{"id":"CVE-2017-7472","aliases":["CLSA-2021-1634922728","CLSA-2022-1650576075","DEBIAN-CVE-2017-7472","DLA-922-1","EUVD-2017-16495","GHSA-77r7-v55r-g5r7","MGASA-2017-0136","MGASA-2017-0147","MGASA-2017-0148","RHSA-2018:0151","RHSA-2018:0152","RHSA-2018:0181","SUSE-SU-2018:0011-1","SUSE-SU-2018:0040-1","SUSE-SU-2018:0180-1","SUSE-SU-2019:1289-1","UBUNTU-CVE-2017-7472","USN-3312-1","USN-3312-2","USN-3361-1","USN-3422-1"],"status":"published","title":"The KEYS subsystem in the Linux kernel before 4.10.13 allows local users to cause a denial of...","description":"The KEYS subsystem in the Linux kernel before 4.10.13 allows local users to cause a denial of service (memory consumption) via a series of KEY_REQKEY_DEFL_THREAD_KEYRING keyctl_set_reqkey_keyring calls.","severity":{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02263,"percentile":0.83115,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-404"],"published":"2017-04-28T00:00:00Z","modified":"2026-10-21T10:47:44Z","exploits":[{"source":"exploitdb","id":"EDB-42136","title":"Linux Kernel \u003c 4.10.13 - 'keyctl_set_reqkey_keyring' Local Denial of Service","type":"dos","platform":"linux","date":"2017-06-07","verified":true,"url":"https://www.exploit-db.com/exploits/42136"},{"source":"pocgithub","id":"homjxi0e/CVE-2017-7472","title":"homjxi0e/CVE-2017-7472","date":"2017-06-08","url":"https://github.com/homjxi0e/CVE-2017-7472"}],"fixes":[{"ecosystem":"Debian:12","package":"linux","fixed_in":["4.9.25-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"linux","fixed_in":["4.9.25-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"linux","fixed_in":["4.9.25-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"linux","fixed_in":["3.13.0-132.181"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-xenial","fixed_in":["4.4.0-79.100~14.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"linux","fixed_in":["4.4.0-79.100"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"linux-aws","fixed_in":["4.4.0-1018.27"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"linux-gke","fixed_in":["4.4.0-1014.14"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"linux-hwe","fixed_in":["4.10.0-32.36~16.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"linux-raspi2","fixed_in":["4.4.0-1057.64"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"linux-snapdragon","fixed_in":["4.4.0-1059.63"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.32-754.35.2.el6"}]}],"bundled":22},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"kernel-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.32-754.35.2.el6"}]}],"bundled":22},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"kernel-debug-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.32-754.35.2.el6"}]}],"bundled":22},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"kernel-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.32-754.35.2.el6"}]}],"bundled":22},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"kernel-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.32-754.35.2.el6"}]}],"bundled":22},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"perf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.32-754.35.2.el6"}]}],"bundled":22},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"python-perf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.32-754.35.2.el6"}]}],"bundled":22},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.32-754.35.2.el6"}]}],"bundled":13},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"kernel-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.32-754.35.2.el6"}]}],"bundled":13},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"kernel-debug-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.32-754.35.2.el6"}]}],"bundled":13},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"kernel-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.32-754.35.2.el6"}]}],"bundled":13},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"kernel-firmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.32-754.35.2.el6"}]}],"bundled":13},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"kernel-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.32-754.35.2.el6"}]}],"bundled":13},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"perf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.32-754.35.2.el6"}]}],"bundled":13},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"python-perf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.32-754.35.2.el6"}]}],"bundled":13},{"source":"osv","ecosystem":"Debian:12","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.25-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.25-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.25-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.88-1"}]}],"versions":["3.2.41-2","3.2.41-2+deb7u1","3.2.41-2+deb7u2","3.2.41-2+deb7u2~bpo60+1","3.2.46-1","3.2.46-1+deb7u1","3.2.46-1+deb7u1~bpo60+1","3.2.46-1~bpo60+1","3.2.51-1","3.2.51-1~bpo60+1","3.2.53-1","3.2.53-2","3.2.54-1","3.2.54-2","3.2.54-2~bpo60+1","3.2.57-1","3.2.57-2","3.2.57-3","3.2.57-3+deb7u1","3.2.57-3+deb7u2","3.2.57-3+deb7u2~bpo60+1","3.2.60-1","3.2.60-1+deb7u1","3.2.60-1+deb7u2","3.2.60-1+deb7u3","3.2.60-1+deb7u3~bpo60+1","3.2.63-1","3.2.63-2","3.2.63-2+deb7u1","3.2.63-2+deb7u1~bpo60+1","3.2.63-2+deb7u2","3.2.63-2+deb7u2~bpo60+1","3.2.65-1","3.2.65-1+deb7u1","3.2.65-1+deb7u1~bpo60+1","3.2.65-1+deb7u2","3.2.65-1+deb7u2~bpo60+1","3.2.68-1","3.2.68-1+deb7u1","3.2.68-1+deb7u1~bpo60+1","3.2.68-1+deb7u2","3.2.68-1+deb7u2~bpo60+1","3.2.68-1+deb7u3","3.2.68-1+deb7u3~bpo60+1","3.2.68-1+deb7u4","3.2.68-1+deb7u4~bpo60+1","3.2.68-1+deb7u5","3.2.68-1+deb7u6","3.2.68-1+deb7u6~bpo60+1","3.2.71-1","3.2.71-2","3.2.73-1","3.2.73-2","3.2.73-2+deb7u1","3.2.73-2+deb7u2","3.2.73-2+deb7u2~bpo60+1","3.2.73-2+deb7u3","3.2.78-1","3.2.81-1","3.2.81-2","3.2.82-1","3.2.84-1","3.2.84-2","3.2.86-1"],"bundled":15},{"source":"osv","ecosystem":"Mageia:5","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.65-1.mga5"}]}],"bundled":13},{"source":"osv","ecosystem":"Mageia:5","package":"kernel-userspace-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.65-1.mga5"}]}],"bundled":13},{"source":"osv","ecosystem":"Mageia:5","package":"kmod-vboxadditions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.22-2.mga5"}]}],"bundled":13},{"source":"osv","ecosystem":"Mageia:5","package":"kmod-virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.22-2.mga5"}]}],"bundled":13},{"source":"osv","ecosystem":"Mageia:5","package":"kmod-xtables-addons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10-37.mga5"}]}],"bundled":13},{"source":"osv","ecosystem":"Mageia:5","package":"kernel-tmb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.68-1.mga5"}]}],"bundled":15},{"source":"osv","ecosystem":"Mageia:5","package":"kernel-linus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.68-1.mga5"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"kernel-abi-whitelists","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"kernel-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"kernel-debug-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"kernel-debug-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"kernel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"kernel-debuginfo-common-x86_64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"kernel-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"kernel-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"kernel-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"kernel-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"kernel-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"kernel-tools-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"perf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"perf-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"python-perf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"python-perf-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"kernel-tools-libs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"kernel-abi-whitelists","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"kernel-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"kernel-debug-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"kernel-debug-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"kernel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"kernel-debuginfo-common-x86_64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"kernel-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"kernel-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"kernel-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"kernel-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"kernel-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"kernel-tools-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"perf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"perf-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"python-perf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"python-perf-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"kernel-tools-libs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"kernel-abi-whitelists","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"kernel-bootwrapper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"kernel-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"kernel-debug-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"kernel-debug-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"kernel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"kernel-debuginfo-common-ppc64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"kernel-debuginfo-common-ppc64le","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"kernel-debuginfo-common-s390x","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"kernel-debuginfo-common-x86_64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"kernel-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"kernel-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"kernel-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"kernel-kdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"kernel-kdump-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"kernel-kdump-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"kernel-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"kernel-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"kernel-tools-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"perf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"perf-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"python-perf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"python-perf-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"kernel-tools-libs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"kernel-abi-whitelists","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"kernel-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"kernel-debug-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"kernel-debug-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"kernel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"kernel-debuginfo-common-x86_64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"kernel-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"kernel-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"kernel-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"kernel-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"kernel-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"kernel-tools-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"perf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"perf-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"python-perf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"python-perf-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"kernel-tools-libs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_extras_rt:7","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.rt56.636.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_extras_rt:7","package":"kernel-rt-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.rt56.636.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_extras_rt:7","package":"kernel-rt-debug-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.rt56.636.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_extras_rt:7","package":"kernel-rt-debug-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.rt56.636.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_extras_rt:7","package":"kernel-rt-debug-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.rt56.636.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_extras_rt:7","package":"kernel-rt-debug-kvm-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.rt56.636.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_extras_rt:7","package":"kernel-rt-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.rt56.636.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_extras_rt:7","package":"kernel-rt-debuginfo-common-x86_64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.rt56.636.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_extras_rt:7","package":"kernel-rt-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.rt56.636.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_extras_rt:7","package":"kernel-rt-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.rt56.636.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_extras_rt:7","package":"kernel-rt-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.rt56.636.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_extras_rt:7","package":"kernel-rt-kvm-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.rt56.636.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_extras_rt:7","package":"kernel-rt-trace","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.rt56.636.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_extras_rt:7","package":"kernel-rt-trace-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.rt56.636.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_extras_rt:7","package":"kernel-rt-trace-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.rt56.636.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_extras_rt:7","package":"kernel-rt-trace-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.rt56.636.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_extras_rt:7","package":"kernel-rt-trace-kvm-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-693.17.1.rt56.636.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_mrg:2:server:el6","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.10.0-693.17.1.rt56.604.el6rt"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_mrg:2:server:el6","package":"kernel-rt-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.10.0-693.17.1.rt56.604.el6rt"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_mrg:2:server:el6","package":"kernel-rt-debug-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.10.0-693.17.1.rt56.604.el6rt"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_mrg:2:server:el6","package":"kernel-rt-debug-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.10.0-693.17.1.rt56.604.el6rt"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_mrg:2:server:el6","package":"kernel-rt-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.10.0-693.17.1.rt56.604.el6rt"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_mrg:2:server:el6","package":"kernel-rt-debuginfo-common-x86_64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.10.0-693.17.1.rt56.604.el6rt"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_mrg:2:server:el6","package":"kernel-rt-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.10.0-693.17.1.rt56.604.el6rt"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_mrg:2:server:el6","package":"kernel-rt-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.10.0-693.17.1.rt56.604.el6rt"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_mrg:2:server:el6","package":"kernel-rt-firmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.10.0-693.17.1.rt56.604.el6rt"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_mrg:2:server:el6","package":"kernel-rt-trace","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.10.0-693.17.1.rt56.604.el6rt"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_mrg:2:server:el6","package":"kernel-rt-trace-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.10.0-693.17.1.rt56.604.el6rt"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_mrg:2:server:el6","package":"kernel-rt-trace-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.10.0-693.17.1.rt56.604.el6rt"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_mrg:2:server:el6","package":"kernel-rt-vanilla","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.10.0-693.17.1.rt56.604.el6rt"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_mrg:2:server:el6","package":"kernel-rt-vanilla-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.10.0-693.17.1.rt56.604.el6rt"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_mrg:2:server:el6","package":"kernel-rt-vanilla-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.10.0-693.17.1.rt56.604.el6rt"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-108.21.2"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"kernel-bigmem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-108.21.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-108.21.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"kernel-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-108.21.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"kernel-pae","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-108.21.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"kernel-ppc64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-108.21.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-108.21.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-108.21.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"kernel-trace","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-108.21.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"kernel-xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-108.21.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"kernel-bigmem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-108.21.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-108.21.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"kernel-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-108.21.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"kernel-pae","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-108.21.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"kernel-ppc64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-108.21.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-108.21.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-108.21.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"kernel-trace","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-108.21.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"kernel-xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-108.21.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.47.106.11.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"kernel-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.47.106.11.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"kernel-pae","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.47.106.11.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.47.106.11.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.47.106.11.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"kernel-trace","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.47.106.11.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"kernel-xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.47.106.11.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"kernel-bigsmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.47.106.11.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.47.106.11.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"kernel-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.47.106.11.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"kernel-pae","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.47.106.11.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.47.106.11.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.47.106.11.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"kernel-trace","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.47.106.11.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"kernel-xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101-0.47.106.11.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 11 SP4","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101.rt130-69.14.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 11 SP4","package":"kernel-rt_trace","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101.rt130-69.14.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 11 SP4","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101.rt130-69.14.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 11 SP4","package":"kernel-syms-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.101.rt130-69.14.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"kernel-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.74-60.64.110.1"}]}],"bundled":33},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.74-60.64.110.1"}]}],"bundled":33},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.74-60.64.110.1"}]}],"bundled":33},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.74-60.64.110.1"}]}],"bundled":33},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"kernel-xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.74-60.64.110.1"}]}],"bundled":33},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"kgraft-patch-SLE12-SP1_Update_33","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-2.3.1"}]}],"bundled":33},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"lttng-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0-4.4.1"}]}],"bundled":33},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.74-60.64.110.1"}]}],"bundled":33},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.74-60.64.110.1"}]}],"bundled":33},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.74-60.64.110.1"}]}],"bundled":33},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"kernel-xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.74-60.64.110.1"}]}],"bundled":33},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"kgraft-patch-SLE12-SP1_Update_33","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-2.3.1"}]}],"bundled":33},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"lttng-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0-4.4.1"}]}],"bundled":33},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.0-132.181"}]}],"versions":["3.11.0-12.19","3.12.0-1.3","3.12.0-2.5","3.12.0-2.7","3.12.0-3.8","3.12.0-3.9","3.12.0-4.10","3.12.0-4.12","3.12.0-5.13","3.12.0-7.15","3.13.0-1.16","3.13.0-2.17","3.13.0-3.18","3.13.0-4.19","3.13.0-5.20","3.13.0-6.23","3.13.0-7.25","3.13.0-7.26","3.13.0-8.27","3.13.0-8.28","3.13.0-10.30","3.13.0-11.31","3.13.0-12.32","3.13.0-13.33","3.13.0-14.34","3.13.0-15.35","3.13.0-16.36","3.13.0-17.37","3.13.0-18.38","3.13.0-19.39","3.13.0-19.40","3.13.0-20.42","3.13.0-21.43","3.13.0-22.44","3.13.0-23.45","3.13.0-24.46","3.13.0-24.47","3.13.0-27.50","3.13.0-29.53","3.13.0-30.54","3.13.0-30.55","3.13.0-32.57","3.13.0-33.58","3.13.0-34.60","3.13.0-35.62","3.13.0-36.63","3.13.0-37.64","3.13.0-39.66","3.13.0-40.69","3.13.0-41.70","3.13.0-43.72","3.13.0-44.73","3.13.0-45.74","3.13.0-46.75","3.13.0-46.76","3.13.0-46.77","3.13.0-46.79","3.13.0-48.80","3.13.0-49.81","3.13.0-49.83","3.13.0-51.84","3.13.0-52.85","3.13.0-52.86","3.13.0-53.88","3.13.0-53.89","3.13.0-54.91","3.13.0-55.92","3.13.0-55.94","3.13.0-57.95","3.13.0-58.97","3.13.0-59.98","3.13.0-61.100","3.13.0-62.102","3.13.0-63.103","3.13.0-65.105","3.13.0-65.106","3.13.0-66.108","3.13.0-67.110","3.13.0-68.111","3.13.0-70.113","3.13.0-71.114","3.13.0-73.116","3.13.0-74.118","3.13.0-76.120","3.13.0-77.121","3.13.0-79.123","3.13.0-83.127","3.13.0-85.129","3.13.0-86.130","3.13.0-86.131","3.13.0-87.133","3.13.0-88.135","3.13.0-91.138","3.13.0-92.139","3.13.0-93.140","3.13.0-95.142","3.13.0-96.143","3.13.0-98.145","3.13.0-100.147","3.13.0-101.148","3.13.0-103.150","3.13.0-105.152","3.13.0-106.153","3.13.0-107.154","3.13.0-108.155","3.13.0-109.156","3.13.0-110.157","3.13.0-111.158","3.13.0-112.159","3.13.0-113.160","3.13.0-115.162","3.13.0-116.163","3.13.0-117.164","3.13.0-119.166","3.13.0-121.170","3.13.0-123.172","3.13.0-125.174","3.13.0-126.175","3.13.0-128.177","3.13.0-129.178"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-xenial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-79.100~14.04.1"}]}],"versions":["4.4.0-13.29~14.04.1","4.4.0-14.30~14.04.2","4.4.0-15.31~14.04.1","4.4.0-18.34~14.04.1","4.4.0-21.37~14.04.1","4.4.0-22.39~14.04.1","4.4.0-22.40~14.04.1","4.4.0-24.43~14.04.1","4.4.0-28.47~14.04.1","4.4.0-31.50~14.04.1","4.4.0-34.53~14.04.1","4.4.0-36.55~14.04.1","4.4.0-38.57~14.04.1","4.4.0-42.62~14.04.1","4.4.0-45.66~14.04.1","4.4.0-47.68~14.04.1","4.4.0-51.72~14.04.1","4.4.0-53.74~14.04.1","4.4.0-57.78~14.04.1","4.4.0-59.80~14.04.1","4.4.0-62.83~14.04.1","4.4.0-63.84~14.04.2","4.4.0-64.85~14.04.1","4.4.0-66.87~14.04.1","4.4.0-67.88~14.04.1","4.4.0-70.91~14.04.1","4.4.0-71.92~14.04.1","4.4.0-72.93~14.04.1","4.4.0-75.96~14.04.1","4.4.0-78.99~14.04.2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-79.100"}]}],"versions":["4.2.0-16.19","4.2.0-17.21","4.2.0-19.23","4.3.0-1.10","4.3.0-2.11","4.3.0-5.16","4.3.0-6.17","4.3.0-7.18","4.4.0-2.16","4.4.0-4.19","4.4.0-6.21","4.4.0-7.22","4.4.0-8.23","4.4.0-9.24","4.4.0-10.25","4.4.0-11.26","4.4.0-12.28","4.4.0-13.29","4.4.0-14.30","4.4.0-15.31","4.4.0-16.32","4.4.0-17.33","4.4.0-18.34","4.4.0-21.37","4.4.0-22.39","4.4.0-22.40","4.4.0-24.43","4.4.0-28.47","4.4.0-31.50","4.4.0-34.53","4.4.0-36.55","4.4.0-38.57","4.4.0-42.62","4.4.0-43.63","4.4.0-45.66","4.4.0-47.68","4.4.0-51.72","4.4.0-53.74","4.4.0-57.78","4.4.0-59.80","4.4.0-62.83","4.4.0-63.84","4.4.0-64.85","4.4.0-65.86","4.4.0-66.87","4.4.0-67.88","4.4.0-70.91","4.4.0-71.92","4.4.0-72.93","4.4.0-75.96","4.4.0-77.98","4.4.0-78.99"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-1018.27"}]}],"versions":["4.4.0-1001.10","4.4.0-1003.12","4.4.0-1004.13","4.4.0-1007.16","4.4.0-1009.18","4.4.0-1011.20","4.4.0-1012.21","4.4.0-1013.22","4.4.0-1016.25","4.4.0-1017.26"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-gke","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-1014.14"}]}],"versions":["4.4.0-1003.3","4.4.0-1005.6","4.4.0-1006.6","4.4.0-1008.8","4.4.0-1009.9","4.4.0-1010.10","4.4.0-1012.12","4.4.0-1013.13"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-32.36~16.04.1"}]}],"versions":["4.8.0-36.36~16.04.1","4.8.0-39.42~16.04.1","4.8.0-41.44~16.04.1","4.8.0-42.45~16.04.1","4.8.0-44.47~16.04.1","4.8.0-45.48~16.04.1","4.8.0-46.49~16.04.1","4.8.0-49.52~16.04.1","4.8.0-51.54~16.04.1","4.8.0-52.55~16.04.1","4.8.0-53.56~16.04.1","4.8.0-54.57~16.04.1","4.8.0-56.61~16.04.1","4.8.0-58.63~16.04.1","4.10.0-27.30~16.04.2","4.10.0-28.32~16.04.2","4.10.0-30.34~16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-raspi2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-1057.64"}]}],"versions":["4.2.0-1013.19","4.2.0-1014.21","4.3.0-1006.6","4.4.0-1003.4","4.4.0-1004.5","4.4.0-1009.10","4.4.0-1010.12","4.4.0-1010.13","4.4.0-1012.16","4.4.0-1016.22","4.4.0-1017.23","4.4.0-1019.25","4.4.0-1021.27","4.4.0-1023.29","4.4.0-1027.33","4.4.0-1029.36","4.4.0-1034.41","4.4.0-1038.45","4.4.0-1040.47","4.4.0-1042.49","4.4.0-1044.51","4.4.0-1046.53","4.4.0-1048.55","4.4.0-1050.57","4.4.0-1051.58","4.4.0-1052.59","4.4.0-1054.61","4.4.0-1055.62"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-snapdragon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-1059.63"}]}],"versions":["4.4.0-1012.12","4.4.0-1013.14","4.4.0-1013.15","4.4.0-1015.18","4.4.0-1019.22","4.4.0-1020.23","4.4.0-1022.25","4.4.0-1024.27","4.4.0-1026.29","4.4.0-1030.33","4.4.0-1032.36","4.4.0-1035.39","4.4.0-1039.43","4.4.0-1042.46","4.4.0-1044.48","4.4.0-1046.50","4.4.0-1047.51","4.4.0-1048.52","4.4.0-1050.54","4.4.0-1051.55","4.4.0-1053.57","4.4.0-1054.58","4.4.0-1055.59","4.4.0-1057.61","4.4.0-1058.62"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1002.2","4.15.0-1003.3","4.15.0-1004.4","4.15.0-1008.8","4.15.0-1009.9","4.15.0-1012.12","4.15.0-1013.13","4.15.0-1014.14","4.15.0-1018.18","4.15.0-1019.19","4.15.0-1021.21","4.15.0-1022.23","4.15.0-1023.24","4.15.0-1025.26","4.15.0-1028.29","4.15.0-1030.31","4.15.0-1031.32","4.15.0-1032.33","4.15.0-1035.36","4.15.0-1036.38","4.15.0-1037.39","4.18.0-1011.11~18.04.1","4.18.0-1013.13~18.04.1","4.18.0-1014.14~18.04.1","4.18.0-1018.18~18.04.1","4.18.0-1019.19~18.04.1","4.18.0-1020.20~18.04.1","4.18.0-1023.24~18.04.1","4.18.0-1024.25~18.04.1","4.18.0-1025.27~18.04.1","5.0.0-1014.14~18.04.1","5.0.0-1016.17~18.04.1","5.0.0-1018.19~18.04.1","5.0.0-1020.21~18.04.1","5.0.0-1022.23~18.04.1","5.0.0-1023.24~18.04.1","5.0.0-1025.27~18.04.1","5.0.0-1027.29~18.04.1","5.0.0-1028.30~18.04.1","5.0.0-1029.31~18.04.1","5.0.0-1031.33","5.0.0-1032.34","5.0.0-1035.37","5.0.0-1036.38"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1001.1","4.15.0-1003.3","4.15.0-1005.5","4.15.0-1006.6","4.15.0-1008.8","4.15.0-1009.9","4.15.0-1010.10","4.15.0-1014.14","4.15.0-1015.15","4.15.0-1017.18","4.15.0-1018.19","4.15.0-1019.20","4.15.0-1021.22","4.15.0-1023.24","4.15.0-1024.25","4.15.0-1025.26","4.15.0-1026.27","4.15.0-1027.28","4.15.0-1028.29","4.15.0-1029.31","4.15.0-1030.32","4.15.0-1032.34","4.15.0-1033.35","4.15.0-1034.36","4.15.0-1036.38","4.15.0-1037.39","4.15.0-1040.42","4.15.0-1042.45","4.15.0-1044.70","5.0.0-1020.20~18.04.1","5.0.0-1021.21~18.04.1","5.0.0-1025.26~18.04.1","5.0.0-1026.27~18.04.1","5.0.0-1028.29~18.04.1","5.0.0-1029.30~18.04.1","5.0.0-1031.32","5.0.0-1033.34","5.0.0-1034.35"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.18.0-13.14~18.04.1","4.18.0-14.15~18.04.1","4.18.0-15.16~18.04.1","4.18.0-16.17~18.04.1","4.18.0-17.18~18.04.1","4.18.0-18.19~18.04.1","4.18.0-20.21~18.04.1","4.18.0-21.22~18.04.1","4.18.0-22.23~18.04.1","4.18.0-24.25~18.04.1","4.18.0-25.26~18.04.1","5.0.0-23.24~18.04.1","5.0.0-25.26~18.04.1","5.0.0-27.28~18.04.1","5.0.0-29.31~18.04.1","5.0.0-31.33~18.04.1","5.0.0-32.34~18.04.2","5.0.0-35.38~18.04.1","5.0.0-36.39~18.04.1","5.0.0-37.40~18.04.1","5.3.0-26.28~18.04.1","5.3.0-28.30~18.04.1","5.3.0-40.32~18.04.1","5.3.0-42.34~18.04.1","5.3.0-45.37~18.04.1","5.3.0-46.38~18.04.1","5.3.0-51.44~18.04.2","5.3.0-53.47~18.04.1","5.3.0-59.53~18.04.1","5.3.0-61.55~18.04.1","5.3.0-62.56~18.04.1","5.3.0-64.58~18.04.1","5.3.0-65.59","5.3.0-66.60","5.3.0-67.61","5.3.0-68.63","5.3.0-69.65","5.3.0-70.66","5.3.0-72.68","5.3.0-73.69","5.3.0-74.70","5.3.0-75.71","5.3.0-76.72"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-hwe-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-15.16~18.04.1","5.0.0-16.17~18.04.1","5.0.0-17.18~18.04.1","5.0.0-19.20~18.04.1","5.0.0-20.21~18.04.1","5.3.0-19.20~18.04.2","5.3.0-22.24~18.04.1","5.3.0-23.25~18.04.1","5.3.0-23.25~18.04.2","5.3.0-24.26~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1002.3","4.15.0-1004.5","4.15.0-1006.9","4.15.0-1008.11","4.15.0-1009.12","4.15.0-1012.15","4.15.0-1013.16","4.15.0-1015.18","4.15.0-1017.20","4.15.0-1018.21","4.15.0-1021.24","4.15.0-1024.29","4.15.0-1026.31","4.15.0-1028.33","4.15.0-1030.35","4.15.0-1033.38","4.15.0-1034.39","4.15.0-1035.40","4.15.0-1036.41","4.15.0-1038.43","4.15.0-1039.44","4.15.0-1043.48","4.15.0-1045.50","4.15.0-1050.57","4.15.0-1056.65","4.15.0-1057.66","4.15.0-1059.68","4.15.0-1063.72","4.15.0-1064.73","4.15.0-1065.75","4.15.0-1066.76","4.15.0-1067.77","4.15.0-1069.79","4.15.0-1073.83","4.15.0-1076.86","4.15.0-1079.89","4.15.0-1080.90","4.15.0-1081.91","4.15.0-1087.97","4.15.0-1090.100","4.15.0-1091.101","4.15.0-1093.103","4.15.0-1094.104","4.15.0-1096.106","4.15.0-1097.107","4.15.0-1099.109","4.15.0-1100.110","4.15.0-1101.112","4.15.0-1102.113","4.15.0-1103.114"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-fde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1063.66+cvm2.2","5.4.0-1063.66+cvm3.2","5.4.0-1064.67+cvm1.1","5.4.0-1065.68+cvm2.1","5.4.0-1067.70+cvm1.1","5.4.0-1068.71+cvm1.1","5.4.0-1069.72+cvm1.1","5.4.0-1070.73+cvm1.1","5.4.0-1072.75+cvm1.1","5.4.0-1073.76+cvm1.1","5.4.0-1074.77+cvm1.1","5.4.0-1076.79+cvm1.1","5.4.0-1078.81+cvm1.1","5.4.0-1080.83+cvm1.1","5.4.0-1083.87+cvm1.1","5.4.0-1085.90+cvm1.1","5.4.0-1085.90+cvm2.1","5.4.0-1086.91+cvm1.1","5.4.0-1089.94+cvm1.2","5.4.0-1090.95+cvm1.1","5.4.0-1091.96+cvm1.1","5.4.0-1092.97+cvm1.1","5.4.0-1095.101+cvm1.1","5.4.0-1098.104+cvm1.1","5.4.0-1100.106+cvm1.1","5.4.0-1103.109+cvm1.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gke","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1033.35","5.4.0-1035.37","5.4.0-1036.38","5.4.0-1037.39","5.4.0-1039.41","5.4.0-1041.43","5.4.0-1042.44","5.4.0-1043.45","5.4.0-1044.46","5.4.0-1046.48","5.4.0-1049.52","5.4.0-1051.54","5.4.0-1052.55","5.4.0-1053.56","5.4.0-1054.57","5.4.0-1055.58","5.4.0-1056.59","5.4.0-1057.60","5.4.0-1059.62","5.4.0-1061.64","5.4.0-1062.65","5.4.0-1063.66","5.4.0-1065.68","5.4.0-1066.69","5.4.0-1067.70","5.4.0-1068.71","5.4.0-1071.76","5.4.0-1072.77","5.4.0-1074.79","5.4.0-1076.82","5.4.0-1078.84","5.4.0-1080.86","5.4.0-1081.87","5.4.0-1083.89","5.4.0-1084.90","5.4.0-1086.93","5.4.0-1087.94","5.4.0-1090.97","5.4.0-1091.98","5.4.0-1094.101","5.4.0-1095.102","5.4.0-1096.103","5.4.0-1097.104","5.4.0-1098.105","5.4.0-1099.106","5.4.0-1100.107","5.4.0-1101.108","5.4.0-1102.109","5.4.0-1103.110","5.4.0-1104.111","5.4.0-1105.112"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-raspi2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1007.8","5.3.0-1014.16","5.3.0-1015.17","5.3.0-1017.19","5.4.0-1004.4","5.4.0-1006.6"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-24.28","5.4.0-26.30","5.4.0-27.31","5.4.0-28.32","5.4.0-30.34","5.4.0-31.35","5.4.0-33.37","5.4.0-34.38","5.4.0-36.41","5.4.0-37.42","5.4.0-39.44","5.4.0-40.45"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-intel-iot-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1073.75"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1032.35"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1004.4","5.13.0-1006.6+22.04.1","5.13.0-1007.7+22.04.1","5.13.0-1010.11+22.04.1","5.15.0-1004.4","5.15.0-1005.5","5.15.0-1006.6","5.15.0-1007.7","5.15.0-1008.8","5.15.0-1011.12","5.15.0-1012.13","5.15.0-1014.16","5.15.0-1015.17","5.15.0-1016.18","5.15.0-1017.19","5.15.0-1018.21","5.15.0-1019.22","5.15.0-1020.23","5.15.0-1022.26","5.15.0-1023.27","5.15.0-1026.30","5.15.0-1027.31","5.15.0-1028.32"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-raspi-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-2019.20"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-79.100"}]}],"versions":["4.2.0-16.19","4.2.0-17.21","4.2.0-19.23","4.3.0-1.10","4.3.0-2.11","4.3.0-5.16","4.3.0-6.17","4.3.0-7.18","4.4.0-2.16","4.4.0-4.19","4.4.0-6.21","4.4.0-7.22","4.4.0-8.23","4.4.0-9.24","4.4.0-10.25","4.4.0-11.26","4.4.0-12.28","4.4.0-13.29","4.4.0-14.30","4.4.0-15.31","4.4.0-16.32","4.4.0-17.33","4.4.0-18.34","4.4.0-21.37","4.4.0-22.39","4.4.0-22.40","4.4.0-24.43","4.4.0-28.47","4.4.0-31.50","4.4.0-34.53","4.4.0-36.55","4.4.0-38.57","4.4.0-42.62","4.4.0-43.63","4.4.0-45.66","4.4.0-47.68","4.4.0-51.72","4.4.0-53.74","4.4.0-57.78","4.4.0-59.80","4.4.0-62.83","4.4.0-63.84","4.4.0-64.85","4.4.0-65.86","4.4.0-66.87","4.4.0-67.88","4.4.0-70.91","4.4.0-71.92","4.4.0-72.93","4.4.0-75.96","4.4.0-77.98","4.4.0-78.99"],"bundled":15},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-1018.27"}]}],"versions":["4.4.0-1001.10","4.4.0-1003.12","4.4.0-1004.13","4.4.0-1007.16","4.4.0-1009.18","4.4.0-1011.20","4.4.0-1012.21","4.4.0-1013.22","4.4.0-1016.25","4.4.0-1017.26"],"bundled":15},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-gke","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-1014.14"}]}],"versions":["4.4.0-1003.3","4.4.0-1005.6","4.4.0-1006.6","4.4.0-1008.8","4.4.0-1009.9","4.4.0-1010.10","4.4.0-1012.12","4.4.0-1013.13"],"bundled":15},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-raspi2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-1057.64"}]}],"versions":["4.2.0-1013.19","4.2.0-1014.21","4.3.0-1006.6","4.4.0-1003.4","4.4.0-1004.5","4.4.0-1009.10","4.4.0-1010.12","4.4.0-1010.13","4.4.0-1012.16","4.4.0-1016.22","4.4.0-1017.23","4.4.0-1019.25","4.4.0-1021.27","4.4.0-1023.29","4.4.0-1027.33","4.4.0-1029.36","4.4.0-1034.41","4.4.0-1038.45","4.4.0-1040.47","4.4.0-1042.49","4.4.0-1044.51","4.4.0-1046.53","4.4.0-1048.55","4.4.0-1050.57","4.4.0-1051.58","4.4.0-1052.59","4.4.0-1054.61","4.4.0-1055.62"],"bundled":15},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-snapdragon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-1059.63"}]}],"versions":["4.4.0-1012.12","4.4.0-1013.14","4.4.0-1013.15","4.4.0-1015.18","4.4.0-1019.22","4.4.0-1020.23","4.4.0-1022.25","4.4.0-1024.27","4.4.0-1026.29","4.4.0-1030.33","4.4.0-1032.36","4.4.0-1035.39","4.4.0-1039.43","4.4.0-1042.46","4.4.0-1044.48","4.4.0-1046.50","4.4.0-1047.51","4.4.0-1048.52","4.4.0-1050.54","4.4.0-1051.55","4.4.0-1053.57","4.4.0-1054.58","4.4.0-1055.59","4.4.0-1057.61","4.4.0-1058.62"],"bundled":15},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-xenial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-79.100~14.04.1"}]}],"versions":["4.4.0-13.29~14.04.1","4.4.0-14.30~14.04.2","4.4.0-15.31~14.04.1","4.4.0-18.34~14.04.1","4.4.0-21.37~14.04.1","4.4.0-22.39~14.04.1","4.4.0-22.40~14.04.1","4.4.0-24.43~14.04.1","4.4.0-28.47~14.04.1","4.4.0-31.50~14.04.1","4.4.0-34.53~14.04.1","4.4.0-36.55~14.04.1","4.4.0-38.57~14.04.1","4.4.0-42.62~14.04.1","4.4.0-45.66~14.04.1","4.4.0-47.68~14.04.1","4.4.0-51.72~14.04.1","4.4.0-53.74~14.04.1","4.4.0-57.78~14.04.1","4.4.0-59.80~14.04.1","4.4.0-62.83~14.04.1","4.4.0-63.84~14.04.2","4.4.0-64.85~14.04.1","4.4.0-66.87~14.04.1","4.4.0-67.88~14.04.1","4.4.0-70.91~14.04.1","4.4.0-71.92~14.04.1","4.4.0-72.93~14.04.1","4.4.0-75.96~14.04.1","4.4.0-78.99~14.04.2"],"bundled":15},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-27.30~16.04.2"}]}],"versions":["4.8.0-36.36~16.04.1","4.8.0-39.42~16.04.1","4.8.0-41.44~16.04.1","4.8.0-42.45~16.04.1","4.8.0-44.47~16.04.1","4.8.0-45.48~16.04.1","4.8.0-46.49~16.04.1","4.8.0-49.52~16.04.1","4.8.0-51.54~16.04.1","4.8.0-52.55~16.04.1","4.8.0-53.56~16.04.1","4.8.0-54.57~16.04.1","4.8.0-56.61~16.04.1","4.8.0-58.63~16.04.1"],"bundled":40},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.0-132.181"}]}],"versions":["3.11.0-12.19","3.12.0-1.3","3.12.0-2.5","3.12.0-2.7","3.12.0-3.8","3.12.0-3.9","3.12.0-4.10","3.12.0-4.12","3.12.0-5.13","3.12.0-7.15","3.13.0-1.16","3.13.0-2.17","3.13.0-3.18","3.13.0-4.19","3.13.0-5.20","3.13.0-6.23","3.13.0-7.25","3.13.0-7.26","3.13.0-8.27","3.13.0-8.28","3.13.0-10.30","3.13.0-11.31","3.13.0-12.32","3.13.0-13.33","3.13.0-14.34","3.13.0-15.35","3.13.0-16.36","3.13.0-17.37","3.13.0-18.38","3.13.0-19.39","3.13.0-19.40","3.13.0-20.42","3.13.0-21.43","3.13.0-22.44","3.13.0-23.45","3.13.0-24.46","3.13.0-24.47","3.13.0-27.50","3.13.0-29.53","3.13.0-30.54","3.13.0-30.55","3.13.0-32.57","3.13.0-33.58","3.13.0-34.60","3.13.0-35.62","3.13.0-36.63","3.13.0-37.64","3.13.0-39.66","3.13.0-40.69","3.13.0-41.70","3.13.0-43.72","3.13.0-44.73","3.13.0-45.74","3.13.0-46.75","3.13.0-46.76","3.13.0-46.77","3.13.0-46.79","3.13.0-48.80","3.13.0-49.81","3.13.0-49.83","3.13.0-51.84","3.13.0-52.85","3.13.0-52.86","3.13.0-53.88","3.13.0-53.89","3.13.0-54.91","3.13.0-55.92","3.13.0-55.94","3.13.0-57.95","3.13.0-58.97","3.13.0-59.98","3.13.0-61.100","3.13.0-62.102","3.13.0-63.103","3.13.0-65.105","3.13.0-65.106","3.13.0-66.108","3.13.0-67.110","3.13.0-68.111","3.13.0-70.113","3.13.0-71.114","3.13.0-73.116","3.13.0-74.118","3.13.0-76.120","3.13.0-77.121","3.13.0-79.123","3.13.0-83.127","3.13.0-85.129","3.13.0-86.130","3.13.0-86.131","3.13.0-87.133","3.13.0-88.135","3.13.0-91.138","3.13.0-92.139","3.13.0-93.140","3.13.0-95.142","3.13.0-96.143","3.13.0-98.145","3.13.0-100.147","3.13.0-101.148","3.13.0-103.150","3.13.0-105.152","3.13.0-106.153","3.13.0-107.154","3.13.0-108.155","3.13.0-109.156","3.13.0-110.157","3.13.0-111.158","3.13.0-112.159","3.13.0-113.160","3.13.0-115.162","3.13.0-116.163","3.13.0-117.164","3.13.0-119.166","3.13.0-121.170","3.13.0-123.172","3.13.0-125.174","3.13.0-126.175","3.13.0-128.177","3.13.0-129.178"],"bundled":18}],"products":[{"vendor":"linux","product":"linux_kernel"}],"references":[{"url":"http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=c9f838d104fed6f2f61d68164712e3204bf5271b","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://lkml.org/lkml/2017/4/3/724","tags":["x_refsource_CONFIRM","x_transferred","Broken Link","web","report"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0181","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1442086","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","fix","report"]},{"url":"https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.10.13","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Vendor Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00007.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0152","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://github.com/torvalds/linux/commit/c9f838d104fed6f2f61d68164712e3204bf5271b","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"http://www.securityfocus.com/bid/98422","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://www.securitytracker.com/id/1038471","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"https://bugzilla.novell.com/show_bug.cgi?id=1034862","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","fix"]},{"url":"https://www.exploit-db.com/exploits/42136/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","web"]},{"url":"http://openwall.com/lists/oss-security/2017/05/11/1","tags":["x_refsource_CONFIRM","x_transferred","Mailing List","Patch","Third Party Advisory","fix"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0151","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://lkml.org/lkml/2017/4/1/235","tags":["x_refsource_CONFIRM","x_transferred","Broken Link","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-7472","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-7472","tags":["report"]},{"url":"https://www.exploit-db.com/exploits/42136"},{"url":"https://github.com/advisories/GHSA-77r7-v55r-g5r7"},{"url":"https://errata.cloudlinux.com/ol6/CLSA-2021-1634922728.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/els6/CLSA-2022-1650576075.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-7472","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2017-0136.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=20747","tags":["report"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.60","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.61","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.62","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.63","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.64","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.65","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2017-0147.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=20859","tags":["report"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.66","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.67","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.68","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2017-0148.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=20860","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://access.redhat.com/security/vulnerabilities/speculativeexecution","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-5753","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-5715","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-5754","tags":["article"]},{"url":"https://access.redhat.com/articles/3327131","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1284450","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1493435","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1501215","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1504574","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1519778","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1519780","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1519781","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_0151.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-8539","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-8539","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8539","tags":["advisory"]},{"url":"https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=096fe9eaea40a17e125569f9e657e34cdb6d73bd","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-5753","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-5753","tags":["advisory"]},{"url":"https://googleprojectzero.blogspot.com/2018/01/reading-privileged-memory-with-side.html","tags":["article"]},{"url":"https://meltdownattack.com","tags":["article"]},{"url":"https://spectreattack.com/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-7472","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-12192","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-12192","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-12192","tags":["advisory"]},{"url":"http://seclists.org/oss-sec/2017/q4/63","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-12193","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-12193","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-12193","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-15649","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-15649","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-15649","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1519506","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_0152.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1422778","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1519504","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_0181.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20180011-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1013018","tags":["report"]},{"url":"https://bugzilla.suse.com/1024612","tags":["report"]},{"url":"https://bugzilla.suse.com/1034862","tags":["report"]},{"url":"https://bugzilla.suse.com/1045479","tags":["report"]},{"url":"https://bugzilla.suse.com/1045538","tags":["report"]},{"url":"https://bugzilla.suse.com/1047487","tags":["report"]},{"url":"https://bugzilla.suse.com/1048185","tags":["report"]},{"url":"https://bugzilla.suse.com/1050231","tags":["report"]},{"url":"https://bugzilla.suse.com/1050431","tags":["report"]},{"url":"https://bugzilla.suse.com/1056982","tags":["report"]},{"url":"https://bugzilla.suse.com/1063043","tags":["report"]},{"url":"https://bugzilla.suse.com/1065180","tags":["report"]},{"url":"https://bugzilla.suse.com/1065600","tags":["report"]},{"url":"https://bugzilla.suse.com/1066569","tags":["report"]},{"url":"https://bugzilla.suse.com/1066693","tags":["report"]},{"url":"https://bugzilla.suse.com/1066973","tags":["report"]},{"url":"https://bugzilla.suse.com/1068032","tags":["report"]},{"url":"https://bugzilla.suse.com/1068671","tags":["report"]},{"url":"https://bugzilla.suse.com/1068984","tags":["report"]},{"url":"https://bugzilla.suse.com/1069702","tags":["report"]},{"url":"https://bugzilla.suse.com/1070771","tags":["report"]},{"url":"https://bugzilla.suse.com/1070964","tags":["report"]},{"url":"https://bugzilla.suse.com/1071074","tags":["report"]},{"url":"https://bugzilla.suse.com/1071470","tags":["report"]},{"url":"https://bugzilla.suse.com/1071695","tags":["report"]},{"url":"https://bugzilla.suse.com/1072457","tags":["report"]},{"url":"https://bugzilla.suse.com/1072561","tags":["report"]},{"url":"https://bugzilla.suse.com/1072876","tags":["report"]},{"url":"https://bugzilla.suse.com/1073792","tags":["report"]},{"url":"https://bugzilla.suse.com/1073874","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11600","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14106","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15115","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15868","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16534","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16939","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17450","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17558","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17805","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17806","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5715","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5753","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5754","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7472","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8824","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20180040-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1010175","tags":["report"]},{"url":"https://bugzilla.suse.com/1045327","tags":["report"]},{"url":"https://bugzilla.suse.com/1052593","tags":["report"]},{"url":"https://bugzilla.suse.com/1057179","tags":["report"]},{"url":"https://bugzilla.suse.com/1057389","tags":["report"]},{"url":"https://bugzilla.suse.com/1058524","tags":["report"]},{"url":"https://bugzilla.suse.com/1062520","tags":["report"]},{"url":"https://bugzilla.suse.com/1063544","tags":["report"]},{"url":"https://bugzilla.suse.com/1063667","tags":["report"]},{"url":"https://bugzilla.suse.com/1066295","tags":["report"]},{"url":"https://bugzilla.suse.com/1066472","tags":["report"]},{"url":"https://bugzilla.suse.com/1066573","tags":["report"]},{"url":"https://bugzilla.suse.com/1066606","tags":["report"]},{"url":"https://bugzilla.suse.com/1066618","tags":["report"]},{"url":"https://bugzilla.suse.com/1066625","tags":["report"]},{"url":"https://bugzilla.suse.com/1066650","tags":["report"]},{"url":"https://bugzilla.suse.com/1066671","tags":["report"]},{"url":"https://bugzilla.suse.com/1066700","tags":["report"]},{"url":"https://bugzilla.suse.com/1066705","tags":["report"]},{"url":"https://bugzilla.suse.com/1067085","tags":["report"]},{"url":"https://bugzilla.suse.com/1069708","tags":["report"]},{"url":"https://bugzilla.suse.com/1074033","tags":["report"]},{"url":"https://bugzilla.suse.com/999245","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000251","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13080","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14140","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14340","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15102","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15265","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15274","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16525","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16527","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16529","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16531","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16535","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16536","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16537","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16649","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20180180-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1012917","tags":["report"]},{"url":"https://bugzilla.suse.com/1045205","tags":["report"]},{"url":"https://bugzilla.suse.com/1051133","tags":["report"]},{"url":"https://bugzilla.suse.com/1054305","tags":["report"]},{"url":"https://bugzilla.suse.com/1064803","tags":["report"]},{"url":"https://bugzilla.suse.com/1064861","tags":["report"]},{"url":"https://bugzilla.suse.com/1066471","tags":["report"]},{"url":"https://bugzilla.suse.com/1067816","tags":["report"]},{"url":"https://bugzilla.suse.com/1067888","tags":["report"]},{"url":"https://bugzilla.suse.com/1074709","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20191289-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1031240","tags":["report"]},{"url":"https://bugzilla.suse.com/1066674","tags":["report"]},{"url":"https://bugzilla.suse.com/1071021","tags":["report"]},{"url":"https://bugzilla.suse.com/1086535","tags":["report"]},{"url":"https://bugzilla.suse.com/1091171","tags":["report"]},{"url":"https://bugzilla.suse.com/1094825","tags":["report"]},{"url":"https://bugzilla.suse.com/1100001","tags":["report"]},{"url":"https://bugzilla.suse.com/1102517","tags":["report"]},{"url":"https://bugzilla.suse.com/1103097","tags":["report"]},{"url":"https://bugzilla.suse.com/1104475","tags":["report"]},{"url":"https://bugzilla.suse.com/1105025","tags":["report"]},{"url":"https://bugzilla.suse.com/1105296","tags":["report"]},{"url":"https://bugzilla.suse.com/1106913","tags":["report"]},{"url":"https://bugzilla.suse.com/1107829","tags":["report"]},{"url":"https://bugzilla.suse.com/1108498","tags":["report"]},{"url":"https://bugzilla.suse.com/1110768","tags":["report"]},{"url":"https://bugzilla.suse.com/1111331","tags":["report"]},{"url":"https://bugzilla.suse.com/1111516","tags":["report"]},{"url":"https://bugzilla.suse.com/1113751","tags":["report"]},{"url":"https://bugzilla.suse.com/1113769","tags":["report"]},{"url":"https://bugzilla.suse.com/1114648","tags":["report"]},{"url":"https://bugzilla.suse.com/1114920","tags":["report"]},{"url":"https://bugzilla.suse.com/1115007","tags":["report"]},{"url":"https://bugzilla.suse.com/1115038","tags":["report"]},{"url":"https://bugzilla.suse.com/1116345","tags":["report"]},{"url":"https://bugzilla.suse.com/1116841","tags":["report"]},{"url":"https://bugzilla.suse.com/1118152","tags":["report"]},{"url":"https://bugzilla.suse.com/1118319","tags":["report"]},{"url":"https://bugzilla.suse.com/1119714","tags":["report"]},{"url":"https://bugzilla.suse.com/1119946","tags":["report"]},{"url":"https://bugzilla.suse.com/1120743","tags":["report"]},{"url":"https://bugzilla.suse.com/1120758","tags":["report"]},{"url":"https://bugzilla.suse.com/1121621","tags":["report"]},{"url":"https://bugzilla.suse.com/1122015","tags":["report"]},{"url":"https://bugzilla.suse.com/1123161","tags":["report"]},{"url":"https://bugzilla.suse.com/1124010","tags":["report"]},{"url":"https://bugzilla.suse.com/1124728","tags":["report"]},{"url":"https://bugzilla.suse.com/1124732","tags":["report"]},{"url":"https://bugzilla.suse.com/1124735","tags":["report"]},{"url":"https://bugzilla.suse.com/1126890","tags":["report"]},{"url":"https://bugzilla.suse.com/1128166","tags":["report"]},{"url":"https://bugzilla.suse.com/1131416","tags":["report"]},{"url":"https://bugzilla.suse.com/1131427","tags":["report"]},{"url":"https://bugzilla.suse.com/1132828","tags":["report"]},{"url":"https://bugzilla.suse.com/1133188","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10741","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000407","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16533","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7273","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12126","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12127","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12130","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14633","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-15572","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16884","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18281","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18386","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18690","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18710","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19407","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19824","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19985","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20169","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5391","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-9516","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-9568","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11091","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11486","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3459","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3460","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3882","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6974","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-7221","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-7222","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8564","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9213","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9503","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-7472","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3314-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3312-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3312-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3361-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3422-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3422-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-7913","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-7917","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-8632","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-9083","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-9084","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-9604","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-0605","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-2596","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-2671","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-6001","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7618","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7645","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7889","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7895","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-1350","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-8405","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-8636","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-9191","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-9755","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-10208","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-2583","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-2584","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-2618","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-5546","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-5549","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-5550","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-5551","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-5576","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-5669","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-5897","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-5970","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-6214","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-6345","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-6346","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-6347","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-6348","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7187","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7261","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7273","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7616","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-8924","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-8925","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9150","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-7097","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-8650","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-9178","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-9754","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-10044","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-10200","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-6951","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7541","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-1000251","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-7472","description":"The KEYS subsystem in the Linux kernel before 4.10.13 allows local users to cause a denial of service (memory consumption) via a series of KEY_REQKEY_DEFL_THREAD_KEYRING keyctl_set_reqkey_keyring calls.","status":"published","published":"2017-05-11T19:00:00Z","modified":"2024-08-05T16:04:11.574Z","updated_at":"2026-11-02T14:33:20.171335Z"}],"euvd":[{"id":"EUVD-2017-16495","description":"The KEYS subsystem in the Linux kernel before 4.10.13 allows local users to cause a denial of service (memory consumption) via a series of KEY_REQKEY_DEFL_THREAD_KEYRING keyctl_set_reqkey_keyring calls.","status":"published","published":"2017-05-11T19:00:00Z","modified":"2024-08-05T16:04:11Z","updated_at":"2026-11-03T02:39:08.461482Z"}],"ghsa":[{"id":"GHSA-77r7-v55r-g5r7","title":"The KEYS subsystem in the Linux kernel before 4.10.13 allows local users to cause a denial of...","description":"The KEYS subsystem in the Linux kernel before 4.10.13 allows local users to cause a denial of service (memory consumption) via a series of KEY_REQKEY_DEFL_THREAD_KEYRING keyctl_set_reqkey_keyring calls.","status":"published","published":"2022-05-13T01:46:58Z","modified":"2025-04-20T03:38:30Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-404"],"updated_at":"2026-11-02T15:01:46.283604Z"}],"nvd":[{"id":"CVE-2017-7472","description":"The KEYS subsystem in the Linux kernel before 4.10.13 allows local users to cause a denial of service (memory consumption) via a series of KEY_REQKEY_DEFL_THREAD_KEYRING keyctl_set_reqkey_keyring calls.","status":"published","published":"2017-05-11T19:29:00.163Z","modified":"2026-06-17T01:24:25.073Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.9,"vector":"AV:L/AC:L/Au:N/C:N/I:N/A:C","level":"medium","assessor":"primary"}],"cwes":["CWE-404"],"updated_at":"2026-11-02T14:03:47.848196Z"}],"osv":[{"id":"CVE-2017-7472","description":"The KEYS subsystem in the Linux kernel before 4.10.13 allows local users to cause a denial of service (memory consumption) via a series of KEY_REQKEY_DEFL_THREAD_KEYRING keyctl_set_reqkey_keyring calls.","status":"published","published":"2017-05-11T19:29:00.163Z","modified":"2026-04-16T06:20:58.654226382Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:06.412595Z"},{"id":"DEBIAN-CVE-2017-7472","description":"The KEYS subsystem in the Linux kernel before 4.10.13 allows local users to cause a denial of service (memory consumption) via a series of KEY_REQKEY_DEFL_THREAD_KEYRING keyctl_set_reqkey_keyring calls.","status":"published","published":"2017-05-11T19:29:00.163Z","modified":"2026-09-01T20:02:53.310620551Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:29.412243Z"},{"id":"RHSA-2018:0151","title":"Red Hat Security Advisory: kernel security and bug fix update","status":"published","published":"2024-09-13T13:40:09Z","modified":"2026-06-29T10:19:02Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:04.822845Z"},{"id":"RHSA-2018:0152","title":"Red Hat Security Advisory: kernel-rt security and bug fix update","status":"published","published":"2024-09-13T13:40:16Z","modified":"2026-06-29T10:19:02Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:04.822845Z"},{"id":"RHSA-2018:0181","title":"Red Hat Security Advisory: kernel-rt security and bug fix update","status":"published","published":"2024-09-13T13:40:21Z","modified":"2026-06-29T10:19:04Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:04.822845Z"},{"id":"UBUNTU-CVE-2017-7472","description":"The KEYS subsystem in the Linux kernel before 4.10.13 allows local users to cause a denial of service (memory consumption) via a series of KEY_REQKEY_DEFL_THREAD_KEYRING keyctl_set_reqkey_keyring calls.","status":"published","published":"2017-05-11T00:00:00Z","modified":"2026-04-22T11:31:45.794525Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:15.773974Z"},{"id":"CLSA-2021-1634922728","title":"Fixed 22 CVEs in kernel","description":"- ELS-138: netfilter: x_tables: add missing tables zeroing\n- ELS-138: CVE-2021-33909: seq_file: disallow extremely large seq buffer allocation\n- ELS-138: CVE-2021-22555: netfilter: x_tables: fix compat match/target pad out-of-bound write\n- ELS-138: CVE-2020-29661: tty: Fix -\u003epgrp locking in tiocspgrp()\n- ELS-138: CVE-2020-25656: vt: keyboard, extend func_buf_lock to readers\n- ELS-138: CVE-2020-25656: tty/vt: fix write/write race in ioctl(KDSKBSENT) handler\n- ELS-138: CVE-2020-25656: vt: keyboard, simplify vt_kdgkbsent\n- ELS-138: CVE-2020-25211: netfilter: ctnetlink: add a range check for l3/l4 protonum\n- ELS-138: CKSIX-276: CVE-2019-19532: HID: Fix assumption that devices have inputs\n- ELS-138: CVE-2021-27365: scsi: iscsi: Ensure sysfs attributes are limited to PAGE_SIZE\n- ELS-138: CVE-2021-27365: scsi: iscsi: Verify lengths on passthrough PDUs\n- ELS-138: CVE-2021-27363: CVE-2021-27364: scsi: iscsi: Restrict sessions and handles to admin capabilities\n- ELS-138: sysfs: Add sysfs_emit and sysfs_emit_at to format sysfs output\n- ELS-138: USB: hso: Fix OOB memory access in hso_probe/hso_get_config_data\n- ELS-138: CVE-2019-14615: drm/i915/gen9: Clear residual context state on context switch\n- ELS-138: CVE-2020-8647, CVE-2020-8649: vgacon: Fix a UAF in vgacon_invert_region\n- ELS-138: CVE-2020-14331: vgacon: Fix for missing check in scrollback handling\n- ELS-138: CVE-2021-3347: futex: Handle faults correctly for PI futexes\n- ELS-138: CVE-2021-3347: futex: Provide and use pi_state_update_owner()\n- ELS-138: KEYS: allow reaching the keys quotas exactly\n- ELS-138: KEYS: reaching the keys quotas correctly\n- ELS-138: fix -ENOMEM result with invalid user space pointer in sendto() syscall\n- ELS-138: CVE-2017-18344: posix-timer: Properly check sigevent-\u003esigev_notify\n- ELS-138: CVE-2018-6927: futex: Prevent overflow by strengthen input validation\n- ELS-138: CVE-2017-6951: KEYS: Change the name of the dead type to \".dead\" to prevent user access\n- ELS-138: CVE-2017-15299: KEYS: don't let add_key() update an uninstantiated key\n- ELS-138: fix CVE-2016-9604\n- ELS-138: KEYS: add missing permission check for request_key() destination\n- ELS-138: CVE-2017-10661: timerfd: Protect the might cancel mechanism proper\n- ELS-138: fix CVE-2017-7472\n- ELS-138: fix CVE-2017-15274","status":"published","published":"2021-10-22T17:12:08Z","modified":"2026-10-21T10:47:02.319990889Z","updated_at":"2026-11-02T15:43:39.801198Z"},{"id":"CLSA-2022-1650576075","title":"Fix of 13 CVEs","description":"- CKSIX-267: USB: hso: Fix OOB memory access in hso_probe/hso_get_config_data\n- CKSIX-267: CVE-2019-14615: drm/i915/gen9: Clear residual context state on context switch \n- CKSIX-267: CVE-2020-8647, CVE-2020-8649: vgacon: Fix a UAF in vgacon_invert_region\n- CKSIX-267: CVE-2020-14331: vgacon: Fix for missing check in scrollback handling\n- CKSIX-268: CVE-2021-3347: futex: Handle faults correctly for PI futexes\n- CKSIX-268: CVE-2021-3347: futex: Provide and use pi_state_update_owner()\n- CKSIX-263: KEYS: allow reaching the keys quotas exactly\n- CKSIX-263: KEYS: reaching the keys quotas correctly\n- CKSIX-263: fix -ENOMEM result with invalid user space pointer in sendto() syscall\n- CKSIX-263: CVE-2017-18344: posix-timer: Properly check sigevent-\u003esigev_notify\n- CKSIX-263: CVE-2018-6927: futex: Prevent overflow by strengthen input validation\n- CKSIX-258: CVE-2017-6951: KEYS: Change the name of the dead type to \".dead\" to prevent user access\n- CKSIX-258: CVE-2017-15299: KEYS: don't let add_key() update an uninstantiated key\n- CKSIX-258: fix CVE-2016-9604\n- CKSIX-258: KEYS: add missing permission check for request_key() destination\n- CKSIX-258: CVE-2017-10661: timerfd: Protect the might cancel mechanism proper\n- CKSIX-258: fix CVE-2017-7472\n- CKSIX-258: fix CVE-2017-15274","status":"published","published":"2022-04-21T21:21:15Z","modified":"2026-10-21T10:47:44.166059745Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"DLA-922-1","title":"linux - security update","status":"published","published":"2017-04-28T00:00:00Z","modified":"2026-03-09T02:11:46.197453Z","updated_at":"2026-11-02T15:46:13.584509Z"},{"id":"MGASA-2017-0136","title":"Updated kernel packages fixes security vulnerabilities","description":"This kernel update is based on upstream 4.4.65 and fixes at least\nthe following security issues:\n\nfs/namespace.c in the Linux kernel before 4.9 does not restrict how many\nmounts may exist in a mount namespace, which allows local users to cause\na denial of service (memory consumption and deadlock) via MS_BIND mount\nsystem calls, as demonstrated by a loop that triggers exponential growth\nin the number of mounts (CVE-2016-6213).\n\nThe xc2028_set_config function in drivers/media/tuners/tuner-xc2028.c in\nthe Linux kernel before 4.6 allows local users to gain privileges or cause\na denial of service (use-after-free) via vectors involving omission of the\nfirmware name from a certain data structure (CVE-2016-7913).\n\nThe nfnetlink_rcv_batch function in net/netfilter/nfnetlink.c in the Linux\nkernel before 4.5 does not check whether a batch message's length field is\nlarge enough, which allows local users to obtain sensitive information from\nkernel memory or cause a denial of service (infinite loop or out-of-bounds\nread) by leveraging the CAP_NET_ADMIN capability (CVE-2016-7917).\n\nThe tipc_msg_build function in net/tipc/msg.c in the Linux kernel through\n4.8.11 does not validate the relationship between the minimum fragment\nlength and the maximum packet size, which allows local users to gain\nprivileges or cause a denial of service (heap-based buffer overflow) by\nleveraging the CAP_NET_ADMIN capability (CVE-2016-8632).\n\ndrivers/vfio/pci/vfio_pci.c in the Linux kernel through 4.8.11 allows local\nusers to bypass integer overflow checks, and cause a denial of service\n(memory corruption) or have unspecified other impact, by leveraging access\nto a vfio PCI device file for a VFIO_DEVICE_SET_IRQS ioctl call, aka a\n\"state machine confusion bug\" (CVE-2016-9083).\n\ndrivers/vfio/pci/vfio_pci_intrs.c in the Linux kernel through 4.8.11\nmisuses the kzalloc function, which allows local users to cause a denial\nof service (integer overflow) or have unspecified other impact by\nleveraging access to a vfio PCI device file (CVE-2016-9084).\n\nIt was discovered that root can gain direct access to an internal keyring,\nsuch as '.builtin_trusted_keys' upstream, by joining it as its session\nkeyring. This allows root to bypass module signature verification by adding\na new public key of its own devising to the keyring (CVE-2016-9604).\n\nThe ping_unhash function in net/ipv4/ping.c in the Linux kernel through\n4.10.8 is too late in obtaining a certain lock and consequently cannot\nensure that disconnect function calls are safe, which allows local users\nto cause a denial of service (panic) by leveraging access to the protocol\nvalue of IPPROTO_ICMP in a socket system call (CVE-2017-2671).\n\nRace condition in kernel/events/core.c in the Linux kernel before 4.9.7\nallows local users to gain privileges via a crafted application that makes\nconcurrent perf_event_open system calls for moving a software group into a\nhardware context. NOTE: this vulnerability exists because of an incomplete\nfix for CVE-2016-6786 (CVE-2017-6001).\n\nThe keyring_search_aux function in security/keys/keyring.c in the Linux\nkernel through 3.14.79 allows local users to cause a denial of service\n(NULL pointer dereference and OOPS) via a request_key system call for the\n\"dead\" type (CVE-2017-6951).\n\nThe packet_set_ring function in net/packet/af_packet.c in the Linux kernel\nthrough 4.10.6 does not properly validate certain block-size data, which\nallows local users to cause a denial of service (overflow) or possibly have\nunspecified other impact via crafted system calls (CVE-2017-7308).\n\nA vulnerability was found in the Linux kernel. It was found that\nkeyctl_set_reqkey_keyring() function leaks thread keyring which allows\nunprivileged local user to exhaust kernel memory (CVE-2017-7472).\n\nFor other upstream fixes in this update, see the referenced changelogs.\n","status":"published","published":"2017-05-10T20:47:44Z","modified":"2026-04-16T06:23:14.218484255Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"MGASA-2017-0147","title":"Updated kernel-tmb packages fixes security vulnerabilities","description":"This kernel-tmb update is based on upstream 4.4.68 and fixes at least\nthe following security issues:\n\nfs/namespace.c in the Linux kernel before 4.9 does not restrict how many\nmounts may exist in a mount namespace, which allows local users to cause\na denial of service (memory consumption and deadlock) via MS_BIND mount\nsystem calls, as demonstrated by a loop that triggers exponential growth\nin the number of mounts (CVE-2016-6213).\n\nThe xc2028_set_config function in drivers/media/tuners/tuner-xc2028.c in\nthe Linux kernel before 4.6 allows local users to gain privileges or cause\na denial of service (use-after-free) via vectors involving omission of the\nfirmware name from a certain data structure (CVE-2016-7913).\n\nThe nfnetlink_rcv_batch function in net/netfilter/nfnetlink.c in the Linux\nkernel before 4.5 does not check whether a batch message's length field is\nlarge enough, which allows local users to obtain sensitive information from\nkernel memory or cause a denial of service (infinite loop or out-of-bounds\nread) by leveraging the CAP_NET_ADMIN capability (CVE-2016-7917).\n\nThe tipc_msg_build function in net/tipc/msg.c in the Linux kernel through\n4.8.11 does not validate the relationship between the minimum fragment\nlength and the maximum packet size, which allows local users to gain\nprivileges or cause a denial of service (heap-based buffer overflow) by\nleveraging the CAP_NET_ADMIN capability (CVE-2016-8632).\n\ndrivers/vfio/pci/vfio_pci.c in the Linux kernel through 4.8.11 allows local\nusers to bypass integer overflow checks, and cause a denial of service\n(memory corruption) or have unspecified other impact, by leveraging access\nto a vfio PCI device file for a VFIO_DEVICE_SET_IRQS ioctl call, aka a\n\"state machine confusion bug\" (CVE-2016-9083).\n\ndrivers/vfio/pci/vfio_pci_intrs.c in the Linux kernel through 4.8.11\nmisuses the kzalloc function, which allows local users to cause a denial\nof service (integer overflow) or have unspecified other impact by\nleveraging access to a vfio PCI device file (CVE-2016-9084).\n\nIt was discovered that root can gain direct access to an internal keyring,\nsuch as '.builtin_trusted_keys' upstream, by joining it as its session\nkeyring. This allows root to bypass module signature verification by adding\na new public key of its own devising to the keyring (CVE-2016-9604).\n\nThe ping_unhash function in net/ipv4/ping.c in the Linux kernel through\n4.10.8 is too late in obtaining a certain lock and consequently cannot\nensure that disconnect function calls are safe, which allows local users\nto cause a denial of service (panic) by leveraging access to the protocol\nvalue of IPPROTO_ICMP in a socket system call (CVE-2017-2671).\n\nRace condition in kernel/events/core.c in the Linux kernel before 4.9.7\nallows local users to gain privileges via a crafted application that makes\nconcurrent perf_event_open system calls for moving a software group into a\nhardware context. NOTE: this vulnerability exists because of an incomplete\nfix for CVE-2016-6786 (CVE-2017-6001).\n\nThe keyring_search_aux function in security/keys/keyring.c in the Linux\nkernel through 3.14.79 allows local users to cause a denial of service\n(NULL pointer dereference and OOPS) via a request_key system call for the\n\"dead\" type (CVE-2017-6951).\n\nThe packet_set_ring function in net/packet/af_packet.c in the Linux kernel\nthrough 4.10.6 does not properly validate certain block-size data, which\nallows local users to cause a denial of service (overflow) or possibly have\nunspecified other impact via crafted system calls (CVE-2017-7308).\n\nA vulnerability was found in the Linux kernel. It was found that\nkeyctl_set_reqkey_keyring() function leaks thread keyring which allows\nunprivileged local user to exhaust kernel memory (CVE-2017-7472).\n\nThe NFSv2/NFSv3 server in the nfsd subsystem in the Linux kernel through\n4.10.11 allows remote attackers to cause a denial of service (system crash)\nvia a long RPC reply, related to net/sunrpc/svc.c, fs/nfsd/nfs3xdr.c, and\nfs/nfsd/nfsxdr.c (CVE-2017-7645).\n\nThe NFSv2 and NFSv3 server implementations in the Linux kernel through\n4.10.13 lack certain checks for the end of a buffer, which allows remote\nattackers to trigger pointer-arithmetic errors or possibly have unspecified\nother impact via crafted requests, related to fs/nfsd/nfs3xdr.c and\nfs/nfsd/nfsxdr.c (CVE-2017-7895).\n\nFor other upstream fixes in this update, see the referenced changelogs.\n","status":"published","published":"2017-05-26T06:54:58Z","modified":"2026-04-16T06:24:55.14066521Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"MGASA-2017-0148","title":"Updated kernel-linus packages fixes security vulnerabilities","description":"This kernel-linus update is based on upstream 4.4.68 and fixes at least\nthe following security issues:\n\nfs/namespace.c in the Linux kernel before 4.9 does not restrict how many\nmounts may exist in a mount namespace, which allows local users to cause\na denial of service (memory consumption and deadlock) via MS_BIND mount\nsystem calls, as demonstrated by a loop that triggers exponential growth\nin the number of mounts (CVE-2016-6213).\n\nThe xc2028_set_config function in drivers/media/tuners/tuner-xc2028.c in\nthe Linux kernel before 4.6 allows local users to gain privileges or cause\na denial of service (use-after-free) via vectors involving omission of the\nfirmware name from a certain data structure (CVE-2016-7913).\n\nThe nfnetlink_rcv_batch function in net/netfilter/nfnetlink.c in the Linux\nkernel before 4.5 does not check whether a batch message's length field is\nlarge enough, which allows local users to obtain sensitive information from\nkernel memory or cause a denial of service (infinite loop or out-of-bounds\nread) by leveraging the CAP_NET_ADMIN capability (CVE-2016-7917).\n\nThe tipc_msg_build function in net/tipc/msg.c in the Linux kernel through\n4.8.11 does not validate the relationship between the minimum fragment\nlength and the maximum packet size, which allows local users to gain\nprivileges or cause a denial of service (heap-based buffer overflow) by\nleveraging the CAP_NET_ADMIN capability (CVE-2016-8632).\n\ndrivers/vfio/pci/vfio_pci.c in the Linux kernel through 4.8.11 allows local\nusers to bypass integer overflow checks, and cause a denial of service\n(memory corruption) or have unspecified other impact, by leveraging access\nto a vfio PCI device file for a VFIO_DEVICE_SET_IRQS ioctl call, aka a\n\"state machine confusion bug\" (CVE-2016-9083).\n\ndrivers/vfio/pci/vfio_pci_intrs.c in the Linux kernel through 4.8.11\nmisuses the kzalloc function, which allows local users to cause a denial\nof service (integer overflow) or have unspecified other impact by\nleveraging access to a vfio PCI device file (CVE-2016-9084).\n\nIt was discovered that root can gain direct access to an internal keyring,\nsuch as '.builtin_trusted_keys' upstream, by joining it as its session\nkeyring. This allows root to bypass module signature verification by adding\na new public key of its own devising to the keyring (CVE-2016-9604).\n\nThe ping_unhash function in net/ipv4/ping.c in the Linux kernel through\n4.10.8 is too late in obtaining a certain lock and consequently cannot\nensure that disconnect function calls are safe, which allows local users\nto cause a denial of service (panic) by leveraging access to the protocol\nvalue of IPPROTO_ICMP in a socket system call (CVE-2017-2671).\n\nRace condition in kernel/events/core.c in the Linux kernel before 4.9.7\nallows local users to gain privileges via a crafted application that makes\nconcurrent perf_event_open system calls for moving a software group into a\nhardware context. NOTE: this vulnerability exists because of an incomplete\nfix for CVE-2016-6786 (CVE-2017-6001).\n\nThe keyring_search_aux function in security/keys/keyring.c in the Linux\nkernel through 3.14.79 allows local users to cause a denial of service\n(NULL pointer dereference and OOPS) via a request_key system call for the\n\"dead\" type (CVE-2017-6951).\n\nThe packet_set_ring function in net/packet/af_packet.c in the Linux kernel\nthrough 4.10.6 does not properly validate certain block-size data, which\nallows local users to cause a denial of service (overflow) or possibly have\nunspecified other impact via crafted system calls (CVE-2017-7308).\n\nA vulnerability was found in the Linux kernel. It was found that\nkeyctl_set_reqkey_keyring() function leaks thread keyring which allows\nunprivileged local user to exhaust kernel memory (CVE-2017-7472).\n\nThe NFSv2/NFSv3 server in the nfsd subsystem in the Linux kernel through\n4.10.11 allows remote attackers to cause a denial of service (system crash)\nvia a long RPC reply, related to net/sunrpc/svc.c, fs/nfsd/nfs3xdr.c, and\nfs/nfsd/nfsxdr.c (CVE-2017-7645).\n\nThe NFSv2 and NFSv3 server implementations in the Linux kernel through\n4.10.13 lack certain checks for the end of a buffer, which allows remote\nattackers to trigger pointer-arithmetic errors or possibly have unspecified\nother impact via crafted requests, related to fs/nfsd/nfs3xdr.c and\nfs/nfsd/nfsxdr.c (CVE-2017-7895).\n\nFor other upstream fixes in this update, see the referenced changelogs.\n","status":"published","published":"2017-05-26T06:54:58Z","modified":"2026-04-16T06:25:22.878869572Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"SUSE-SU-2018:0011-1","title":"Security update for the Linux Kernel","description":"\n\nThe SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes.\n\nThis update adds mitigations for various side channel attacks against\nmodern CPUs that could disclose content of otherwise unreadable memory\n(bnc#1068032).\n\n- CVE-2017-5753: Local attackers on systems with modern CPUs featuring\n  deep instruction pipelining could use attacker controllable speculative\n  execution over code patterns in the Linux Kernel to leak content from\n  otherwise not readable memory in the same address space, allowing\n  retrieval of passwords, cryptographic keys and other secrets.\n\n  This problem is mitigated by adding speculative fencing on affected\n  code paths throughout the Linux kernel.\n\n  This issue is addressed for the x86_64, the IBM Power and IBM zSeries\n  architecture.\n\n- CVE-2017-5715: Local attackers on systems with modern CPUs featuring\n  branch prediction could use mispredicted branches to speculatively execute\n  code patterns that in turn could be made to leak other non-readable\n  content in the same address space, an attack similar to CVE-2017-5753.\n\n  This problem is mitigated by disabling predictive branches, depending\n  on CPU architecture either by firmware updates and/or fixes in the\n  user-kernel privilege boundaries.\n\n  This is done with help of Linux Kernel fixes on the Intel/AMD x86_64 and\n  IBM zSeries architectures. On x86_64, this requires also updates of the\n  CPU microcode packages, delivered in seperate updates.\n\n  For IBM Power and zSeries the required firmware updates are supplied\n  over regular channels by IBM.\n\n  As this feature can have a performance impact, it can be disabled using\n  the 'nospec' kernel commandline option.\n\n- CVE-2017-5754: Local attackers on systems with modern CPUs featuring\n  deep instruction pipelining could use code patterns in userspace to\n  speculative executive code that would read otherwise read protected\n  memory, an attack similar to CVE-2017-5753.\n\n  This problem is mitigated by unmapping the Linux Kernel from the user\n  address space during user code execution, following a approach called\n  'KAISER'. The terms used here are 'KAISER' / 'Kernel Address Isolation'\n  and 'PTI' / 'Page Table Isolation'.\n\n  This update does this on the Intel x86_64 and IBM Power\n  architecture. Updates are also necessary for the ARM architecture,\n  but will be delivered in the next round of updates.\n\n  This feature can be enabled / disabled by the 'pti=[on|off|auto]' or\n  'nopti' commandline options.\n\n\nThe following security bugs were fixed:\n\n- CVE-2017-17806: The HMAC implementation (crypto/hmac.c) in the Linux kernel did not validate that the underlying cryptographic hash algorithm is unkeyed, allowing a local attacker able to use the AF_ALG-based hash interface (CONFIG_CRYPTO_USER_API_HASH) and the SHA-3 hash algorithm (CONFIG_CRYPTO_SHA3) to cause a kernel stack buffer overflow by executing a crafted sequence of system calls that encounter a missing SHA-3 initialization (bnc#1073874).\n- CVE-2017-17805: The Salsa20 encryption algorithm in the Linux kernel did not correctly handle zero-length inputs, allowing a local attacker able to use the AF_ALG-based skcipher interface (CONFIG_CRYPTO_USER_API_SKCIPHER) to cause a denial of service (uninitialized-memory free and kernel crash) or have unspecified other impact by executing a crafted sequence of system calls that use the blkcipher_walk API. Both the generic implementation (crypto/salsa20_generic.c) and x86 implementation (arch/x86/crypto/salsa20_glue.c) of Salsa20 were vulnerable (bnc#1073792).\n- CVE-2017-15868: The bnep_add_connection function in net/bluetooth/bnep/core.c in the Linux kernel did not ensure that an l2cap socket is available, which allowed local users to gain privileges via a crafted application (bnc#1071470).\n- CVE-2017-13167: An elevation of privilege vulnerability in the kernel sound timer. (bnc#1072876).\n- CVE-2017-16538: drivers/media/usb/dvb-usb-v2/lmedm04.c in the Linux kernel allowed local users to cause a denial of service (general protection fault and system crash) or possibly have unspecified other impact via a crafted USB device, related to a missing warm-start check and incorrect attach timing (dm04_lme2510_frontend_attach versus dm04_lme2510_tuner) (bnc#1066569).\n- CVE-2017-17558: The usb_destroy_configuration function in drivers/usb/core/config.c in the USB core subsystem in the Linux kernel did not consider the maximum number of configurations and interfaces before attempting to release resources, which allowed local users to cause a denial of service (out-of-bounds write access) or possibly have unspecified other impact via a crafted USB device (bnc#1072561).\n- CVE-2017-17450: net/netfilter/xt_osf.c in the Linux kernel did not require the CAP_NET_ADMIN capability for add_callback and remove_callback operations, which allowed local users to bypass intended access restrictions because the xt_osf_fingers data structure is shared across all net namespaces (bnc#1071695).\n- CVE-2017-8824: The dccp_disconnect function in net/dccp/proto.c in the Linux kernel allowed local users to gain privileges or cause a denial of service (use-after-free) via an AF_UNSPEC connect system call during the DCCP_LISTEN state (bnc#1070771).\n- CVE-2017-16939: The XFRM dump policy implementation in net/xfrm/xfrm_user.c in the Linux kernel allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages (bnc#1069702).\n- CVE-2017-15115: The sctp_do_peeloff function in net/sctp/socket.c in the Linux kernel did not check whether the intended netns is used in a peel-off action, which allowed local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via crafted system calls (bnc#1068671).\n- CVE-2017-14106: The tcp_disconnect function in net/ipv4/tcp.c in the Linux kernel allowed local users to cause a denial of service (__tcp_select_window divide-by-zero error and system crash) by triggering a disconnect within a certain tcp_recvmsg code path (bnc#1056982).\n- CVE-2017-11600: net/xfrm/xfrm_policy.c in the Linux kernel through 4.12.3, when CONFIG_XFRM_MIGRATE is enabled, did not ensure that the dir value of xfrm_userpolicy_id is XFRM_POLICY_MAX or less, which allowed local users to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via an XFRM_MSG_MIGRATE xfrm Netlink message (bnc#1050231).\n- CVE-2017-7472: The KEYS subsystem in the Linux kernel allowed local users to cause a denial of service (memory consumption) via a series of KEY_REQKEY_DEFL_THREAD_KEYRING keyctl_set_reqkey_keyring calls (bnc#1034862).\n- CVE-2017-16534: The cdc_parse_cdc_header function in drivers/usb/core/message.c in the Linux kernel allowed local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066693).\n\nThe following non-security bugs were fixed:\n\n- adm80211: return an error if adm8211_alloc_rings() fails (bsc#1048185).\n- autofs: fix careless error in recent commit (bsc#1065180).\n- bpf: prevent speculative execution in eBPF interpreter (bnc#1068032).\n- carl9170: prevent speculative execution (bnc#1068032).\n- ecryptfs: fix dereference of NULL user_key_payload (bsc#1013018).\n- eCryptfs: use after free in ecryptfs_release_messaging() (bsc#1013018).\n- fs/9p: Compare qid.path in v9fs_test_inode (bsc#1013018).\n- fs: prevent speculative execution (bnc#1068032).\n- isa: Prevent NULL dereference in isa_bus driver callbacks (bsc#1045538).\n- kabi: silence spurious kabi error in net/sctp/socket.c (bsc#1068671).\n- kaiser: add 'nokaiser' boot option, using ALTERNATIVE.\n- kaiser: fix ldt freeing.\n- kaiser: Kernel Address Isolation.\n- kaiser: use ALTERNATIVE instead of x86_cr3_pcid_noflush.\n- kaiser: work around kABI.\n- kvm: SVM: Do not intercept new speculative control MSRs (bsc#1068032).\n- kvm: x86: Add speculative control CPUID support for guests (bsc#1068032).\n- locking/barriers: introduce new memory barrier gmb() (bnc#1068032).\n- media: cx231xx-cards: fix NULL-deref at probe (bsc#1050431).\n- mm/madvise.c: fix madvise() infinite loop under special circumstances (bnc#1070964).\n- mm/mmu_context, sched/core: Fix mmu_context.h assumption.\n- p54: prevent speculative execution (bnc#1068032).\n- powerpc/barrier: add gmb.\n- powerpc: Secure memory rfi flush (bsc#1068032).\n- ptrace: Add a new thread access check (bsc#1068032).\n- qeth: check not more than 16 SBALEs on the completion queue (bnc#1072457, LTC#148203).\n- s390: add ppa to system call and program check path (bsc#1068032).\n- s390/disassembler: correct disassembly lines alignment (bnc#1066973, LTC#161577).\n- s390/disassembler: increase show_code buffer size (bnc#1066973, LTC#161577).\n- s390: fix transactional execution control register handling (bnc#1072457, LTC#162116).\n- s390: introduce CPU alternatives.\n- s390: introduce CPU alternatives (bsc#1068032).\n- s390/spinlock: add gmb memory barrier.\n- s390/spinlock: add gmb memory barrier (bsc#1068032).\n- s390/spinlock: add ppa to system call path.\n- sched/core: Add switch_mm_irqs_off() and use it in the scheduler.\n- sched/core: Idle_task_exit() shouldn't use switch_mm_irqs_off().\n- scsi_scan: Exit loop if TUR to LUN0 fails with 0x05/0x25 (bsc#1063043). This is specific to FUJITSU ETERNUS_DX* targets. They can return 'Illegal Request - Logical unit not supported' and processing should leave the timeout loop in this case.\n- scsi: zfcp: fix erp_action use-before-initialize in REC action trace (bnc#1066973, LTC#160081).\n- temporary fix (bsc#1068032).\n- udf: prevent speculative execution (bnc#1068032).\n- usb: host: fix incorrect updating of offset (bsc#1047487).\n- usb: uas: fix bug in handling of alternate settings (bsc#1071074).\n- uvcvideo: prevent speculative execution (bnc#1068032).\n- video: udlfb: Fix read EDID timeout (bsc#1045538).\n- watchdog: hpwdt: add support for iLO5 (bsc#1024612).\n- watchdog/hpwdt: Check source of NMI (bsc#1024612).\n- x86-64: Give vvars their own page.\n- x86-64: Map the HPET NX.\n- x86/acpi: Handle SCI interrupts above legacy space gracefully (bsc#1068984).\n- x86/acpi: Reduce code duplication in mp_override_legacy_irq() (bsc#1068984).\n- x86/alternatives: Add instruction padding.\n- x86/alternatives: Cleanup DPRINTK macro.\n- x86/alternatives: Make JMPs more robust.\n- x86/alternatives: Use optimized NOPs for padding.\n- x86/boot: Add early cmdline parsing for options with arguments.\n- x86, boot: Carve out early cmdline parsing function.\n- x86/CPU/AMD: Add speculative control support for AMD (bsc#1068032).\n- x86/CPU/AMD: Make the LFENCE instruction serialized (bsc#1068032).\n- x86/CPU/AMD: Remove now unused definition of MFENCE_RDTSC feature (bsc#1068032).\n- x86/CPU: Check speculation control CPUID bit (bsc#1068032).\n- x86/cpu: Fix bootup crashes by sanitizing the argument of the 'clearcpuid=' command-line option (bsc#1065600).\n- x86/enter: Add macros to set/clear IBRS and set IBPB (bsc#1068032).\n- x86/entry: Add a function to overwrite the RSB (bsc#1068032).\n- x86/entry: Stuff RSB for entry to kernel for non-SMEP platform (bsc#1068032).\n- x86/entry: Use IBRS on entry to kernel space (bsc#1068032).\n- x86/feature: Enable the x86 feature to control Speculation (bsc#1068032).\n- x86/idle: Disable IBRS when offlining a CPU and re-enable on wakeup (bsc#1068032).\n- x86/idle: Toggle IBRS when going idle (bsc#1068032).\n- x86/kaiser: Check boottime cmdline params.\n- x86/kaiser: disable vmstat accounting.\n- x86/kaiser: Move feature detection up (bsc#1068032).\n- x86/kaiser: propagate info to /proc/cpuinfo.\n- x86/kaiser: Rename and simplify X86_FEATURE_KAISER handling.\n- x86/kvm: Add MSR_IA32_SPEC_CTRL and MSR_IA32_PRED_CMD to kvm (bsc#1068032).\n- x86/kvm: Flush IBP when switching VMs (bsc#1068032).\n- x86/kvm: Pad RSB on VM transition (bsc#1068032).\n- x86/kvm: Toggle IBRS on VM entry and exit (bsc#1068032).\n- x86: Make alternative instruction pointers relative.\n- x86/microcode/AMD: Add support for fam17h microcode loading (bsc#1068032).\n- x86/mm/64: Fix reboot interaction with CR4.PCIDE.\n- x86/mm: Add a 'noinvpcid' boot option to turn off INVPCID.\n- x86/mm: Add INVPCID helpers.\n- x86/mm: Add the 'nopcid' boot option to turn off PCID.\n- x86/mm: Build arch/x86/mm/tlb.c even on !SMP.\n- x86/mm: Disable PCID on 32-bit kernels.\n- x86/mm: Enable CR4.PCIDE on supported systems.\n- x86/mm: fix bad backport to disable PCID on Xen.\n- x86/mm: Fix INVPCID asm constraint.\n- x86/mm: If INVPCID is available, use it to flush global mappings.\n- x86/mm/kaiser: re-enable vsyscalls.\n- x86/mm: Only set IBPB when the new thread cannot ptrace current thread (bsc#1068032).\n- x86/mm: Remove the UP asm/tlbflush.h code, always use the (formerly) SMP code.\n- x86/mm, sched/core: Turn off IRQs in switch_mm().\n- x86/mm, sched/core: Uninline switch_mm().\n- x86/mm: Set IBPB upon context switch (bsc#1068032).\n- x86/MSR: Move native_*msr(.. u64) to msr.h (bsc#1068032).\n- x86/spec: Add IBRS control functions (bsc#1068032).\n- x86/spec: Add 'nospec' chicken bit (bsc#1068032).\n- x86/spec: Check CPUID direclty post microcode reload to support IBPB feature (bsc#1068032).\n- x86/spec_ctrl: Add an Indirect Branch Predictor barrier (bsc#1068032).\n- x86/spec_ctrl: Check whether IBPB is enabled before using it (bsc#1068032).\n- x86/spec_ctrl: Check whether IBRS is enabled before using it (bsc#1068032).\n- x86/svm: Add code to clear registers on VM exit (bsc#1068032).\n- x86/svm: Clobber the RSB on VM exit (bsc#1068032).\n- x86/svm: Set IBPB when running a different VCPU (bsc#1068032).\n- x86/svm: Set IBRS value on VM entry and exit (bsc#1068032).\n- xen/kaiser: add 'nokaiser' boot option, using ALTERNATIVE.\n- xen/KAISER: Kernel Address Isolation.\n- xen/kaiser: use ALTERNATIVE instead of x86_cr3_pcid_noflush.\n- xen/kaiser: work around kABI.\n- xen/x86-64: Give vvars their own page.\n- xen/x86-64: Map the HPET NX.\n- xen/x86/alternatives: Add instruction padding.\n- xen/x86/kaiser: Rename and simplify X86_FEATURE_KAISER handling.\n- xen/x86/mm: Enable CR4.PCIDE on supported systems.\n- xen/x86/mm/kaiser: re-enable vsyscalls.\n- xen/x86/mm: Remove the UP asm/tlbflush.h code, always use the (formerly) SMP code.\n- xen: x86/mm, sched/core: Turn off IRQs in switch_mm().\n- xen: x86/mm, sched/core: Uninline switch_mm().\n- zd1211rw: fix NULL-deref at probe (bsc#1045479).\n","status":"published","published":"2018-01-04T07:51:57Z","modified":"2026-02-04T02:36:27.614731Z","updated_at":"2026-11-02T15:53:44.594517Z"},{"id":"SUSE-SU-2018:0040-1","title":"Security update for the Linux Kernel","description":"\n\nThe SUSE Linux Enterprise 11 SP3 LTSS kernel was updated to receive various security and bugfixes.\n\nThis update adds mitigations for various side channel attacks against\nmodern CPUs that could disclose content of otherwise unreadable memory\n(bnc#1068032).\n\n- CVE-2017-5753: Local attackers on systems with modern CPUs featuring\n  deep instruction pipelining could use attacker controllable speculative\n  execution over code patterns in the Linux Kernel to leak content from\n  otherwise not readable memory in the same address space, allowing\n  retrieval of passwords, cryptographic keys and other secrets.\n\n  This problem is mitigated by adding speculative fencing on affected\n  code paths throughout the Linux kernel.\n\n\n- CVE-2017-5715: Local attackers on systems with modern CPUs featuring\n  branch prediction could use mispredicted branches to speculatively execute\n  code patterns that in turn could be made to leak other non-readable\n  content in the same address space, an attack similar to CVE-2017-5753.\n\n  This problem is mitigated by disabling predictive branches, depending\n  on CPU architecture either by firmware updates and/or fixes in the\n  user-kernel privilege boundaries.\n\n  Please contact your CPU / hardware vendor for potential microcode\n  or BIOS updates needed for this fix.\n\n  As this feature can have a performance impact, it can be disabled\n  using the 'nospec' kernel commandline option.\n\n\n- CVE-2017-5754: Local attackers on systems with modern CPUs featuring\n  deep instruction pipelining could use code patterns in userspace to\n  speculative executive code that would read otherwise read protected\n  memory, an attack similar to CVE-2017-5753.\n\n  This problem is mitigated by unmapping the Linux Kernel from the user\n  address space during user code execution, following a approach called\n  'KAISER'. The terms used here are 'KAISER' / 'Kernel Address Isolation'\n  and 'PTI' / 'Page Table Isolation'.\n\n  This feature is disabled on unaffected architectures.\n\n  This feature can be enabled / disabled by the 'pti=[on|off|auto]' or\n  'nopti' commandline options.\n\n\nThe following security bugs were fixed:\n\n- CVE-2017-1000251: The native Bluetooth stack in the Linux Kernel (BlueZ) was vulnerable to a stack overflow vulnerability in the processing of L2CAP configuration responses resulting in Remote code execution in kernel space (bnc#1057389).\n- CVE-2017-11600: net/xfrm/xfrm_policy.c in the Linux kernel did not ensure that the dir value of xfrm_userpolicy_id is XFRM_POLICY_MAX or less, which allowed local users to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via an XFRM_MSG_MIGRATE xfrm Netlink message (bnc#1050231).\n- CVE-2017-13080: Wi-Fi Protected Access (WPA and WPA2) allowed reinstallation of the Group Temporal Key (GTK) during the group key handshake, allowing an attacker within radio range to replay frames from access points to clients (bnc#1063667).\n- CVE-2017-13167: An elevation of privilege vulnerability in the kernel sound timer was fixed. (bnc#1072876).\n- CVE-2017-14106: The tcp_disconnect function in net/ipv4/tcp.c in the Linux kernel allowed local users to cause a denial of service (__tcp_select_window divide-by-zero error and system crash) by triggering a disconnect within a certain tcp_recvmsg code path (bnc#1056982).\n- CVE-2017-14140: The move_pages system call in mm/migrate.c in the Linux kernel didn't check the effective uid of the target process, enabling a local attacker to learn the memory layout of a setuid executable despite ASLR (bnc#1057179).\n- CVE-2017-14340: The XFS_IS_REALTIME_INODE macro in fs/xfs/xfs_linux.h in the Linux kernel did not verify that a filesystem has a realtime device, which allowed local users to cause a denial of service (NULL pointer dereference and OOPS) via vectors related to setting an RHINHERIT flag on a directory (bnc#1058524).\n- CVE-2017-15102: The tower_probe function in drivers/usb/misc/legousbtower.c in the Linux kernel allowed local users (who are physically proximate for inserting a crafted USB device) to gain privileges by leveraging a write-what-where condition that occurs after a race condition and a NULL pointer dereference (bnc#1066705).\n- CVE-2017-15115: The sctp_do_peeloff function in net/sctp/socket.c in the Linux kernel did not check whether the intended netns is used in a peel-off action, which allowed local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via crafted system calls (bnc#1068671).\n- CVE-2017-15265: Race condition in the ALSA subsystem in the Linux kernel allowed local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted /dev/snd/seq ioctl calls, related to sound/core/seq/seq_clientmgr.c and sound/core/seq/seq_ports.c (bnc#1062520).\n- CVE-2017-15274: security/keys/keyctl.c in the Linux kernel did not consider the case of a NULL payload in conjunction with a nonzero length value, which allowed local users to cause a denial of service (NULL pointer dereference and OOPS) via a crafted add_key or keyctl system call, a different vulnerability than CVE-2017-12192 (bnc#1045327).\n- CVE-2017-15868: The bnep_add_connection function in net/bluetooth/bnep/core.c in the Linux kernel did not ensure that an l2cap socket is available, which allowed local users to gain privileges via a crafted application (bnc#1071470).\n- CVE-2017-16525: The usb_serial_console_disconnect function in drivers/usb/serial/console.c in the Linux kernel allowed local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via a crafted USB device, related to disconnection and failed setup (bnc#1066618).\n- CVE-2017-16527: sound/usb/mixer.c in the Linux kernel allowed local users to cause a denial of service (snd_usb_mixer_interrupt use-after-free and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066625).\n- CVE-2017-16529: The snd_usb_create_streams function in sound/usb/card.c in the Linux kernel allowed local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066650).\n- CVE-2017-16531: drivers/usb/core/config.c in the Linux kernel allowed local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device, related to the USB_DT_INTERFACE_ASSOCIATION descriptor (bnc#1066671).\n- CVE-2017-16534: The cdc_parse_cdc_header function in drivers/usb/core/message.c in the Linux kernel allowed local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066693).\n- CVE-2017-16535: The usb_get_bos_descriptor function in drivers/usb/core/config.c in the Linux kernel allowed local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066700).\n- CVE-2017-16536: The cx231xx_usb_probe function in drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux kernel allowed local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066606).\n- CVE-2017-16537: The imon_probe function in drivers/media/rc/imon.c in the Linux kernel allowed local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066573).\n- CVE-2017-16538: drivers/media/usb/dvb-usb-v2/lmedm04.c in the Linux kernel allowed local users to cause a denial of service (general protection fault and system crash) or possibly have unspecified other impact via a crafted USB device, related to a missing warm-start check and incorrect attach timing (dm04_lme2510_frontend_attach versus dm04_lme2510_tuner) (bnc#1066569).\n- CVE-2017-16649: The usbnet_generic_cdc_bind function in drivers/net/usb/cdc_ether.c in the Linux kernel allowed local users to cause a denial of service (divide-by-zero error and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1067085).\n- CVE-2017-16939: The XFRM dump policy implementation in net/xfrm/xfrm_user.c in the Linux kernel allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages (bnc#1069702 1069708).\n- CVE-2017-17450: net/netfilter/xt_osf.c in the Linux kernel did not require the CAP_NET_ADMIN capability for add_callback and remove_callback operations, which allowed local users to bypass intended access restrictions because the xt_osf_fingers data structure is shared across all net namespaces (bnc#1071695 1074033).\n- CVE-2017-17558: The usb_destroy_configuration function in drivers/usb/core/config.c in the USB core subsystem in the Linux kernel did not consider the maximum number of configurations and interfaces before attempting to release resources, which allowed local users to cause a denial of service (out-of-bounds write access) or possibly have unspecified other impact via a crafted USB device (bnc#1072561).\n- CVE-2017-17805: The Salsa20 encryption algorithm in the Linux kernel did not correctly handle zero-length inputs, allowing a local attacker able to use the AF_ALG-based skcipher interface (CONFIG_CRYPTO_USER_API_SKCIPHER) to cause a denial of service (uninitialized-memory free and kernel crash) or have unspecified other impact by executing a crafted sequence of system calls that use the blkcipher_walk API. Both the generic implementation (crypto/salsa20_generic.c) and x86 implementation (arch/x86/crypto/salsa20_glue.c) of Salsa20 were vulnerable (bnc#1073792).\n- CVE-2017-17806: The HMAC implementation (crypto/hmac.c) in the Linux kernel did not validate that the underlying cryptographic hash algorithm is unkeyed, allowing a local attacker able to use the AF_ALG-based hash interface (CONFIG_CRYPTO_USER_API_HASH) and the SHA-3 hash algorithm (CONFIG_CRYPTO_SHA3) to cause a kernel stack buffer overflow by executing a crafted sequence of system calls that encounter a missing SHA-3 initialization (bnc#1073874).\n- CVE-2017-7472: The KEYS subsystem in the Linux kernel allowed local users to cause a denial of service (memory consumption) via a series of KEY_REQKEY_DEFL_THREAD_KEYRING keyctl_set_reqkey_keyring calls (bnc#1034862).\n- CVE-2017-8824: The dccp_disconnect function in net/dccp/proto.c in the Linux kernel allowed local users to gain privileges or cause a denial of service (use-after-free) via an AF_UNSPEC connect system call during the DCCP_LISTEN state (bnc#1070771).\n\nThe following non-security bugs were fixed:\n\n- asm alternatives: remove incorrect alignment notes.\n- getcwd: Close race with d_move called by lustre (bsc#1052593).\n- kabi: silence spurious kabi error in net/sctp/socket.c (bsc#1068671).\n- kaiser: add 'nokaiser' boot option, using ALTERNATIVE.\n- kaiser: fix ldt freeing.\n- kaiser: Kernel Address Isolation.\n- kaiser: use ALTERNATIVE instead of x86_cr3_pcid_noflush.\n- kaiser: work around kABI.\n- kvm: SVM: Do not intercept new speculative control MSRs (bsc#1068032).\n- kvm: x86: Add speculative control CPUID support for guests (bsc#1068032).\n- mac80211: do not compare TKIP TX MIC key in reinstall prevention (bsc#1066472).\n- mm/mmu_context, sched/core: Fix mmu_context.h assumption.\n- nfs: Remove asserts from the NFS XDR code (bsc#1063544).\n- ptrace: Add a new thread access check (bsc#1068032).\n- Revert 'mac80211: accept key reinstall without changing anything' This reverts commit 1def0d4e1446974356bacd9f4be06eee32b66473.\n- s390: add ppa to system call and program check path (bsc#1068032).\n- s390: introduce CPU alternatives (bsc#1068032).\n- s390/spinlock: add gmb memory barrier (bsc#1068032).\n- sched/core: Add switch_mm_irqs_off() and use it in the scheduler.\n- sched/core: Idle_task_exit() shouldn't use switch_mm_irqs_off().\n- scsi: mpt2sas: fix cleanup on controller resource mapping failure (bsc#999245).\n- tcp: fix inet6_csk_route_req() for link-local addresses (bsc#1010175).\n- tcp: pass fl6 to inet6_csk_route_req() (bsc#1010175).\n- tcp: plug dst leak in tcp_v6_conn_request() (bsc#1010175).\n- tcp: use inet6_csk_route_req() in tcp_v6_send_synack() (bsc#1010175).\n- temporary fix (bsc#1068032).\n- usb: uas: fix bug in handling of alternate settings (bsc#1071074).\n- x86-64: Give vvars their own page.\n- x86-64: Map the HPET NX.\n- x86/alternatives: Add instruction padding.\n- x86/alternatives: Cleanup DPRINTK macro.\n- x86/alternatives: Make JMPs more robust.\n- x86/alternatives: Use optimized NOPs for padding.\n- x86/boot: Add early cmdline parsing for options with arguments.\n- x86, boot: Carve out early cmdline parsing function.\n- x86/CPU/AMD: Add speculative control support for AMD (bsc#1068032).\n- x86/CPU/AMD: Make the LFENCE instruction serialized (bsc#1068032).\n- x86/CPU/AMD: Remove now unused definition of MFENCE_RDTSC feature (bsc#1068032).\n- x86/CPU: Check speculation control CPUID bit (bsc#1068032).\n- x86/enter: Add macros to set/clear IBRS and set IBPB (bsc#1068032).\n- x86/entry: Add a function to overwrite the RSB (bsc#1068032).\n- x86/entry: Stuff RSB for entry to kernel for non-SMEP platform (bsc#1068032).\n- x86/entry: Use IBRS on entry to kernel space (bsc#1068032).\n- x86/feature: Enable the x86 feature to control Speculation (bsc#1068032).\n- x86/idle: Disable IBRS when offlining a CPU and re-enable on wakeup (bsc#1068032).\n- x86/idle: Toggle IBRS when going idle (bsc#1068032).\n- x86/kaiser: Check boottime cmdline params.\n- x86/kaiser: disable vmstat accounting.\n- x86/kaiser: Move feature detection up (bsc#1068032).\n- x86/kaiser: propagate info to /proc/cpuinfo.\n- x86/kaiser: Rename and simplify X86_FEATURE_KAISER handling.\n- x86/kvm: Add MSR_IA32_SPEC_CTRL and MSR_IA32_PRED_CMD to kvm (bsc#1068032).\n- x86/kvm: Flush IBP when switching VMs (bsc#1068032).\n- x86/kvm: Pad RSB on VM transition (bsc#1068032).\n- x86/kvm: Toggle IBRS on VM entry and exit (bsc#1068032).\n- x86: Make alternative instruction pointers relative.\n- x86/microcode/AMD: Add support for fam17h microcode loading (bsc#1068032).\n- x86/mm/64: Fix reboot interaction with CR4.PCIDE.\n- x86/mm: Add a 'noinvpcid' boot option to turn off INVPCID.\n- x86/mm: Add INVPCID helpers.\n- x86/mm: Add the 'nopcid' boot option to turn off PCID.\n- x86/mm: Build arch/x86/mm/tlb.c even on !SMP.\n- x86/mm: Disable PCID on 32-bit kernels.\n- x86/mm: Enable CR4.PCIDE on supported systems.\n- x86/mm: fix bad backport to disable PCID on Xen.\n- x86/mm: Fix INVPCID asm constraint.\n- x86/mm: If INVPCID is available, use it to flush global mappings.\n- x86/mm/kaiser: re-enable vsyscalls.\n- x86/mm: Only set IBPB when the new thread cannot ptrace current thread (bsc#1068032).\n- x86/mm: Remove the UP asm/tlbflush.h code, always use the (formerly) SMP code.\n- x86/mm, sched/core: Turn off IRQs in switch_mm().\n- x86/mm, sched/core: Uninline switch_mm().\n- x86/mm: Set IBPB upon context switch (bsc#1068032).\n- x86/MSR: Move native_*msr(.. u64) to msr.h (bsc#1068032).\n- x86/spec: Add IBRS control functions (bsc#1068032).\n- x86/spec: Add 'nospec' chicken bit (bsc#1068032).\n- x86/spec: Check CPUID direclty post microcode reload to support IBPB feature (bsc#1068032).\n- x86/spec_ctrl: Add an Indirect Branch Predictor barrier (bsc#1068032).\n- x86/spec_ctrl: Check whether IBPB is enabled before using it (bsc#1068032).\n- x86/spec_ctrl: Check whether IBRS is enabled before using it (bsc#1068032).\n- x86/svm: Add code to clear registers on VM exit (bsc#1068032).\n- x86/svm: Clobber the RSB on VM exit (bsc#1068032).\n- x86/svm: Set IBPB when running a different VCPU (bsc#1068032).\n- x86/svm: Set IBRS value on VM entry and exit (bsc#1068032).\n- xen/kaiser: add 'nokaiser' boot option, using ALTERNATIVE.\n- xen/KAISER: Kernel Address Isolation.\n- xen/kaiser: use ALTERNATIVE instead of x86_cr3_pcid_noflush.\n- xen/kaiser: work around kABI.\n- xen/x86-64: Give vvars their own page.\n- xen/x86-64: Map the HPET NX.\n- xen/x86/alternatives: Add instruction padding.\n- xen/x86/kaiser: Rename and simplify X86_FEATURE_KAISER handling.\n- xen/x86/mm: Enable CR4.PCIDE on supported systems.\n- xen/x86/mm/kaiser: re-enable vsyscalls.\n- xen/x86/mm: Remove the UP asm/tlbflush.h code, always use the (formerly) SMP code.\n- xen: x86/mm, sched/core: Turn off IRQs in switch_mm().\n- xen: x86/mm, sched/core: Uninline switch_mm().\n","status":"published","published":"2018-01-08T16:02:54Z","modified":"2026-02-04T03:48:54.385077Z","updated_at":"2026-11-02T15:53:44.594517Z"},{"id":"SUSE-SU-2018:0180-1","title":"Security update for the Linux Kernel","description":"\n\nThe SUSE Linux Enterprise 11 SP4 realtime kernel was updated to receive\nvarious security and bugfixes.\n\nThis update adds mitigations for various side channel attacks against\nmodern CPUs that could disclose content of otherwise unreadable memory\n(bnc#1068032).\n\n- CVE-2017-5753: Local attackers on systems with modern CPUs featuring\n  deep instruction pipelining could use attacker controllable speculative\n  execution over code patterns in the Linux Kernel to leak content from\n  otherwise not readable memory in the same address space, allowing\n  retrieval of passwords, cryptographic keys and other secrets.\n\n  This problem is mitigated by adding speculative fencing on affected\n  code paths throughout the Linux kernel.\n\n- CVE-2017-5715: Local attackers on systems with modern CPUs featuring\n  branch prediction could use mispredicted branches to speculatively execute\n  code patterns that in turn could be made to leak other non-readable\n  content in the same address space, an attack similar to CVE-2017-5753.\n\n  This problem is mitigated by disabling predictive branches, depending\n  on CPU architecture either by firmware updates and/or fixes in the\n  user-kernel privilege boundaries.\n\n  This is done with help of Linux Kernel fixes on the Intel/AMD x86_64\n  architectures.\n  On x86_64, this requires also updates of the CPU microcode packages,\n  delivered in seperate updates.\n\n  As this feature can have a performance impact, it can be disabled\n  using the 'nospec' kernel commandline option.\n\n\n- CVE-2017-5754: Local attackers on systems with modern CPUs featuring\n  deep instruction pipelining could use code patterns in userspace to\n  speculative executive code that would read otherwise read protected\n  memory, an attack similar to CVE-2017-5753.\n\n  This problem is mitigated by unmapping the Linux Kernel from the user\n  address space during user code execution, following a approach called\n  'KAISER'. The terms used here are 'KAISER' / 'Kernel Address Isolation'\n  and 'PTI' / 'Page Table Isolation'.\n\n\nThe following security bugs were fixed:\n\n- CVE-2017-11600: net/xfrm/xfrm_policy.c in the Linux kernel did not ensure that the dir value of xfrm_userpolicy_id is XFRM_POLICY_MAX or less, which allowed local users to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via an XFRM_MSG_MIGRATE xfrm Netlink message (bnc#1050231).\n- CVE-2017-13167: An elevation of privilege vulnerability in the kernel sound timer was fixed. (bnc#1072876).\n- CVE-2017-14106: The tcp_disconnect function in net/ipv4/tcp.c in the Linux kernel allowed local users to cause a denial of service (__tcp_select_window divide-by-zero error and system crash) by triggering a disconnect within a certain tcp_recvmsg code path (bnc#1056982).\n- CVE-2017-15102: The tower_probe function in drivers/usb/misc/legousbtower.c in the Linux kernel allowed local users (who are physically proximate for inserting a crafted USB device) to gain privileges by leveraging a write-what-where condition that occurs after a race condition and a NULL pointer dereference (bnc#1066705).\n- CVE-2017-15115: The sctp_do_peeloff function in net/sctp/socket.c in the Linux kernel did not check whether the intended netns is used in a peel-off action, which allowed local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via crafted system calls (bnc#1068671).\n- CVE-2017-15868: The bnep_add_connection function in net/bluetooth/bnep/core.c in the Linux kernel did not ensure that an l2cap socket is available, which allowed local users to gain privileges via a crafted application (bnc#1071470).\n- CVE-2017-16525: The usb_serial_console_disconnect function in drivers/usb/serial/console.c in the Linux kernel allowed local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via a crafted USB device, related to disconnection and failed setup (bnc#1066618).\n- CVE-2017-16527: sound/usb/mixer.c in the Linux kernel allowed local users to cause a denial of service (snd_usb_mixer_interrupt use-after-free and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066625).\n- CVE-2017-16529: The snd_usb_create_streams function in sound/usb/card.c in the Linux kernel allowed local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066650).\n- CVE-2017-16531: drivers/usb/core/config.c in the Linux kernel allowed local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device, related to the USB_DT_INTERFACE_ASSOCIATION descriptor (bnc#1066671).\n- CVE-2017-16534: The cdc_parse_cdc_header function in drivers/usb/core/message.c in the Linux kernel allowed local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066693).\n- CVE-2017-16535: The usb_get_bos_descriptor function in drivers/usb/core/config.c in the Linux kernel allowed local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066700).\n- CVE-2017-16536: The cx231xx_usb_probe function in drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux kernel allowed local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066606).\n- CVE-2017-16537: The imon_probe function in drivers/media/rc/imon.c in the Linux kernel allowed local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066573).\n- CVE-2017-16538: drivers/media/usb/dvb-usb-v2/lmedm04.c in the Linux kernel allowed local users to cause a denial of service (general protection fault and system crash) or possibly have unspecified other impact via a crafted USB device, related to a missing warm-start check and incorrect attach timing (dm04_lme2510_frontend_attach versus dm04_lme2510_tuner) (bnc#1066569).\n- CVE-2017-16649: The usbnet_generic_cdc_bind function in drivers/net/usb/cdc_ether.c in the Linux kernel allowed local users to cause a denial of service (divide-by-zero error and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1067085).\n- CVE-2017-16939: The XFRM dump policy implementation in net/xfrm/xfrm_user.c in the Linux kernel allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages (bnc#1069702).\n- CVE-2017-17450: net/netfilter/xt_osf.c in the Linux kernel did not require the CAP_NET_ADMIN capability for add_callback and remove_callback operations, which allowed local users to bypass intended access restrictions because the xt_osf_fingers data structure is shared across all net namespaces (bnc#1071695).\n- CVE-2017-17558: The usb_destroy_configuration function in drivers/usb/core/config.c in the USB core subsystem in the Linux kernel did not consider the maximum number of configurations and interfaces before attempting to release resources, which allowed local users to cause a denial of service (out-of-bounds write access) or possibly have unspecified other impact via a crafted USB device (bnc#1072561).\n- CVE-2017-17805: The Salsa20 encryption algorithm in the Linux kernel did not correctly handle zero-length inputs, allowing a local attacker able to use the AF_ALG-based skcipher interface (CONFIG_CRYPTO_USER_API_SKCIPHER) to cause a denial of service (uninitialized-memory free and kernel crash) or have unspecified other impact by executing a crafted sequence of system calls that use the blkcipher_walk API. Both the generic implementation (crypto/salsa20_generic.c) and x86 implementation (arch/x86/crypto/salsa20_glue.c) of Salsa20 were vulnerable (bnc#1073792).\n- CVE-2017-17806: The HMAC implementation (crypto/hmac.c) in the Linux kernel did not validate that the underlying cryptographic hash algorithm is unkeyed, allowing a local attacker able to use the AF_ALG-based hash interface (CONFIG_CRYPTO_USER_API_HASH) and the SHA-3 hash algorithm (CONFIG_CRYPTO_SHA3) to cause a kernel stack buffer overflow by executing a crafted sequence of system calls that encounter a missing SHA-3 initialization (bnc#1073874).\n- CVE-2017-7472: The KEYS subsystem in the Linux kernel allowed local users to cause a denial of service (memory consumption) via a series of KEY_REQKEY_DEFL_THREAD_KEYRING keyctl_set_reqkey_keyring calls (bnc#1034862).\n- CVE-2017-8824: The dccp_disconnect function in net/dccp/proto.c in the Linux kernel allowed local users to gain privileges or cause a denial of service (use-after-free) via an AF_UNSPEC connect system call during the DCCP_LISTEN state (bnc#1070771).\n\nThe following non-security bugs were fixed:\n\n- Add upstream RT preemption points to block/blk-iopoll.c and net/core/dev.c\n- adm80211: return an error if adm8211_alloc_rings() fails (bsc#1048185).\n- alsa: core: Fix unexpected error at replacing user TLV (bsc#1045538).\n- alsa: hda/ca0132 - Fix memory leak at error path (bsc#1045538).\n- alsa: timer: Add missing mutex lock for compat ioctls (bsc#1045538).\n- asm alternatives: remove incorrect alignment notes.\n- audit: Fix use after free in audit_remove_watch_rule() (bsc#1045205).\n- autofs: do not fail mount for transient error (bsc#1065180).\n- autofs: fix careless error in recent commit (bsc#1065180).\n- blacklist.conf: Add PCI ASPM fix to blacklist (bsc#1045538)\n- blacklist.conf: Blacklisted commit 2b1be689f3aadcfe0 ('printk/console: Always disable boot consoles that use init memory before it is freed')\n- bpf: prevent speculative execution in eBPF interpreter (bnc#1068032).\n- carl9170: prevent speculative execution (bnc#1068032).\n- dm bufio: fix integer overflow when limiting maximum cache size (git-fixes).\n- ecryptfs: fix dereference of NULL user_key_payload (bsc#1013018).\n- eCryptfs: use after free in ecryptfs_release_messaging() (bsc#1013018).\n- fnic: Use the local variable instead of I/O flag to acquire io_req_lock in fnic_queuecommand() to avoid deadloack (bsc#1067816).\n- fs/9p: Compare qid.path in v9fs_test_inode (bsc#1013018).\n- fs-cache: fix dereference of NULL user_key_payload (git-fixes).\n- fs: prevent speculative execution (bnc#1068032). [jkosina@suse.cz: hack around kABI; this should be done in separate  patch in patches.kabi eventually]\n- isa: Prevent NULL dereference in isa_bus driver callbacks (bsc#1045538).\n- kabi fix for new hash_cred function (bsc#1012917).\n- kabi: silence spurious kabi error in net/sctp/socket.c (bsc#1068671).\n- kaiser: add 'nokaiser' boot option, using ALTERNATIVE.\n- kaiser: fix ldt freeing.\n- kaiser: Kernel Address Isolation.\n- kaiser: use ALTERNATIVE instead of x86_cr3_pcid_noflush.\n- kaiser: work around kABI.\n- kvm: SVM: Do not intercept new speculative control MSRs (bsc#1068032).\n- kvm: x86: Add speculative control CPUID support for guests (bsc#1068032).\n- locking/barriers: introduce new memory barrier gmb() (bnc#1068032).\n- lpfc: check for valid scsi cmnd in lpfc_scsi_cmd_iocb_cmpl() (bsc#1051133).\n- mac80211: do not compare TKIP TX MIC key in reinstall prevention (bsc#1066472).\n- media: cx231xx-cards: fix NULL-deref at probe (bsc#1050431).\n- mm/madvise.c: fix madvise() infinite loop under special circumstances (bnc#1070964).\n- mm/mmu_context, sched/core: Fix mmu_context.h assumption.\n- nfs: Fix ugly referral attributes (git-fixes).\n- nfs: improve shinking of access cache (bsc#1012917).\n- p54: prevent speculative execution (bnc#1068032).\n- powerpc/barrier: add gmb.\n- powerpc: Correct instruction code for xxlor instruction (bsc#1064861, git-fixes).\n- powerpc: Fix emulation of mfocrf in emulate_step() (bsc#1064861, git-fixes).\n- powerpc/mm: Fix check of multiple 16G pages from device tree (bsc#1064861, git-fixes).\n- powerpc/pseries/vio: Dispose of virq mapping on vdevice unregister (bsc#1067888, git-fixes f2ab6219969f).\n- powerpc-rfi-flush.patch: disable due to boot failure\n- powerpc: Secure memory rfi flush (bsc#1068032).\n- pti: unbreak EFI (bsc#1074709).\n- ptrace: Add a new thread access check (bsc#1068032).\n- qeth: check not more than 16 SBALEs on the completion queue (bnc#1072457, LTC#148203).\n- Revert 'mac80211: accept key reinstall without changing anything'\n- s390: add ppa to system call and program check path (bsc#1068032).\n- s390/disassembler: correct disassembly lines alignment (bnc#1066973, LTC#161577).\n- s390/disassembler: increase show_code buffer size (bnc#1066973, LTC#161577).\n- s390: fix transactional execution control register handling (bnc#1072457, LTC#162116).\n- s390: introduce CPU alternatives.\n- s390: introduce CPU alternatives (bsc#1068032).\n- s390/spinlock: add gmb memory barrier.\n- s390/spinlock: add gmb memory barrier (bsc#1068032).\n- s390/spinlock: add ppa to system call path.\n- sched/core: Add switch_mm_irqs_off() and use it in the scheduler.\n- sched/core: Idle_task_exit() shouldn't use switch_mm_irqs_off().\n- scsi_scan: Exit loop if TUR to LUN0 fails with 0x05/0x25 (bsc#1063043). This is specific to FUJITSU ETERNUS_DX* targets. They can return 'Illegal Request - Logical unit not supported' and processing should leave the timeout loop in this case.\n- scsi: zfcp: fix erp_action use-before-initialize in REC action trace (bnc#1066973, LTC#160081).\n- sunrpc: add auth_unix hash_cred() function (bsc#1012917).\n- sunrpc: add generic_auth hash_cred() function (bsc#1012917).\n- sunrpc: add hash_cred() function to rpc_authops struct (bsc#1012917).\n- sunrpc: add RPCSEC_GSS hash_cred() function (bsc#1012917).\n- sunrpc: replace generic auth_cred hash with auth-specific function (bsc#1012917).\n- sunrpc: use supplimental groups in auth hash (bsc#1012917).\n- temporary fix (bsc#1068032).\n- udf: prevent speculative execution (bnc#1068032).\n- usb: host: fix incorrect updating of offset (bsc#1047487).\n- usb-serial: check for NULL private data in pl2303_suse_disconnect (bsc#1064803).\n- usb: uas: fix bug in handling of alternate settings (bsc#1071074).\n- uvcvideo: prevent speculative execution (bnc#1068032).\n- video: udlfb: Fix read EDID timeout (bsc#1045538).\n- watchdog: hpwdt: add support for iLO5 (bsc#1024612).\n- watchdog/hpwdt: Check source of NMI (bsc#1024612).\n- x86-64: Give vvars their own page.\n- x86-64: Map the HPET NX.\n- x86/acpi: Handle SCI interrupts above legacy space gracefully (bsc#1068984).\n- x86/acpi: Reduce code duplication in mp_override_legacy_irq() (bsc#1068984).\n- x86/alternatives: Add instruction padding.\n- x86/alternatives: Cleanup DPRINTK macro.\n- x86/alternatives: Make JMPs more robust.\n- x86/alternatives: Use optimized NOPs for padding.\n- x86/boot: Add early cmdline parsing for options with arguments.\n- x86, boot: Carve out early cmdline parsing function.\n- x86/CPU/AMD: Add speculative control support for AMD (bsc#1068032).\n- x86/CPU/AMD: Make the LFENCE instruction serialized (bsc#1068032).\n- x86/CPU/AMD: Remove now unused definition of MFENCE_RDTSC feature (bsc#1068032).\n- x86/CPU: Check speculation control CPUID bit (bsc#1068032).\n- x86/cpu: Fix bootup crashes by sanitizing the argument of the 'clearcpuid=' command-line option (bsc#1065600).\n- x86/enter: Add macros to set/clear IBRS and set IBPB (bsc#1068032).\n- x86/entry: Add a function to overwrite the RSB (bsc#1068032).\n- x86/entry: Stuff RSB for entry to kernel for non-SMEP platform (bsc#1068032).\n- x86/entry: Use IBRS on entry to kernel space (bsc#1068032).\n- x86/feature: Enable the x86 feature to control Speculation (bsc#1068032).\n- x86/idle: Disable IBRS when offlining a CPU and re-enable on wakeup (bsc#1068032).\n- x86/idle: Toggle IBRS when going idle (bsc#1068032).\n- x86/kaiser: Check boottime cmdline params.\n- x86/kaiser: disable vmstat accounting.\n- x86/kaiser: Move feature detection up (bsc#1068032).\n- x86/kaiser: propagate info to /proc/cpuinfo.\n- x86/kaiser: Rename and simplify X86_FEATURE_KAISER handling.\n- x86/kvm: Add MSR_IA32_SPEC_CTRL and MSR_IA32_PRED_CMD to kvm (bsc#1068032).\n- x86/kvm: Flush IBP when switching VMs (bsc#1068032).\n- x86/kvm: Pad RSB on VM transition (bsc#1068032).\n- x86/kvm: Toggle IBRS on VM entry and exit (bsc#1068032).\n- x86: Make alternative instruction pointers relative.\n- x86/microcode/AMD: Add support for fam17h microcode loading (bsc#1068032).\n- x86/microcode/intel: Disable late loading on model 79 (bsc#1054305).\n- x86/mm/64: Fix reboot interaction with CR4.PCIDE.\n- x86/mm: Add a 'noinvpcid' boot option to turn off INVPCID.\n- x86/mm: Add INVPCID helpers.\n- x86/mm: Add the 'nopcid' boot option to turn off PCID.\n- x86/mm: Build arch/x86/mm/tlb.c even on !SMP.\n- x86/mm: Disable PCID on 32-bit kernels.\n- x86/mm: Enable CR4.PCIDE on supported systems.\n- x86/mm: fix bad backport to disable PCID on Xen.\n- x86/mm: Fix INVPCID asm constraint.\n- x86/mm: If INVPCID is available, use it to flush global mappings.\n- x86/mm/kaiser: re-enable vsyscalls.\n- x86/mm: Only set IBPB when the new thread cannot ptrace current thread (bsc#1068032).\n- x86/mm: Remove the UP asm/tlbflush.h code, always use the (formerly) SMP code.\n- x86/mm, sched/core: Turn off IRQs in switch_mm().\n- x86/mm, sched/core: Uninline switch_mm().\n- x86/mm: Set IBPB upon context switch (bsc#1068032).\n- x86/MSR: Move native_*msr(.. u64) to msr.h (bsc#1068032).\n- x86/spec: Add IBRS control functions (bsc#1068032).\n- x86/spec: Add 'nospec' chicken bit (bsc#1068032).\n- x86/spec: Check CPUID direclty post microcode reload to support IBPB feature (bsc#1068032).\n- x86/spec_ctrl: Add an Indirect Branch Predictor barrier (bsc#1068032).\n- x86/spec_ctrl: Check whether IBPB is enabled before using it (bsc#1068032).\n- x86/spec_ctrl: Check whether IBRS is enabled before using it (bsc#1068032).\n- x86/svm: Add code to clear registers on VM exit (bsc#1068032).\n- x86/svm: Clobber the RSB on VM exit (bsc#1068032).\n- x86/svm: Set IBPB when running a different VCPU (bsc#1068032).\n- x86/svm: Set IBRS value on VM entry and exit (bsc#1068032).\n- xen/kaiser: add 'nokaiser' boot option, using ALTERNATIVE.\n- xen/KAISER: Kernel Address Isolation.\n- xen/kaiser: use ALTERNATIVE instead of x86_cr3_pcid_noflush.\n- xen/kaiser: work around kABI.\n- xen/x86-64: Give vvars their own page.\n- xen/x86-64: Map the HPET NX.\n- xen/x86/alternatives: Add instruction padding.\n- xen/x86/kaiser: Rename and simplify X86_FEATURE_KAISER handling.\n- xen/x86/mm: Enable CR4.PCIDE on supported systems.\n- xen/x86/mm/kaiser: re-enable vsyscalls.\n- xen/x86/mm: Remove the UP asm/tlbflush.h code, always use the (formerly) SMP code.\n- xen: x86/mm, sched/core: Turn off IRQs in switch_mm().\n- xen: x86/mm, sched/core: Uninline switch_mm().\n- zd1211rw: fix NULL-deref at probe (bsc#1045479).\n","status":"published","published":"2018-01-23T12:59:47Z","modified":"2026-02-04T03:00:12.371725Z","updated_at":"2026-11-02T15:53:44.594517Z"},{"id":"SUSE-SU-2019:1289-1","title":"Security update for the Linux Kernel","description":"\n\nThe SUSE Linux Enterprise 12 SP1 LTSS kernel was updated to receive various security and bugfixes.\n\nFour new speculative execution information leak issues have been identified in Intel CPUs. (bsc#1111331)\n\n- CVE-2018-12126: Microarchitectural Store Buffer Data Sampling (MSBDS)\n- CVE-2018-12127: Microarchitectural Fill Buffer Data Sampling (MFBDS)\n- CVE-2018-12130: Microarchitectural Load Port Data Samling (MLPDS)\n- CVE-2019-11091: Microarchitectural Data Sampling Uncacheable Memory (MDSUM)\n\nThis kernel update contains software mitigations for these issues, which also utilize CPU microcode updates shipped in parallel.\n\nFor more information on this set of information leaks, check out https://www.suse.com/support/kb/doc/?id=7023736\n\nThe following security bugs were fixed:\n\n- CVE-2016-10741: fs/xfs/xfs_aops.c allowed local users to cause a denial of service (system crash) because there is a race condition between direct and memory-mapped I/O (associated with a hole) that is handled with BUG_ON instead of an I/O failure (bnc#1114920 bnc#1124010).\n- CVE-2017-1000407: By flooding the diagnostic port 0x80 an exception can be triggered leading to a kernel panic (bnc#1071021).\n- CVE-2017-16533: The usbhid_parse function in drivers/hid/usbhid/hid-core.c allowed local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066674).\n- CVE-2017-7273: The cp_report_fixup function in drivers/hid/hid-cypress.c allowed physically proximate attackers to cause a denial of service (integer underflow) or possibly have unspecified other impact via a crafted HID report (bnc#1031240).\n- CVE-2017-7472: The KEYS subsystem allowed local users to cause a denial of service (memory consumption) via a series of KEY_REQKEY_DEFL_THREAD_KEYRING keyctl_set_reqkey_keyring calls (bnc#1034862).\n- CVE-2018-14633: A security flaw was found in the chap_server_compute_md5() function in the ISCSI target code in the Linux kernel in a way an authentication request from an ISCSI initiator is processed. An unauthenticated remote attacker can cause a stack buffer overflow and smash up to 17 bytes of the stack. The attack requires the iSCSI target to be enabled on the victim host. Depending on how the target's code was built (i.e. depending on a compiler, compile flags and hardware architecture) an attack may lead to a system crash and thus to a denial-of-service or possibly to a non-authorized access to data exported by an iSCSI target. (bnc#1107829).\n- CVE-2018-15572: The spectre_v2_select_mitigation function in arch/x86/kernel/cpu/bugs.c did not always fill RSB upon a context switch, which made it easier for attackers to conduct userspace-userspace spectreRSB attacks (bnc#1102517 bnc#1105296).\n- CVE-2018-16884: NFS41+ shares mounted in different network namespaces at the same time can make bc_svc_process() use wrong back-channel IDs and cause a use-after-free vulnerability. Thus a malicious container user can cause a host kernel memory corruption and a system panic. Due to the nature of the flaw, privilege escalation cannot be fully ruled out (bnc#1119946).\n- CVE-2018-18281: The mremap() syscall performed TLB flushes after dropping pagetable locks. If a syscall such as ftruncate() removes entries from the pagetables of a task that is in the middle of mremap(), a stale TLB entry can remain for a short time that permits access to a physical page after it has been released back to the page allocator and reused. (bnc#1113769).\n- CVE-2018-18386: drivers/tty/n_tty.c allowed local attackers (who are able to access pseudo terminals) to hang/block further usage of any pseudo terminal devices due to an EXTPROC versus ICANON confusion in TIOCINQ (bnc#1094825).\n- CVE-2018-18690: A local attacker able to set attributes on an xfs filesystem could make this filesystem non-operational until the next mount by triggering an unchecked error condition during an xfs attribute change, because xfs_attr_shortform_addname in fs/xfs/libxfs/xfs_attr.c mishandled ATTR_REPLACE operations with conversion of an attr from short to long form (bnc#1105025).\n- CVE-2018-18710: An information leak in cdrom_ioctl_select_disc in drivers/cdrom/cdrom.c could be used by local attackers to read kernel memory because a cast from unsigned long to int interferes with bounds checking. This is similar to CVE-2018-10940 and CVE-2018-16658 (bnc#1113751).\n- CVE-2018-19407: The vcpu_scan_ioapic function in arch/x86/kvm/x86.c allowed local users to cause a denial of service (NULL pointer dereference and BUG) via crafted system calls that reach a situation where ioapic is uninitialized (bnc#1116841).\n- CVE-2018-19824: A local user could exploit a use-after-free in the ALSA driver by supplying a malicious USB Sound device (with zero interfaces) that is mishandled in usb_audio_probe in sound/usb/card.c (bnc#1118152).\n- CVE-2018-19985: The function hso_get_config_data in drivers/net/usb/hso.c read if_num from the USB device (as a u8) and uses it to index a small array, resulting in an object out-of-bounds (OOB) read that potentially allowed arbitrary read in the kernel address space (bnc#1120743).\n- CVE-2018-20169: The USB subsystem mishandled size checks during the reading of an extra descriptor, related to __usb_get_extra_descriptor in drivers/usb/core/usb.c (bnc#1119714).\n- CVE-2018-5391: The Linux kernel was vulnerable to a denial of service attack with low rates of specially modified packets targeting IP fragment re-assembly. An attacker may cause a denial of service condition by sending specially crafted IP fragments. Various vulnerabilities in IP fragmentation have been discovered and fixed over the years. The current vulnerability (CVE-2018-5391) became exploitable in the Linux kernel with the increase of the IP fragment reassembly queue size (bnc#1103097).\n- CVE-2018-9516: In hid_debug_events_read of drivers/hid/hid-debug.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. (bnc#1108498).\n- CVE-2018-9568: In sk_clone_lock of sock.c, there is a possible memory corruption due to type confusion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. (bnc#1118319).\n- CVE-2019-11486: The Siemens R3964 line discipline driver in drivers/tty/n_r3964.c had multiple race conditions (bnc#1133188). The line discipline was disabled.\n- CVE-2019-3459: A heap address information leak while using L2CAP_GET_CONF_OPT was discovered (bnc#1120758).\n- CVE-2019-3460: A heap data infoleak in multiple locations including L2CAP_PARSE_CONF_RSP was found (bnc#1120758).\n- CVE-2019-3882: A flaw was found vfio interface implementation that permitted violation of the user's locked memory limit. If a device is bound to a vfio driver, such as vfio-pci, and the local attacker is administratively granted ownership of the device, it may cause a system memory exhaustion and thus a denial of service (DoS). (bnc#1131416 bnc#1131427).\n- CVE-2019-6974: kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandled reference counting because of a race condition, leading to a use-after-free (bnc#1124728).\n- CVE-2019-7221: The KVM implementation had a Use-after-Free (bnc#1124732).\n- CVE-2019-7222: The KVM implementation had an Information Leak (bnc#1124735).\n- CVE-2019-9213: expand_downwards in mm/mmap.c lacked a check for the mmap minimum address, which made it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task (bnc#1128166).\n- CVE-2019-9503: Multiple brcmfmac frame validation bypasses have been fixed (bnc#1132828).\n\nThe following non-security bugs were fixed:\n\n- cifs: Check for timeout on Negotiate stage (bsc#1091171 bsc#1126890).\n- fix pgd underflow (bnc#1104475) (bsc#1104475, bsc#1110768).\n- kvm: x86: Report STIBP on GET_SUPPORTED_CPUID (bsc#1111331).\n- locking/atomics, asm-generic: Move some macros from \u003clinux/bitops.h\u003e to a new \u003clinux/bits.h\u003e file (bsc#1111331).\n- net: ipv4: do not handle duplicate fragments as overlapping (bsc#1116345).\n- sched/core: Optimize SCHED_SMT (bsc#1111331)\n- sched/smt: Expose sched_smt_present static key (bsc#1106913).\n- sched/smt: Make sched_smt_present track topology (bsc#1106913).\n- sched/smt: Update sched_smt_present at runtime (bsc#1111331)\n- tcp: prevent bogus FRTO undos with non-SACK flows (bsc#1086535).\n- x86/bugs: Rename SSBD_NO to SSB_NO (bsc#1111331)\n- x86/cpu: Sanitize FAM6_ATOM naming (bsc#1111331).\n- x86/kvm: Expose X86_FEATURE_MD_CLEAR to guests (bsc#1111331).\n- x86/kvm/vmx: Add MDS protection when L1D Flush is not active (bsc#1111331).\n- x86/mce: Improve error message when kernel cannot recover, p2 (bsc#1114648).\n- x86/msr-index: Cleanup bit defines (bsc#1111331).\n- x86/spec_ctrl: Fix spec_ctrl reporting (bsc#1106913, bsc#1111516).\n- x86/speculation: Apply IBPB more strictly to avoid cross-process data leak (bsc#1106913).\n- x86/speculation: Consolidate CPU whitelists (bsc#1111331).\n- x86/speculation: Enable cross-hyperthread spectre v2 STIBP mitigation (bsc#1106913).\n- x86/speculation/mds: Add basic bug infrastructure for MDS (bsc#1111331).\n- x86/speculation/mds: Add BUG_MSBDS_ONLY (bsc#1111331).\n- x86/speculation/mds: Add mds_clear_cpu_buffers() (bsc#1111331).\n- x86/speculation/mds: Add mitigation control for MDS (bsc#1111331).\n- x86/speculation/mds: Add mitigation mode VMWERV (bsc#1111331).\n- x86/speculation/mds: Add sysfs reporting for MDS (bsc#1111331).\n- x86/speculation/mds: Clear CPU buffers on exit to user (bsc#1111331).\n- x86/speculation/mds: Conditionally clear CPU buffers on idle entry (bsc#1111331).\n- x86/speculation: Remove redundant arch_smt_update() invocation (bsc#1111331).\n- x86/speculation: Rework SMT state change (bsc#1111331).\n- x86/speculation: Simplify the CPU bug detection logic (bsc#1111331).\n- x86/uaccess: Do not leak the AC flag into __put_user() value evaluation (bsc#1114648).\n- xfs: do not BUG() on mixed direct and mapped I/O (bsc#1114920).\n- xfs: fix quotacheck dquot id overflow infinite loop (bsc#1121621).\n- xfs: stop searching for free slots in an inode chunk when there are none (bsc#1115007).\n- xfs: xfs_iget_check_free_state: Use correct sign for errors (bsc#1122015, bsc#1100001).\n- xfs: validate sb_logsunit is a multiple of the fs blocksize (bsc#1115038).\n","status":"published","published":"2019-05-28T11:38:31Z","modified":"2026-02-04T03:44:16.209794Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"USN-3312-1","title":"linux, linux-aws, linux-gke, linux-raspi2, linux-snapdragon vulnerabilities","description":"It was discovered that the netfilter netlink implementation in the Linux\nkernel did not properly validate batch messages. A local attacker with the\nCAP_NET_ADMIN capability could use this to expose sensitive information or\ncause a denial of service. (CVE-2016-7917)\n\nQian Zhang discovered a heap-based buffer overflow in the tipc_msg_build()\nfunction in the Linux kernel. A local attacker could use to cause a denial\nof service (system crash) or possibly execute arbitrary code with\nadministrative privileges. (CVE-2016-8632)\n\nIt was discovered that the keyring implementation in the Linux kernel in\nsome situations did not prevent special internal keyrings from being joined\nby userspace keyrings. A privileged local attacker could use this to bypass\nmodule verification. (CVE-2016-9604)\n\nIt was discovered that a buffer overflow existed in the trace subsystem in\nthe Linux kernel. A privileged local attacker could use this to execute\narbitrary code. (CVE-2017-0605)\n\nDmitry Vyukov discovered that KVM implementation in the Linux kernel\nimproperly emulated the VMXON instruction. A local attacker in a guest OS\ncould use this to cause a denial of service (memory consumption) in the\nhost OS. (CVE-2017-2596)\n\nDaniel Jiang discovered that a race condition existed in the ipv4 ping\nsocket implementation in the Linux kernel. A local privileged attacker\ncould use this to cause a denial of service (system crash). (CVE-2017-2671)\n\nDi Shen discovered that a race condition existed in the perf subsystem of\nthe Linux kernel. A local attacker could use this to cause a denial of\nservice or possibly gain administrative privileges. (CVE-2017-6001)\n\nEric Biggers discovered a memory leak in the keyring implementation in the\nLinux kernel. A local attacker could use this to cause a denial of service\n(memory consumption). (CVE-2017-7472)\n\nSabrina Dubroca discovered that the asynchronous cryptographic hash (ahash)\nimplementation in the Linux kernel did not properly handle a full request\nqueue. A local attacker could use this to cause a denial of service\n(infinite recursion). (CVE-2017-7618)\n\nTuomas Haanpää and Ari Kauppi discovered that the NFSv2 and NFSv3 server\nimplementations in the Linux kernel did not properly handle certain long\nRPC replies. A remote attacker could use this to cause a denial of service\n(system crash). (CVE-2017-7645)\n\nTommi Rantala and Brad Spengler discovered that the memory manager in the\nLinux kernel did not properly enforce the CONFIG_STRICT_DEVMEM protection\nmechanism. A local attacker with access to /dev/mem could use this to\nexpose sensitive information or possibly execute arbitrary code.\n(CVE-2017-7889)\n\nTuomas Haanpää and Ari Kauppi discovered that the NFSv2 and NFSv3 server\nimplementations in the Linux kernel did not properly check for the end of\nbuffer. A remote attacker could use this to craft requests that cause a\ndenial of service (system crash) or possibly execute arbitrary code.\n(CVE-2017-7895)\n\nIt was discovered that a use-after-free vulnerability existed in the device\ndriver for XCeive xc2028/xc3028 tuners in the Linux kernel. A local\nattacker could use this to cause a denial of service (system crash) or\npossibly execute arbitrary code. (CVE-2016-7913)\n\nVlad Tsyrklevich discovered an integer overflow vulnerability in the VFIO\nPCI driver for the Linux kernel. A local attacker with access to a vfio PCI\ndevice file could use this to cause a denial of service (system crash) or\npossibly execute arbitrary code. (CVE-2016-9083, CVE-2016-9084)\n","status":"published","published":"2017-06-07T04:45:15Z","modified":"2026-04-22T09:36:29.10787Z","updated_at":"2026-11-02T16:58:13.496563Z"},{"id":"USN-3312-2","title":"linux-lts-xenial vulnerabilities","description":"USN-3312-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04\nLTS. This update provides the corresponding updates for the Linux\nHardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu\n14.04 LTS.\n\nIt was discovered that the netfilter netlink implementation in the Linux\nkernel did not properly validate batch messages. A local attacker with the\nCAP_NET_ADMIN capability could use this to expose sensitive information or\ncause a denial of service. (CVE-2016-7917)\n\nQian Zhang discovered a heap-based buffer overflow in the tipc_msg_build()\nfunction in the Linux kernel. A local attacker could use to cause a denial\nof service (system crash) or possibly execute arbitrary code with\nadministrative privileges. (CVE-2016-8632)\n\nIt was discovered that the keyring implementation in the Linux kernel in\nsome situations did not prevent special internal keyrings from being joined\nby userspace keyrings. A privileged local attacker could use this to bypass\nmodule verification. (CVE-2016-9604)\n\nIt was discovered that a buffer overflow existed in the trace subsystem in\nthe Linux kernel. A privileged local attacker could use this to execute\narbitrary code. (CVE-2017-0605)\n\nDmitry Vyukov discovered that KVM implementation in the Linux kernel\nimproperly emulated the VMXON instruction. A local attacker in a guest OS\ncould use this to cause a denial of service (memory consumption) in the\nhost OS. (CVE-2017-2596)\n\nDaniel Jiang discovered that a race condition existed in the ipv4 ping\nsocket implementation in the Linux kernel. A local privileged attacker\ncould use this to cause a denial of service (system crash). (CVE-2017-2671)\n\nDi Shen discovered that a race condition existed in the perf subsystem of\nthe Linux kernel. A local attacker could use this to cause a denial of\nservice or possibly gain administrative privileges. (CVE-2017-6001)\n\nEric Biggers discovered a memory leak in the keyring implementation in the\nLinux kernel. A local attacker could use this to cause a denial of service\n(memory consumption). (CVE-2017-7472)\n\nSabrina Dubroca discovered that the asynchronous cryptographic hash (ahash)\nimplementation in the Linux kernel did not properly handle a full request\nqueue. A local attacker could use this to cause a denial of service\n(infinite recursion). (CVE-2017-7618)\n\nTuomas Haanpää and Ari Kauppi discovered that the NFSv2 and NFSv3 server\nimplementations in the Linux kernel did not properly handle certain long\nRPC replies. A remote attacker could use this to cause a denial of service\n(system crash). (CVE-2017-7645)\n\nTommi Rantala and Brad Spengler discovered that the memory manager in the\nLinux kernel did not properly enforce the CONFIG_STRICT_DEVMEM protection\nmechanism. A local attacker with access to /dev/mem could use this to\nexpose sensitive information or possibly execute arbitrary code.\n(CVE-2017-7889)\n\nTuomas Haanpää and Ari Kauppi discovered that the NFSv2 and NFSv3 server\nimplementations in the Linux kernel did not properly check for the end of\nbuffer. A remote attacker could use this to craft requests that cause a\ndenial of service (system crash) or possibly execute arbitrary code.\n(CVE-2017-7895)\n\nIt was discovered that a use-after-free vulnerability existed in the device\ndriver for XCeive xc2028/xc3028 tuners in the Linux kernel. A local\nattacker could use this to cause a denial of service (system crash) or\npossibly execute arbitrary code. (CVE-2016-7913)\n\nVlad Tsyrklevich discovered an integer overflow vulnerability in the VFIO\nPCI driver for the Linux kernel. A local attacker with access to a vfio PCI\ndevice file could use this to cause a denial of service (system crash) or\npossibly execute arbitrary code. (CVE-2016-9083, CVE-2016-9084)\n","status":"published","published":"2017-06-07T04:48:51Z","modified":"2026-02-10T04:41:08Z","updated_at":"2026-11-02T16:58:13.496563Z"},{"id":"USN-3361-1","title":"linux-hwe vulnerabilities","description":"USN-3358-1 fixed vulnerabilities in the Linux kernel for Ubuntu 17.04.\nThis update provides the corresponding updates for the Linux Hardware\nEnablement (HWE) kernel from Ubuntu 17.04 for Ubuntu 16.04 LTS. Please\nnote that this update changes the Linux HWE kernel to the 4.10 based\nkernel from Ubuntu 17.04, superseding the 4.8 based HWE kernel from\nUbuntu 16.10.\n\nBen Harris discovered that the Linux kernel would strip extended privilege\nattributes of files when performing a failed unprivileged system call. A\nlocal attacker could use this to cause a denial of service. (CVE-2015-1350)\n\nRalf Spenneberg discovered that the ext4 implementation in the Linux kernel\ndid not properly validate meta block groups. An attacker with physical\naccess could use this to specially craft an ext4 image that causes a denial\nof service (system crash). (CVE-2016-10208)\n\nPeter Pi discovered that the colormap handling for frame buffer devices in\nthe Linux kernel contained an integer overflow. A local attacker could use\nthis to disclose sensitive information (kernel memory). (CVE-2016-8405)\n\nIt was discovered that an integer overflow existed in the InfiniBand RDMA\nover ethernet (RXE) transport implementation in the Linux kernel. A local\nattacker could use this to cause a denial of service (system crash) or\npossibly execute arbitrary code. (CVE-2016-8636)\n\nVlad Tsyrklevich discovered an integer overflow vulnerability in the VFIO\nPCI driver for the Linux kernel. A local attacker with access to a vfio PCI\ndevice file could use this to cause a denial of service (system crash) or\npossibly execute arbitrary code. (CVE-2016-9083, CVE-2016-9084)\n\nCAI Qian discovered that the sysctl implementation in the Linux kernel did\nnot properly perform reference counting in some situations. An unprivileged\nattacker could use this to cause a denial of service (system hang).\n(CVE-2016-9191)\n\nIt was discovered that the keyring implementation in the Linux kernel in\nsome situations did not prevent special internal keyrings from being joined\nby userspace keyrings. A privileged local attacker could use this to bypass\nmodule verification. (CVE-2016-9604)\n\nDmitry Vyukov, Andrey Konovalov, Florian Westphal, and Eric Dumazet\ndiscovered that the netfiler subsystem in the Linux kernel mishandled IPv6\npacket reassembly. A local user could use this to cause a denial of service\n(system crash) or possibly execute arbitrary code. (CVE-2016-9755)\n\nAndy Lutomirski and Willy Tarreau discovered that the KVM implementation in\nthe Linux kernel did not properly emulate instructions on the SS segment\nregister. A local attacker in a guest virtual machine could use this to\ncause a denial of service (guest OS crash) or possibly gain administrative\nprivileges in the guest OS. (CVE-2017-2583)\n\nDmitry Vyukov discovered that the KVM implementation in the Linux kernel\nimproperly emulated certain instructions. A local attacker could use this\nto obtain sensitive information (kernel memory). (CVE-2017-2584)\n\nDmitry Vyukov discovered that KVM implementation in the Linux kernel\nimproperly emulated the VMXON instruction. A local attacker in a guest OS\ncould use this to cause a denial of service (memory consumption) in the\nhost OS. (CVE-2017-2596)\n\nIt was discovered that SELinux in the Linux kernel did not properly handle\nempty writes to /proc/pid/attr. A local attacker could use this to cause a\ndenial of service (system crash). (CVE-2017-2618)\n\nDaniel Jiang discovered that a race condition existed in the ipv4 ping\nsocket implementation in the Linux kernel. A local privileged attacker\ncould use this to cause a denial of service (system crash). (CVE-2017-2671)\n\nIt was discovered that the freelist-randomization in the SLAB memory\nallocator allowed duplicate freelist entries. A local attacker could use\nthis to cause a denial of service (system crash). (CVE-2017-5546)\n\nIt was discovered that the KLSI KL5KUSB105 serial-to-USB device driver in\nthe Linux kernel did not properly initialize memory related to logging. A\nlocal attacker could use this to expose sensitive information (kernel\nmemory). (CVE-2017-5549)\n\nIt was discovered that a fencepost error existed in the pipe_advance()\nfunction in the Linux kernel. A local attacker could use this to expose\nsensitive information (kernel memory). (CVE-2017-5550)\n\nIt was discovered that the Linux kernel did not clear the setgid bit during\na setxattr call on a tmpfs filesystem. A local attacker could use this to\ngain elevated group privileges. (CVE-2017-5551)\n\nMurray McAllister discovered that an integer overflow existed in the\nVideoCore DRM driver of the Linux kernel. A local attacker could use this\nto cause a denial of service (system crash) or possibly execute arbitrary\ncode. (CVE-2017-5576)\n\nGareth Evans discovered that the shm IPC subsystem in the Linux kernel did\nnot properly restrict mapping page zero. A local privileged attacker could\nuse this to execute arbitrary code. (CVE-2017-5669)\n\nAndrey Konovalov discovered an out-of-bounds access in the IPv6 Generic\nRouting Encapsulation (GRE) tunneling implementation in the Linux kernel.\nAn attacker could use this to possibly expose sensitive information.\n(CVE-2017-5897)\n\nAndrey Konovalov discovered that the IPv4 implementation in the Linux\nkernel did not properly handle invalid IP options in some situations. An\nattacker could use this to cause a denial of service or possibly execute\narbitrary code. (CVE-2017-5970)\n\nDi Shen discovered that a race condition existed in the perf subsystem of\nthe Linux kernel. A local attacker could use this to cause a denial of\nservice or possibly gain administrative privileges. (CVE-2017-6001)\n\nDmitry Vyukov discovered that the Linux kernel did not properly handle TCP\npackets with the URG flag. A remote attacker could use this to cause a\ndenial of service. (CVE-2017-6214)\n\nAndrey Konovalov discovered that the LLC subsytem in the Linux kernel did\nnot properly set up a destructor in certain situations. A local attacker\ncould use this to cause a denial of service (system crash). (CVE-2017-6345)\n\nIt was discovered that a race condition existed in the AF_PACKET handling\ncode in the Linux kernel. A local attacker could use this to cause a denial\nof service (system crash) or possibly execute arbitrary code.\n(CVE-2017-6346)\n\nAndrey Konovalov discovered that the IP layer in the Linux kernel made\nimproper assumptions about internal data layout when performing checksums.\nA local attacker could use this to cause a denial of service (system crash)\nor possibly execute arbitrary code. (CVE-2017-6347)\n\nDmitry Vyukov discovered race conditions in the Infrared (IrDA) subsystem\nin the Linux kernel. A local attacker could use this to cause a denial of\nservice (deadlock). (CVE-2017-6348)\n\nDmitry Vyukov discovered that the generic SCSI (sg) subsystem in the Linux\nkernel contained a stack-based buffer overflow. A local attacker with\naccess to an sg device could use this to cause a denial of service (system\ncrash) or possibly execute arbitrary code. (CVE-2017-7187)\n\nIt was discovered that a NULL pointer dereference existed in the Direct\nRendering Manager (DRM) driver for VMWare devices in the Linux kernel. A\nlocal attacker could use this to cause a denial of service (system crash).\n(CVE-2017-7261)\n\nIt was discovered that the USB Cypress HID drivers for the Linux kernel did\nnot properly validate reported information from the device. An attacker\nwith physical access could use this to expose sensitive information (kernel\nmemory). (CVE-2017-7273)\n\nEric Biggers discovered a memory leak in the keyring implementation in the\nLinux kernel. A local attacker could use this to cause a denial of service\n(memory consumption). (CVE-2017-7472)\n\nIt was discovered that an information leak existed in the set_mempolicy and\nmbind compat syscalls in the Linux kernel. A local attacker could use this\nto expose sensitive information (kernel memory). (CVE-2017-7616)\n\nSabrina Dubroca discovered that the asynchronous cryptographic hash (ahash)\nimplementation in the Linux kernel did not properly handle a full request\nqueue. A local attacker could use this to cause a denial of service\n(infinite recursion). (CVE-2017-7618)\n\nTuomas Haanpää and Ari Kauppi discovered that the NFSv2 and NFSv3 server\nimplementations in the Linux kernel did not properly handle certain long\nRPC replies. A remote attacker could use this to cause a denial of service\n(system crash). (CVE-2017-7645)\n\nTommi Rantala and Brad Spengler discovered that the memory manager in the\nLinux kernel did not properly enforce the CONFIG_STRICT_DEVMEM protection\nmechanism. A local attacker with access to /dev/mem could use this to\nexpose sensitive information or possibly execute arbitrary code.\n(CVE-2017-7889)\n\nTuomas Haanpää and Ari Kauppi discovered that the NFSv2 and NFSv3 server\nimplementations in the Linux kernel did not properly check for the end of\nbuffer. A remote attacker could use this to craft requests that cause a\ndenial of service (system crash) or possibly execute arbitrary code.\n(CVE-2017-7895)\n\nIt was discovered that an integer underflow existed in the Edgeport USB\nSerial Converter device driver of the Linux kernel. An attacker with\nphysical access could use this to expose sensitive information (kernel\nmemory). (CVE-2017-8924)\n\nIt was discovered that the USB ZyXEL omni.net LCD PLUS driver in the Linux\nkernel did not properly perform reference counting. A local attacker could\nuse this to cause a denial of service (tty exhaustion). (CVE-2017-8925)\n\nJann Horn discovered that bpf in Linux kernel does not restrict the output\nof the print_bpf_insn function. A local attacker could use this to obtain\nsensitive address information. (CVE-2017-9150)\n","status":"published","published":"2017-07-21T09:59:15Z","modified":"2026-06-03T14:04:19.16359445Z","updated_at":"2026-11-02T16:58:13.496563Z"},{"id":"USN-3422-1","title":"linux vulnerabilities","description":"It was discovered that a buffer overflow existed in the Bluetooth stack of\nthe Linux kernel when handling L2CAP configuration responses. A physically\nproximate attacker could use this to cause a denial of service (system\ncrash). (CVE-2017-1000251)\n\nIt was discovered that the asynchronous I/O (aio) subsystem of the Linux\nkernel did not properly set permissions on aio memory mappings in some\nsituations. An attacker could use this to more easily exploit other\nvulnerabilities. (CVE-2016-10044)\n\nBaozeng Ding and Andrey Konovalov discovered a race condition in the L2TPv3\nIP Encapsulation implementation in the Linux kernel. A local attacker could\nuse this to cause a denial of service (system crash) or possibly execute\narbitrary code. (CVE-2016-10200)\n\nAndreas Gruenbacher and Jan Kara discovered that the filesystem\nimplementation in the Linux kernel did not clear the setgid bit during a\nsetxattr call. A local attacker could use this to possibly elevate group\nprivileges. (CVE-2016-7097)\n\nSergej Schumilo, Ralf Spenneberg, and Hendrik Schwartke discovered that the\nkey management subsystem in the Linux kernel did not properly allocate\nmemory in some situations. A local attacker could use this to cause a\ndenial of service (system crash). (CVE-2016-8650)\n\nVlad Tsyrklevich discovered an integer overflow vulnerability in the VFIO\nPCI driver for the Linux kernel. A local attacker with access to a vfio PCI\ndevice file could use this to cause a denial of service (system crash) or\npossibly execute arbitrary code. (CVE-2016-9083, CVE-2016-9084)\n\nIt was discovered that an information leak existed in __get_user_asm_ex()\nin the Linux kernel. A local attacker could use this to expose sensitive\ninformation. (CVE-2016-9178)\n\nCAI Qian discovered that the sysctl implementation in the Linux kernel did\nnot properly perform reference counting in some situations. An unprivileged\nattacker could use this to cause a denial of service (system hang).\n(CVE-2016-9191)\n\nIt was discovered that the keyring implementation in the Linux kernel in\nsome situations did not prevent special internal keyrings from being joined\nby userspace keyrings. A privileged local attacker could use this to bypass\nmodule verification. (CVE-2016-9604)\n\nIt was discovered that an integer overflow existed in the trace subsystem\nof the Linux kernel. A local privileged attacker could use this to cause a\ndenial of service (system crash). (CVE-2016-9754)\n\nAndrey Konovalov discovered that the IPv4 implementation in the Linux\nkernel did not properly handle invalid IP options in some situations. An\nattacker could use this to cause a denial of service or possibly execute\narbitrary code. (CVE-2017-5970)\n\nDmitry Vyukov discovered that the Linux kernel did not properly handle TCP\npackets with the URG flag. A remote attacker could use this to cause a\ndenial of service. (CVE-2017-6214)\n\nIt was discovered that a race condition existed in the AF_PACKET handling\ncode in the Linux kernel. A local attacker could use this to cause a denial\nof service (system crash) or possibly execute arbitrary code.\n(CVE-2017-6346)\n\nIt was discovered that the keyring implementation in the Linux kernel did\nnot properly restrict searches for dead keys. A local attacker could use\nthis to cause a denial of service (system crash). (CVE-2017-6951)\n\nDmitry Vyukov discovered that the generic SCSI (sg) subsystem in the Linux\nkernel contained a stack-based buffer overflow. A local attacker with\naccess to an sg device could use this to cause a denial of service (system\ncrash) or possibly execute arbitrary code. (CVE-2017-7187)\n\nEric Biggers discovered a memory leak in the keyring implementation in the\nLinux kernel. A local attacker could use this to cause a denial of service\n(memory consumption). (CVE-2017-7472)\n\nIt was discovered that a buffer overflow existed in the Broadcom FullMAC\nWLAN driver in the Linux kernel. A local attacker could use this to cause a\ndenial of service (system crash) or possibly execute arbitrary code.\n(CVE-2017-7541)\n","status":"published","published":"2017-09-18T20:29:06Z","modified":"2026-04-22T09:39:30.53389Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}