CVE-2018-7740

The resv_map_release function in mm/hugetlb.c in the Linux kernel through 4.15.7 allows local users to cause a denial of service (BUG) via a crafted application that makes mmap system calls and has a large pgoff argument to the remap_file_pages system call.

The SUSE Linux Enterprise 12 SP3 kernel was updated to 4.4.126 to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-1091: In the flush_tmregs_to_thread function in arch/powerpc/kernel/ptrace.c, a guest kernel crash can be triggered from unprivileged userspace during a core dump on a POWER host due to a missing processor feature check and an erroneous use of transactional memory (TM) instructions in the core dump path, leading to a denial of service (bnc#1087231).
• CVE-2018-7740: The resv_map_release function in mm/hugetlb.c allowed local users to cause a denial of service (BUG) via a crafted application that made mmap system calls and has a large pgoff argument to the remap_file_pages system call (bnc#1084353).
• CVE-2018-8043: The unimac_mdio_probe function in drivers/net/phy/mdio-bcm-unimac.c did not validate certain resource availability, which allowed local users to cause a denial of service (NULL pointer dereference) (bnc#1084829).
• CVE-2017-18257: The __get_data_block function in fs/f2fs/data.c allowed local users to cause a denial of service (integer overflow and loop) via crafted use of the open and fallocate system calls with an FS_IOC_FIEMAP ioctl. (bnc#1088241)
• CVE-2018-8822: Incorrect buffer length handling in the ncp_read_kernel function in fs/ncpfs/ncplib_kernel.c could be exploited by malicious NCPFS servers to crash the kernel or execute code (bnc#1086162).

The following non-security bugs were fixed:

• acpica: Add header support for TPM2 table changes (bsc#1084452).
• acpica: Add support for new SRAT subtable (bsc#1085981).
• acpica: iasl: Update to IORT SMMUv3 disassembling (bsc#1085981).
• acpi/iort: numa: Add numa node mapping for smmuv3 devices (bsc#1085981).
• acpi, numa: fix pxm to online numa node associations (bnc#1012382).
• acpi / pmic: xpower: Fix power_table addresses (bnc#1012382).
• acpi/processor: Fix error handling in __acpi_processor_start() (bnc#1012382).
• acpi/processor: Replace racy task affinity logic (bnc#1012382).
• add mainline tag to various patches to be able to get further work done
• af_iucv: enable control sends in case of SEND_SHUTDOWN (bnc#1085507, LTC#165135).
• agp/intel: Flush all chipset writes after updating the GGTT (bnc#1012382).
• ahci: Add PCI-id for the Highpoint Rocketraid 644L card (bnc#1012382).
• alsa: aloop: Fix access to not-yet-ready substream via cable (bnc#1012382).
• alsa: aloop: Sync stale timer before release (bnc#1012382).
• alsa: firewire-digi00x: handle all MIDI messages on streaming packets (bnc#1012382).
• alsa: hda: Add a power_save blacklist (bnc#1012382).
• alsa: hda: add dock and led support for HP EliteBook 820 G3 (bnc#1012382).
• alsa: hda: add dock and led support for HP ProBook 640 G2 (bnc#1012382).
• alsa: hda/realtek - Always immediately update mute LED with pin VREF (bnc#1012382).
• alsa: hda/realtek - Fix dock line-out volume on Dell Precision 7520 (bnc#1012382).
• alsa: hda/realtek - Fix speaker no sound after system resume (bsc#1031717).
• alsa: hda - Revert power_save option default value (git-fixes).
• alsa: pcm: Fix UAF in snd_pcm_oss_get_formats() (bnc#1012382).
• alsa: usb-audio: Add a quirck for B&W PX headphones (bnc#1012382).
• alsa: usb-audio: Fix parsing descriptor of UAC2 processing unit (bnc#1012382).
• apparmor: Make path_max parameter readonly (bnc#1012382).
• arm64: Add ARM_SMCCC_ARCH_WORKAROUND_1 BP hardening support (bsc#1068032).
• arm64: Add missing Falkor part number for branch predictor hardening (bsc#1068032).
• arm64: capabilities: Handle duplicate entries for a capability (bsc#1068032).
• arm64: cpufeature: __this_cpu_has_cap() shouldn't stop early (bsc#1068032).
• arm64 / cpuidle: Use new cpuidle macro for entering retention state (bsc#1084328).
• arm64: Enforce BBM for huge IO/VMAP mappings (bsc#1088313).
• arm64: fix smccc compilation (bsc#1068032).
• arm64: Kill PSCI_GET_VERSION as a variant-2 workaround (bsc#1068032).
• arm64: KVM: Add SMCCC_ARCH_WORKAROUND_1…

The SUSE Linux Enterprise 12 SP2 LTSS kernel was updated to 4.4.121 to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-8781: The udl_fb_mmap function in drivers/gpu/drm/udl/udl_fb.c had an integer-overflow vulnerability that allowed local users with access to the udldrmfb driver to obtain full read and write permissions on kernel physical pages, resulting in a code execution in kernel space (bnc#1090643).
• CVE-2018-10124: The kill_something_info function in kernel/signal.c might have allowed local users to cause a denial of service via an INT_MIN argument (bnc#1089752).
• CVE-2018-10087: The kernel_wait4 function in kernel/exit.c might have allowed local users to cause a denial of service by triggering an attempted use of the -INT_MIN value (bnc#1089608).
• CVE-2017-18257: The __get_data_block function in fs/f2fs/data.c in the Linux kernel allowed local users to cause a denial of service (integer overflow and loop) via crafted use of the open and fallocate system calls with an FS_IOC_FIEMAP ioctl. (bnc#1088241)
• CVE-2018-8822: Incorrect buffer length handling in the ncp_read_kernel function in fs/ncpfs/ncplib_kernel.c could be exploited by malicious NCPFS servers to crash the kernel or execute code (bnc#1086162).
• CVE-2018-8043: The unimac_mdio_probe function in drivers/net/phy/mdio-bcm-unimac.c did not validate certain resource availability, which allowed local users to cause a denial of service (NULL pointer dereference) (bnc#1084829).
• CVE-2018-7740: The resv_map_release function in mm/hugetlb.c allowed local users to cause a denial of service (BUG) via a crafted application that made mmap system calls and has a large pgoff argument to the remap_file_pages system call (bnc#1084353).
• CVE-2018-1087: And an unprivileged KVM guest user could use this flaw to potentially escalate their privileges inside a guest. (bsc#1087088)
• CVE-2018-8897: An unprivileged system user could use incorrect set up interrupt stacks to crash the Linux kernel resulting in DoS issue. (bsc#1087088)

The following non-security bugs were fixed:

• alsa: hda/realtek - Fix speaker no sound after system resume (bsc#1031717).
• alsa: hda: Add a power_save blacklist (bnc#1012382).
• alsa: usb-audio: Add a quirck for B&W PX headphones (bnc#1012382).
• arm: dts: LogicPD Torpedo: Fix I2C1 pinmux (bnc#1012382).
• arm: mvebu: Fix broken PL310_ERRATA_753970 selects (bnc#1012382).
• kvm: mmu: Fix overlap between public and private memslots (bnc#1012382).
• Partial revert 'e1000e: Avoid receiver overrun interrupt bursts' (bsc#1075428).
• Revert 'e1000e: Separate signaling for link check/link up' (bsc#1075428).
• Revert 'led: core: Fix brightness setting when setting delay_off=0' (bnc#1012382).
• Revert 'watchdog: hpwdt: Remove legacy NMI sourcing (bsc#1085185).' This reverts commit 5d4a2355a2a1c2ec6fdf9d18b68ca0a04ff73c70.
• bpf, x64: implement retpoline for tail call (bnc#1012382).
• bridge: check brport attr show in brport_show (bnc#1012382).
• btrfs: Only check first key for committed tree blocks (bsc#1084721).
• btrfs: Validate child tree block's level and first key (bsc#1084721).
• btrfs: preserve i_mode if __btrfs_set_acl() fails (bnc#1012382).
• ch9200: use skb_cow_head() to deal with cloned skbs (bsc#1088684).
• cpufreq: s3c24xx: Fix broken s3c_cpufreq_init() (bnc#1012382).
• dcache: Add cond_resched in shrink_dentry_list (bsc#1086194).
• dm io: fix duplicate bio completion due to missing ref count (bnc#1012382).
• drm/i915/cmdparser: Do not check past the cmd length (bsc#1031717).
• drm/i915/psr: Check for the specific AUX_FRAME_SYNC cap bit (bsc#1031717).
• e1000e: Avoid missed interrupts following ICR read (bsc#1075428).
• e1000e: Avoid receiver overrun interrupt bursts (bsc#1075428).
• e1000e: Fix check_for_link return value with autoneg off (bsc#1075428).
• e1000e: Fix link check race condition (bsc#1075428).
• e1000e: Fix queue interrupt re-raising in Other interrupt (bsc#1075428).
• e1000e: Remove…

The SUSE Linux Enterprise 12 SP2 LTSS kernel was updated to 4.4.121 to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-8781: The udl_fb_mmap function in drivers/gpu/drm/udl/udl_fb.c had an integer-overflow vulnerability that allowed local users with access to the udldrmfb driver to obtain full read and write permissions on kernel physical pages, resulting in a code execution in kernel space (bnc#1090643).
• CVE-2018-10124: The kill_something_info function in kernel/signal.c might have allowed local users to cause a denial of service via an INT_MIN argument (bnc#1089752).
• CVE-2018-10087: The kernel_wait4 function in kernel/exit.c might have allowed local users to cause a denial of service by triggering an attempted use of the -INT_MIN value (bnc#1089608).
• CVE-2017-18257: The __get_data_block function in fs/f2fs/data.c in the Linux kernel allowed local users to cause a denial of service (integer overflow and loop) via crafted use of the open and fallocate system calls with an FS_IOC_FIEMAP ioctl. (bnc#1088241)
• CVE-2018-8822: Incorrect buffer length handling in the ncp_read_kernel function in fs/ncpfs/ncplib_kernel.c could be exploited by malicious NCPFS servers to crash the kernel or execute code (bnc#1086162).
• CVE-2018-8043: The unimac_mdio_probe function in drivers/net/phy/mdio-bcm-unimac.c did not validate certain resource availability, which allowed local users to cause a denial of service (NULL pointer dereference) (bnc#1084829).
• CVE-2018-7740: The resv_map_release function in mm/hugetlb.c allowed local users to cause a denial of service (BUG) via a crafted application that made mmap system calls and has a large pgoff argument to the remap_file_pages system call (bnc#1084353).
• CVE-2018-1087: And an unprivileged KVM guest user could use this flaw to potentially escalate their privileges inside a guest. (bsc#1087088)
• CVE-2018-8897: An unprivileged system user could use incorrect set up interrupt stacks to crash the Linux kernel resulting in DoS issue. (bsc#1087088)

The following non-security bugs were fixed:

• alsa: hda/realtek - Fix speaker no sound after system resume (bsc#1031717).
• alsa: hda: Add a power_save blacklist (bnc#1012382).
• alsa: usb-audio: Add a quirck for B&W PX headphones (bnc#1012382).
• arm: dts: LogicPD Torpedo: Fix I2C1 pinmux (bnc#1012382).
• arm: mvebu: Fix broken PL310_ERRATA_753970 selects (bnc#1012382).
• kvm: mmu: Fix overlap between public and private memslots (bnc#1012382).
• Partial revert 'e1000e: Avoid receiver overrun interrupt bursts' (bsc#1075428).
• Revert 'e1000e: Separate signaling for link check/link up' (bsc#1075428).
• Revert 'led: core: Fix brightness setting when setting delay_off=0' (bnc#1012382).
• Revert 'watchdog: hpwdt: Remove legacy NMI sourcing (bsc#1085185).' This reverts commit 5d4a2355a2a1c2ec6fdf9d18b68ca0a04ff73c70.
• bpf, x64: implement retpoline for tail call (bnc#1012382).
• bridge: check brport attr show in brport_show (bnc#1012382).
• btrfs: Only check first key for committed tree blocks (bsc#1084721).
• btrfs: Validate child tree block's level and first key (bsc#1084721).
• btrfs: preserve i_mode if __btrfs_set_acl() fails (bnc#1012382).
• ch9200: use skb_cow_head() to deal with cloned skbs (bsc#1088684).
• cpufreq: s3c24xx: Fix broken s3c_cpufreq_init() (bnc#1012382).
• dcache: Add cond_resched in shrink_dentry_list (bsc#1086194).
• dm io: fix duplicate bio completion due to missing ref count (bnc#1012382).
• drm/i915/cmdparser: Do not check past the cmd length (bsc#1031717).
• drm/i915/psr: Check for the specific AUX_FRAME_SYNC cap bit (bsc#1031717).
• e1000e: Avoid missed interrupts following ICR read (bsc#1075428).
• e1000e: Avoid receiver overrun interrupt bursts (bsc#1075428).
• e1000e: Fix check_for_link return value with autoneg off (bsc#1075428).
• e1000e: Fix link check race condition (bsc#1075428).
• e1000e: Fix queue interrupt re-raising in Other interrupt (bsc#1075428).
• e1000e: Remove…

The SUSE Linux Enterprise 12 SP3 RT kernel was updated to 4.4.128 to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-10124: The kill_something_info function in kernel/signal.c might have allowed local users to cause a denial of service via an INT_MIN argument (bnc#1089752).
• CVE-2018-10087: The kernel_wait4 function in kernel/exit.c might have allowed local users to cause a denial of service by triggering an attempted use of the -INT_MIN value (bnc#1089608).
• CVE-2017-18257: The __get_data_block function in fs/f2fs/data.c allowed local users to cause a denial of service (integer overflow and loop) via crafted use of the open and fallocate system calls with an FS_IOC_FIEMAP ioctl (bnc#1088241)
• CVE-2018-1091: In the flush_tmregs_to_thread function in arch/powerpc/kernel/ptrace.c, a guest kernel crash can be triggered from unprivileged userspace during a core dump on a POWER host due to a missing processor feature check and an erroneous use of transactional memory (TM) instructions in the core dump path, leading to a denial of service (bnc#1087231).
• CVE-2018-8822: Incorrect buffer length handling in the ncp_read_kernel function could have been exploited by malicious NCPFS servers to crash the kernel or execute code (bnc#1086162).
• CVE-2018-8043: The unimac_mdio_probe function in drivers/net/phy/mdio-bcm-unimac.c did not validate certain resource availability, which allowed local users to cause a denial of service (NULL pointer dereference) (bnc#1084829).
• CVE-2018-7740: The resv_map_release function in mm/hugetlb.c allowed local users to cause a denial of service (BUG) via a crafted application that made mmap system calls and has a large pgoff argument to the remap_file_pages system call (bnc#1084353).

The following non-security bugs were fixed:

• Fix ltp might_sleep() splat BUG
• ACPI / PMIC: xpower: Fix power_table addresses (bnc#1012382).
• ACPI, PCI, irq: remove redundant check for null string pointer (bnc#1012382).
• ACPI/IORT: numa: Add numa node mapping for smmuv3 devices (bsc#1085981).
• ACPI/processor: Fix error handling in __acpi_processor_start() (bnc#1012382).
• ACPI/processor: Replace racy task affinity logic (bnc#1012382).
• ACPICA: Add header support for TPM2 table changes (bsc#1084452).
• ACPICA: Add support for new SRAT subtable (bsc#1085981).
• ACPICA: Disassembler: Abort on an invalid/unknown AML opcode (bnc#1012382).
• ACPICA: Events: Add runtime stub support for event APIs (bnc#1012382).
• ACPICA: iasl: Update to IORT SMMUv3 disassembling (bsc#1085981).
• ALSA: aloop: Fix access to not-yet-ready substream via cable (bnc#1012382).
• ALSA: aloop: Sync stale timer before release (bnc#1012382).
• ALSA: firewire-digi00x: handle all MIDI messages on streaming packets (bnc#1012382).
• ALSA: hda - Revert power_save option default value (git-fixes).
• ALSA: hda/realtek - Always immediately update mute LED with pin VREF (bnc#1012382).
• ALSA: hda/realtek - Fix dock line-out volume on Dell Precision 7520 (bnc#1012382).
• ALSA: hda/realtek - Fix speaker no sound after system resume (bsc#1031717).
• ALSA: hda: Add a power_save blacklist (bnc#1012382).
• ALSA: hda: add dock and led support for HP EliteBook 820 G3 (bnc#1012382).
• ALSA: hda: add dock and led support for HP ProBook 640 G2 (bnc#1012382).
• ALSA: pcm: Fix UAF in snd_pcm_oss_get_formats() (bnc#1012382).
• ALSA: pcm: Use dma_bytes as size parameter in dma_mmap_coherent() (bnc#1012382).
• ALSA: pcm: potential uninitialized return values (bnc#1012382).
• ALSA: usb-audio: Add a quirck for BW PX headphones (bnc#1012382).
• ALSA: usb-audio: Fix parsing descriptor of UAC2 processing unit (bnc#1012382).
• ARM64 / cpuidle: Use new cpuidle macro for entering retention state (bsc#1084328).
• ARM: 8668/1: ftrace: Fix dynamic ftrace with DEBUG_RODATA and !FRAME_POINTER (bnc#1012382).
• ARM: DRA7: clockdomain: Change the CLKTRCTRL of CM_PCIE_CLKSTCTRL to SW_WKUP (bnc#1012382). -…

It was discovered that the f2fs filesystem implementation in the Linux kernel did not handle the noflush_merge mount option correctly. An attacker could use this to cause a denial of service (system crash). (CVE-2017-18241)

It was discovered that the procfs filesystem did not properly handle processes mapping some memory elements onto files. A local attacker could use this to block utilities that examine the procfs filesystem to report operating system state, such as ps(1). (CVE-2018-1120)

Hui Peng and Mathias Payer discovered that the Option USB High Speed driver in the Linux kernel did not properly validate metadata received from the device. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2018-19985)

It was discovered that multiple integer overflows existed in the hugetlbfs implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash). (CVE-2018-7740)

Jann Horn discovered a race condition in the fork() system call in the Linux kernel. A local attacker could use this to gain access to services that cache authorizations. (CVE-2019-6133)

USN-3910-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS.

It was discovered that the f2fs filesystem implementation in the Linux kernel did not handle the noflush_merge mount option correctly. An attacker could use this to cause a denial of service (system crash). (CVE-2017-18241)

It was discovered that the procfs filesystem did not properly handle processes mapping some memory elements onto files. A local attacker could use this to block utilities that examine the procfs filesystem to report operating system state, such as ps(1). (CVE-2018-1120)

Hui Peng and Mathias Payer discovered that the Option USB High Speed driver in the Linux kernel did not properly validate metadata received from the device. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2018-19985)

It was discovered that multiple integer overflows existed in the hugetlbfs implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash). (CVE-2018-7740)

Jann Horn discovered a race condition in the fork() system call in the Linux kernel. A local attacker could use this to gain access to services that cache authorizations. (CVE-2019-6133)