CVE-2018-10853

A flaw was found in the way Linux kernel KVM hypervisor before 4.18 emulated instructions such as sgdt/sidt/fxsave/fxrstor. It did not check current privilege(CPL) level while emulating unprivileged instructions. An unprivileged guest user/process could use this flaw to potentially escalate privileges inside guest.

This kernel update is based on the upstream 4.14.50 and fixes at least the following security issues:

In the function sbusfb_ioctl_helper() in drivers/video/fbdev/sbuslib.c in the Linux kernel through 4.15, an integer signedness error allows arbitrary information leakage for the FBIOPUTCMAP_SPARC and FBIOGETCMAP_SPARC commands (CVE-2018-6412).

The kvm functions that were used in the emulation of fxrstor, fxsave, sgdt and sidt were originally meant for task switching, and as such they did not check privilege levels. This allowed guest userspace to guest kernel write (CVE-2018-10853).

In arch/x86/kvm/vmx.c in the Linux kernel before 4.17.2, when nested virtualization is used, local attackers could cause L1 KVM guests to VMEXIT, potentially allowing privilege escalations and denial of service attacks due to lack of checking of CPL (CVE-2018-12904).

WireGuard has been updated to 0.0.20180613.

For other fixes in this update, see the referenced changelogs.

This kernel-tmb update is based on the upstream 4.14.62 and fixes at least the following security issues:

kernel KVM before versions kernel 4.16, kernel 4.16-rc7, kernel 4.17-rc1, kernel 4.17-rc2 and kernel 4.17-rc3 is vulnerable to a flaw in the way the Linux kernel's KVM hypervisor handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stack switch operation, the processor did not deliver interrupts and exceptions, rather they are delivered once the first instruction after the stack switch is executed. An unprivileged KVM guest user could use this flaw to crash the guest or, potentially, escalate their privileges in the guest (CVE-2018-1087).

Linux kernel vhost since version 4.8 does not properly initialize memory in messages passed between virtual guests and the host operating system in the vhost/vhost.c:vhost_new_msg() function. This can allow local privileged users to read some kernel memory contents when reading from the /dev/vhost-net device file (CVE-2018-1118).

Security researchers from FICORA have identified a remote denial of service attack against the Linux kernel caused by inefficient implementation of TCP segment reassembly, named "SegmentSmack". A remote attacker could consume a lot of CPU resources in the kernel networking stack with just a low bandwidth or single host attack by using lots of small TCP segments packets. Usually large botnets are needed for similar effect. The rate needed for this denial of service attack to be effective is several magnitudes lower than the usual packet processing capability of the machine, as the attack exploits worst case behaviour of existing algorithms (CVE-2018-5390). In the function sbusfb_ioctl_helper() in drivers/video/fbdev/sbuslib.c in the Linux kernel through 4.15, an integer signedness error allows arbitrary information leakage for the FBIOPUTCMAP_SPARC and FBIOGETCMAP_SPARC commands (CVE-2018-6412).

In some circumstances, some operating systems or hypervisors may not expect or properly handle an Intel architecture hardware debug exception. The error appears to be due to developer interpretation of existing documentation for certain Intel architecture interrupt/exception instructions, namely MOV SS and POP SS. An authenticated attacker may be able to read sensitive data in memory or control low-level operating system functions (CVE-2018-8897).

Linux kernel is vulnerable to a heap-based buffer overflow in the fs/ext4/xattr.c:ext4_xattr_set_entry() function. An attacker could exploit this by operating on a mounted crafted ext4 image (CVE-2018-10840).

The kvm functions that were used in the emulation of fxrstor, fxsave, sgdt and sidt were originally meant for task switching, and as such they did not check privilege levels. This allowed guest userspace to guest kernel write (CVE-2018-10853).

A flaw was found in Linux kernel ext4 File System. A use-after-free in ext4_ext_remove_space() when mounting and operating a crafted ext4 image (CVE-2018-10876).

Linux kernel ext4 filesystem is vulnerable to an out-of-bound access in the ext4_ext_drop_refs() function when operating on a crafted ext4 filesystem image (CVE-2018-10877).

A flaw was found in Linux kernel ext4 filesystem. A local user can cause a use-after-free in ext4_xattr_set_entry function and so a denial of service or possibly unspecified other impact by when renaming a file in a crafted ext4 filesystem image (CVE-2018-10879).

A flaw was found in Linux kernel ext4 filesystem code. A stack-out-of-bounds write in ext4_update_inline_data() is possible when mounting and writing to a crafted ext4 image. An attacker could use this to cause a system crash and a denial of service (CVE-2018-10880).

A flaw was found in Linux kernel ext4 filesystem. A local user can cause an out-of-bound access in ext4_get_group_info function and so a denial of service and a system crash by mounting and operating on a crafted ext4 filesystem image (CVE-2018-10881).

A flaw was…

This kernel-linus update is based on the upstream 4.14.62 and fixes at least the following security issues:

kernel KVM before versions kernel 4.16, kernel 4.16-rc7, kernel 4.17-rc1, kernel 4.17-rc2 and kernel 4.17-rc3 is vulnerable to a flaw in the way the Linux kernel's KVM hypervisor handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stack switch operation, the processor did not deliver interrupts and exceptions, rather they are delivered once the first instruction after the stack switch is executed. An unprivileged KVM guest user could use this flaw to crash the guest or, potentially, escalate their privileges in the guest (CVE-2018-1087).

Linux kernel vhost since version 4.8 does not properly initialize memory in messages passed between virtual guests and the host operating system in the vhost/vhost.c:vhost_new_msg() function. This can allow local privileged users to read some kernel memory contents when reading from the /dev/vhost-net device file (CVE-2018-1118).

Security researchers from FICORA have identified a remote denial of service attack against the Linux kernel caused by inefficient implementation of TCP segment reassembly, named "SegmentSmack". A remote attacker could consume a lot of CPU resources in the kernel networking stack with just a low bandwidth or single host attack by using lots of small TCP segments packets. Usually large botnets are needed for similar effect. The rate needed for this denial of service attack to be effective is several magnitudes lower than the usual packet processing capability of the machine, as the attack exploits worst case behaviour of existing algorithms (CVE-2018-5390). In the function sbusfb_ioctl_helper() in drivers/video/fbdev/sbuslib.c in the Linux kernel through 4.15, an integer signedness error allows arbitrary information leakage for the FBIOPUTCMAP_SPARC and FBIOGETCMAP_SPARC commands (CVE-2018-6412).

In some circumstances, some operating systems or hypervisors may not expect or properly handle an Intel architecture hardware debug exception. The error appears to be due to developer interpretation of existing documentation for certain Intel architecture interrupt/exception instructions, namely MOV SS and POP SS. An authenticated attacker may be able to read sensitive data in memory or control low-level operating system functions (CVE-2018-8897).

Linux kernel is vulnerable to a heap-based buffer overflow in the fs/ext4/xattr.c:ext4_xattr_set_entry() function. An attacker could exploit this by operating on a mounted crafted ext4 image (CVE-2018-10840).

The kvm functions that were used in the emulation of fxrstor, fxsave, sgdt and sidt were originally meant for task switching, and as such they did not check privilege levels. This allowed guest userspace to guest kernel write (CVE-2018-10853).

A flaw was found in Linux kernel ext4 File System. A use-after-free in ext4_ext_remove_space() when mounting and operating a crafted ext4 image (CVE-2018-10876).

Linux kernel ext4 filesystem is vulnerable to an out-of-bound access in the ext4_ext_drop_refs() function when operating on a crafted ext4 filesystem image (CVE-2018-10877).

A flaw was found in Linux kernel ext4 filesystem. A local user can cause a use-after-free in ext4_xattr_set_entry function and so a denial of service or possibly unspecified other impact by when renaming a file in a crafted ext4 filesystem image (CVE-2018-10879).

A flaw was found in Linux kernel ext4 filesystem code. A stack-out-of-bounds write in ext4_update_inline_data() is possible when mounting and writing to a crafted ext4 image. An attacker could use this to cause a system crash and a denial of service (CVE-2018-10880).

A flaw was found in Linux kernel ext4 filesystem. A local user can cause an out-of-bound access in ext4_get_group_info function and so a denial of service and a system crash by mounting and operating on a crafted ext4 filesystem image (CVE-2018-10881).

A flaw was…

This update for the Linux Kernel 3.12.61-52_125 fixes several issues.

The following security issues were fixed:

• CVE-2018-3646: Local attackers in virtualized guest systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data, even from other virtual machines or the host system (bsc#1099306).
• CVE-2018-10853: A flaw was found in kvm. In which certain instructions such as sgdt/sidt call segmented_write_std didn't propagate access correctly. As such, during userspace induced exception, the guest can incorrectly assume that the exception happened in the kernel and panic. (bsc#1097108).

This update for the Linux Kernel 3.12.61-52_133 fixes several issues.

The following security issues were fixed:

• CVE-2018-3646: Local attackers in virtualized guest systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data, even from other virtual machines or the host system (bsc#1099306).
• CVE-2018-10853: A flaw was found in kvm. In which certain instructions such as sgdt/sidt call segmented_write_std didn't propagate access correctly. As such, during userspace induced exception, the guest can incorrectly assume that the exception happened in the kernel and panic. (bsc#1097108).

This update for the Linux Kernel 3.12.61-52_128 fixes several issues.

The following security issues were fixed:

• CVE-2018-3646: Local attackers in virtualized guest systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data, even from other virtual machines or the host system (bsc#1099306).
• CVE-2018-10853: A flaw was found in kvm. In which certain instructions such as sgdt/sidt call segmented_write_std didn't propagate access correctly. As such, during userspace induced exception, the guest can incorrectly assume that the exception happened in the kernel and panic. (bsc#1097108).

This update for the Linux Kernel 3.12.61-52_92 fixes several issues.

The following security issues were fixed:

• CVE-2018-3646: Local attackers in virtualized guest systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data, even from other virtual machines or the host system (bsc#1099306).
• CVE-2017-11600: net/xfrm/xfrm_policy.c did not ensure that the dir value of xfrm_userpolicy_id is XFRM_POLICY_MAX or less, which allowed local users to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via an XFRM_MSG_MIGRATE xfrm Netlink message (bsc#1096564)
• CVE-2018-10853: A flaw was found in kvm. In which certain instructions such as sgdt/sidt call segmented_write_std didn't propagate access correctly. As such, during userspace induced exception, the guest can incorrectly assume that the exception happened in the kernel and panic. (bsc#1097108).

This update for the Linux Kernel 3.12.61-52_106 fixes several issues.

The following security issues were fixed:

• CVE-2018-3646: Local attackers in virtualized guest systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data, even from other virtual machines or the host system (bsc#1099306).
• CVE-2017-11600: net/xfrm/xfrm_policy.c did not ensure that the dir value of xfrm_userpolicy_id is XFRM_POLICY_MAX or less, which allowed local users to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via an XFRM_MSG_MIGRATE xfrm Netlink message (bsc#1096564)
• CVE-2018-10853: A flaw was found in kvm. In which certain instructions such as sgdt/sidt call segmented_write_std didn't propagate access correctly. As such, during userspace induced exception, the guest can incorrectly assume that the exception happened in the kernel and panic. (bsc#1097108).

This update for the Linux Kernel 3.12.74-60_64_88 fixes several issues.

The following security issues were fixed:

• CVE-2018-3646: Local attackers in virtualized guest systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data, even from other virtual machines or the host system (bsc#1099306).
• CVE-2018-10853: A flaw was found in kvm. In which certain instructions such as sgdt/sidt call segmented_write_std didn't propagate access correctly. As such, during userspace induced exception, the guest can incorrectly assume that the exception happened in the kernel and panic. (bsc#1097108).

This update for the Linux Kernel 3.12.61-52_122 fixes several issues.

The following security issues were fixed:

• CVE-2018-3646: Local attackers in virtualized guest systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data, even from other virtual machines or the host system (bsc#1099306).
• CVE-2018-10853: A flaw was found in kvm. In which certain instructions such as sgdt/sidt call segmented_write_std didn't propagate access correctly. As such, during userspace induced exception, the guest can incorrectly assume that the exception happened in the kernel and panic. (bsc#1097108).

This update for the Linux Kernel 3.12.74-60_64_60 fixes several issues.

The following security issues were fixed:

• CVE-2018-3646: Local attackers in virtualized guest systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data, even from other virtual machines or the host system (bsc#1099306).
• CVE-2017-11600: net/xfrm/xfrm_policy.c did not ensure that the dir value of xfrm_userpolicy_id is XFRM_POLICY_MAX or less, which allowed local users to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via an XFRM_MSG_MIGRATE xfrm Netlink message (bsc#1096564)
• CVE-2018-10853: A flaw was found in kvm. In which certain instructions such as sgdt/sidt call segmented_write_std didn't propagate access correctly. As such, during userspace induced exception, the guest can incorrectly assume that the exception happened in the kernel and panic. (bsc#1097108).

This update for the Linux Kernel 3.12.61-52_101 fixes several issues.

The following security issues were fixed:

• CVE-2018-3646: Local attackers in virtualized guest systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data, even from other virtual machines or the host system (bsc#1099306).
• CVE-2017-11600: net/xfrm/xfrm_policy.c did not ensure that the dir value of xfrm_userpolicy_id is XFRM_POLICY_MAX or less, which allowed local users to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via an XFRM_MSG_MIGRATE xfrm Netlink message (bsc#1096564)
• CVE-2018-10853: A flaw was found in kvm. In which certain instructions such as sgdt/sidt call segmented_write_std didn't propagate access correctly. As such, during userspace induced exception, the guest can incorrectly assume that the exception happened in the kernel and panic. (bsc#1097108).

This update for the Linux Kernel 3.12.61-52_89 fixes several issues.

The following security issues were fixed:

• CVE-2018-3646: Local attackers in virtualized guest systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data, even from other virtual machines or the host system (bsc#1099306).
• CVE-2017-11600: net/xfrm/xfrm_policy.c did not ensure that the dir value of xfrm_userpolicy_id is XFRM_POLICY_MAX or less, which allowed local users to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via an XFRM_MSG_MIGRATE xfrm Netlink message (bsc#1096564)
• CVE-2018-10853: A flaw was found in kvm. In which certain instructions such as sgdt/sidt call segmented_write_std didn't propagate access correctly. As such, during userspace induced exception, the guest can incorrectly assume that the exception happened in the kernel and panic. (bsc#1097108).

This update for the Linux Kernel 3.12.74-60_64_63 fixes several issues.

The following security issues were fixed:

• CVE-2018-3646: Local attackers in virtualized guest systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data, even from other virtual machines or the host system (bsc#1099306).
• CVE-2017-11600: net/xfrm/xfrm_policy.c did not ensure that the dir value of xfrm_userpolicy_id is XFRM_POLICY_MAX or less, which allowed local users to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via an XFRM_MSG_MIGRATE xfrm Netlink message (bsc#1096564)
• CVE-2018-10853: A flaw was found in kvm. In which certain instructions such as sgdt/sidt call segmented_write_std didn't propagate access correctly. As such, during userspace induced exception, the guest can incorrectly assume that the exception happened in the kernel and panic. (bsc#1097108).

This update for the Linux Kernel 3.12.61-52_119 fixes several issues.

The following security issues were fixed:

• CVE-2018-3646: Local attackers in virtualized guest systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data, even from other virtual machines or the host system (bsc#1099306).
• CVE-2018-10853: A flaw was found in kvm. In which certain instructions such as sgdt/sidt call segmented_write_std didn't propagate access correctly. As such, during userspace induced exception, the guest can incorrectly assume that the exception happened in the kernel and panic. (bsc#1097108).

This update for the Linux Kernel 3.12.74-60_64_57 fixes several issues.

The following security issues were fixed:

• CVE-2018-3646: Local attackers in virtualized guest systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data, even from other virtual machines or the host system (bsc#1099306).
• CVE-2017-11600: net/xfrm/xfrm_policy.c did not ensure that the dir value of xfrm_userpolicy_id is XFRM_POLICY_MAX or less, which allowed local users to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via an XFRM_MSG_MIGRATE xfrm Netlink message (bsc#1096564)
• CVE-2018-10853: A flaw was found in kvm. In which certain instructions such as sgdt/sidt call segmented_write_std didn't propagate access correctly. As such, during userspace induced exception, the guest can incorrectly assume that the exception happened in the kernel and panic. (bsc#1097108).

This update for the Linux Kernel 3.12.61-52_111 fixes several issues.

The following security issues were fixed:

• CVE-2018-3646: Local attackers in virtualized guest systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data, even from other virtual machines or the host system (bsc#1099306).
• CVE-2018-10853: A flaw was found in kvm. In which certain instructions such as sgdt/sidt call segmented_write_std didn't propagate access correctly. As such, during userspace induced exception, the guest can incorrectly assume that the exception happened in the kernel and panic. (bsc#1097108).

This update for the Linux Kernel 3.12.74-60_64_96 fixes several issues.

The following security issues were fixed:

• CVE-2018-3646: Local attackers in virtualized guest systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data, even from other virtual machines or the host system (bsc#1099306).
• CVE-2018-10853: A flaw was found in kvm. In which certain instructions such as sgdt/sidt call segmented_write_std didn't propagate access correctly. As such, during userspace induced exception, the guest can incorrectly assume that the exception happened in the kernel and panic. (bsc#1097108).

This update for the Linux Kernel 3.12.74-60_64_69 fixes several issues.

The following security issues were fixed:

• CVE-2018-3646: Local attackers in virtualized guest systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data, even from other virtual machines or the host system (bsc#1099306).
• CVE-2018-10853: A flaw was found in kvm. In which certain instructions such as sgdt/sidt call segmented_write_std didn't propagate access correctly. As such, during userspace induced exception, the guest can incorrectly assume that the exception happened in the kernel and panic. (bsc#1097108).

This update for the Linux Kernel 3.12.74-60_64_82 fixes several issues.

The following security issues were fixed:

• CVE-2018-3646: Local attackers in virtualized guest systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data, even from other virtual machines or the host system (bsc#1099306).
• CVE-2018-10853: A flaw was found in kvm. In which certain instructions such as sgdt/sidt call segmented_write_std didn't propagate access correctly. As such, during userspace induced exception, the guest can incorrectly assume that the exception happened in the kernel and panic. (bsc#1097108).

This update for the Linux Kernel 3.12.74-60_64_93 fixes several issues.

The following security issues were fixed:

• CVE-2018-3646: Local attackers in virtualized guest systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data, even from other virtual machines or the host system (bsc#1099306).
• CVE-2018-10853: A flaw was found in kvm. In which certain instructions such as sgdt/sidt call segmented_write_std didn't propagate access correctly. As such, during userspace induced exception, the guest can incorrectly assume that the exception happened in the kernel and panic. (bsc#1097108).

This update for the Linux Kernel 3.12.74-60_64_66 fixes several issues.

The following security issues were fixed:

• CVE-2018-3646: Local attackers in virtualized guest systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data, even from other virtual machines or the host system (bsc#1099306).
• CVE-2017-11600: net/xfrm/xfrm_policy.c did not ensure that the dir value of xfrm_userpolicy_id is XFRM_POLICY_MAX or less, which allowed local users to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via an XFRM_MSG_MIGRATE xfrm Netlink message (bsc#1096564)
• CVE-2018-10853: A flaw was found in kvm. In which certain instructions such as sgdt/sidt call segmented_write_std didn't propagate access correctly. As such, during userspace induced exception, the guest can incorrectly assume that the exception happened in the kernel and panic. (bsc#1097108).

This update for the Linux Kernel 3.12.74-60_64_85 fixes several issues.

The following security issues were fixed:

• CVE-2018-3646: Local attackers in virtualized guest systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data, even from other virtual machines or the host system (bsc#1099306).
• CVE-2018-10853: A flaw was found in kvm. In which certain instructions such as sgdt/sidt call segmented_write_std didn't propagate access correctly. As such, during userspace induced exception, the guest can incorrectly assume that the exception happened in the kernel and panic. (bsc#1097108).

This update for the Linux Kernel 3.12.61-52_136 fixes several issues.

The following security issues were fixed:

• CVE-2018-3646: Local attackers in virtualized guest systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data, even from other virtual machines or the host system (bsc#1099306).
• CVE-2018-10853: A flaw was found in kvm. In which certain instructions such as sgdt/sidt call segmented_write_std didn't propagate access correctly. As such, during userspace induced exception, the guest can incorrectly assume that the exception happened in the kernel and panic. (bsc#1097108).

This update for the Linux Kernel 4.4.74-92_38 fixes several issues.

The following security issues were fixed:

• CVE-2018-3646: Local attackers in virtualized guest systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data, even from other virtual machines or the host system (bsc#1099306).
• CVE-2017-18344: The timer_create syscall implementation in kernel/time/posix-timers.c didn't properly validate the sigevent->sigev_notify field, which lead to out-of-bounds access in the show_timer function (called when /proc/$PID/timers is read). This allowed userspace applications to read arbitrary kernel memory (on a kernel built with CONFIG_POSIX_TIMERS and CONFIG_CHECKPOINT_RESTORE) (bsc#1103203). before 4.14.8
• CVE-2017-11600: net/xfrm/xfrm_policy.c did not ensure that the dir value of xfrm_userpolicy_id is XFRM_POLICY_MAX or less, which allowed local users to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via an XFRM_MSG_MIGRATE xfrm Netlink message (bsc#1096564)
• CVE-2018-10853: A flaw was found in kvm. In which certain instructions such as sgdt/sidt call segmented_write_std didn't propagate access correctly. As such, during userspace induced exception, the guest can incorrectly assume that the exception happened in the kernel and panic. (bsc#1097108).

This update for the Linux Kernel 4.4.121-92_85 fixes several issues.

The following security issues were fixed:

• CVE-2018-3646: Local attackers in virtualized guest systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data, even from other virtual machines or the host system (bsc#1099306).
• CVE-2018-10853: A flaw was found in kvm. In which certain instructions such as sgdt/sidt call segmented_write_std didn't propagate access correctly. As such, during userspace induced exception, the guest can incorrectly assume that the exception happened in the kernel and panic. (bsc#1097108).

This update for the Linux Kernel 4.4.114-92_64 fixes several issues.

The following security issues were fixed:

• CVE-2018-3646: Local attackers in virtualized guest systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data, even from other virtual machines or the host system (bsc#1099306).
• CVE-2017-18344: The timer_create syscall implementation in kernel/time/posix-timers.c didn't properly validate the sigevent->sigev_notify field, which lead to out-of-bounds access in the show_timer function (called when /proc/$PID/timers is read). This allowed userspace applications to read arbitrary kernel memory (on a kernel built with CONFIG_POSIX_TIMERS and CONFIG_CHECKPOINT_RESTORE) (bsc#1103203). before 4.14.8
• CVE-2018-10853: A flaw was found in kvm. In which certain instructions such as sgdt/sidt call segmented_write_std didn't propagate access correctly. As such, during userspace induced exception, the guest can incorrectly assume that the exception happened in the kernel and panic. (bsc#1097108).

This update for the Linux Kernel 4.4.82-6_6 fixes several issues.

The following security issues were fixed:

• CVE-2018-3646: Local attackers in virtualized guest systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data, even from other virtual machines or the host system (bsc#1099306).
• CVE-2017-18344: The timer_create syscall implementation in kernel/time/posix-timers.c didn't properly validate the sigevent->sigev_notify field, which lead to out-of-bounds access in the show_timer function (called when /proc/$PID/timers is read). This allowed userspace applications to read arbitrary kernel memory (on a kernel built with CONFIG_POSIX_TIMERS and CONFIG_CHECKPOINT_RESTORE) (bsc#1103203). before 4.14.8
• CVE-2017-17053: The init_new_context function in arch/x86/include/asm/mmu_context.h did not correctly handle errors from LDT table allocation when forking a new process, allowing a local attacker to achieve a use-after-free or possibly have unspecified other impact by running a specially crafted program. This vulnerability only affected kernels built with CONFIG_MODIFY_LDT_SYSCALL=y (bsc#1096679).
• CVE-2017-11600: net/xfrm/xfrm_policy.c did not ensure that the dir value of xfrm_userpolicy_id is XFRM_POLICY_MAX or less, which allowed local users to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via an XFRM_MSG_MIGRATE xfrm Netlink message (bsc#1096564)
• CVE-2018-10853: A flaw was found in kvm. In which certain instructions such as sgdt/sidt call segmented_write_std didn't propagate access correctly. As such, during userspace induced exception, the guest can incorrectly assume that the exception happened in the kernel and panic. (bsc#1097108).

This update for the Linux Kernel 4.4.132-94_33 fixes several issues.

The following security issues were fixed:

• CVE-2018-3646: Local attackers in virtualized guest systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data, even from other virtual machines or the host system (bsc#1099306).
• CVE-2018-10853: A flaw was found in kvm. In which certain instructions such as sgdt/sidt call segmented_write_std didn't propagate access correctly. As such, during userspace induced exception, the guest can incorrectly assume that the exception happened in the kernel and panic. (bsc#1097108).

This update for the Linux Kernel 4.4.103-92_53 fixes several issues.

The following security issues were fixed:

• CVE-2018-3646: Local attackers in virtualized guest systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data, even from other virtual machines or the host system (bsc#1099306).
• CVE-2017-18344: The timer_create syscall implementation in kernel/time/posix-timers.c didn't properly validate the sigevent->sigev_notify field, which lead to out-of-bounds access in the show_timer function (called when /proc/$PID/timers is read). This allowed userspace applications to read arbitrary kernel memory (on a kernel built with CONFIG_POSIX_TIMERS and CONFIG_CHECKPOINT_RESTORE) (bsc#1103203). before 4.14.8
• CVE-2018-10853: A flaw was found in kvm. In which certain instructions such as sgdt/sidt call segmented_write_std didn't propagate access correctly. As such, during userspace induced exception, the guest can incorrectly assume that the exception happened in the kernel and panic. (bsc#1097108).

The SUSE Linux Enterprise 15 azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-5391: A remote attacker even with relatively low bandwidth could have caused lots of CPU usage by triggering the worst case scenario during fragment reassembly (bsc#1103097)
• CVE-2018-3620, CVE-2018-3646: Local attackers in virtualized guest systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data, even from other virtual machines or the host system. (bnc#1089343, bsc#1087081).
• CVE-2018-10882: A local user could have caused an out-of-bound write, leading to denial of service and a system crash by unmounting a crafted ext4 filesystem image (bsc#1099849).
• CVE-2018-10880: Prevent a stack-out-of-bounds write in the ext4 filesystem code when mounting and writing crafted ext4 images. An attacker could have used this to cause a system crash and a denial of service (bsc#1099845).
• CVE-2018-10881: A local user could have caused an out-of-bound access and a system crash by mounting and operating on a crafted ext4 filesystem image (bsc#1099864).
• CVE-2018-10877: Prevent an out-of-bound access in the ext4_ext_drop_refs() function when operating on a crafted ext4 filesystem image (bsc#1099846).
• CVE-2018-10876: Prevent use-after-free in ext4_ext_remove_space() function when mounting and operating a crafted ext4 image (bsc#1099811).
• CVE-2018-10878: A local user could have caused an out-of-bounds write and a denial of service by mounting and operating a crafted ext4 filesystem image (bsc#1099813).
• CVE-2018-10883: A local user could have caused an out-of-bounds write in jbd2_journal_dirty_metadata(), a denial of service, and a system crash by mounting and operating on a crafted ext4 filesystem image (bsc#1099863).
• CVE-2018-10879: A local user could have caused a use-after-free in ext4_xattr_set_entry function and a denial of service or unspecified other impact may occur by renaming a file in a crafted ext4 filesystem image (bsc#1099844).
• CVE-2018-10853: A flaw was found in Linux Kernel KVM. In which certain instructions such as sgdt/sidt call segmented_write_std doesn't propagate access correctly. As such, during userspace induced exception, the guest can incorrectly assume that the exception happened in the kernel and panic. (bnc#1097104).

The following non-security bugs were fixed:

• apci / lpss: Only call pwm_add_table() for Bay Trail PWM if PMIC HRV is 2 (bsc#1051510).
• acpi / pci: Bail early in acpi_pci_add_bus() if there is no ACPI handle (bsc#1051510).
• af_key: Always verify length of provided sadb_key (bsc#1051510).
• af_key: fix buffer overread in parse_exthdrs() (bsc#1051510).
• af_key: fix buffer overread in verify_address_len() (bsc#1051510).
• afs: Fix directory permissions check (bsc#1101828).
• agp: uninorth: make two functions static (bsc#1051510).
• alsa: emu10k1: add error handling for snd_ctl_add (bsc#1051510).
• alsa: emu10k1: Rate-limit error messages about page errors (bsc#1051510).
• alsa: fm801: add error handling for snd_ctl_add (bsc#1051510).
• alsa: snd-aoa: add of_node_put() in error path (bsc#1051510).
• alsa: usb-audio: Apply rate limit to warning messages in URB complete callback (bsc#1051510).
• arm64: Correct type for PUD macros (bsc#1103723).
• arm64: Disable unhandled signal log messages by default (bsc#1103724).
• arm64: KVM: fix VTTBR_BADDR_MASK BUG_ON off-by-one (bsc#1103725).
• arm64: mm: Fix set_memory_valid() declaration (bsc#1103726).
• arm64: perf: correct PMUVer probing (bsc#1103727).
• arm64: ptrace: Avoid setting compat FPR to garbage if get_user fails (bsc#1103728).
• arm64: spinlock: Fix theoretical trylock() A-B-A with LSE atomics (bsc#1103729).
• arm64: vdso: fix clock_getres for 4GiB-aligned res (bsc#1103730).
• arm: 8715/1: add a…

This update for the Linux Kernel 4.12.14-25_3 fixes several issues.

The following security issues were fixed:

• CVE-2018-5390: Linux kernel versions 4.9+ can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service (bsc#1102682).
• CVE-2018-3646: Local attackers in virtualized guest systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data, even from other virtual machines or the host system (bsc#1099306).
• CVE-2017-18344: The timer_create syscall implementation in kernel/time/posix-timers.c didn't properly validate the sigevent->sigev_notify field, which lead to out-of-bounds access in the show_timer function (called when /proc/$PID/timers is read). This allowed userspace applications to read arbitrary kernel memory (on a kernel built with CONFIG_POSIX_TIMERS and CONFIG_CHECKPOINT_RESTORE) (bsc#1103203). before 4.14.8
• CVE-2018-10853: A flaw was found in kvm. In which certain instructions such as sgdt/sidt call segmented_write_std didn't propagate access correctly. As such, during userspace induced exception, the guest can incorrectly assume that the exception happened in the kernel and panic. (bsc#1097108).

This update for the Linux Kernel 4.12.14-23 fixes several issues.

The following security issues were fixed:

• CVE-2018-5390: Linux kernel versions 4.9+ can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service (bsc#1102682).
• CVE-2018-3646: Local attackers in virtualized guest systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data, even from other virtual machines or the host system (bsc#1099306).
• CVE-2017-18344: The timer_create syscall implementation in kernel/time/posix-timers.c didn't properly validate the sigevent->sigev_notify field, which lead to out-of-bounds access in the show_timer function (called when /proc/$PID/timers is read). This allowed userspace applications to read arbitrary kernel memory (on a kernel built with CONFIG_POSIX_TIMERS and CONFIG_CHECKPOINT_RESTORE) (bsc#1103203). before 4.14.8
• CVE-2018-12904: In arch/x86/kvm/vmx.c local attackers could cause L1 KVM guests to VMEXIT, potentially allowing privilege escalations and denial of service attacks due to lack of checking of CPL (bsc#1099258).
• CVE-2018-10853: A flaw was found in kvm. In which certain instructions such as sgdt/sidt call segmented_write_std didn't propagate access correctly. As such, during userspace induced exception, the guest can incorrectly assume that the exception happened in the kernel and panic. (bsc#1097108).

The SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-15572: The spectre_v2_select_mitigation function in arch/x86/kernel/cpu/bugs.c did not always fill RSB upon a context switch, which made it easier for attackers to conduct userspace-userspace spectreRSB attacks (bnc#1102517 bnc#1105296).
• CVE-2018-10902: It was found that the raw midi kernel driver did not protect against concurrent access which leads to a double realloc (double free) in snd_rawmidi_input_params() and snd_rawmidi_output_status() which are part of snd_rawmidi_ioctl() handler in rawmidi.c file. A malicious local attacker could possibly use this for privilege escalation (bnc#1105322).
• CVE-2018-9363: A buffer overflow in bluetooth HID report processing could be used by malicious bluetooth devices to crash the kernel or potentially execute code (bnc#1105292).
• CVE-2018-10853: A KVM guest userspace to guest kernel write was fixed, which could be used by guest users to crash the guest kernel (bnc#1097104).

The following non-security bugs were fixed:

• acpi / apei: Remove ghes_ioremap_area (bsc#1051510).
• acpi / pci: Bail early in acpi_pci_add_bus() if there is no ACPI handle (bsc#1051510).
• acpi / pm: save NVS memory for ASUS 1025C laptop (bsc#1051510).
• affs_lookup(): close a race with affs_remove_link() (bsc#1105355).
• alsa: cs5535audio: Fix invalid endian conversion (bsc#1051510).
• alsa: hda: Correct Asrock B85M-ITX power_save blacklist entry (bsc#1051510).
• alsa: hda - Sleep for 10ms after entering D3 on Conexant codecs (bsc#1051510).
• alsa: hda - Turn CX8200 into D3 as well upon reboot (bsc#1051510).
• alsa: memalloc: Do not exceed over the requested size (bsc#1051510).
• alsa: snd-aoa: add of_node_put() in error path (bsc#1051510).
• alsa: virmidi: Fix too long output trigger loop (bsc#1051510).
• alsa: vx222: Fix invalid endian conversions (bsc#1051510).
• alsa: vxpocket: Fix invalid endian conversions (bsc#1051510).
• arm64: enable thunderx gpio driver
• arm/asm/tlb.h: Fix build error implicit func declaration (bnc#1105467 Reduce IPIs and atomic ops with improved lazy TLB).
• asoc: dpcm: do not merge format from invalid codec dai (bsc#1051510).
• asoc: es7134: remove 64kHz rate from the supported rates (bsc#1051510).
• asoc: Intel: cht_bsw_max98090: remove useless code, align with ChromeOS driver (bsc#1051510).
• asoc: Intel: cht_bsw_max98090_ti: Fix jack initialization (bsc#1051510).
• asoc: msm8916-wcd-digital: fix RX2 MIX1 and RX3 MIX1 (bsc#1051510).
• asoc: rsnd: cmd: Add missing newline to debug message (bsc#1051510).
• asoc: sirf: Fix potential NULL pointer dereference (bsc#1051510).
• asoc: zte: Fix incorrect PCM format bit usages (bsc#1051510).
• ata: Fix ZBC_OUT all bit handling (bsc#1051510).
• ata: Fix ZBC_OUT command block check (bsc#1051510).
• ath10k: prevent active scans on potential unusable channels (bsc#1051510).
• atm: horizon: Fix irq release error (bsc#1105355).
• atm: Preserve value of skb->truesize when accounting to vcc (networking-stable-18_07_19).
• atm: zatm: fix memcmp casting (bsc#1105355).
• atm: zatm: Fix potential Spectre v1 (networking-stable-18_07_19).
• audit: allow not equal op for audit by executable (bsc#1051510).
• audit: Fix extended comparison of GID/EGID (bsc#1051510).
• be2net: gather debug info and reset adapter (only for Lancer) on a tx-timeout (bsc#1086288).
• be2net: Update the driver version to 12.0.0.0 (bsc#1086288 ).
• binfmt_elf: Respect error return from `regset->active' (bsc#1051510).
• bluetooth: avoid killing an already killed socket (bsc#1051510).
• bluetooth: hidp: buffer overflow in hidp_process_report (bsc#1051510).
• bpf, ppc64: fix unexpected r0=0 exit path inside bpf_xadd (bsc#1083647).
• brcmsmac: fix wrap around in conversion from constant to s16 (bsc#1051510).
• clk: core: Potentially free connection id (bsc#1051510).
• clk: imx6ul: fix missing of_node_put() (bsc#1051510).
• clk: meson:…

The SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-15572: The spectre_v2_select_mitigation function in arch/x86/kernel/cpu/bugs.c did not always fill RSB upon a context switch, which made it easier for attackers to conduct userspace-userspace spectreRSB attacks (bnc#1102517 bnc#1105296).
• CVE-2018-10902: It was found that the raw midi kernel driver did not protect against concurrent access which leads to a double realloc (double free) in snd_rawmidi_input_params() and snd_rawmidi_output_status() which are part of snd_rawmidi_ioctl() handler in rawmidi.c file. A malicious local attacker could possibly use this for privilege escalation (bnc#1105322).
• CVE-2018-9363: A buffer overflow in bluetooth HID report processing could be used by malicious bluetooth devices to crash the kernel or potentially execute code (bnc#1105292).
• CVE-2018-10853: A KVM guest userspace to guest kernel write was fixed, which could be used by guest users to crash the guest kernel (bnc#1097104).

The following non-security bugs were fixed:

• acpi / apei: Remove ghes_ioremap_area (bsc#1051510).
• acpi / pci: Bail early in acpi_pci_add_bus() if there is no ACPI handle (bsc#1051510).
• acpi / pm: save NVS memory for ASUS 1025C laptop (bsc#1051510).
• affs_lookup(): close a race with affs_remove_link() (bsc#1105355).
• alsa: cs5535audio: Fix invalid endian conversion (bsc#1051510).
• alsa: hda: Correct Asrock B85M-ITX power_save blacklist entry (bsc#1051510).
• alsa: hda - Sleep for 10ms after entering D3 on Conexant codecs (bsc#1051510).
• alsa: hda - Turn CX8200 into D3 as well upon reboot (bsc#1051510).
• alsa: memalloc: Do not exceed over the requested size (bsc#1051510).
• alsa: snd-aoa: add of_node_put() in error path (bsc#1051510).
• alsa: virmidi: Fix too long output trigger loop (bsc#1051510).
• alsa: vx222: Fix invalid endian conversions (bsc#1051510).
• alsa: vxpocket: Fix invalid endian conversions (bsc#1051510).
• arm64: enable thunderx gpio driver
• arm/asm/tlb.h: Fix build error implicit func declaration (bnc#1105467 Reduce IPIs and atomic ops with improved lazy TLB).
• asoc: dpcm: do not merge format from invalid codec dai (bsc#1051510).
• asoc: es7134: remove 64kHz rate from the supported rates (bsc#1051510).
• asoc: Intel: cht_bsw_max98090: remove useless code, align with ChromeOS driver (bsc#1051510).
• asoc: Intel: cht_bsw_max98090_ti: Fix jack initialization (bsc#1051510).
• asoc: msm8916-wcd-digital: fix RX2 MIX1 and RX3 MIX1 (bsc#1051510).
• asoc: rsnd: cmd: Add missing newline to debug message (bsc#1051510).
• asoc: sirf: Fix potential NULL pointer dereference (bsc#1051510).
• asoc: zte: Fix incorrect PCM format bit usages (bsc#1051510).
• ata: Fix ZBC_OUT all bit handling (bsc#1051510).
• ata: Fix ZBC_OUT command block check (bsc#1051510).
• ath10k: prevent active scans on potential unusable channels (bsc#1051510).
• atm: horizon: Fix irq release error (bsc#1105355).
• atm: Preserve value of skb->truesize when accounting to vcc (networking-stable-18_07_19).
• atm: zatm: fix memcmp casting (bsc#1105355).
• atm: zatm: Fix potential Spectre v1 (networking-stable-18_07_19).
• audit: allow not equal op for audit by executable (bsc#1051510).
• audit: Fix extended comparison of GID/EGID (bsc#1051510).
• be2net: gather debug info and reset adapter (only for Lancer) on a tx-timeout (bsc#1086288).
• be2net: Update the driver version to 12.0.0.0 (bsc#1086288 ).
• binfmt_elf: Respect error return from `regset->active' (bsc#1051510).
• bluetooth: avoid killing an already killed socket (bsc#1051510).
• bluetooth: hidp: buffer overflow in hidp_process_report (bsc#1051510).
• bpf, ppc64: fix unexpected r0=0 exit path inside bpf_xadd (bsc#1083647).
• brcmsmac: fix wrap around in conversion from constant to s16 (bsc#1051510).
• clk: core: Potentially free connection id (bsc#1051510).
• clk: imx6ul: fix missing of_node_put() (bsc#1051510).
• clk: meson:…

This update for the Linux Kernel 4.12.14-25_6 fixes several issues.

The following security issues were fixed:

• CVE-2018-15471: An issue was discovered in xenvif_set_hash_mapping in drivers/net/xen-netback/hash.c. The Linux netback driver allowed frontends to control mapping of requests to request queues. When processing a request to set or change this mapping, some input validation (e.g., for an integer overflow) was missing or flawed, leading to OOB access in hash handling. A malicious or buggy frontend may cause the (usually privileged) backend to make out of bounds memory accesses, potentially resulting in one or more of privilege escalation, Denial of Service (DoS), or information leaks (bsc#1105026).
• CVE-2018-10853: A KVM guest userspace to guest kernel write was fixed, which could be used by guest users to crash the guest kernel (bsc#1097108).

This update for the Linux Kernel 4.4.121-92_92 fixes one issue.

The following security issue was fixed:

• CVE-2018-10853: A KVM guest userspace to guest kernel write was fixed, which could be used by guest users to crash the guest kernel (bsc#1097108).

The SUSE Linux Enterprise 12 SP1 kernel was updated receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-14634: Prevent integer overflow in create_elf_tables that allowed a local attacker to exploit this vulnerability via a SUID-root binary and obtain full root privileges (bsc#1108912)
• CVE-2018-14617: Prevent NULL pointer dereference and panic in hfsplus_lookup() when opening a file (that is purportedly a hard link) in an hfs+ filesystem that has malformed catalog data, and is mounted read-only without a metadata directory (bsc#1102870)
• CVE-2018-16276: Incorrect bounds checking in the yurex USB driver in yurex_read allowed local attackers to use user access read/writes to crash the kernel or potentially escalate privileges (bsc#1106095)
• CVE-2018-12896: Prevent integer overflow in the POSIX timer code that was caused by the way the overrun accounting works. Depending on interval and expiry time values, the overrun can be larger than INT_MAX, but the accounting is int based. This basically made the accounting values, which are visible to user space via timer_getoverrun(2) and siginfo::si_overrun, random. This allowed a local user to cause a denial of service (signed integer overflow) via crafted mmap, futex, timer_create, and timer_settime system calls (bnc#1099922)
• CVE-2018-13093: Prevent NULL pointer dereference and panic in lookup_slow() on a NULL inode->i_ops pointer when doing pathwalks on a corrupted xfs image. This occured because of a lack of proper validation that cached inodes are free during allocation (bnc#1100001)
• CVE-2018-10940: The cdrom_ioctl_media_changed function allowed local attackers to use a incorrect bounds check in the CDROM driver CDROM_MEDIA_CHANGED ioctl to read out kernel memory (bsc#1092903)
• CVE-2018-16658: Prevent information leak in cdrom_ioctl_drive_status that could have been used by local attackers to read kernel memory (bnc#1107689)
• CVE-2018-6555: The irda_setsockopt function allowed local users to cause a denial of service (ias_object use-after-free and system crash) or possibly have unspecified other impact via an AF_IRDA socket (bnc#1106511)
• CVE-2018-6554: Prevent memory leak in the irda_bind function that allowed local users to cause a denial of service (memory consumption) by repeatedly binding an AF_IRDA socket (bnc#1106509)
• CVE-2018-10902: Protect against concurrent access to prevent double realloc (double free) in snd_rawmidi_input_params() and snd_rawmidi_output_status(). A malicious local attacker could have used this for privilege escalation (bnc#1105322)
• CVE-2018-10879: A local user could have caused a use-after-free in ext4_xattr_set_entry function and a denial of service or unspecified other impact by renaming a file in a crafted ext4 filesystem image (bsc#1099844)
• CVE-2018-10883: A local user could have caused an out-of-bounds write in jbd2_journal_dirty_metadata(), a denial of service, and a system crash by mounting and operating on a crafted ext4 filesystem image (bsc#1099863)
• CVE-2018-10880: Prevent stack-out-of-bounds write in the ext4 filesystem code when mounting and writing to a crafted ext4 image in ext4_update_inline_data(). An attacker could have used this to cause a system crash and a denial of service (bsc#1099845)
• CVE-2018-10882: A local user could have caused an out-of-bound write, a denial of service, and a system crash by unmounting a crafted ext4 filesystem image (bsc#1099849)
• CVE-2018-10881: A local user could have caused an out-of-bound access in ext4_get_group_info function, a denial of service, and a system crash by mounting and operating on a crafted ext4 filesystem image (bsc#1099864)
• CVE-2018-10877: Prevent out-of-bound access in the ext4_ext_drop_refs() function when operating on a crafted ext4 filesystem image (bsc#1099846)
• CVE-2018-10876: A use-after-free was possible in ext4_ext_remove_space() function…

The SUSE Linux Enterprise 12 SP1 kernel was updated receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-14634: Prevent integer overflow in create_elf_tables that allowed a local attacker to exploit this vulnerability via a SUID-root binary and obtain full root privileges (bsc#1108912)
• CVE-2018-14617: Prevent NULL pointer dereference and panic in hfsplus_lookup() when opening a file (that is purportedly a hard link) in an hfs+ filesystem that has malformed catalog data, and is mounted read-only without a metadata directory (bsc#1102870)
• CVE-2018-16276: Incorrect bounds checking in the yurex USB driver in yurex_read allowed local attackers to use user access read/writes to crash the kernel or potentially escalate privileges (bsc#1106095)
• CVE-2018-12896: Prevent integer overflow in the POSIX timer code that was caused by the way the overrun accounting works. Depending on interval and expiry time values, the overrun can be larger than INT_MAX, but the accounting is int based. This basically made the accounting values, which are visible to user space via timer_getoverrun(2) and siginfo::si_overrun, random. This allowed a local user to cause a denial of service (signed integer overflow) via crafted mmap, futex, timer_create, and timer_settime system calls (bnc#1099922)
• CVE-2018-13093: Prevent NULL pointer dereference and panic in lookup_slow() on a NULL inode->i_ops pointer when doing pathwalks on a corrupted xfs image. This occured because of a lack of proper validation that cached inodes are free during allocation (bnc#1100001)
• CVE-2018-10940: The cdrom_ioctl_media_changed function allowed local attackers to use a incorrect bounds check in the CDROM driver CDROM_MEDIA_CHANGED ioctl to read out kernel memory (bsc#1092903)
• CVE-2018-16658: Prevent information leak in cdrom_ioctl_drive_status that could have been used by local attackers to read kernel memory (bnc#1107689)
• CVE-2018-6555: The irda_setsockopt function allowed local users to cause a denial of service (ias_object use-after-free and system crash) or possibly have unspecified other impact via an AF_IRDA socket (bnc#1106511)
• CVE-2018-6554: Prevent memory leak in the irda_bind function that allowed local users to cause a denial of service (memory consumption) by repeatedly binding an AF_IRDA socket (bnc#1106509)
• CVE-2018-10902: Protect against concurrent access to prevent double realloc (double free) in snd_rawmidi_input_params() and snd_rawmidi_output_status(). A malicious local attacker could have used this for privilege escalation (bnc#1105322)
• CVE-2018-10879: A local user could have caused a use-after-free in ext4_xattr_set_entry function and a denial of service or unspecified other impact by renaming a file in a crafted ext4 filesystem image (bsc#1099844)
• CVE-2018-10883: A local user could have caused an out-of-bounds write in jbd2_journal_dirty_metadata(), a denial of service, and a system crash by mounting and operating on a crafted ext4 filesystem image (bsc#1099863)
• CVE-2018-10880: Prevent stack-out-of-bounds write in the ext4 filesystem code when mounting and writing to a crafted ext4 image in ext4_update_inline_data(). An attacker could have used this to cause a system crash and a denial of service (bsc#1099845)
• CVE-2018-10882: A local user could have caused an out-of-bound write, a denial of service, and a system crash by unmounting a crafted ext4 filesystem image (bsc#1099849)
• CVE-2018-10881: A local user could have caused an out-of-bound access in ext4_get_group_info function, a denial of service, and a system crash by mounting and operating on a crafted ext4 filesystem image (bsc#1099864)
• CVE-2018-10877: Prevent out-of-bound access in the ext4_ext_drop_refs() function when operating on a crafted ext4 filesystem image (bsc#1099846)
• CVE-2018-10876: A use-after-free was possible in ext4_ext_remove_space() function…

This update for the Linux Kernel 4.12.14-25_11 fixes several issues.

The following security issues were fixed:

• CVE-2018-15471: An issue was discovered in xenvif_set_hash_mapping in drivers/net/xen-netback/hash.c. The Linux netback driver allowed frontends to control mapping of requests to request queues. When processing a request to set or change this mapping, some input validation (e.g., for an integer overflow) was missing or flawed, leading to OOB access in hash handling. A malicious or buggy frontend may cause the (usually privileged) backend to make out of bounds memory accesses, potentially resulting in one or more of privilege escalation, Denial of Service (DoS), or information leaks (bsc#1105026).
• CVE-2018-10853: A KVM guest userspace to guest kernel write was fixed, which could be used by guest users to crash the guest kernel (bsc#1097108).