CVE-2015-2666

Stack-based buffer overflow in the get_matching_model_microcode function in arch/x86/kernel/cpu/microcode/intel_early.c in the Linux kernel before 4.0 allows context-dependent attackers to gain privileges by constructing a crafted microcode header and leveraging root privileges for write access to the initrd.

The SUSE Linux Enterprise 12 kernel was updated to version 3.12.43 to receive various security and bugfixes.

Following security bugs were fixed:

• CVE-2014-3647: arch/x86/kvm/emulate.c in the KVM subsystem in the Linux kernel through 3.17.2 did not properly perform RIP changes, which allowed guest OS users to cause a denial of service (guest OS crash) via a crafted application (bsc#899192).
• CVE-2014-8086: Race condition in the ext4_file_write_iter function in fs/ext4/file.c in the Linux kernel through 3.17 allowed local users to cause a denial of service (file unavailability) via a combination of a write action and an F_SETFL fcntl operation for the O_DIRECT flag (bsc#900881).
• CVE-2014-8159: The InfiniBand (IB) implementation did not properly restrict use of User Verbs for registration of memory regions, which allowed local users to access arbitrary physical memory locations, and consequently cause a denial of service (system crash) or gain privileges, by leveraging permissions on a uverbs device under /dev/infiniband/ (bsc#914742).
• CVE-2015-1465: The IPv4 implementation in the Linux kernel before 3.18.8 did not properly consider the length of the Read-Copy Update (RCU) grace period for redirecting lookups in the absence of caching, which allowed remote attackers to cause a denial of service (memory consumption or system crash) via a flood of packets (bsc#916225).
• CVE-2015-2041: net/llc/sysctl_net_llc.c in the Linux kernel before 3.19 used an incorrect data type in a sysctl table, which allowed local users to obtain potentially sensitive information from kernel memory or possibly have unspecified other impact by accessing a sysctl entry (bsc#919007).
• CVE-2015-2042: net/rds/sysctl.c in the Linux kernel before 3.19 used an incorrect data type in a sysctl table, which allowed local users to obtain potentially sensitive information from kernel memory or possibly have unspecified other impact by accessing a sysctl entry (bsc#919018).
• CVE-2015-2666: Fixed a flaw that allowed crafted microcode to overflow the kernel stack (bsc#922944).
• CVE-2015-2830: Fixed int80 fork from 64-bit tasks mishandling (bsc#926240).
• CVE-2015-2922: Fixed possible denial of service (DoS) attack against IPv6 network stacks due to improper handling of Router Advertisements (bsc#922583).
• CVE-2015-3331: Fixed buffer overruns in RFC4106 implementation using AESNI (bsc#927257).
• CVE-2015-3332: Fixed TCP Fast Open local DoS (bsc#928135).
• CVE-2015-3339: Fixed race condition flaw between the chown() and execve() system calls which could have lead to local privilege escalation (bsc#928130).
• CVE-2015-3636: Fixed use-after-free in ping sockets which could have lead to local privilege escalation (bsc#929525).

The following non-security bugs were fixed:

• /proc/stat: convert to single_open_size() (bsc#928122).
• ACPI / sysfs: Treat the count field of counter_show() as unsigned (bsc#909312).
• Automatically Provide/Obsolete all subpackages of old flavors (bsc#925567)
• Btrfs: btrfs_release_extent_buffer_page did not free pages of dummy extent (bsc#930226).
• Btrfs: fix inode eviction infinite loop after cloning into it (bsc#930224).
• Btrfs: fix inode eviction infinite loop after extent_same ioctl (bsc#930224).
• Btrfs: fix log tree corruption when fs mounted with -o discard (bsc#927116).
• Btrfs: fix up bounds checking in lseek (bsc#927115).
• Fix rtworkqueues crash. Calling __sched_setscheduler() in interrupt context is forbidden, and destroy_worker() did so in the timer interrupt with a nohz_full config. Preclude that possibility for both boot options.
• Input: psmouse - add psmouse_matches_pnp_id helper function (bsc#929092).
• Input: synaptics - fix middle button on Lenovo 2015 products (bsc#929092).
• Input: synaptics - handle spurious release of trackstick buttons (bsc#929092).
• Input: synaptics - re-route tracksticks buttons on the Lenovo 2015 series (bsc#929092).
• Input: synaptics - remove TOPBUTTONPAD property for Lenovos 2015…

Stack-based buffer overflow in the get_matching_model_microcode function in arch/x86/kernel/cpu/microcode/intel_early.c in the Linux kernel before 4.0 allows context-dependent attackers to gain privileges by constructing a crafted microcode header and leveraging root privileges for write access to the initrd.

A stack overflow was discovered in the the microcode loader for the intel x86 platform. A local attacker could exploit this flaw to cause a denial of service (kernel crash) or to potentially execute code with kernel privileges. (CVE-2015-2666)

It was discovered that the Linux kernel's IPv6 networking stack has a flaw that allows using route advertisement (RA) messages to set the 'hop_limit' to values that are too low. An unprivileged attacker on a local network could exploit this flaw to cause a denial of service (IPv6 messages dropped). (CVE-2015-2922)

Jan Beulich discovered the Xen virtual machine subsystem of the Linux kernel did not properly restrict access to PCI command registers. A local guest user could exploit this flaw to cause a denial of service (host crash). (CVE-2015-2150)

A stack overflow was discovered in the the microcode loader for the intel x86 platform. A local attacker could exploit this flaw to cause a denial of service (kernel crash) or to potentially execute code with kernel privileges. (CVE-2015-2666)

A privilege escalation was discovered in the fork syscall via the int80 entry on 64 bit kernels with 32 bit emulation support. An unprivileged local attacker could exploit this flaw to increase their privileges on the system. (CVE-2015-2830)

It was discovered that the Linux kernel's IPv6 networking stack has a flaw that allows using route advertisement (RA) messages to set the 'hop_limit' to values that are too low. An unprivileged attacker on a local network could exploit this flaw to cause a denial of service (IPv6 messages dropped). (CVE-2015-2922)