Security update for Linux Kernel Live Patch 17 for SLE 12 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2017:2093-1 Final 1 1 2017-08-08T09:29:06Z current 2017-08-08T09:29:06Z 2017-08-08T09:29:06Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for Linux Kernel Live Patch 17 for SLE 12 This update for the Linux Kernel 3.12.60-52_60 fixes several issues. The following security bugs were fixed: - CVE-2017-7533: A bug in inotify code allowed local users to escalate privilege (bsc#1050751). - CVE-2017-7645: The NFSv2/NFSv3 server in the nfsd subsystem in the Linux kernel allowed remote attackers to cause a denial of service (system crash) via a long RPC reply, related to net/sunrpc/svc.c, fs/nfsd/nfs3xdr.c, and fs/nfsd/nfsxdr.c (bsc#1046191). - CVE-2017-2636: Race condition in drivers/tty/n_hdlc.c in the Linux kernel allowed local users to gain privileges or cause a denial of service (double free) by setting the HDLC line discipline (bsc#1027575). - CVE-2017-9242: The __ip6_append_data function in net/ipv6/ip6_output.c in the Linux kernel is too late in checking whether an overwrite of an skb data structure may occur, which allowed local users to cause a denial of service (system crash) via crafted system calls (bsc#1042892). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-SAP-12-2017-1296,SUSE-SLE-SERVER-12-2017-1296 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2017/suse-su-20172093-1/ Link for SUSE-SU-2017:2093-1 https://lists.suse.com/pipermail/sle-security-updates/2017-August/003112.html E-Mail link for SUSE-SU-2017:2093-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1027575 SUSE Bug 1027575 https://bugzilla.suse.com/1042892 SUSE Bug 1042892 https://bugzilla.suse.com/1046191 SUSE Bug 1046191 https://bugzilla.suse.com/1050751 SUSE Bug 1050751 https://www.suse.com/security/cve/CVE-2017-2636/ SUSE CVE CVE-2017-2636 page https://www.suse.com/security/cve/CVE-2017-7533/ SUSE CVE CVE-2017-7533 page https://www.suse.com/security/cve/CVE-2017-7645/ SUSE CVE CVE-2017-7645 page https://www.suse.com/security/cve/CVE-2017-9242/ SUSE CVE CVE-2017-9242 page SUSE Linux Enterprise Server 12-LTSS SUSE Linux Enterprise Server for SAP Applications 12 kgraft-patch-3_12_60-52_60-default-7-2.1 kgraft-patch-3_12_60-52_60-xen-7-2.1 kgraft-patch-3_12_60-52_60-default-7-2.1 as a component of SUSE Linux Enterprise Server 12-LTSS kgraft-patch-3_12_60-52_60-xen-7-2.1 as a component of SUSE Linux Enterprise Server 12-LTSS kgraft-patch-3_12_60-52_60-default-7-2.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 kgraft-patch-3_12_60-52_60-xen-7-2.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 Race condition in drivers/tty/n_hdlc.c in the Linux kernel through 4.10.1 allows local users to gain privileges or cause a denial of service (double free) by setting the HDLC line discipline. CVE-2017-2636 SUSE Linux Enterprise Server 12-LTSS:kgraft-patch-3_12_60-52_60-default-7-2.1 SUSE Linux Enterprise Server 12-LTSS:kgraft-patch-3_12_60-52_60-xen-7-2.1 SUSE Linux Enterprise Server for SAP Applications 12:kgraft-patch-3_12_60-52_60-default-7-2.1 SUSE Linux Enterprise Server for SAP Applications 12:kgraft-patch-3_12_60-52_60-xen-7-2.1 moderate 6 AV:L/AC:H/Au:S/C:C/I:C/A:C 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172093-1/ https://www.suse.com/security/cve/CVE-2017-2636.html CVE-2017-2636 https://bugzilla.suse.com/1027565 SUSE Bug 1027565 https://bugzilla.suse.com/1027575 SUSE Bug 1027575 https://bugzilla.suse.com/1028372 SUSE Bug 1028372 https://bugzilla.suse.com/1115893 SUSE Bug 1115893 Race condition in the fsnotify implementation in the Linux kernel through 4.12.4 allows local users to gain privileges or cause a denial of service (memory corruption) via a crafted application that leverages simultaneous execution of the inotify_handle_event and vfs_rename functions. CVE-2017-7533 SUSE Linux Enterprise Server 12-LTSS:kgraft-patch-3_12_60-52_60-default-7-2.1 SUSE Linux Enterprise Server 12-LTSS:kgraft-patch-3_12_60-52_60-xen-7-2.1 SUSE Linux Enterprise Server for SAP Applications 12:kgraft-patch-3_12_60-52_60-default-7-2.1 SUSE Linux Enterprise Server for SAP Applications 12:kgraft-patch-3_12_60-52_60-xen-7-2.1 important 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172093-1/ https://www.suse.com/security/cve/CVE-2017-7533.html CVE-2017-7533 https://bugzilla.suse.com/1049483 SUSE Bug 1049483 https://bugzilla.suse.com/1050677 SUSE Bug 1050677 https://bugzilla.suse.com/1050751 SUSE Bug 1050751 https://bugzilla.suse.com/1053919 SUSE Bug 1053919 The NFSv2/NFSv3 server in the nfsd subsystem in the Linux kernel through 4.10.11 allows remote attackers to cause a denial of service (system crash) via a long RPC reply, related to net/sunrpc/svc.c, fs/nfsd/nfs3xdr.c, and fs/nfsd/nfsxdr.c. CVE-2017-7645 SUSE Linux Enterprise Server 12-LTSS:kgraft-patch-3_12_60-52_60-default-7-2.1 SUSE Linux Enterprise Server 12-LTSS:kgraft-patch-3_12_60-52_60-xen-7-2.1 SUSE Linux Enterprise Server for SAP Applications 12:kgraft-patch-3_12_60-52_60-default-7-2.1 SUSE Linux Enterprise Server for SAP Applications 12:kgraft-patch-3_12_60-52_60-xen-7-2.1 important 6.3 AV:N/AC:M/Au:S/C:N/I:N/A:C 7.8 AV:N/AC:L/Au:N/C:N/I:N/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172093-1/ https://www.suse.com/security/cve/CVE-2017-7645.html CVE-2017-7645 https://bugzilla.suse.com/1034670 SUSE Bug 1034670 https://bugzilla.suse.com/1036741 SUSE Bug 1036741 https://bugzilla.suse.com/1046191 SUSE Bug 1046191 https://bugzilla.suse.com/1087082 SUSE Bug 1087082 The __ip6_append_data function in net/ipv6/ip6_output.c in the Linux kernel through 4.11.3 is too late in checking whether an overwrite of an skb data structure may occur, which allows local users to cause a denial of service (system crash) via crafted system calls. CVE-2017-9242 SUSE Linux Enterprise Server 12-LTSS:kgraft-patch-3_12_60-52_60-default-7-2.1 SUSE Linux Enterprise Server 12-LTSS:kgraft-patch-3_12_60-52_60-xen-7-2.1 SUSE Linux Enterprise Server for SAP Applications 12:kgraft-patch-3_12_60-52_60-default-7-2.1 SUSE Linux Enterprise Server for SAP Applications 12:kgraft-patch-3_12_60-52_60-xen-7-2.1 important 4.6 AV:L/AC:L/Au:N/C:P/I:P/A:P 4.9 AV:L/AC:L/Au:N/C:N/I:N/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172093-1/ https://www.suse.com/security/cve/CVE-2017-9242.html CVE-2017-9242 https://bugzilla.suse.com/1041431 SUSE Bug 1041431 https://bugzilla.suse.com/1042892 SUSE Bug 1042892