Lucene search

K
suseSuseSUSE-SU-2015:1489-1
HistorySep 04, 2015 - 12:13 p.m.

Live patch for the Linux Kernel (important)

2015-09-0412:13:03
lists.opensuse.org
34

EPSS

0.399

Percentile

97.3%

This update contains a kernel live patch for the 3.12.32-33 SUSE Linux
Enterprise Server 12 Kernel, fixing following security issues.

  • CVE-2015-3339: A race condition in the prepare_binprm function in
    fs/exec.c in the Linux kernel allowed local users to gain privileges by
    executing a setuid program at a time instant when a chown to root is in
    progress, and the ownership is changed but the setuid bit is not yet
    stripped. (bsc#939263 bsc#939044)

  • CVE-2015-1465: The IPv4 implementation in the Linux kernel did not
    properly consider the length of the Read-Copy Update (RCU) grace period
    for redirecting lookups in the absence of caching, which allowed remote
    attackers to cause a denial of service (memory consumption or system
    crash) via a flood of packets. (bsc#939044 bsc#916225)

  • CVE-2015-3636: The ping_unhash function in net/ipv4/ping.c in the Linux
    kernel did not initialize a certain list data structure during an unhash
    operation, which allowed local users to gain privileges or cause a
    denial of service (use-after-free and system crash) by leveraging the
    ability to make a SOCK_DGRAM socket system call for the IPPROTO_ICMP
    or IPPROTO_ICMPV6 protocol, and then making a connect system call after
    a disconnect. (bsc#939277)

  • CVE-2015-5364/CVE-2015-5366: Two denial of service attacks via a flood
    of UDP packets with invalid checksums were fixed that could be used by
    remote attackers to delay execution. (bsc#939276)

  • CVE-2015-1805: The (1) pipe_read and (2) pipe_write implementations in
    fs/pipe.c in the Linux kernel did not properly consider the side effects
    of failed __copy_to_user_inatomic and __copy_from_user_inatomic calls,
    which allowed local users to cause a denial of service (system crash)
    or possibly gain privileges via a crafted application, aka an "I/O
    vector array overrun." (bsc#939270)

  • CVE-2015-4700: A BPF Jit optimization flaw could allow local users to
    panic the kernel. (bsc#939273)

  • CVE-2014-9710: The Btrfs implementation in the Linux kernel did not
    ensure that the visible xattr state is consistent with a requested
    replacement, which allowed local users to bypass intended ACL settings
    and gain privileges via standard filesystem operations (1) during an
    xattr-replacement time window, related to a race condition, or (2) after
    an xattr-replacement attempt that fails because the data does not fit.
    (bsc#939260)

  • CVE-2014-3687: The sctp_assoc_lookup_asconf_ack function in
    net/sctp/associola.c in the SCTP implementation in the Linux kernel
    allowed remote attackers to cause a denial of service (panic) via
    duplicate ASCONF chunks that trigger an incorrect uncork within the
    side-effect interpreter. (bsc#902349 bsc#939044)

  • CVE-2015-3331: The __driver_rfc4106_decrypt function in
    arch/x86/crypto/aesni-intel_glue.c in the Linux kernel did not properly
    determine the memory locations used for encrypted data, which allowed
    context-dependent attackers to cause a denial of service (buffer
    overflow and system crash) or possibly execute arbitrary code by
    triggering a crypto API call, as demonstrated by use of a libkcapi test
    program with an AF_ALG(aead) socket. (bsc#939262)

  • CVE-2014-8159: The InfiniBand (IB) implementation in the Linux kernel
    did not properly restrict use of User Verbs for registration of memory
    regions, which allowed local users to access arbitrary physical memory
    locations, and consequently cause a denial of service (system crash)
    or gain privileges, by leveraging permissions on a uverbs device under
    /dev/infiniband/. (bsc#939241)

  • CVE-2014-7822: The implementation of certain splice_write file
    operations in the Linux kernel before 3.16 does not enforce a restriction
    on the maximum size of a single file, which allows local users to cause
    a denial of service (system crash) or possibly have unspecified other
    impact via a crafted splice system call, as demonstrated by use of a
    file descriptor associated with an ext4 filesystem. (bsc#939240)