bridge: start hello timer only if device is up (bnc#1012382).\n - net/ena: change condition for host attribute configuration (bsc#1026509).\n - net/ena: change driver's default timeouts (bsc#1026509).\n - net: ena: change the return type of ena_set_push_mode() to be void\n (bsc#1026509).\n - net: ena: Fix error return code in ena_device_init() (bsc#1026509).\n - net/ena: fix ethtool RSS flow configuration (bsc#1026509).\n - net/ena: fix NULL dereference when removing the driver after device\n reset failed (bsc#1026509).\n - net/ena: fix potential access to freed memory during device reset\n (bsc#1026509).\n - net/ena: fix queues number calculation (bsc#1026509).\n - net/ena: fix RSS default hash configuration (bsc#1026509).\n - net/ena: reduce the severity of ena printouts (bsc#1026509).\n - net/ena: refactor ena_get_stats64 to be atomic context safe\n (bsc#1026509).\n - net/ena: remove ntuple filter support from device feature list\n (bsc#1026509).\n - net: ena: remove superfluous check in ena_remove() (bsc#1026509).\n - net: ena: Remove unnecessary pci_set_drvdata() (bsc#1026509).\n - net/ena: update driver version to 1.1.2 (bsc#1026509).\n - net/ena: use READ_ONCE to access completion descriptors (bsc#1026509).\n - net: ena: use setup_timer() and mod_timer() (bsc#1026509).\n - net: ethernet: apm: xgene: use phydev from struct net_device\n (bsc#1019351).\n - net: ethtool: Initialize buffer when querying device channel settings\n (bsc#969479 FATE#320634).\n - netfilter: allow logging from non-init namespaces (bsc#970083).\n - netfilter: nf_conntrack_sip: extend request line validation\n (bsc#1042286).\n - netfilter: nf_ct_expect: remove the redundant slash when policy name is\n empty (bsc#1042286).\n - netfilter: nf_dup_ipv6: set again FLOWI_FLAG_KNOWN_NH at flowi6_flags\n (bsc#1042286).\n - netfilter: nf_nat_snmp: Fix panic when snmp_trap_helper fails to\n register (bsc#1042286).\n - netfilter: nfnetlink_queue: reject verdict request from different portid\n (bsc#1042286).\n - netfilter: restart search if moved to other chain (bsc#1042286).\n - netfilter: use fwmark_reflect in nf_send_reset (bsc#1042286).\n - net: fix compile error in skb_orphan_partial() (bnc#1012382).\n - net: ibmvnic: Remove unused net_stats member from struct ibmvnic_adapter\n (fate#322021, bsc#1031512).\n - net: icmp_route_lookup should use rt dev to determine L3 domain\n (bsc#1042286).\n - net: implement netif_cond_dbg macro (bsc#1019168).\n - net: ipv6: Fix processing of RAs in presence of VRF (bsc#1042286).\n - net: ipv6: set route type for anycast routes (bsc#1042286).\n - net: l3mdev: Add master device lookup by index (bsc#1042286).\n - net: make netdev_for_each_lower_dev safe for device removal\n (bsc#1042286).\n - net/mlx4_core: Avoid command timeouts during VF driver device shutdown\n (bsc#1028017).\n - net/mlx4_core: Avoid delays during VF driver device shutdown\n (bsc#1028017).\n - net/mlx4_core: Fix racy CQ (Completion Queue) free (bsc#1028017).\n - net/mlx4_core: Fix when to save some qp context flags for dynamic VST to\n VGT transitions (bsc#1028017).\n - net/mlx4_core: Use cq quota in SRIOV when creating completion EQs\n (bsc#1028017).\n - net/mlx4_en: Fix bad WQE issue (bsc#1028017).\n - net/mlx5: Do not unlock fte while still using it (bsc#966170 bsc#966172\n bsc#966191).\n - net/mlx5e: Modify TIRs hash only when it's needed (bsc#966170 bsc#966172\n bsc#966191).\n - net/mlx5: Fix create autogroup prev initializer (bsc#966170 bsc#966172\n bsc#966191).\n - net/mlx5: Prevent setting multicast macs for VFs (bsc#966170 bsc#966172\n bsc#966191).\n - net/mlx5: Release FTE lock in error flow (bsc#966170 bsc#966172\n bsc#966191).\n - net: remove useless memset's in drivers get_stats64 (bsc#1019351).\n - net: vrf: Create FIB tables on link create (bsc#1042286).\n - net: vrf: Fix crash when IPv6 is disabled at boot time (bsc#1042286).\n - net: vrf: Fix dev refcnt leak due to IPv6 prefix route (bsc#1042286).\n - net: vrf: Fix dst reference counting (bsc#1042286).\n - net: vrf: protect changes to private data with rcu (bsc#1042286).\n - net: vrf: Switch dst dev to loopback on device delete (bsc#1042286).\n - netvsc: add rcu_read locking to netvsc callback (fate#320485).\n - netxen_nic: set rcode to the return status from the call to\n netxen_issue_cmd (bsc#966339 FATE#320150).\n - net: xgene: avoid bogus maybe-uninitialized warning (bsc#1019351).\n - net: xgene: fix backward compatibility fix (bsc#1019351).\n - net/xgene: fix error handling during reset (bsc#1019351).\n - net: xgene: move xgene_cle_ptree_ewdn data off stack (bsc#1019351).\n - nfit: fail DSMs that return non-zero status by default (bsc#1023175).\n - nfsd4: minor NFSv2/v3 write decoding cleanup (bsc#1034670).\n - nfsd: check for oversized NFSv2/v3 arguments (bsc#1034670).\n - nfs: do not try to cross a mountpount when there isn't one there\n (bsc#1028041).\n - nfsd: stricter decoding of write-like NFSv2/v3 ops (bsc#1034670).\n - nfs: Fix an LOCK/OPEN race when unlinking an open file (git-fixes).\n - nfs: Fix "Do not increment lock sequence ID after NFS4ERR_MOVED"\n (git-fixes).\n - nfs: Fix inode corruption in nfs_prime_dcache() (git-fixes).\n - nfs: Fix missing pg_cleanup after nfs_pageio_cond_complete() (git-fixes).\n - nfs: Fix NFS4 nfs4_do_reclaim() might_sleep()/scheduling while atomic\n splats. Bug exists in all RT trees &gt;= v3.16, was spotted/fixed in\n v4.8-rt, but with no stable-rt backport. Pick it up.\n - nfs: flush out dirty data on file fput() (bsc#1021762).\n - nfs: Use GFP_NOIO for two allocations in writeback (git-fixes).\n - nfsv4.1: Fix Oopsable condition in server callback races (git-fixes).\n - nfsv4: fix a reference leak caused WARNING messages (git-fixes).\n - nfsv4: Fix the underestimation of delegation XDR space reservation\n (git-fixes).\n - nsfs: mark dentry with DCACHE_RCUACCESS (bsc#1012829).\n - nvdimm: kabi protect nd_cmd_out_size() (bsc#1023175).\n - nvme: apply DELAY_BEFORE_CHK_RDY quirk at probe time too (bsc#1020685).\n - nvme: Delete created IO queues on reset (bsc#1031717).\n - nvme: Do not suspend admin queue that wasn't created (bsc#1026505).\n - nvme: submit nvme_admin_activate_fw to admin queue (bsc#1044532).\n - nvme: Suspend all queues before deletion (bsc#1026505).\n - ocfs2/dlmglue: prepare tracking logic to avoid recursive cluster lock\n (bsc#1004003).\n - ocfs2: fix deadlock issue when taking inode lock at vfs entry points\n (bsc#1004003).\n - overlayfs: compat, fix incorrect dentry use in ovl_rename2 (bsc#1032400).\n - overlayfs: compat, use correct dentry to detect compat mode in\n ovl_compat_is_whiteout (bsc#1032400).\n - pci: Add devm_request_pci_bus_resources() (bsc#1019351).\n - pci/AER: include header file (bsc#964944,FATE#319965).\n - pci: generic: Fix pci_remap_iospace() failure path (bsc#1019630).\n - pci: hv: Fix wslot_to_devfn() to fix warnings on device removal\n (fate#320485, bug#1028217).\n - pci: hv: Use device serial number as PCI domain (fate#320485,\n bug#1028217).\n - pci: pciehp: Prioritize data-link event over presence detect\n (bsc#1031040,bsc#1037483).\n - pci: Reverse standard ACS vs device-specific ACS enabling (bsc#1030057).\n - pci: Work around Intel Sunrise Point PCH incorrect ACS capability\n (bsc#1030057).\n - pci: xgene: Add local struct device pointers (bsc#1019351).\n - pci: xgene: Add register accessors (bsc#1019351).\n - pci: xgene: Free bridge resource list on failure (bsc#1019351).\n - pci: xgene: Make explicitly non-modular (bsc#1019351).\n - pci: xgene: Pass struct xgene_pcie_port to setup functions (bsc#1019351).\n - pci: xgene: Remove unused platform data (bsc#1019351).\n - pci: xgene: Request host bridge window resources (bsc#1019351).\n - percpu: remove unused chunk_alloc parameter from pcpu_get_pages()\n (bnc#971975 VM -- git fixes).\n - perf/x86/intel/rapl: Make Knights Landings support functional\n (bsc#1042517).\n - perf/x86/intel/uncore: Remove SBOX support for Broadwell server\n (bsc#1035887).\n - perf: xgene: Remove bogus IS_ERR() check (bsc#1019351).\n - phy: qcom-usb-hs: Add depends on EXTCON (4.4.68 stable queue).\n - phy: xgene: rename "enum phy_mode" to "enum xgene_phy_mode"\n (bsc#1019351).\n - pid_ns: Sleep in TASK_INTERRUPTIBLE in zap_pid_ns_processes\n (bnc#1012985).\n - ping: implement proper locking (bsc#1031003).\n - pkcs#7: fix missing break on OID_sha224 case (bsc#1031717).\n - platform/x86: fujitsu-laptop: use brightness_set_blocking for\n LED-setting callbacks (bsc#1031717).\n - pm / QoS: Fix memory leak on resume_latency.notifiers (bsc#1043231).\n - pm / wakeirq: Enable dedicated wakeirq for suspend (bsc#1031717).\n - pm / wakeirq: Fix spurious wake-up events for dedicated wakeirqs\n (bsc#1031717).\n - pm / wakeirq: report a wakeup_event on dedicated wekup irq (bsc#1031717).\n - power: bq27xxx: fix register numbers of bq27500 (bsc#1031717).\n - powerpc/64: Fix flush_(d|i)cache_range() called from modules (bnc#863764\n fate#315275, LTC#103998).\n - powerpc: Blacklist GCC 5.4 6.1 and 6.2 (boo#1028895).\n - powerpc: Create a helper for getting the kernel toc value (FATE#322421).\n - powerpc/fadump: Fix the race in crash_fadump() (bsc#1022971).\n - powerpc/fadump: Reserve memory at an offset closer to bottom of RAM\n (bsc#1032141).\n - powerpc/fadump: Update fadump documentation (bsc#1032141).\n - powerpc/ftrace: Add Kconfig & Make glue for mprofile-kernel\n (FATE#322421).\n - powerpc/ftrace: Add support for -mprofile-kernel ftrace ABI\n (FATE#322421).\n - powerpc/ftrace: Use $(CC_FLAGS_FTRACE) when disabling ftrace\n (FATE#322421).\n - powerpc/ftrace: Use generic ftrace_modify_all_code() (FATE#322421).\n - powerpc: introduce TIF_KGR_IN_PROGRESS thread flag (FATE#322421).\n - powerpc/livepatch: Add livepatch header (FATE#322421).\n - powerpc/livepatch: Add live patching support on ppc64le (FATE#322421).\n - powerpc/livepatch: Add livepatch stack to struct thread_info\n (FATE#322421).\n - powerpc/module: Create a special stub for ftrace_caller() (FATE#322421).\n - powerpc/module: Mark module stubs with a magic value (FATE#322421).\n - powerpc/module: Only try to generate the ftrace_caller() stub once\n (FATE#322421).\n - powerpc/modules: Never restore r2 for a mprofile-kernel style mcount()\n call (FATE#322421).\n - powerpc/powernv: Fix opal_exit tracepoint opcode (4.4.68 stable queue).\n - power: reset: xgene-reboot: Unmap region obtained by of_iomap\n (bsc#1019351).\n - power: supply: bq24190_charger: Call power_supply_changed() for relevant\n component (4.4.68 stable queue).\n - power: supply: bq24190_charger: Call set_mode_host() on pm_resume()\n (4.4.68 stable queue).\n - power: supply: bq24190_charger: Do not read fault register outside\n irq_handle_thread() (4.4.68 stable queue).\n - power: supply: bq24190_charger: Fix irq trigger to IRQF_TRIGGER_FALLING\n (4.4.68 stable queue).\n - power: supply: bq24190_charger: Handle fault before status on interrupt\n (4.4.68 stable queue).\n - power: supply: bq24190_charger: Install irq_handler_thread() at end of\n probe() (4.4.68 stable queue).\n - printk: Switch to the sync mode when an emergency message is printed\n (bsc#1034995).\n - qeth: check not more than 16 SBALEs on the completion queue\n (bnc#1009718, LTC#148203).\n - quota: fill in Q_XGETQSTAT inode information for inactive quotas\n (bsc#1042356).\n - radix-tree: fix radix_tree_iter_retry() for tagged iterators\n (bsc#1012829).\n - raid1: a new I/O barrier implementation to remove resync window\n (bsc#998106,bsc#1020048,bsc#982783).\n - raid1: avoid unnecessary spin locks in I/O barrier code\n (bsc#998106,bsc#1020048,bsc#982783).\n - raid1: ignore discard error (bsc#1017164).\n - ravb: Fix use-after-free on `ifconfig eth0 down` (git-fixes).\n - rdma/iw_cxgb4: Add missing error codes for act open cmd (bsc#1026570).\n - rdma/iw_cxgb4: Low resource fixes for Completion queue (bsc#1026570).\n - rdma/iw_cxgb4: only read markers_enabled mod param once (bsc#1026570).\n - Refresh patches.suse/blk-timeout-no-round. Refresh\n patches.drivers/0041-block-add-ability-to-flag-write-back-caching-on-a-devi\n ce.patch Do not collide with QUEUE_FLAG_WC from upstream (bsc#1022547)\n - regulator: isl9305: fix array size (bsc#1031717).\n - reiserfs: fix race in prealloc discard (bsc#987576).\n - Revert "acpi, nfit, libnvdimm: fix interleave set cookie calculation\n (64-bit comparison)" (kabi).\n - Revert "btrfs: qgroup: Move half of the qgroup accounting time out of"\n (bsc#1017461 bsc#1033885).\n - Revert "btrfs: qgroup: Move half of the qgroup accounting time out of"\n This reverts commit f69c1d0f6254c73529a48fd2f87815d047ad7288.\n - Revert "give up on gcc ilog2() constant optimizations" (kabi).\n - Revert "KVM: nested VMX: disable perf cpuid reporting" (4.4.68 stable\n queue).\n - Revert "l2tp: take reference on sessions being dumped" (kabi).\n - Revert "mac80211: pass block ack session timeout to to driver" (kabi).\n - Revert "mac80211: RX BA support for sta max_rx_aggregation_subframes"\n (kabi).\n - Revert "net: introduce device min_header_len" (kabi).\n - Revert "net/mlx4_en: Avoid unregister_netdev at shutdown flow"\n (bsc#1028017).\n - Revert "nfit, libnvdimm: fix interleave set cookie calculation" (kabi).\n - Revert "RDMA/core: Fix incorrect structure packing for booleans" (kabi).\n - Revert "target: Fix NULL dereference during LUN lookup + active I/O\n shutdown" (kabi).\n - Revert "wlcore: Add RX_BA_WIN_SIZE_CHANGE_EVENT event" (kabi).\n - rpm/kernel-binary.spec.in: Fix installation of /etc/uefi/certs\n (bsc#1019594)\n - rpm/kernel-binary.spec: remove superfluous flags This should make build\n logs more readable and people adding more flags should have easier time\n finding a place to add them in the spec file.\n - rpm/kernel-spec-macros: Fix the check if there is no rebuild counter\n (bsc#1012060)\n - rpm/SLES-UEFI-SIGN-Certificate-2048.crt: Update the certificate\n (bsc#1035922)\n - rtc: cmos: avoid unused function warning (bsc#1022429).\n - rtc: cmos: Clear ACPI-driven alarms upon resume (bsc#1022429).\n - rtc: cmos: Do not enable interrupts in the middle of the interrupt\n handler (bsc#1022429).\n - rtc: cmos: Restore alarm after resume (bsc#1022429).\n - rtlwifi: rtl_usb: Fix missing entry in USB driver's private data\n (bsc#1026462).\n - rtnetlink: NUL-terminate IFLA_PHYS_PORT_NAME string (4.4.68 stable\n queue).\n - rtnl: reset calcit fptr in rtnl_unregister() (bsc#1042286).\n - s390/cpuinfo: show maximum thread id (bnc#1009718, LTC#148580).\n - s390/dasd: check if query host access feature is supported (bsc#1037871).\n - s390/kmsg: add missing kmsg descriptions (bnc#1025683, LTC#151573).\n - s390/mm: fix zone calculation in arch_add_memory() (bnc#1025683,\n LTC#152318).\n - s390/sysinfo: show partition extended name and UUID if available\n (bnc#1009718, LTC#150160).\n - s390/time: LPAR offset handling (bnc#1009718, LTC#146920).\n - s390/time: move PTFF definitions (bnc#1009718, LTC#146920).\n - sbp-target: Fix second argument of percpu_ida_alloc() (bsc#1032803).\n - sched: Allow hotplug notifiers to be setup early (bnc#1022476).\n - sched/core: Fix incorrect utilization accounting when switching to fair\n class (bnc#1022476).\n - sched/core: Fix set_user_nice() (bnc#1022476).\n - sched/core, x86/topology: Fix NUMA in package topology bug (bnc#1022476).\n - sched/cputime: Add steal time support to full dynticks CPU time\n accounting (bnc#1022476).\n - sched/cputime: Fix prev steal time accouting during CPU hotplug\n (bnc#1022476).\n - sched/deadline: Always calculate end of period on sched_yield()\n (bnc#1022476).\n - sched/deadline: Fix a bug in dl_overflow() (bnc#1022476).\n - sched/deadline: Fix lock pinning warning during CPU hotplug\n (bnc#1022476).\n - sched/deadline: Fix wrap-around in DL heap (bnc#1022476).\n - sched/fair: Avoid using decay_load_missed() with a negative value\n (bnc#1022476).\n - sched/fair: Fix fixed point arithmetic width for shares and effective\n load (bnc#1022476).\n - sched/fair: Fix load_above_capacity fixed point arithmetic width\n (bnc#1022476).\n - sched/fair: Fix min_vruntime tracking (bnc#1022476).\n - sched/fair: Fix the wrong throttled clock time for cfs_rq_clock_task()\n (bnc#1022476).\n - sched/fair: Improve PELT stuff some more (bnc#1022476).\n - sched/loadavg: Avoid loadavg spikes caused by delayed NO_HZ accounting\n (bsc#1018419).\n - sched: Make wake_up_nohz_cpu() handle CPUs going offline (bnc#1022476).\n - sched/rt: Fix PI handling vs. sched_setscheduler() (bnc#1022476).\n - sched/rt: Kick RT bandwidth timer immediately on start up (bnc#1022476).\n - sched/rt, sched/dl: Do not push if task's scheduling class was changed\n (bnc#1022476).\n - scsi: be2iscsi: Add FUNCTION_RESET during driver unload (bsc#1038458).\n - scsi: be2iscsi: Add IOCTL to check UER supported (bsc#1038458).\n - scsi: be2iscsi: Add TPE recovery feature (bsc#1038458).\n - scsi: be2iscsi: Add V1 of EPFW cleanup IOCTL (bsc#1038458).\n - scsi: be2iscsi: allocate enough memory in beiscsi_boot_get_sinfo()\n (bsc#1038458).\n - scsi: be2iscsi: Check all zeroes IP before issuing IOCTL (bsc#1038458).\n - scsi: be2iscsi: Fail the sessions immediately after TPE (bsc#1038458).\n - scsi: be2iscsi: Fix async PDU handling path (bsc#1038458).\n - scsi: be2iscsi: Fix bad WRB index error (bsc#1038458).\n - scsi: be2iscsi: Fix checks for HBA in error state (bsc#1038458).\n - scsi: be2iscsi: Fix gateway APIs to support IPv4 & IPv6 (bsc#1038458).\n - scsi: be2iscsi: Fix POST check and reset sequence (bsc#1038458).\n - scsi: be2iscsi: Fix queue and connection parameters (bsc#1038458).\n - scsi: be2iscsi: Fix release of DHCP IP in static mode (bsc#1038458).\n - scsi: be2iscsi: Fix to add timer for UE detection (bsc#1038458).\n - scsi: be2iscsi: Fix to make boot discovery non-blocking (bsc#1038458).\n - scsi: be2iscsi: Fix to use correct configuration values (bsc#1038458).\n - scsi: be2iscsi: Handle only NET_PARAM in iface_get_param (bsc#1038458).\n - scsi: be2iscsi: Move functions to right files (bsc#1038458).\n - scsi: be2iscsi: Move VLAN code to common iface_set_param (bsc#1038458).\n - scsi: be2iscsi: Reduce driver load/unload time (bsc#1038458).\n - scsi: be2iscsi: Remove alloc_mcc_tag & beiscsi_pci_soft_reset\n (bsc#1038458).\n - scsi: be2iscsi: Remove isr_lock and dead code (bsc#1038458).\n - scsi: be2iscsi: Rename iface get/set/create/destroy APIs (bsc#1038458).\n - scsi: be2iscsi: Replace _bh version for mcc_lock spinlock (bsc#1038458).\n - scsi: be2iscsi: Set and return right iface v4/v6 states (bsc#1038458).\n - scsi: be2iscsi: Update copyright information (bsc#1038458).\n - scsi: be2iscsi: Update iface handle before any set param (bsc#1038458).\n - scsi: be2iscsi: Update the driver version (bsc#1038458).\n - scsi: cxgb4i: libcxgbi: add missing module_put() (bsc#1018885).\n - scsi: cxgb4i: libcxgbi: cxgb4: add T6 iSCSI completion feature\n (bsc#1021424).\n - scsi: cxlflash: Remove the device cleanly in the system shutdown path\n (bsc#1028310, fate#321597, bsc#1034762). cherry-pick from SP3\n - scsi_dh_alua: do not call BUG_ON when updating port group (bsc#1028340).\n - scsi_dh_alua: Do not modify the interval value for retries (bsc#1012910).\n - scsi_dh_alua: Do not retry for unmapped device (bsc#1012910).\n - scsi: do not print 'reservation conflict' for TEST UNIT READY\n (bsc#1027054).\n - scsi_error: count medium access timeout only once per EH run\n (bsc#993832, bsc#1032345).\n - scsi: fnic: Correcting rport check location in fnic_queuecommand_lck\n (bsc#1035920).\n - scsi: ipr: do not set DID_PASSTHROUGH on CHECK CONDITION (bsc#1034419).\n - scsi: ipr: Driver version 2.6.4 (bsc#1031555, fate#321595).\n - scsi: ipr: Error path locking fixes (bsc#1031555, fate#321595).\n - scsi: ipr: Fix abort path race condition (bsc#1031555, fate#321595).\n - scsi: ipr: Fix missed EH wakeup (bsc#1031555, fate#321595).\n - scsi: ipr: Fix SATA EH hang (bsc#1031555, fate#321595).\n - scsi: ipr: Remove redundant initialization (bsc#1031555, fate#321595).\n - scsi: mac_scsi: Fix MAC_SCSI=m option when SCSI=m (4.4.68 stable queue).\n - scsi: scsi_dh_alua: Check scsi_device_get() return value (bsc#1040125).\n - scsi: scsi_dh_emc: return success in clariion_std_inquiry() (4.4.68\n stable queue).\n - scsi_transport_fc: do not call queue_work under lock (bsc#1013887).\n - scsi_transport_fc: fixup race condition in fc_rport_final_delete()\n (bsc#1013887).\n - scsi_transport_fc: return -EBUSY for deleted vport (bsc#1013887).\n - sctp: check af before verify address in sctp_addr_id2transport\n (git-fixes).\n - sd: always scan VPD pages if thin provisioning is enabled (bsc#1013792).\n - serial: 8250_omap: Fix probe and remove for PM runtime (4.4.68 stable\n queue).\n - series.conf cosmetic adjustment (missing rt version placeholders)\n - series.conf: remove silly comment\n - ses: Fix SAS device detection in enclosure (bsc#1016403).\n - sfc: reduce severity of PIO buffer alloc failures (bsc#1019168).\n - sfc: refactor debug-or-warnings printks (bsc#1019168).\n - softirq: Let ksoftirqd do its job (bsc#1019618).\n - staging: emxx_udc: remove incorrect __init annotations (4.4.68 stable\n queue).\n - staging: rtl8188eu: prevent an underflow in rtw_check_beacon_data()\n (bsc#1031717).\n - staging: wlan-ng: add missing byte order conversion (4.4.68 stable\n queue).\n - sunrpc: Allow xprt->ops->timer method to sleep (git-fixes).\n - sunrpc: ensure correct error is reported by xs_tcp_setup_socket()\n (git-fixes).\n - sunrpc: fix UDP memory accounting (git-fixes).\n - sunrpc: Silence WARN_ON when NFSv4.1 over RDMA is in use (git-fixes).\n - supported.conf: added drivers/net/ethernet/chelsio/libcxgb/libcxgb\n - supported.conf: Add tcp_westwood as supported module (fate#322432)\n - supported.conf: Bugzilla and FATE references for dcdbas and dell_rbu\n - sysfs: be careful of error returns from ops->show() (bsc#1028883).\n - taint/module: Clean up global and module taint flags handling\n (fate#313296).\n - target: add XCOPY target/segment desc sense codes (bsc#991273).\n - target: bounds check XCOPY segment descriptor list (bsc#991273).\n - target: bounds check XCOPY total descriptor list length (bsc#991273).\n - target: check for XCOPY parameter truncation (bsc#991273).\n - target: check XCOPY segment descriptor CSCD IDs (bsc#1017170).\n - target: return UNSUPPORTED TARGET/SEGMENT DESC TYPE CODE sense\n (bsc#991273).\n - target: simplify XCOPY wwn->se_dev lookup helper (bsc#991273).\n - target: support XCOPY requests without parameters (bsc#991273).\n - target: use XCOPY segment descriptor CSCD IDs (bsc#1017170).\n - target: use XCOPY TOO MANY TARGET DESCRIPTORS sense (bsc#991273).\n - tcp: account for ts offset only if tsecr not zero (bsc#1042286).\n - tcp: do not inherit fastopen_req from parent (4.4.68 stable queue).\n - tcp: do not underestimate skb->truesize in tcp_trim_head() (4.4.68\n stable queue).\n - tcp: fastopen: accept data/FIN present in SYNACK message (bsc#1042286).\n - tcp: fastopen: avoid negative sk_forward_alloc (bsc#1042286).\n - tcp: fastopen: call tcp_fin() if FIN present in SYNACK (bsc#1042286).\n - tcp: fastopen: fix rcv_wup initialization for TFO server on SYN/data\n (bsc#1042286).\n - tcp: fix wraparound issue in tcp_lp (4.4.68 stable queue).\n - thp: fix MADV_DONTNEED vs. numa balancing race (bnc#1027974).\n - thp: reduce indentation level in change_huge_pmd() (bnc#1027974).\n - tpm: Downgrade error level (bsc#1042535).\n - tpm: fix checks for policy digest existence in tpm2_seal_trusted()\n (bsc#1034048, Pending fixes 2017-04-10).\n - tpm: fix RC value check in tpm2_seal_trusted (bsc#1034048, Pending fixes\n 2017-04-10).\n - tpm: fix: set continueSession attribute for the unseal operation\n (bsc#1034048, Pending fixes 2017-04-10).\n - tracing/kprobes: Enforce kprobes teardown after testing (bnc#1012985).\n - udp: avoid ufo handling on IP payload compression packets (bsc#1042286).\n - udplite: call proper backlog handlers (bsc#1042286).\n - Update mainline reference in\n patches.drivers/drm-ast-Fix-memleaks-in-error-path-in-ast_fb_create.patch S\n ee (bsc#1028158) for the context in which this was discovered upstream.\n - Update metadata for serial fixes (bsc#1013001)\n - Update patches.fixes/xen-silence-efi-error-messge.patch (bnc#1039900).\n - Update patches.kernel.org/patch-4.4.47-48 (bnc#1012382 bnc#1022181). Add\n a bnc reference.\n - usb: chipidea: Handle extcon events properly (4.4.68 stable queue).\n - usb: chipidea: Only read/write OTGSC from one place (4.4.68 stable\n queue).\n - usb: host: ehci-exynos: Decrese node refcount on exynos_ehci_get_phy()\n error paths (4.4.68 stable queue).\n - usb: host: ohci-exynos: Decrese node refcount on exynos_ehci_get_phy()\n error paths (4.4.68 stable queue).\n - usb: musb: ux500: Fix NULL pointer dereference at system PM\n (bsc#1038033).\n - usb: serial: ark3116: fix open error handling (bnc#1038043).\n - usb: serial: ch341: add register and USB request definitions\n (bnc#1038043).\n - usb: serial: ch341: add support for parity, frame length, stop bits\n (bnc#1038043).\n - usb: serial: ch341: fix baud rate and line-control handling\n (bnc#1038043).\n - usb: serial: ch341: fix line settings after reset-resume (bnc#1038043).\n - usb: serial: ch341: fix modem-status handling (bnc#1038043).\n - usb: serial: ch341: reinitialize chip on reconfiguration (bnc#1038043).\n - usb: serial: digi_acceleport: fix incomplete rx sanity check (4.4.68\n stable queue).\n - usb: serial: fix compare_const_fl.cocci warnings (bnc#1038043).\n - usb: serial: ftdi_sio: fix latency-timer error handling (4.4.68 stable\n queue).\n - usb: serial: io_edgeport: fix descriptor error handling (4.4.68 stable\n queue).\n - usb: serial: io_edgeport: fix epic-descriptor handling (bnc#1038043).\n - usb: serial: keyspan_pda: fix receive sanity checks (4.4.68 stable\n queue).\n - usb: serial: mct_u232: fix modem-status error handling (4.4.68 stable\n queue).\n - usb: serial: quatech2: fix control-message error handling (bnc#1038043).\n - usb: serial: sierra: fix bogus alternate-setting assumption\n (bnc#1038043).\n - usb: serial: ssu100: fix control-message error handling (bnc#1038043).\n - usb: serial: ti_usb_3410_5052: fix control-message error handling\n (4.4.68 stable queue).\n - Use make --output-sync feature when available (bsc#1012422). The mesages\n in make output can interleave making it impossible to extract warnings\n reliably. Since version 4 GNU Make supports --output-sync flag that\n prints output of each sub-command atomically preventing this issue.\n Detect the flag and use it if available.\n - Use up spare in struct module for livepatch (FATE#322421).\n - vmxnet3: segCnt can be 1 for LRO packets (bsc#988065).\n - vrf: remove slave queue and private slave struct (bsc#1042286).\n - vsock: Detach QP check should filter out non matching QPs (bsc#1036752).\n - x86/apic/uv: Silence a shift wrapping warning (bsc#1023866).\n - x86/CPU/AMD: Fix Zen SMT topology (bsc#1027512).\n - x86/ioapic: Change prototype of acpi_ioapic_add() (bsc#1027153,\n bsc#1027616).\n - x86/ioapic: Fix incorrect pointers in ioapic_setup_resources()\n (bsc#1027153, bsc#1027616).\n - x86/ioapic: Fix IOAPIC failing to request resource (bsc#1027153,\n bsc#1027616).\n - x86/ioapic: fix kABI (hide added include) (bsc#1027153, bsc#1027616).\n - x86/ioapic: Fix lost IOAPIC resource after hot-removal and hotadd\n (bsc#1027153, bsc#1027616).\n - x86/ioapic: Fix setup_res() failing to get resource (bsc#1027153,\n bsc#1027616).\n - x86/ioapic: Ignore root bridges without a companion ACPI device\n (bsc#1027153, bsc#1027616).\n - x86/ioapic: Restore IO-APIC irq_chip retrigger callback (4.4.68 stable\n queue).\n - x86/ioapic: Simplify ioapic_setup_resources() (bsc#1027153, bsc#1027616).\n - x86/ioapic: Support hot-removal of IOAPICs present during boot\n (bsc#1027153, bsc#1027616).\n - x86/mce: Do not print MCEs when mcelog is active (bsc#1013994).\n - x86/MCE: Dump MCE to dmesg if no consumers (bsc#1013994).\n - x86/mce: Fix copy/paste error in exception table entries (fate#319858).\n - x86, mm: fix gup_pte_range() vs DAX mappings (bsc#1026405).\n - x86/mm/gup: Simplify get_user_pages() PTE bit handling (bsc#1026405).\n - x86/pci-calgary: Fix iommu_free() comparison of unsigned expression >= 0\n (4.4.68 stable queue).\n - x86/PCI: Mark Broadwell-EP Home Agent 1 as having non-compliant BARs\n (bsc#9048891).\n - x86/platform/intel/iosf_mbi: Add a mutex for P-Unit access (bsc#1011913).\n - x86/platform/intel/iosf_mbi: Add a PMIC bus access notifier\n (bsc#1011913).\n - x86/platform/intel-mid: Correct MSI IRQ line for watchdog device (4.4.68\n stable queue).\n - x86/platform: Remove warning message for duplicate NMI handlers\n (bsc#1029220).\n - x86/platform/UV: Add basic CPU NMI health check (bsc#1023866).\n - x86/platform/UV: Add Support for UV4 Hubless NMIs (bsc#1023866).\n - x86/platform/UV: Add Support for UV4 Hubless systems (bsc#1023866).\n - x86/platform/uv/BAU: Add generic function pointers (bsc#1035024).\n - x86/platform/uv/BAU: Add payload descriptor qualifier (bsc#1035024).\n - x86/platform/uv/BAU: Add status mmr location fields to bau_control\n (bsc#1035024).\n - x86/platform/uv/BAU: Add UV4-specific functions (bsc#1035024).\n - x86/platform/uv/BAU: Add uv_bau_version enumerated constants\n (bsc#1035024).\n - x86/platform/uv/BAU: Add wait_completion to bau_operations (bsc#1035024).\n - x86/platform/uv/BAU: Clean up and update printks (bsc#1035024).\n - x86/platform/uv/BAU: Cleanup bau_operations declaration and instances\n (bsc#1035024).\n - x86/platform/uv/BAU: Clean up pq_init() (bsc#1035024).\n - x86/platform/uv/BAU: Clean up vertical alignment (bsc#1035024).\n - x86/platform/uv/BAU: Convert uv_physnodeaddr() use to uv_gpa_to_offset()\n (bsc#1035024).\n - x86/platform/uv/BAU: Disable software timeout on UV4 hardware\n (bsc#1035024).\n - x86/platform/uv/BAU: Fix HUB errors by remove initial write to sw-ack\n register (bsc#1035024).\n - x86/platform/uv/BAU: Fix payload queue setup on UV4 hardware\n (bsc#1035024).\n - x86/platform/uv/BAU: Implement uv4_wait_completion with read_status\n (bsc#1035024).\n - x86/platform/uv/BAU: Populate ->uvhub_version with UV4 version\n information (bsc#1035024).\n - x86/platform/uv/BAU: Use generic function pointers (bsc#1035024).\n - x86/platform/UV: Clean up the NMI code to match current coding style\n (bsc#1023866).\n - x86/platform/UV: Clean up the UV APIC code (bsc#1023866).\n - x86/platform/UV: Ensure uv_system_init is called when necessary\n (bsc#1023866).\n - x86/platform/UV: Fix 2 socket config problem (bsc#1023866).\n - x86/platform/uv: Fix calculation of Global Physical Address\n (bsc#1031147).\n - x86/platform/UV: Fix panic with missing UVsystab support (bsc#1023866).\n - x86/platform/UV: Initialize PCH GPP_D_0 NMI Pin to be NMI source\n (bsc#1023866).\n - x86/platform/UV: Verify NMI action is valid, default is standard\n (bsc#1023866).\n - x86/ras/therm_throt: Do not log a fake MCE for thermal events\n (bsc#1028027).\n - xen: add sysfs node for guest type (bnc#1037840).\n - xen: adjust early dom0 p2m handling to xen hypervisor behavior\n (bnc#1031470).\n - xen-blkback: do not leak stack data via response ring (bsc#1042863\n XSA-216).\n - xen-blkfront: correct maximum segment accounting (bsc#1018263).\n - xen-blkfront: do not call talk_to_blkback when already connected to\n blkback.\n - xen/blkfront: Fix crash if backend does not follow the right states.\n - xen-blkfront: free resources if xlvbd_alloc_gendisk fails.\n - xen/mce: do not issue error message for failed /dev/mcelog registration\n (bnc#1036638).\n - xen/netback: set default upper limit of tx/rx queues to 8 (bnc#1019163).\n - xen/netfront: set default upper limit of tx/rx queues to 8 (bnc#1019163).\n - xen: Use machine addresses in /sys/kernel/vmcoreinfo when PV\n (bsc#1014136)\n - xfrm: Fix memory leak of aead algorithm name (bsc#1042286).\n - xfrm: Only add l3mdev oif to dst lookups (bsc#1042286).\n - xfs: add missing include dependencies to xfs_dir2.h (bsc#1042421).\n - xfs_dmapi: fix the debug compilation of xfs_dmapi (bsc#989056).\n - xfs: do not allow di_size with high bit set (bsc#1024234).\n - xfs: do not assert fail on non-async buffers on ioacct decrement\n (bsc#1041160).\n - xfs: do not take the IOLOCK exclusive for direct I/O page invalidation\n (bsc#1015609).\n - xfs: do not warn on buffers not being recovered due to LSN (bsc#1043598).\n - xfs: exclude never-released buffers from buftarg I/O accounting\n (bsc#1024508).\n - xfs: fix broken multi-fsb buffer logging (bsc#1024081).\n - xfs: fix buffer overflow dm_get_dirattrs/dm_get_dirattrs2 (bsc#989056).\n - xfs: fix eofblocks race with file extending async dio writes\n (bsc#1040929).\n - xfs: Fix missed holes in SEEK_HOLE implementation (bsc#1041168).\n - xfs: fix off-by-one on max nr_pages in xfs_find_get_desired_pgoff()\n (bsc#1041168).\n - xfs: fix up xfs_swap_extent_forks inline extent handling (bsc#1023888).\n - xfs: fix xfs_mode_to_ftype() prototype (bsc#1043598).\n - xfs: in _attrlist_by_handle, copy the cursor back to userspace\n (bsc#1041242).\n - xfs: log recovery tracepoints to track current lsn and buffer submission\n (bsc#1043598).\n - xfs: Make __xfs_xattr_put_listen preperly report errors (bsc#1041242).\n - xfs: only return -errno or success from attr ->put_listent (bsc#1041242).\n - xfs: pass current lsn to log recovery buffer validation (bsc#1043598).\n - xfs: refactor log record unpack and data processing (bsc#1043598).\n - xfs: replace xfs_mode_to_ftype table with switch statement (bsc#1042421).\n - xfs: rework log recovery to submit buffers on LSN boundaries\n (bsc#1043598).\n - xfs: rework the inline directory verifiers (bsc#1042421).\n - xfs: sanity check directory inode di_size (bsc#1042421).\n - xfs: sanity check inode di_mode (bsc#1042421).\n - xfs: Split default quota limits by quota type (bsc#1040941).\n - xfs: track and serialize in-flight async buffers against unmount\n (bsc#1024508).\n - xfs: track and serialize in-flight async buffers against unmount - kABI\n (bsc#1024508).\n - xfs: update metadata LSN in buffers during log recovery (bsc#1043598).\n - xfs: use ->b_state to fix buffer I/O accounting release race\n (bsc#1041160).\n - xfs: verify inline directory data forks (bsc#1042421).\n - xgene_enet: remove bogus forward declarations (bsc#1032673).\n - zswap: do not param_set_charp while holding spinlock (VM Functionality,\n bsc#1042886).\n - blacklist.conf: add non-applicable fixes for iwlwifi (FATE#323335)\n - blacklist.conf: blacklist c34a69059d78 (bnc#1044880)\n - btrfs: disable possible cause of premature ENOSPC (bsc#1040182)\n - btrfs: Manually implement device_total_bytes getter/setter\n (bsc#1043912).\n - btrfs: Round down values which are written for total_bytes_size\n (bsc#1043912).\n - dm: remove dummy dm_table definition (bsc#1045307)\n - Fix soft lockup in svc_rdma_send (bsc#1044854).\n - fs/exec.c: account for argv/envp pointers (bnc#1039354,\n CVE-2017-1000365).\n - hpsa: limit transfer length to 1MB (bsc#1025461).\n - hwpoison, memcg: forcibly uncharge LRU pages (bnc#1046105).\n - IB/ipoib: Fix memory leak in create child syscall (bsc#1022595\n FATE#322350).\n - ibmvnic: Correct return code checking for ibmvnic_init during probe\n (bsc#1045286).\n - ibmvnic: Fix assignment of RX/TX IRQ's (bsc#1046589).\n - ibmvnic: Fix error handling when registering long-term-mapped buffers\n (bsc#1045568).\n - ibmvnic: Fix incorrectly defined ibmvnic_request_map_rsp structure\n (bsc#1045568).\n - ibmvnic: Remove module author mailing address (bsc#1045467).\n - ibmvnic: Return from ibmvnic_resume if not in VNIC_OPEN state\n (bsc#1045235).\n - iw_cxgb4: Fix error return code in c4iw_rdev_open() (bsc#1026570).\n - iwlwifi: 8000: fix MODULE_FIRMWARE input.\n - iwlwifi: 9000: increase the number of queues.\n - iwlwifi: add device ID for 8265.\n - iwlwifi: add device IDs for the 8265 device.\n - iwlwifi: add disable_11ac module param.\n - iwlwifi: add new 3168 series devices support.\n - iwlwifi: add new 8260 PCI IDs.\n - iwlwifi: add new 8265.\n - iwlwifi: add new 8265 series PCI ID.\n - iwlwifi: Add new PCI IDs for 9260 and 5165 series.\n - iwlwifi: Add PCI IDs for the new 3168 series.\n - iwlwifi: Add PCI IDs for the new series 8165.\n - iwlwifi: add support for 12K Receive Buffers.\n - iwlwifi: add support for getting HW address from CSR.\n - iwlwifi: avoid d0i3 commands when no/init ucode is loaded.\n - iwlwifi: bail out in case of bad trans state.\n - iwlwifi: block the queues when we send ADD_STA for uAPSD.\n - iwlwifi: change the Intel Wireless email address.\n - iwlwifi: check for valid ethernet address provided by OEM.\n - iwlwifi: clean up transport debugfs handling.\n - iwlwifi: clear ieee80211_tx_info->driver_data in the op_mode.\n - iwlwifi: Document missing module options.\n - iwlwifi: dump prph registers in a common place for all transports.\n - iwlwifi: dvm: advertise NETIF_F_SG.\n - iwlwifi: dvm: fix compare_const_fl.cocci warnings.\n - iwlwifi: dvm: handle zero brightness for wifi LED.\n - iwlwifi: dvm: remove a wrong dependency on m.\n - iwlwifi: dvm: remove Kconfig default.\n - iwlwifi: dvm: remove stray debug code.\n - iwlwifi: export the _no_grab version of PRPH IO functions.\n - iwlwifi: expose fw usniffer mode to more utilities.\n - iwlwifi: fix double hyphen in MODULE_FIRMWARE for 8000.\n - iwlwifi: Fix firmware name maximum length definition.\n - iwlwifi: fix name of ucode loaded for 8265 series.\n - iwlwifi: fix printf specifier.\n - iwlwifi: generalize d0i3_entry_timeout module parameter.\n - iwlwifi: mvm: adapt the firmware assert log to new firmware.\n - iwlwifi: mvm: add 9000-series RX API.\n - iwlwifi: mvm: add 9000 series RX processing.\n - iwlwifi: mvm: add a non-trigger window to fw dbg triggers.\n - iwlwifi: mvm: add an option to start rs from HT/VHT rates.\n - iwlwifi: mvm: Add a station in monitor mode.\n - iwlwifi: mvm: add bt rrc and ttc to debugfs.\n - iwlwifi: mvm: add bt settings to debugfs.\n - iwlwifi: mvm: add ctdp operations to debugfs.\n - iwlwifi: mvm: add CT-KILL notification.\n - iwlwifi: mvm: add debug print if scan config is ignored.\n - iwlwifi: mvm: add extended dwell time.\n - iwlwifi: mvm: add new ADD_STA command version.\n - iwlwifi: mvm: Add P2P client snoozing.\n - iwlwifi: mvm: add registration to cooling device.\n - iwlwifi: mvm: add registration to thermal zone.\n - iwlwifi: mvm: add support for negative temperatures.\n - iwlwifi: mvm: add tlv for multi queue rx support.\n - iwlwifi: mvm: add trigger for firmware dump upon TDLS events.\n - iwlwifi: mvm: add trigger for firmware dump upon TX response status.\n - iwlwifi: mvm: advertise NETIF_F_SG.\n - iwlwifi: mvm: Align bt-coex priority with requirements.\n - iwlwifi: mvm: allow to disable beacon filtering for AP/GO interface.\n - iwlwifi: mvm: avoid harmless -Wmaybe-uninialized warning.\n - iwlwifi: mvm: avoid panics with thermal device usage.\n - iwlwifi: mvm: avoid to WARN about gscan capabilities.\n - iwlwifi: mvm: bail out if CTDP start operation fails.\n - iwlwifi: mvm: bump firmware API to 21.\n - iwlwifi: mvm: bump max API to 20.\n - iwlwifi: mvm: change access to ieee80211_hdr.\n - iwlwifi: mvm: change iwl_mvm_get_key_sta_id() to return the station.\n - iwlwifi: mvm: change mcc update API.\n - iwlwifi: mvm: change name of iwl_mvm_d3_update_gtk.\n - iwlwifi: mvm: Change number of associated stations when station becomes\n associated.\n - iwlwifi: mvm: change protocol offload flows.\n - iwlwifi: mvm: change the check for ADD_STA status.\n - iwlwifi: mvm: check FW's response for nvm access write cmd.\n - iwlwifi: mvm: check iwl_mvm_wowlan_config_key_params() return value.\n - iwlwifi: mvm: check minimum temperature notification length.\n - iwlwifi: mvm: cleanup roc te on restart cleanup.\n - iwlwifi: mvm: Configure fragmented scan for scheduled scan.\n - iwlwifi: mvm: configure scheduled scan according to traffic conditions.\n - iwlwifi: mvm: constify the parameters of a few functions in fw-dbg.c.\n - iwlwifi: mvm: Disable beacon storing in D3 when WOWLAN configured.\n - iwlwifi: mvm: disable DQA support.\n - iwlwifi: mvm: Do not switch to D3 image on suspend.\n - iwlwifi: mvm: don't ask beacons when P2P GO vif and no assoc sta.\n - iwlwifi: mvm: don't keep an mvm ref when the interface is down.\n - iwlwifi: mvm: don't let NDPs mess the packet tracking.\n - iwlwifi: mvm: don't restart HW if suspend fails with unified image.\n - iwlwifi: mvm: don't try to offload AES-CMAC in AP/IBSS modes.\n - iwlwifi: mvm: drop low_latency_agg_frame_cnt_limit.\n - iwlwifi: mvm: dump more registers upon error.\n - iwlwifi: mvm: dump the radio registers when the firmware crashes.\n - iwlwifi: mvm: enable L3 filtering.\n - iwlwifi: mvm: Enable MPLUT only on supported hw.\n - iwlwifi: mvm: enable VHT MU-MIMO for supported hardware.\n - iwlwifi: mvm: extend time event duration.\n - iwlwifi: mvm: fix accessing Null pointer during fw dump collection.\n - iwlwifi: mvm: fix d3_test with unified D0/D3 images.\n - iwlwifi: mvm: fix debugfs signedness warning.\n - iwlwifi: mvm: fix extended dwell time.\n - iwlwifi: mvm: fix incorrect fallthrough in iwl_mvm_check_running_scans().\n - iwlwifi: mvm: fix memory leaks in error paths upon fw error dump.\n - iwlwifi: mvm: fix netdetect starting/stopping for unified images.\n - iwlwifi: mvm: fix RSS key sizing.\n - iwlwifi: mvm: fix unregistration of thermal in some error flows.\n - iwlwifi: mvm: flush all used TX queues before suspending.\n - iwlwifi: mvm: forbid U-APSD for P2P Client if the firmware doesn't\n support it.\n - iwlwifi: mvm: handle pass all scan reporting.\n - iwlwifi: mvm: ignore LMAC scan notifications when running UMAC scans.\n - iwlwifi: mvm: infrastructure for frame-release message.\n - iwlwifi: mvm: kill iwl_mvm_enable_agg_txq.\n - iwlwifi: mvm: let the firmware choose the antenna for beacons.\n - iwlwifi: mvm: make collecting fw debug data optional.\n - iwlwifi: mvm: move fw-dbg code to separate file.\n - iwlwifi: mvm: only release the trans ref if d0i3 is supported in fw.\n - iwlwifi: mvm: prepare the code towards TSO implementation.\n - iwlwifi: mvm: refactor d3 key update functions.\n - iwlwifi: mvm: refactor the way fw_key_table is handled.\n - iwlwifi: mvm: remove an extra tab.\n - iwlwifi: mvm: Remove bf_vif from iwl_power_vifs.\n - iwlwifi: mvm: Remove iwl_mvm_update_beacon_abort.\n - iwlwifi: mvm: remove redundant d0i3 flag from the config struct.\n - iwlwifi: mvm: remove shadowing variable.\n - iwlwifi: mvm: remove stray nd_config element.\n - iwlwifi: mvm: remove the vif parameter of\n iwl_mvm_configure_bcast_filter().\n - iwlwifi: mvm: remove unnecessary check in iwl_mvm_is_d0i3_supported().\n - iwlwifi: mvm: remove useless WARN_ON and rely on cfg80211's combination.\n - iwlwifi: mvm: report wakeup for wowlan.\n - iwlwifi: mvm: reset mvm->scan_type when firmware is started.\n - iwlwifi: mvm: return the cooling state index instead of the budget.\n - iwlwifi: mvm: ROC: cleanup time event info on FW failure.\n - iwlwifi: mvm: ROC: Extend the ROC max delay duration & limit ROC\n duration.\n - iwlwifi: mvm: rs: fix a potential out of bounds access.\n - iwlwifi: mvm: rs: fix a theoretical access to uninitialized array\n elements.\n - iwlwifi: mvm: rs: fix a warning message.\n - iwlwifi: mvm: rs: fix TPC action decision algorithm.\n - iwlwifi: mvm: rs: fix TPC statistics handling.\n - iwlwifi: mvm: Send power command on BSS_CHANGED_BEACON_INFO if needed.\n - iwlwifi: mvm: set default new STA as non-aggregated.\n - iwlwifi: mvm: set the correct amsdu enum values.\n - iwlwifi: mvm: set the correct descriptor size for tracing.\n - iwlwifi: mvm: small update in the firmware API.\n - iwlwifi: mvm: support A-MSDU in A-MPDU.\n - iwlwifi: mvm: support beacon storing.\n - iwlwifi: mvm: support description for user triggered fw dbg collection.\n - iwlwifi: mvm: support rss queues configuration command.\n - iwlwifi: mvm: Support setting continuous recording debug mode.\n - iwlwifi: mvm: support setting minimum quota from debugfs.\n - iwlwifi: mvm: support sw queue start/stop from mvm.\n - iwlwifi: mvm: take care of padded packets.\n - iwlwifi: mvm: take the transport ref back when leaving.\n - iwlwifi: mvm: track low-latency sources separately.\n - iwlwifi: mvm: update GSCAN capabilities.\n - iwlwifi: mvm: update ucode status before stopping device.\n - iwlwifi: mvm: use build-time assertion for fw trigger ID.\n - iwlwifi: mvm: use firmware station lookup, combine code.\n - iwlwifi: mvm: various trivial cleanups.\n - iwlwifi: mvm: writing zero bytes to debugfs causes a crash.\n - iwlwifi: nvm: fix loading default NVM file.\n - iwlwifi: nvm: fix up phy section when reading it.\n - iwlwifi: pcie: add 9000 series multi queue rx DMA support.\n - iwlwifi: pcie: add infrastructure for multi-queue rx.\n - iwlwifi: pcie: add initial RTPM support for PCI.\n - iwlwifi: pcie: Add new configuration to enable MSIX.\n - iwlwifi: pcie: add pm_prepare and pm_complete ops.\n - iwlwifi: pcie: add RTPM support when wifi is enabled.\n - iwlwifi: pcie: aggregate Flow Handler configuration writes.\n - iwlwifi: pcie: allow the op_mode to block the tx queues.\n - iwlwifi: pcie: allow to pretend to have Tx CSUM for debug.\n - iwlwifi: pcie: avoid restocks inside rx loop if not emergency.\n - iwlwifi: pcie: buffer packets to avoid overflowing Tx queues.\n - iwlwifi: pcie: build an A-MSDU using TSO core.\n - iwlwifi: pcie: configure more RFH settings.\n - iwlwifi: pcie: detect and workaround invalid write ptr behavior.\n - iwlwifi: pcie: don't increment / decrement a bool.\n - iwlwifi: pcie: enable interrupts before releasing the NIC's CPU.\n - iwlwifi: pcie: enable multi-queue rx path.\n - iwlwifi: pcie: extend device reset delay.\n - iwlwifi: pcie: fine tune number of rxbs.\n - iwlwifi: pcie: fix a race in firmware loading flow.\n - iwlwifi: pcie: fix erroneous return value.\n - iwlwifi: pcie: fix global table size.\n - iwlwifi: pcie: fix identation in trans.c.\n - iwlwifi: pcie: fix RF-Kill vs. firmware load race.\n - iwlwifi: pcie: forbid RTPM on device removal.\n - iwlwifi: pcie: mark command queue lock with separate lockdep class.\n - iwlwifi: pcie: prevent skbs shadowing in iwl_trans_pcie_reclaim.\n - iwlwifi: pcie: refactor RXBs reclaiming code.\n - iwlwifi: pcie: remove ICT allocation message.\n - iwlwifi: pcie: remove pointer from debug message.\n - iwlwifi: pcie: re-organize code towards TSO.\n - iwlwifi: pcie: set RB chunk size back to 64.\n - iwlwifi: pcie: update iwl_mpdu_desc fields.\n - iwlwifi: print index in api/capa flags parsing message.\n - iwlwifi: refactor the code that reads the MAC address from the NVM.\n - iwlwifi: remove IWL_DL_LED.\n - iwlwifi: remove unused parameter from grab_nic_access.\n - iwlwifi: replace d0i3_mode and wowlan_d0i3 with more generic variables.\n - iwlwifi: set max firmware version of 7265 to 17.\n - iwlwifi: support ucode with d0 unified image - regular and usniffer.\n - iwlwifi: trans: make various conversion macros inlines.\n - iwlwifi: trans: support a callback for ASYNC commands.\n - iwlwifi: treat iwl_parse_nvm_data() MAC addr as little endian.\n - iwlwifi: tt: move ucode_loaded check under mutex.\n - iwlwifi: uninline iwl_trans_send_cmd.\n - iwlwifi: update host command messages to new format.\n - iwlwifi: Update PCI IDs for 8000 and 9000 series.\n - iwlwifi: update support for 3168 series firmware and NVM.\n - iwlwifi: various comments and code cleanups.\n - kabi: ignore fs_info parameter for tracepoints that didn't have it\n (bsc#1044912).\n - kabi/severities: ignore kABi changes in iwlwifi stuff itself\n - lan78xx: use skb_cow_head() to deal with cloned skbs (bsc#1045154).\n - Linux 4.4.74 (CVE-2017-1000364 bnc#1012382 bnc#1039348 bnc#1045340\n bsc#1031717 bsc#1043231).\n - loop: Add PF_LESS_THROTTLE to block/loop device thread (bsc#1027101).\n - md: fix a null dereference (bsc#1040351).\n - md: use a separate bio_set for synchronous IO (bsc#1040351).\n - mm: fix new crash in unmapped_area_topdown() (bnc#1039348).\n - mm: larger stack guard gap, between vmas (bnc#1039348, CVE-2017-1000364,\n bnc#1045340).\n - net/mlx5e: Fix timestamping capabilities reporting (bsc#966170\n bsc#1015342).\n - NFSv4: don't let hanging mounts block other mounts (bsc#1040364).\n - powerpc/fadump: add reschedule point while releasing memory\n (bsc#1040609).\n - powerpc/fadump: avoid duplicates in crash memory ranges (bsc#1037669).\n - powerpc/fadump: avoid holes in boot memory area when fadump is\n registered (bsc#1037669).\n - powerpc/fadump: provide a helpful error message (bsc#1037669).\n - powerpc/fadump: return error when fadump registration fails\n (bsc#1040567).\n - powerpc/ftrace: Pass the correct stack pointer for\n DYNAMIC_FTRACE_WITH_REGS (FATE#322421).\n - printk: Correctly handle preemption in console_unlock() (bsc#1046434).\n - printk/xen: Force printk sync mode when migrating Xen guest\n (bsc#1043347).\n - RDMA/iw_cxgb4: Always wake up waiter in c4iw_peer_abort_intr()\n (bsc#1026570).\n - Reenable and refresh\n patches.suse/iwlwifi-expose-default-fallback-ucode-api.\n - reiserfs: don't preallocate blocks for extended attributes (bsc#990682).\n - smartpqi: limit transfer length to 1MB (bsc#1025461).\n - tty: Destroy ldisc instance on hangup (bnc#1043488).\n - tty: Fix ldisc crash on reopened tty (bnc#1043488).\n - tty: Handle NULL tty->ldisc (bnc#1043488).\n - tty: Move tty_ldisc_kill() (bnc#1043488).\n - tty: Prepare for destroying line discipline on hangup (bnc#1043488).\n - tty: Refactor tty_ldisc_reinit() for reuse (bnc#1043488).\n - tty: Reset c_line from driver's init_termios (bnc#1043488).\n - tty: Simplify tty_set_ldisc() exit handling (bnc#1043488).\n - tty: Use 'disc' for line discipline index name (bnc#1043488).\n - Update config files: add CONFIG_IWLWIFI_PCIE_RTPM=y (FATE#323335)\n - Update patches.fixes/xfs-split-default-quota-limits-by-quota-type.patch\n (bsc#1040941). Fix the bug nr used.\n\n", "cvss3": {}, "published": "2017-07-28T15:10:24", "type": "suse", "title": "Security update for the Linux Kernel (important)", "bulletinFamily": "unix", "cvss2": {}, "cvelist": ["CVE-2017-5576", "CVE-2016-7097", "CVE-2016-9191", "CVE-2017-7261", "CVE-2017-7184", "CVE-2017-2584", "CVE-2017-1000380", "CVE-2017-6074", "CVE-2016-7117", "CVE-2017-7616", "CVE-2017-5577", "CVE-2017-9074", "CVE-2017-7346", "CVE-2017-7618", "CVE-2017-9242", "CVE-2017-5970", "CVE-2016-10200", "CVE-2017-2636", "CVE-2017-5551", "CVE-2017-2671", "CVE-2017-9075", "CVE-2017-7294", "CVE-2017-2583", "CVE-2017-6214", "CVE-2017-7374", "CVE-2017-9150", "CVE-2017-1000364", "CVE-2016-4997", "CVE-2017-7308", "CVE-2017-6345", "CVE-2017-5986", "CVE-2017-6346", "CVE-2017-2596", "CVE-2017-6353", "CVE-2017-7487", "CVE-2017-9076", "CVE-2017-7187", "CVE-2017-9077", "CVE-2016-2117", "CVE-2017-1000365", "CVE-2017-8890", "CVE-2016-4998", "CVE-2017-6347", "CVE-2017-5897"], "modified": "2017-07-28T15:10:24", "id": "SUSE-SU-2017:1990-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2017-07/msg00054.html", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-05-15T21:20:15", "description": "This update for the Linux Kernel 3.12.67-60_64_24 fixes several issues.\n\n The following security bugs were fixed:\n\n - CVE-2017-7308: The packet_set_ring function in net/packet/af_packet.c in\n the Linux kernel did not properly validate certain block-size data,\n which allowed local users to cause a denial of service (overflow) or\n possibly have unspecified other impact via crafted system calls\n (bsc#1031660).\n - CVE-2017-7294: The vmw_surface_define_ioctl function in\n drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not\n validate addition of certain levels data, which allowed local users to\n trigger an integer overflow and out-of-bounds write, and cause a denial\n of service (system hang or crash) or possibly gain privileges, via a\n crafted ioctl call for a /dev/dri/renderD* device (bsc#1031440,\n bsc#1031481).\n\n", "cvss3": {}, "published": "2017-05-15T21:23:12", "type": "suse", "title": "Security update for Linux Kernel Live Patch 11 for SLE 12 SP1 (important)", "bulletinFamily": "unix", "cvss2": {}, "cvelist": ["CVE-2017-7294", "CVE-2017-7308"], "modified": "2017-05-15T21:23:12", "id": "SUSE-SU-2017:1290-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00034.html", "cvss": {"score": 7.2, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-05-15T21:20:15", "description": "This update for the Linux Kernel 3.12.67-60_64_18 fixes several issues.\n\n The following security bugs were fixed:\n\n - CVE-2017-7308: The packet_set_ring function in net/packet/af_packet.c in\n the Linux kernel did not properly validate certain block-size data,\n which allowed local users to cause a denial of service (overflow) or\n possibly have unspecified other impact via crafted system calls\n (bsc#1030575, bsc#1031660).\n - CVE-2017-7294: The vmw_surface_define_ioctl function in\n drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not\n validate addition of certain levels data, which allowed local users to\n trigger an integer overflow and out-of-bounds write, and cause a denial\n of service (system hang or crash) or possibly gain privileges, via a\n crafted ioctl call for a /dev/dri/renderD* device (bsc#1031440,\n bsc#1031481).\n\n", "cvss3": {}, "published": "2017-05-15T21:30:42", "type": "suse", "title": "Security update for Linux Kernel Live Patch 9 for SLE 12 SP1 (important)", "bulletinFamily": "unix", "cvss2": {}, "cvelist": ["CVE-2017-7294", "CVE-2017-7308"], "modified": "2017-05-15T21:30:42", "id": "SUSE-SU-2017:1297-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00044.html", "cvss": {"score": 7.2, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-05-15T21:20:15", "description": "This update for the Linux Kernel 3.12.59-60_45 fixes several issues.\n\n The following security bugs were fixed:\n\n - CVE-2017-7308: The packet_set_ring function in net/packet/af_packet.c in\n the Linux kernel did not properly validate certain block-size data,\n which allowed local users to cause a denial of service (overflow) or\n possibly have unspecified other impact via crafted system calls\n (bsc#1030575, bsc#1031660).\n - CVE-2017-7294: The vmw_surface_define_ioctl function in\n drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not\n validate addition of certain levels data, which allowed local users to\n trigger an integer overflow and out-of-bounds write, and cause a denial\n of service (system hang or crash) or possibly gain privileges, via a\n crafted ioctl call for a /dev/dri/renderD* device (bsc#1031440,\n bsc#1031481).\n - bsc#1030467: Updated Dirty COW fix. The former patch caused some apps to\n freeze in rare circumstances\n\n", "cvss3": {}, "published": "2017-05-15T21:25:50", "type": "suse", "title": "Security update for Linux Kernel Live Patch 6 for SLE 12 SP1 (important)", "bulletinFamily": "unix", "cvss2": {}, "cvelist": ["CVE-2017-7294", "CVE-2017-7308"], "modified": "2017-05-15T21:25:50", "id": "SUSE-SU-2017:1293-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00038.html", "cvss": {"score": 7.2, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-05-15T19:20:15", "description": "This update for the Linux Kernel 4.4.21-81 fixes several issues.\n\n The following security bugs were fixed:\n\n - CVE-2017-7308: The packet_set_ring function in net/packet/af_packet.c in\n the Linux kernel did not properly validate certain block-size data,\n which allowed local users to cause a denial of service (overflow) or\n possibly have unspecified other impact via crafted system calls\n (bsc#1030575, bsc#1031660).\n - CVE-2017-7294: The vmw_surface_define_ioctl function in\n drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not\n validate addition of certain levels data, which allowed local users to\n trigger an integer overflow and out-of-bounds write, and cause a denial\n of service (system hang or crash) or possibly gain privileges, via a\n crafted ioctl call for a /dev/dri/renderD* device (bsc#1031440,\n bsc#1031481).\n\n", "cvss3": {}, "published": "2017-05-15T21:11:29", "type": "suse", "title": "Security update for Linux Kernel Live Patch 1 for SLE 12 SP2 (important)", "bulletinFamily": "unix", "cvss2": {}, "cvelist": ["CVE-2017-7294", "CVE-2017-7308"], "modified": "2017-05-15T21:11:29", "id": "SUSE-SU-2017:1279-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00030.html", "cvss": {"score": 7.2, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-05-15T21:20:15", "description": "This update for the Linux Kernel 4.4.38-93 fixes several issues.\n\n The following security bugs were fixed:\n\n - CVE-2017-7308: The packet_set_ring function in net/packet/af_packet.c in\n the Linux kernel did not properly validate certain block-size data,\n which allowed local users to cause a denial of service (overflow) or\n possibly have unspecified other impact via crafted system calls\n (bsc#1030575, bsc#1031660).\n - CVE-2017-7294: The vmw_surface_define_ioctl function in\n drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not\n validate addition of certain levels data, which allowed local users to\n trigger an integer overflow and out-of-bounds write, and cause a denial\n of service (system hang or crash) or possibly gain privileges, via a\n crafted ioctl call for a /dev/dri/renderD* device (bsc#1031440,\n bsc#1031481).\n\n", "cvss3": {}, "published": "2017-05-15T21:27:50", "type": "suse", "title": "Security update for Linux Kernel Live Patch 4 for SLE 12 SP2 (important)", "bulletinFamily": "unix", "cvss2": {}, "cvelist": ["CVE-2017-7294", "CVE-2017-7308"], "modified": "2017-05-15T21:27:50", "id": "SUSE-SU-2017:1295-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00036.html", "cvss": {"score": 7.2, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-05-15T19:20:15", "description": "This update for the Linux Kernel 4.4.49-92_11 fixes several issues.\n\n The following security bugs were fixed:\n\n - CVE-2017-7308: The packet_set_ring function in net/packet/af_packet.c in\n the Linux kernel did not properly validate certain block-size data,\n which allowed local users to cause a denial of service (overflow) or\n possibly have unspecified other impact via crafted system calls\n (bsc#1030575, bsc#1031660).\n - CVE-2017-7294: The vmw_surface_define_ioctl function in\n drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not\n validate addition of certain levels data, which allowed local users to\n trigger an integer overflow and out-of-bounds write, and cause a denial\n of service (system hang or crash) or possibly gain privileges, via a\n crafted ioctl call for a /dev/dri/renderD* device (bsc#1031440,\n bsc#1031481).\n\n", "cvss3": {}, "published": "2017-05-15T21:15:10", "type": "suse", "title": "Security update for Linux Kernel Live Patch 5 for SLE 12 SP2 (important)", "bulletinFamily": "unix", "cvss2": {}, "cvelist": ["CVE-2017-7294", "CVE-2017-7308"], "modified": "2017-05-15T21:15:10", "id": "SUSE-SU-2017:1283-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00032.html", "cvss": {"score": 7.2, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-05-15T23:20:15", "description": "This update for the Linux Kernel 4.4.21-69 fixes several issues.\n\n The following security bugs were fixed:\n\n - CVE-2017-7308: The packet_set_ring function in net/packet/af_packet.c in\n the Linux kernel did not properly validate certain block-size data,\n which allowed local users to cause a denial of service (overflow) or\n possibly have unspecified other impact via crafted system calls\n (bsc#1030575, bsc#1031660).\n - CVE-2017-7294: The vmw_surface_define_ioctl function in\n drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not\n validate addition of certain levels data, which allowed local users to\n trigger an integer overflow and out-of-bounds write, and cause a denial\n of service (system hang or crash) or possibly gain privileges, via a\n crafted ioctl call for a /dev/dri/renderD* device (bsc#1031440,\n bsc#1031481).\n\n", "cvss3": {}, "published": "2017-05-16T00:08:57", "type": "suse", "title": "Security update for Linux Kernel Live Patch 0 for SLE 12 SP2 (important)", "bulletinFamily": "unix", "cvss2": {}, "cvelist": ["CVE-2017-7294", "CVE-2017-7308"], "modified": "2017-05-16T00:08:57", "id": "SUSE-SU-2017:1303-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00046.html", "cvss": {"score": 7.2, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-05-15T21:20:15", "description": "This update for the Linux Kernel 3.12.69-60_64_29 fixes several issues.\n\n The following security bugs were fixed:\n\n - CVE-2017-7308: The packet_set_ring function in net/packet/af_packet.c in\n the Linux kernel did not properly validate certain block-size data,\n which allowed local users to cause a denial of service (overflow) or\n possibly have unspecified other impact via crafted system calls\n (bsc#1031660).\n - CVE-2017-7294: The vmw_surface_define_ioctl function in\n drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not\n validate addition of certain levels data, which allowed local users to\n trigger an integer overflow and out-of-bounds write, and cause a denial\n of service (system hang or crash) or possibly gain privileges, via a\n crafted ioctl call for a /dev/dri/renderD* device (bsc#1031440,\n bsc#1031481).\n\n", "cvss3": {}, "published": "2017-05-15T21:26:51", "type": "suse", "title": "Security update for Linux Kernel Live Patch 12 for SLE 12 SP1 (important)", "bulletinFamily": "unix", "cvss2": {}, "cvelist": ["CVE-2017-7294", "CVE-2017-7308"], "modified": "2017-05-15T21:26:51", "id": "SUSE-SU-2017:1294-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00040.html", "cvss": {"score": 7.2, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-05-15T19:20:15", "description": "This update for the Linux Kernel 3.12.69-60_64_32 fixes several issues.\n\n The following security bugs were fixed:\n\n - CVE-2017-7308: The packet_set_ring function in net/packet/af_packet.c in\n the Linux kernel did not properly validate certain block-size data,\n which allowed local users to cause a denial of service (overflow) or\n possibly have unspecified other impact via crafted system calls\n (bsc#1031660).\n - CVE-2017-7294: The vmw_surface_define_ioctl function in\n drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not\n validate addition of certain levels data, which allowed local users to\n trigger an integer overflow and out-of-bounds write, and cause a denial\n of service (system hang or crash) or possibly gain privileges, via a\n crafted ioctl call for a /dev/dri/renderD* device (bsc#1031440,\n bsc#1031481).\n\n", "cvss3": {}, "published": "2017-05-15T21:12:22", "type": "suse", "title": "Security update for Linux Kernel Live Patch 13 for SLE 12 SP1 (important)", "bulletinFamily": "unix", "cvss2": {}, "cvelist": ["CVE-2017-7294", "CVE-2017-7308"], "modified": "2017-05-15T21:12:22", "id": "SUSE-SU-2017:1280-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00029.html", "cvss": {"score": 7.2, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-05-15T19:20:15", "description": "This update for the Linux Kernel 4.4.21-84 fixes several issues.\n\n The following security bugs were fixed:\n\n - CVE-2017-7308: The packet_set_ring function in net/packet/af_packet.c in\n the Linux kernel did not properly validate certain block-size data,\n which allowed local users to cause a denial of service (overflow) or\n possibly have unspecified other impact via crafted system calls\n (bsc#1030575, bsc#1031660).\n - CVE-2017-7294: The vmw_surface_define_ioctl function in\n drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not\n validate addition of certain levels data, which allowed local users to\n trigger an integer overflow and out-of-bounds write, and cause a denial\n of service (system hang or crash) or possibly gain privileges, via a\n crafted ioctl call for a /dev/dri/renderD* device (bsc#1031440,\n bsc#1031481).\n\n", "cvss3": {}, "published": "2017-05-15T21:09:45", "type": "suse", "title": "Security update for Linux Kernel Live Patch 2 for SLE 12 SP2 (important)", "bulletinFamily": "unix", "cvss2": {}, "cvelist": ["CVE-2017-7294", "CVE-2017-7308"], "modified": "2017-05-15T21:09:45", "id": "SUSE-SU-2017:1277-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00027.html", "cvss": {"score": 7.2, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-05-15T21:20:15", "description": "This update for the Linux Kernel 3.12.67-60_64_21 fixes several issues.\n\n The following security bugs were fixed:\n\n - CVE-2017-7308: The packet_set_ring function in net/packet/af_packet.c in\n the Linux kernel did not properly validate certain block-size data,\n which allowed local users to cause a denial of service (overflow) or\n possibly have unspecified other impact via crafted system calls\n (bsc#1031660).\n - CVE-2017-7294: The vmw_surface_define_ioctl function in\n drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not\n validate addition of certain levels data, which allowed local users to\n trigger an integer overflow and out-of-bounds write, and cause a denial\n of service (system hang or crash) or possibly gain privileges, via a\n crafted ioctl call for a /dev/dri/renderD* device (bsc#1031440,\n bsc#1031481).\n\n", "cvss3": {}, "published": "2017-05-15T21:22:21", "type": "suse", "title": "Security update for Linux Kernel Live Patch 10 for SLE 12 SP1 (important)", "bulletinFamily": "unix", "cvss2": {}, "cvelist": ["CVE-2017-7294", "CVE-2017-7308"], "modified": "2017-05-15T21:22:21", "id": "SUSE-SU-2017:1289-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00039.html", "cvss": {"score": 7.2, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-05-16T17:20:23", "description": "This update for the Linux Kernel 4.4.49-92_14 fixes several issues.\n\n The following security bugs were fixed:\n\n - CVE-2017-7308: The packet_set_ring function in net/packet/af_packet.c in\n the Linux kernel did not properly validate certain block-size data,\n which allowed local users to cause a denial of service (overflow) or\n possibly have unspecified other impact via crafted system calls\n (bsc#1030575, bsc#1031660).\n - CVE-2017-7294: The vmw_surface_define_ioctl function in\n drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not\n validate addition of certain levels data, which allowed local users to\n trigger an integer overflow and out-of-bounds write, and cause a denial\n of service (system hang or crash) or possibly gain privileges, via a\n crafted ioctl call for a /dev/dri/renderD* device (bsc#1031440,\n bsc#1031481).\n\n", "cvss3": {}, "published": "2017-05-16T18:13:17", "type": "suse", "title": "Security update for Linux Kernel Live Patch 6 for SLE 12 SP2 (important)", "bulletinFamily": "unix", "cvss2": {}, "cvelist": ["CVE-2017-7294", "CVE-2017-7308"], "modified": "2017-05-16T18:13:17", "id": "SUSE-SU-2017:1308-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00048.html", "cvss": {"score": 7.2, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-04-19T17:18:37", "description": "This update for the Linux Kernel 3.12.69-60_64_35 fixes several issues.\n\n The following security bugs were fixed:\n\n - CVE-2017-7308: The packet_set_ring function in net/packet/af_packet.c in\n the Linux kernel did not properly validate certain block-size data,\n which allowed local users to cause a denial of service (overflow) or\n possibly have unspecified other impact via crafted system calls\n (bsc#1031660).\n - CVE-2017-7294: The vmw_surface_define_ioctl function in\n drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not\n validate addition of certain levels data, which allowed local users to\n trigger an integer overflow and out-of-bounds write, and cause a denial\n of service (system hang or crash) or possibly gain privileges, via a\n crafted ioctl call for a /dev/dri/renderD* device (bsc#1031440,\n bsc#1031481).\n\n", "cvss3": {}, "published": "2017-04-19T18:09:31", "type": "suse", "title": "Security update for Linux Kernel Live Patch 14 for SLE 12 SP1 (important)", "bulletinFamily": "unix", "cvss2": {}, "cvelist": ["CVE-2017-7294", "CVE-2017-7308"], "modified": "2017-04-19T18:09:31", "id": "SUSE-SU-2017:1059-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2017-04/msg00021.html", "cvss": {"score": 7.2, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-04-19T21:18:38", "description": "This update for the Linux Kernel 3.12.59-60_41 fixes several issues.\n\n The following security bugs were fixed:\n\n - CVE-2017-7308: The packet_set_ring function in net/packet/af_packet.c in\n the Linux kernel did not properly validate certain block-size data,\n which allowed local users to cause a denial of service (overflow) or\n possibly have unspecified other impact via crafted system calls\n (bsc#1030575, bsc#1031660).\n - CVE-2017-7294: The vmw_surface_define_ioctl function in\n drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not\n validate addition of certain levels data, which allowed local users to\n trigger an integer overflow and out-of-bounds write, and cause a denial\n of service (system hang or crash) or possibly gain privileges, via a\n crafted ioctl call for a /dev/dri/renderD* device (bsc#1031440,\n bsc#1031481).\n - bsc#1030467: Updated Dirty COW fix. The former patch caused some apps to\n freeze in rare circumstances\n\n", "cvss3": {}, "published": "2017-04-19T21:10:41", "type": "suse", "title": "Security update for Linux Kernel Live Patch 5 for SLE 12 SP1 (important)", "bulletinFamily": "unix", "cvss2": {}, "cvelist": ["CVE-2017-7294", "CVE-2017-7308"], "modified": "2017-04-19T21:10:41", "id": "SUSE-SU-2017:1064-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2017-04/msg00023.html", "cvss": {"score": 7.2, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-09-05T00:36:41", "description": "The SUSE Linux Enterprise 11 SP4 RT kernel was updated to receive various\n security and bugfixes.\n\n\n The following security bugs were fixed:\n\n - CVE-2014-9922: The eCryptfs subsystem in the Linux kernel allowed local\n users to gain privileges via a large filesystem stack that includes an\n overlayfs layer, related to fs/ecryptfs/main.c and fs/overlayfs/super.c\n (bsc#1032340).\n - CVE-2015-3288: mm/memory.c in the Linux kernel mishandled anonymous\n pages, which allowed local users to gain privileges or cause a denial of\n service (page tainting) via a crafted application that triggers writing\n to page zero (bnc#979021).\n - CVE-2015-8970: crypto/algif_skcipher.c in the Linux kernel did not\n verify that a setkey operation has been performed on an AF_ALG socket\n before an accept system call is processed, which allowed local users to\n cause a denial of service (NULL pointer dereference and system crash)\n via a crafted application that did not supply a key, related to the\n lrw_crypt function in crypto/lrw.c (bnc#1008374 bsc#1008850).\n - CVE-2016-10200: Race condition in the L2TPv3 IP Encapsulation feature in\n the Linux kernel allowed local users to gain privileges or cause a\n denial of service (use-after-free) by making multiple bind system calls\n without properly ascertaining whether a socket has the SOCK_ZAPPED\n status, related to net/l2tp/l2tp_ip.c and net/l2tp/l2tp_ip6.c\n (bnc#1028415).\n - CVE-2016-2188: The iowarrior_probe function in\n drivers/usb/misc/iowarrior.c in the Linux kernel allowed physically\n proximate attackers to cause a denial of service (NULL pointer\n dereference and system crash) via a crafted endpoints value in a USB\n device descriptor (bnc#970956).\n - CVE-2016-4997: The compat IPT_SO_SET_REPLACE and IP6T_SO_SET_REPLACE\n setsockopt implementations in the netfilter subsystem in the Linux\n kernel allow local users to gain privileges or cause a denial of service\n (memory corruption) by leveraging in-container root access to provide a\n crafted offset value that triggers an unintended decrement (bnc#986362).\n - CVE-2016-4998: The IPT_SO_SET_REPLACE setsockopt implementation in the\n netfilter subsystem in the Linux kernel allowed local users to cause a\n denial of service (out-of-bounds read) or possibly obtain sensitive\n information from kernel heap memory by leveraging in-container root\n access to provide a crafted offset value that leads to crossing a\n ruleset blob boundary (bnc#986365).\n - CVE-2016-5243: The tipc_nl_compat_link_dump function in\n net/tipc/netlink_compat.c in the Linux kernel did not properly copy a\n certain string, which allowed local users to obtain sensitive\n information from kernel stack memory by reading a Netlink message\n (bnc#983212).\n - CVE-2016-7117: Use-after-free vulnerability in the __sys_recvmmsg\n function in net/socket.c in the Linux kernel allowed remote attackers to\n execute arbitrary code via vectors involving a recvmmsg system call that\n is mishandled during error processing (bnc#1003077).\n - CVE-2017-1000363: A buffer overflow in kernel commandline handling of\n the "lp" parameter could be used to bypass certain secure boot settings.\n (bnc#1039456).\n - CVE-2017-1000364: An issue was discovered in the size of the stack guard\n page on Linux, specifically a 4k stack guard page is not sufficiently\n large and can be "jumped" over (the stack guard page is bypassed), this\n affects Linux Kernel versions 4.11.5 and earlier (the stackguard page\n was introduced in 2010) (bnc#1039348).\n - CVE-2017-1000365: The Linux Kernel imposes a size restriction on the\n arguments and environmental strings passed through\n RLIMIT_STACK/RLIM_INFINITY (1/4 of the size), but did not take the\n argument and environment pointers into account, which allowed attackers\n to bypass this limitation (bnc#1039354).\n - CVE-2017-1000380: sound/core/timer.c in the Linux kernel is vulnerable\n to a data race in the ALSA /dev/snd/timer driver resulting in local\n users being able to read information belonging to other users, i.e.,\n uninitialized memory contents may be disclosed when a read and an ioctl\n happen at the same time (bnc#1044125).\n - CVE-2017-11176: The mq_notify function in the Linux kernel did not set\n the sock pointer to NULL upon entry into the retry logic. During a\n user-space close of a Netlink socket, it allowed attackers to cause a\n denial of service (use-after-free) or possibly have unspecified other\n impact (bnc#1048275).\n - CVE-2017-11473: Buffer overflow in the mp_override_legacy_irq() function\n in arch/x86/kernel/acpi/boot.c in the Linux kernel allowed local users\n to gain privileges via a crafted ACPI table (bsc#1049603).\n - CVE-2017-2636: Race condition in drivers/tty/n_hdlc.c in the Linux\n kernel allowed local users to gain privileges or cause a denial of\n service (double free) by setting the HDLC line discipline (bnc#1027565\n bsc#1028372).\n - CVE-2017-2647: The KEYS subsystem in the Linux kernel allowed local\n users to gain privileges or cause a denial of service (NULL pointer\n dereference and system crash) via vectors involving a NULL value for a\n certain match field, related to the keyring_search_iterator function in\n keyring.c (bnc#1030593).\n - CVE-2017-2671: The ping_unhash function in net/ipv4/ping.c in the Linux\n kernel is too late in obtaining a certain lock and consequently cannot\n ensure that disconnect function calls are safe, which allowed local\n users to cause a denial of service (panic) by leveraging access to the\n protocol value of IPPROTO_ICMP in a socket system call (bnc#1031003).\n - CVE-2017-5669: The do_shmat function in ipc/shm.c in the Linux kernel\n did not restrict the address calculated by a certain rounding operation,\n which allowed local users to map page zero, and consequently bypass a\n protection mechanism that exists for the mmap system call, by making\n crafted shmget and shmat system calls in a privileged context\n (bnc#1026914).\n - CVE-2017-5970: The ipv4_pktinfo_prepare function in\n net/ipv4/ip_sockglue.c in the Linux kernel allowed attackers to cause a\n denial of service (system crash) via (1) an application that made\n crafted system calls or possibly (2) IPv4 traffic with invalid IP\n options (bnc#1024938).\n - CVE-2017-5986: Race condition in the sctp_wait_for_sndbuf function in\n net/sctp/socket.c in the Linux kernel allowed local users to cause a\n denial of service (assertion failure and panic) via a multithreaded\n application that peels off an association in a certain buffer-full state\n (bnc#1025235).\n - CVE-2017-6074: The dccp_rcv_state_process function in net/dccp/input.c\n in the Linux kernel mishandled DCCP_PKT_REQUEST packet data structures\n in the LISTEN state, which allowed local users to obtain root privileges\n or cause a denial of service (double free) via an application that made\n an IPV6_RECVPKTINFO setsockopt system call (bnc#1026024 bsc#1033287).\n - CVE-2017-6214: The tcp_splice_read function in net/ipv4/tcp.c in the\n Linux kernel allowed remote attackers to cause a denial of service\n (infinite loop and soft lockup) via vectors involving a TCP packet with\n the URG flag (bnc#1026722).\n - CVE-2017-6348: The hashbin_delete function in net/irda/irqueue.c in the\n Linux kernel improperly manages lock dropping, which allowed local users\n to cause a denial of service (deadlock) via crafted operations on IrDA\n devices (bnc#1027178).\n - CVE-2017-6353: net/sctp/socket.c in the Linux kernel did not properly\n restrict association peel-off operations during certain wait states,\n which allowed local users to cause a denial of service (invalid unlock\n and double free) via a multithreaded application. NOTE: this\n vulnerability exists because of an incorrect fix for CVE-2017-5986\n (bnc#1027066).\n - CVE-2017-6951: The keyring_search_aux function in\n security/keys/keyring.c in the Linux kernel allowed local users to cause\n a denial of service (NULL pointer dereference and OOPS) via a\n request_key system call for the "dead" type (bnc#1029850).\n - CVE-2017-7184: The xfrm_replay_verify_len function in\n net/xfrm/xfrm_user.c in the Linux kernel did not validate certain size\n data after an XFRM_MSG_NEWAE update, which allowed local users to obtain\n root privileges or cause a denial of service (heap-based out-of-bounds\n access) by leveraging the CAP_NET_ADMIN capability, as demonstrated\n during a Pwn2Own competition at CanSecWest 2017 for the Ubuntu 16.10\n linux-image-* package 4.8.0.41.52 (bnc#1030573).\n - CVE-2017-7187: The sg_ioctl function in drivers/scsi/sg.c in the Linux\n kernel allowed local users to cause a denial of service (stack-based\n buffer overflow) or possibly have unspecified other impact via a large\n command size in an SG_NEXT_CMD_LEN ioctl call, leading to out-of-bounds\n write access in the sg_write function (bnc#1030213).\n - CVE-2017-7261: The vmw_surface_define_ioctl function in\n drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not\n check for a zero value of certain levels data, which allowed local users\n to cause a denial of service (ZERO_SIZE_PTR dereference, and GPF and\n possibly panic) via a crafted ioctl call for a /dev/dri/renderD* device\n (bnc#1031052).\n - CVE-2017-7294: The vmw_surface_define_ioctl function in\n drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not\n validate addition of certain levels data, which allowed local users to\n trigger an integer overflow and out-of-bounds write, and cause a denial\n of service (system hang or crash) or possibly gain privileges, via a\n crafted ioctl call for a /dev/dri/renderD* device (bnc#1031440).\n - CVE-2017-7308: The packet_set_ring function in net/packet/af_packet.c in\n the Linux kernel did not properly validate certain block-size data,\n which allowed local users to cause a denial of service (integer\n signedness error and out-of-bounds write), or gain privileges (if the\n CAP_NET_RAW capability is held), via crafted system calls (bnc#1031579).\n - CVE-2017-7482: Fixed a potential overflow in the net/rxprc where a\n padded len isn't checked in ticket decode (bsc#1046107).\n - CVE-2017-7487: The ipxitf_ioctl function in net/ipx/af_ipx.c in the\n Linux kernel mishandled reference counts, which allowed local users to\n cause a denial of service (use-after-free) or possibly have unspecified\n other impact via a failed SIOCGIFADDR ioctl call for an IPX interface\n (bnc#1038879).\n - CVE-2017-7533: Race condition in the fsnotify implementation in the\n Linux kernel allowed local users to gain privileges or cause a denial of\n service (memory corruption) via a crafted application that leverages\n simultaneous execution of the inotify_handle_event and vfs_rename\n functions (bsc#1049483).\n - CVE-2017-7542: The ip6_find_1stfragopt function in\n net/ipv6/output_core.c in the Linux kernel allowed local users to cause\n a denial of service (integer overflow and infinite loop) by leveraging\n the ability to open a raw socket (bsc#1049882).\n - CVE-2017-7616: Incorrect error handling in the set_mempolicy and mbind\n compat syscalls in mm/mempolicy.c in the Linux kernel allowed local\n users to obtain sensitive information from uninitialized stack data by\n triggering failure of a certain bitmap operation (bnc#1033336).\n - CVE-2017-8890: The inet_csk_clone_lock function in\n net/ipv4/inet_connection_sock.c in the Linux kernel allowed attackers to\n cause a denial of service (double free) or possibly have unspecified\n other impact by leveraging use of the accept system call (bnc#1038544).\n - CVE-2017-8924: The edge_bulk_in_callback function in\n drivers/usb/serial/io_ti.c in the Linux kernel allowed local users to\n obtain sensitive information (in the dmesg ringbuffer and syslog) from\n uninitialized kernel memory by using a crafted USB device (posing as an\n io_ti USB serial device) to trigger an integer underflow (bnc#1037182\n bsc#1038982).\n - CVE-2017-8925: The omninet_open function in drivers/usb/serial/omninet.c\n in the Linux kernel allowed local users to cause a denial of service\n (tty exhaustion) by leveraging reference count mishandling (bnc#1037183\n bsc#1038981).\n - CVE-2017-9074: The IPv6 fragmentation implementation in the Linux kernel\n did not consider that the nexthdr field may be associated with an\n invalid option, which allowed local users to cause a denial of service\n (out-of-bounds read and BUG) or possibly have unspecified other impact\n via crafted socket and send system calls (bnc#1039882).\n - CVE-2017-9075: The sctp_v6_create_accept_sk function in net/sctp/ipv6.c\n in the Linux kernel mishandled inheritance, which allowed local users to\n cause a denial of service or possibly have unspecified other impact via\n crafted system calls, a related issue to CVE-2017-8890 (bnc#1039883).\n - CVE-2017-9076: The dccp_v6_request_recv_sock function in net/dccp/ipv6.c\n in the Linux kernel mishandled inheritance, which allowed local users to\n cause a denial of service or possibly have unspecified other impact via\n crafted system calls, a related issue to CVE-2017-8890 (bnc#1039885).\n - CVE-2017-9077: The tcp_v6_syn_recv_sock function in net/ipv6/tcp_ipv6.c\n in the Linux kernel mishandled inheritance, which allowed local users to\n cause a denial of service or possibly have unspecified other impact via\n crafted system calls, a related issue to CVE-2017-8890 (bnc#1040069).\n - CVE-2017-9242: The __ip6_append_data function in net/ipv6/ip6_output.c\n in the Linux kernel is too late in checking whether an overwrite of an\n skb data structure may occur, which allowed local users to cause a\n denial of service (system crash) via crafted system calls (bnc#1041431).\n\n The following non-security bugs were fixed:\n\n - 8250: use callbacks to access UART_DLL/UART_DLM.\n - acpi: Disable APEI error injection if securelevel is set (bsc#972891,\n bsc#1023051).\n - af_key: Add lock to key dump (bsc#1047653).\n - af_key: Fix slab-out-of-bounds in pfkey_compile_policy (bsc#1047354).\n - alsa: ctxfi: Fallback DMA mask to 32bit (bsc#1045538).\n - alsa: hda - Fix regression of HD-audio controller fallback modes\n (bsc#1045538).\n - alsa: hda/realtek - Correction of fixup codes for PB V7900 laptop\n (bsc#1045538).\n - alsa: hda/realtek - Fix COEF widget NID for ALC260 replacer fixup\n (bsc#1045538).\n - alsa: hda - using uninitialized data (bsc#1045538).\n - alsa: off by one bug in snd_riptide_joystick_probe() (bsc#1045538).\n - alsa: seq: Fix snd_seq_call_port_info_ioctl in compat mode (bsc#1045538).\n - ath9k: fix buffer overrun for ar9287 (bsc#1045538).\n - __bitmap_parselist: fix bug in empty string handling (bnc#1042633).\n - blacklist.conf: Add a few inapplicable items (bsc#1045538).\n - blacklist.conf: blacklisted 1fe89e1b6d27 (bnc#1046122)\n - block: do not allow updates through sysfs until registration completes\n (bsc#1047027).\n - block: fix ext_dev_lock lockdep report (bsc#1050154).\n - btrfs: Don't clear SGID when inheriting ACLs (bsc#1030552).\n - cifs: backport prepath matching fix (bsc#799133).\n - cifs: don't compare uniqueids in cifs_prime_dcache unless server inode\n numbers are in use (bsc#1041975).\n - cifs: small underflow in cnvrtDosUnixTm() (bsc#1043935).\n - cifs: Timeout on SMBNegotiate request (bsc#1044913).\n - clocksource: Remove "weak" from clocksource_default_clock() declaration\n (bnc#1013018).\n - cputime: Avoid multiplication overflow on utime scaling (bnc#938352).\n - crypto: nx - off by one bug in nx_of_update_msc()\n (fate#314588,bnc#792863).\n - decompress_bunzip2: off by one in get_next_block() (git-fixes).\n - devres: fix a for loop bounds check (git-fixes).\n - dlm: backport "fix lvb invalidation conditions" (bsc#1005651).\n - dm: fix ioctl retry termination with signal (bsc#1050154).\n - drm/mgag200: Add support for G200eH3 (bnc#1044216, fate#323551)\n - drm/mgag200: Add support for G200e rev 4 (bnc#995542, comment #81)\n - edac, amd64_edac: Shift wrapping issue in f1x_get_norm_dct_addr()\n (fate#313937).\n - enic: set skb->hash type properly (bsc#911105 FATE#317501).\n - ext2: Don't clear SGID when inheriting ACLs (bsc#1030552).\n - ext3: Don't clear SGID when inheriting ACLs (bsc#1030552).\n - ext4: Don't clear SGID when inheriting ACLs (bsc#1030552).\n - ext4: fix fdatasync(2) after extent manipulation operations\n (bsc#1013018).\n - ext4: fix mballoc breakage with 64k block size (bsc#1013018).\n - ext4: fix stack memory corruption with 64k block size (bsc#1013018).\n - ext4: keep existing extra fields when inode expands (bsc#1013018).\n - ext4: reject inodes with negative size (bsc#1013018).\n - fbdev/efifb: Fix 16 color palette entry calculation (bsc#1041762).\n - firmware: fix directory creation rule matching with make 3.80\n (bsc#1012422).\n - firmware: fix directory creation rule matching with make 3.82\n (bsc#1012422).\n - fixed invalid assignment of 64bit mask to host dma_boundary for scatter\n gather segment boundary limit (bsc#1042045).\n - Fix soft lockup in svc_rdma_send (bsc#1044854).\n - fnic: Return 'DID_IMM_RETRY' if rport is not ready (bsc#1035920).\n - fnic: Using rport->dd_data to check rport online instead of rport_lookup\n (bsc#1035920).\n - fs/block_dev: always invalidate cleancache in invalidate_bdev()\n (git-fixes).\n - fs: fix data invalidation in the cleancache during direct IO (git-fixes).\n - fs/xattr.c: zero out memory copied to userspace in getxattr\n (bsc#1013018).\n - fuse: add missing FR_FORCE (bsc#1013018).\n - fuse: initialize fc->release before calling it (bsc#1013018).\n - genirq: Prevent proc race against freeing of irq descriptors\n (bnc#1044230).\n - hrtimer: Allow concurrent hrtimer_start() for self restarting timers\n (bnc#1013018).\n - i40e: avoid null pointer dereference (bsc#909486 FATE#317393).\n - i40e: Fix TSO with more than 8 frags per segment issue (bsc#985561).\n - i40e/i40evf: Break up xmit_descriptor_count from maybe_stop_tx\n (bsc#985561).\n - i40e/i40evf: Fix mixed size frags and linearization (bsc#985561).\n - i40e/i40evf: Limit TSO to 7 descriptors for payload instead of 8 per\n packet (bsc#985561).\n - i40e/i40evf: Rewrite logic for 8 descriptor per packet check\n (bsc#985561).\n - i40e: Impose a lower limit on gso size (bsc#985561).\n - i40e: Limit TX descriptor count in cases where frag size is greater than\n 16K (bsc#985561).\n - ib/mlx4: Demote mcg message from warning to debug (bsc#919382).\n - ib/mlx4: Fix ib device initialization error flow (bsc#919382).\n - ib/mlx4: Fix port query for 56Gb Ethernet links (bsc#919382).\n - ib/mlx4: Handle well-known-gid in mad_demux processing (bsc#919382).\n - ib/mlx4: Reduce SRIOV multicast cleanup warning message to debug level\n (bsc#919382).\n - ib/mlx4: Set traffic class in AH (bsc#919382).\n - Implement an ioctl to support the USMTMC-USB488 READ_STATUS_BYTE\n operation (bsc#1036288).\n - initial cr0 bits (bnc#1036056, LTC#153612).\n - input: cm109 - validate number of endpoints before using them\n (bsc#1037193).\n - input: hanwang - validate number of endpoints before using them\n (bsc#1037232).\n - input: yealink - validate number of endpoints before using them\n (bsc#1037227).\n - ipmr, ip6mr: fix scheduling while atomic and a deadlock with\n ipmr_get_route (git-fixes).\n - irq: Fix race condition (bsc#1042615).\n - isdn/gigaset: fix NULL-deref at probe (bsc#1037356).\n - isofs: Do not return EACCES for unknown filesystems (bsc#1013018).\n - jbd: do not wait (forever) for stale tid caused by wraparound\n (bsc#1020229).\n - jbd: Fix oops in journal_remove_journal_head() (bsc#1017143).\n - jsm: add support for additional Neo cards (bsc#1045615).\n - kabi fix (bsc#1008893).\n - kABI: mask struct xfs_icdinode change (bsc#1024788).\n - kabi: Protect xfs_mount and xfs_buftarg (bsc#1024508).\n - kabi:severeties: Add splice_write_to_file PASS This function is part of\n an xfs-specific fix which never went upstream and is not expected to\n have 3rdparty users other than xfs itself.\n - kernel-binary.spec: Propagate MAKE_ARGS to %build (bsc#1012422)\n - keys: Disallow keyrings beginning with '.' to be joined as session\n keyrings (bnc#1035576).\n - kvm: kvm_io_bus_unregister_dev() should never fail.\n - libata: fix sff host state machine locking while polling (bsc#1045525).\n - libceph: NULL deref on crush_decode() error path (bsc#1044015).\n - libceph: potential NULL dereference in ceph_msg_data_create()\n (bsc#1051515).\n - libfc: fixup locking in fc_disc_stop() (bsc#1029140).\n - libfc: move 'pending' and 'requested' setting (bsc#1029140).\n - libfc: only restart discovery after timeout if not already running\n (bsc#1029140).\n - lockd: use init_utsname for id encoding (bsc#1033804).\n - lockd: use rpc client's cl_nodename for id encoding (bsc#1033804).\n - locking/rtmutex: Prevent dequeue vs. unlock race (bnc#1013018).\n - math64: New div64_u64_rem helper (bnc#938352).\n - md: ensure md devices are freed before module is unloaded (git-fixes).\n - md: fix a null dereference (bsc#1040351).\n - md: flush ->event_work before stopping array (git-fixes).\n - md linear: fix a race between linear_add() and linear_congested()\n (bsc#1018446).\n - md/linear: shutup lockdep warnning (bsc#1018446).\n - md: make sure GET_ARRAY_INFO ioctl reports correct "clean" status\n (git-fixes).\n - md/raid0: apply base queue limits *before* disk_stack_limits (git-fixes).\n - md/raid1: extend spinlock to protect raid1_end_read_request against\n inconsistencies (git-fixes).\n - md/raid1: fix test for 'was read error from last working device'\n (git-fixes).\n - md/raid5: do not record new size if resize_stripes fails (git-fixes).\n - md/raid5: Fix CPU hotplug callback registration (git-fixes).\n - md: use separate bio_pool for metadata writes (bsc#1040351).\n - megaraid_sas: add missing curly braces in ioctl handler (bsc#1050154).\n - mlx4: reduce OOM risk on arches with large pages (bsc#919382).\n - mmc: core: add missing pm event in mmc_pm_notify to fix hib restore\n (bsc#1045547).\n - mmc: ushc: fix NULL-deref at probe (bsc#1037191).\n - mm: do not collapse stack gap into THP (bnc#1039348)\n - mm: enlarge stack guard gap (bnc#1039348).\n - mm/huge_memory: replace VM_NO_THP VM_BUG_ON with actual VMA check (VM\n Functionality, bsc#1042832).\n - mm: hugetlb: call huge_pte_alloc() only if ptep is null (VM\n Functionality, bsc#1042832).\n - mm/memory-failure.c: use compound_head() flags for huge pages\n (bnc#971975 VM -- git fixes).\n - mm/mempolicy.c: do not put mempolicy before using its nodemask\n (References: VM Performance, bnc#931620).\n - mm, mmap: do not blow on PROT_NONE MAP_FIXED holes in the stack\n (bnc#1039348, bnc#1045340, bnc#1045406).\n - module: fix memory leak on early load_module() failures (bsc#1043014).\n - Move nr_cpus_allowed into a hole in struct_sched_entity instead of the\n one below task_struct.policy. RT fills the hole 29baa7478ba4 used, which\n will screw up kABI for RT instead of curing the space needed problem in\n sched_rt_entity caused by adding ff77e4685359. This leaves\n nr_cpus_alowed in an odd spot, but safely allows the RT entity specific\n data added by ff77e4685359 to reside where it belongs.. nr_cpus_allowed\n just moves from one odd spot to another.\n - mwifiex: printk() overflow with 32-byte SSIDs (bsc#1048185).\n - net: avoid reference counter overflows on fib_rules in multicast\n forwarding (git-fixes).\n - net: ip6mr: fix static mfc/dev leaks on table destruction (git-fixes).\n - net: ipmr: fix static mfc/dev leaks on table destruction (git-fixes).\n - net/mlx4_core: Eliminate warning messages for SRQ_LIMIT under SRIOV\n (bsc#919382).\n - net/mlx4_core: Enhance the MAD_IFC wrapper to convert VF port to\n physical (bsc#919382).\n - net/mlx4_core: Fix VF overwrite of module param which disables DMFS on\n new probed PFs (bsc#919382).\n - net/mlx4_core: Fix when to save some qp context flags for dynamic VST to\n VGT transitions (bsc#919382).\n - net/mlx4_core: Get num_tc using netdev_get_num_tc (bsc#919382).\n - net/mlx4_core: Prevent VF from changing port configuration (bsc#919382).\n - net/mlx4_core: Use-after-free causes a resource leak in flow-steering\n detach (bsc#919382).\n - net/mlx4_core: Use cq quota in SRIOV when creating completion EQs\n (bsc#919382).\n - net/mlx4_en: Avoid adding steering rules with invalid ring (bsc#919382).\n - net/mlx4_en: Change the error print to debug print (bsc#919382).\n - net/mlx4_en: fix overflow in mlx4_en_init_timestamp() (bsc#919382).\n - net/mlx4_en: Fix type mismatch for 32-bit systems (bsc#919382).\n - net/mlx4_en: Resolve dividing by zero in 32-bit system (bsc#919382).\n - net/mlx4_en: Wake TX queues only when there's enough room (bsc#1039258).\n - net/mlx4: Fix the check in attaching steering rules (bsc#919382).\n - net/mlx4: Fix uninitialized fields in rule when adding promiscuous mode\n to device managed flow steering (bsc#919382).\n - net: wimax/i2400m: fix NULL-deref at probe (bsc#1037358).\n - netxen_nic: set rcode to the return status from the call to\n netxen_issue_cmd (bnc#784815 FATE#313898).\n - nfs: Avoid getting confused by confused server (bsc#1045416).\n - nfsd4: minor NFSv2/v3 write decoding cleanup (bsc#1034670).\n - nfsd: check for oversized NFSv2/v3 arguments (bsc#1034670).\n - nfsd: do not risk using duplicate owner/file/delegation ids\n (bsc#1029212).\n - nfsd: Don't use state id of 0 - it is reserved (bsc#1049688 bsc#1051770).\n - nfsd: stricter decoding of write-like NFSv2/v3 ops (bsc#1034670).\n - nfs: Fix another OPEN_DOWNGRADE bug (git-next).\n - nfs: fix nfs_size_to_loff_t (git-fixes).\n - nfs: Fix size of NFSACL SETACL operations (git-fixes).\n - nfs: Make nfs_readdir revalidate less often (bsc#1048232).\n - nfs: tidy up nfs_show_mountd_netid (git-fixes).\n - nfsv4: Do not call put_rpccred() under the rcu_read_lock() (git-fixes).\n - nfsv4: Fix another bug in the close/open_downgrade code (git-fixes).\n - nfsv4: fix getacl head length estimation (git-fixes).\n - nfsv4: Fix problems with close in the presence of a delegation\n (git-fixes).\n - nfsv4: Fix the underestimation of delegation XDR space reservation\n (git-fixes).\n - ocfs2: do not write error flag to user structure we cannot copy from/to\n (bsc#1013018).\n - ocfs2: Don't clear SGID when inheriting ACLs (bsc#1030552).\n - ocfs2: fix crash caused by stale lvb with fsdlm plugin (bsc#1013800).\n - ocfs2: fix error return code in ocfs2_info_handle_freefrag()\n (bsc#1013018).\n - ocfs2: NFS hangs in __ocfs2_cluster_lock due to race with\n ocfs2_unblock_lock (bsc#962257).\n - ocfs2: null deref on allocation error (bsc#1013018).\n - pci: Allow access to VPD attributes with size 0 (bsc#1018074).\n - pciback: only check PF if actually dealing with a VF (bsc#999245).\n - pciback: use pci_physfn() (bsc#999245).\n - pci: Fix devfn for VPD access through function 0 (bnc#943786 git-fixes).\n - perf/core: Correct event creation with PERF_FORMAT_GROUP (bnc#1013018).\n - perf/core: Fix event inheritance on fork() (bnc#1013018).\n - posix-timers: Fix stack info leak in timer_create() (bnc#1013018).\n - powerpc,cpuidle: Dont toggle CPUIDLE_FLAG_IGNORE while setting\n smt_snooze_delay (bsc#1023163).\n - powerpc: Drop support for pre-POWER4 cpus (fate#322495, bsc#1032471).\n - powerpc/fadump: Fix the race in crash_fadump() (bsc#1022971).\n - powerpc/fadump: Reserve memory at an offset closer to bottom of RAM\n (bsc#1032141).\n - powerpc/fadump: Update fadump documentation (bsc#1032141).\n - powerpc/mm: Do not alias user region to other regions below PAGE_OFFSET\n (bsc#928138,fate#319026).\n - powerpc/mm/hash: Check for non-kernel address in get_kernel_vsid()\n (fate#322495, bsc#1032471).\n - powerpc/mm/hash: Convert mask to unsigned long (fate#322495,\n bsc#1032471).\n - powerpc/mm/hash: Increase VA range to 128TB (fate#322495, bsc#1032471).\n - powerpc/mm/hash: Properly mask the ESID bits when building proto VSID\n (fate#322495, bsc#1032471).\n - powerpc/mm/hash: Support 68 bit VA (fate#322495, bsc#1032471).\n - powerpc/mm/hash: Use context ids 1-4 for the kernel (fate#322495,\n bsc#1032471).\n - powerpc/mm: Remove checks that TASK_SIZE_USER64 is too small\n (fate#322495, bsc#1032471).\n - powerpc/mm/slice: Convert slice_mask high slice to a bitmap\n (fate#322495, bsc#1032471).\n - powerpc/mm/slice: Fix off-by-1 error when computing slice mask\n (fate#322495, bsc#1032471).\n - powerpc/mm/slice: Move slice_mask struct definition to slice.c\n (fate#322495, bsc#1032471).\n - powerpc/mm/slice: Update slice mask printing to use bitmap printing\n (fate#322495, bsc#1032471).\n - powerpc/mm/slice: Update the function prototype (fate#322495,\n bsc#1032471).\n - powerpc/mm: use macro PGTABLE_EADDR_SIZE instead of digital\n (fate#322495, bsc#1032471).\n - powerpc/nvram: Fix an incorrect partition merge (bsc#1016489).\n - powerpc/pseries: Release DRC when configure_connector fails\n (bsc#1035777, Pending Base Kernel Fixes).\n - powerpc: Remove STAB code (fate#322495, bsc#1032471).\n - powerpc/vdso64: Use double word compare on pointers (bsc#1016489).\n - raid1: avoid unnecessary spin locks in I/O barrier code\n (bsc#982783,bsc#1026260).\n - random32: fix off-by-one in seeding requirement (git-fixes).\n - rcu: Call out dangers of expedited RCU primitives (bsc#1008893).\n - rcu: Direct algorithmic SRCU implementation (bsc#1008893).\n - rcu: Flip ->completed only once per SRCU grace period (bsc#1008893).\n - rcu: Implement a variant of Peter's SRCU algorithm (bsc#1008893).\n - rcu: Increment upper bit only for srcu_read_lock() (bsc#1008893).\n - rcu: Remove fast check path from __synchronize_srcu() (bsc#1008893).\n - reiserfs: Don't clear SGID when inheriting ACLs (bsc#1030552).\n - reiserfs: don't preallocate blocks for extended attributes (bsc#990682).\n - Remove patches causing regression (bsc#1043234)\n - Remove superfluous make flags (bsc#1012422)\n - Return short read or 0 at end of a raw device, not EIO (bsc#1039594).\n - Revert "kabi:severeties: Add splice_write_to_file PASS" This reverts\n commit 05ecf7ab16b2ea555fadd1ce17d8177394de88f2.\n - Revert "math64: New div64_u64_rem helper" (bnc#938352).\n - Revert "xfs: fix up xfs_swap_extent_forks inline extent handling\n (bsc#1023888)." I was baing my assumption of SLE11-SP4 needing this\n patch on an old kernel build (3.0.101-63). Re-testing with the latest\n one 3.0.101-94 shows that the issue is not present. Furthermore this one\n was causing some crashes. This reverts commit\n 16ceeac70f7286b6232861c3170ed32e39dcc68c.\n - rfkill: fix rfkill_fop_read wait_event usage (bsc#1046192).\n - s390/kmsg: add missing kmsg descriptions (bnc#1025702, LTC#151573).\n - s390/qdio: clear DSCI prior to scanning multiple input queues\n (bnc#1046715, LTC#156234).\n - s390/qeth: no ETH header for outbound AF_IUCV (bnc#1046715, LTC#156276).\n - s390/qeth: size calculation outbound buffers (bnc#1046715, LTC#156276).\n - s390/vmlogrdr: fix IUCV buffer allocation (bnc#1025702, LTC#152144).\n - s390/zcrypt: Introduce CEX6 toleration (FATE#321782, LTC#147505).\n - sched: Always initialize cpu-power (bnc#1013018).\n - sched: Avoid cputime scaling overflow (bnc#938352).\n - sched: Avoid prev->stime underflow (bnc#938352).\n - sched/core: Fix TASK_DEAD race in finish_task_switch() (bnc#1013018).\n - sched/core: Remove false-positive warning from wake_up_process()\n (bnc#1044882).\n - sched/cputime: Do not scale when utime == 0 (bnc#938352).\n - sched/debug: Print the scheduler topology group mask (bnc#1013018).\n - sched: Do not account bogus utime (bnc#938352).\n - sched/fair, cpumask: Export for_each_cpu_wrap() (bnc#1013018).\n - sched/fair: Fix min_vruntime tracking (bnc#1013018).\n - sched: Fix domain iteration (bnc#1013018).\n - sched: Fix SD_OVERLAP (bnc#1013018).\n - sched/loadavg: Fix loadavg artifacts on fully idle and on fully loaded\n systems (bnc#1013018).\n - sched: Lower chances of cputime scaling overflow (bnc#938352).\n - sched: Move nr_cpus_allowed out of 'struct sched_rt_entity'\n (bnc#1013018). Prep for b60205c7c558 sched/fair: Fix min_vruntime\n tracking\n - sched: Rename a misleading variable in build_overlap_sched_groups()\n (bnc#1013018).\n - sched/rt: Fix PI handling vs. sched_setscheduler() (bnc#1013018). Prep\n for b60205c7c558 sched/fair: Fix min_vruntime tracking\n - sched/topology: Fix building of overlapping sched-groups (bnc#1013018).\n - sched/topology: Fix overlapping sched_group_capacity (bnc#1013018).\n - sched/topology: Fix overlapping sched_group_mask (bnc#1013018).\n - sched/topology: Move comment about asymmetric node setups (bnc#1013018).\n - sched/topology: Optimize build_group_mask() (bnc#1013018).\n - sched/topology: Refactor function build_overlap_sched_groups()\n (bnc#1013018).\n - sched/topology: Remove FORCE_SD_OVERLAP (bnc#1013018).\n - sched/topology: Simplify build_overlap_sched_groups() (bnc#1013018).\n - sched/topology: Verify the first group matches the child domain\n (bnc#1013018).\n - sched: Use swap() macro in scale_stime() (bnc#938352).\n - scsi: bnx2i: missing error code in bnx2i_ep_connect() (bsc#1048221).\n - scsi: fix race between simultaneous decrements of ->host_failed\n (bsc#1050154).\n - scsi: fnic: Correcting rport check location in fnic_queuecommand_lck\n (bsc#1035920).\n - scsi: mvsas: fix command_active typo (bsc#1050154).\n - scsi: qla2xxx: Fix scsi scan hang triggered if adapter fails during init\n (bsc#1050154).\n - scsi: virtio_scsi: fix memory leak on full queue condition (bsc#1028880).\n - scsi: zfcp: do not trace pure benign residual HBA responses at default\n level (bnc#1025702, LTC#151317).\n - scsi: zfcp: fix rport unblock race with LUN recovery (bnc#1025702,\n LTC#151319).\n - scsi: zfcp: fix use-after-free by not tracing WKA port open/close on\n failed send (bnc#1025702, LTC#151365).\n - scsi: zfcp: fix use-after-"free" in FC ingress path after TMF\n (bnc#1025702, LTC#151312).\n - sfc: do not device_attach if a reset is pending (bsc#909618 FATE#317521).\n - sfc: reduce severity of PIO buffer alloc failures (bsc#1019168).\n - smsc75xx: use skb_cow_head() to deal with cloned skbs (bsc#1045154).\n - splice: Stub splice_write_to_file (bsc#1043234).\n - sunrpc: Clean up the slot table allocation (bsc#1013862).\n - sunrpc: Fix a memory leak in the backchannel code (git-fixes).\n - sunrpc: Initalise the struct xprt upon allocation (bsc#1013862).\n - svcrdma: Fix send_reply() scatter/gather set-up (git-fixes).\n - target/iscsi: Fix double free in lio_target_tiqn_addtpg() (bsc#1050154).\n - tcp: abort orphan sockets stalling on zero window probes (bsc#1021913).\n - tracing: Fix syscall_*regfunc() vs copy_process() race (bnc#1042687).\n - tracing/kprobes: Enforce kprobes teardown after testing (bnc#1013018).\n - udf: Fix deadlock between writeback and udf_setsize() (bsc#1013018).\n - udf: Fix races with i_size changes during readpage (bsc#1013018).\n - Update metadata for serial fixes (bsc#1013070)\n - Update patches.fixes/nfs-svc-rdma.fix (bsc#1044854).\n - usb: cdc-acm: fix broken runtime suspend (bsc#1033771).\n - usb: cdc-acm: fix open and suspend race (bsc#1033771).\n - usb: cdc-acm: fix potential urb leak and PM imbalance in write\n (bsc#1033771).\n - usb: cdc-acm: fix runtime PM for control messages (bsc#1033771).\n - usb: cdc-acm: fix runtime PM imbalance at shutdown (bsc#1033771).\n - usb: cdc-acm: fix shutdown and suspend race (bsc#1033771).\n - usb: cdc-acm: fix write and resume race (bsc#1033771).\n - usb: cdc-acm: fix write and suspend race (bsc#1033771).\n - usb: class: usbtmc.c: Cleaning up uninitialized variables (bsc#1036288).\n - usb: class: usbtmc: do not print error when allocating urb fails\n (bsc#1036288).\n - usb: class: usbtmc: do not print on ENOMEM (bsc#1036288).\n - usb: hub: Fix crash after failure to read BOS descriptor (FATE#317453).\n - usb: iowarrior: fix info ioctl on big-endian hosts (bsc#1037441).\n - usb: iowarrior: fix NULL-deref in write (bsc#1037359).\n - usb: r8a66597-hcd: select a different endpoint on timeout (bsc#1047053).\n - usb: serial: ark3116: fix register-accessor error handling (git-fixes).\n - usb: serial: ch341: fix open error handling (bsc#1037441).\n - usb: serial: cp210x: fix tiocmget error handling (bsc#1037441).\n - usb: serial: ftdi_sio: fix line-status over-reporting (bsc#1037441).\n - usb: serial: io_edgeport: fix epic-descriptor handling (bsc#1037441).\n - usb: serial: io_ti: fix information leak in completion handler\n (git-fixes).\n - usb: serial: iuu_phoenix: fix NULL-deref at open (bsc#1033794).\n - usb: serial: kl5kusb105: fix line-state error handling (bsc#1021256).\n - usb: serial: mos7720: fix NULL-deref at open (bsc#1033816).\n - usb: serial: mos7720: fix parallel probe (bsc#1033816).\n - usb: serial: mos7720: fix parport use-after-free on probe errors\n (bsc#1033816).\n - usb: serial: mos7720: fix use-after-free on probe errors (bsc#1033816).\n - usb: serial: mos7840: fix another NULL-deref at open (bsc#1034026).\n - usb: serial: mos7840: fix NULL-deref at open (bsc#1034026).\n - usb: serial: oti6858: fix NULL-deref at open (bsc#1037441).\n - usb: serial: sierra: fix bogus alternate-setting assumption\n (bsc#1037441).\n - usb: serial: spcp8x5: fix NULL-deref at open (bsc#1037441).\n - usbtmc: remove redundant braces (bsc#1036288).\n - usbtmc: remove trailing spaces (bsc#1036288).\n - usb: usbip: fix nonconforming hub descriptor (bsc#1047487).\n - usb: usbtmc: add device quirk for Rigol DS6104 (bsc#1036288).\n - usb: usbtmc: Add flag rigol_quirk to usbtmc_device_data (bsc#1036288).\n - usb: usbtmc: add missing endpoint sanity check (bsc#1036288).\n - usb: usbtmc: Change magic number to constant (bsc#1036288).\n - usb: usbtmc: fix big-endian probe of Rigol devices (bsc#1036288).\n - usb: usbtmc: fix DMA on stack (bsc#1036288).\n - usb: usbtmc: fix probe error path (bsc#1036288).\n - usb: usbtmc: Set rigol_quirk if device is listed (bsc#1036288).\n - usb: usbtmc: TMC request code segregated from usbtmc_read (bsc#1036288).\n - usb: usbtmc: usbtmc_read sends multiple TMC header based on rigol_quirk\n (bsc#1036288).\n - usbvision: fix NULL-deref at probe (bsc#1050431).\n - usb: xhci-mem: use passed in GFP flags instead of GFP_KERNEL\n (bsc#1023014).\n - Use make --output-sync feature when available (bsc#1012422). The mesages\n in make output can interleave making it impossible to extract warnings\n reliably. Since version 4 GNU Make supports --output-sync flag that\n prints output of each sub-command atomically preventing this issue.\n Detect the flag and use it if available. SLE11 has make 3.81 so it is\n required to include make 4 in the kernel OBS projects to take advantege\n of this.\n - Use PF_LESS_THROTTLE in loop device thread (bsc#1027101).\n - uwb: hwa-rc: fix NULL-deref at probe (bsc#1037233).\n - uwb: i1480-dfu: fix NULL-deref at probe (bsc#1036629).\n - vb2: Fix an off by one error in 'vb2_plane_vaddr' (bsc#1050431).\n - vfs: split generic splice code from i_mutex locking (bsc#1024788).\n - vmxnet3: avoid calling pskb_may_pull with interrupts disabled\n (bsc#1045356).\n - vmxnet3: fix checks for dma mapping errors (bsc#1045356).\n - vmxnet3: fix lock imbalance in vmxnet3_tq_xmit() (bsc#1045356).\n - vmxnet3: segCnt can be 1 for LRO packets (bsc#988065, bsc#1029770).\n - x86, mm, paravirt: Fix vmalloc_fault oops during lazy MMU updates\n (bsc#948562).\n - x86/pci-calgary: Fix iommu_free() comparison of unsigned expression >= 0\n (bsc#1051478).\n - xen: avoid deadlock in xenbus (bnc#1047523).\n - xen-blkfront: correct maximum segment accounting (bsc#1018263).\n - xen-blkfront: do not call talk_to_blkback when already connected to\n blkback.\n - xen-blkfront: free resources if xlvbd_alloc_gendisk fails.\n - xen/PCI-MSI: fix sysfs teardown in DomU (bsc#986924).\n - xfrm: dst_entries_init() per-net dst_ops (bsc#1030814).\n - xfrm: NULL dereference on allocation failure (bsc#1047343).\n - xfrm: Oops on error in pfkey_msg2xfrm_state() (bsc#1047653).\n - xfs_dmapi: fix the debug compilation of xfs_dmapi (bsc#989056).\n - xfs: do not assert fail on non-async buffers on ioacct decrement\n (bsc#1024508).\n - xfs: exclude never-released buffers from buftarg I/O accounting\n (bsc#1024508).\n - xfs: fix buffer overflow dm_get_dirattrs/dm_get_dirattrs2 (bsc#989056).\n - xfs: Fix lock ordering in splice write (bsc#1024788).\n - xfs: fix up xfs_swap_extent_forks inline extent handling (bsc#1023888).\n - xfs: kill xfs_itruncate_start (bsc#1024788).\n - xfs: Make xfs_icdinode->di_dmstate atomic_t (bsc#1024788).\n - xfs: remove the i_new_size field in struct xfs_inode (bsc#1024788).\n - xfs: remove the i_size field in struct xfs_inode (bsc#1024788).\n - xfs: remove xfs_itruncate_data (bsc#1024788).\n - xfs: replace global xfslogd wq with per-mount wq (bsc#1024508).\n - xfs: split xfs_itruncate_finish (bsc#1024788).\n - xfs: split xfs_setattr (bsc#1024788).\n - xfs: Synchronize xfs_buf disposal routines (bsc#1041160).\n - xfs: track and serialize in-flight async buffers against unmount\n (bsc#1024508).\n - xfs: use ->b_state to fix buffer I/O accounting release race\n (bsc#1041160).\n - xprtrdma: Free the pd if ib_query_qp() fails (git-fixes).\n\n", "cvss3": {}, "published": "2017-09-04T21:11:06", "type": "suse", "title": "Security update for the Linux Kernel (important)", "bulletinFamily": "unix", "cvss2": {}, "cvelist": ["CVE-2017-11176", "CVE-2017-7261", "CVE-2017-7184", "CVE-2017-1000380", "CVE-2017-6074", "CVE-2016-7117", "CVE-2017-7616", "CVE-2015-3288", "CVE-2017-9074", "CVE-2017-9242", "CVE-2017-5970", "CVE-2016-10200", "CVE-2017-2636", "CVE-2017-2671", "CVE-2017-11473", "CVE-2017-9075", "CVE-2017-7533", "CVE-2017-7294", "CVE-2017-6348", "CVE-2017-8924", "CVE-2015-8970", "CVE-2016-5243", "CVE-2017-6214", "CVE-2017-1000364", "CVE-2017-7482", "CVE-2014-9922", "CVE-2016-4997", "CVE-2017-7308", "CVE-2017-5669", "CVE-2017-6951", "CVE-2017-2647", "CVE-2017-8925", "CVE-2017-5986", "CVE-2017-6353", "CVE-2017-7487", "CVE-2017-9076", "CVE-2017-1000363", "CVE-2017-7187", "CVE-2017-9077", "CVE-2017-7542", "CVE-2017-1000365", "CVE-2017-8890", "CVE-2016-4998", "CVE-2016-2188"], "modified": "2017-09-04T21:11:06", "id": "SUSE-SU-2017:2342-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2017-09/msg00009.html", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-05-15T19:20:15", "description": "This update the for Linux Kernel 3.12.61-52.69 fixes one issue.\n\n The following security bug was fixed:\n\n - CVE-2017-5970: The ipv4_pktinfo_prepare function in\n net/ipv4/ip_sockglue.c in the Linux kernel allowed attackers to cause a\n denial of service (system crash) via (1) an application that made\n crafted system calls or possibly (2) IPv4 traffic with invalid IP\n options (bsc#1025013).\n - CVE-2017-7308: The packet_set_ring function in net/packet/af_packet.c in\n the Linux kernel did not properly validate certain block-size data,\n which allowed local users to cause a denial of service (overflow) or\n possibly have unspecified other impact via crafted system calls\n (bsc#1030575, bsc#1031660).\n\n", "cvss3": {}, "published": "2017-05-15T21:13:19", "type": "suse", "title": "Security update for Linux Kernel Live Patch 20 for SLE 12 (important)", "bulletinFamily": "unix", "cvss2": {}, "cvelist": ["CVE-2017-5970", "CVE-2017-7308"], "modified": "2017-05-15T21:13:19", "id": "SUSE-SU-2017:1281-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00031.html", "cvss": {"score": 7.2, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-09-19T18:33:11", "description": "The SUSE Linux Enterprise 11 SP3 LTSS kernel was updated receive various\n security and bugfixes.\n\n The following security bugs were fixed:\n\n - CVE-2016-5243: The tipc_nl_compat_link_dump function in\n net/tipc/netlink_compat.c in the Linux kernel did not properly copy a\n certain string, which allowed local users to obtain sensitive\n information from kernel stack memory by reading a Netlink message\n (bnc#983212)\n - CVE-2016-10200: Race condition in the L2TPv3 IP Encapsulation feature in\n the Linux kernel allowed local users to gain privileges or cause a\n denial of service (use-after-free) by making multiple bind system calls\n without properly ascertaining whether a socket has the SOCK_ZAPPED\n status, related to net/l2tp/l2tp_ip.c and net/l2tp/l2tp_ip6.c\n (bnc#1028415)\n - CVE-2017-2647: The KEYS subsystem in the Linux kernel allowed local\n users to gain privileges or cause a denial of service (NULL pointer\n dereference and system crash) via vectors involving a NULL value for a\n certain match field, related to the keyring_search_iterator function in\n keyring.c (bsc#1030593).\n - CVE-2017-2671: The ping_unhash function in net/ipv4/ping.c in the Linux\n kernel was too late in obtaining a certain lock and consequently could\n not ensure that disconnect function calls are safe, which allowed local\n users to cause a denial of service (panic) by leveraging access to the\n protocol value of IPPROTO_ICMP in a socket system call (bnc#1031003)\n - CVE-2017-5669: The do_shmat function in ipc/shm.c in the Linux kernel\n did not restrict the address calculated by a certain rounding operation,\n which allowed local users to map page zero, and consequently bypass a\n protection mechanism that exists for the mmap system call, by making\n crafted shmget and shmat system calls in a privileged context\n (bnc#1026914)\n - CVE-2017-5970: The ipv4_pktinfo_prepare function in\n net/ipv4/ip_sockglue.c in the Linux kernel allowed attackers to cause a\n denial of service (system crash) via (1) an application that made\n crafted system calls or possibly (2) IPv4 traffic with invalid IP\n options (bsc#1024938)\n - CVE-2017-5986: Race condition in the sctp_wait_for_sndbuf function in\n net/sctp/socket.c in the Linux kernel allowed local users to cause a\n denial of service (assertion failure and panic) via a multithreaded\n application that peels off an association in a certain buffer-full state\n (bsc#1025235)\n - CVE-2017-6074: The dccp_rcv_state_process function in net/dccp/input.c\n in the Linux kernel mishandled DCCP_PKT_REQUEST packet data structures\n in the LISTEN state, which allowed local users to obtain root privileges\n or cause a denial of service (double free) via an application that made\n an IPV6_RECVPKTINFO setsockopt system call (bnc#1026024)\n - CVE-2017-6214: The tcp_splice_read function in net/ipv4/tcp.c in the\n Linux kernel allowed remote attackers to cause a denial of service\n (infinite loop and soft lockup) via vectors involving a TCP packet with\n the URG flag (bnc#1026722)\n - CVE-2017-6348: The hashbin_delete function in net/irda/irqueue.c in the\n Linux kernel improperly managed lock dropping, which allowed local users\n to cause a denial of service (deadlock) via crafted operations on IrDA\n devices (bnc#1027178)\n - CVE-2017-6353: net/sctp/socket.c in the Linux kernel did not properly\n restrict association peel-off operations during certain wait states,\n which allowed local users to cause a denial of service (invalid unlock\n and double free) via a multithreaded application. NOTE: this\n vulnerability exists because of an incorrect fix for CVE-2017-5986\n (bnc#1027066)\n - CVE-2017-6951: The keyring_search_aux function in\n security/keys/keyring.c in the Linux kernel allowed local users to cause\n a denial of service (NULL pointer dereference and OOPS) via a\n request_key system call for the "dead" type (bsc#1029850).\n - CVE-2017-7184: The xfrm_replay_verify_len function in\n net/xfrm/xfrm_user.c in the Linux kernel did not validate certain size\n data after an XFRM_MSG_NEWAE update, which allowed local users to obtain\n root privileges or cause a denial of service (heap-based out-of-bounds\n access) by leveraging the CAP_NET_ADMIN capability (bsc#1030573)\n - CVE-2017-7187: The sg_ioctl function in drivers/scsi/sg.c in the Linux\n kernel allowed local users to cause a denial of service (stack-based\n buffer overflow) or possibly have unspecified other impact via a large\n command size in an SG_NEXT_CMD_LEN ioctl call, leading to out-of-bounds\n write access in the sg_write function (bnc#1030213)\n - CVE-2017-7261: The vmw_surface_define_ioctl function in\n drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not\n check for a zero value of certain levels data, which allowed local users\n to cause a denial of service (ZERO_SIZE_PTR dereference, and GPF and\n possibly panic) via a crafted ioctl call for a /dev/dri/renderD* device\n (bnc#1031052)\n - CVE-2017-7294: The vmw_surface_define_ioctl function in\n drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not\n validate addition of certain levels data, which allowed local users to\n trigger an integer overflow and out-of-bounds write, and cause a denial\n of service (system hang or crash) or possibly gain privileges, via a\n crafted ioctl call for a /dev/dri/renderD* device (bnc#1031440)\n - CVE-2017-7308: The packet_set_ring function in net/packet/af_packet.c in\n the Linux kernel did not properly validate certain block-size data,\n which allowed local users to cause a denial of service (overflow) or\n possibly have unspecified other impact via crafted system calls\n (bnc#1031579)\n - CVE-2017-7482: Several missing length checks ticket decode allowing for\n information leak or potentially code execution (bsc#1046107).\n - CVE-2017-7487: The ipxitf_ioctl function in net/ipx/af_ipx.c in the\n Linux kernel mishandled reference counts, which allowed local users to\n cause a denial of service (use-after-free) or possibly have unspecified\n other impact via a failed SIOCGIFADDR ioctl call for an IPX interface\n (bsc#1038879).\n - CVE-2017-7533: Race condition in the fsnotify implementation in the\n Linux kernel allowed local users to gain privileges or cause a denial of\n service (memory corruption) via a crafted application that leverages\n simultaneous execution of the inotify_handle_event and vfs_rename\n functions (bnc#1049483 1050677 ).\n - CVE-2017-7542: The ip6_find_1stfragopt function in\n net/ipv6/output_core.c in the Linux kernel allowed local users to cause\n a denial of service (integer overflow and infinite loop) by leveraging\n the ability to open a raw socket (bnc#1049882).\n - CVE-2017-7616: Incorrect error handling in the set_mempolicy and mbind\n compat syscalls in mm/mempolicy.c in the Linux kernel allowed local\n users to obtain sensitive information from uninitialized stack data by\n triggering failure of a certain bitmap operation (bsc#1033336)\n - CVE-2017-8831: The saa7164_bus_get function in\n drivers/media/pci/saa7164/saa7164-bus.c in the Linux kernel allowed\n local users to cause a denial of service (out-of-bounds array access) or\n possibly have unspecified other impact by changing a certain\n sequence-number value, aka a "double fetch" vulnerability. This requires\n a malicious PCI Card. (bnc#1037994).\n - CVE-2017-8890: The inet_csk_clone_lock function in\n net/ipv4/inet_connection_sock.c in the Linux kernel allowed attackers to\n cause a denial of service (double free) or possibly have unspecified\n other impact by leveraging use of the accept system call (bsc#1038544).\n - CVE-2017-8924: The edge_bulk_in_callback function in\n drivers/usb/serial/io_ti.c in the Linux kernel allowed local users to\n obtain sensitive information (in the dmesg ringbuffer and syslog) from\n uninitialized kernel memory by using a crafted USB device (posing as an\n io_ti USB serial device) to trigger an integer underflow (bnc#1037182).\n - CVE-2017-8925: The omninet_open function in drivers/usb/serial/omninet.c\n in the Linux kernel allowed local users to cause a denial of service\n (tty exhaustion) by leveraging reference count mishandling (bnc#1038981).\n - CVE-2017-9074: The IPv6 fragmentation implementation in the Linux kernel\n did not consider that the nexthdr field may be associated with an\n invalid option, which allowed local users to cause a denial of service\n (out-of-bounds read and BUG) or possibly have unspecified other impact\n via crafted socket and send system calls (bnc#1039882).\n - CVE-2017-9075: The sctp_v6_create_accept_sk function in net/sctp/ipv6.c\n in the Linux kernel mishandled inheritance, which allowed local users to\n cause a denial of service or possibly have unspecified other impact via\n crafted system calls, a related issue to CVE-2017-8890 (bsc#1039883).\n - CVE-2017-9076: The dccp_v6_request_recv_sock function in net/dccp/ipv6.c\n in the Linux kernel mishandled inheritance, which allowed local users to\n cause a denial of service or possibly have unspecified other impact via\n crafted system calls, a related issue to CVE-2017-8890 (bnc#1039885).\n - CVE-2017-9077: The tcp_v6_syn_recv_sock function in net/ipv6/tcp_ipv6.c\n in the Linux kernel mishandled inheritance, which allowed local users to\n cause a denial of service or possibly have unspecified other impact via\n crafted system calls, a related issue to CVE-2017-8890 (bsc#1040069).\n - CVE-2017-9242: The __ip6_append_data function in net/ipv6/ip6_output.c\n in the Linux kernel was too late in checking whether an overwrite of an\n skb data structure may occur, which allowed local users to cause a\n denial of service (system crash) via crafted system calls (bnc#1041431).\n - CVE-2017-10661: Race condition in fs/timerfd.c in the Linux kernel\n allowed local users to gain privileges or cause a denial of service\n (list corruption or use-after-free) via simultaneous file-descriptor\n operations that leverage improper might_cancel queueing (bnc#1053152).\n - CVE-2017-11176: The mq_notify function in the Linux kernel did not set\n the sock pointer to NULL upon entry into the retry logic. During a\n user-space close of a Netlink socket, it allowed attackers to cause a\n denial of service (use-after-free) or possibly have unspecified other\n impact (bnc#1048275).\n - CVE-2017-11473: Buffer overflow in the mp_override_legacy_irq() function\n in arch/x86/kernel/acpi/boot.c in the Linux kernel allowed local users\n to gain privileges via a crafted ACPI table (bnc#1049603).\n - CVE-2017-12762: In /drivers/isdn/i4l/isdn_net.c: A user-controlled\n buffer is copied into a local buffer of constant size using strcpy\n without a length check which can cause a buffer overflow. (bnc#1053148).\n - CVE-2017-14051: An integer overflow in the\n qla2x00_sysfs_write_optrom_ctl function in\n drivers/scsi/qla2xxx/qla_attr.c in the Linux kernel allowed local users\n to cause a denial of service (memory corruption and system crash) by\n leveraging root access (bnc#1056588).\n - CVE-2017-1000112: Fixed a race condition in net-packet code that could\n have been exploited by unprivileged users to gain root access.\n (bsc#1052311).\n - CVE-2017-1000363: Linux drivers/char/lp.c Out-of-Bounds Write. Due to a\n missing bounds check, and the fact that parport_ptr integer is static, a\n 'secure boot' kernel command line adversary could have overflowed the\n parport_nr array in the following code (bnc#1039456).\n - CVE-2017-1000365: The Linux Kernel imposes a size restriction on the\n arguments and environmental strings passed through\n RLIMIT_STACK/RLIM_INFINITY (1/4 of the size), but did not take the\n argument and environment pointers into account, which allowed attackers\n to bypass this limitation (bnc#1039354).\n - CVE-2017-1000380: sound/core/timer.c in the Linux kernel was vulnerable\n to a data race in the ALSA /dev/snd/timer driver resulting in local\n users being able to read information belonging to other users, i.e.,\n uninitialized memory contents may be disclosed when a read and an ioctl\n happen at the same time (bnc#1044125).\n\n The following non-security bugs were fixed:\n\n - acpi: Disable APEI error injection if securelevel is set (bsc#972891,\n bsc#1023051).\n - blkback/blktap: do not leak stack data via response ring (bsc#1042863\n XSA-216).\n - btrfs: cleanup code of btrfs_balance_delayed_items() (bsc#1034838).\n - btrfs: do not run delayed nodes again after all nodes flush\n (bsc#1034838).\n - btrfs: remove btrfs_end_transaction_dmeta() (bsc#1034838).\n - btrfs: remove residual code in delayed inode async helper (bsc#1034838).\n - btrfs: use flags instead of the bool variants in delayed node\n (bsc#1034838).\n - cifs: cifs_get_root shouldn't use path with tree name, alternate fix\n (bsc#963655, bsc#979681, bsc#1027406).\n - dentry name snapshots (bsc#1049483).\n - firmware: fix directory creation rule matching with make 3.80\n (bsc#1012422).\n - firmware: fix directory creation rule matching with make 3.82\n (bsc#1012422).\n - Fix vmalloc_fault oops during lazy MMU updates (bsc#948562) (bsc#948562).\n - hv: do not lose pending heartbeat vmbus packets (bnc#1006919,\n bnc#1053760).\n - jbd: do not wait (forever) for stale tid caused by wraparound\n (bsc#1020229).\n - jbd: Fix oops in journal_remove_journal_head() (bsc#1017143).\n - kernel-binary.spec: Propagate MAKE_ARGS to %build (bsc#1012422)\n - keys: Disallow keyrings beginning with '.' to be joined as session\n keyrings (bnc#1035576).\n - nfs: Avoid getting confused by confused server (bsc#1045416).\n - nfsd4: minor NFSv2/v3 write decoding cleanup (bsc#1034670).\n - nfsd: check for oversized NFSv2/v3 arguments (bsc#1034670).\n - nfsd: do not risk using duplicate owner/file/delegation ids\n (bsc#1029212).\n - nfsd: stricter decoding of write-like NFSv2/v3 ops (bsc#1034670).\n - nfs: Make nfs_readdir revalidate less often (bsc#1048232).\n - pciback: check PF instead of VF for PCI_COMMAND_MEMORY (bsc#957990).\n - pciback: only check PF if actually dealing with a VF (bsc#999245).\n - pciback: Save the number of MSI-X entries to be copied later\n (bsc#957988).\n - Remove superfluous make flags (bsc#1012422)\n - Return short read or 0 at end of a raw device, not EIO (bsc#1039594).\n - Revert "fs/cifs: fix wrongly prefixed path to root (bsc#963655,\n bsc#979681)\n - scsi: lpfc: avoid double free of resource identifiers (bsc#989896).\n - scsi: virtio_scsi: fix memory leak on full queue condition (bsc#1028880).\n - sunrpc: Clean up the slot table allocation (bsc#1013862).\n - sunrpc: Initalise the struct xprt upon allocation (bsc#1013862).\n - usb: serial: kl5kusb105: fix line-state error handling (bsc#1021256).\n - usb: wusbcore: fix NULL-deref at probe (bsc#1045487).\n - Use make --output-sync feature when available (bsc#1012422).\n - Use PF_LESS_THROTTLE in loop device thread (bsc#1027101).\n - xen/PCI-MSI: fix sysfs teardown in DomU (bsc#986924).\n\n", "cvss3": {}, "published": "2017-09-19T15:07:27", "type": "suse", "title": "Security update for the Linux Kernel (important)", "bulletinFamily": "unix", "cvss2": {}, "cvelist": ["CVE-2017-11176", "CVE-2017-14051", "CVE-2017-7261", "CVE-2017-7184", "CVE-2017-1000380", "CVE-2017-6074", "CVE-2017-7616", "CVE-2017-12762", "CVE-2017-9074", "CVE-2017-9242", "CVE-2017-5970", "CVE-2016-10200", "CVE-2017-8831", "CVE-2017-2671", "CVE-2017-11473", "CVE-2017-9075", "CVE-2017-7533", "CVE-2017-7294", "CVE-2017-6348", "CVE-2017-10661", "CVE-2017-8924", "CVE-2017-1000112", "CVE-2016-5243", "CVE-2017-6214", "CVE-2017-7482", "CVE-2017-7308", "CVE-2017-5669", "CVE-2017-6951", "CVE-2017-2647", "CVE-2017-8925", "CVE-2017-5986", "CVE-2017-6353", "CVE-2017-7487", "CVE-2017-9076", "CVE-2017-1000363", "CVE-2017-7187", "CVE-2017-9077", "CVE-2017-7542", "CVE-2017-1000365", "CVE-2017-8890"], "modified": "2017-09-19T15:07:27", "id": "SUSE-SU-2017:2525-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2017-09/msg00073.html", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-02-28T23:11:36", "description": "The SUSE Linux Enterprise 12 SP2 kernel was updated to 4.4.49 to receive\n various security and bugfixes.\n\n\n The following security bugs were fixed:\n\n - CVE-2016-7117: Use-after-free vulnerability in the __sys_recvmmsg\n function in net/socket.c in the Linux kernel allowed remote attackers to\n execute arbitrary code via vectors involving a recvmmsg system call that\n was mishandled during error processing (bnc#1003077).\n - CVE-2017-5576: Integer overflow in the vc4_get_bcl function in\n drivers/gpu/drm/vc4/vc4_gem.c in the VideoCore DRM driver in the Linux\n kernel allowed local users to cause a denial of service or possibly have\n unspecified\n other impact via a crafted size value in a VC4_SUBMIT_CL ioctl call\n (bnc#1021294).\n - CVE-2017-5577: The vc4_get_bcl function in drivers/gpu/drm/vc4/vc4_gem.c\n in the VideoCore DRM driver in the Linux kernel did not set an errno\n value upon certain overflow detections, which allowed local users to\n cause a denial of service (incorrect pointer dereference and OOPS) via\n inconsistent size values in a VC4_SUBMIT_CL ioctl call (bnc#1021294).\n - CVE-2017-5551: The simple_set_acl function in fs/posix_acl.c in the\n Linux kernel preserved the setgid bit during a setxattr call involving a\n tmpfs filesystem, which allowed local users to gain group privileges by\n leveraging the existence of a setgid program with restrictions on\n execute permissions. (bnc#1021258).\n - CVE-2017-2583: The load_segment_descriptor implementation in\n arch/x86/kvm/emulate.c in the Linux kernel improperly emulated a "MOV\n SS, NULL selector" instruction, which allowed guest OS users to cause a\n denial of service (guest OS crash) or gain guest OS privileges via a\n crafted application (bnc#1020602).\n - CVE-2017-2584: arch/x86/kvm/emulate.c in the Linux kernel allowed local\n users to obtain sensitive information from kernel memory or cause a\n denial of service (use-after-free) via a crafted application that\n leverages instruction emulation for fxrstor, fxsave, sgdt, and sidt\n (bnc#1019851).\n - CVE-2015-8709: kernel/ptrace.c in the Linux kernel mishandled uid and\n gid mappings, which allowed local users to gain privileges by\n establishing a user namespace, waiting for a root process to enter that\n namespace with an unsafe uid or gid, and then using the ptrace system\n call. NOTE: the vendor states "there is no kernel bug here"\n (bnc#1010933).\n - CVE-2016-9806: Race condition in the netlink_dump function in\n net/netlink/af_netlink.c in the Linux kernel allowed local users to\n cause a denial of service (double free) or possibly have unspecified\n other impact via a crafted application that made sendmsg system calls,\n leading to a free\n operation associated with a new dump that started earlier than\n anticipated (bnc#1013540).\n - CVE-2017-5897: fixed a bug in the Linux kernel IPv6 implementation which\n allowed remote attackers to trigger an out-of-bounds access, leading to\n a denial-of-service attack (bnc#1023762).\n - CVE-2017-5970: Fixed a possible denial-of-service that could have been\n triggered by sending bad IP options on a socket (bsc#1024938).\n - CVE-2017-5986: an application could have triggered a BUG_ON() in\n sctp_wait_for_sndbuf() if the socket TX buffer was full, a thread was\n waiting\n on it to queue more data, and meanwhile another thread peeled off the\n association being used by the first thread (bsc#1025235).\n\n The following non-security bugs were fixed:\n\n - 8250: fintek: rename IRQ_MODE macro (boo#1009546).\n - acpi: nfit, libnvdimm: fix / harden ars_status output length handling\n (bsc#1023175).\n - acpi: nfit: fix bus vs dimm confusion in xlat_status (bsc#1023175).\n - acpi: nfit: validate ars_status output buffer size (bsc#1023175).\n - arm64: numa: fix incorrect log for memory-less node (bsc#1019631).\n - asoc: cht_bsw_rt5645: Fix leftover kmalloc (bsc#1010690).\n - asoc: rt5670: add HS ground control (bsc#1016250).\n - bcache: Make gc wakeup sane, remove set_task_state() (bsc#1021260).\n - bcache: partition support: add 16 minors per bcacheN device\n (bsc#1019784).\n - blk-mq: Allow timeouts to run while queue is freezing (bsc#1020817).\n - blk-mq: Always schedule hctx->next_cpu (bsc#1020817).\n - blk-mq: Avoid memory reclaim when remapping queues (bsc#1020817).\n - blk-mq: Fix failed allocation path when mapping queues (bsc#1020817).\n - blk-mq: do not overwrite rq->mq_ctx (bsc#1020817).\n - blk-mq: improve warning for running a queue on the wrong CPU\n (bsc#1020817).\n - block: Change extern inline to static inline (bsc#1023175).\n - bluetooth: btmrvl: fix hung task warning dump (bsc#1018813).\n - bnx2x: Correct ringparam estimate when DOWN (bsc#1020214).\n - brcmfmac: Change error print on wlan0 existence (bsc#1000092).\n - btrfs: add support for RENAME_EXCHANGE and RENAME_WHITEOUT (bsc#1020975).\n - btrfs: bugfix: handle FS_IOC32_{GETFLAGS,SETFLAGS,GETVERSION} in\n btrfs_ioctl (bsc#1018100).\n - btrfs: fix btrfs_compat_ioctl failures on non-compat ioctls\n (bsc#1018100).\n - btrfs: fix inode leak on failure to setup whiteout inode in rename\n (bsc#1020975).\n - btrfs: fix lockdep warning about log_mutex (bsc#1021455).\n - btrfs: fix lockdep warning on deadlock against an inode's log mutex\n (bsc#1021455).\n - btrfs: fix number of transaction units for renames with whiteout\n (bsc#1020975).\n - btrfs: increment ctx->pos for every emitted or skipped dirent in readdir\n (bsc#981709).\n - btrfs: incremental send, fix invalid paths for rename operations\n (bsc#1018316).\n - btrfs: incremental send, fix premature rmdir operations (bsc#1018316).\n - btrfs: pin log earlier when renaming (bsc#1020975).\n - btrfs: pin logs earlier when doing a rename exchange operation\n (bsc#1020975).\n - btrfs: remove old tree_root dirent processing in btrfs_real_readdir()\n (bsc#981709).\n - btrfs: send, add missing error check for calls to path_loop()\n (bsc#1018316).\n - btrfs: send, avoid incorrect leaf accesses when sending utimes\n operations (bsc#1018316).\n - btrfs: send, fix failure to move directories with the same name around\n (bsc#1018316).\n - btrfs: send, fix invalid leaf accesses due to incorrect utimes\n operations (bsc#1018316).\n - btrfs: send, fix warning due to late freeing of orphan_dir_info\n structures (bsc#1018316).\n - btrfs: test_check_exists: Fix infinite loop when searching for free\n space entries (bsc#987192).\n - btrfs: unpin log if rename operation fails (bsc#1020975).\n - btrfs: unpin logs if rename exchange operation fails (bsc#1020975).\n - ceph: fix bad endianness handling in parse_reply_info_extra\n (bsc#1020488).\n - clk: xgene: Add PMD clock (bsc#1019351).\n - clk: xgene: Do not call __pa on ioremaped address (bsc#1019351).\n - clk: xgene: Remove CLK_IS_ROOT (bsc#1019351).\n - config: enable CONFIG_OCFS2_DEBUG_MASKLOG for ocfs2 (bsc#1015038)\n - config: enable Ceph kernel client modules for ppc64le\n - config: enable Ceph kernel client modules for s390x\n - crypto: FIPS - allow tests to be disabled in FIPS mode (bsc#1018913).\n - crypto: drbg - do not call drbg_instantiate in healt test (bsc#1018913).\n - crypto: drbg - remove FIPS 140-2 continuous test (bsc#1018913).\n - crypto: qat - fix bar discovery for c62x (bsc#1021251).\n - crypto: qat - zero esram only for DH85x devices (bsc#1021248).\n - crypto: rsa - allow keys >= 2048 bits in FIPS mode (bsc#1018913).\n - crypto: xts - consolidate sanity check for keys (bsc#1018913).\n - crypto: xts - fix compile errors (bsc#1018913).\n - cxl: fix potential NULL dereference in free_adapter() (bsc#1016517).\n - dax: fix deadlock with DAX 4k holes (bsc#1012829).\n - dax: fix device-dax region base (bsc#1023175).\n - device-dax: check devm_nsio_enable() return value (bsc#1023175).\n - device-dax: fail all private mapping attempts (bsc#1023175).\n - device-dax: fix percpu_ref_exit ordering (bsc#1023175).\n - driver core: fix race between creating/querying glue dir and its cleanup\n (bnc#1008742).\n - drivers: hv: Introduce a policy for controlling channel affinity.\n - drivers: hv: balloon: Add logging for dynamic memory operations.\n - drivers: hv: balloon: Disable hot add when CONFIG_MEMORY_HOTPLUG is not\n set.\n - drivers: hv: balloon: Fix info request to show max page count.\n - drivers: hv: balloon: Use available memory value in pressure report.\n - drivers: hv: balloon: account for gaps in hot add regions.\n - drivers: hv: balloon: keep track of where ha_region starts.\n - drivers: hv: balloon: replace ha_region_mutex with spinlock.\n - drivers: hv: cleanup vmbus_open() for wrap around mappings.\n - drivers: hv: do not leak memory in vmbus_establish_gpadl().\n - drivers: hv: get rid of id in struct vmbus_channel.\n - drivers: hv: get rid of redundant messagecount in create_gpadl_header().\n - drivers: hv: get rid of timeout in vmbus_open().\n - drivers: hv: make VMBus bus ids persistent.\n - drivers: hv: ring_buffer: count on wrap around mappings in\n get_next_pkt_raw() (v2).\n - drivers: hv: ring_buffer: use wrap around mappings in hv_copy{from,\n to}_ringbuffer().\n - drivers: hv: ring_buffer: wrap around mappings for ring buffers.\n - drivers: hv: utils: Check VSS daemon is listening before a hot backup.\n - drivers: hv: utils: Continue to poll VSS channel after handling requests.\n - drivers: hv: utils: Fix the mapping between host version and protocol to\n use.\n - drivers: hv: utils: reduce HV_UTIL_NEGO_TIMEOUT timeout.\n - drivers: hv: vmbus: Base host signaling strictly on the ring state.\n - drivers: hv: vmbus: Enable explicit signaling policy for NIC channels.\n - drivers: hv: vmbus: Implement a mechanism to tag the channel for low\n latency.\n - drivers: hv: vmbus: Make mmio resource local.\n - drivers: hv: vmbus: On the read path cleanup the logic to interrupt the\n host.\n - drivers: hv: vmbus: On write cleanup the logic to interrupt the host.\n - drivers: hv: vmbus: Reduce the delay between retries in vmbus_post_msg().\n - drivers: hv: vmbus: finally fix hv_need_to_signal_on_read().\n - drivers: hv: vmbus: fix the race when querying and updating the percpu\n list.\n - drivers: hv: vmbus: suppress some "hv_vmbus: Unknown GUID" warnings.\n - drivers: hv: vss: Improve log messages.\n - drivers: hv: vss: Operation timeouts should match host expectation.\n - drivers: net: phy: mdio-xgene: Add hardware dependency (bsc#1019351).\n - drivers: net: phy: xgene: Fix 'remove' function (bsc#1019351).\n - drivers: net: xgene: Add change_mtu function (bsc#1019351).\n - drivers: net: xgene: Add flow control configuration (bsc#1019351).\n - drivers: net: xgene: Add flow control initialization (bsc#1019351).\n - drivers: net: xgene: Add helper function (bsc#1019351).\n - drivers: net: xgene: Add support for Jumbo frame (bsc#1019351).\n - drivers: net: xgene: Configure classifier with pagepool (bsc#1019351).\n - drivers: net: xgene: Fix MSS programming (bsc#1019351).\n - drivers: net: xgene: fix build after change_mtu function change\n (bsc#1019351).\n - drivers: net: xgene: fix: Coalescing values for v2 hardware\n (bsc#1019351).\n - drivers: net: xgene: fix: Disable coalescing on v1 hardware\n (bsc#1019351).\n - drivers: net: xgene: fix: RSS for non-TCP/UDP (bsc#1019351).\n - drivers: net: xgene: fix: Use GPIO to get link status (bsc#1019351).\n - drivers: net: xgene: uninitialized variable in\n xgene_enet_free_pagepool() (bsc#1019351).\n - drm: Delete previous two fixes for i915 (bsc#1019061). These upstream\n fixes brought some regressions, so better to revert for now.\n - drm: Disable\n patches.drivers/drm-i915-Exit-cherryview_irq_handler-after-one-pass The\n patch seems leading to the instability on Wyse box (bsc#1015367).\n - drm: Fix broken VT switch with video=1366x768 option (bsc#1018358).\n - drm: Use u64 for intermediate dotclock calculations (bnc#1006472).\n - drm: i915: Do not init hpd polling for vlv and chv from\n runtime_suspend() (bsc#1014120).\n - drm: i915: Fix PCODE polling during CDCLK change notification\n (bsc#1015367).\n - drm: i915: Fix watermarks for VLV/CHV (bsc#1011176).\n - drm: i915: Force VDD off on the new power seqeuencer before starting to\n use it (bsc#1009674).\n - drm: i915: Mark CPU cache as dirty when used for rendering (bsc#1015367).\n - drm: i915: Mark i915_hpd_poll_init_work as static (bsc#1014120).\n - drm: i915: Prevent PPS stealing from a normal DP port on VLV/CHV\n (bsc#1019061).\n - drm: i915: Prevent enabling hpd polling in late suspend (bsc#1014120).\n - drm: i915: Restore PPS HW state from the encoder resume hook\n (bsc#1019061).\n - drm: i915: Workaround for DP DPMS D3 on Dell monitor (bsc#1019061).\n - drm: vc4: Fix an integer overflow in temporary allocation layout\n (bsc#1021294).\n - drm: vc4: Return -EINVAL on the overflow checks failing (bsc#1021294).\n - drm: virtio-gpu: get the fb from the plane state for atomic updates\n (bsc#1023101).\n - edac: xgene: Fix spelling mistake in error messages (bsc#1019351).\n - efi: libstub: Move Graphics Output Protocol handling to generic code\n (bnc#974215).\n - fbcon: Fix vc attr at deinit (bsc#1000619).\n - fs: nfs: avoid including "mountproto=" with no protocol in /proc/mounts\n (bsc#1019260).\n - gpio: xgene: make explicitly non-modular (bsc#1019351).\n - hv: acquire vmbus_connection.channel_mutex in vmbus_free_channels().\n - hv: change clockevents unbind tactics.\n - hv: do not reset hv_context.tsc_page on crash.\n - hv_netvsc: Add handler for physical link speed change.\n - hv_netvsc: Add query for initial physical link speed.\n - hv_netvsc: Implement batching of receive completions.\n - hv_netvsc: Revert "make inline functions static".\n - hv_netvsc: Revert "report vmbus name in ethtool".\n - hv_netvsc: add ethtool statistics for tx packet issues.\n - hv_netvsc: count multicast packets received.\n - hv_netvsc: dev hold/put reference to VF.\n - hv_netvsc: fix a race between netvsc_send() and netvsc_init_buf().\n - hv_netvsc: fix comments.\n - hv_netvsc: fix rtnl locking in callback.\n - hv_netvsc: improve VF device matching.\n - hv_netvsc: init completion during alloc.\n - hv_netvsc: make RSS hash key static.\n - hv_netvsc: make device_remove void.\n - hv_netvsc: make inline functions static.\n - hv_netvsc: make netvsc_destroy_buf void.\n - hv_netvsc: make variable local.\n - hv_netvsc: rearrange start_xmit.\n - hv_netvsc: refactor completion function.\n - hv_netvsc: remove VF in flight counters.\n - hv_netvsc: remove excessive logging on MTU change.\n - hv_netvsc: report vmbus name in ethtool.\n - hv_netvsc: simplify callback event code.\n - hv_netvsc: style cleanups.\n - hv_netvsc: use ARRAY_SIZE() for NDIS versions.\n - hv_netvsc: use RCU to protect vf_netdev.\n - hv_netvsc: use consume_skb.\n - hv_netvsc: use kcalloc.\n - hyperv: Fix spelling of HV_UNKOWN.\n - i2c: designware-baytrail: Disallow the CPU to enter C6 or C7 while\n holding the punit semaphore (bsc#1011913).\n - i2c: designware: Implement support for SMBus block read and write\n (bsc#1019351).\n - i2c: designware: fix wrong Tx/Rx FIFO for ACPI (bsc#1019351).\n - i2c: xgene: Fix missing code of DTB support (bsc#1019351).\n - i40e: Be much more verbose about what we can and cannot offload\n (bsc#985561).\n - ibmveth: calculate gso_segs for large packets (bsc#1019148).\n - ibmveth: check return of skb_linearize in ibmveth_start_xmit\n (bsc#1019148).\n - ibmveth: consolidate kmalloc of array, memset 0 to kcalloc (bsc#1019148).\n - ibmveth: set correct gso_size and gso_type (bsc#1019148).\n - igb: Workaround for igb i210 firmware issue (bsc#1009911).\n - igb: add i211 to i210 PHY workaround (bsc#1009911).\n - input: i8042: Trust firmware a bit more when probing on X86\n (bsc#1011660).\n - intel_idle: Add KBL support (bsc#1016884).\n - ip6_gre: fix ip6gre_err() invalid reads (CVE-2017-5897, bsc#1023762).\n - ipc: msg, make msgrcv work with LONG_MIN (bnc#1005918).\n - iwlwifi: Expose the default fallback ucode API to module info\n (boo#1021082, boo#1023884).\n - kgraft: iscsi-target: Do not block kGraft in iscsi_np kthread\n (bsc#1010612).\n - kgraft: xen: Do not block kGraft in xenbus kthread (bsc#1017410).\n - libnvdimm: pfn: fix align attribute (bsc#1023175).\n - mailbox: xgene-slimpro: Fix wrong test for devm_kzalloc (bsc#1019351).\n - md linear: fix a race between linear_add() and linear_congested()\n (bsc#1018446).\n - md-cluster: convert the completion to wait queue.\n - md-cluster: protect md_find_rdev_nr_rcu with rcu lock.\n - md: ensure md devices are freed before module is unloaded (bsc#1022304).\n - md: fix refcount problem on mddev when stopping array (bsc#1022304).\n - misc: genwqe: ensure zero initialization.\n - mm: do not loop on GFP_REPEAT high order requests if there is no reclaim\n progress (bnc#1013000).\n - mm: memcg: do not retry precharge charges (bnc#1022559).\n - mm: page_alloc: fix check for NULL preferred_zone (bnc#971975 VM\n performance -- page allocator).\n - mm: page_alloc: fix fast-path race with cpuset update or removal\n (bnc#971975 VM performance -- page allocator).\n - mm: page_alloc: fix premature OOM when racing with cpuset mems update\n (bnc#971975 VM performance -- page allocator).\n - mm: page_alloc: keep pcp count and list contents in sync if struct page\n is corrupted (bnc#971975 VM performance -- page allocator).\n - mm: page_alloc: move cpuset seqcount checking to slowpath (bnc#971975 VM\n performance -- page allocator).\n - mmc: sdhci-of-arasan: Remove no-hispd and no-cmd23 quirks for\n sdhci-arasan4.9a (bsc#1019351).\n - mwifiex: add missing check for PCIe8997 chipset (bsc#1018813).\n - mwifiex: fix IBSS data path issue (bsc#1018813).\n - mwifiex: fix PCIe register information for 8997 chipset (bsc#1018813).\n - net: af_iucv: do not use paged skbs for TX on HiperSockets (bnc#1020945,\n LTC#150566).\n - net: ethernet: apm: xgene: use phydev from struct net_device\n (bsc#1019351).\n - net: ethtool: Initialize buffer when querying device channel settings\n (bsc#969479).\n - net: hyperv: avoid uninitialized variable.\n - net: implement netif_cond_dbg macro (bsc#1019168).\n - net: remove useless memset's in drivers get_stats64 (bsc#1019351).\n - net: xgene: avoid bogus maybe-uninitialized warning (bsc#1019351).\n - net: xgene: fix backward compatibility fix (bsc#1019351).\n - net: xgene: fix error handling during reset (bsc#1019351).\n - net: xgene: move xgene_cle_ptree_ewdn data off stack (bsc#1019351).\n - netvsc: Remove mistaken udp.h inclusion.\n - netvsc: add rcu_read locking to netvsc callback.\n - netvsc: fix checksum on UDP IPV6.\n - netvsc: reduce maximum GSO size.\n - nfit: fail DSMs that return non-zero status by default (bsc#1023175).\n - nfsv4: Cap the transport reconnection timer at 1/2 lease period\n (bsc#1014410).\n - nfsv4: Cleanup the setting of the nfs4 lease period (bsc#1014410).\n - nvdimm: kabi protect nd_cmd_out_size() (bsc#1023175).\n - nvme: apply DELAY_BEFORE_CHK_RDY quirk at probe time too (bsc#1020685).\n - ocfs2: fix deadlock on mmapped page in ocfs2_write_begin_nolock()\n (bnc#921494).\n - pci: Add devm_request_pci_bus_resources() (bsc#1019351).\n - pci: generic: Fix pci_remap_iospace() failure path (bsc#1019630).\n - pci: hv: Allocate physically contiguous hypercall params buffer.\n - pci: hv: Fix hv_pci_remove() for hot-remove.\n - pci: hv: Handle hv_pci_generic_compl() error case.\n - pci: hv: Handle vmbus_sendpacket() failure in hv_compose_msi_msg().\n - pci: hv: Make unnecessarily global IRQ masking functions static.\n - pci: hv: Remove the unused 'wrk' in struct hv_pcibus_device.\n - pci: hv: Use list_move_tail() instead of list_del() + list_add_tail().\n - pci: hv: Use pci_function_description in struct definitions.\n - pci: hv: Use the correct buffer size in new_pcichild_device().\n - pci: hv: Use zero-length array in struct pci_packet.\n - pci: include header file (bsc#964944).\n - pci: xgene: Add local struct device pointers (bsc#1019351).\n - pci: xgene: Add register accessors (bsc#1019351).\n - pci: xgene: Free bridge resource list on failure (bsc#1019351).\n - pci: xgene: Make explicitly non-modular (bsc#1019351).\n - pci: xgene: Pass struct xgene_pcie_port to setup functions (bsc#1019351).\n - pci: xgene: Remove unused platform data (bsc#1019351).\n - pci: xgene: Request host bridge window resources (bsc#1019351).\n - perf: xgene: Remove bogus IS_ERR() check (bsc#1019351).\n - phy: xgene: rename "enum phy_mode" to "enum xgene_phy_mode"\n (bsc#1019351).\n - power: reset: xgene-reboot: Unmap region obtained by of_iomap\n (bsc#1019351).\n - powerpc: fadump: Fix the race in crash_fadump() (bsc#1022971).\n - qeth: check not more than 16 SBALEs on the completion queue\n (bnc#1009718, LTC#148203).\n - raid1: Fix a regression observed during the rebuilding of degraded\n MDRAID VDs (bsc#1020048).\n - raid1: ignore discard error (bsc#1017164).\n - reiserfs: fix race in prealloc discard (bsc#987576).\n - rpm: kernel-binary.spec.in: Export a make-stderr.log file (bsc#1012422)\n - rpm: kernel-binary.spec.in: Fix installation of /etc/uefi/certs\n (bsc#1019594)\n - rtc: cmos: Clear ACPI-driven alarms upon resume (bsc#1022429).\n - rtc: cmos: Do not enable interrupts in the middle of the interrupt\n handler (bsc#1022429).\n - rtc: cmos: Restore alarm after resume (bsc#1022429).\n - rtc: cmos: avoid unused function warning (bsc#1022429).\n - s390: Fix invalid domain response handling (bnc#1009718).\n - s390: cpuinfo: show maximum thread id (bnc#1009718, LTC#148580).\n - s390: sysinfo: show partition extended name and UUID if available\n (bnc#1009718, LTC#150160).\n - s390: time: LPAR offset handling (bnc#1009718, LTC#146920).\n - s390: time: move PTFF definitions (bnc#1009718, LTC#146920).\n - sched: Allow hotplug notifiers to be setup early (bnc#1022476).\n - sched: Make wake_up_nohz_cpu() handle CPUs going offline (bnc#1022476).\n - sched: core, x86/topology: Fix NUMA in package topology bug\n (bnc#1022476).\n - sched: core: Fix incorrect utilization accounting when switching to fair\n class (bnc#1022476).\n - sched: core: Fix set_user_nice() (bnc#1022476).\n - sched: cputime: Add steal time support to full dynticks CPU time\n accounting (bnc#1022476).\n - sched: cputime: Fix prev steal time accouting during CPU hotplug\n (bnc#1022476).\n - sched: deadline: Always calculate end of period on sched_yield()\n (bnc#1022476).\n - sched: deadline: Fix a bug in dl_overflow() (bnc#1022476).\n - sched: deadline: Fix lock pinning warning during CPU hotplug\n (bnc#1022476).\n - sched: deadline: Fix wrap-around in DL heap (bnc#1022476).\n - sched: fair: Avoid using decay_load_missed() with a negative value\n (bnc#1022476).\n - sched: fair: Fix fixed point arithmetic width for shares and effective\n load (bnc#1022476).\n - sched: fair: Fix load_above_capacity fixed point arithmetic width\n (bnc#1022476).\n - sched: fair: Fix min_vruntime tracking (bnc#1022476).\n - sched: fair: Fix the wrong throttled clock time for cfs_rq_clock_task()\n (bnc#1022476).\n - sched: fair: Improve PELT stuff some more (bnc#1022476).\n - sched: rt, sched/dl: Do not push if task's scheduling class was changed\n (bnc#1022476).\n - sched: rt: Fix PI handling vs. sched_setscheduler() (bnc#1022476).\n - sched: rt: Kick RT bandwidth timer immediately on start up (bnc#1022476).\n - scsi: Add 'AIX VDASD' to blacklist (bsc#1006469).\n - scsi: Modify HITACHI OPEN-V blacklist entry (bsc#1006469).\n - scsi: bfa: Increase requested firmware version to 3.2.5.1 (bsc#1013273).\n - scsi: storvsc: Payload buffer incorrectly sized for 32 bit kernels.\n - scsi_dh_alua: uninitialized variable in alua_rtpg() (bsc#1012910).\n - sctp: avoid BUG_ON on sctp_wait_for_sndbuf (CVE-2017-5986, bsc#1025235).\n - sd: always scan VPD pages if thin provisioning is enabled (bsc#1013792).\n - serial: 8250: Integrate Fintek into 8250_base (boo#1016979). Update\n config files to change CONFIG_SERIAL_8250_FINTEK to boolean accordingly,\n too. Also, the corresponding entry got removed from supported.conf.\n - serial: 8250_fintek: fix the mismatched IRQ mode (boo#1009546).\n - serial: Update metadata for serial fixes (bsc#1013001)\n - ses: Fix SAS device detection in enclosure (bsc#1016403).\n - sfc: reduce severity of PIO buffer alloc failures (bsc#1019168).\n - sfc: refactor debug-or-warnings printks (bsc#1019168).\n - sunrpc: Fix reconnection timeouts (bsc#1014410).\n - sunrpc: Limit the reconnect backoff timer to the max RPC message timeout\n (bsc#1014410).\n - supported.conf: Support Marvell WiFi/BT SDIO and pinctrl-cherrytrail\n (bsc#1018813)\n - supported.conf: delete xilinx/ll_temac (bsc#1011602)\n - target: add XCOPY target/segment desc sense codes (bsc#991273).\n - target: bounds check XCOPY segment descriptor list (bsc#991273).\n - target: bounds check XCOPY total descriptor list length (bsc#991273).\n - target: check XCOPY segment descriptor CSCD IDs (bsc#1017170).\n - target: check for XCOPY parameter truncation (bsc#991273).\n - target: return UNSUPPORTED TARGET/SEGMENT DESC TYPE CODE sense\n (bsc#991273).\n - target: simplify XCOPY wwn->se_dev lookup helper (bsc#991273).\n - target: support XCOPY requests without parameters (bsc#991273).\n - target: use XCOPY TOO MANY TARGET DESCRIPTORS sense (bsc#991273).\n - target: use XCOPY segment descriptor CSCD IDs (bsc#1017170).\n - tools: hv: Enable network manager for bonding scripts on RHEL.\n - tools: hv: fix a compile warning in snprintf.\n - tools: hv: kvp: configurable external scripts path.\n - tools: hv: kvp: ensure kvp device fd is closed on exec.\n - tools: hv: remove unnecessary header files and netlink related code.\n - tools: hv: remove unnecessary link flag.\n - tty: n_hdlc, fix lockdep false positive (bnc#1015840).\n - uvcvideo: uvc_scan_fallback() for webcams with broken chain\n (bsc#1021474).\n - vmbus: make sysfs names consistent with PCI.\n - x86: MCE: Dump MCE to dmesg if no consumers (bsc#1013994).\n - x86: hyperv: Handle unknown NMIs on one CPU when unknown_nmi_panic.\n - xfs: don't allow di_size with high bit set (bsc#1024234).\n - xfs: exclude never-released buffers from buftarg I/O accounting\n (bsc#1024508).\n - xfs: fix broken multi-fsb buffer logging (bsc#1024081).\n - xfs: fix buffer overflow dm_get_dirattrs/dm_get_dirattrs2 (bsc#989056).\n - xfs: fix up xfs_swap_extent_forks inline extent handling (bsc#1023888).\n - xfs: track and serialize in-flight async buffers against unmount\n (bsc#1024508).\n - xfs: track and serialize in-flight async buffers against unmount - kABI\n (bsc#1024508).\n\n", "cvss3": {}, "published": "2017-03-01T00:09:01", "type": "suse", "title": "Security update for the Linux Kernel (important)", "bulletinFamily": "unix", "cvss2": {}, "cvelist": ["CVE-2017-5576", "CVE-2016-9806", "CVE-2017-2584", "CVE-2016-7117", "CVE-2017-5577", "CVE-2017-5970", "CVE-2017-5551", "CVE-2017-2583", "CVE-2017-5986", "CVE-2015-8709", "CVE-2017-5897"], "modified": "2017-03-01T00:09:01", "id": "SUSE-SU-2017:0575-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00047.html", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "nessus": [{"lastseen": "2023-01-20T15:06:38", "description": "The SUSE Linux Enterprise 12 SP1 kernel was updated to 3.12.74 to receive various security and bugfixes. Notable new/improved features :\n\n - Improved support for Hyper-V\n\n - Support for the tcp_westwood TCP scheduling algorithm The following security bugs were fixed :\n\n - CVE-2017-8106: The handle_invept function in arch/x86/kvm/vmx.c in the Linux kernel allowed privileged KVM guest OS users to cause a denial of service (NULL pointer dereference and host OS crash) via a single-context INVEPT instruction with a NULL EPT pointer (bsc#1035877).\n\n - CVE-2017-6951: The keyring_search_aux function in security/keys/keyring.c in the Linux kernel allowed local users to cause a denial of service (NULL pointer dereference and OOPS) via a request_key system call for the 'dead' type. (bsc#1029850).\n\n - CVE-2017-2647: The KEYS subsystem in the Linux kernel allowed local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) via vectors involving a NULL value for a certain match field, related to the keyring_search_iterator function in keyring.c. (bsc#1030593)\n\n - CVE-2016-9604: This fixes handling of keyrings starting with '.' in KEYCTL_JOIN_SESSION_KEYRING, which could have allowed local users to manipulate privileged keyrings (bsc#1035576)\n\n - CVE-2017-7616: Incorrect error handling in the set_mempolicy and mbind compat syscalls in mm/mempolicy.c in the Linux kernel allowed local users to obtain sensitive information from uninitialized stack data by triggering failure of a certain bitmap operation. (bnc#1033336).\n\n - CVE-2017-7645: The NFSv2/NFSv3 server in the nfsd subsystem in the Linux kernel allowed remote attackers to cause a denial of service (system crash) via a long RPC reply, related to net/sunrpc/svc.c, fs/nfsd/nfs3xdr.c, and fs/nfsd/nfsxdr.c. (bsc#1034670).\n\n - CVE-2017-7308: The packet_set_ring function in net/packet/af_packet.c in the Linux kernel did not properly validate certain block-size data, which allowed local users to cause a denial of service (overflow) or possibly have unspecified other impact via crafted system calls (bnc#1031579)\n\n - CVE-2017-2671: The ping_unhash function in net/ipv4/ping.c in the Linux kernel was too late in obtaining a certain lock and consequently could not ensure that disconnect function calls are safe, which allowed local users to cause a denial of service (panic) by leveraging access to the protocol value of IPPROTO_ICMP in a socket system call (bnc#1031003)\n\n - CVE-2017-7294: The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not validate addition of certain levels data, which allowed local users to trigger an integer overflow and out-of-bounds write, and cause a denial of service (system hang or crash) or possibly gain privileges, via a crafted ioctl call for a /dev/dri/renderD* device (bnc#1031440)\n\n - CVE-2017-7261: The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not check for a zero value of certain levels data, which allowed local users to cause a denial of service (ZERO_SIZE_PTR dereference, and GPF and possibly panic) via a crafted ioctl call for a /dev/dri/renderD* device (bnc#1031052)\n\n - CVE-2017-7187: The sg_ioctl function in drivers/scsi/sg.c in the Linux kernel allowed local users to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a large command size in an SG_NEXT_CMD_LEN ioctl call, leading to out-of-bounds write access in the sg_write function (bnc#1030213)\n\n - CVE-2016-9588: arch/x86/kvm/vmx.c in the Linux kernel mismanaged the #BP and #OF exceptions, which allowed guest OS users to cause a denial of service (guest OS crash) by declining to handle an exception thrown by an L2 guest (bsc#1015703).\n\n - CVE-2017-5669: The do_shmat function in ipc/shm.c in the Linux kernel did not restrict the address calculated by a certain rounding operation, which allowed local users to map page zero, and consequently bypass a protection mechanism that exists for the mmap system call, by making crafted shmget and shmat system calls in a privileged context (bnc#1026914).\n\n - CVE-2016-10200: Race condition in the L2TPv3 IP Encapsulation feature in the Linux kernel allowed local users to gain privileges or cause a denial of service (use-after-free) by making multiple bind system calls without properly ascertaining whether a socket has the SOCK_ZAPPED status, related to net/l2tp/l2tp_ip.c and net/l2tp/l2tp_ip6.c (bnc#1028415)\n\n - CVE-2016-10208: The ext4_fill_super function in fs/ext4/super.c in the Linux kernel did not properly validate meta block groups, which allowed physically proximate attackers to cause a denial of service (out-of-bounds read and system crash) via a crafted ext4 image (bnc#1023377).\n\n - CVE-2017-5897: The ip6gre_err function in net/ipv6/ip6_gre.c in the Linux kernel allowed remote attackers to have unspecified impact via vectors involving GRE flags in an IPv6 packet, which trigger an out-of-bounds access (bsc#1023762).\n\n - CVE-2017-5986: A race condition in the sctp_wait_for_sndbuf function in net/sctp/socket.c in the Linux kernel allowed local users to cause a denial of service (assertion failure and panic) via a multithreaded application that peels off an association in a certain buffer-full state (bsc#1025235).\n\n - CVE-2017-6074: The dccp_rcv_state_process function in net/dccp/input.c in the Linux kernel mishandled DCCP_PKT_REQUEST packet data structures in the LISTEN state, which allowed local users to obtain root privileges or cause a denial of service (double free) via an application that made an IPV6_RECVPKTINFO setsockopt system call (bnc#1026024)\n\n - CVE-2016-9191: The cgroup offline implementation in the Linux kernel mishandled certain drain operations, which allowed local users to cause a denial of service (system hang) by leveraging access to a container environment for executing a crafted application (bnc#1008842)\n\n - CVE-2017-6348: The hashbin_delete function in net/irda/irqueue.c in the Linux kernel improperly managed lock dropping, which allowed local users to cause a denial of service (deadlock) via crafted operations on IrDA devices (bnc#1027178).\n\n - CVE-2016-10044: The aio_mount function in fs/aio.c in the Linux kernel did not properly restrict execute access, which made it easier for local users to bypass intended SELinux W^X policy restrictions, and consequently gain privileges, via an io_setup system call (bnc#1023992).\n\n - CVE-2016-3070: The trace_writeback_dirty_page implementation in include/trace/events/writeback.h in the Linux kernel improperly interacts with mm/migrate.c, which allowed local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by triggering a certain page move (bnc#979215).\n\n - CVE-2016-5243: The tipc_nl_compat_link_dump function in net/tipc/netlink_compat.c in the Linux kernel did not properly copy a certain string, which allowed local users to obtain sensitive information from kernel stack memory by reading a Netlink message (bnc#983212).\n\n - CVE-2017-6345: The LLC subsystem in the Linux kernel did not ensure that a certain destructor exists in required circumstances, which allowed local users to cause a denial of service (BUG_ON) or possibly have unspecified other impact via crafted system calls (bnc#1027190)\n\n - CVE-2017-6346: Race condition in net/packet/af_packet.c in the Linux kernel allowed local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via a multithreaded application that made PACKET_FANOUT setsockopt system calls (bnc#1027189)\n\n - CVE-2017-6353: net/sctp/socket.c in the Linux kernel did not properly restrict association peel-off operations during certain wait states, which allowed local users to cause a denial of service (invalid unlock and double free) via a multithreaded application. NOTE: this vulnerability exists because of an incorrect fix for CVE-2017-5986 (bnc#1027066)\n\n - CVE-2017-5986: Race condition in the sctp_wait_for_sndbuf function in net/sctp/socket.c in the Linux kernel allowed local users to cause a denial of service (assertion failure and panic) via a multithreaded application that peels off an association in a certain buffer-full state (bsc#1025235).\n\n - CVE-2017-6214: The tcp_splice_read function in net/ipv4/tcp.c in the Linux kernel allowed remote attackers to cause a denial of service (infinite loop and soft lockup) via vectors involving a TCP packet with the URG flag (bnc#1026722)\n\n - CVE-2016-2117: The atl2_probe function in drivers/net/ethernet/atheros/atlx/atl2.c in the Linux kernel incorrectly enables scatter/gather I/O, which allowed remote attackers to obtain sensitive information from kernel memory by reading packet data (bnc#968697)\n\n - CVE-2015-1350: The VFS subsystem in the Linux kernel provided an incomplete set of requirements for setattr operations that underspecifies removing extended privilege attributes, which allowed local users to cause a denial of service (capability stripping) via a failed invocation of a system call, as demonstrated by using chown to remove a capability from the ping or Wireshark dumpcap program (bsc#914939).\n\n - CVE-2016-7117: Use-after-free vulnerability in the\n __sys_recvmmsg function in net/socket.c in the Linux kernel allowed remote attackers to execute arbitrary code via vectors involving a recvmmsg system call that is mishandled during error processing (bsc#1003077).\n\nThe update package also includes non-security fixes. See advisory for details.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2017-05-22T00:00:00", "type": "nessus", "title": "SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2017:1360-1)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-1350", "CVE-2016-10044", "CVE-2016-10200", "CVE-2016-10208", "CVE-2016-2117", "CVE-2016-3070", "CVE-2016-5243", "CVE-2016-7117", "CVE-2016-9191", "CVE-2016-9588", "CVE-2016-9604", "CVE-2017-2647", "CVE-2017-2671", "CVE-2017-5669", "CVE-2017-5897", "CVE-2017-5986", "CVE-2017-6074", "CVE-2017-6214", "CVE-2017-6345", "CVE-2017-6346", "CVE-2017-6348", "CVE-2017-6353", "CVE-2017-6951", "CVE-2017-7187", "CVE-2017-7261", "CVE-2017-7294", "CVE-2017-7308", "CVE-2017-7616", "CVE-2017-7645", "CVE-2017-8106"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:novell:suse_linux:kernel-default", "p-cpe:/a:novell:suse_linux:kernel-default-base", "p-cpe:/a:novell:suse_linux:kernel-default-base-debuginfo", "p-cpe:/a:novell:suse_linux:kernel-default-debuginfo", "p-cpe:/a:novell:suse_linux:kernel-default-debugsource", "p-cpe:/a:novell:suse_linux:kernel-default-devel", "p-cpe:/a:novell:suse_linux:kernel-default-extra", "p-cpe:/a:novell:suse_linux:kernel-default-extra-debuginfo", "p-cpe:/a:novell:suse_linux:kernel-default-man", "p-cpe:/a:novell:suse_linux:kernel-syms", "p-cpe:/a:novell:suse_linux:kernel-xen", "p-cpe:/a:novell:suse_linux:kernel-xen-base", "p-cpe:/a:novell:suse_linux:kernel-xen-base-debuginfo", "p-cpe:/a:novell:suse_linux:kernel-xen-debuginfo", "p-cpe:/a:novell:suse_linux:kernel-xen-debugsource", "p-cpe:/a:novell:suse_linux:kernel-xen-devel", "cpe:/o:novell:suse_linux:12"], "id": "SUSE_SU-2017-1360-1.NASL", "href": "https://www.tenable.com/plugins/nessus/100320", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2017:1360-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(100320);\n script_version(\"3.10\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2015-1350\", \"CVE-2016-10044\", \"CVE-2016-10200\", \"CVE-2016-10208\", \"CVE-2016-2117\", \"CVE-2016-3070\", \"CVE-2016-5243\", \"CVE-2016-7117\", \"CVE-2016-9191\", \"CVE-2016-9588\", \"CVE-2016-9604\", \"CVE-2017-2647\", \"CVE-2017-2671\", \"CVE-2017-5669\", \"CVE-2017-5897\", \"CVE-2017-5986\", \"CVE-2017-6074\", \"CVE-2017-6214\", \"CVE-2017-6345\", \"CVE-2017-6346\", \"CVE-2017-6348\", \"CVE-2017-6353\", \"CVE-2017-6951\", \"CVE-2017-7187\", \"CVE-2017-7261\", \"CVE-2017-7294\", \"CVE-2017-7308\", \"CVE-2017-7616\", \"CVE-2017-7645\", \"CVE-2017-8106\");\n\n script_name(english:\"SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2017:1360-1)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote SUSE host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The SUSE Linux Enterprise 12 SP1 kernel was updated to 3.12.74 to\nreceive various security and bugfixes. Notable new/improved features :\n\n - Improved support for Hyper-V\n\n - Support for the tcp_westwood TCP scheduling algorithm\n The following security bugs were fixed :\n\n - CVE-2017-8106: The handle_invept function in\n arch/x86/kvm/vmx.c in the Linux kernel allowed\n privileged KVM guest OS users to cause a denial of\n service (NULL pointer dereference and host OS crash) via\n a single-context INVEPT instruction with a NULL EPT\n pointer (bsc#1035877).\n\n - CVE-2017-6951: The keyring_search_aux function in\n security/keys/keyring.c in the Linux kernel allowed\n local users to cause a denial of service (NULL pointer\n dereference and OOPS) via a request_key system call for\n the 'dead' type. (bsc#1029850).\n\n - CVE-2017-2647: The KEYS subsystem in the Linux kernel\n allowed local users to gain privileges or cause a denial\n of service (NULL pointer dereference and system crash)\n via vectors involving a NULL value for a certain match\n field, related to the keyring_search_iterator function\n in keyring.c. (bsc#1030593)\n\n - CVE-2016-9604: This fixes handling of keyrings starting\n with '.' in KEYCTL_JOIN_SESSION_KEYRING, which could\n have allowed local users to manipulate privileged\n keyrings (bsc#1035576)\n\n - CVE-2017-7616: Incorrect error handling in the\n set_mempolicy and mbind compat syscalls in\n mm/mempolicy.c in the Linux kernel allowed local users\n to obtain sensitive information from uninitialized stack\n data by triggering failure of a certain bitmap\n operation. (bnc#1033336).\n\n - CVE-2017-7645: The NFSv2/NFSv3 server in the nfsd\n subsystem in the Linux kernel allowed remote attackers\n to cause a denial of service (system crash) via a long\n RPC reply, related to net/sunrpc/svc.c,\n fs/nfsd/nfs3xdr.c, and fs/nfsd/nfsxdr.c. (bsc#1034670).\n\n - CVE-2017-7308: The packet_set_ring function in\n net/packet/af_packet.c in the Linux kernel did not\n properly validate certain block-size data, which allowed\n local users to cause a denial of service (overflow) or\n possibly have unspecified other impact via crafted\n system calls (bnc#1031579)\n\n - CVE-2017-2671: The ping_unhash function in\n net/ipv4/ping.c in the Linux kernel was too late in\n obtaining a certain lock and consequently could not\n ensure that disconnect function calls are safe, which\n allowed local users to cause a denial of service (panic)\n by leveraging access to the protocol value of\n IPPROTO_ICMP in a socket system call (bnc#1031003)\n\n - CVE-2017-7294: The vmw_surface_define_ioctl function in\n drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux\n kernel did not validate addition of certain levels data,\n which allowed local users to trigger an integer overflow\n and out-of-bounds write, and cause a denial of service\n (system hang or crash) or possibly gain privileges, via\n a crafted ioctl call for a /dev/dri/renderD* device\n (bnc#1031440)\n\n - CVE-2017-7261: The vmw_surface_define_ioctl function in\n drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux\n kernel did not check for a zero value of certain levels\n data, which allowed local users to cause a denial of\n service (ZERO_SIZE_PTR dereference, and GPF and possibly\n panic) via a crafted ioctl call for a /dev/dri/renderD*\n device (bnc#1031052)\n\n - CVE-2017-7187: The sg_ioctl function in\n drivers/scsi/sg.c in the Linux kernel allowed local\n users to cause a denial of service (stack-based buffer\n overflow) or possibly have unspecified other impact via\n a large command size in an SG_NEXT_CMD_LEN ioctl call,\n leading to out-of-bounds write access in the sg_write\n function (bnc#1030213)\n\n - CVE-2016-9588: arch/x86/kvm/vmx.c in the Linux kernel\n mismanaged the #BP and #OF exceptions, which allowed\n guest OS users to cause a denial of service (guest OS\n crash) by declining to handle an exception thrown by an\n L2 guest (bsc#1015703).\n\n - CVE-2017-5669: The do_shmat function in ipc/shm.c in the\n Linux kernel did not restrict the address calculated by\n a certain rounding operation, which allowed local users\n to map page zero, and consequently bypass a protection\n mechanism that exists for the mmap system call, by\n making crafted shmget and shmat system calls in a\n privileged context (bnc#1026914).\n\n - CVE-2016-10200: Race condition in the L2TPv3 IP\n Encapsulation feature in the Linux kernel allowed local\n users to gain privileges or cause a denial of service\n (use-after-free) by making multiple bind system calls\n without properly ascertaining whether a socket has the\n SOCK_ZAPPED status, related to net/l2tp/l2tp_ip.c and\n net/l2tp/l2tp_ip6.c (bnc#1028415)\n\n - CVE-2016-10208: The ext4_fill_super function in\n fs/ext4/super.c in the Linux kernel did not properly\n validate meta block groups, which allowed physically\n proximate attackers to cause a denial of service\n (out-of-bounds read and system crash) via a crafted ext4\n image (bnc#1023377).\n\n - CVE-2017-5897: The ip6gre_err function in\n net/ipv6/ip6_gre.c in the Linux kernel allowed remote\n attackers to have unspecified impact via vectors\n involving GRE flags in an IPv6 packet, which trigger an\n out-of-bounds access (bsc#1023762).\n\n - CVE-2017-5986: A race condition in the\n sctp_wait_for_sndbuf function in net/sctp/socket.c in\n the Linux kernel allowed local users to cause a denial\n of service (assertion failure and panic) via a\n multithreaded application that peels off an association\n in a certain buffer-full state (bsc#1025235).\n\n - CVE-2017-6074: The dccp_rcv_state_process function in\n net/dccp/input.c in the Linux kernel mishandled\n DCCP_PKT_REQUEST packet data structures in the LISTEN\n state, which allowed local users to obtain root\n privileges or cause a denial of service (double free)\n via an application that made an IPV6_RECVPKTINFO\n setsockopt system call (bnc#1026024)\n\n - CVE-2016-9191: The cgroup offline implementation in the\n Linux kernel mishandled certain drain operations, which\n allowed local users to cause a denial of service (system\n hang) by leveraging access to a container environment\n for executing a crafted application (bnc#1008842)\n\n - CVE-2017-6348: The hashbin_delete function in\n net/irda/irqueue.c in the Linux kernel improperly\n managed lock dropping, which allowed local users to\n cause a denial of service (deadlock) via crafted\n operations on IrDA devices (bnc#1027178).\n\n - CVE-2016-10044: The aio_mount function in fs/aio.c in\n the Linux kernel did not properly restrict execute\n access, which made it easier for local users to bypass\n intended SELinux W^X policy restrictions, and\n consequently gain privileges, via an io_setup system\n call (bnc#1023992).\n\n - CVE-2016-3070: The trace_writeback_dirty_page\n implementation in include/trace/events/writeback.h in\n the Linux kernel improperly interacts with mm/migrate.c,\n which allowed local users to cause a denial of service\n (NULL pointer dereference and system crash) or possibly\n have unspecified other impact by triggering a certain\n page move (bnc#979215).\n\n - CVE-2016-5243: The tipc_nl_compat_link_dump function in\n net/tipc/netlink_compat.c in the Linux kernel did not\n properly copy a certain string, which allowed local\n users to obtain sensitive information from kernel stack\n memory by reading a Netlink message (bnc#983212).\n\n - CVE-2017-6345: The LLC subsystem in the Linux kernel did\n not ensure that a certain destructor exists in required\n circumstances, which allowed local users to cause a\n denial of service (BUG_ON) or possibly have unspecified\n other impact via crafted system calls (bnc#1027190)\n\n - CVE-2017-6346: Race condition in net/packet/af_packet.c\n in the Linux kernel allowed local users to cause a\n denial of service (use-after-free) or possibly have\n unspecified other impact via a multithreaded application\n that made PACKET_FANOUT setsockopt system calls\n (bnc#1027189)\n\n - CVE-2017-6353: net/sctp/socket.c in the Linux kernel did\n not properly restrict association peel-off operations\n during certain wait states, which allowed local users to\n cause a denial of service (invalid unlock and double\n free) via a multithreaded application. NOTE: this\n vulnerability exists because of an incorrect fix for\n CVE-2017-5986 (bnc#1027066)\n\n - CVE-2017-5986: Race condition in the\n sctp_wait_for_sndbuf function in net/sctp/socket.c in\n the Linux kernel allowed local users to cause a denial\n of service (assertion failure and panic) via a\n multithreaded application that peels off an association\n in a certain buffer-full state (bsc#1025235).\n\n - CVE-2017-6214: The tcp_splice_read function in\n net/ipv4/tcp.c in the Linux kernel allowed remote\n attackers to cause a denial of service (infinite loop\n and soft lockup) via vectors involving a TCP packet with\n the URG flag (bnc#1026722)\n\n - CVE-2016-2117: The atl2_probe function in\n drivers/net/ethernet/atheros/atlx/atl2.c in the Linux\n kernel incorrectly enables scatter/gather I/O, which\n allowed remote attackers to obtain sensitive information\n from kernel memory by reading packet data (bnc#968697)\n\n - CVE-2015-1350: The VFS subsystem in the Linux kernel\n provided an incomplete set of requirements for setattr\n operations that underspecifies removing extended\n privilege attributes, which allowed local users to cause\n a denial of service (capability stripping) via a failed\n invocation of a system call, as demonstrated by using\n chown to remove a capability from the ping or Wireshark\n dumpcap program (bsc#914939).\n\n - CVE-2016-7117: Use-after-free vulnerability in the\n __sys_recvmmsg function in net/socket.c in the Linux\n kernel allowed remote attackers to execute arbitrary\n code via vectors involving a recvmmsg system call that\n is mishandled during error processing (bsc#1003077).\n\nThe update package also includes non-security fixes. See advisory for\ndetails.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1003077\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1008842\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1009682\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1012620\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1012985\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1015703\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1015787\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1015821\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1017512\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1018100\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1018263\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1018419\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1018446\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1019168\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1019514\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1020048\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1020795\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1021256\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1021374\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1021762\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1021913\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1022559\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1022971\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1023164\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1023207\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1023377\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1023762\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1023824\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1023888\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1023992\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1024081\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1024234\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1024309\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1024508\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1024788\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1025039\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1025235\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1025354\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1025802\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1026024\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1026722\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1026914\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1027066\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1027178\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1027189\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1027190\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1027974\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1028041\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1028415\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1028595\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1028648\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1028895\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1029470\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1029850\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1029986\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1030118\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1030213\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1030593\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1030901\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1031003\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1031052\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1031080\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1031440\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1031567\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1031579\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1031662\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1031842\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1032125\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1032141\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1032344\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1032345\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1033336\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1034670\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=103470\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1034700\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1035576\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1035699\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1035738\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1035877\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1036752\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1038261\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=799133\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=857926\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=914939\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=917630\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=922853\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=930399\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=931620\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=937444\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=940946\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=954763\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=968697\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=970083\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=971933\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=979215\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=982783\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=983212\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=984530\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=985561\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=988065\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=989056\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=993832\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-1350/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-10044/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-10200/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-10208/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2117/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-3070/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-5243/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-7117/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-9191/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-9588/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-9604/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-2647/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-2671/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-5669/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-5897/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-5986/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-6074/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-6214/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-6345/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-6346/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-6348/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-6353/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-6951/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-7187/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-7261/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-7294/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-7308/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-7616/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-7645/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-8106/\"\n );\n # https://www.suse.com/support/update/announcement/2017/suse-su-20171360-1/\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?b505b515\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"To install this SUSE Security Update use YaST online_update.\nAlternatively you can run the command listed for your product :\n\nSUSE Linux Enterprise Workstation Extension 12-SP1:zypper in -t patch\nSUSE-SLE-WE-12-SP1-2017-831=1\n\nSUSE Linux Enterprise Software Development Kit 12-SP1:zypper in -t\npatch SUSE-SLE-SDK-12-SP1-2017-831=1\n\nSUSE Linux Enterprise Server 12-SP1:zypper in -t patch\nSUSE-SLE-SERVER-12-SP1-2017-831=1\n\nSUSE Linux Enterprise Module for Public Cloud 12:zypper in -t patch\nSUSE-SLE-Module-Public-Cloud-12-2017-831=1\n\nSUSE Linux Enterprise Live Patching 12:zypper in -t patch\nSUSE-SLE-Live-Patching-12-2017-831=1\n\nSUSE Linux Enterprise Desktop 12-SP1:zypper in -t patch\nSUSE-SLE-DESKTOP-12-SP1-2017-831=1\n\nTo bring your system up-to-date, use 'zypper patch'.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'AF_PACKET packet_set_ring Privilege Escalation');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-base\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-base-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-extra\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-extra-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-man\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-syms\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-xen\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-xen-base\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-xen-base-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-xen-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-xen-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-xen-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:12\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2016/05/02\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/05/19\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/05/22\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2017-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLED12|SLES12)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLED12 / SLES12\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES12\" && (! preg(pattern:\"^(1)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES12 SP1\", os_ver + \" SP\" + sp);\nif (os_ver == \"SLED12\" && (! preg(pattern:\"^(1)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLED12 SP1\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES12\", sp:\"1\", cpu:\"x86_64\", reference:\"kernel-xen-3.12.74-60.64.40.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", cpu:\"x86_64\", reference:\"kernel-xen-base-3.12.74-60.64.40.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", cpu:\"x86_64\", reference:\"kernel-xen-base-debuginfo-3.12.74-60.64.40.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", cpu:\"x86_64\", reference:\"kernel-xen-debuginfo-3.12.74-60.64.40.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", cpu:\"x86_64\", reference:\"kernel-xen-debugsource-3.12.74-60.64.40.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", cpu:\"x86_64\", reference:\"kernel-xen-devel-3.12.74-60.64.40.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", cpu:\"s390x\", reference:\"kernel-default-man-3.12.74-60.64.40.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"kernel-default-3.12.74-60.64.40.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"kernel-default-base-3.12.74-60.64.40.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"kernel-default-base-debuginfo-3.12.74-60.64.40.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"kernel-default-debuginfo-3.12.74-60.64.40.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"kernel-default-debugsource-3.12.74-60.64.40.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"kernel-default-devel-3.12.74-60.64.40.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"kernel-syms-3.12.74-60.64.40.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"1\", cpu:\"x86_64\", reference:\"kernel-default-3.12.74-60.64.40.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"1\", cpu:\"x86_64\", reference:\"kernel-default-debuginfo-3.12.74-60.64.40.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"1\", cpu:\"x86_64\", reference:\"kernel-default-debugsource-3.12.74-60.64.40.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"1\", cpu:\"x86_64\", reference:\"kernel-default-devel-3.12.74-60.64.40.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"1\", cpu:\"x86_64\", reference:\"kernel-default-extra-3.12.74-60.64.40.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"1\", cpu:\"x86_64\", reference:\"kernel-default-extra-debuginfo-3.12.74-60.64.40.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"1\", cpu:\"x86_64\", reference:\"kernel-syms-3.12.74-60.64.40.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"1\", cpu:\"x86_64\", reference:\"kernel-xen-3.12.74-60.64.40.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"1\", cpu:\"x86_64\", reference:\"kernel-xen-debuginfo-3.12.74-60.64.40.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"1\", cpu:\"x86_64\", reference:\"kernel-xen-debugsource-3.12.74-60.64.40.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"1\", cpu:\"x86_64\", reference:\"kernel-xen-devel-3.12.74-60.64.40.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kernel\");\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-18T14:14:46", "description": "The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes. Notable new features :\n\n - Toleration of newer crypto hardware for z Systems\n\n - USB 2.0 Link power management for Haswell-ULT The following security bugs were fixed :\n\n - CVE-2017-7308: The packet_set_ring function in net/packet/af_packet.c in the Linux kernel did not properly validate certain block-size data, which allowed local users to cause a denial of service (overflow) or possibly have unspecified other impact via crafted system calls (bnc#1031579)\n\n - CVE-2017-2671: The ping_unhash function in net/ipv4/ping.c in the Linux kernel was too late in obtaining a certain lock and consequently could not ensure that disconnect function calls are safe, which allowed local users to cause a denial of service (panic) by leveraging access to the protocol value of IPPROTO_ICMP in a socket system call (bnc#1031003)\n\n - CVE-2017-7184: The xfrm_replay_verify_len function in net/xfrm/xfrm_user.c in the Linux kernel did not validate certain size data after an XFRM_MSG_NEWAE update, which allowed local users to obtain root privileges or cause a denial of service (heap-based out-of-bounds access) by leveraging the CAP_NET_ADMIN capability (bsc#1030573).\n\n - CVE-2017-5970: The ipv4_pktinfo_prepare function in net/ipv4/ip_sockglue.c in the Linux kernel allowed attackers to cause a denial of service (system crash) via (1) an application that made crafted system calls or possibly (2) IPv4 traffic with invalid IP options (bsc#1024938).\n\n - CVE-2017-7616: Incorrect error handling in the set_mempolicy and mbind compat syscalls in mm/mempolicy.c in the Linux kernel allowed local users to obtain sensitive information from uninitialized stack data by triggering failure of a certain bitmap operation (bsc#1033336).\n\n - CVE-2017-7294: The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not validate addition of certain levels data, which allowed local users to trigger an integer overflow and out-of-bounds write, and cause a denial of service (system hang or crash) or possibly gain privileges, via a crafted ioctl call for a /dev/dri/renderD* device (bnc#1031440)\n\n - CVE-2017-7261: The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not check for a zero value of certain levels data, which allowed local users to cause a denial of service (ZERO_SIZE_PTR dereference, and GPF and possibly panic) via a crafted ioctl call for a /dev/dri/renderD* device (bnc#1031052)\n\n - CVE-2017-7187: The sg_ioctl function in drivers/scsi/sg.c in the Linux kernel allowed local users to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a large command size in an SG_NEXT_CMD_LEN ioctl call, leading to out-of-bounds write access in the sg_write function (bnc#1030213)\n\n - CVE-2017-6348: The hashbin_delete function in net/irda/irqueue.c in the Linux kernel improperly managed lock dropping, which allowed local users to cause a denial of service (deadlock) via crafted operations on IrDA devices (bnc#1027178)\n\n - CVE-2017-5669: The do_shmat function in ipc/shm.c in the Linux kernel did not restrict the address calculated by a certain rounding operation, which allowed local users to map page zero, and consequently bypass a protection mechanism that exists for the mmap system call, by making crafted shmget and shmat system calls in a privileged context (bnc#1026914)\n\n - CVE-2015-3288: mm/memory.c in the Linux kernel mishandled anonymous pages, which allowed local users to gain privileges or cause a denial of service (page tainting) via a crafted application that triggers writing to page zero (bsc#979021).\n\n - CVE-2016-10200: Race condition in the L2TPv3 IP Encapsulation feature in the Linux kernel allowed local users to gain privileges or cause a denial of service (use-after-free) by making multiple bind system calls without properly ascertaining whether a socket has the SOCK_ZAPPED status, related to net/l2tp/l2tp_ip.c and net/l2tp/l2tp_ip6.c (bnc#1028415)\n\n - CVE-2016-5243: The tipc_nl_compat_link_dump function in net/tipc/netlink_compat.c in the Linux kernel did not properly copy a certain string, which allowed local users to obtain sensitive information from kernel stack memory by reading a Netlink message (bnc#983212)\n\n - CVE-2017-6353: net/sctp/socket.c in the Linux kernel did not properly restrict association peel-off operations during certain wait states, which allowed local users to cause a denial of service (invalid unlock and double free) via a multithreaded application (bnc#1027066)\n\n - CVE-2017-6214: The tcp_splice_read function in net/ipv4/tcp.c in the Linux kernel allowed remote attackers to cause a denial of service (infinite loop and soft lockup) via vectors involving a TCP packet with the URG flag (bnc#1026722)\n\n - CVE-2017-6074: The dccp_rcv_state_process function in net/dccp/input.c in the Linux kernel mishandled DCCP_PKT_REQUEST packet data structures in the LISTEN state, which allowed local users to obtain root privileges or cause a denial of service (double free) via an application that made an IPV6_RECVPKTINFO setsockopt system call (bnc#1026024)\n\n - CVE-2017-5986: Race condition in the sctp_wait_for_sndbuf function in net/sctp/socket.c in the Linux kernel allowed local users to cause a denial of service (assertion failure and panic) via a multithreaded application that peels off an association in a certain buffer-full state (bsc#1025235)\n\n - CVE-2015-8970: crypto/algif_skcipher.c in the Linux kernel did not verify that a setkey operation has been performed on an AF_ALG socket an accept system call is processed, which allowed local users to cause a denial of service (NULL pointer dereference and system crash) via a crafted application that does not supply a key, related to the lrw_crypt function in crypto/lrw.c (bsc#1008374).\n\nThe update package also includes non-security fixes. See advisory for details.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2017-05-16T00:00:00", "type": "nessus", "title": "SUSE SLES11 Security Update : kernel (SUSE-SU-2017:1301-1)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-3288", "CVE-2015-8970", "CVE-2016-10200", "CVE-2016-5243", "CVE-2017-2671", "CVE-2017-5669", "CVE-2017-5970", "CVE-2017-5986", "CVE-2017-6074", "CVE-2017-6214", "CVE-2017-6348", "CVE-2017-6353", "CVE-2017-7184", "CVE-2017-7187", "CVE-2017-7261", "CVE-2017-7294", "CVE-2017-7308", "CVE-2017-7616"], "modified": "2021-01-19T00:00:00", "cpe": ["p-cpe:/a:novell:suse_linux:kernel-default", "p-cpe:/a:novell:suse_linux:kernel-default-base", "p-cpe:/a:novell:suse_linux:kernel-default-devel", "p-cpe:/a:novell:suse_linux:kernel-default-man", "p-cpe:/a:novell:suse_linux:kernel-ec2", "p-cpe:/a:novell:suse_linux:kernel-ec2-base", "p-cpe:/a:novell:suse_linux:kernel-ec2-devel", "p-cpe:/a:novell:suse_linux:kernel-pae", "p-cpe:/a:novell:suse_linux:kernel-pae-base", "p-cpe:/a:novell:suse_linux:kernel-pae-devel", "p-cpe:/a:novell:suse_linux:kernel-source", "p-cpe:/a:novell:suse_linux:kernel-syms", "p-cpe:/a:novell:suse_linux:kernel-trace", "p-cpe:/a:novell:suse_linux:kernel-trace-base", "p-cpe:/a:novell:suse_linux:kernel-trace-devel", "p-cpe:/a:novell:suse_linux:kernel-xen", "p-cpe:/a:novell:suse_linux:kernel-xen-base", "p-cpe:/a:novell:suse_linux:kernel-xen-devel", "cpe:/o:novell:suse_linux:11"], "id": "SUSE_SU-2017-1301-1.NASL", "href": "https://www.tenable.com/plugins/nessus/100214", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2017:1301-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(100214);\n script_version(\"3.12\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/19\");\n\n script_cve_id(\"CVE-2015-3288\", \"CVE-2015-8970\", \"CVE-2016-10200\", \"CVE-2016-5243\", \"CVE-2017-2671\", \"CVE-2017-5669\", \"CVE-2017-5970\", \"CVE-2017-5986\", \"CVE-2017-6074\", \"CVE-2017-6214\", \"CVE-2017-6348\", \"CVE-2017-6353\", \"CVE-2017-7184\", \"CVE-2017-7187\", \"CVE-2017-7261\", \"CVE-2017-7294\", \"CVE-2017-7308\", \"CVE-2017-7616\");\n\n script_name(english:\"SUSE SLES11 Security Update : kernel (SUSE-SU-2017:1301-1)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote SUSE host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various\nsecurity and bugfixes. Notable new features :\n\n - Toleration of newer crypto hardware for z Systems\n\n - USB 2.0 Link power management for Haswell-ULT The\n following security bugs were fixed :\n\n - CVE-2017-7308: The packet_set_ring function in\n net/packet/af_packet.c in the Linux kernel did not\n properly validate certain block-size data, which allowed\n local users to cause a denial of service (overflow) or\n possibly have unspecified other impact via crafted\n system calls (bnc#1031579)\n\n - CVE-2017-2671: The ping_unhash function in\n net/ipv4/ping.c in the Linux kernel was too late in\n obtaining a certain lock and consequently could not\n ensure that disconnect function calls are safe, which\n allowed local users to cause a denial of service (panic)\n by leveraging access to the protocol value of\n IPPROTO_ICMP in a socket system call (bnc#1031003)\n\n - CVE-2017-7184: The xfrm_replay_verify_len function in\n net/xfrm/xfrm_user.c in the Linux kernel did not\n validate certain size data after an XFRM_MSG_NEWAE\n update, which allowed local users to obtain root\n privileges or cause a denial of service (heap-based\n out-of-bounds access) by leveraging the CAP_NET_ADMIN\n capability (bsc#1030573).\n\n - CVE-2017-5970: The ipv4_pktinfo_prepare function in\n net/ipv4/ip_sockglue.c in the Linux kernel allowed\n attackers to cause a denial of service (system crash)\n via (1) an application that made crafted system calls or\n possibly (2) IPv4 traffic with invalid IP options\n (bsc#1024938).\n\n - CVE-2017-7616: Incorrect error handling in the\n set_mempolicy and mbind compat syscalls in\n mm/mempolicy.c in the Linux kernel allowed local users\n to obtain sensitive information from uninitialized stack\n data by triggering failure of a certain bitmap operation\n (bsc#1033336).\n\n - CVE-2017-7294: The vmw_surface_define_ioctl function in\n drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux\n kernel did not validate addition of certain levels data,\n which allowed local users to trigger an integer overflow\n and out-of-bounds write, and cause a denial of service\n (system hang or crash) or possibly gain privileges, via\n a crafted ioctl call for a /dev/dri/renderD* device\n (bnc#1031440)\n\n - CVE-2017-7261: The vmw_surface_define_ioctl function in\n drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux\n kernel did not check for a zero value of certain levels\n data, which allowed local users to cause a denial of\n service (ZERO_SIZE_PTR dereference, and GPF and possibly\n panic) via a crafted ioctl call for a /dev/dri/renderD*\n device (bnc#1031052)\n\n - CVE-2017-7187: The sg_ioctl function in\n drivers/scsi/sg.c in the Linux kernel allowed local\n users to cause a denial of service (stack-based buffer\n overflow) or possibly have unspecified other impact via\n a large command size in an SG_NEXT_CMD_LEN ioctl call,\n leading to out-of-bounds write access in the sg_write\n function (bnc#1030213)\n\n - CVE-2017-6348: The hashbin_delete function in\n net/irda/irqueue.c in the Linux kernel improperly\n managed lock dropping, which allowed local users to\n cause a denial of service (deadlock) via crafted\n operations on IrDA devices (bnc#1027178)\n\n - CVE-2017-5669: The do_shmat function in ipc/shm.c in the\n Linux kernel did not restrict the address calculated by\n a certain rounding operation, which allowed local users\n to map page zero, and consequently bypass a protection\n mechanism that exists for the mmap system call, by\n making crafted shmget and shmat system calls in a\n privileged context (bnc#1026914)\n\n - CVE-2015-3288: mm/memory.c in the Linux kernel\n mishandled anonymous pages, which allowed local users to\n gain privileges or cause a denial of service (page\n tainting) via a crafted application that triggers\n writing to page zero (bsc#979021).\n\n - CVE-2016-10200: Race condition in the L2TPv3 IP\n Encapsulation feature in the Linux kernel allowed local\n users to gain privileges or cause a denial of service\n (use-after-free) by making multiple bind system calls\n without properly ascertaining whether a socket has the\n SOCK_ZAPPED status, related to net/l2tp/l2tp_ip.c and\n net/l2tp/l2tp_ip6.c (bnc#1028415)\n\n - CVE-2016-5243: The tipc_nl_compat_link_dump function in\n net/tipc/netlink_compat.c in the Linux kernel did not\n properly copy a certain string, which allowed local\n users to obtain sensitive information from kernel stack\n memory by reading a Netlink message (bnc#983212)\n\n - CVE-2017-6353: net/sctp/socket.c in the Linux kernel did\n not properly restrict association peel-off operations\n during certain wait states, which allowed local users to\n cause a denial of service (invalid unlock and double\n free) via a multithreaded application (bnc#1027066)\n\n - CVE-2017-6214: The tcp_splice_read function in\n net/ipv4/tcp.c in the Linux kernel allowed remote\n attackers to cause a denial of service (infinite loop\n and soft lockup) via vectors involving a TCP packet with\n the URG flag (bnc#1026722)\n\n - CVE-2017-6074: The dccp_rcv_state_process function in\n net/dccp/input.c in the Linux kernel mishandled\n DCCP_PKT_REQUEST packet data structures in the LISTEN\n state, which allowed local users to obtain root\n privileges or cause a denial of service (double free)\n via an application that made an IPV6_RECVPKTINFO\n setsockopt system call (bnc#1026024)\n\n - CVE-2017-5986: Race condition in the\n sctp_wait_for_sndbuf function in net/sctp/socket.c in\n the Linux kernel allowed local users to cause a denial\n of service (assertion failure and panic) via a\n multithreaded application that peels off an association\n in a certain buffer-full state (bsc#1025235)\n\n - CVE-2015-8970: crypto/algif_skcipher.c in the Linux\n kernel did not verify that a setkey operation has been\n performed on an AF_ALG socket an accept system call is\n processed, which allowed local users to cause a denial\n of service (NULL pointer dereference and system crash)\n via a crafted application that does not supply a key,\n related to the lrw_crypt function in crypto/lrw.c\n (bsc#1008374).\n\nThe update package also includes non-security fixes. See advisory for\ndetails.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1005651\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1008374\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1008893\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1013018\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1013070\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1013800\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1013862\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1016489\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1017143\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1018263\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1018446\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1019168\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1020229\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1021256\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1021913\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1022971\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1023014\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1023163\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1023888\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1024508\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1024788\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1024938\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1025235\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1025702\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1026024\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1026260\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1026722\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1026914\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1027066\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1027101\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1027178\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1028415\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1028880\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1029212\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1029770\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1030213\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1030573\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1031003\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1031052\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1031440\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1031579\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1032141\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1033336\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1033771\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1033794\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1033804\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1033816\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1034026\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=909486\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=911105\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=931620\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=979021\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=982783\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=983212\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=985561\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=988065\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=989056\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=995542\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=999245\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-3288/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-8970/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-10200/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-5243/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-2671/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-5669/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-5970/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-5986/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-6074/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-6214/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-6348/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-6353/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-7184/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-7187/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-7261/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-7294/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-7308/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-7616/\"\n );\n # https://www.suse.com/support/update/announcement/2017/suse-su-20171301-1/\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?bed1dddf\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"To install this SUSE Security Update use YaST online_update.\nAlternatively you can run the command listed for your product :\n\nSUSE Linux Enterprise Software Development Kit 11-SP4:zypper in -t\npatch sdksp4-linux-kernel-13105=1\n\nSUSE Linux Enterprise Server 11-SP4:zypper in -t patch\nslessp4-linux-kernel-13105=1\n\nSUSE Linux Enterprise Server 11-EXTRA:zypper in -t patch\nslexsp3-linux-kernel-13105=1\n\nSUSE Linux Enterprise Debuginfo 11-SP4:zypper in -t patch\ndbgsp4-linux-kernel-13105=1\n\nTo bring your system up-to-date, use 'zypper patch'.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'AF_PACKET packet_set_ring Privilege Escalation');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-base\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-man\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-ec2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-ec2-base\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-ec2-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-pae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-pae-base\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-pae-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-source\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-syms\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-trace\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-trace-base\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-trace-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-xen\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-xen-base\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-xen-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:11\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2016/06/27\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/05/15\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/05/16\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2017-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLES11)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLES11\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES11\" && (! preg(pattern:\"^(4)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES11 SP4\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES11\", sp:\"4\", cpu:\"x86_64\", reference:\"kernel-ec2-3.0.101-100.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"4\", cpu:\"x86_64\", reference:\"kernel-ec2-base-3.0.101-100.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"4\", cpu:\"x86_64\", reference:\"kernel-ec2-devel-3.0.101-100.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"4\", cpu:\"x86_64\", reference:\"kernel-xen-3.0.101-100.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"4\", cpu:\"x86_64\", reference:\"kernel-xen-base-3.0.101-100.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"4\", cpu:\"x86_64\", reference:\"kernel-xen-devel-3.0.101-100.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"4\", cpu:\"x86_64\", reference:\"kernel-pae-3.0.101-100.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"4\", cpu:\"x86_64\", reference:\"kernel-pae-base-3.0.101-100.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"4\", cpu:\"x86_64\", reference:\"kernel-pae-devel-3.0.101-100.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"4\", cpu:\"s390x\", reference:\"kernel-default-man-3.0.101-100.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"4\", reference:\"kernel-default-3.0.101-100.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"4\", reference:\"kernel-default-base-3.0.101-100.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"4\", reference:\"kernel-default-devel-3.0.101-100.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"4\", reference:\"kernel-source-3.0.101-100.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"4\", reference:\"kernel-syms-3.0.101-100.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"4\", reference:\"kernel-trace-3.0.101-100.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"4\", reference:\"kernel-trace-base-3.0.101-100.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"4\", reference:\"kernel-trace-devel-3.0.101-100.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"4\", cpu:\"i586\", reference:\"kernel-ec2-3.0.101-100.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"4\", cpu:\"i586\", reference:\"kernel-ec2-base-3.0.101-100.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"4\", cpu:\"i586\", reference:\"kernel-ec2-devel-3.0.101-100.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"4\", cpu:\"i586\", reference:\"kernel-xen-3.0.101-100.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"4\", cpu:\"i586\", reference:\"kernel-xen-base-3.0.101-100.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"4\", cpu:\"i586\", reference:\"kernel-xen-devel-3.0.101-100.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"4\", cpu:\"i586\", reference:\"kernel-pae-3.0.101-100.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"4\", cpu:\"i586\", reference:\"kernel-pae-base-3.0.101-100.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"4\", cpu:\"i586\", reference:\"kernel-pae-devel-3.0.101-100.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kernel\");\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-11T14:21:43", "description": "Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or have other impacts.\n\nCVE-2016-9588\n\nJim Mattson discovered that the KVM implementation for Intel x86 processors does not properly handle #BP and #OF exceptions in an L2 (nested) virtual machine. A local attacker in an L2 guest VM can take advantage of this flaw to cause a denial of service for the L1 guest VM.\n\nCVE-2017-2636\n\nAlexander Popov discovered a race condition flaw in the n_hdlc line discipline that can lead to a double free. A local unprivileged user can take advantage of this flaw for privilege escalation. On systems that do not already have the n_hdlc module loaded, this can be mitigated by disabling it: echo >> /etc/modprobe.d/disable-n_hdlc.conf install n_hdlc false\n\nCVE-2017-5669\n\nGareth Evans reported that privileged users can map memory at address 0 through the shmat() system call. This could make it easier to exploit other kernel security vulnerabilities via a set-UID program.\n\nCVE-2017-5986\n\nAlexander Popov reported a race condition in the SCTP implementation that can be used by local users to cause a denial of service (crash).\nThe initial fix for this was incorrect and introduced further security issues (CVE-2017-6353). This update includes a later fix that avoids those. On systems that do not already have the sctp module loaded, this can be mitigated by disabling it: echo >> /etc/modprobe.d/disable-sctp.conf install sctp false\n\nCVE-2017-6214\n\nDmitry Vyukov reported a bug in the TCP implementation's handling of urgent data in the splice() system call. This can be used by a remote attacker for denial of service (hang) against applications that read from TCP sockets with splice().\n\nCVE-2017-6345\n\nAndrey Konovalov reported that the LLC type 2 implementation incorrectly assigns socket buffer ownership. This might be usable by a local user to cause a denial of service (memory corruption or crash) or privilege escalation. On systems that do not already have the llc2 module loaded, this can be mitigated by disabling it: echo >> /etc/modprobe.d/disable-llc2.conf install llc2 false\n\nCVE-2017-6346\n\nDmitry Vyukov reported a race condition in the raw packet (af_packet) fanout feature. Local users with the CAP_NET_RAW capability (in any user namespace) can use this for denial of service and possibly for privilege escalation.\n\nCVE-2017-6348\n\nDmitry Vyukov reported that the general queue implementation in the IrDA subsystem does not properly manage multiple locks, possibly allowing local users to cause a denial of service (deadlock) via crafted operations on IrDA devices.\n\nFor Debian 7 'Wheezy', these problems have been fixed in version 3.2.86-1.\n\nFor Debian 8 'Jessie', these problems have been fixed in version 3.16.39-1+deb8u2.\n\nWe recommend that you upgrade your linux packages.\n\nNOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 7.8, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2017-03-10T00:00:00", "type": "nessus", "title": "Debian DLA-849-1 : linux security update", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-9588", "CVE-2017-2636", "CVE-2017-5669", "CVE-2017-5986", "CVE-2017-6214", "CVE-2017-6345", "CVE-2017-6346", "CVE-2017-6348", "CVE-2017-6353"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:debian:debian_linux:linux", "cpe:/o:debian:debian_linux:7.0"], "id": "DEBIAN_DLA-849.NASL", "href": "https://www.tenable.com/plugins/nessus/97640", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Debian Security Advisory DLA-849-1. The text\n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(97640);\n script_version(\"3.7\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2016-9588\", \"CVE-2017-2636\", \"CVE-2017-5669\", \"CVE-2017-5986\", \"CVE-2017-6214\", \"CVE-2017-6345\", \"CVE-2017-6346\", \"CVE-2017-6348\", \"CVE-2017-6353\");\n\n script_name(english:\"Debian DLA-849-1 : linux security update\");\n script_summary(english:\"Checks dpkg output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Several vulnerabilities have been discovered in the Linux kernel that\nmay lead to a privilege escalation, denial of service or have other\nimpacts.\n\nCVE-2016-9588\n\nJim Mattson discovered that the KVM implementation for Intel x86\nprocessors does not properly handle #BP and #OF exceptions in an L2\n(nested) virtual machine. A local attacker in an L2 guest VM can take\nadvantage of this flaw to cause a denial of service for the L1 guest\nVM.\n\nCVE-2017-2636\n\nAlexander Popov discovered a race condition flaw in the n_hdlc line\ndiscipline that can lead to a double free. A local unprivileged user\ncan take advantage of this flaw for privilege escalation. On systems\nthat do not already have the n_hdlc module loaded, this can be\nmitigated by disabling it: echo >> /etc/modprobe.d/disable-n_hdlc.conf\ninstall n_hdlc false\n\nCVE-2017-5669\n\nGareth Evans reported that privileged users can map memory at address\n0 through the shmat() system call. This could make it easier to\nexploit other kernel security vulnerabilities via a set-UID program.\n\nCVE-2017-5986\n\nAlexander Popov reported a race condition in the SCTP implementation\nthat can be used by local users to cause a denial of service (crash).\nThe initial fix for this was incorrect and introduced further security\nissues (CVE-2017-6353). This update includes a later fix that avoids\nthose. On systems that do not already have the sctp module loaded,\nthis can be mitigated by disabling it: echo >>\n/etc/modprobe.d/disable-sctp.conf install sctp false\n\nCVE-2017-6214\n\nDmitry Vyukov reported a bug in the TCP implementation's handling of\nurgent data in the splice() system call. This can be used by a remote\nattacker for denial of service (hang) against applications that read\nfrom TCP sockets with splice().\n\nCVE-2017-6345\n\nAndrey Konovalov reported that the LLC type 2 implementation\nincorrectly assigns socket buffer ownership. This might be usable by a\nlocal user to cause a denial of service (memory corruption or crash)\nor privilege escalation. On systems that do not already have the llc2\nmodule loaded, this can be mitigated by disabling it: echo >>\n/etc/modprobe.d/disable-llc2.conf install llc2 false\n\nCVE-2017-6346\n\nDmitry Vyukov reported a race condition in the raw packet (af_packet)\nfanout feature. Local users with the CAP_NET_RAW capability (in any\nuser namespace) can use this for denial of service and possibly for\nprivilege escalation.\n\nCVE-2017-6348\n\nDmitry Vyukov reported that the general queue implementation in the\nIrDA subsystem does not properly manage multiple locks, possibly\nallowing local users to cause a denial of service (deadlock) via\ncrafted operations on IrDA devices.\n\nFor Debian 7 'Wheezy', these problems have been fixed in version\n3.2.86-1.\n\nFor Debian 8 'Jessie', these problems have been fixed in version\n3.16.39-1+deb8u2.\n\nWe recommend that you upgrade your linux packages.\n\nNOTE: Tenable Network Security has extracted the preceding description\nblock directly from the DLA security advisory. Tenable has attempted\nto automatically clean and format it as much as possible without\nintroducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://lists.debian.org/debian-lts-announce/2017/03/msg00007.html\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Upgrade the affected linux package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:7.0\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2016/12/28\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/03/09\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/03/10\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2017-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"7.0\", prefix:\"linux\", reference:\"3.2.86-1\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-11T14:22:14", "description": "Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or have other impacts.\n\n - CVE-2016-9588 Jim Mattson discovered that the KVM implementation for Intel x86 processors does not properly handle #BP and #OF exceptions in an L2 (nested) virtual machine. A local attacker in an L2 guest VM can take advantage of this flaw to cause a denial of service for the L1 guest VM.\n\n - CVE-2017-2636 Alexander Popov discovered a race condition flaw in the n_hdlc line discipline that can lead to a double free. A local unprivileged user can take advantage of this flaw for privilege escalation. On systems that do not already have the n_hdlc module loaded, this can be mitigated by disabling it:echo >> /etc/modprobe.d/disable-n_hdlc.conf install n_hdlc false\n\n - CVE-2017-5669 Gareth Evans reported that privileged users can map memory at address 0 through the shmat() system call.\n This could make it easier to exploit other kernel security vulnerabilities via a set-UID program.\n\n - CVE-2017-5986 Alexander Popov reported a race condition in the SCTP implementation that can be used by local users to cause a denial-of-service (crash). The initial fix for this was incorrect and introduced further security issues ( CVE-2017-6353 ). This update includes a later fix that avoids those. On systems that do not already have the sctp module loaded, this can be mitigated by disabling it:echo >> /etc/modprobe.d/disable-sctp.conf install sctp false\n\n - CVE-2017-6214 Dmitry Vyukov reported a bug in the TCP implementation's handling of urgent data in the splice() system call.\n This can be used by a remote attacker for denial-of-service (hang) against applications that read from TCP sockets with splice().\n\n - CVE-2017-6345 Andrey Konovalov reported that the LLC type 2 implementation incorrectly assigns socket buffer ownership. This can be used by a local user to cause a denial-of-service (crash). On systems that do not already have the llc2 module loaded, this can be mitigated by disabling it:echo >> /etc/modprobe.d/disable-llc2.conf install llc2 false\n\n - CVE-2017-6346 Dmitry Vyukov reported a race condition in the raw packet (af_packet) fanout feature. Local users with the CAP_NET_RAW capability (in any user namespace) can use this for denial-of-service and possibly for privilege escalation.\n\n - CVE-2017-6348 Dmitry Vyukov reported that the general queue implementation in the IrDA subsystem does not properly manage multiple locks, possibly allowing local users to cause a denial-of-service (deadlock) via crafted operations on IrDA devices.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 7.8, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2017-03-09T00:00:00", "type": "nessus", "title": "Debian DSA-3804-1 : linux - security update", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-9588", "CVE-2017-2636", "CVE-2017-5669", "CVE-2017-5986", "CVE-2017-6214", "CVE-2017-6345", "CVE-2017-6346", "CVE-2017-6348", "CVE-2017-6353"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:debian:debian_linux:linux", "cpe:/o:debian:debian_linux:8.0"], "id": "DEBIAN_DSA-3804.NASL", "href": "https://www.tenable.com/plugins/nessus/97615", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-3804. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(97615);\n script_version(\"3.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2016-9588\", \"CVE-2017-2636\", \"CVE-2017-5669\", \"CVE-2017-5986\", \"CVE-2017-6214\", \"CVE-2017-6345\", \"CVE-2017-6346\", \"CVE-2017-6348\", \"CVE-2017-6353\");\n script_xref(name:\"DSA\", value:\"3804\");\n\n script_name(english:\"Debian DSA-3804-1 : linux - security update\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Several vulnerabilities have been discovered in the Linux kernel that\nmay lead to a privilege escalation, denial of service or have other\nimpacts.\n\n - CVE-2016-9588\n Jim Mattson discovered that the KVM implementation for\n Intel x86 processors does not properly handle #BP and\n #OF exceptions in an L2 (nested) virtual machine. A\n local attacker in an L2 guest VM can take advantage of\n this flaw to cause a denial of service for the L1 guest\n VM.\n\n - CVE-2017-2636\n Alexander Popov discovered a race condition flaw in the\n n_hdlc line discipline that can lead to a double free. A\n local unprivileged user can take advantage of this flaw\n for privilege escalation. On systems that do not already\n have the n_hdlc module loaded, this can be mitigated by\n disabling it:echo >> /etc/modprobe.d/disable-n_hdlc.conf\n install n_hdlc false\n\n - CVE-2017-5669\n Gareth Evans reported that privileged users can map\n memory at address 0 through the shmat() system call.\n This could make it easier to exploit other kernel\n security vulnerabilities via a set-UID program.\n\n - CVE-2017-5986\n Alexander Popov reported a race condition in the SCTP\n implementation that can be used by local users to cause\n a denial-of-service (crash). The initial fix for this\n was incorrect and introduced further security issues (\n CVE-2017-6353 ). This update includes a later fix that\n avoids those. On systems that do not already have the\n sctp module loaded, this can be mitigated by disabling\n it:echo >> /etc/modprobe.d/disable-sctp.conf install\n sctp false\n\n - CVE-2017-6214\n Dmitry Vyukov reported a bug in the TCP implementation's\n handling of urgent data in the splice() system call.\n This can be used by a remote attacker for\n denial-of-service (hang) against applications that read\n from TCP sockets with splice().\n\n - CVE-2017-6345\n Andrey Konovalov reported that the LLC type 2\n implementation incorrectly assigns socket buffer\n ownership. This can be used by a local user to cause a\n denial-of-service (crash). On systems that do not\n already have the llc2 module loaded, this can be\n mitigated by disabling it:echo >>\n /etc/modprobe.d/disable-llc2.conf install llc2 false\n\n - CVE-2017-6346\n Dmitry Vyukov reported a race condition in the raw\n packet (af_packet) fanout feature. Local users with the\n CAP_NET_RAW capability (in any user namespace) can use\n this for denial-of-service and possibly for privilege\n escalation.\n\n - CVE-2017-6348\n Dmitry Vyukov reported that the general queue\n implementation in the IrDA subsystem does not properly\n manage multiple locks, possibly allowing local users to\n cause a denial-of-service (deadlock) via crafted\n operations on IrDA devices.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2016-9588\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2017-2636\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2017-5669\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2017-5986\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2017-6353\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2017-6214\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2017-6345\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2017-6346\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2017-6348\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/jessie/linux\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.debian.org/security/2017/dsa-3804\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Upgrade the linux packages.\n\nFor the stable distribution (jessie), these problems have been fixed\nin version 3.16.39-1+deb8u2.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:linux\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:8.0\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2016/12/28\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/03/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/03/09\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2017-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"8.0\", prefix:\"linux-compiler-gcc-4.8-arm\", reference:\"3.16.39-1+deb8u2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-compiler-gcc-4.8-x86\", reference:\"3.16.39-1+deb8u2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-compiler-gcc-4.9-x86\", reference:\"3.16.39-1+deb8u2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-doc-3.16\", reference:\"3.16.39-1+deb8u2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-3.16.0-9-586\", reference:\"3.16.39-1+deb8u2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-3.16.0-9-686-pae\", reference:\"3.16.39-1+deb8u2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-3.16.0-9-all\", reference:\"3.16.39-1+deb8u2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-3.16.0-9-all-amd64\", reference:\"3.16.39-1+deb8u2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-3.16.0-9-all-armel\", reference:\"3.16.39-1+deb8u2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-3.16.0-9-all-armhf\", reference:\"3.16.39-1+deb8u2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-3.16.0-9-all-i386\", reference:\"3.16.39-1+deb8u2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-3.16.0-9-amd64\", reference:\"3.16.39-1+deb8u2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-3.16.0-9-armmp\", reference:\"3.16.39-1+deb8u2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-3.16.0-9-armmp-lpae\", reference:\"3.16.39-1+deb8u2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-3.16.0-9-common\", reference:\"3.16.39-1+deb8u2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-3.16.0-9-ixp4xx\", reference:\"3.16.39-1+deb8u2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-3.16.0-9-kirkwood\", reference:\"3.16.39-1+deb8u2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-3.16.0-9-orion5x\", reference:\"3.16.39-1+deb8u2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-headers-3.16.0-9-versatile\", reference:\"3.16.39-1+deb8u2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-image-3.16.0-9-586\", reference:\"3.16.39-1+deb8u2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-image-3.16.0-9-686-pae\", reference:\"3.16.39-1+deb8u2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-image-3.16.0-9-686-pae-dbg\", reference:\"3.16.39-1+deb8u2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-image-3.16.0-9-amd64\", reference:\"3.16.39-1+deb8u2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-image-3.16.0-9-amd64-dbg\", reference:\"3.16.39-1+deb8u2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-image-3.16.0-9-armmp\", reference:\"3.16.39-1+deb8u2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-image-3.16.0-9-armmp-lpae\", reference:\"3.16.39-1+deb8u2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-image-3.16.0-9-ixp4xx\", reference:\"3.16.39-1+deb8u2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-image-3.16.0-9-kirkwood\", reference:\"3.16.39-1+deb8u2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-image-3.16.0-9-orion5x\", reference:\"3.16.39-1+deb8u2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-image-3.16.0-9-versatile\", reference:\"3.16.39-1+deb8u2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-libc-dev\", reference:\"3.16.39-1+deb8u2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-manual-3.16\", reference:\"3.16.39-1+deb8u2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-source-3.16\", reference:\"3.16.39-1+deb8u2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"linux-support-3.16.0-9\", reference:\"3.16.39-1+deb8u2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"xen-linux-system-3.16.0-9-amd64\", reference:\"3.16.39-1+deb8u2\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-11T14:25:26", "description": "The SUSE Linux Enterprise 12 SP2 kernel was updated to 4.4.58 to receive various security and bugfixes. Notable new/improved features :\n\n - Improved support for Hyper-V\n\n - Support for Matrox G200eH3\n\n - Support for tcp_westwood The following security bugs were fixed :\n\n - CVE-2017-2671: The ping_unhash function in net/ipv4/ping.c in the Linux kernel was too late in obtaining a certain lock and consequently could not ensure that disconnect function calls are safe, which allowed local users to cause a denial of service (panic) by leveraging access to the protocol value of IPPROTO_ICMP in a socket system call (bnc#1031003).\n\n - CVE-2017-7308: The packet_set_ring function in net/packet/af_packet.c in the Linux kernel did not properly validate certain block-size data, which allowed local users to cause a denial of service (overflow) or possibly have unspecified other impact via crafted system calls (bnc#1031579).\n\n - CVE-2017-7294: The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not validate addition of certain levels data, which allowed local users to trigger an integer overflow and out-of-bounds write, and cause a denial of service (system hang or crash) or possibly gain privileges, via a crafted ioctl call for a /dev/dri/renderD* device (bnc#1031440).\n\n - CVE-2017-7261: The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not check for a zero value of certain levels data, which allowed local users to cause a denial of service (ZERO_SIZE_PTR dereference, and GPF and possibly panic) via a crafted ioctl call for a /dev/dri/renderD* device (bnc#1031052).\n\n - CVE-2017-7187: The sg_ioctl function in drivers/scsi/sg.c in the Linux kernel allowed local users to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a large command size in an SG_NEXT_CMD_LEN ioctl call, leading to out-of-bounds write access in the sg_write function (bnc#1030213).\n\n - CVE-2017-7374: Use-after-free vulnerability in fs/crypto/ in the Linux kernel allowed local users to cause a denial of service (NULL pointer dereference) or possibly gain privileges by revoking keyring keys being used for ext4, f2fs, or ubifs encryption, causing cryptographic transform objects to be freed prematurely (bnc#1032006).\n\n - CVE-2016-10200: Race condition in the L2TPv3 IP Encapsulation feature in the Linux kernel allowed local users to gain privileges or cause a denial of service (use-after-free) by making multiple bind system calls without properly ascertaining whether a socket has the SOCK_ZAPPED status, related to net/l2tp/l2tp_ip.c and net/l2tp/l2tp_ip6.c (bnc#1028415).\n\n - CVE-2017-6345: The LLC subsystem in the Linux kernel did not ensure that a certain destructor exists in required circumstances, which allowed local users to cause a denial of service (BUG_ON) or possibly have unspecified other impact via crafted system calls (bnc#1027190).\n\n - CVE-2017-6346: Race condition in net/packet/af_packet.c in the Linux kernel allowed local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via a multithreaded application that made PACKET_FANOUT setsockopt system calls (bnc#1027189).\n\n - CVE-2017-6353: net/sctp/socket.c in the Linux kernel did not properly restrict association peel-off operations during certain wait states, which allowed local users to cause a denial of service (invalid unlock and double free) via a multithreaded application. NOTE: this vulnerability exists because of an incorrect fix for CVE-2017-5986 (bnc#1027066).\n\n - CVE-2017-6214: The tcp_splice_read function in net/ipv4/tcp.c in the Linux kernel allowed remote attackers to cause a denial of service (infinite loop and soft lockup) via vectors involving a TCP packet with the URG flag (bnc#1026722).\n\n - CVE-2016-2117: The atl2_probe function in drivers/net/ethernet/atheros/atlx/atl2.c in the Linux kernel incorrectly enables scatter/gather I/O, which allowed remote attackers to obtain sensitive information from kernel memory by reading packet data (bnc#968697).\n\n - CVE-2017-6347: The ip_cmsg_recv_checksum function in net/ipv4/ip_sockglue.c in the Linux kernel had incorrect expectations about skb data layout, which allowed local users to cause a denial of service (buffer over-read) or possibly have unspecified other impact via crafted system calls, as demonstrated by use of the MSG_MORE flag in conjunction with loopback UDP transmission (bnc#1027179).\n\n - CVE-2016-9191: The cgroup offline implementation in the Linux kernel mishandled certain drain operations, which allowed local users to cause a denial of service (system hang) by leveraging access to a container environment for executing a crafted application (bnc#1008842).\n\n - CVE-2017-2596: The nested_vmx_check_vmptr function in arch/x86/kvm/vmx.c in the Linux kernel improperly emulated the VMXON instruction, which allowed KVM L1 guest OS users to cause a denial of service (host OS memory consumption) by leveraging the mishandling of page references (bnc#1022785).\n\n - CVE-2017-6074: The dccp_rcv_state_process function in net/dccp/input.c in the Linux kernel mishandled DCCP_PKT_REQUEST packet data structures in the LISTEN state, which allowed local users to obtain root privileges or cause a denial of service (double free) via an application that made an IPV6_RECVPKTINFO setsockopt system call (bnc#1026024).\n\nThe update package also includes non-security fixes. See advisory for details.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 7.8, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2017-05-08T00:00:00", "type": "nessus", "title": "SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2017:1183-1)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-10200", "CVE-2016-2117", "CVE-2016-9191", "CVE-2017-2596", "CVE-2017-2671", "CVE-2017-5986", "CVE-2017-6074", "CVE-2017-6214", "CVE-2017-6345", "CVE-2017-6346", "CVE-2017-6347", "CVE-2017-6353", "CVE-2017-7187", "CVE-2017-7261", "CVE-2017-7294", "CVE-2017-7308", "CVE-2017-7374"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:novell:suse_linux:kernel-default", "p-cpe:/a:novell:suse_linux:kernel-default-base", "p-cpe:/a:novell:suse_linux:kernel-default-base-debuginfo", "p-cpe:/a:novell:suse_linux:kernel-default-debuginfo", "p-cpe:/a:novell:suse_linux:kernel-default-debugsource", "p-cpe:/a:novell:suse_linux:kernel-default-devel", "p-cpe:/a:novell:suse_linux:kernel-default-extra", "p-cpe:/a:novell:suse_linux:kernel-default-extra-debuginfo", "p-cpe:/a:novell:suse_linux:kernel-syms", "cpe:/o:novell:suse_linux:12"], "id": "SUSE_SU-2017-1183-1.NASL", "href": "https://www.tenable.com/plugins/nessus/100023", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2017:1183-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(100023);\n script_version(\"3.12\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2016-10200\", \"CVE-2016-2117\", \"CVE-2016-9191\", \"CVE-2017-2596\", \"CVE-2017-2671\", \"CVE-2017-5986\", \"CVE-2017-6074\", \"CVE-2017-6214\", \"CVE-2017-6345\", \"CVE-2017-6346\", \"CVE-2017-6347\", \"CVE-2017-6353\", \"CVE-2017-7187\", \"CVE-2017-7261\", \"CVE-2017-7294\", \"CVE-2017-7308\", \"CVE-2017-7374\");\n\n script_name(english:\"SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2017:1183-1)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote SUSE host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The SUSE Linux Enterprise 12 SP2 kernel was updated to 4.4.58 to\nreceive various security and bugfixes. Notable new/improved features :\n\n - Improved support for Hyper-V\n\n - Support for Matrox G200eH3\n\n - Support for tcp_westwood The following security bugs\n were fixed :\n\n - CVE-2017-2671: The ping_unhash function in\n net/ipv4/ping.c in the Linux kernel was too late in\n obtaining a certain lock and consequently could not\n ensure that disconnect function calls are safe, which\n allowed local users to cause a denial of service (panic)\n by leveraging access to the protocol value of\n IPPROTO_ICMP in a socket system call (bnc#1031003).\n\n - CVE-2017-7308: The packet_set_ring function in\n net/packet/af_packet.c in the Linux kernel did not\n properly validate certain block-size data, which allowed\n local users to cause a denial of service (overflow) or\n possibly have unspecified other impact via crafted\n system calls (bnc#1031579).\n\n - CVE-2017-7294: The vmw_surface_define_ioctl function in\n drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux\n kernel did not validate addition of certain levels data,\n which allowed local users to trigger an integer overflow\n and out-of-bounds write, and cause a denial of service\n (system hang or crash) or possibly gain privileges, via\n a crafted ioctl call for a /dev/dri/renderD* device\n (bnc#1031440).\n\n - CVE-2017-7261: The vmw_surface_define_ioctl function in\n drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux\n kernel did not check for a zero value of certain levels\n data, which allowed local users to cause a denial of\n service (ZERO_SIZE_PTR dereference, and GPF and possibly\n panic) via a crafted ioctl call for a /dev/dri/renderD*\n device (bnc#1031052).\n\n - CVE-2017-7187: The sg_ioctl function in\n drivers/scsi/sg.c in the Linux kernel allowed local\n users to cause a denial of service (stack-based buffer\n overflow) or possibly have unspecified other impact via\n a large command size in an SG_NEXT_CMD_LEN ioctl call,\n leading to out-of-bounds write access in the sg_write\n function (bnc#1030213).\n\n - CVE-2017-7374: Use-after-free vulnerability in\n fs/crypto/ in the Linux kernel allowed local users to\n cause a denial of service (NULL pointer dereference) or\n possibly gain privileges by revoking keyring keys being\n used for ext4, f2fs, or ubifs encryption, causing\n cryptographic transform objects to be freed prematurely\n (bnc#1032006).\n\n - CVE-2016-10200: Race condition in the L2TPv3 IP\n Encapsulation feature in the Linux kernel allowed local\n users to gain privileges or cause a denial of service\n (use-after-free) by making multiple bind system calls\n without properly ascertaining whether a socket has the\n SOCK_ZAPPED status, related to net/l2tp/l2tp_ip.c and\n net/l2tp/l2tp_ip6.c (bnc#1028415).\n\n - CVE-2017-6345: The LLC subsystem in the Linux kernel did\n not ensure that a certain destructor exists in required\n circumstances, which allowed local users to cause a\n denial of service (BUG_ON) or possibly have unspecified\n other impact via crafted system calls (bnc#1027190).\n\n - CVE-2017-6346: Race condition in net/packet/af_packet.c\n in the Linux kernel allowed local users to cause a\n denial of service (use-after-free) or possibly have\n unspecified other impact via a multithreaded application\n that made PACKET_FANOUT setsockopt system calls\n (bnc#1027189).\n\n - CVE-2017-6353: net/sctp/socket.c in the Linux kernel did\n not properly restrict association peel-off operations\n during certain wait states, which allowed local users to\n cause a denial of service (invalid unlock and double\n free) via a multithreaded application. NOTE: this\n vulnerability exists because of an incorrect fix for\n CVE-2017-5986 (bnc#1027066).\n\n - CVE-2017-6214: The tcp_splice_read function in\n net/ipv4/tcp.c in the Linux kernel allowed remote\n attackers to cause a denial of service (infinite loop\n and soft lockup) via vectors involving a TCP packet with\n the URG flag (bnc#1026722).\n\n - CVE-2016-2117: The atl2_probe function in\n drivers/net/ethernet/atheros/atlx/atl2.c in the Linux\n kernel incorrectly enables scatter/gather I/O, which\n allowed remote attackers to obtain sensitive information\n from kernel memory by reading packet data (bnc#968697).\n\n - CVE-2017-6347: The ip_cmsg_recv_checksum function in\n net/ipv4/ip_sockglue.c in the Linux kernel had incorrect\n expectations about skb data layout, which allowed local\n users to cause a denial of service (buffer over-read) or\n possibly have unspecified other impact via crafted\n system calls, as demonstrated by use of the MSG_MORE\n flag in conjunction with loopback UDP transmission\n (bnc#1027179).\n\n - CVE-2016-9191: The cgroup offline implementation in the\n Linux kernel mishandled certain drain operations, which\n allowed local users to cause a denial of service (system\n hang) by leveraging access to a container environment\n for executing a crafted application (bnc#1008842).\n\n - CVE-2017-2596: The nested_vmx_check_vmptr function in\n arch/x86/kvm/vmx.c in the Linux kernel improperly\n emulated the VMXON instruction, which allowed KVM L1\n guest OS users to cause a denial of service (host OS\n memory consumption) by leveraging the mishandling of\n page references (bnc#1022785).\n\n - CVE-2017-6074: The dccp_rcv_state_process function in\n net/dccp/input.c in the Linux kernel mishandled\n DCCP_PKT_REQUEST packet data structures in the LISTEN\n state, which allowed local users to obtain root\n privileges or cause a denial of service (double free)\n via an application that made an IPV6_RECVPKTINFO\n setsockopt system call (bnc#1026024).\n\nThe update package also includes non-security fixes. See advisory for\ndetails.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1007959\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1007962\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1008842\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1010032\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1011913\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1012382\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1012910\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1013994\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1014136\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1015609\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1017461\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1017641\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1018263\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1018419\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1019163\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1019614\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1019618\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1020048\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1021762\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1022340\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1022785\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1023866\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1024015\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1025683\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1026024\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1026405\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1026462\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1026505\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1026509\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1026692\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1026722\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1027054\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1027066\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1027153\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1027179\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1027189\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1027190\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1027195\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1027273\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1027616\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1028017\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1028027\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1028041\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1028158\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1028217\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1028325\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1028415\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1028819\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1028895\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1029220\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1029514\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1029634\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1029986\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1030118\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1030213\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1031003\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1031052\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1031200\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1031206\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1031208\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1031440\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1031481\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1031579\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1031660\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1031662\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1031717\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1031831\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1032006\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1032673\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1032681\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=897662\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=951844\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=968697\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=969755\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=970083\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=977572\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=977860\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=978056\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=980892\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=981634\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=982783\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=987899\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=988281\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=991173\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=998106\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-10200/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2117/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-9191/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-2596/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-2671/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-6074/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-6214/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-6345/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-6346/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-6347/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-6353/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-7187/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-7261/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-7294/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-7308/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-7374/\"\n );\n # https://www.suse.com/support/update/announcement/2017/suse-su-20171183-1/\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?e163b69f\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"To install this SUSE Security Update use YaST online_update.\nAlternatively you can run the command listed for your product :\n\nSUSE Linux Enterprise Workstation Extension 12-SP2:zypper in -t patch\nSUSE-SLE-WE-12-SP2-2017-697=1\n\nSUSE Linux Enterprise Software Development Kit 12-SP2:zypper in -t\npatch SUSE-SLE-SDK-12-SP2-2017-697=1\n\nSUSE Linux Enterprise Server for Raspberry Pi 12-SP2:zypper in -t\npatch SUSE-SLE-RPI-12-SP2-2017-697=1\n\nSUSE Linux Enterprise Server 12-SP2:zypper in -t patch\nSUSE-SLE-SERVER-12-SP2-2017-697=1\n\nSUSE Linux Enterprise Live Patching 12:zypper in -t patch\nSUSE-SLE-Live-Patching-12-2017-697=1\n\nSUSE Linux Enterprise High Availability 12-SP2:zypper in -t patch\nSUSE-SLE-HA-12-SP2-2017-697=1\n\nSUSE Linux Enterprise Desktop 12-SP2:zypper in -t patch\nSUSE-SLE-DESKTOP-12-SP2-2017-697=1\n\nOpenStack Cloud Magnum Orchestration 7:zypper in -t patch\nSUSE-OpenStack-Cloud-Magnum-Orchestration-7-2017-697=1\n\nTo bring your system up-to-date, use 'zypper patch'.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'AF_PACKET packet_set_ring Privilege Escalation');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-base\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-base-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-extra\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-default-extra-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:kernel-syms\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:12\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2016/05/02\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/05/05\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/05/08\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2017-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLED12|SLES12)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLED12 / SLES12\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\nif (cpu >!< \"x86_64\") audit(AUDIT_ARCH_NOT, \"x86_64\", cpu);\n\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES12\" && (! preg(pattern:\"^(2)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES12 SP2\", os_ver + \" SP\" + sp);\nif (os_ver == \"SLED12\" && (! preg(pattern:\"^(2)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLED12 SP2\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES12\", sp:\"2\", cpu:\"x86_64\", reference:\"kernel-default-4.4.59-92.17.3\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", cpu:\"x86_64\", reference:\"kernel-default-base-4.4.59-92.17.3\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", cpu:\"x86_64\", reference:\"kernel-default-base-debuginfo-4.4.59-92.17.3\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", cpu:\"x86_64\", reference:\"kernel-default-debuginfo-4.4.59-92.17.3\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", cpu:\"x86_64\", reference:\"kernel-default-debugsource-4.4.59-92.17.3\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", cpu:\"x86_64\", reference:\"kernel-default-devel-4.4.59-92.17.3\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", cpu:\"x86_64\", reference:\"kernel-syms-4.4.59-92.17.2\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"2\", cpu:\"x86_64\", reference:\"kernel-default-4.4.59-92.17.3\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"2\", cpu:\"x86_64\", reference:\"kernel-default-debuginfo-4.4.59-92.17.3\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"2\", cpu:\"x86_64\", reference:\"kernel-default-debugsource-4.4.59-92.17.3\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"2\", cpu:\"x86_64\", reference:\"kernel-default-devel-4.4.59-92.17.3\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"2\", cpu:\"x86_64\", reference:\"kernel-default-extra-4.4.59-92.17.3\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"2\", cpu:\"x86_64\", reference:\"kernel-default-extra-debuginfo-4.4.59-92.17.3\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"2\", cpu:\"x86_64\", reference:\"kernel-syms-4.4.59-92.17.2\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kernel\");\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-13T14:39:26", "description": "USN-3265-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS.\n\nIt was discovered that a use-after-free flaw existed in the filesystem encryption subsystem in the Linux kernel. A local attacker could use this to cause a denial of service (system crash). (CVE-2017-7374)\n\nAndrey Konovalov discovered an out-of-bounds access in the IPv6 Generic Routing Encapsulation (GRE) tunneling implementation in the Linux kernel. An attacker could use this to possibly expose sensitive information. (CVE-2017-5897)\n\nAndrey Konovalov discovered that the IPv4 implementation in the Linux kernel did not properly handle invalid IP options in some situations.\nAn attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2017-5970)\n\nGareth Evans discovered that the shm IPC subsystem in the Linux kernel did not properly restrict mapping page zero. A local privileged attacker could use this to execute arbitrary code. (CVE-2017-5669)\n\nAlexander Popov discovered that a race condition existed in the Stream Control Transmission Protocol (SCTP) implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash). (CVE-2017-5986)\n\nDmitry Vyukov discovered that the Linux kernel did not properly handle TCP packets with the URG flag. A remote attacker could use this to cause a denial of service. (CVE-2017-6214)\n\nAndrey Konovalov discovered that the LLC subsytem in the Linux kernel did not properly set up a destructor in certain situations. A local attacker could use this to cause a denial of service (system crash).\n(CVE-2017-6345)\n\nIt was discovered that a race condition existed in the AF_PACKET handling code in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-6346)\n\nAndrey Konovalov discovered that the IP layer in the Linux kernel made improper assumptions about internal data layout when performing checksums. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.\n(CVE-2017-6347)\n\nDmitry Vyukov discovered race conditions in the Infrared (IrDA) subsystem in the Linux kernel. A local attacker could use this to cause a denial of service (deadlock). (CVE-2017-6348).\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2017-04-25T00:00:00", "type": "nessus", "title": "Ubuntu 14.04 LTS : linux-lts-xenial vulnerabilities (USN-3265-2)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": true, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-5669", "CVE-2017-5897", "CVE-2017-5970", "CVE-2017-5986", "CVE-2017-6214", "CVE-2017-6345", "CVE-2017-6346", "CVE-2017-6347", "CVE-2017-6348", "CVE-2017-7374"], "modified": "2023-01-12T00:00:00", "cpe": ["p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-generic", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-generic-lpae", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-lowlatency", "p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lpae-lts-xenial", "p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lts-xenial", "p-cpe:/a:canonical:ubuntu_linux:linux-image-lowlatency-lts-xenial", "cpe:/o:canonical:ubuntu_linux:14.04"], "id": "UBUNTU_USN-3265-2.NASL", "href": "https://www.tenable.com/plugins/nessus/99658", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-3265-2. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(99658);\n script_version(\"3.10\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/01/12\");\n\n script_cve_id(\"CVE-2017-5669\", \"CVE-2017-5897\", \"CVE-2017-5970\", \"CVE-2017-5986\", \"CVE-2017-6214\", \"CVE-2017-6345\", \"CVE-2017-6346\", \"CVE-2017-6347\", \"CVE-2017-6348\", \"CVE-2017-7374\");\n script_xref(name:\"USN\", value:\"3265-2\");\n\n script_name(english:\"Ubuntu 14.04 LTS : linux-lts-xenial vulnerabilities (USN-3265-2)\");\n script_summary(english:\"Checks dpkg output for updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\n\"The remote Ubuntu host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"USN-3265-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04\nLTS. This update provides the corresponding updates for the Linux\nHardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu\n14.04 LTS.\n\nIt was discovered that a use-after-free flaw existed in the filesystem\nencryption subsystem in the Linux kernel. A local attacker could use\nthis to cause a denial of service (system crash). (CVE-2017-7374)\n\nAndrey Konovalov discovered an out-of-bounds access in the IPv6\nGeneric Routing Encapsulation (GRE) tunneling implementation in the\nLinux kernel. An attacker could use this to possibly expose sensitive\ninformation. (CVE-2017-5897)\n\nAndrey Konovalov discovered that the IPv4 implementation in the Linux\nkernel did not properly handle invalid IP options in some situations.\nAn attacker could use this to cause a denial of service or possibly\nexecute arbitrary code. (CVE-2017-5970)\n\nGareth Evans discovered that the shm IPC subsystem in the Linux kernel\ndid not properly restrict mapping page zero. A local privileged\nattacker could use this to execute arbitrary code. (CVE-2017-5669)\n\nAlexander Popov discovered that a race condition existed in the Stream\nControl Transmission Protocol (SCTP) implementation in the Linux\nkernel. A local attacker could use this to cause a denial of service\n(system crash). (CVE-2017-5986)\n\nDmitry Vyukov discovered that the Linux kernel did not properly handle\nTCP packets with the URG flag. A remote attacker could use this to\ncause a denial of service. (CVE-2017-6214)\n\nAndrey Konovalov discovered that the LLC subsytem in the Linux kernel\ndid not properly set up a destructor in certain situations. A local\nattacker could use this to cause a denial of service (system crash).\n(CVE-2017-6345)\n\nIt was discovered that a race condition existed in the AF_PACKET\nhandling code in the Linux kernel. A local attacker could use this to\ncause a denial of service (system crash) or possibly execute arbitrary\ncode. (CVE-2017-6346)\n\nAndrey Konovalov discovered that the IP layer in the Linux kernel made\nimproper assumptions about internal data layout when performing\nchecksums. A local attacker could use this to cause a denial of\nservice (system crash) or possibly execute arbitrary code.\n(CVE-2017-6347)\n\nDmitry Vyukov discovered race conditions in the Infrared (IrDA)\nsubsystem in the Linux kernel. A local attacker could use this to\ncause a denial of service (deadlock). (CVE-2017-6348).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://usn.ubuntu.com/3265-2/\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-generic\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-generic-lpae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-lowlatency\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lpae-lts-xenial\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lts-xenial\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-lowlatency-lts-xenial\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:14.04\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/02/14\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/04/24\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/04/25\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"Ubuntu Security Notice (C) 2017-2023 Canonical, Inc. / NASL script (C) 2017-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"linux_alt_patch_detect.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"ubuntu.inc\");\ninclude(\"ksplice.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/Ubuntu/release\");\nif ( isnull(release) ) audit(AUDIT_OS_NOT, \"Ubuntu\");\nvar release = chomp(release);\nif (! preg(pattern:\"^(14\\.04)$\", string:release)) audit(AUDIT_OS_NOT, \"Ubuntu 14.04\", \"Ubuntu \" + release);\nif ( ! get_kb_item(\"Host/Debian/dpkg-l\") ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Ubuntu', cpu);\n\nif (get_one_kb_item(\"Host/ksplice/kernel-cves\"))\n{\n rm_kb_item(name:\"Host/uptrack-uname-r\");\n cve_list = make_list(\"CVE-2017-5669\", \"CVE-2017-5897\", \"CVE-2017-5970\", \"CVE-2017-5986\", \"CVE-2017-6214\", \"CVE-2017-6345\", \"CVE-2017-6346\", \"CVE-2017-6347\", \"CVE-2017-6348\", \"CVE-2017-7374\");\n if (ksplice_cves_check(cve_list))\n {\n audit(AUDIT_PATCH_INSTALLED, \"KSplice hotfix for USN-3265-2\");\n }\n else\n {\n _ubuntu_report = ksplice_reporting_text();\n }\n}\n\nvar flag = 0;\n\nif (ubuntu_check(osver:\"14.04\", pkgname:\"linux-image-4.4.0-75-generic\", pkgver:\"4.4.0-75.96~14.04.1\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"linux-image-4.4.0-75-generic-lpae\", pkgver:\"4.4.0-75.96~14.04.1\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"linux-image-4.4.0-75-lowlatency\", pkgver:\"4.4.0-75.96~14.04.1\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"linux-image-generic-lpae-lts-xenial\", pkgver:\"4.4.0.75.62\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"linux-image-generic-lts-xenial\", pkgver:\"4.4.0.75.62\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"linux-image-lowlatency-lts-xenial\", pkgver:\"4.4.0.75.62\")) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"linux-image-4.4-generic / linux-image-4.4-generic-lpae / etc\");\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-01-13T14:39:50", "description": "It was discovered that a use-after-free flaw existed in the filesystem encryption subsystem in the Linux kernel. A local attacker could use this to cause a denial of service (system crash). (CVE-2017-7374)\n\nAndrey Konovalov discovered an out-of-bounds access in the IPv6 Generic Routing Encapsulation (GRE) tunneling implementation in the Linux kernel. An attacker could use this to possibly expose sensitive information. (CVE-2017-5897)\n\nAndrey Konovalov discovered that the IPv4 implementation in the Linux kernel did not properly handle invalid IP options in some situations.\nAn attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2017-5970)\n\nGareth Evans discovered that the shm IPC subsystem in the Linux kernel did not properly restrict mapping page zero. A local privileged attacker could use this to execute arbitrary code. (CVE-2017-5669)\n\nAlexander Popov discovered that a race condition existed in the Stream Control Transmission Protocol (SCTP) implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash). (CVE-2017-5986)\n\nDmitry Vyukov discovered that the Linux kernel did not properly handle TCP packets with the URG flag. A remote attacker could use this to cause a denial of service. (CVE-2017-6214)\n\nAndrey Konovalov discovered that the LLC subsytem in the Linux kernel did not properly set up a destructor in certain situations. A local attacker could use this to cause a denial of service (system crash).\n(CVE-2017-6345)\n\nIt was discovered that a race condition existed in the AF_PACKET handling code in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-6346)\n\nAndrey Konovalov discovered that the IP layer in the Linux kernel made improper assumptions about internal data layout when performing checksums. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.\n(CVE-2017-6347)\n\nDmitry Vyukov discovered race conditions in the Infrared (IrDA) subsystem in the Linux kernel. A local attacker could use this to cause a denial of service (deadlock). (CVE-2017-6348).\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2017-04-25T00:00:00", "type": "nessus", "title": "Ubuntu 16.04 LTS : linux, linux-aws, linux-gke, linux-raspi2, linux-snapdragon vulnerabilities (USN-3265-1)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": true, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-5669", "CVE-2017-5897", "CVE-2017-5970", "CVE-2017-5986", "CVE-2017-6214", "CVE-2017-6345", "CVE-2017-6346", "CVE-2017-6347", "CVE-2017-6348", "CVE-2017-7374"], "modified": "2023-01-12T00:00:00", "cpe": ["p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-aws", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-generic", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-generic-lpae", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-gke", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-lowlatency", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-raspi2", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-snapdragon", "p-cpe:/a:canonical:ubuntu_linux:linux-image-aws", "p-cpe:/a:canonical:ubuntu_linux:linux-image-generic", "p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lpae", "p-cpe:/a:canonical:ubuntu_linux:linux-image-gke", "p-cpe:/a:canonical:ubuntu_linux:linux-image-lowlatency", "p-cpe:/a:canonical:ubuntu_linux:linux-image-raspi2", "p-cpe:/a:canonical:ubuntu_linux:linux-image-snapdragon", "cpe:/o:canonical:ubuntu_linux:16.04"], "id": "UBUNTU_USN-3265-1.NASL", "href": "https://www.tenable.com/plugins/nessus/99657", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-3265-1. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(99657);\n script_version(\"3.10\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/01/12\");\n\n script_cve_id(\"CVE-2017-5669\", \"CVE-2017-5897\", \"CVE-2017-5970\", \"CVE-2017-5986\", \"CVE-2017-6214\", \"CVE-2017-6345\", \"CVE-2017-6346\", \"CVE-2017-6347\", \"CVE-2017-6348\", \"CVE-2017-7374\");\n script_xref(name:\"USN\", value:\"3265-1\");\n\n script_name(english:\"Ubuntu 16.04 LTS : linux, linux-aws, linux-gke, linux-raspi2, linux-snapdragon vulnerabilities (USN-3265-1)\");\n script_summary(english:\"Checks dpkg output for updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\n\"The remote Ubuntu host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"It was discovered that a use-after-free flaw existed in the filesystem\nencryption subsystem in the Linux kernel. A local attacker could use\nthis to cause a denial of service (system crash). (CVE-2017-7374)\n\nAndrey Konovalov discovered an out-of-bounds access in the IPv6\nGeneric Routing Encapsulation (GRE) tunneling implementation in the\nLinux kernel. An attacker could use this to possibly expose sensitive\ninformation. (CVE-2017-5897)\n\nAndrey Konovalov discovered that the IPv4 implementation in the Linux\nkernel did not properly handle invalid IP options in some situations.\nAn attacker could use this to cause a denial of service or possibly\nexecute arbitrary code. (CVE-2017-5970)\n\nGareth Evans discovered that the shm IPC subsystem in the Linux kernel\ndid not properly restrict mapping page zero. A local privileged\nattacker could use this to execute arbitrary code. (CVE-2017-5669)\n\nAlexander Popov discovered that a race condition existed in the Stream\nControl Transmission Protocol (SCTP) implementation in the Linux\nkernel. A local attacker could use this to cause a denial of service\n(system crash). (CVE-2017-5986)\n\nDmitry Vyukov discovered that the Linux kernel did not properly handle\nTCP packets with the URG flag. A remote attacker could use this to\ncause a denial of service. (CVE-2017-6214)\n\nAndrey Konovalov discovered that the LLC subsytem in the Linux kernel\ndid not properly set up a destructor in certain situations. A local\nattacker could use this to cause a denial of service (system crash).\n(CVE-2017-6345)\n\nIt was discovered that a race condition existed in the AF_PACKET\nhandling code in the Linux kernel. A local attacker could use this to\ncause a denial of service (system crash) or possibly execute arbitrary\ncode. (CVE-2017-6346)\n\nAndrey Konovalov discovered that the IP layer in the Linux kernel made\nimproper assumptions about internal data layout when performing\nchecksums. A local attacker could use this to cause a denial of\nservice (system crash) or possibly execute arbitrary code.\n(CVE-2017-6347)\n\nDmitry Vyukov discovered race conditions in the Infrared (IrDA)\nsubsystem in the Linux kernel. A local attacker could use this to\ncause a denial of service (deadlock). (CVE-2017-6348).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://usn.ubuntu.com/3265-1/\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-aws\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-generic\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-generic-lpae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-gke\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-lowlatency\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-raspi2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-snapdragon\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-aws\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-generic\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lpae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-gke\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-lowlatency\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-raspi2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-snapdragon\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:16.04\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/02/14\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/04/24\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/04/25\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"Ubuntu Security Notice (C) 2017-2023 Canonical, Inc. / NASL script (C) 2017-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"linux_alt_patch_detect.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"ubuntu.inc\");\ninclude(\"ksplice.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/Ubuntu/release\");\nif ( isnull(release) ) audit(AUDIT_OS_NOT, \"Ubuntu\");\nvar release = chomp(release);\nif (! preg(pattern:\"^(16\\.04)$\", string:release)) audit(AUDIT_OS_NOT, \"Ubuntu 16.04\", \"Ubuntu \" + release);\nif ( ! get_kb_item(\"Host/Debian/dpkg-l\") ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Ubuntu', cpu);\n\nif (get_one_kb_item(\"Host/ksplice/kernel-cves\"))\n{\n rm_kb_item(name:\"Host/uptrack-uname-r\");\n cve_list = make_list(\"CVE-2017-5669\", \"CVE-2017-5897\", \"CVE-2017-5970\", \"CVE-2017-5986\", \"CVE-2017-6214\", \"CVE-2017-6345\", \"CVE-2017-6346\", \"CVE-2017-6347\", \"CVE-2017-6348\", \"CVE-2017-7374\");\n if (ksplice_cves_check(cve_list))\n {\n audit(AUDIT_PATCH_INSTALLED, \"KSplice hotfix for USN-3265-1\");\n }\n else\n {\n _ubuntu_report = ksplice_reporting_text();\n }\n}\n\nvar flag = 0;\n\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.4.0-1012-gke\", pkgver:\"4.4.0-1012.12\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.4.0-1016-aws\", pkgver:\"4.4.0-1016.25\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.4.0-1054-raspi2\", pkgver:\"4.4.0-1054.61\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.4.0-1057-snapdragon\", pkgver:\"4.4.0-1057.61\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.4.0-75-generic\", pkgver:\"4.4.0-75.96\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.4.0-75-generic-lpae\", pkgver:\"4.4.0-75.96\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.4.0-75-lowlatency\", pkgver:\"4.4.0-75.96\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-aws\", pkgver:\"4.4.0.1016.19\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-generic\", pkgver:\"4.4.0.75.81\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-generic-lpae\", pkgver:\"4.4.0.75.81\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-gke\", pkgver:\"4.4.0.1012.14\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-lowlatency\", pkgver:\"4.4.0.75.81\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-raspi2\", pkgver:\"4.4.0.1054.55\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-snapdragon\", pkgver:\"4.4.0.1057.50\")) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"linux-image-4.4-aws / linux-image-4.4-generic / etc\");\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-01-11T14:23:32", "description": "The openSUSE Leap 42.1 kernel was updated to 4.1.39 to receive various security and bugfixes.\n\nThe following security bugs were fixed :\n\n - CVE-2017-5669: The do_shmat function in ipc/shm.c in the Linux kernel did not restrict the address calculated by a certain rounding operation, which allowed local users to map page zero, and consequently bypass a protection mechanism that exists for the mmap system call, by making crafted shmget and shmat system calls in a privileged context (bnc#1026914).\n\n - CVE-2017-6348: The hashbin_delete function in net/irda/irqueue.c in the Linux kernel improperly manages lock dropping, which allowed local users to cause a denial of service (deadlock) via crafted operations on IrDA devices (bnc#1027178).\n\n - CVE-2017-7184: The xfrm_replay_verify_len function in net/xfrm/xfrm_user.c in the Linux kernel did not validate certain size data after an XFRM_MSG_NEWAE update, which allowed local users to obtain root privileges or cause a denial of service (heap-based out-of-bounds access) by leveraging the CAP_NET_ADMIN capability, as demonstrated during a Pwn2Own competition at CanSecWest 2017 for the Ubuntu 16.10 linux-image-* package 4.8.0.41.52 (bnc#1030573).\n\n - CVE-2016-10200: Race condition in the L2TPv3 IP Encapsulation feature in the Linux kernel allowed local users to gain privileges or cause a denial of service (use-after-free) by making multiple bind system calls without properly ascertaining whether a socket has the SOCK_ZAPPED status, related to net/l2tp/l2tp_ip.c and net/l2tp/l2tp_ip6.c (bnc#1028415).\n\n - CVE-2017-2636: Race condition in drivers/tty/n_hdlc.c in the Linux kernel allowed local users to gain privileges or cause a denial of service (double free) by setting the HDLC line discipline (bnc#1027565).\n\n - CVE-2017-6345: The LLC subsystem in the Linux kernel did not ensure that a certain destructor exists in required circumstances, which allowed local users to cause a denial of service (BUG_ON) or possibly have unspecified other impact via crafted system calls (bnc#1027190).\n\n - CVE-2017-6346: Race condition in net/packet/af_packet.c in the Linux kernel allowed local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via a multithreaded application that made PACKET_FANOUT setsockopt system calls (bnc#1027189).\n\n - CVE-2017-6347: The ip_cmsg_recv_checksum function in net/ipv4/ip_sockglue.c in the Linux kernel has incorrect expectations about skb data layout, which allowed local users to cause a denial of service (buffer over-read) or possibly have unspecified other impact via crafted system calls, as demonstrated by use of the MSG_MORE flag in conjunction with loopback UDP transmission (bnc#1027179).\n\n - CVE-2017-6353: net/sctp/socket.c in the Linux kernel did not properly restrict association peel-off operations during certain wait states, which allowed local users to cause a denial of service (invalid unlock and double free) via a multithreaded application. NOTE: this vulnerability exists because of an incorrect fix for CVE-2017-5986 (bnc#1025235).\n\n - CVE-2017-6214: The tcp_splice_read function in net/ipv4/tcp.c in the Linux kernel allowed remote attackers to cause a denial of service (infinite loop and soft lockup) via vectors involving a TCP packet with the URG flag (bnc#1026722).\n\n - CVE-2016-2117: The atl2_probe function in drivers/net/ethernet/atheros/atlx/atl2.c in the Linux kernel incorrectly enables scatter/gather I/O, which allowed remote attackers to obtain sensitive information from kernel memory by reading packet data (bnc#968697).\n\n - CVE-2016-10208: The ext4_fill_super function in fs/ext4/super.c in the Linux kernel did not properly validate meta block groups, which allowed physically proximate attackers to cause a denial of service (out-of-bounds read and system crash) via a crafted ext4 image (bnc#1023377).\n\n - CVE-2017-2596: The nested_vmx_check_vmptr function in arch/x86/kvm/vmx.c in the Linux kernel improperly emulates the VMXON instruction, which allowed KVM L1 guest OS users to cause a denial of service (host OS memory consumption) by leveraging the mishandling of page references (bnc#1022785).\n\n - CVE-2017-2583: The load_segment_descriptor implementation in arch/x86/kvm/emulate.c in the Linux kernel improperly emulates a 'MOV SS, NULL selector' instruction, which allowed guest OS users to cause a denial of service (guest OS crash) or gain guest OS privileges via a crafted application (bnc#1020602).\n\n - CVE-2017-2584: arch/x86/kvm/emulate.c in the Linux kernel allowed local users to obtain sensitive information from kernel memory or cause a denial of service (use-after-free) via a crafted application that leverages instruction emulation for fxrstor, fxsave, sgdt, and sidt (bnc#1019851).\n\nThe following non-security bugs were fixed :\n\n - Fix kABI breakage of musb struct in 4.1.39 (stable 4.1.39).\n\n - Revert 'ptrace: Capture the ptracer's creds not PT_PTRACE_CAP' (stable 4.1.39).\n\n - ext4: fix fencepost in s_first_meta_bg validation (bsc#1029986).\n\n - ext4: validate s_first_meta_bg at mount time (bsc#1023377).\n\n - kabi/severities: Ignore x86/kvm kABI changes for 4.1.39\n\n - l2tp: fix address test in __l2tp_ip6_bind_lookup() (bsc#1028415).\n\n - l2tp: fix lookup for sockets not bound to a device in l2tp_ip (bsc#1028415).\n\n - l2tp: fix racy socket lookup in l2tp_ip and l2tp_ip6 bind() (bsc#1028415).\n\n - l2tp: hold socket before dropping lock in l2tp_ip(, 6)_recv() (bsc#1028415).\n\n - l2tp: lock socket before checking flags in connect() (bsc#1028415).\n\n - mm/huge_memory.c: respect FOLL_FORCE/FOLL_COW for thp (bsc#1030118).", "cvss3": {"exploitabilityScore": 2.5, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.4, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2017-04-03T00:00:00", "type": "nessus", "title": "openSUSE Security Update : the Linux Kernel (openSUSE-2017-419)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-10200", "CVE-2016-10208", "CVE-2016-2117", "CVE-2017-2583", "CVE-2017-2584", "CVE-2017-2596", "CVE-2017-2636", "CVE-2017-5669", "CVE-2017-5986", "CVE-2017-6214", "CVE-2017-6345", "CVE-2017-6346", "CVE-2017-6347", "CVE-2017-6348", "CVE-2017-6353", "CVE-2017-7184"], "modified": "2021-01-19T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:kernel-debug", "p-cpe:/a:novell:opensuse:kernel-debug-base", "p-cpe:/a:novell:opensuse:kernel-debug-base-debuginfo", "p-cpe:/a:novell:opensuse:kernel-debug-debuginfo", "p-cpe:/a:novell:opensuse:kernel-debug-debugsource", "p-cpe:/a:novell:opensuse:kernel-debug-devel", "p-cpe:/a:novell:opensuse:kernel-debug-devel-debuginfo", "p-cpe:/a:novell:opensuse:kernel-default", "p-cpe:/a:novell:opensuse:kernel-default-base", "p-cpe:/a:novell:opensuse:kernel-default-base-debuginfo", "p-cpe:/a:novell:opensuse:kernel-default-debuginfo", "p-cpe:/a:novell:opensuse:kernel-default-debugsource", "p-cpe:/a:novell:opensuse:kernel-default-devel", "p-cpe:/a:novell:opensuse:kernel-devel", "p-cpe:/a:novell:opensuse:kernel-docs-html", "p-cpe:/a:novell:opensuse:kernel-docs-pdf", "p-cpe:/a:novell:opensuse:kernel-ec2", "p-cpe:/a:novell:opensuse:kernel-ec2-base", "p-cpe:/a:novell:opensuse:kernel-ec2-base-debuginfo", "p-cpe:/a:novell:opensuse:kernel-ec2-debuginfo", "p-cpe:/a:novell:opensuse:kernel-ec2-debugsource", "p-cpe:/a:novell:opensuse:kernel-ec2-devel", "p-cpe:/a:novell:opensuse:kernel-macros", "p-cpe:/a:novell:opensuse:kernel-obs-build", "p-cpe:/a:novell:opensuse:kernel-obs-build-debugsource", "p-cpe:/a:novell:opensuse:kernel-obs-qa", "p-cpe:/a:novell:opensuse:kernel-pae", "p-cpe:/a:novell:opensuse:kernel-pae-base", "p-cpe:/a:novell:opensuse:kernel-pae-base-debuginfo", "p-cpe:/a:novell:opensuse:kernel-pae-debuginfo", "p-cpe:/a:novell:opensuse:kernel-pae-debugsource", "p-cpe:/a:novell:opensuse:kernel-pae-devel", "p-cpe:/a:novell:opensuse:kernel-pv", "p-cpe:/a:novell:opensuse:kernel-pv-base", "p-cpe:/a:novell:opensuse:kernel-pv-base-debuginfo", "p-cpe:/a:novell:opensuse:kernel-pv-debuginfo", "p-cpe:/a:novell:opensuse:kernel-pv-debugsource", "p-cpe:/a:novell:opensuse:kernel-pv-devel", "p-cpe:/a:novell:opensuse:kernel-source", "p-cpe:/a:novell:opensuse:kernel-source-vanilla", "p-cpe:/a:novell:opensuse:kernel-syms", "p-cpe:/a:novell:opensuse:kernel-vanilla", "p-cpe:/a:novell:opensuse:kernel-vanilla-debuginfo", "p-cpe:/a:novell:opensuse:kernel-vanilla-debugsource", "p-cpe:/a:novell:opensuse:kernel-vanilla-devel", "p-cpe:/a:novell:opensuse:kernel-xen", "p-cpe:/a:novell:opensuse:kernel-xen-base", "p-cpe:/a:novell:opensuse:kernel-xen-base-debuginfo", "p-cpe:/a:novell:opensuse:kernel-xen-debuginfo", "p-cpe:/a:novell:opensuse:kernel-xen-debugsource", "p-cpe:/a:novell:opensuse:kernel-xen-devel", "cpe:/o:novell:opensuse:42.1"], "id": "OPENSUSE-2017-419.NASL", "href": "https://www.tenable.com/plugins/nessus/99157", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2017-419.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(99157);\n script_version(\"3.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/19\");\n\n script_cve_id(\"CVE-2016-10200\", \"CVE-2016-10208\", \"CVE-2016-2117\", \"CVE-2017-2583\", \"CVE-2017-2584\", \"CVE-2017-2596\", \"CVE-2017-2636\", \"CVE-2017-5669\", \"CVE-2017-5986\", \"CVE-2017-6214\", \"CVE-2017-6345\", \"CVE-2017-6346\", \"CVE-2017-6347\", \"CVE-2017-6348\", \"CVE-2017-6353\", \"CVE-2017-7184\");\n\n script_name(english:\"openSUSE Security Update : the Linux Kernel (openSUSE-2017-419)\");\n script_summary(english:\"Check for the openSUSE-2017-419 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The openSUSE Leap 42.1 kernel was updated to 4.1.39 to receive various\nsecurity and bugfixes.\n\nThe following security bugs were fixed :\n\n - CVE-2017-5669: The do_shmat function in ipc/shm.c in the\n Linux kernel did not restrict the address calculated by\n a certain rounding operation, which allowed local users\n to map page zero, and consequently bypass a protection\n mechanism that exists for the mmap system call, by\n making crafted shmget and shmat system calls in a\n privileged context (bnc#1026914).\n\n - CVE-2017-6348: The hashbin_delete function in\n net/irda/irqueue.c in the Linux kernel improperly\n manages lock dropping, which allowed local users to\n cause a denial of service (deadlock) via crafted\n operations on IrDA devices (bnc#1027178).\n\n - CVE-2017-7184: The xfrm_replay_verify_len function in\n net/xfrm/xfrm_user.c in the Linux kernel did not\n validate certain size data after an XFRM_MSG_NEWAE\n update, which allowed local users to obtain root\n privileges or cause a denial of service (heap-based\n out-of-bounds access) by leveraging the CAP_NET_ADMIN\n capability, as demonstrated during a Pwn2Own competition\n at CanSecWest 2017 for the Ubuntu 16.10 linux-image-*\n package 4.8.0.41.52 (bnc#1030573).\n\n - CVE-2016-10200: Race condition in the L2TPv3 IP\n Encapsulation feature in the Linux kernel allowed local\n users to gain privileges or cause a denial of service\n (use-after-free) by making multiple bind system calls\n without properly ascertaining whether a socket has the\n SOCK_ZAPPED status, related to net/l2tp/l2tp_ip.c and\n net/l2tp/l2tp_ip6.c (bnc#1028415).\n\n - CVE-2017-2636: Race condition in drivers/tty/n_hdlc.c in\n the Linux kernel allowed local users to gain privileges\n or cause a denial of service (double free) by setting\n the HDLC line discipline (bnc#1027565).\n\n - CVE-2017-6345: The LLC subsystem in the Linux kernel did\n not ensure that a certain destructor exists in required\n circumstances, which allowed local users to cause a\n denial of service (BUG_ON) or possibly have unspecified\n other impact via crafted system calls (bnc#1027190).\n\n - CVE-2017-6346: Race condition in net/packet/af_packet.c\n in the Linux kernel allowed local users to cause a\n denial of service (use-after-free) or possibly have\n unspecified other impact via a multithreaded application\n that made PACKET_FANOUT setsockopt system calls\n (bnc#1027189).\n\n - CVE-2017-6347: The ip_cmsg_recv_checksum function in\n net/ipv4/ip_sockglue.c in the Linux kernel has incorrect\n expectations about skb data layout, which allowed local\n users to cause a denial of service (buffer over-read) or\n possibly have unspecified other impact via crafted\n system calls, as demonstrated by use of the MSG_MORE\n flag in conjunction with loopback UDP transmission\n (bnc#1027179).\n\n - CVE-2017-6353: net/sctp/socket.c in the Linux kernel did\n not properly restrict association peel-off operations\n during certain wait states, which allowed local users to\n cause a denial of service (invalid unlock and double\n free) via a multithreaded application. NOTE: this\n vulnerability exists because of an incorrect fix for\n CVE-2017-5986 (bnc#1025235).\n\n - CVE-2017-6214: The tcp_splice_read function in\n net/ipv4/tcp.c in the Linux kernel allowed remote\n attackers to cause a denial of service (infinite loop\n and soft lockup) via vectors involving a TCP packet with\n the URG flag (bnc#1026722).\n\n - CVE-2016-2117: The atl2_probe function in\n drivers/net/ethernet/atheros/atlx/atl2.c in the Linux\n kernel incorrectly enables scatter/gather I/O, which\n allowed remote attackers to obtain sensitive information\n from kernel memory by reading packet data (bnc#968697).\n\n - CVE-2016-10208: The ext4_fill_super function in\n fs/ext4/super.c in the Linux kernel did not properly\n validate meta block groups, which allowed physically\n proximate attackers to cause a denial of service\n (out-of-bounds read and system crash) via a crafted ext4\n image (bnc#1023377).\n\n - CVE-2017-2596: The nested_vmx_check_vmptr function in\n arch/x86/kvm/vmx.c in the Linux kernel improperly\n emulates the VMXON instruction, which allowed KVM L1\n guest OS users to cause a denial of service (host OS\n memory consumption) by leveraging the mishandling of\n page references (bnc#1022785).\n\n - CVE-2017-2583: The load_segment_descriptor\n implementation in arch/x86/kvm/emulate.c in the Linux\n kernel improperly emulates a 'MOV SS, NULL selector'\n instruction, which allowed guest OS users to cause a\n denial of service (guest OS crash) or gain guest OS\n privileges via a crafted application (bnc#1020602).\n\n - CVE-2017-2584: arch/x86/kvm/emulate.c in the Linux\n kernel allowed local users to obtain sensitive\n information from kernel memory or cause a denial of\n service (use-after-free) via a crafted application that\n leverages instruction emulation for fxrstor, fxsave,\n sgdt, and sidt (bnc#1019851).\n\nThe following non-security bugs were fixed :\n\n - Fix kABI breakage of musb struct in 4.1.39 (stable\n 4.1.39).\n\n - Revert 'ptrace: Capture the ptracer's creds not\n PT_PTRACE_CAP' (stable 4.1.39).\n\n - ext4: fix fencepost in s_first_meta_bg validation\n (bsc#1029986).\n\n - ext4: validate s_first_meta_bg at mount time\n (bsc#1023377).\n\n - kabi/severities: Ignore x86/kvm kABI changes for 4.1.39\n\n - l2tp: fix address test in __l2tp_ip6_bind_lookup()\n (bsc#1028415).\n\n - l2tp: fix lookup for sockets not bound to a device in\n l2tp_ip (bsc#1028415).\n\n - l2tp: fix racy socket lookup in l2tp_ip and l2tp_ip6\n bind() (bsc#1028415).\n\n - l2tp: hold socket before dropping lock in l2tp_ip(,\n 6)_recv() (bsc#1028415).\n\n - l2tp: lock socket before checking flags in connect()\n (bsc#1028415).\n\n - mm/huge_memory.c: respect FOLL_FORCE/FOLL_COW for thp\n (bsc#1030118).\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1019851\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1020602\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1022785\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1023377\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1025235\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1026722\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1026914\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1027066\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1027178\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1027179\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1027189\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1027190\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1027565\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1028415\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1029986\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1030118\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1030573\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=968697\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected the Linux Kernel packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-debug\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-debug-base\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-debug-base-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-debug-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-debug-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-debug-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-debug-devel-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-default\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-default-base\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-default-base-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-default-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-default-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-default-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-docs-html\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-docs-pdf\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-ec2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-ec2-base\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-ec2-base-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-ec2-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-ec2-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-ec2-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-macros\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-obs-build\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-obs-build-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-obs-qa\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-pae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-pae-base\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-pae-base-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-pae-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-pae-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-pae-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-pv\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-pv-base\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-pv-base-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-pv-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-pv-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-pv-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-source\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-source-vanilla\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-syms\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-vanilla\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-vanilla-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-vanilla-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-vanilla-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-xen\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-xen-base\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-xen-base-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-xen-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-xen-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-xen-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:42.1\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2016/05/02\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/04/01\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/04/03\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2017-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE42\\.1)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"42.1\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE42.1\", reference:\"kernel-default-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"kernel-default-base-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"kernel-default-base-debuginfo-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"kernel-default-debuginfo-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"kernel-default-debugsource-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"kernel-default-devel-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"kernel-devel-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"kernel-docs-html-4.1.39-53.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"kernel-docs-pdf-4.1.39-53.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"kernel-macros-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"kernel-obs-build-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"kernel-obs-build-debugsource-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"kernel-obs-qa-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"kernel-source-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"kernel-source-vanilla-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"kernel-syms-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-debug-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-debug-base-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-debug-base-debuginfo-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-debug-debuginfo-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-debug-debugsource-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-debug-devel-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-debug-devel-debuginfo-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-ec2-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-ec2-base-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-ec2-base-debuginfo-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-ec2-debuginfo-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-ec2-debugsource-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-ec2-devel-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-pae-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-pae-base-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-pae-base-debuginfo-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-pae-debuginfo-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-pae-debugsource-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-pae-devel-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-pv-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-pv-base-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-pv-base-debuginfo-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-pv-debuginfo-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-pv-debugsource-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-pv-devel-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-vanilla-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-vanilla-debuginfo-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-vanilla-debugsource-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-vanilla-devel-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-xen-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-xen-base-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-xen-base-debuginfo-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-xen-debuginfo-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-xen-debugsource-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"i686\", reference:\"kernel-xen-devel-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-debug-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-debug-base-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-debug-base-debuginfo-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-debug-debuginfo-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-debug-debugsource-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-debug-devel-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-debug-devel-debuginfo-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-ec2-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-ec2-base-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-ec2-base-debuginfo-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-ec2-debuginfo-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-ec2-debugsource-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-ec2-devel-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-pae-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-pae-base-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-pae-base-debuginfo-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-pae-debuginfo-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-pae-debugsource-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-pae-devel-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-pv-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-pv-base-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-pv-base-debuginfo-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-pv-debuginfo-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-pv-debugsource-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-pv-devel-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-vanilla-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-vanilla-debuginfo-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-vanilla-debugsource-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-vanilla-devel-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-xen-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-xen-base-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-xen-base-debuginfo-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-xen-debuginfo-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-xen-debugsource-4.1.39-53.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"kernel-xen-devel-4.1.39-53.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kernel-debug / kernel-debug-base / kernel-debug-base-debuginfo / etc\");\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-13T14:40:47", "description": "Dmitry Vyukov discovered that the generic SCSI (sg) subsystem in the Linux kernel contained a stack-based buffer overflow. A local attacker with access to an sg device could use this to cause a denial of service (system crash) or possibly execute arbitrary code.\n(CVE-2017-7187)\n\nIt was discovered that a NULL pointer dereference existed in the Direct Rendering Manager (DRM) driver for VMware devices in the Linux kernel. A local attacker could use this to cause a denial of service (system crash). (CVE-2017-7261)\n\nLi Qiang discovered that an integer overflow vulnerability existed in the Direct Rendering Manager (DRM) driver for VMware devices in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.\n(CVE-2017-7294)\n\nIt was discovered that an information leak existed in the set_mempolicy and mbind compat syscalls in the Linux kernel. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2017-7616).\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 7.8, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2017-05-17T00:00:00", "type": "nessus", "title": "Ubuntu 16.04 LTS : linux vulnerabilities (USN-3291-1)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": true, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-7187", "CVE-2017-7261", "CVE-2017-7294", "CVE-2017-7616"], "modified": "2023-01-12T00:00:00", "cpe": ["p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-generic", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-generic-lpae", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-lowlatency", "p-cpe:/a:canonical:ubuntu_linux:linux-image-generic", "p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lpae", "p-cpe:/a:canonical:ubuntu_linux:linux-image-lowlatency", "cpe:/o:canonical:ubuntu_linux:16.04"], "id": "UBUNTU_USN-3291-1.NASL", "href": "https://www.tenable.com/plugins/nessus/100252", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-3291-1. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(100252);\n script_version(\"3.9\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/01/12\");\n\n script_cve_id(\"CVE-2017-7187\", \"CVE-2017-7261\", \"CVE-2017-7294\", \"CVE-2017-7616\");\n script_xref(name:\"USN\", value:\"3291-1\");\n\n script_name(english:\"Ubuntu 16.04 LTS : linux vulnerabilities (USN-3291-1)\");\n script_summary(english:\"Checks dpkg output for updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\n\"The remote Ubuntu host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"Dmitry Vyukov discovered that the generic SCSI (sg) subsystem in the\nLinux kernel contained a stack-based buffer overflow. A local attacker\nwith access to an sg device could use this to cause a denial of\nservice (system crash) or possibly execute arbitrary code.\n(CVE-2017-7187)\n\nIt was discovered that a NULL pointer dereference existed in the\nDirect Rendering Manager (DRM) driver for VMware devices in the Linux\nkernel. A local attacker could use this to cause a denial of service\n(system crash). (CVE-2017-7261)\n\nLi Qiang discovered that an integer overflow vulnerability existed in\nthe Direct Rendering Manager (DRM) driver for VMware devices in the\nLinux kernel. A local attacker could use this to cause a denial of\nservice (system crash) or possibly execute arbitrary code.\n(CVE-2017-7294)\n\nIt was discovered that an information leak existed in the\nset_mempolicy and mbind compat syscalls in the Linux kernel. A local\nattacker could use this to expose sensitive information (kernel\nmemory). (CVE-2017-7616).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://usn.ubuntu.com/3291-1/\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-generic\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-generic-lpae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-lowlatency\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-generic\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lpae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-lowlatency\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:16.04\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/03/20\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/05/16\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/05/17\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"Ubuntu Security Notice (C) 2017-2023 Canonical, Inc. / NASL script (C) 2017-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"linux_alt_patch_detect.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"ubuntu.inc\");\ninclude(\"ksplice.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/Ubuntu/release\");\nif ( isnull(release) ) audit(AUDIT_OS_NOT, \"Ubuntu\");\nvar release = chomp(release);\nif (! preg(pattern:\"^(16\\.04)$\", string:release)) audit(AUDIT_OS_NOT, \"Ubuntu 16.04\", \"Ubuntu \" + release);\nif ( ! get_kb_item(\"Host/Debian/dpkg-l\") ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Ubuntu', cpu);\n\nif (get_one_kb_item(\"Host/ksplice/kernel-cves\"))\n{\n rm_kb_item(name:\"Host/uptrack-uname-r\");\n cve_list = make_list(\"CVE-2017-7187\", \"CVE-2017-7261\", \"CVE-2017-7294\", \"CVE-2017-7616\");\n if (ksplice_cves_check(cve_list))\n {\n audit(AUDIT_PATCH_INSTALLED, \"KSplice hotfix for USN-3291-1\");\n }\n else\n {\n _ubuntu_report = ksplice_reporting_text();\n }\n}\n\nvar flag = 0;\n\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.4.0-78-generic\", pkgver:\"4.4.0-78.99\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.4.0-78-generic-lpae\", pkgver:\"4.4.0-78.99\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.4.0-78-lowlatency\", pkgver:\"4.4.0-78.99\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-generic\", pkgver:\"4.4.0.78.84\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-generic-lpae\", pkgver:\"4.4.0.78.84\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-lowlatency\", pkgver:\"4.4.0.78.84\")) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"linux-image-4.4-generic / linux-image-4.4-generic-lpae / etc\");\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-13T14:40:07", "description": "USN-3291-1 fixed vulnerabilities in the generic Linux kernel. This update provides the corresponding updates for the Linux kernel built for specific processors and cloud environments.\n\nDmitry Vyukov discovered that the generic SCSI (sg) subsystem in the Linux kernel contained a stack-based buffer overflow. A local attacker with access to an sg device could use this to cause a denial of service (system crash) or possibly execute arbitrary code.\n(CVE-2017-7187)\n\nIt was discovered that a NULL pointer dereference existed in the Direct Rendering Manager (DRM) driver for VMware devices in the Linux kernel. A local attacker could use this to cause a denial of service (system crash). (CVE-2017-7261)\n\nLi Qiang discovered that an integer overflow vulnerability existed in the Direct Rendering Manager (DRM) driver for VMware devices in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.\n(CVE-2017-7294)\n\nIt was discovered that an information leak existed in the set_mempolicy and mbind compat syscalls in the Linux kernel. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2017-7616).\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 7.8, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2017-05-18T00:00:00", "type": "nessus", "title": "Ubuntu 16.04 LTS : linux-aws, linux-gke, linux-raspi2, linux-snapdragon vulnerabilities (USN-3291-2)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": true, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-7187", "CVE-2017-7261", "CVE-2017-7294", "CVE-2017-7616"], "modified": "2023-01-12T00:00:00", "cpe": ["p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-aws", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-gke", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-raspi2", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-snapdragon", "p-cpe:/a:canonical:ubuntu_linux:linux-image-aws", "p-cpe:/a:canonical:ubuntu_linux:linux-image-gke", "p-cpe:/a:canonical:ubuntu_linux:linux-image-raspi2", "p-cpe:/a:canonical:ubuntu_linux:linux-image-snapdragon", "cpe:/o:canonical:ubuntu_linux:16.04"], "id": "UBUNTU_USN-3291-2.NASL", "href": "https://www.tenable.com/plugins/nessus/100266", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-3291-2. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(100266);\n script_version(\"3.9\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/01/12\");\n\n script_cve_id(\"CVE-2017-7187\", \"CVE-2017-7261\", \"CVE-2017-7294\", \"CVE-2017-7616\");\n script_xref(name:\"USN\", value:\"3291-2\");\n\n script_name(english:\"Ubuntu 16.04 LTS : linux-aws, linux-gke, linux-raspi2, linux-snapdragon vulnerabilities (USN-3291-2)\");\n script_summary(english:\"Checks dpkg output for updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\n\"The remote Ubuntu host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"USN-3291-1 fixed vulnerabilities in the generic Linux kernel. This\nupdate provides the corresponding updates for the Linux kernel built\nfor specific processors and cloud environments.\n\nDmitry Vyukov discovered that the generic SCSI (sg) subsystem in the\nLinux kernel contained a stack-based buffer overflow. A local attacker\nwith access to an sg device could use this to cause a denial of\nservice (system crash) or possibly execute arbitrary code.\n(CVE-2017-7187)\n\nIt was discovered that a NULL pointer dereference existed in the\nDirect Rendering Manager (DRM) driver for VMware devices in the Linux\nkernel. A local attacker could use this to cause a denial of service\n(system crash). (CVE-2017-7261)\n\nLi Qiang discovered that an integer overflow vulnerability existed in\nthe Direct Rendering Manager (DRM) driver for VMware devices in the\nLinux kernel. A local attacker could use this to cause a denial of\nservice (system crash) or possibly execute arbitrary code.\n(CVE-2017-7294)\n\nIt was discovered that an information leak existed in the\nset_mempolicy and mbind compat syscalls in the Linux kernel. A local\nattacker could use this to expose sensitive information (kernel\nmemory). (CVE-2017-7616).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://usn.ubuntu.com/3291-2/\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-aws\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-gke\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-raspi2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-snapdragon\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-aws\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-gke\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-raspi2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-snapdragon\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:16.04\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/03/20\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/05/17\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/05/18\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"Ubuntu Security Notice (C) 2017-2023 Canonical, Inc. / NASL script (C) 2017-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"linux_alt_patch_detect.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"ubuntu.inc\");\ninclude(\"ksplice.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/Ubuntu/release\");\nif ( isnull(release) ) audit(AUDIT_OS_NOT, \"Ubuntu\");\nvar release = chomp(release);\nif (! preg(pattern:\"^(16\\.04)$\", string:release)) audit(AUDIT_OS_NOT, \"Ubuntu 16.04\", \"Ubuntu \" + release);\nif ( ! get_kb_item(\"Host/Debian/dpkg-l\") ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Ubuntu', cpu);\n\nif (get_one_kb_item(\"Host/ksplice/kernel-cves\"))\n{\n rm_kb_item(name:\"Host/uptrack-uname-r\");\n cve_list = make_list(\"CVE-2017-7187\", \"CVE-2017-7261\", \"CVE-2017-7294\", \"CVE-2017-7616\");\n if (ksplice_cves_check(cve_list))\n {\n audit(AUDIT_PATCH_INSTALLED, \"KSplice hotfix for USN-3291-2\");\n }\n else\n {\n _ubuntu_report = ksplice_reporting_text();\n }\n}\n\nvar flag = 0;\n\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.4.0-1013-gke\", pkgver:\"4.4.0-1013.13\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.4.0-1017-aws\", pkgver:\"4.4.0-1017.26\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.4.0-1055-raspi2\", pkgver:\"4.4.0-1055.62\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-4.4.0-1058-snapdragon\", pkgver:\"4.4.0-1058.62\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-aws\", pkgver:\"4.4.0.1017.20\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-gke\", pkgver:\"4.4.0.1013.15\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-raspi2\", pkgver:\"4.4.0.1055.56\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"linux-image-snapdragon\", pkgver:\"4.4.0.1058.51\")) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"linux-image-4.4-aws / linux-image-4.4-gke / linux-image-4.4-raspi2 / etc\");\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-13T14:40:26", "description": "USN-3291-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS.\n\nDmitry Vyukov discovered that the generic SCSI (sg) subsystem in the Linux kernel contained a stack-based buffer overflow. A local attacker with access to an sg device could use this to cause a denial of service (system crash) or possibly execute arbitrary code.\n(CVE-2017-7187)\n\nIt was discovered that a NULL pointer dereference existed in the Direct Rendering Manager (DRM) driver for VMware devices in the Linux kernel. A local attacker could use this to cause a denial of service (system crash). (CVE-2017-7261)\n\nLi Qiang discovered that an integer overflow vulnerability existed in the Direct Rendering Manager (DRM) driver for VMware devices in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.\n(CVE-2017-7294)\n\nIt was discovered that an information leak existed in the set_mempolicy and mbind compat syscalls in the Linux kernel. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2017-7616).\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 7.8, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2017-05-18T00:00:00", "type": "nessus", "title": "Ubuntu 14.04 LTS : linux-lts-xenial vulnerabilities (USN-3291-3)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.2, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": true, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-7187", "CVE-2017-7261", "CVE-2017-7294", "CVE-2017-7616"], "modified": "2023-01-12T00:00:00", "cpe": ["p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-generic", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-generic-lpae", "p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-lowlatency", "p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lpae-lts-xenial", "p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lts-xenial", "p-cpe:/a:canonical:ubuntu_linux:linux-image-lowlatency-lts-xenial", "cpe:/o:canonical:ubuntu_linux:14.04"], "id": "UBUNTU_USN-3291-3.NASL", "href": "https://www.tenable.com/plugins/nessus/100267", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-3291-3. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(100267);\n script_version(\"3.9\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/01/12\");\n\n script_cve_id(\"CVE-2017-7187\", \"CVE-2017-7261\", \"CVE-2017-7294\", \"CVE-2017-7616\");\n script_xref(name:\"USN\", value:\"3291-3\");\n\n script_name(english:\"Ubuntu 14.04 LTS : linux-lts-xenial vulnerabilities (USN-3291-3)\");\n script_summary(english:\"Checks dpkg output for updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\n\"The remote Ubuntu host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"USN-3291-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04\nLTS. This update provides the corresponding updates for the Linux\nHardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu\n14.04 LTS.\n\nDmitry Vyukov discovered that the generic SCSI (sg) subsystem in the\nLinux kernel contained a stack-based buffer overflow. A local attacker\nwith access to an sg device could use this to cause a denial of\nservice (system crash) or possibly execute arbitrary code.\n(CVE-2017-7187)\n\nIt was discovered that a NULL pointer dereference existed in the\nDirect Rendering Manager (DRM) driver for VMware devices in the Linux\nkernel. A local attacker could use this to cause a denial of service\n(system crash). (CVE-2017-7261)\n\nLi Qiang discovered that an integer overflow vulnerability existed in\nthe Direct Rendering Manager (DRM) driver for VMware devices in the\nLinux kernel. A local attacker could use this to cause a denial of\nservice (system crash) or possibly execute arbitrary code.\n(CVE-2017-7294)\n\nIt was discovered that an information leak existed in the\nset_mempolicy and mbind compat syscalls in the Linux kernel. A local\nattacker could use this to expose sensitive information (kernel\nmemory). (CVE-2017-7616).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://usn.ubuntu.com/3291-3/\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-generic\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-generic-lpae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-lowlatency\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lpae-lts-xenial\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lts-xenial\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:linux-image-lowlatency-lts-xenial\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:14.04\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/03/20\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/05/17\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/05/18\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"Ubuntu Security Notice (C) 2017-2023 Canonical, Inc. / NASL script (C) 2017-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"linux_alt_patch_detect.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"ubuntu.inc\");\ninclude(\"ksplice.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/Ubuntu/release\");\nif ( isnull(release) ) audit(AUDIT_OS_NOT, \"Ubuntu\");\nvar release = chomp(release);\nif (! preg(pattern:\"^(14\\.04)$\", string:release)) audit(AUDIT_OS_NOT, \"Ubuntu 14.04\", \"Ubuntu \" + release);\nif ( ! get_kb_item(\"Host/Debian/dpkg-l\") ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Ubuntu', cpu);\n\nif (get_one_kb_item(\"Host/ksplice/kernel-cves\"))\n{\n rm_kb_item(name:\"Host/uptrack-uname-r\");\n cve_list = make_list(\"CVE-2017-7187\", \"CVE-2017-7261\", \"CVE-2017-7294\", \"CVE-2017-7616\");\n if (ksplice_cves_check(cve_list))\n {\n audit(AUDIT_PATCH_INSTALLED, \"KSplice hotfix for USN-3291-3\");\n }\n else\n {\n _ubuntu_report = ksplice_reporting_text();\n }\n}\n\nvar flag = 0;\n\nif (ubuntu_check(osver:\"14.04\", pkgname:\"linux-image-4.4.0-78-generic\", pkgver:\"4.4.0-78.99~14.04.2\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"linux-image-4.4.0-78-generic-lpae\", pkgver:\"4.4.0-78.99~14.04.2\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"linux-image-4.4.0-78-lowlatency\", pkgver:\"4.4.0-78.99~14.04.2\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"linux-image-generic-lpae-lts-xenial\", pkgver:\"4.4.0.78.63\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"linux-image-generic-lts-xenial\", pkgver:\"4.4.0.78.63\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"linux-image-lowlatency-lts-xenial\", pkgver:\"4.4.0.78.63\")) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"linux-image-4.4-generic / linux-image-4.4-generic-lpae / etc\");\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-11T14:19:18", "description": "The openSUSE Leap 42.2 kernel was updated to 4.4.49 to receive various security and bugfixes.\n\nThe following security bugs were fixed :\n\n - CVE-2017-5986: A userlevel triggerable BUG_ON on sctp_wait_for_sndbuf was fixed. (bsc#1025235)\n\n - CVE-2017-5970: The ipv4_pktinfo_prepare function in net/ipv4/ip_sockglue.c in the Linux kernel allowed attackers to cause a denial of service (system crash) via (1) an application that made crafted system calls or possibly (2) IPv4 traffic with invalid IP options (bnc#1024938).\n\n - CVE-2017-5897: A potential remote denial of service within the IPv6 GRE protocol was fixed. (bsc#1023762)\n\n - CVE-2017-6074: The dccp_rcv_state_process function in net/dccp/input.c in the Linux kernel mishandled DCCP_PKT_REQUEST packet data structures in the LISTEN state, which allowed local users to cause a denial of service (invalid free) or possibly have unspecified other impact via an application that makes an IPV6_RECVPKTINFO setsockopt system call. (bsc#1026024).\n\nThe following non-security bugs were fixed :\n\n - btrfs: fix btrfs_compat_ioctl failures on non-compat ioctls (bsc#1018100).\n\n - iwlwifi: Expose the default fallback ucode API to module info (boo#1021082, boo#1023884).\n\n - kabi: protect struct tcp_fastopen_cookie (kabi).\n\n - md: ensure md devices are freed before module is unloaded (bsc#1022304).\n\n - md: Fix a regression reported by bsc#1020048 in patches.fixes/0003-md-lockless-I-O-submission-for-RAID1.\n patch (bsc#982783,bsc#998106,bsc#1020048).\n\n - net: ethtool: Initialize buffer when querying device channel settings (bsc#969479 FATE#320634).\n\n - net: implement netif_cond_dbg macro (bsc#1019168).\n\n - sfc: reduce severity of PIO buffer alloc failures (bsc#1019168).\n\n - sfc: refactor debug-or-warnings printks (bsc#1019168).\n\n - xfs_dmapi: fix the debug compilation of xfs_dmapi (bsc#989056).\n\n - xfs: do not allow di_size with high bit set (bsc#1024234).\n\n - xfs: exclude never-released buffers from buftarg I/O accounting (bsc#1024508).\n\n - xfs: fix broken multi-fsb buffer logging (bsc#1024081).\n\n - xfs: fix buffer overflow dm_get_dirattrs/dm_get_dirattrs2 (bsc#989056).\n\n - xfs: fix up xfs_swap_extent_forks inline extent handling (bsc#1023888).\n\n - xfs: track and serialize in-flight async buffers against unmount (bsc#1024508).\n\n - xfs: track and serialize in-flight async buffers against unmount - kABI (bsc#1024508).", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2017-02-24T00:00:00", "type": "nessus", "title": "openSUSE Security Update : the Linux Kernel (openSUSE-2017-286)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": true, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-5897", "CVE-2017-5970", "CVE-2017-5986", "CVE-2017-6074"], "modified": "2021-01-19T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:kernel-debug", "p-cpe:/a:novell:opensuse:kernel-debug-base", "p-cpe:/a:novell:opensuse:kernel-debug-base-debuginfo", "p-cpe:/a:novell:opensuse:kernel-debug-debuginfo", "p-cpe:/a:novell:opensuse:kernel-debug-debugsource", "p-cpe:/a:novell:opensuse:kernel-debug-devel", "p-cpe:/a:novell:opensuse:kernel-debug-devel-debuginfo", "p-cpe:/a:novell:opensuse:kernel-default", "p-cpe:/a:novell:opensuse:kernel-default-base", "p-cpe:/a:novell:opensuse:kernel-default-base-debuginfo", "p-cpe:/a:novell:opensuse:kernel-default-debuginfo", "p-cpe:/a:novell:opensuse:kernel-default-debugsource", "p-cpe:/a:novell:opensuse:kernel-default-devel", "p-cpe:/a:novell:opensuse:kernel-devel", "p-cpe:/a:novell:opensuse:kernel-docs-html", "p-cpe:/a:novell:opensuse:kernel-docs-pdf", "p-cpe:/a:novell:opensuse:kernel-macros", "p-cpe:/a:novell:opensuse:kernel-obs-build", "p-cpe:/a:novell:opensuse:kernel-obs-build-debugsource", "p-cpe:/a:novell:opensuse:kernel-obs-qa", "p-cpe:/a:novell:opensuse:kernel-source", "p-cpe:/a:novell:opensuse:kernel-source-vanilla", "p-cpe:/a:novell:opensuse:kernel-syms", "p-cpe:/a:novell:opensuse:kernel-vanilla", "p-cpe:/a:novell:opensuse:kernel-vanilla-base", "p-cpe:/a:novell:opensuse:kernel-vanilla-base-debuginfo", "p-cpe:/a:novell:opensuse:kernel-vanilla-debuginfo", "p-cpe:/a:novell:opensuse:kernel-vanilla-debugsource", "p-cpe:/a:novell:opensuse:kernel-vanilla-devel", "cpe:/o:novell:opensuse:42.2"], "id": "OPENSUSE-2017-286.NASL", "href": "https://www.tenable.com/plugins/nessus/97366", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2017-286.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(97366);\n script_version(\"3.9\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/19\");\n\n script_cve_id(\"CVE-2017-5897\", \"CVE-2017-5970\", \"CVE-2017-5986\", \"CVE-2017-6074\");\n\n script_name(english:\"openSUSE Security Update : the Linux Kernel (openSUSE-2017-286)\");\n script_summary(english:\"Check for the openSUSE-2017-286 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The openSUSE Leap 42.2 kernel was updated to 4.4.49 to receive various\nsecurity and bugfixes.\n\nThe following security bugs were fixed :\n\n - CVE-2017-5986: A userlevel triggerable BUG_ON on\n sctp_wait_for_sndbuf was fixed. (bsc#1025235)\n\n - CVE-2017-5970: The ipv4_pktinfo_prepare function in\n net/ipv4/ip_sockglue.c in the Linux kernel allowed\n attackers to cause a denial of service (system crash)\n via (1) an application that made crafted system calls or\n possibly (2) IPv4 traffic with invalid IP options\n (bnc#1024938).\n\n - CVE-2017-5897: A potential remote denial of service\n within the IPv6 GRE protocol was fixed. (bsc#1023762)\n\n - CVE-2017-6074: The dccp_rcv_state_process function in\n net/dccp/input.c in the Linux kernel mishandled\n DCCP_PKT_REQUEST packet data structures in the LISTEN\n state, which allowed local users to cause a denial of\n service (invalid free) or possibly have unspecified\n other impact via an application that makes an\n IPV6_RECVPKTINFO setsockopt system call. (bsc#1026024).\n\nThe following non-security bugs were fixed :\n\n - btrfs: fix btrfs_compat_ioctl failures on non-compat\n ioctls (bsc#1018100).\n\n - iwlwifi: Expose the default fallback ucode API to module\n info (boo#1021082, boo#1023884).\n\n - kabi: protect struct tcp_fastopen_cookie (kabi).\n\n - md: ensure md devices are freed before module is\n unloaded (bsc#1022304).\n\n - md: Fix a regression reported by bsc#1020048 in\n patches.fixes/0003-md-lockless-I-O-submission-for-RAID1.\n patch (bsc#982783,bsc#998106,bsc#1020048).\n\n - net: ethtool: Initialize buffer when querying device\n channel settings (bsc#969479 FATE#320634).\n\n - net: implement netif_cond_dbg macro (bsc#1019168).\n\n - sfc: reduce severity of PIO buffer alloc failures\n (bsc#1019168).\n\n - sfc: refactor debug-or-warnings printks (bsc#1019168).\n\n - xfs_dmapi: fix the debug compilation of xfs_dmapi\n (bsc#989056).\n\n - xfs: do not allow di_size with high bit set\n (bsc#1024234).\n\n - xfs: exclude never-released buffers from buftarg I/O\n accounting (bsc#1024508).\n\n - xfs: fix broken multi-fsb buffer logging (bsc#1024081).\n\n - xfs: fix buffer overflow\n dm_get_dirattrs/dm_get_dirattrs2 (bsc#989056).\n\n - xfs: fix up xfs_swap_extent_forks inline extent handling\n (bsc#1023888).\n\n - xfs: track and serialize in-flight async buffers against\n unmount (bsc#1024508).\n\n - xfs: track and serialize in-flight async buffers against\n unmount - kABI (bsc#1024508).\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1012382\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1018100\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1019168\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1020048\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1021082\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1022181\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1022304\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1023762\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1023884\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1023888\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1024081\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1024234\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1024508\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1024938\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1025235\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1026024\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=969479\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=982783\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=989056\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=998106\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected the Linux Kernel packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:F/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-debug\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-debug-base\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-debug-base-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-debug-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-debug-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-debug-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-debug-devel-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-default\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-default-base\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-default-base-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-default-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-default-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-default-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-docs-html\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-docs-pdf\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-macros\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-obs-build\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-obs-build-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-obs-qa\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-source\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-source-vanilla\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-syms\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-vanilla\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-vanilla-base\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-vanilla-base-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-vanilla-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-vanilla-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kernel-vanilla-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:42.2\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/02/22\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/02/24\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2017-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE42\\.2)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"42.2\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(x86_64)$\") audit(AUDIT_ARCH_NOT, \"x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE42.2\", reference:\"kernel-debug-4.4.49-16.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"kernel-debug-base-4.4.49-16.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"kernel-debug-base-debuginfo-4.4.49-16.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"kernel-debug-debuginfo-4.4.49-16.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"kernel-debug-debugsource-4.4.49-16.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"kernel-debug-devel-4.4.49-16.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"kernel-debug-devel-debuginfo-4.4.49-16.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"kernel-default-4.4.49-16.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"kernel-default-base-4.4.49-16.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"kernel-default-base-debuginfo-4.4.49-16.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"kernel-default-debuginfo-4.4.49-16.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"kernel-default-debugsource-4.4.49-16.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"kernel-default-devel-4.4.49-16.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"kernel-devel-4.4.49-16.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"kernel-docs-html-4.4.49-16.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"kernel-docs-pdf-4.4.49-16.2\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"kernel-macros-4.4.49-16.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"kernel-obs-build-4.4.49-16.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"kernel-obs-build-debugsource-4.4.49-16.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"kernel-obs-qa-4.4.49-16.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"kernel-source-4.4.49-16.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"kernel-source-vanilla-4.4.49-16.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"kernel-syms-4.4.49-16.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"kernel-vanilla-4.4.49-16.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"kernel-vanilla-base-4.4.49-16.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"kernel-vanilla-base-debuginfo-4.4.49-16.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"kernel-vanilla-debuginfo-4.4.49-16.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"kernel-vanilla-debugsource-4.4.49-16.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"kernel-vanilla-devel-4.4.49-16.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kernel-docs-html / kernel-docs-pdf / kernel-devel / kernel-macros / etc\");\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-01-11T14:19:58", "description": "The openSUSE Leap 42.1 kernel was updated to receive various security and bugfixes.\n\nThe following security bugs were fixed :\n\n - CVE-2017-6074: The dccp_rcv_state_process function in net/dccp/input.c in the Linux kernel mishandled DCCP_PKT_REQUEST packet data structures in the LISTEN state, which allowed local users to cause a denial of service (invalid free) or possibly have unspecified other impact via an application that made an IPV6_RECVPKTINFO setsockopt system call (bnc#1026024).\n\n - CVE-2017-5986: Race condition in the sctp_wait_for_sndbuf function in net/sctp/socket.c in the Linux kernel allowed local users to cause a denial of service (assertion failure and panic) via a multithreaded application that peels off an association in a certain buffer-full state (bnc#1025235).\n\n - CVE-2017-5970: The ipv4_pktinfo_prepare function in net/ipv4/ip_sockglue.c in the Linux kernel allowed attackers to cause a denial of service (system crash) via (1) an application that made crafted system calls or possibly (2) IPv4 traffic with invalid IP options (bnc#1024938).\n\n - CVE-2017-5897: A potential remote denial of service within the IPv6 GRE protocol was fixed. (bsc#1023762)\n\nThe following non-security bugs were fixed :\n\n - btrfs: support NFSv2 export (bnc#929871).\n\n - btrfs: Direct I/O: Fix space accounting (bsc#1025058).\n\n - btrfs: add RAID 5/6 BTRFS_RBIO_REBUILD_MISSING operation (bsc#1025069).\n\n - btrfs: bail out if block group has different mixed flag (bsc#1025072).\n\n - btrfs: be more precise on errors when getting an inode from disk (bsc#981038).\n\n - btrfs: check pending chunks when shrinking fs to avoid corruption (bnc#936445).\n\n - btrfs: check prepare_uptodate_page() error code earlier (bnc#966910).\n\n - btrfs: do not BUG() during drop snapshot (bsc#1025076).\n\n - btrfs: do not collect ordered extents when logging that inode exists (bsc#977685).\n\n - btrfs: do not initialize a space info as full to prevent ENOSPC (bnc#944001).\n\n - btrfs: do not leak reloc root nodes on error (bsc#1025074).\n\n - btrfs: fix block group ->space_info NULL pointer dereference (bnc#935088).\n\n - btrfs: fix chunk allocation regression leading to transaction abort (bnc#938550).\n\n - btrfs: fix crash on close_ctree() if cleaner starts new transaction (bnc#938891).\n\n - btrfs: fix deadlock between direct IO reads and buffered writes (bsc#973855).\n\n - btrfs: fix deadlock between direct IO write and defrag/readpages (bnc#965344).\n\n - btrfs: fix device replace of a missing RAID 5/6 device (bsc#1025057).\n\n - btrfs: fix empty symlink after creating symlink and fsync parent dir (bsc#977685).\n\n - btrfs: fix extent accounting for partial direct IO writes (bsc#1025062).\n\n - btrfs: fix file corruption after cloning inline extents (bnc#942512).\n\n - btrfs: fix file loss on log replay after renaming a file and fsync (bsc#977685).\n\n - btrfs: fix file read corruption after extent cloning and fsync (bnc#946902).\n\n - btrfs: fix fitrim discarding device area reserved for boot loader's use (bsc#904489).\n\n - btrfs: fix for incorrect directory entries after fsync log replay (bsc#957805, bsc#977685).\n\n - btrfs: fix hang when failing to submit bio of directIO (bnc#942685).\n\n - btrfs: fix incremental send failure caused by balance (bsc#985850).\n\n - btrfs: fix invalid page accesses in extent_same (dedup) ioctl (bnc#968230).\n\n - btrfs: fix listxattrs not listing all xattrs packed in the same item (bsc#1025063).\n\n - btrfs: fix loading of orphan roots leading to BUG_ON (bsc#972844).\n\n - btrfs: fix memory corruption on failure to submit bio for direct IO (bnc#942685).\n\n - btrfs: fix memory leak in do_walk_down (bsc#1025075).\n\n - btrfs: fix memory leak in reading btree blocks (bsc#1025071).\n\n - btrfs: fix order by which delayed references are run (bnc#949440).\n\n - btrfs: fix page reading in extent_same ioctl leading to csum errors (bnc#968230).\n\n - btrfs: fix qgroup rescan worker initialization (bsc#1025077).\n\n - btrfs: fix qgroup sanity tests (bnc#951615).\n\n - btrfs: fix race between balance and unused block group deletion (bnc#938892).\n\n - btrfs: fix race between fsync and lockless direct IO writes (bsc#977685).\n\n - btrfs: fix race waiting for qgroup rescan worker (bnc#960300).\n\n - btrfs: fix regression running delayed references when using qgroups (bnc#951615).\n\n - btrfs: fix regression when running delayed references (bnc#951615).\n\n - btrfs: fix relocation incorrectly dropping data references (bsc#990384).\n\n - btrfs: fix shrinking truncate when the no_holes feature is enabled (bsc#1025053).\n\n - btrfs: fix sleeping inside atomic context in qgroup rescan worker (bnc#960300).\n\n - btrfs: fix stale dir entries after removing a link and fsync (bnc#942925).\n\n - btrfs: fix unreplayable log after snapshot delete + parent dir fsync (bsc#977685).\n\n - btrfs: fix warning in backref walking (bnc#966278).\n\n - btrfs: fix warning of bytes_may_use (bsc#1025065).\n\n - btrfs: fix wrong check for btrfs_force_chunk_alloc() (bnc#938550).\n\n - btrfs: handle quota reserve failure properly (bsc#1005666).\n\n - btrfs: incremental send, check if orphanized dir inode needs delayed rename (bsc#1025049).\n\n - btrfs: incremental send, do not delay directory renames unnecessarily (bsc#1025048).\n\n - btrfs: incremental send, fix clone operations for compressed extents (fate#316463).\n\n - btrfs: incremental send, fix premature rmdir operations (bsc#1025064).\n\n - btrfs: keep dropped roots in cache until transaction commit (bnc#935087, bnc#945649, bnc#951615).\n\n - btrfs: remove misleading handling of missing device scrub (bsc#1025055).\n\n - btrfs: remove unnecessary locking of cleaner_mutex to avoid deadlock (bsc#904489).\n\n - btrfs: return gracefully from balance if fs tree is corrupted (bsc#1025073).\n\n - btrfs: send, do not bug on inconsistent snapshots (bsc#985850).\n\n - btrfs: send, fix corner case for reference overwrite detection (bsc#1025080).\n\n - btrfs: send, fix file corruption due to incorrect cloning operations (bsc#1025060).\n\n - btrfs: set UNWRITTEN for prealloc'ed extents in fiemap (bsc#1025047).\n\n - btrfs: test_check_exists: Fix infinite loop when searching for free space entries (bsc#987192).\n\n - btrfs: use btrfs_get_fs_root in resolve_indirect_ref (bnc#935087, bnc#945649).\n\n - btrfs: use received_uuid of parent during send (bsc#1025051).\n\n - btrfs: wake up extent state waiters on unlock through clear_extent_bits (bsc#1025050).\n\n - btrfs: Add handler for invalidate page (bsc#963193).\n\n - btrfs: Add qgroup tracing (bnc#935087, bnc#945649).\n\n - btrfs: Avoid truncate tailing page if fallocate range does not exceed inode size (bsc#1025059).\n\n - btrfs: Continue write in case of can_not_nocow (bsc#1025070).\n\n - btrfs: Ensure proper sector alignment for btrfs_free_reserved_data_space (bsc#1005666).\n\n - btrfs: Export and move leaf/subtree qgroup helpers to qgroup.c (bsc#983087).\n\n - btrfs: Fix a data space underflow warning (bsc#985562, bsc#975596, bsc#984779).\n\n - btrfs: Handle unaligned length in extent_same (bsc#937609).\n\n - btrfs: abort transaction on btrfs_reloc_cow_block() (bsc#1025081).\n\n - btrfs: add missing discards when unpinning extents with\n -o discard (bsc#904489).\n\n - btrfs: advertise which crc32c implementation is being used on mount (bsc#946057).\n\n - btrfs: allow dedupe of same inode (bsc#1025067).\n\n - btrfs: backref: Add special time_seq == (u64)-1 case for btrfs_find_all_roots() (bnc#935087, bnc#945649).\n\n - btrfs: backref: Do not merge refs which are not for same block (bnc#935087, bnc#945649).\n\n - btrfs: btrfs_issue_discard ensure offset/length are aligned to sector boundaries (bsc#904489).\n\n - btrfs: change max_inline default to 2048 (bsc#949472).\n\n - btrfs: delayed-ref: Cleanup the unneeded functions (bnc#935087, bnc#945649).\n\n - btrfs: delayed-ref: Use list to replace the ref_root in ref_head (bnc#935087, bnc#945649).\n\n - btrfs: delayed-ref: double free in btrfs_add_delayed_tree_ref() (bsc#1025079).\n\n - btrfs: delayed_ref: Add new function to record reserved space into delayed ref (bsc#963193).\n\n - btrfs: delayed_ref: release and free qgroup reserved at proper timing (bsc#963193).\n\n - btrfs: disable defrag of tree roots.\n\n - btrfs: do not create or leak aliased root while cleaning up orphans (bsc#994881).\n\n - btrfs: do not update mtime/ctime on deduped inodes (bsc#937616).\n\n - btrfs: explictly delete unused block groups in close_ctree and ro-remount (bsc#904489).\n\n - btrfs: extent-tree: Add new version of btrfs_check_data_free_space and btrfs_free_reserved_data_space (bsc#963193).\n\n - btrfs: extent-tree: Add new version of btrfs_delalloc_reserve/release_space (bsc#963193).\n\n - btrfs: extent-tree: Switch to new check_data_free_space and free_reserved_data_space (bsc#963193).\n\n - btrfs: extent-tree: Switch to new delalloc space reserve and release (bsc#963193).\n\n - btrfs: extent-tree: Use ref_node to replace unneeded parameters in __inc_extent_ref() and __free_extent() (bnc#935087, bnc#945649).\n\n - btrfs: extent_io: Introduce needed structure for recoding set/clear bits (bsc#963193).\n\n - btrfs: extent_io: Introduce new function clear_record_extent_bits() (bsc#963193).\n\n - btrfs: extent_io: Introduce new function set_record_extent_bits (bsc#963193).\n\n - btrfs: fallocate: Add support to accurate qgroup reserve (bsc#963193).\n\n - btrfs: fix btrfs_compat_ioctl failures on non-compat ioctls (bsc#1018100).\n\n - btrfs: fix clone / extent-same deadlocks (bsc#937612).\n\n - btrfs: fix deadlock with extent-same and readpage (bsc#937612).\n\n - btrfs: fix resending received snapshot with parent (bsc#1025061).\n\n - btrfs: handle non-fatal errors in btrfs_qgroup_inherit() (bsc#972951).\n\n - btrfs: increment ctx->pos for every emitted or skipped dirent in readdir (bsc#981709).\n\n - btrfs: iterate over unused chunk space in FITRIM (bsc#904489).\n\n - btrfs: make btrfs_issue_discard return bytes discarded (bsc#904489).\n\n - btrfs: make file clone aware of fatal signals (bsc#1015787).\n\n - btrfs: pass unaligned length to btrfs_cmp_data() (bsc#937609).\n\n - btrfs: properly track when rescan worker is running (bsc#989953).\n\n - btrfs: provide super_operations->inode_get_dev (bsc#927455).\n\n - btrfs: qgroup: Add function qgroup_update_counters() (bnc#935087, bnc#945649).\n\n - btrfs: qgroup: Add function qgroup_update_refcnt() (bnc#935087, bnc#945649).\n\n - btrfs: qgroup: Add handler for NOCOW and inline (bsc#963193).\n\n - btrfs: qgroup: Add new function to record old_roots (bnc#935087, bnc#945649).\n\n - btrfs: qgroup: Add new qgroup calculation function btrfs_qgroup_account_extents() (bnc#935087, bnc#945649).\n\n - btrfs: qgroup: Add new trace point for qgroup data reserve (bsc#963193).\n\n - btrfs: qgroup: Add the ability to skip given qgroup for old/new_roots (bnc#935087, bnc#945649).\n\n - btrfs: qgroup: Avoid calling btrfs_free_reserved_data_space in clear_bit_hook (bsc#963193).\n\n - btrfs: qgroup: Check if qgroup reserved space leaked (bsc#963193).\n\n - btrfs: qgroup: Cleanup old inaccurate facilities (bsc#963193).\n\n - btrfs: qgroup: Cleanup open-coded old/new_refcnt update and read (bnc#935087, bnc#945649).\n\n - btrfs: qgroup: Cleanup the old ref_node-oriented mechanism (bnc#935087, bnc#945649).\n\n - btrfs: qgroup: Do not copy extent buffer to do qgroup rescan (bnc#960300).\n\n - btrfs: qgroup: Fix a race in delayed_ref which leads to abort trans (bsc#963193).\n\n - btrfs: qgroup: Fix a rebase bug which will cause qgroup double free (bsc#963193).\n\n - btrfs: qgroup: Fix a regression in qgroup reserved space (bnc#935087, bnc#945649).\n\n - btrfs: qgroup: Fix qgroup accounting when creating snapshot (bsc#972993).\n\n - btrfs: qgroup: Fix qgroup data leaking by using subtree tracing (bsc#983087).\n\n - btrfs: qgroup: Introduce btrfs_qgroup_reserve_data function (bsc#963193).\n\n - btrfs: qgroup: Introduce functions to release/free qgroup reserve data space (bsc#963193).\n\n - btrfs: qgroup: Introduce new functions to reserve/free metadata (bsc#963193).\n\n - btrfs: qgroup: Make snapshot accounting work with new extent-oriented qgroup (bnc#935087, bnc#945649).\n\n - btrfs: qgroup: Record possible quota-related extent for qgroup (bnc#935087, bnc#945649).\n\n - btrfs: qgroup: Switch rescan to new mechanism (bnc#935087, bnc#945649).\n\n - btrfs: qgroup: Switch self test to extent-oriented qgroup mechanism (bnc#935087, bnc#945649).\n\n - btrfs: qgroup: Switch to new extent-oriented qgroup mechanism (bnc#935087, bnc#945649).\n\n - btrfs: qgroup: Use new metadata reservation (bsc#963193).\n\n - btrfs: qgroup: account shared subtree during snapshot delete (bnc#935087, bnc#945649).\n\n - btrfs: qgroup: exit the rescan worker during umount (bnc#960300).\n\n - btrfs: qgroup: fix quota disable during rescan (bnc#960300).\n\n - btrfs: remove old tree_root dirent processing in btrfs_real_readdir() (bsc#981709).\n\n - btrfs: serialize subvolume mounts with potentially mismatching rw flags (bsc#951844).\n\n - btrfs: skip superblocks during discard (bsc#904489).\n\n - btrfs: syslog when quota is disabled.\n\n - btrfs: syslog when quota is enabled\n\n - btrfs: ulist: Add ulist_del() function (bnc#935087, bnc#945649).\n\n - btrfs: use the new VFS super_block_dev (bnc#865869).\n\n - btrfs: waiting on qgroup rescan should not always be interruptible (bsc#992712).\n\n - fs/super.c: add new super block sub devices super_block_dev (bnc#865869).\n\n - fs/super.c: fix race between freeze_super() and thaw_super() (bsc#1025066).\n\n - kabi: only use sops->get_inode_dev with proper fsflag (bsc#927455).\n\n - qgroup: Prevent qgroup->reserved from going subzero (bsc#993841).\n\n - vfs: add super_operations->get_inode_dev (bsc#927455).\n\n - xfs: do not allow di_size with high bit set (bsc#1024234).\n\n - xfs: exclude never-released buffers from buftarg I/O accounting (bsc#1024508).\n\n - xfs: fix broken multi-fsb buffer logging (bsc#1024081).\n\n - xfs: fix up xfs_swap_extent_forks inline extent handling (bsc#1023888).\n\n - xfs: track and serialize in-flight async buffers against unmount - kABI (bsc#1024508).\n\n - xfs: track and serialize in-flight async buffers against unmount (bsc#1024508).", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2017-02-24T00:00:00", "type": "nessus", "title": "openSUSE Security Update : the Linux Kernel (openSUSE-2017-287)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": true, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-5897", "CVE-2017-5970", "CVE-2017-5986", "CVE-2017-6074"], "modified": "2021-01-19T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:kernel-debug", "p-cpe:/a:novell:opensuse:kernel-debug-base", "p-cpe:/a:novell:opensuse:kernel-debug-base-debuginfo", "p-cpe:/a:novell:opensuse:kernel-debug-debuginfo", "p-cpe:/a:novell:opensuse:kernel-debug-debugsource", "p-cpe:/a:novell:opensuse:kernel-debug-devel", "p-cpe:/a:novell:opensuse:kernel-debug-devel-debuginfo", "p-cpe:/a:novell:opensuse:kernel-default", "p-cpe:/a:novell:opensuse:kernel-default-base", "p-cpe:/a:novell:opensuse:kernel-default-base-debuginfo", "p-cpe:/a:novell:opensuse:kernel-default-debuginfo", "p-cpe:/a:novell:opensuse:kernel-default-debugsource", "p-cpe:/a:novell:opensuse:kernel-default-devel", "p-cpe:/a:novell:opensuse:kernel-devel", "p-cpe:/a:novell:opensuse:kernel-docs-html", "p-cpe:/a:novell:opensuse:kernel-docs-pdf", "p-cpe:/a:novell:opensuse:kernel-ec2", "p-cpe:/a:novell:opensuse:kernel-ec2-base", "p-cpe:/a:novell:opensuse:kernel-ec2-base-debuginfo", "p-cpe:/a:novell:opensuse:kernel-ec2-debuginfo", "p-cpe:/a:novell:opensuse:kernel-ec2-debugsource", "p-cpe:/a:novell:opensuse:kernel-ec2-devel", "p-cpe:/a:novell:opensuse:kernel-macros", "p-cpe:/a:novell:opensuse:kernel-obs-build", "p-cpe:/a:novell:opensuse:kernel-obs-build-debugsource", "p-cpe:/a:novell:opensuse:kernel-obs-qa", "p-cpe:/a:novell:opensuse:kernel-pae", "p-cpe:/a:novell:opensuse:kernel-pae-base", "p-cpe:/a:novell:opensuse:kernel-pae-base-debuginfo", "p-cpe:/a:novell:opensuse:kernel-pae-debuginfo", "p-cpe:/a:novell:opensuse:kernel-pae-debugsource", "p-cpe:/a:novell:opensuse:kernel-pae-devel", "p-cpe:/a:novell:opensuse:kernel-pv", "p-cpe:/a:novell:opensuse:kernel-pv-base", "p-cpe:/a:novell:opensuse:kernel-pv-base-debuginfo", "p-cpe:/a:novell:opensuse:kernel-pv-debuginfo", "p-cpe:/a:novell:opensuse:kernel-pv-debugsource", "p-cpe:/a:novell:opensuse:kernel-pv-devel", "p-cpe:/a:novell:opensuse:kernel-source", "p-cpe:/a:novell:opensuse:kernel-source-vanilla", "p-cpe:/a:novell:opensuse:kernel-syms", "p-cpe:/a:novell:opensuse:kernel-vanilla", "p-cpe:/a:novell:opensuse:kernel-vanilla-debuginfo", "p-cpe:/a:novell:opensuse:kernel-vanilla-debugsource", "p-cpe:/a:novell:opensuse:kernel-vanilla-devel", "p-cpe:/a:novell:opensuse:kernel-xen", "p-cpe:/a:novell:opensuse:kernel-xen-base", "p-cpe:/a:novell:opensuse:kernel-xen-base-debuginfo", "p-cpe:/a:novell:opensuse:kernel-xen-debuginfo", "p-cpe:/a:novell:opensuse:kernel-xen-debugsource", "p-cpe:/a:novell:opensuse:kernel-xen-devel", "cpe:/o:novell:opensuse:42.1"], "id": "OPENSUSE-2017-287.NASL", "href": "https://www.tenable.com/plugins/nessus/97367", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2017-287.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(97367);\n script_version(\"3.9\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/19\");\n\n script_cve_id(\"CVE-2017-5897\", \"CVE-2017-5970\", \"CVE-2017-5986\", \"CVE-2017-6074\");\n\n script_name(english:\"openSUSE Security Update : the Linux Kernel (openSUSE-2017-287)\");\n script_summary(english:\"Check for the openSUSE-2017-287 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The openSUSE Leap 42.1 kernel was updated to receive various security\nand bugfixes.\n\nThe following security bugs were fixed :\n\n - CVE-2017-6074: The dccp_rcv_state_process function in\n net/dccp/input.c in the Linux kernel mishandled\n DCCP_PKT_REQUEST packet data structures in the LISTEN\n state, which allowed local users to cause a denial of\n service (invalid free) or possibly have unspecified\n other impact via an application that made an\n IPV6_RECVPKTINFO setsockopt system call (bnc#1026024).\n\n - CVE-2017-5986: Race condition in the\n sctp_wait_for_sndbuf function in net/sctp/socket.c in\n the Linux kernel allowed local users to cause a denial\n of service (assertion failure and panic) via a\n multithreaded application that peels off an association\n in a certain buffer-full state (bnc#1025235).\n\n - CVE-2017-5970: The ipv4_pktinfo_prepare function in\n net/ipv4/ip_sockglue.c in the Linux kernel allowed\n attackers to cause a denial of service (system crash)\n via (1) an application that made crafted system calls or\n possibly (2) IPv4 traffic with invalid IP options\n (bnc#1024938).\n\n - CVE-2017-5897: A potential remote denial of service\n within the IPv6 GRE protocol was fixed. (bsc#1023762)\n\nThe following non-security bugs were fixed :\n\n - btrfs: support NFSv2 export (bnc#929871).\n\n - btrfs: Direct I/O: Fix space accounting (bsc#1025058).\n\n - btrfs: add RAID 5/6 BTRFS_RBIO_REBUILD_MISSING operation\n (bsc#1025069).\n\n - btrfs: bail out if block group has different mixed flag\n (bsc#1025072).\n\n - btrfs: be more precise on errors when getting an inode\n from disk (bsc#981038).\n\n - btrfs: check pending chunks when shrinking fs to avoid\n corruption (bnc#936445).\n\n - btrfs: check prepare_uptodate_page() error code earlier\n (bnc#966910).\n\n - btrfs: do not BUG() during drop snapshot (bsc#1025076).\n\n - btrfs: do not collect ordered extents when logging that\n inode exists (bsc#977685).\n\n - btrfs: do not initialize a space info as full to prevent\n ENOSPC (bnc#944001).\n\n - btrfs: do not leak reloc root nodes on error\n (bsc#1025074).\n\n - btrfs: fix block group ->space_info NULL pointer\n dereference (bnc#935088).\n\n - btrfs: fix chunk allocation regression leading to\n transaction abort (bnc#938550).\n\n - btrfs: fix crash on close_ctree() if cleaner starts new\n transaction (bnc#938891).\n\n - btrfs: fix deadlock between direct IO reads and buffered\n writes (bsc#973855).\n\n - btrfs: fix deadlock between direct IO write and\n defrag/readpages (bnc#965344).\n\n - btrfs: fix device replace of a missing RAID 5/6 device\n (bsc#1025057).\n\n - btrfs: fix empty symlink after creating symlink and\n fsync parent dir (bsc#977685).\n\n - btrfs: fix extent accounting for partial direct IO\n writes (bsc#1025062).\n\n - btrfs: fix file corruption after cloning inline extents\n (bnc#942512).\n\n - btrfs: fix file loss on log replay after renaming a file\n and fsync (bsc#977685).\n\n - btrfs: fix file read corruption after extent cloning and\n fsync (bnc#946902).\n\n - btrfs: fix fitrim discarding device area reserved for\n boot loader's use (bsc#904489).\n\n - btrfs: fix for incorrect directory entries after fsync\n log replay (bsc#957805, bsc#977685).\n\n - btrfs: fix hang when failing to submit bio of directIO\n (bnc#942685).\n\n - btrfs: fix incremental send failure caused by balance\n (bsc#985850).\n\n - btrfs: fix invalid page accesses in extent_same (dedup)\n ioctl (bnc#968230).\n\n - btrfs: fix listxattrs not listing all xattrs packed in\n the same item (bsc#1025063).\n\n - btrfs: fix loading of orphan roots leading to BUG_ON\n (bsc#972844).\n\n - btrfs: fix memory corruption on failure to submit bio\n for direct IO (bnc#942685).\n\n - btrfs: fix memory leak in do_walk_down (bsc#1025075).\n\n - btrfs: fix memory leak in reading btree blocks\n (bsc#1025071).\n\n - btrfs: fix order by which delayed references are run\n (bnc#949440).\n\n - btrfs: fix page reading in extent_same ioctl leading to\n csum errors (bnc#968230).\n\n - btrfs: fix qgroup rescan worker initialization\n (bsc#1025077).\n\n - btrfs: fix qgroup sanity tests (bnc#951615).\n\n - btrfs: fix race between balance and unused block group\n deletion (bnc#938892).\n\n - btrfs: fix race between fsync and lockless direct IO\n writes (bsc#977685).\n\n - btrfs: fix race waiting for qgroup rescan worker\n (bnc#960300).\n\n - btrfs: fix regression running delayed references when\n using qgroups (bnc#951615).\n\n - btrfs: fix regression when running delayed references\n (bnc#951615).\n\n - btrfs: fix relocation incorrectly dropping data\n references (bsc#990384).\n\n - btrfs: fix shrinking truncate when the no_holes feature\n is enabled (bsc#1025053).\n\n - btrfs: fix sleeping inside atomic context in qgroup\n rescan worker (bnc#960300).\n\n - btrfs: fix stale dir entries after removing a link and\n fsync (bnc#942925).\n\n - btrfs: fix unreplayable log after snapshot delete +\n parent dir fsync (bsc#977685).\n\n - btrfs: fix warning in backref walking (bnc#966278).\n\n - btrfs: fix warning of bytes_may_use (bsc#1025065).\n\n - btrfs: fix wrong check for btrfs_force_chunk_alloc()\n (bnc#938550).\n\n - btrfs: handle quota reserve failure properly\n (bsc#1005666).\n\n - btrfs: incremental send, check if orphanized dir inode\n needs delayed rename (bsc#1025049).\n\n - btrfs: incremental send, do not delay directory renames\n unnecessarily (bsc#1025048).\n\n - btrfs: incremental send, fix clone operations for\n compressed extents (fate#316463).\n\n - btrfs: incremental send, fix premature rmdir operations\n (bsc#1025064).\n\n - btrfs: keep dropped roots in cache until transaction\n commit (bnc#935087, bnc#945649, bnc#951615).\n\n - btrfs: remove misleading handling of missing device\n scrub (bsc#1025055).\n\n - btrfs: remove unnecessary locking of cleaner_mutex to\n avoid deadlock (bsc#904489).\n\n - btrfs: return gracefully from balance if fs tree is\n corrupted (bsc#1025073).\n\n - btrfs: send, do not bug on inconsistent snapshots\n (bsc#985850).\n\n - btrfs: send, fix corner case for reference overwrite\n detection (bsc#1025080).\n\n - btrfs: send, fix file corruption due to incorrect\n cloning operations (bsc#1025060).\n\n - btrfs: set UNWRITTEN for prealloc'ed extents in fiemap\n (bsc#1025047).\n\n - btrfs: test_check_exists: Fix infinite loop when\n searching for free space entries (bsc#987192).\n\n - btrfs: use btrfs_get_fs_root in resolve_indirect_ref\n (bnc#935087, bnc#945649).\n\n - btrfs: use received_uuid of parent during send\n (bsc#1025051).\n\n - btrfs: wake up extent state waiters on unlock through\n clear_extent_bits (bsc#1025050).\n\n - btrfs: Add handler for invalidate page (bsc#963193).\n\n - btrfs: Add qgroup tracing (bnc#935087, bnc#945649).\n\n - btrfs: Avoid truncate tailing page if fallocate range\n does not exceed inode size (bsc#1025059).\n\n - btrfs: Continue write in case of can_not_nocow\n (bsc#1025070).\n\n - btrfs: Ensure proper sector alignment for\n btrfs_free_reserved_data_space (bsc#1005666).\n\n - btrfs: Export and move leaf/subtree qgroup helpers to\n qgroup.c (bsc#983087).\n\n - btrfs: Fix a data space underflow warning (bsc#985562,\n bsc#975596, bsc#984779).\n\n - btrfs: Handle unaligned length in extent_same\n (bsc#937609).\n\n - btrfs: abort transaction on btrfs_reloc_cow_block()\n (bsc#1025081).\n\n - btrfs: add missing discards when unpinning extents with\n -o discard (bsc#904489).\n\n - btrfs: advertise which crc32c implementation is being\n used on mount (bsc#946057).\n\n - btrfs: allow dedupe of same inode (bsc#1025067).\n\n - btrfs: backref: Add special time_seq == (u64)-1 case for\n btrfs_find_all_roots() (bnc#935087, bnc#945649).\n\n - btrfs: backref: Do not merge refs which are not for same\n block (bnc#935087, bnc#945649).\n\n - btrfs: btrfs_issue_discard ensure offset/length are\n aligned to sector boundaries (bsc#904489).\n\n - btrfs: change max_inline default to 2048 (bsc#949472).\n\n - btrfs: delayed-ref: Cleanup the unneeded functions\n (bnc#935087, bnc#945649).\n\n - btrfs: delayed-ref: Use list to replace the ref_root in\n ref_head (bnc#935087, bnc#945649).\n\n - btrfs: delayed-ref: double free in\n btrfs_add_delayed_tree_ref() (bsc#1025079).\n\n - btrfs: delayed_ref: Add new function to record reserved\n space into delayed ref (bsc#963193).\n\n - btrfs: delayed_ref: release and free qgroup reserved at\n proper timing (bsc#963193).\n\n - btrfs: disable defrag of tree roots.\n\n - btrfs: do not create or leak aliased root while cleaning\n up orphans (bsc#994881).\n\n - btrfs: do not update mtime/ctime on deduped inodes\n (bsc#937616).\n\n - btrfs: explictly delete unused block groups in\n close_ctree and ro-remount (bsc#904489).\n\n - btrfs: extent-tree: Add new version of\n btrfs_check_data_free_space and\n btrfs_free_reserved_data_space (bsc#963193).\n\n - btrfs: extent-tree: Add new version of\n btrfs_delalloc_reserve/release_space (bsc#963193).\n\n - btrfs: extent-tree: Switch to new check_data_free_space\n and free_reserved_data_space (bsc#963193).\n\n - btrfs: extent-tree: Switch to new delalloc space reserve\n and release (bsc#963193).\n\n - btrfs: extent-tree: Use ref_node to replace unneeded\n parameters in __inc_extent_ref() and __free_extent()\n (bnc#935087, bnc#945649).\n\n - btrfs: extent_io: Introduce needed structure for\n recoding set/clear bits (bsc#963193).\n\n - btrfs: extent_io: Introduce new function\n clear_record_extent_bits() (bsc#963193).\n\n - btrfs: extent_io: Introduce new function\n set_record_extent_bits (bsc#963193).\n\n - btrfs: fallocate: Add support to accurate qgroup reserve\n (bsc#963193).\n\n - btrfs: fix btrfs_compat_ioctl failures on non-compat\n ioctls (bsc#1018100).\n\n - btrfs: fix clone / extent-same deadlocks (bsc#937612).\n\n - btrfs: fix deadlock with extent-same and readpage\n (bsc#937612).\n\n - btrfs: fix resending received snapshot with parent\n (bsc#1025061).\n\n - btrfs: handle non-fatal errors in btrfs_qgroup_inherit()\n (bsc#972951).\n\n - btrfs: increment ctx->pos for every emitted or skipped\n dirent in readdir (bsc#981709).\n\n - btrfs: iterate over unused chunk space in FITRIM\n (bsc#904489).\n\n - btrfs: make btrfs_issue_discard return bytes discarded\n (bsc#904489).\n\n - btrfs: make file clone aware of fatal signals\n (bsc#1015787).\n\n - btrfs: pass unaligned length to btrfs_cmp_data()\n (bsc#937609).\n\n - btrfs: properly track when rescan worker is running\n (bsc#989953).\n\n - btrfs: provide super_operations->inode_get_dev\n (bsc#927455).\n\n - btrfs: qgroup: Add function qgroup_update_counters()\n (bnc#935087, bnc#945649).\n\n - btrfs: qgroup: Add function qgroup_update_refcnt()\n (bnc#935087, bnc#945649).\n\n - btrfs: qgroup: Add handler for NOCOW and inline\n (bsc#963193).\n\n - btrfs: qgroup: Add new function to record old_roots\n (bnc#935087, bnc#945649).\n\n - btrfs: qgroup: Add new qgroup calculation function\n btrfs_qgroup_account_extents() (bnc#935087, bnc#945649).\n\n - btrfs: qgroup: Add new trace point for qgroup data\n reserve (bsc#963193).\n\n - btrfs: qgroup: Add the ability to skip given qgroup for\n old/new_roots (bnc#935087, bnc#945649).\n\n - btrfs: qgroup: Avoid calling\n btrfs_free_reserved_data_space in clear_bit_hook\n (bsc#963193).\n\n - btrfs: qgroup: Check if qgroup reserved space leaked\n (bsc#963193).\n\n - btrfs: qgroup: Cleanup old inaccurate facilities\n (bsc#963193).\n\n - btrfs: qgroup: Cleanup open-coded old/new_refcnt update\n and read (bnc#935087, bnc#945649).\n\n - btrfs: qgroup: Cleanup the old ref_node-oriented\n mechanism (bnc#935087, bnc#945649).\n\n - btrfs: qgroup: Do not copy extent buffer to do qgroup\n rescan (bnc#960300).\n\n - btrfs: qgroup: Fix a race in delayed_ref which leads to\n abort trans (bsc#963193).\n\n - btrfs: qgroup: Fix a rebase bug which will cause qgroup\n double free (bsc#963193).\n\n - btrfs: qgroup: Fix a regression in qgroup reserved space\n (bnc#935087, bnc#945649).\n\n - btrfs: qgroup: Fix qgroup accounting when creating\n snapshot (bsc#972993).\n\n - btrfs: qgroup: Fix qgroup data leaking by using subtree\n tracing (bsc#983087).\n\n - btrfs: qgroup: Introduce btrfs_qgroup_reserve_data\n function (bsc#963193).\n\n - btrfs: qgroup: Introduce functions to release/free\n qgroup reserve data space (bsc#963193).\n\n - btrfs: qgroup: Introduce new functions to reserve/free\n metadata (bsc#963193).\n\n - btrfs: qgroup: Make snapshot accounting work with new\n extent-oriented qgroup (bnc#935087, bnc#945649).\n\n - btrfs: qgroup: Record possible quota-related extent for\n qgroup (bnc#935087, bnc#945649).\n\n - btrfs: qgroup: Switch rescan to new mechanism\n (bnc#935087, bnc#945649).\n\n - btrfs: qgroup: Switch self test to extent-oriented\n qgroup mechanism (bnc#935087, bnc#945649).\n\n - btrfs: qgroup: Switch to new extent-oriented qgroup\n mechanism (bnc#935087, bnc#945649).\n\n - btrfs: qgroup: Use new metadata reservation\n (bsc#963193).\n\n - btrfs: qgroup: account shared subtree during snapshot\n delete (bnc#935087, bnc#945649).\n\n - btrfs: qgroup: exit the rescan worker during umount\n (bnc#960300).\n\n - btrfs: qgroup: fix quota disable during rescan\n (bnc#960300).\n\n - btrfs: remove old tree_root dirent processing in\n btrfs_real_readdir() (bsc#981709).\n\n - btrfs: serialize subvolume mounts with potentially\n mismatching rw flags (bsc#951844).\n\n - btrfs: skip superblocks during discard (bsc#904489).\n\n - btrfs: syslog when quota is disabled.\n\n - btrfs: syslog when quota is enabled\n\n - btrfs: ulist: Add ulist_del() function (bnc#935087,\n bnc#945649).\n\n - btrfs: use the new VFS super_block_dev (bnc#865869).\n\n - btrfs: waiting on qgroup rescan should not always be\n interruptible (bsc#992712).\n\n - fs/super.c: add new super block sub devices\n super_block_dev (bnc#865869).\n\n - fs/super.c: fix race between freeze_super() and\n thaw_super() (bsc#1025066).\n\n - kabi: only use sops->get_inode_dev with proper fsflag\n (bsc#927455).\n\n - qgroup: Prevent qgroup->reserved from going subzero\n (bsc#993841).\n\n - vfs: add super_operations->get_inode_dev (bsc#927455).\n\n - xfs: do not allow di_size with high bit set\n (bsc#1024234).\n\n - xfs: exclude never-released buffers from buftarg I/O\n accounting (bsc#1024508).\n\n - xfs: fix broken multi-fsb buffer logging (bsc#1024081).\n\n - xfs: fix up xfs_swap_extent_forks inline extent handling\n (bsc#1023888).\n\n - xfs: track and serialize in-flight async buffers against\n unmount - kABI (bsc#1024508).\n\n - xfs: track and serialize in-flight async buffers against\n unmount (bsc#1024508).\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1005666\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1015787\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1018100\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1023762\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1023888\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1024081\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1024234\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1024508\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1024938\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1025047\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1025048\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1025049\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1025050\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1025051\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1025053\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1025055\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1025057\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1025058\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1025059\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1025060\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1025061\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1025062\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1025063\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1025064\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1025065\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1025066\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1025067\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1025069\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1025070\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1025071\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1025072\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1025073\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1025074\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1025075\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1025076\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1025077\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1025079\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1025080\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1025081\"\n );\n script_set_att

SUSE SLES12 Security Update : kernel (SUSE-SU-2017:1247-1)

Description

Related