Security update for the Linux Kernel (important)

The openSUSE 13.2 kernel was updated to receive various security and
bugfixes.

The following security bugs were fixed:

• CVE-2015-8962: Double free vulnerability in the sg_common_write function
  in drivers/scsi/sg.c in the Linux kernel allowed local users to gain
  privileges or cause a denial of service (memory corruption and system
  crash) by detaching a device during an SG_IO ioctl call (bnc#1010501).
• CVE-2015-8963: Race condition in kernel/events/core.c in the Linux
  kernel allowed local users to gain privileges or cause a denial of
  service (use-after-free) by leveraging incorrect handling of an swevent
  data structure during a CPU unplug operation (bnc#1010502).
• CVE-2016-7042: The proc_keys_show function in security/keys/proc.c in
  the Linux kernel through 4.8.2, when the GNU Compiler Collection (gcc)
  stack protector is enabled, uses an incorrect buffer size for certain
  timeout data, which allowed local users to cause a denial of service
  (stack memory corruption and panic) by reading the /proc/keys file
  (bnc#1004517).
• CVE-2016-7910: Use-after-free vulnerability in the disk_seqf_stop
  function in block/genhd.c in the Linux kernel allowed local users to
  gain privileges by leveraging the execution of a certain stop operation
  even if the corresponding start operation had failed (bnc#1010716).
• CVE-2016-7911: Race condition in the get_task_ioprio function in
  block/ioprio.c in the Linux kernel allowed local users to gain
  privileges or cause a denial of service (use-after-free) via a crafted
  ioprio_get system call (bnc#1010711).
• CVE-2016-7913: The xc2028_set_config function in
  drivers/media/tuners/tuner-xc2028.c in the Linux kernel allowed local
  users to gain privileges or cause a denial of service (use-after-free)
  via vectors involving omission of the firmware name from a certain data
  structure (bnc#1010478).
• CVE-2016-7914: The assoc_array_insert_into_terminal_node function in
  lib/assoc_array.c in the Linux kernel did not check whether a slot is a
  leaf, which allowed local users to obtain sensitive information from
  kernel memory or cause a denial of service (invalid pointer dereference
  and out-of-bounds read) via an application that uses associative-array
  data structures, as demonstrated by the keyutils test suite
  (bnc#1010475).
• CVE-2016-7916: Race condition in the environ_read function in
  fs/proc/base.c in the Linux kernel allowed local users to obtain
  sensitive information from kernel memory by reading a /proc/*/environ
  file during a process-setup time interval in which environment-variable
  copying is incomplete (bnc#1010467).
• CVE-2016-8633: drivers/firewire/net.c in the Linux kernel before 4.8.7,
  in certain unusual hardware configurations, allowed remote attackers to
  execute arbitrary code via crafted fragmented packets (bnc#1008833).
• CVE-2016-8646: The hash_accept function in crypto/algif_hash.c in the
  Linux kernel allowed local users to cause a denial of service (OOPS) by
  attempting to trigger use of in-kernel hash algorithms for a socket that
  has received zero bytes of data (bnc#1010150).
• CVE-2016-8655: A race condition in the af_packet packet_set_ring
  function could be used by local attackers to crash the kernel or gain
  privileges (bsc#1012754).
• CVE-2016-9555: The sctp_sf_ootb function in net/sctp/sm_statefuns.c in
  the Linux kernel lacks chunk-length checking for the first chunk, which
  allowed remote attackers to cause a denial of service (out-of-bounds
  slab access) or possibly have unspecified other impact via crafted SCTP
  data (bnc#1011685).

The following non-security bugs were fixed:

• bna: Add synchronization for tx ring (bsc#993739).
• bonding: set carrier off for devices created through netlink
  (bsc#999577).
• btrfs: fix extent tree corruption due to relocation (bsc#990384).
• introduce NETIF_F_GSO_ENCAP_ALL helper mask (bsc#1001486).
• ipv6: send NEWLINK on RA managed/otherconf changes (bsc#934067).
• ipv6: send only one NEWLINK when RA causes changes (bsc#934067).
• tunnels: Remove encapsulation offloads on decap (bsc#1001486).
• usbhid: add ATEN CS962 to list of quirky devices (bsc#1007615).
• vmxnet3: Wake queue from reset work (bsc#999907).