CVE-2015-4036

Array index error in the tcm_vhost_make_tpg function in drivers/vhost/scsi.c in the Linux kernel before 4.0 might allow guest OS users to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted VHOST_SCSI_SET_ENDPOINT ioctl call. NOTE: the affected function was renamed to vhost_scsi_make_tpg before the vulnerability was announced.

Updated kernel fixes security, critical data corruption and pdata loss issues

This kernel update is based on upstream -longterm 3.14.43 and fixes a security issue, and critical data corruption and data loss issues:

drivers/vhost/scsi.c: potential memory corruption (CVE-2015-4036)

ext4 filesystem has a bug that make it possible to lose whole file system block worth of data when we hit the specific interaction with unwritten and delayed extents in status extent tree.

when using software raid 0 on SSDs along with trim/discard, any delete or modification of files can lead to random destruction on the filesystem. (this regression was introduced in upstream 3.14.41)

For other fixes in this update, see the referenced changelogs.

Updated kernel-linus fixes security, critical data corruption and pdata loss issues

This kernel-linus update is based on upstream -longterm 3.14.43 and fixes a security issue, and critical data corruption and data loss issues:

drivers/vhost/scsi.c: potential memory corruption (CVE-2015-4036)

ext4 filesystem has a bug that make it possible to lose whole file system block worth of data when we hit the specific interaction with unwritten and delayed extents in status extent tree.

when using software raid 0 on SSDs along with trim/discard, any delete or modification of files can lead to random destruction on the filesystem. (this regression was introduced in upstream 3.14.41)

For other fixes in this update, see the referenced changelogs.

Updated kernel-tmb fixes security, critical data corruption and pdata loss issues

This kernel-tmb update is based on upstream -longterm 3.14.43 and fixes a security issue, and critical data corruption and data loss issues:

drivers/vhost/scsi.c: potential memory corruption (CVE-2015-4036)

ext4 filesystem has a bug that make it possible to lose whole file system block worth of data when we hit the specific interaction with unwritten and delayed extents in status extent tree.

when using software raid 0 on SSDs along with trim/discard, any delete or modification of files can lead to random destruction on the filesystem. (this regression was introduced in upstream 3.14.41)

For other fixes in this update, see the referenced changelogs.

The SUSE Linux Enterprise 12 kernel was updated to 3.12.44 to receive various security and bugfixes.

These features were added:

• mpt2sas: Added Reply Descriptor Post Queue (RDPQ) Array support (bsc#854824).
• mpt3sas: Bump mpt3sas driver version to 04.100.00.00 (bsc#854817).

Following security bugs were fixed:

• CVE-2015-1805: iov overrun for failed atomic copy could have lead to DoS or privilege escalation (bsc#933429).
• CVE-2015-3212: A race condition in the way the Linux kernel handled lists of associations in SCTP sockets could have lead to list corruption and kernel panics (bsc#936502).
• CVE-2015-4036: DoS via memory corruption in vhost/scsi driver (bsc#931988).
• CVE-2015-4167: Linux kernel built with the UDF file system(CONFIG_UDF_FS) support was vulnerable to a crash. It occurred while fetching inode information from a corrupted/malicious udf file system image (bsc#933907).
• CVE-2015-4692: DoS via NULL pointer dereference in kvm_apic_has_events function (bsc#935542).
• CVE-2015-5364: Remote DoS via flood of UDP packets with invalid checksums (bsc#936831).
• CVE-2015-5366: Remote DoS of EPOLLET epoll applications via flood of UDP packets with invalid checksums (bsc#936831).

Security issues already fixed in the previous update but not referenced by CVE:

• CVE-2014-9728: Kernel built with the UDF file system(CONFIG_UDF_FS) support were vulnerable to a crash (bsc#933904).
• CVE-2014-9729: Kernel built with the UDF file system(CONFIG_UDF_FS) support were vulnerable to a crash (bsc#933904).
• CVE-2014-9730: Kernel built with the UDF file system(CONFIG_UDF_FS) support were vulnerable to a crash (bsc#933904).
• CVE-2014-9731: Kernel built with the UDF file system(CONFIG_UDF_FS) support were vulnerable to information leakage (bsc#933896).

The following non-security bugs were fixed:

• ALSA: hda - add codec ID for Skylake display audio codec (bsc#936556).
• ALSA: hda/hdmi - apply Haswell fix-ups to Skylake display codec (bsc#936556).
• ALSA: hda_controller: Separate stream_tag for input and output streams (bsc#936556).
• ALSA: hda_intel: add AZX_DCAPS_I915_POWERWELL for SKL and BSW (bsc#936556).
• ALSA: hda_intel: apply the Seperate stream_tag for Skylake (bsc#936556).
• ALSA: hda_intel: apply the Seperate stream_tag for Sunrise Point (bsc#936556).
• Btrfs: Handle unaligned length in extent_same (bsc#937609).
• Btrfs: add missing inode item update in fallocate() (bsc#938023).
• Btrfs: check pending chunks when shrinking fs to avoid corruption (bsc#936445).
• Btrfs: do not update mtime/ctime on deduped inodes (bsc#937616).
• Btrfs: fix block group ->space_info null pointer dereference (bsc#935088).
• Btrfs: fix clone / extent-same deadlocks (bsc#937612).
• Btrfs: fix deadlock with extent-same and readpage (bsc#937612).
• Btrfs: fix fsync data loss after append write (bsc#936446).
• Btrfs: fix hang during inode eviction due to concurrent readahead (bsc#935085).
• Btrfs: fix memory leak in the extent_same ioctl (bsc#937613).
• Btrfs: fix race when reusing stale extent buffers that leads to BUG_ON (bsc#926369).
• Btrfs: fix use after free when close_ctree frees the orphan_rsv (bsc#938022).
• Btrfs: pass unaligned length to btrfs_cmp_data() (bsc#937609).
• Btrfs: provide super_operations->inode_get_dev (bsc#927455).
• Drivers: hv: balloon: check if ha_region_mutex was acquired in MEM_CANCEL_ONLINE case.
• Drivers: hv: fcopy: process deferred messages when we complete the transaction.
• Drivers: hv: fcopy: rename fcopy_work -> fcopy_timeout_work.
• Drivers: hv: fcopy: set .owner reference for file operations.
• Drivers: hv: fcopy: switch to using the hvutil_device_state state machine.
• Drivers: hv: hv_balloon: correctly handle num_pages>INT_MAX case.
• Drivers: hv: hv_balloon: correctly handle val.freeram lower than num_pages case.
• Drivers: hv: hv_balloon: do not lose memory when onlining order is not natural.
• Drivers: hv: hv_balloon: do not online pages in offline…

Array index error in the tcm_vhost_make_tpg function in drivers/vhost/scsi.c in the Linux kernel before 4.0 might allow guest OS users to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted VHOST_SCSI_SET_ENDPOINT ioctl call. NOTE: the affected function was renamed to vhost_scsi_make_tpg before the vulnerability was announced.

An integer overflow was discovered in the stack randomization feature of the Linux kernel on 64 bit platforms. A local attacker could exploit this flaw to bypass the Address Space Layout Randomization (ASLR) protection mechanism. (CVE-2015-1593)

An information leak was discovered in the Linux Kernel's handling of userspace configuration of the link layer control (LLC). A local user could exploit this flaw to read data from other sysctl settings. (CVE-2015-2041)

An information leak was discovered in how the Linux kernel handles setting the Reliable Datagram Sockets (RDS) settings. A local user could exploit this flaw to read data from other sysctl settings. (CVE-2015-2042)

A memory corruption flaw was discovered in the Linux kernel's scsi subsystem. A local attacker could potentially exploit this flaw to cause a denial of service (system crash). (CVE-2015-4036)

Wen Xu discovered a use-after-free flaw in the Linux kernel's ipv4 ping support. A local user could exploit this flaw to cause a denial of service (system crash) or gain administrative privileges on the system. (CVE-2015-3636)

A memory corruption flaw was discovered in the Linux kernel's scsi subsystem. A local attacker could potentially exploit this flaw to cause a denial of service (system crash). (CVE-2015-4036)

Xiong Zhou discovered a bug in the way the EXT4 filesystem handles fallocate zero range functionality when the page size is greater than the block size. A local attacker could exploit this flaw to cause a denial of service (system crash). (CVE-2015-0275)

Wen Xu discovered a use-after-free flaw in the Linux kernel's ipv4 ping support. A local user could exploit this flaw to cause a denial of service (system crash) or gain administrative privileges on the system. (CVE-2015-3636)

A memory corruption flaw was discovered in the Linux kernel's scsi subsystem. A local attacker could potentially exploit this flaw to cause a denial of service (system crash). (CVE-2015-4036)