CVE-2013-6885

Updated kernel provides upstream 3.10.40 kernel and fixes the following security issues:

The microcode on AMD 16h 00h through 0Fh processors does not properly handle the interaction between locked instructions and write-combined memory types, which allows local users to cause a denial of service (system hang) via a crafted application, aka the errata 793 issue. (CVE-2013-6885)

Buffer overflow in the complete_emulated_mmio function in arch/x86/kvm/ x86.c in the Linux kernel before 3.13.6 allows guest OS users to execute arbitrary code on the host OS by leveraging a loop that triggers an invalid memory copy affecting certain cancel_work_item data. (CVE-2014-0049)

The get_rx_bufs function in drivers/vhost/net.c in the vhost-net subsystem in the Linux kernel package before 2.6.32-431.11.2 on Red Hat Enterprise Linux (RHEL) 6 does not properly handle vhost_get_vq_desc errors, which allows guest OS users to cause a denial of service (host OS crash) via unspecified vectors. (CVE-2014-0055)

The cifs_iovec_write function in fs/cifs/file.c in the Linux kernel through 3.13.5 does not properly handle uncached write operations that copy fewer than the requested number of bytes, which allows local users to obtain sensitive information from kernel memory, cause a denial of service (memory corruption and system crash), or possibly gain privileges via a writev system call with a crafted pointer. (CVE-2014-0069)

drivers/vhost/net.c in the Linux kernel before 3.13.10, when mergeable buffers are disabled, does not properly validate packet lengths, which allows guest OS users to cause a denial of service (memory corruption and host OS crash) or possibly gain privileges on the host OS via crafted packets, related to the handle_rx and get_rx_bufs functions. (CVE-2014-0077)

The ioapic_deliver function in virt/kvm/ioapic.c in the Linux kernel through 3.14.1 does not properly validate the kvm_irq_delivery_to_apic return value, which allows guest OS users to cause a denial of service (host OS crash) via a crafted entry in the redirection table of an I/O APIC. NOTE: the affected code was moved to the ioapic_service function before the vulnerability was announced. (CVE-2014-0155)

The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial of service (memory corruption and system crash) or gain privileges by triggering a race condition involving read and write operations with long strings. (CVE-2014-0196)

The raw_cmd_copyin function in drivers/block/floppy.c in the Linux kernel through 3.14.3 does not properly handle error conditions during processing of an FDRAWCMD ioctl call, which allows local users to trigger kfree operations and gain privileges by leveraging write access to a /dev/fd device. (CVE-2014-1737)

The raw_cmd_copyout function in drivers/block/floppy.c in the Linux kernel through 3.14.3 does not properly restrict access to certain pointers during processing of an FDRAWCMD ioctl call, which allows local users to obtain sensitive information from kernel heap memory by leveraging write access to a /dev/fd device. (CVE-2014-1738)

Integer overflow in the ping_init_sock function in net/ipv4/ping.c in the Linux kernel through 3.14.1 allows local users to cause a denial of service (use-after-free and system crash) or possibly gain privileges via a crafted application that leverages an improperly managed reference counter. (CVE-2014-2851)

For other fixes, see the referenced changelogs.

Updated kernel-vserver provides upstream 3.10.40 kernel and fixes the following security issues:

The microcode on AMD 16h 00h through 0Fh processors does not properly handle the interaction between locked instructions and write-combined memory types, which allows local users to cause a denial of service (system hang) via a crafted application, aka the errata 793 issue. (CVE-2013-6885)

Buffer overflow in the complete_emulated_mmio function in arch/x86/kvm/ x86.c in the Linux kernel before 3.13.6 allows guest OS users to execute arbitrary code on the host OS by leveraging a loop that triggers an invalid memory copy affecting certain cancel_work_item data. (CVE-2014-0049)

The get_rx_bufs function in drivers/vhost/net.c in the vhost-net subsystem in the Linux kernel package before 2.6.32-431.11.2 on Red Hat Enterprise Linux (RHEL) 6 does not properly handle vhost_get_vq_desc errors, which allows guest OS users to cause a denial of service (host OS crash) via unspecified vectors. (CVE-2014-0055)

The cifs_iovec_write function in fs/cifs/file.c in the Linux kernel through 3.13.5 does not properly handle uncached write operations that copy fewer than the requested number of bytes, which allows local users to obtain sensitive information from kernel memory, cause a denial of service (memory corruption and system crash), or possibly gain privileges via a writev system call with a crafted pointer. (CVE-2014-0069)

drivers/vhost/net.c in the Linux kernel before 3.13.10, when mergeable buffers are disabled, does not properly validate packet lengths, which allows guest OS users to cause a denial of service (memory corruption and host OS crash) or possibly gain privileges on the host OS via crafted packets, related to the handle_rx and get_rx_bufs functions. (CVE-2014-0077)

The ioapic_deliver function in virt/kvm/ioapic.c in the Linux kernel through 3.14.1 does not properly validate the kvm_irq_delivery_to_apic return value, which allows guest OS users to cause a denial of service (host OS crash) via a crafted entry in the redirection table of an I/O APIC. NOTE: the affected code was moved to the ioapic_service function before the vulnerability was announced. (CVE-2014-0155)

The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial of service (memory corruption and system crash) or gain privileges by triggering a race condition involving read and write operations with long strings. (CVE-2014-0196)

The raw_cmd_copyin function in drivers/block/floppy.c in the Linux kernel through 3.14.3 does not properly handle error conditions during processing of an FDRAWCMD ioctl call, which allows local users to trigger kfree operations and gain privileges by leveraging write access to a /dev/fd device. (CVE-2014-1737)

The raw_cmd_copyout function in drivers/block/floppy.c in the Linux kernel through 3.14.3 does not properly restrict access to certain pointers during processing of an FDRAWCMD ioctl call, which allows local users to obtain sensitive information from kernel heap memory by leveraging write access to a /dev/fd device. (CVE-2014-1738)

Integer overflow in the ping_init_sock function in net/ipv4/ping.c in the Linux kernel through 3.14.1 allows local users to cause a denial of service (use-after-free and system crash) or possibly gain privileges via a crafted application that leverages an improperly managed reference counter. (CVE-2014-2851)

For other fixes, see the referenced changelogs.

Updated kernel-linus provides upstream 3.10.40 kernel and fixes the following security issues:

The microcode on AMD 16h 00h through 0Fh processors does not properly handle the interaction between locked instructions and write-combined memory types, which allows local users to cause a denial of service (system hang) via a crafted application, aka the errata 793 issue. (CVE-2013-6885)

Buffer overflow in the complete_emulated_mmio function in arch/x86/kvm/ x86.c in the Linux kernel before 3.13.6 allows guest OS users to execute arbitrary code on the host OS by leveraging a loop that triggers an invalid memory copy affecting certain cancel_work_item data. (CVE-2014-0049)

The get_rx_bufs function in drivers/vhost/net.c in the vhost-net subsystem in the Linux kernel package before 2.6.32-431.11.2 on Red Hat Enterprise Linux (RHEL) 6 does not properly handle vhost_get_vq_desc errors, which allows guest OS users to cause a denial of service (host OS crash) via unspecified vectors. (CVE-2014-0055)

The cifs_iovec_write function in fs/cifs/file.c in the Linux kernel through 3.13.5 does not properly handle uncached write operations that copy fewer than the requested number of bytes, which allows local users to obtain sensitive information from kernel memory, cause a denial of service (memory corruption and system crash), or possibly gain privileges via a writev system call with a crafted pointer. (CVE-2014-0069)

drivers/vhost/net.c in the Linux kernel before 3.13.10, when mergeable buffers are disabled, does not properly validate packet lengths, which allows guest OS users to cause a denial of service (memory corruption and host OS crash) or possibly gain privileges on the host OS via crafted packets, related to the handle_rx and get_rx_bufs functions. (CVE-2014-0077)

The ioapic_deliver function in virt/kvm/ioapic.c in the Linux kernel through 3.14.1 does not properly validate the kvm_irq_delivery_to_apic return value, which allows guest OS users to cause a denial of service (host OS crash) via a crafted entry in the redirection table of an I/O APIC. NOTE: the affected code was moved to the ioapic_service function before the vulnerability was announced. (CVE-2014-0155)

The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial of service (memory corruption and system crash) or gain privileges by triggering a race condition involving read and write operations with long strings. (CVE-2014-0196)

The raw_cmd_copyin function in drivers/block/floppy.c in the Linux kernel through 3.14.3 does not properly handle error conditions during processing of an FDRAWCMD ioctl call, which allows local users to trigger kfree operations and gain privileges by leveraging write access to a /dev/fd device. (CVE-2014-1737)

The raw_cmd_copyout function in drivers/block/floppy.c in the Linux kernel through 3.14.3 does not properly restrict access to certain pointers during processing of an FDRAWCMD ioctl call, which allows local users to obtain sensitive information from kernel heap memory by leveraging write access to a /dev/fd device. (CVE-2014-1738)

Integer overflow in the ping_init_sock function in net/ipv4/ping.c in the Linux kernel through 3.14.1 allows local users to cause a denial of service (use-after-free and system crash) or possibly gain privileges via a crafted application that leverages an improperly managed reference counter. (CVE-2014-2851)

For other fixes, see the referenced changelogs.

Updated kernel-tmb provides upstream 3.10.40 kernel and fixes the following security issues:

The microcode on AMD 16h 00h through 0Fh processors does not properly handle the interaction between locked instructions and write-combined memory types, which allows local users to cause a denial of service (system hang) via a crafted application, aka the errata 793 issue. (CVE-2013-6885)

Buffer overflow in the complete_emulated_mmio function in arch/x86/kvm/ x86.c in the Linux kernel before 3.13.6 allows guest OS users to execute arbitrary code on the host OS by leveraging a loop that triggers an invalid memory copy affecting certain cancel_work_item data. (CVE-2014-0049)

The get_rx_bufs function in drivers/vhost/net.c in the vhost-net subsystem in the Linux kernel package before 2.6.32-431.11.2 on Red Hat Enterprise Linux (RHEL) 6 does not properly handle vhost_get_vq_desc errors, which allows guest OS users to cause a denial of service (host OS crash) via unspecified vectors. (CVE-2014-0055)

The cifs_iovec_write function in fs/cifs/file.c in the Linux kernel through 3.13.5 does not properly handle uncached write operations that copy fewer than the requested number of bytes, which allows local users to obtain sensitive information from kernel memory, cause a denial of service (memory corruption and system crash), or possibly gain privileges via a writev system call with a crafted pointer. (CVE-2014-0069)

drivers/vhost/net.c in the Linux kernel before 3.13.10, when mergeable buffers are disabled, does not properly validate packet lengths, which allows guest OS users to cause a denial of service (memory corruption and host OS crash) or possibly gain privileges on the host OS via crafted packets, related to the handle_rx and get_rx_bufs functions. (CVE-2014-0077)

The ioapic_deliver function in virt/kvm/ioapic.c in the Linux kernel through 3.14.1 does not properly validate the kvm_irq_delivery_to_apic return value, which allows guest OS users to cause a denial of service (host OS crash) via a crafted entry in the redirection table of an I/O APIC. NOTE: the affected code was moved to the ioapic_service function before the vulnerability was announced. (CVE-2014-0155)

The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial of service (memory corruption and system crash) or gain privileges by triggering a race condition involving read and write operations with long strings. (CVE-2014-0196)

The raw_cmd_copyin function in drivers/block/floppy.c in the Linux kernel through 3.14.3 does not properly handle error conditions during processing of an FDRAWCMD ioctl call, which allows local users to trigger kfree operations and gain privileges by leveraging write access to a /dev/fd device. (CVE-2014-1737)

The raw_cmd_copyout function in drivers/block/floppy.c in the Linux kernel through 3.14.3 does not properly restrict access to certain pointers during processing of an FDRAWCMD ioctl call, which allows local users to obtain sensitive information from kernel heap memory by leveraging write access to a /dev/fd device. (CVE-2014-1738)

Integer overflow in the ping_init_sock function in net/ipv4/ping.c in the Linux kernel through 3.14.1 allows local users to cause a denial of service (use-after-free and system crash) or possibly gain privileges via a crafted application that leverages an improperly managed reference counter. (CVE-2014-2851)

For other fixes, see the referenced changelogs.

Updated kernel-rt provides upstream 3.10.40 kernel and fixes the following security issues:

The microcode on AMD 16h 00h through 0Fh processors does not properly handle the interaction between locked instructions and write-combined memory types, which allows local users to cause a denial of service (system hang) via a crafted application, aka the errata 793 issue. (CVE-2013-6885)

Buffer overflow in the complete_emulated_mmio function in arch/x86/kvm/ x86.c in the Linux kernel before 3.13.6 allows guest OS users to execute arbitrary code on the host OS by leveraging a loop that triggers an invalid memory copy affecting certain cancel_work_item data. (CVE-2014-0049)

The get_rx_bufs function in drivers/vhost/net.c in the vhost-net subsystem in the Linux kernel package before 2.6.32-431.11.2 on Red Hat Enterprise Linux (RHEL) 6 does not properly handle vhost_get_vq_desc errors, which allows guest OS users to cause a denial of service (host OS crash) via unspecified vectors. (CVE-2014-0055)

The cifs_iovec_write function in fs/cifs/file.c in the Linux kernel through 3.13.5 does not properly handle uncached write operations that copy fewer than the requested number of bytes, which allows local users to obtain sensitive information from kernel memory, cause a denial of service (memory corruption and system crash), or possibly gain privileges via a writev system call with a crafted pointer. (CVE-2014-0069)

drivers/vhost/net.c in the Linux kernel before 3.13.10, when mergeable buffers are disabled, does not properly validate packet lengths, which allows guest OS users to cause a denial of service (memory corruption and host OS crash) or possibly gain privileges on the host OS via crafted packets, related to the handle_rx and get_rx_bufs functions. (CVE-2014-0077)

The ioapic_deliver function in virt/kvm/ioapic.c in the Linux kernel through 3.14.1 does not properly validate the kvm_irq_delivery_to_apic return value, which allows guest OS users to cause a denial of service (host OS crash) via a crafted entry in the redirection table of an I/O APIC. NOTE: the affected code was moved to the ioapic_service function before the vulnerability was announced. (CVE-2014-0155)

The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial of service (memory corruption and system crash) or gain privileges by triggering a race condition involving read and write operations with long strings. (CVE-2014-0196)

The raw_cmd_copyin function in drivers/block/floppy.c in the Linux kernel through 3.14.3 does not properly handle error conditions during processing of an FDRAWCMD ioctl call, which allows local users to trigger kfree operations and gain privileges by leveraging write access to a /dev/fd device. (CVE-2014-1737)

The raw_cmd_copyout function in drivers/block/floppy.c in the Linux kernel through 3.14.3 does not properly restrict access to certain pointers during processing of an FDRAWCMD ioctl call, which allows local users to obtain sensitive information from kernel heap memory by leveraging write access to a /dev/fd device. (CVE-2014-1738)

Integer overflow in the ping_init_sock function in net/ipv4/ping.c in the Linux kernel through 3.14.1 allows local users to cause a denial of service (use-after-free and system crash) or possibly gain privileges via a crafted application that leverages an improperly managed reference counter. (CVE-2014-2851)

The -rt patch has been updated to rt40.

For other fixes, see the referenced changelogs.

Updated kernel-vserver provides upstream 3.10.40 kernel and fixes the following security issues:

The microcode on AMD 16h 00h through 0Fh processors does not properly handle the interaction between locked instructions and write-combined memory types, which allows local users to cause a denial of service (system hang) via a crafted application, aka the errata 793 issue. (CVE-2013-6885)

Buffer overflow in the complete_emulated_mmio function in arch/x86/kvm/ x86.c in the Linux kernel before 3.13.6 allows guest OS users to execute arbitrary code on the host OS by leveraging a loop that triggers an invalid memory copy affecting certain cancel_work_item data. (CVE-2014-0049)

The get_rx_bufs function in drivers/vhost/net.c in the vhost-net subsystem in the Linux kernel package before 2.6.32-431.11.2 on Red Hat Enterprise Linux (RHEL) 6 does not properly handle vhost_get_vq_desc errors, which allows guest OS users to cause a denial of service (host OS crash) via unspecified vectors. (CVE-2014-0055)

The cifs_iovec_write function in fs/cifs/file.c in the Linux kernel through 3.13.5 does not properly handle uncached write operations that copy fewer than the requested number of bytes, which allows local users to obtain sensitive information from kernel memory, cause a denial of service (memory corruption and system crash), or possibly gain privileges via a writev system call with a crafted pointer. (CVE-2014-0069)

drivers/vhost/net.c in the Linux kernel before 3.13.10, when mergeable buffers are disabled, does not properly validate packet lengths, which allows guest OS users to cause a denial of service (memory corruption and host OS crash) or possibly gain privileges on the host OS via crafted packets, related to the handle_rx and get_rx_bufs functions. (CVE-2014-0077)

The ioapic_deliver function in virt/kvm/ioapic.c in the Linux kernel through 3.14.1 does not properly validate the kvm_irq_delivery_to_apic return value, which allows guest OS users to cause a denial of service (host OS crash) via a crafted entry in the redirection table of an I/O APIC. NOTE: the affected code was moved to the ioapic_service function before the vulnerability was announced. (CVE-2014-0155)

The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial of service (memory corruption and system crash) or gain privileges by triggering a race condition involving read and write operations with long strings. (CVE-2014-0196)

The raw_cmd_copyin function in drivers/block/floppy.c in the Linux kernel through 3.14.3 does not properly handle error conditions during processing of an FDRAWCMD ioctl call, which allows local users to trigger kfree operations and gain privileges by leveraging write access to a /dev/fd device. (CVE-2014-1737)

The raw_cmd_copyout function in drivers/block/floppy.c in the Linux kernel through 3.14.3 does not properly restrict access to certain pointers during processing of an FDRAWCMD ioctl call, which allows local users to obtain sensitive information from kernel heap memory by leveraging write access to a /dev/fd device. (CVE-2014-1738)

Integer overflow in the ping_init_sock function in net/ipv4/ping.c in the Linux kernel through 3.14.1 allows local users to cause a denial of service (use-after-free and system crash) or possibly gain privileges via a crafted application that leverages an improperly managed reference counter. (CVE-2014-2851)

For other fixes, see the referenced changelogs.

This kernel-linus update is based on upstream -longterm 3.14.32 and fixes the following security issues:

The microcode on AMD 16h 00h through 0Fh processors does not properly handle the interaction between locked instructions and write-combined memory types, which allows local users to cause a denial of service (system hang) via a crafted application, aka the errata 793 issue (CVE-2013-6885)

The kvm_iommu_map_pages function in virt/kvm/iommu.c in the Linux kernel through 3.16.1 miscalculates the number of pages during the handling of a mapping failure, which allows guest OS users to (1) cause a denial of service (host OS memory corruption) or possibly have unspecified other impact by triggering a large gfn value or (2) cause a denial of service (host OS memory consumption) by triggering a small gfn value that leads to permanently pinned pages (CVE-2014-3601).

The WRMSR processing functionality in the KVM subsystem in the Linux kernel through 3.17.2 does not properly handle the writing of a non- canonical address to a model-specific register, which allows guest OS users to cause a denial of service (host OS crash) by leveraging guest OS privileges, related to the wrmsr_interception function in arch/x86/kvm/svm.c and the handle_wrmsr function in arch/x86/kvm/vmx.c (CVE-2014-3610).

Race condition in the __kvm_migrate_pit_timer function in arch/x86/kvm/i8254.c in the KVM subsystem in the Linux kernel through 3.17.2 allows guest OS users to cause a denial of service (host OS crash) by leveraging incorrect PIT emulation (CVE-2014-3611).

arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel through 3.17.2 does not have an exit handler for the INVVPID instruction, which allows guest OS users to cause a denial of service (guest OS crash) via a crafted application (CVE-2014-3646).

arch/x86/kvm/emulate.c in the KVM subsystem in the Linux kernel through 3.17.2 does not properly perform RIP changes, which allows guest OS users to cause a denial of service (guest OS crash) via a crafted application (CVE-2014-3647).

The pivot_root implementation in fs/namespace.c in the Linux kernel through 3.17 does not properly interact with certain locations of a chroot directory, which allows local users to cause a denial of service (mount-tree loop) via . (dot) values in both arguments to the pivot_root system call (CVE-2014-7970).

arch/x86/kernel/tls.c in the Thread Local Storage (TLS) implementation in the Linux kernel through 3.18.1 allows local users to bypass the espfix protection mechanism, and consequently makes it easier for local users to bypass the ASLR protection mechanism, via a crafted application that makes a set_thread_area system call and later reads a 16-bit value (CVE-2014-8133).

The paravirt_ops_setup function in arch/x86/kernel/kvm.c in the Linux kernel through 3.18 uses an improper paravirt_enabled setting for KVM guest kernels, which makes it easier for guest OS users to bypass the ASLR protection mechanism via a crafted application that reads a 16-bit value (CVE-2014-8134).

The Linux kernel through 3.17.4 does not properly restrict dropping of supplemental group memberships in certain namespace scenarios, which allows local users to bypass intended file permissions by leveraging a POSIX ACL containing an entry for the group category that is more restrictive than the entry for the other category, aka a "negative groups" issue, related to kernel/groups.c, kernel/uid16.c, and kernel/user_namespace.c (CVE-2014-8989).

arch/x86/kernel/entry_64.S in the Linux kernel before 3.17.5 does not properly handle faults associated with the Stack Segment (SS) segment register, which allows local users to gain privileges by triggering an IRET instruction that leads to access to a GS Base address from the wrong space (CVE-2014-9322).

On x86_64 Linux kernels a malicious user program can do a partial ASLR bypass through TLS base addresses leak when attacking other programs (CVE-2014-9419).

Linux kernel built with the iso9660 file…

This kernel-tmb update is based on upstream -longterm 3.14.32 and fixes the following security issues:

The microcode on AMD 16h 00h through 0Fh processors does not properly handle the interaction between locked instructions and write-combined memory types, which allows local users to cause a denial of service (system hang) via a crafted application, aka the errata 793 issue (CVE-2013-6885)

The kvm_iommu_map_pages function in virt/kvm/iommu.c in the Linux kernel through 3.16.1 miscalculates the number of pages during the handling of a mapping failure, which allows guest OS users to (1) cause a denial of service (host OS memory corruption) or possibly have unspecified other impact by triggering a large gfn value or (2) cause a denial of service (host OS memory consumption) by triggering a small gfn value that leads to permanently pinned pages (CVE-2014-3601).

The WRMSR processing functionality in the KVM subsystem in the Linux kernel through 3.17.2 does not properly handle the writing of a non- canonical address to a model-specific register, which allows guest OS users to cause a denial of service (host OS crash) by leveraging guest OS privileges, related to the wrmsr_interception function in arch/x86/kvm/svm.c and the handle_wrmsr function in arch/x86/kvm/vmx.c (CVE-2014-3610).

Race condition in the __kvm_migrate_pit_timer function in arch/x86/kvm/i8254.c in the KVM subsystem in the Linux kernel through 3.17.2 allows guest OS users to cause a denial of service (host OS crash) by leveraging incorrect PIT emulation (CVE-2014-3611).

arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel through 3.17.2 does not have an exit handler for the INVVPID instruction, which allows guest OS users to cause a denial of service (guest OS crash) via a crafted application (CVE-2014-3646).

arch/x86/kvm/emulate.c in the KVM subsystem in the Linux kernel through 3.17.2 does not properly perform RIP changes, which allows guest OS users to cause a denial of service (guest OS crash) via a crafted application (CVE-2014-3647).

The pivot_root implementation in fs/namespace.c in the Linux kernel through 3.17 does not properly interact with certain locations of a chroot directory, which allows local users to cause a denial of service (mount-tree loop) via . (dot) values in both arguments to the pivot_root system call (CVE-2014-7970).

arch/x86/kernel/tls.c in the Thread Local Storage (TLS) implementation in the Linux kernel through 3.18.1 allows local users to bypass the espfix protection mechanism, and consequently makes it easier for local users to bypass the ASLR protection mechanism, via a crafted application that makes a set_thread_area system call and later reads a 16-bit value (CVE-2014-8133).

The paravirt_ops_setup function in arch/x86/kernel/kvm.c in the Linux kernel through 3.18 uses an improper paravirt_enabled setting for KVM guest kernels, which makes it easier for guest OS users to bypass the ASLR protection mechanism via a crafted application that reads a 16-bit value (CVE-2014-8134).

The Linux kernel through 3.17.4 does not properly restrict dropping of supplemental group memberships in certain namespace scenarios, which allows local users to bypass intended file permissions by leveraging a POSIX ACL containing an entry for the group category that is more restrictive than the entry for the other category, aka a "negative groups" issue, related to kernel/groups.c, kernel/uid16.c, and kernel/user_namespace.c (CVE-2014-8989).

arch/x86/kernel/entry_64.S in the Linux kernel before 3.17.5 does not properly handle faults associated with the Stack Segment (SS) segment register, which allows local users to gain privileges by triggering an IRET instruction that leads to access to a GS Base address from the wrong space (CVE-2014-9322).

On x86_64 Linux kernels a malicious user program can do a partial ASLR bypass through TLS base addresses leak when attacking other programs (CVE-2014-9419).

Linux kernel built with the iso9660 file…

This kernel-rt update provides as upgrade to upstream 3.14 longterm branch, currently based on 3.14.32 and fixes the following security issues:

The microcode on AMD 16h 00h through 0Fh processors does not properly handle the interaction between locked instructions and write-combined memory types, which allows local users to cause a denial of service (system hang) via a crafted application, aka the errata 793 issue (CVE-2013-6885)

Array index error in the aio_read_events_ring function in fs/aio.c in the Linux kernel through 3.15.1 allows local users to obtain sensitive information from kernel memory via a large head value (CVE-2014-0206).

media-device: fix infoleak in ioctl media_enum_entities() (CVE-2014-1739)

The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresses, which allows local users to gain privileges via a crafted FUTEX_REQUEUE command that facilitates unsafe waiter modification. (CVE-2014-3153)

The kvm_iommu_map_pages function in virt/kvm/iommu.c in the Linux kernel through 3.16.1 miscalculates the number of pages during the handling of a mapping failure, which allows guest OS users to (1) cause a denial of service (host OS memory corruption) or possibly have unspecified other impact by triggering a large gfn value or (2) cause a denial of service (host OS memory consumption) by triggering a small gfn value that leads to permanently pinned pages (CVE-2014-3601).

The WRMSR processing functionality in the KVM subsystem in the Linux kernel through 3.17.2 does not properly handle the writing of a non- canonical address to a model-specific register, which allows guest OS users to cause a denial of service (host OS crash) by leveraging guest OS privileges, related to the wrmsr_interception function in arch/x86/kvm/svm.c and the handle_wrmsr function in arch/x86/kvm/vmx.c (CVE-2014-3610).

Race condition in the __kvm_migrate_pit_timer function in arch/x86/kvm/i8254.c in the KVM subsystem in the Linux kernel through 3.17.2 allows guest OS users to cause a denial of service (host OS crash) by leveraging incorrect PIT emulation (CVE-2014-3611).

arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel through 3.17.2 does not have an exit handler for the INVVPID instruction, which allows guest OS users to cause a denial of service (guest OS crash) via a crafted application (CVE-2014-3646).

arch/x86/kvm/emulate.c in the KVM subsystem in the Linux kernel through 3.17.2 does not properly perform RIP changes, which allows guest OS users to cause a denial of service (guest OS crash) via a crafted application (CVE-2014-3647).

kernel/auditsc.c in the Linux kernel through 3.14.5, when CONFIG_AUDITSYSCALL is enabled with certain syscall rules, allows local users to obtain potentially sensitive single-bit values from kernel memory or cause a denial of service (OOPS) via a large value of a syscall number. To avoid this and other issues CONFIG_AUDITSYSCALL has been disabled. (CVE-2014-3917)

The capabilities implementation in the Linux kernel before 3.14.8 does not properly consider that namespaces are inapplicable to inodes, which allows local users to bypass intended chmod restrictions by first creating a user namespace, as demonstrated by setting the setgid bit on a file with group ownership of root (CVE-2014-4014)

mm/shmem.c in the Linux kernel through 3.15.1 does not properly implement the interaction between range notification and hole punching, which allows local users to cause a denial of service (i_mutex hold) by using the mmap system call to access a hole, as demonstrated by interfering with intended shmem activity by blocking completion of (1) an MADV_REMOVE madvise call or (2) an FALLOC_FL_PUNCH_HOLE fallocate call (CVE-2014-4171).

arch/x86/kernel/entry_32.S in the Linux kernel through 3.15.1 on 32-bit x86 platforms, when syscall auditing is enabled and the sep CPU feature flag is set, allows local users to cause a denial of…

This kernel-vserver update is based on upstream -longterm 3.14.32 and fixes the following security issues:

The microcode on AMD 16h 00h through 0Fh processors does not properly handle the interaction between locked instructions and write-combined memory types, which allows local users to cause a denial of service (system hang) via a crafted application, aka the errata 793 issue (CVE-2013-6885)

The kvm_iommu_map_pages function in virt/kvm/iommu.c in the Linux kernel through 3.16.1 miscalculates the number of pages during the handling of a mapping failure, which allows guest OS users to (1) cause a denial of service (host OS memory corruption) or possibly have unspecified other impact by triggering a large gfn value or (2) cause a denial of service (host OS memory consumption) by triggering a small gfn value that leads to permanently pinned pages (CVE-2014-3601).

The WRMSR processing functionality in the KVM subsystem in the Linux kernel through 3.17.2 does not properly handle the writing of a non- canonical address to a model-specific register, which allows guest OS users to cause a denial of service (host OS crash) by leveraging guest OS privileges, related to the wrmsr_interception function in arch/x86/kvm/svm.c and the handle_wrmsr function in arch/x86/kvm/vmx.c (CVE-2014-3610).

Race condition in the __kvm_migrate_pit_timer function in arch/x86/kvm/i8254.c in the KVM subsystem in the Linux kernel through 3.17.2 allows guest OS users to cause a denial of service (host OS crash) by leveraging incorrect PIT emulation (CVE-2014-3611).

arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel through 3.17.2 does not have an exit handler for the INVVPID instruction, which allows guest OS users to cause a denial of service (guest OS crash) via a crafted application (CVE-2014-3646).

arch/x86/kvm/emulate.c in the KVM subsystem in the Linux kernel through 3.17.2 does not properly perform RIP changes, which allows guest OS users to cause a denial of service (guest OS crash) via a crafted application (CVE-2014-3647).

The pivot_root implementation in fs/namespace.c in the Linux kernel through 3.17 does not properly interact with certain locations of a chroot directory, which allows local users to cause a denial of service (mount-tree loop) via . (dot) values in both arguments to the pivot_root system call (CVE-2014-7970).

arch/x86/kernel/tls.c in the Thread Local Storage (TLS) implementation in the Linux kernel through 3.18.1 allows local users to bypass the espfix protection mechanism, and consequently makes it easier for local users to bypass the ASLR protection mechanism, via a crafted application that makes a set_thread_area system call and later reads a 16-bit value (CVE-2014-8133).

The paravirt_ops_setup function in arch/x86/kernel/kvm.c in the Linux kernel through 3.18 uses an improper paravirt_enabled setting for KVM guest kernels, which makes it easier for guest OS users to bypass the ASLR protection mechanism via a crafted application that reads a 16-bit value (CVE-2014-8134).

The Linux kernel through 3.17.4 does not properly restrict dropping of supplemental group memberships in certain namespace scenarios, which allows local users to bypass intended file permissions by leveraging a POSIX ACL containing an entry for the group category that is more restrictive than the entry for the other category, aka a "negative groups" issue, related to kernel/groups.c, kernel/uid16.c, and kernel/user_namespace.c (CVE-2014-8989).

arch/x86/kernel/entry_64.S in the Linux kernel before 3.17.5 does not properly handle faults associated with the Stack Segment (SS) segment register, which allows local users to gain privileges by triggering an IRET instruction that leads to access to a GS Base address from the wrong space (CVE-2014-9322).

On x86_64 Linux kernels a malicious user program can do a partial ASLR bypass through TLS base addresses leak when attacking other programs (CVE-2014-9419).

Linux kernel built with the iso9660…

The SUSE Linux Enterprise 11 Service Pack 3 kernel has been updated to fix various bugs and security issues.

The following security bugs have been fixed:

* 

  CVE-2014-1739: The media_device_enum_entities function in
  drivers/media/media-device.c in the Linux kernel before 3.14.6 does
  not initialize a certain data structure, which allows local users to
  obtain sensitive information from kernel memory by leveraging
  /dev/media0 read access for a MEDIA_IOC_ENUM_ENTITIES ioctl call
  (bnc#882804).

* 

  CVE-2014-4171: mm/shmem.c in the Linux kernel through 3.15.1 does not
  properly implement the interaction between range notification and
  hole punching, which allows local users to cause a denial of service
  (i_mutex hold) by using the mmap system call to access a hole, as
  demonstrated by interfering with intended shmem activity by blocking
  completion of (1) an MADV_REMOVE madvise call or (2) an
  FALLOC_FL_PUNCH_HOLE fallocate call (bnc#883518).

* 

  CVE-2014-4508: arch/x86/kernel/entry_32.S in the Linux kernel through
  3.15.1 on 32-bit x86 platforms, when syscall auditing is enabled and
  the sep CPU feature flag is set, allows local users to cause a denial
  of service (OOPS and system crash) via an invalid syscall number, as
  demonstrated by number 1000 (bnc#883724).

* 

  CVE-2014-4667: The sctp_association_free function in
  net/sctp/associola.c in the Linux kernel before 3.15.2 does not
  properly manage a certain backlog value, which allows remote
  attackers to cause a denial of service (socket outage) via a crafted
  SCTP packet (bnc#885422).

* 

  CVE-2014-4943: The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the
  Linux kernel through 3.15.6 allows local users to gain privileges by
  leveraging data-structure differences between an l2tp socket and an
  inet socket (bnc#887082).

* 

  CVE-2014-5077: The sctp_assoc_update function in net/sctp/associola.c
  in the Linux kernel through 3.15.8, when SCTP authentication is
  enabled, allows remote attackers to cause a denial of service (NULL
  pointer dereference and OOPS) by starting to establish an association
  between two endpoints immediately after an exchange of INIT and INIT
  ACK chunks to establish an earlier association between these
  endpoints in the opposite direction (bnc#889173).

* 

  CVE-2014-5471: Stack consumption vulnerability in the
  parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the
  Linux kernel through 3.16.1 allows local users to cause a denial of
  service (uncontrolled recursion, and system crash or reboot) via a
  crafted iso9660 image with a CL entry referring to a directory entry
  that has a CL entry. (bnc#892490)

* 

  CVE-2014-5472: The parse_rock_ridge_inode_internal function in
  fs/isofs/rock.c in the Linux kernel through 3.16.1 allows local users
  to cause a denial of service (unkillable mount process) via a crafted
  iso9660 image with a self-referential CL entry. (bnc#892490)

* 

  CVE-2014-2706: Race condition in the mac80211 subsystem in the Linux
  kernel before 3.13.7 allows remote attackers to cause a denial of
  service (system crash) via network traffic that improperly interacts
  with the WLAN_STA_PS_STA state (aka power-save mode), related to
  sta_info.c and tx.c. (bnc#871797)

* 

  CVE-2014-4027: The rd_build_device_space function in
  drivers/target/target_core_rd.c in the Linux kernel before 3.14 does
  not properly initialize a certain data structure, which allows local
  users to obtain sensitive information from ramdisk_mcp memory by
  leveraging access to a SCSI initiator. (bnc#882639)

* 

  CVE-2014-3153 The futex_requeue function in kernel/futex.c in the
  Linux kernel through 3.14.5 does not ensure that…

The SUSE Linux Enterprise 11 Service Pack 2 kernel was updated to fix a regression introduced by the previous update:

* scsi_dh_alua: Incorrect reference counting in the SCSI ALUA
  initialization code lead to system crashes on boot (bnc#858831).

As the update introducing the regression was marked security, this is also marked security even though this bug is not security relevant.

The SUSE Linux Enterprise 11 Service Pack 3 kernel has been updated to fix various bugs and security issues.

The following security bugs have been fixed:

* 

  CVE-2014-1739: The media_device_enum_entities function in
  drivers/media/media-device.c in the Linux kernel before 3.14.6 does
  not initialize a certain data structure, which allows local users to
  obtain sensitive information from kernel memory by leveraging
  /dev/media0 read access for a MEDIA_IOC_ENUM_ENTITIES ioctl call
  (bnc#882804).

* 

  CVE-2014-4171: mm/shmem.c in the Linux kernel through 3.15.1 does not
  properly implement the interaction between range notification and
  hole punching, which allows local users to cause a denial of service
  (i_mutex hold) by using the mmap system call to access a hole, as
  demonstrated by interfering with intended shmem activity by blocking
  completion of (1) an MADV_REMOVE madvise call or (2) an
  FALLOC_FL_PUNCH_HOLE fallocate call (bnc#883518).

* 

  CVE-2014-4508: arch/x86/kernel/entry_32.S in the Linux kernel through
  3.15.1 on 32-bit x86 platforms, when syscall auditing is enabled and
  the sep CPU feature flag is set, allows local users to cause a denial
  of service (OOPS and system crash) via an invalid syscall number, as
  demonstrated by number 1000 (bnc#883724).

* 

  CVE-2014-4667: The sctp_association_free function in
  net/sctp/associola.c in the Linux kernel before 3.15.2 does not
  properly manage a certain backlog value, which allows remote
  attackers to cause a denial of service (socket outage) via a crafted
  SCTP packet (bnc#885422).

* 

  CVE-2014-4943: The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the
  Linux kernel through 3.15.6 allows local users to gain privileges by
  leveraging data-structure differences between an l2tp socket and an
  inet socket (bnc#887082).

* 

  CVE-2014-5077: The sctp_assoc_update function in net/sctp/associola.c
  in the Linux kernel through 3.15.8, when SCTP authentication is
  enabled, allows remote attackers to cause a denial of service (NULL
  pointer dereference and OOPS) by starting to establish an association
  between two endpoints immediately after an exchange of INIT and INIT
  ACK chunks to establish an earlier association between these
  endpoints in the opposite direction (bnc#889173).

* 

  CVE-2014-5471: Stack consumption vulnerability in the
  parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the
  Linux kernel through 3.16.1 allows local users to cause a denial of
  service (uncontrolled recursion, and system crash or reboot) via a
  crafted iso9660 image with a CL entry referring to a directory entry
  that has a CL entry. (bnc#892490)

* 

  CVE-2014-5472: The parse_rock_ridge_inode_internal function in
  fs/isofs/rock.c in the Linux kernel through 3.16.1 allows local users
  to cause a denial of service (unkillable mount process) via a crafted
  iso9660 image with a self-referential CL entry. (bnc#892490)

* 

  CVE-2014-2706: Race condition in the mac80211 subsystem in the Linux
  kernel before 3.13.7 allows remote attackers to cause a denial of
  service (system crash) via network traffic that improperly interacts
  with the WLAN_STA_PS_STA state (aka power-save mode), related to
  sta_info.c and tx.c. (bnc#871797)

* 

  CVE-2014-4027: The rd_build_device_space function in
  drivers/target/target_core_rd.c in the Linux kernel before 3.14 does
  not properly initialize a certain data structure, which allows local
  users to obtain sensitive information from ramdisk_mcp memory by
  leveraging access to a SCSI initiator. (bnc#882639)

* 

  CVE-2014-3153 The futex_requeue function in kernel/futex.c in the
  Linux kernel through 3.14.5 does not ensure that…

The SUSE Linux Enterprise 11 SP1 Teradata kernel was updated to fix bugs and security issues.

Following security issues were fixed:

CVE-2011-1083: Limit the path length users can build using epoll() to avoid local attackers consuming lots of kernel CPU time.

CVE-2011-4086: Fixed a oops in jbd/jbd2 that could be caused by specific filesystem access patterns.

CVE-2011-4622: KVM: Prevent starting PIT timers in the absence of irqchip support.

CVE-2012-0045: KVM: Extend 'struct x86_emulate_ops' with 'get_cpuid' and fix missing checks in syscall emulation.

CVE-2012-0879: Fix io_context leak after clone with CLONE_IO.

CVE-2012-1090: Fixed a dentry refcount leak in the CIFS file system that could lead to a crash on unmount.

CVE-2012-1097: The regset common infrastructure assumed that regsets would always have .get and .set methods, but necessarily .active methods. Unfortunately people have since written regsets without .set method, so NULL pointer dereference attacks were possible.

Following non-security issues were fixed:

* SCSI inquiry doesn't return data on SLES 11-SP1 Xen VMs (bnc#745929).
* FC transport driver killing off the timers/work queues (bnc#734300).
* The driver ixgbevf doesn't work on newer SLES 11-SP1 kernels
  (bnc#752972).
* Pack sparsemem memmap sections closer together and in higher zones
  (bnc#743870).

Following feature was implemented:

* The megaraid_sas driver update to version 5.40-LSI (bnc#736813).

Security Issues:

* CVE-2011-1083
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1083>
* CVE-2011-4086
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4086>
* CVE-2011-4622
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4622>
* CVE-2012-0045
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0045>
* CVE-2012-0879
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0879>
* CVE-2012-1090
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1090>
* CVE-2012-1097
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1097>

The SUSE Linux Enterprise 11 Service Pack 3 kernel has been updated to fix various bugs and security issues.

The following security bugs have been fixed:

* 

  CVE-2014-1739: The media_device_enum_entities function in
  drivers/media/media-device.c in the Linux kernel before 3.14.6 does
  not initialize a certain data structure, which allows local users to
  obtain sensitive information from kernel memory by leveraging
  /dev/media0 read access for a MEDIA_IOC_ENUM_ENTITIES ioctl call
  (bnc#882804).

* 

  CVE-2014-4171: mm/shmem.c in the Linux kernel through 3.15.1 does not
  properly implement the interaction between range notification and
  hole punching, which allows local users to cause a denial of service
  (i_mutex hold) by using the mmap system call to access a hole, as
  demonstrated by interfering with intended shmem activity by blocking
  completion of (1) an MADV_REMOVE madvise call or (2) an
  FALLOC_FL_PUNCH_HOLE fallocate call (bnc#883518).

* 

  CVE-2014-4508: arch/x86/kernel/entry_32.S in the Linux kernel through
  3.15.1 on 32-bit x86 platforms, when syscall auditing is enabled and
  the sep CPU feature flag is set, allows local users to cause a denial
  of service (OOPS and system crash) via an invalid syscall number, as
  demonstrated by number 1000 (bnc#883724).

* 

  CVE-2014-4667: The sctp_association_free function in
  net/sctp/associola.c in the Linux kernel before 3.15.2 does not
  properly manage a certain backlog value, which allows remote
  attackers to cause a denial of service (socket outage) via a crafted
  SCTP packet (bnc#885422).

* 

  CVE-2014-4943: The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the
  Linux kernel through 3.15.6 allows local users to gain privileges by
  leveraging data-structure differences between an l2tp socket and an
  inet socket (bnc#887082).

* 

  CVE-2014-5077: The sctp_assoc_update function in net/sctp/associola.c
  in the Linux kernel through 3.15.8, when SCTP authentication is
  enabled, allows remote attackers to cause a denial of service (NULL
  pointer dereference and OOPS) by starting to establish an association
  between two endpoints immediately after an exchange of INIT and INIT
  ACK chunks to establish an earlier association between these
  endpoints in the opposite direction (bnc#889173).

* 

  CVE-2014-5471: Stack consumption vulnerability in the
  parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the
  Linux kernel through 3.16.1 allows local users to cause a denial of
  service (uncontrolled recursion, and system crash or reboot) via a
  crafted iso9660 image with a CL entry referring to a directory entry
  that has a CL entry. (bnc#892490)

* 

  CVE-2014-5472: The parse_rock_ridge_inode_internal function in
  fs/isofs/rock.c in the Linux kernel through 3.16.1 allows local users
  to cause a denial of service (unkillable mount process) via a crafted
  iso9660 image with a self-referential CL entry. (bnc#892490)

* 

  CVE-2014-2706: Race condition in the mac80211 subsystem in the Linux
  kernel before 3.13.7 allows remote attackers to cause a denial of
  service (system crash) via network traffic that improperly interacts
  with the WLAN_STA_PS_STA state (aka power-save mode), related to
  sta_info.c and tx.c. (bnc#871797)

* 

  CVE-2014-4027: The rd_build_device_space function in
  drivers/target/target_core_rd.c in the Linux kernel before 3.14 does
  not properly initialize a certain data structure, which allows local
  users to obtain sensitive information from ramdisk_mcp memory by
  leveraging access to a SCSI initiator. (bnc#882639)

* 

  CVE-2014-3153 The futex_requeue function in kernel/futex.c in the
  Linux kernel through 3.14.5 does not ensure that…

The SUSE Linux Enterprise 11 Service Pack 3 kernel has been updated to fix various bugs and security issues.

The following security bugs have been fixed:

* 

  CVE-2014-1739: The media_device_enum_entities function in
  drivers/media/media-device.c in the Linux kernel before 3.14.6 does
  not initialize a certain data structure, which allows local users to
  obtain sensitive information from kernel memory by leveraging
  /dev/media0 read access for a MEDIA_IOC_ENUM_ENTITIES ioctl call
  (bnc#882804).

* 

  CVE-2014-4171: mm/shmem.c in the Linux kernel through 3.15.1 does not
  properly implement the interaction between range notification and
  hole punching, which allows local users to cause a denial of service
  (i_mutex hold) by using the mmap system call to access a hole, as
  demonstrated by interfering with intended shmem activity by blocking
  completion of (1) an MADV_REMOVE madvise call or (2) an
  FALLOC_FL_PUNCH_HOLE fallocate call (bnc#883518).

* 

  CVE-2014-4508: arch/x86/kernel/entry_32.S in the Linux kernel through
  3.15.1 on 32-bit x86 platforms, when syscall auditing is enabled and
  the sep CPU feature flag is set, allows local users to cause a denial
  of service (OOPS and system crash) via an invalid syscall number, as
  demonstrated by number 1000 (bnc#883724).

* 

  CVE-2014-4667: The sctp_association_free function in
  net/sctp/associola.c in the Linux kernel before 3.15.2 does not
  properly manage a certain backlog value, which allows remote
  attackers to cause a denial of service (socket outage) via a crafted
  SCTP packet (bnc#885422).

* 

  CVE-2014-4943: The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the
  Linux kernel through 3.15.6 allows local users to gain privileges by
  leveraging data-structure differences between an l2tp socket and an
  inet socket (bnc#887082).

* 

  CVE-2014-5077: The sctp_assoc_update function in net/sctp/associola.c
  in the Linux kernel through 3.15.8, when SCTP authentication is
  enabled, allows remote attackers to cause a denial of service (NULL
  pointer dereference and OOPS) by starting to establish an association
  between two endpoints immediately after an exchange of INIT and INIT
  ACK chunks to establish an earlier association between these
  endpoints in the opposite direction (bnc#889173).

* 

  CVE-2014-5471: Stack consumption vulnerability in the
  parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the
  Linux kernel through 3.16.1 allows local users to cause a denial of
  service (uncontrolled recursion, and system crash or reboot) via a
  crafted iso9660 image with a CL entry referring to a directory entry
  that has a CL entry. (bnc#892490)

* 

  CVE-2014-5472: The parse_rock_ridge_inode_internal function in
  fs/isofs/rock.c in the Linux kernel through 3.16.1 allows local users
  to cause a denial of service (unkillable mount process) via a crafted
  iso9660 image with a self-referential CL entry. (bnc#892490)

* 

  CVE-2014-2706: Race condition in the mac80211 subsystem in the Linux
  kernel before 3.13.7 allows remote attackers to cause a denial of
  service (system crash) via network traffic that improperly interacts
  with the WLAN_STA_PS_STA state (aka power-save mode), related to
  sta_info.c and tx.c. (bnc#871797)

* 

  CVE-2014-4027: The rd_build_device_space function in
  drivers/target/target_core_rd.c in the Linux kernel before 3.14 does
  not properly initialize a certain data structure, which allows local
  users to obtain sensitive information from ramdisk_mcp memory by
  leveraging access to a SCSI initiator. (bnc#882639)

* 

  CVE-2014-3153 The futex_requeue function in kernel/futex.c in the
  Linux kernel through 3.14.5 does not ensure that…

The SUSE Linux Enterprise 11 Service Pack 3 kernel has been updated to fix various bugs and security issues.

The following security bugs have been fixed:

* 

  CVE-2014-1739: The media_device_enum_entities function in
  drivers/media/media-device.c in the Linux kernel before 3.14.6 does
  not initialize a certain data structure, which allows local users to
  obtain sensitive information from kernel memory by leveraging
  /dev/media0 read access for a MEDIA_IOC_ENUM_ENTITIES ioctl call
  (bnc#882804).

* 

  CVE-2014-4171: mm/shmem.c in the Linux kernel through 3.15.1 does not
  properly implement the interaction between range notification and
  hole punching, which allows local users to cause a denial of service
  (i_mutex hold) by using the mmap system call to access a hole, as
  demonstrated by interfering with intended shmem activity by blocking
  completion of (1) an MADV_REMOVE madvise call or (2) an
  FALLOC_FL_PUNCH_HOLE fallocate call (bnc#883518).

* 

  CVE-2014-4508: arch/x86/kernel/entry_32.S in the Linux kernel through
  3.15.1 on 32-bit x86 platforms, when syscall auditing is enabled and
  the sep CPU feature flag is set, allows local users to cause a denial
  of service (OOPS and system crash) via an invalid syscall number, as
  demonstrated by number 1000 (bnc#883724).

* 

  CVE-2014-4667: The sctp_association_free function in
  net/sctp/associola.c in the Linux kernel before 3.15.2 does not
  properly manage a certain backlog value, which allows remote
  attackers to cause a denial of service (socket outage) via a crafted
  SCTP packet (bnc#885422).

* 

  CVE-2014-4943: The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the
  Linux kernel through 3.15.6 allows local users to gain privileges by
  leveraging data-structure differences between an l2tp socket and an
  inet socket (bnc#887082).

* 

  CVE-2014-5077: The sctp_assoc_update function in net/sctp/associola.c
  in the Linux kernel through 3.15.8, when SCTP authentication is
  enabled, allows remote attackers to cause a denial of service (NULL
  pointer dereference and OOPS) by starting to establish an association
  between two endpoints immediately after an exchange of INIT and INIT
  ACK chunks to establish an earlier association between these
  endpoints in the opposite direction (bnc#889173).

* 

  CVE-2014-5471: Stack consumption vulnerability in the
  parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the
  Linux kernel through 3.16.1 allows local users to cause a denial of
  service (uncontrolled recursion, and system crash or reboot) via a
  crafted iso9660 image with a CL entry referring to a directory entry
  that has a CL entry. (bnc#892490)

* 

  CVE-2014-5472: The parse_rock_ridge_inode_internal function in
  fs/isofs/rock.c in the Linux kernel through 3.16.1 allows local users
  to cause a denial of service (unkillable mount process) via a crafted
  iso9660 image with a self-referential CL entry. (bnc#892490)

* 

  CVE-2014-2706: Race condition in the mac80211 subsystem in the Linux
  kernel before 3.13.7 allows remote attackers to cause a denial of
  service (system crash) via network traffic that improperly interacts
  with the WLAN_STA_PS_STA state (aka power-save mode), related to
  sta_info.c and tx.c. (bnc#871797)

* 

  CVE-2014-4027: The rd_build_device_space function in
  drivers/target/target_core_rd.c in the Linux kernel before 3.14 does
  not properly initialize a certain data structure, which allows local
  users to obtain sensitive information from ramdisk_mcp memory by
  leveraging access to a SCSI initiator. (bnc#882639)

* 

  CVE-2014-3153 The futex_requeue function in kernel/futex.c in the
  Linux kernel through 3.14.5 does not ensure that…