CVE-2018-1000004

In the Linux kernel 4.12, 3.10, 2.6 and possibly earlier versions a race condition vulnerability exists in the sound system, this can lead to a deadlock and denial of service condition.

This kernel update is based on the upstream 4.14.30 and fixes at least the following security issues:

The KPTI mitigation for Meltdown (CVE-2017-5754) on 32bit x86 has been updated to revision 4.

A flaw was found in the Linux kernel implementation of 32 bit syscall interface for bridging allowing a privileged user to arbitrarily write to a limited range of kernel memory. This flaw can be exploited not only by a system's privileged user (a real "root" user), but also by an attacker who is a privileged user (a "root" user) in a user+network namespace (CVE-2018-1068).

A race condition vulnerability exists in the sound system, that can lead to a deadlock and denial of service condition (CVE-2018-1000004).

Other changes in this update:

3rdparty rtl8812au driver has been updated to v5.2.20 (mga#22808) and adds fixes for KRACK security issue.

For other upstream fixes in this update, read the referenced changelogs.

This kernel-tmb update is based on the upstream 4.14.44 and fixes at least the following security issues:

This update adds KPTI mitigation for Meltdown (CVE-2017-5754) on 32bit x86.

The netfilter subsystem in the Linux kernel through 4.15.7 mishandles the case of a rule blob that contains a jump but lacks a user-defined chain, which allows local users to cause a denial of service (NULL pointer dereference) by leveraging the CAP_NET_RAW or CAP_NET_ADMIN capability, related to arpt_do_table in net/ipv4/netfilter/arp_tables.c, ipt_do_table in net/ipv4/netfilter/ip_tables.c, and ip6t_do_table in net/ipv6/netfilter/ip6_tables.c (CVE-2018-1065).

A flaw was found in the Linux kernel implementation of 32 bit syscall interface for bridging allowing a privileged user to arbitrarily write to a limited range of kernel memory. This flaw can be exploited not only by a system's privileged user (a real "root" user), but also by an attacker who is a privileged user (a "root" user) in a user+network namespace (CVE-2018-1068).

On x86, MOV SS and POP SS behave strangely if they encounter a data breakpoint. If this occurs in a KVM guest, KVM incorrectly thinks that a #DB instruction was caused by the undocumented ICEBP instruction. This results in #DB being delivered to the guest kernel with an incorrect RIP on the stack. On most guest kernels, this will allow a guest user to DoS the guest kernel or even to escalate privilege to that of the guest kernel (CVE-2018-1087).

The ext4_iget function in fs/ext4/inode.c in the Linux kernel through 4.15.15 mishandles the case of a root directory with a zero i_links_count, which allows attackers to cause a denial of service (ext4_process_freed_data NULL pointer dereference and OOPS) via a crafted ext4 image (CVE-2018-1092).

The ext4_valid_block_bitmap function in fs/ext4/balloc.c in the Linux kernel through 4.15.15 allows attackers to cause a denial of service (out-of-bounds read and system crash) via a crafted ext4 image because balloc.c and ialloc.c do not validate bitmap block numbers (CVE-2018-1093).

The ext4_fill_super function in fs/ext4/super.c in the Linux kernel through 4.15.15 does not always initialize the crc32c checksum driver, which allows attackers to cause a denial of service (ext4_xattr_inode_hash NULL pointer dereference and system crash) via a crafted ext4 image (CVE-2018-1094).

The ext4_xattr_check_entries function in fs/ext4/xattr.c in the Linux kernel through 4.15.15 does not properly validate xattr sizes, which causes misinterpretation of a size as an error code, and consequently allows attackers to cause a denial of service (get_acl NULL pointer dereference and system crash) via a crafted ext4 image (CVE-2018-1095).

By mmap()ing a FUSE-backed file onto a process's memory containing command line arguments (or environment strings), an attacker can cause utilities from psutils or procps (such as ps, w) or any other program which makes a read() call to the /proc/<pid>/cmdline (or /proc/<pid>/environ) files to block indefinitely (denial of service) or for some controlled time (as a synchronization primitive for other attacks) (CVE-2018-1120).

A null pointer dereference in dccp_write_xmit() function in net/dccp/output.c in the Linux kernel before v4.16-rc7 allows a local user to cause a denial of service by a number of certain crafted system calls (CVE-2018-1130).

Speculative Store Bypass (SSB) – also known as Spectre Variant 4. Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis (CVE-2018-3639). NOTE! This fix only apply to Amd hardware so far as Intel CPUs need a fixed microcode update in order for the fix to get activated. At the time of this release we dont yet know when Intel will release new microcode.

The Linux kernel does not properly handle debug…

This kernel-linus update is based on the upstream 4.14.44 and fixes at least the following security issues:

The netfilter subsystem in the Linux kernel through 4.15.7 mishandles the case of a rule blob that contains a jump but lacks a user-defined chain, which allows local users to cause a denial of service (NULL pointer dereference) by leveraging the CAP_NET_RAW or CAP_NET_ADMIN capability, related to arpt_do_table in net/ipv4/netfilter/arp_tables.c, ipt_do_table in net/ipv4/netfilter/ip_tables.c, and ip6t_do_table in net/ipv6/netfilter/ip6_tables.c (CVE-2018-1065).

A flaw was found in the Linux kernel implementation of 32 bit syscall interface for bridging allowing a privileged user to arbitrarily write to a limited range of kernel memory. This flaw can be exploited not only by a system's privileged user (a real "root" user), but also by an attacker who is a privileged user (a "root" user) in a user+network namespace (CVE-2018-1068).

On x86, MOV SS and POP SS behave strangely if they encounter a data breakpoint. If this occurs in a KVM guest, KVM incorrectly thinks that a #DB instruction was caused by the undocumented ICEBP instruction. This results in #DB being delivered to the guest kernel with an incorrect RIP on the stack. On most guest kernels, this will allow a guest user to DoS the guest kernel or even to escalate privilege to that of the guest kernel (CVE-2018-1087).

The ext4_iget function in fs/ext4/inode.c in the Linux kernel through 4.15.15 mishandles the case of a root directory with a zero i_links_count, which allows attackers to cause a denial of service (ext4_process_freed_data NULL pointer dereference and OOPS) via a crafted ext4 image (CVE-2018-1092).

The ext4_valid_block_bitmap function in fs/ext4/balloc.c in the Linux kernel through 4.15.15 allows attackers to cause a denial of service (out-of-bounds read and system crash) via a crafted ext4 image because balloc.c and ialloc.c do not validate bitmap block numbers (CVE-2018-1093).

The ext4_fill_super function in fs/ext4/super.c in the Linux kernel through 4.15.15 does not always initialize the crc32c checksum driver, which allows attackers to cause a denial of service (ext4_xattr_inode_hash NULL pointer dereference and system crash) via a crafted ext4 image (CVE-2018-1094).

The ext4_xattr_check_entries function in fs/ext4/xattr.c in the Linux kernel through 4.15.15 does not properly validate xattr sizes, which causes misinterpretation of a size as an error code, and consequently allows attackers to cause a denial of service (get_acl NULL pointer dereference and system crash) via a crafted ext4 image (CVE-2018-1095).

Predictable Random Number Generator Weakness (CVE-2018-1108).

By mmap()ing a FUSE-backed file onto a process's memory containing command line arguments (or environment strings), an attacker can cause utilities from psutils or procps (such as ps, w) or any other program which makes a read() call to the /proc/<pid>/cmdline (or /proc/<pid>/environ) files to block indefinitely (denial of service) or for some controlled time (as a synchronization primitive for other attacks) (CVE-2018-1120).

A null pointer dereference in dccp_write_xmit() function in net/dccp/output.c in the Linux kernel before v4.16-rc7 allows a local user to cause a denial of service by a number of certain crafted system calls (CVE-2018-1130).

Speculative Store Bypass (SSB) – also known as Spectre Variant 4. Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis (CVE-2018-3639). NOTE! This fix only apply to Amd hardware so far as Intel CPUs need a fixed microcode update in order for the fix to get activated. At the time of this release we dont yet know when Intel will release new microcode.

The Linux kernel does not properly handle debug exceptions…

These are all security issues fixed in the kernel-devel-5.14.6-1.4 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the kernel-devel-longterm-6.6.17-1.1 package on the GA media of openSUSE Tumbleweed.

The SUSE Linux Enterprise 12 SP3 kernel was updated to 4.4.114 to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2017-5715: Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis (bnc#1068032).

  The previous fix using CPU Microcode has been complemented by building the Linux Kernel with return trampolines aka 'retpolines'.

• CVE-2017-15129: A use-after-free vulnerability was found in network namespaces code affecting the Linux kernel in the function get_net_ns_by_id() in net/core/net_namespace.c did not check for the net::count value after it has found a peer network in netns_ids idr, which could lead to double free and memory corruption. This vulnerability could allow an unprivileged local user to induce kernel memory corruption on the system, leading to a crash. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although it is thought to be unlikely (bnc#1074839).

• CVE-2017-17712: The raw_sendmsg() function in net/ipv4/raw.c in the Linux kernel has a race condition in inet->hdrincl that leads to uninitialized stack pointer usage; this allowed a local user to execute code and gain privileges (bnc#1073229).

• CVE-2017-17862: kernel/bpf/verifier.c in the Linux kernel ignored unreachable code, even though it would still be processed by JIT compilers. This behavior, also considered an improper branch-pruning logic issue, could possibly be used by local users for denial of service (bnc#1073928).

• CVE-2017-17864: kernel/bpf/verifier.c in the Linux kernel mishandled states_equal comparisons between the pointer data type and the UNKNOWN_VALUE data type, which allowed local users to obtain potentially sensitive address information, aka a 'pointer leak (bnc#1073928).

• CVE-2017-18017: The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c in the Linux kernel allowed remote attackers to cause a denial of service (use-after-free and memory corruption) or possibly have unspecified other impact by leveraging the presence of xt_TCPMSS in an iptables action (bnc#1074488).

• CVE-2018-5332: In the Linux kernel the rds_message_alloc_sgs() function did not validate a value that is used during DMA page allocation, leading to a heap-based out-of-bounds write (related to the rds_rdma_extra_size function in net/rds/rdma.c) (bnc#1075621).

• CVE-2018-5333: In the Linux kernel the rds_cmsg_atomic function in net/rds/rdma.c mishandled cases where page pinning fails or an invalid address is supplied, leading to an rds_atomic_free_op NULL pointer dereference (bnc#1075617).

• CVE-2018-1000004: In the Linux kernel a race condition vulnerability existed in the sound system, this can lead to a deadlock and denial of service condition (bnc#1076017).

The following non-security bugs were fixed:

• 8021q: fix a memory leak for VLAN 0 device (bnc#1012382).
• acpi / scan: Prefer devices without _HID/_CID for _ADR matching (bnc#1012382).
• af_key: fix buffer overread in parse_exthdrs() (bnc#1012382).
• af_key: fix buffer overread in verify_address_len() (bnc#1012382).
• afs: Adjust mode bits processing (bnc#1012382).
• afs: Connect up the CB.ProbeUuid (bnc#1012382).
• afs: Fix afs_kill_pages() (bnc#1012382).
• afs: Fix missing put_page() (bnc#1012382).
• afs: Fix page leak in afs_write_begin() (bnc#1012382).
• afs: Fix the maths in afs_fs_store_data() (bnc#1012382).
• afs: Flush outstanding writes when an fd is closed (bnc#1012382).
• afs: Migrate vlocation fields to 64-bit (bnc#1012382).
• afs: Populate and use client modification time (bnc#1012382).
• afs: Populate group ID from vnode status (bnc#1012382).
• afs: Prevent callback expiry timer overflow (bnc#1012382).
• alpha: fix build failures (bnc#1012382).
• alsa: aloop: Fix inconsistent format due to incomplete rule (bsc#1031717).
• alsa: aloop: Fix racy hw constraints…

The SUSE Linux Enterprise 12 SP2 kernel was updated to 4.4.114 to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2017-5715: Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis (bnc#1068032).

  The previous fix using CPU Microcode has been complemented by building the Linux Kernel with return trampolines aka 'retpolines'.

• CVE-2017-15129: A use-after-free vulnerability was found in network namespaces code affecting the Linux kernel The function get_net_ns_by_id() in net/core/net_namespace.c did not check for the net::count value after it has found a peer network in netns_ids idr, which could lead to double free and memory corruption. This vulnerability could allow an unprivileged local user to induce kernel memory corruption on the system, leading to a crash. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although it is thought to be unlikely (bnc#1074839).

• CVE-2017-17712: The raw_sendmsg() function in net/ipv4/raw.c in the Linux kernel has a race condition in inet->hdrincl that leads to uninitialized stack pointer usage; this allowed a local user to execute code and gain privileges (bnc#1073229).

• CVE-2017-17862: kernel/bpf/verifier.c in the Linux kernel ignored unreachable code, even though it would still be processed by JIT compilers. This behavior, also considered an improper branch-pruning logic issue, could possibly be used by local users for denial of service (bnc#1073928).

• CVE-2017-17864: kernel/bpf/verifier.c in the Linux kernel mishandled states_equal comparisons between the pointer data type and the UNKNOWN_VALUE data type, which allowed local users to obtain potentially sensitive address information, aka a 'pointer leak (bnc#1073928).

• CVE-2017-18017: The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c in the Linux kernel allowed remote attackers to cause a denial of service (use-after-free and memory corruption) or possibly have unspecified other impact by leveraging the presence of xt_TCPMSS in an iptables action (bnc#1074488).

• CVE-2018-1000004: In the Linux kernel a race condition vulnerability existed in the sound system, this can lead to a deadlock and denial of service condition (bnc#1076017).

• CVE-2018-5332: In the Linux kernel the rds_message_alloc_sgs() function did not validate a value that is used during DMA page allocation, leading to a heap-based out-of-bounds write (related to the rds_rdma_extra_size function in net/rds/rdma.c) (bnc#1075621).

• CVE-2018-5333: In the Linux kernel the rds_cmsg_atomic function in net/rds/rdma.c mishandled cases where page pinning fails or an invalid address is supplied, leading to an rds_atomic_free_op NULL pointer dereference (bnc#1075617).

The following non-security bugs were fixed:

• 8021q: fix a memory leak for VLAN 0 device (bnc#1012382).
• ACPI / scan: Prefer devices without _HID/_CID for _ADR matching (bnc#1012382).
• ARC: uaccess: dont use 'l' gcc inline asm constraint modifier (bnc#1012382).
• Fix EX_SIZE. We do not have the patches that shave off parts of the exception data.
• Fix build error in vma.c (bnc#1012382).
• Fix mishandling of cases with MSR not being present (writing to MSR even though _state == -1).
• Fix return value from ib[rs|pb]_enabled()
• Input: trackpoint - force 3 buttons if 0 button is reported (bnc#1012382).
• KVM: s390: Enable all facility bits that are known good for passthrough (bsc#1076806).
• Kabi: Keep KVM stable after enable s390 wire up bpb feature (bsc#1076806).
• Move RFI sysfs to a separate patch
• Move the RFI debug code into separate patch.
• Re-enable fixup detection by CPU type in case hypervisor call fails.
• Revert 'Bluetooth: btusb: driver to enable the usb-wakeup feature' (bnc#1012382).
• Revert 'Re-enable fixup detection by CPU type in case hypervisor call fails.' The…

The SUSE Linux Enterprise 12 GA LTSS kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2017-5715: Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis (bnc#1068032).

  The previous fix using CPU Microcode has been complemented by building the Linux Kernel with return trampolines aka 'retpolines'.

• CVE-2017-18079: drivers/input/serio/i8042.c allowed attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact because the port->exists value can change after it is validated (bnc#1077922)

• CVE-2015-1142857: Prevent guests from sending ethernet flow control pause frames via the PF (bnc#1077355)

• CVE-2017-17741: KVM allowed attackers to obtain potentially sensitive information from kernel memory, aka a write_mmio stack-based out-of-bounds read (bnc#1073311)

• CVE-2017-13215: Prevent elevation of privilege (bnc#1075908)

• CVE-2018-1000004: Prevent race condition in the sound system, this could have lead a deadlock and denial of service condition (bnc#1076017)

• CVE-2017-17806: The HMAC implementation did not validate that the underlying cryptographic hash algorithm is unkeyed, allowing a local attacker able to use the AF_ALG-based hash interface (CONFIG_CRYPTO_USER_API_HASH) and the SHA-3 hash algorithm (CONFIG_CRYPTO_SHA3) to cause a kernel stack buffer overflow by executing a crafted sequence of system calls that encounter a missing SHA-3 initialization (bnc#1073874)

• CVE-2017-17805: The Salsa20 encryption algorithm did not correctly handle zero-length inputs, allowing a local attacker able to use the AF_ALG-based skcipher interface (CONFIG_CRYPTO_USER_API_SKCIPHER) to cause a denial of service (uninitialized-memory free and kernel crash) or have unspecified other impact by executing a crafted sequence of system calls that use the blkcipher_walk API. Both the generic implementation (crypto/salsa20_generic.c) and x86 implementation (arch/x86/crypto/salsa20_glue.c) of Salsa20 were vulnerable (bnc#1073792)

The following non-security bugs were fixed:

• bcache allocator: send discards with correct size (bsc#1047626).
• bcache.txt: standardize document format (bsc#1076110).
• bcache: Abstract out stuff needed for sorting (bsc#1076110).
• bcache: Add a cond_resched() call to gc (bsc#1076110).
• bcache: Add a real GC_MARK_RECLAIMABLE (bsc#1076110).
• bcache: Add bch_bkey_equal_header() (bsc#1076110).
• bcache: Add bch_btree_keys_u64s_remaining() (bsc#1076110).
• bcache: Add bch_keylist_init_single() (bsc#1047626).
• bcache: Add btree_insert_node() (bnc#951638).
• bcache: Add btree_map() functions (bsc#1047626).
• bcache: Add btree_node_write_sync() (bsc#1076110).
• bcache: Add explicit keylist arg to btree_insert() (bnc#951638).
• bcache: Add make_btree_freeing_key() (bsc#1076110).
• bcache: Add on error panic/unregister setting (bsc#1047626).
• bcache: Add struct bset_sort_state (bsc#1076110).
• bcache: Add struct btree_keys (bsc#1076110).
• bcache: Allocate bounce buffers with GFP_NOWAIT (bsc#1076110).
• bcache: Avoid deadlocking in garbage collection (bsc#1076110).
• bcache: Avoid nested function definition (bsc#1076110).
• bcache: Better alloc tracepoints (bsc#1076110).
• bcache: Better full stripe scanning (bsc#1076110).
• bcache: Bkey indexing renaming (bsc#1076110).
• bcache: Break up struct search (bsc#1076110).
• bcache: Btree verify code improvements (bsc#1076110).
• bcache: Bypass torture test (bsc#1076110).
• bcache: Change refill_dirty() to always scan entire disk if necessary (bsc#1076110).
• bcache: Clean up cache_lookup_fn (bsc#1076110).
• bcache: Clean up keylist code (bnc#951638).
• bcache: Convert bch_btree_insert() to bch_btree_map_leaf_nodes() (bsc#1076110).
• bcache: Convert…

The SUSE Linux Enterprise 12 SP2 Realtime kernel was updated to 4.4.114 to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2017-5715: Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis (bnc#1068032).

  The previous fix using CPU Microcode has been complemented by building the Linux Kernel with return trampolines aka 'retpolines'.

• CVE-2018-5333: In the Linux kernel the rds_cmsg_atomic function in net/rds/rdma.c mishandled cases where page pinning fails or an invalid address is supplied, leading to an rds_atomic_free_op NULL pointer dereference (bnc#1075617).

• CVE-2018-5332: In the Linux kernel the rds_message_alloc_sgs() function did not validate a value that is used during DMA page allocation, leading to a heap-based out-of-bounds write (related to the rds_rdma_extra_size function in net/rds/rdma.c) (bnc#1075621).

• CVE-2017-17862: kernel/bpf/verifier.c in the Linux kernel ignores unreachable code, even though it would still be processed by JIT compilers. This behavior, also considered an improper branch-pruning logic issue, could possibly be used by local users for denial of service (bnc#1073928).

• CVE-2017-17864: kernel/bpf/verifier.c in the Linux kernel mishandled states_equal comparisons between the pointer data type and the UNKNOWN_VALUE data type, which allowed local users to obtain potentially sensitive address information, aka a 'pointer leak (bnc#1073928).

• CVE-2017-17712: The raw_sendmsg() function in net/ipv4/raw.c in the Linux kernel has a race condition in inet->hdrincl that leads to uninitialized stack pointer usage; this allowed a local user to execute code and gain privileges (bnc#1073229 1073230).

• CVE-2017-15129: A use-after-free vulnerability was found in network namespaces code affecting the Linux kernel The function get_net_ns_by_id() in net/core/net_namespace.c did not check for the net::count value after it has found a peer network in netns_ids idr, which could lead to double free and memory corruption. This vulnerability could allow an unprivileged local user to induce kernel memory corruption on the system, leading to a crash. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although it is thought to be unlikely (bnc#1074839).

• CVE-2017-18017: The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c in the Linux kernel allowed remote attackers to cause a denial of service (use-after-free and memory corruption) or possibly have unspecified other impact by leveraging the presence of xt_TCPMSS in an iptables action (bnc#1074488).

• CVE-2018-1000004: In the Linux kernel a race condition vulnerability exists in the sound system, this can lead to a deadlock and denial of service condition (bnc#1076017).

The following non-security bugs were fixed:

• 509: fix printing uninitialized stack memory when OID is empty (bsc#1075078).
• 8021q: fix a memory leak for VLAN 0 device (bnc#1012382).
• acpi / scan: Prefer devices without _HID/_CID for _ADR matching (bnc#1012382).
• af_key: fix buffer overread in parse_exthdrs() (bnc#1012382).
• af_key: fix buffer overread in verify_address_len() (bnc#1012382).
• afs: Adjust mode bits processing (bnc#1012382).
• afs: Connect up the CB.ProbeUuid (bnc#1012382).
• afs: Fix afs_kill_pages() (bnc#1012382).
• afs: Fix missing put_page() (bnc#1012382).
• afs: Fix page leak in afs_write_begin() (bnc#1012382).
• afs: Fix the maths in afs_fs_store_data() (bnc#1012382).
• afs: Flush outstanding writes when an fd is closed (bnc#1012382).
• afs: Migrate vlocation fields to 64-bit (bnc#1012382).
• afs: Populate and use client modification time (bnc#1012382).
• afs: Populate group ID from vnode status (bnc#1012382).
• afs: Prevent callback expiry timer overflow (bnc#1012382).
• alpha: fix build failures (bnc#1012382).
• alsa: aloop: Fix inconsistent…

The SUSE Linux Enterprise 12 SP1 LTSS kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2017-5715: Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis (bnc#1068032).

  The previous fix using CPU Microcode has been complemented by building the Linux Kernel with return trampolines aka 'retpolines'.

• CVE-2017-18079: drivers/input/serio/i8042.c allowed attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact because the port->exists value can change after it is validated (bnc#1077922).

• CVE-2015-1142857: Prevent guests from sending ethernet flow control pause frames via the PF (bnc#1077355).

• CVE-2017-17741: KVM allowed attackers to obtain potentially sensitive information from kernel memory, aka a write_mmio stack-based out-of-bounds read (bnc#1073311).

• CVE-2017-13215: Prevent elevation of privilege (bnc#1075908).

• CVE-2018-1000004: Prevent race condition in the sound system, this could have lead a deadlock and denial of service condition (bnc#1076017).

• CVE-2017-17806: The HMAC implementation did not validate that the underlying cryptographic hash algorithm is unkeyed, allowing a local attacker able to use the AF_ALG-based hash interface (CONFIG_CRYPTO_USER_API_HASH) and the SHA-3 hash algorithm (CONFIG_CRYPTO_SHA3) to cause a kernel stack buffer overflow by executing a crafted sequence of system calls that encounter a missing SHA-3 initialization (bnc#1073874).

• CVE-2017-17805: The Salsa20 encryption algorithm did not correctly handle zero-length inputs, allowing a local attacker able to use the AF_ALG-based skcipher interface (CONFIG_CRYPTO_USER_API_SKCIPHER) to cause a denial of service (uninitialized-memory free and kernel crash) or have unspecified other impact by executing a crafted sequence of system calls that use the blkcipher_walk API. Both the generic implementation (crypto/salsa20_generic.c) and x86 implementation (arch/x86/crypto/salsa20_glue.c) of Salsa20 were vulnerable (bnc#1073792).

The following non-security bugs were fixed:

• NFS: only invalidate dentrys that are clearly invalid (bsc#1047118).
• bcache.txt: standardize document format (bsc#1076110).
• bcache: Abstract out stuff needed for sorting (bsc#1076110).
• bcache: Add a cond_resched() call to gc (bsc#1076110).
• bcache: Add a real GC_MARK_RECLAIMABLE (bsc#1076110).
• bcache: Add bch_bkey_equal_header() (bsc#1076110).
• bcache: Add bch_btree_keys_u64s_remaining() (bsc#1076110).
• bcache: Add bch_keylist_init_single() (bsc#1047626).
• bcache: Add btree_insert_node() (bnc#951638).
• bcache: Add btree_map() functions (bsc#1047626).
• bcache: Add btree_node_write_sync() (bsc#1076110).
• bcache: Add explicit keylist arg to btree_insert() (bnc#951638).
• bcache: Add make_btree_freeing_key() (bsc#1076110).
• bcache: Add on error panic/unregister setting (bsc#1047626).
• bcache: Add struct bset_sort_state (bsc#1076110).
• bcache: Add struct btree_keys (bsc#1076110).
• bcache: Allocate bounce buffers with GFP_NOWAIT (bsc#1076110).
• bcache: Avoid deadlocking in garbage collection (bsc#1076110).
• bcache: Avoid nested function definition (bsc#1076110).
• bcache: Better alloc tracepoints (bsc#1076110).
• bcache: Better full stripe scanning (bsc#1076110).
• bcache: Bkey indexing renaming (bsc#1076110).
• bcache: Break up struct search (bsc#1076110).
• bcache: Btree verify code improvements (bsc#1076110).
• bcache: Bypass torture test (bsc#1076110).
• bcache: Change refill_dirty() to always scan entire disk if necessary (bsc#1076110).
• bcache: Clean up cache_lookup_fn (bsc#1076110).
• bcache: Clean up keylist code (bnc#951638).
• bcache: Convert bch_btree_insert() to bch_btree_map_leaf_nodes() (bsc#1076110).
• bcache: Convert…

The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2017-5715: Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis (bnc#1068032).

  The previous fix using CPU Microcode has been complemented by building the Linux Kernel with return trampolines aka 'retpolines'.

• CVE-2018-5332: In the Linux kernel the rds_message_alloc_sgs() function did not validate a value that is used during DMA page allocation, leading to a heap-based out-of-bounds write (related to the rds_rdma_extra_size function in net/rds/rdma.c) (bnc#1075621).

• CVE-2018-5333: In the Linux kernel the rds_cmsg_atomic function in net/rds/rdma.c mishandled cases where page pinning fails or an invalid address is supplied, leading to an rds_atomic_free_op NULL pointer dereference (bnc#1075617).

• CVE-2017-18017: The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c in the Linux kernel allowed remote attackers to cause a denial of service (use-after-free and memory corruption) or possibly have unspecified other impact by leveraging the presence of xt_TCPMSS in an iptables action (bnc#1074488).

• CVE-2017-18079: drivers/input/serio/i8042.c in the Linux kernel allowed attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact because the port->exists value can change after it is validated (bnc#1077922).

• CVE-2015-1142857: On multiple SR-IOV cars it is possible for VF's assigned to guests to send ethernet flow control pause frames via the PF. (bnc#1077355).

• CVE-2017-17741: The KVM implementation in the Linux kernel allowed attackers to obtain potentially sensitive information from kernel memory, aka a write_mmio stack-based out-of-bounds read, related to arch/x86/kvm/x86.c and include/trace/events/kvm.h (bnc#1073311).

• CVE-2017-13215: A elevation of privilege vulnerability in the Upstream kernel skcipher. (bnc#1075908).

• CVE-2018-1000004: In the Linux kernel a race condition vulnerability existed in the sound system, this can lead to a deadlock and denial of service condition (bnc#1076017).

The following non-security bugs were fixed:

• alsa: aloop: Fix inconsistent format due to incomplete rule (bsc#1045538).
• alsa: aloop: Fix racy hw constraints adjustment (bsc#1045538).
• alsa: aloop: Release cable upon open error path (bsc#1045538).
• alsa: pcm: Abort properly at pending signal in OSS read/write loops (bsc#1045538).
• alsa: pcm: Add missing error checks in OSS emulation plugin builder (bsc#1045538).
• alsa: pcm: Allow aborting mutex lock at OSS read/write loops (bsc#1045538).
• alsa: pcm: Remove incorrect snd_BUG_ON() usages (bsc#1045538).
• alsa: pcm: Remove yet superfluous WARN_ON() (bsc#1045538).
• btrfs: cleanup unnecessary assignment when cleaning up all the residual transaction (FATE#325056).
• btrfs: copy fsid to super_block s_uuid (bsc#1080774).
• btrfs: do not wait for all the writers circularly during the transaction commit (FATE#325056).
• btrfs: do not WARN() in btrfs_transaction_abort() for IO errors (bsc#1080363).
• btrfs: fix two use-after-free bugs with transaction cleanup (FATE#325056).
• btrfs: make the state of the transaction more readable (FATE#325056).
• btrfs: qgroup: exit the rescan worker during umount (bsc#1080685).
• btrfs: qgroup: Fix dead judgement on qgroup_rescan_leaf() return value (bsc#1080685).
• btrfs: reset intwrite on transaction abort (FATE#325056).
• btrfs: set qgroup_ulist to be null after calling ulist_free() (bsc#1080359).
• btrfs: stop waiting on current trans if we aborted (FATE#325056).
• cdc-acm: apply quirk for card reader (bsc#1060279).
• cdrom: factor out common open_for_* code (bsc#1048585).
• cdrom: wait for tray to close (bsc#1048585).
• delay:…

The SUSE Linux Enterprise 11 SP3 LTSS kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2017-5715: Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis (bnc#1068032).

  The previous fix using CPU Microcode has been complemented by building the Linux Kernel with return trampolines aka 'retpolines'.

• CVE-2018-5332: In the Linux kernel the rds_message_alloc_sgs() function did not validate a value that is used during DMA page allocation, leading to a heap-based out-of-bounds write (related to the rds_rdma_extra_size function in net/rds/rdma.c) (bnc#1075621).

• CVE-2018-5333: In the Linux kernel the rds_cmsg_atomic function in net/rds/rdma.c mishandled cases where page pinning fails or an invalid address is supplied, leading to an rds_atomic_free_op NULL pointer dereference (bnc#1075617).

• CVE-2017-18017: The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c in the Linux kernel allowed remote attackers to cause a denial of service (use-after-free and memory corruption) or possibly have unspecified other impact by leveraging the presence of xt_TCPMSS in an iptables action (bnc#1074488).

• CVE-2017-18079: drivers/input/serio/i8042.c in the Linux kernel allowed attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact because the port->exists value can change after it is validated (bnc#1077922).

• CVE-2017-17741: The KVM implementation in the Linux kernel allowed attackers to obtain potentially sensitive information from kernel memory, aka a write_mmio stack-based out-of-bounds read, related to arch/x86/kvm/x86.c and include/trace/events/kvm.h (bnc#1073311).

• CVE-2017-13215: A elevation of privilege vulnerability in the Upstream kernel skcipher. (bnc#1075908).

• CVE-2018-1000004: In the Linux kernel a race condition vulnerability exists in the sound system, this can lead to a deadlock and denial of service condition (bnc#1076017).

The following non-security bugs were fixed:

• cdc-acm: apply quirk for card reader (bsc#1060279).
• Enable CPU vulnerabilities reporting via sysfs
• fork: clear thread stack upon allocation (bsc#1077560).
• kaiser: Set _PAGE_NX only if supported (bnc#1012382, bnc#1076278).
• kbuild: modversions for EXPORT_SYMBOL() for asm (bsc#1074621 bsc#1068032).
• Move kABI fixup for retpolines to proper place.
• powerpc/vdso64: Use double word compare on pointers (bsc#1070781).
• s390: add ppa to the idle loop (bnc#1077406, LTC#163910).
• s390/cpuinfo: show facilities as reported by stfle (bnc#1076849, LTC#163741).
• storvsc: do not assume SG list is continuous when doing bounce buffers (bsc#1075410).
• sysfs/cpu: Add vulnerability folder (bnc#1012382).
• sysfs/cpu: Fix typos in vulnerability documentation (bnc#1012382).
• sysfs: spectre_v2, handle spec_ctrl (bsc#1075994 bsc#1075091).
• x86/acpi: Handle SCI interrupts above legacy space gracefully (bsc#1068984).
• x86/acpi: Reduce code duplication in mp_override_legacy_irq() (bsc#1068984).
• x86/boot: Fix early command-line parsing when matching at end (bsc#1068032).
• x86/cpu: Factor out application of forced CPU caps (bsc#1075994 bsc#1075091).
• x86/cpu: Implement CPU vulnerabilites sysfs functions (bnc#1012382).
• x86/CPU: Sync CPU feature flags late (bsc#1075994 bsc#1075091).
• x86/kaiser: Populate shadow PGD with NX bit only if supported by platform (bsc#1076154 bsc#1076278).
• x86/kaiser: use trampoline stack for kernel entry.
• x86/microcode/intel: Disable late loading on model 79 (bsc#1054305).
• x86/microcode/intel: Extend BDW late-loading further with LLC size check (bsc#1054305).
• x86/microcode/intel: Extend BDW late-loading with a revision check (bsc#1054305).
• x86/microcode: Rescan feature flags upon late loading (bsc#1075994 bsc#1075091). -…

The SUSE Linux Enterprise 11 SP4 Realtime kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2017-5715: Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis (bnc#1068032).

  The previous fix using CPU Microcode has been complemented by building the Linux Kernel with return trampolines aka 'retpolines'.

• CVE-2015-1142857: On multiple SR-IOV cars it is possible for VF's assigned to guests to send ethernet flow control pause frames via the PF. This includes Linux kernel ixgbe driver, i40e/i40evf driver and the DPDK, additionally multiple vendor NIC firmware is affected (bnc#1077355).

• CVE-2017-13215: A elevation of privilege vulnerability in the Upstream kernel skcipher. (bnc#1075908).

• CVE-2017-17741: The KVM implementation in the Linux kernel allowed attackers to obtain potentially sensitive information from kernel memory, aka a write_mmio stack-based out-of-bounds read, related to arch/x86/kvm/x86.c and include/trace/events/kvm.h (bnc#1073311).

• CVE-2017-18017: The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c in the Linux kernel allowed remote attackers to cause a denial of service (use-after-free and memory corruption) or possibly have unspecified other impact by leveraging the presence of xt_TCPMSS in an iptables action (bnc#1074488).

• CVE-2017-18079: drivers/input/serio/i8042.c in the Linux kernel allowed attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact because the port->exists value can change after it is validated (bnc#1077922).

• CVE-2018-1000004: In the Linux kernel a race condition vulnerability exists in the sound system, this can lead to a deadlock and denial of service condition (bnc#1076017).

• CVE-2018-5332: In the Linux kernel the rds_message_alloc_sgs() function did not validate a value that is used during DMA page allocation, leading to a heap-based out-of-bounds write (related to the rds_rdma_extra_size function in net/rds/rdma.c) (bnc#1075621).

• CVE-2018-5333: In the Linux kernel rds_cmsg_atomic function in net/rds/rdma.c mishandled cases where page pinning fails or an invalid address is supplied, leading to an rds_atomic_free_op NULL pointer dereference (bnc#1075617).

The following non-security bugs were fixed:

• Add proper NX hadnling for !NX-capable systems also to kaiser_add_user_map(). (bsc#1076278).
• alsa: aloop: Fix inconsistent format due to incomplete rule (bsc#1045538).
• alsa: aloop: Fix racy hw constraints adjustment (bsc#1045538).
• alsa: aloop: Release cable upon open error path (bsc#1045538).
• alsa: pcm: Abort properly at pending signal in OSS read/write loops (bsc#1045538).
• alsa: pcm: Add missing error checks in OSS emulation plugin builder (bsc#1045538).
• alsa: pcm: Allow aborting mutex lock at OSS read/write loops (bsc#1045538).
• alsa: pcm: Remove incorrect snd_BUG_ON() usages (bsc#1045538).
• alsa: pcm: Remove yet superfluous WARN_ON() (bsc#1045538).
• btrfs: cleanup unnecessary assignment when cleaning up all the residual transaction (FATE#325056).
• btrfs: copy fsid to super_block s_uuid (bsc#1080774).
• btrfs: do not wait for all the writers circularly during the transaction commit (FATE#325056).
• btrfs: do not WARN() in btrfs_transaction_abort() for IO errors (bsc#1080363).
• btrfs: fix two use-after-free bugs with transaction cleanup (FATE#325056).
• btrfs: make the state of the transaction more readable (FATE#325056).
• btrfs: qgroup: exit the rescan worker during umount (bsc#1080685).
• btrfs: qgroup: Fix dead judgement on qgroup_rescan_leaf() return value (bsc#1080685).
• btrfs: reset intwrite on transaction abort (FATE#325056).
• btrfs: set qgroup_ulist to be null after calling ulist_free() (bsc#1080359).
• btrfs: stop waiting on current trans if we aborted…

The SUSE Linux Enterprise 12 SP3 Realtime kernel was updated to 4.4.120 to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2017-5715: Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis (bnc#1068032).

  The previous fix using CPU Microcode has been complemented by building the Linux Kernel with return trampolines aka 'retpolines'.

• CVE-2017-13166: An elevation of privilege vulnerability in the v4l2 video driver. (bnc#1072865).

• CVE-2017-15129: A use-after-free vulnerability was found in network namespaces code affecting the Linux kernel. The function get_net_ns_by_id() in net/core/net_namespace.c did not check for the net::count value after it has found a peer network in netns_ids idr, which could lead to double free and memory corruption. This vulnerability could allow an unprivileged local user to induce kernel memory corruption on the system, leading to a crash. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although it is thought to be unlikely (bnc#1074839).

• CVE-2017-15951: The KEYS subsystem in the Linux kernel did not correctly synchronize the actions of updating versus finding a key in the 'negative' state to avoid a race condition, which allowed local users to cause a denial of service or possibly have unspecified other impact via crafted system calls (bnc#1065615).

• CVE-2017-16912: The 'get_pipe()' function (drivers/usb/usbip/stub_rx.c) in the Linux Kernel allowed attackers to cause a denial of service (out-of-bounds read) via a specially crafted USB over IP packet (bnc#1078673).

• CVE-2017-16913: The 'stub_recv_cmd_submit()' function (drivers/usb/usbip/stub_rx.c) in the Linux Kernel when handling CMD_SUBMIT packets allowed attackers to cause a denial of service (arbitrary memory allocation) via a specially crafted USB over IP packet (bnc#1078672).

• CVE-2017-17712: The raw_sendmsg() function in net/ipv4/raw.c in the Linux kernel has a race condition in inet->hdrincl that leads to uninitialized stack pointer usage; this allowed a local user to execute code and gain privileges (bnc#1073229 1073230).

• CVE-2017-17862: kernel/bpf/verifier.c in the Linux kernel ignores unreachable code, even though it would still be processed by JIT compilers. This behavior, also considered an improper branch-pruning logic issue, could possibly be used by local users for denial of service (bnc#1073928).

• CVE-2017-17864: kernel/bpf/verifier.c in the Linux kernel mishandled states_equal comparisons between the pointer data type and the UNKNOWN_VALUE data type, which allowed local users to obtain potentially sensitive address information, aka a 'pointer leak (bnc#1073928).

• CVE-2017-17975: Use-after-free in the usbtv_probe function in drivers/media/usb/usbtv/usbtv-core.c allowed attackers to cause a denial of service (system crash) or possibly have unspecified other impact by triggering failure of audio registration, because a kfree of the usbtv data structure occurs during a usbtv_video_free call, but the usbtv_video_fail label's code attempts to both access and free this data structure (bnc#1074426).

• CVE-2017-18017: The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c in the Linux kernel allowed remote attackers to cause a denial of service (use-after-free and memory corruption) or possibly have unspecified other impact by leveraging the presence of xt_TCPMSS in an iptables action (bnc#1074488).

• CVE-2017-18174: In the Linux kernel the amd_gpio_remove function in drivers/pinctrl/pinctrl-amd.c calls the pinctrl_unregister function, leading to a double free (bnc#1080533).

• CVE-2017-18208: The madvise_willneed function in mm/madvise.c allowed local users to cause a denial of service (infinite loop) by triggering use of MADVISE_WILLNEED for a DAX mapping (bnc#1083494).

• CVE-2018-1000004: In the…

This update for the Linux Kernel 3.12.74-60_64_69 fixes several issues.

The following security issues were fixed:

• CVE-2017-13166: An elevation of privilege vulnerability was fixed in the kernel v4l2 video driver. (bsc#1085447).
• CVE-2018-1068: A flaw was found in the Linux kernels implementation of 32-bit syscall interface for bridging. This allowed a privileged user to arbitrarily write to a limited range of kernel memory (bsc#1085114).
• CVE-2018-1000004: A race condition vulnerability existed in the sound system, which could lead to a deadlock and denial of service condition (bsc#1076017)

This update for the Linux Kernel 4.4.90-92_45 fixes several issues.

The following security issues were fixed:

• CVE-2017-13166: Prevent elevation of privilege vulnerability in the v4l2 video driver (bsc#1085447).
• CVE-2018-1068: A flaw in the implementation of 32-bit syscall interface for bridging allowed a privileged user to arbitrarily write to a limited range of kernel memory (bsc#1085114).
• CVE-2018-7566: Prevent buffer overflow via an SNDRV_SEQ_IOCTL_SET_CLIENT_POOL ioctl write operation to /dev/snd/seq by a local user (bsc#1083488).
• CVE-2018-1000004: Prevent race condition in the sound system that could have lead to a deadlock and denial of service condition (bsc#1076017).

This update for the Linux Kernel 3.12.74-60_64_51 fixes several issues.

The following security issues were fixed:

• CVE-2017-13166: An elevation of privilege vulnerability was fixed in the kernel v4l2 video driver. (bsc#1085447).
• CVE-2018-1068: A flaw was found in the Linux kernels implementation of 32-bit syscall interface for bridging. This allowed a privileged user to arbitrarily write to a limited range of kernel memory (bsc#1085114).
• CVE-2018-1000004: A race condition vulnerability existed in the sound system, which could lead to a deadlock and denial of service condition (bsc#1076017)

This update for the Linux Kernel 4.4.74-92_35 fixes several issues.

The following security issues were fixed:

• CVE-2017-13166: Prevent elevation of privilege vulnerability in the v4l2 video driver (bsc#1085447).
• CVE-2018-1068: A flaw in the implementation of 32-bit syscall interface for bridging allowed a privileged user to arbitrarily write to a limited range of kernel memory (bsc#1085114).
• CVE-2018-7566: Prevent buffer overflow via an SNDRV_SEQ_IOCTL_SET_CLIENT_POOL ioctl write operation to /dev/snd/seq by a local user (bsc#1083488).
• CVE-2018-1000004: Prevent race condition in the sound system that could have lead to a deadlock and denial of service condition (bsc#1076017).

This update for the Linux Kernel 3.12.61-52_111 fixes several issues.

The following security issues were fixed:

• CVE-2017-13166: An elevation of privilege vulnerability was fixed in the kernel v4l2 video driver. (bsc#1085447).
• CVE-2018-1068: A flaw was found in the Linux kernels implementation of 32-bit syscall interface for bridging. This allowed a privileged user to arbitrarily write to a limited range of kernel memory (bsc#1085114).
• CVE-2018-1000004: A race condition vulnerability existed in the sound system, which could lead to a deadlock and denial of service condition (bsc#1076017)

This update for the Linux Kernel 3.12.61-52_101 fixes several issues.

The following security issues were fixed:

• CVE-2017-13166: An elevation of privilege vulnerability was fixed in the kernel v4l2 video driver. (bsc#1085447).
• CVE-2018-1068: A flaw was found in the Linux kernels implementation of 32-bit syscall interface for bridging. This allowed a privileged user to arbitrarily write to a limited range of kernel memory (bsc#1085114).
• CVE-2018-1000004: A race condition vulnerability existed in the sound system, which could lead to a deadlock and denial of service condition (bsc#1076017)

This update for the Linux Kernel 3.12.61-52_83 fixes several issues.

The following security issues were fixed:

• CVE-2017-13166: An elevation of privilege vulnerability was fixed in the kernel v4l2 video driver. (bsc#1085447).
• CVE-2018-1068: A flaw was found in the Linux kernels implementation of 32-bit syscall interface for bridging. This allowed a privileged user to arbitrarily write to a limited range of kernel memory (bsc#1085114).
• CVE-2018-1000004: A race condition vulnerability existed in the sound system, which could lead to a deadlock and denial of service condition (bsc#1076017)

This update for the Linux Kernel 4.4.82-6_6 fixes several issues.

The following security issues were fixed:

• CVE-2017-13166: Prevent elevation of privilege vulnerability in the v4l2 video driver (bsc#1085447).
• CVE-2018-1068: A flaw in the implementation of 32-bit syscall interface for bridging allowed a privileged user to arbitrarily write to a limited range of kernel memory (bsc#1085114).
• CVE-2018-7566: Prevent buffer overflow via an SNDRV_SEQ_IOCTL_SET_CLIENT_POOL ioctl write operation to /dev/snd/seq by a local user (bsc#1083488).
• CVE-2018-1000004: Prevent race condition in the sound system that could have lead to a deadlock and denial of service condition (bsc#1076017).

This update for the Linux Kernel 3.12.61-52_77 fixes several issues.

The following security issues were fixed:

• CVE-2017-13166: An elevation of privilege vulnerability was fixed in the kernel v4l2 video driver. (bsc#1085447).
• CVE-2018-1068: A flaw was found in the Linux kernels implementation of 32-bit syscall interface for bridging. This allowed a privileged user to arbitrarily write to a limited range of kernel memory (bsc#1085114).
• CVE-2018-1000004: A race condition vulnerability existed in the sound system, which could lead to a deadlock and denial of service condition (bsc#1076017)

This update for the Linux Kernel 3.12.61-52_89 fixes several issues.

The following security issues were fixed:

• CVE-2017-13166: An elevation of privilege vulnerability was fixed in the kernel v4l2 video driver. (bsc#1085447).
• CVE-2018-1068: A flaw was found in the Linux kernels implementation of 32-bit syscall interface for bridging. This allowed a privileged user to arbitrarily write to a limited range of kernel memory (bsc#1085114).
• CVE-2018-1000004: A race condition vulnerability existed in the sound system, which could lead to a deadlock and denial of service condition (bsc#1076017)

This update for the Linux Kernel 3.12.61-52_92 fixes several issues.

The following security issues were fixed:

• CVE-2017-13166: An elevation of privilege vulnerability was fixed in the kernel v4l2 video driver. (bsc#1085447).
• CVE-2018-1068: A flaw was found in the Linux kernels implementation of 32-bit syscall interface for bridging. This allowed a privileged user to arbitrarily write to a limited range of kernel memory (bsc#1085114).
• CVE-2018-1000004: A race condition vulnerability existed in the sound system, which could lead to a deadlock and denial of service condition (bsc#1076017)

This update for the Linux Kernel 4.4.103-92_53 fixes several issues.

The following security issues were fixed:

• CVE-2017-13166: Prevent elevation of privilege vulnerability in the v4l2 video driver (bsc#1085447).
• CVE-2018-1068: A flaw in the implementation of 32-bit syscall interface for bridging allowed a privileged user to arbitrarily write to a limited range of kernel memory (bsc#1085114).
• CVE-2018-7566: Prevent buffer overflow via an SNDRV_SEQ_IOCTL_SET_CLIENT_POOL ioctl write operation to /dev/snd/seq by a local user (bsc#1083488).
• CVE-2018-1000004: Prevent race condition in the sound system that could have lead to a deadlock and denial of service condition (bsc#1076017).

This update for the Linux Kernel 3.12.74-60_64_57 fixes several issues.

The following security issues were fixed:

• CVE-2017-13166: An elevation of privilege vulnerability was fixed in the kernel v4l2 video driver. (bsc#1085447).
• CVE-2018-1068: A flaw was found in the Linux kernels implementation of 32-bit syscall interface for bridging. This allowed a privileged user to arbitrarily write to a limited range of kernel memory (bsc#1085114).
• CVE-2018-1000004: A race condition vulnerability existed in the sound system, which could lead to a deadlock and denial of service condition (bsc#1076017)

This update for the Linux Kernel 3.12.61-52_80 fixes several issues.

The following security issues were fixed:

• CVE-2017-13166: An elevation of privilege vulnerability was fixed in the kernel v4l2 video driver. (bsc#1085447).
• CVE-2018-1068: A flaw was found in the Linux kernels implementation of 32-bit syscall interface for bridging. This allowed a privileged user to arbitrarily write to a limited range of kernel memory (bsc#1085114).
• CVE-2018-1000004: A race condition vulnerability existed in the sound system, which could lead to a deadlock and denial of service condition (bsc#1076017)

This update for the Linux Kernel 4.4.74-92_38 fixes several issues.

The following security issues were fixed:

• CVE-2017-13166: Prevent elevation of privilege vulnerability in the v4l2 video driver (bsc#1085447).
• CVE-2018-1068: A flaw in the implementation of 32-bit syscall interface for bridging allowed a privileged user to arbitrarily write to a limited range of kernel memory (bsc#1085114).
• CVE-2018-7566: Prevent buffer overflow via an SNDRV_SEQ_IOCTL_SET_CLIENT_POOL ioctl write operation to /dev/snd/seq by a local user (bsc#1083488).
• CVE-2018-1000004: Prevent race condition in the sound system that could have lead to a deadlock and denial of service condition (bsc#1076017).

This update for the Linux Kernel 3.12.74-60_64_45 fixes several issues.

The following security issues were fixed:

• CVE-2017-13166: An elevation of privilege vulnerability was fixed in the kernel v4l2 video driver. (bsc#1085447).
• CVE-2018-1068: A flaw was found in the Linux kernels implementation of 32-bit syscall interface for bridging. This allowed a privileged user to arbitrarily write to a limited range of kernel memory (bsc#1085114).
• CVE-2018-1000004: A race condition vulnerability existed in the sound system, which could lead to a deadlock and denial of service condition (bsc#1076017)

This update for the Linux Kernel 3.12.61-52_86 fixes several issues.

The following security issues were fixed:

• CVE-2017-13166: An elevation of privilege vulnerability was fixed in the kernel v4l2 video driver. (bsc#1085447).
• CVE-2018-1068: A flaw was found in the Linux kernels implementation of 32-bit syscall interface for bridging. This allowed a privileged user to arbitrarily write to a limited range of kernel memory (bsc#1085114).
• CVE-2018-1000004: A race condition vulnerability existed in the sound system, which could lead to a deadlock and denial of service condition (bsc#1076017)

This update for the Linux Kernel 3.12.61-52_72 fixes several issues.

The following security issues were fixed:

• CVE-2017-13166: An elevation of privilege vulnerability was fixed in the kernel v4l2 video driver. (bsc#1085447).
• CVE-2018-1068: A flaw was found in the Linux kernels implementation of 32-bit syscall interface for bridging. This allowed a privileged user to arbitrarily write to a limited range of kernel memory (bsc#1085114).
• CVE-2018-1000004: A race condition vulnerability existed in the sound system, which could lead to a deadlock and denial of service condition (bsc#1076017)

This update for the Linux Kernel 4.4.90-92_50 fixes several issues.

The following security issues were fixed:

• CVE-2017-13166: Prevent elevation of privilege vulnerability in the v4l2 video driver (bsc#1085447).
• CVE-2018-1068: A flaw in the implementation of 32-bit syscall interface for bridging allowed a privileged user to arbitrarily write to a limited range of kernel memory (bsc#1085114).
• CVE-2018-7566: Prevent buffer overflow via an SNDRV_SEQ_IOCTL_SET_CLIENT_POOL ioctl write operation to /dev/snd/seq by a local user (bsc#1083488).
• CVE-2018-1000004: Prevent race condition in the sound system that could have lead to a deadlock and denial of service condition (bsc#1076017).

This update for the Linux Kernel 4.4.59-92_17 fixes several issues.

The following security issues were fixed:

• CVE-2017-13166: Prevent elevation of privilege vulnerability in the v4l2 video driver (bsc#1085447).
• CVE-2018-1068: A flaw in the implementation of 32-bit syscall interface for bridging allowed a privileged user to arbitrarily write to a limited range of kernel memory (bsc#1085114).
• CVE-2018-7566: Prevent buffer overflow via an SNDRV_SEQ_IOCTL_SET_CLIENT_POOL ioctl write operation to /dev/snd/seq by a local user (bsc#1083488).
• CVE-2018-1000004: Prevent race condition in the sound system that could have lead to a deadlock and denial of service condition (bsc#1076017).

This update for the Linux Kernel 4.4.90-6_12 fixes several issues.

The following security issues were fixed:

• CVE-2017-13166: Prevent elevation of privilege vulnerability in the v4l2 video driver (bsc#1085447).
• CVE-2018-1068: A flaw in the implementation of 32-bit syscall interface for bridging allowed a privileged user to arbitrarily write to a limited range of kernel memory (bsc#1085114).
• CVE-2018-7566: Prevent buffer overflow via an SNDRV_SEQ_IOCTL_SET_CLIENT_POOL ioctl write operation to /dev/snd/seq by a local user (bsc#1083488).
• CVE-2018-1000004: Prevent race condition in the sound system that could have lead to a deadlock and denial of service condition (bsc#1076017).

This update for the Linux Kernel 3.12.74-60_64_60 fixes several issues.

The following security issues were fixed:

• CVE-2017-13166: An elevation of privilege vulnerability was fixed in the kernel v4l2 video driver. (bsc#1085447).
• CVE-2018-1068: A flaw was found in the Linux kernels implementation of 32-bit syscall interface for bridging. This allowed a privileged user to arbitrarily write to a limited range of kernel memory (bsc#1085114).
• CVE-2018-1000004: A race condition vulnerability existed in the sound system, which could lead to a deadlock and denial of service condition (bsc#1076017)

This update for the Linux Kernel 3.12.74-60_64_48 fixes several issues.

The following security issues were fixed:

• CVE-2017-13166: An elevation of privilege vulnerability was fixed in the kernel v4l2 video driver. (bsc#1085447).
• CVE-2018-1068: A flaw was found in the Linux kernels implementation of 32-bit syscall interface for bridging. This allowed a privileged user to arbitrarily write to a limited range of kernel memory (bsc#1085114).
• CVE-2018-1000004: A race condition vulnerability existed in the sound system, which could lead to a deadlock and denial of service condition (bsc#1076017)

This update for the Linux Kernel 3.12.74-60_64_66 fixes several issues.

The following security issues were fixed:

• CVE-2017-13166: An elevation of privilege vulnerability was fixed in the kernel v4l2 video driver. (bsc#1085447).
• CVE-2018-1068: A flaw was found in the Linux kernels implementation of 32-bit syscall interface for bridging. This allowed a privileged user to arbitrarily write to a limited range of kernel memory (bsc#1085114).
• CVE-2018-1000004: A race condition vulnerability existed in the sound system, which could lead to a deadlock and denial of service condition (bsc#1076017)

This update for the Linux Kernel 4.4.59-92_20 fixes several issues.

The following security issues were fixed:

• CVE-2017-13166: Prevent elevation of privilege vulnerability in the v4l2 video driver (bsc#1085447).
• CVE-2018-1068: A flaw in the implementation of 32-bit syscall interface for bridging allowed a privileged user to arbitrarily write to a limited range of kernel memory (bsc#1085114).
• CVE-2018-7566: Prevent buffer overflow via an SNDRV_SEQ_IOCTL_SET_CLIENT_POOL ioctl write operation to /dev/snd/seq by a local user (bsc#1083488).
• CVE-2018-1000004: Prevent race condition in the sound system that could have lead to a deadlock and denial of service condition (bsc#1076017).