CVE-2013-2237

This kernel update provides the upstream 3.4.52 kernel and fixes the following security issues:

The pciback_enable_msi function in the PCI backend driver (drivers/xen/pciback/conf_space_capability_msi.c) in Xen for the Linux kernel 2.6.18 and 3.8 allows guest OS users with PCI device access to cause a denial of service via a large number of kernel log messages. (CVE-2013-0231 / XSA-43)

ipv6: ip6_sk_dst_check() must not assume ipv6 dst It's possible to use AF_INET6 sockets and to connect to an IPv4 destination. After this, socket dst cache is a pointer to a rtable, not rt6_info. This bug can be exploited by local non-root users to trigger various corruptions/crashes (CVE-2013-2232)

af_key: fix info leaks in notify messages key_notify_sa_flush() and key_notify_policy_flush() miss to initialize the sadb_msg_reserved member of the broadcasted message and thereby leak 2 bytes of heap memory to listeners (CVE-2013-2234)

af_key: initialize satype in key_notify_policy_flush() key_notify_policy_flush() miss to nitialize the sadb_msg_satype member of the broadcasted message and thereby leak heap memory to listeners (CVE-2013-2237)

Heap-based buffer overflow in the iscsi_add_notunderstood_response function in drivers/target/iscsi/iscsi_target_parameters.c in the iSCSI target subsystem in the Linux kernel through 3.9.4 allows remote attackers to cause a denial of service (memory corruption and OOPS) or possibly execute arbitrary code via a long key that is not properly handled during construction of an error-response packet. A reproduction case requires patching open-iscsi to send overly large keys. Performing discovery in a loop will Oops the remote server. (CVE-2013-2850)

Format string vulnerability in the b43_request_firmware function in drivers/net/wireless/b43/main.c in the Broadcom B43 wireless driver in the Linux kernel through 3.9.4 allows local users to gain privileges by leveraging root access and including format string specifiers in an fwpostfix modprobe parameter, leading to improper construction of an error message. (CVE-2013-2852)

Other fixes: Fix up alx AR8161 breakage (mga #10079)

For other -stable fixes, read the referenced changelogs

This kernel update provides the extended stable 3.8.13.4 kernel and fixes the follwing security issues:

The pciback_enable_msi function in the PCI backend driver (drivers/xen/pciback/conf_space_capability_msi.c) in Xen for the Linux kernel 2.6.18 and 3.8 allows guest OS users with PCI device access to cause a denial of service via a large number of kernel log messages. (CVE-2013-0231 / XSA-43)

ipv6: ip6_sk_dst_check() must not assume ipv6 dst It's possible to use AF_INET6 sockets and to connect to an IPv4 destination. After this, socket dst cache is a pointer to a rtable, not rt6_info. This bug can be exploited by local non-root users to trigger various corruptions/crashes (CVE-2013-2232)

af_key: fix info leaks in notify messages key_notify_sa_flush() and key_notify_policy_flush() miss to initialize the sadb_msg_reserved member of the broadcasted message and thereby leak 2 bytes of heap memory to listeners (CVE-2013-2234)

af_key: initialize satype in key_notify_policy_flush() key_notify_policy_flush() miss to nitialize the sadb_msg_satype member of the broadcasted message and thereby leak heap memory to listeners (CVE-2013-2237)

Heap-based buffer overflow in the iscsi_add_notunderstood_response function in drivers/target/iscsi/iscsi_target_parameters.c in the iSCSI target subsystem in the Linux kernel through 3.9.4 allows remote attackers to cause a denial of service (memory corruption and OOPS) or possibly execute arbitrary code via a long key that is not properly handled during construction of an error-response packet. A reproduction case requires patching open-iscsi to send overly large keys. Performing discovery in a loop will Oops the remote server. (CVE-2013-2850)

Format string vulnerability in the b43_request_firmware function in drivers/net/wireless/b43/main.c in the Broadcom B43 wireless driver in the Linux kernel through 3.9.4 allows local users to gain privileges by leveraging root access and including format string specifiers in an fwpostfix modprobe parameter, leading to improper construction of an error message. (CVE-2013-2852)

Other fixes:

• Fix up alx AR8161 breakage (mga #10079)
• bcma: add support for BCM43142 (mga#9378, mga#10611)
• net/tg3: Avoid delay during MMIO access
• re-add aufs support (mga#8314)
• enable support for more touchscreens
• iommu/vt-d: add quirk for broken interrupt remapping on 55XX chipsets
• rtlwifi: rtl8723ae: Fix typo in firmware names
• rtlwifi: rtl8192cu: Fix problem in connecting to WEP or WPA(1) networks
• md/raid10: fix two bugs affecting RAID10 reshape
• crypto: algboss - Hold ref count on larval
• perf: Disable monitoring on setuid processes for regular users
• netfilter: nf_conntrack_ipv6: Plug sk_buff leak in fragment handling
• enable X86_X2APIC, X86_REROUTE_FOR_BROKEN_BOOT_IRQS, FHANDLE
• disable COMPAT_VDSO (not needed since glibc-2.3.3)
• conflict too old plymouth to make cleaner upgrades (mga #10128) (fixes the errata for online upgraders)

For other fixes in the extended stable update, see the referenced shortlog

This kernel-tmb update provides the upstream 3.4.52 kernel and fixes the follwing security issues:

The pciback_enable_msi function in the PCI backend driver (drivers/xen/pciback/conf_space_capability_msi.c) in Xen for the Linux kernel 2.6.18 and 3.8 allows guest OS users with PCI device access to cause a denial of service via a large number of kernel log messages. (CVE-2013-0231 / XSA-43)

ipv6: ip6_sk_dst_check() must not assume ipv6 dst It's possible to use AF_INET6 sockets and to connect to an IPv4 destination. After this, socket dst cache is a pointer to a rtable, not rt6_info. This bug can be exploited by local non-root users to trigger various corruptions/crashes (CVE-2013-2232)

af_key: fix info leaks in notify messages key_notify_sa_flush() and key_notify_policy_flush() miss to initialize the sadb_msg_reserved member of the broadcasted message and thereby leak 2 bytes of heap memory to listeners (CVE-2013-2234)

af_key: initialize satype in key_notify_policy_flush() key_notify_policy_flush() miss to nitialize the sadb_msg_satype member of the broadcasted message and thereby leak heap memory to listeners (CVE-2013-2237)

Heap-based buffer overflow in the iscsi_add_notunderstood_response function in drivers/target/iscsi/iscsi_target_parameters.c in the iSCSI target subsystem in the Linux kernel through 3.9.4 allows remote attackers to cause a denial of service (memory corruption and OOPS) or possibly execute arbitrary code via a long key that is not properly handled during construction of an error-response packet. A reproduction case requires patching open-iscsi to send overly large keys. Performing discovery in a loop will Oops the remote server. (CVE-2013-2850)

Format string vulnerability in the b43_request_firmware function in drivers/net/wireless/b43/main.c in the Broadcom B43 wireless driver in the Linux kernel through 3.9.4 allows local users to gain privileges by leveraging root access and including format string specifiers in an fwpostfix modprobe parameter, leading to improper construction of an error message. (CVE-2013-2852)

Other fixes: Fix up alx AR8161 breakage (mga #10079)

For other -stable fixes, read the referenced changelogs

This kernel-rt update provides the upstream 3.4.52 kernel and fixes the follwing security issues:

The pciback_enable_msi function in the PCI backend driver (drivers/xen/pciback/conf_space_capability_msi.c) in Xen for the Linux kernel 2.6.18 and 3.8 allows guest OS users with PCI device access to cause a denial of service via a large number of kernel log messages. (CVE-2013-0231 / XSA-43)

ipv6: ip6_sk_dst_check() must not assume ipv6 dst It's possible to use AF_INET6 sockets and to connect to an IPv4 destination. After this, socket dst cache is a pointer to a rtable, not rt6_info. This bug can be exploited by local non-root users to trigger various corruptions/crashes (CVE-2013-2232)

af_key: fix info leaks in notify messages key_notify_sa_flush() and key_notify_policy_flush() miss to initialize the sadb_msg_reserved member of the broadcasted message and thereby leak 2 bytes of heap memory to listeners (CVE-2013-2234)

af_key: initialize satype in key_notify_policy_flush() key_notify_policy_flush() miss to nitialize the sadb_msg_satype member of the broadcasted message and thereby leak heap memory to listeners (CVE-2013-2237)

Heap-based buffer overflow in the iscsi_add_notunderstood_response function in drivers/target/iscsi/iscsi_target_parameters.c in the iSCSI target subsystem in the Linux kernel through 3.9.4 allows remote attackers to cause a denial of service (memory corruption and OOPS) or possibly execute arbitrary code via a long key that is not properly handled during construction of an error-response packet. A reproduction case requires patching open-iscsi to send overly large keys. Performing discovery in a loop will Oops the remote server. (CVE-2013-2850)

Format string vulnerability in the b43_request_firmware function in drivers/net/wireless/b43/main.c in the Broadcom B43 wireless driver in the Linux kernel through 3.9.4 allows local users to gain privileges by leveraging root access and including format string specifiers in an fwpostfix modprobe parameter, leading to improper construction of an error message. (CVE-2013-2852)

Other fixes: Fix up alx AR8161 breakage (mga #10079) rt patch has been updated to -rt67

For other -stable fixes, read the referenced changelogs

This kernel-vserver update provides the upstream 3.4.52 kernel and fixes the follwing security issues:

The pciback_enable_msi function in the PCI backend driver (drivers/xen/pciback/conf_space_capability_msi.c) in Xen for the Linux kernel 2.6.18 and 3.8 allows guest OS users with PCI device access to cause a denial of service via a large number of kernel log messages. (CVE-2013-0231 / XSA-43)

ipv6: ip6_sk_dst_check() must not assume ipv6 dst It's possible to use AF_INET6 sockets and to connect to an IPv4 destination. After this, socket dst cache is a pointer to a rtable, not rt6_info. This bug can be exploited by local non-root users to trigger various corruptions/crashes (CVE-2013-2232)

af_key: fix info leaks in notify messages key_notify_sa_flush() and key_notify_policy_flush() miss to initialize the sadb_msg_reserved member of the broadcasted message and thereby leak 2 bytes of heap memory to listeners (CVE-2013-2234)

af_key: initialize satype in key_notify_policy_flush() key_notify_policy_flush() miss to nitialize the sadb_msg_satype member of the broadcasted message and thereby leak heap memory to listeners (CVE-2013-2237)

Heap-based buffer overflow in the iscsi_add_notunderstood_response function in drivers/target/iscsi/iscsi_target_parameters.c in the iSCSI target subsystem in the Linux kernel through 3.9.4 allows remote attackers to cause a denial of service (memory corruption and OOPS) or possibly execute arbitrary code via a long key that is not properly handled during construction of an error-response packet. A reproduction case requires patching open-iscsi to send overly large keys. Performing discovery in a loop will Oops the remote server. (CVE-2013-2850)

Format string vulnerability in the b43_request_firmware function in drivers/net/wireless/b43/main.c in the Broadcom B43 wireless driver in the Linux kernel through 3.9.4 allows local users to gain privileges by leveraging root access and including format string specifiers in an fwpostfix modprobe parameter, leading to improper construction of an error message. (CVE-2013-2852)

Other fixes: Fix up alx AR8161 breakage (mga #10079)

For other -stable fixes, read the referenced changelogs

This kernel-tmb update provides the extended stable 3.8.13.4 kernel and fixes the following security issues:

The pciback_enable_msi function in the PCI backend driver (drivers/xen/pciback/conf_space_capability_msi.c) in Xen for the Linux kernel 2.6.18 and 3.8 allows guest OS users with PCI device access to cause a denial of service via a large number of kernel log messages. (CVE-2013-0231 / XSA-43)

ipv6: ip6_sk_dst_check() must not assume ipv6 dst It's possible to use AF_INET6 sockets and to connect to an IPv4 destination. After this, socket dst cache is a pointer to a rtable, not rt6_info. This bug can be exploited by local non-root users to trigger various corruptions/crashes (CVE-2013-2232)

af_key: fix info leaks in notify messages key_notify_sa_flush() and key_notify_policy_flush() miss to initialize the sadb_msg_reserved member of the broadcasted message and thereby leak 2 bytes of heap memory to listeners (CVE-2013-2234)

af_key: initialize satype in key_notify_policy_flush() key_notify_policy_flush() miss to nitialize the sadb_msg_satype member of the broadcasted message and thereby leak heap memory to listeners (CVE-2013-2237)

Heap-based buffer overflow in the iscsi_add_notunderstood_response function in drivers/target/iscsi/iscsi_target_parameters.c in the iSCSI target subsystem in the Linux kernel through 3.9.4 allows remote attackers to cause a denial of service (memory corruption and OOPS) or possibly execute arbitrary code via a long key that is not properly handled during construction of an error-response packet. A reproduction case requires patching open-iscsi to send overly large keys. Performing discovery in a loop will Oops the remote server. (CVE-2013-2850)

Format string vulnerability in the b43_request_firmware function in drivers/net/wireless/b43/main.c in the Broadcom B43 wireless driver in the Linux kernel through 3.9.4 allows local users to gain privileges by leveraging root access and including format string specifiers in an fwpostfix modprobe parameter, leading to improper construction of an error message. (CVE-2013-2852)

Other fixes:

• Fix up alx AR8161 breakage (mga #10079)
• bcma: add support for BCM43142 (mga#9378, mga#10611)
• net/tg3: Avoid delay during MMIO access
• iommu/vt-d: add quirk for broken interrupt remapping on 55XX chipsets
• rtlwifi: rtl8723ae: Fix typo in firmware names
• rtlwifi: rtl8192cu: Fix problem in connecting to WEP or WPA(1) networks
• md/raid10: fix two bugs affecting RAID10 reshape
• crypto: algboss - Hold ref count on larval
• perf: Disable monitoring on setuid processes for regular users
• netfilter: nf_conntrack_ipv6: Plug sk_buff leak in fragment handling
• enable X86_X2APIC, X86_REROUTE_FOR_BROKEN_BOOT_IRQS, FHANDLE
• disable COMPAT_VDSO (not needed since glibc-2.3.3)

For other fixes in the extended stable update, see the referenced shortlog

This kernel-rt update provides the extended stable 3.8.13.4 kernel and fixes the follwing security issues:

The pciback_enable_msi function in the PCI backend driver (drivers/xen/pciback/conf_space_capability_msi.c) in Xen for the Linux kernel 2.6.18 and 3.8 allows guest OS users with PCI device access to cause a denial of service via a large number of kernel log messages. (CVE-2013-0231 / XSA-43)

ipv6: ip6_sk_dst_check() must not assume ipv6 dst It's possible to use AF_INET6 sockets and to connect to an IPv4 destination. After this, socket dst cache is a pointer to a rtable, not rt6_info. This bug can be exploited by local non-root users to trigger various corruptions/crashes (CVE-2013-2232)

af_key: fix info leaks in notify messages key_notify_sa_flush() and key_notify_policy_flush() miss to initialize the sadb_msg_reserved member of the broadcasted message and thereby leak 2 bytes of heap memory to listeners (CVE-2013-2234)

af_key: initialize satype in key_notify_policy_flush() key_notify_policy_flush() miss to nitialize the sadb_msg_satype member of the broadcasted message and thereby leak heap memory to listeners (CVE-2013-2237)

Heap-based buffer overflow in the iscsi_add_notunderstood_response function in drivers/target/iscsi/iscsi_target_parameters.c in the iSCSI target subsystem in the Linux kernel through 3.9.4 allows remote attackers to cause a denial of service (memory corruption and OOPS) or possibly execute arbitrary code via a long key that is not properly handled during construction of an error-response packet. A reproduction case requires patching open-iscsi to send overly large keys. Performing discovery in a loop will Oops the remote server. (CVE-2013-2850)

Format string vulnerability in the b43_request_firmware function in drivers/net/wireless/b43/main.c in the Broadcom B43 wireless driver in the Linux kernel through 3.9.4 allows local users to gain privileges by leveraging root access and including format string specifiers in an fwpostfix modprobe parameter, leading to improper construction of an error message. (CVE-2013-2852)

Other fixes:

• Fix up alx AR8161 breakage (mga #10079)
• md/raid10: fix two bugs affecting RAID10 reshape
• perf: Disable monitoring on setuid processes for regular users
• netfilter: nf_conntrack_ipv6: Plug sk_buff leak in fragment handling
• enable X86_X2APIC, X86_REROUTE_FOR_BROKEN_BOOT_IRQS, FHANDLE
• disable COMPAT_VDSO (not needed since glibc-2.3.3)

The -rt patch has been updated to -rt14

For other fixes in the extended stable update, see the referenced shortlog

The SUSE Linux Enterprise 11 Service Pack 3 kernel has been updated to fix various bugs and security issues.

The following security bugs have been fixed:

* 

  CVE-2014-1739: The media_device_enum_entities function in
  drivers/media/media-device.c in the Linux kernel before 3.14.6 does
  not initialize a certain data structure, which allows local users to
  obtain sensitive information from kernel memory by leveraging
  /dev/media0 read access for a MEDIA_IOC_ENUM_ENTITIES ioctl call
  (bnc#882804).

* 

  CVE-2014-4171: mm/shmem.c in the Linux kernel through 3.15.1 does not
  properly implement the interaction between range notification and
  hole punching, which allows local users to cause a denial of service
  (i_mutex hold) by using the mmap system call to access a hole, as
  demonstrated by interfering with intended shmem activity by blocking
  completion of (1) an MADV_REMOVE madvise call or (2) an
  FALLOC_FL_PUNCH_HOLE fallocate call (bnc#883518).

* 

  CVE-2014-4508: arch/x86/kernel/entry_32.S in the Linux kernel through
  3.15.1 on 32-bit x86 platforms, when syscall auditing is enabled and
  the sep CPU feature flag is set, allows local users to cause a denial
  of service (OOPS and system crash) via an invalid syscall number, as
  demonstrated by number 1000 (bnc#883724).

* 

  CVE-2014-4667: The sctp_association_free function in
  net/sctp/associola.c in the Linux kernel before 3.15.2 does not
  properly manage a certain backlog value, which allows remote
  attackers to cause a denial of service (socket outage) via a crafted
  SCTP packet (bnc#885422).

* 

  CVE-2014-4943: The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the
  Linux kernel through 3.15.6 allows local users to gain privileges by
  leveraging data-structure differences between an l2tp socket and an
  inet socket (bnc#887082).

* 

  CVE-2014-5077: The sctp_assoc_update function in net/sctp/associola.c
  in the Linux kernel through 3.15.8, when SCTP authentication is
  enabled, allows remote attackers to cause a denial of service (NULL
  pointer dereference and OOPS) by starting to establish an association
  between two endpoints immediately after an exchange of INIT and INIT
  ACK chunks to establish an earlier association between these
  endpoints in the opposite direction (bnc#889173).

* 

  CVE-2014-5471: Stack consumption vulnerability in the
  parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the
  Linux kernel through 3.16.1 allows local users to cause a denial of
  service (uncontrolled recursion, and system crash or reboot) via a
  crafted iso9660 image with a CL entry referring to a directory entry
  that has a CL entry. (bnc#892490)

* 

  CVE-2014-5472: The parse_rock_ridge_inode_internal function in
  fs/isofs/rock.c in the Linux kernel through 3.16.1 allows local users
  to cause a denial of service (unkillable mount process) via a crafted
  iso9660 image with a self-referential CL entry. (bnc#892490)

* 

  CVE-2014-2706: Race condition in the mac80211 subsystem in the Linux
  kernel before 3.13.7 allows remote attackers to cause a denial of
  service (system crash) via network traffic that improperly interacts
  with the WLAN_STA_PS_STA state (aka power-save mode), related to
  sta_info.c and tx.c. (bnc#871797)

* 

  CVE-2014-4027: The rd_build_device_space function in
  drivers/target/target_core_rd.c in the Linux kernel before 3.14 does
  not properly initialize a certain data structure, which allows local
  users to obtain sensitive information from ramdisk_mcp memory by
  leveraging access to a SCSI initiator. (bnc#882639)

* 

  CVE-2014-3153 The futex_requeue function in kernel/futex.c in the
  Linux kernel through 3.14.5 does not ensure that…

The SUSE Linux Enterprise 11 Service Pack 2 kernel was updated to fix a regression introduced by the previous update:

* scsi_dh_alua: Incorrect reference counting in the SCSI ALUA
  initialization code lead to system crashes on boot (bnc#858831).

As the update introducing the regression was marked security, this is also marked security even though this bug is not security relevant.

The SUSE Linux Enterprise 11 Service Pack 3 kernel has been updated to fix various bugs and security issues.

The following security bugs have been fixed:

* 

  CVE-2014-1739: The media_device_enum_entities function in
  drivers/media/media-device.c in the Linux kernel before 3.14.6 does
  not initialize a certain data structure, which allows local users to
  obtain sensitive information from kernel memory by leveraging
  /dev/media0 read access for a MEDIA_IOC_ENUM_ENTITIES ioctl call
  (bnc#882804).

* 

  CVE-2014-4171: mm/shmem.c in the Linux kernel through 3.15.1 does not
  properly implement the interaction between range notification and
  hole punching, which allows local users to cause a denial of service
  (i_mutex hold) by using the mmap system call to access a hole, as
  demonstrated by interfering with intended shmem activity by blocking
  completion of (1) an MADV_REMOVE madvise call or (2) an
  FALLOC_FL_PUNCH_HOLE fallocate call (bnc#883518).

* 

  CVE-2014-4508: arch/x86/kernel/entry_32.S in the Linux kernel through
  3.15.1 on 32-bit x86 platforms, when syscall auditing is enabled and
  the sep CPU feature flag is set, allows local users to cause a denial
  of service (OOPS and system crash) via an invalid syscall number, as
  demonstrated by number 1000 (bnc#883724).

* 

  CVE-2014-4667: The sctp_association_free function in
  net/sctp/associola.c in the Linux kernel before 3.15.2 does not
  properly manage a certain backlog value, which allows remote
  attackers to cause a denial of service (socket outage) via a crafted
  SCTP packet (bnc#885422).

* 

  CVE-2014-4943: The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the
  Linux kernel through 3.15.6 allows local users to gain privileges by
  leveraging data-structure differences between an l2tp socket and an
  inet socket (bnc#887082).

* 

  CVE-2014-5077: The sctp_assoc_update function in net/sctp/associola.c
  in the Linux kernel through 3.15.8, when SCTP authentication is
  enabled, allows remote attackers to cause a denial of service (NULL
  pointer dereference and OOPS) by starting to establish an association
  between two endpoints immediately after an exchange of INIT and INIT
  ACK chunks to establish an earlier association between these
  endpoints in the opposite direction (bnc#889173).

* 

  CVE-2014-5471: Stack consumption vulnerability in the
  parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the
  Linux kernel through 3.16.1 allows local users to cause a denial of
  service (uncontrolled recursion, and system crash or reboot) via a
  crafted iso9660 image with a CL entry referring to a directory entry
  that has a CL entry. (bnc#892490)

* 

  CVE-2014-5472: The parse_rock_ridge_inode_internal function in
  fs/isofs/rock.c in the Linux kernel through 3.16.1 allows local users
  to cause a denial of service (unkillable mount process) via a crafted
  iso9660 image with a self-referential CL entry. (bnc#892490)

* 

  CVE-2014-2706: Race condition in the mac80211 subsystem in the Linux
  kernel before 3.13.7 allows remote attackers to cause a denial of
  service (system crash) via network traffic that improperly interacts
  with the WLAN_STA_PS_STA state (aka power-save mode), related to
  sta_info.c and tx.c. (bnc#871797)

* 

  CVE-2014-4027: The rd_build_device_space function in
  drivers/target/target_core_rd.c in the Linux kernel before 3.14 does
  not properly initialize a certain data structure, which allows local
  users to obtain sensitive information from ramdisk_mcp memory by
  leveraging access to a SCSI initiator. (bnc#882639)

* 

  CVE-2014-3153 The futex_requeue function in kernel/futex.c in the
  Linux kernel through 3.14.5 does not ensure that…

The SUSE Linux Enterprise 11 SP1 Teradata kernel was updated to fix bugs and security issues.

Following security issues were fixed:

CVE-2011-1083: Limit the path length users can build using epoll() to avoid local attackers consuming lots of kernel CPU time.

CVE-2011-4086: Fixed a oops in jbd/jbd2 that could be caused by specific filesystem access patterns.

CVE-2011-4622: KVM: Prevent starting PIT timers in the absence of irqchip support.

CVE-2012-0045: KVM: Extend 'struct x86_emulate_ops' with 'get_cpuid' and fix missing checks in syscall emulation.

CVE-2012-0879: Fix io_context leak after clone with CLONE_IO.

CVE-2012-1090: Fixed a dentry refcount leak in the CIFS file system that could lead to a crash on unmount.

CVE-2012-1097: The regset common infrastructure assumed that regsets would always have .get and .set methods, but necessarily .active methods. Unfortunately people have since written regsets without .set method, so NULL pointer dereference attacks were possible.

Following non-security issues were fixed:

* SCSI inquiry doesn't return data on SLES 11-SP1 Xen VMs (bnc#745929).
* FC transport driver killing off the timers/work queues (bnc#734300).
* The driver ixgbevf doesn't work on newer SLES 11-SP1 kernels
  (bnc#752972).
* Pack sparsemem memmap sections closer together and in higher zones
  (bnc#743870).

Following feature was implemented:

* The megaraid_sas driver update to version 5.40-LSI (bnc#736813).

Security Issues:

* CVE-2011-1083
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1083>
* CVE-2011-4086
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4086>
* CVE-2011-4622
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4622>
* CVE-2012-0045
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0045>
* CVE-2012-0879
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0879>
* CVE-2012-1090
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1090>
* CVE-2012-1097
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1097>

The SUSE Linux Enterprise 11 Service Pack 3 kernel has been updated to fix various bugs and security issues.

The following security bugs have been fixed:

* 

  CVE-2014-1739: The media_device_enum_entities function in
  drivers/media/media-device.c in the Linux kernel before 3.14.6 does
  not initialize a certain data structure, which allows local users to
  obtain sensitive information from kernel memory by leveraging
  /dev/media0 read access for a MEDIA_IOC_ENUM_ENTITIES ioctl call
  (bnc#882804).

* 

  CVE-2014-4171: mm/shmem.c in the Linux kernel through 3.15.1 does not
  properly implement the interaction between range notification and
  hole punching, which allows local users to cause a denial of service
  (i_mutex hold) by using the mmap system call to access a hole, as
  demonstrated by interfering with intended shmem activity by blocking
  completion of (1) an MADV_REMOVE madvise call or (2) an
  FALLOC_FL_PUNCH_HOLE fallocate call (bnc#883518).

* 

  CVE-2014-4508: arch/x86/kernel/entry_32.S in the Linux kernel through
  3.15.1 on 32-bit x86 platforms, when syscall auditing is enabled and
  the sep CPU feature flag is set, allows local users to cause a denial
  of service (OOPS and system crash) via an invalid syscall number, as
  demonstrated by number 1000 (bnc#883724).

* 

  CVE-2014-4667: The sctp_association_free function in
  net/sctp/associola.c in the Linux kernel before 3.15.2 does not
  properly manage a certain backlog value, which allows remote
  attackers to cause a denial of service (socket outage) via a crafted
  SCTP packet (bnc#885422).

* 

  CVE-2014-4943: The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the
  Linux kernel through 3.15.6 allows local users to gain privileges by
  leveraging data-structure differences between an l2tp socket and an
  inet socket (bnc#887082).

* 

  CVE-2014-5077: The sctp_assoc_update function in net/sctp/associola.c
  in the Linux kernel through 3.15.8, when SCTP authentication is
  enabled, allows remote attackers to cause a denial of service (NULL
  pointer dereference and OOPS) by starting to establish an association
  between two endpoints immediately after an exchange of INIT and INIT
  ACK chunks to establish an earlier association between these
  endpoints in the opposite direction (bnc#889173).

* 

  CVE-2014-5471: Stack consumption vulnerability in the
  parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the
  Linux kernel through 3.16.1 allows local users to cause a denial of
  service (uncontrolled recursion, and system crash or reboot) via a
  crafted iso9660 image with a CL entry referring to a directory entry
  that has a CL entry. (bnc#892490)

* 

  CVE-2014-5472: The parse_rock_ridge_inode_internal function in
  fs/isofs/rock.c in the Linux kernel through 3.16.1 allows local users
  to cause a denial of service (unkillable mount process) via a crafted
  iso9660 image with a self-referential CL entry. (bnc#892490)

* 

  CVE-2014-2706: Race condition in the mac80211 subsystem in the Linux
  kernel before 3.13.7 allows remote attackers to cause a denial of
  service (system crash) via network traffic that improperly interacts
  with the WLAN_STA_PS_STA state (aka power-save mode), related to
  sta_info.c and tx.c. (bnc#871797)

* 

  CVE-2014-4027: The rd_build_device_space function in
  drivers/target/target_core_rd.c in the Linux kernel before 3.14 does
  not properly initialize a certain data structure, which allows local
  users to obtain sensitive information from ramdisk_mcp memory by
  leveraging access to a SCSI initiator. (bnc#882639)

* 

  CVE-2014-3153 The futex_requeue function in kernel/futex.c in the
  Linux kernel through 3.14.5 does not ensure that…

The SUSE Linux Enterprise 11 Service Pack 3 kernel has been updated to fix various bugs and security issues.

The following security bugs have been fixed:

* 

  CVE-2014-1739: The media_device_enum_entities function in
  drivers/media/media-device.c in the Linux kernel before 3.14.6 does
  not initialize a certain data structure, which allows local users to
  obtain sensitive information from kernel memory by leveraging
  /dev/media0 read access for a MEDIA_IOC_ENUM_ENTITIES ioctl call
  (bnc#882804).

* 

  CVE-2014-4171: mm/shmem.c in the Linux kernel through 3.15.1 does not
  properly implement the interaction between range notification and
  hole punching, which allows local users to cause a denial of service
  (i_mutex hold) by using the mmap system call to access a hole, as
  demonstrated by interfering with intended shmem activity by blocking
  completion of (1) an MADV_REMOVE madvise call or (2) an
  FALLOC_FL_PUNCH_HOLE fallocate call (bnc#883518).

* 

  CVE-2014-4508: arch/x86/kernel/entry_32.S in the Linux kernel through
  3.15.1 on 32-bit x86 platforms, when syscall auditing is enabled and
  the sep CPU feature flag is set, allows local users to cause a denial
  of service (OOPS and system crash) via an invalid syscall number, as
  demonstrated by number 1000 (bnc#883724).

* 

  CVE-2014-4667: The sctp_association_free function in
  net/sctp/associola.c in the Linux kernel before 3.15.2 does not
  properly manage a certain backlog value, which allows remote
  attackers to cause a denial of service (socket outage) via a crafted
  SCTP packet (bnc#885422).

* 

  CVE-2014-4943: The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the
  Linux kernel through 3.15.6 allows local users to gain privileges by
  leveraging data-structure differences between an l2tp socket and an
  inet socket (bnc#887082).

* 

  CVE-2014-5077: The sctp_assoc_update function in net/sctp/associola.c
  in the Linux kernel through 3.15.8, when SCTP authentication is
  enabled, allows remote attackers to cause a denial of service (NULL
  pointer dereference and OOPS) by starting to establish an association
  between two endpoints immediately after an exchange of INIT and INIT
  ACK chunks to establish an earlier association between these
  endpoints in the opposite direction (bnc#889173).

* 

  CVE-2014-5471: Stack consumption vulnerability in the
  parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the
  Linux kernel through 3.16.1 allows local users to cause a denial of
  service (uncontrolled recursion, and system crash or reboot) via a
  crafted iso9660 image with a CL entry referring to a directory entry
  that has a CL entry. (bnc#892490)

* 

  CVE-2014-5472: The parse_rock_ridge_inode_internal function in
  fs/isofs/rock.c in the Linux kernel through 3.16.1 allows local users
  to cause a denial of service (unkillable mount process) via a crafted
  iso9660 image with a self-referential CL entry. (bnc#892490)

* 

  CVE-2014-2706: Race condition in the mac80211 subsystem in the Linux
  kernel before 3.13.7 allows remote attackers to cause a denial of
  service (system crash) via network traffic that improperly interacts
  with the WLAN_STA_PS_STA state (aka power-save mode), related to
  sta_info.c and tx.c. (bnc#871797)

* 

  CVE-2014-4027: The rd_build_device_space function in
  drivers/target/target_core_rd.c in the Linux kernel before 3.14 does
  not properly initialize a certain data structure, which allows local
  users to obtain sensitive information from ramdisk_mcp memory by
  leveraging access to a SCSI initiator. (bnc#882639)

* 

  CVE-2014-3153 The futex_requeue function in kernel/futex.c in the
  Linux kernel through 3.14.5 does not ensure that…

The SUSE Linux Enterprise 11 Service Pack 3 kernel has been updated to fix various bugs and security issues.

The following security bugs have been fixed:

* 

  CVE-2014-1739: The media_device_enum_entities function in
  drivers/media/media-device.c in the Linux kernel before 3.14.6 does
  not initialize a certain data structure, which allows local users to
  obtain sensitive information from kernel memory by leveraging
  /dev/media0 read access for a MEDIA_IOC_ENUM_ENTITIES ioctl call
  (bnc#882804).

* 

  CVE-2014-4171: mm/shmem.c in the Linux kernel through 3.15.1 does not
  properly implement the interaction between range notification and
  hole punching, which allows local users to cause a denial of service
  (i_mutex hold) by using the mmap system call to access a hole, as
  demonstrated by interfering with intended shmem activity by blocking
  completion of (1) an MADV_REMOVE madvise call or (2) an
  FALLOC_FL_PUNCH_HOLE fallocate call (bnc#883518).

* 

  CVE-2014-4508: arch/x86/kernel/entry_32.S in the Linux kernel through
  3.15.1 on 32-bit x86 platforms, when syscall auditing is enabled and
  the sep CPU feature flag is set, allows local users to cause a denial
  of service (OOPS and system crash) via an invalid syscall number, as
  demonstrated by number 1000 (bnc#883724).

* 

  CVE-2014-4667: The sctp_association_free function in
  net/sctp/associola.c in the Linux kernel before 3.15.2 does not
  properly manage a certain backlog value, which allows remote
  attackers to cause a denial of service (socket outage) via a crafted
  SCTP packet (bnc#885422).

* 

  CVE-2014-4943: The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the
  Linux kernel through 3.15.6 allows local users to gain privileges by
  leveraging data-structure differences between an l2tp socket and an
  inet socket (bnc#887082).

* 

  CVE-2014-5077: The sctp_assoc_update function in net/sctp/associola.c
  in the Linux kernel through 3.15.8, when SCTP authentication is
  enabled, allows remote attackers to cause a denial of service (NULL
  pointer dereference and OOPS) by starting to establish an association
  between two endpoints immediately after an exchange of INIT and INIT
  ACK chunks to establish an earlier association between these
  endpoints in the opposite direction (bnc#889173).

* 

  CVE-2014-5471: Stack consumption vulnerability in the
  parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the
  Linux kernel through 3.16.1 allows local users to cause a denial of
  service (uncontrolled recursion, and system crash or reboot) via a
  crafted iso9660 image with a CL entry referring to a directory entry
  that has a CL entry. (bnc#892490)

* 

  CVE-2014-5472: The parse_rock_ridge_inode_internal function in
  fs/isofs/rock.c in the Linux kernel through 3.16.1 allows local users
  to cause a denial of service (unkillable mount process) via a crafted
  iso9660 image with a self-referential CL entry. (bnc#892490)

* 

  CVE-2014-2706: Race condition in the mac80211 subsystem in the Linux
  kernel before 3.13.7 allows remote attackers to cause a denial of
  service (system crash) via network traffic that improperly interacts
  with the WLAN_STA_PS_STA state (aka power-save mode), related to
  sta_info.c and tx.c. (bnc#871797)

* 

  CVE-2014-4027: The rd_build_device_space function in
  drivers/target/target_core_rd.c in the Linux kernel before 3.14 does
  not properly initialize a certain data structure, which allows local
  users to obtain sensitive information from ramdisk_mcp memory by
  leveraging access to a SCSI initiator. (bnc#882639)

* 

  CVE-2014-3153 The futex_requeue function in kernel/futex.c in the
  Linux kernel through 3.14.5 does not ensure that…

The key_notify_policy_flush function in net/key/af_key.c in the Linux kernel before 3.9 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel heap memory by reading a broadcast message from the notify_policy interface of an IPSec key_socket.