Security update for Linux Kernel Live Patch 2 for SP 1
SUSE Patch
security@suse.de
SUSE Security Team
SUSE-SU-2016:1035-1
Final
1
1
2016-04-14T11:44:46Z
current
2016-04-14T11:44:46Z
2016-04-14T11:44:46Z
cve-database/bin/generate-cvrf.pl
2017-02-24T01:00:00Z
Security update for Linux Kernel Live Patch 2 for SP 1
This update for the Linux Kernel 3.12.51-60.25.1 fixes the following issues:
- CVE-2016-2384: A malicious USB device could cause a kernel crash in
the alsa usb-audio driver. (bsc#967773)
- CVE-2015-8812: A flaw was found in the CXGB3 kernel driver when
the network was considered congested. The kernel would incorrectly
misinterpret the congestion as an error condition and incorrectly
free/clean up the skb. When the device would then send the skb's queued,
these structures would be referenced and may panic the system or allow
an attacker to escalate privileges in a use-after-free scenario. (bsc#966683)
- CVE-2016-0774: A pipe buffer state corruption after unsuccessful atomic
read from pipe was fixed (bsc#964732).
- CVE-2015-8709: kernel/ptrace.c in the Linux kernel mishandled uid and
gid mappings, which allowed local users to gain privileges by establishing
a user namespace, waiting for a root process to enter that namespace
with an unsafe uid or gid, and then using the ptrace system call. NOTE:
the vendor states 'there is no kernel bug here.' (bsc#960563)
The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
SUSE-SLE-Live-Patching-12-2016-612
Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0)
https://www.suse.com/support/update/announcement/2016/suse-su-20161035-1/
Link for SUSE-SU-2016:1035-1
https://lists.suse.com/pipermail/sle-security-updates/2016-April/002006.html
E-Mail link for SUSE-SU-2016:1035-1
https://www.suse.com/support/security/rating/
SUSE Security Ratings
https://bugzilla.suse.com/960563
SUSE Bug 960563
https://bugzilla.suse.com/964732
SUSE Bug 964732
https://bugzilla.suse.com/966683
SUSE Bug 966683
https://bugzilla.suse.com/967773
SUSE Bug 967773
https://www.suse.com/security/cve/CVE-2015-8709/
SUSE CVE CVE-2015-8709 page
https://www.suse.com/security/cve/CVE-2015-8812/
SUSE CVE CVE-2015-8812 page
https://www.suse.com/security/cve/CVE-2016-0774/
SUSE CVE CVE-2016-0774 page
https://www.suse.com/security/cve/CVE-2016-2384/
SUSE CVE CVE-2016-2384 page
SUSE Linux Enterprise Live Patching 12
kgraft-patch-3_12_51-60_25-default-3-2.1
kgraft-patch-3_12_51-60_25-xen-3-2.1
kgraft-patch-3_12_51-60_25-default-3-2.1 as a component of SUSE Linux Enterprise Live Patching 12
kgraft-patch-3_12_51-60_25-xen-3-2.1 as a component of SUSE Linux Enterprise Live Patching 12
** DISPUTED ** kernel/ptrace.c in the Linux kernel through 4.4.1 mishandles uid and gid mappings, which allows local users to gain privileges by establishing a user namespace, waiting for a root process to enter that namespace with an unsafe uid or gid, and then using the ptrace system call. NOTE: the vendor states "there is no kernel bug here."
CVE-2015-8709
SUSE Linux Enterprise Live Patching 12:kgraft-patch-3_12_51-60_25-default-3-2.1
SUSE Linux Enterprise Live Patching 12:kgraft-patch-3_12_51-60_25-xen-3-2.1
moderate
6
AV:L/AC:H/Au:S/C:C/I:C/A:C
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
https://www.suse.com/support/update/announcement/2016/suse-su-20161035-1/
https://www.suse.com/security/cve/CVE-2015-8709.html
CVE-2015-8709
https://bugzilla.suse.com/1010933
SUSE Bug 1010933
https://bugzilla.suse.com/959709
SUSE Bug 959709
https://bugzilla.suse.com/960561
SUSE Bug 960561
https://bugzilla.suse.com/960563
SUSE Bug 960563
drivers/infiniband/hw/cxgb3/iwch_cm.c in the Linux kernel before 4.5 does not properly identify error conditions, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via crafted packets.
CVE-2015-8812
SUSE Linux Enterprise Live Patching 12:kgraft-patch-3_12_51-60_25-default-3-2.1
SUSE Linux Enterprise Live Patching 12:kgraft-patch-3_12_51-60_25-xen-3-2.1
moderate
6.9
AV:L/AC:M/Au:N/C:C/I:C/A:C
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
https://www.suse.com/support/update/announcement/2016/suse-su-20161035-1/
https://www.suse.com/security/cve/CVE-2015-8812.html
CVE-2015-8812
https://bugzilla.suse.com/1020452
SUSE Bug 1020452
https://bugzilla.suse.com/1115893
SUSE Bug 1115893
https://bugzilla.suse.com/966437
SUSE Bug 966437
https://bugzilla.suse.com/966683
SUSE Bug 966683
The (1) pipe_read and (2) pipe_write implementations in fs/pipe.c in a certain Linux kernel backport in the linux package before 3.2.73-2+deb7u3 on Debian wheezy and the kernel package before 3.10.0-229.26.2 on Red Hat Enterprise Linux (RHEL) 7.1 do not properly consider the side effects of failed __copy_to_user_inatomic and __copy_from_user_inatomic calls, which allows local users to cause a denial of service (system crash) or possibly gain privileges via a crafted application, aka an "I/O vector array overrun." NOTE: this vulnerability exists because of an incorrect fix for CVE-2015-1805.
CVE-2016-0774
SUSE Linux Enterprise Live Patching 12:kgraft-patch-3_12_51-60_25-default-3-2.1
SUSE Linux Enterprise Live Patching 12:kgraft-patch-3_12_51-60_25-xen-3-2.1
moderate
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
https://www.suse.com/support/update/announcement/2016/suse-su-20161035-1/
https://www.suse.com/security/cve/CVE-2016-0774.html
CVE-2016-0774
https://bugzilla.suse.com/917839
SUSE Bug 917839
https://bugzilla.suse.com/964730
SUSE Bug 964730
https://bugzilla.suse.com/964732
SUSE Bug 964732
Double free vulnerability in the snd_usbmidi_create function in sound/usb/midi.c in the Linux kernel before 4.5 allows physically proximate attackers to cause a denial of service (panic) or possibly have unspecified other impact via vectors involving an invalid USB descriptor.
CVE-2016-2384
SUSE Linux Enterprise Live Patching 12:kgraft-patch-3_12_51-60_25-default-3-2.1
SUSE Linux Enterprise Live Patching 12:kgraft-patch-3_12_51-60_25-xen-3-2.1
moderate
6.2
AV:L/AC:H/Au:N/C:C/I:C/A:C
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
https://www.suse.com/support/update/announcement/2016/suse-su-20161035-1/
https://www.suse.com/security/cve/CVE-2016-2384.html
CVE-2016-2384
https://bugzilla.suse.com/1020452
SUSE Bug 1020452
https://bugzilla.suse.com/966693
SUSE Bug 966693
https://bugzilla.suse.com/967773
SUSE Bug 967773