CVE-2018-18445

In the Linux kernel 4.14.x, 4.15.x, 4.16.x, 4.17.x, and 4.18.x before 4.18.13, faulty computation of numeric bounds in the BPF verifier permits out-of-bounds memory accesses because adjust_scalar_min_max_vals in kernel/bpf/verifier.c mishandles 32-bit right shifts.

This kernel update is based on the upstream 4.14.78 and fixes at least the following security issues:

An issue was discovered in the fd_locked_ioctl function in drivers/block/floppy.c in the Linux kernel through 4.15.7. The floppy driver will copy a kernel pointer to user memory in response to the FDGETPRM ioctl. An attacker can send the FDGETPRM ioctl and use the obtained kernel pointer to discover the location of kernel code and data and bypass kernel security protections such as KASLR (CVE-2018-7755).

A security flaw was found in the chap_server_compute_md5() function in the ISCSI target code in the Linux kernel in a way an authentication request from an ISCSI initiator is processed. An unauthenticated remote attacker can cause a stack buffer overflow and smash up to 17 bytes of the stack. The attack requires the iSCSI target to be enabled on the victim host. Depending on how the target's code was built (i.e. depending on a compiler, compile flags and hardware architecture) an attack may lead to a system crash and thus to a denial-of-service or possibly to a non-authorized access to data exported by an iSCSI target. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is highly unlikely (CVE-2018-14633).

An issue was discovered in xenvif_set_hash_mapping in drivers/net/xen-netback/hash.c in the Linux kernel through 4.18.1, as used in Xen through 4.11.x and other products. The Linux netback driver allows frontends to control mapping of requests to request queues. When processing a request to set or change this mapping, some input validation (e.g., for an integer overflow) was missing or flawed, leading to OOB access in hash handling. A malicious or buggy frontend may cause the (usually privileged) backend to make out of bounds memory accesses, potentially resulting in one or more of privilege escalation, Denial of Service (DoS), or information leaks (CVE-2018-15471).

Since Linux kernel version 3.2, the mremap() syscall performs TLB flushes after dropping pagetable locks. If a syscall such as ftruncate() removes entries from the pagetables of a task that is in the middle of mremap(), a stale TLB entry can remain for a short time that permits access to a physical page after it has been released back to the page allocator and reused (CVE-2018-18281).

In the Linux kernel 4.14.x, 4.15.x, 4.16.x, 4.17.x, and 4.18.x before 4.18.13, faulty computation of numeric bounds in the BPF verifier permits out-of-bounds memory accesses because adjust_scalar_min_max_vals in kernel/bpf/verifier.c mishandles 32-bit right shifts (CVE-2018-18445).

Other fixes in this update:

• WireGuard has been updated 0.0.20181018

For other uptstream fixes in this update, see the referenced changelogs.

This kernel-tmb update is based on the upstream 4.14.78 and adds additional fixes for the L1TF security issues. It also fixes at least the following security issues:

Linux kernel from versions 3.9 and up, is vulnerable to a denial of service attack with low rates of specially modified packets targeting IP fragment re-assembly. An attacker may cause a denial of service condition by sending specially crafted IP fragments (CVE-2018-5391, FragmentSmack).

An issue was discovered in the fd_locked_ioctl function in drivers/block/floppy.c in the Linux kernel through 4.15.7. The floppy driver will copy a kernel pointer to user memory in response to the FDGETPRM ioctl. An attacker can send the FDGETPRM ioctl and use the obtained kernel pointer to discover the location of kernel code and data and bypass kernel security protections such as KASLR (CVE-2018-7755).

A security flaw was found in the chap_server_compute_md5() function in the ISCSI target code in the Linux kernel in a way an authentication request from an ISCSI initiator is processed. An unauthenticated remote attacker can cause a stack buffer overflow and smash up to 17 bytes of the stack. The attack requires the iSCSI target to be enabled on the victim host. Depending on how the target's code was built (i.e. depending on a compiler, compile flags and hardware architecture) an attack may lead to a system crash and thus to a denial-of-service or possibly to a non-authorized access to data exported by an iSCSI target. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is highly unlikely (CVE-2018-14633).

A security flaw was found in the ip_frag_reasm() function in net/ipv4/ip_fragment.c in the Linux kernel caused by fixes for CVE-2018-5391, which can cause a later system crash in ip_do_fragment(). With certain non-default, but non-rare, configuration of a victim host, an attacker can trigger this crash remotely, thus leading to a remote denial-of-service (CVE-2018-14641).

An issue was discovered in xenvif_set_hash_mapping in drivers/net/xen-netback/hash.c in the Linux kernel through 4.18.1, as used in Xen through 4.11.x and other products. The Linux netback driver allows frontends to control mapping of requests to request queues. When processing a request to set or change this mapping, some input validation (e.g., for an integer overflow) was missing or flawed, leading to OOB access in hash handling. A malicious or buggy frontend may cause the (usually privileged) backend to make out of bounds memory accesses, potentially resulting in one or more of privilege escalation, Denial of Service (DoS), or information leaks (CVE-2018-15471).

An issue was discovered in the Linux kernel through 4.18.8. The vmacache_flush_all function in mm/vmacache.c mishandles sequence number overflows. An attacker can trigger a use-after-free (and possibly gain privileges) via certain thread creation, map, unmap, invalidation, and dereference operations (CVE-2018-17182).

Since Linux kernel version 3.2, the mremap() syscall performs TLB flushes after dropping pagetable locks. If a syscall such as ftruncate() removes entries from the pagetables of a task that is in the middle of mremap(), a stale TLB entry can remain for a short time that permits access to a physical page after it has been released back to the page allocator and reused (CVE-2018-18281).

In the Linux kernel 4.14.x, 4.15.x, 4.16.x, 4.17.x, and 4.18.x before 4.18.13, faulty computation of numeric bounds in the BPF verifier permits out-of-bounds memory accesses because adjust_scalar_min_max_vals in kernel/bpf/verifier.c mishandles 32-bit right shifts (CVE-2018-18445).

Other fixes in this update:

• WireGuard has been updated 0.0.20181018

For other uptstream fixes in this update, see the referenced changelogs.

This kernel-linus update is based on the upstream 4.14.78 and adds additional fixes for the L1TF security issues. It also fixes at least the following security issues:

Linux kernel from versions 3.9 and up, is vulnerable to a denial of service attack with low rates of specially modified packets targeting IP fragment re-assembly. An attacker may cause a denial of service condition by sending specially crafted IP fragments (CVE-2018-5391, FragmentSmack).

Memory leak in the irda_bind function in net/irda/af_irda.c and later in drivers/staging/irda/net/af_irda.c in the Linux kernel before 4.17 allows local users to cause a denial of service (memory consumption) by repeatedly binding an AF_IRDA socket (CVE-2018-6554).

The irda_setsockopt function in net/irda/af_irda.c and later in drivers/staging/irda/net/af_irda.c in the Linux kernel before 4.17 allows local users to cause a denial of service (ias_object use-after-free and system crash) or possibly have unspecified other impact via an AF_IRDA socket (CVE-2018-6555).

An issue was discovered in the fd_locked_ioctl function in drivers/block/floppy.c in the Linux kernel through 4.15.7. The floppy driver will copy a kernel pointer to user memory in response to the FDGETPRM ioctl. An attacker can send the FDGETPRM ioctl and use the obtained kernel pointer to discover the location of kernel code and data and bypass kernel security protections such as KASLR (CVE-2018-7755).

A security flaw was found in the chap_server_compute_md5() function in the ISCSI target code in the Linux kernel in a way an authentication request from an ISCSI initiator is processed. An unauthenticated remote attacker can cause a stack buffer overflow and smash up to 17 bytes of the stack. The attack requires the iSCSI target to be enabled on the victim host. Depending on how the target's code was built (i.e. depending on a compiler, compile flags and hardware architecture) an attack may lead to a system crash and thus to a denial-of-service or possibly to a non-authorized access to data exported by an iSCSI target. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is highly unlikely (CVE-2018-14633).

A security flaw was found in the ip_frag_reasm() function in net/ipv4/ip_fragment.c in the Linux kernel caused by fixes for CVE-2018-5391, which can cause a later system crash in ip_do_fragment(). With certain non-default, but non-rare, configuration of a victim host, an attacker can trigger this crash remotely, thus leading to a remote denial-of-service (CVE-2018-14641).

An issue was discovered in xenvif_set_hash_mapping in drivers/net/xen-netback/hash.c in the Linux kernel through 4.18.1, as used in Xen through 4.11.x and other products. The Linux netback driver allows frontends to control mapping of requests to request queues. When processing a request to set or change this mapping, some input validation (e.g., for an integer overflow) was missing or flawed, leading to OOB access in hash handling. A malicious or buggy frontend may cause the (usually privileged) backend to make out of bounds memory accesses, potentially resulting in one or more of privilege escalation, Denial of Service (DoS), or information leaks (CVE-2018-15471).

An issue was discovered in the Linux kernel through 4.18.8. The vmacache_flush_all function in mm/vmacache.c mishandles sequence number overflows. An attacker can trigger a use-after-free (and possibly gain privileges) via certain thread creation, map, unmap, invalidation, and dereference operations (CVE-2018-17182).

Since Linux kernel version 3.2, the mremap() syscall performs TLB flushes after dropping pagetable locks. If a syscall such as ftruncate() removes entries from the pagetables of a task that is in the middle of mremap(), a stale TLB entry can remain for a short time that permits access to a physical page after it has been released back to the page allocator and reused (CVE-2018-18281).

In the Linux kernel 4.14.x,…

The SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-18445: A faulty computation of numeric bounds in the BPF verifier permits out-of-bounds memory accesses because adjust_scalar_min_max_vals in kernel/bpf/verifier.c mishandled 32-bit right shifts (bnc#1112372).
• CVE-2018-18386: drivers/tty/n_tty.c allowed local attackers (who are able to access pseudo terminals) to hang/block further usage of any pseudo terminal devices due to an EXTPROC versus ICANON confusion in TIOCINQ (bnc#1094825).
• CVE-2017-18224: fs/ocfs2/aops.c omits use of a semaphore and consequently has a race condition for access to the extent tree during read operations in DIRECT mode, which allowed local users to cause a denial of service (BUG) by modifying a certain e_cpos field (bnc#1084831).
• CVE-2017-16533: The usbhid_parse function in drivers/hid/usbhid/hid-core.c allowed local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066674).

The following non-security bugs were fixed:

• acpi / processor: Fix the return value of acpi_processor_ids_walk() (bsc#1051510).
• acpica: Reference Counts: increase max to 0x4000 for large servers (bsc#1108241).
• alsa: hda/realtek - Cannot adjust speaker's volume on Dell XPS 27 7760 (bsc#1051510).
• arm: 8799/1: mm: fix pci_ioremap_io() offset check (bsc#1051510).
• arm: bcm2835: Add GET_THROTTLED firmware property (bsc#1108468).
• arm: exynos: Clear global variable on init error path (bsc#1051510).
• arm: hisi: check of_iomap and fix missing of_node_put (bsc#1051510).
• arm: hwmod: RTC: Do not assume lock/unlock will be called with irq enabled (bsc#1051510).
• arm: mvebu: declare asm symbols as character arrays in pmsu.c (bsc#1051510).
• ASoC: Intel: Skylake: Reset the controller in probe (bsc#1051510).
• ASoC: rsnd: adg: care clock-frequency size (bsc#1051510).
• ASoC: rsnd: do not fallback to PIO mode when -EPROBE_DEFER (bsc#1051510).
• ASoC: rt5514: Fix the issue of the delay volume applied again (bsc#1051510).
• ASoC: sigmadsp: safeload should not have lower byte limit (bsc#1051510).
• ASoC: wm8804: Add ACPI support (bsc#1051510).
• Btrfs: fix file data corruption after cloning a range and fsync (bsc#1111901).
• Btrfs: fix mount failure after fsync due to hard link recreation (bsc#1103543).
• Btrfs: send, fix invalid access to commit roots due to concurrent snapshotting (bsc#1111904).
• cifs: check for STATUS_USER_SESSION_DELETED (bsc#1112902).
• Delete patches.drivers/IB-qedr-Remove-GID-add-del-dummy-routines.patch. (bsc#1110921)
• Disable DRM patches that broke vbox video driver KMP (bsc#1111076)
• EDAC, ghes: Add DDR4 and NVDIMM memory types (bsc#1099125).
• EDAC, skx: Fix skx_edac build error when ACPI_NFIT=m (bsc#1099125).
• EDAC, skx_edac: Detect non-volatile DIMMs (bsc#1099125).
• EDAC: Add new memory type for non-volatile DIMMs (bsc#1099125).
• HID: add support for Apple Magic Keyboards (bsc#1051510).
• HID: hid-saitek: Add device ID for RAT 7 Contagion (bsc#1051510).
• HID: hid-sensor-hub: Force logical minimum to 1 for power and report state (bsc#1051510).
• HID: quirks: fix support for Apple Magic Keyboards (bsc#1051510).
• HID: sensor-hub: Restore fixup for Lenovo ThinkPad Helix 2 sensor hub report (bsc#1051510).
• input: atakbd - fix Atari CapsLock behaviour (bsc#1051510).
• input: atakbd - fix Atari keymap (bsc#1051510).
• kvm/vmx: Optimize vmx_vcpu_run() and svm_vcpu_run() by marking the RDMSR path as unlikely() (bsc#1110006).
• kvm: svm: Add MSR-based feature support for serializing LFENCE (bsc#1106240).
• kvm: vmx: Tell the nested hypervisor to skip L1D flush on vmentry (bsc#1106240).
• kvm: vmx: raise internal error for exception during invalid protected mode state (bsc#1110006).
• kvm: vmx: support MSR_IA32_ARCH_CAPABILITIES as a feature MSR (bsc#1106240).
• kvm: x86: Fix reserved bits check for MOV to CR3…

The SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-18445: A faulty computation of numeric bounds in the BPF verifier permits out-of-bounds memory accesses because adjust_scalar_min_max_vals in kernel/bpf/verifier.c mishandled 32-bit right shifts (bnc#1112372).
• CVE-2018-18386: drivers/tty/n_tty.c allowed local attackers (who are able to access pseudo terminals) to hang/block further usage of any pseudo terminal devices due to an EXTPROC versus ICANON confusion in TIOCINQ (bnc#1094825).
• CVE-2017-18224: fs/ocfs2/aops.c omits use of a semaphore and consequently has a race condition for access to the extent tree during read operations in DIRECT mode, which allowed local users to cause a denial of service (BUG) by modifying a certain e_cpos field (bnc#1084831).
• CVE-2017-16533: The usbhid_parse function in drivers/hid/usbhid/hid-core.c allowed local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066674).

The following non-security bugs were fixed:

• acpi / processor: Fix the return value of acpi_processor_ids_walk() (bsc#1051510).
• acpica: Reference Counts: increase max to 0x4000 for large servers (bsc#1108241).
• alsa: hda/realtek - Cannot adjust speaker's volume on Dell XPS 27 7760 (bsc#1051510).
• arm: 8799/1: mm: fix pci_ioremap_io() offset check (bsc#1051510).
• arm: bcm2835: Add GET_THROTTLED firmware property (bsc#1108468).
• arm: exynos: Clear global variable on init error path (bsc#1051510).
• arm: hisi: check of_iomap and fix missing of_node_put (bsc#1051510).
• arm: hwmod: RTC: Do not assume lock/unlock will be called with irq enabled (bsc#1051510).
• arm: mvebu: declare asm symbols as character arrays in pmsu.c (bsc#1051510).
• ASoC: Intel: Skylake: Reset the controller in probe (bsc#1051510).
• ASoC: rsnd: adg: care clock-frequency size (bsc#1051510).
• ASoC: rsnd: do not fallback to PIO mode when -EPROBE_DEFER (bsc#1051510).
• ASoC: rt5514: Fix the issue of the delay volume applied again (bsc#1051510).
• ASoC: sigmadsp: safeload should not have lower byte limit (bsc#1051510).
• ASoC: wm8804: Add ACPI support (bsc#1051510).
• Btrfs: fix file data corruption after cloning a range and fsync (bsc#1111901).
• Btrfs: fix mount failure after fsync due to hard link recreation (bsc#1103543).
• Btrfs: send, fix invalid access to commit roots due to concurrent snapshotting (bsc#1111904).
• cifs: check for STATUS_USER_SESSION_DELETED (bsc#1112902).
• Delete patches.drivers/IB-qedr-Remove-GID-add-del-dummy-routines.patch. (bsc#1110921)
• Disable DRM patches that broke vbox video driver KMP (bsc#1111076)
• EDAC, ghes: Add DDR4 and NVDIMM memory types (bsc#1099125).
• EDAC, skx: Fix skx_edac build error when ACPI_NFIT=m (bsc#1099125).
• EDAC, skx_edac: Detect non-volatile DIMMs (bsc#1099125).
• EDAC: Add new memory type for non-volatile DIMMs (bsc#1099125).
• HID: add support for Apple Magic Keyboards (bsc#1051510).
• HID: hid-saitek: Add device ID for RAT 7 Contagion (bsc#1051510).
• HID: hid-sensor-hub: Force logical minimum to 1 for power and report state (bsc#1051510).
• HID: quirks: fix support for Apple Magic Keyboards (bsc#1051510).
• HID: sensor-hub: Restore fixup for Lenovo ThinkPad Helix 2 sensor hub report (bsc#1051510).
• input: atakbd - fix Atari CapsLock behaviour (bsc#1051510).
• input: atakbd - fix Atari keymap (bsc#1051510).
• kvm/vmx: Optimize vmx_vcpu_run() and svm_vcpu_run() by marking the RDMSR path as unlikely() (bsc#1110006).
• kvm: svm: Add MSR-based feature support for serializing LFENCE (bsc#1106240).
• kvm: vmx: Tell the nested hypervisor to skip L1D flush on vmentry (bsc#1106240).
• kvm: vmx: raise internal error for exception during invalid protected mode state (bsc#1110006).
• kvm: vmx: support MSR_IA32_ARCH_CAPABILITIES as a feature MSR (bsc#1106240).
• kvm: x86: Fix reserved bits check for MOV to CR3…

The SUSE Linux Enterprise 12 SP4 kernel for Azure was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-18710: An information leak in cdrom_ioctl_select_disc in drivers/cdrom/cdrom.c could be used by local attackers to read kernel memory because a cast from unsigned long to int interferes with bounds checking. This is similar to CVE-2018-10940 and CVE-2018-16658 (bnc#1113751).
• CVE-2018-18445: Faulty computation of numeric bounds in the BPF verifier permits out-of-bounds memory accesses because adjust_scalar_min_max_vals in kernel/bpf/verifier.c mishandled 32-bit right shifts (bnc#1112372).
• CVE-2018-18386: drivers/tty/n_tty.c allowed local attackers (who are able to access pseudo terminals) to hang/block further usage of any pseudo terminal devices due to an EXTPROC versus ICANON confusion in TIOCINQ (bnc#1094825).
• CVE-2017-18224: fs/ocfs2/aops.c omits use of a semaphore and consequently has a race condition for access to the extent tree during read operations in DIRECT mode, which allowed local users to cause a denial of service (BUG) by modifying a certain e_cpos field (bnc#1084831).
• CVE-2017-16533: The usbhid_parse function in drivers/hid/usbhid/hid-core.c allowed local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066674).

The following non-security bugs were fixed:

• acpi, nfit: Prefer _DSM over _LSR for namespace label reads (bsc#112128).
• acpi / processor: Fix the return value of acpi_processor_ids_walk() (bsc#1051510).
• aio: fix io_destroy(2) vs. lookup_ioctx() race (git-fixes).
• alsa: hda: Add 2 more models to the power_save blacklist (bsc#1051510).
• alsa: hda - Add mic quirk for the Lenovo G50-30 (17aa:3905) (bsc#1051510).
• alsa: hda - Add quirk for ASUS G751 laptop (bsc#1051510).
• alsa: hda - Fix headphone pin config for ASUS G751 (bsc#1051510).
• alsa: hda: fix unused variable warning (bsc#1051510).
• alsa: hda/realtek - Cannot adjust speaker's volume on Dell XPS 27 7760 (bsc#1051510).
• alsa: hda/realtek - Fix the problem of the front MIC on the Lenovo M715 (bsc#1051510).
• alsa: usb-audio: update quirk for B&W PX to remove microphone (bsc#1051510).
• apparmor: Check buffer bounds when mapping permissions mask (git-fixes).
• ARM: bcm2835: Add GET_THROTTLED firmware property (bsc#1108468).
• ASoC: intel: skylake: Add missing break in skl_tplg_get_token() (bsc#1051510).
• ASoC: Intel: Skylake: Reset the controller in probe (bsc#1051510).
• ASoC: rsnd: adg: care clock-frequency size (bsc#1051510).
• ASoC: rsnd: do not fallback to PIO mode when -EPROBE_DEFER (bsc#1051510).
• ASoC: rt5514: Fix the issue of the delay volume applied again (bsc#1051510).
• ASoC: sigmadsp: safeload should not have lower byte limit (bsc#1051510).
• ASoC: wm8804: Add ACPI support (bsc#1051510).
• ath10k: fix kernel panic issue during pci probe (bsc#1051510).
• ath10k: fix scan crash due to incorrect length calculation (bsc#1051510).
• ath10k: fix use-after-free in ath10k_wmi_cmd_send_nowait (bsc#1051510).
• autofs: fix autofs_sbi() does not check super block type (git-fixes).
• autofs: fix slab out of bounds read in getname_kernel() (git-fixes).
• autofs: mount point create should honour passed in mode (git-fixes).
• badblocks: fix wrong return value in badblocks_set if badblocks are disabled (git-fixes).
• batman-adv: Avoid probe ELP information leak (bsc#1051510).
• batman-adv: fix backbone_gw refcount on queue_work() failure (bsc#1051510).
• batman-adv: fix hardif_neigh refcount on queue_work() failure (bsc#1051510).
• bdi: Fix another oops in wb_workfn() (bsc#1112746).
• bdi: Preserve kabi when adding cgwb_release_mutex (bsc#1112746).
• blkdev_report_zones_ioctl(): Use vmalloc() to allocate large buffers (bsc#1111819).
• blk-mq: I/O and timer unplugs are inverted in blktrace (bsc#1112713).
• block, bfq: fix wrong init of saved start time for weight raising…

The SUSE Linux Enterprise 15 azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-9363: Fixed an integer overflow that could have been used for an out of bounds write with no additional execution privileges needed. User interaction is not needed for exploitation (bsc#1105292).
• CVE-2018-6555: The irda_setsockopt function in net/irda/af_irda.c was fixed in drivers/staging/irda/net/af_irda.c that allowed local users to cause a denial of service (ias_object use-after-free and system crash) or possibly have unspecified other impact via an AF_IRDA socket (bsc#1106511).
• CVE-2018-6554: Fixed memory leak in the irda_bind function in net/irda/af_irda.c and later in drivers/staging/irda/net/af_irda.c that allowed local users to cause a denial of service (memory consumption) by repeatedly binding an AF_IRDA socket (bsc#1106509).
• CVE-2018-18710: An information leak was fixed in cdrom_ioctl_select_disc in drivers/cdrom/cdrom.c that could have been used by local attackers to read kernel memory because a cast from unsigned long to int interferes with bounds checking. This is similar to CVE-2018-10940 and CVE-2018-16658 (bsc#1113751).
• CVE-2018-18445: Fixed faulty computation of numeric bounds in the BPF verifier that now permits out-of-bounds memory accesses because adjust_scalar_min_max_vals in kernel/bpf/verifier.c mishandled 32-bit right shifts (bsc#1112372).
• CVE-2018-17182: The vmacache_flush_all function in mm/vmacache.c was fixed that was vulnerable to sequence number overflows. An attacker can trigger a use-after-free (and possibly gain privileges) via certain thread creation, map, unmap, invalidation, and dereference operations. (bsc#1108399).
• CVE-2018-16658: An information leak in cdrom_ioctl_drive_status in drivers/cdrom/cdrom.c was fixed that could have leed to be used by local attackers to read kernel memory because a cast from unsigned long to int interferes with bounds checking. This is similar to CVE-2018-10940 (bsc#1107689).
• CVE-2018-15572: The spectre_v2_select_mitigation function in arch/x86/kernel/cpu/bugs.c was not always fill RSB upon a context switch, which makes it easier for attackers to conduct userspace-userspace spectreRSB attacks. (bsc#1102517)
• CVE-2018-14633: A security flaw was fixed in the chap_server_compute_md5() function in the ISCSI target code in a way an authentication request from an ISCSI initiator is processed. An unauthenticated remote attacker can cause a stack buffer overflow and smash up to 17 bytes of the stack. The attack requires the iSCSI target to be enabled on the victim host. Depending on how the target's code was built (i.e. depending on a compiler, compile flags and hardware architecture) an attack may lead to a system crash and thus to a denial-of-service or possibly to a non-authorized access to data exported by an iSCSI target. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is highly unlikely (bsc#1107829).
• CVE-2018-14617: A NULL pointer dereference and panic in hfsplus_lookup() was fixed when opening a file (that is purportedly a hard link) in an hfs+ filesystem that has malformed catalog data, and is mounted read-only without a metadata directory. (bsc#1102870)
• CVE-2018-14613: An invalid pointer dereference in io_ctl_map_page() was fixed when mounting and operating a crafted btrfs image, because of a lack of block group item validation in check_leaf_item in fs/btrfs/tree-checker.c. (bsc#1102896)
• CVE-2018-13095: A denial of service (memory corruption and BUG) was fixed to prevent a corrupted xfs image upon encountering an inode that is in extent format, but has more extents than fit in the inode fork. (bsc#1099999)
• CVE-2018-13093: A NULL pointer dereference and panic in lookup_slow() on a NULL was fixed to prevent pathwalks on a corrupted xfs image. This occurs because of a lack of proper validation that cached inodes are free during…

The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-19824: A local user could exploit a use-after-free in the ALSA driver by supplying a malicious USB Sound device (with zero interfaces) that is mishandled in usb_audio_probe in sound/usb/card.c (bnc#1118152).
• CVE-2018-18281: The mremap() syscall performs TLB flushes after dropping pagetable locks. If a syscall such as ftruncate() removed entries from the pagetables of a task that is in the middle of mremap(), a stale TLB entry could remain for a short time that permits access to a physical page after it has been released back to the page allocator and reused. (bnc#1113769).
• CVE-2018-18710: An information leak in cdrom_ioctl_select_disc in drivers/cdrom/cdrom.c could be used by local attackers to read kernel memory because a cast from unsigned long to int interferes with bounds checking. This is similar to CVE-2018-10940 and CVE-2018-16658 (bnc#1113751).
• CVE-2018-18445: Faulty computation of numeric bounds in the BPF verifier permitted out-of-bounds memory accesses because adjust_scalar_min_max_vals in kernel/bpf/verifier.c mishandled 32-bit right shifts (bnc#1112372).
• CVE-2018-18386: drivers/tty/n_tty.c allowed local attackers (who are able to access pseudo terminals) to hang/block further usage of any pseudo terminal devices due to an EXTPROC versus ICANON confusion in TIOCINQ (bnc#1094825).
• CVE-2017-18224: fs/ocfs2/aops.c omitted use of a semaphore and consequently had a race condition for access to the extent tree during read operations in DIRECT mode, which allowed local users to cause a denial of service (BUG) by modifying a certain e_cpos field (bnc#1084831).
• CVE-2017-16533: The usbhid_parse function in drivers/hid/usbhid/hid-core.c allowed local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066674).

The following non-security bugs were fixed:

• ACPI/APEI: Handle GSIV and GPIO notification types (bsc#1115567).
• ACPICA: Tables: Add WSMT support (bsc#1089350).
• ACPI/IORT: Fix iort_get_platform_device_domain() uninitialized pointer value (bsc#1051510).
• ACPI / LPSS: Add alternative ACPI HIDs for Cherry Trail DMA controllers (bsc#1051510).
• ACPI, nfit: Fix ARS overflow continuation (bsc#1116895).
• ACPI, nfit: Prefer _DSM over _LSR for namespace label reads (bsc#1112128).
• ACPI/nfit, x86/mce: Handle only uncorrectable machine checks (bsc#1114279).
• ACPI/nfit, x86/mce: Validate a MCE's address before using it (bsc#1114279).
• ACPI / platform: Add SMB0001 HID to forbidden_id_list (bsc#1051510).
• ACPI / processor: Fix the return value of acpi_processor_ids_walk() (bsc#1051510).
• ACPI / watchdog: Prefer iTCO_wdt always when WDAT table uses RTC SRAM (bsc#1051510).
• act_ife: fix a potential use-after-free (networking-stable-18_09_11).
• Add the cherry-picked dup id for PCI dwc fix
• Add version information to KLP_SYMBOLS file
• ALSA: ac97: Fix incorrect bit shift at AC97-SPSA control write (bsc#1051510).
• ALSA: ca0106: Disable IZD on SB0570 DAC to fix audio pops (bsc#1051510).
• ALSA: control: Fix race between adding and removing a user element (bsc#1051510).
• ALSA: hda: Add 2 more models to the power_save blacklist (bsc#1051510).
• ALSA: hda: Add ASRock N68C-S UCC the power_save blacklist (bsc#1051510).
• ALSA: hda - Add mic quirk for the Lenovo G50-30 (17aa:3905) (bsc#1051510).
• ALSA: hda - Add quirk for ASUS G751 laptop (bsc#1051510).
• ALSA: hda/ca0132 - Call pci_iounmap() instead of iounmap() (bsc#1051510).
• ALSA: hda - Fix headphone pin config for ASUS G751 (bsc#1051510).
• ALSA: hda: fix unused variable warning (bsc#1051510).
• ALSA: hda/realtek - Add auto-mute quirk for HP Spectre x360 laptop (bsc#1051510).
• ALSA: hda/realtek - Add GPIO data update helper (bsc#1051510).
• ALSA: hda/realtek - Allow skipping spec->init_amp detection (bsc#1051510). -…

The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-19824: A local user could exploit a use-after-free in the ALSA driver by supplying a malicious USB Sound device (with zero interfaces) that is mishandled in usb_audio_probe in sound/usb/card.c (bnc#1118152).
• CVE-2018-18281: The mremap() syscall performs TLB flushes after dropping pagetable locks. If a syscall such as ftruncate() removed entries from the pagetables of a task that is in the middle of mremap(), a stale TLB entry could remain for a short time that permits access to a physical page after it has been released back to the page allocator and reused. (bnc#1113769).
• CVE-2018-18710: An information leak in cdrom_ioctl_select_disc in drivers/cdrom/cdrom.c could be used by local attackers to read kernel memory because a cast from unsigned long to int interferes with bounds checking. This is similar to CVE-2018-10940 and CVE-2018-16658 (bnc#1113751).
• CVE-2018-18445: Faulty computation of numeric bounds in the BPF verifier permitted out-of-bounds memory accesses because adjust_scalar_min_max_vals in kernel/bpf/verifier.c mishandled 32-bit right shifts (bnc#1112372).
• CVE-2018-18386: drivers/tty/n_tty.c allowed local attackers (who are able to access pseudo terminals) to hang/block further usage of any pseudo terminal devices due to an EXTPROC versus ICANON confusion in TIOCINQ (bnc#1094825).
• CVE-2017-18224: fs/ocfs2/aops.c omitted use of a semaphore and consequently had a race condition for access to the extent tree during read operations in DIRECT mode, which allowed local users to cause a denial of service (BUG) by modifying a certain e_cpos field (bnc#1084831).
• CVE-2017-16533: The usbhid_parse function in drivers/hid/usbhid/hid-core.c allowed local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066674).

The following non-security bugs were fixed:

• ACPI/APEI: Handle GSIV and GPIO notification types (bsc#1115567).
• ACPICA: Tables: Add WSMT support (bsc#1089350).
• ACPI/IORT: Fix iort_get_platform_device_domain() uninitialized pointer value (bsc#1051510).
• ACPI / LPSS: Add alternative ACPI HIDs for Cherry Trail DMA controllers (bsc#1051510).
• ACPI, nfit: Fix ARS overflow continuation (bsc#1116895).
• ACPI, nfit: Prefer _DSM over _LSR for namespace label reads (bsc#1112128).
• ACPI/nfit, x86/mce: Handle only uncorrectable machine checks (bsc#1114279).
• ACPI/nfit, x86/mce: Validate a MCE's address before using it (bsc#1114279).
• ACPI / platform: Add SMB0001 HID to forbidden_id_list (bsc#1051510).
• ACPI / processor: Fix the return value of acpi_processor_ids_walk() (bsc#1051510).
• ACPI / watchdog: Prefer iTCO_wdt always when WDAT table uses RTC SRAM (bsc#1051510).
• act_ife: fix a potential use-after-free (networking-stable-18_09_11).
• Add the cherry-picked dup id for PCI dwc fix
• Add version information to KLP_SYMBOLS file
• ALSA: ac97: Fix incorrect bit shift at AC97-SPSA control write (bsc#1051510).
• ALSA: ca0106: Disable IZD on SB0570 DAC to fix audio pops (bsc#1051510).
• ALSA: control: Fix race between adding and removing a user element (bsc#1051510).
• ALSA: hda: Add 2 more models to the power_save blacklist (bsc#1051510).
• ALSA: hda: Add ASRock N68C-S UCC the power_save blacklist (bsc#1051510).
• ALSA: hda - Add mic quirk for the Lenovo G50-30 (17aa:3905) (bsc#1051510).
• ALSA: hda - Add quirk for ASUS G751 laptop (bsc#1051510).
• ALSA: hda/ca0132 - Call pci_iounmap() instead of iounmap() (bsc#1051510).
• ALSA: hda - Fix headphone pin config for ASUS G751 (bsc#1051510).
• ALSA: hda: fix unused variable warning (bsc#1051510).
• ALSA: hda/realtek - Add auto-mute quirk for HP Spectre x360 laptop (bsc#1051510).
• ALSA: hda/realtek - Add GPIO data update helper (bsc#1051510).
• ALSA: hda/realtek - Allow skipping spec->init_amp detection (bsc#1051510). -…

It was discovered that a race condition existed in the raw MIDI driver for the Linux kernel, leading to a double free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-10902)

It was discovered that an integer overrun vulnerability existed in the POSIX timers implementation in the Linux kernel. A local attacker could use this to cause a denial of service. (CVE-2018-12896)

Noam Rathaus discovered that a use-after-free vulnerability existed in the Infiniband implementation in the Linux kernel. An attacker could use this to cause a denial of service (system crash). (CVE-2018-14734)

It was discovered that the YUREX USB device driver for the Linux kernel did not properly restrict user space reads or writes. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-16276)

It was discovered that the BPF verifier in the Linux kernel did not correctly compute numeric bounds in some situations. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-18445)

Kanda Motohiro discovered that writing extended attributes to an XFS file system in the Linux kernel in certain situations could cause an error condition to occur. A local attacker could use this to cause a denial of service. (CVE-2018-18690)

It was discovered that an integer overflow vulnerability existed in the CDROM driver of the Linux kernel. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2018-18710)

USN-3847-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 18.04 LTS for Ubuntu 16.04 LTS.

It was discovered that a race condition existed in the raw MIDI driver for the Linux kernel, leading to a double free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-10902)

It was discovered that an integer overrun vulnerability existed in the POSIX timers implementation in the Linux kernel. A local attacker could use this to cause a denial of service. (CVE-2018-12896)

Noam Rathaus discovered that a use-after-free vulnerability existed in the Infiniband implementation in the Linux kernel. An attacker could use this to cause a denial of service (system crash). (CVE-2018-14734)

It was discovered that the YUREX USB device driver for the Linux kernel did not properly restrict user space reads or writes. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-16276)

It was discovered that the BPF verifier in the Linux kernel did not correctly compute numeric bounds in some situations. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-18445)

Kanda Motohiro discovered that writing extended attributes to an XFS file system in the Linux kernel in certain situations could cause an error condition to occur. A local attacker could use this to cause a denial of service. (CVE-2018-18690)

It was discovered that an integer overflow vulnerability existed in the CDROM driver of the Linux kernel. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2018-18710)

USN-3847-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.04 LTS. This update provides the corresponding updates for the Linux kernel for Microsoft Azure Cloud systems for Ubuntu 14.04 LTS.

It was discovered that a race condition existed in the raw MIDI driver for the Linux kernel, leading to a double free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-10902)

It was discovered that an integer overrun vulnerability existed in the POSIX timers implementation in the Linux kernel. A local attacker could use this to cause a denial of service. (CVE-2018-12896)

Noam Rathaus discovered that a use-after-free vulnerability existed in the Infiniband implementation in the Linux kernel. An attacker could use this to cause a denial of service (system crash). (CVE-2018-14734)

It was discovered that the YUREX USB device driver for the Linux kernel did not properly restrict user space reads or writes. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-16276)

It was discovered that the BPF verifier in the Linux kernel did not correctly compute numeric bounds in some situations. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-18445)

Kanda Motohiro discovered that writing extended attributes to an XFS file system in the Linux kernel in certain situations could cause an error condition to occur. A local attacker could use this to cause a denial of service. (CVE-2018-18690)

It was discovered that an integer overflow vulnerability existed in the CDROM driver of the Linux kernel. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2018-18710)