{"id":"CVE-2017-5669","aliases":["DEBIAN-CVE-2017-5669","DLA-849-1","DSA-3804-1","EUVD-2017-14746","GHSA-xjq6-89c2-fjjf","SUSE-SU-2017:1247-1","SUSE-SU-2017:1301-1","SUSE-SU-2017:1360-1","SUSE-SU-2017:2342-1","SUSE-SU-2017:2525-1","UBUNTU-CVE-2017-5669","USN-3265-1","USN-3265-2","USN-3361-1","USN-3583-1"],"status":"published","title":"The do_shmat function in ipc/shm.c in the Linux kernel through 4.9.12 does not restrict the...","description":"The do_shmat function in ipc/shm.c in the Linux kernel through 4.9.12 does not restrict the address calculated by a certain rounding operation, which allows local users to map page zero, and consequently bypass a protection mechanism that exists for the mmap system call, by making crafted shmget and shmat system calls in a privileged context.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.004,"percentile":0.34466,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2017-02-24T00:00:00Z","modified":"2026-10-28T08:17:39Z","fixes":[{"ecosystem":"Debian:12","package":"linux","fixed_in":["4.9.13-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"linux","fixed_in":["4.9.13-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"linux","fixed_in":["4.9.13-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"linux","fixed_in":["3.13.0-142.191"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-xenial","fixed_in":["4.4.0-75.96~14.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"linux","fixed_in":["4.4.0-75.96"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"linux-aws","fixed_in":["4.4.0-1016.25"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"linux-gke","fixed_in":["4.4.0-1012.12"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"linux-hwe","fixed_in":["4.10.0-32.36~16.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"linux-raspi2","fixed_in":["4.4.0-1054.61"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"linux-snapdragon","fixed_in":["4.4.0-1057.61"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.13-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.13-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.13-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.86-1"}]}],"versions":["3.2.41-2","3.2.41-2+deb7u1","3.2.41-2+deb7u2","3.2.41-2+deb7u2~bpo60+1","3.2.46-1","3.2.46-1+deb7u1","3.2.46-1+deb7u1~bpo60+1","3.2.46-1~bpo60+1","3.2.51-1","3.2.51-1~bpo60+1","3.2.53-1","3.2.53-2","3.2.54-1","3.2.54-2","3.2.54-2~bpo60+1","3.2.57-1","3.2.57-2","3.2.57-3","3.2.57-3+deb7u1","3.2.57-3+deb7u2","3.2.57-3+deb7u2~bpo60+1","3.2.60-1","3.2.60-1+deb7u1","3.2.60-1+deb7u2","3.2.60-1+deb7u3","3.2.60-1+deb7u3~bpo60+1","3.2.63-1","3.2.63-2","3.2.63-2+deb7u1","3.2.63-2+deb7u1~bpo60+1","3.2.63-2+deb7u2","3.2.63-2+deb7u2~bpo60+1","3.2.65-1","3.2.65-1+deb7u1","3.2.65-1+deb7u1~bpo60+1","3.2.65-1+deb7u2","3.2.65-1+deb7u2~bpo60+1","3.2.68-1","3.2.68-1+deb7u1","3.2.68-1+deb7u1~bpo60+1","3.2.68-1+deb7u2","3.2.68-1+deb7u2~bpo60+1","3.2.68-1+deb7u3","3.2.68-1+deb7u3~bpo60+1","3.2.68-1+deb7u4","3.2.68-1+deb7u4~bpo60+1","3.2.68-1+deb7u5","3.2.68-1+deb7u6","3.2.68-1+deb7u6~bpo60+1","3.2.71-1","3.2.71-2","3.2.73-1","3.2.73-2","3.2.73-2+deb7u1","3.2.73-2+deb7u2","3.2.73-2+deb7u2~bpo60+1","3.2.73-2+deb7u3","3.2.78-1","3.2.81-1","3.2.81-2","3.2.82-1","3.2.84-1","3.2.84-2"],"bundled":9},{"source":"osv","ecosystem":"Debian:8","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.16.39-1+deb8u2"}]}],"versions":["3.16.36-1","3.16.36-1+deb8u1","3.16.36-1+deb8u1~bpo70+1","3.16.36-1+deb8u2","3.16.36-1+deb8u2~bpo70+1","3.16.39-1","3.16.39-1+deb8u1","3.16.39-1+deb8u1~bpo70+1","3.16.39-1+deb8u1~bpo70+1+gcc4.4","3.16.39-1~bpo70+1","3.16.7-ckt11-1","3.16.7-ckt11-1+deb8u1","3.16.7-ckt11-1+deb8u2","3.16.7-ckt11-1+deb8u2~bpo70+1","3.16.7-ckt11-1+deb8u3","3.16.7-ckt11-1+deb8u3~bpo70+1","3.16.7-ckt11-1+deb8u4","3.16.7-ckt11-1+deb8u4~bpo70+1","3.16.7-ckt11-1+deb8u5","3.16.7-ckt11-1+deb8u6","3.16.7-ckt11-1+deb8u6~bpo70+1","3.16.7-ckt11-1~bpo70+1","3.16.7-ckt17-1","3.16.7-ckt20-1","3.16.7-ckt20-1+deb8u1","3.16.7-ckt20-1+deb8u2","3.16.7-ckt20-1+deb8u2~bpo70+1","3.16.7-ckt20-1+deb8u3","3.16.7-ckt20-1+deb8u3~bpo70+1","3.16.7-ckt20-1+deb8u4","3.16.7-ckt20-1+deb8u4~bpo70+1","3.16.7-ckt25-1","3.16.7-ckt25-1~bpo70+1","3.16.7-ckt25-2","3.16.7-ckt25-2+deb8u1","3.16.7-ckt25-2+deb8u2","3.16.7-ckt25-2+deb8u3","3.16.7-ckt25-2+deb8u3~bpo70+1","3.16.7-ckt25-2~bpo70+1","3.16.7-ckt9-2","3.16.7-ckt9-3","3.16.7-ckt9-3~deb8u1","3.16.7-ckt9-3~deb8u1~bpo70+1"],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"kernel-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.61-52.72.1"}]}],"bundled":25},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.61-52.72.1"}]}],"bundled":25},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.61-52.72.1"}]}],"bundled":25},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.61-52.72.1"}]}],"bundled":25},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"kernel-xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.61-52.72.1"}]}],"bundled":25},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"kgraft-patch-SLE12_Update_21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-2.1"}]}],"bundled":25},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.61-52.72.1"}]}],"bundled":25},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.61-52.72.1"}]}],"bundled":25},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.61-52.72.1"}]}],"bundled":25},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"kernel-xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.61-52.72.1"}]}],"bundled":25},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"kgraft-patch-SLE12_Update_21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-2.1"}]}],"bundled":25},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-100.2"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"kernel-bigmem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-100.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-100.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"kernel-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-100.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"kernel-pae","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-100.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"kernel-ppc64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-100.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-100.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-100.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"kernel-trace","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-100.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"kernel-xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-100.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"kernel-bigmem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-100.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-100.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"kernel-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-100.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"kernel-pae","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-100.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"kernel-ppc64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-100.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-100.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-100.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"kernel-trace","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-100.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"kernel-xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-100.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.74-60.64.40.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.74-60.64.40.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.74-60.64.40.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"kernel-xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.74-60.64.40.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 12","package":"kgraft-patch-SLE12-SP1_Update_15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-4.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"kernel-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.74-60.64.40.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.74-60.64.40.4"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.74-60.64.40.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.74-60.64.40.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.74-60.64.40.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.74-60.64.40.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"kernel-xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.74-60.64.40.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.74-60.64.40.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.74-60.64.40.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.74-60.64.40.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"kernel-xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.74-60.64.40.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP1","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.74-60.64.40.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 11 SP4","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101.rt130-69.5.1"}]}],"bundled":43},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 11 SP4","package":"kernel-rt_trace","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101.rt130-69.5.1"}]}],"bundled":43},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 11 SP4","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101.rt130-69.5.1"}]}],"bundled":43},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 11 SP4","package":"kernel-syms-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101.rt130-69.5.1"}]}],"bundled":43},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.47.106.5.1"}]}],"bundled":40},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"kernel-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.47.106.5.1"}]}],"bundled":40},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"kernel-pae","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.47.106.5.1"}]}],"bundled":40},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.47.106.5.1"}]}],"bundled":40},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.47.106.5.1"}]}],"bundled":40},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"kernel-trace","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.47.106.5.1"}]}],"bundled":40},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"kernel-xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.47.106.5.1"}]}],"bundled":40},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"kernel-bigsmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.47.106.5.1"}]}],"bundled":40},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.47.106.5.1"}]}],"bundled":40},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"kernel-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.47.106.5.1"}]}],"bundled":40},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"kernel-pae","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.47.106.5.1"}]}],"bundled":40},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.47.106.5.1"}]}],"bundled":40},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.47.106.5.1"}]}],"bundled":40},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"kernel-trace","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.47.106.5.1"}]}],"bundled":40},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"kernel-xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.47.106.5.1"}]}],"bundled":40},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.0-142.191"}]}],"versions":["3.11.0-12.19","3.12.0-1.3","3.12.0-2.5","3.12.0-2.7","3.12.0-3.8","3.12.0-3.9","3.12.0-4.10","3.12.0-4.12","3.12.0-5.13","3.12.0-7.15","3.13.0-1.16","3.13.0-2.17","3.13.0-3.18","3.13.0-4.19","3.13.0-5.20","3.13.0-6.23","3.13.0-7.25","3.13.0-7.26","3.13.0-8.27","3.13.0-8.28","3.13.0-10.30","3.13.0-11.31","3.13.0-12.32","3.13.0-13.33","3.13.0-14.34","3.13.0-15.35","3.13.0-16.36","3.13.0-17.37","3.13.0-18.38","3.13.0-19.39","3.13.0-19.40","3.13.0-20.42","3.13.0-21.43","3.13.0-22.44","3.13.0-23.45","3.13.0-24.46","3.13.0-24.47","3.13.0-27.50","3.13.0-29.53","3.13.0-30.54","3.13.0-30.55","3.13.0-32.57","3.13.0-33.58","3.13.0-34.60","3.13.0-35.62","3.13.0-36.63","3.13.0-37.64","3.13.0-39.66","3.13.0-40.69","3.13.0-41.70","3.13.0-43.72","3.13.0-44.73","3.13.0-45.74","3.13.0-46.75","3.13.0-46.76","3.13.0-46.77","3.13.0-46.79","3.13.0-48.80","3.13.0-49.81","3.13.0-49.83","3.13.0-51.84","3.13.0-52.85","3.13.0-52.86","3.13.0-53.88","3.13.0-53.89","3.13.0-54.91","3.13.0-55.92","3.13.0-55.94","3.13.0-57.95","3.13.0-58.97","3.13.0-59.98","3.13.0-61.100","3.13.0-62.102","3.13.0-63.103","3.13.0-65.105","3.13.0-65.106","3.13.0-66.108","3.13.0-67.110","3.13.0-68.111","3.13.0-70.113","3.13.0-71.114","3.13.0-73.116","3.13.0-74.118","3.13.0-76.120","3.13.0-77.121","3.13.0-79.123","3.13.0-83.127","3.13.0-85.129","3.13.0-86.130","3.13.0-86.131","3.13.0-87.133","3.13.0-88.135","3.13.0-91.138","3.13.0-92.139","3.13.0-93.140","3.13.0-95.142","3.13.0-96.143","3.13.0-98.145","3.13.0-100.147","3.13.0-101.148","3.13.0-103.150","3.13.0-105.152","3.13.0-106.153","3.13.0-107.154","3.13.0-108.155","3.13.0-109.156","3.13.0-110.157","3.13.0-111.158","3.13.0-112.159","3.13.0-113.160","3.13.0-115.162","3.13.0-116.163","3.13.0-117.164","3.13.0-119.166","3.13.0-121.170","3.13.0-123.172","3.13.0-125.174","3.13.0-126.175","3.13.0-128.177","3.13.0-129.178","3.13.0-132.181","3.13.0-133.182","3.13.0-135.184","3.13.0-137.186","3.13.0-139.188","3.13.0-141.190"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-xenial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-75.96~14.04.1"}]}],"versions":["4.4.0-13.29~14.04.1","4.4.0-14.30~14.04.2","4.4.0-15.31~14.04.1","4.4.0-18.34~14.04.1","4.4.0-21.37~14.04.1","4.4.0-22.39~14.04.1","4.4.0-22.40~14.04.1","4.4.0-24.43~14.04.1","4.4.0-28.47~14.04.1","4.4.0-31.50~14.04.1","4.4.0-34.53~14.04.1","4.4.0-36.55~14.04.1","4.4.0-38.57~14.04.1","4.4.0-42.62~14.04.1","4.4.0-45.66~14.04.1","4.4.0-47.68~14.04.1","4.4.0-51.72~14.04.1","4.4.0-53.74~14.04.1","4.4.0-57.78~14.04.1","4.4.0-59.80~14.04.1","4.4.0-62.83~14.04.1","4.4.0-63.84~14.04.2","4.4.0-64.85~14.04.1","4.4.0-66.87~14.04.1","4.4.0-67.88~14.04.1","4.4.0-70.91~14.04.1","4.4.0-71.92~14.04.1","4.4.0-72.93~14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-75.96"}]}],"versions":["4.2.0-16.19","4.2.0-17.21","4.2.0-19.23","4.3.0-1.10","4.3.0-2.11","4.3.0-5.16","4.3.0-6.17","4.3.0-7.18","4.4.0-2.16","4.4.0-4.19","4.4.0-6.21","4.4.0-7.22","4.4.0-8.23","4.4.0-9.24","4.4.0-10.25","4.4.0-11.26","4.4.0-12.28","4.4.0-13.29","4.4.0-14.30","4.4.0-15.31","4.4.0-16.32","4.4.0-17.33","4.4.0-18.34","4.4.0-21.37","4.4.0-22.39","4.4.0-22.40","4.4.0-24.43","4.4.0-28.47","4.4.0-31.50","4.4.0-34.53","4.4.0-36.55","4.4.0-38.57","4.4.0-42.62","4.4.0-43.63","4.4.0-45.66","4.4.0-47.68","4.4.0-51.72","4.4.0-53.74","4.4.0-57.78","4.4.0-59.80","4.4.0-62.83","4.4.0-63.84","4.4.0-64.85","4.4.0-65.86","4.4.0-66.87","4.4.0-67.88","4.4.0-70.91","4.4.0-71.92","4.4.0-72.93"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-1016.25"}]}],"versions":["4.4.0-1001.10","4.4.0-1003.12","4.4.0-1004.13","4.4.0-1007.16","4.4.0-1009.18","4.4.0-1011.20","4.4.0-1012.21","4.4.0-1013.22"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-gke","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-1012.12"}]}],"versions":["4.4.0-1003.3","4.4.0-1005.6","4.4.0-1006.6","4.4.0-1008.8","4.4.0-1009.9","4.4.0-1010.10"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-32.36~16.04.1"}]}],"versions":["4.8.0-36.36~16.04.1","4.8.0-39.42~16.04.1","4.8.0-41.44~16.04.1","4.8.0-42.45~16.04.1","4.8.0-44.47~16.04.1","4.8.0-45.48~16.04.1","4.8.0-46.49~16.04.1","4.8.0-49.52~16.04.1","4.8.0-51.54~16.04.1","4.8.0-52.55~16.04.1","4.8.0-53.56~16.04.1","4.8.0-54.57~16.04.1","4.8.0-56.61~16.04.1","4.8.0-58.63~16.04.1","4.10.0-27.30~16.04.2","4.10.0-28.32~16.04.2","4.10.0-30.34~16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-raspi2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-1054.61"}]}],"versions":["4.2.0-1013.19","4.2.0-1014.21","4.3.0-1006.6","4.4.0-1003.4","4.4.0-1004.5","4.4.0-1009.10","4.4.0-1010.12","4.4.0-1010.13","4.4.0-1012.16","4.4.0-1016.22","4.4.0-1017.23","4.4.0-1019.25","4.4.0-1021.27","4.4.0-1023.29","4.4.0-1027.33","4.4.0-1029.36","4.4.0-1034.41","4.4.0-1038.45","4.4.0-1040.47","4.4.0-1042.49","4.4.0-1044.51","4.4.0-1046.53","4.4.0-1048.55","4.4.0-1050.57","4.4.0-1051.58","4.4.0-1052.59"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-snapdragon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-1057.61"}]}],"versions":["4.4.0-1012.12","4.4.0-1013.14","4.4.0-1013.15","4.4.0-1015.18","4.4.0-1019.22","4.4.0-1020.23","4.4.0-1022.25","4.4.0-1024.27","4.4.0-1026.29","4.4.0-1030.33","4.4.0-1032.36","4.4.0-1035.39","4.4.0-1039.43","4.4.0-1042.46","4.4.0-1044.48","4.4.0-1046.50","4.4.0-1047.51","4.4.0-1048.52","4.4.0-1050.54","4.4.0-1051.55","4.4.0-1053.57","4.4.0-1054.58","4.4.0-1055.59"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1002.2","4.15.0-1003.3","4.15.0-1004.4","4.15.0-1008.8","4.15.0-1009.9","4.15.0-1012.12","4.15.0-1013.13","4.15.0-1014.14","4.15.0-1018.18","4.15.0-1019.19","4.15.0-1021.21","4.15.0-1022.23","4.15.0-1023.24","4.15.0-1025.26","4.15.0-1028.29","4.15.0-1030.31","4.15.0-1031.32","4.15.0-1032.33","4.15.0-1035.36","4.15.0-1036.38","4.15.0-1037.39","4.18.0-1011.11~18.04.1","4.18.0-1013.13~18.04.1","4.18.0-1014.14~18.04.1","4.18.0-1018.18~18.04.1","4.18.0-1019.19~18.04.1","4.18.0-1020.20~18.04.1","4.18.0-1023.24~18.04.1","4.18.0-1024.25~18.04.1","4.18.0-1025.27~18.04.1","5.0.0-1014.14~18.04.1","5.0.0-1016.17~18.04.1","5.0.0-1018.19~18.04.1","5.0.0-1020.21~18.04.1","5.0.0-1022.23~18.04.1","5.0.0-1023.24~18.04.1","5.0.0-1025.27~18.04.1","5.0.0-1027.29~18.04.1","5.0.0-1028.30~18.04.1","5.0.0-1029.31~18.04.1","5.0.0-1031.33","5.0.0-1032.34","5.0.0-1035.37","5.0.0-1036.38"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1001.1","4.15.0-1003.3","4.15.0-1005.5","4.15.0-1006.6","4.15.0-1008.8","4.15.0-1009.9","4.15.0-1010.10","4.15.0-1014.14","4.15.0-1015.15","4.15.0-1017.18","4.15.0-1018.19","4.15.0-1019.20","4.15.0-1021.22","4.15.0-1023.24","4.15.0-1024.25","4.15.0-1025.26","4.15.0-1026.27","4.15.0-1027.28","4.15.0-1028.29","4.15.0-1029.31","4.15.0-1030.32","4.15.0-1032.34","4.15.0-1033.35","4.15.0-1034.36","4.15.0-1036.38","4.15.0-1037.39","4.15.0-1040.42","4.15.0-1042.45","4.15.0-1044.70","5.0.0-1020.20~18.04.1","5.0.0-1021.21~18.04.1","5.0.0-1025.26~18.04.1","5.0.0-1026.27~18.04.1","5.0.0-1028.29~18.04.1","5.0.0-1029.30~18.04.1","5.0.0-1031.32","5.0.0-1033.34","5.0.0-1034.35"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.18.0-13.14~18.04.1","4.18.0-14.15~18.04.1","4.18.0-15.16~18.04.1","4.18.0-16.17~18.04.1","4.18.0-17.18~18.04.1","4.18.0-18.19~18.04.1","4.18.0-20.21~18.04.1","4.18.0-21.22~18.04.1","4.18.0-22.23~18.04.1","4.18.0-24.25~18.04.1","4.18.0-25.26~18.04.1","5.0.0-23.24~18.04.1","5.0.0-25.26~18.04.1","5.0.0-27.28~18.04.1","5.0.0-29.31~18.04.1","5.0.0-31.33~18.04.1","5.0.0-32.34~18.04.2","5.0.0-35.38~18.04.1","5.0.0-36.39~18.04.1","5.0.0-37.40~18.04.1","5.3.0-26.28~18.04.1","5.3.0-28.30~18.04.1","5.3.0-40.32~18.04.1","5.3.0-42.34~18.04.1","5.3.0-45.37~18.04.1","5.3.0-46.38~18.04.1","5.3.0-51.44~18.04.2","5.3.0-53.47~18.04.1","5.3.0-59.53~18.04.1","5.3.0-61.55~18.04.1","5.3.0-62.56~18.04.1","5.3.0-64.58~18.04.1","5.3.0-65.59","5.3.0-66.60","5.3.0-67.61","5.3.0-68.63","5.3.0-69.65","5.3.0-70.66","5.3.0-72.68","5.3.0-73.69","5.3.0-74.70","5.3.0-75.71","5.3.0-76.72"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-hwe-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-15.16~18.04.1","5.0.0-16.17~18.04.1","5.0.0-17.18~18.04.1","5.0.0-19.20~18.04.1","5.0.0-20.21~18.04.1","5.3.0-19.20~18.04.2","5.3.0-22.24~18.04.1","5.3.0-23.25~18.04.1","5.3.0-23.25~18.04.2","5.3.0-24.26~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1002.3","4.15.0-1004.5","4.15.0-1006.9","4.15.0-1008.11","4.15.0-1009.12","4.15.0-1012.15","4.15.0-1013.16","4.15.0-1015.18","4.15.0-1017.20","4.15.0-1018.21","4.15.0-1021.24","4.15.0-1024.29","4.15.0-1026.31","4.15.0-1028.33","4.15.0-1030.35","4.15.0-1033.38","4.15.0-1034.39","4.15.0-1035.40","4.15.0-1036.41","4.15.0-1038.43","4.15.0-1039.44","4.15.0-1043.48","4.15.0-1045.50","4.15.0-1050.57","4.15.0-1056.65","4.15.0-1057.66","4.15.0-1059.68","4.15.0-1063.72","4.15.0-1064.73","4.15.0-1065.75","4.15.0-1066.76","4.15.0-1067.77","4.15.0-1069.79","4.15.0-1073.83","4.15.0-1076.86","4.15.0-1079.89","4.15.0-1080.90","4.15.0-1081.91","4.15.0-1087.97","4.15.0-1090.100","4.15.0-1091.101","4.15.0-1093.103","4.15.0-1094.104","4.15.0-1096.106","4.15.0-1097.107","4.15.0-1099.109","4.15.0-1100.110","4.15.0-1101.112","4.15.0-1102.113","4.15.0-1103.114"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-fde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1063.66+cvm2.2","5.4.0-1063.66+cvm3.2","5.4.0-1064.67+cvm1.1","5.4.0-1065.68+cvm2.1","5.4.0-1067.70+cvm1.1","5.4.0-1068.71+cvm1.1","5.4.0-1069.72+cvm1.1","5.4.0-1070.73+cvm1.1","5.4.0-1072.75+cvm1.1","5.4.0-1073.76+cvm1.1","5.4.0-1074.77+cvm1.1","5.4.0-1076.79+cvm1.1","5.4.0-1078.81+cvm1.1","5.4.0-1080.83+cvm1.1","5.4.0-1083.87+cvm1.1","5.4.0-1085.90+cvm1.1","5.4.0-1085.90+cvm2.1","5.4.0-1086.91+cvm1.1","5.4.0-1089.94+cvm1.2","5.4.0-1090.95+cvm1.1","5.4.0-1091.96+cvm1.1","5.4.0-1092.97+cvm1.1","5.4.0-1095.101+cvm1.1","5.4.0-1098.104+cvm1.1","5.4.0-1100.106+cvm1.1","5.4.0-1103.109+cvm1.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-azure-fde-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1019.24~20.04.1.1","5.15.0-1020.25~20.04.1.1","5.15.0-1021.26~20.04.1.1","5.15.0-1029.36~20.04.1.1","5.15.0-1030.37~20.04.1.1","5.15.0-1031.38~20.04.1.1","5.15.0-1033.40~20.04.1.1","5.15.0-1034.41~20.04.1.2","5.15.0-1035.42~20.04.1.1","5.15.0-1036.43~20.04.1.1","5.15.0-1037.44~20.04.1.1","5.15.0-1038.45~20.04.1.1","5.15.0-1039.46~20.04.1.1","5.15.0-1040.47~20.04.1.1","5.15.0-1041.48~20.04.1.1","5.15.0-1042.49~20.04.1.1","5.15.0-1043.50~20.04.1.1","5.15.0-1046.53~20.04.1.1","5.15.0-1047.54~20.04.1.1","5.15.0-1049.56~20.04.1.1","5.15.0-1050.57~20.04.1.1","5.15.0-1051.59~20.04.1.1","5.15.0-1052.60~20.04.1.1","5.15.0-1053.61~20.04.1.1","5.15.0-1054.62~20.04.1.1","5.15.0-1056.64~20.04.1.1","5.15.0-1057.65~20.04.1.1","5.15.0-1058.66~20.04.2.1","5.15.0-1059.67~20.04.1.1","5.15.0-1060.69~20.04.1.1","5.15.0-1061.70~20.04.1.1","5.15.0-1063.72~20.04.1.1","5.15.0-1064.73~20.04.1.1","5.15.0-1065.74~20.04.1.1","5.15.0-1067.76~20.04.1.1","5.15.0-1068.77~20.04.1.1","5.15.0-1070.79~20.04.1.1","5.15.0-1071.80~20.04.1.1","5.15.0-1072.81~20.04.1.1","5.15.0-1073.82~20.04.1.1","5.15.0-1074.83~20.04.1.1","5.15.0-1076.85~20.04.1.1","5.15.0-1078.87~20.04.1.1","5.15.0-1081.90~20.04.1.1","5.15.0-1082.91~20.04.1.1","5.15.0-1086.95~20.04.1.1","5.15.0-1087.96~20.04.1.1","5.15.0-1088.97~20.04.1.1","5.15.0-1089.98~20.04.1.1","5.15.0-1091.100~20.04.1.1","5.15.0-1094.103~20.04.1.1","5.15.0-1096.105~20.04.1.1","5.15.0-1097.106~20.04.1.1","5.15.0-1098.107~20.04.1.1","5.15.0-1102.111~20.04.1.1","5.15.0-1103.112~20.04.1.1","5.15.0-1111.120~20.04.1.1","5.15.0-1114.123~20.04.1","5.15.0-1116.125~20.04.1","5.15.0-1117.126~20.04.2","5.15.0-1118.127~20.04.1","5.15.0-1119.128~20.04.1","5.15.0-1120.129~20.04.1","5.15.0-1121.130~20.04.1","5.15.0-1122.131~20.04.1","5.15.0-1124.133~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gke","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1033.35","5.4.0-1035.37","5.4.0-1036.38","5.4.0-1037.39","5.4.0-1039.41","5.4.0-1041.43","5.4.0-1042.44","5.4.0-1043.45","5.4.0-1044.46","5.4.0-1046.48","5.4.0-1049.52","5.4.0-1051.54","5.4.0-1052.55","5.4.0-1053.56","5.4.0-1054.57","5.4.0-1055.58","5.4.0-1056.59","5.4.0-1057.60","5.4.0-1059.62","5.4.0-1061.64","5.4.0-1062.65","5.4.0-1063.66","5.4.0-1065.68","5.4.0-1066.69","5.4.0-1067.70","5.4.0-1068.71","5.4.0-1071.76","5.4.0-1072.77","5.4.0-1074.79","5.4.0-1076.82","5.4.0-1078.84","5.4.0-1080.86","5.4.0-1081.87","5.4.0-1083.89","5.4.0-1084.90","5.4.0-1086.93","5.4.0-1087.94","5.4.0-1090.97","5.4.0-1091.98","5.4.0-1094.101","5.4.0-1095.102","5.4.0-1096.103","5.4.0-1097.104","5.4.0-1098.105","5.4.0-1099.106","5.4.0-1100.107","5.4.0-1101.108","5.4.0-1102.109","5.4.0-1103.110","5.4.0-1104.111","5.4.0-1105.112"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-raspi2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1007.8","5.3.0-1014.16","5.3.0-1015.17","5.3.0-1017.19","5.4.0-1004.4","5.4.0-1006.6"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-24.28","5.4.0-26.30","5.4.0-27.31","5.4.0-28.32","5.4.0-30.34","5.4.0-31.35","5.4.0-33.37","5.4.0-34.38","5.4.0-36.41","5.4.0-37.42","5.4.0-39.44","5.4.0-40.45"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-intel-iot-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1073.75"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1032.35"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1004.4","5.13.0-1006.6+22.04.1","5.13.0-1007.7+22.04.1","5.13.0-1010.11+22.04.1","5.15.0-1004.4","5.15.0-1005.5","5.15.0-1006.6","5.15.0-1007.7","5.15.0-1008.8","5.15.0-1011.12","5.15.0-1012.13","5.15.0-1014.16","5.15.0-1015.17","5.15.0-1016.18","5.15.0-1017.19","5.15.0-1018.21","5.15.0-1019.22","5.15.0-1020.23","5.15.0-1022.26","5.15.0-1023.27","5.15.0-1026.30","5.15.0-1027.31","5.15.0-1028.32"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1008.8~24.04.1","6.11.0-1012.12~24.04.1","6.11.0-1013.13~24.04.1","6.11.0-1014.14~24.04.1","6.11.0-1015.15~24.04.1","6.11.0-1017.17~24.04.1","6.11.0-1018.18~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1006.6~24.04.2","6.11.0-1011.11~24.04.1","6.11.0-1013.13~24.04.1","6.11.0-1014.14~24.04.1","6.11.0-1015.15~24.04.1","6.11.0-1016.16~24.04.1","6.11.0-1017.17~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-hwe-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-17.17~24.04.2","6.11.0-19.19~24.04.1","6.11.0-21.21~24.04.1","6.11.0-24.24~24.04.1","6.11.0-25.25~24.04.1","6.11.0-26.26~24.04.1","6.11.0-28.28~24.04.1","6.11.0-29.29~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-lowlatency-hwe-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1009.10~24.04.1","6.11.0-1011.12~24.04.1","6.11.0-1012.13~24.04.1","6.11.0-1013.14~24.04.1","6.11.0-1014.15~24.04.1","6.11.0-1015.16~24.04.2","6.11.0-1016.17~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-raspi-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-2019.20"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-75.96"}]}],"versions":["4.2.0-16.19","4.2.0-17.21","4.2.0-19.23","4.3.0-1.10","4.3.0-2.11","4.3.0-5.16","4.3.0-6.17","4.3.0-7.18","4.4.0-2.16","4.4.0-4.19","4.4.0-6.21","4.4.0-7.22","4.4.0-8.23","4.4.0-9.24","4.4.0-10.25","4.4.0-11.26","4.4.0-12.28","4.4.0-13.29","4.4.0-14.30","4.4.0-15.31","4.4.0-16.32","4.4.0-17.33","4.4.0-18.34","4.4.0-21.37","4.4.0-22.39","4.4.0-22.40","4.4.0-24.43","4.4.0-28.47","4.4.0-31.50","4.4.0-34.53","4.4.0-36.55","4.4.0-38.57","4.4.0-42.62","4.4.0-43.63","4.4.0-45.66","4.4.0-47.68","4.4.0-51.72","4.4.0-53.74","4.4.0-57.78","4.4.0-59.80","4.4.0-62.83","4.4.0-63.84","4.4.0-64.85","4.4.0-65.86","4.4.0-66.87","4.4.0-67.88","4.4.0-70.91","4.4.0-71.92","4.4.0-72.93"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-1016.25"}]}],"versions":["4.4.0-1001.10","4.4.0-1003.12","4.4.0-1004.13","4.4.0-1007.16","4.4.0-1009.18","4.4.0-1011.20","4.4.0-1012.21","4.4.0-1013.22"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-gke","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-1012.12"}]}],"versions":["4.4.0-1003.3","4.4.0-1005.6","4.4.0-1006.6","4.4.0-1008.8","4.4.0-1009.9","4.4.0-1010.10"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-raspi2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-1054.61"}]}],"versions":["4.2.0-1013.19","4.2.0-1014.21","4.3.0-1006.6","4.4.0-1003.4","4.4.0-1004.5","4.4.0-1009.10","4.4.0-1010.12","4.4.0-1010.13","4.4.0-1012.16","4.4.0-1016.22","4.4.0-1017.23","4.4.0-1019.25","4.4.0-1021.27","4.4.0-1023.29","4.4.0-1027.33","4.4.0-1029.36","4.4.0-1034.41","4.4.0-1038.45","4.4.0-1040.47","4.4.0-1042.49","4.4.0-1044.51","4.4.0-1046.53","4.4.0-1048.55","4.4.0-1050.57","4.4.0-1051.58","4.4.0-1052.59"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-snapdragon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-1057.61"}]}],"versions":["4.4.0-1012.12","4.4.0-1013.14","4.4.0-1013.15","4.4.0-1015.18","4.4.0-1019.22","4.4.0-1020.23","4.4.0-1022.25","4.4.0-1024.27","4.4.0-1026.29","4.4.0-1030.33","4.4.0-1032.36","4.4.0-1035.39","4.4.0-1039.43","4.4.0-1042.46","4.4.0-1044.48","4.4.0-1046.50","4.4.0-1047.51","4.4.0-1048.52","4.4.0-1050.54","4.4.0-1051.55","4.4.0-1053.57","4.4.0-1054.58","4.4.0-1055.59"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-xenial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-75.96~14.04.1"}]}],"versions":["4.4.0-13.29~14.04.1","4.4.0-14.30~14.04.2","4.4.0-15.31~14.04.1","4.4.0-18.34~14.04.1","4.4.0-21.37~14.04.1","4.4.0-22.39~14.04.1","4.4.0-22.40~14.04.1","4.4.0-24.43~14.04.1","4.4.0-28.47~14.04.1","4.4.0-31.50~14.04.1","4.4.0-34.53~14.04.1","4.4.0-36.55~14.04.1","4.4.0-38.57~14.04.1","4.4.0-42.62~14.04.1","4.4.0-45.66~14.04.1","4.4.0-47.68~14.04.1","4.4.0-51.72~14.04.1","4.4.0-53.74~14.04.1","4.4.0-57.78~14.04.1","4.4.0-59.80~14.04.1","4.4.0-62.83~14.04.1","4.4.0-63.84~14.04.2","4.4.0-64.85~14.04.1","4.4.0-66.87~14.04.1","4.4.0-67.88~14.04.1","4.4.0-70.91~14.04.1","4.4.0-71.92~14.04.1","4.4.0-72.93~14.04.1"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-27.30~16.04.2"}]}],"versions":["4.8.0-36.36~16.04.1","4.8.0-39.42~16.04.1","4.8.0-41.44~16.04.1","4.8.0-42.45~16.04.1","4.8.0-44.47~16.04.1","4.8.0-45.48~16.04.1","4.8.0-46.49~16.04.1","4.8.0-49.52~16.04.1","4.8.0-51.54~16.04.1","4.8.0-52.55~16.04.1","4.8.0-53.56~16.04.1","4.8.0-54.57~16.04.1","4.8.0-56.61~16.04.1","4.8.0-58.63~16.04.1"],"bundled":40},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.0-142.191"}]}],"versions":["3.11.0-12.19","3.12.0-1.3","3.12.0-2.5","3.12.0-2.7","3.12.0-3.8","3.12.0-3.9","3.12.0-4.10","3.12.0-4.12","3.12.0-5.13","3.12.0-7.15","3.13.0-1.16","3.13.0-2.17","3.13.0-3.18","3.13.0-4.19","3.13.0-5.20","3.13.0-6.23","3.13.0-7.25","3.13.0-7.26","3.13.0-8.27","3.13.0-8.28","3.13.0-10.30","3.13.0-11.31","3.13.0-12.32","3.13.0-13.33","3.13.0-14.34","3.13.0-15.35","3.13.0-16.36","3.13.0-17.37","3.13.0-18.38","3.13.0-19.39","3.13.0-19.40","3.13.0-20.42","3.13.0-21.43","3.13.0-22.44","3.13.0-23.45","3.13.0-24.46","3.13.0-24.47","3.13.0-27.50","3.13.0-29.53","3.13.0-30.54","3.13.0-30.55","3.13.0-32.57","3.13.0-33.58","3.13.0-34.60","3.13.0-35.62","3.13.0-36.63","3.13.0-37.64","3.13.0-39.66","3.13.0-40.69","3.13.0-41.70","3.13.0-43.72","3.13.0-44.73","3.13.0-45.74","3.13.0-46.75","3.13.0-46.76","3.13.0-46.77","3.13.0-46.79","3.13.0-48.80","3.13.0-49.81","3.13.0-49.83","3.13.0-51.84","3.13.0-52.85","3.13.0-52.86","3.13.0-53.88","3.13.0-53.89","3.13.0-54.91","3.13.0-55.92","3.13.0-55.94","3.13.0-57.95","3.13.0-58.97","3.13.0-59.98","3.13.0-61.100","3.13.0-62.102","3.13.0-63.103","3.13.0-65.105","3.13.0-65.106","3.13.0-66.108","3.13.0-67.110","3.13.0-68.111","3.13.0-70.113","3.13.0-71.114","3.13.0-73.116","3.13.0-74.118","3.13.0-76.120","3.13.0-77.121","3.13.0-79.123","3.13.0-83.127","3.13.0-85.129","3.13.0-86.130","3.13.0-86.131","3.13.0-87.133","3.13.0-88.135","3.13.0-91.138","3.13.0-92.139","3.13.0-93.140","3.13.0-95.142","3.13.0-96.143","3.13.0-98.145","3.13.0-100.147","3.13.0-101.148","3.13.0-103.150","3.13.0-105.152","3.13.0-106.153","3.13.0-107.154","3.13.0-108.155","3.13.0-109.156","3.13.0-110.157","3.13.0-111.158","3.13.0-112.159","3.13.0-113.160","3.13.0-115.162","3.13.0-116.163","3.13.0-117.164","3.13.0-119.166","3.13.0-121.170","3.13.0-123.172","3.13.0-125.174","3.13.0-126.175","3.13.0-128.177","3.13.0-129.178","3.13.0-132.181","3.13.0-133.182","3.13.0-135.184","3.13.0-137.186","3.13.0-139.188","3.13.0-141.190"],"bundled":25}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"linux","product":"linux_kernel"}],"references":[{"url":"https://usn.ubuntu.com/3583-2/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/3583-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securitytracker.com/id/1037918","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.securityfocus.com/bid/96754","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.debian.org/security/2017/dsa-3804","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://bugzilla.kernel.org/show_bug.cgi?id=192931","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Vendor Advisory","fix"]},{"url":"https://github.com/torvalds/linux/commit/95e91b831f87ac8e1f8ed50c14d709089b4e01b8","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://github.com/torvalds/linux/commit/e1d35d4dc7f089e6c9c080d556feedf9c706f0c7","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-5669"},{"url":"https://usn.ubuntu.com/3583-1"},{"url":"https://usn.ubuntu.com/3583-2"},{"url":"https://github.com/advisories/GHSA-xjq6-89c2-fjjf"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-5669","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20171247-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1003077","tags":["report"]},{"url":"https://bugzilla.suse.com/1015703","tags":["report"]},{"url":"https://bugzilla.suse.com/1021256","tags":["report"]},{"url":"https://bugzilla.suse.com/1021762","tags":["report"]},{"url":"https://bugzilla.suse.com/1023377","tags":["report"]},{"url":"https://bugzilla.suse.com/1023762","tags":["report"]},{"url":"https://bugzilla.suse.com/1023992","tags":["report"]},{"url":"https://bugzilla.suse.com/1024938","tags":["report"]},{"url":"https://bugzilla.suse.com/1025235","tags":["report"]},{"url":"https://bugzilla.suse.com/1026024","tags":["report"]},{"url":"https://bugzilla.suse.com/1026722","tags":["report"]},{"url":"https://bugzilla.suse.com/1026914","tags":["report"]},{"url":"https://bugzilla.suse.com/1027066","tags":["report"]},{"url":"https://bugzilla.suse.com/1027149","tags":["report"]},{"url":"https://bugzilla.suse.com/1027178","tags":["report"]},{"url":"https://bugzilla.suse.com/1027189","tags":["report"]},{"url":"https://bugzilla.suse.com/1027190","tags":["report"]},{"url":"https://bugzilla.suse.com/1028415","tags":["report"]},{"url":"https://bugzilla.suse.com/1028895","tags":["report"]},{"url":"https://bugzilla.suse.com/1029986","tags":["report"]},{"url":"https://bugzilla.suse.com/1030118","tags":["report"]},{"url":"https://bugzilla.suse.com/1030213","tags":["report"]},{"url":"https://bugzilla.suse.com/1030901","tags":["report"]},{"url":"https://bugzilla.suse.com/1031003","tags":["report"]},{"url":"https://bugzilla.suse.com/1031052","tags":["report"]},{"url":"https://bugzilla.suse.com/1031440","tags":["report"]},{"url":"https://bugzilla.suse.com/1031579","tags":["report"]},{"url":"https://bugzilla.suse.com/1032344","tags":["report"]},{"url":"https://bugzilla.suse.com/1033336","tags":["report"]},{"url":"https://bugzilla.suse.com/914939","tags":["report"]},{"url":"https://bugzilla.suse.com/954763","tags":["report"]},{"url":"https://bugzilla.suse.com/968697","tags":["report"]},{"url":"https://bugzilla.suse.com/979215","tags":["report"]},{"url":"https://bugzilla.suse.com/983212","tags":["report"]},{"url":"https://bugzilla.suse.com/989056","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1350","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10044","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10200","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10208","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2117","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3070","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5243","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7117","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9588","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2671","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5669","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5897","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5970","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6074","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6214","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6346","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6348","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6353","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7187","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7261","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7294","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7308","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7616","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20171301-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1005651","tags":["report"]},{"url":"https://bugzilla.suse.com/1008374","tags":["report"]},{"url":"https://bugzilla.suse.com/1008893","tags":["report"]},{"url":"https://bugzilla.suse.com/1013018","tags":["report"]},{"url":"https://bugzilla.suse.com/1013070","tags":["report"]},{"url":"https://bugzilla.suse.com/1013800","tags":["report"]},{"url":"https://bugzilla.suse.com/1013862","tags":["report"]},{"url":"https://bugzilla.suse.com/1016489","tags":["report"]},{"url":"https://bugzilla.suse.com/1017143","tags":["report"]},{"url":"https://bugzilla.suse.com/1018263","tags":["report"]},{"url":"https://bugzilla.suse.com/1018446","tags":["report"]},{"url":"https://bugzilla.suse.com/1019168","tags":["report"]},{"url":"https://bugzilla.suse.com/1020229","tags":["report"]},{"url":"https://bugzilla.suse.com/1021913","tags":["report"]},{"url":"https://bugzilla.suse.com/1022971","tags":["report"]},{"url":"https://bugzilla.suse.com/1023014","tags":["report"]},{"url":"https://bugzilla.suse.com/1023163","tags":["report"]},{"url":"https://bugzilla.suse.com/1023888","tags":["report"]},{"url":"https://bugzilla.suse.com/1024508","tags":["report"]},{"url":"https://bugzilla.suse.com/1024788","tags":["report"]},{"url":"https://bugzilla.suse.com/1025702","tags":["report"]},{"url":"https://bugzilla.suse.com/1026260","tags":["report"]},{"url":"https://bugzilla.suse.com/1027101","tags":["report"]},{"url":"https://bugzilla.suse.com/1028880","tags":["report"]},{"url":"https://bugzilla.suse.com/1029212","tags":["report"]},{"url":"https://bugzilla.suse.com/1029770","tags":["report"]},{"url":"https://bugzilla.suse.com/1030573","tags":["report"]},{"url":"https://bugzilla.suse.com/1032141","tags":["report"]},{"url":"https://bugzilla.suse.com/1033771","tags":["report"]},{"url":"https://bugzilla.suse.com/1033794","tags":["report"]},{"url":"https://bugzilla.suse.com/1033804","tags":["report"]},{"url":"https://bugzilla.suse.com/1033816","tags":["report"]},{"url":"https://bugzilla.suse.com/1034026","tags":["report"]},{"url":"https://bugzilla.suse.com/909486","tags":["report"]},{"url":"https://bugzilla.suse.com/911105","tags":["report"]},{"url":"https://bugzilla.suse.com/931620","tags":["report"]},{"url":"https://bugzilla.suse.com/979021","tags":["report"]},{"url":"https://bugzilla.suse.com/982783","tags":["report"]},{"url":"https://bugzilla.suse.com/985561","tags":["report"]},{"url":"https://bugzilla.suse.com/988065","tags":["report"]},{"url":"https://bugzilla.suse.com/995542","tags":["report"]},{"url":"https://bugzilla.suse.com/999245","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3288","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8970","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7184","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20171360-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1008842","tags":["report"]},{"url":"https://bugzilla.suse.com/1009682","tags":["report"]},{"url":"https://bugzilla.suse.com/1012620","tags":["report"]},{"url":"https://bugzilla.suse.com/1012985","tags":["report"]},{"url":"https://bugzilla.suse.com/1015787","tags":["report"]},{"url":"https://bugzilla.suse.com/1015821","tags":["report"]},{"url":"https://bugzilla.suse.com/1017512","tags":["report"]},{"url":"https://bugzilla.suse.com/1018100","tags":["report"]},{"url":"https://bugzilla.suse.com/1018419","tags":["report"]},{"url":"https://bugzilla.suse.com/1019514","tags":["report"]},{"url":"https://bugzilla.suse.com/1020048","tags":["report"]},{"url":"https://bugzilla.suse.com/1020795","tags":["report"]},{"url":"https://bugzilla.suse.com/1021374","tags":["report"]},{"url":"https://bugzilla.suse.com/1022559","tags":["report"]},{"url":"https://bugzilla.suse.com/1023164","tags":["report"]},{"url":"https://bugzilla.suse.com/1023207","tags":["report"]},{"url":"https://bugzilla.suse.com/1023824","tags":["report"]},{"url":"https://bugzilla.suse.com/1024081","tags":["report"]},{"url":"https://bugzilla.suse.com/1024234","tags":["report"]},{"url":"https://bugzilla.suse.com/1024309","tags":["report"]},{"url":"https://bugzilla.suse.com/1025039","tags":["report"]},{"url":"https://bugzilla.suse.com/1025354","tags":["report"]},{"url":"https://bugzilla.suse.com/1025802","tags":["report"]},{"url":"https://bugzilla.suse.com/1027974","tags":["report"]},{"url":"https://bugzilla.suse.com/1028041","tags":["report"]},{"url":"https://bugzilla.suse.com/1028595","tags":["report"]},{"url":"https://bugzilla.suse.com/1028648","tags":["report"]},{"url":"https://bugzilla.suse.com/1029470","tags":["report"]},{"url":"https://bugzilla.suse.com/1029850","tags":["report"]},{"url":"https://bugzilla.suse.com/1030593","tags":["report"]},{"url":"https://bugzilla.suse.com/1031080","tags":["report"]},{"url":"https://bugzilla.suse.com/1031567","tags":["report"]},{"url":"https://bugzilla.suse.com/1031662","tags":["report"]},{"url":"https://bugzilla.suse.com/1031842","tags":["report"]},{"url":"https://bugzilla.suse.com/1032125","tags":["report"]},{"url":"https://bugzilla.suse.com/1032345","tags":["report"]},{"url":"https://bugzilla.suse.com/1034670","tags":["report"]},{"url":"https://bugzilla.suse.com/103470","tags":["report"]},{"url":"https://bugzilla.suse.com/1034700","tags":["report"]},{"url":"https://bugzilla.suse.com/1035576","tags":["report"]},{"url":"https://bugzilla.suse.com/1035699","tags":["report"]},{"url":"https://bugzilla.suse.com/1035738","tags":["report"]},{"url":"https://bugzilla.suse.com/1035877","tags":["report"]},{"url":"https://bugzilla.suse.com/1036752","tags":["report"]},{"url":"https://bugzilla.suse.com/1038261","tags":["report"]},{"url":"https://bugzilla.suse.com/799133","tags":["report"]},{"url":"https://bugzilla.suse.com/857926","tags":["report"]},{"url":"https://bugzilla.suse.com/917630","tags":["report"]},{"url":"https://bugzilla.suse.com/922853","tags":["report"]},{"url":"https://bugzilla.suse.com/930399","tags":["report"]},{"url":"https://bugzilla.suse.com/937444","tags":["report"]},{"url":"https://bugzilla.suse.com/940946","tags":["report"]},{"url":"https://bugzilla.suse.com/970083","tags":["report"]},{"url":"https://bugzilla.suse.com/971933","tags":["report"]},{"url":"https://bugzilla.suse.com/984530","tags":["report"]},{"url":"https://bugzilla.suse.com/993832","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9191","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9604","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2647","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6951","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7645","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8106","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20172342-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1008850","tags":["report"]},{"url":"https://bugzilla.suse.com/1012422","tags":["report"]},{"url":"https://bugzilla.suse.com/1018074","tags":["report"]},{"url":"https://bugzilla.suse.com/1023051","tags":["report"]},{"url":"https://bugzilla.suse.com/1027565","tags":["report"]},{"url":"https://bugzilla.suse.com/1028372","tags":["report"]},{"url":"https://bugzilla.suse.com/1029140","tags":["report"]},{"url":"https://bugzilla.suse.com/1030552","tags":["report"]},{"url":"https://bugzilla.suse.com/1030814","tags":["report"]},{"url":"https://bugzilla.suse.com/1032340","tags":["report"]},{"url":"https://bugzilla.suse.com/1032471","tags":["report"]},{"url":"https://bugzilla.suse.com/1033287","tags":["report"]},{"url":"https://bugzilla.suse.com/1035777","tags":["report"]},{"url":"https://bugzilla.suse.com/1035920","tags":["report"]},{"url":"https://bugzilla.suse.com/1036056","tags":["report"]},{"url":"https://bugzilla.suse.com/1036288","tags":["report"]},{"url":"https://bugzilla.suse.com/1036629","tags":["report"]},{"url":"https://bugzilla.suse.com/1037182","tags":["report"]},{"url":"https://bugzilla.suse.com/1037183","tags":["report"]},{"url":"https://bugzilla.suse.com/1037191","tags":["report"]},{"url":"https://bugzilla.suse.com/1037193","tags":["report"]},{"url":"https://bugzilla.suse.com/1037227","tags":["report"]},{"url":"https://bugzilla.suse.com/1037232","tags":["report"]},{"url":"https://bugzilla.suse.com/1037233","tags":["report"]},{"url":"https://bugzilla.suse.com/1037356","tags":["report"]},{"url":"https://bugzilla.suse.com/1037358","tags":["report"]},{"url":"https://bugzilla.suse.com/1037359","tags":["report"]},{"url":"https://bugzilla.suse.com/1037441","tags":["report"]},{"url":"https://bugzilla.suse.com/1038544","tags":["report"]},{"url":"https://bugzilla.suse.com/1038879","tags":["report"]},{"url":"https://bugzilla.suse.com/1038981","tags":["report"]},{"url":"https://bugzilla.suse.com/1038982","tags":["report"]},{"url":"https://bugzilla.suse.com/1039258","tags":["report"]},{"url":"https://bugzilla.suse.com/1039348","tags":["report"]},{"url":"https://bugzilla.suse.com/1039354","tags":["report"]},{"url":"https://bugzilla.suse.com/1039456","tags":["report"]},{"url":"https://bugzilla.suse.com/1039594","tags":["report"]},{"url":"https://bugzilla.suse.com/1039882","tags":["report"]},{"url":"https://bugzilla.suse.com/1039883","tags":["report"]},{"url":"https://bugzilla.suse.com/1039885","tags":["report"]},{"url":"https://bugzilla.suse.com/1040069","tags":["report"]},{"url":"https://bugzilla.suse.com/1040351","tags":["report"]},{"url":"https://bugzilla.suse.com/1041160","tags":["report"]},{"url":"https://bugzilla.suse.com/1041431","tags":["report"]},{"url":"https://bugzilla.suse.com/1041762","tags":["report"]},{"url":"https://bugzilla.suse.com/1041975","tags":["report"]},{"url":"https://bugzilla.suse.com/1042045","tags":["report"]},{"url":"https://bugzilla.suse.com/1042200","tags":["report"]},{"url":"https://bugzilla.suse.com/1042615","tags":["report"]},{"url":"https://bugzilla.suse.com/1042633","tags":["report"]},{"url":"https://bugzilla.suse.com/1042687","tags":["report"]},{"url":"https://bugzilla.suse.com/1042832","tags":["report"]},{"url":"https://bugzilla.suse.com/1043014","tags":["report"]},{"url":"https://bugzilla.suse.com/1043234","tags":["report"]},{"url":"https://bugzilla.suse.com/1043935","tags":["report"]},{"url":"https://bugzilla.suse.com/1044015","tags":["report"]},{"url":"https://bugzilla.suse.com/1044125","tags":["report"]},{"url":"https://bugzilla.suse.com/1044216","tags":["report"]},{"url":"https://bugzilla.suse.com/1044230","tags":["report"]},{"url":"https://bugzilla.suse.com/1044854","tags":["report"]},{"url":"https://bugzilla.suse.com/1044882","tags":["report"]},{"url":"https://bugzilla.suse.com/1044913","tags":["report"]},{"url":"https://bugzilla.suse.com/1044985","tags":["report"]},{"url":"https://bugzilla.suse.com/1045154","tags":["report"]},{"url":"https://bugzilla.suse.com/1045340","tags":["report"]},{"url":"https://bugzilla.suse.com/1045356","tags":["report"]},{"url":"https://bugzilla.suse.com/1045406","tags":["report"]},{"url":"https://bugzilla.suse.com/1045416","tags":["report"]},{"url":"https://bugzilla.suse.com/1045525","tags":["report"]},{"url":"https://bugzilla.suse.com/1045538","tags":["report"]},{"url":"https://bugzilla.suse.com/1045547","tags":["report"]},{"url":"https://bugzilla.suse.com/1045615","tags":["report"]},{"url":"https://bugzilla.suse.com/1046107","tags":["report"]},{"url":"https://bugzilla.suse.com/1046122","tags":["report"]},{"url":"https://bugzilla.suse.com/1046192","tags":["report"]},{"url":"https://bugzilla.suse.com/1046715","tags":["report"]},{"url":"https://bugzilla.suse.com/1047027","tags":["report"]},{"url":"https://bugzilla.suse.com/1047053","tags":["report"]},{"url":"https://bugzilla.suse.com/1047343","tags":["report"]},{"url":"https://bugzilla.suse.com/1047354","tags":["report"]},{"url":"https://bugzilla.suse.com/1047487","tags":["report"]},{"url":"https://bugzilla.suse.com/1047523","tags":["report"]},{"url":"https://bugzilla.suse.com/1047653","tags":["report"]},{"url":"https://bugzilla.suse.com/1048185","tags":["report"]},{"url":"https://bugzilla.suse.com/1048221","tags":["report"]},{"url":"https://bugzilla.suse.com/1048232","tags":["report"]},{"url":"https://bugzilla.suse.com/1048275","tags":["report"]},{"url":"https://bugzilla.suse.com/1049483","tags":["report"]},{"url":"https://bugzilla.suse.com/1049603","tags":["report"]},{"url":"https://bugzilla.suse.com/1049688","tags":["report"]},{"url":"https://bugzilla.suse.com/1049882","tags":["report"]},{"url":"https://bugzilla.suse.com/1050154","tags":["report"]},{"url":"https://bugzilla.suse.com/1050431","tags":["report"]},{"url":"https://bugzilla.suse.com/1051478","tags":["report"]},{"url":"https://bugzilla.suse.com/1051515","tags":["report"]},{"url":"https://bugzilla.suse.com/1051770","tags":["report"]},{"url":"https://bugzilla.suse.com/784815","tags":["report"]},{"url":"https://bugzilla.suse.com/792863","tags":["report"]},{"url":"https://bugzilla.suse.com/870618","tags":["report"]},{"url":"https://bugzilla.suse.com/909618","tags":["report"]},{"url":"https://bugzilla.suse.com/919382","tags":["report"]},{"url":"https://bugzilla.suse.com/928138","tags":["report"]},{"url":"https://bugzilla.suse.com/938352","tags":["report"]},{"url":"https://bugzilla.suse.com/943786","tags":["report"]},{"url":"https://bugzilla.suse.com/948562","tags":["report"]},{"url":"https://bugzilla.suse.com/962257","tags":["report"]},{"url":"https://bugzilla.suse.com/970956","tags":["report"]},{"url":"https://bugzilla.suse.com/971975","tags":["report"]},{"url":"https://bugzilla.suse.com/972891","tags":["report"]},{"url":"https://bugzilla.suse.com/986362","tags":["report"]},{"url":"https://bugzilla.suse.com/986365","tags":["report"]},{"url":"https://bugzilla.suse.com/986924","tags":["report"]},{"url":"https://bugzilla.suse.com/990682","tags":["report"]},{"url":"https://bugzilla.suse.com/991651","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2188","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4997","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000363","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000364","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000365","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11176","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11473","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2636","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7482","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7487","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7533","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7542","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8890","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8924","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8925","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9074","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9075","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9076","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9077","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9242","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20172525-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1006919","tags":["report"]},{"url":"https://bugzilla.suse.com/1025013","tags":["report"]},{"url":"https://bugzilla.suse.com/1027179","tags":["report"]},{"url":"https://bugzilla.suse.com/1027406","tags":["report"]},{"url":"https://bugzilla.suse.com/1030575","tags":["report"]},{"url":"https://bugzilla.suse.com/1031481","tags":["report"]},{"url":"https://bugzilla.suse.com/1031660","tags":["report"]},{"url":"https://bugzilla.suse.com/1034838","tags":["report"]},{"url":"https://bugzilla.suse.com/1037994","tags":["report"]},{"url":"https://bugzilla.suse.com/1038564","tags":["report"]},{"url":"https://bugzilla.suse.com/1038883","tags":["report"]},{"url":"https://bugzilla.suse.com/1039349","tags":["report"]},{"url":"https://bugzilla.suse.com/1042364","tags":["report"]},{"url":"https://bugzilla.suse.com/1042863","tags":["report"]},{"url":"https://bugzilla.suse.com/1042892","tags":["report"]},{"url":"https://bugzilla.suse.com/1045487","tags":["report"]},{"url":"https://bugzilla.suse.com/1050677","tags":["report"]},{"url":"https://bugzilla.suse.com/1052311","tags":["report"]},{"url":"https://bugzilla.suse.com/1053148","tags":["report"]},{"url":"https://bugzilla.suse.com/1053152","tags":["report"]},{"url":"https://bugzilla.suse.com/1053760","tags":["report"]},{"url":"https://bugzilla.suse.com/1056588","tags":["report"]},{"url":"https://bugzilla.suse.com/957988","tags":["report"]},{"url":"https://bugzilla.suse.com/957990","tags":["report"]},{"url":"https://bugzilla.suse.com/963655","tags":["report"]},{"url":"https://bugzilla.suse.com/979681","tags":["report"]},{"url":"https://bugzilla.suse.com/989896","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000112","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10661","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12762","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14051","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8831","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-5669","tags":["report"]},{"url":"https://git.kernel.org/cgit/linux/kernel/git/next/linux-next.git/commit/?id=e1d35d4dc7f089e6c9c080d556feedf9c706f0c7","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3265-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3265-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3361-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3583-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3583-2","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-5669","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-5897","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-5970","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-5986","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-6214","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-6345","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-6346","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-6347","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-6348","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7374","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-1350","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-8405","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-8636","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-9083","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-9084","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-9191","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-9604","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-9755","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-10208","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-2583","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-2584","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-2596","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-2618","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-2671","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-5546","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-5549","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-5550","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-5551","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-5576","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-6001","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7187","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7261","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7273","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7472","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7616","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7618","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7645","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7889","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7895","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-8924","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-8925","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9150","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-0750","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-0861","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-5754","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7542","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-8824","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-12153","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-12190","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-12192","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-14051","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-14140","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-14156","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-14489","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-15102","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-15115","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-15274","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-15868","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-16525","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-17450","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-17806","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-18017","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-1000407","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-5333","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-5344","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-5669","description":"The do_shmat function in ipc/shm.c in the Linux kernel through 4.9.12 does not restrict the address calculated by a certain rounding operation, which allows local users to map page zero, and consequently bypass a protection mechanism that exists for the mmap system call, by making crafted shmget and shmat system calls in a privileged context.","status":"published","published":"2017-02-24T15:00:00Z","modified":"2024-08-05T15:11:47.757Z","updated_at":"2026-11-02T14:33:12.942409Z"}],"euvd":[{"id":"EUVD-2017-14746","description":"The do_shmat function in ipc/shm.c in the Linux kernel through 4.9.12 does not restrict the address calculated by a certain rounding operation, which allows local users to map page zero, and consequently bypass a protection mechanism that exists for the mmap system call, by making crafted shmget and shmat system calls in a privileged context.","status":"published","published":"2017-02-24T15:00:00Z","modified":"2024-08-05T15:11:47Z","updated_at":"2026-11-03T02:39:14.545495Z"}],"ghsa":[{"id":"GHSA-xjq6-89c2-fjjf","title":"The do_shmat function in ipc/shm.c in the Linux kernel through 4.9.12 does not restrict the...","description":"The do_shmat function in ipc/shm.c in the Linux kernel through 4.9.12 does not restrict the address calculated by a certain rounding operation, which allows local users to map page zero, and consequently bypass a protection mechanism that exists for the mmap system call, by making crafted shmget and shmat system calls in a privileged context.","status":"published","published":"2022-05-13T01:14:47Z","modified":"2025-04-20T03:34:27Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:01:41.934315Z"}],"nvd":[{"id":"CVE-2017-5669","description":"The do_shmat function in ipc/shm.c in the Linux kernel through 4.9.12 does not restrict the address calculated by a certain rounding operation, which allows local users to map page zero, and consequently bypass a protection mechanism that exists for the mmap system call, by making crafted shmget and shmat system calls in a privileged context.","status":"published","published":"2017-02-24T15:59:00.15Z","modified":"2026-06-17T01:21:00.543Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:03:43.325192Z"}],"osv":[{"id":"CVE-2017-5669","description":"The do_shmat function in ipc/shm.c in the Linux kernel through 4.9.12 does not restrict the address calculated by a certain rounding operation, which allows local users to map page zero, and consequently bypass a protection mechanism that exists for the mmap system call, by making crafted shmget and shmat system calls in a privileged context.","status":"published","published":"2017-02-24T15:59:00.15Z","modified":"2026-03-15T14:25:18.840649Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:06.029968Z"},{"id":"DEBIAN-CVE-2017-5669","description":"The do_shmat function in ipc/shm.c in the Linux kernel through 4.9.12 does not restrict the address calculated by a certain rounding operation, which allows local users to map page zero, and consequently bypass a protection mechanism that exists for the mmap system call, by making crafted shmget and shmat system calls in a privileged context.","status":"published","published":"2017-02-24T15:59:00.15Z","modified":"2026-09-01T20:03:48.604216682Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:29.412243Z"},{"id":"UBUNTU-CVE-2017-5669","description":"The do_shmat function in ipc/shm.c in the Linux kernel through 4.9.12 does not restrict the address calculated by a certain rounding operation, which allows local users to map page zero, and consequently bypass a protection mechanism that exists for the mmap system call, by making crafted shmget and shmat system calls in a privileged context.","status":"published","published":"2017-02-24T00:00:00Z","modified":"2026-10-28T08:17:39.736908546Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:15.388065Z"},{"id":"DLA-849-1","title":"linux - security update","status":"published","published":"2017-03-08T00:00:00Z","modified":"2026-03-09T02:11:37.251216Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"DSA-3804-1","title":"linux - security update","status":"published","published":"2017-03-08T00:00:00Z","modified":"2026-03-09T01:18:36.514162Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"SUSE-SU-2017:1247-1","title":"Security update for the Linux Kernel","description":"\n\nThe SUSE Linux Enterprise 12 GA LTSS kernel was updated to receive various security and bugfixes.\n\nThe following security bugs were fixed:\n\n- CVE-2015-1350: The VFS subsystem in the Linux kernel provided an incomplete set of requirements for setattr operations that underspecifies removing extended privilege attributes, which allowed local users to cause a denial of service (capability stripping) via a failed invocation of a system call, as demonstrated by using chown to remove a capability from the ping or Wireshark dumpcap program (bnc#914939).\n- CVE-2016-2117: The atl2_probe function in drivers/net/ethernet/atheros/atlx/atl2.c in the Linux kernel incorrectly enabled scatter/gather I/O, which allowed remote attackers to obtain sensitive information from kernel memory by reading packet data (bnc#968697).\n- CVE-2016-3070: The trace_writeback_dirty_page implementation in include/trace/events/writeback.h in the Linux kernel improperly interacted with mm/migrate.c, which allowed local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by triggering a certain page move (bnc#979215).\n- CVE-2016-5243: The tipc_nl_compat_link_dump function in net/tipc/netlink_compat.c in the Linux kernel did not properly copy a certain string, which allowed local users to obtain sensitive information from kernel stack memory by reading a Netlink message (bnc#983212).\n- CVE-2016-7117: Use-after-free vulnerability in the __sys_recvmmsg function in net/socket.c in the Linux kernel allowed remote attackers to execute arbitrary code via vectors involving a recvmmsg system call that is mishandled during error processing (bnc#1003077).\n- CVE-2016-9588: arch/x86/kvm/vmx.c in the Linux kernel mismanages the #BP and #OF exceptions, which allowed guest OS users to cause a denial of service (guest OS crash) by declining to handle an exception thrown by an L2 guest (bnc#1015703).\n- CVE-2016-10044: The aio_mount function in fs/aio.c in the Linux kernel did not properly restrict execute access, which made it easier for local users to bypass intended SELinux W^X policy restrictions, and consequently gain privileges, via an io_setup system call (bnc#1023992).\n- CVE-2016-10200: Race condition in the L2TPv3 IP Encapsulation feature in the Linux kernel allowed local users to gain privileges or cause a denial of service (use-after-free) by making multiple bind system calls without properly ascertaining whether a socket has the SOCK_ZAPPED status, related to net/l2tp/l2tp_ip.c and net/l2tp/l2tp_ip6.c (bnc#1028415).\n- CVE-2016-10208: The ext4_fill_super function in fs/ext4/super.c in the Linux kernel did not properly validate meta block groups, which allowed physically proximate attackers to cause a denial of service (out-of-bounds read and system crash) via a crafted ext4 image (bnc#1023377).\n- CVE-2017-2671: The ping_unhash function in net/ipv4/ping.c in the Linux kernel is too late in obtaining a certain lock and consequently cannot ensure that disconnect function calls are safe, which allowed local users to cause a denial of service (panic) by leveraging access to the protocol value of IPPROTO_ICMP in a socket system call (bnc#1031003).\n- CVE-2017-5669: The do_shmat function in ipc/shm.c in the Linux kernel did not restrict the address calculated by a certain rounding operation, which allowed local users to map page zero, and consequently bypass a protection mechanism that exists for the mmap system call, by making crafted shmget and shmat system calls in a privileged context (bnc#1026914).\n- CVE-2017-5897: The ip6gre_err function in net/ipv6/ip6_gre.c in the Linux kernel allowed remote attackers to have unspecified impact via vectors involving GRE flags in an IPv6 packet, which trigger an out-of-bounds access (bnc#1023762).\n- CVE-2017-5970: The ipv4_pktinfo_prepare function in net/ipv4/ip_sockglue.c in the Linux kernel allowed attackers to cause a denial of service (system crash) via (1) an application that made crafted system calls or possibly (2) IPv4 traffic with invalid IP options (bnc#1024938).\n- CVE-2017-5986: Race condition in the sctp_wait_for_sndbuf function in net/sctp/socket.c in the Linux kernel allowed local users to cause a denial of service (assertion failure and panic) via a multithreaded application that peels off an association in a certain buffer-full state (bnc#1025235).\n- CVE-2017-6074: The dccp_rcv_state_process function in net/dccp/input.c in the Linux kernel mishandled DCCP_PKT_REQUEST packet data structures in the LISTEN state, which allowed local users to obtain root privileges or cause a denial of service (double free) via an application that made an IPV6_RECVPKTINFO setsockopt system call (bnc#1026024).\n- CVE-2017-6214: The tcp_splice_read function in net/ipv4/tcp.c in the Linux kernel allowed remote attackers to cause a denial of service (infinite loop and soft lockup) via vectors involving a TCP packet with the URG flag (bnc#1026722).\n- CVE-2017-6345: The LLC subsystem in the Linux kernel did not ensure that a certain destructor exists in required circumstances, which allowed local users to cause a denial of service (BUG_ON) or possibly have unspecified other impact via crafted system calls (bnc#1027190).\n- CVE-2017-6346: Race condition in net/packet/af_packet.c in the Linux kernel allowed local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via a multithreaded application that made PACKET_FANOUT setsockopt system calls (bnc#1027189).\n- CVE-2017-6348: The hashbin_delete function in net/irda/irqueue.c in the Linux kernel improperly managed lock dropping, which allowed local users to cause a denial of service (deadlock) via crafted operations on IrDA devices (bnc#1027178).\n- CVE-2017-6353: net/sctp/socket.c in the Linux kernel did not properly restrict association peel-off operations during certain wait states, which allowed local users to cause a denial of service (invalid unlock and double free) via a multithreaded application.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2017-5986 (bnc#1027066).\n- CVE-2017-7187: The sg_ioctl function in drivers/scsi/sg.c in the Linux kernel allowed local users to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a large command size in an SG_NEXT_CMD_LEN ioctl call, leading to out-of-bounds write access in the sg_write function (bnc#1030213).\n- CVE-2017-7261: The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not check for a zero value of certain levels data, which allowed local users to cause a denial of service (ZERO_SIZE_PTR dereference, and GPF and possibly panic) via a crafted ioctl call for a /dev/dri/renderD* device (bnc#1031052).\n- CVE-2017-7294: The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not validate addition of certain levels data, which allowed local users to trigger an integer overflow and out-of-bounds write, and cause a denial of service (system hang or crash) or possibly gain privileges, via a crafted ioctl call for a /dev/dri/renderD* device (bnc#1031440).\n- CVE-2017-7308: The packet_set_ring function in net/packet/af_packet.c in the Linux kernel did not properly validate certain block-size data, which allowed local users to cause a denial of service (overflow) or possibly have unspecified other impact via crafted system calls (bnc#1031579).\n- CVE-2017-7616: Incorrect error handling in the set_mempolicy and mbind compat syscalls in mm/mempolicy.c in the Linux kernel allowed local users to obtain sensitive information from uninitialized stack data by triggering failure of a certain bitmap operation (bnc#1033336).\n\nThe following non-security bugs were fixed:\n\n- ext4: fix fencepost in s_first_meta_bg validation (bsc#1029986).\n- hwrng: virtio - ensure reads happen after successful probe (bsc#954763 bsc#1032344).\n- kgr/module: make a taint flag module-specific (fate#313296).\n- l2tp: fix address test in __l2tp_ip6_bind_lookup() (bsc#1028415).\n- l2tp: fix lookup for sockets not bound to a device in l2tp_ip (bsc#1028415).\n- l2tp: fix racy socket lookup in l2tp_ip and l2tp_ip6 bind() (bsc#1028415).\n- l2tp: hold socket before dropping lock in l2tp_ip{, 6}_recv() (bsc#1028415).\n- l2tp: hold tunnel socket when handling control frames in l2tp_ip and l2tp_ip6 (bsc#1028415).\n- l2tp: lock socket before checking flags in connect() (bsc#1028415).\n- mm/huge_memory.c: respect FOLL_FORCE/FOLL_COW for thp (bnc#1030118).\n- module: move add_taint_module() to a header file (fate#313296).\n- netfilter: bridge: Fix the build when IPV6 is disabled (bsc#1027149).\n- nfs: flush out dirty data on file fput() (bsc#1021762).\n- powerpc: Blacklist GCC 5.4 6.1 and 6.2 (boo#1028895).\n- powerpc: Reject binutils 2.24 when building little endian (boo#1028895).\n- revert 'procfs: mark thread stack correctly in proc/\u003cpid\u003e/maps' (bnc#1030901).\n- taint/module: Clean up global and module taint flags handling (fate#313296).\n- usb: serial: kl5kusb105: fix line-state error handling (bsc#1021256).\n- xfs_dmapi: fix the debug compilation of xfs_dmapi (bsc#989056).\n- xfs: fix buffer overflow dm_get_dirattrs/dm_get_dirattrs2 (bsc#989056).\n","status":"published","published":"2017-05-11T14:24:14Z","modified":"2026-02-04T04:27:50.154633Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"SUSE-SU-2017:1301-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes.\n\nNotable new features:\n\n- Toleration of newer crypto hardware for z Systems\n- USB 2.0 Link power management for Haswell-ULT\n\nThe following security bugs were fixed:\n\n- CVE-2017-7308: The packet_set_ring function in net/packet/af_packet.c in the Linux kernel did not properly validate certain block-size data, which allowed local users to cause a denial of service (overflow) or possibly have unspecified other impact via crafted system calls (bnc#1031579)\n- CVE-2017-2671: The ping_unhash function in net/ipv4/ping.c in the Linux kernel was  too late in obtaining a certain lock and consequently could not ensure that disconnect function calls are safe, which allowed local users to cause a denial of service (panic) by leveraging access to the protocol value of IPPROTO_ICMP in a socket system call (bnc#1031003)\n- CVE-2017-7184: The xfrm_replay_verify_len function in net/xfrm/xfrm_user.c in the Linux kernel did not validate certain size data after an XFRM_MSG_NEWAE update, which allowed local users to obtain root privileges or cause a denial of service (heap-based out-of-bounds access) by leveraging the CAP_NET_ADMIN capability (bsc#1030573).\n- CVE-2017-5970: The ipv4_pktinfo_prepare function in net/ipv4/ip_sockglue.c in the Linux kernel allowed attackers to cause a denial of service (system crash) via (1) an application that made crafted system calls or possibly (2) IPv4 traffic with invalid IP options (bsc#1024938).\n- CVE-2017-7616: Incorrect error handling in the set_mempolicy and mbind compat syscalls in mm/mempolicy.c in the Linux kernel allowed local users to obtain sensitive information from uninitialized stack data by triggering failure of a certain bitmap operation (bsc#1033336).\n- CVE-2017-7294: The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not validate addition of certain levels data, which allowed local users to trigger an integer overflow and out-of-bounds write, and cause a denial of service (system hang or crash) or possibly gain privileges, via a crafted ioctl call for a /dev/dri/renderD* device (bnc#1031440)\n- CVE-2017-7261: The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not check for a zero value of certain levels data, which allowed local users to cause a denial of service (ZERO_SIZE_PTR dereference, and GPF and possibly panic) via a crafted ioctl call for a /dev/dri/renderD* device (bnc#1031052)\n- CVE-2017-7187: The sg_ioctl function in drivers/scsi/sg.c in the Linux kernel allowed local users to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a large command size in an SG_NEXT_CMD_LEN ioctl call, leading to out-of-bounds write access in the sg_write function (bnc#1030213)\n- CVE-2017-6348: The hashbin_delete function in net/irda/irqueue.c in the Linux kernel improperly managed lock dropping, which allowed local users to cause a denial of service (deadlock) via crafted operations on IrDA devices (bnc#1027178)\n- CVE-2017-5669: The do_shmat function in ipc/shm.c in the Linux kernel did not restrict the address calculated by a certain rounding operation, which allowed local users to map page zero, and consequently bypass a protection mechanism that exists for the mmap system call, by making crafted shmget and shmat system calls in a privileged context (bnc#1026914)\n- CVE-2015-3288: mm/memory.c in the Linux kernel mishandled anonymous pages, which allowed local users to gain privileges or cause a denial of service (page tainting) via a crafted application that triggers writing to page zero (bsc#979021).\n- CVE-2016-10200: Race condition in the L2TPv3 IP Encapsulation feature in the Linux kernel allowed local users to gain privileges or cause a denial of service (use-after-free) by making multiple bind system calls without properly ascertaining whether a socket has the SOCK_ZAPPED status, related to net/l2tp/l2tp_ip.c and net/l2tp/l2tp_ip6.c (bnc#1028415)\n- CVE-2016-5243: The tipc_nl_compat_link_dump function in net/tipc/netlink_compat.c in the Linux kernel did not properly copy a certain string, which allowed local users to obtain sensitive information from kernel stack memory by reading a Netlink message (bnc#983212)\n- CVE-2017-6353: net/sctp/socket.c in the Linux kernel did not properly restrict association peel-off operations during certain wait states, which allowed local users to cause a denial of service (invalid unlock and double free) via a multithreaded application (bnc#1027066)\n- CVE-2017-6214: The tcp_splice_read function in net/ipv4/tcp.c in the Linux kernel allowed remote attackers to cause a denial of service (infinite loop and soft lockup) via vectors involving a TCP packet with the URG flag (bnc#1026722)\n- CVE-2017-6074: The dccp_rcv_state_process function in net/dccp/input.c in the Linux kernel mishandled DCCP_PKT_REQUEST packet data structures in the LISTEN state, which allowed local users to obtain root privileges or cause a denial of service (double free) via an application that made an IPV6_RECVPKTINFO setsockopt system call (bnc#1026024)\n- CVE-2017-5986: Race condition in the sctp_wait_for_sndbuf function in net/sctp/socket.c in the Linux kernel allowed local users to cause a denial of service (assertion failure and panic) via a multithreaded application that peels off an association in a certain buffer-full state (bsc#1025235)\n- CVE-2015-8970: crypto/algif_skcipher.c in the Linux kernel did not verify that a setkey operation has been performed on an AF_ALG socket an accept system call is processed, which allowed local users to cause a denial of service (NULL pointer dereference and system crash) via a crafted application that does not supply a key, related to the lrw_crypt function in crypto/lrw.c (bsc#1008374).\n\nThe following non-security bugs were fixed:\n\n- NFSD: do not risk using duplicate owner/file/delegation ids (bsc#1029212).\n- RAID1: avoid unnecessary spin locks in I/O barrier code (bsc#982783, bsc#1026260).\n- SUNRPC: Clean up the slot table allocation (bsc#1013862).\n- SUNRPC: Initalise the struct xprt upon allocation (bsc#1013862).\n- USB: cdc-acm: fix broken runtime suspend (bsc#1033771).\n- USB: cdc-acm: fix open and suspend race (bsc#1033771).\n- USB: cdc-acm: fix potential urb leak and PM imbalance in write (bsc#1033771).\n- USB: cdc-acm: fix runtime PM for control messages (bsc#1033771).\n- USB: cdc-acm: fix runtime PM imbalance at shutdown (bsc#1033771).\n- USB: cdc-acm: fix shutdown and suspend race (bsc#1033771).\n- USB: cdc-acm: fix write and resume race (bsc#1033771).\n- USB: cdc-acm: fix write and suspend race (bsc#1033771).\n- USB: hub: Fix crash after failure to read BOS descriptor\n- USB: serial: iuu_phoenix: fix NULL-deref at open (bsc#1033794).\n- USB: serial: kl5kusb105: fix line-state error handling (bsc#1021256).\n- USB: serial: mos7720: fix NULL-deref at open (bsc#1033816).\n- USB: serial: mos7720: fix parallel probe (bsc#1033816).\n- USB: serial: mos7720: fix parport use-after-free on probe errors (bsc#1033816).\n- USB: serial: mos7720: fix use-after-free on probe errors (bsc#1033816).\n- USB: serial: mos7840: fix NULL-deref at open (bsc#1034026).\n- USB: xhci-mem: use passed in GFP flags instead of GFP_KERNEL (bsc#1023014).\n- Update metadata for serial fixes (bsc#1013070)\n- Use PF_LESS_THROTTLE in loop device thread (bsc#1027101).\n- clocksource: Remove 'weak' from clocksource_default_clock() declaration (bnc#1013018).\n- dlm: backport 'fix lvb invalidation conditions' (bsc#1005651).\n- drm/mgag200: Add support for G200e rev 4 (bnc#995542, comment #81)\n- enic: set skb-\u003ehash type properly (bsc#911105).\n- ext4: fix mballoc breakage with 64k block size (bsc#1013018).\n- ext4: fix stack memory corruption with 64k block size (bsc#1013018).\n- ext4: reject inodes with negative size (bsc#1013018).\n- fuse: initialize fc-\u003erelease before calling it (bsc#1013018).\n- i40e/i40evf: Break up xmit_descriptor_count from maybe_stop_tx (bsc#985561).\n- i40e/i40evf: Fix mixed size frags and linearization (bsc#985561).\n- i40e/i40evf: Limit TSO to 7 descriptors for payload instead of 8 per packet (bsc#985561).\n- i40e/i40evf: Rewrite logic for 8 descriptor per packet check (bsc#985561).\n- i40e: Fix TSO with more than 8 frags per segment issue (bsc#985561).\n- i40e: Impose a lower limit on gso size (bsc#985561).\n- i40e: Limit TX descriptor count in cases where frag size is greater than 16K (bsc#985561).\n- i40e: avoid null pointer dereference (bsc#909486).\n- jbd: Fix oops in journal_remove_journal_head() (bsc#1017143).\n- jbd: do not wait (forever) for stale tid caused by wraparound (bsc#1020229).\n- kABI: mask struct xfs_icdinode change (bsc#1024788).\n- kabi: Protect xfs_mount and xfs_buftarg (bsc#1024508).\n- kabi: fix (bsc#1008893).\n- lockd: use init_utsname for id encoding (bsc#1033804).\n- lockd: use rpc client's cl_nodename for id encoding (bsc#1033804).\n- md linear: fix a race between linear_add() and linear_congested() (bsc#1018446).\n- md/linear: shutup lockdep warnning (bsc#1018446).\n- mm/mempolicy.c: do not put mempolicy before using its nodemask (bnc#931620).\n- ocfs2: do not write error flag to user structure we cannot copy from/to (bsc#1013018).\n- ocfs2: fix crash caused by stale lvb with fsdlm plugin (bsc#1013800).\n- ocfs2: fix error return code in ocfs2_info_handle_freefrag() (bsc#1013018).\n- ocfs2: null deref on allocation error (bsc#1013018).\n- pciback: only check PF if actually dealing with a VF (bsc#999245).\n- pciback: use pci_physfn() (bsc#999245).\n- posix-timers: Fix stack info leak in timer_create() (bnc#1013018).\n- powerpc,cpuidle: Dont toggle CPUIDLE_FLAG_IGNORE while setting smt_snooze_delay (bsc#1023163).\n- powerpc/fadump: Fix the race in crash_fadump() (bsc#1022971).\n- powerpc/fadump: Reserve memory at an offset closer to bottom of RAM (bsc#1032141).\n- powerpc/fadump: Update fadump documentation (bsc#1032141).\n- powerpc/nvram: Fix an incorrect partition merge (bsc#1016489).\n- powerpc/vdso64: Use double word compare on pointers (bsc#1016489).\n- rcu: Call out dangers of expedited RCU primitives (bsc#1008893).\n- rcu: Direct algorithmic SRCU implementation (bsc#1008893).\n- rcu: Flip -\u003ecompleted only once per SRCU grace period (bsc#1008893).\n- rcu: Implement a variant of Peter's SRCU algorithm (bsc#1008893).\n- rcu: Increment upper bit only for srcu_read_lock() (bsc#1008893).\n- rcu: Remove fast check path from __synchronize_srcu() (bsc#1008893).\n- s390/kmsg: add missing kmsg descriptions (bnc#1025702).\n- s390/vmlogrdr: fix IUCV buffer allocation (bnc#1025702).\n- s390/zcrypt: Introduce CEX6 toleration\n- sched/core: Fix TASK_DEAD race in finish_task_switch() (bnc#1013018).\n- sched/loadavg: Fix loadavg artifacts on fully idle and on fully loaded systems (bnc#1013018).\n- scsi: zfcp: do not trace pure benign residual HBA responses at default level (bnc#1025702).\n- scsi: zfcp: fix rport unblock race with LUN recovery (bnc#1025702).\n- scsi: zfcp: fix use-after-'free' in FC ingress path after TMF (bnc#1025702).\n- scsi: zfcp: fix use-after-free by not tracing WKA port open/close on failed send (bnc#1025702).\n- sfc: reduce severity of PIO buffer alloc failures (bsc#1019168).\n- tcp: abort orphan sockets stalling on zero window probes (bsc#1021913).\n- vfs: split generic splice code from i_mutex locking (bsc#1024788).\n- virtio_scsi: fix memory leak on full queue condition (bsc#1028880).\n- vmxnet3: segCnt can be 1 for LRO packets (bsc#988065, bsc#1029770).\n- xen-blkfront: correct maximum segment accounting (bsc#1018263).\n- xen-blkfront: do not call talk_to_blkback when already connected to blkback.\n- xen-blkfront: free resources if xlvbd_alloc_gendisk fails.\n- xfs: Fix lock ordering in splice write (bsc#1024788).\n- xfs: Make xfs_icdinode-\u003edi_dmstate atomic_t (bsc#1024788).\n- xfs: do not assert fail on non-async buffers on ioacct decrement (bsc#1024508).\n- xfs: exclude never-released buffers from buftarg I/O accounting (bsc#1024508).\n- xfs: fix buffer overflow dm_get_dirattrs/dm_get_dirattrs2 (bsc#989056).\n- xfs: fix up xfs_swap_extent_forks inline extent handling (bsc#1023888).\n- xfs: kill xfs_itruncate_start (bsc#1024788).\n- xfs: remove the i_new_size field in struct xfs_inode (bsc#1024788).\n- xfs: remove the i_size field in struct xfs_inode (bsc#1024788).\n- xfs: remove xfs_itruncate_data (bsc#1024788).\n- xfs: replace global xfslogd wq with per-mount wq (bsc#1024508).\n- xfs: split xfs_itruncate_finish (bsc#1024788).\n- xfs: split xfs_setattr (bsc#1024788).\n- xfs: track and serialize in-flight async buffers against unmount (bsc#1024508).\n- xfs_dmapi: fix the debug compilation of xfs_dmapi (bsc#989056).\n","status":"published","published":"2017-05-15T15:06:35Z","modified":"2026-02-04T02:17:04.105222Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"SUSE-SU-2017:1360-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 12 SP1 kernel was updated to 3.12.74 to receive various security and bugfixes.\n\nNotable new/improved features:\n- Improved support for Hyper-V\n- Support for the tcp_westwood TCP scheduling algorithm\n\nThe following security bugs were fixed:\n\n- CVE-2017-8106: The handle_invept function in arch/x86/kvm/vmx.c in the Linux kernel allowed privileged KVM guest OS users to cause a denial of service (NULL pointer dereference and host OS crash) via a single-context INVEPT instruction with a NULL EPT pointer (bsc#1035877).\n- CVE-2017-6951: The keyring_search_aux function in security/keys/keyring.c in the Linux kernel allowed local users to cause a denial of service (NULL pointer dereference and OOPS) via a request_key system call for the 'dead' type. (bsc#1029850).\n- CVE-2017-2647: The KEYS subsystem in the Linux kernel allowed local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) via vectors involving a NULL value for a certain match field, related to the keyring_search_iterator function in keyring.c. (bsc#1030593)\n- CVE-2016-9604: This fixes handling of keyrings starting with '.' in KEYCTL_JOIN_SESSION_KEYRING, which could have allowed local users to manipulate privileged keyrings (bsc#1035576)\n- CVE-2017-7616: Incorrect error handling in the set_mempolicy and mbind compat syscalls in mm/mempolicy.c in the Linux kernel allowed local users to obtain sensitive information from uninitialized stack data by triggering failure of a certain bitmap operation. (bnc#1033336).\n- CVE-2017-7645: The NFSv2/NFSv3 server in the nfsd subsystem in the Linux kernel allowed remote attackers to cause a denial of service (system crash) via a long RPC reply, related to net/sunrpc/svc.c, fs/nfsd/nfs3xdr.c, and fs/nfsd/nfsxdr.c. (bsc#1034670).\n- CVE-2017-7308: The packet_set_ring function in net/packet/af_packet.c in the Linux kernel did not properly validate certain block-size data, which allowed local users to cause a denial of service (overflow) or possibly have unspecified other impact via crafted system calls (bnc#1031579)\n- CVE-2017-2671: The ping_unhash function in net/ipv4/ping.c in the Linux kernel was  too late in obtaining a certain lock and consequently could not ensure that disconnect function calls are safe, which allowed local users to cause a denial of service (panic) by leveraging access to the protocol value of IPPROTO_ICMP in a socket system call (bnc#1031003)\n- CVE-2017-7294: The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not validate addition of certain levels data, which allowed local users to trigger an integer overflow and out-of-bounds write, and cause a denial of service (system hang or crash) or possibly gain privileges, via a crafted ioctl call for a /dev/dri/renderD* device (bnc#1031440)\n- CVE-2017-7261: The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not check for a zero value of certain levels data, which allowed local users to cause a denial of service (ZERO_SIZE_PTR dereference, and GPF and possibly panic) via a crafted ioctl call for a /dev/dri/renderD* device (bnc#1031052)\n- CVE-2017-7187: The sg_ioctl function in drivers/scsi/sg.c in the Linux kernel allowed local users to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a large command size in an SG_NEXT_CMD_LEN ioctl call, leading to out-of-bounds write access in the sg_write function (bnc#1030213)\n- CVE-2016-9588: arch/x86/kvm/vmx.c in the Linux kernel mismanaged the #BP and #OF exceptions, which allowed guest OS users to cause a denial of service (guest OS crash) by declining to handle an exception thrown by an L2 guest (bsc#1015703).\n- CVE-2017-5669: The do_shmat function in ipc/shm.c in the Linux kernel did not restrict the address calculated by a certain rounding operation, which allowed local users to map page zero, and consequently bypass a protection mechanism that exists for the mmap system call, by making crafted shmget and shmat system calls in a privileged context (bnc#1026914).\n- CVE-2016-10200: Race condition in the L2TPv3 IP Encapsulation feature in the Linux kernel allowed local users to gain privileges or cause a denial of service (use-after-free) by making multiple bind system calls without properly ascertaining whether a socket has the SOCK_ZAPPED status, related to net/l2tp/l2tp_ip.c and net/l2tp/l2tp_ip6.c (bnc#1028415)\n- CVE-2016-10208: The ext4_fill_super function in fs/ext4/super.c in the Linux kernel did not properly validate meta block groups, which allowed physically proximate attackers to cause a denial of service (out-of-bounds read and system crash) via a crafted ext4 image (bnc#1023377).\n- CVE-2017-5897: The ip6gre_err function in net/ipv6/ip6_gre.c in the Linux kernel allowed remote attackers to have unspecified impact via vectors involving GRE flags in an IPv6 packet, which trigger an out-of-bounds access (bsc#1023762).\n- CVE-2017-5986: A race condition in the sctp_wait_for_sndbuf function in net/sctp/socket.c in the Linux kernel allowed local users to cause a denial of service (assertion failure and panic) via a multithreaded application that peels off an association in a certain buffer-full state (bsc#1025235).\n- CVE-2017-6074: The dccp_rcv_state_process function in net/dccp/input.c in the Linux kernel mishandled DCCP_PKT_REQUEST packet data structures in the LISTEN state, which allowed local users to obtain root privileges or cause a denial of service (double free) via an application that made an IPV6_RECVPKTINFO setsockopt system call (bnc#1026024)\n- CVE-2016-9191: The cgroup offline implementation in the Linux kernel mishandled certain drain operations, which allowed local users to cause a denial of service (system hang) by leveraging access to a container environment for executing a crafted application (bnc#1008842)\n- CVE-2017-6348: The hashbin_delete function in net/irda/irqueue.c in the Linux kernel improperly managed lock dropping, which allowed local users to cause a denial of service (deadlock) via crafted operations on IrDA devices (bnc#1027178).\n- CVE-2016-10044: The aio_mount function in fs/aio.c in the Linux kernel did not properly restrict execute access, which made it easier for local users to bypass intended SELinux W^X policy restrictions, and consequently gain privileges, via an io_setup system call (bnc#1023992).\n- CVE-2016-3070: The trace_writeback_dirty_page implementation in include/trace/events/writeback.h in the Linux kernel improperly interacts with mm/migrate.c, which allowed local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by triggering a certain page move (bnc#979215).\n- CVE-2016-5243: The tipc_nl_compat_link_dump function in net/tipc/netlink_compat.c in the Linux kernel did not properly copy a certain string, which allowed local users to obtain sensitive information from kernel stack memory by reading a Netlink message (bnc#983212).\n- CVE-2017-6345: The LLC subsystem in the Linux kernel did not ensure that a certain destructor exists in required circumstances, which allowed local users to cause a denial of service (BUG_ON) or possibly have unspecified other impact via crafted system calls (bnc#1027190)\n- CVE-2017-6346: Race condition in net/packet/af_packet.c in the Linux kernel allowed local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via a multithreaded application that made PACKET_FANOUT setsockopt system calls (bnc#1027189)\n- CVE-2017-6353: net/sctp/socket.c in the Linux kernel did not properly restrict association peel-off operations during certain wait states, which allowed local users to cause a denial of service (invalid unlock and double free) via a multithreaded application. NOTE: this vulnerability exists because of an incorrect fix for CVE-2017-5986 (bnc#1027066)\n- CVE-2017-5986: Race condition in the sctp_wait_for_sndbuf function in net/sctp/socket.c in the Linux kernel allowed local users to cause a denial of service (assertion failure and panic) via a multithreaded application that peels off an association in a certain buffer-full state (bsc#1025235).\n- CVE-2017-6214: The tcp_splice_read function in net/ipv4/tcp.c in the Linux kernel allowed remote attackers to cause a denial of service (infinite loop and soft lockup) via vectors involving a TCP packet with the URG flag (bnc#1026722)\n- CVE-2016-2117: The atl2_probe function in drivers/net/ethernet/atheros/atlx/atl2.c in the Linux kernel incorrectly enables scatter/gather I/O, which allowed remote attackers to obtain sensitive information from kernel memory by reading packet data (bnc#968697)\n- CVE-2015-1350: The VFS subsystem in the Linux kernel provided an incomplete set of requirements for setattr operations that underspecifies removing extended privilege attributes, which allowed local users to cause a denial of service (capability stripping) via a failed invocation of a system call, as demonstrated by using chown to remove a capability from the ping or Wireshark dumpcap program (bsc#914939).\n- CVE-2016-7117: Use-after-free vulnerability in the __sys_recvmmsg function in net/socket.c in the Linux kernel allowed remote attackers to execute arbitrary code via vectors involving a recvmmsg system call that is mishandled during error processing (bsc#1003077).\n\nThe following non-security bugs were fixed:\n\n- ACPI / APEI: Fix NMI notification handling (bsc#917630).\n- arch: Mass conversion of smp_mb__*() (bsc#1020795).\n- asm-generic: add __smp_xxx wrappers (bsc#1020795).\n- block: remove struct request buffer member (bsc#1020795).\n- block: submit_bio_wait() conversions (bsc#1020795).\n- bonding: Advertize vxlan offload features when supported (bsc#1009682).\n- bonding: handle more gso types (bsc#1009682).\n- bonding: use the correct ether type for alb (bsc#1028595).\n- btrfs: allow unlink to exceed subvolume quota (bsc#1015821).\n- btrfs: Change qgroup_meta_rsv to 64bit (bsc#1015821).\n- btrfs: fix btrfs_compat_ioctl failures on non-compat ioctls (bsc#1018100).\n- btrfs: make file clone aware of fatal signals (bsc#1015787).\n- btrfs: qgroups: Retry after commit on getting EDQUOT (bsc#1015821).\n- cancel the setfilesize transation when io error happen (bsc#1028648).\n- cgroup: remove stray references to css_id (bsc#1020795).\n- cpuidle: powernv/pseries: Auto-promotion of snooze to deeper idle state (bnc#1023164).\n- dm: add era target (bsc#1020795).\n- dm: allow remove to be deferred (bsc#1020795).\n- dm bitset: only flush the current word if it has been dirtied (bsc#1020795).\n- dm btree: add dm_btree_find_lowest_key (bsc#1020795).\n- dm cache: actually resize cache (bsc#1020795).\n- dm cache: add block sizes and total cache blocks to status output (bsc#1020795).\n- dm cache: add cache block invalidation support (bsc#1020795).\n- dm cache: add passthrough mode (bsc#1020795).\n- dm cache: add policy name to status output (bsc#1020795).\n- dm cache: add remove_cblock method to policy interface (bsc#1020795).\n- dm cache: be much more aggressive about promoting writes to discarded blocks (bsc#1020795).\n- dm cache: cache shrinking support (bsc#1020795).\n- dm cache: do not add migration to completed list before unhooking bio (bsc#1020795).\n- dm cache: fix a lock-inversion (bsc#1020795).\n- dm cache: fix truncation bug when mapping I/O to more than 2TB fast device (bsc#1020795).\n- dm cache: fix writethrough mode quiescing in cache_map (bsc#1020795).\n- dm cache: improve efficiency of quiescing flag management (bsc#1020795).\n- dm cache: io destined for the cache device can now serve as tick bios (bsc#1020795).\n- dm cache: log error message if dm_kcopyd_copy() fails (bsc#1020795).\n- dm cache metadata: check the metadata version when reading the superblock (bsc#1020795).\n- dm cache metadata: return bool from __superblock_all_zeroes (bsc#1020795).\n- dm cache: move hook_info into common portion of per_bio_data structure (bsc#1020795).\n- dm cache: optimize commit_if_needed (bsc#1020795).\n- dm cache policy mq: a few small fixes (bsc#1020795).\n- dm cache policy mq: fix promotions to occur as expected (bsc#1020795).\n- dm cache policy mq: implement writeback_work() and mq_{set,clear}_dirty() (bsc#1020795).\n- dm cache policy mq: introduce three promotion threshold tunables (bsc#1020795).\n- dm cache policy mq: protect residency method with existing mutex (bsc#1020795).\n- dm cache policy mq: reduce memory requirements (bsc#1020795).\n- dm cache policy mq: use list_del_init instead of list_del + INIT_LIST_HEAD (bsc#1020795).\n- dm cache policy: remove return from void policy_remove_mapping (bsc#1020795).\n- dm cache: promotion optimisation for writes (bsc#1020795).\n- dm cache: resolve small nits and improve Documentation (bsc#1020795).\n- dm cache: return -EINVAL if the user specifies unknown cache policy (bsc#1020795).\n- dm cache: use cell_defer() boolean argument consistently (bsc#1020795).\n- dm: change sector_count member in clone_info from sector_t to unsigned (bsc#1020795).\n- dm crypt: add TCW IV mode for old CBC TCRYPT containers (bsc#1020795).\n- dm crypt: properly handle extra key string in initialization (bsc#1020795).\n- dm delay: use per-bio data instead of a mempool and slab cache (bsc#1020795).\n- dm: fix Kconfig indentation (bsc#1020795).\n- dm: fix Kconfig menu indentation (bsc#1020795).\n- dm: make dm_table_alloc_md_mempools static (bsc#1020795).\n- dm mpath: do not call pg_init when it is already running (bsc#1020795).\n- dm mpath: fix lock order inconsistency in multipath_ioctl (bsc#1020795).\n- dm mpath: print more useful warnings in multipath_message() (bsc#1020795).\n- dm mpath: push back requests instead of queueing (bsc#1020795).\n- dm mpath: really fix lockdep warning (bsc#1020795).\n- dm mpath: reduce memory pressure when requeuing (bsc#1020795).\n- dm mpath: remove extra nesting in map function (bsc#1020795).\n- dm mpath: remove map_io() (bsc#1020795).\n- dm mpath: remove process_queued_ios() (bsc#1020795).\n- dm mpath: requeue I/O during pg_init (bsc#1020795).\n- dm persistent data: cleanup dm-thin specific references in text (bsc#1020795).\n- dm snapshot: call destroy_work_on_stack() to pair with INIT_WORK_ONSTACK() (bsc#1020795).\n- dm snapshot: fix metadata corruption (bsc#1020795).\n- dm snapshot: prepare for switch to using dm-bufio (bsc#1020795).\n- dm snapshot: use dm-bufio (bsc#1020795).\n- dm snapshot: use dm-bufio prefetch (bsc#1020795).\n- dm snapshot: use GFP_KERNEL when initializing exceptions (bsc#1020795).\n- dm space map disk: optimise sm_disk_dec_block (bsc#1020795).\n- dm space map metadata: limit errors in sm_metadata_new_block (bsc#1020795).\n- dm: stop using bi_private (bsc#1020795).\n- dm table: add dm_table_run_md_queue_async (bsc#1020795).\n- dm table: print error on preresume failure (bsc#1020795).\n- dm table: remove unused buggy code that extends the targets array (bsc#1020795).\n- dm thin: add error_if_no_space feature (bsc#1020795).\n- dm thin: add mappings to end of prepared_* lists (bsc#1020795).\n- dm thin: add 'no_space_timeout' dm-thin-pool module param (bsc#1020795).\n- dm thin: add timeout to stop out-of-data-space mode holding IO forever (bsc#1020795).\n- dm thin: allow metadata commit if pool is in PM_OUT_OF_DATA_SPACE mode (bsc#1020795).\n- dm thin: allow metadata space larger than supported to go unused (bsc#1020795).\n- dm thin: cleanup and improve no space handling (bsc#1020795).\n- dm thin: eliminate the no_free_space flag (bsc#1020795).\n- dm thin: ensure user takes action to validate data and metadata consistency (bsc#1020795).\n- dm thin: factor out check_low_water_mark and use bools (bsc#1020795).\n- dm thin: fix deadlock in __requeue_bio_list (bsc#1020795).\n- dm thin: fix noflush suspend IO queueing (bsc#1020795).\n- dm thin: fix out of data space handling (bsc#1020795).\n- dm thin: fix pool feature parsing (bsc#1020795).\n- dm thin: fix rcu_read_lock being held in code that can sleep (bsc#1020795).\n- dm thin: handle metadata failures more consistently (bsc#1020795).\n- dm thin: irqsave must always be used with the pool-\u003elock spinlock (bsc#1020795).\n- dm thin: log info when growing the data or metadata device (bsc#1020795).\n- dm thin: requeue bios to DM core if no_free_space and in read-only mode (bsc#1020795).\n- dm thin: return error from alloc_data_block if pool is not in write mode (bsc#1020795).\n- dm thin: simplify pool_is_congested (bsc#1020795).\n- dm thin: sort the per thin deferred bios using an rb_tree (bsc#1020795).\n- dm thin: synchronize the pool mode during suspend (bsc#1020795).\n- dm thin: use bool rather than unsigned for flags in structures (bsc#1020795).\n- dm thin: use INIT_WORK_ONSTACK in noflush_work to avoid ODEBUG warning (bsc#1020795).\n- dm thin: use per thin device deferred bio lists (bsc#1020795).\n- dm: use RCU_INIT_POINTER instead of rcu_assign_pointer in __unbind (bsc#1020795).\n- drm/i915: relax uncritical udelay_range() (bsc#1038261).\n- ether: add loopback type ETH_P_LOOPBACK (bsc#1028595).\n- ext4: fix bh leak on error paths in ext4_rename() and ext4_cross_rename() (bsc#1012985).\n- ext4: fix fencepost in s_first_meta_bg validation (bsc#1029986).\n- ext4: mark inode dirty after converting inline directory (bsc#1012985).\n- ftrace: Make ftrace_location_range() global (FATE#322421).\n- HID: usbhid: improve handling of Clear-Halt and reset (bsc#1031080).\n- hv: util: catch allocation errors\n- hv: utils: use memdup_user in hvt_op_write\n- hwrng: virtio - ensure reads happen after successful probe (bsc#954763 bsc#1032344).\n- i40e: avoid null pointer dereference (bsc#922853).\n- i40e/i40evf: Break up xmit_descriptor_count from maybe_stop_tx (bsc#985561).\n- i40e/i40evf: Limit TSO to 7 descriptors for payload instead of 8 per packet (bsc#985561).\n- i40e/i40evf: Rewrite logic for 8 descriptor per packet check (bsc#985561).\n- i40e: Impose a lower limit on gso size (bsc#985561).\n- i40e: Limit TX descriptor count in cases where frag size is greater than 16K (bsc#985561).\n- iommu/vt-d: Flush old iommu caches for kdump when the device gets context mapped (bsc#1023824).\n- iommu/vt-d: Tylersburg isoch identity map check is done too late (bsc#1032125).\n- ipv6: make ECMP route replacement less greedy (bsc#930399).\n- kabi: hide changes in struct sk_buff (bsc#1009682).\n- KABI: Hide new include in arch/powerpc/kernel/process.c (fate#322421).\n- kABI: mask struct xfs_icdinode change (bsc#1024788).\n- kABI: protect struct inet6_dev (kabi).\n- kABI: protect struct iscsi_conn (bsc#103470).\n- kABI: protect struct xfs_buftarg and struct xfs_mount (bsc#1024508).\n- kABI: restore can_rx_register parameters (kabi).\n- kernel/watchdog: use nmi registers snapshot in hardlockup handler (bsc#940946, bsc#937444).\n- kgr: Mark eeh_event_handler() kthread safe using a timeout (bsc#1031662).\n- kgr/module: make a taint flag module-specific\n- kgr: remove unneeded kgr_needs_lazy_migration() s390x definition\n- l2tp: fix address test in __l2tp_ip6_bind_lookup() (bsc#1028415).\n- l2tp: fix lookup for sockets not bound to a device in l2tp_ip (bsc#1028415).\n- l2tp: fix racy socket lookup in l2tp_ip and l2tp_ip6 bind() (bsc#1028415).\n- l2tp: hold socket before dropping lock in l2tp_ip{, 6}_recv() (bsc#1028415).\n- l2tp: hold tunnel socket when handling control frames in l2tp_ip and l2tp_ip6 (bsc#1028415).\n- l2tp: lock socket before checking flags in connect() (bsc#1028415).\n- livepatch: Allow architectures to specify an alternate ftrace location (FATE#322421).\n- locking/semaphore: Add down_interruptible_timeout() (bsc#1031662).\n- md: avoid oops on unload if some process is in poll or select (bsc#1020795).\n- md: Convert use of typedef ctl_table to struct ctl_table (bsc#1020795).\n- md: ensure metadata is writen after raid level change (bsc#1020795).\n- md linear: fix a race between linear_add() and linear_congested() (bsc#1018446).\n- md: md_clear_badblocks should return an error code on failure (bsc#1020795).\n- md: refuse to change shape of array if it is active but read-only (bsc#1020795).\n- megaraid_sas: add missing curly braces in ioctl handler (bsc#1023207).\n- megaraid_sas: Fixup tgtid count in megasas_ld_list_query() (bsc#971933).\n- mm/huge_memory.c: respect FOLL_FORCE/FOLL_COW for thp (bnc#1030118).\n- mm, memcg: do not retry precharge charges (bnc#1022559).\n- mm/mempolicy.c: do not put mempolicy before using its nodemask (References: VM Performance, bnc#931620).\n- mm/page_alloc: fix nodes for reclaim in fast path (bnc#1031842).\n- module: move add_taint_module() to a header file\n- net: Add skb_gro_postpull_rcsum to udp and vxlan (bsc#1009682).\n- net: add skb_pop_rcv_encapsulation (bsc#1009682).\n- net: Call skb_checksum_init in IPv4 (bsc#1009682).\n- net: Call skb_checksum_init in IPv6 (bsc#1009682).\n- netfilter: allow logging fron non-init netns (bsc#970083).\n- net: Generalize checksum_init functions (bsc#1009682).\n- net: Preserve CHECKSUM_COMPLETE at validation (bsc#1009682).\n- NFS: do not try to cross a mountpount when there isn't one there (bsc#1028041).\n- NFS: Expedite unmount of NFS auto-mounts (bnc#1025802).\n- NFS: Fix a performance regression in readdir (bsc#857926).\n- NFS: flush out dirty data on file fput() (bsc#1021762).\n- ocfs2: do not write error flag to user structure we cannot copy from/to (bsc#1012985).\n- powerpc: Blacklist GCC 5.4 6.1 and 6.2 (boo#1028895).\n- powerpc: Create a helper for getting the kernel toc value (FATE#322421).\n- powerpc/fadump: Fix the race in crash_fadump() (bsc#1022971).\n- powerpc/fadump: Reserve memory at an offset closer to bottom of RAM (bsc#1032141).\n- powerpc/fadump: Update fadump documentation (bsc#1032141).\n- powerpc/ftrace: Add Kconfig \u0026 Make glue for mprofile-kernel (FATE#322421).\n- powerpc/ftrace: Add support for -mprofile-kernel ftrace ABI (FATE#322421).\n- powerpc/ftrace: Use $(CC_FLAGS_FTRACE) when disabling ftrace (FATE#322421).\n- powerpc/ftrace: Use generic ftrace_modify_all_code() (FATE#322421).\n- powerpc: introduce TIF_KGR_IN_PROGRESS thread flag (FATE#322421).\n- powerpc/kgraft: Add kgraft header (FATE#322421).\n- powerpc/kgraft: Add kgraft stack to struct thread_info (FATE#322421).\n- powerpc/kgraft: Add live patching support on ppc64le (FATE#322421).\n- powerpc/module: Create a special stub for ftrace_caller() (FATE#322421).\n- powerpc/module: Mark module stubs with a magic value (FATE#322421).\n- powerpc/module: Only try to generate the ftrace_caller() stub once (FATE#322421).\n- powerpc/modules: Never restore r2 for a mprofile-kernel style mcount() call (FATE#322421).\n- powerpc/prom: Increase minimum RMA size to 512MB (bsc#984530).\n- powerpc/pseries/cpuidle: Remove MAX_IDLE_STATE macro (bnc#1023164).\n- powerpc/pseries/cpuidle: Use cpuidle_register() for initialisation (bnc#1023164).\n- powerpc: Reject binutils 2.24 when building little endian (boo#1028895).\n- RAID1: avoid unnecessary spin locks in I/O barrier code (bsc#982783,bsc#1020048).\n- raid1: include bio_end_io_list in nr_queued to prevent freeze_array hang\n- remove mpath patches from dmcache backport, for bsc#1035738\n- revert 'procfs: mark thread stack correctly in proc/PID/maps' (bnc#1030901).\n- Revert 'RDMA/core: Fix incorrect structure packing for booleans' (kabi).\n- rtnetlink: allow to register ops without ops-\u003esetup set (bsc#1021374).\n- s390/zcrypt: Introduce CEX6 toleration (FATE#321783, LTC#147506, bsc#1019514).\n- sched/loadavg: Avoid loadavg spikes caused by delayed NO_HZ accounting (bsc#1018419).\n- scsi_error: count medium access timeout only once per EH run (bsc#993832, bsc#1032345).\n- scsi: libiscsi: add lock around task lists to fix list corruption regression (bsc#1034700).\n- scsi: storvsc: fix SRB_STATUS_ABORTED handling\n- sfc: reduce severity of PIO buffer alloc failures (bsc#1019168).\n- svcrpc: fix gss-proxy NULL dereference in some error cases (bsc#1024309).\n- taint/module: Clean up global and module taint flags handling\n- tcp: abort orphan sockets stalling on zero window probes (bsc#1021913).\n- thp: fix MADV_DONTNEED vs. numa balancing race (bnc#1027974).\n- thp: reduce indentation level in change_huge_pmd() (bnc#1027974).\n- treewide: fix 'distingush' typo (bsc#1020795).\n- tree-wide: use reinit_completion instead of INIT_COMPLETION (bsc#1020795).\n- usb: dwc3: gadget: Fix incorrect DEPCMD and DGCMD status macros (bsc#1035699).\n- usb: host: xhci: print correct command ring address (bnc#1035699).\n- USB: serial: kl5kusb105: fix line-state error handling (bsc#1021256).\n- vfs: Do not exchange 'short' filenames unconditionally (bsc#1012985).\n- vfs: split generic splice code from i_mutex locking (bsc#1024788).\n- vmxnet3: segCnt can be 1 for LRO packets (bsc#988065).\n- VSOCK: Detach QP check should filter out non matching QPs (bsc#1036752).\n- vxlan: cancel sock_work in vxlan_dellink() (bsc#1031567).\n- vxlan: Checksum fixes (bsc#1009682).\n- vxlan: GRO support at tunnel layer (bsc#1009682).\n- xen-blkfront: correct maximum segment accounting (bsc#1018263).\n- xen-blkfront: do not call talk_to_blkback when already connected to blkback.\n- xen-blkfront: free resources if xlvbd_alloc_gendisk fails.\n- xfs_dmapi: fix the debug compilation of xfs_dmapi (bsc#989056).\n- xfs: do not allow di_size with high bit set (bsc#1024234).\n- xfs: do not assert fail on non-async buffers on ioacct decrement (bsc#1024508).\n- xfs: exclude never-released buffers from buftarg I/O accounting (bsc#1024508).\n- xfs: fix broken multi-fsb buffer logging (bsc#1024081).\n- xfs: fix buffer overflow dm_get_dirattrs/dm_get_dirattrs2 (bsc#989056).\n- xfs: Fix lock ordering in splice write (bsc#1024788).\n- xfs: fix up xfs_swap_extent_forks inline extent handling (bsc#1023888).\n- xfs: Make xfs_icdinode-\u003edi_dmstate atomic_t (bsc#1024788).\n- xfs: pass total block res. as total xfs_bmapi_write() parameter (bsc#1029470).\n- xfs: replace global xfslogd wq with per-mount wq (bsc#1024508).\n- xfs: track and serialize in-flight async buffers against unmount (bsc#1024508).\n","status":"published","published":"2017-05-19T12:12:38Z","modified":"2026-02-04T03:19:59.910788Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"SUSE-SU-2017:2342-1","title":"Security update for the Linux Kernel","description":"\n\nThe SUSE Linux Enterprise 11 SP4 RT kernel was updated to receive various security and bugfixes.\n\n\nThe following security bugs were fixed:\n\n- CVE-2014-9922: The eCryptfs subsystem in the Linux kernel allowed local users to gain privileges via a large filesystem stack that includes an overlayfs layer, related to fs/ecryptfs/main.c and fs/overlayfs/super.c (bsc#1032340).\n- CVE-2015-3288: mm/memory.c in the Linux kernel mishandled anonymous pages, which allowed local users to gain privileges or cause a denial of service (page tainting) via a crafted application that triggers writing to page zero (bnc#979021).\n- CVE-2015-8970: crypto/algif_skcipher.c in the Linux kernel did not verify that a setkey operation has been performed on an AF_ALG socket before an accept system call is processed, which allowed local users to cause a denial of service (NULL pointer dereference and system crash) via a crafted application that did not supply a key, related to the lrw_crypt function in crypto/lrw.c (bnc#1008374 bsc#1008850).\n- CVE-2016-10200: Race condition in the L2TPv3 IP Encapsulation feature in the Linux kernel allowed local users to gain privileges or cause a denial of service (use-after-free) by making multiple bind system calls without properly ascertaining whether a socket has the SOCK_ZAPPED status, related to net/l2tp/l2tp_ip.c and net/l2tp/l2tp_ip6.c (bnc#1028415).\n- CVE-2016-2188: The iowarrior_probe function in drivers/usb/misc/iowarrior.c in the Linux kernel allowed physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor (bnc#970956).\n- CVE-2016-4997: The compat IPT_SO_SET_REPLACE and IP6T_SO_SET_REPLACE setsockopt implementations in the netfilter subsystem in the Linux kernel allow local users to gain privileges or cause a denial of service (memory corruption) by leveraging in-container root access to provide a crafted offset value that triggers an unintended decrement (bnc#986362).\n- CVE-2016-4998: The IPT_SO_SET_REPLACE setsockopt implementation in the netfilter subsystem in the Linux kernel allowed local users to cause a denial of service (out-of-bounds read) or possibly obtain sensitive information from kernel heap memory by leveraging in-container root access to provide a crafted offset value that leads to crossing a ruleset blob boundary (bnc#986365).\n- CVE-2016-5243: The tipc_nl_compat_link_dump function in net/tipc/netlink_compat.c in the Linux kernel did not properly copy a certain string, which allowed local users to obtain sensitive information from kernel stack memory by reading a Netlink message (bnc#983212).\n- CVE-2016-7117: Use-after-free vulnerability in the __sys_recvmmsg function in net/socket.c in the Linux kernel allowed remote attackers to execute arbitrary code via vectors involving a recvmmsg system call that is mishandled during error processing (bnc#1003077).\n- CVE-2017-1000363: A buffer overflow in kernel commandline handling of the 'lp' parameter could be used to bypass certain secure boot settings. (bnc#1039456).\n- CVE-2017-1000364: An issue was discovered in the size of the stack guard page on Linux, specifically a 4k stack guard page is not sufficiently large and can be 'jumped' over (the stack guard page is bypassed), this affects Linux Kernel versions 4.11.5 and earlier (the stackguard page was introduced in 2010) (bnc#1039348).\n- CVE-2017-1000365: The Linux Kernel imposes a size restriction on the arguments and environmental strings passed through RLIMIT_STACK/RLIM_INFINITY (1/4 of the size), but did not take the argument and environment pointers into account, which allowed attackers to bypass this limitation (bnc#1039354).\n- CVE-2017-1000380: sound/core/timer.c in the Linux kernel is vulnerable to a data race in the ALSA /dev/snd/timer driver resulting in local users being able to read information belonging to other users, i.e., uninitialized memory contents may be disclosed when a read and an ioctl happen at the same time (bnc#1044125).\n- CVE-2017-11176: The mq_notify function in the Linux kernel did not set the sock pointer to NULL upon entry into the retry logic. During a user-space close of a Netlink socket, it allowed attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact (bnc#1048275).\n- CVE-2017-11473: Buffer overflow in the mp_override_legacy_irq() function in arch/x86/kernel/acpi/boot.c in the Linux kernel allowed local users to gain privileges via a crafted ACPI table (bsc#1049603).\n- CVE-2017-2636: Race condition in drivers/tty/n_hdlc.c in the Linux kernel allowed local users to gain privileges or cause a denial of service (double free) by setting the HDLC line discipline (bnc#1027565 bsc#1028372).\n- CVE-2017-2647: The KEYS subsystem in the Linux kernel allowed local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) via vectors involving a NULL value for a certain match field, related to the keyring_search_iterator function in keyring.c (bnc#1030593).\n- CVE-2017-2671: The ping_unhash function in net/ipv4/ping.c in the Linux kernel is too late in obtaining a certain lock and consequently cannot ensure that disconnect function calls are safe, which allowed local users to cause a denial of service (panic) by leveraging access to the protocol value of IPPROTO_ICMP in a socket system call (bnc#1031003).\n- CVE-2017-5669: The do_shmat function in ipc/shm.c in the Linux kernel did not restrict the address calculated by a certain rounding operation, which allowed local users to map page zero, and consequently bypass a protection mechanism that exists for the mmap system call, by making crafted shmget and shmat system calls in a privileged context (bnc#1026914).\n- CVE-2017-5970: The ipv4_pktinfo_prepare function in net/ipv4/ip_sockglue.c in the Linux kernel allowed attackers to cause a denial of service (system crash) via (1) an application that made crafted system calls or possibly (2) IPv4 traffic with invalid IP options (bnc#1024938).\n- CVE-2017-5986: Race condition in the sctp_wait_for_sndbuf function in net/sctp/socket.c in the Linux kernel allowed local users to cause a denial of service (assertion failure and panic) via a multithreaded application that peels off an association in a certain buffer-full state (bnc#1025235).\n- CVE-2017-6074: The dccp_rcv_state_process function in net/dccp/input.c in the Linux kernel mishandled DCCP_PKT_REQUEST packet data structures in the LISTEN state, which allowed local users to obtain root privileges or cause a denial of service (double free) via an application that made an IPV6_RECVPKTINFO setsockopt system call (bnc#1026024 bsc#1033287).\n- CVE-2017-6214: The tcp_splice_read function in net/ipv4/tcp.c in the Linux kernel allowed remote attackers to cause a denial of service (infinite loop and soft lockup) via vectors involving a TCP packet with the URG flag (bnc#1026722).\n- CVE-2017-6348: The hashbin_delete function in net/irda/irqueue.c in the Linux kernel improperly manages lock dropping, which allowed local users to cause a denial of service (deadlock) via crafted operations on IrDA devices (bnc#1027178).\n- CVE-2017-6353: net/sctp/socket.c in the Linux kernel did not properly restrict association peel-off operations during certain wait states, which allowed local users to cause a denial of service (invalid unlock and double free) via a multithreaded application.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2017-5986 (bnc#1027066).\n- CVE-2017-6951: The keyring_search_aux function in security/keys/keyring.c in the Linux kernel allowed local users to cause a denial of service (NULL pointer dereference and OOPS) via a request_key system call for the 'dead' type (bnc#1029850).\n- CVE-2017-7184: The xfrm_replay_verify_len function in net/xfrm/xfrm_user.c in the Linux kernel did not validate certain size data after an XFRM_MSG_NEWAE update, which allowed local users to obtain root privileges or cause a denial of service (heap-based out-of-bounds access) by leveraging the CAP_NET_ADMIN capability, as demonstrated during a Pwn2Own competition at CanSecWest 2017 for the Ubuntu 16.10 linux-image-* package 4.8.0.41.52 (bnc#1030573).\n- CVE-2017-7187: The sg_ioctl function in drivers/scsi/sg.c in the Linux kernel allowed local users to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a large command size in an SG_NEXT_CMD_LEN ioctl call, leading to out-of-bounds write access in the sg_write function (bnc#1030213).\n- CVE-2017-7261: The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not check for a zero value of certain levels data, which allowed local users to cause a denial of service (ZERO_SIZE_PTR dereference, and GPF and possibly panic) via a crafted ioctl call for a /dev/dri/renderD* device (bnc#1031052).\n- CVE-2017-7294: The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not validate addition of certain levels data, which allowed local users to trigger an integer overflow and out-of-bounds write, and cause a denial of service (system hang or crash) or possibly gain privileges, via a crafted ioctl call for a /dev/dri/renderD* device (bnc#1031440).\n- CVE-2017-7308: The packet_set_ring function in net/packet/af_packet.c in the Linux kernel did not properly validate certain block-size data, which allowed local users to cause a denial of service (integer signedness error and out-of-bounds write), or gain privileges (if the CAP_NET_RAW capability is held), via crafted system calls (bnc#1031579).\n- CVE-2017-7482: Fixed a potential overflow in the net/rxprc where a padded len isn't checked in ticket decode (bsc#1046107).\n- CVE-2017-7487: The ipxitf_ioctl function in net/ipx/af_ipx.c in the Linux kernel mishandled reference counts, which allowed local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via a failed SIOCGIFADDR ioctl call for an IPX interface (bnc#1038879).\n- CVE-2017-7533: Race condition in the fsnotify implementation in the Linux kernel allowed local users to gain privileges or cause a denial of service (memory corruption) via a crafted application that leverages simultaneous execution of the inotify_handle_event and vfs_rename functions (bsc#1049483).\n- CVE-2017-7542: The ip6_find_1stfragopt function in net/ipv6/output_core.c in the Linux kernel allowed local users to cause a denial of service (integer overflow and infinite loop) by leveraging the ability to open a raw socket (bsc#1049882).\n- CVE-2017-7616: Incorrect error handling in the set_mempolicy and mbind compat syscalls in mm/mempolicy.c in the Linux kernel allowed local users to obtain sensitive information from uninitialized stack data by triggering failure of a certain bitmap operation (bnc#1033336).\n- CVE-2017-8890: The inet_csk_clone_lock function in net/ipv4/inet_connection_sock.c in the Linux kernel allowed attackers to cause a denial of service (double free) or possibly have unspecified other impact by leveraging use of the accept system call (bnc#1038544).\n- CVE-2017-8924: The edge_bulk_in_callback function in drivers/usb/serial/io_ti.c in the Linux kernel allowed local users to obtain sensitive information (in the dmesg ringbuffer and syslog) from uninitialized kernel memory by using a crafted USB device (posing as an io_ti USB serial device) to trigger an integer underflow (bnc#1037182 bsc#1038982).\n- CVE-2017-8925: The omninet_open function in drivers/usb/serial/omninet.c in the Linux kernel allowed local users to cause a denial of service (tty exhaustion) by leveraging reference count mishandling (bnc#1037183 bsc#1038981).\n- CVE-2017-9074: The IPv6 fragmentation implementation in the Linux kernel did not consider that the nexthdr field may be associated with an invalid option, which allowed local users to cause a denial of service (out-of-bounds read and BUG) or possibly have unspecified other impact via crafted socket and send system calls (bnc#1039882).\n- CVE-2017-9075: The sctp_v6_create_accept_sk function in net/sctp/ipv6.c in the Linux kernel mishandled inheritance, which allowed local users to cause a denial of service or possibly have unspecified other impact via crafted system calls, a related issue to CVE-2017-8890 (bnc#1039883).\n- CVE-2017-9076: The dccp_v6_request_recv_sock function in net/dccp/ipv6.c in the Linux kernel mishandled inheritance, which allowed local users to cause a denial of service or possibly have unspecified other impact via crafted system calls, a related issue to CVE-2017-8890 (bnc#1039885).\n- CVE-2017-9077: The tcp_v6_syn_recv_sock function in net/ipv6/tcp_ipv6.c in the Linux kernel mishandled inheritance, which allowed local users to cause a denial of service or possibly have unspecified other impact via crafted system calls, a related issue to CVE-2017-8890 (bnc#1040069).\n- CVE-2017-9242: The __ip6_append_data function in net/ipv6/ip6_output.c in the Linux kernel is too late in checking whether an overwrite of an skb data structure may occur, which allowed local users to cause a denial of service (system crash) via crafted system calls (bnc#1041431).\n\nThe following non-security bugs were fixed:\n\n- 8250: use callbacks to access UART_DLL/UART_DLM.\n- acpi: Disable APEI error injection if securelevel is set (bsc#972891, bsc#1023051).\n- af_key: Add lock to key dump (bsc#1047653).\n- af_key: Fix slab-out-of-bounds in pfkey_compile_policy (bsc#1047354).\n- alsa: ctxfi: Fallback DMA mask to 32bit (bsc#1045538).\n- alsa: hda - Fix regression of HD-audio controller fallback modes (bsc#1045538).\n- alsa: hda/realtek - Correction of fixup codes for PB V7900 laptop (bsc#1045538).\n- alsa: hda/realtek - Fix COEF widget NID for ALC260 replacer fixup (bsc#1045538).\n- alsa: hda - using uninitialized data (bsc#1045538).\n- alsa: off by one bug in snd_riptide_joystick_probe() (bsc#1045538).\n- alsa: seq: Fix snd_seq_call_port_info_ioctl in compat mode (bsc#1045538).\n- ath9k: fix buffer overrun for ar9287 (bsc#1045538).\n- __bitmap_parselist: fix bug in empty string handling (bnc#1042633).\n- blacklist.conf: Add a few inapplicable items (bsc#1045538).\n- blacklist.conf: blacklisted 1fe89e1b6d27 (bnc#1046122)\n- block: do not allow updates through sysfs until registration completes (bsc#1047027).\n- block: fix ext_dev_lock lockdep report (bsc#1050154).\n- btrfs: Don't clear SGID when inheriting ACLs (bsc#1030552).\n- cifs: backport prepath matching fix (bsc#799133).\n- cifs: don't compare uniqueids in cifs_prime_dcache unless server inode numbers are in use (bsc#1041975).\n- cifs: small underflow in cnvrtDosUnixTm() (bsc#1043935).\n- cifs: Timeout on SMBNegotiate request (bsc#1044913).\n- clocksource: Remove 'weak' from clocksource_default_clock() declaration (bnc#1013018).\n- cputime: Avoid multiplication overflow on utime scaling (bnc#938352).\n- crypto: nx - off by one bug in nx_of_update_msc() (fate#314588,bnc#792863).\n- decompress_bunzip2: off by one in get_next_block() (git-fixes).\n- devres: fix a for loop bounds check (git-fixes).\n- dlm: backport 'fix lvb invalidation conditions' (bsc#1005651).\n- dm: fix ioctl retry termination with signal (bsc#1050154).\n- drm/mgag200: Add support for G200eH3 (bnc#1044216, fate#323551)\n- drm/mgag200: Add support for G200e rev 4 (bnc#995542, comment #81)\n- edac, amd64_edac: Shift wrapping issue in f1x_get_norm_dct_addr() (fate#313937).\n- enic: set skb-\u003ehash type properly (bsc#911105 FATE#317501).\n- ext2: Don't clear SGID when inheriting ACLs (bsc#1030552).\n- ext3: Don't clear SGID when inheriting ACLs (bsc#1030552).\n- ext4: Don't clear SGID when inheriting ACLs (bsc#1030552).\n- ext4: fix fdatasync(2) after extent manipulation operations (bsc#1013018).\n- ext4: fix mballoc breakage with 64k block size (bsc#1013018).\n- ext4: fix stack memory corruption with 64k block size (bsc#1013018).\n- ext4: keep existing extra fields when inode expands (bsc#1013018).\n- ext4: reject inodes with negative size (bsc#1013018).\n- fbdev/efifb: Fix 16 color palette entry calculation (bsc#1041762).\n- firmware: fix directory creation rule matching with make 3.80 (bsc#1012422).\n- firmware: fix directory creation rule matching with make 3.82 (bsc#1012422).\n- fixed invalid assignment of 64bit mask to host dma_boundary for scatter gather segment boundary limit (bsc#1042045).\n- Fix soft lockup in svc_rdma_send (bsc#1044854).\n- fnic: Return 'DID_IMM_RETRY' if rport is not ready (bsc#1035920).\n- fnic: Using rport-\u003edd_data to check rport online instead of rport_lookup (bsc#1035920).\n- fs/block_dev: always invalidate cleancache in invalidate_bdev() (git-fixes).\n- fs: fix data invalidation in the cleancache during direct IO (git-fixes).\n- fs/xattr.c: zero out memory copied to userspace in getxattr (bsc#1013018).\n- fuse: add missing FR_FORCE (bsc#1013018).\n- fuse: initialize fc-\u003erelease before calling it (bsc#1013018).\n- genirq: Prevent proc race against freeing of irq descriptors (bnc#1044230).\n- hrtimer: Allow concurrent hrtimer_start() for self restarting timers (bnc#1013018).\n- i40e: avoid null pointer dereference (bsc#909486 FATE#317393).\n- i40e: Fix TSO with more than 8 frags per segment issue (bsc#985561).\n- i40e/i40evf: Break up xmit_descriptor_count from maybe_stop_tx (bsc#985561).\n- i40e/i40evf: Fix mixed size frags and linearization (bsc#985561).\n- i40e/i40evf: Limit TSO to 7 descriptors for payload instead of 8 per packet (bsc#985561).\n- i40e/i40evf: Rewrite logic for 8 descriptor per packet check (bsc#985561).\n- i40e: Impose a lower limit on gso size (bsc#985561).\n- i40e: Limit TX descriptor count in cases where frag size is greater than 16K (bsc#985561).\n- ib/mlx4: Demote mcg message from warning to debug (bsc#919382).\n- ib/mlx4: Fix ib device initialization error flow (bsc#919382).\n- ib/mlx4: Fix port query for 56Gb Ethernet links (bsc#919382).\n- ib/mlx4: Handle well-known-gid in mad_demux processing (bsc#919382).\n- ib/mlx4: Reduce SRIOV multicast cleanup warning message to debug level (bsc#919382).\n- ib/mlx4: Set traffic class in AH (bsc#919382).\n- Implement an ioctl to support the USMTMC-USB488 READ_STATUS_BYTE operation (bsc#1036288).\n- initial cr0 bits (bnc#1036056, LTC#153612).\n- input: cm109 - validate number of endpoints before using them (bsc#1037193).\n- input: hanwang - validate number of endpoints before using them (bsc#1037232).\n- input: yealink - validate number of endpoints before using them (bsc#1037227).\n- ipmr, ip6mr: fix scheduling while atomic and a deadlock with ipmr_get_route (git-fixes).\n- irq: Fix race condition (bsc#1042615).\n- isdn/gigaset: fix NULL-deref at probe (bsc#1037356).\n- isofs: Do not return EACCES for unknown filesystems (bsc#1013018).\n- jbd: do not wait (forever) for stale tid caused by wraparound (bsc#1020229).\n- jbd: Fix oops in journal_remove_journal_head() (bsc#1017143).\n- jsm: add support for additional Neo cards (bsc#1045615).\n- kabi fix (bsc#1008893).\n- kABI: mask struct xfs_icdinode change (bsc#1024788).\n- kabi: Protect xfs_mount and xfs_buftarg (bsc#1024508).\n- kabi:severeties: Add splice_write_to_file PASS This function is part of an xfs-specific fix which never went upstream and is not expected to have 3rdparty users other than xfs itself.\n- kernel-binary.spec: Propagate MAKE_ARGS to %build (bsc#1012422)\n- keys: Disallow keyrings beginning with '.' to be joined as session keyrings (bnc#1035576).\n- kvm: kvm_io_bus_unregister_dev() should never fail.\n- libata: fix sff host state machine locking while polling (bsc#1045525).\n- libceph: NULL deref on crush_decode() error path (bsc#1044015).\n- libceph: potential NULL dereference in ceph_msg_data_create() (bsc#1051515).\n- libfc: fixup locking in fc_disc_stop() (bsc#1029140).\n- libfc: move 'pending' and 'requested' setting (bsc#1029140).\n- libfc: only restart discovery after timeout if not already running (bsc#1029140).\n- lockd: use init_utsname for id encoding (bsc#1033804).\n- lockd: use rpc client's cl_nodename for id encoding (bsc#1033804).\n- locking/rtmutex: Prevent dequeue vs. unlock race (bnc#1013018).\n- math64: New div64_u64_rem helper (bnc#938352).\n- md: ensure md devices are freed before module is unloaded (git-fixes).\n- md: fix a null dereference (bsc#1040351).\n- md: flush -\u003eevent_work before stopping array (git-fixes).\n- md linear: fix a race between linear_add() and linear_congested() (bsc#1018446).\n- md/linear: shutup lockdep warnning (bsc#1018446).\n- md: make sure GET_ARRAY_INFO ioctl reports correct 'clean' status (git-fixes).\n- md/raid0: apply base queue limits *before* disk_stack_limits (git-fixes).\n- md/raid1: extend spinlock to protect raid1_end_read_request against inconsistencies (git-fixes).\n- md/raid1: fix test for 'was read error from last working device' (git-fixes).\n- md/raid5: do not record new size if resize_stripes fails (git-fixes).\n- md/raid5: Fix CPU hotplug callback registration (git-fixes).\n- md: use separate bio_pool for metadata writes (bsc#1040351).\n- megaraid_sas: add missing curly braces in ioctl handler (bsc#1050154).\n- mlx4: reduce OOM risk on arches with large pages (bsc#919382).\n- mmc: core: add missing pm event in mmc_pm_notify to fix hib restore (bsc#1045547).\n- mmc: ushc: fix NULL-deref at probe (bsc#1037191).\n- mm: do not collapse stack gap into THP (bnc#1039348)\n- mm: enlarge stack guard gap (bnc#1039348).\n- mm/huge_memory: replace VM_NO_THP VM_BUG_ON with actual VMA check (VM Functionality, bsc#1042832).\n- mm: hugetlb: call huge_pte_alloc() only if ptep is null (VM Functionality, bsc#1042832).\n- mm/memory-failure.c: use compound_head() flags for huge pages (bnc#971975 VM -- git fixes).\n- mm/mempolicy.c: do not put mempolicy before using its nodemask (References: VM Performance, bnc#931620).\n- mm, mmap: do not blow on PROT_NONE MAP_FIXED holes in the stack (bnc#1039348, bnc#1045340, bnc#1045406).\n- module: fix memory leak on early load_module() failures (bsc#1043014).\n- Move nr_cpus_allowed into a hole in struct_sched_entity instead of the one below task_struct.policy. RT fills the hole 29baa7478ba4 used, which will screw up kABI for RT instead of curing the space needed problem in sched_rt_entity caused by adding ff77e4685359. This leaves nr_cpus_alowed in an odd spot, but safely allows the RT entity specific data added by ff77e4685359 to reside where it belongs.. nr_cpus_allowed just moves from one odd spot to another.\n- mwifiex: printk() overflow with 32-byte SSIDs (bsc#1048185).\n- net: avoid reference counter overflows on fib_rules in multicast forwarding (git-fixes).\n- net: ip6mr: fix static mfc/dev leaks on table destruction (git-fixes).\n- net: ipmr: fix static mfc/dev leaks on table destruction (git-fixes).\n- net/mlx4_core: Eliminate warning messages for SRQ_LIMIT under SRIOV (bsc#919382).\n- net/mlx4_core: Enhance the MAD_IFC wrapper to convert VF port to physical (bsc#919382).\n- net/mlx4_core: Fix VF overwrite of module param which disables DMFS on new probed PFs (bsc#919382).\n- net/mlx4_core: Fix when to save some qp context flags for dynamic VST to VGT transitions (bsc#919382).\n- net/mlx4_core: Get num_tc using netdev_get_num_tc (bsc#919382).\n- net/mlx4_core: Prevent VF from changing port configuration (bsc#919382).\n- net/mlx4_core: Use-after-free causes a resource leak in flow-steering detach (bsc#919382).\n- net/mlx4_core: Use cq quota in SRIOV when creating completion EQs (bsc#919382).\n- net/mlx4_en: Avoid adding steering rules with invalid ring (bsc#919382).\n- net/mlx4_en: Change the error print to debug print (bsc#919382).\n- net/mlx4_en: fix overflow in mlx4_en_init_timestamp() (bsc#919382).\n- net/mlx4_en: Fix type mismatch for 32-bit systems (bsc#919382).\n- net/mlx4_en: Resolve dividing by zero in 32-bit system (bsc#919382).\n- net/mlx4_en: Wake TX queues only when there's enough room (bsc#1039258).\n- net/mlx4: Fix the check in attaching steering rules (bsc#919382).\n- net/mlx4: Fix uninitialized fields in rule when adding promiscuous mode to device managed flow steering (bsc#919382).\n- net: wimax/i2400m: fix NULL-deref at probe (bsc#1037358).\n- netxen_nic: set rcode to the return status from the call to netxen_issue_cmd (bnc#784815 FATE#313898).\n- nfs: Avoid getting confused by confused server (bsc#1045416).\n- nfsd4: minor NFSv2/v3 write decoding cleanup (bsc#1034670).\n- nfsd: check for oversized NFSv2/v3 arguments (bsc#1034670).\n- nfsd: do not risk using duplicate owner/file/delegation ids (bsc#1029212).\n- nfsd: Don't use state id of 0 - it is reserved (bsc#1049688 bsc#1051770).\n- nfsd: stricter decoding of write-like NFSv2/v3 ops (bsc#1034670).\n- nfs: Fix another OPEN_DOWNGRADE bug (git-next).\n- nfs: fix nfs_size_to_loff_t (git-fixes).\n- nfs: Fix size of NFSACL SETACL operations (git-fixes).\n- nfs: Make nfs_readdir revalidate less often (bsc#1048232).\n- nfs: tidy up nfs_show_mountd_netid (git-fixes).\n- nfsv4: Do not call put_rpccred() under the rcu_read_lock() (git-fixes).\n- nfsv4: Fix another bug in the close/open_downgrade code (git-fixes).\n- nfsv4: fix getacl head length estimation (git-fixes).\n- nfsv4: Fix problems with close in the presence of a delegation (git-fixes).\n- nfsv4: Fix the underestimation of delegation XDR space reservation (git-fixes).\n- ocfs2: do not write error flag to user structure we cannot copy from/to (bsc#1013018).\n- ocfs2: Don't clear SGID when inheriting ACLs (bsc#1030552).\n- ocfs2: fix crash caused by stale lvb with fsdlm plugin (bsc#1013800).\n- ocfs2: fix error return code in ocfs2_info_handle_freefrag() (bsc#1013018).\n- ocfs2: NFS hangs in __ocfs2_cluster_lock due to race with ocfs2_unblock_lock (bsc#962257).\n- ocfs2: null deref on allocation error (bsc#1013018).\n- pci: Allow access to VPD attributes with size 0 (bsc#1018074).\n- pciback: only check PF if actually dealing with a VF (bsc#999245).\n- pciback: use pci_physfn() (bsc#999245).\n- pci: Fix devfn for VPD access through function 0 (bnc#943786 git-fixes).\n- perf/core: Correct event creation with PERF_FORMAT_GROUP (bnc#1013018).\n- perf/core: Fix event inheritance on fork() (bnc#1013018).\n- posix-timers: Fix stack info leak in timer_create() (bnc#1013018).\n- powerpc,cpuidle: Dont toggle CPUIDLE_FLAG_IGNORE while setting smt_snooze_delay (bsc#1023163).\n- powerpc: Drop support for pre-POWER4 cpus (fate#322495, bsc#1032471).\n- powerpc/fadump: Fix the race in crash_fadump() (bsc#1022971).\n- powerpc/fadump: Reserve memory at an offset closer to bottom of RAM (bsc#1032141).\n- powerpc/fadump: Update fadump documentation (bsc#1032141).\n- powerpc/mm: Do not alias user region to other regions below PAGE_OFFSET (bsc#928138,fate#319026).\n- powerpc/mm/hash: Check for non-kernel address in get_kernel_vsid() (fate#322495, bsc#1032471).\n- powerpc/mm/hash: Convert mask to unsigned long (fate#322495, bsc#1032471).\n- powerpc/mm/hash: Increase VA range to 128TB (fate#322495, bsc#1032471).\n- powerpc/mm/hash: Properly mask the ESID bits when building proto VSID (fate#322495, bsc#1032471).\n- powerpc/mm/hash: Support 68 bit VA (fate#322495, bsc#1032471).\n- powerpc/mm/hash: Use context ids 1-4 for the kernel (fate#322495, bsc#1032471).\n- powerpc/mm: Remove checks that TASK_SIZE_USER64 is too small (fate#322495, bsc#1032471).\n- powerpc/mm/slice: Convert slice_mask high slice to a bitmap (fate#322495, bsc#1032471).\n- powerpc/mm/slice: Fix off-by-1 error when computing slice mask (fate#322495, bsc#1032471).\n- powerpc/mm/slice: Move slice_mask struct definition to slice.c (fate#322495, bsc#1032471).\n- powerpc/mm/slice: Update slice mask printing to use bitmap printing (fate#322495, bsc#1032471).\n- powerpc/mm/slice: Update the function prototype (fate#322495, bsc#1032471).\n- powerpc/mm: use macro PGTABLE_EADDR_SIZE instead of digital (fate#322495, bsc#1032471).\n- powerpc/nvram: Fix an incorrect partition merge (bsc#1016489).\n- powerpc/pseries: Release DRC when configure_connector fails (bsc#1035777, Pending Base Kernel Fixes).\n- powerpc: Remove STAB code (fate#322495, bsc#1032471).\n- powerpc/vdso64: Use double word compare on pointers (bsc#1016489).\n- raid1: avoid unnecessary spin locks in I/O barrier code (bsc#982783,bsc#1026260).\n- random32: fix off-by-one in seeding requirement (git-fixes).\n- rcu: Call out dangers of expedited RCU primitives (bsc#1008893).\n- rcu: Direct algorithmic SRCU implementation (bsc#1008893).\n- rcu: Flip -\u003ecompleted only once per SRCU grace period (bsc#1008893).\n- rcu: Implement a variant of Peter's SRCU algorithm (bsc#1008893).\n- rcu: Increment upper bit only for srcu_read_lock() (bsc#1008893).\n- rcu: Remove fast check path from __synchronize_srcu() (bsc#1008893).\n- reiserfs: Don't clear SGID when inheriting ACLs (bsc#1030552).\n- reiserfs: don't preallocate blocks for extended attributes (bsc#990682).\n- Remove patches causing regression (bsc#1043234)\n- Remove superfluous make flags (bsc#1012422)\n- Return short read or 0 at end of a raw device, not EIO (bsc#1039594).\n- Revert 'kabi:severeties: Add splice_write_to_file PASS' This reverts commit 05ecf7ab16b2ea555fadd1ce17d8177394de88f2.\n- Revert 'math64: New div64_u64_rem helper' (bnc#938352).\n- Revert 'xfs: fix up xfs_swap_extent_forks inline extent handling (bsc#1023888).' I was baing my assumption of SLE11-SP4 needing this patch on an old kernel build (3.0.101-63). Re-testing with the latest one 3.0.101-94 shows that the issue is not present. Furthermore this one was causing some crashes. This reverts commit 16ceeac70f7286b6232861c3170ed32e39dcc68c.\n- rfkill: fix rfkill_fop_read wait_event usage (bsc#1046192).\n- s390/kmsg: add missing kmsg descriptions (bnc#1025702, LTC#151573).\n- s390/qdio: clear DSCI prior to scanning multiple input queues (bnc#1046715, LTC#156234).\n- s390/qeth: no ETH header for outbound AF_IUCV (bnc#1046715, LTC#156276).\n- s390/qeth: size calculation outbound buffers (bnc#1046715, LTC#156276).\n- s390/vmlogrdr: fix IUCV buffer allocation (bnc#1025702, LTC#152144).\n- s390/zcrypt: Introduce CEX6 toleration (FATE#321782, LTC#147505).\n- sched: Always initialize cpu-power (bnc#1013018).\n- sched: Avoid cputime scaling overflow (bnc#938352).\n- sched: Avoid prev-\u003estime underflow (bnc#938352).\n- sched/core: Fix TASK_DEAD race in finish_task_switch() (bnc#1013018).\n- sched/core: Remove false-positive warning from wake_up_process() (bnc#1044882).\n- sched/cputime: Do not scale when utime == 0 (bnc#938352).\n- sched/debug: Print the scheduler topology group mask (bnc#1013018).\n- sched: Do not account bogus utime (bnc#938352).\n- sched/fair, cpumask: Export for_each_cpu_wrap() (bnc#1013018).\n- sched/fair: Fix min_vruntime tracking (bnc#1013018).\n- sched: Fix domain iteration (bnc#1013018).\n- sched: Fix SD_OVERLAP (bnc#1013018).\n- sched/loadavg: Fix loadavg artifacts on fully idle and on fully loaded systems (bnc#1013018).\n- sched: Lower chances of cputime scaling overflow (bnc#938352).\n- sched: Move nr_cpus_allowed out of 'struct sched_rt_entity' (bnc#1013018). Prep for b60205c7c558 sched/fair: Fix min_vruntime tracking\n- sched: Rename a misleading variable in build_overlap_sched_groups() (bnc#1013018).\n- sched/rt: Fix PI handling vs. sched_setscheduler() (bnc#1013018). Prep for b60205c7c558 sched/fair: Fix min_vruntime tracking\n- sched/topology: Fix building of overlapping sched-groups (bnc#1013018).\n- sched/topology: Fix overlapping sched_group_capacity (bnc#1013018).\n- sched/topology: Fix overlapping sched_group_mask (bnc#1013018).\n- sched/topology: Move comment about asymmetric node setups (bnc#1013018).\n- sched/topology: Optimize build_group_mask() (bnc#1013018).\n- sched/topology: Refactor function build_overlap_sched_groups() (bnc#1013018).\n- sched/topology: Remove FORCE_SD_OVERLAP (bnc#1013018).\n- sched/topology: Simplify build_overlap_sched_groups() (bnc#1013018).\n- sched/topology: Verify the first group matches the child domain (bnc#1013018).\n- sched: Use swap() macro in scale_stime() (bnc#938352).\n- scsi: bnx2i: missing error code in bnx2i_ep_connect() (bsc#1048221).\n- scsi: fix race between simultaneous decrements of -\u003ehost_failed (bsc#1050154).\n- scsi: fnic: Correcting rport check location in fnic_queuecommand_lck (bsc#1035920).\n- scsi: mvsas: fix command_active typo (bsc#1050154).\n- scsi: qla2xxx: Fix scsi scan hang triggered if adapter fails during init (bsc#1050154).\n- scsi: virtio_scsi: fix memory leak on full queue condition (bsc#1028880).\n- scsi: zfcp: do not trace pure benign residual HBA responses at default level (bnc#1025702, LTC#151317).\n- scsi: zfcp: fix rport unblock race with LUN recovery (bnc#1025702, LTC#151319).\n- scsi: zfcp: fix use-after-free by not tracing WKA port open/close on failed send (bnc#1025702, LTC#151365).\n- scsi: zfcp: fix use-after-'free' in FC ingress path after TMF (bnc#1025702, LTC#151312).\n- sfc: do not device_attach if a reset is pending (bsc#909618 FATE#317521).\n- sfc: reduce severity of PIO buffer alloc failures (bsc#1019168).\n- smsc75xx: use skb_cow_head() to deal with cloned skbs (bsc#1045154).\n- splice: Stub splice_write_to_file (bsc#1043234).\n- sunrpc: Clean up the slot table allocation (bsc#1013862).\n- sunrpc: Fix a memory leak in the backchannel code (git-fixes).\n- sunrpc: Initalise the struct xprt upon allocation (bsc#1013862).\n- svcrdma: Fix send_reply() scatter/gather set-up (git-fixes).\n- target/iscsi: Fix double free in lio_target_tiqn_addtpg() (bsc#1050154).\n- tcp: abort orphan sockets stalling on zero window probes (bsc#1021913).\n- tracing: Fix syscall_*regfunc() vs copy_process() race (bnc#1042687).\n- tracing/kprobes: Enforce kprobes teardown after testing (bnc#1013018).\n- udf: Fix deadlock between writeback and udf_setsize() (bsc#1013018).\n- udf: Fix races with i_size changes during readpage (bsc#1013018).\n- Update metadata for serial fixes (bsc#1013070)\n- Update patches.fixes/nfs-svc-rdma.fix (bsc#1044854).\n- usb: cdc-acm: fix broken runtime suspend (bsc#1033771).\n- usb: cdc-acm: fix open and suspend race (bsc#1033771).\n- usb: cdc-acm: fix potential urb leak and PM imbalance in write (bsc#1033771).\n- usb: cdc-acm: fix runtime PM for control messages (bsc#1033771).\n- usb: cdc-acm: fix runtime PM imbalance at shutdown (bsc#1033771).\n- usb: cdc-acm: fix shutdown and suspend race (bsc#1033771).\n- usb: cdc-acm: fix write and resume race (bsc#1033771).\n- usb: cdc-acm: fix write and suspend race (bsc#1033771).\n- usb: class: usbtmc.c: Cleaning up uninitialized variables (bsc#1036288).\n- usb: class: usbtmc: do not print error when allocating urb fails (bsc#1036288).\n- usb: class: usbtmc: do not print on ENOMEM (bsc#1036288).\n- usb: hub: Fix crash after failure to read BOS descriptor (FATE#317453).\n- usb: iowarrior: fix info ioctl on big-endian hosts (bsc#1037441).\n- usb: iowarrior: fix NULL-deref in write (bsc#1037359).\n- usb: r8a66597-hcd: select a different endpoint on timeout (bsc#1047053).\n- usb: serial: ark3116: fix register-accessor error handling (git-fixes).\n- usb: serial: ch341: fix open error handling (bsc#1037441).\n- usb: serial: cp210x: fix tiocmget error handling (bsc#1037441).\n- usb: serial: ftdi_sio: fix line-status over-reporting (bsc#1037441).\n- usb: serial: io_edgeport: fix epic-descriptor handling (bsc#1037441).\n- usb: serial: io_ti: fix information leak in completion handler (git-fixes).\n- usb: serial: iuu_phoenix: fix NULL-deref at open (bsc#1033794).\n- usb: serial: kl5kusb105: fix line-state error handling (bsc#1021256).\n- usb: serial: mos7720: fix NULL-deref at open (bsc#1033816).\n- usb: serial: mos7720: fix parallel probe (bsc#1033816).\n- usb: serial: mos7720: fix parport use-after-free on probe errors (bsc#1033816).\n- usb: serial: mos7720: fix use-after-free on probe errors (bsc#1033816).\n- usb: serial: mos7840: fix another NULL-deref at open (bsc#1034026).\n- usb: serial: mos7840: fix NULL-deref at open (bsc#1034026).\n- usb: serial: oti6858: fix NULL-deref at open (bsc#1037441).\n- usb: serial: sierra: fix bogus alternate-setting assumption (bsc#1037441).\n- usb: serial: spcp8x5: fix NULL-deref at open (bsc#1037441).\n- usbtmc: remove redundant braces (bsc#1036288).\n- usbtmc: remove trailing spaces (bsc#1036288).\n- usb: usbip: fix nonconforming hub descriptor (bsc#1047487).\n- usb: usbtmc: add device quirk for Rigol DS6104 (bsc#1036288).\n- usb: usbtmc: Add flag rigol_quirk to usbtmc_device_data (bsc#1036288).\n- usb: usbtmc: add missing endpoint sanity check (bsc#1036288).\n- usb: usbtmc: Change magic number to constant (bsc#1036288).\n- usb: usbtmc: fix big-endian probe of Rigol devices (bsc#1036288).\n- usb: usbtmc: fix DMA on stack (bsc#1036288).\n- usb: usbtmc: fix probe error path (bsc#1036288).\n- usb: usbtmc: Set rigol_quirk if device is listed (bsc#1036288).\n- usb: usbtmc: TMC request code segregated from usbtmc_read (bsc#1036288).\n- usb: usbtmc: usbtmc_read sends multiple TMC header based on rigol_quirk (bsc#1036288).\n- usbvision: fix NULL-deref at probe (bsc#1050431).\n- usb: xhci-mem: use passed in GFP flags instead of GFP_KERNEL (bsc#1023014).\n- Use make --output-sync feature when available (bsc#1012422). The mesages in make output can interleave making it impossible to extract warnings reliably. Since version 4 GNU Make supports --output-sync flag that prints output of each sub-command atomically preventing this issue. Detect the flag and use it if available. SLE11 has make 3.81 so it is required to include make 4 in the kernel OBS projects to take advantege of this.\n- Use PF_LESS_THROTTLE in loop device thread (bsc#1027101).\n- uwb: hwa-rc: fix NULL-deref at probe (bsc#1037233).\n- uwb: i1480-dfu: fix NULL-deref at probe (bsc#1036629).\n- vb2: Fix an off by one error in 'vb2_plane_vaddr' (bsc#1050431).\n- vfs: split generic splice code from i_mutex locking (bsc#1024788).\n- vmxnet3: avoid calling pskb_may_pull with interrupts disabled (bsc#1045356).\n- vmxnet3: fix checks for dma mapping errors (bsc#1045356).\n- vmxnet3: fix lock imbalance in vmxnet3_tq_xmit() (bsc#1045356).\n- vmxnet3: segCnt can be 1 for LRO packets (bsc#988065, bsc#1029770).\n- x86, mm, paravirt: Fix vmalloc_fault oops during lazy MMU updates (bsc#948562).\n- x86/pci-calgary: Fix iommu_free() comparison of unsigned expression \u003e= 0 (bsc#1051478).\n- xen: avoid deadlock in xenbus (bnc#1047523).\n- xen-blkfront: correct maximum segment accounting (bsc#1018263).\n- xen-blkfront: do not call talk_to_blkback when already connected to blkback.\n- xen-blkfront: free resources if xlvbd_alloc_gendisk fails.\n- xen/PCI-MSI: fix sysfs teardown in DomU (bsc#986924).\n- xfrm: dst_entries_init() per-net dst_ops (bsc#1030814).\n- xfrm: NULL dereference on allocation failure (bsc#1047343).\n- xfrm: Oops on error in pfkey_msg2xfrm_state() (bsc#1047653).\n- xfs_dmapi: fix the debug compilation of xfs_dmapi (bsc#989056).\n- xfs: do not assert fail on non-async buffers on ioacct decrement (bsc#1024508).\n- xfs: exclude never-released buffers from buftarg I/O accounting (bsc#1024508).\n- xfs: fix buffer overflow dm_get_dirattrs/dm_get_dirattrs2 (bsc#989056).\n- xfs: Fix lock ordering in splice write (bsc#1024788).\n- xfs: fix up xfs_swap_extent_forks inline extent handling (bsc#1023888).\n- xfs: kill xfs_itruncate_start (bsc#1024788).\n- xfs: Make xfs_icdinode-\u003edi_dmstate atomic_t (bsc#1024788).\n- xfs: remove the i_new_size field in struct xfs_inode (bsc#1024788).\n- xfs: remove the i_size field in struct xfs_inode (bsc#1024788).\n- xfs: remove xfs_itruncate_data (bsc#1024788).\n- xfs: replace global xfslogd wq with per-mount wq (bsc#1024508).\n- xfs: split xfs_itruncate_finish (bsc#1024788).\n- xfs: split xfs_setattr (bsc#1024788).\n- xfs: Synchronize xfs_buf disposal routines (bsc#1041160).\n- xfs: track and serialize in-flight async buffers against unmount (bsc#1024508).\n- xfs: use -\u003eb_state to fix buffer I/O accounting release race (bsc#1041160).\n- xprtrdma: Free the pd if ib_query_qp() fails (git-fixes).\n","status":"published","published":"2017-09-04T13:37:48Z","modified":"2025-05-02T04:04:17.704556Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"SUSE-SU-2017:2525-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 11 SP3 LTSS kernel was updated receive various security and bugfixes.\n\nThe following security bugs were fixed:\n\n- CVE-2016-5243: The tipc_nl_compat_link_dump function in net/tipc/netlink_compat.c in the Linux kernel did not properly copy a certain string, which allowed local users to obtain sensitive information from kernel stack memory by reading a Netlink message (bnc#983212)\n- CVE-2016-10200: Race condition in the L2TPv3 IP Encapsulation feature in the Linux kernel allowed local users to gain privileges or cause a denial of service (use-after-free) by making multiple bind system calls without properly ascertaining whether a socket has the SOCK_ZAPPED status, related to net/l2tp/l2tp_ip.c and net/l2tp/l2tp_ip6.c (bnc#1028415)\n- CVE-2017-2647: The KEYS subsystem in the Linux kernel allowed local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) via vectors involving a NULL value for a certain match field, related to the keyring_search_iterator function in keyring.c (bsc#1030593).\n- CVE-2017-2671: The ping_unhash function in net/ipv4/ping.c in the Linux kernel was  too late in obtaining a certain lock and consequently could not ensure that disconnect function calls are safe, which allowed local users to cause a denial of service (panic) by leveraging access to the protocol value of IPPROTO_ICMP in a socket system call (bnc#1031003)\n- CVE-2017-5669: The do_shmat function in ipc/shm.c in the Linux kernel did not restrict the address calculated by a certain rounding operation, which allowed local users to map page zero, and consequently bypass a protection mechanism that exists for the mmap system call, by making crafted shmget and shmat system calls in a privileged context (bnc#1026914)\n- CVE-2017-5970: The ipv4_pktinfo_prepare function in net/ipv4/ip_sockglue.c in the Linux kernel allowed attackers to cause a denial of service (system crash) via (1) an application that made crafted system calls or possibly (2) IPv4 traffic with invalid IP options (bsc#1024938)\n- CVE-2017-5986: Race condition in the sctp_wait_for_sndbuf function in net/sctp/socket.c in the Linux kernel allowed local users to cause a denial of service (assertion failure and panic) via a multithreaded application that peels off an association in a certain buffer-full state (bsc#1025235)\n- CVE-2017-6074: The dccp_rcv_state_process function in net/dccp/input.c in the Linux kernel mishandled DCCP_PKT_REQUEST packet data structures in the LISTEN state, which allowed local users to obtain root privileges or cause a denial of service (double free) via an application that made an IPV6_RECVPKTINFO setsockopt system call (bnc#1026024)\n- CVE-2017-6214: The tcp_splice_read function in net/ipv4/tcp.c in the Linux kernel allowed remote attackers to cause a denial of service (infinite loop and soft lockup) via vectors involving a TCP packet with the URG flag (bnc#1026722)\n- CVE-2017-6348: The hashbin_delete function in net/irda/irqueue.c in the Linux kernel improperly managed lock dropping, which allowed local users to cause a denial of service (deadlock) via crafted operations on IrDA devices (bnc#1027178)\n- CVE-2017-6353: net/sctp/socket.c in the Linux kernel did not properly restrict association peel-off operations during certain wait states, which allowed local users to cause a denial of service (invalid unlock and double free) via a multithreaded application. NOTE: this vulnerability exists because of an incorrect fix for CVE-2017-5986 (bnc#1027066)\n- CVE-2017-6951: The keyring_search_aux function in security/keys/keyring.c in the Linux kernel allowed local users to cause a denial of service (NULL pointer dereference and OOPS) via a request_key system call for the 'dead' type (bsc#1029850).\n- CVE-2017-7184: The xfrm_replay_verify_len function in net/xfrm/xfrm_user.c in the Linux kernel did not validate certain size data after an XFRM_MSG_NEWAE update, which allowed local users to obtain root privileges or cause a denial of service (heap-based out-of-bounds access) by leveraging the CAP_NET_ADMIN capability (bsc#1030573)\n- CVE-2017-7187: The sg_ioctl function in drivers/scsi/sg.c in the Linux kernel allowed local users to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a large command size in an SG_NEXT_CMD_LEN ioctl call, leading to out-of-bounds write access in the sg_write function (bnc#1030213)\n- CVE-2017-7261: The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not check for a zero value of certain levels data, which allowed local users to cause a denial of service (ZERO_SIZE_PTR dereference, and GPF and possibly panic) via a crafted ioctl call for a /dev/dri/renderD* device (bnc#1031052)\n- CVE-2017-7294: The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not validate addition of certain levels data, which allowed local users to trigger an integer overflow and out-of-bounds write, and cause a denial of service (system hang or crash) or possibly gain privileges, via a crafted ioctl call for a /dev/dri/renderD* device (bnc#1031440)\n- CVE-2017-7308: The packet_set_ring function in net/packet/af_packet.c in the Linux kernel did not properly validate certain block-size data, which allowed local users to cause a denial of service (overflow) or possibly have unspecified other impact via crafted system calls (bnc#1031579)\n- CVE-2017-7482: Several missing length checks ticket decode allowing for information leak or potentially code execution (bsc#1046107).\n- CVE-2017-7487: The ipxitf_ioctl function in net/ipx/af_ipx.c in the Linux kernel mishandled reference counts, which allowed local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via a failed SIOCGIFADDR ioctl call for an IPX interface (bsc#1038879).\n- CVE-2017-7533: Race condition in the fsnotify implementation in the Linux kernel allowed local users to gain privileges or cause a denial of service (memory corruption) via a crafted application that leverages simultaneous execution of the inotify_handle_event and vfs_rename functions (bnc#1049483 1050677 ).\n- CVE-2017-7542: The ip6_find_1stfragopt function in net/ipv6/output_core.c in the Linux kernel allowed local users to cause a denial of service (integer overflow and infinite loop) by leveraging the ability to open a raw socket (bnc#1049882).\n- CVE-2017-7616: Incorrect error handling in the set_mempolicy and mbind compat syscalls in mm/mempolicy.c in the Linux kernel allowed local users to obtain sensitive information from uninitialized stack data by triggering failure of a certain bitmap operation (bsc#1033336)\n- CVE-2017-8831: The saa7164_bus_get function in drivers/media/pci/saa7164/saa7164-bus.c in the Linux kernel allowed local users to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact by changing a certain sequence-number value, aka a 'double fetch' vulnerability. This requires a malicious PCI Card. (bnc#1037994).\n- CVE-2017-8890: The inet_csk_clone_lock function in net/ipv4/inet_connection_sock.c in the Linux kernel allowed attackers to cause a denial of service (double free) or possibly have unspecified other impact by leveraging use of the accept system call (bsc#1038544).\n- CVE-2017-8924: The edge_bulk_in_callback function in drivers/usb/serial/io_ti.c in the Linux kernel allowed local users to obtain sensitive information (in the dmesg ringbuffer and syslog) from uninitialized kernel memory by using a crafted USB device (posing as an io_ti USB serial device) to trigger an integer underflow (bnc#1037182).\n- CVE-2017-8925: The omninet_open function in drivers/usb/serial/omninet.c in the Linux kernel allowed local users to cause a denial of service (tty exhaustion) by leveraging reference count mishandling (bnc#1038981).\n- CVE-2017-9074: The IPv6 fragmentation implementation in the Linux kernel did not consider that the nexthdr field may be associated with an invalid option, which allowed local users to cause a denial of service (out-of-bounds read and BUG) or possibly have unspecified other impact via crafted socket and send system calls (bnc#1039882).\n- CVE-2017-9075: The sctp_v6_create_accept_sk function in net/sctp/ipv6.c in the Linux kernel mishandled inheritance, which allowed local users to cause a denial of service or possibly have unspecified other impact via crafted system calls, a related issue to CVE-2017-8890 (bsc#1039883).\n- CVE-2017-9076: The dccp_v6_request_recv_sock function in net/dccp/ipv6.c in the Linux kernel mishandled inheritance, which allowed local users to cause a denial of service or possibly have unspecified other impact via crafted system calls, a related issue to CVE-2017-8890 (bnc#1039885).\n- CVE-2017-9077: The tcp_v6_syn_recv_sock function in net/ipv6/tcp_ipv6.c in the Linux kernel mishandled inheritance, which allowed local users to cause a denial of service or possibly have unspecified other impact via crafted system calls, a related issue to CVE-2017-8890 (bsc#1040069).\n- CVE-2017-9242: The __ip6_append_data function in net/ipv6/ip6_output.c in the Linux kernel was too late in checking whether an overwrite of an skb data structure may occur, which allowed local users to cause a denial of service (system crash) via crafted system calls (bnc#1041431).\n- CVE-2017-10661: Race condition in fs/timerfd.c in the Linux kernel allowed local users to gain privileges or cause a denial of service (list corruption or use-after-free) via simultaneous file-descriptor operations that leverage improper might_cancel queueing (bnc#1053152).\n- CVE-2017-11176: The mq_notify function in the Linux kernel did not set the sock pointer to NULL upon entry into the retry logic. During a user-space close of a Netlink socket, it allowed attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact (bnc#1048275).\n- CVE-2017-11473: Buffer overflow in the mp_override_legacy_irq() function in arch/x86/kernel/acpi/boot.c in the Linux kernel allowed local users to gain privileges via a crafted ACPI table (bnc#1049603).\n- CVE-2017-12762: In /drivers/isdn/i4l/isdn_net.c: A user-controlled buffer is copied into a local buffer of constant size using strcpy without a length check which can cause a buffer overflow. (bnc#1053148).\n- CVE-2017-14051: An integer overflow in the qla2x00_sysfs_write_optrom_ctl function in drivers/scsi/qla2xxx/qla_attr.c in the Linux kernel allowed local users to cause a denial of service (memory corruption and system crash) by leveraging root access (bnc#1056588).\n- CVE-2017-1000112: Fixed a race condition in net-packet code that could have been exploited by unprivileged users to gain root access. (bsc#1052311).\n- CVE-2017-1000363: Linux drivers/char/lp.c Out-of-Bounds Write. Due to a missing bounds check, and the fact that parport_ptr integer is static, a 'secure boot' kernel command line adversary  could have overflowed the parport_nr array in the following code (bnc#1039456).\n- CVE-2017-1000365: The Linux Kernel imposes a size restriction on the arguments and environmental strings passed through RLIMIT_STACK/RLIM_INFINITY (1/4 of the size), but did not take the argument and environment pointers into account, which allowed attackers to bypass this limitation (bnc#1039354).\n- CVE-2017-1000380: sound/core/timer.c in the Linux kernel was vulnerable to a data race in the ALSA /dev/snd/timer driver resulting in local users being able to read information belonging to other users, i.e., uninitialized memory contents may be disclosed when a read and an ioctl happen at the same time (bnc#1044125).\n\nThe following non-security bugs were fixed:\n\n- acpi: Disable APEI error injection if securelevel is set (bsc#972891, bsc#1023051).\n- blkback/blktap: do not leak stack data via response ring (bsc#1042863 XSA-216).\n- btrfs: cleanup code of btrfs_balance_delayed_items() (bsc#1034838).\n- btrfs: do not run delayed nodes again after all nodes flush (bsc#1034838).\n- btrfs: remove btrfs_end_transaction_dmeta() (bsc#1034838).\n- btrfs: remove residual code in delayed inode async helper (bsc#1034838).\n- btrfs: use flags instead of the bool variants in delayed node (bsc#1034838).\n- cifs: cifs_get_root shouldn't use path with tree name, alternate fix (bsc#963655, bsc#979681, bsc#1027406).\n- dentry name snapshots (bsc#1049483).\n- firmware: fix directory creation rule matching with make 3.80 (bsc#1012422).\n- firmware: fix directory creation rule matching with make 3.82 (bsc#1012422).\n- Fix vmalloc_fault oops during lazy MMU updates (bsc#948562) (bsc#948562).\n- hv: do not lose pending heartbeat vmbus packets (bnc#1006919, bnc#1053760).\n- jbd: do not wait (forever) for stale tid caused by wraparound (bsc#1020229).\n- jbd: Fix oops in journal_remove_journal_head() (bsc#1017143).\n- kernel-binary.spec: Propagate MAKE_ARGS to %build (bsc#1012422)\n- keys: Disallow keyrings beginning with '.' to be joined as session keyrings (bnc#1035576).\n- nfs: Avoid getting confused by confused server (bsc#1045416).\n- nfsd4: minor NFSv2/v3 write decoding cleanup (bsc#1034670).\n- nfsd: check for oversized NFSv2/v3 arguments (bsc#1034670).\n- nfsd: do not risk using duplicate owner/file/delegation ids (bsc#1029212).\n- nfsd: stricter decoding of write-like NFSv2/v3 ops (bsc#1034670).\n- nfs: Make nfs_readdir revalidate less often (bsc#1048232).\n- pciback: check PF instead of VF for PCI_COMMAND_MEMORY (bsc#957990).\n- pciback: only check PF if actually dealing with a VF (bsc#999245).\n- pciback: Save the number of MSI-X entries to be copied later (bsc#957988).\n- Remove superfluous make flags (bsc#1012422)\n- Return short read or 0 at end of a raw device, not EIO (bsc#1039594).\n- Revert 'fs/cifs: fix wrongly prefixed path to root (bsc#963655, bsc#979681)\n- scsi: lpfc: avoid double free of resource identifiers (bsc#989896).\n- scsi: virtio_scsi: fix memory leak on full queue condition (bsc#1028880).\n- sunrpc: Clean up the slot table allocation (bsc#1013862).\n- sunrpc: Initalise the struct xprt upon allocation (bsc#1013862).\n- usb: serial: kl5kusb105: fix line-state error handling (bsc#1021256).\n- usb: wusbcore: fix NULL-deref at probe (bsc#1045487).\n- Use make --output-sync feature when available (bsc#1012422). \n- Use PF_LESS_THROTTLE in loop device thread (bsc#1027101).\n- xen/PCI-MSI: fix sysfs teardown in DomU (bsc#986924).\n","status":"published","published":"2017-09-19T08:33:08Z","modified":"2026-02-04T04:14:57.335109Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"USN-3265-1","title":"linux, linux-aws, linux-gke, linux-raspi2, linux-snapdragon vulnerabilities","description":"It was discovered that a use-after-free flaw existed in the filesystem\nencryption subsystem in the Linux kernel. A local attacker could use this\nto cause a denial of service (system crash). (CVE-2017-7374)\n\nAndrey Konovalov discovered an out-of-bounds access in the IPv6 Generic\nRouting Encapsulation (GRE) tunneling implementation in the Linux kernel.\nAn attacker could use this to possibly expose sensitive information.\n(CVE-2017-5897)\n\nAndrey Konovalov discovered that the IPv4 implementation in the Linux\nkernel did not properly handle invalid IP options in some situations. An\nattacker could use this to cause a denial of service or possibly execute\narbitrary code. (CVE-2017-5970)\n\nGareth Evans discovered that the shm IPC subsystem in the Linux kernel did\nnot properly restrict mapping page zero. A local privileged attacker could\nuse this to execute arbitrary code. (CVE-2017-5669)\n\nAlexander Popov discovered that a race condition existed in the Stream\nControl Transmission Protocol (SCTP) implementation in the Linux kernel. A\nlocal attacker could use this to cause a denial of service (system crash).\n(CVE-2017-5986)\n\nDmitry Vyukov discovered that the Linux kernel did not properly handle TCP\npackets with the URG flag. A remote attacker could use this to cause a\ndenial of service. (CVE-2017-6214)\n\nAndrey Konovalov discovered that the LLC subsytem in the Linux kernel did\nnot properly set up a destructor in certain situations. A local attacker\ncould use this to cause a denial of service (system crash). (CVE-2017-6345)\n\nIt was discovered that a race condition existed in the AF_PACKET handling\ncode in the Linux kernel. A local attacker could use this to cause a denial\nof service (system crash) or possibly execute arbitrary code.\n(CVE-2017-6346)\n\nAndrey Konovalov discovered that the IP layer in the Linux kernel made\nimproper assumptions about internal data layout when performing checksums.\nA local attacker could use this to cause a denial of service (system crash)\nor possibly execute arbitrary code. (CVE-2017-6347)\n\nDmitry Vyukov discovered race conditions in the Infrared (IrDA) subsystem\nin the Linux kernel. A local attacker could use this to cause a denial of\nservice (deadlock). (CVE-2017-6348)\n","status":"published","published":"2017-04-25T01:26:56Z","modified":"2026-04-22T09:34:09.586375Z","updated_at":"2026-11-02T16:58:10.303275Z"},{"id":"USN-3265-2","title":"linux-lts-xenial vulnerabilities","description":"USN-3265-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04\nLTS. This update provides the corresponding updates for the Linux\nHardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu\n14.04 LTS.\n\nIt was discovered that a use-after-free flaw existed in the filesystem\nencryption subsystem in the Linux kernel. A local attacker could use this\nto cause a denial of service (system crash). (CVE-2017-7374)\n\nAndrey Konovalov discovered an out-of-bounds access in the IPv6 Generic\nRouting Encapsulation (GRE) tunneling implementation in the Linux kernel.\nAn attacker could use this to possibly expose sensitive information.\n(CVE-2017-5897)\n\nAndrey Konovalov discovered that the IPv4 implementation in the Linux\nkernel did not properly handle invalid IP options in some situations. An\nattacker could use this to cause a denial of service or possibly execute\narbitrary code. (CVE-2017-5970)\n\nGareth Evans discovered that the shm IPC subsystem in the Linux kernel did\nnot properly restrict mapping page zero. A local privileged attacker could\nuse this to execute arbitrary code. (CVE-2017-5669)\n\nAlexander Popov discovered that a race condition existed in the Stream\nControl Transmission Protocol (SCTP) implementation in the Linux kernel. A\nlocal attacker could use this to cause a denial of service (system crash).\n(CVE-2017-5986)\n\nDmitry Vyukov discovered that the Linux kernel did not properly handle TCP\npackets with the URG flag. A remote attacker could use this to cause a\ndenial of service. (CVE-2017-6214)\n\nAndrey Konovalov discovered that the LLC subsytem in the Linux kernel did\nnot properly set up a destructor in certain situations. A local attacker\ncould use this to cause a denial of service (system crash). (CVE-2017-6345)\n\nIt was discovered that a race condition existed in the AF_PACKET handling\ncode in the Linux kernel. A local attacker could use this to cause a denial\nof service (system crash) or possibly execute arbitrary code.\n(CVE-2017-6346)\n\nAndrey Konovalov discovered that the IP layer in the Linux kernel made\nimproper assumptions about internal data layout when performing checksums.\nA local attacker could use this to cause a denial of service (system crash)\nor possibly execute arbitrary code. (CVE-2017-6347)\n\nDmitry Vyukov discovered race conditions in the Infrared (IrDA) subsystem\nin the Linux kernel. A local attacker could use this to cause a denial of\nservice (deadlock). (CVE-2017-6348)\n","status":"published","published":"2017-04-25T01:47:26Z","modified":"2026-02-10T04:41:07Z","updated_at":"2026-11-02T16:58:10.303275Z"},{"id":"USN-3361-1","title":"linux-hwe vulnerabilities","description":"USN-3358-1 fixed vulnerabilities in the Linux kernel for Ubuntu 17.04.\nThis update provides the corresponding updates for the Linux Hardware\nEnablement (HWE) kernel from Ubuntu 17.04 for Ubuntu 16.04 LTS. Please\nnote that this update changes the Linux HWE kernel to the 4.10 based\nkernel from Ubuntu 17.04, superseding the 4.8 based HWE kernel from\nUbuntu 16.10.\n\nBen Harris discovered that the Linux kernel would strip extended privilege\nattributes of files when performing a failed unprivileged system call. A\nlocal attacker could use this to cause a denial of service. (CVE-2015-1350)\n\nRalf Spenneberg discovered that the ext4 implementation in the Linux kernel\ndid not properly validate meta block groups. An attacker with physical\naccess could use this to specially craft an ext4 image that causes a denial\nof service (system crash). (CVE-2016-10208)\n\nPeter Pi discovered that the colormap handling for frame buffer devices in\nthe Linux kernel contained an integer overflow. A local attacker could use\nthis to disclose sensitive information (kernel memory). (CVE-2016-8405)\n\nIt was discovered that an integer overflow existed in the InfiniBand RDMA\nover ethernet (RXE) transport implementation in the Linux kernel. A local\nattacker could use this to cause a denial of service (system crash) or\npossibly execute arbitrary code. (CVE-2016-8636)\n\nVlad Tsyrklevich discovered an integer overflow vulnerability in the VFIO\nPCI driver for the Linux kernel. A local attacker with access to a vfio PCI\ndevice file could use this to cause a denial of service (system crash) or\npossibly execute arbitrary code. (CVE-2016-9083, CVE-2016-9084)\n\nCAI Qian discovered that the sysctl implementation in the Linux kernel did\nnot properly perform reference counting in some situations. An unprivileged\nattacker could use this to cause a denial of service (system hang).\n(CVE-2016-9191)\n\nIt was discovered that the keyring implementation in the Linux kernel in\nsome situations did not prevent special internal keyrings from being joined\nby userspace keyrings. A privileged local attacker could use this to bypass\nmodule verification. (CVE-2016-9604)\n\nDmitry Vyukov, Andrey Konovalov, Florian Westphal, and Eric Dumazet\ndiscovered that the netfiler subsystem in the Linux kernel mishandled IPv6\npacket reassembly. A local user could use this to cause a denial of service\n(system crash) or possibly execute arbitrary code. (CVE-2016-9755)\n\nAndy Lutomirski and Willy Tarreau discovered that the KVM implementation in\nthe Linux kernel did not properly emulate instructions on the SS segment\nregister. A local attacker in a guest virtual machine could use this to\ncause a denial of service (guest OS crash) or possibly gain administrative\nprivileges in the guest OS. (CVE-2017-2583)\n\nDmitry Vyukov discovered that the KVM implementation in the Linux kernel\nimproperly emulated certain instructions. A local attacker could use this\nto obtain sensitive information (kernel memory). (CVE-2017-2584)\n\nDmitry Vyukov discovered that KVM implementation in the Linux kernel\nimproperly emulated the VMXON instruction. A local attacker in a guest OS\ncould use this to cause a denial of service (memory consumption) in the\nhost OS. (CVE-2017-2596)\n\nIt was discovered that SELinux in the Linux kernel did not properly handle\nempty writes to /proc/pid/attr. A local attacker could use this to cause a\ndenial of service (system crash). (CVE-2017-2618)\n\nDaniel Jiang discovered that a race condition existed in the ipv4 ping\nsocket implementation in the Linux kernel. A local privileged attacker\ncould use this to cause a denial of service (system crash). (CVE-2017-2671)\n\nIt was discovered that the freelist-randomization in the SLAB memory\nallocator allowed duplicate freelist entries. A local attacker could use\nthis to cause a denial of service (system crash). (CVE-2017-5546)\n\nIt was discovered that the KLSI KL5KUSB105 serial-to-USB device driver in\nthe Linux kernel did not properly initialize memory related to logging. A\nlocal attacker could use this to expose sensitive information (kernel\nmemory). (CVE-2017-5549)\n\nIt was discovered that a fencepost error existed in the pipe_advance()\nfunction in the Linux kernel. A local attacker could use this to expose\nsensitive information (kernel memory). (CVE-2017-5550)\n\nIt was discovered that the Linux kernel did not clear the setgid bit during\na setxattr call on a tmpfs filesystem. A local attacker could use this to\ngain elevated group privileges. (CVE-2017-5551)\n\nMurray McAllister discovered that an integer overflow existed in the\nVideoCore DRM driver of the Linux kernel. A local attacker could use this\nto cause a denial of service (system crash) or possibly execute arbitrary\ncode. (CVE-2017-5576)\n\nGareth Evans discovered that the shm IPC subsystem in the Linux kernel did\nnot properly restrict mapping page zero. A local privileged attacker could\nuse this to execute arbitrary code. (CVE-2017-5669)\n\nAndrey Konovalov discovered an out-of-bounds access in the IPv6 Generic\nRouting Encapsulation (GRE) tunneling implementation in the Linux kernel.\nAn attacker could use this to possibly expose sensitive information.\n(CVE-2017-5897)\n\nAndrey Konovalov discovered that the IPv4 implementation in the Linux\nkernel did not properly handle invalid IP options in some situations. An\nattacker could use this to cause a denial of service or possibly execute\narbitrary code. (CVE-2017-5970)\n\nDi Shen discovered that a race condition existed in the perf subsystem of\nthe Linux kernel. A local attacker could use this to cause a denial of\nservice or possibly gain administrative privileges. (CVE-2017-6001)\n\nDmitry Vyukov discovered that the Linux kernel did not properly handle TCP\npackets with the URG flag. A remote attacker could use this to cause a\ndenial of service. (CVE-2017-6214)\n\nAndrey Konovalov discovered that the LLC subsytem in the Linux kernel did\nnot properly set up a destructor in certain situations. A local attacker\ncould use this to cause a denial of service (system crash). (CVE-2017-6345)\n\nIt was discovered that a race condition existed in the AF_PACKET handling\ncode in the Linux kernel. A local attacker could use this to cause a denial\nof service (system crash) or possibly execute arbitrary code.\n(CVE-2017-6346)\n\nAndrey Konovalov discovered that the IP layer in the Linux kernel made\nimproper assumptions about internal data layout when performing checksums.\nA local attacker could use this to cause a denial of service (system crash)\nor possibly execute arbitrary code. (CVE-2017-6347)\n\nDmitry Vyukov discovered race conditions in the Infrared (IrDA) subsystem\nin the Linux kernel. A local attacker could use this to cause a denial of\nservice (deadlock). (CVE-2017-6348)\n\nDmitry Vyukov discovered that the generic SCSI (sg) subsystem in the Linux\nkernel contained a stack-based buffer overflow. A local attacker with\naccess to an sg device could use this to cause a denial of service (system\ncrash) or possibly execute arbitrary code. (CVE-2017-7187)\n\nIt was discovered that a NULL pointer dereference existed in the Direct\nRendering Manager (DRM) driver for VMWare devices in the Linux kernel. A\nlocal attacker could use this to cause a denial of service (system crash).\n(CVE-2017-7261)\n\nIt was discovered that the USB Cypress HID drivers for the Linux kernel did\nnot properly validate reported information from the device. An attacker\nwith physical access could use this to expose sensitive information (kernel\nmemory). (CVE-2017-7273)\n\nEric Biggers discovered a memory leak in the keyring implementation in the\nLinux kernel. A local attacker could use this to cause a denial of service\n(memory consumption). (CVE-2017-7472)\n\nIt was discovered that an information leak existed in the set_mempolicy and\nmbind compat syscalls in the Linux kernel. A local attacker could use this\nto expose sensitive information (kernel memory). (CVE-2017-7616)\n\nSabrina Dubroca discovered that the asynchronous cryptographic hash (ahash)\nimplementation in the Linux kernel did not properly handle a full request\nqueue. A local attacker could use this to cause a denial of service\n(infinite recursion). (CVE-2017-7618)\n\nTuomas Haanpää and Ari Kauppi discovered that the NFSv2 and NFSv3 server\nimplementations in the Linux kernel did not properly handle certain long\nRPC replies. A remote attacker could use this to cause a denial of service\n(system crash). (CVE-2017-7645)\n\nTommi Rantala and Brad Spengler discovered that the memory manager in the\nLinux kernel did not properly enforce the CONFIG_STRICT_DEVMEM protection\nmechanism. A local attacker with access to /dev/mem could use this to\nexpose sensitive information or possibly execute arbitrary code.\n(CVE-2017-7889)\n\nTuomas Haanpää and Ari Kauppi discovered that the NFSv2 and NFSv3 server\nimplementations in the Linux kernel did not properly check for the end of\nbuffer. A remote attacker could use this to craft requests that cause a\ndenial of service (system crash) or possibly execute arbitrary code.\n(CVE-2017-7895)\n\nIt was discovered that an integer underflow existed in the Edgeport USB\nSerial Converter device driver of the Linux kernel. An attacker with\nphysical access could use this to expose sensitive information (kernel\nmemory). (CVE-2017-8924)\n\nIt was discovered that the USB ZyXEL omni.net LCD PLUS driver in the Linux\nkernel did not properly perform reference counting. A local attacker could\nuse this to cause a denial of service (tty exhaustion). (CVE-2017-8925)\n\nJann Horn discovered that bpf in Linux kernel does not restrict the output\nof the print_bpf_insn function. A local attacker could use this to obtain\nsensitive address information. (CVE-2017-9150)\n","status":"published","published":"2017-07-21T09:59:15Z","modified":"2026-06-03T14:04:19.16359445Z","updated_at":"2026-11-02T16:58:13.496563Z"},{"id":"USN-3583-1","title":"linux vulnerabilities","description":"It was discovered that an out-of-bounds write vulnerability existed in the\nFlash-Friendly File System (f2fs) in the Linux kernel. An attacker could\nconstruct a malicious file system that, when mounted, could cause a denial\nof service (system crash) or possibly execute arbitrary code.\n(CVE-2017-0750)\n\nIt was discovered that a race condition leading to a use-after-free\nvulnerability existed in the ALSA PCM subsystem of the Linux kernel. A\nlocal attacker could use this to cause a denial of service (system crash)\nor possibly execute arbitrary code. (CVE-2017-0861)\n\nIt was discovered that the KVM implementation in the Linux kernel allowed\npassthrough of the diagnostic I/O port 0x80. An attacker in a guest VM\ncould use this to cause a denial of service (system crash) in the host OS.\n(CVE-2017-1000407)\n\nBo Zhang discovered that the netlink wireless configuration interface in\nthe Linux kernel did not properly validate attributes when handling certain\nrequests. A local attacker with the CAP_NET_ADMIN could use this to cause a\ndenial of service (system crash). (CVE-2017-12153)\n\nVitaly Mayatskikh discovered that the SCSI subsystem in the Linux kernel\ndid not properly track reference counts when merging buffers. A local\nattacker could use this to cause a denial of service (memory exhaustion).\n(CVE-2017-12190)\n\nIt was discovered that the key management subsystem in the Linux kernel did\nnot properly restrict key reads on negatively instantiated keys. A local\nattacker could use this to cause a denial of service (system crash).\n(CVE-2017-12192)\n\nIt was discovered that an integer overflow existed in the sysfs interface\nfor the QLogic 24xx+ series SCSI driver in the Linux kernel. A local\nprivileged attacker could use this to cause a denial of service (system\ncrash). (CVE-2017-14051)\n\nOtto Ebeling discovered that the memory manager in the Linux kernel did not\nproperly check the effective UID in some situations. A local attacker could\nuse this to expose sensitive information. (CVE-2017-14140)\n\nIt was discovered that the ATI Radeon framebuffer driver in the Linux\nkernel did not properly initialize a data structure returned to user space.\nA local attacker could use this to expose sensitive information (kernel\nmemory). (CVE-2017-14156)\n\nChunYu Wang discovered that the iSCSI transport implementation in the Linux\nkernel did not properly validate data structures. A local attacker could\nuse this to cause a denial of service (system crash). (CVE-2017-14489)\n\nJames Patrick-Evans discovered a race condition in the LEGO USB Infrared\nTower driver in the Linux kernel. A physically proximate attacker could use\nthis to cause a denial of service (system crash) or possibly execute\narbitrary code. (CVE-2017-15102)\n\nChunYu Wang discovered that a use-after-free vulnerability existed in the\nSCTP protocol implementation in the Linux kernel. A local attacker could\nuse this to cause a denial of service (system crash) or possibly execute\narbitrary code, (CVE-2017-15115)\n\nIt was discovered that the key management subsystem in the Linux kernel did\nnot properly handle NULL payloads with non-zero length values. A local\nattacker could use this to cause a denial of service (system crash).\n(CVE-2017-15274)\n\nIt was discovered that the Bluebooth Network Encapsulation Protocol (BNEP)\nimplementation in the Linux kernel did not validate the type of socket\npassed in the BNEPCONNADD ioctl(). A local attacker with the CAP_NET_ADMIN\nprivilege could use this to cause a denial of service (system crash) or\npossibly execute arbitrary code. (CVE-2017-15868)\n\nAndrey Konovalov discovered a use-after-free vulnerability in the USB\nserial console driver in the Linux kernel. A physically proximate attacker\ncould use this to cause a denial of service (system crash) or possibly\nexecute arbitrary code. (CVE-2017-16525)\n\nIt was discovered that the netfilter passive OS fingerprinting (xt_osf)\nmodule did not properly perform access control checks. A local attacker\ncould improperly modify the system-wide OS fingerprint list.\n(CVE-2017-17450)\n\nIt was discovered that the HMAC implementation did not validate the state\nof the underlying cryptographic hash algorithm. A local attacker could use\nthis to cause a denial of service (system crash) or possibly execute\narbitrary code. (CVE-2017-17806)\n\nDenys Fedoryshchenko discovered a use-after-free vulnerability in the\nnetfilter xt_TCPMSS filter of the Linux kernel. A remote attacker could use\nthis to cause a denial of service (system crash). (CVE-2017-18017)\n\nGareth Evans discovered that the shm IPC subsystem in the Linux kernel did\nnot properly restrict mapping page zero. A local privileged attacker could\nuse this to execute arbitrary code. (CVE-2017-5669)\n\nIt was discovered that an integer overflow vulnerability existing in the\nIPv6 implementation in the Linux kernel. A local attacker could use this to\ncause a denial of service (infinite loop). (CVE-2017-7542)\n\nTommi Rantala and Brad Spengler discovered that the memory manager in the\nLinux kernel did not properly enforce the CONFIG_STRICT_DEVMEM protection\nmechanism. A local attacker with access to /dev/mem could use this to\nexpose sensitive information or possibly execute arbitrary code.\n(CVE-2017-7889)\n\nMohamed Ghannam discovered a use-after-free vulnerability in the DCCP\nprotocol implementation in the Linux kernel. A local attacker could use\nthis to cause a denial of service (system crash) or possibly execute\narbitrary code. (CVE-2017-8824)\n\nMohamed Ghannam discovered a null pointer dereference in the RDS (Reliable\nDatagram Sockets) protocol implementation of the Linux kernel. A local\nattacker could use this to cause a denial of service (system crash).\n(CVE-2018-5333)\n\n范龙飞 discovered that a race condition existed in loop block device\nimplementation in the Linux kernel. A local attacker could use this to\ncause a denial of service (system crash) or possibly execute arbitrary\ncode. (CVE-2018-5344)\n\nUSN-3524-1 mitigated CVE-2017-5754 (Meltdown) for the amd64\narchitecture in Ubuntu 14.04 LTS. This update provides the\ncorresponding mitigations for the ppc64el architecture. Original\nadvisory details:\n\n Jann Horn discovered that microprocessors utilizing speculative execution\n and indirect branch prediction may allow unauthorized memory reads via\n sidechannel attacks. This flaw is known as Meltdown. A local attacker could\n use this to expose sensitive information, including kernel memory.\n (CVE-2017-5754)\n\n","status":"published","published":"2018-02-23T09:14:24Z","modified":"2026-04-22T09:43:37.619348Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}