drivers/hid/hid-picolcd_core.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_PICOLCD is enabled, allows physically proximate attackers to cause a denial of service (NULL pointer dereference and OOPS) via a crafted device.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The snd_msndmidi_input_read function in     sound/isa/msnd/msnd_midi.c in the Linux kernel through     4.11.7 allows local users to cause a denial of service     (over-boundary access) or possibly have unspecified     other impact by changing the value of a message queue     head pointer between two kernel reads of that value,     aka a 'double fetch' vulnerability.(CVE-2017-9985i1/4%0

  - An assertion failure issue was found in the Linux     kernel's KVM hypervisor module built to support     visualization on ARM64 architecture platforms. The     failure could occur while accessing Performance     Monitors Cycle Count Register (PMCCNTR) from a guest. A     privileged guest user could use this flaw to crash the     host kernel resulting in denial of     service.(CVE-2017-12168i1/4%0

  - The iscsi_if_rx() function in     'drivers/scsi/scsi_transport_iscsi.c' in the Linux     kernel from v2.6.24-rc1 through 4.13.2 allows local     users to cause a denial of service (a system panic) by     making a number of certain syscalls by leveraging     incorrect length validation in the kernel     code.(CVE-2017-14489i1/4%0

  - The hdpvr_probe function in     drivers/media/usb/hdpvr/hdpvr-core.c in the Linux     kernel through 4.13.11 allows local users to cause a     denial of service (improper error handling and system     crash) or possibly have unspecified other impact via a     crafted USB device.(CVE-2017-16644i1/4%0

  - The dvb frontend management subsystem in the Linux     kernel contains a use-after-free which can allow a     malicious user to write to memory that may be assigned     to another kernel structure. This could create memory     corruption, panic, or possibly other side     affects.(CVE-2017-16648i1/4%0

  - It was found that the Linux kernel's IPv6     implementation mishandled socket options. A local     attacker could abuse concurrent access to the socket     options to escalate their privileges, or cause a denial     of service (use-after-free and system crash) via a     crafted sendmsg system call.(CVE-2016-3841i1/4%0

  - A flaw was found in the Linux kernel's ext4 filesystem.
    A local user can cause a use-after-free in     ext4_xattr_set_entry function and a denial of service     or unspecified other impact may occur by renaming a     file in a crafted ext4 filesystem     image.(CVE-2018-10879i1/4%0

  - A race condition was found in the Linux kernel, present     since v3.14-rc1 through v4.12. The race happens between     threads of inotify_handle_event() and vfs_rename()     while running the rename operation against the same     file. As a result of the race the next slab data or the     slab's free list pointer can be corrupted with     attacker-controlled data, which may lead to the     privilege escalation.(CVE-2017-7533i1/4%0

  - A privilege-escalation vulnerability was discovered in     the Linux kernel built with User Namespace     (CONFIG_USER_NS) support. The flaw occurred when the     ptrace() system call was used on a root-owned process     to enter a user namespace. A privileged namespace user     could exploit this flaw to potentially escalate their     privileges on the system, outside the original     namespace.(CVE-2015-8709i1/4%0

  - Use-after-free vulnerability in     drivers/net/ppp/ppp_generic.c in the Linux kernel     before 4.5.2 allows local users to cause a denial of     service (memory corruption and system crash, or     spinlock) or possibly have unspecified other impact by     removing a network namespace, related to the     ppp_register_net_channel and ppp_unregister_channel     functions.(CVE-2016-4805i1/4%0

  - A flaw was found in the way the Linux kernel's     kvm_iommu_map_pages() function handled IOMMU mapping     failures. A privileged user in a guest with an assigned     host device could use this flaw to crash the     host.(CVE-2014-3601i1/4%0

  - A flaw was found in the Linux kernel's implementation     of associative arrays introduced in 3.13. This     functionality was backported to the 3.10 kernels in Red     Hat Enterprise Linux 7. The flaw involved a null     pointer dereference in assoc_array_apply_edit() due to     incorrect node-splitting in assoc_array implementation.
    This affects the keyring key type and thus key addition     and link creation operations may cause the kernel to     panic.(CVE-2017-12193i1/4%0

  - Multiple race conditions in drivers/char/adsprpc.c and     drivers/char/adsprpc_compat.c in the ADSPRPC driver for     the Linux kernel 3.x, as used in Qualcomm Innovation     Center (QuIC) Android contributions for MSM devices and     other products, allow attackers to cause a denial of     service (zero-value write) or possibly have unspecified     other impact via a COMPAT_FASTRPC_IOCTL_INVOKE_FD ioctl     call.(CVE-2015-0572i1/4%0

  - The sanity_check_ckpt function in fs/f2fs/super.c in     the Linux kernel before version 4.12.4 does not     validate the blkoff and segno arrays. This allows an     unprivileged, local user to cause a system panic and     DoS. Due to the nature of the flaw, privilege     escalation cannot be fully ruled out, although we     believe it is unlikely.(CVE-2017-10663i1/4%0

  - A stack overflow flaw caused by infinite recursion was     found in the way the Linux kernel's Universal Disk     Format (UDF) file system implementation processed     indirect Information Control Blocks (ICBs). An attacker     with physical access to the system could use a     specially crafted UDF image to crash the     system.(CVE-2014-6410i1/4%0

  - Race condition in the ion_ioctl function in     drivers/staging/android/ion/ion.c in the Linux kernel     before 4.6 allows local users to gain privileges or     cause a denial of service (use-after-free) by calling     ION_IOC_FREE on two CPUs at the same     time.(CVE-2016-9120i1/4%0

  - drivers/hid/hid-picolcd_core.c in the Human Interface     Device (HID) subsystem in the Linux kernel through     3.11, when CONFIG_HID_PICOLCD is enabled, allows     physically proximate attackers to cause a denial of     service (NULL pointer dereference and OOPS) via a     crafted device.(CVE-2013-2899i1/4%0

  - A flaw was found in the Linux kernel's implementation     of overlayfs. An attacker can leak file resources in     the system by opening a large file with write     permissions on a overlay filesystem that is     insufficient to deal with the size of the write.When     unmounting the underlying device, the system is unable     to free an inode and this will consume resources.
    Repeating this for all available inodes and memory will     create a denial of service situation.(CVE-2015-8953i1/4%0

  - Buffer overflow in the mp_override_legacy_irq()     function in arch/x86/kernel/acpi/boot.c in the Linux     kernel through 4.12.2 allows local users to gain     privileges via a crafted ACPI table.(CVE-2017-11473i1/4%0

  - Use-after-free vulnerability in the     kvm_ioctl_create_device function in virt/kvm/kvm_main.c     in the Linux kernel before 4.8.13 allows host OS users     to cause a denial of service (host OS crash) or     possibly gain privileges via crafted ioctl calls on the     /dev/kvm device.(CVE-2016-10150i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2017-0057 for details.

The SUSE Linux Enterprise 11 Service Pack 2 LTSS kernel has been updated to fix security issues on kernels on the x86_64 architecture.

The following security bugs have been fixed :

  - CVE-2012-4398: The __request_module function in     kernel/kmod.c in the Linux kernel before 3.4 did not set     a certain killable attribute, which allowed local users     to cause a denial of service (memory consumption) via a     crafted application (bnc#779488).

  - CVE-2013-2893: The Human Interface Device (HID)     subsystem in the Linux kernel through 3.11, when     CONFIG_LOGITECH_FF, CONFIG_LOGIG940_FF, or     CONFIG_LOGIWHEELS_FF is enabled, allowed physically     proximate attackers to cause a denial of service     (heap-based out-of-bounds write) via a crafted device,     related to (1) drivers/hid/hid-lgff.c, (2)     drivers/hid/hid-lg3ff.c, and (3) drivers/hid/hid-lg4ff.c     (bnc#835839).

  - CVE-2013-2897: Multiple array index errors in     drivers/hid/hid-multitouch.c in the Human Interface     Device (HID) subsystem in the Linux kernel through 3.11,     when CONFIG_HID_MULTITOUCH is enabled, allowed     physically proximate attackers to cause a denial of     service (heap memory corruption, or NULL pointer     dereference and OOPS) via a crafted device (bnc#835839).

  - CVE-2013-2899: drivers/hid/hid-picolcd_core.c in the     Human Interface Device (HID) subsystem in the Linux     kernel through 3.11, when CONFIG_HID_PICOLCD is enabled,     allowed physically proximate attackers to cause a denial     of service (NULL pointer dereference and OOPS) via a     crafted device (bnc#835839).

  - CVE-2013-2929: The Linux kernel before 3.12.2 did not     properly use the get_dumpable function, which allowed     local users to bypass intended ptrace restrictions or     obtain sensitive information from IA64 scratch registers     via a crafted application, related to kernel/ptrace.c     and arch/ia64/include/asm/processor.h (bnc#847652).

  - CVE-2013-7263: The Linux kernel before 3.12.4 updates     certain length values before ensuring that associated     data structures have been initialized, which allowed     local users to obtain sensitive information from kernel     stack memory via a (1) recvfrom, (2) recvmmsg, or (3)     recvmsg system call, related to net/ipv4/ping.c,     net/ipv4/raw.c, net/ipv4/udp.c, net/ipv6/raw.c, and     net/ipv6/udp.c (bnc#857643).

  - CVE-2014-0131: Use-after-free vulnerability in the     skb_segment function in net/core/skbuff.c in the Linux     kernel through 3.13.6 allowed attackers to obtain     sensitive information from kernel memory by leveraging     the absence of a certain orphaning operation     (bnc#867723).

  - CVE-2014-0181: The Netlink implementation in the Linux     kernel through 3.14.1 did not provide a mechanism for     authorizing socket operations based on the opener of a     socket, which allowed local users to bypass intended     access restrictions and modify network configurations by     using a Netlink socket for the (1) stdout or (2) stderr     of a setuid program (bnc#875051).

  - CVE-2014-2309: The ip6_route_add function in     net/ipv6/route.c in the Linux kernel through 3.13.6 did     not properly count the addition of routes, which allowed     remote attackers to cause a denial of service (memory     consumption) via a flood of ICMPv6 Router Advertisement     packets (bnc#867531).

  - CVE-2014-3181: Multiple stack-based buffer overflows in     the magicmouse_raw_event function in     drivers/hid/hid-magicmouse.c in the Magic Mouse HID     driver in the Linux kernel through 3.16.3 allowed     physically proximate attackers to cause a denial of     service (system crash) or possibly execute arbitrary     code via a crafted device that provides a large amount     of (1) EHCI or (2) XHCI data associated with an event     (bnc#896382).

  - CVE-2014-3184: The report_fixup functions in the HID     subsystem in the Linux kernel before 3.16.2 might have     allowed physically proximate attackers to cause a denial     of service (out-of-bounds write) via a crafted device     that provides a small report descriptor, related to (1)     drivers/hid/hid-cherry.c, (2) drivers/hid/hid-kye.c, (3)     drivers/hid/hid-lg.c, (4) drivers/hid/hid-monterey.c,     (5) drivers/hid/hid-petalynx.c, and (6)     drivers/hid/hid-sunplus.c (bnc#896390).

  - CVE-2014-3185: Multiple buffer overflows in the     command_port_read_callback function in     drivers/usb/serial/whiteheat.c in the Whiteheat USB     Serial Driver in the Linux kernel before 3.16.2 allowed     physically proximate attackers to execute arbitrary code     or cause a denial of service (memory corruption and     system crash) via a crafted device that provides a large     amount of (1) EHCI or (2) XHCI data associated with a     bulk response (bnc#896391).

  - CVE-2014-3186: Buffer overflow in the picolcd_raw_event     function in devices/hid/hid-picolcd_core.c in the     PicoLCD HID device driver in the Linux kernel through     3.16.3, as used in Android on Nexus 7 devices, allowed     physically proximate attackers to cause a denial of     service (system crash) or possibly execute arbitrary     code via a crafted device that sends a large report     (bnc#896392).

  - CVE-2014-3601: The kvm_iommu_map_pages function in     virt/kvm/iommu.c in the Linux kernel through 3.16.1     miscalculates the number of pages during the handling of     a mapping failure, which allowed guest OS users to (1)     cause a denial of service (host OS memory corruption) or     possibly have unspecified other impact by triggering a     large gfn value or (2) cause a denial of service (host     OS memory consumption) by triggering a small gfn value     that leads to permanently pinned pages (bnc#892782).

  - CVE-2014-3610: The WRMSR processing functionality in the     KVM subsystem in the Linux kernel through 3.17.2 did not     properly handle the writing of a non-canonical address     to a model-specific register, which allowed guest OS     users to cause a denial of service (host OS crash) by     leveraging guest OS privileges, related to the     wrmsr_interception function in arch/x86/kvm/svm.c and     the handle_wrmsr function in arch/x86/kvm/vmx.c     (bnc#899192).

  - CVE-2014-3646: arch/x86/kvm/vmx.c in the KVM subsystem     in the Linux kernel through 3.17.2 did not have an exit     handler for the INVVPID instruction, which allowed guest     OS users to cause a denial of service (guest OS crash)     via a crafted application (bnc#899192).

  - CVE-2014-3647: arch/x86/kvm/emulate.c in the KVM     subsystem in the Linux kernel through 3.17.2 did not     properly perform RIP changes, which allowed guest OS     users to cause a denial of service (guest OS crash) via     a crafted application (bnc#899192).

  - CVE-2014-3673: The SCTP implementation in the Linux     kernel through 3.17.2 allowed remote attackers to cause     a denial of service (system crash) via a malformed     ASCONF chunk, related to net/sctp/sm_make_chunk.c and     net/sctp/sm_statefuns.c (bnc#902346).

  - CVE-2014-3687: The sctp_assoc_lookup_asconf_ack function     in net/sctp/associola.c in the SCTP implementation in     the Linux kernel through 3.17.2 allowed remote attackers     to cause a denial of service (panic) via duplicate     ASCONF chunks that trigger an incorrect uncork within     the side-effect interpreter (bnc#902349).

  - CVE-2014-3688: The SCTP implementation in the Linux     kernel before 3.17.4 allowed remote attackers to cause a     denial of service (memory consumption) by triggering a     large number of chunks in an associations output queue,     as demonstrated by ASCONF probes, related to     net/sctp/inqueue.c and net/sctp/sm_statefuns.c     (bnc#902351).

  - CVE-2014-3690: arch/x86/kvm/vmx.c in the KVM subsystem     in the Linux kernel before 3.17.2 on Intel processors     did not ensure that the value in the CR4 control     register remains the same after a VM entry, which     allowed host OS users to kill arbitrary processes or     cause a denial of service (system disruption) by     leveraging /dev/kvm access, as demonstrated by     PR_SET_TSC prctl calls within a modified copy of QEMU     (bnc#902232).

  - CVE-2014-4608: Multiple integer overflows in the     lzo1x_decompress_safe function in     lib/lzo/lzo1x_decompress_safe.c in the LZO decompressor     in the Linux kernel before 3.15.2 allowed     context-dependent attackers to cause a denial of service     (memory corruption) via a crafted Literal Run     (bnc#883948).

  - CVE-2014-4943: The PPPoL2TP feature in     net/l2tp/l2tp_ppp.c in the Linux kernel through 3.15.6     allowed local users to gain privileges by leveraging     data-structure differences between an l2tp socket and an     inet socket (bnc#887082).

  - CVE-2014-5471: Stack consumption vulnerability in the     parse_rock_ridge_inode_internal function in     fs/isofs/rock.c in the Linux kernel through 3.16.1     allowed local users to cause a denial of service     (uncontrolled recursion, and system crash or reboot) via     a crafted iso9660 image with a CL entry referring to a     directory entry that has a CL entry (bnc#892490).

  - CVE-2014-5472: The parse_rock_ridge_inode_internal     function in fs/isofs/rock.c in the Linux kernel through     3.16.1 allowed local users to cause a denial of service     (unkillable mount process) via a crafted iso9660 image     with a self-referential CL entry (bnc#892490).

  - CVE-2014-7826: kernel/trace/trace_syscalls.c in the     Linux kernel through 3.17.2 did not properly handle     private syscall numbers during use of the ftrace     subsystem, which allowed local users to gain privileges     or cause a denial of service (invalid pointer     dereference) via a crafted application (bnc#904013).

  - CVE-2014-7841: The sctp_process_param function in     net/sctp/sm_make_chunk.c in the SCTP implementation in     the Linux kernel before 3.17.4, when ASCONF is used,     allowed remote attackers to cause a denial of service     (NULL pointer dereference and system crash) via a     malformed INIT chunk (bnc#905100).

  - CVE-2014-7842: Race condition in arch/x86/kvm/x86.c in     the Linux kernel before 3.17.4 allowed guest OS users to     cause a denial of service (guest OS crash) via a crafted     application that performs an MMIO transaction or a PIO     transaction to trigger a guest userspace emulation error     report, a similar issue to CVE-2010-5313 (bnc#905312).

  - CVE-2014-8134: The paravirt_ops_setup function in     arch/x86/kernel/kvm.c in the Linux kernel through 3.18     uses an improper paravirt_enabled setting for KVM guest     kernels, which made it easier for guest OS users to     bypass the ASLR protection mechanism via a crafted     application that reads a 16-bit value (bnc#909078).

  - CVE-2014-8369: The kvm_iommu_map_pages function in     virt/kvm/iommu.c in the Linux kernel through 3.17.2     miscalculates the number of pages during the handling of     a mapping failure, which allowed guest OS users to cause     a denial of service (host OS page unpinning) or possibly     have unspecified other impact by leveraging guest OS     privileges. NOTE: this vulnerability exists because of     an incorrect fix for CVE-2014-3601 (bnc#902675).

  - CVE-2014-8559: The d_walk function in fs/dcache.c in the     Linux kernel through 3.17.2 did not properly maintain     the semantics of rename_lock, which allowed local users     to cause a denial of service (deadlock and system hang)     via a crafted application (bnc#903640).

  - CVE-2014-8709: The ieee80211_fragment function in     net/mac80211/tx.c in the Linux kernel before 3.13.5 did     not properly maintain a certain tail pointer, which     allowed remote attackers to obtain sensitive cleartext     information by reading packets (bnc#904700).

  - CVE-2014-9584: The parse_rock_ridge_inode_internal     function in fs/isofs/rock.c in the Linux kernel before     3.18.2 did not validate a length value in the Extensions     Reference (ER) System Use Field, which allowed local     users to obtain sensitive information from kernel memory     via a crafted iso9660 image (bnc#912654).

  - CVE-2014-9585: The vdso_addr function in     arch/x86/vdso/vma.c in the Linux kernel through 3.18.2     did not properly choose memory locations for the vDSO     area, which made it easier for local users to bypass the     ASLR protection mechanism by guessing a location at the     end of a PMD (bnc#912705).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 11 Service Pack 3 kernel has been updated to fix various bugs and security issues.

The following security bugs have been fixed :

  - The __request_module function in kernel/kmod.c in the     Linux kernel before 3.4 did not set a certain killable     attribute, which allowed local users to cause a denial     of service (memory consumption) via a crafted     application. (bnc#779488). (CVE-2012-4398)

  - drivers/hid/hid-zpff.c in the Human Interface Device     (HID) subsystem in the Linux kernel through 3.11, when     CONFIG_HID_ZEROPLUS is enabled, allowed physically     proximate attackers to cause a denial of service     (heap-based out-of-bounds write) via a crafted device.
    (bnc#835839). (CVE-2013-2889)

  - The Human Interface Device (HID) subsystem in the Linux     kernel through 3.11, when CONFIG_LOGITECH_FF,     CONFIG_LOGIG940_FF, or CONFIG_LOGIWHEELS_FF is enabled,     allowed physically proximate attackers to cause a denial     of service (heap-based out-of-bounds write) via a     crafted device, related to (1) drivers/hid/hid-lgff.c,     (2) drivers/hid/hid-lg3ff.c, and (3)     drivers/hid/hid-lg4ff.c. (bnc#835839). (CVE-2013-2893)

  - Multiple array index errors in     drivers/hid/hid-multitouch.c in the Human Interface     Device (HID) subsystem in the Linux kernel through 3.11,     when CONFIG_HID_MULTITOUCH is enabled, allowed     physically proximate attackers to cause a denial of     service (heap memory corruption, or NULL pointer     dereference and OOPS) via a crafted device.
    (bnc#835839). (CVE-2013-2897)

  - drivers/hid/hid-picolcd_core.c in the Human Interface     Device (HID) subsystem in the Linux kernel through 3.11,     when CONFIG_HID_PICOLCD is enabled, allowed physically     proximate attackers to cause a denial of service (NULL     pointer dereference and OOPS) via a crafted device.
    (bnc#835839). (CVE-2013-2899)

  - The Linux kernel before 3.12.4 updates certain length     values before ensuring that associated data structures     have been initialized, which allowed local users to     obtain sensitive information from kernel stack memory     via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system     call, related to net/ipv4/ping.c, net/ipv4/raw.c,     net/ipv4/udp.c, net/ipv6/raw.c, and net/ipv6/udp.c.
    (bnc#853040, bnc#857643). (CVE-2013-7263)

  - Multiple stack-based buffer overflows in the     magicmouse_raw_event function in     drivers/hid/hid-magicmouse.c in the Magic Mouse HID     driver in the Linux kernel through 3.16.3 allowed     physically proximate attackers to cause a denial of     service (system crash) or possibly execute arbitrary     code via a crafted device that provides a large amount     of (1) EHCI or (2) XHCI data associated with an event.
    (bnc#896382). (CVE-2014-3181)

  - The report_fixup functions in the HID subsystem in the     Linux kernel before 3.16.2 allowed physically proximate     attackers to cause a denial of service (out-of-bounds     write) via a crafted device that provides a small report     descriptor, related to (1) drivers/hid/hid-cherry.c, (2)     drivers/hid/hid-kye.c, (3) drivers/hid/hid-lg.c, (4)     drivers/hid/hid-monterey.c, (5)     drivers/hid/hid-petalynx.c, and (6)     drivers/hid/hid-sunplus.c. (bnc#896390). (CVE-2014-3184)

  - Multiple buffer overflows in the     command_port_read_callback function in     drivers/usb/serial/whiteheat.c in the Whiteheat USB     Serial Driver in the Linux kernel before 3.16.2 allowed     physically proximate attackers to execute arbitrary code     or cause a denial of service (memory corruption and     system crash) via a crafted device that provides a large     amount of (1) EHCI or (2) XHCI data associated with a     bulk response. (bnc#896391). (CVE-2014-3185)

  - Buffer overflow in the picolcd_raw_event function in     devices/hid/hid-picolcd_core.c in the PicoLCD HID device     driver in the Linux kernel through 3.16.3, as used in     Android on Nexus 7 devices, allowed physically proximate     attackers to cause a denial of service (system crash) or     possibly execute arbitrary code via a crafted device     that sends a large report. (bnc#896392). (CVE-2014-3186)

  - The kvm_iommu_map_pages function in virt/kvm/iommu.c in     the Linux kernel through 3.16.1 miscalculated the number     of pages during the handling of a mapping failure, which     allowed guest OS users to (1) cause a denial of service     (host OS memory corruption) or possibly have unspecified     other impact by triggering a large gfn value or (2)     cause a denial of service (host OS memory consumption)     by triggering a small gfn value that leads to     permanently pinned pages. (bnc#892782). (CVE-2014-3601)

  - The WRMSR processing functionality in the KVM subsystem     in the Linux kernel through 3.17.2 did not properly     handle the writing of a non-canonical address to a     model-specific register, which allowed guest OS users to     cause a denial of service (host OS crash) by leveraging     guest OS privileges, related to the wrmsr_interception     function in arch/x86/kvm/svm.c and the handle_wrmsr     function in arch/x86/kvm/vmx.c. (bnc#899192).
    (CVE-2014-3610)

  - arch/x86/kvm/vmx.c in the KVM subsystem in the Linux     kernel through 3.17.2 did not have an exit handler for     the INVVPID instruction, which allowed guest OS users to     cause a denial of service (guest OS crash) via a crafted     application. (bnc#899192). (CVE-2014-3646)

  - arch/x86/kvm/emulate.c in the KVM subsystem in the Linux     kernel through 3.17.2 did not properly perform RIP     changes, which allowed guest OS users to cause a denial     of service (guest OS crash) via a crafted application.
    (bnc#899192). (CVE-2014-3647)

  - The SCTP implementation in the Linux kernel through     3.17.2 allowed remote attackers to cause a denial of     service (system crash) via a malformed ASCONF chunk,     related to net/sctp/sm_make_chunk.c and     net/sctp/sm_statefuns.c. (bnc#902346, bnc#902349).
    (CVE-2014-3673)

  - arch/x86/kernel/entry_32.S in the Linux kernel through     3.15.1 on 32-bit x86 platforms, when syscall auditing is     enabled and the sep CPU feature flag is set, allowed     local users to cause a denial of service (OOPS and     system crash) via an invalid syscall number, as     demonstrated by number 1000. (bnc#883724).
    (CVE-2014-4508)

  - * DISPUTED * Multiple integer overflows in the     lzo1x_decompress_safe function in     lib/lzo/lzo1x_decompress_safe.c in the LZO decompressor     in the Linux kernel before 3.15.2 allowed     context-dependent attackers to cause a denial of service     (memory corruption) via a crafted Literal Run. NOTE: the     author of the LZO algorithms says: The Linux kernel is     not affected; media hype. (bnc#883948). (CVE-2014-4608)

  - kernel/trace/trace_syscalls.c in the Linux kernel     through 3.17.2 did not properly handle private syscall     numbers during use of the ftrace subsystem, which     allowed local users to gain privileges or cause a denial     of service (invalid pointer dereference) via a crafted     application. (bnc#904013). (CVE-2014-7826)

  - An SCTP server doing ASCONF would panic on malformed     INIT ping-of-death. (bnc#905100). (CVE-2014-7841)

  - The ieee80211_fragment function in net/mac80211/tx.c in     the Linux kernel before 3.13.5 did not properly maintain     a certain tail pointer, which allowed remote attackers     to obtain sensitive cleartext information by reading     packets. (bnc#904700). (CVE-2014-8709)

  - A local user with write access could have used this flaw     to crash the kernel or elevate privileges (bnc#905522).
    The following non-security bugs have been fixed:.
    (CVE-2014-8884)

  - Build the KOTD against the SP3 Update project

  - HID: fix kabi breakage.

  - NFS: Provide stub nfs_fscache_wait_on_invalidate() for     when CONFIG_NFS_FSCACHE=n.

  - NFS: fix inverted test for delegation in     nfs4_reclaim_open_state. (bnc#903331)

  - NFS: remove incorrect Lock reclaim failed! warning.
    (bnc#903331)

  - NFSv4: nfs4_open_done first must check that GETATTR     decoded a file type. (bnc#899574)

  - PCI: pciehp: Clear Data Link Layer State Changed during     init. (bnc#898295)

  - PCI: pciehp: Enable link state change notifications.
    (bnc#898295)

  - PCI: pciehp: Handle push button event asynchronously.
    (bnc#898295)

  - PCI: pciehp: Make check_link_active() non-static.
    (bnc#898295)

  - PCI: pciehp: Use link change notifications for hot-plug     and removal. (bnc#898295)

  - PCI: pciehp: Use per-slot workqueues to avoid deadlock.
    (bnc#898295)

  - PCI: pciehp: Use symbolic constants, not hard-coded     bitmask. (bnc#898295)

  - PM / hibernate: Iterate over set bits instead of PFNs in     swsusp_free(). (bnc#860441)

  - be2net: Fix invocation of be_close() after be_clear().
    (bnc#895468)

  - block: Fix bogus partition statistics reports.
    (bnc#885077 / bnc#891211)

  - block: Fix computation of merged request priority.

  - btrfs: Fix wrong device size when we are resizing the     device.

  - btrfs: Return right extent when fiemap gives unaligned     offset and len.

  - btrfs: abtract out range locking in clone ioctl().

  - btrfs: always choose work from prio_head first.

  - btrfs: balance delayed inode updates.

  - btrfs: cache extent states in defrag code path.

  - btrfs: check file extent type before anything else.
    (bnc#897694)

  - btrfs: clone, do not create invalid hole extent map.

  - btrfs: correctly determine if blocks are shared in     btrfs_compare_trees.

  - btrfs: do not bug_on if we try to cow a free space cache     inode.

  - btrfs: ensure btrfs_prev_leaf does not miss 1 item.

  - btrfs: ensure readers see new data after a clone     operation.

  - btrfs: fill_holes: Fix slot number passed to     hole_mergeable() call.

  - btrfs: filter invalid arg for btrfs resize.

  - btrfs: fix EINVAL checks in btrfs_clone.

  - btrfs: fix EIO on reading file after ioctl clone works     on it.

  - btrfs: fix a crash of clone with inline extents split.

  - btrfs: fix crash of compressed writes. (bnc#898375)

  - btrfs: fix crash when starting transaction.

  - btrfs: fix deadlock with nested trans handles.

  - btrfs: fix hang on error (such as ENOSPC) when writing     extent pages.

  - btrfs: fix leaf corruption after __btrfs_drop_extents.

  - btrfs: fix race between balance recovery and root     deletion.

  - btrfs: fix wrong extent mapping for DirectIO.

  - btrfs: handle a missing extent for the first file     extent.

  - btrfs: limit delalloc pages outside of     find_delalloc_range. (bnc#898375)

  - btrfs: read lock extent buffer while walking backrefs.

  - btrfs: remove unused wait queue in struct extent_buffer.

  - btrfs: replace EINVAL with ERANGE for resize when     ULLONG_MAX.

  - btrfs: replace error code from btrfs_drop_extents.

  - btrfs: unlock extent and pages on error in     cow_file_range.

  - btrfs: unlock inodes in correct order in clone ioctl.

  - btrfs_ioctl_clone: Move clone code into its own     function.

  - cifs: delay super block destruction until all     cifsFileInfo objects are gone. (bnc#903653)

  - drm/i915: Flush the PTEs after updating them before     suspend. (bnc#901638)

  - drm/i915: Undo gtt scratch pte unmapping again.
    (bnc#901638)

  - ext3: return 32/64-bit dir name hash according to usage     type. (bnc#898554)

  - ext4: return 32/64-bit dir name hash according to usage     type. (bnc#898554)

  - fix: use after free of xfs workqueues. (bnc#894895)

  - fs: add new FMODE flags: FMODE_32bithash and     FMODE_64bithash. (bnc#898554)

  - futex: Ensure get_futex_key_refs() always implies a     barrier (bnc#851603 (futex scalability series)).

  - futex: Fix a race condition between REQUEUE_PI and task     death (bnc#851603 (futex scalability series)).

  - ipv6: add support of peer address. (bnc#896415)

  - ipv6: fix a refcnt leak with peer addr. (bnc#896415)

  - megaraid_sas: Disable fastpath writes for non-RAID0.
    (bnc#897502)

  - mm: change __remove_pages() to call     release_mem_region_adjustable(). (bnc#891790)

  - netxen: Fix link event handling. (bnc#873228)

  - netxen: fix link notification order. (bnc#873228)

  - nfsd: rename int access to int may_flags in nfsd_open().
    (bnc#898554)

  - nfsd: vfs_llseek() with 32 or 64 bit offsets (hashes).
    (bnc#898554)

  - ocfs2: fix NULL pointer dereference in     ocfs2_duplicate_clusters_by_page. (bnc#899843)

  - powerpc: Add smp_mb() to arch_spin_is_locked()     (bsc#893758).

  - powerpc: Add smp_mb()s to arch_spin_unlock_wait()     (bsc#893758).

  - powerpc: Add support for the optimised lockref     implementation (bsc#893758).

  - powerpc: Implement arch_spin_is_locked() using     arch_spin_value_unlocked() (bsc#893758).

  - refresh patches.xen/xen-blkback-multi-page-ring     (bnc#897708)).

  - remove filesize checks for sync I/O journal commit.
    (bnc#800255)

  - resource: add __adjust_resource() for internal use.
    (bnc#891790)

  - resource: add release_mem_region_adjustable().
    (bnc#891790)

  - revert PM / Hibernate: Iterate over set bits instead of     PFNs in swsusp_free(). (bnc#860441)

  - rpm/mkspec: Generate specfiles according to Factory     requirements.

  - rpm/mkspec: Generate a per-architecture per-package
    _constraints file

  - sched: Fix unreleased llc_shared_mask bit during CPU     hotplug. (bnc#891368)

  - scsi_dh_alua: disable ALUA handling for non-disk     devices. (bnc#876633)

  - usb: Do not re-read descriptors for wired devices in     usb_authorize_device(). (bnc#904358)

  - usbback: Do not access request fields in shared ring     more than once.

  - usbhid: add another mouse that needs QUIRK_ALWAYS_POLL.
    (bnc#888607)

  - vfs,proc: guarantee unique inodes in /proc. (bnc#868049)

  - x86, cpu hotplug: Fix stack frame warning     incheck_irq_vectors_for_cpu_disable(). (bnc#887418)

  - x86, ioremap: Speed up check for RAM pages (Boot time     optimisations (bnc#895387)).

  - x86: Add check for number of available vectors before     CPU down. (bnc#887418)

  - x86: optimize resource lookups for ioremap (Boot time     optimisations (bnc#895387)).

  - x86: use optimized ioresource lookup in ioremap function     (Boot time optimisations (bnc#895387)).

  - xfs: Do not free EFIs before the EFDs are committed     (bsc#755743).

  - xfs: Do not reference the EFI after it is freed     (bsc#755743).

  - xfs: fix cil push sequence after log recovery     (bsc#755743).

  - zcrypt: support for extended number of ap domains     (bnc#894058, LTC#117041).

  - zcrypt: toleration of new crypto adapter hardware     (bnc#894058, LTC#117041).

The openSUSE 12.3 kernel was updated to fix security issues :

This will be the final kernel update for openSUSE 13.2 during its lifetime, which ends January 4th 2015.

CVE-2014-9322: A local privilege escalation in the x86_64 32bit compatibility signal handling was fixed, which could be used by local attackers to crash the machine or execute code.

CVE-2014-9090: The do_double_fault function in arch/x86/kernel/traps.c in the Linux kernel did not properly handle faults associated with the Stack Segment (SS) segment register, which allowed local users to cause a denial of service (panic) via a modify_ldt system call, as demonstrated by sigreturn_32 in the linux-clock-tests test suite.

CVE-2014-8133: Insufficient validation of TLS register usage could leak information from the kernel stack to userspace.

CVE-2014-4508: arch/x86/kernel/entry_32.S in the Linux kernel on 32-bit x86 platforms, when syscall auditing is enabled and the sep CPU feature flag is set, allowed local users to cause a denial of service (OOPS and system crash) via an invalid syscall number, as demonstrated by number 1000.

CVE-2014-8884: Stack-based buffer overflow in the ttusbdecfe_dvbs_diseqc_send_master_cmd function in drivers/media/usb/ttusb-dec/ttusbdecfe.c in the Linux kernel allowed local users to cause a denial of service (system crash) or possibly gain privileges via a large message length in an ioctl call.

CVE-2014-3186: Buffer overflow in the picolcd_raw_event function in devices/hid/hid-picolcd_core.c in the PicoLCD HID device driver in the Linux kernel, as used in Android on Nexus 7 devices, allowed physically proximate attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a crafted device that sends a large report.

CVE-2014-7841: The sctp_process_param function in net/sctp/sm_make_chunk.c in the SCTP implementation in the Linux kernel, when ASCONF is used, allowed remote attackers to cause a denial of service (NULL pointer dereference and system crash) via a malformed INIT chunk.

CVE-2014-4608: Multiple integer overflows in the lzo1x_decompress_safe function in lib/lzo/lzo1x_decompress_safe.c in the LZO decompressor in the Linux kernel allowed context-dependent attackers to cause a denial of service (memory corruption) via a crafted Literal Run.

CVE-2014-8709: The ieee80211_fragment function in net/mac80211/tx.c in the Linux kernel did not properly maintain a certain tail pointer, which allowed remote attackers to obtain sensitive cleartext information by reading packets.

CVE-2014-3185: Multiple buffer overflows in the command_port_read_callback function in drivers/usb/serial/whiteheat.c in the Whiteheat USB Serial Driver in the Linux kernel allowed physically proximate attackers to execute arbitrary code or cause a denial of service (memory corruption and system crash) via a crafted device that provides a large amount of (1) EHCI or (2) XHCI data associated with a bulk response.

CVE-2014-3184: The report_fixup functions in the HID subsystem in the Linux kernel might have allowed physically proximate attackers to cause a denial of service (out-of-bounds write) via a crafted device that provides a small report descriptor, related to (1) drivers/hid/hid-cherry.c, (2) drivers/hid/hid-kye.c, (3) drivers/hid/hid-lg.c, (4) drivers/hid/hid-monterey.c, (5) drivers/hid/hid-petalynx.c, and (6) drivers/hid/hid-sunplus.c.

CVE-2014-3182: Array index error in the logi_dj_raw_event function in drivers/hid/hid-logitech-dj.c in the Linux kernel allowed physically proximate attackers to execute arbitrary code or cause a denial of service (invalid kfree) via a crafted device that provides a malformed REPORT_TYPE_NOTIF_DEVICE_UNPAIRED value.

CVE-2014-3181: Multiple stack-based buffer overflows in the magicmouse_raw_event function in drivers/hid/hid-magicmouse.c in the Magic Mouse HID driver in the Linux kernel allowed physically proximate attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a crafted device that provides a large amount of (1) EHCI or (2) XHCI data associated with an event.

CVE-2014-7826: kernel/trace/trace_syscalls.c in the Linux kernel did not properly handle private syscall numbers during use of the ftrace subsystem, which allowed local users to gain privileges or cause a denial of service (invalid pointer dereference) via a crafted application.

CVE-2013-7263: The Linux kernel updated certain length values before ensuring that associated data structures have been initialized, which allowed local users to obtain sensitive information from kernel stack memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call, related to net/ipv4/ping.c, net/ipv4/raw.c, net/ipv4/udp.c, net/ipv6/raw.c, and net/ipv6/udp.c. This update fixes the leak of the port number when using ipv6 sockets. (bsc#853040).

CVE-2014-6410: The __udf_read_inode function in fs/udf/inode.c in the Linux kernel did not restrict the amount of ICB indirection, which allowed physically proximate attackers to cause a denial of service (infinite loop or stack consumption) via a UDF filesystem with a crafted inode.

CVE-2014-5471: Stack consumption vulnerability in the parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel allowed local users to cause a denial of service (uncontrolled recursion, and system crash or reboot) via a crafted iso9660 image with a CL entry referring to a directory entry that has a CL entry.

CVE-2014-5472: The parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel allowed local users to cause a denial of service (unkillable mount process) via a crafted iso9660 image with a self-referential CL entry.

CVE-2014-4508: arch/x86/kernel/entry_32.S in the Linux kernel on 32-bit x86 platforms, when syscall auditing is enabled and the sep CPU feature flag is set, allowed local users to cause a denial of service (OOPS and system crash) via an invalid syscall number, as demonstrated by number 1000.

CVE-2014-4943: The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the Linux kernel allowed local users to gain privileges by leveraging data-structure differences between an l2tp socket and an inet socket.

CVE-2014-5077: The sctp_assoc_update function in net/sctp/associola.c in the Linux kernel, when SCTP authentication is enabled, allowed remote attackers to cause a denial of service (NULL pointer dereference and OOPS) by starting to establish an association between two endpoints immediately after an exchange of INIT and INIT ACK chunks to establish an earlier association between these endpoints in the opposite direction.

CVE-2014-4171: mm/shmem.c in the Linux kernel did not properly implement the interaction between range notification and hole punching, which allowed local users to cause a denial of service (i_mutex hold) by using the mmap system call to access a hole, as demonstrated by interfering with intended shmem activity by blocking completion of (1) an MADV_REMOVE madvise call or (2) an FALLOC_FL_PUNCH_HOLE fallocate call.

CVE-2013-2888, CVE-2013-2889, CVE-2013-2890, CVE-2013-2891, CVE-2013-2892, CVE-2013-2893, CVE-2013-2894, CVE-2013-2895, CVE-2013-2896, CVE-2013-2897, CVE-2013-2898, CVE-2013-2899: Multiple issues in the Human Interface Device (HID) subsystem in the Linux kernel allowed physically proximate attackers to cause a denial of service or system crash via (heap-based out-of-bounds write) via a crafted device. (Not separately listed.)

Other bugfixes :

  - xfs: mark all internal workqueues as freezable     (bnc#899785).

  - target/rd: Refactor rd_build_device_space +     rd_release_device_space (bnc#882639)

  - Enable CONFIG_ATH9K_HTC for armv7hl/omap2plus config     (bnc#890624)

  - swiotlb: don't assume PA 0 is invalid (bnc#865882).

  - drm/i915: Apply alignment restrictions on scanout     surfaces for VT-d (bnc#818561).

  - tg3: Change nvram command timeout value to 50ms     (bnc#768714).

  - tg3: Override clock, link aware and link idle mode     during NVRAM dump (bnc#768714).

  - tg3: Set the MAC clock to the fastest speed during boot     code load (bnc#768714).

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-3002 advisory.

  - The HP Smart Array controller disk-array driver and Compaq SMART2 controller disk-array driver in the     Linux kernel through 3.9.4 do not initialize certain data structures, which allows local users to obtain     sensitive information from kernel memory via (1) a crafted IDAGETPCIINFO command for a /dev/ida device,     related to the ida_locked_ioctl function in drivers/block/cpqarray.c or (2) a crafted CCISS_PASSTHRU32     command for a /dev/cciss device, related to the cciss_ioctl32_passthru function in drivers/block/cciss.c.
    (CVE-2013-2147)

  - The fill_event_metadata function in fs/notify/fanotify/fanotify_user.c in the Linux kernel through 3.9.4     does not initialize a certain structure member, which allows local users to obtain sensitive information     from kernel memory via a read operation on the fanotify descriptor. (CVE-2013-2148)

  - Heap-based buffer overflow in the iscsi_add_notunderstood_response function in     drivers/target/iscsi/iscsi_target_parameters.c in the iSCSI target subsystem in the Linux kernel through     3.9.4 allows remote attackers to cause a denial of service (memory corruption and OOPS) or possibly     execute arbitrary code via a long key that is not properly handled during construction of an error-     response packet. (CVE-2013-2850)

  - The Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_LOGITECH_FF,     CONFIG_LOGIG940_FF, or CONFIG_LOGIWHEELS_FF is enabled, allows physically proximate attackers to cause a     denial of service (heap-based out-of-bounds write) via a crafted device, related to (1) drivers/hid/hid-     lgff.c, (2) drivers/hid/hid-lg3ff.c, and (3) drivers/hid/hid-lg4ff.c. (CVE-2013-2893)

  - drivers/hid/hid-logitech-dj.c in the Human Interface Device (HID) subsystem in the Linux kernel through     3.11, when CONFIG_HID_LOGITECH_DJ is enabled, allows physically proximate attackers to cause a denial of     service (NULL pointer dereference and OOPS) or obtain sensitive information from kernel memory via a     crafted device. (CVE-2013-2895)

  - drivers/hid/hid-ntrig.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11,     when CONFIG_HID_NTRIG is enabled, allows physically proximate attackers to cause a denial of service (NULL     pointer dereference and OOPS) via a crafted device. (CVE-2013-2896)

  - Multiple array index errors in drivers/hid/hid-multitouch.c in the Human Interface Device (HID) subsystem     in the Linux kernel through 3.11, when CONFIG_HID_MULTITOUCH is enabled, allow physically proximate     attackers to cause a denial of service (heap memory corruption, or NULL pointer dereference and OOPS) via     a crafted device. (CVE-2013-2897)

  - drivers/hid/hid-sensor-hub.c in the Human Interface Device (HID) subsystem in the Linux kernel through     3.11, when CONFIG_HID_SENSOR_HUB is enabled, allows physically proximate attackers to obtain sensitive     information from kernel memory via a crafted device. (CVE-2013-2898)

  - drivers/hid/hid-picolcd_core.c in the Human Interface Device (HID) subsystem in the Linux kernel through     3.11, when CONFIG_HID_PICOLCD is enabled, allows physically proximate attackers to cause a denial of     service (NULL pointer dereference and OOPS) via a crafted device. (CVE-2013-2899)

  - The IPv6 SCTP implementation in net/sctp/ipv6.c in the Linux kernel through 3.11.1 uses data structures     and function calls that do not trigger an intended configuration of IPsec encryption, which allows remote     attackers to obtain sensitive information by sniffing the network. (CVE-2013-4350)

  - Memory leak in the unshare_userns function in kernel/user_namespace.c in the Linux kernel before 3.10.6     allows local users to cause a denial of service (memory consumption) via an invalid CLONE_NEWUSER unshare     call. (CVE-2013-4205)

  - Off-by-one error in the build_unc_path_to_root function in fs/cifs/connect.c in the Linux kernel before     3.9.6 allows remote attackers to cause a denial of service (memory corruption and system crash) via a DFS     share mount operation that triggers use of an unexpected DFS referral name length. (CVE-2013-4247)

  - The net_ctl_permissions function in net/sysctl_net.c in the Linux kernel before 3.11.5 does not properly     determine uid and gid values, which allows local users to bypass intended /proc/sys/net restrictions via a     crafted application. (CVE-2013-4270)

  - The scm_check_creds function in net/core/scm.c in the Linux kernel before 3.11 performs a capability check     in an incorrect namespace, which allows local users to gain privileges via PID spoofing. (CVE-2013-4300)

  - The fib6_add function in net/ipv6/ip6_fib.c in the Linux kernel before 3.11.5 does not properly implement     error-code encoding, which allows local users to cause a denial of service (NULL pointer dereference and     system crash) by leveraging the CAP_NET_ADMIN capability for an IPv6 SIOCADDRT ioctl call. (CVE-2013-6431)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An information leak was discovered in the handling of ICMPv6 Router Advertisement (RA) messages in the Linux kernel's IPv6 network stack.
A remote attacker could exploit this flaw to cause a denial of service (excessive retries and address-generation outage), and consequently obtain sensitive information. (CVE-2013-0343)

A flaw was discovered in the Xen subsystem of the Linux kernel when it provides read-only access to a disk that supports TRIM or SCSI UNMAP to a guest OS. A privileged user in the guest OS could exploit this flaw to destroy data on the disk, even though the guest OS should not be able to write to the disk. (CVE-2013-2140)

Kees Cook discovered flaw in the Human Interface Device (HID) subsystem of the Linux kernel. A physically proximate attacker could exploit this flaw to execute arbitrary code or cause a denial of service (heap memory corruption) via a specially crafted device that provides an invalid Report ID. (CVE-2013-2888)

Kees Cook discovered flaw in the Human Interface Device (HID) subsystem when CONFIG_HID_ZEROPLUS is enabled. A physically proximate attacker could leverage this flaw to cause a denial of service via a specially crafted device. (CVE-2013-2889)

Kees Cook discovered a flaw in the Human Interface Device (HID) subsystem of the Linux kerenl when CONFIG_HID_PANTHERLORD is enabled.
A physically proximate attacker could cause a denial of service (heap out-of-bounds write) via a specially crafted device. (CVE-2013-2892)

Kees Cook discovered another flaw in the Human Interface Device (HID) subsystem of the Linux kernel when any of CONFIG_LOGITECH_FF, CONFIG_LOGIG940_FF, or CONFIG_LOGIWHEELS_FF are enabled. A physcially proximate attacker can leverage this flaw to cause a denial of service vias a specially crafted device. (CVE-2013-2893)

Kees Cook discovered another flaw in the Human Interface Device (HID) subsystem of the Linux kernel when CONFIG_HID_LOGITECH_DJ is enabled.
A physically proximate attacker could cause a denial of service (OOPS) or obtain sensitive information from kernel memory via a specially crafted device. (CVE-2013-2895)

Kees Cook discovered a vulnerability in the Linux Kernel's Human Interface Device (HID) subsystem's support for N-Trig touch screens. A physically proximate attacker could exploit this flaw to cause a denial of service (OOPS) via a specially crafted device.
(CVE-2013-2896)

Kees Cook discovered yet another flaw in the Human Interface Device (HID) subsystem of the Linux kernel when CONFIG_HID_MULTITOUCH is enabled. A physically proximate attacker could leverage this flaw to cause a denial of service (OOPS) via a specially crafted device.
(CVE-2013-2897)

Kees Cook discovered a flaw in the Human Interface Device (HID) subsystem of the Linux kernel whe CONFIG_HID_PICOLCD is enabled. A physically proximate attacker could exploit this flaw to cause a denial of service (OOPS) via a specially crafted device.
(CVE-2013-2899)

Alan Chester reported a flaw in the IPv6 Stream Control Transmission Protocol (SCTP) of the Linux kernel. A remote attacker could exploit this flaw to obtain sensitive information by sniffing network traffic.
(CVE-2013-4350)

Dmitry Vyukov reported a flaw in the Linux kernel's handling of IPv6 UDP Fragmentation Offload (UFO) processing. A remote attacker could leverage this flaw to cause a denial of service (system crash).
(CVE-2013-4387).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An information leak was discovered in the handling of ICMPv6 Router Advertisement (RA) messages in the Linux kernel's IPv6 network stack.
A remote attacker could exploit this flaw to cause a denial of service (excessive retries and address-generation outage), and consequently obtain sensitive information. (CVE-2013-0343)

Kees Cook discovered flaw in the Human Interface Device (HID) subsystem of the Linux kernel. A physically proximate attacker could exploit this flaw to execute arbitrary code or cause a denial of service (heap memory corruption) via a specially crafted device that provides an invalid Report ID. (CVE-2013-2888)

Kees Cook discovered flaw in the Human Interface Device (HID) subsystem when CONFIG_HID_ZEROPLUS is enabled. A physically proximate attacker could leverage this flaw to cause a denial of service via a specially crafted device. (CVE-2013-2889)

Kees Cook discovered a flaw in the Human Interface Device (HID) subsystem of the Linux kerenl when CONFIG_HID_PANTHERLORD is enabled.
A physically proximate attacker could cause a denial of service (heap out-of-bounds write) via a specially crafted device. (CVE-2013-2892)

Kees Cook discovered another flaw in the Human Interface Device (HID) subsystem of the Linux kernel when any of CONFIG_LOGITECH_FF, CONFIG_LOGIG940_FF, or CONFIG_LOGIWHEELS_FF are enabled. A physcially proximate attacker can leverage this flaw to cause a denial of service vias a specially crafted device. (CVE-2013-2893)

Kees Cook discovered another flaw in the Human Interface Device (HID) subsystem of the Linux kernel when CONFIG_HID_LOGITECH_DJ is enabled.
A physically proximate attacker could cause a denial of service (OOPS) or obtain sensitive information from kernel memory via a specially crafted device. (CVE-2013-2895)

Kees Cook discovered a vulnerability in the Linux Kernel's Human Interface Device (HID) subsystem's support for N-Trig touch screens. A physically proximate attacker could exploit this flaw to cause a denial of service (OOPS) via a specially crafted device.
(CVE-2013-2896)

Kees Cook discovered yet another flaw in the Human Interface Device (HID) subsystem of the Linux kernel when CONFIG_HID_MULTITOUCH is enabled. A physically proximate attacker could leverage this flaw to cause a denial of service (OOPS) via a specially crafted device.
(CVE-2013-2897)

Kees Cook discovered a flaw in the Human Interface Device (HID) subsystem of the Linux kernel whe CONFIG_HID_PICOLCD is enabled. A physically proximate attacker could exploit this flaw to cause a denial of service (OOPS) via a specially crafted device.
(CVE-2013-2899)

Alan Chester reported a flaw in the IPv6 Stream Control Transmission Protocol (SCTP) of the Linux kernel. A remote attacker could exploit this flaw to obtain sensitive information by sniffing network traffic.
(CVE-2013-4350)

Dmitry Vyukov reported a flaw in the Linux kernel's handling of IPv6 UDP Fragmentation Offload (UFO) processing. A remote attacker could leverage this flaw to cause a denial of service (system crash).
(CVE-2013-4387).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An information leak was discovered in the Linux kernel when reading broadcast messages from the notify_policy interface of the IPSec key_socket. A local user could exploit this flaw to examine potentially sensitive information in kernel memory. (CVE-2013-2237)

Kees Cook discovered flaw in the Human Interface Device (HID) subsystem of the Linux kernel. A physically proximate attacker could exploit this flaw to execute arbitrary code or cause a denial of service (heap memory corruption) via a specially crafted device that provides an invalid Report ID. (CVE-2013-2888)

Kees Cook discovered a flaw in the Human Interface Device (HID) subsystem of the Linux kerenl when CONFIG_HID_PANTHERLORD is enabled.
A physically proximate attacker could cause a denial of service (heap out-of-bounds write) via a specially crafted device. (CVE-2013-2892)

Kees Cook discovered a vulnerability in the Linux Kernel's Human Interface Device (HID) subsystem's support for N-Trig touch screens. A physically proximate attacker could exploit this flaw to cause a denial of service (OOPS) via a specially crafted device.
(CVE-2013-2896)

Kees Cook discovered an information leak in the Linux kernel's Human Interface Device (HID) subsystem when CONFIG_HID_SENSOR_HUB is enabled. A physically proximate attacker could obtain potentially sensitive information from kernel memory via a specially crafted device. (CVE-2013-2898)

Kees Cook discovered a flaw in the Human Interface Device (HID) subsystem of the Linux kernel whe CONFIG_HID_PICOLCD is enabled. A physically proximate attacker could exploit this flaw to cause a denial of service (OOPS) via a specially crafted device.
(CVE-2013-2899)

A flaw was discovered in how the Linux Kernel's networking stack checks scm credentials when used with namespaces. A local attacker could exploit this flaw to gain privileges. (CVE-2013-4300).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities has been found and corrected in the Linux kernel :

Multiple array index errors in drivers/hid/hid-core.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11 allow physically proximate attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted device that provides an invalid Report ID (CVE-2013-2888).

drivers/hid/hid-zpff.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_ZEROPLUS is enabled, allows physically proximate attackers to cause a denial of service (heap-based out-of-bounds write) via a crafted device (CVE-2013-2889).

drivers/hid/hid-pl.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_PANTHERLORD is enabled, allows physically proximate attackers to cause a denial of service (heap-based out-of-bounds write) via a crafted device (CVE-2013-2892).

The Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_LOGITECH_FF, CONFIG_LOGIG940_FF, or CONFIG_LOGIWHEELS_FF is enabled, allows physically proximate attackers to cause a denial of service (heap-based out-of-bounds write) via a crafted device, related to (1) drivers/hid/hid-lgff.c, (2) drivers/hid/hid-lg3ff.c, and (3) drivers/hid/hid-lg4ff.c (CVE-2013-2893).

drivers/hid/hid-logitech-dj.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_LOGITECH_DJ is enabled, allows physically proximate attackers to cause a denial of service (NULL pointer dereference and OOPS) or obtain sensitive information from kernel memory via a crafted device (CVE-2013-2895).

drivers/hid/hid-ntrig.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_NTRIG is enabled, allows physically proximate attackers to cause a denial of service (NULL pointer dereference and OOPS) via a crafted device (CVE-2013-2896).

Multiple array index errors in drivers/hid/hid-multitouch.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_MULTITOUCH is enabled, allow physically proximate attackers to cause a denial of service (heap memory corruption, or NULL pointer dereference and OOPS) via a crafted device (CVE-2013-2897).

drivers/hid/hid-picolcd_core.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_PICOLCD is enabled, allows physically proximate attackers to cause a denial of service (NULL pointer dereference and OOPS) via a crafted device (CVE-2013-2899).

The udp_v6_push_pending_frames function in net/ipv6/udp.c in the IPv6 implementation in the Linux kernel through 3.10.3 makes an incorrect function call for pending data, which allows local users to cause a denial of service (BUG and system crash) via a crafted application that uses the UDP_CORK option in a setsockopt system call (CVE-2013-4162).

The ip6_append_data_mtu function in net/ipv6/ip6_output.c in the IPv6 implementation in the Linux kernel through 3.10.3 does not properly maintain information about whether the IPV6_MTU setsockopt option had been specified, which allows local users to cause a denial of service (BUG and system crash) via a crafted application that uses the UDP_CORK option in a setsockopt system call (CVE-2013-4163).

The validate_event function in arch/arm/kernel/perf_event.c in the Linux kernel before 3.10.8 on the ARM platform allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) by adding a hardware event to an event group led by a software event (CVE-2013-4254

The updated packages provides a solution for these security issues.

The 3.10.11 stable update contains a number of important fixes across the tree.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
124976	EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1523)	Nessus	Huawei Local Security Checks	critical
99163	OracleVM 3.3 : Unbreakable / etc (OVMSA-2017-0057) (Dirty COW)	Nessus	OracleVM Local Security Checks	critical
83696	SUSE SLES11 Security Update : kernel (SUSE-SU-2015:0481-1)	Nessus	SuSE Local Security Checks	high
80250	SuSE 11.3 Security Update : Linux kernel (SAT Patch Number 10103)	Nessus	SuSE Local Security Checks	high
80249	SuSE 11.3 Security Update : Linux kernel (SAT Patch Numbers 10037 / 10040)	Nessus	SuSE Local Security Checks	high
80150	openSUSE Security Update : the Linux Kernel (openSUSE-SU-2014:1669-1)	Nessus	SuSE Local Security Checks	high
72472	Oracle Linux 6 : Unbreakable Enterprise kernel (ELSA-2014-3002)	Nessus	Oracle Linux Local Security Checks	high
71205	Ubuntu 12.04 LTS : linux vulnerabilities (USN-2038-1)	Nessus	Ubuntu Local Security Checks	medium
70804	Ubuntu 12.10 : linux vulnerabilities (USN-2021-1)	Nessus	Ubuntu Local Security Checks	medium
70802	Ubuntu 12.04 LTS : linux-lts-quantal vulnerabilities (USN-2019-1)	Nessus	Ubuntu Local Security Checks	medium
70543	Ubuntu 13.04 : linux vulnerabilities (USN-1998-1)	Nessus	Ubuntu Local Security Checks	high
70541	Ubuntu 12.04 LTS : linux-lts-raring vulnerabilities (USN-1995-1)	Nessus	Ubuntu Local Security Checks	high
70162	Mandriva Linux Security Advisory : kernel (MDVSA-2013:242)	Nessus	Mandriva Local Security Checks	medium
69910	Fedora 18 : kernel-3.10.11-100.fc18 (2013-16336)	Nessus	Fedora Local Security Checks	medium
69859	Fedora 19 : kernel-3.10.11-200.fc19 (2013-16379)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2013-2899

medium

Tenable Plugins

critical

critical

high

high

high

high

high

medium

medium

medium

high

high

medium

medium

medium