Security update for the Linux Kernel (Live Patch 3 for SLE 12 SP3) (important)

2018-02-02T00:13:17
ID SUSE-SU-2018:0347-1
Type suse
Reporter Suse
Modified 2018-02-02T00:13:17

Description

This update for the Linux Kernel 4.4.82-6_9 fixes several issues.

The following security issues were fixed:

  • CVE-2017-17712: The raw_sendmsg() function had a race condition that lead to uninitialized stack pointer usage. This allowed a local user to execute code and gain privileges (bsc#1073230).
  • CVE-2017-16939: The XFRM dump policy implementation allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages (bsc#1069708).