CVE-2018-10675

The do_get_mempolicy function in mm/mempolicy.c in the Linux kernel before 4.12.9 allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted system calls.

The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-3639: Information leaks using 'Memory Disambiguation' feature in modern CPUs were mitigated, aka 'Spectre Variant 4' (bnc#1087082).

  A new boot commandline option was introduced, 'spec_store_bypass_disable', which can have following values:

  • auto: Kernel detects whether your CPU model contains an implementation of Speculative Store Bypass and picks the most appropriate mitigation.
  • on: disable Speculative Store Bypass
  • off: enable Speculative Store Bypass
  • prctl: Control Speculative Store Bypass per thread via prctl. Speculative Store Bypass is enabled for a process by default. The state of the control is inherited on fork.
  • seccomp: Same as 'prctl' above, but all seccomp threads will disable SSB unless they explicitly opt out.

  The default is 'seccomp', meaning programs need explicit opt-in into the mitigation.

  Status can be queried via the /sys/devices/system/cpu/vulnerabilities/spec_store_bypass file, containing:

  • 'Vulnerable'
  • 'Mitigation: Speculative Store Bypass disabled'
  • 'Mitigation: Speculative Store Bypass disabled via prctl'
  • 'Mitigation: Speculative Store Bypass disabled via prctl and seccomp'

• CVE-2018-1000199: An address corruption flaw was discovered while modifying a h/w breakpoint via 'modify_user_hw_breakpoint' routine, an unprivileged user/process could use this flaw to crash the system kernel resulting in DoS OR to potentially escalate privileges on a the system. (bsc#1089895)

• CVE-2018-10675: The do_get_mempolicy function in mm/mempolicy.c allowed local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted system calls (bnc#1091755).

• CVE-2017-5715: The retpoline mitigation for Spectre v2 has been enabled also for 32bit x86.

• CVE-2017-5753: Spectre v1 mitigations have been improved by the versions merged from the upstream kernel.

The following non-security bugs were fixed:

• Avoid quadratic search when freeing delegations (bsc#1084760).
• cifs: fix crash due to race in hmac(md5) handling (bsc#1091671).
• hid: roccat: prevent an out of bounds read in kovaplus_profile_activated() (bsc#1087092).
• mmc: jz4740: Fix race condition in IRQ mask update (bsc#1090888).
• powerpc/64: Disable gmb() on powerpc
• powerpc/64s: Add barrier_nospec (bsc#1068032, bsc#1080157).
• powerpc/64s: Add support for ori barrier_nospec patching (bsc#1068032, bsc#1080157).
• powerpc/64s: Enable barrier_nospec based on firmware settings (bsc#1068032, bsc#1080157).
• powerpc/64s: Enhance the information in cpu_show_meltdown() (bsc#1068032, bsc#1075088, bsc#1091815).
• powerpc/64s: Enhance the information in cpu_show_spectre_v1() (bsc#1068032).
• powerpc/64s: Fix section mismatch warnings from setup_rfi_flush() (bsc#1068032, bsc#1075087, bsc#1091041).
• powerpc/64s: Improve RFI L1-D cache flush fallback (bsc#1068032, bsc#1075088, bsc#1091815).
• powerpc/64s: Move cpu_show_meltdown() (bsc#1068032, bsc#1075088, bsc#1091815).
• powerpc/64s: Patch barrier_nospec in modules (bsc#1068032, bsc#1080157).
• powerpc/64s: Wire up cpu_show_spectre_v1() (bsc#1068032, bsc#1075088, bsc#1091815).
• powerpc/64s: Wire up cpu_show_spectre_v2() (bsc#1068032, bsc#1075088, bsc#1091815).
• powerpc/64: Use barrier_nospec in syscall entry (bsc#1068032, bsc#1080157).
• powerpc: Add security feature flags for Spectre/Meltdown (bsc#1068032, bsc#1075088, bsc#1091815).
• powerpc: Move default security feature flags (bsc#1068032, bsc#1075088, bsc#1091815).
• powerpc: Move local setup.h declarations to arch includes (bsc#1068032, bsc#1075088, bsc#1091815).
• powerpc/pseries: Add new H_GET_CPU_CHARACTERISTICS flags (bsc#1068032, bsc#1075088, bsc#1091815).
• powerpc/pseries: Fix clearing of security feature flags (bsc#1068032, bsc#1075088, bsc#1091815).
• powerpc/pseries: Restore default security…

The SUSE Linux Enterprise 12 GA LTSS kernel was updated to receive several security fixes.

The following security bugs were fixed:

• CVE-2018-3639: Information leaks using 'Memory Disambiguation' feature in modern CPUs were mitigated, aka 'Spectre Variant 4' (bnc#1087082).

  A new boot commandline option was introduced, 'spec_store_bypass_disable', which can have following values:

  • auto: Kernel detects whether your CPU model contains an implementation of Speculative Store Bypass and picks the most appropriate mitigation.
  • on: disable Speculative Store Bypass
  • off: enable Speculative Store Bypass
  • prctl: Control Speculative Store Bypass per thread via prctl. Speculative Store Bypass is enabled for a process by default. The state of the control is inherited on fork.
  • seccomp: Same as 'prctl' above, but all seccomp threads will disable SSB unless they explicitly opt out.

  The default is 'seccomp', meaning programs need explicit opt-in into the mitigation.

  Status can be queried via the /sys/devices/system/cpu/vulnerabilities/spec_store_bypass file, containing:

  • 'Vulnerable'
  • 'Mitigation: Speculative Store Bypass disabled'
  • 'Mitigation: Speculative Store Bypass disabled via prctl'
  • 'Mitigation: Speculative Store Bypass disabled via prctl and seccomp'

• CVE-2018-1000199: An address corruption flaw was discovered while modifying a h/w breakpoint via 'modify_user_hw_breakpoint' routine, an unprivileged user/process could use this flaw to crash the system kernel resulting in DoS OR to potentially escalate privileges on a the system. (bsc#1089895)

• CVE-2018-10675: The do_get_mempolicy function in mm/mempolicy.c allowed local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted system calls (bnc#1091755).

The following non-security bugs were fixed:

• x86/bugs: Make sure that _TIF_SSBD does not end up in _TIF_ALLWORK_MASK (bsc#1093215).
• x86/bugs: correctly force-disable IBRS on !SKL systems (bsc#1092497).
• x86/cpu/intel: Introduce macros for Intel family numbers (bsc#985025).
• x86/cpu/intel: Introduce macros for Intel family numbers (bsc985025).
• x86/speculation: Remove Skylake C2 from Speculation Control microcode blacklist (bsc#1087845).

The SUSE Linux Enterprise 12 SP1 LTSS kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-3639: Information leaks using 'Memory Disambiguation' feature in modern CPUs were mitigated, aka 'Spectre Variant 4' (bnc#1087082).

  A new boot commandline option was introduced, 'spec_store_bypass_disable', which can have following values:

  • auto: Kernel detects whether your CPU model contains an implementation of Speculative Store Bypass and picks the most appropriate mitigation.
  • on: disable Speculative Store Bypass
  • off: enable Speculative Store Bypass
  • prctl: Control Speculative Store Bypass per thread via prctl. Speculative Store Bypass is enabled for a process by default. The state of the control is inherited on fork.
  • seccomp: Same as 'prctl' above, but all seccomp threads will disable SSB unless they explicitly opt out.

  The default is 'seccomp', meaning programs need explicit opt-in into the mitigation.

  Status can be queried via the /sys/devices/system/cpu/vulnerabilities/spec_store_bypass file, containing:

  • 'Vulnerable'
  • 'Mitigation: Speculative Store Bypass disabled'
  • 'Mitigation: Speculative Store Bypass disabled via prctl'
  • 'Mitigation: Speculative Store Bypass disabled via prctl and seccomp'

• CVE-2018-1000199: An address corruption flaw was discovered while modifying a h/w breakpoint via 'modify_user_hw_breakpoint' routine, an unprivileged user/process could use this flaw to crash the system kernel resulting in DoS OR to potentially escalate privileges on a the system. (bsc#1089895)

• CVE-2018-10675: The do_get_mempolicy function in mm/mempolicy.c allowed local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted system calls (bnc#1091755).

The following non-security bugs were fixed:

• x86/bugs: Make sure that _TIF_SSBD does not end up in _TIF_ALLWORK_MASK (bsc#1093215).
• x86/bugs: correctly force-disable IBRS on !SKL systems (bsc#1092497).
• x86/cpu/intel: Introduce macros for Intel family numbers (bsc#985025).
• x86/speculation: Remove Skylake C2 from Speculation Control microcode blacklist (bsc#1087845).

The SUSE Linux Enterprise 11 SP3 LTSS kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-3639: Information leaks using 'Memory Disambiguation' feature in modern CPUs were mitigated, aka 'Spectre Variant 4' (bnc#1087082).

  A new boot commandline option was introduced, 'spec_store_bypass_disable', which can have following values:

  • auto: Kernel detects whether your CPU model contains an implementation of Speculative Store Bypass and picks the most appropriate mitigation.
  • on: disable Speculative Store Bypass
  • off: enable Speculative Store Bypass
  • prctl: Control Speculative Store Bypass per thread via prctl. Speculative Store Bypass is enabled for a process by default. The state of the control is inherited on fork.
  • seccomp: Same as 'prctl' above, but all seccomp threads will disable SSB unless they explicitly opt out.

  The default is 'seccomp', meaning programs need explicit opt-in into the mitigation.

  Status can be queried via the /sys/devices/system/cpu/vulnerabilities/spec_store_bypass file, containing:

  • 'Vulnerable'
  • 'Mitigation: Speculative Store Bypass disabled'
  • 'Mitigation: Speculative Store Bypass disabled via prctl'
  • 'Mitigation: Speculative Store Bypass disabled via prctl and seccomp'

• CVE-2018-1000199: An address corruption flaw was discovered while modifying a h/w breakpoint via 'modify_user_hw_breakpoint' routine, an unprivileged user/process could use this flaw to crash the system kernel resulting in DoS OR to potentially escalate privileges on a the system. (bsc#1089895)

• CVE-2018-10675: The do_get_mempolicy function in mm/mempolicy.c allowed local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted system calls (bnc#1091755).

• CVE-2017-5715: The retpoline mitigation for Spectre v2 has been enabled also for 32bit x86.

• CVE-2017-5753: Spectre v1 mitigations have been improved by the versions merged from the upstream kernel.

The following non-security bugs were fixed:

• Update config files. Set CONFIG_RETPOLINE=y for i386.
• x86/espfix: Fix return stack in do_double_fault() (bsc#1085279).
• xen-netfront: fix req_prod check to avoid RX hang when index wraps (bsc#1046610).

The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes.

This new feature was added:

• Btrfs: Remove empty block groups in the background

The following security bugs were fixed:

• : Prevent disclosure of FPU registers (including XMM and AVX registers) between processes. These registers might contain encryption keys when doing SSE accelerated AES enc/decryption (bsc#1087086)
• : Systems with microprocessors utilizing speculative execution and speculative execution of memory reads the addresses of all prior memory writes are known may have allowed unauthorized disclosure of information to an attacker with local user access via a side-channel analysis, aka Speculative Store Bypass (SSB), Variant 4 (bsc#1087082)
• : Prevent vulnerability in modify_user_hw_breakpoint() that could have caused a crash and possibly memory corruption (bsc#1089895)
• : The do_get_mempolicy function allowed local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted system calls (bnc#1091755).

The following non-security bugs were fixed:

• ALSA: timer: Fix pause event notification (bsc#973378).
• Avoid quadratic search when freeing delegations (bsc#1084760).
• Btrfs: Avoid trucating page or punching hole in a already existed hole (bsc#1088998).
• Btrfs: Avoid truncate tailing page if fallocate range does not exceed inode size (bsc#1094424).
• Btrfs: Fix lost-data-profile caused by auto removing bg
• Btrfs: Fix misuse of chunk mutex
• Btrfs: Fix out-of-space bug (bsc#1089231).
• Btrfs: Set relative data on clear btrfs_block_group_cache->pinned
• Btrfs: Use ref_cnt for set_block_group_ro() (bsc#1089239).
• Btrfs: add alloc_fs_devices and switch to it (bsc#1089205).
• Btrfs: add btrfs_alloc_device and switch to it (bsc#1089204).
• Btrfs: add missing discards when unpinning extents with -o discard
• Btrfs: add missing inode update when punching hole (bsc#1089006).
• Btrfs: add support for asserts (bsc#1089207).
• Btrfs: avoid syncing log in the fast fsync path when not necessary (bsc#1089010).
• Btrfs: btrfs_issue_discard ensure offset/length are aligned to sector boundaries
• Btrfs: check pending chunks when shrinking fs to avoid corruption (bsc#1089235).
• Btrfs: cleanup backref search commit root flag stuff (bsc#1089200).
• Btrfs: do not leak transaction in btrfs_sync_file() (bsc#1089210).
• Btrfs: do not mix the ordered extents of all files together during logging the inodes (bsc#1089214).
• Btrfs: do not remove extents and xattrs when logging new names (bsc#1089005).
• Btrfs: eliminate races in worker stopping code (bsc#1089211).
• Btrfs: ensure deletion from pinned_chunks list is protected
• Btrfs: fix -ENOSPC on block group removal
• Btrfs: fix -ENOSPC when finishing block group creation
• Btrfs: fix NULL pointer crash when running balance and scrub concurrently (bsc#1089220).
• Btrfs: fix chunk allocation regression leading to transaction abort (bsc#1089236).
• Btrfs: fix crash caused by block group removal
• Btrfs: fix data loss in the fast fsync path (bsc#1089007).
• Btrfs: fix deadlock caused by fsync when logging directory entries (bsc#1093194).
• Btrfs: fix directory inconsistency after fsync log replay (bsc#1089001).
• Btrfs: fix directory recovery from fsync log (bsc#1088999).
• Btrfs: fix empty symlink after creating symlink and fsync parent dir (bsc#1093195).
• Btrfs: fix file loss on log replay after renaming a file and fsync (bsc#1093196).
• Btrfs: fix file/data loss caused by fsync after rename and new inode (bsc#1089241).
• Btrfs: fix find_free_dev_extent() malfunction in case device tree has hole (bsc#1089232).
• Btrfs: fix fitrim discarding device area reserved for boot loader's use
• Btrfs: fix freeing used extent after removing empty block group
• Btrfs: fix freeing used extents after removing empty block group
• Btrfs: fix fs mapping extent map leak (bsc#1089229).
• Btrfs: fix fsync data loss after a ranged fsync…

Ralf Spenneberg discovered that the ext4 implementation in the Linux kernel did not properly validate meta block groups. An attacker with physical access could use this to specially craft an ext4 image that causes a denial of service (system crash). (CVE-2016-10208)

It was discovered that an information disclosure vulnerability existed in the ACPI implementation of the Linux kernel. A local attacker could use this to expose sensitive information (kernel memory addresses). (CVE-2017-11472)

It was discovered that a buffer overflow existed in the ACPI table parsing implementation in the Linux kernel. A local attacker could use this to construct a malicious ACPI table that, when loaded, caused a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-11473)

It was discovered that the generic SCSI driver in the Linux kernel did not properly initialize data returned to user space in some situations. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2017-14991)

It was discovered that a race condition existed in the packet fanout implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-15649)

Andrey Konovalov discovered that the Ultra Wide Band driver in the Linux kernel did not properly check for an error condition. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-16526)

Andrey Konovalov discovered that the ALSA subsystem in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-16527)

Andrey Konovalov discovered that the ALSA subsystem in the Linux kernel did not properly validate USB audio buffer descriptors. A physically proximate attacker could use this cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-16529)

Andrey Konovalov discovered that the USB subsystem in the Linux kernel did not properly validate USB interface association descriptors. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2017-16531)

Andrey Konovalov discovered that the usbtest device driver in the Linux kernel did not properly validate endpoint metadata. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2017-16532)

Andrey Konovalov discovered that the USB subsystem in the Linux kernel did not properly validate USB HID descriptors. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2017-16533)

Andrey Konovalov discovered that the USB subsystem in the Linux kernel did not properly validate USB BOS metadata. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2017-16535)

Andrey Konovalov discovered that the Conexant cx231xx USB video capture driver in the Linux kernel did not properly validate interface descriptors. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2017-16536)

Andrey Konovalov discovered that the SoundGraph iMON USB driver in the Linux kernel did not properly validate device metadata. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2017-16537)

It was discovered that the DM04/QQBOX USB driver in the Linux kernel did not properly handle device attachment and warm-start. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-16538)

Andrey Konovalov discovered an out-of-bounds read in the GTCO digitizer USB driver for the Linux kernel. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.…