CVE-2014-9730

The SUSE Linux Enterprise 11 SP3 Teradata kernel was updated to fix the following bugs and security issues.

The following security issues have been fixed:

• Update patches.fixes/udp-fix-behavior-of-wrong-checksums.patch (bsc#936831, CVE-2015-5364, CVE-2015-5366).
• Btrfs: make xattr replace operations atomic (bnc#923908, CVE-2014-9710).
• udp: fix behavior of wrong checksums (bsc#936831, CVE-2015-5364, CVE-2015-5366).
• vfs: read file_handle only once in handle_to_path (bsc#915517, CVE-2015-1420).
• x86: bpf_jit: fix compilation of large bpf programs (bnc#935705,CVE-2015-4700).
• udf: Check length of extended attributes and allocation (bsc#936831, CVE-2015-5364, CVE-2015-5366).
• Update patches.fixes/udf-Check-component-length-before-reading-it.patch (bsc#933904, CVE-2014-9728, CVE-2014-9730).
• Update patches.fixes/udf-Verify-i_size-when-loading-inode.patch (bsc#933904, CVE-2014-9728, CVE-2014-9729).
• Update patches.fixes/udf-Verify-symlink-size-before-loading-it.patch (bsc#933904, CVE-2014-9728).
• Update patches.fixes/udf-Check-path-length-when-reading-symlink.patch (bnc#933896, CVE-2014-9731).
• pipe: fix iov overrun for failed atomic copy (bsc#933429, CVE-2015-1805).
• ipv6: Don't reduce hop limit for an interface (bsc#922583, CVE-2015-2922).
• net: llc: use correct size for sysctl timeout entries (bsc#919007, CVE-2015-2041).
• ipv4: Missing sk_nulls_node_init() in ping_unhash() (bsc#929525, CVE-2015-3636).
• ipv6: Don't reduce hop limit for an interface (bsc#922583, CVE-2015-2922).
• net: llc: use correct size for sysctl timeout entries (bsc#919007, CVE-2015-2041).
• ipv4: Missing sk_nulls_node_init() in ping_unhash() (bsc#929525, CVE-2015-3636).

The following non-security issues have been fixed:

• mlx4: Check for assigned VFs before disabling SR-IOV (bsc#927355).
• ixgbe: Use pci_vfs_assigned instead of ixgbe_vfs_are_assigned (bsc#927355).
• pci: Add SRIOV helper function to determine if VFs are assigned to guest (bsc#927355).
• net/mlx4_core: Don't disable SRIOV if there are active VFs (bsc#927355).
• udf: Remove repeated loads blocksize (bsc#933907).
• Refresh patches.fixes/deal-with-deadlock-in-d_walk-fix.patch. based on 3.2 stable fix 20defcec264c ('dcache: Fix locking bugs in backported 'deal with deadlock in d_walk()''). Not harmfull for regular SLES kernels but RT or PREEMPT kernels would see disbalance.
• sched: Fix potential near-infinite distribute_cfs_runtime() loop (bnc#930786)
• tty: Correct tty buffer flush (bnc#929647).
• tty: hold lock across tty buffer finding and buffer filling (bnc#929647).

The SUSE Linux Enterprise 12 kernel was updated to 3.12.44 to receive various security and bugfixes.

These features were added:

• mpt2sas: Added Reply Descriptor Post Queue (RDPQ) Array support (bsc#854824).
• mpt3sas: Bump mpt3sas driver version to 04.100.00.00 (bsc#854817).

Following security bugs were fixed:

• CVE-2015-1805: iov overrun for failed atomic copy could have lead to DoS or privilege escalation (bsc#933429).
• CVE-2015-3212: A race condition in the way the Linux kernel handled lists of associations in SCTP sockets could have lead to list corruption and kernel panics (bsc#936502).
• CVE-2015-4036: DoS via memory corruption in vhost/scsi driver (bsc#931988).
• CVE-2015-4167: Linux kernel built with the UDF file system(CONFIG_UDF_FS) support was vulnerable to a crash. It occurred while fetching inode information from a corrupted/malicious udf file system image (bsc#933907).
• CVE-2015-4692: DoS via NULL pointer dereference in kvm_apic_has_events function (bsc#935542).
• CVE-2015-5364: Remote DoS via flood of UDP packets with invalid checksums (bsc#936831).
• CVE-2015-5366: Remote DoS of EPOLLET epoll applications via flood of UDP packets with invalid checksums (bsc#936831).

Security issues already fixed in the previous update but not referenced by CVE:

• CVE-2014-9728: Kernel built with the UDF file system(CONFIG_UDF_FS) support were vulnerable to a crash (bsc#933904).
• CVE-2014-9729: Kernel built with the UDF file system(CONFIG_UDF_FS) support were vulnerable to a crash (bsc#933904).
• CVE-2014-9730: Kernel built with the UDF file system(CONFIG_UDF_FS) support were vulnerable to a crash (bsc#933904).
• CVE-2014-9731: Kernel built with the UDF file system(CONFIG_UDF_FS) support were vulnerable to information leakage (bsc#933896).

The following non-security bugs were fixed:

• ALSA: hda - add codec ID for Skylake display audio codec (bsc#936556).
• ALSA: hda/hdmi - apply Haswell fix-ups to Skylake display codec (bsc#936556).
• ALSA: hda_controller: Separate stream_tag for input and output streams (bsc#936556).
• ALSA: hda_intel: add AZX_DCAPS_I915_POWERWELL for SKL and BSW (bsc#936556).
• ALSA: hda_intel: apply the Seperate stream_tag for Skylake (bsc#936556).
• ALSA: hda_intel: apply the Seperate stream_tag for Sunrise Point (bsc#936556).
• Btrfs: Handle unaligned length in extent_same (bsc#937609).
• Btrfs: add missing inode item update in fallocate() (bsc#938023).
• Btrfs: check pending chunks when shrinking fs to avoid corruption (bsc#936445).
• Btrfs: do not update mtime/ctime on deduped inodes (bsc#937616).
• Btrfs: fix block group ->space_info null pointer dereference (bsc#935088).
• Btrfs: fix clone / extent-same deadlocks (bsc#937612).
• Btrfs: fix deadlock with extent-same and readpage (bsc#937612).
• Btrfs: fix fsync data loss after append write (bsc#936446).
• Btrfs: fix hang during inode eviction due to concurrent readahead (bsc#935085).
• Btrfs: fix memory leak in the extent_same ioctl (bsc#937613).
• Btrfs: fix race when reusing stale extent buffers that leads to BUG_ON (bsc#926369).
• Btrfs: fix use after free when close_ctree frees the orphan_rsv (bsc#938022).
• Btrfs: pass unaligned length to btrfs_cmp_data() (bsc#937609).
• Btrfs: provide super_operations->inode_get_dev (bsc#927455).
• Drivers: hv: balloon: check if ha_region_mutex was acquired in MEM_CANCEL_ONLINE case.
• Drivers: hv: fcopy: process deferred messages when we complete the transaction.
• Drivers: hv: fcopy: rename fcopy_work -> fcopy_timeout_work.
• Drivers: hv: fcopy: set .owner reference for file operations.
• Drivers: hv: fcopy: switch to using the hvutil_device_state state machine.
• Drivers: hv: hv_balloon: correctly handle num_pages>INT_MAX case.
• Drivers: hv: hv_balloon: correctly handle val.freeram lower than num_pages case.
• Drivers: hv: hv_balloon: do not lose memory when onlining order is not natural.
• Drivers: hv: hv_balloon: do not online pages in offline…

The SUSE Linux Enterprise 11 SP3 Realtime kernel was updated to receive various security and bugfixes.

The following feature was added for RT:

• FATE#317131: The SocketCAN (Peak PCI) driver was added for CAN bus support.

Following security bugs were fixed:

• CVE-2015-5707: An integer overflow in the SCSI generic driver could be potentially used by local attackers to crash the kernel or execute code (bsc#940338).
• CVE-2015-5364: A remote denial of service (hang) via UDP flood with incorrect package checksums was fixed. (bsc#936831).
• CVE-2015-5366: A remote denial of service (unexpected error returns) via UDP flood with incorrect package checksums was fixed. (bsc#936831).
• CVE-2015-1420: A race condition in the handle_to_path function in fs/fhandle.c in the Linux kernel allowed local users to bypass intended size restrictions and trigger read operations on additional memory locations by changing the handle_bytes value of a file handle during the execution of this function (bnc#915517).
• CVE-2015-4700: A local user could have created a bad instruction in the JIT processed BPF code, leading to a kernel crash (bnc#935705).
• CVE-2015-4167: The UDF filesystem in the Linux kernel was vulnerable to a crash which could occur while fetching inode information from a corrupted/malicious udf file system image. (bsc#933907).
• CVE-2014-9728 CVE-2014-9729 CVE-2014-9730 CVE-2014-9731: Various issues in handling UDF filesystems in the Linux kernel allowed the corruption of kernel memory and other issues. An attacker able to mount a corrupted/malicious UDF file system image could cause the kernel to crash. (bsc#933904 bsc#933896)
• CVE-2015-2150: The Linux kernel did not properly restrict access to PCI command registers, which might have allowed local guest users to cause a denial of service (non-maskable interrupt and host crash) by disabling the (1) memory or (2) I/O decoding for a PCI Express device and then accessing the device, which triggers an Unsupported Request (UR) response (bsc#919463).
• CVE-2015-0777: drivers/xen/usbback/usbback.c as used in the Linux kernel 2.6.x and 3.x in SUSE Linux distributions, allowed guest OS users to obtain sensitive information from uninitialized locations in host OS kernel memory via unspecified vectors (bnc#917830).
• CVE-2015-2830: arch/x86/kernel/entry_64.S in the Linux kernel did not prevent the TS_COMPAT flag from reaching a user-mode task, which might have allowed local users to bypass the seccomp or audit protection mechanism via a crafted application that uses the (1) fork or (2) close system call, as demonstrated by an attack against seccomp before 3.16 (bnc#926240).
• CVE-2015-1805: The Linux kernels implementation of vectored pipe read and write functionality did not take into account the I/O vectors that were already processed when retrying after a failed atomic access operation, potentially resulting in memory corruption due to an I/O vector array overrun. A local, unprivileged user could use this flaw to crash the system or, potentially, escalate their privileges on the system. (bsc#933429).

Also the following non-security bugs were fixed:

• audit: keep inode pinned (bsc#851068).
• btrfs: be aware of btree inode write errors to avoid fs corruption (bnc#942350).
• btrfs: check if previous transaction aborted to avoid fs corruption (bnc#942350).
• btrfs: deal with convert_extent_bit errors to avoid fs corruption (bnc#942350).
• cifs: Fix missing crypto allocation (bnc#937402).
• client MUST ignore EncryptionKeyLength if CAP_EXTENDED_SECURITY is set (bnc#932348).
• drm: ast,cirrus,mgag200: use drm_can_sleep (bnc#883380, bsc#935572).
• drm/cirrus: do not attempt to acquire a reservation while in an interrupt handler (bsc#935572).
• drm/mgag200: do not attempt to acquire a reservation while in an interrupt handler (bsc#935572).
• drm/mgag200: Do not do full cleanup if mgag200_device_init fails.
• ext3: Fix data…

The SUSE Linux Enterprise 11 SP3 kernel was updated to receive various security and bugfixes.

Following security bugs were fixed:

• CVE-2015-5707: An integer overflow in the SCSI generic driver could be potentially used by local attackers to crash the kernel or execute code (bsc#940338).
• CVE-2015-5364: A remote denial of service (hang) via UDP flood with incorrect package checksums was fixed. (bsc#936831).
• CVE-2015-5366: A remote denial of service (unexpected error returns) via UDP flood with incorrect package checksums was fixed. (bsc#936831).
• CVE-2015-1420: A race condition in the handle_to_path function in fs/fhandle.c in the Linux kernel allowed local users to bypass intended size restrictions and trigger read operations on additional memory locations by changing the handle_bytes value of a file handle during the execution of this function (bnc#915517).
• CVE-2015-4700: A local user could have created a bad instruction in the JIT processed BPF code, leading to a kernel crash (bnc#935705).
• CVE-2015-4167: The UDF filesystem in the Linux kernel was vulnerable to a crash which could occur while fetching inode information from a corrupted/malicious udf file system image. (bsc#933907).
• CVE-2014-9728 CVE-2014-9729 CVE-2014-9730 CVE-2014-9731: Various issues in handling UDF filesystems in the Linux kernel allowed the corruption of kernel memory and other issues. An attacker able to mount a corrupted/malicious UDF file system image could cause the kernel to crash. (bsc#933904 bsc#933896)
• CVE-2015-2150: The Linux kernel did not properly restrict access to PCI command registers, which might have allowed local guest users to cause a denial of service (non-maskable interrupt and host crash) by disabling the (1) memory or (2) I/O decoding for a PCI Express device and then accessing the device, which triggers an Unsupported Request (UR) response (bsc#919463).
• CVE-2015-0777: drivers/xen/usbback/usbback.c as used in the Linux kernel 2.6.x and 3.x in SUSE Linux distributions, allowed guest OS users to obtain sensitive information from uninitialized locations in host OS kernel memory via unspecified vectors (bnc#917830).
• CVE-2015-2830: arch/x86/kernel/entry_64.S in the Linux kernel did not prevent the TS_COMPAT flag from reaching a user-mode task, which might have allowed local users to bypass the seccomp or audit protection mechanism via a crafted application that uses the (1) fork or (2) close system call, as demonstrated by an attack against seccomp before 3.16 (bnc#926240).
• CVE-2015-1805: The Linux kernels implementation of vectored pipe read and write functionality did not take into account the I/O vectors that were already processed when retrying after a failed atomic access operation, potentially resulting in memory corruption due to an I/O vector array overrun. A local, unprivileged user could use this flaw to crash the system or, potentially, escalate their privileges on the system. (bsc#933429).

Also the following non-security bugs were fixed:

• audit: keep inode pinned (bsc#851068).
• btrfs: be aware of btree inode write errors to avoid fs corruption (bnc#942350).
• btrfs: check if previous transaction aborted to avoid fs corruption (bnc#942350).
• btrfs: deal with convert_extent_bit errors to avoid fs corruption (bnc#942350).
• cifs: Fix missing crypto allocation (bnc#937402).
• client MUST ignore EncryptionKeyLength if CAP_EXTENDED_SECURITY is set (bnc#932348).
• drm: ast,cirrus,mgag200: use drm_can_sleep (bnc#883380, bsc#935572).
• drm/cirrus: do not attempt to acquire a reservation while in an interrupt handler (bsc#935572).
• drm/mgag200: do not attempt to acquire a reservation while in an interrupt handler (bsc#935572).
• drm/mgag200: Do not do full cleanup if mgag200_device_init fails.
• ext3: Fix data corruption in inodes with journalled data (bsc#936637)
• ext4: handle SEEK_HOLE/SEEK_DATA generically (bsc#934944).
• fanotify: Fix…

The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes.

Following security bugs were fixed:

• CVE-2015-6252: Possible file descriptor leak for each VHOST_SET_LOG_FDcommand issued, this could eventually wasting available system resources and creating a denial of service (bsc#942367).
• CVE-2015-5707: Possible integer overflow in the calculation of total number of pages in bio_map_user_iov() (bsc#940338).
• CVE-2015-5364: The (1) udp_recvmsg and (2) udpv6_recvmsg functions in the Linux kernel before 4.0.6 do not properly consider yielding a processor, which allowed remote attackers to cause a denial of service (system hang) via incorrect checksums within a UDP packet flood (bsc#936831).
• CVE-2015-5366: The (1) udp_recvmsg and (2) udpv6_recvmsg functions in the Linux kernel before 4.0.6 provide inappropriate -EAGAIN return values, which allowed remote attackers to cause a denial of service (EPOLLET epoll application read outage) via an incorrect checksum in a UDP packet, a different vulnerability than CVE-2015-5364 (bsc#936831).
• CVE-2015-1420: Race condition in the handle_to_path function in fs/fhandle.c in the Linux kernel through 3.19.1 allowed local users to bypass intended size restrictions and trigger read operations on additional memory locations by changing the handle_bytes value of a file handle during the execution of this function (bsc#915517).
• CVE-2015-1805: The (1) pipe_read and (2) pipe_write implementations in fs/pipe.c in the Linux kernel before 3.16 do not properly consider the side effects of failed __copy_to_user_inatomic and __copy_from_user_inatomic calls, which allows local users to cause a denial of service (system crash) or possibly gain privileges via a crafted application, aka an 'I/O' vector array overrun. (bsc#933429)
• CVE-2015-2150: Xen 3.3.x through 4.5.x and the Linux kernel through 3.19.1 do not properly restrict access to PCI command registers, which might allow local guest users to cause a denial of service (non-maskable interrupt and host crash) by disabling the (1) memory or (2) I/O decoding for a PCI Express device and then accessing the device, which triggers an Unsupported Request (UR) response. (bsc#919463)
• CVE-2015-2830: arch/x86/kernel/entry_64.S in the Linux kernel before 3.19.2 does not prevent the TS_COMPAT flag from reaching a user-mode task, which might allow local users to bypass the seccomp or audit protection mechanism via a crafted application that uses the (1) fork or (2) close system call, as demonstrated by an attack against seccomp before 3.16. (bsc#926240)
• CVE-2015-4700: The bpf_int_jit_compile function in arch/x86/net/bpf_jit_comp.c in the Linux kernel before 4.0.6 allowed local users to cause a denial of service (system crash) by creating a packet filter and then loading crafted BPF instructions that trigger late convergence by the JIT compiler (bsc#935705).
• CVE-2015-4167: The udf_read_inode function in fs/udf/inode.c in the Linux kernel before 3.19.1 did not validate certain length values, which allowed local users to cause a denial of service (incorrect data representation or integer overflow, and OOPS) via a crafted UDF filesystem (bsc#933907).
• CVE-2015-0777: drivers/xen/usbback/usbback.c in linux-2.6.18-xen-3.4.0 (aka the Xen 3.4.x support patches for the Linux kernel 2.6.18), as used in the Linux kernel 2.6.x and 3.x in SUSE Linux distributions, allows guest OS users to obtain sensitive information from uninitialized locations in host OS kernel memory via unspecified vectors. (bsc#917830)
• CVE-2014-9728: The UDF filesystem implementation in the Linux kernel before 3.18.2 did not validate certain lengths, which allowed local users to cause a denial of service (buffer over-read and system crash) via a crafted filesystem image, related to fs/udf/inode.c and fs/udf/symlink.c (bsc#933904).
• CVE-2014-9730: The udf_pc_to_char…

The udf_pc_to_char function in fs/udf/symlink.c in the Linux kernel before 3.18.2 relies on component lengths that are unused, which allows local users to cause a denial of service (system crash) via a crafted UDF filesystem image.

A flaw was discovered in the Kernel Virtual Machine's (KVM) emulation of the SYSTENTER instruction when the guest OS does not initialize the SYSENTER MSRs. A guest OS user could exploit this flaw to cause a denial of service of the guest OS (crash) or potentially gain privileges on the guest OS. (CVE-2015-0239)

Andy Lutomirski discovered an information leak in the Linux kernel's Thread Local Storage (TLS) implementation allowing users to bypass the espfix to obtain information that could be used to bypass the Address Space Layout Randomization (ASLR) protection mechanism. A local user could exploit this flaw to obtain potentially sensitive information from kernel memory. (CVE-2014-8133)

A restriction bypass was discovered in iptables when conntrack rules are specified and the conntrack protocol handler module is not loaded into the Linux kernel. This flaw can cause the firewall rules on the system to be bypassed when conntrack rules are used. (CVE-2014-8160)

A flaw was discovered with file renaming in the linux kernel. A local user could exploit this flaw to cause a denial of service (deadlock and system hang). (CVE-2014-8559)

A flaw was discovered in how supplemental group memberships are handled in certain namespace scenarios. A local user could exploit this flaw to bypass file permission restrictions. (CVE-2014-8989)

A flaw was discovered in how Thread Local Storage (TLS) is handled by the task switching function in the Linux kernel for x86_64 based machines. A local user could exploit this flaw to bypass the Address Space Layout Radomization (ASLR) protection mechanism. (CVE-2014-9419)

Prasad J Pandit reported a flaw in the rock_continue function of the Linux kernel's ISO 9660 CDROM file system. A local user could exploit this flaw to cause a denial of service (system crash or hang). (CVE-2014-9420)

A flaw was discovered in the fragment handling of the B.A.T.M.A.N. Advanced Meshing Protocol in the Linux kernel. A remote attacker could exploit this flaw to cause a denial of service (mesh-node system crash) via fragmented packets. (CVE-2014-9428)

A race condition was discovered in the Linux kernel's key ring. A local user could cause a denial of service (memory corruption or panic) or possibly have unspecified impact via the keyctl commands. (CVE-2014-9529)

A memory leak was discovered in the ISO 9660 CDROM file system when parsing rock ridge ER records. A local user could exploit this flaw to obtain sensitive information from kernel memory via a crafted iso9660 image. (CVE-2014-9584)

A flaw was discovered in the Address Space Layout Randomization (ASLR) of the Virtual Dynamically linked Shared Objects (vDSO) location. This flaw makes it easier for a local user to bypass the ASLR protection mechanism. (CVE-2014-9585)

Dmitry Chernenkov discovered a buffer overflow in eCryptfs' encrypted file name decoding. A local unprivileged user could exploit this flaw to cause a denial of service (system crash) or potentially gain administrative privileges. (CVE-2014-9683)

Carl H Lunde discovered that the UDF file system (CONFIG_UDF_FS) failed to verify symlink size info. A local attacker, who is able to mount a malicous UDF file system image, could exploit this flaw to cause a denial of service (system crash) or possibly cause other undesired behaviors. (CVE-2014-9728)

Carl H Lunde discovered that the UDF file system (CONFIG_UDF_FS) did not valid inode size information . A local attacker, who is able to mount a malicous UDF file system image, could exploit this flaw to cause a denial of service (system crash) or possibly cause other undesired behaviors. (CVE-2014-9729)

Carl H Lunde discovered that the UDF file system (CONFIG_UDF_FS) did not correctly verify the component length for symlinks. A local attacker, who is able to mount a malicous UDF file system image, could exploit this flaw to cause a denial of service (system crash) or possibly cause other undesired behaviors. (CVE-2014-9730)

Carl H Lunde discovered an…

Eric Windisch discovered flaw in how the Linux kernel's XFS file system replaces remote attributes. A local access with access to an XFS file system could exploit this flaw to escalate their privileges. (CVE-2015-0274)

A flaw was discovered in the automatic loading of modules in the crypto subsystem of the Linux kernel. A local user could exploit this flaw to load installed kernel modules, increasing the attack surface and potentially using this to gain administrative privileges. (CVE-2013-7421)

The Linux kernel's splice system call did not correctly validate its parameters. A local, unprivileged user could exploit this flaw to cause a denial of service (system crash). (CVE-2014-7822)

A flaw was discovered in the crypto subsystem when screening module names for automatic module loading if the name contained a valid crypto module name, eg. vfat(aes). A local user could exploit this flaw to load installed kernel modules, increasing the attack surface and potentially using this to gain administrative privileges. (CVE-2014-9644)

Carl H Lunde discovered that the UDF file system (CONFIG_UDF_FS) failed to verify symlink size info. A local attacker, who is able to mount a malicous UDF file system image, could exploit this flaw to cause a denial of service (system crash) or possibly cause other undesired behaviors. (CVE-2014-9728)

Carl H Lunde discovered that the UDF file system (CONFIG_UDF_FS) did not valid inode size information . A local attacker, who is able to mount a malicous UDF file system image, could exploit this flaw to cause a denial of service (system crash) or possibly cause other undesired behaviors. (CVE-2014-9729)

Carl H Lunde discovered that the UDF file system (CONFIG_UDF_FS) did not correctly verify the component length for symlinks. A local attacker, who is able to mount a malicous UDF file system image, could exploit this flaw to cause a denial of service (system crash) or possibly cause other undesired behaviors. (CVE-2014-9730)

Carl H Lunde discovered an information leak in the UDF file system (CONFIG_UDF_FS). A local attacker, who is able to mount a malicous UDF file system image, could exploit this flaw to read potential sensitve kernel memory. (CVE-2014-9731)