CVE-2017-18344

The timer_create syscall implementation in kernel/time/posix-timers.c in the Linux kernel before 4.14.8 doesn't properly validate the sigevent->sigev_notify field, which leads to out-of-bounds access in the show_timer function (called when /proc/$PID/timers is read). This allows userspace applications to read arbitrary kernel memory (on a kernel built with CONFIG_POSIX_TIMERS and CONFIG_CHECKPOINT_RESTORE).

• ELS-138: netfilter: x_tables: add missing tables zeroing
• ELS-138: CVE-2021-33909: seq_file: disallow extremely large seq buffer allocation
• ELS-138: CVE-2021-22555: netfilter: x_tables: fix compat match/target pad out-of-bound write
• ELS-138: CVE-2020-29661: tty: Fix ->pgrp locking in tiocspgrp()
• ELS-138: CVE-2020-25656: vt: keyboard, extend func_buf_lock to readers
• ELS-138: CVE-2020-25656: tty/vt: fix write/write race in ioctl(KDSKBSENT) handler
• ELS-138: CVE-2020-25656: vt: keyboard, simplify vt_kdgkbsent
• ELS-138: CVE-2020-25211: netfilter: ctnetlink: add a range check for l3/l4 protonum
• ELS-138: CKSIX-276: CVE-2019-19532: HID: Fix assumption that devices have inputs
• ELS-138: CVE-2021-27365: scsi: iscsi: Ensure sysfs attributes are limited to PAGE_SIZE
• ELS-138: CVE-2021-27365: scsi: iscsi: Verify lengths on passthrough PDUs
• ELS-138: CVE-2021-27363: CVE-2021-27364: scsi: iscsi: Restrict sessions and handles to admin capabilities
• ELS-138: sysfs: Add sysfs_emit and sysfs_emit_at to format sysfs output
• ELS-138: USB: hso: Fix OOB memory access in hso_probe/hso_get_config_data
• ELS-138: CVE-2019-14615: drm/i915/gen9: Clear residual context state on context switch
• ELS-138: CVE-2020-8647, CVE-2020-8649: vgacon: Fix a UAF in vgacon_invert_region
• ELS-138: CVE-2020-14331: vgacon: Fix for missing check in scrollback handling
• ELS-138: CVE-2021-3347: futex: Handle faults correctly for PI futexes
• ELS-138: CVE-2021-3347: futex: Provide and use pi_state_update_owner()
• ELS-138: KEYS: allow reaching the keys quotas exactly
• ELS-138: KEYS: reaching the keys quotas correctly
• ELS-138: fix -ENOMEM result with invalid user space pointer in sendto() syscall
• ELS-138: CVE-2017-18344: posix-timer: Properly check sigevent->sigev_notify
• ELS-138: CVE-2018-6927: futex: Prevent overflow by strengthen input validation
• ELS-138: CVE-2017-6951: KEYS: Change the name of the dead type to ".dead" to prevent user access
• ELS-138: CVE-2017-15299: KEYS: don't let add_key() update an uninstantiated key
• ELS-138: fix CVE-2016-9604
• ELS-138: KEYS: add missing permission check for request_key() destination
• ELS-138: CVE-2017-10661: timerfd: Protect the might cancel mechanism proper
• ELS-138: fix CVE-2017-7472
• ELS-138: fix CVE-2017-15274

• CKSIX-267: USB: hso: Fix OOB memory access in hso_probe/hso_get_config_data
• CKSIX-267: CVE-2019-14615: drm/i915/gen9: Clear residual context state on context switch
• CKSIX-267: CVE-2020-8647, CVE-2020-8649: vgacon: Fix a UAF in vgacon_invert_region
• CKSIX-267: CVE-2020-14331: vgacon: Fix for missing check in scrollback handling
• CKSIX-268: CVE-2021-3347: futex: Handle faults correctly for PI futexes
• CKSIX-268: CVE-2021-3347: futex: Provide and use pi_state_update_owner()
• CKSIX-263: KEYS: allow reaching the keys quotas exactly
• CKSIX-263: KEYS: reaching the keys quotas correctly
• CKSIX-263: fix -ENOMEM result with invalid user space pointer in sendto() syscall
• CKSIX-263: CVE-2017-18344: posix-timer: Properly check sigevent->sigev_notify
• CKSIX-263: CVE-2018-6927: futex: Prevent overflow by strengthen input validation
• CKSIX-258: CVE-2017-6951: KEYS: Change the name of the dead type to ".dead" to prevent user access
• CKSIX-258: CVE-2017-15299: KEYS: don't let add_key() update an uninstantiated key
• CKSIX-258: fix CVE-2016-9604
• CKSIX-258: KEYS: add missing permission check for request_key() destination
• CKSIX-258: CVE-2017-10661: timerfd: Protect the might cancel mechanism proper
• CKSIX-258: fix CVE-2017-7472
• CKSIX-258: fix CVE-2017-15274

This kernel update provides an upgrade to the 4.14 longterm branch, currently based on 4.14.10. It also fixes at least the following security issues:

An elevation of privilege vulnerability in the Broadcom wi-fi driver (CVE-2017-0786).

Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem in the Linux kernel allows attackers to gain privileges via unspecified vectors (CVE-2017-0861).

Linux kernel built with the Kernel-based Virtual Machine(CONFIG_KVM) support is vulnerable to an incorrect debug exception(#DB) error. It could occur while emulating a syscall instruction. A user/process inside guest could use this flaw to potentially escalate their privileges inside guest. Linux guests are not affected.(CVE-2017-7518).

arch/x86/kvm/mmu.c in the Linux kernel through 4.13.5, when nested virtualisation is used, does not properly traverse guest pagetable entries to resolve a guest virtual address, which allows L1 guest OS users to execute arbitrary code on the host OS or cause a denial of service (incorrect index during page walking, and host OS crash), aka an "MMU potential stack buffer overrun" (CVE-2017-12188).

The bio_map_user_iov and bio_unmap_user functions in block/bio.c in the Linux kernel before 4.13.8 do unbalanced refcounting when a SCSI I/O vector has small consecutive buffers belonging to the same page. The bio_add_pc_page function merges them into one, but the page reference is never dropped. This causes a memory leak and possible system lockup (exploitable against the host OS by a guest OS user, if a SCSI disk is passed through to a virtual machine) due to an out-of-memory condition (CVE-2017-12190).

The assoc_array_insert_into_terminal_node function in lib/assoc_array.c in the Linux kernel before 4.13.11 mishandles node splitting, which allows local users to cause a denial of service (NULL pointer dereference and panic) via a crafted application, as demonstrated by the keyring key type, and key addition and link creation operations (CVE-2017-12193).

Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the group key handshake, allowing an attacker within radio range to replay frames from access points to clients (CVE-2017-13080).

The sctp_do_peeloff function in net/sctp/socket.c in the Linux kernel before 4.14 does not check whether the intended netns is used in a peel-off action, which allows local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via crafted system calls (CVE-2017-15115).

Race condition in the ALSA subsystem in the Linux kernel before 4.13.8 allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted /dev/snd/seq ioctl calls, related to sound/core/seq/seq_clientmgr.c and sound/core/seq/seq_ports.c (CVE-2017-15265)

The KEYS subsystem in the Linux kernel through 4.13.7 mishandles use of add_key for a key that already exists but is uninstantiated, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted system call (CVE-2017-15299).

The XFRM dump policy implementation in net/xfrm/xfrm_user.c in the Linux kernel before 4.13.11 allows local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages (CVE-2017-16939).

The walk_hugetlb_range function in mm/pagewalk.c in the Linux kernel before 4.14.2 mishandles holes in hugetlb ranges, which allows local users to obtain sensitive information from uninitialized kernel memory via crafted use of the mincore() system call (CVE-2017-16994).

The check_alu_op function in kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging…

This kernel-tmb update provides an upgrade to the 4.14 longterm branch, currently based on 4.14.10. It also fixes at least the following security issues:

An elevation of privilege vulnerability in the Broadcom wi-fi driver (CVE-2017-0786).

Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem in the Linux kernel allows attackers to gain privileges via unspecified vectors (CVE-2017-0861).

Linux kernel built with the Kernel-based Virtual Machine(CONFIG_KVM) support is vulnerable to an incorrect debug exception(#DB) error. It could occur while emulating a syscall instruction. A user/process inside guest could use this flaw to potentially escalate their privileges inside guest. Linux guests are not affected.(CVE-2017-7518).

arch/x86/kvm/mmu.c in the Linux kernel through 4.13.5, when nested virtualisation is used, does not properly traverse guest pagetable entries to resolve a guest virtual address, which allows L1 guest OS users to execute arbitrary code on the host OS or cause a denial of service (incorrect index during page walking, and host OS crash), aka an "MMU potential stack buffer overrun" (CVE-2017-12188).

The bio_map_user_iov and bio_unmap_user functions in block/bio.c in the Linux kernel before 4.13.8 do unbalanced refcounting when a SCSI I/O vector has small consecutive buffers belonging to the same page. The bio_add_pc_page function merges them into one, but the page reference is never dropped. This causes a memory leak and possible system lockup (exploitable against the host OS by a guest OS user, if a SCSI disk is passed through to a virtual machine) due to an out-of-memory condition (CVE-2017-12190).

The assoc_array_insert_into_terminal_node function in lib/assoc_array.c in the Linux kernel before 4.13.11 mishandles node splitting, which allows local users to cause a denial of service (NULL pointer dereference and panic) via a crafted application, as demonstrated by the keyring key type, and key addition and link creation operations (CVE-2017-12193).

Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the group key handshake, allowing an attacker within radio range to replay frames from access points to clients (CVE-2017-13080).

The sctp_do_peeloff function in net/sctp/socket.c in the Linux kernel before 4.14 does not check whether the intended netns is used in a peel-off action, which allows local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via crafted system calls (CVE-2017-15115).

Race condition in the ALSA subsystem in the Linux kernel before 4.13.8 allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted /dev/snd/seq ioctl calls, related to sound/core/seq/seq_clientmgr.c and sound/core/seq/seq_ports.c (CVE-2017-15265)

The KEYS subsystem in the Linux kernel through 4.13.7 mishandles use of add_key for a key that already exists but is uninstantiated, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted system call (CVE-2017-15299).

The XFRM dump policy implementation in net/xfrm/xfrm_user.c in the Linux kernel before 4.13.11 allows local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages (CVE-2017-16939).

The walk_hugetlb_range function in mm/pagewalk.c in the Linux kernel before 4.14.2 mishandles holes in hugetlb ranges, which allows local users to obtain sensitive information from uninitialized kernel memory via crafted use of the mincore() system call (CVE-2017-16994).

The check_alu_op function in kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging…

This kernel-linus update provides an upgrade to the 4.14 longterm branch, currently based on 4.14.10. It also fixes at least the following security issues:

An elevation of privilege vulnerability in the Broadcom wi-fi driver (CVE-2017-0786).

Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem in the Linux kernel allows attackers to gain privileges via unspecified vectors (CVE-2017-0861).

Linux kernel built with the Kernel-based Virtual Machine(CONFIG_KVM) support is vulnerable to an incorrect debug exception(#DB) error. It could occur while emulating a syscall instruction. A user/process inside guest could use this flaw to potentially escalate their privileges inside guest. Linux guests are not affected.(CVE-2017-7518).

arch/x86/kvm/mmu.c in the Linux kernel through 4.13.5, when nested virtualisation is used, does not properly traverse guest pagetable entries to resolve a guest virtual address, which allows L1 guest OS users to execute arbitrary code on the host OS or cause a denial of service (incorrect index during page walking, and host OS crash), aka an "MMU potential stack buffer overrun" (CVE-2017-12188).

The bio_map_user_iov and bio_unmap_user functions in block/bio.c in the Linux kernel before 4.13.8 do unbalanced refcounting when a SCSI I/O vector has small consecutive buffers belonging to the same page. The bio_add_pc_page function merges them into one, but the page reference is never dropped. This causes a memory leak and possible system lockup (exploitable against the host OS by a guest OS user, if a SCSI disk is passed through to a virtual machine) due to an out-of-memory condition (CVE-2017-12190).

The assoc_array_insert_into_terminal_node function in lib/assoc_array.c in the Linux kernel before 4.13.11 mishandles node splitting, which allows local users to cause a denial of service (NULL pointer dereference and panic) via a crafted application, as demonstrated by the keyring key type, and key addition and link creation operations (CVE-2017-12193).

Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the group key handshake, allowing an attacker within radio range to replay frames from access points to clients (CVE-2017-13080).

The sctp_do_peeloff function in net/sctp/socket.c in the Linux kernel before 4.14 does not check whether the intended netns is used in a peel-off action, which allows local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via crafted system calls (CVE-2017-15115).

Race condition in the ALSA subsystem in the Linux kernel before 4.13.8 allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted /dev/snd/seq ioctl calls, related to sound/core/seq/seq_clientmgr.c and sound/core/seq/seq_ports.c (CVE-2017-15265)

The KEYS subsystem in the Linux kernel through 4.13.7 mishandles use of add_key for a key that already exists but is uninstantiated, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted system call (CVE-2017-15299).

The XFRM dump policy implementation in net/xfrm/xfrm_user.c in the Linux kernel before 4.13.11 allows local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages (CVE-2017-16939).

The walk_hugetlb_range function in mm/pagewalk.c in the Linux kernel before 4.14.2 mishandles holes in hugetlb ranges, which allows local users to obtain sensitive information from uninitialized kernel memory via crafted use of the mincore() system call (CVE-2017-16994).

The check_alu_op function in kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging…

The SUSE Linux Enterprise 15 kernel-azure was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-5390 aka 'SegmentSmack': A remote attacker even with relatively low bandwidth could have caused lots of CPU usage by triggering the worst case scenario during IP and/or TCP fragment reassembly (bsc#1102340)
• CVE-2017-18344: The timer_create syscall implementation didn't properly validate input, which could have lead to out-of-bounds access. This allowed userspace applications to read arbitrary kernel memory in some setups. (bsc#1102851)
• CVE-2018-13406: An integer overflow in the uvesafb_setcmap function could have result in local attackers being able to crash the kernel or potentially elevate privileges because kmalloc_array is not used (bnc#1100418)
• CVE-2018-13053: The alarm_timer_nsleep function had an integer overflow via a large relative timeout because ktime_add_safe was not used (bnc#1099924)
• CVE-2018-13405: The inode_init_owner function allowed local users to create files with an unintended group ownership allowing attackers to escalate privileges by making a plain file executable and SGID (bnc#1100416)
• CVE-2017-5753: Systems with microprocessors utilizing speculative execution and branch prediction may have allowed unauthorized disclosure of information to an attacker with local user access via a side-channel analysis (bsc#1068032)
• CVE-2018-1118: Linux kernel vhost did not properly initialize memory in messages passed between virtual guests and the host operating system. This could have allowed local privileged users to read some kernel memory contents when reading from the /dev/vhost-net device file (bsc#1092472)

The following non-security bugs were fixed:

• 1wire: family module autoload fails because of upper/lower case mismatch (bsc#1051510)
• 8139too: Use disable_irq_nosync() in rtl8139_poll_controller() (networking-stable-18_05_15)
• acpi / LPSS: Add missing prv_offset setting for byt/cht PWM devices (bsc#1051510)
• acpi / processor: Finish making acpi_processor_ppc_has_changed() void (bsc#1051510)
• acpi / watchdog: properly initialize resources (bsc#1051510)
• acpi, APEI, EINJ: Subtract any matching Register Region from Trigger resources (bsc#1051510)
• acpi, nfit: Fix scrub idle detection (bsc#1094119)
• acpi/nfit: fix cmd_rc for acpi_nfit_ctl to always return a value (bsc#1051510)
• acpi: Add helper for deactivating memory region (bsc#1100132)
• ahci: Disable LPM on Lenovo 50 series laptops with a too old BIOS (bsc#1051510)
• alsa: hda - Handle pm failure during hotplug (bsc#1051510)
• alsa: hda/ca0132 - use ARRAY_SIZE (bsc#1051510)
• alsa: hda/ca0132: Delete pointless assignments to struct auto_pin_cfg fields (bsc#1051510)
• alsa: hda/ca0132: Delete redundant UNSOL event requests (bsc#1051510)
• alsa: hda/ca0132: Do not test for QUIRK_NONE (bsc#1051510)
• alsa: hda/ca0132: Fix DMic data rate for Alienware M17x R4 (bsc#1051510)
• alsa: hda/ca0132: Restore PCM Analog Mic-In2 (bsc#1051510)
• alsa: hda/ca0132: Restore behavior of QUIRK_ALIENWARE (bsc#1051510)
• alsa: hda/ca0132: make array ca0132_alt_chmaps static (bsc#1051510)
• alsa: hda/realtek - Add Panasonic CF-SZ6 headset jack quirk (bsc#1051510)
• alsa: hda/realtek - Add a quirk for FSC ESPRIMO U9210 (bsc#1051510)
• alsa: hda/realtek - Fix pop noise on Lenovo P50 and co (bsc#1051510)
• alsa: hda/realtek - Fix the problem of two front mics on more machines (bsc#1051510)
• alsa: hda/realtek - Yet another Clevo P950 quirk entry (bsc#1101143)
• alsa: hda/realtek - two more lenovo models need fixup of MIC_LOCATION (bsc#1051510)
• alsa: hda: add mute led support for HP ProBook 455 G5 (bsc#1051510)
• alsa: rawmidi: Change resized buffers atomically (bsc#1051510)
• alsa: seq: Fix UBSAN warning at SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT ioctl (bsc#1051510)
• alsa: timer: Fix UBSAN warning at SNDRV_TIMER_IOCTL_NEXT_DEVICE ioctl (bsc#1051510)
• alx: take rtnl before calling __alx_open…

The SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

CVE-2018-5390 aka SegmentSmack: A remote attacker even with relatively low bandwidth could have caused lots of CPU usage by triggering the worst case scenario during IP and/or TCP fragment reassembly (bsc#1102340) CVE-2017-18344: The timer_create syscall implementation didn't properly validate input, which could have lead to out-of-bounds access. This allowed userspace applications to read arbitrary kernel memory in some setups. (bsc#1102851)

The following non-security bugs were fixed:

• acpi, apei, einj: Subtract any matching Register Region from Trigger resources (bsc#1051510).
• acpi, nfit: Fix scrub idle detection (bsc#1094119).
• acpi/nfit: fix cmd_rc for acpi_nfit_ctl to always return a value (bsc#1051510).
• acpi/processor: Finish making acpi_processor_ppc_has_changed() void (bsc#1051510).
• ahci: Disable Lpm on Lenovo 50 series laptops with a too old BIOS (bsc#1051510).
• alsa: hda - Handle pm failure during hotplug (bsc#1051510).
• alsa: hda/realtek - Add Panasonic CF-SZ6 headset jack quirk (bsc#1051510).
• alsa: hda/realtek - Yet another Clevo P950 quirk entry (bsc#1101143).
• alsa: hda/realtek - two more lenovo models need fixup of MIC_LOCATION (bsc#1051510).
• alsa: hda: add mute led support for HP ProBook 455 G5 (bsc#1051510).
• alsa: rawmidi: Change resized buffers atomically (bsc#1051510).
• alx: take rtnl before calling __alx_open from resume (bsc#1051510).
• arm64: kpti: Use early_param for kpti= command-line option (bsc#1103220).
• arm: module: fix modsign build error (bsc#1093666).
• asoc: mediatek: preallocate pages use platform device (bsc#1051510).
• ath9k_htc: Add a sanity check in ath9k_htc_ampdu_action() (bsc#1051510).
• atl1c: reserve min skb headroom (bsc#1051510).
• audit: Fix wrong task in comparison of session ID (bsc#1051510).
• audit: ensure that 'audit=1' actually enables audit for PID 1 (bsc#1051510).
• audit: return on memory error to avoid null pointer dereference (bsc#1051510).
• b44: Initialize 64-bit stats seqcount (bsc#1051510).
• backlight: as3711_bl: Fix Device Tree node leaks (bsc#1051510).
• backlight: lm3630a: Bump REG_MAX value to 0x50 instead of 0x1F (bsc#1051510).
• batman-adv: Accept only filled wifi station info (bsc#1051510).
• batman-adv: Always initialize fragment header priority (bsc#1051510).
• batman-adv: Avoid race in TT TVLV allocator helper (bsc#1051510).
• batman-adv: Avoid storing non-TT-sync flags on singular entries too (bsc#1051510).
• batman-adv: Fix TT sync flags for intermediate TT responses (bsc#1051510).
• batman-adv: Fix bat_ogm_iv best gw refcnt after netlink dump (bsc#1051510).
• batman-adv: Fix bat_v best gw refcnt after netlink dump (bsc#1051510).
• batman-adv: Fix check of retrieved orig_gw in batadv_v_gw_is_eligible (bsc#1051510).
• batman-adv: Fix debugfs path for renamed hardif (bsc#1051510).
• batman-adv: Fix debugfs path for renamed softif (bsc#1051510).
• batman-adv: Fix internal interface indices types (bsc#1051510).
• batman-adv: Fix lock for ogm cnt access in batadv_iv_ogm_calc_tq (bsc#1051510).
• batman-adv: Fix multicast packet loss with a single WANT_ALL_IPV4/6 flag (bsc#1051510).
• batman-adv: Fix netlink dumping of BLA backbones (bsc#1051510).
• batman-adv: Fix netlink dumping of BLA claims (bsc#1051510).
• batman-adv: Fix skbuff rcsum on packet reroute (bsc#1051510).
• batman-adv: Ignore invalid batadv_iv_gw during netlink send (bsc#1051510).
• batman-adv: Ignore invalid batadv_v_gw during netlink send (bsc#1051510).
• batman-adv: Use default throughput value on cfg80211 error (bsc#1051510).
• batman-adv: fix TT sync flag inconsistencies (bsc#1051510).
• batman-adv: fix header size check in batadv_dbg_arp() (bsc#1051510).
• batman-adv: fix multicast-via-unicast transmission with AP isolation (bsc#1051510).
• batman-adv: fix packet checksum in receive path (bsc#1051510).
• batman-adv: fix packet…

The SUSE Linux Enterprise 12 SP3 kernel was updated to 4.4.143 to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-5390 aka 'SegmentSmack': Linux kernel could be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service (bnc#1102340).
• CVE-2018-14734: drivers/infiniband/core/ucma.c in the Linux kernel allowed ucma_leave_multicast to access a certain data structure after a cleanup step in ucma_process_join, which allowed attackers to cause a denial of service (use-after-free) (bnc#1103119).
• CVE-2017-18344: The timer_create syscall implementation in kernel/time/posix-timers.c didn't properly validate the sigevent->sigev_notify field, which lead to out-of-bounds access in the show_timer function (called when /proc/$PID/timers is read). This allowed userspace applications to read arbitrary kernel memory (on a kernel built with CONFIG_POSIX_TIMERS and CONFIG_CHECKPOINT_RESTORE) (bnc#1102851 bnc#1103580).
• CVE-2018-3620: Local attackers on baremetal systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data. (bnc#1087081).
• CVE-2018-3646: Local attackers in virtualized guest systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data, even from other virtual machines or the host system. (bnc#1089343).

The following non-security bugs were fixed:

• Add support for 5,25,50, and 100G to 802.3ad bonding driver (bsc#1096978)
• ahci: Disable LPM on Lenovo 50 series laptops with a too old BIOS (bnc#1012382).
• arm64: do not open code page table entry creation (bsc#1102197).
• arm64: kpti: Use early_param for kpti= command-line option (bsc#1102188).
• arm64: Make sure permission updates happen for pmd/pud (bsc#1102197).
• atm: zatm: Fix potential Spectre v1 (bnc#1012382).
• bcm63xx_enet: correct clock usage (bnc#1012382).
• bcm63xx_enet: do not write to random DMA channel on BCM6345 (bnc#1012382).
• blacklist 9fb8d5dc4b64 ('stop_machine: Disable preemption when waking two stopper threads') Preemption is already disabled inside cpu_stop_queue_two_works() in SLE12-SP3 because it does not have commit 6a19005157c4 ('stop_machine: Do not disable preemption in stop_two_cpus()')
• block: copy ioprio in __bio_clone_fast() (bsc#1082653).
• bpf: fix loading of BPF_MAXINSNS sized programs (bsc#1012382).
• bpf, x64: fix memleak when not converging after image (bsc#1012382).
• cachefiles: Fix missing clear of the CACHEFILES_OBJECT_ACTIVE flag (bsc#1099858).
• cachefiles: Fix refcounting bug in backing-file read monitoring (bsc#1099858).
• cachefiles: Wait rather than BUG'ing on 'Unexpected object collision' (bsc#1099858).
• cifs: fix bad/NULL ptr dereferencing in SMB2_sess_setup() (bsc#1090123).
• compiler, clang: always inline when CONFIG_OPTIMIZE_INLINING is disabled (bnc#1012382).
• compiler, clang: properly override 'inline' for clang (bnc#1012382).
• compiler, clang: suppress warning for unused static inline functions (bnc#1012382).
• compiler-gcc.h: Add attribute((gnu_inline)) to all inline declarations (bnc#1012382).
• cpu/hotplug: Add sysfs state interface (bsc#1089343).
• cpu/hotplug: Provide knobs to control SMT (bsc#1089343).
• cpu/hotplug: Split do_cpu_down() (bsc#1089343).
• crypto: crypto4xx - fix crypto4xx_build_pdr, crypto4xx_build_sdr leak (bnc#1012382).
• crypto: crypto4xx - remove bad list_del (bnc#1012382).
• drm/msm: Fix possible null dereference on failure of get_pages() (bsc#1102394).
• drm: re-enable error handling (bsc#1103884).
• fscache: Allow cancelled operations to be enqueued (bsc#1099858).
• fscache: Fix reference overput in fscache_attach_object() error handling (bsc#1099858).
• hid: usbhid: add quirk…

The SUSE Linux Enterprise 12 SP2 LTSS kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-3620: Local attackers on baremetal systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data. (bnc#1087081).
• CVE-2018-3646: Local attackers in virtualized guest systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data, even from other virtual machines or the host system. (bnc#1089343).
• CVE-2018-5390 aka 'SegmentSmack': The Linux Kernel can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service (bnc#1102340).
• CVE-2018-5391 aka 'FragmentSmack': A flaw in the IP packet reassembly could be used by remote attackers to consume lots of CPU time (bnc#1103097).
• CVE-2018-14734: drivers/infiniband/core/ucma.c allowed ucma_leave_multicast to access a certain data structure after a cleanup step in ucma_process_join, which allowed attackers to cause a denial of service (use-after-free) (bnc#1103119).
• CVE-2017-18344: The timer_create syscall implementation in kernel/time/posix-timers.c didn't properly validate the sigevent->sigev_notify field, which leads to out-of-bounds access in the show_timer function (called when /proc/$PID/timers is read). This allowed userspace applications to read arbitrary kernel memory (on a kernel built with CONFIG_POSIX_TIMERS and CONFIG_CHECKPOINT_RESTORE) (bnc#1102851 bnc#1103580).
• CVE-2018-9385: When printing the 'driver_override' option from with-in the amba driver, a very long line could expose one additional uninitialized byte (bnc#1100491).
• CVE-2018-13053: The alarm_timer_nsleep function in kernel/time/alarmtimer.c had an integer overflow via a large relative timeout because ktime_add_safe is not used (bnc#1099924).
• CVE-2018-13405: The inode_init_owner function in fs/inode.c allowed local users to create files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of that group. Here, the non-member can trigger creation of a plain file whose group ownership is that group. The intended behavior was that the non-member can trigger creation of a directory (but not a plain file) whose group ownership is that group. The non-member can escalate privileges by making the plain file executable and SGID (bnc#1100416).
• CVE-2018-13406: An integer overflow in the uvesafb_setcmap function in drivers/video/fbdev/uvesafb.c could result in local attackers being able to crash the kernel or potentially elevate privileges because kmalloc_array is not used (bnc#1098016 1100418).
• CVE-2018-5814: Multiple race condition errors when handling probe, disconnect, and rebind operations could be exploited to trigger a use-after-free condition or a NULL pointer dereference by sending multiple USB over IP packets (bnc#1096480).

The following non-security bugs were fixed:

• Add support for 5,25,50, and 100G to 802.3ad bonding driver (bsc#1096978)
• bcache: add backing_request_endio() for bi_end_io (bsc#1064232).
• bcache: add CACHE_SET_IO_DISABLE to struct cache_set flags (bsc#1064232).
• bcache: add io_disable to struct cached_dev (bsc#1064232).
• bcache: add journal statistic (bsc#1076110).
• bcache: Add __printf annotation to __bch_check_keys() (bsc#1064232).
• bcache: add stop_when_cache_set_failed option to backing device (bsc#1064232).
• bcache: add wait_for_kthread_stop() in bch_allocator_thread() (bsc#1064232).
• bcache: Annotate switch fall-through (bsc#1064232).
• bcache: closures: move control bits one bit right (bsc#1076110).
• bcache: correct flash only vols (check all uuids) (bsc#1064232). -…

The SUSE Linux Enterprise 12 SP2 LTSS kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-3620: Local attackers on baremetal systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data. (bnc#1087081).
• CVE-2018-3646: Local attackers in virtualized guest systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data, even from other virtual machines or the host system. (bnc#1089343).
• CVE-2018-5390 aka 'SegmentSmack': The Linux Kernel can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service (bnc#1102340).
• CVE-2018-5391 aka 'FragmentSmack': A flaw in the IP packet reassembly could be used by remote attackers to consume lots of CPU time (bnc#1103097).
• CVE-2018-14734: drivers/infiniband/core/ucma.c allowed ucma_leave_multicast to access a certain data structure after a cleanup step in ucma_process_join, which allowed attackers to cause a denial of service (use-after-free) (bnc#1103119).
• CVE-2017-18344: The timer_create syscall implementation in kernel/time/posix-timers.c didn't properly validate the sigevent->sigev_notify field, which leads to out-of-bounds access in the show_timer function (called when /proc/$PID/timers is read). This allowed userspace applications to read arbitrary kernel memory (on a kernel built with CONFIG_POSIX_TIMERS and CONFIG_CHECKPOINT_RESTORE) (bnc#1102851 bnc#1103580).
• CVE-2018-9385: When printing the 'driver_override' option from with-in the amba driver, a very long line could expose one additional uninitialized byte (bnc#1100491).
• CVE-2018-13053: The alarm_timer_nsleep function in kernel/time/alarmtimer.c had an integer overflow via a large relative timeout because ktime_add_safe is not used (bnc#1099924).
• CVE-2018-13405: The inode_init_owner function in fs/inode.c allowed local users to create files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of that group. Here, the non-member can trigger creation of a plain file whose group ownership is that group. The intended behavior was that the non-member can trigger creation of a directory (but not a plain file) whose group ownership is that group. The non-member can escalate privileges by making the plain file executable and SGID (bnc#1100416).
• CVE-2018-13406: An integer overflow in the uvesafb_setcmap function in drivers/video/fbdev/uvesafb.c could result in local attackers being able to crash the kernel or potentially elevate privileges because kmalloc_array is not used (bnc#1098016 1100418).
• CVE-2018-5814: Multiple race condition errors when handling probe, disconnect, and rebind operations could be exploited to trigger a use-after-free condition or a NULL pointer dereference by sending multiple USB over IP packets (bnc#1096480).

The following non-security bugs were fixed:

• Add support for 5,25,50, and 100G to 802.3ad bonding driver (bsc#1096978)
• bcache: add backing_request_endio() for bi_end_io (bsc#1064232).
• bcache: add CACHE_SET_IO_DISABLE to struct cache_set flags (bsc#1064232).
• bcache: add io_disable to struct cached_dev (bsc#1064232).
• bcache: add journal statistic (bsc#1076110).
• bcache: Add __printf annotation to __bch_check_keys() (bsc#1064232).
• bcache: add stop_when_cache_set_failed option to backing device (bsc#1064232).
• bcache: add wait_for_kthread_stop() in bch_allocator_thread() (bsc#1064232).
• bcache: Annotate switch fall-through (bsc#1064232).
• bcache: closures: move control bits one bit right (bsc#1076110).
• bcache: correct flash only vols (check all uuids) (bsc#1064232). -…

The SUSE Linux Enterprise 12 SP3 Azure kernel was updated to 4.4.143 to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-3620: Local attackers on baremetal systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data. (bnc#1087081).
• CVE-2018-3646: Local attackers in virtualized guest systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data, even from other virtual machines or the host system. (bnc#1089343).
• CVE-2018-5391: A flaw in the IP packet reassembly could be used by remote attackers to consume CPU time (bnc#1103097).
• CVE-2018-5390: Linux kernel versions 4.9+ can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service (bnc#1102340).
• CVE-2018-14734: drivers/infiniband/core/ucma.c allowed ucma_leave_multicast to access a certain data structure after a cleanup step in ucma_process_join, which allowed attackers to cause a denial of service (use-after-free) (bnc#1103119).
• CVE-2017-18344: The timer_create syscall implementation in kernel/time/posix-timers.c didn't properly validate the sigevent->sigev_notify field, which leads to out-of-bounds access in the show_timer function (called when /proc/$PID/timers is read). This allowed userspace applications to read arbitrary kernel memory (on a kernel built with CONFIG_POSIX_TIMERS and CONFIG_CHECKPOINT_RESTORE) (bnc#1102851 1103580).

The following non-security bugs were fixed:

• 1wire: family module autoload fails because of upper/lower case mismatch (bnc#1012382).
• Add support for 5,25,50, and 100G to 802.3ad bonding driver (bsc#1096978)
• ahci: Disable LPM on Lenovo 50 series laptops with a too old BIOS (bnc#1012382).
• alsa: hda - Fix pincfg at resume on Lenovo T470 dock (bsc#1099810).
• alsa: hda - Handle kzalloc() failure in snd_hda_attach_pcm_stream() (bnc#1012382).
• alsa: hda/realtek - set PINCFG_HEADSET_MIC to parse_flags (bsc#1099810).
• arm64: do not open code page table entry creation (bsc#1102197).
• arm64: kpti: Use early_param for kpti= command-line option (bsc#1102188).
• arm64: Make sure permission updates happen for pmd/pud (bsc#1102197).
• arm: 8764/1: kgdb: fix NUMREGBYTES so that gdb_regs[] is the correct size (bnc#1012382).
• arm: dts: imx6q: Use correct SDMA script for SPI5 core (bnc#1012382).
• ASoC: cirrus: i2s: Fix LRCLK configuration (bnc#1012382).
• ASoC: cirrus: i2s: Fix {TX|RX}LinCtrlData setup (bnc#1012382).
• ASoC: dapm: delete dapm_kcontrol_data paths list before freeing it (bnc#1012382).
• ath10k: fix rfc1042 header retrieval in QCA4019 with eth decap mode (bnc#1012382).
• atm: zatm: fix memcmp casting (bnc#1012382).
• atm: zatm: Fix potential Spectre v1 (bnc#1012382).
• backlight: as3711_bl: Fix Device Tree node lookup (bnc#1012382).
• backlight: max8925_bl: Fix Device Tree node lookup (bnc#1012382).
• backlight: tps65217_bl: Fix Device Tree node lookup (bnc#1012382).
• bcache: add backing_request_endio() for bi_end_io (bsc#1064232).
• bcache: add CACHE_SET_IO_DISABLE to struct cache_set flags (bsc#1064232).
• bcache: add io_disable to struct cached_dev (bsc#1064232).
• bcache: add journal statistic (bsc#1076110).
• bcache: Add __printf annotation to __bch_check_keys() (bsc#1064232).
• bcache: add stop_when_cache_set_failed option to backing device (bsc#1064232).
• bcache: add wait_for_kthread_stop() in bch_allocator_thread() (bsc#1064232).
• bcache: Annotate switch fall-through (bsc#1064232).
• bcache: closures: move control bits one bit right (bsc#1076110).
• bcache: correct flash only vols (check all uuids) (bsc#1064232).
• bcache: count backing device I/O error for writeback I/O (bsc#1064232).
• bcache: Fix a…

This update for the Linux Kernel 4.4.74-92_38 fixes several issues.

The following security issues were fixed:

• CVE-2018-3646: Local attackers in virtualized guest systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data, even from other virtual machines or the host system (bsc#1099306).
• CVE-2017-18344: The timer_create syscall implementation in kernel/time/posix-timers.c didn't properly validate the sigevent->sigev_notify field, which lead to out-of-bounds access in the show_timer function (called when /proc/$PID/timers is read). This allowed userspace applications to read arbitrary kernel memory (on a kernel built with CONFIG_POSIX_TIMERS and CONFIG_CHECKPOINT_RESTORE) (bsc#1103203). before 4.14.8
• CVE-2017-11600: net/xfrm/xfrm_policy.c did not ensure that the dir value of xfrm_userpolicy_id is XFRM_POLICY_MAX or less, which allowed local users to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via an XFRM_MSG_MIGRATE xfrm Netlink message (bsc#1096564)
• CVE-2018-10853: A flaw was found in kvm. In which certain instructions such as sgdt/sidt call segmented_write_std didn't propagate access correctly. As such, during userspace induced exception, the guest can incorrectly assume that the exception happened in the kernel and panic. (bsc#1097108).

This update for the Linux Kernel 4.4.114-92_64 fixes several issues.

The following security issues were fixed:

• CVE-2018-3646: Local attackers in virtualized guest systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data, even from other virtual machines or the host system (bsc#1099306).
• CVE-2017-18344: The timer_create syscall implementation in kernel/time/posix-timers.c didn't properly validate the sigevent->sigev_notify field, which lead to out-of-bounds access in the show_timer function (called when /proc/$PID/timers is read). This allowed userspace applications to read arbitrary kernel memory (on a kernel built with CONFIG_POSIX_TIMERS and CONFIG_CHECKPOINT_RESTORE) (bsc#1103203). before 4.14.8
• CVE-2018-10853: A flaw was found in kvm. In which certain instructions such as sgdt/sidt call segmented_write_std didn't propagate access correctly. As such, during userspace induced exception, the guest can incorrectly assume that the exception happened in the kernel and panic. (bsc#1097108).

This update for the Linux Kernel 4.4.82-6_6 fixes several issues.

The following security issues were fixed:

• CVE-2018-3646: Local attackers in virtualized guest systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data, even from other virtual machines or the host system (bsc#1099306).
• CVE-2017-18344: The timer_create syscall implementation in kernel/time/posix-timers.c didn't properly validate the sigevent->sigev_notify field, which lead to out-of-bounds access in the show_timer function (called when /proc/$PID/timers is read). This allowed userspace applications to read arbitrary kernel memory (on a kernel built with CONFIG_POSIX_TIMERS and CONFIG_CHECKPOINT_RESTORE) (bsc#1103203). before 4.14.8
• CVE-2017-17053: The init_new_context function in arch/x86/include/asm/mmu_context.h did not correctly handle errors from LDT table allocation when forking a new process, allowing a local attacker to achieve a use-after-free or possibly have unspecified other impact by running a specially crafted program. This vulnerability only affected kernels built with CONFIG_MODIFY_LDT_SYSCALL=y (bsc#1096679).
• CVE-2017-11600: net/xfrm/xfrm_policy.c did not ensure that the dir value of xfrm_userpolicy_id is XFRM_POLICY_MAX or less, which allowed local users to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via an XFRM_MSG_MIGRATE xfrm Netlink message (bsc#1096564)
• CVE-2018-10853: A flaw was found in kvm. In which certain instructions such as sgdt/sidt call segmented_write_std didn't propagate access correctly. As such, during userspace induced exception, the guest can incorrectly assume that the exception happened in the kernel and panic. (bsc#1097108).

This update for the Linux Kernel 4.4.103-92_53 fixes several issues.

The following security issues were fixed:

• CVE-2018-3646: Local attackers in virtualized guest systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data, even from other virtual machines or the host system (bsc#1099306).
• CVE-2017-18344: The timer_create syscall implementation in kernel/time/posix-timers.c didn't properly validate the sigevent->sigev_notify field, which lead to out-of-bounds access in the show_timer function (called when /proc/$PID/timers is read). This allowed userspace applications to read arbitrary kernel memory (on a kernel built with CONFIG_POSIX_TIMERS and CONFIG_CHECKPOINT_RESTORE) (bsc#1103203). before 4.14.8
• CVE-2018-10853: A flaw was found in kvm. In which certain instructions such as sgdt/sidt call segmented_write_std didn't propagate access correctly. As such, during userspace induced exception, the guest can incorrectly assume that the exception happened in the kernel and panic. (bsc#1097108).

This update for the Linux Kernel 4.12.14-25_3 fixes several issues.

The following security issues were fixed:

• CVE-2018-5390: Linux kernel versions 4.9+ can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service (bsc#1102682).
• CVE-2018-3646: Local attackers in virtualized guest systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data, even from other virtual machines or the host system (bsc#1099306).
• CVE-2017-18344: The timer_create syscall implementation in kernel/time/posix-timers.c didn't properly validate the sigevent->sigev_notify field, which lead to out-of-bounds access in the show_timer function (called when /proc/$PID/timers is read). This allowed userspace applications to read arbitrary kernel memory (on a kernel built with CONFIG_POSIX_TIMERS and CONFIG_CHECKPOINT_RESTORE) (bsc#1103203). before 4.14.8
• CVE-2018-10853: A flaw was found in kvm. In which certain instructions such as sgdt/sidt call segmented_write_std didn't propagate access correctly. As such, during userspace induced exception, the guest can incorrectly assume that the exception happened in the kernel and panic. (bsc#1097108).

This update for the Linux Kernel 4.12.14-23 fixes several issues.

The following security issues were fixed:

• CVE-2018-5390: Linux kernel versions 4.9+ can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service (bsc#1102682).
• CVE-2018-3646: Local attackers in virtualized guest systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data, even from other virtual machines or the host system (bsc#1099306).
• CVE-2017-18344: The timer_create syscall implementation in kernel/time/posix-timers.c didn't properly validate the sigevent->sigev_notify field, which lead to out-of-bounds access in the show_timer function (called when /proc/$PID/timers is read). This allowed userspace applications to read arbitrary kernel memory (on a kernel built with CONFIG_POSIX_TIMERS and CONFIG_CHECKPOINT_RESTORE) (bsc#1103203). before 4.14.8
• CVE-2018-12904: In arch/x86/kvm/vmx.c local attackers could cause L1 KVM guests to VMEXIT, potentially allowing privilege escalations and denial of service attacks due to lack of checking of CPL (bsc#1099258).
• CVE-2018-10853: A flaw was found in kvm. In which certain instructions such as sgdt/sidt call segmented_write_std didn't propagate access correctly. As such, during userspace induced exception, the guest can incorrectly assume that the exception happened in the kernel and panic. (bsc#1097108).

The SUSE Linux Enterprise 12 SP3 RT kernel was updated to 4.4.147 to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2017-18344: The timer_create syscall implementation in kernel/time/posix-timers.c didn't properly validate the sigevent->sigev_notify field, which leads to out-of-bounds access in the show_timer function (called when /proc/$PID/timers is read). This allowed userspace applications to read arbitrary kernel memory (on a kernel built with CONFIG_POSIX_TIMERS and CONFIG_CHECKPOINT_RESTORE) (bnc#1102851 bsc#1103580).
• CVE-2018-10876: A flaw was found in the ext4 filesystem code. A use-after-free was possible in ext4_ext_remove_space() function when mounting and operating a crafted ext4 image. (bnc#1099811)
• CVE-2018-10877: The ext4 filesystem was vulnerable to an out-of-bound access in the ext4_ext_drop_refs() function when operating on a crafted ext4 filesystem image. (bnc#1099846)
• CVE-2018-10878: A flaw was found in the ext4 filesystem. A local user could cause an out-of-bounds write and a denial of service or unspecified other impact is possible by mounting and operating a crafted ext4 filesystem image. (bnc#1099813)
• CVE-2018-10879: A flaw was found in the ext4 filesystem. A local user could cause a use-after-free in ext4_xattr_set_entry function and a denial of service or unspecified other impact may occur by renaming a file in a crafted ext4 filesystem image. (bnc#1099844)
• CVE-2018-10880: Linux kernel is vulnerable to a stack-out-of-bounds write in the ext4 filesystem code when mounting and writing to a crafted ext4 image in ext4_update_inline_data(). An attacker could use this to cause a system crash and a denial of service. (bnc#1099845)
• CVE-2018-10881: A flaw was found in the ext4 filesystem. A local user can cause an out-of-bound access in ext4_get_group_info function, a denial of service, and a system crash by mounting and operating on a crafted ext4 filesystem image. (bnc#1099864)
• CVE-2018-10882: A flaw was found in the ext4 filesystem. A local user can cause an out-of-bound write in in fs/jbd2/transaction.c code, a denial of service, and a system crash by unmounting a crafted ext4 filesystem image. (bnc#1099849)
• CVE-2018-10883: A flaw was found in the ext4 filesystem. A local user can cause an out-of-bounds write in jbd2_journal_dirty_metadata(), a denial of service, and a system crash by mounting and operating on a crafted ext4 filesystem image. (bnc#1099863)
• CVE-2018-14734: drivers/infiniband/core/ucma.c allowed ucma_leave_multicast to access a certain data structure after a cleanup step in ucma_process_join, which allowed attackers to cause a denial of service (use-after-free) (bnc#1103119).
• CVE-2018-3620: Systems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access via a terminal page fault and a side-channel analysis (bnc#1087081).
• CVE-2018-3646: Systems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access with guest OS privilege via a terminal page fault and a side-channel analysis (bnc#1089343 bnc#1104365).
• CVE-2018-5390: The Linux kernel could be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service (bnc#1102340).
• CVE-2018-5391 aka 'FragmentSmack': A flaw in the IP packet reassembly could be used by remote attackers to consume lots of CPU time (bnc#1103097).
• CVE-2018-9363: A buffer overflow in bluetooth HID report processing could be used by malicious bluetooth devices to crash the kernel or potentially execute code (bnc#1105292).

The following non-security bugs were fixed:

• acpi / pci: Bail early in acpi_pci_add_bus() if there is no ACPI handle…

The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-3268: Fixed an out of bounds memory access flaw in relay_file_read_start_pos in the relayfs (bsc#1212502).
• CVE-2023-3776: Fixed improper refcount update in cls_fw leads to use-after-free (bsc#1213588).
• CVE-2022-40982: Fixed transient execution attack called 'Gather Data Sampling' (bsc#1206418).
• CVE-2023-3567: Fixed a use-after-free in vcs_read in drivers/tty/vt/vc_screen.c (bsc#1213167).
• CVE-2023-0459: Fixed information leak in __uaccess_begin_nospec (bsc#1211738).
• CVE-2023-20593: Fixed a ZenBleed issue in 'Zen 2' CPUs that could allow an attacker to potentially access sensitive information (bsc#1213286).
• CVE-2018-3639: Fixed Speculative Store Bypass aka 'Memory Disambiguation' (bsc#1087082).
• CVE-2017-18344: Fixed an OOB access led by an invalid check in timer_create. (bsc#1102851).
• CVE-2022-45919: Fixed a use-after-free in dvb_ca_en50221.c that could occur if there is a disconnect after an open, because of the lack of a wait_event (bsc#1205803).
• CVE-2023-35824: Fixed a use-after-free in dm1105_remove in drivers/media/pci/dm1105/dm1105.c (bsc#1212501).
• CVE-2023-3161: Fixed shift-out-of-bounds in fbcon_set_font() (bsc#1212154).
• CVE-2023-3141: Fixed a use-after-free flaw in r592_remove in drivers/memstick/host/r592.c, that allowed local attackers to crash the system at device disconnect (bsc#1212129).
• CVE-2023-3159: Fixed use-after-free issue in driver/firewire in outbound_phy_packet_callback (bsc#1212128).

The following non-security bugs were fixed:

• fbcon: Check font dimension limits (CVE-2023-3161 bsc#1212154).
• firewire: fix potential uaf in outbound_phy_packet_callback() (CVE-2023-3159 bsc#1212128).
• kABI: restore _copy_from_user on x86_64 and copy_to_user on x86 (bsc#1211738 CVE-2023-0459).
• media: dm1105: Fix use after free bug in dm1105_remove due to race condition (bsc#1212501 CVE-2023-35824).
• media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221 (CVE-2022-45919 bsc#1205803).
• memstick: r592: Fix UAF bug in r592_remove due to race condition (CVE-2023-3141 bsc#1212129 bsc#1211449).
• net/sched: cls_fw: Fix improper refcount update leads to use-after-free (CVE-2023-3776 bsc#1213588).
• pkt_sched: fix error return code in fw_change_attrs() (bsc#1213588).
• pkt_sched: fix error return code in fw_change_attrs() (bsc#1213588).
• posix-timer: Properly check sigevent->sigev_notify (CVE-2017-18344, bsc#1102851, bsc#1208715).
• relayfs: fix out-of-bounds access in relay_file_read (bsc#1212502 CVE-2023-3268).
• uaccess: Add speculation barrier to copy_from_user() (bsc#1211738 CVE-2023-0459).
• vc_screen: don't clobber return value in vcs_read (bsc#1213167 CVE-2023-3567).
• vc_screen: modify vcs_size() handling in vcs_read() (bsc#1213167 CVE-2023-3567).
• vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF (bsc#1213167 CVE-2023-3567).
• x86: Unify copy_from_user() size checking (bsc#1211738 CVE-2023-0459).
• x86/copy_user: Unify the code by removing the 64-bit asm copy*_user() variants (bsc#1211738 CVE-2023-0459).
• x86/cpu/amd: Add a Zenbleed fix (bsc#1213286, CVE-2023-20593).
• x86/speculation: Add Gather Data Sampling mitigation (bsc#1206418, CVE-2022-40982).

It was discovered that memory present in the L1 data cache of an Intel CPU core may be exposed to a malicious process that is executing on the CPU core. This vulnerability is also known as L1 Terminal Fault (L1TF). A local attacker in a guest virtual machine could use this to expose sensitive information (memory from other guests or the host OS). (CVE-2018-3646)

It was discovered that memory present in the L1 data cache of an Intel CPU core may be exposed to a malicious process that is executing on the CPU core. This vulnerability is also known as L1 Terminal Fault (L1TF). A local attacker could use this to expose sensitive information (memory from the kernel or other processes). (CVE-2018-3620)

Andrey Konovalov discovered an out-of-bounds read in the POSIX timers subsystem in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or expose sensitive information. (CVE-2017-18344)

Juha-Matti Tilli discovered that the TCP implementation in the Linux kernel performed algorithmically expensive operations in some situations when handling incoming packets. A remote attacker could use this to cause a denial of service. (CVE-2018-5390)

Juha-Matti Tilli discovered that the IP implementation in the Linux kernel performed algorithmically expensive operations in some situations when handling incoming packet fragments. A remote attacker could use this to cause a denial of service. (CVE-2018-5391)