CVE-2014-4656

Multiple integer overflows in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 allow local users to cause a denial of service by leveraging /dev/snd/controlCX access, related to (1) index values in the snd_ctl_add function and (2) numid values in the snd_ctl_remove_numid_conflict function.

The SUSE Linux Enterprise 11 Service Pack 3 kernel has been updated to fix various bugs and security issues.

The following security bugs have been fixed:

* 

  CVE-2014-1739: The media_device_enum_entities function in
  drivers/media/media-device.c in the Linux kernel before 3.14.6 does
  not initialize a certain data structure, which allows local users to
  obtain sensitive information from kernel memory by leveraging
  /dev/media0 read access for a MEDIA_IOC_ENUM_ENTITIES ioctl call
  (bnc#882804).

* 

  CVE-2014-4171: mm/shmem.c in the Linux kernel through 3.15.1 does not
  properly implement the interaction between range notification and
  hole punching, which allows local users to cause a denial of service
  (i_mutex hold) by using the mmap system call to access a hole, as
  demonstrated by interfering with intended shmem activity by blocking
  completion of (1) an MADV_REMOVE madvise call or (2) an
  FALLOC_FL_PUNCH_HOLE fallocate call (bnc#883518).

* 

  CVE-2014-4508: arch/x86/kernel/entry_32.S in the Linux kernel through
  3.15.1 on 32-bit x86 platforms, when syscall auditing is enabled and
  the sep CPU feature flag is set, allows local users to cause a denial
  of service (OOPS and system crash) via an invalid syscall number, as
  demonstrated by number 1000 (bnc#883724).

* 

  CVE-2014-4667: The sctp_association_free function in
  net/sctp/associola.c in the Linux kernel before 3.15.2 does not
  properly manage a certain backlog value, which allows remote
  attackers to cause a denial of service (socket outage) via a crafted
  SCTP packet (bnc#885422).

* 

  CVE-2014-4943: The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the
  Linux kernel through 3.15.6 allows local users to gain privileges by
  leveraging data-structure differences between an l2tp socket and an
  inet socket (bnc#887082).

* 

  CVE-2014-5077: The sctp_assoc_update function in net/sctp/associola.c
  in the Linux kernel through 3.15.8, when SCTP authentication is
  enabled, allows remote attackers to cause a denial of service (NULL
  pointer dereference and OOPS) by starting to establish an association
  between two endpoints immediately after an exchange of INIT and INIT
  ACK chunks to establish an earlier association between these
  endpoints in the opposite direction (bnc#889173).

* 

  CVE-2014-5471: Stack consumption vulnerability in the
  parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the
  Linux kernel through 3.16.1 allows local users to cause a denial of
  service (uncontrolled recursion, and system crash or reboot) via a
  crafted iso9660 image with a CL entry referring to a directory entry
  that has a CL entry. (bnc#892490)

* 

  CVE-2014-5472: The parse_rock_ridge_inode_internal function in
  fs/isofs/rock.c in the Linux kernel through 3.16.1 allows local users
  to cause a denial of service (unkillable mount process) via a crafted
  iso9660 image with a self-referential CL entry. (bnc#892490)

* 

  CVE-2014-2706: Race condition in the mac80211 subsystem in the Linux
  kernel before 3.13.7 allows remote attackers to cause a denial of
  service (system crash) via network traffic that improperly interacts
  with the WLAN_STA_PS_STA state (aka power-save mode), related to
  sta_info.c and tx.c. (bnc#871797)

* 

  CVE-2014-4027: The rd_build_device_space function in
  drivers/target/target_core_rd.c in the Linux kernel before 3.14 does
  not properly initialize a certain data structure, which allows local
  users to obtain sensitive information from ramdisk_mcp memory by
  leveraging access to a SCSI initiator. (bnc#882639)

* 

  CVE-2014-3153 The futex_requeue function in kernel/futex.c in the
  Linux kernel through 3.14.5 does not ensure that…

The SUSE Linux Enterprise 11 Service Pack 2 kernel was updated to fix a regression introduced by the previous update:

* scsi_dh_alua: Incorrect reference counting in the SCSI ALUA
  initialization code lead to system crashes on boot (bnc#858831).

As the update introducing the regression was marked security, this is also marked security even though this bug is not security relevant.

The SUSE Linux Enterprise 11 Service Pack 3 kernel has been updated to fix various bugs and security issues.

The following security bugs have been fixed:

* 

  CVE-2014-1739: The media_device_enum_entities function in
  drivers/media/media-device.c in the Linux kernel before 3.14.6 does
  not initialize a certain data structure, which allows local users to
  obtain sensitive information from kernel memory by leveraging
  /dev/media0 read access for a MEDIA_IOC_ENUM_ENTITIES ioctl call
  (bnc#882804).

* 

  CVE-2014-4171: mm/shmem.c in the Linux kernel through 3.15.1 does not
  properly implement the interaction between range notification and
  hole punching, which allows local users to cause a denial of service
  (i_mutex hold) by using the mmap system call to access a hole, as
  demonstrated by interfering with intended shmem activity by blocking
  completion of (1) an MADV_REMOVE madvise call or (2) an
  FALLOC_FL_PUNCH_HOLE fallocate call (bnc#883518).

* 

  CVE-2014-4508: arch/x86/kernel/entry_32.S in the Linux kernel through
  3.15.1 on 32-bit x86 platforms, when syscall auditing is enabled and
  the sep CPU feature flag is set, allows local users to cause a denial
  of service (OOPS and system crash) via an invalid syscall number, as
  demonstrated by number 1000 (bnc#883724).

* 

  CVE-2014-4667: The sctp_association_free function in
  net/sctp/associola.c in the Linux kernel before 3.15.2 does not
  properly manage a certain backlog value, which allows remote
  attackers to cause a denial of service (socket outage) via a crafted
  SCTP packet (bnc#885422).

* 

  CVE-2014-4943: The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the
  Linux kernel through 3.15.6 allows local users to gain privileges by
  leveraging data-structure differences between an l2tp socket and an
  inet socket (bnc#887082).

* 

  CVE-2014-5077: The sctp_assoc_update function in net/sctp/associola.c
  in the Linux kernel through 3.15.8, when SCTP authentication is
  enabled, allows remote attackers to cause a denial of service (NULL
  pointer dereference and OOPS) by starting to establish an association
  between two endpoints immediately after an exchange of INIT and INIT
  ACK chunks to establish an earlier association between these
  endpoints in the opposite direction (bnc#889173).

* 

  CVE-2014-5471: Stack consumption vulnerability in the
  parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the
  Linux kernel through 3.16.1 allows local users to cause a denial of
  service (uncontrolled recursion, and system crash or reboot) via a
  crafted iso9660 image with a CL entry referring to a directory entry
  that has a CL entry. (bnc#892490)

* 

  CVE-2014-5472: The parse_rock_ridge_inode_internal function in
  fs/isofs/rock.c in the Linux kernel through 3.16.1 allows local users
  to cause a denial of service (unkillable mount process) via a crafted
  iso9660 image with a self-referential CL entry. (bnc#892490)

* 

  CVE-2014-2706: Race condition in the mac80211 subsystem in the Linux
  kernel before 3.13.7 allows remote attackers to cause a denial of
  service (system crash) via network traffic that improperly interacts
  with the WLAN_STA_PS_STA state (aka power-save mode), related to
  sta_info.c and tx.c. (bnc#871797)

* 

  CVE-2014-4027: The rd_build_device_space function in
  drivers/target/target_core_rd.c in the Linux kernel before 3.14 does
  not properly initialize a certain data structure, which allows local
  users to obtain sensitive information from ramdisk_mcp memory by
  leveraging access to a SCSI initiator. (bnc#882639)

* 

  CVE-2014-3153 The futex_requeue function in kernel/futex.c in the
  Linux kernel through 3.14.5 does not ensure that…

The SUSE Linux Enterprise 11 SP1 Teradata kernel was updated to fix bugs and security issues.

Following security issues were fixed:

CVE-2011-1083: Limit the path length users can build using epoll() to avoid local attackers consuming lots of kernel CPU time.

CVE-2011-4086: Fixed a oops in jbd/jbd2 that could be caused by specific filesystem access patterns.

CVE-2011-4622: KVM: Prevent starting PIT timers in the absence of irqchip support.

CVE-2012-0045: KVM: Extend 'struct x86_emulate_ops' with 'get_cpuid' and fix missing checks in syscall emulation.

CVE-2012-0879: Fix io_context leak after clone with CLONE_IO.

CVE-2012-1090: Fixed a dentry refcount leak in the CIFS file system that could lead to a crash on unmount.

CVE-2012-1097: The regset common infrastructure assumed that regsets would always have .get and .set methods, but necessarily .active methods. Unfortunately people have since written regsets without .set method, so NULL pointer dereference attacks were possible.

Following non-security issues were fixed:

* SCSI inquiry doesn't return data on SLES 11-SP1 Xen VMs (bnc#745929).
* FC transport driver killing off the timers/work queues (bnc#734300).
* The driver ixgbevf doesn't work on newer SLES 11-SP1 kernels
  (bnc#752972).
* Pack sparsemem memmap sections closer together and in higher zones
  (bnc#743870).

Following feature was implemented:

* The megaraid_sas driver update to version 5.40-LSI (bnc#736813).

Security Issues:

* CVE-2011-1083
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1083>
* CVE-2011-4086
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4086>
* CVE-2011-4622
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4622>
* CVE-2012-0045
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0045>
* CVE-2012-0879
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0879>
* CVE-2012-1090
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1090>
* CVE-2012-1097
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1097>

The SUSE Linux Enterprise 11 Service Pack 3 kernel has been updated to fix various bugs and security issues.

The following security bugs have been fixed:

* 

  CVE-2014-1739: The media_device_enum_entities function in
  drivers/media/media-device.c in the Linux kernel before 3.14.6 does
  not initialize a certain data structure, which allows local users to
  obtain sensitive information from kernel memory by leveraging
  /dev/media0 read access for a MEDIA_IOC_ENUM_ENTITIES ioctl call
  (bnc#882804).

* 

  CVE-2014-4171: mm/shmem.c in the Linux kernel through 3.15.1 does not
  properly implement the interaction between range notification and
  hole punching, which allows local users to cause a denial of service
  (i_mutex hold) by using the mmap system call to access a hole, as
  demonstrated by interfering with intended shmem activity by blocking
  completion of (1) an MADV_REMOVE madvise call or (2) an
  FALLOC_FL_PUNCH_HOLE fallocate call (bnc#883518).

* 

  CVE-2014-4508: arch/x86/kernel/entry_32.S in the Linux kernel through
  3.15.1 on 32-bit x86 platforms, when syscall auditing is enabled and
  the sep CPU feature flag is set, allows local users to cause a denial
  of service (OOPS and system crash) via an invalid syscall number, as
  demonstrated by number 1000 (bnc#883724).

* 

  CVE-2014-4667: The sctp_association_free function in
  net/sctp/associola.c in the Linux kernel before 3.15.2 does not
  properly manage a certain backlog value, which allows remote
  attackers to cause a denial of service (socket outage) via a crafted
  SCTP packet (bnc#885422).

* 

  CVE-2014-4943: The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the
  Linux kernel through 3.15.6 allows local users to gain privileges by
  leveraging data-structure differences between an l2tp socket and an
  inet socket (bnc#887082).

* 

  CVE-2014-5077: The sctp_assoc_update function in net/sctp/associola.c
  in the Linux kernel through 3.15.8, when SCTP authentication is
  enabled, allows remote attackers to cause a denial of service (NULL
  pointer dereference and OOPS) by starting to establish an association
  between two endpoints immediately after an exchange of INIT and INIT
  ACK chunks to establish an earlier association between these
  endpoints in the opposite direction (bnc#889173).

* 

  CVE-2014-5471: Stack consumption vulnerability in the
  parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the
  Linux kernel through 3.16.1 allows local users to cause a denial of
  service (uncontrolled recursion, and system crash or reboot) via a
  crafted iso9660 image with a CL entry referring to a directory entry
  that has a CL entry. (bnc#892490)

* 

  CVE-2014-5472: The parse_rock_ridge_inode_internal function in
  fs/isofs/rock.c in the Linux kernel through 3.16.1 allows local users
  to cause a denial of service (unkillable mount process) via a crafted
  iso9660 image with a self-referential CL entry. (bnc#892490)

* 

  CVE-2014-2706: Race condition in the mac80211 subsystem in the Linux
  kernel before 3.13.7 allows remote attackers to cause a denial of
  service (system crash) via network traffic that improperly interacts
  with the WLAN_STA_PS_STA state (aka power-save mode), related to
  sta_info.c and tx.c. (bnc#871797)

* 

  CVE-2014-4027: The rd_build_device_space function in
  drivers/target/target_core_rd.c in the Linux kernel before 3.14 does
  not properly initialize a certain data structure, which allows local
  users to obtain sensitive information from ramdisk_mcp memory by
  leveraging access to a SCSI initiator. (bnc#882639)

* 

  CVE-2014-3153 The futex_requeue function in kernel/futex.c in the
  Linux kernel through 3.14.5 does not ensure that…

The SUSE Linux Enterprise 11 Service Pack 3 kernel has been updated to fix various bugs and security issues.

The following security bugs have been fixed:

* 

  CVE-2014-1739: The media_device_enum_entities function in
  drivers/media/media-device.c in the Linux kernel before 3.14.6 does
  not initialize a certain data structure, which allows local users to
  obtain sensitive information from kernel memory by leveraging
  /dev/media0 read access for a MEDIA_IOC_ENUM_ENTITIES ioctl call
  (bnc#882804).

* 

  CVE-2014-4171: mm/shmem.c in the Linux kernel through 3.15.1 does not
  properly implement the interaction between range notification and
  hole punching, which allows local users to cause a denial of service
  (i_mutex hold) by using the mmap system call to access a hole, as
  demonstrated by interfering with intended shmem activity by blocking
  completion of (1) an MADV_REMOVE madvise call or (2) an
  FALLOC_FL_PUNCH_HOLE fallocate call (bnc#883518).

* 

  CVE-2014-4508: arch/x86/kernel/entry_32.S in the Linux kernel through
  3.15.1 on 32-bit x86 platforms, when syscall auditing is enabled and
  the sep CPU feature flag is set, allows local users to cause a denial
  of service (OOPS and system crash) via an invalid syscall number, as
  demonstrated by number 1000 (bnc#883724).

* 

  CVE-2014-4667: The sctp_association_free function in
  net/sctp/associola.c in the Linux kernel before 3.15.2 does not
  properly manage a certain backlog value, which allows remote
  attackers to cause a denial of service (socket outage) via a crafted
  SCTP packet (bnc#885422).

* 

  CVE-2014-4943: The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the
  Linux kernel through 3.15.6 allows local users to gain privileges by
  leveraging data-structure differences between an l2tp socket and an
  inet socket (bnc#887082).

* 

  CVE-2014-5077: The sctp_assoc_update function in net/sctp/associola.c
  in the Linux kernel through 3.15.8, when SCTP authentication is
  enabled, allows remote attackers to cause a denial of service (NULL
  pointer dereference and OOPS) by starting to establish an association
  between two endpoints immediately after an exchange of INIT and INIT
  ACK chunks to establish an earlier association between these
  endpoints in the opposite direction (bnc#889173).

* 

  CVE-2014-5471: Stack consumption vulnerability in the
  parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the
  Linux kernel through 3.16.1 allows local users to cause a denial of
  service (uncontrolled recursion, and system crash or reboot) via a
  crafted iso9660 image with a CL entry referring to a directory entry
  that has a CL entry. (bnc#892490)

* 

  CVE-2014-5472: The parse_rock_ridge_inode_internal function in
  fs/isofs/rock.c in the Linux kernel through 3.16.1 allows local users
  to cause a denial of service (unkillable mount process) via a crafted
  iso9660 image with a self-referential CL entry. (bnc#892490)

* 

  CVE-2014-2706: Race condition in the mac80211 subsystem in the Linux
  kernel before 3.13.7 allows remote attackers to cause a denial of
  service (system crash) via network traffic that improperly interacts
  with the WLAN_STA_PS_STA state (aka power-save mode), related to
  sta_info.c and tx.c. (bnc#871797)

* 

  CVE-2014-4027: The rd_build_device_space function in
  drivers/target/target_core_rd.c in the Linux kernel before 3.14 does
  not properly initialize a certain data structure, which allows local
  users to obtain sensitive information from ramdisk_mcp memory by
  leveraging access to a SCSI initiator. (bnc#882639)

* 

  CVE-2014-3153 The futex_requeue function in kernel/futex.c in the
  Linux kernel through 3.14.5 does not ensure that…

The SUSE Linux Enterprise 11 Service Pack 3 kernel has been updated to fix various bugs and security issues.

The following security bugs have been fixed:

* 

  CVE-2014-1739: The media_device_enum_entities function in
  drivers/media/media-device.c in the Linux kernel before 3.14.6 does
  not initialize a certain data structure, which allows local users to
  obtain sensitive information from kernel memory by leveraging
  /dev/media0 read access for a MEDIA_IOC_ENUM_ENTITIES ioctl call
  (bnc#882804).

* 

  CVE-2014-4171: mm/shmem.c in the Linux kernel through 3.15.1 does not
  properly implement the interaction between range notification and
  hole punching, which allows local users to cause a denial of service
  (i_mutex hold) by using the mmap system call to access a hole, as
  demonstrated by interfering with intended shmem activity by blocking
  completion of (1) an MADV_REMOVE madvise call or (2) an
  FALLOC_FL_PUNCH_HOLE fallocate call (bnc#883518).

* 

  CVE-2014-4508: arch/x86/kernel/entry_32.S in the Linux kernel through
  3.15.1 on 32-bit x86 platforms, when syscall auditing is enabled and
  the sep CPU feature flag is set, allows local users to cause a denial
  of service (OOPS and system crash) via an invalid syscall number, as
  demonstrated by number 1000 (bnc#883724).

* 

  CVE-2014-4667: The sctp_association_free function in
  net/sctp/associola.c in the Linux kernel before 3.15.2 does not
  properly manage a certain backlog value, which allows remote
  attackers to cause a denial of service (socket outage) via a crafted
  SCTP packet (bnc#885422).

* 

  CVE-2014-4943: The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the
  Linux kernel through 3.15.6 allows local users to gain privileges by
  leveraging data-structure differences between an l2tp socket and an
  inet socket (bnc#887082).

* 

  CVE-2014-5077: The sctp_assoc_update function in net/sctp/associola.c
  in the Linux kernel through 3.15.8, when SCTP authentication is
  enabled, allows remote attackers to cause a denial of service (NULL
  pointer dereference and OOPS) by starting to establish an association
  between two endpoints immediately after an exchange of INIT and INIT
  ACK chunks to establish an earlier association between these
  endpoints in the opposite direction (bnc#889173).

* 

  CVE-2014-5471: Stack consumption vulnerability in the
  parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the
  Linux kernel through 3.16.1 allows local users to cause a denial of
  service (uncontrolled recursion, and system crash or reboot) via a
  crafted iso9660 image with a CL entry referring to a directory entry
  that has a CL entry. (bnc#892490)

* 

  CVE-2014-5472: The parse_rock_ridge_inode_internal function in
  fs/isofs/rock.c in the Linux kernel through 3.16.1 allows local users
  to cause a denial of service (unkillable mount process) via a crafted
  iso9660 image with a self-referential CL entry. (bnc#892490)

* 

  CVE-2014-2706: Race condition in the mac80211 subsystem in the Linux
  kernel before 3.13.7 allows remote attackers to cause a denial of
  service (system crash) via network traffic that improperly interacts
  with the WLAN_STA_PS_STA state (aka power-save mode), related to
  sta_info.c and tx.c. (bnc#871797)

* 

  CVE-2014-4027: The rd_build_device_space function in
  drivers/target/target_core_rd.c in the Linux kernel before 3.14 does
  not properly initialize a certain data structure, which allows local
  users to obtain sensitive information from ramdisk_mcp memory by
  leveraging access to a SCSI initiator. (bnc#882639)

* 

  CVE-2014-3153 The futex_requeue function in kernel/futex.c in the
  Linux kernel through 3.14.5 does not ensure that…

Multiple integer overflows in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 allow local users to cause a denial of service by leveraging /dev/snd/controlCX access, related to (1) index values in the snd_ctl_add function and (2) numid values in the snd_ctl_remove_numid_conflict function.

A flaw was discovered in the Linux kernel virtual machine's (kvm) validation of interrupt requests (irq). A guest OS user could exploit this flaw to cause a denial of service (host OS crash). (CVE-2014-0155)

Andy Lutomirski discovered a flaw in the authorization of netlink socket operations when a socket is passed to a process of more privilege. A local user could exploit this flaw to bypass access restrictions by having a privileged executable do something it was not intended to do. (CVE-2014-0181)

An information leak was discovered in the Linux kernels aio_read_events_ring function. A local user could exploit this flaw to obtain potentially sensitive information from kernel memory. (CVE-2014-0206)

A flaw was discovered in the Linux kernel's implementation of user namespaces with respect to inode permissions. A local user could exploit this flaw by creating a user namespace to gain administrative privileges. (CVE-2014-4014)

An information leak was discovered in the rd_mcp backend of the iSCSI target subsystem in the Linux kernel. A local user could exploit this flaw to obtain sensitive information from ramdisk_mcp memory by leveraging access to a SCSI initiator. (CVE-2014-4027)

Sasha Levin reported an issue with the Linux kernel's shared memory subsystem when used with range notifications and hole punching. A local user could exploit this flaw to cause a denial of service. (CVE-2014-4171)

Toralf Förster reported an error in the Linux kernels syscall auditing on 32 bit x86 platforms. A local user could exploit this flaw to cause a denial of service (OOPS and system crash). (CVE-2014-4508)

An information leak was discovered in the control implemenation of the Advanced Linux Sound Architecture (ALSA) subsystem in the Linux kernel. A local user could exploit this flaw to obtain sensitive information from kernel memory. (CVE-2014-4652)

A use-after-free flaw was discovered in the Advanced Linux Sound Architecture (ALSA) control implementation of the Linux kernel. A local user could exploit this flaw to cause a denial of service (system crash). (CVE-2014-4653)

A authorization bug was discovered with the snd_ctl_elem_add function of the Advanced Linux Sound Architecture (ALSA) in the Linux kernel. A local user could exploit his bug to cause a denial of service (remove kernel controls). (CVE-2014-4654)

A flaw discovered in how the snd_ctl_elem function of the Advanced Linux Sound Architecture (ALSA) handled a reference count. A local user could exploit this flaw to cause a denial of service (integer overflow and limit bypass). (CVE-2014-4655)

An integer overflow flaw was discovered in the control implementation of the Advanced Linux Sound Architecture (ALSA). A local user could exploit this flaw to cause a denial of service (system crash). (CVE-2014-4656)

An integer underflow flaw was discovered in the Linux kernel's handling of the backlog value for certain SCTP packets. A remote attacker could exploit this flaw to cause a denial of service (socket outage) via a crafted SCTP packet. (CVE-2014-4667)

Vasily Averin discover a reference count flaw during attempts to umount in conjunction with a symlink. A local user could exploit this flaw to cause a denial of service (memory consumption or use after free) or possibly have other unspecified impact. (CVE-2014-5045)