CVE-2017-13215

A elevation of privilege vulnerability in the Upstream kernel skcipher. Product: Android. Versions: Android kernel. Android ID: A-64386293. References: Upstream kernel.

The SUSE Linux Enterprise 12 GA LTSS kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2017-5715: Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis (bnc#1068032).

  The previous fix using CPU Microcode has been complemented by building the Linux Kernel with return trampolines aka 'retpolines'.

• CVE-2017-18079: drivers/input/serio/i8042.c allowed attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact because the port->exists value can change after it is validated (bnc#1077922)

• CVE-2015-1142857: Prevent guests from sending ethernet flow control pause frames via the PF (bnc#1077355)

• CVE-2017-17741: KVM allowed attackers to obtain potentially sensitive information from kernel memory, aka a write_mmio stack-based out-of-bounds read (bnc#1073311)

• CVE-2017-13215: Prevent elevation of privilege (bnc#1075908)

• CVE-2018-1000004: Prevent race condition in the sound system, this could have lead a deadlock and denial of service condition (bnc#1076017)

• CVE-2017-17806: The HMAC implementation did not validate that the underlying cryptographic hash algorithm is unkeyed, allowing a local attacker able to use the AF_ALG-based hash interface (CONFIG_CRYPTO_USER_API_HASH) and the SHA-3 hash algorithm (CONFIG_CRYPTO_SHA3) to cause a kernel stack buffer overflow by executing a crafted sequence of system calls that encounter a missing SHA-3 initialization (bnc#1073874)

• CVE-2017-17805: The Salsa20 encryption algorithm did not correctly handle zero-length inputs, allowing a local attacker able to use the AF_ALG-based skcipher interface (CONFIG_CRYPTO_USER_API_SKCIPHER) to cause a denial of service (uninitialized-memory free and kernel crash) or have unspecified other impact by executing a crafted sequence of system calls that use the blkcipher_walk API. Both the generic implementation (crypto/salsa20_generic.c) and x86 implementation (arch/x86/crypto/salsa20_glue.c) of Salsa20 were vulnerable (bnc#1073792)

The following non-security bugs were fixed:

• bcache allocator: send discards with correct size (bsc#1047626).
• bcache.txt: standardize document format (bsc#1076110).
• bcache: Abstract out stuff needed for sorting (bsc#1076110).
• bcache: Add a cond_resched() call to gc (bsc#1076110).
• bcache: Add a real GC_MARK_RECLAIMABLE (bsc#1076110).
• bcache: Add bch_bkey_equal_header() (bsc#1076110).
• bcache: Add bch_btree_keys_u64s_remaining() (bsc#1076110).
• bcache: Add bch_keylist_init_single() (bsc#1047626).
• bcache: Add btree_insert_node() (bnc#951638).
• bcache: Add btree_map() functions (bsc#1047626).
• bcache: Add btree_node_write_sync() (bsc#1076110).
• bcache: Add explicit keylist arg to btree_insert() (bnc#951638).
• bcache: Add make_btree_freeing_key() (bsc#1076110).
• bcache: Add on error panic/unregister setting (bsc#1047626).
• bcache: Add struct bset_sort_state (bsc#1076110).
• bcache: Add struct btree_keys (bsc#1076110).
• bcache: Allocate bounce buffers with GFP_NOWAIT (bsc#1076110).
• bcache: Avoid deadlocking in garbage collection (bsc#1076110).
• bcache: Avoid nested function definition (bsc#1076110).
• bcache: Better alloc tracepoints (bsc#1076110).
• bcache: Better full stripe scanning (bsc#1076110).
• bcache: Bkey indexing renaming (bsc#1076110).
• bcache: Break up struct search (bsc#1076110).
• bcache: Btree verify code improvements (bsc#1076110).
• bcache: Bypass torture test (bsc#1076110).
• bcache: Change refill_dirty() to always scan entire disk if necessary (bsc#1076110).
• bcache: Clean up cache_lookup_fn (bsc#1076110).
• bcache: Clean up keylist code (bnc#951638).
• bcache: Convert bch_btree_insert() to bch_btree_map_leaf_nodes() (bsc#1076110).
• bcache: Convert…

The SUSE Linux Enterprise 12 SP1 LTSS kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2017-5715: Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis (bnc#1068032).

  The previous fix using CPU Microcode has been complemented by building the Linux Kernel with return trampolines aka 'retpolines'.

• CVE-2017-18079: drivers/input/serio/i8042.c allowed attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact because the port->exists value can change after it is validated (bnc#1077922).

• CVE-2015-1142857: Prevent guests from sending ethernet flow control pause frames via the PF (bnc#1077355).

• CVE-2017-17741: KVM allowed attackers to obtain potentially sensitive information from kernel memory, aka a write_mmio stack-based out-of-bounds read (bnc#1073311).

• CVE-2017-13215: Prevent elevation of privilege (bnc#1075908).

• CVE-2018-1000004: Prevent race condition in the sound system, this could have lead a deadlock and denial of service condition (bnc#1076017).

• CVE-2017-17806: The HMAC implementation did not validate that the underlying cryptographic hash algorithm is unkeyed, allowing a local attacker able to use the AF_ALG-based hash interface (CONFIG_CRYPTO_USER_API_HASH) and the SHA-3 hash algorithm (CONFIG_CRYPTO_SHA3) to cause a kernel stack buffer overflow by executing a crafted sequence of system calls that encounter a missing SHA-3 initialization (bnc#1073874).

• CVE-2017-17805: The Salsa20 encryption algorithm did not correctly handle zero-length inputs, allowing a local attacker able to use the AF_ALG-based skcipher interface (CONFIG_CRYPTO_USER_API_SKCIPHER) to cause a denial of service (uninitialized-memory free and kernel crash) or have unspecified other impact by executing a crafted sequence of system calls that use the blkcipher_walk API. Both the generic implementation (crypto/salsa20_generic.c) and x86 implementation (arch/x86/crypto/salsa20_glue.c) of Salsa20 were vulnerable (bnc#1073792).

The following non-security bugs were fixed:

• NFS: only invalidate dentrys that are clearly invalid (bsc#1047118).
• bcache.txt: standardize document format (bsc#1076110).
• bcache: Abstract out stuff needed for sorting (bsc#1076110).
• bcache: Add a cond_resched() call to gc (bsc#1076110).
• bcache: Add a real GC_MARK_RECLAIMABLE (bsc#1076110).
• bcache: Add bch_bkey_equal_header() (bsc#1076110).
• bcache: Add bch_btree_keys_u64s_remaining() (bsc#1076110).
• bcache: Add bch_keylist_init_single() (bsc#1047626).
• bcache: Add btree_insert_node() (bnc#951638).
• bcache: Add btree_map() functions (bsc#1047626).
• bcache: Add btree_node_write_sync() (bsc#1076110).
• bcache: Add explicit keylist arg to btree_insert() (bnc#951638).
• bcache: Add make_btree_freeing_key() (bsc#1076110).
• bcache: Add on error panic/unregister setting (bsc#1047626).
• bcache: Add struct bset_sort_state (bsc#1076110).
• bcache: Add struct btree_keys (bsc#1076110).
• bcache: Allocate bounce buffers with GFP_NOWAIT (bsc#1076110).
• bcache: Avoid deadlocking in garbage collection (bsc#1076110).
• bcache: Avoid nested function definition (bsc#1076110).
• bcache: Better alloc tracepoints (bsc#1076110).
• bcache: Better full stripe scanning (bsc#1076110).
• bcache: Bkey indexing renaming (bsc#1076110).
• bcache: Break up struct search (bsc#1076110).
• bcache: Btree verify code improvements (bsc#1076110).
• bcache: Bypass torture test (bsc#1076110).
• bcache: Change refill_dirty() to always scan entire disk if necessary (bsc#1076110).
• bcache: Clean up cache_lookup_fn (bsc#1076110).
• bcache: Clean up keylist code (bnc#951638).
• bcache: Convert bch_btree_insert() to bch_btree_map_leaf_nodes() (bsc#1076110).
• bcache: Convert…

The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2017-5715: Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis (bnc#1068032).

  The previous fix using CPU Microcode has been complemented by building the Linux Kernel with return trampolines aka 'retpolines'.

• CVE-2018-5332: In the Linux kernel the rds_message_alloc_sgs() function did not validate a value that is used during DMA page allocation, leading to a heap-based out-of-bounds write (related to the rds_rdma_extra_size function in net/rds/rdma.c) (bnc#1075621).

• CVE-2018-5333: In the Linux kernel the rds_cmsg_atomic function in net/rds/rdma.c mishandled cases where page pinning fails or an invalid address is supplied, leading to an rds_atomic_free_op NULL pointer dereference (bnc#1075617).

• CVE-2017-18017: The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c in the Linux kernel allowed remote attackers to cause a denial of service (use-after-free and memory corruption) or possibly have unspecified other impact by leveraging the presence of xt_TCPMSS in an iptables action (bnc#1074488).

• CVE-2017-18079: drivers/input/serio/i8042.c in the Linux kernel allowed attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact because the port->exists value can change after it is validated (bnc#1077922).

• CVE-2015-1142857: On multiple SR-IOV cars it is possible for VF's assigned to guests to send ethernet flow control pause frames via the PF. (bnc#1077355).

• CVE-2017-17741: The KVM implementation in the Linux kernel allowed attackers to obtain potentially sensitive information from kernel memory, aka a write_mmio stack-based out-of-bounds read, related to arch/x86/kvm/x86.c and include/trace/events/kvm.h (bnc#1073311).

• CVE-2017-13215: A elevation of privilege vulnerability in the Upstream kernel skcipher. (bnc#1075908).

• CVE-2018-1000004: In the Linux kernel a race condition vulnerability existed in the sound system, this can lead to a deadlock and denial of service condition (bnc#1076017).

The following non-security bugs were fixed:

• alsa: aloop: Fix inconsistent format due to incomplete rule (bsc#1045538).
• alsa: aloop: Fix racy hw constraints adjustment (bsc#1045538).
• alsa: aloop: Release cable upon open error path (bsc#1045538).
• alsa: pcm: Abort properly at pending signal in OSS read/write loops (bsc#1045538).
• alsa: pcm: Add missing error checks in OSS emulation plugin builder (bsc#1045538).
• alsa: pcm: Allow aborting mutex lock at OSS read/write loops (bsc#1045538).
• alsa: pcm: Remove incorrect snd_BUG_ON() usages (bsc#1045538).
• alsa: pcm: Remove yet superfluous WARN_ON() (bsc#1045538).
• btrfs: cleanup unnecessary assignment when cleaning up all the residual transaction (FATE#325056).
• btrfs: copy fsid to super_block s_uuid (bsc#1080774).
• btrfs: do not wait for all the writers circularly during the transaction commit (FATE#325056).
• btrfs: do not WARN() in btrfs_transaction_abort() for IO errors (bsc#1080363).
• btrfs: fix two use-after-free bugs with transaction cleanup (FATE#325056).
• btrfs: make the state of the transaction more readable (FATE#325056).
• btrfs: qgroup: exit the rescan worker during umount (bsc#1080685).
• btrfs: qgroup: Fix dead judgement on qgroup_rescan_leaf() return value (bsc#1080685).
• btrfs: reset intwrite on transaction abort (FATE#325056).
• btrfs: set qgroup_ulist to be null after calling ulist_free() (bsc#1080359).
• btrfs: stop waiting on current trans if we aborted (FATE#325056).
• cdc-acm: apply quirk for card reader (bsc#1060279).
• cdrom: factor out common open_for_* code (bsc#1048585).
• cdrom: wait for tray to close (bsc#1048585).
• delay:…

The SUSE Linux Enterprise 11 SP3 LTSS kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2017-5715: Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis (bnc#1068032).

  The previous fix using CPU Microcode has been complemented by building the Linux Kernel with return trampolines aka 'retpolines'.

• CVE-2018-5332: In the Linux kernel the rds_message_alloc_sgs() function did not validate a value that is used during DMA page allocation, leading to a heap-based out-of-bounds write (related to the rds_rdma_extra_size function in net/rds/rdma.c) (bnc#1075621).

• CVE-2018-5333: In the Linux kernel the rds_cmsg_atomic function in net/rds/rdma.c mishandled cases where page pinning fails or an invalid address is supplied, leading to an rds_atomic_free_op NULL pointer dereference (bnc#1075617).

• CVE-2017-18017: The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c in the Linux kernel allowed remote attackers to cause a denial of service (use-after-free and memory corruption) or possibly have unspecified other impact by leveraging the presence of xt_TCPMSS in an iptables action (bnc#1074488).

• CVE-2017-18079: drivers/input/serio/i8042.c in the Linux kernel allowed attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact because the port->exists value can change after it is validated (bnc#1077922).

• CVE-2017-17741: The KVM implementation in the Linux kernel allowed attackers to obtain potentially sensitive information from kernel memory, aka a write_mmio stack-based out-of-bounds read, related to arch/x86/kvm/x86.c and include/trace/events/kvm.h (bnc#1073311).

• CVE-2017-13215: A elevation of privilege vulnerability in the Upstream kernel skcipher. (bnc#1075908).

• CVE-2018-1000004: In the Linux kernel a race condition vulnerability exists in the sound system, this can lead to a deadlock and denial of service condition (bnc#1076017).

The following non-security bugs were fixed:

• cdc-acm: apply quirk for card reader (bsc#1060279).
• Enable CPU vulnerabilities reporting via sysfs
• fork: clear thread stack upon allocation (bsc#1077560).
• kaiser: Set _PAGE_NX only if supported (bnc#1012382, bnc#1076278).
• kbuild: modversions for EXPORT_SYMBOL() for asm (bsc#1074621 bsc#1068032).
• Move kABI fixup for retpolines to proper place.
• powerpc/vdso64: Use double word compare on pointers (bsc#1070781).
• s390: add ppa to the idle loop (bnc#1077406, LTC#163910).
• s390/cpuinfo: show facilities as reported by stfle (bnc#1076849, LTC#163741).
• storvsc: do not assume SG list is continuous when doing bounce buffers (bsc#1075410).
• sysfs/cpu: Add vulnerability folder (bnc#1012382).
• sysfs/cpu: Fix typos in vulnerability documentation (bnc#1012382).
• sysfs: spectre_v2, handle spec_ctrl (bsc#1075994 bsc#1075091).
• x86/acpi: Handle SCI interrupts above legacy space gracefully (bsc#1068984).
• x86/acpi: Reduce code duplication in mp_override_legacy_irq() (bsc#1068984).
• x86/boot: Fix early command-line parsing when matching at end (bsc#1068032).
• x86/cpu: Factor out application of forced CPU caps (bsc#1075994 bsc#1075091).
• x86/cpu: Implement CPU vulnerabilites sysfs functions (bnc#1012382).
• x86/CPU: Sync CPU feature flags late (bsc#1075994 bsc#1075091).
• x86/kaiser: Populate shadow PGD with NX bit only if supported by platform (bsc#1076154 bsc#1076278).
• x86/kaiser: use trampoline stack for kernel entry.
• x86/microcode/intel: Disable late loading on model 79 (bsc#1054305).
• x86/microcode/intel: Extend BDW late-loading further with LLC size check (bsc#1054305).
• x86/microcode/intel: Extend BDW late-loading with a revision check (bsc#1054305).
• x86/microcode: Rescan feature flags upon late loading (bsc#1075994 bsc#1075091). -…

The SUSE Linux Enterprise 11 SP4 Realtime kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2017-5715: Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis (bnc#1068032).

  The previous fix using CPU Microcode has been complemented by building the Linux Kernel with return trampolines aka 'retpolines'.

• CVE-2015-1142857: On multiple SR-IOV cars it is possible for VF's assigned to guests to send ethernet flow control pause frames via the PF. This includes Linux kernel ixgbe driver, i40e/i40evf driver and the DPDK, additionally multiple vendor NIC firmware is affected (bnc#1077355).

• CVE-2017-13215: A elevation of privilege vulnerability in the Upstream kernel skcipher. (bnc#1075908).

• CVE-2017-17741: The KVM implementation in the Linux kernel allowed attackers to obtain potentially sensitive information from kernel memory, aka a write_mmio stack-based out-of-bounds read, related to arch/x86/kvm/x86.c and include/trace/events/kvm.h (bnc#1073311).

• CVE-2017-18017: The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c in the Linux kernel allowed remote attackers to cause a denial of service (use-after-free and memory corruption) or possibly have unspecified other impact by leveraging the presence of xt_TCPMSS in an iptables action (bnc#1074488).

• CVE-2017-18079: drivers/input/serio/i8042.c in the Linux kernel allowed attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact because the port->exists value can change after it is validated (bnc#1077922).

• CVE-2018-1000004: In the Linux kernel a race condition vulnerability exists in the sound system, this can lead to a deadlock and denial of service condition (bnc#1076017).

• CVE-2018-5332: In the Linux kernel the rds_message_alloc_sgs() function did not validate a value that is used during DMA page allocation, leading to a heap-based out-of-bounds write (related to the rds_rdma_extra_size function in net/rds/rdma.c) (bnc#1075621).

• CVE-2018-5333: In the Linux kernel rds_cmsg_atomic function in net/rds/rdma.c mishandled cases where page pinning fails or an invalid address is supplied, leading to an rds_atomic_free_op NULL pointer dereference (bnc#1075617).

The following non-security bugs were fixed:

• Add proper NX hadnling for !NX-capable systems also to kaiser_add_user_map(). (bsc#1076278).
• alsa: aloop: Fix inconsistent format due to incomplete rule (bsc#1045538).
• alsa: aloop: Fix racy hw constraints adjustment (bsc#1045538).
• alsa: aloop: Release cable upon open error path (bsc#1045538).
• alsa: pcm: Abort properly at pending signal in OSS read/write loops (bsc#1045538).
• alsa: pcm: Add missing error checks in OSS emulation plugin builder (bsc#1045538).
• alsa: pcm: Allow aborting mutex lock at OSS read/write loops (bsc#1045538).
• alsa: pcm: Remove incorrect snd_BUG_ON() usages (bsc#1045538).
• alsa: pcm: Remove yet superfluous WARN_ON() (bsc#1045538).
• btrfs: cleanup unnecessary assignment when cleaning up all the residual transaction (FATE#325056).
• btrfs: copy fsid to super_block s_uuid (bsc#1080774).
• btrfs: do not wait for all the writers circularly during the transaction commit (FATE#325056).
• btrfs: do not WARN() in btrfs_transaction_abort() for IO errors (bsc#1080363).
• btrfs: fix two use-after-free bugs with transaction cleanup (FATE#325056).
• btrfs: make the state of the transaction more readable (FATE#325056).
• btrfs: qgroup: exit the rescan worker during umount (bsc#1080685).
• btrfs: qgroup: Fix dead judgement on qgroup_rescan_leaf() return value (bsc#1080685).
• btrfs: reset intwrite on transaction abort (FATE#325056).
• btrfs: set qgroup_ulist to be null after calling ulist_free() (bsc#1080359).
• btrfs: stop waiting on current trans if we aborted…