CVE-2017-18360

In change_port_settings in drivers/usb/serial/io_ti.c in the Linux kernel before 4.11.3, local users could cause a denial of service by division-by-zero in the serial device layer by trying to set very high baud rates.

The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2016-10741: fs/xfs/xfs_aops.c allowed local users to cause a denial of service (system crash) because there is a race condition between direct and memory-mapped I/O (associated with a hole) that is handled with BUG_ON instead of an I/O failure (bnc#1114920 bnc#1124010).
• CVE-2017-18360: In change_port_settings in drivers/usb/serial/io_ti.c local users could cause a denial of service by division-by-zero in the serial device layer by trying to set very high baud rates (bnc#1123706).
• CVE-2018-9568: In sk_clone_lock of sock.c, there is a possible memory corruption due to type confusion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. (bnc#1118319).
• CVE-2018-19407: The vcpu_scan_ioapic function in arch/x86/kvm/x86.c allowed local users to cause a denial of service (NULL pointer dereference and BUG) via crafted system calls that reach a situation where ioapic is uninitialized (bnc#1116841).
• CVE-2018-19824: A local user could exploit a use-after-free in the ALSA driver by supplying a malicious USB Sound device (with zero interfaces) that is mishandled in usb_audio_probe in sound/usb/card.c (bnc#1118152).
• CVE-2018-19985: The function hso_probe read if_num from the USB device (as an u8) and used it without a length check to index an array, resulting in an OOB memory read in hso_probe or hso_get_config_data that could be used by local attackers (bnc#1120743).
• CVE-2018-20169: The USB subsystem mishandled size checks during the reading of an extra descriptor, related to __usb_get_extra_descriptor in drivers/usb/core/usb.c (bnc#1119714).
• CVE-2019-7222: A information leak in exception handling in KVM could be used to expose host memory to guests. (bnc#1124735).

The following non-security bugs were fixed:

• aacraid: Fix memory leak in aac_fib_map_free (bsc#1115827).
• arcmsr: upper 32 of dma address lost (bsc#1115828).
• block/swim3: Fix -EBUSY error when re-opening device after unmount (bsc#1121997).
• block/swim: Fix array bounds check (Git-fix).
• btrfs: Enhance btrfs_trim_fs function to handle error better (Dependency for bsc#1113667).
• btrfs: Ensure btrfs_trim_fs can trim the whole filesystem (bsc#1113667).
• cpusets, isolcpus: exclude isolcpus from load balancing in cpusets (bsc#1119255).
• dasd: fix deadlock in dasd_times_out (bnc#1117943, LTC#174111).
• drivers: hv: vmbus: check the creation_status in vmbus_establish_gpadl() (bsc#1104098).
• drm/ast: Remove existing framebuffers before loading driver (boo#1112963)
• drm/fb-helper: Ignore the value of fb_var_screeninfo.pixclock (bsc#1106886)
• ext4: add missing brelse() update_backups()'s error path (bsc#1117796).
• ext4: avoid buffer leak in ext4_orphan_add() after prior errors (bsc#1117802).
• ext4: avoid possible double brelse() in add_new_gdb() on error path (bsc#1118760).
• ext4: fix buffer leak in ext4_xattr_move_to_block() on error path (bsc#1117806).
• ext4: release bs.bh before re-using in ext4_xattr_block_find() (bsc#1117805).
• fbdev: fbcon: Fix unregister crash when more than one framebuffer (bsc#1106886)
• fbdev: fbmem: behave better with small rotated displays and many CPUs (bsc#1106886)
• Fix kabi break cased by NFS: Cache state owners after files are closed (bsc#1031572).
• fork: record start_time late (bsc#1121872).
• fscache: Fix dead object requeue (bsc#1107371).
• fscache: Fix race in fscache_op_complete() due to split atomic_sub & read (git-fixes).
• fs-cache: Move fscache_report_unexpected_submission() to make it more available (bsc#1107371).
• fs-cache: When submitting an op, cancel it if the target object is dying (bsc#1107371).
• fuse: Add missed unlock_page() to fuse_readpages_fill() (git-fixes).
• fuse: fix blocked_waitq wakeup (git-fixes).
• fuse: fix leaked notify reply (git-fixes).
• fuse: Fix oops at…

It was discovered that an information leak vulnerability existed in the Bluetooth implementation of the Linux kernel. An attacker within Bluetooth range could possibly expose sensitive information (kernel memory). (CVE-2017-1000410)

It was discovered that the USB serial device driver in the Linux kernel did not properly validate baud rate settings when debugging is enabled. A local attacker could use this to cause a denial of service (system crash). (CVE-2017-18360)

Mathias Payer and Hui Peng discovered a use-after-free vulnerability in the Advanced Linux Sound Architecture (ALSA) subsystem. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2018-19824)

Shlomi Oberman, Yuli Shapiro, and Ran Menscher discovered an information leak in the Bluetooth implementation of the Linux kernel. An attacker within Bluetooth range could use this to expose sensitive information (kernel memory). (CVE-2019-3459, CVE-2019-3460)

Jann Horn discovered that the KVM implementation in the Linux kernel contained a use-after-free vulnerability. An attacker in a guest VM with access to /dev/kvm could use this to cause a denial of service (guest VM crash). (CVE-2019-6974)

Felix Wilhelm discovered that an information leak vulnerability existed in the KVM subsystem of the Linux kernel, when nested virtualization is used. A local attacker could use this to expose sensitive information (host system memory to a guest VM). (CVE-2019-7222)

Jann Horn discovered that the mmap implementation in the Linux kernel did not properly check for the mmap minimum address in some situations. A local attacker could use this to assist exploiting a kernel NULL pointer dereference vulnerability. (CVE-2019-9213)