CVE-2015-3331

The __driver_rfc4106_decrypt function in arch/x86/crypto/aesni-intel_glue.c in the Linux kernel before 3.19.3 does not properly determine the memory locations used for encrypted data, which allows context-dependent attackers to cause a denial of service (buffer overflow and system crash) or possibly execute arbitrary code by triggering a crypto API call, as demonstrated by use of a libkcapi test program with an AF_ALG(aead) socket.

This kernel update is based on upstream -longterm 3.14.39 and fixes the following security issues:

It was found that the Linux kernel's Infiniband subsystem did not properly sanitize input parameters while registering memory regions from user space via the (u)verbs API. A local user with access to a /dev/infiniband/uverbsX device could use this flaw to crash the system or, potentially, escalate their privileges on the system (CVE-2014-8159)

The stack randomization feature in the Linux kernel before 3.19.1 on 64-bit platforms uses incorrect data types for the results of bitwise left-shift operations, which makes it easier for attackers to bypass the ASLR protection mechanism by predicting the address of the top of the stack, related to the randomize_stack_top function in fs/binfmt_elf.c and the stack_maxrandom_size function in arch/x86/mm/mmap.c (CVE-2015-1593)

Xen 3.3.x through 4.5.x and the Linux kernel through 3.19.1 do not properly restrict access to PCI command registers, which might allow local guest users to cause a denial of service (non-maskable interrupt and host crash) by disabling the (1) memory or (2) I/O decoding for a PCI Express device and then accessing the device, which triggers an Unsupported Request (UR) response (CVE-2015-2150)

Sasha Levin discovered that the LLC subsystem exposed some variables as sysctls with the wrong type. On a 64-bit kernel, this possibly allows privilege escalation from a process with CAP_NET_ADMIN capability; it also results in a trivial information leak (CVE-2015-2041).

Sasha Levin discovered that the RDS subsystem exposed some variables as sysctls with the wrong type. On a 64-bit kernel, this results in a trivial information leak (CVE-2015-2042).

Andrew Lutomirski discovered that when a 64-bit task on an amd64 kernel makes a fork(2) or clone(2) system call using int $0x80, the 32-bit compatibility flag is set (correctly) but is not cleared on return. As a result, both seccomp and audit will misinterpret the following system call by the task(s), possibly leading to a violation of security policy (CVE-2015-2830).

Stephan Mueller discovered that the optimised implementation of RFC4106 GCM for x86 processors that support AESNI miscalculated buffer addresses in some cases. If an IPsec tunnel is configured to use this mode (also known as AES-GCM-ESP) this can lead to memory corruption and crashes (even without malicious traffic). This could potentially also result in remote code execution (CVE-2015-3331).

Ben Hutchings discovered that the TCP Fast Open feature regressed in Linux 3.16.7-ckt9, resulting in a kernel BUG when it is used. This can be used as a local denial of service (CVE-2015-3332)

For other fixes in this update, see the referenced changelogs.

This kernel-linus update is based on upstream -longterm 3.14.39 and fixes the following security issues:

It was found that the Linux kernel's Infiniband subsystem did not properly sanitize input parameters while registering memory regions from user space via the (u)verbs API. A local user with access to a /dev/infiniband/uverbsX device could use this flaw to crash the system or, potentially, escalate their privileges on the system (CVE-2014-8159)

The stack randomization feature in the Linux kernel before 3.19.1 on 64-bit platforms uses incorrect data types for the results of bitwise left-shift operations, which makes it easier for attackers to bypass the ASLR protection mechanism by predicting the address of the top of the stack, related to the randomize_stack_top function in fs/binfmt_elf.c and the stack_maxrandom_size function in arch/x86/mm/mmap.c (CVE-2015-1593)

Xen 3.3.x through 4.5.x and the Linux kernel through 3.19.1 do not properly restrict access to PCI command registers, which might allow local guest users to cause a denial of service (non-maskable interrupt and host crash) by disabling the (1) memory or (2) I/O decoding for a PCI Express device and then accessing the device, which triggers an Unsupported Request (UR) response (CVE-2015-2150)

Sasha Levin discovered that the LLC subsystem exposed some variables as sysctls with the wrong type. On a 64-bit kernel, this possibly allows privilege escalation from a process with CAP_NET_ADMIN capability; it also results in a trivial information leak (CVE-2015-2041).

Sasha Levin discovered that the RDS subsystem exposed some variables as sysctls with the wrong type. On a 64-bit kernel, this results in a trivial information leak (CVE-2015-2042).

Andrew Lutomirski discovered that when a 64-bit task on an amd64 kernel makes a fork(2) or clone(2) system call using int $0x80, the 32-bit compatibility flag is set (correctly) but is not cleared on return. As a result, both seccomp and audit will misinterpret the following system call by the task(s), possibly leading to a violation of security policy (CVE-2015-2830).

Stephan Mueller discovered that the optimised implementation of RFC4106 GCM for x86 processors that support AESNI miscalculated buffer addresses in some cases. If an IPsec tunnel is configured to use this mode (also known as AES-GCM-ESP) this can lead to memory corruption and crashes (even without malicious traffic). This could potentially also result in remote code execution (CVE-2015-3331).

Ben Hutchings discovered that the TCP Fast Open feature regressed in Linux 3.16.7-ckt9, resulting in a kernel BUG when it is used. This can be used as a local denial of service (CVE-2015-3332)

For other fixes in this update, see the referenced changelogs.

This kernel-tmb update is based on upstream -longterm 3.14.41 and fixes the following security issues:

It was found that the Linux kernel's Infiniband subsystem did not properly sanitize input parameters while registering memory regions from user space via the (u)verbs API. A local user with access to a /dev/infiniband/uverbsX device could use this flaw to crash the system or, potentially, escalate their privileges on the system (CVE-2014-8159)

net/netfilter/nf_conntrack_proto_generic.c in the Linux kernel before 3.18 generates incorrect conntrack entries during handling of certain iptables rule sets for the SCTP, DCCP, GRE, and UDP-Lite protocols, which allows remote attackers to bypass intended access restrictions via packets with disallowed port numbers (CVE-2014-8160).

The em_sysenter function in arch/x86/kvm/emulate.c in the Linux kernel before 3.18.5, when the guest OS lacks SYSENTER MSR initialization, allows guest OS users to gain guest OS privileges or cause a denial of service (guest OS crash) by triggering use of a 16-bit code segment for emulation of a SYSENTER instruction (CVE-2015-0239).

The stack randomization feature in the Linux kernel before 3.19.1 on 64-bit platforms uses incorrect data types for the results of bitwise left-shift operations, which makes it easier for attackers to bypass the ASLR protection mechanism by predicting the address of the top of the stack, related to the randomize_stack_top function in fs/binfmt_elf.c and the stack_maxrandom_size function in arch/x86/mm/mmap.c (CVE-2015-1593)

Xen 3.3.x through 4.5.x and the Linux kernel through 3.19.1 do not properly restrict access to PCI command registers, which might allow local guest users to cause a denial of service (non-maskable interrupt and host crash) by disabling the (1) memory or (2) I/O decoding for a PCI Express device and then accessing the device, which triggers an Unsupported Request (UR) response (CVE-2015-2150)

Sasha Levin discovered that the LLC subsystem exposed some variables as sysctls with the wrong type. On a 64-bit kernel, this possibly allows privilege escalation from a process with CAP_NET_ADMIN capability; it also results in a trivial information leak (CVE-2015-2041).

Sasha Levin discovered that the RDS subsystem exposed some variables as sysctls with the wrong type. On a 64-bit kernel, this results in a trivial information leak (CVE-2015-2042).

Andrew Lutomirski discovered that when a 64-bit task on an amd64 kernel makes a fork(2) or clone(2) system call using int $0x80, the 32-bit compatibility flag is set (correctly) but is not cleared on return. As a result, both seccomp and audit will misinterpret the following system call by the task(s), possibly leading to a violation of security policy (CVE-2015-2830).

Stephan Mueller discovered that the optimised implementation of RFC4106 GCM for x86 processors that support AESNI miscalculated buffer addresses in some cases. If an IPsec tunnel is configured to use this mode (also known as AES-GCM-ESP) this can lead to memory corruption and crashes (even without malicious traffic). This could potentially also result in remote code execution (CVE-2015-3331).

Ben Hutchings discovered that the TCP Fast Open feature regressed in Linux 3.16.7-ckt9, resulting in a kernel BUG when it is used. This can be used as a local denial of service (CVE-2015-3332)

It was found that the Linux kernel's ping socket implementation didn't properly handle socket unhashing during spurious disconnects which could lead to use-after-free flaw. On x86-64 architecture systems, a local user able to create ping sockets could use this flaw to crash the system. On non-x86-64 architecture systems, a local user able to create ping sockets could use this flaw to increase their privileges on the system. Note: By default ping sockets are disabled on the system (net.ipv4.ping_group_range = 1 0) and have to be explicitly enabled by the system administrator for specific user groups in order to exploit…

The SUSE Linux Enterprise 11 Service Pack 3 kernel has been updated to fix various bugs and security issues.

The following security bugs have been fixed:

* 

  CVE-2014-1739: The media_device_enum_entities function in
  drivers/media/media-device.c in the Linux kernel before 3.14.6 does
  not initialize a certain data structure, which allows local users to
  obtain sensitive information from kernel memory by leveraging
  /dev/media0 read access for a MEDIA_IOC_ENUM_ENTITIES ioctl call
  (bnc#882804).

* 

  CVE-2014-4171: mm/shmem.c in the Linux kernel through 3.15.1 does not
  properly implement the interaction between range notification and
  hole punching, which allows local users to cause a denial of service
  (i_mutex hold) by using the mmap system call to access a hole, as
  demonstrated by interfering with intended shmem activity by blocking
  completion of (1) an MADV_REMOVE madvise call or (2) an
  FALLOC_FL_PUNCH_HOLE fallocate call (bnc#883518).

* 

  CVE-2014-4508: arch/x86/kernel/entry_32.S in the Linux kernel through
  3.15.1 on 32-bit x86 platforms, when syscall auditing is enabled and
  the sep CPU feature flag is set, allows local users to cause a denial
  of service (OOPS and system crash) via an invalid syscall number, as
  demonstrated by number 1000 (bnc#883724).

* 

  CVE-2014-4667: The sctp_association_free function in
  net/sctp/associola.c in the Linux kernel before 3.15.2 does not
  properly manage a certain backlog value, which allows remote
  attackers to cause a denial of service (socket outage) via a crafted
  SCTP packet (bnc#885422).

* 

  CVE-2014-4943: The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the
  Linux kernel through 3.15.6 allows local users to gain privileges by
  leveraging data-structure differences between an l2tp socket and an
  inet socket (bnc#887082).

* 

  CVE-2014-5077: The sctp_assoc_update function in net/sctp/associola.c
  in the Linux kernel through 3.15.8, when SCTP authentication is
  enabled, allows remote attackers to cause a denial of service (NULL
  pointer dereference and OOPS) by starting to establish an association
  between two endpoints immediately after an exchange of INIT and INIT
  ACK chunks to establish an earlier association between these
  endpoints in the opposite direction (bnc#889173).

* 

  CVE-2014-5471: Stack consumption vulnerability in the
  parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the
  Linux kernel through 3.16.1 allows local users to cause a denial of
  service (uncontrolled recursion, and system crash or reboot) via a
  crafted iso9660 image with a CL entry referring to a directory entry
  that has a CL entry. (bnc#892490)

* 

  CVE-2014-5472: The parse_rock_ridge_inode_internal function in
  fs/isofs/rock.c in the Linux kernel through 3.16.1 allows local users
  to cause a denial of service (unkillable mount process) via a crafted
  iso9660 image with a self-referential CL entry. (bnc#892490)

* 

  CVE-2014-2706: Race condition in the mac80211 subsystem in the Linux
  kernel before 3.13.7 allows remote attackers to cause a denial of
  service (system crash) via network traffic that improperly interacts
  with the WLAN_STA_PS_STA state (aka power-save mode), related to
  sta_info.c and tx.c. (bnc#871797)

* 

  CVE-2014-4027: The rd_build_device_space function in
  drivers/target/target_core_rd.c in the Linux kernel before 3.14 does
  not properly initialize a certain data structure, which allows local
  users to obtain sensitive information from ramdisk_mcp memory by
  leveraging access to a SCSI initiator. (bnc#882639)

* 

  CVE-2014-3153 The futex_requeue function in kernel/futex.c in the
  Linux kernel through 3.14.5 does not ensure that…

The SUSE Linux Enterprise 11 Service Pack 3 kernel has been updated to fix various bugs and security issues.

The following security bugs have been fixed:

* 

  CVE-2014-1739: The media_device_enum_entities function in
  drivers/media/media-device.c in the Linux kernel before 3.14.6 does
  not initialize a certain data structure, which allows local users to
  obtain sensitive information from kernel memory by leveraging
  /dev/media0 read access for a MEDIA_IOC_ENUM_ENTITIES ioctl call
  (bnc#882804).

* 

  CVE-2014-4171: mm/shmem.c in the Linux kernel through 3.15.1 does not
  properly implement the interaction between range notification and
  hole punching, which allows local users to cause a denial of service
  (i_mutex hold) by using the mmap system call to access a hole, as
  demonstrated by interfering with intended shmem activity by blocking
  completion of (1) an MADV_REMOVE madvise call or (2) an
  FALLOC_FL_PUNCH_HOLE fallocate call (bnc#883518).

* 

  CVE-2014-4508: arch/x86/kernel/entry_32.S in the Linux kernel through
  3.15.1 on 32-bit x86 platforms, when syscall auditing is enabled and
  the sep CPU feature flag is set, allows local users to cause a denial
  of service (OOPS and system crash) via an invalid syscall number, as
  demonstrated by number 1000 (bnc#883724).

* 

  CVE-2014-4667: The sctp_association_free function in
  net/sctp/associola.c in the Linux kernel before 3.15.2 does not
  properly manage a certain backlog value, which allows remote
  attackers to cause a denial of service (socket outage) via a crafted
  SCTP packet (bnc#885422).

* 

  CVE-2014-4943: The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the
  Linux kernel through 3.15.6 allows local users to gain privileges by
  leveraging data-structure differences between an l2tp socket and an
  inet socket (bnc#887082).

* 

  CVE-2014-5077: The sctp_assoc_update function in net/sctp/associola.c
  in the Linux kernel through 3.15.8, when SCTP authentication is
  enabled, allows remote attackers to cause a denial of service (NULL
  pointer dereference and OOPS) by starting to establish an association
  between two endpoints immediately after an exchange of INIT and INIT
  ACK chunks to establish an earlier association between these
  endpoints in the opposite direction (bnc#889173).

* 

  CVE-2014-5471: Stack consumption vulnerability in the
  parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the
  Linux kernel through 3.16.1 allows local users to cause a denial of
  service (uncontrolled recursion, and system crash or reboot) via a
  crafted iso9660 image with a CL entry referring to a directory entry
  that has a CL entry. (bnc#892490)

* 

  CVE-2014-5472: The parse_rock_ridge_inode_internal function in
  fs/isofs/rock.c in the Linux kernel through 3.16.1 allows local users
  to cause a denial of service (unkillable mount process) via a crafted
  iso9660 image with a self-referential CL entry. (bnc#892490)

* 

  CVE-2014-2706: Race condition in the mac80211 subsystem in the Linux
  kernel before 3.13.7 allows remote attackers to cause a denial of
  service (system crash) via network traffic that improperly interacts
  with the WLAN_STA_PS_STA state (aka power-save mode), related to
  sta_info.c and tx.c. (bnc#871797)

* 

  CVE-2014-4027: The rd_build_device_space function in
  drivers/target/target_core_rd.c in the Linux kernel before 3.14 does
  not properly initialize a certain data structure, which allows local
  users to obtain sensitive information from ramdisk_mcp memory by
  leveraging access to a SCSI initiator. (bnc#882639)

* 

  CVE-2014-3153 The futex_requeue function in kernel/futex.c in the
  Linux kernel through 3.14.5 does not ensure that…

The SUSE Linux Enterprise 11 Service Pack 3 kernel has been updated to fix various bugs and security issues.

The following security bugs have been fixed:

* 

  CVE-2014-1739: The media_device_enum_entities function in
  drivers/media/media-device.c in the Linux kernel before 3.14.6 does
  not initialize a certain data structure, which allows local users to
  obtain sensitive information from kernel memory by leveraging
  /dev/media0 read access for a MEDIA_IOC_ENUM_ENTITIES ioctl call
  (bnc#882804).

* 

  CVE-2014-4171: mm/shmem.c in the Linux kernel through 3.15.1 does not
  properly implement the interaction between range notification and
  hole punching, which allows local users to cause a denial of service
  (i_mutex hold) by using the mmap system call to access a hole, as
  demonstrated by interfering with intended shmem activity by blocking
  completion of (1) an MADV_REMOVE madvise call or (2) an
  FALLOC_FL_PUNCH_HOLE fallocate call (bnc#883518).

* 

  CVE-2014-4508: arch/x86/kernel/entry_32.S in the Linux kernel through
  3.15.1 on 32-bit x86 platforms, when syscall auditing is enabled and
  the sep CPU feature flag is set, allows local users to cause a denial
  of service (OOPS and system crash) via an invalid syscall number, as
  demonstrated by number 1000 (bnc#883724).

* 

  CVE-2014-4667: The sctp_association_free function in
  net/sctp/associola.c in the Linux kernel before 3.15.2 does not
  properly manage a certain backlog value, which allows remote
  attackers to cause a denial of service (socket outage) via a crafted
  SCTP packet (bnc#885422).

* 

  CVE-2014-4943: The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the
  Linux kernel through 3.15.6 allows local users to gain privileges by
  leveraging data-structure differences between an l2tp socket and an
  inet socket (bnc#887082).

* 

  CVE-2014-5077: The sctp_assoc_update function in net/sctp/associola.c
  in the Linux kernel through 3.15.8, when SCTP authentication is
  enabled, allows remote attackers to cause a denial of service (NULL
  pointer dereference and OOPS) by starting to establish an association
  between two endpoints immediately after an exchange of INIT and INIT
  ACK chunks to establish an earlier association between these
  endpoints in the opposite direction (bnc#889173).

* 

  CVE-2014-5471: Stack consumption vulnerability in the
  parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the
  Linux kernel through 3.16.1 allows local users to cause a denial of
  service (uncontrolled recursion, and system crash or reboot) via a
  crafted iso9660 image with a CL entry referring to a directory entry
  that has a CL entry. (bnc#892490)

* 

  CVE-2014-5472: The parse_rock_ridge_inode_internal function in
  fs/isofs/rock.c in the Linux kernel through 3.16.1 allows local users
  to cause a denial of service (unkillable mount process) via a crafted
  iso9660 image with a self-referential CL entry. (bnc#892490)

* 

  CVE-2014-2706: Race condition in the mac80211 subsystem in the Linux
  kernel before 3.13.7 allows remote attackers to cause a denial of
  service (system crash) via network traffic that improperly interacts
  with the WLAN_STA_PS_STA state (aka power-save mode), related to
  sta_info.c and tx.c. (bnc#871797)

* 

  CVE-2014-4027: The rd_build_device_space function in
  drivers/target/target_core_rd.c in the Linux kernel before 3.14 does
  not properly initialize a certain data structure, which allows local
  users to obtain sensitive information from ramdisk_mcp memory by
  leveraging access to a SCSI initiator. (bnc#882639)

* 

  CVE-2014-3153 The futex_requeue function in kernel/futex.c in the
  Linux kernel through 3.14.5 does not ensure that…

The SUSE Linux Enterprise 12 kernel was updated to version 3.12.43 to receive various security and bugfixes.

Following security bugs were fixed:

• CVE-2014-3647: arch/x86/kvm/emulate.c in the KVM subsystem in the Linux kernel through 3.17.2 did not properly perform RIP changes, which allowed guest OS users to cause a denial of service (guest OS crash) via a crafted application (bsc#899192).
• CVE-2014-8086: Race condition in the ext4_file_write_iter function in fs/ext4/file.c in the Linux kernel through 3.17 allowed local users to cause a denial of service (file unavailability) via a combination of a write action and an F_SETFL fcntl operation for the O_DIRECT flag (bsc#900881).
• CVE-2014-8159: The InfiniBand (IB) implementation did not properly restrict use of User Verbs for registration of memory regions, which allowed local users to access arbitrary physical memory locations, and consequently cause a denial of service (system crash) or gain privileges, by leveraging permissions on a uverbs device under /dev/infiniband/ (bsc#914742).
• CVE-2015-1465: The IPv4 implementation in the Linux kernel before 3.18.8 did not properly consider the length of the Read-Copy Update (RCU) grace period for redirecting lookups in the absence of caching, which allowed remote attackers to cause a denial of service (memory consumption or system crash) via a flood of packets (bsc#916225).
• CVE-2015-2041: net/llc/sysctl_net_llc.c in the Linux kernel before 3.19 used an incorrect data type in a sysctl table, which allowed local users to obtain potentially sensitive information from kernel memory or possibly have unspecified other impact by accessing a sysctl entry (bsc#919007).
• CVE-2015-2042: net/rds/sysctl.c in the Linux kernel before 3.19 used an incorrect data type in a sysctl table, which allowed local users to obtain potentially sensitive information from kernel memory or possibly have unspecified other impact by accessing a sysctl entry (bsc#919018).
• CVE-2015-2666: Fixed a flaw that allowed crafted microcode to overflow the kernel stack (bsc#922944).
• CVE-2015-2830: Fixed int80 fork from 64-bit tasks mishandling (bsc#926240).
• CVE-2015-2922: Fixed possible denial of service (DoS) attack against IPv6 network stacks due to improper handling of Router Advertisements (bsc#922583).
• CVE-2015-3331: Fixed buffer overruns in RFC4106 implementation using AESNI (bsc#927257).
• CVE-2015-3332: Fixed TCP Fast Open local DoS (bsc#928135).
• CVE-2015-3339: Fixed race condition flaw between the chown() and execve() system calls which could have lead to local privilege escalation (bsc#928130).
• CVE-2015-3636: Fixed use-after-free in ping sockets which could have lead to local privilege escalation (bsc#929525).

The following non-security bugs were fixed:

• /proc/stat: convert to single_open_size() (bsc#928122).
• ACPI / sysfs: Treat the count field of counter_show() as unsigned (bsc#909312).
• Automatically Provide/Obsolete all subpackages of old flavors (bsc#925567)
• Btrfs: btrfs_release_extent_buffer_page did not free pages of dummy extent (bsc#930226).
• Btrfs: fix inode eviction infinite loop after cloning into it (bsc#930224).
• Btrfs: fix inode eviction infinite loop after extent_same ioctl (bsc#930224).
• Btrfs: fix log tree corruption when fs mounted with -o discard (bsc#927116).
• Btrfs: fix up bounds checking in lseek (bsc#927115).
• Fix rtworkqueues crash. Calling __sched_setscheduler() in interrupt context is forbidden, and destroy_worker() did so in the timer interrupt with a nohz_full config. Preclude that possibility for both boot options.
• Input: psmouse - add psmouse_matches_pnp_id helper function (bsc#929092).
• Input: synaptics - fix middle button on Lenovo 2015 products (bsc#929092).
• Input: synaptics - handle spurious release of trackstick buttons (bsc#929092).
• Input: synaptics - re-route tracksticks buttons on the Lenovo 2015 series (bsc#929092).
• Input: synaptics - remove TOPBUTTONPAD property for Lenovos 2015…

The SUSE Linux Enterprise 11 Service Pack 3 kernel has been updated to fix various bugs and security issues.

The following security bugs have been fixed:

* 

  CVE-2014-1739: The media_device_enum_entities function in
  drivers/media/media-device.c in the Linux kernel before 3.14.6 does
  not initialize a certain data structure, which allows local users to
  obtain sensitive information from kernel memory by leveraging
  /dev/media0 read access for a MEDIA_IOC_ENUM_ENTITIES ioctl call
  (bnc#882804).

* 

  CVE-2014-4171: mm/shmem.c in the Linux kernel through 3.15.1 does not
  properly implement the interaction between range notification and
  hole punching, which allows local users to cause a denial of service
  (i_mutex hold) by using the mmap system call to access a hole, as
  demonstrated by interfering with intended shmem activity by blocking
  completion of (1) an MADV_REMOVE madvise call or (2) an
  FALLOC_FL_PUNCH_HOLE fallocate call (bnc#883518).

* 

  CVE-2014-4508: arch/x86/kernel/entry_32.S in the Linux kernel through
  3.15.1 on 32-bit x86 platforms, when syscall auditing is enabled and
  the sep CPU feature flag is set, allows local users to cause a denial
  of service (OOPS and system crash) via an invalid syscall number, as
  demonstrated by number 1000 (bnc#883724).

* 

  CVE-2014-4667: The sctp_association_free function in
  net/sctp/associola.c in the Linux kernel before 3.15.2 does not
  properly manage a certain backlog value, which allows remote
  attackers to cause a denial of service (socket outage) via a crafted
  SCTP packet (bnc#885422).

* 

  CVE-2014-4943: The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the
  Linux kernel through 3.15.6 allows local users to gain privileges by
  leveraging data-structure differences between an l2tp socket and an
  inet socket (bnc#887082).

* 

  CVE-2014-5077: The sctp_assoc_update function in net/sctp/associola.c
  in the Linux kernel through 3.15.8, when SCTP authentication is
  enabled, allows remote attackers to cause a denial of service (NULL
  pointer dereference and OOPS) by starting to establish an association
  between two endpoints immediately after an exchange of INIT and INIT
  ACK chunks to establish an earlier association between these
  endpoints in the opposite direction (bnc#889173).

* 

  CVE-2014-5471: Stack consumption vulnerability in the
  parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the
  Linux kernel through 3.16.1 allows local users to cause a denial of
  service (uncontrolled recursion, and system crash or reboot) via a
  crafted iso9660 image with a CL entry referring to a directory entry
  that has a CL entry. (bnc#892490)

* 

  CVE-2014-5472: The parse_rock_ridge_inode_internal function in
  fs/isofs/rock.c in the Linux kernel through 3.16.1 allows local users
  to cause a denial of service (unkillable mount process) via a crafted
  iso9660 image with a self-referential CL entry. (bnc#892490)

* 

  CVE-2014-2706: Race condition in the mac80211 subsystem in the Linux
  kernel before 3.13.7 allows remote attackers to cause a denial of
  service (system crash) via network traffic that improperly interacts
  with the WLAN_STA_PS_STA state (aka power-save mode), related to
  sta_info.c and tx.c. (bnc#871797)

* 

  CVE-2014-4027: The rd_build_device_space function in
  drivers/target/target_core_rd.c in the Linux kernel before 3.14 does
  not properly initialize a certain data structure, which allows local
  users to obtain sensitive information from ramdisk_mcp memory by
  leveraging access to a SCSI initiator. (bnc#882639)

* 

  CVE-2014-3153 The futex_requeue function in kernel/futex.c in the
  Linux kernel through 3.14.5 does not ensure that…

The SUSE Linux Enterprise 11 Service Pack 3 kernel has been updated to fix various bugs and security issues.

The following security bugs have been fixed:

* 

  CVE-2014-1739: The media_device_enum_entities function in
  drivers/media/media-device.c in the Linux kernel before 3.14.6 does
  not initialize a certain data structure, which allows local users to
  obtain sensitive information from kernel memory by leveraging
  /dev/media0 read access for a MEDIA_IOC_ENUM_ENTITIES ioctl call
  (bnc#882804).

* 

  CVE-2014-4171: mm/shmem.c in the Linux kernel through 3.15.1 does not
  properly implement the interaction between range notification and
  hole punching, which allows local users to cause a denial of service
  (i_mutex hold) by using the mmap system call to access a hole, as
  demonstrated by interfering with intended shmem activity by blocking
  completion of (1) an MADV_REMOVE madvise call or (2) an
  FALLOC_FL_PUNCH_HOLE fallocate call (bnc#883518).

* 

  CVE-2014-4508: arch/x86/kernel/entry_32.S in the Linux kernel through
  3.15.1 on 32-bit x86 platforms, when syscall auditing is enabled and
  the sep CPU feature flag is set, allows local users to cause a denial
  of service (OOPS and system crash) via an invalid syscall number, as
  demonstrated by number 1000 (bnc#883724).

* 

  CVE-2014-4667: The sctp_association_free function in
  net/sctp/associola.c in the Linux kernel before 3.15.2 does not
  properly manage a certain backlog value, which allows remote
  attackers to cause a denial of service (socket outage) via a crafted
  SCTP packet (bnc#885422).

* 

  CVE-2014-4943: The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the
  Linux kernel through 3.15.6 allows local users to gain privileges by
  leveraging data-structure differences between an l2tp socket and an
  inet socket (bnc#887082).

* 

  CVE-2014-5077: The sctp_assoc_update function in net/sctp/associola.c
  in the Linux kernel through 3.15.8, when SCTP authentication is
  enabled, allows remote attackers to cause a denial of service (NULL
  pointer dereference and OOPS) by starting to establish an association
  between two endpoints immediately after an exchange of INIT and INIT
  ACK chunks to establish an earlier association between these
  endpoints in the opposite direction (bnc#889173).

* 

  CVE-2014-5471: Stack consumption vulnerability in the
  parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the
  Linux kernel through 3.16.1 allows local users to cause a denial of
  service (uncontrolled recursion, and system crash or reboot) via a
  crafted iso9660 image with a CL entry referring to a directory entry
  that has a CL entry. (bnc#892490)

* 

  CVE-2014-5472: The parse_rock_ridge_inode_internal function in
  fs/isofs/rock.c in the Linux kernel through 3.16.1 allows local users
  to cause a denial of service (unkillable mount process) via a crafted
  iso9660 image with a self-referential CL entry. (bnc#892490)

* 

  CVE-2014-2706: Race condition in the mac80211 subsystem in the Linux
  kernel before 3.13.7 allows remote attackers to cause a denial of
  service (system crash) via network traffic that improperly interacts
  with the WLAN_STA_PS_STA state (aka power-save mode), related to
  sta_info.c and tx.c. (bnc#871797)

* 

  CVE-2014-4027: The rd_build_device_space function in
  drivers/target/target_core_rd.c in the Linux kernel before 3.14 does
  not properly initialize a certain data structure, which allows local
  users to obtain sensitive information from ramdisk_mcp memory by
  leveraging access to a SCSI initiator. (bnc#882639)

* 

  CVE-2014-3153 The futex_requeue function in kernel/futex.c in the
  Linux kernel through 3.14.5 does not ensure that…

The SUSE Linux Enterprise Server 11 SP2 LTSS kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2015-5707: An integer overflow in the SCSI generic driver could be potentially used by local attackers to crash the kernel or execute code.
• CVE-2015-2830: arch/x86/kernel/entry_64.S in the Linux kernel did not prevent the TS_COMPAT flag from reaching a user-mode task, which might have allowed local users to bypass the seccomp or audit protection mechanism via a crafted application that uses the (1) fork or (2) close system call, as demonstrated by an attack against seccomp before 3.16 (bnc#926240).
• CVE-2015-0777: drivers/xen/usbback/usbback.c in the Linux kernel allowed guest OS users to obtain sensitive information from uninitialized locations in host OS kernel memory via unspecified vectors (bnc#917830).
• CVE-2015-2150: Xen and the Linux kernel did not properly restrict access to PCI command registers, which might have allowed local guest users to cause a denial of service (non-maskable interrupt and host crash) by disabling the (1) memory or (2) I/O decoding for a PCI Express device and then accessing the device, which triggers an Unsupported Request (UR) response (bnc#919463).
• CVE-2015-5364: A remote denial of service (hang) via UDP flood with incorrect package checksums was fixed. (bsc#936831).
• CVE-2015-5366: A remote denial of service (unexpected error returns) via UDP flood with incorrect package checksums was fixed. (bsc#936831).
• CVE-2015-1420: CVE-2015-1420: Race condition in the handle_to_path function in fs/fhandle.c in the Linux kernel allowed local users to bypass intended size restrictions and trigger read operations on additional memory locations by changing the handle_bytes value of a file handle during the execution of this function (bnc#915517).
• CVE-2015-4700: A local user could have created a bad instruction in the JIT processed BPF code, leading to a kernel crash (bnc#935705).
• CVE-2015-1805: The (1) pipe_read and (2) pipe_write implementations in fs/pipe.c in the Linux kernel did not properly consider the side effects of failed __copy_to_user_inatomic and __copy_from_user_inatomic calls, which allowed local users to cause a denial of service (system crash) or possibly gain privileges via a crafted application, aka an 'I/O vector array overrun' (bnc#933429).
• CVE-2015-3331: The __driver_rfc4106_decrypt function in arch/x86/crypto/aesni-intel_glue.c in the Linux kernel did not properly determine the memory locations used for encrypted data, which allowed context-dependent attackers to cause a denial of service (buffer overflow and system crash) or possibly execute arbitrary code by triggering a crypto API call, as demonstrated by use of a libkcapi test program with an AF_ALG(aead) socket (bnc#927257).
• CVE-2015-2922: The ndisc_router_discovery function in net/ipv6/ndisc.c in the Neighbor Discovery (ND) protocol implementation in the IPv6 stack in the Linux kernel allowed remote attackers to reconfigure a hop-limit setting via a small hop_limit value in a Router Advertisement (RA) message (bnc#922583).
• CVE-2015-2041: net/llc/sysctl_net_llc.c in the Linux kernel used an incorrect data type in a sysctl table, which allowed local users to obtain potentially sensitive information from kernel memory or possibly have unspecified other impact by accessing a sysctl entry (bnc#919007).
• CVE-2015-3636: The ping_unhash function in net/ipv4/ping.c in the Linux kernel did not initialize a certain list data structure during an unhash operation, which allowed local users to gain privileges or cause a denial of service (use-after-free and system crash) by leveraging the ability to make a SOCK_DGRAM socket system call for the IPPROTO_ICMP or IPPROTO_ICMPV6 protocol, and then making a connect system call after a disconnect (bnc#929525).
• CVE-2014-8086: Race condition…

This update contains a kernel live patch for the 3.12.38-44 SUSE Linux Enterprise Server 12 Kernel, fixing following security issues.

• CVE-2015-3339: A race condition in the prepare_binprm function in fs/exec.c in the Linux kernel allowed local users to gain privileges by executing a setuid program at a time instant when a chown to root is in progress, and the ownership is changed but the setuid bit is not yet stripped. (bsc#939263 bsc#939044)

• CVE-2015-3636: The ping_unhash function in net/ipv4/ping.c in the Linux kernel did not initialize a certain list data structure during an unhash operation, which allowed local users to gain privileges or cause a denial of service (use-after-free and system crash) by leveraging the ability to make a SOCK_DGRAM socket system call for the IPPROTO_ICMP or IPPROTO_ICMPV6 protocol, and then making a connect system call after a disconnect. (bsc#939277)

• CVE-2015-5364/CVE-2015-5366: Two denial of service attacks via a flood of UDP packets with invalid checksums were fixed that could be used by remote attackers to delay execution. (bsc#939276)

• CVE-2015-1805: The (1) pipe_read and (2) pipe_write implementations in fs/pipe.c in the Linux kernel did not properly consider the side effects of failed __copy_to_user_inatomic and __copy_from_user_inatomic calls, which allowed local users to cause a denial of service (system crash) or possibly gain privileges via a crafted application, aka an 'I/O vector array overrun.' (bsc#939270)

• CVE-2015-4700: A BPF Jit optimization flaw could allow local users to panic the kernel. (bsc#939273)

• CVE-2015-3331: The __driver_rfc4106_decrypt function in arch/x86/crypto/aesni-intel_glue.c in the Linux kernel did not properly determine the memory locations used for encrypted data, which allowed context-dependent attackers to cause a denial of service (buffer overflow and system crash) or possibly execute arbitrary code by triggering a crypto API call, as demonstrated by use of a libkcapi test program with an AF_ALG(aead) socket. (bsc#939262)

• CVE-2014-8159: The InfiniBand (IB) implementation in the Linux kernel did not properly restrict use of User Verbs for registration of memory regions, which allowed local users to access arbitrary physical memory locations, and consequently cause a denial of service (system crash) or gain privileges, by leveraging permissions on a uverbs device under /dev/infiniband/. (bsc#939241)

This update contains a kernel live patch for the 3.12.36-38 SUSE Linux Enterprise Server 12 Kernel, fixing following security issues.

• CVE-2015-3339: A race condition in the prepare_binprm function in fs/exec.c in the Linux kernel allowed local users to gain privileges by executing a setuid program at a time instant when a chown to root is in progress, and the ownership is changed but the setuid bit is not yet stripped. (bsc#939263 bsc#939044)

• CVE-2015-1465: The IPv4 implementation in the Linux kernel did not properly consider the length of the Read-Copy Update (RCU) grace period for redirecting lookups in the absence of caching, which allowed remote attackers to cause a denial of service (memory consumption or system crash) via a flood of packets. (bsc#939044 bsc#916225)

• CVE-2015-3636: The ping_unhash function in net/ipv4/ping.c in the Linux kernel did not initialize a certain list data structure during an unhash operation, which allowed local users to gain privileges or cause a denial of service (use-after-free and system crash) by leveraging the ability to make a SOCK_DGRAM socket system call for the IPPROTO_ICMP or IPPROTO_ICMPV6 protocol, and then making a connect system call after a disconnect. (bsc#939277)

• CVE-2015-5364/CVE-2015-5366: Two denial of service attacks via a flood of UDP packets with invalid checksums were fixed that could be used by remote attackers to delay execution. (bsc#939276)

• CVE-2015-1805: The (1) pipe_read and (2) pipe_write implementations in fs/pipe.c in the Linux kernel did not properly consider the side effects of failed __copy_to_user_inatomic and __copy_from_user_inatomic calls, which allowed local users to cause a denial of service (system crash) or possibly gain privileges via a crafted application, aka an 'I/O vector array overrun.' (bsc#939270)

• CVE-2015-4700: A BPF Jit optimization flaw could allow local users to panic the kernel. (bsc#939273)

• CVE-2015-3331: The __driver_rfc4106_decrypt function in arch/x86/crypto/aesni-intel_glue.c in the Linux kernel did not properly determine the memory locations used for encrypted data, which allowed context-dependent attackers to cause a denial of service (buffer overflow and system crash) or possibly execute arbitrary code by triggering a crypto API call, as demonstrated by use of a libkcapi test program with an AF_ALG(aead) socket. (bsc#939262)

• CVE-2014-8159: The InfiniBand (IB) implementation in the Linux kernel did not properly restrict use of User Verbs for registration of memory regions, which allowed local users to access arbitrary physical memory locations, and consequently cause a denial of service (system crash) or gain privileges, by leveraging permissions on a uverbs device under /dev/infiniband/. (bsc#939241)

• CVE-2014-7822: The implementation of certain splice_write file operations in the Linux kernel before 3.16 does not enforce a restriction on the maximum size of a single file, which allows local users to cause a denial of service (system crash) or possibly have unspecified other impact via a crafted splice system call, as demonstrated by use of a file descriptor associated with an ext4 filesystem. (bsc#939240)

This update contains a kernel live patch for the 3.12.32-33 SUSE Linux Enterprise Server 12 Kernel, fixing following security issues.

• CVE-2015-3339: A race condition in the prepare_binprm function in fs/exec.c in the Linux kernel allowed local users to gain privileges by executing a setuid program at a time instant when a chown to root is in progress, and the ownership is changed but the setuid bit is not yet stripped. (bsc#939263 bsc#939044)

• CVE-2015-1465: The IPv4 implementation in the Linux kernel did not properly consider the length of the Read-Copy Update (RCU) grace period for redirecting lookups in the absence of caching, which allowed remote attackers to cause a denial of service (memory consumption or system crash) via a flood of packets. (bsc#939044 bsc#916225)

• CVE-2015-3636: The ping_unhash function in net/ipv4/ping.c in the Linux kernel did not initialize a certain list data structure during an unhash operation, which allowed local users to gain privileges or cause a denial of service (use-after-free and system crash) by leveraging the ability to make a SOCK_DGRAM socket system call for the IPPROTO_ICMP or IPPROTO_ICMPV6 protocol, and then making a connect system call after a disconnect. (bsc#939277)

• CVE-2015-5364/CVE-2015-5366: Two denial of service attacks via a flood of UDP packets with invalid checksums were fixed that could be used by remote attackers to delay execution. (bsc#939276)

• CVE-2015-1805: The (1) pipe_read and (2) pipe_write implementations in fs/pipe.c in the Linux kernel did not properly consider the side effects of failed __copy_to_user_inatomic and __copy_from_user_inatomic calls, which allowed local users to cause a denial of service (system crash) or possibly gain privileges via a crafted application, aka an 'I/O vector array overrun.' (bsc#939270)

• CVE-2015-4700: A BPF Jit optimization flaw could allow local users to panic the kernel. (bsc#939273)

• CVE-2014-9710: The Btrfs implementation in the Linux kernel did not ensure that the visible xattr state is consistent with a requested replacement, which allowed local users to bypass intended ACL settings and gain privileges via standard filesystem operations (1) during an xattr-replacement time window, related to a race condition, or (2) after an xattr-replacement attempt that fails because the data does not fit. (bsc#939260)

• CVE-2014-3687: The sctp_assoc_lookup_asconf_ack function in net/sctp/associola.c in the SCTP implementation in the Linux kernel allowed remote attackers to cause a denial of service (panic) via duplicate ASCONF chunks that trigger an incorrect uncork within the side-effect interpreter. (bsc#902349 bsc#939044)

• CVE-2015-3331: The __driver_rfc4106_decrypt function in arch/x86/crypto/aesni-intel_glue.c in the Linux kernel did not properly determine the memory locations used for encrypted data, which allowed context-dependent attackers to cause a denial of service (buffer overflow and system crash) or possibly execute arbitrary code by triggering a crypto API call, as demonstrated by use of a libkcapi test program with an AF_ALG(aead) socket. (bsc#939262)

• CVE-2014-8159: The InfiniBand (IB) implementation in the Linux kernel did not properly restrict use of User Verbs for registration of memory regions, which allowed local users to access arbitrary physical memory locations, and consequently cause a denial of service (system crash) or gain privileges, by leveraging permissions on a uverbs device under /dev/infiniband/. (bsc#939241)

• CVE-2014-7822: The implementation of certain splice_write file operations in the Linux kernel before 3.16 does not enforce a restriction on the maximum size of a single file, which allows local users to cause a denial of service (system crash) or possibly have unspecified other impact via a crafted splice system call, as demonstrated by use of a file descriptor associated with…

This update contains a kernel live patch for the 3.12.39-47 SUSE Linux Enterprise Server 12 Kernel, fixing following security issues.

• CVE-2015-3339: A race condition in the prepare_binprm function in fs/exec.c in the Linux kernel allowed local users to gain privileges by executing a setuid program at a time instant when a chown to root is in progress, and the ownership is changed but the setuid bit is not yet stripped. (bsc#939263 bsc#939044)

• CVE-2015-3636: The ping_unhash function in net/ipv4/ping.c in the Linux kernel did not initialize a certain list data structure during an unhash operation, which allowed local users to gain privileges or cause a denial of service (use-after-free and system crash) by leveraging the ability to make a SOCK_DGRAM socket system call for the IPPROTO_ICMP or IPPROTO_ICMPV6 protocol, and then making a connect system call after a disconnect. (bsc#939277)

• CVE-2015-5364/CVE-2015-5366: Two denial of service attacks via a flood of UDP packets with invalid checksums were fixed that could be used by remote attackers to delay execution. (bsc#939276)

• CVE-2015-1805: The (1) pipe_read and (2) pipe_write implementations in fs/pipe.c in the Linux kernel did not properly consider the side effects of failed __copy_to_user_inatomic and __copy_from_user_inatomic calls, which allowed local users to cause a denial of service (system crash) or possibly gain privileges via a crafted application, aka an 'I/O vector array overrun.' (bsc#939270)

• CVE-2015-4700: A BPF Jit optimization flaw could allow local users to panic the kernel. (bsc#939273)

• CVE-2015-3331: The __driver_rfc4106_decrypt function in arch/x86/crypto/aesni-intel_glue.c in the Linux kernel did not properly determine the memory locations used for encrypted data, which allowed context-dependent attackers to cause a denial of service (buffer overflow and system crash) or possibly execute arbitrary code by triggering a crypto API call, as demonstrated by use of a libkcapi test program with an AF_ALG(aead) socket. (bsc#939262)

• CVE-2014-8159: The InfiniBand (IB) implementation in the Linux kernel did not properly restrict use of User Verbs for registration of memory regions, which allowed local users to access arbitrary physical memory locations, and consequently cause a denial of service (system crash) or gain privileges, by leveraging permissions on a uverbs device under /dev/infiniband/. (bsc#939241)

The __driver_rfc4106_decrypt function in arch/x86/crypto/aesni-intel_glue.c in the Linux kernel before 3.19.3 does not properly determine the memory locations used for encrypted data, which allows context-dependent attackers to cause a denial of service (buffer overflow and system crash) or possibly execute arbitrary code by triggering a crypto API call, as demonstrated by use of a libkcapi test program with an AF_ALG(aead) socket.

Vincent Tondellier discovered an integer overflow in the Linux kernel's netfilter connection tracking accounting of loaded extensions. An attacker on the local area network (LAN) could potential exploit this flaw to cause a denial of service (system crash of targeted system). (CVE-2014-9715)

Jan Beulich discovered the Xen virtual machine subsystem of the Linux kernel did not properly restrict access to PCI command registers. A local guest user could exploit this flaw to cause a denial of service (host crash). (CVE-2015-2150)

A privilege escalation was discovered in the fork syscall via the int80 entry on 64 bit kernels with 32 bit emulation support. An unprivileged local attacker could exploit this flaw to increase their privileges on the system. (CVE-2015-2830)

A memory corruption issue was discovered in AES decryption when using the Intel AES-NI accelerated code path. A remote attacker could exploit this flaw to cause a denial of service (system crash) or potentially escalate privileges on Intel base machines with AEC-GCM mode IPSec security association. (CVE-2015-3331)

Alexandre Oliva reported a race condition flaw in the btrfs file system's handling of extended attributes (xattrs). A local attacker could exploit this flaw to bypass ACLs and potentially escalate privileges. (CVE-2014-9710)

A memory corruption issue was discovered in AES decryption when using the Intel AES-NI accelerated code path. A remote attacker could exploit this flaw to cause a denial of service (system crash) or potentially escalate privileges on Intel base machines with AEC-GCM mode IPSec security association. (CVE-2015-3331)

A flaw was discovered in the Linux kernel's IPv4 networking when using TCP fast open to initiate a connection. An unprivileged local user could exploit this flaw to cause a denial of service (system crash). (CVE-2015-3332)