CVE-2018-5390

Linux kernel versions 4.9+ can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service.

Linux kernel versions 4.9+ can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service.

This kernel update is based on the upstream 4.14.62 and fixes at least the following security issues:

Security researchers from FICORA have identified a remote denial of service attack against the Linux kernel caused by inefficient implementation of TCP segment reassembly, named "SegmentSmack". A remote attacker could consume a lot of CPU resources in the kernel networking stack with just a low bandwidth or single host attack by using lots of small TCP segments packets. Usually large botnets are needed for similar effect. The rate needed for this denial of service attack to be effective is several magnitudes lower than the usual packet processing capability of the machine, as the attack exploits worst case behaviour of existing algorithms (CVE-2018-5390).

An issue was discovered in the Linux kernel through 4.17.11, as used in Xen through 4.11.x. The xen_failsafe_callback entry point in arch/x86/entry/entry_64.S does not properly maintain RBX, which allows local users to cause a denial of service (uninitialized memory usage and system crash). Within Xen, 64-bit x86 PV Linux guest OS users can trigger a guest OS crash or possibly gain privileges (CVE-2018-14678).

Other changes in this update:

• WireGuard has been updated to 0.0.20180802.

For other upstream fixes in this update, see the referenced changelogs.

This kernel-tmb update is based on the upstream 4.14.62 and fixes at least the following security issues:

kernel KVM before versions kernel 4.16, kernel 4.16-rc7, kernel 4.17-rc1, kernel 4.17-rc2 and kernel 4.17-rc3 is vulnerable to a flaw in the way the Linux kernel's KVM hypervisor handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stack switch operation, the processor did not deliver interrupts and exceptions, rather they are delivered once the first instruction after the stack switch is executed. An unprivileged KVM guest user could use this flaw to crash the guest or, potentially, escalate their privileges in the guest (CVE-2018-1087).

Linux kernel vhost since version 4.8 does not properly initialize memory in messages passed between virtual guests and the host operating system in the vhost/vhost.c:vhost_new_msg() function. This can allow local privileged users to read some kernel memory contents when reading from the /dev/vhost-net device file (CVE-2018-1118).

Security researchers from FICORA have identified a remote denial of service attack against the Linux kernel caused by inefficient implementation of TCP segment reassembly, named "SegmentSmack". A remote attacker could consume a lot of CPU resources in the kernel networking stack with just a low bandwidth or single host attack by using lots of small TCP segments packets. Usually large botnets are needed for similar effect. The rate needed for this denial of service attack to be effective is several magnitudes lower than the usual packet processing capability of the machine, as the attack exploits worst case behaviour of existing algorithms (CVE-2018-5390). In the function sbusfb_ioctl_helper() in drivers/video/fbdev/sbuslib.c in the Linux kernel through 4.15, an integer signedness error allows arbitrary information leakage for the FBIOPUTCMAP_SPARC and FBIOGETCMAP_SPARC commands (CVE-2018-6412).

In some circumstances, some operating systems or hypervisors may not expect or properly handle an Intel architecture hardware debug exception. The error appears to be due to developer interpretation of existing documentation for certain Intel architecture interrupt/exception instructions, namely MOV SS and POP SS. An authenticated attacker may be able to read sensitive data in memory or control low-level operating system functions (CVE-2018-8897).

Linux kernel is vulnerable to a heap-based buffer overflow in the fs/ext4/xattr.c:ext4_xattr_set_entry() function. An attacker could exploit this by operating on a mounted crafted ext4 image (CVE-2018-10840).

The kvm functions that were used in the emulation of fxrstor, fxsave, sgdt and sidt were originally meant for task switching, and as such they did not check privilege levels. This allowed guest userspace to guest kernel write (CVE-2018-10853).

A flaw was found in Linux kernel ext4 File System. A use-after-free in ext4_ext_remove_space() when mounting and operating a crafted ext4 image (CVE-2018-10876).

Linux kernel ext4 filesystem is vulnerable to an out-of-bound access in the ext4_ext_drop_refs() function when operating on a crafted ext4 filesystem image (CVE-2018-10877).

A flaw was found in Linux kernel ext4 filesystem. A local user can cause a use-after-free in ext4_xattr_set_entry function and so a denial of service or possibly unspecified other impact by when renaming a file in a crafted ext4 filesystem image (CVE-2018-10879).

A flaw was found in Linux kernel ext4 filesystem code. A stack-out-of-bounds write in ext4_update_inline_data() is possible when mounting and writing to a crafted ext4 image. An attacker could use this to cause a system crash and a denial of service (CVE-2018-10880).

A flaw was found in Linux kernel ext4 filesystem. A local user can cause an out-of-bound access in ext4_get_group_info function and so a denial of service and a system crash by mounting and operating on a crafted ext4 filesystem image (CVE-2018-10881).

A flaw was…

This kernel-linus update is based on the upstream 4.14.62 and fixes at least the following security issues:

kernel KVM before versions kernel 4.16, kernel 4.16-rc7, kernel 4.17-rc1, kernel 4.17-rc2 and kernel 4.17-rc3 is vulnerable to a flaw in the way the Linux kernel's KVM hypervisor handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stack switch operation, the processor did not deliver interrupts and exceptions, rather they are delivered once the first instruction after the stack switch is executed. An unprivileged KVM guest user could use this flaw to crash the guest or, potentially, escalate their privileges in the guest (CVE-2018-1087).

Linux kernel vhost since version 4.8 does not properly initialize memory in messages passed between virtual guests and the host operating system in the vhost/vhost.c:vhost_new_msg() function. This can allow local privileged users to read some kernel memory contents when reading from the /dev/vhost-net device file (CVE-2018-1118).

Security researchers from FICORA have identified a remote denial of service attack against the Linux kernel caused by inefficient implementation of TCP segment reassembly, named "SegmentSmack". A remote attacker could consume a lot of CPU resources in the kernel networking stack with just a low bandwidth or single host attack by using lots of small TCP segments packets. Usually large botnets are needed for similar effect. The rate needed for this denial of service attack to be effective is several magnitudes lower than the usual packet processing capability of the machine, as the attack exploits worst case behaviour of existing algorithms (CVE-2018-5390). In the function sbusfb_ioctl_helper() in drivers/video/fbdev/sbuslib.c in the Linux kernel through 4.15, an integer signedness error allows arbitrary information leakage for the FBIOPUTCMAP_SPARC and FBIOGETCMAP_SPARC commands (CVE-2018-6412).

In some circumstances, some operating systems or hypervisors may not expect or properly handle an Intel architecture hardware debug exception. The error appears to be due to developer interpretation of existing documentation for certain Intel architecture interrupt/exception instructions, namely MOV SS and POP SS. An authenticated attacker may be able to read sensitive data in memory or control low-level operating system functions (CVE-2018-8897).

Linux kernel is vulnerable to a heap-based buffer overflow in the fs/ext4/xattr.c:ext4_xattr_set_entry() function. An attacker could exploit this by operating on a mounted crafted ext4 image (CVE-2018-10840).

The kvm functions that were used in the emulation of fxrstor, fxsave, sgdt and sidt were originally meant for task switching, and as such they did not check privilege levels. This allowed guest userspace to guest kernel write (CVE-2018-10853).

A flaw was found in Linux kernel ext4 File System. A use-after-free in ext4_ext_remove_space() when mounting and operating a crafted ext4 image (CVE-2018-10876).

Linux kernel ext4 filesystem is vulnerable to an out-of-bound access in the ext4_ext_drop_refs() function when operating on a crafted ext4 filesystem image (CVE-2018-10877).

A flaw was found in Linux kernel ext4 filesystem. A local user can cause a use-after-free in ext4_xattr_set_entry function and so a denial of service or possibly unspecified other impact by when renaming a file in a crafted ext4 filesystem image (CVE-2018-10879).

A flaw was found in Linux kernel ext4 filesystem code. A stack-out-of-bounds write in ext4_update_inline_data() is possible when mounting and writing to a crafted ext4 image. An attacker could use this to cause a system crash and a denial of service (CVE-2018-10880).

A flaw was found in Linux kernel ext4 filesystem. A local user can cause an out-of-bound access in ext4_get_group_info function and so a denial of service and a system crash by mounting and operating on a crafted ext4 filesystem image (CVE-2018-10881).

A flaw was…

The SUSE Linux Enterprise 15 kernel-azure was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-5390 aka 'SegmentSmack': A remote attacker even with relatively low bandwidth could have caused lots of CPU usage by triggering the worst case scenario during IP and/or TCP fragment reassembly (bsc#1102340)
• CVE-2017-18344: The timer_create syscall implementation didn't properly validate input, which could have lead to out-of-bounds access. This allowed userspace applications to read arbitrary kernel memory in some setups. (bsc#1102851)
• CVE-2018-13406: An integer overflow in the uvesafb_setcmap function could have result in local attackers being able to crash the kernel or potentially elevate privileges because kmalloc_array is not used (bnc#1100418)
• CVE-2018-13053: The alarm_timer_nsleep function had an integer overflow via a large relative timeout because ktime_add_safe was not used (bnc#1099924)
• CVE-2018-13405: The inode_init_owner function allowed local users to create files with an unintended group ownership allowing attackers to escalate privileges by making a plain file executable and SGID (bnc#1100416)
• CVE-2017-5753: Systems with microprocessors utilizing speculative execution and branch prediction may have allowed unauthorized disclosure of information to an attacker with local user access via a side-channel analysis (bsc#1068032)
• CVE-2018-1118: Linux kernel vhost did not properly initialize memory in messages passed between virtual guests and the host operating system. This could have allowed local privileged users to read some kernel memory contents when reading from the /dev/vhost-net device file (bsc#1092472)

The following non-security bugs were fixed:

• 1wire: family module autoload fails because of upper/lower case mismatch (bsc#1051510)
• 8139too: Use disable_irq_nosync() in rtl8139_poll_controller() (networking-stable-18_05_15)
• acpi / LPSS: Add missing prv_offset setting for byt/cht PWM devices (bsc#1051510)
• acpi / processor: Finish making acpi_processor_ppc_has_changed() void (bsc#1051510)
• acpi / watchdog: properly initialize resources (bsc#1051510)
• acpi, APEI, EINJ: Subtract any matching Register Region from Trigger resources (bsc#1051510)
• acpi, nfit: Fix scrub idle detection (bsc#1094119)
• acpi/nfit: fix cmd_rc for acpi_nfit_ctl to always return a value (bsc#1051510)
• acpi: Add helper for deactivating memory region (bsc#1100132)
• ahci: Disable LPM on Lenovo 50 series laptops with a too old BIOS (bsc#1051510)
• alsa: hda - Handle pm failure during hotplug (bsc#1051510)
• alsa: hda/ca0132 - use ARRAY_SIZE (bsc#1051510)
• alsa: hda/ca0132: Delete pointless assignments to struct auto_pin_cfg fields (bsc#1051510)
• alsa: hda/ca0132: Delete redundant UNSOL event requests (bsc#1051510)
• alsa: hda/ca0132: Do not test for QUIRK_NONE (bsc#1051510)
• alsa: hda/ca0132: Fix DMic data rate for Alienware M17x R4 (bsc#1051510)
• alsa: hda/ca0132: Restore PCM Analog Mic-In2 (bsc#1051510)
• alsa: hda/ca0132: Restore behavior of QUIRK_ALIENWARE (bsc#1051510)
• alsa: hda/ca0132: make array ca0132_alt_chmaps static (bsc#1051510)
• alsa: hda/realtek - Add Panasonic CF-SZ6 headset jack quirk (bsc#1051510)
• alsa: hda/realtek - Add a quirk for FSC ESPRIMO U9210 (bsc#1051510)
• alsa: hda/realtek - Fix pop noise on Lenovo P50 and co (bsc#1051510)
• alsa: hda/realtek - Fix the problem of two front mics on more machines (bsc#1051510)
• alsa: hda/realtek - Yet another Clevo P950 quirk entry (bsc#1101143)
• alsa: hda/realtek - two more lenovo models need fixup of MIC_LOCATION (bsc#1051510)
• alsa: hda: add mute led support for HP ProBook 455 G5 (bsc#1051510)
• alsa: rawmidi: Change resized buffers atomically (bsc#1051510)
• alsa: seq: Fix UBSAN warning at SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT ioctl (bsc#1051510)
• alsa: timer: Fix UBSAN warning at SNDRV_TIMER_IOCTL_NEXT_DEVICE ioctl (bsc#1051510)
• alx: take rtnl before calling __alx_open…

The SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

CVE-2018-5390 aka SegmentSmack: A remote attacker even with relatively low bandwidth could have caused lots of CPU usage by triggering the worst case scenario during IP and/or TCP fragment reassembly (bsc#1102340) CVE-2017-18344: The timer_create syscall implementation didn't properly validate input, which could have lead to out-of-bounds access. This allowed userspace applications to read arbitrary kernel memory in some setups. (bsc#1102851)

The following non-security bugs were fixed:

• acpi, apei, einj: Subtract any matching Register Region from Trigger resources (bsc#1051510).
• acpi, nfit: Fix scrub idle detection (bsc#1094119).
• acpi/nfit: fix cmd_rc for acpi_nfit_ctl to always return a value (bsc#1051510).
• acpi/processor: Finish making acpi_processor_ppc_has_changed() void (bsc#1051510).
• ahci: Disable Lpm on Lenovo 50 series laptops with a too old BIOS (bsc#1051510).
• alsa: hda - Handle pm failure during hotplug (bsc#1051510).
• alsa: hda/realtek - Add Panasonic CF-SZ6 headset jack quirk (bsc#1051510).
• alsa: hda/realtek - Yet another Clevo P950 quirk entry (bsc#1101143).
• alsa: hda/realtek - two more lenovo models need fixup of MIC_LOCATION (bsc#1051510).
• alsa: hda: add mute led support for HP ProBook 455 G5 (bsc#1051510).
• alsa: rawmidi: Change resized buffers atomically (bsc#1051510).
• alx: take rtnl before calling __alx_open from resume (bsc#1051510).
• arm64: kpti: Use early_param for kpti= command-line option (bsc#1103220).
• arm: module: fix modsign build error (bsc#1093666).
• asoc: mediatek: preallocate pages use platform device (bsc#1051510).
• ath9k_htc: Add a sanity check in ath9k_htc_ampdu_action() (bsc#1051510).
• atl1c: reserve min skb headroom (bsc#1051510).
• audit: Fix wrong task in comparison of session ID (bsc#1051510).
• audit: ensure that 'audit=1' actually enables audit for PID 1 (bsc#1051510).
• audit: return on memory error to avoid null pointer dereference (bsc#1051510).
• b44: Initialize 64-bit stats seqcount (bsc#1051510).
• backlight: as3711_bl: Fix Device Tree node leaks (bsc#1051510).
• backlight: lm3630a: Bump REG_MAX value to 0x50 instead of 0x1F (bsc#1051510).
• batman-adv: Accept only filled wifi station info (bsc#1051510).
• batman-adv: Always initialize fragment header priority (bsc#1051510).
• batman-adv: Avoid race in TT TVLV allocator helper (bsc#1051510).
• batman-adv: Avoid storing non-TT-sync flags on singular entries too (bsc#1051510).
• batman-adv: Fix TT sync flags for intermediate TT responses (bsc#1051510).
• batman-adv: Fix bat_ogm_iv best gw refcnt after netlink dump (bsc#1051510).
• batman-adv: Fix bat_v best gw refcnt after netlink dump (bsc#1051510).
• batman-adv: Fix check of retrieved orig_gw in batadv_v_gw_is_eligible (bsc#1051510).
• batman-adv: Fix debugfs path for renamed hardif (bsc#1051510).
• batman-adv: Fix debugfs path for renamed softif (bsc#1051510).
• batman-adv: Fix internal interface indices types (bsc#1051510).
• batman-adv: Fix lock for ogm cnt access in batadv_iv_ogm_calc_tq (bsc#1051510).
• batman-adv: Fix multicast packet loss with a single WANT_ALL_IPV4/6 flag (bsc#1051510).
• batman-adv: Fix netlink dumping of BLA backbones (bsc#1051510).
• batman-adv: Fix netlink dumping of BLA claims (bsc#1051510).
• batman-adv: Fix skbuff rcsum on packet reroute (bsc#1051510).
• batman-adv: Ignore invalid batadv_iv_gw during netlink send (bsc#1051510).
• batman-adv: Ignore invalid batadv_v_gw during netlink send (bsc#1051510).
• batman-adv: Use default throughput value on cfg80211 error (bsc#1051510).
• batman-adv: fix TT sync flag inconsistencies (bsc#1051510).
• batman-adv: fix header size check in batadv_dbg_arp() (bsc#1051510).
• batman-adv: fix multicast-via-unicast transmission with AP isolation (bsc#1051510).
• batman-adv: fix packet checksum in receive path (bsc#1051510).
• batman-adv: fix packet…

The SUSE Linux Enterprise 12 SP3 kernel was updated to 4.4.143 to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-5390 aka 'SegmentSmack': Linux kernel could be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service (bnc#1102340).
• CVE-2018-14734: drivers/infiniband/core/ucma.c in the Linux kernel allowed ucma_leave_multicast to access a certain data structure after a cleanup step in ucma_process_join, which allowed attackers to cause a denial of service (use-after-free) (bnc#1103119).
• CVE-2017-18344: The timer_create syscall implementation in kernel/time/posix-timers.c didn't properly validate the sigevent->sigev_notify field, which lead to out-of-bounds access in the show_timer function (called when /proc/$PID/timers is read). This allowed userspace applications to read arbitrary kernel memory (on a kernel built with CONFIG_POSIX_TIMERS and CONFIG_CHECKPOINT_RESTORE) (bnc#1102851 bnc#1103580).
• CVE-2018-3620: Local attackers on baremetal systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data. (bnc#1087081).
• CVE-2018-3646: Local attackers in virtualized guest systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data, even from other virtual machines or the host system. (bnc#1089343).

The following non-security bugs were fixed:

• Add support for 5,25,50, and 100G to 802.3ad bonding driver (bsc#1096978)
• ahci: Disable LPM on Lenovo 50 series laptops with a too old BIOS (bnc#1012382).
• arm64: do not open code page table entry creation (bsc#1102197).
• arm64: kpti: Use early_param for kpti= command-line option (bsc#1102188).
• arm64: Make sure permission updates happen for pmd/pud (bsc#1102197).
• atm: zatm: Fix potential Spectre v1 (bnc#1012382).
• bcm63xx_enet: correct clock usage (bnc#1012382).
• bcm63xx_enet: do not write to random DMA channel on BCM6345 (bnc#1012382).
• blacklist 9fb8d5dc4b64 ('stop_machine: Disable preemption when waking two stopper threads') Preemption is already disabled inside cpu_stop_queue_two_works() in SLE12-SP3 because it does not have commit 6a19005157c4 ('stop_machine: Do not disable preemption in stop_two_cpus()')
• block: copy ioprio in __bio_clone_fast() (bsc#1082653).
• bpf: fix loading of BPF_MAXINSNS sized programs (bsc#1012382).
• bpf, x64: fix memleak when not converging after image (bsc#1012382).
• cachefiles: Fix missing clear of the CACHEFILES_OBJECT_ACTIVE flag (bsc#1099858).
• cachefiles: Fix refcounting bug in backing-file read monitoring (bsc#1099858).
• cachefiles: Wait rather than BUG'ing on 'Unexpected object collision' (bsc#1099858).
• cifs: fix bad/NULL ptr dereferencing in SMB2_sess_setup() (bsc#1090123).
• compiler, clang: always inline when CONFIG_OPTIMIZE_INLINING is disabled (bnc#1012382).
• compiler, clang: properly override 'inline' for clang (bnc#1012382).
• compiler, clang: suppress warning for unused static inline functions (bnc#1012382).
• compiler-gcc.h: Add attribute((gnu_inline)) to all inline declarations (bnc#1012382).
• cpu/hotplug: Add sysfs state interface (bsc#1089343).
• cpu/hotplug: Provide knobs to control SMT (bsc#1089343).
• cpu/hotplug: Split do_cpu_down() (bsc#1089343).
• crypto: crypto4xx - fix crypto4xx_build_pdr, crypto4xx_build_sdr leak (bnc#1012382).
• crypto: crypto4xx - remove bad list_del (bnc#1012382).
• drm/msm: Fix possible null dereference on failure of get_pages() (bsc#1102394).
• drm: re-enable error handling (bsc#1103884).
• fscache: Allow cancelled operations to be enqueued (bsc#1099858).
• fscache: Fix reference overput in fscache_attach_object() error handling (bsc#1099858).
• hid: usbhid: add quirk…

The SUSE Linux Enterprise 12 SP2 LTSS kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-3620: Local attackers on baremetal systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data. (bnc#1087081).
• CVE-2018-3646: Local attackers in virtualized guest systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data, even from other virtual machines or the host system. (bnc#1089343).
• CVE-2018-5390 aka 'SegmentSmack': The Linux Kernel can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service (bnc#1102340).
• CVE-2018-5391 aka 'FragmentSmack': A flaw in the IP packet reassembly could be used by remote attackers to consume lots of CPU time (bnc#1103097).
• CVE-2018-14734: drivers/infiniband/core/ucma.c allowed ucma_leave_multicast to access a certain data structure after a cleanup step in ucma_process_join, which allowed attackers to cause a denial of service (use-after-free) (bnc#1103119).
• CVE-2017-18344: The timer_create syscall implementation in kernel/time/posix-timers.c didn't properly validate the sigevent->sigev_notify field, which leads to out-of-bounds access in the show_timer function (called when /proc/$PID/timers is read). This allowed userspace applications to read arbitrary kernel memory (on a kernel built with CONFIG_POSIX_TIMERS and CONFIG_CHECKPOINT_RESTORE) (bnc#1102851 bnc#1103580).
• CVE-2018-9385: When printing the 'driver_override' option from with-in the amba driver, a very long line could expose one additional uninitialized byte (bnc#1100491).
• CVE-2018-13053: The alarm_timer_nsleep function in kernel/time/alarmtimer.c had an integer overflow via a large relative timeout because ktime_add_safe is not used (bnc#1099924).
• CVE-2018-13405: The inode_init_owner function in fs/inode.c allowed local users to create files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of that group. Here, the non-member can trigger creation of a plain file whose group ownership is that group. The intended behavior was that the non-member can trigger creation of a directory (but not a plain file) whose group ownership is that group. The non-member can escalate privileges by making the plain file executable and SGID (bnc#1100416).
• CVE-2018-13406: An integer overflow in the uvesafb_setcmap function in drivers/video/fbdev/uvesafb.c could result in local attackers being able to crash the kernel or potentially elevate privileges because kmalloc_array is not used (bnc#1098016 1100418).
• CVE-2018-5814: Multiple race condition errors when handling probe, disconnect, and rebind operations could be exploited to trigger a use-after-free condition or a NULL pointer dereference by sending multiple USB over IP packets (bnc#1096480).

The following non-security bugs were fixed:

• Add support for 5,25,50, and 100G to 802.3ad bonding driver (bsc#1096978)
• bcache: add backing_request_endio() for bi_end_io (bsc#1064232).
• bcache: add CACHE_SET_IO_DISABLE to struct cache_set flags (bsc#1064232).
• bcache: add io_disable to struct cached_dev (bsc#1064232).
• bcache: add journal statistic (bsc#1076110).
• bcache: Add __printf annotation to __bch_check_keys() (bsc#1064232).
• bcache: add stop_when_cache_set_failed option to backing device (bsc#1064232).
• bcache: add wait_for_kthread_stop() in bch_allocator_thread() (bsc#1064232).
• bcache: Annotate switch fall-through (bsc#1064232).
• bcache: closures: move control bits one bit right (bsc#1076110).
• bcache: correct flash only vols (check all uuids) (bsc#1064232). -…

The SUSE Linux Enterprise 12 SP2 LTSS kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-3620: Local attackers on baremetal systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data. (bnc#1087081).
• CVE-2018-3646: Local attackers in virtualized guest systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data, even from other virtual machines or the host system. (bnc#1089343).
• CVE-2018-5390 aka 'SegmentSmack': The Linux Kernel can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service (bnc#1102340).
• CVE-2018-5391 aka 'FragmentSmack': A flaw in the IP packet reassembly could be used by remote attackers to consume lots of CPU time (bnc#1103097).
• CVE-2018-14734: drivers/infiniband/core/ucma.c allowed ucma_leave_multicast to access a certain data structure after a cleanup step in ucma_process_join, which allowed attackers to cause a denial of service (use-after-free) (bnc#1103119).
• CVE-2017-18344: The timer_create syscall implementation in kernel/time/posix-timers.c didn't properly validate the sigevent->sigev_notify field, which leads to out-of-bounds access in the show_timer function (called when /proc/$PID/timers is read). This allowed userspace applications to read arbitrary kernel memory (on a kernel built with CONFIG_POSIX_TIMERS and CONFIG_CHECKPOINT_RESTORE) (bnc#1102851 bnc#1103580).
• CVE-2018-9385: When printing the 'driver_override' option from with-in the amba driver, a very long line could expose one additional uninitialized byte (bnc#1100491).
• CVE-2018-13053: The alarm_timer_nsleep function in kernel/time/alarmtimer.c had an integer overflow via a large relative timeout because ktime_add_safe is not used (bnc#1099924).
• CVE-2018-13405: The inode_init_owner function in fs/inode.c allowed local users to create files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of that group. Here, the non-member can trigger creation of a plain file whose group ownership is that group. The intended behavior was that the non-member can trigger creation of a directory (but not a plain file) whose group ownership is that group. The non-member can escalate privileges by making the plain file executable and SGID (bnc#1100416).
• CVE-2018-13406: An integer overflow in the uvesafb_setcmap function in drivers/video/fbdev/uvesafb.c could result in local attackers being able to crash the kernel or potentially elevate privileges because kmalloc_array is not used (bnc#1098016 1100418).
• CVE-2018-5814: Multiple race condition errors when handling probe, disconnect, and rebind operations could be exploited to trigger a use-after-free condition or a NULL pointer dereference by sending multiple USB over IP packets (bnc#1096480).

The following non-security bugs were fixed:

• Add support for 5,25,50, and 100G to 802.3ad bonding driver (bsc#1096978)
• bcache: add backing_request_endio() for bi_end_io (bsc#1064232).
• bcache: add CACHE_SET_IO_DISABLE to struct cache_set flags (bsc#1064232).
• bcache: add io_disable to struct cached_dev (bsc#1064232).
• bcache: add journal statistic (bsc#1076110).
• bcache: Add __printf annotation to __bch_check_keys() (bsc#1064232).
• bcache: add stop_when_cache_set_failed option to backing device (bsc#1064232).
• bcache: add wait_for_kthread_stop() in bch_allocator_thread() (bsc#1064232).
• bcache: Annotate switch fall-through (bsc#1064232).
• bcache: closures: move control bits one bit right (bsc#1076110).
• bcache: correct flash only vols (check all uuids) (bsc#1064232). -…

The SUSE Linux Enterprise 12 SP3 Azure kernel was updated to 4.4.143 to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-3620: Local attackers on baremetal systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data. (bnc#1087081).
• CVE-2018-3646: Local attackers in virtualized guest systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data, even from other virtual machines or the host system. (bnc#1089343).
• CVE-2018-5391: A flaw in the IP packet reassembly could be used by remote attackers to consume CPU time (bnc#1103097).
• CVE-2018-5390: Linux kernel versions 4.9+ can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service (bnc#1102340).
• CVE-2018-14734: drivers/infiniband/core/ucma.c allowed ucma_leave_multicast to access a certain data structure after a cleanup step in ucma_process_join, which allowed attackers to cause a denial of service (use-after-free) (bnc#1103119).
• CVE-2017-18344: The timer_create syscall implementation in kernel/time/posix-timers.c didn't properly validate the sigevent->sigev_notify field, which leads to out-of-bounds access in the show_timer function (called when /proc/$PID/timers is read). This allowed userspace applications to read arbitrary kernel memory (on a kernel built with CONFIG_POSIX_TIMERS and CONFIG_CHECKPOINT_RESTORE) (bnc#1102851 1103580).

The following non-security bugs were fixed:

• 1wire: family module autoload fails because of upper/lower case mismatch (bnc#1012382).
• Add support for 5,25,50, and 100G to 802.3ad bonding driver (bsc#1096978)
• ahci: Disable LPM on Lenovo 50 series laptops with a too old BIOS (bnc#1012382).
• alsa: hda - Fix pincfg at resume on Lenovo T470 dock (bsc#1099810).
• alsa: hda - Handle kzalloc() failure in snd_hda_attach_pcm_stream() (bnc#1012382).
• alsa: hda/realtek - set PINCFG_HEADSET_MIC to parse_flags (bsc#1099810).
• arm64: do not open code page table entry creation (bsc#1102197).
• arm64: kpti: Use early_param for kpti= command-line option (bsc#1102188).
• arm64: Make sure permission updates happen for pmd/pud (bsc#1102197).
• arm: 8764/1: kgdb: fix NUMREGBYTES so that gdb_regs[] is the correct size (bnc#1012382).
• arm: dts: imx6q: Use correct SDMA script for SPI5 core (bnc#1012382).
• ASoC: cirrus: i2s: Fix LRCLK configuration (bnc#1012382).
• ASoC: cirrus: i2s: Fix {TX|RX}LinCtrlData setup (bnc#1012382).
• ASoC: dapm: delete dapm_kcontrol_data paths list before freeing it (bnc#1012382).
• ath10k: fix rfc1042 header retrieval in QCA4019 with eth decap mode (bnc#1012382).
• atm: zatm: fix memcmp casting (bnc#1012382).
• atm: zatm: Fix potential Spectre v1 (bnc#1012382).
• backlight: as3711_bl: Fix Device Tree node lookup (bnc#1012382).
• backlight: max8925_bl: Fix Device Tree node lookup (bnc#1012382).
• backlight: tps65217_bl: Fix Device Tree node lookup (bnc#1012382).
• bcache: add backing_request_endio() for bi_end_io (bsc#1064232).
• bcache: add CACHE_SET_IO_DISABLE to struct cache_set flags (bsc#1064232).
• bcache: add io_disable to struct cached_dev (bsc#1064232).
• bcache: add journal statistic (bsc#1076110).
• bcache: Add __printf annotation to __bch_check_keys() (bsc#1064232).
• bcache: add stop_when_cache_set_failed option to backing device (bsc#1064232).
• bcache: add wait_for_kthread_stop() in bch_allocator_thread() (bsc#1064232).
• bcache: Annotate switch fall-through (bsc#1064232).
• bcache: closures: move control bits one bit right (bsc#1076110).
• bcache: correct flash only vols (check all uuids) (bsc#1064232).
• bcache: count backing device I/O error for writeback I/O (bsc#1064232).
• bcache: Fix a…

This update for the Linux Kernel 4.12.14-25_3 fixes several issues.

The following security issues were fixed:

• CVE-2018-5390: Linux kernel versions 4.9+ can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service (bsc#1102682).
• CVE-2018-3646: Local attackers in virtualized guest systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data, even from other virtual machines or the host system (bsc#1099306).
• CVE-2017-18344: The timer_create syscall implementation in kernel/time/posix-timers.c didn't properly validate the sigevent->sigev_notify field, which lead to out-of-bounds access in the show_timer function (called when /proc/$PID/timers is read). This allowed userspace applications to read arbitrary kernel memory (on a kernel built with CONFIG_POSIX_TIMERS and CONFIG_CHECKPOINT_RESTORE) (bsc#1103203). before 4.14.8
• CVE-2018-10853: A flaw was found in kvm. In which certain instructions such as sgdt/sidt call segmented_write_std didn't propagate access correctly. As such, during userspace induced exception, the guest can incorrectly assume that the exception happened in the kernel and panic. (bsc#1097108).

This update for the Linux Kernel 4.12.14-23 fixes several issues.

The following security issues were fixed:

• CVE-2018-5390: Linux kernel versions 4.9+ can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service (bsc#1102682).
• CVE-2018-3646: Local attackers in virtualized guest systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data, even from other virtual machines or the host system (bsc#1099306).
• CVE-2017-18344: The timer_create syscall implementation in kernel/time/posix-timers.c didn't properly validate the sigevent->sigev_notify field, which lead to out-of-bounds access in the show_timer function (called when /proc/$PID/timers is read). This allowed userspace applications to read arbitrary kernel memory (on a kernel built with CONFIG_POSIX_TIMERS and CONFIG_CHECKPOINT_RESTORE) (bsc#1103203). before 4.14.8
• CVE-2018-12904: In arch/x86/kvm/vmx.c local attackers could cause L1 KVM guests to VMEXIT, potentially allowing privilege escalations and denial of service attacks due to lack of checking of CPL (bsc#1099258).
• CVE-2018-10853: A flaw was found in kvm. In which certain instructions such as sgdt/sidt call segmented_write_std didn't propagate access correctly. As such, during userspace induced exception, the guest can incorrectly assume that the exception happened in the kernel and panic. (bsc#1097108).

The SUSE Linux Enterprise 12 SP3 RT kernel was updated to 4.4.147 to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2017-18344: The timer_create syscall implementation in kernel/time/posix-timers.c didn't properly validate the sigevent->sigev_notify field, which leads to out-of-bounds access in the show_timer function (called when /proc/$PID/timers is read). This allowed userspace applications to read arbitrary kernel memory (on a kernel built with CONFIG_POSIX_TIMERS and CONFIG_CHECKPOINT_RESTORE) (bnc#1102851 bsc#1103580).
• CVE-2018-10876: A flaw was found in the ext4 filesystem code. A use-after-free was possible in ext4_ext_remove_space() function when mounting and operating a crafted ext4 image. (bnc#1099811)
• CVE-2018-10877: The ext4 filesystem was vulnerable to an out-of-bound access in the ext4_ext_drop_refs() function when operating on a crafted ext4 filesystem image. (bnc#1099846)
• CVE-2018-10878: A flaw was found in the ext4 filesystem. A local user could cause an out-of-bounds write and a denial of service or unspecified other impact is possible by mounting and operating a crafted ext4 filesystem image. (bnc#1099813)
• CVE-2018-10879: A flaw was found in the ext4 filesystem. A local user could cause a use-after-free in ext4_xattr_set_entry function and a denial of service or unspecified other impact may occur by renaming a file in a crafted ext4 filesystem image. (bnc#1099844)
• CVE-2018-10880: Linux kernel is vulnerable to a stack-out-of-bounds write in the ext4 filesystem code when mounting and writing to a crafted ext4 image in ext4_update_inline_data(). An attacker could use this to cause a system crash and a denial of service. (bnc#1099845)
• CVE-2018-10881: A flaw was found in the ext4 filesystem. A local user can cause an out-of-bound access in ext4_get_group_info function, a denial of service, and a system crash by mounting and operating on a crafted ext4 filesystem image. (bnc#1099864)
• CVE-2018-10882: A flaw was found in the ext4 filesystem. A local user can cause an out-of-bound write in in fs/jbd2/transaction.c code, a denial of service, and a system crash by unmounting a crafted ext4 filesystem image. (bnc#1099849)
• CVE-2018-10883: A flaw was found in the ext4 filesystem. A local user can cause an out-of-bounds write in jbd2_journal_dirty_metadata(), a denial of service, and a system crash by mounting and operating on a crafted ext4 filesystem image. (bnc#1099863)
• CVE-2018-14734: drivers/infiniband/core/ucma.c allowed ucma_leave_multicast to access a certain data structure after a cleanup step in ucma_process_join, which allowed attackers to cause a denial of service (use-after-free) (bnc#1103119).
• CVE-2018-3620: Systems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access via a terminal page fault and a side-channel analysis (bnc#1087081).
• CVE-2018-3646: Systems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access with guest OS privilege via a terminal page fault and a side-channel analysis (bnc#1089343 bnc#1104365).
• CVE-2018-5390: The Linux kernel could be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service (bnc#1102340).
• CVE-2018-5391 aka 'FragmentSmack': A flaw in the IP packet reassembly could be used by remote attackers to consume lots of CPU time (bnc#1103097).
• CVE-2018-9363: A buffer overflow in bluetooth HID report processing could be used by malicious bluetooth devices to crash the kernel or potentially execute code (bnc#1105292).

The following non-security bugs were fixed:

• acpi / pci: Bail early in acpi_pci_add_bus() if there is no ACPI handle…

This update for the Linux Kernel 3.12.61-52_106 fixes several issues.

The following security issues were fixed:

• CVE-2018-5390: Prevent very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming TCP packet which can lead to a denial of service (bsc#1102682).
• CVE-2018-10902: It was found that the raw midi kernel driver did not protect against concurrent access which lead to a double realloc (double free) in snd_rawmidi_input_params() and snd_rawmidi_output_status(), allowing a malicious local attacker to use this for privilege escalation (bsc#1105323).

This update for the Linux Kernel 4.4.114-92_64 fixes several issues.

The following security issues were fixed:

• CVE-2018-5390: Prevent very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming TCP packet which can lead to a denial of service (bsc#1102682).
• CVE-2018-1000026: Fixed an insufficient input validation in bnx2x network card driver that can result in DoS via very large, specially crafted packet to the bnx2x card due to a network card firmware assertion that will take the card offline (bsc#1096723).
• CVE-2018-10938: Fixed an infinite loop in the cipso_v4_optptr() function leading to a denial-of-service via crafted network packets (bsc#1106191).
• CVE-2018-10902: It was found that the raw midi kernel driver did not protect against concurrent access which lead to a double realloc (double free) in snd_rawmidi_input_params() and snd_rawmidi_output_status(), allowing a malicious local attacker to use this for privilege escalation (bsc#1105323).

This update for the Linux Kernel 4.4.121-92_85 fixes several issues.

The following security issues were fixed:

• CVE-2018-5390: Prevent very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming TCP packet which can lead to a denial of service (bsc#1102682).
• CVE-2018-10938: Fixed an infinite loop in the cipso_v4_optptr() function leading to a denial-of-service via crafted network packets (bsc#1106191).
• CVE-2018-10902: It was found that the raw midi kernel driver did not protect against concurrent access which lead to a double realloc (double free) in snd_rawmidi_input_params() and snd_rawmidi_output_status(), allowing a malicious local attacker to use this for privilege escalation (bsc#1105323).

This update for the Linux Kernel 3.12.74-60_64_63 fixes several issues.

The following security issues were fixed:

• CVE-2018-5390: Prevent very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming TCP packet which can lead to a denial of service (bsc#1102682).
• CVE-2018-10902: It was found that the raw midi kernel driver did not protect against concurrent access which lead to a double realloc (double free) in snd_rawmidi_input_params() and snd_rawmidi_output_status(), allowing a malicious local attacker to use this for privilege escalation (bsc#1105323).

This update for the Linux Kernel 4.4.143-94_47 fixes several issues.

The following security issues were fixed:

• CVE-2018-5390: Prevent very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming TCP packet which can lead to a denial of service (bsc#1102682).
• CVE-2018-10938: Fixed an infinite loop in the cipso_v4_optptr() function leading to a denial-of-service via crafted network packets (bsc#1106191).
• CVE-2018-10902: It was found that the raw midi kernel driver did not protect against concurrent access which lead to a double realloc (double free) in snd_rawmidi_input_params() and snd_rawmidi_output_status(), allowing a malicious local attacker to use this for privilege escalation (bsc#1105323).

This update for the Linux Kernel 4.4.114-94_11 fixes several issues.

The following security issues were fixed:

• CVE-2018-5390: Prevent very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming TCP packet which can lead to a denial of service (bsc#1102682).
• CVE-2018-1000026: Fixed an insufficient input validation in bnx2x network card driver that can result in DoS via very large, specially crafted packet to the bnx2x card due to a network card firmware assertion that will take the card offline (bsc#1096723).
• CVE-2018-10938: Fixed an infinite loop in the cipso_v4_optptr() function leading to a denial-of-service via crafted network packets (bsc#1106191).
• CVE-2018-10902: It was found that the raw midi kernel driver did not protect against concurrent access which lead to a double realloc (double free) in snd_rawmidi_input_params() and snd_rawmidi_output_status(), allowing a malicious local attacker to use this for privilege escalation (bsc#1105323).

This update for the Linux Kernel 4.4.140-94_42 fixes several issues.

The following security issues were fixed:

• CVE-2018-5390: Prevent very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming TCP packet which can lead to a denial of service (bsc#1102682).
• CVE-2018-10938: Fixed an infinite loop in the cipso_v4_optptr() function leading to a denial-of-service via crafted network packets (bsc#1106191).
• CVE-2018-10902: It was found that the raw midi kernel driver did not protect against concurrent access which lead to a double realloc (double free) in snd_rawmidi_input_params() and snd_rawmidi_output_status(), allowing a malicious local attacker to use this for privilege escalation (bsc#1105323).
• CVE-2018-3646: Fixed unauthorized disclosure of information residing in the L1 data cache on systems with microprocessors utilizing speculative execution and address translations (bsc#1099306).

This update for the Linux Kernel 4.4.82-6_6 fixes several issues.

The following security issues were fixed:

• CVE-2018-5390: Prevent very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming TCP packet which can lead to a denial of service (bsc#1102682).
• CVE-2018-1000026: Fixed an insufficient input validation in bnx2x network card driver that can result in DoS via very large, specially crafted packet to the bnx2x card due to a network card firmware assertion that will take the card offline (bsc#1096723).
• CVE-2018-10938: Fixed an infinite loop in the cipso_v4_optptr() function leading to a denial-of-service via crafted network packets (bsc#1106191).
• CVE-2018-10902: It was found that the raw midi kernel driver did not protect against concurrent access which lead to a double realloc (double free) in snd_rawmidi_input_params() and snd_rawmidi_output_status(), allowing a malicious local attacker to use this for privilege escalation (bsc#1105323).

This update for the Linux Kernel 3.12.74-60_64_104 fixes several issues.

The following security issues were fixed:

• CVE-2018-17182: The vmacache_flush_all function in mm/vmacache.c mishandled sequence number overflows. An attacker can trigger a use-after-free (and possibly gain privileges) via certain thread creation, map, unmap, invalidation, and dereference operations (bsc#1110233).
• CVE-2018-14633: A security flaw was found in the chap_server_compute_md5() function in the ISCSI target code in a way an authentication request from an ISCSI initiator is processed. An unauthenticated remote attacker can cause a stack buffer overflow and smash up to 17 bytes of the stack. The attack requires the iSCSI target to be enabled on the victim host. Depending on how the target's code was built (i.e. depending on a compiler, compile flags and hardware architecture) an attack may lead to a system crash and thus to a denial-of-service or possibly to a non-authorized access to data exported by an iSCSI target. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is highly unlikely. (bsc#1107832).
• CVE-2018-5390: The Linux kernel could be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service (bsc#1102682).

This update for the Linux Kernel 3.12.61-52_146 fixes several issues.

The following security issues were fixed:

• CVE-2018-14633: A security flaw was found in the chap_server_compute_md5() function in the ISCSI target code in the Linux kernel in a way an authentication request from an ISCSI initiator is processed. An unauthenticated remote attacker can cause a stack buffer overflow and smash up to 17 bytes of the stack. The attack requires the iSCSI target to be enabled on the victim host. Depending on how the target's code was built (i.e. depending on a compiler, compile flags and hardware architecture) an attack may lead to a system crash and thus to a denial-of-service or possibly to a non-authorized access to data exported by an iSCSI target. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is highly unlikely. (bsc#1107832).
• CVE-2018-5390: The Linux kernel could be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service (bsc#1102682).

This update for the Linux Kernel 3.12.74-60_64_107 fixes several issues.

The following security issues were fixed:

• CVE-2018-14633: A security flaw was found in the chap_server_compute_md5() function in the ISCSI target code in a way an authentication request from an ISCSI initiator is processed. An unauthenticated remote attacker can cause a stack buffer overflow and smash up to 17 bytes of the stack. The attack requires the iSCSI target to be enabled on the victim host. Depending on how the target's code was built (i.e. depending on a compiler, compile flags and hardware architecture) an attack may lead to a system crash and thus to a denial-of-service or possibly to a non-authorized access to data exported by an iSCSI target. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is highly unlikely. (bsc#1107832).
• CVE-2018-5390: The Linux kernel could be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service (bsc#1102682).

This update for the Linux Kernel 4.4.121-92_95 fixes several issues.

The following security issues were fixed:

• CVE-2018-14633: A security flaw was found in the chap_server_compute_md5() function in the ISCSI target code in a way an authentication request from an ISCSI initiator is processed. An unauthenticated remote attacker can cause a stack buffer overflow and smash up to 17 bytes of the stack. The attack requires the iSCSI target to be enabled on the victim host. Depending on how the target's code was built (i.e. depending on a compiler, compile flags and hardware architecture) an attack may lead to a system crash and thus to a denial-of-service or possibly to a non-authorized access to data exported by an iSCSI target. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is highly unlikely. (bsc#1107832).
• CVE-2018-5390: The Linux kernel could be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service (bsc#1102682).

This update for the Linux Kernel 4.4.121-92_98 fixes several issues.

The following security issues were fixed:

• CVE-2018-14633: A security flaw was found in the chap_server_compute_md5() function in the ISCSI target code in the Linux kernel in a way an authentication request from an ISCSI initiator is processed. An unauthenticated remote attacker can cause a stack buffer overflow and smash up to 17 bytes of the stack. The attack requires the iSCSI target to be enabled on the victim host. Depending on how the target's code was built (i.e. depending on a compiler, compile flags and hardware architecture) an attack may lead to a system crash and thus to a denial-of-service or possibly to a non-authorized access to data exported by an iSCSI target. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is highly unlikely (bsc#1107832).
• CVE-2018-5390: Fixed the possiblilty that the kernel can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service (bnc#1102682).

This update for the Linux Kernel 4.4.121-92_104 fixes one issue.

The following security issue was fixed:

• CVE-2018-5390: The Linux kernel could be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service (bsc#1102682).

The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2019-3459: A heap address information leak while using L2CAP_GET_CONF_OPT was discovered in the Linux kernel(bnc#1120758).
• CVE-2019-3460: A heap data infoleak in multiple locations including L2CAP_PARSE_CONF_RSP was found in the Linux kernel before (bnc#1120758).
• CVE-2019-3896: A double-free could happen in idr_remove_all() in lib/idr.c in the Linux kernel. An unprivileged local attacker could use this flaw for a privilege escalation or for a system crash and a denial of service (DoS) (bnc#1138943).
• CVE-2018-5390: The Linux kernel could be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which could lead to a denial of service (bnc#1102340).
• CVE-2018-20836: An issue was discovered in the Linux kernel There was a race condition in smp_task_timedout() and smp_task_done() in drivers/scsi/libsas/sas_expander.c, leading to a use-after-free (bnc#1134395).
• CVE-2019-12614: An issue was discovered in dlpar_parse_cc_property in arch/powerpc/platforms/pseries/dlpar.c in the Linux kernel There was an unchecked kstrdup of prop-name, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash) (bnc#1137194).
• CVE-2019-3846: A flaw that allowed an attacker to corrupt memory and possibly escalate privileges was found in the mwifiex kernel module while connecting to a malicious wireless network (bnc#1136424 1136446).

The following non-security bugs were fixed:

• KEYS: do not let add_key() update an uninstantiated key (bnc#1063416).
• fnic: Fix to cleanup aborted IO to avoid device being offlined by mid-layer (bsc#1134835).
• signal: give SEND_SIG_FORCED more power to beat SIGNAL_UNKILLABLE (bsc#1135650).
• signal: oom_kill_task: use SEND_SIG_FORCED instead of force_sig() (bsc#1135650).
• tcp: a regression in the previous fix for the TCP SACK issue was fixed (bnc#1139751)

This update for the Linux Kernel 4.4.121-92_109 fixes one issue.

The following security issue was fixed:

• CVE-2018-5390: The Linux kernel could be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service (bsc#1102682).

This update for the Linux Kernel 4.4.121-92_114 fixes several issues.

The following security issues were fixed:

• CVE-2019-11487: The Linux kernel allowed page->_refcount reference count overflow, with resultant use-after-free issues, if about 140 GiB of RAM exists. This is related to fs/fuse/dev.c, fs/pipe.c, fs/splice.c, include/linux/mm.h, include/linux/pipe_fs_i.h, kernel/trace/trace.c, mm/gup.c, and mm/hugetlb.c. It can occur with FUSE requests (bsc#1133191).
• CVE-2018-5390: Linux kernel could be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service (bsc#1102682).

The SUSE Linux Enterprise 12 SP1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-5390 aka 'SegmentSmack': A remote attacker even with relatively low bandwidth could have caused lots of CPU usage by triggering the worst case scenario during IP and/or TCP fragment reassembly (bsc#1102340)
• CVE-2018-7191: In the tun subsystem in the Linux kernel, dev_get_valid_name was not called before register_netdevice. This allowed local users to cause a denial of service (NULL pointer dereference and panic) via an ioctl(TUNSETIFF) call with a dev name containing a / character. (bnc#1135603)
• CVE-2018-20836: A race condition in smp_task_timedout() and smp_task_done() in drivers/scsi/libsas/sas_expander.c, could have lead to a use-after-free. (bnc#1134395)
• CVE-2019-12614: An unchecked kstrdup might have allowed an attacker to cause denial of service (a NULL pointer dereference and system crash). (bnc#1137194)
• CVE-2019-12818: The nfc_llcp_build_tlv function in net/nfc/llcp_commands.c may have returned NULL. If the caller did not check for this, it would trigger a NULL pointer dereference. This would cause denial of service. (bnc#1138293)
• CVE-2019-12456: An issue in the MPT3COMMAND case in _ctl_ioctl_main() allowed local users to cause a denial of service or possibly have unspecified other impact by changing the value of ioc_number between two kernel reads of that value, aka a 'double fetch' vulnerability. (bsc#1136922)
• CVE-2019-11487: An attacker could have triggered use-after-free via page reference count overflow on slow filesystems with at least of 140 GiB of RAM available. (bnc#1133190)

The following non-security bugs were fixed:

• fuse: Don't access pipe->buffers without pipe_lock() (Prerequisity for CVE-2019-11487, bsc#1133190).
• fuse: call pipe_buf_release() under pipe lock (Prerequisity for CVE-2019-11487, bsc#1133190).
• mm: /proc/pid/maps: Check permissions when opening proc pid maps (bsc#1130159).
• pipe: add pipe_buf_get() helper (Prerequisity for CVE-2019-11487, bsc#1133190).
• tcp: refine memory limit test in tcp_fragment() after CVE-2019-11478 fix (bsc#1139751).
• x86/bugs: do not default to IBRS even on SKL (bsc#1112824).