CVE-2012-3430

The SUSE Linux Enterprise 11 Service Pack 2 kernel was updated to fix a regression introduced by the previous update:

* scsi_dh_alua: Incorrect reference counting in the SCSI ALUA
  initialization code lead to system crashes on boot (bnc#858831).

As the update introducing the regression was marked security, this is also marked security even though this bug is not security relevant.

The SUSE Linux Enterprise 11 SP1 Teradata kernel was updated to fix bugs and security issues.

Following security issues were fixed:

CVE-2011-1083: Limit the path length users can build using epoll() to avoid local attackers consuming lots of kernel CPU time.

CVE-2011-4086: Fixed a oops in jbd/jbd2 that could be caused by specific filesystem access patterns.

CVE-2011-4622: KVM: Prevent starting PIT timers in the absence of irqchip support.

CVE-2012-0045: KVM: Extend 'struct x86_emulate_ops' with 'get_cpuid' and fix missing checks in syscall emulation.

CVE-2012-0879: Fix io_context leak after clone with CLONE_IO.

CVE-2012-1090: Fixed a dentry refcount leak in the CIFS file system that could lead to a crash on unmount.

CVE-2012-1097: The regset common infrastructure assumed that regsets would always have .get and .set methods, but necessarily .active methods. Unfortunately people have since written regsets without .set method, so NULL pointer dereference attacks were possible.

Following non-security issues were fixed:

* SCSI inquiry doesn't return data on SLES 11-SP1 Xen VMs (bnc#745929).
* FC transport driver killing off the timers/work queues (bnc#734300).
* The driver ixgbevf doesn't work on newer SLES 11-SP1 kernels
  (bnc#752972).
* Pack sparsemem memmap sections closer together and in higher zones
  (bnc#743870).

Following feature was implemented:

* The megaraid_sas driver update to version 5.40-LSI (bnc#736813).

Security Issues:

* CVE-2011-1083
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1083>
* CVE-2011-4086
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4086>
* CVE-2011-4622
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4622>
* CVE-2012-0045
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0045>
* CVE-2012-0879
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0879>
* CVE-2012-1090
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1090>
* CVE-2012-1097
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1097>

The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes.

Four new speculative execution information leak issues have been identified in Intel CPUs. (bsc#1111331)

• CVE-2018-12126: Microarchitectural Store Buffer Data Sampling (MSBDS)
• CVE-2018-12127: Microarchitectural Fill Buffer Data Sampling (MFBDS)
• CVE-2018-12130: Microarchitectural Load Port Data Samling (MLPDS)
• CVE-2019-11091: Microarchitectural Data Sampling Uncacheable Memory (MDSUM)

This kernel update contains software mitigations for these issues, which also utilize CPU microcode updates shipped in parallel.

For more information on this set of information leaks, check out https://www.suse.com/support/kb/doc/?id=7023736

The following security bugs were fixed:

• CVE-2019-9213: The expand_downwards function in mm/mmap.c lacked a check for the mmap minimum address, which made it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task (bnc#1128166).
• CVE-2013-0216: The Xen netback functionality allowed guest OS users to cause a denial of service (loop) by triggering ring pointer corruption (bnc#800280).
• CVE-2013-0231: The pciback_enable_msi function in the PCI backend driver (drivers/xen/pciback/conf_space_capability_msi.c) in Xen allowed guest OS users with PCI device access to cause a denial of service via a large number of kernel log messages. (bnc#801178).
• CVE-2012-3430: The rds_recvmsg function in net/rds/recv.c did not initialize a certain structure member, which allowed local users to obtain potentially sensitive information from kernel stack memory via a recvfrom or recvmsg system call on an RDS socket (bnc#773383).
• CVE-2012-3412: The sfc (aka Solarflare Solarstorm) driver allowed remote attackers to cause a denial of service (DMA descriptor consumption and network-controller outage) via crafted TCP packets that trigger a small MSS value (bnc#774523).
• CVE-2013-0160: The kernel allowed local users to obtain sensitive information about keystroke timing by using the inotify API on the /dev/ptmx device (bnc#797175).
• CVE-2013-1979: The scm_set_cred function in include/net/scm.h uses incorrect uid and gid values during credentials passing, which allowed local users to gain privileges via a crafted application (bnc#816708).

The following non-security bugs were fixed:

• Add opcodes from net: filter: BPF 'JIT' compiler for PPC64 (bsc#1131107).
• EHCI: improved logic for isochronous scheduling (bsc#1117515).
• KVM: x86: Use jmp to invoke kvm_spurious_fault() from .fixup (bsc#1129439).
• USB: Add new USB LPM helpers (bsc#1129770).
• USB: Consolidate LPM checks to avoid enabling LPM twice (bsc#1129770).
• USB: EHCI: add new root-hub state: STOPPING (bsc#1117515).
• USB: EHCI: add pointer to end of async-unlink list (bsc#1117515).
• USB: EHCI: add symbolic constants for QHs (bsc#1117515).
• USB: EHCI: always scan each interrupt QH (bsc#1117515).
• USB: EHCI: do not lose events during a scan (bsc#1117515).
• USB: EHCI: do not refcount QHs (bsc#1117515).
• USB: EHCI: do not refcount iso_stream structures (bsc#1117515).
• USB: EHCI: fix initialization bug in iso_stream_schedule() (bsc#1117515).
• USB: EHCI: fix up locking (bsc#1117515).
• USB: EHCI: initialize data before resetting hardware (bsc#1117515).
• USB: EHCI: introduce high-res timer (bsc#1117515).
• USB: EHCI: remove PS3 status polling (bsc#1117515).
• USB: EHCI: remove unneeded suspend/resume code (bsc#1117515).
• USB: EHCI: rename 'reclaim' (bsc#1117515).
• USB: EHCI: resolve some unlikely races (bsc#1117515).
• USB: EHCI: return void instead of 0 (bsc#1117515).
• USB: EHCI: simplify isochronous scanning (bsc#1117515).
• USB: EHCI: unlink multiple async QHs together (bsc#1117515).
• USB: EHCI: use hrtimer for (s)iTD deallocation (bsc#1117515).
• USB: EHCI: use hrtimer for async schedule (bsc#1117515).
• USB: EHCI: use hrtimer for controller death (bsc#1117515).
• USB:…

The rds_recvmsg function in net/rds/recv.c in the Linux kernel before 3.0.44 does not initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via a (1) recvfrom or (2) recvmsg system call on an RDS socket.