The PCI backend driver in Xen, when running on an x86 system and using Linux 3.1.x through 4.3.x as the driver domain, allows local guest administrators to hit BUG conditions and cause a denial of service (NULL pointer dereference and host OS crash) by leveraging a system with access to a passed-through MSI or MSI-X capable physical PCI device and a crafted sequence of XEN_PCI_OP_* operations, aka "Linux pciback missing sanity checks."

The SUSE Linux Enterprise 12 SP1 kernel was updated to 3.12.62 to receive various security and bugfixes. The following security bugs were fixed :

  - CVE-2014-9904: The snd_compress_check_input function in     sound/core/compress_offload.c in the ALSA subsystem in     the Linux kernel did not properly check for an integer     overflow, which allowed local users to cause a denial of     service (insufficient memory allocation) or possibly     have unspecified other impact via a crafted     SNDRV_COMPRESS_SET_PARAMS ioctl call (bnc#986811).

  - CVE-2015-7833: The usbvision driver in the Linux kernel     allowed physically proximate attackers to cause a denial     of service (panic) via a nonzero bInterfaceNumber value     in a USB device descriptor (bnc#950998).

  - CVE-2015-8551: The PCI backend driver in Xen, when     running on an x86 system and using Linux as the driver     domain, allowed local guest administrators to hit BUG     conditions and cause a denial of service (NULL pointer     dereference and host OS crash) by leveraging a system     with access to a passed-through MSI or MSI-X capable     physical PCI device and a crafted sequence of     XEN_PCI_OP_* operations, aka 'Linux pciback missing     sanity checks (bnc#957990).

  - CVE-2015-8552: The PCI backend driver in Xen, when     running on an x86 system and using Linux as the driver     domain, allowed local guest administrators to generate a     continuous stream of WARN messages and cause a denial of     service (disk consumption) by leveraging a system with     access to a passed-through MSI or MSI-X capable physical     PCI device and XEN_PCI_OP_enable_msi operations, aka     'Linux pciback missing sanity checks (bnc#957990).

  - CVE-2015-8845: The tm_reclaim_thread function in     arch/powerpc/kernel/process.c in the Linux kernel on     powerpc platforms did not ensure that TM suspend mode     exists before proceeding with a tm_reclaim call, which     allowed local users to cause a denial of service (TM Bad     Thing exception and panic) via a crafted application     (bnc#975533).

  - CVE-2016-0758: Integer overflow in lib/asn1_decoder.c in     the Linux kernel allowed local users to gain privileges     via crafted ASN.1 data (bnc#979867).

  - CVE-2016-1583: The ecryptfs_privileged_open function in     fs/ecryptfs/kthread.c in the Linux kernel allowed local     users to gain privileges or cause a denial of service     (stack memory consumption) via vectors involving crafted     mmap calls for /proc pathnames, leading to recursive     pagefault handling (bsc#983143).

  - CVE-2016-2053: The asn1_ber_decoder function in     lib/asn1_decoder.c in the Linux kernel allowed attackers     to cause a denial of service (panic) via an ASN.1 BER     file that lacks a public key, leading to mishandling by     the public_key_verify_signature function in     crypto/asymmetric_keys/public_key.c (bnc#963762).

  - CVE-2016-3672: The arch_pick_mmap_layout function in     arch/x86/mm/mmap.c in the Linux kernel did not properly     randomize the legacy base address, which made it easier     for local users to defeat the intended restrictions on     the ADDR_NO_RANDOMIZE flag, and bypass the ASLR     protection mechanism for a setuid or setgid program, by     disabling stack-consumption resource limits     (bnc#974308).

  - CVE-2016-4470: The key_reject_and_link function in     security/keys/key.c in the Linux kernel did not ensure     that a certain data structure is initialized, which     allowed local users to cause a denial of service (system     crash) via vectors involving a crafted keyctl request2     command (bnc#984755).

  - CVE-2016-4482: The proc_connectinfo function in     drivers/usb/core/devio.c in the Linux kernel did not     initialize a certain data structure, which allowed local     users to obtain sensitive information from kernel stack     memory via a crafted USBDEVFS_CONNECTINFO ioctl call     (bsc#978401).

  - CVE-2016-4486: The rtnl_fill_link_ifmap function in     net/core/rtnetlink.c in the Linux kernel did not     initialize a certain data structure, which allowed local     users to obtain sensitive information from kernel stack     memory by reading a Netlink message (bnc#978822).

  - CVE-2016-4565: The InfiniBand (aka IB) stack in the     Linux kernel incorrectly relied on the write system     call, which allowed local users to cause a denial of     service (kernel memory write operation) or possibly have     unspecified other impact via a uAPI interface     (bnc#979548).

  - CVE-2016-4569: The snd_timer_user_params function in     sound/core/timer.c in the Linux kernel did not     initialize a certain data structure, which allowed local     users to obtain sensitive information from kernel stack     memory via crafted use of the ALSA timer interface     (bsc#979213).

  - CVE-2016-4578: sound/core/timer.c in the Linux kernel     did not initialize certain r1 data structures, which     allowed local users to obtain sensitive information from     kernel stack memory via crafted use of the ALSA timer     interface, related to the (1) snd_timer_user_ccallback     and (2) snd_timer_user_tinterrupt functions     (bnc#979879).

  - CVE-2016-4805: Use-after-free vulnerability in     drivers/net/ppp/ppp_generic.c in the Linux kernel     allowed local users to cause a denial of service (memory     corruption and system crash, or spinlock) or possibly     have unspecified other impact by removing a network     namespace, related to the ppp_register_net_channel and     ppp_unregister_channel functions (bnc#980371).

  - CVE-2016-4997: The compat IPT_SO_SET_REPLACE setsockopt     implementation in the netfilter subsystem in the Linux     kernel allowed local users to gain privileges or cause a     denial of service (memory corruption) by leveraging     in-container root access to provide a crafted offset     value that triggers an unintended decrement     (bsc#986362).

  - CVE-2016-4998: The IPT_SO_SET_REPLACE setsockopt     implementation in the netfilter subsystem in the Linux     kernel allowed local users to cause a denial of service     (out-of-bounds read) or possibly obtain sensitive     information from kernel heap memory by leveraging     in-container root access to provide a crafted offset     value that leads to crossing a ruleset blob boundary     (bsc#986365).

  - CVE-2016-5244: The rds_inc_info_copy function in     net/rds/recv.c in the Linux kernel did not initialize a     certain structure member, which allowed remote attackers     to obtain sensitive information from kernel stack memory     by reading an RDS message (bnc#983213).

  - CVE-2016-5828: The start_thread function in     arch/powerpc/kernel/process.c in the Linux kernel on     powerpc platforms mishandled transactional state, which     allowed local users to cause a denial of service     (invalid process state or TM Bad Thing exception, and     system crash) or possibly have unspecified other impact     by starting and suspending a transaction an exec system     call (bsc#986569).

  - CVE-2016-5829: Multiple heap-based buffer overflows in     the hiddev_ioctl_usage function in     drivers/hid/usbhid/hiddev.c in the Linux kernel allowed     local users to cause a denial of service or possibly     have unspecified other impact via a crafted (1)     HIDIOCGUSAGES or (2) HIDIOCSUSAGES ioctl call     (bnc#986572).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 11 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

  - CVE-2013-7446: Use-after-free vulnerability in     net/unix/af_unix.c in the Linux kernel allowed local     users to bypass intended AF_UNIX socket permissions or     cause a denial of service (panic) via crafted epoll_ctl     calls (bnc#955654).

  - CVE-2015-7509: fs/ext4/namei.c in the Linux kernel     allowed physically proximate attackers to cause a denial     of service (system crash) via a crafted no-journal     filesystem, a related issue to CVE-2013-2015     (bnc#956707).

  - CVE-2015-7515: An out of bounds memory access in the     aiptek USB driver could be used by physical local     attackers to crash the kernel (bnc#956708).

  - CVE-2015-7550: The keyctl_read_key function in     security/keys/keyctl.c in the Linux kernel did not     properly use a semaphore, which allowed local users to     cause a denial of service (NULL pointer dereference and     system crash) or possibly have unspecified other impact     via a crafted application that leverages a race     condition between keyctl_revoke and keyctl_read calls     (bnc#958951).

  - CVE-2015-7566: A malicious USB device could cause kernel     crashes in the visor device driver (bnc#961512).

  - CVE-2015-7799: The slhc_init function in     drivers/net/slip/slhc.c in the Linux kernel did not     ensure that certain slot numbers are valid, which     allowed local users to cause a denial of service (NULL     pointer dereference and system crash) via a crafted     PPPIOCSMAXCID ioctl call (bnc#949936).

  - CVE-2015-8215: net/ipv6/addrconf.c in the IPv6 stack in     the Linux kernel did not validate attempted changes to     the MTU value, which allowed context-dependent attackers     to cause a denial of service (packet loss) via a value     that is (1) smaller than the minimum compliant value or     (2) larger than the MTU of an interface, as demonstrated     by a Router Advertisement (RA) message that is not     validated by a daemon, a different vulnerability than     CVE-2015-0272. NOTE: the scope of CVE-2015-0272 is     limited to the NetworkManager product (bnc#955354).

  - CVE-2015-8539: The KEYS subsystem in the Linux kernel     allowed local users to gain privileges or cause a denial     of service (BUG) via crafted keyctl commands that     negatively instantiate a key, related to     security/keys/encrypted-keys/encrypted.c,     security/keys/trusted.c, and     security/keys/user_defined.c (bnc#958463).

  - CVE-2015-8543: The networking implementation in the     Linux kernel did not validate protocol identifiers for     certain protocol families, which allowed local users to     cause a denial of service (NULL function pointer     dereference and system crash) or possibly gain     privileges by leveraging CLONE_NEWUSER support to     execute a crafted SOCK_RAW application (bnc#958886).

  - CVE-2015-8550: Optimizations introduced by the compiler     could have lead to double fetch vulnerabilities,     potentially possibly leading to arbitrary code execution     in backend (bsc#957988). (bsc#957988 XSA-155).

  - CVE-2015-8551: The PCI backend driver in Xen, when     running on an x86 system and using Linux as the driver     domain, allowed local guest administrators to hit BUG     conditions and cause a denial of service (NULL pointer     dereference and host OS crash) by leveraging a system     with access to a passed-through MSI or MSI-X capable     physical PCI device and a crafted sequence of     XEN_PCI_OP_* operations, aka 'Linux pciback missing     sanity checks (bnc#957990).

  - CVE-2015-8552: The PCI backend driver in Xen, when     running on an x86 system and using Linux as the driver     domain, allowed local guest administrators to generate a     continuous stream of WARN messages and cause a denial of     service (disk consumption) by leveraging a system with     access to a passed-through MSI or MSI-X capable physical     PCI device and XEN_PCI_OP_enable_msi operations, aka     'Linux pciback missing sanity checks (bnc#957990).

  - CVE-2015-8569: The (1) pptp_bind and (2) pptp_connect     functions in drivers/net/ppp/pptp.c in the Linux kernel     do not verify an address length, which allowed local     users to obtain sensitive information from kernel memory     and bypass the KASLR protection mechanism via a crafted     application (bnc#959190).

  - CVE-2015-8575: The sco_sock_bind function in     net/bluetooth/sco.c in the Linux kernel did not verify     an address length, which allowed local users to obtain     sensitive information from kernel memory and bypass the     KASLR protection mechanism via a crafted application     (bnc#959399).

  - CVE-2015-8767: net/sctp/sm_sideeffect.c in the Linux     kernel did not properly manage the relationship between     a lock and a socket, which allowed local users to cause     a denial of service (deadlock) via a crafted sctp_accept     call (bnc#961509).

  - CVE-2015-8785: The fuse_fill_write_pages function in     fs/fuse/file.c in the Linux kernel allowed local users     to cause a denial of service (infinite loop) via a     writev system call that triggers a zero length for the     first segment of an iov (bnc#963765).

  - CVE-2015-8812: A flaw was found in the CXGB3 kernel     driver when the network was considered congested. The     kernel would incorrectly misinterpret the congestion as     an error condition and incorrectly free/clean up the     skb. When the device would then send the skb's queued,     these structures would be referenced and may panic the     system or allow an attacker to escalate privileges in a     use-after-free scenario.(bsc#966437).

  - CVE-2015-8816: A malicious USB device could cause kernel     crashes in the in hub_activate() function (bnc#968010).

  - CVE-2016-0723: Race condition in the tty_ioctl function     in drivers/tty/tty_io.c in the Linux kernel allowed     local users to obtain sensitive information from kernel     memory or cause a denial of service (use-after-free and     system crash) by making a TIOCGETD ioctl call during     processing of a TIOCSETD ioctl call (bnc#961500).

  - CVE-2016-2069: A race in invalidating paging structures     that were not in use locally could have lead to     disclosoure of information or arbitrary code exectution     (bnc#963767).

  - CVE-2016-2143: On zSeries a fork of a large process     could have caused memory corruption due to incorrect     page table handling. (bnc#970504, LTC#138810).

  - CVE-2016-2184: A malicious USB device could cause kernel     crashes in the alsa usb-audio device driver     (bsc#971125).

  - CVE-2016-2185: A malicious USB device could cause kernel     crashes in the usb_driver_claim_interface function     (bnc#971124).

  - CVE-2016-2186: A malicious USB device could cause kernel     crashes in the powermate device driver (bnc#970958).

  - CVE-2016-2384: A double free on the ALSA umidi object     was fixed. (bsc#966693).

  - CVE-2016-2543: A missing NULL check at remove_events     ioctl in the ALSA seq driver was fixed. (bsc#967972).

  - CVE-2016-2544: Fix race at timer setup and close in the     ALSA seq driver was fixed. (bsc#967973).

  - CVE-2016-2545: A double unlink of active_list in the     ALSA timer driver was fixed. (bsc#967974).

  - CVE-2016-2546: A race among ALSA timer ioctls was fixed     (bsc#967975).

  - CVE-2016-2547,CVE-2016-2548: The ALSA slave timer list     handling was hardened against hangs and races.
    (CVE-2016-2547,CVE-2016-2548,bsc#968011,bsc#968012).

  - CVE-2016-2549: A stall in ALSA hrtimer handling was     fixed (bsc#968013).

  - CVE-2016-2782: A malicious USB device could cause kernel     crashes in the visor device driver (bnc#968670).

  - CVE-2016-3137: A malicious USB device could cause kernel     crashes in the cypress_m8 device driver (bnc#970970).

  - CVE-2016-3139: A malicious USB device could cause kernel     crashes in the wacom device driver (bnc#970909).

  - CVE-2016-3140: A malicious USB device could cause kernel     crashes in the digi_acceleport device driver     (bnc#970892).

  - CVE-2016-3156: A quadratic algorithm could lead to long     kernel ipv4 hangs when removing a device with a large     number of addresses. (bsc#971360).

  - CVE-2016-3955: A remote buffer overflow in the usbip     driver could be used by authenticated attackers to crash     the kernel. (bsc#975945)

  - CVE-2016-2847: A local user could exhaust kernel memory     by pushing lots of data into pipes. (bsc#970948).

  - CVE-2016-2188: A malicious USB device could cause kernel     crashes in the iowarrior device driver (bnc#970956).

  - CVE-2016-3138: A malicious USB device could cause kernel     crashes in the cdc-acm device driver (bnc#970911).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The openSUSE 13.1 kernel was updated to 3.12.57 to receive various security and bugfixes.

The following security bugs were fixed :

  - CVE-2015-8785: The fuse_fill_write_pages function in     fs/fuse/file.c in the Linux kernel allowed local users     to cause a denial of service (infinite loop) via a     writev system call that triggers a zero length for the     first segment of an iov. (bsc#963765)

  - CVE-2015-8551: The PCI backend driver in Xen, when     running on an x86 system and using Linux as the driver     domain, allowed local guest administrators to hit BUG     conditions and cause a denial of service (NULL pointer     dereference and host OS crash) by leveraging a system     with access to a passed-through MSI or MSI-X capable     physical PCI device and a crafted sequence of     XEN_PCI_OP_* operations, aka 'Linux pciback missing     sanity checks (bnc#957990).

  - CVE-2015-8552: The PCI backend driver in Xen, when     running on an x86 system and using Linux as the driver     domain, allowed local guest administrators to generate a     continuous stream of WARN messages and cause a denial of     service (disk consumption) by leveraging a system with     access to a passed-through MSI or MSI-X capable physical     PCI device and XEN_PCI_OP_enable_msi operations, aka     'Linux pciback missing sanity checks (bnc#957990).

  - CVE-2015-8812: A flaw was found in the CXGB3 kernel     driver when the network was considered congested. The     kernel would incorrectly misinterpret the congestion as     an error condition and incorrectly free/clean up the     skb. When the device would then send the skb's queued,     these structures would be referenced and may panic the     system or allow an attacker to escalate privileges in a     use-after-free scenario.(bsc#966437).

  - CVE-2015-8816: A malicious USB device could cause kernel     crashes in the in hub_activate() function (bnc#968010).

  - CVE-2016-0723: Race condition in the tty_ioctl function     in drivers/tty/tty_io.c in the Linux kernel allowed     local users to obtain sensitive information from kernel     memory or cause a denial of service (use-after-free and     system crash) by making a TIOCGETD ioctl call during     processing of a TIOCSETD ioctl call. (bsc#961500)

  - CVE-2016-2184: A malicious USB device could cause kernel     crashes in the alsa usb-audio device driver     (bsc#971125).

  - CVE-2016-2384: A double free on the ALSA umidi object     was fixed. (bsc#966693).

  - CVE-2016-2782: A malicious USB device could cause kernel     crashes in the visor device driver (bnc#968670).

  - CVE-2016-3139: A malicious USB device could cause kernel     crashes in the wacom device driver (bnc#970909).

  - CVE-2016-3156: A quadratic algorithm could lead to long     kernel ipv4 hangs when removing a device with a large     number of addresses. (bsc#971360).

The following non-security bugs were fixed :

  - acl: Fix problem with setting ACL on directories     (bsc#867251).

  - acpi / processor: Introduce apic_id in struct processor     to save parsed APIC id (bsc#959463).

  - alsa: rawmidi: Make snd_rawmidi_transmit() race-free     (bsc#968018).

  - alsa: seq: Fix leak of pool buffer at concurrent writes     (bsc#968018).

  - arm: cubox: Add separate cubox configuration.

  - arm: xen: implement multicall hypercall support.

  - block: xen-blkfront: Fix possible NULL ptr dereference     (bsc#957986 fate#320625).

  -     btrfs-8394-qgroup-Account-data-space-in-more-proper-timi     n.patch: (bsc#963193).

  - btrfs: Add handler for invalidate page (bsc#963193).

  - btrfs: check prepare_uptodate_page() error code earlier     (bnc#966910).

  - btrfs: delayed_ref: Add new function to record reserved     space into delayed ref (bsc#963193).

  - btrfs: delayed_ref: release and free qgroup reserved at     proper timing (bsc#963193).

  - btrfs: extent_io: Introduce needed structure for     recoding set/clear bits (bsc#963193).

  - btrfs: extent_io: Introduce new function     clear_record_extent_bits() (bsc#963193).

  - btrfs: extent_io: Introduce new function     set_record_extent_bits (bsc#963193).

  - btrfs: extent-tree: Add new version of     btrfs_check_data_free_space and     btrfs_free_reserved_data_space (bsc#963193).

  - btrfs: extent-tree: Add new version of     btrfs_delalloc_reserve/release_space (bsc#963193).

  - btrfs: extent-tree: Switch to new check_data_free_space     and free_reserved_data_space (bsc#963193).

  - btrfs: extent-tree: Switch to new delalloc space reserve     and release (bsc#963193).

  - btrfs: fallocate: Add support to accurate qgroup reserve     (bsc#963193).

  - btrfs: fix invalid page accesses in extent_same (dedup)     ioctl (bnc#968230).

  - btrfs: fix page reading in extent_same ioctl leading to     csum errors (bnc#968230).

  - btrfs: fix warning in backref walking (bnc#966278).

  - btrfs: qgroup: Add handler for NOCOW and inline     (bsc#963193).

  - btrfs: qgroup: Add new trace point for qgroup data     reserve (bsc#963193).

  - btrfs: qgroup: Avoid calling     btrfs_free_reserved_data_space in clear_bit_hook     (bsc#963193).

  - btrfs: qgroup: Check if qgroup reserved space leaked     (bsc#963193).

  - btrfs: qgroup: Cleanup old inaccurate facilities     (bsc#963193).

  - btrfs: qgroup: Fix a race in delayed_ref which leads to     abort trans (bsc#963193).

  - btrfs: qgroup: Fix a rebase bug which will cause qgroup     double free (bsc#963193).

  - btrfs: qgroup: Fix dead judgement on     qgroup_rescan_leaf() return value (bsc#969439).

  - btrfs: qgroup: Introduce btrfs_qgroup_reserve_data     function (bsc#963193).

  - btrfs: qgroup: Introduce functions to release/free     qgroup reserve data space (bsc#963193).

  - btrfs: qgroup: Introduce new functions to reserve/free     metadata (bsc#963193).

  - btrfs: qgroup: Use new metadata reservation     (bsc#963193).

  - cpu: Provide smpboot_thread_init() on !CONFIG_SMP     kernels as well.

  - dcache: use IS_ROOT to decide where dentry is hashed     (bsc#949752).

  - dmapi: fix dm_open_by_handle_rvp taking an extra ref to     mnt (bsc#967292).

  - drivers/base/memory.c: fix kernel warning during memory     hotplug on ppc64 (bsc#963827).

  - drivers:hv: Allow for MMIO claims that span ACPI _CRS     records (bnc#965924).

  - drivers:hv: Define the channel type for Hyper-V PCI     Express pass-through (bnc#965924).

  - drivers:hv: Export a function that maps Linux CPU num     onto Hyper-V proc num (bnc#965924).

  - drivers:hv: Export the API to invoke a hypercall on     Hyper-V (bnc#965924).

  - drivers: hv: kvp: fix IP Failover.

  - drivers:pci:hv: New paravirtual PCI front-end for     Hyper-V VMs (bnc#965924).

  - drivers: xen-blkfront: only talk_to_blkback() when in     XenbusStateInitialising (bsc#957986 fate#320625).

  - driver: xen-blkfront: move talk_to_blkback to a more     suitable place (bsc#957986 fate#320625).

  - drm/i915: do not warn if backlight unexpectedly enabled     (boo#972068).

  - drm/i915: set backlight duty cycle after backlight     enable for gen4 (boo#972780).

  - e1000e: Avoid divide by zero error (bsc#968643).

  - e1000e: fix division by zero on jumbo MTUs (bsc#968643).

  - e1000e: Fix tight loop implementation of systime read     algorithm (bsc#968643).

  - fix: print ext4 mountopt data_err=abort correctly     (bsc#969735).

  - fs/proc_namespace.c: simplify testing nsp and     nsp->mnt_ns (bug#963960).

  - futex: Drop refcount if requeue_pi() acquired the     rtmutex (bug#960174).

  - hv: Lock access to hyperv_mmio resource tree     (bnc#965924).

  - hv: Make a function to free mmio regions through vmbus     (bnc#965924).

  - hv: Reverse order of resources in hyperv_mmio     (bnc#965924).

  - hv: Track allocations of children of hv_vmbus in private     resource tree (bnc#965924).

  - hv: Use new vmbus_mmio_free() from client drivers     (bnc#965924).

  - hwmon: (coretemp) Increase maximum core to 128     (bsc#970160)

  - ibmvnic: Fix ibmvnic_capability struct (fate#320253).

  - intel_pstate: Use del_timer_sync in     intel_pstate_cpu_stop (bsc#967650).

  - ipv6: mld: fix add_grhead skb_over_panic for devs with     large MTUs (bsc#956852).

  - kabi: Preserve checksum of kvm_x86_ops (bsc#969112).

  - kABI: protect enum enclosure_component_type.

  - kabi: protect struct acpi_processor signature     (bsc#959463).

  - kABI: protect struct af_alg_type.

  - kABI: protect struct crypto_ahash.

  - kABI: protect struct dm_exception_store_type.

  - kABI: protect struct fib_nh_exception.

  - kABI: protect struct module.

  - kABI: protect struct rq.

  - kABI: protect struct sched_class.

  - kABI: protect struct scm_creds.

  - kABI: protect struct user_struct.

  - kabi/severities :

  - kabi/severities: Fail on changes in kvm_x86_ops, needed     by lttng-modules

  - kgr: fix reversion of a patch already reverted by a     replace_all patch (fate#313296).

  - kvm: SVM: add rdmsr support for AMD event registers     (bsc#968448).

  - kvm: x86: Check dest_map->vector to match eoi signals     for rtc (bsc#966471).

  - kvm: x86: Convert ioapic->rtc_status.dest_map to a     struct (bsc#966471).

  - kvm: x86: store IOAPIC-handled vectors in each VCPU     (bsc#966471).

  - kvm: x86: Track irq vectors in     ioapic->rtc_status.dest_map (bsc#966471).

  - libceph: fix scatterlist last_piece calculation     (bsc#963746).

  - lpfc: Fix kmalloc overflow in LPFC driver at large core     count (bsc#969690).

  - memcg: do not hang on OOM when killed by userspace OOM     access to memory reserves (bnc#969571).

  - mld, igmp: Fix reserved tailroom calculation     (bsc#956852).

  - mmc: Exynos: Add module alias for dw mmc.

  - mvneta: fix per-cpu stats initialization.

  - namespaces: Re-introduce task_nsproxy() helper     (bug#963960).

  - namespaces: Use task_lock and not rcu to protect nsproxy     (bug#963960).

  - net: core: Correct an over-stringent device loop     detection (bsc#945219).

  - net: irda: Fix use-after-free in irtty_open()     (bnc#967903).

  - nfs4: treat lock owners as opaque values (bnc#968141).

  - nfs: Background flush should not be low priority     (bsc#955308).

  - nfsd: fix nfsd_setattr return code for HSM (bsc#969992).

  - nfs: do not use STABLE writes during writeback     (bnc#816099).

  - nfs: Fix handling of re-write-before-commit for mmapped     NFS pages (bsc#964201).

  - nvme: default to 4k device page size (bsc#967047).

  - nvme: special case AEN requests (bsc#965087).

  - omap3isp: fix miscompile.

  - omap: Fix missing cm3xxx.h include.

  - omap: Fix missing usb.h include.

  - pci: Add global pci_lock_rescan_remove() (bnc#965924).

  - pci: allow access to VPD attributes with size 0     (bsc#959146).

  - pciback: Check PF instead of VF for PCI_COMMAND_MEMORY.

  - pciback: Save the number of MSI-X entries to be copied     later.

  - pci: Blacklist vpd access for buggy devices     (bsc#959146).

  - pci: Determine actual VPD size on first access     (bsc#959146).

  - pci: Export symbols required for loadable host driver     modules (bnc#965924).

  - pci: pciehp: Disable link notification across slot reset     (bsc#967651).

  - pci: pciehp: Do not check adapter or latch status while     disabling (bsc#967651).

  - pci: pciehp: Do not disable the link permanently during     removal (bsc#967651).

  - pci: pciehp: Ensure very fast hotplug events are also     processed (bsc#967651).

  - pci: Update VPD definitions (bsc#959146).

  - perf, nmi: Fix unknown NMI warning (bsc#968512).

  - power: Add _GLOBAL_TOC for 32bit.

  - proc: Fix ptrace-based permission checks for accessing     task maps.

  - qla2xxx: Remove unavailable firmware files (bsc#943645).

  - rbd: do not log miscompare as an error (bsc#970062).

  - Refresh     patches.drivers/0005-aacraid-MSI-x-support.patch.
    (boo#970249)

  - resources: Set type in __request_region() (bnc#965924).

  - Revert 'ipv6: tcp: add rcu locking in     tcp_v6_send_synack()' (bnc#961257).

  - rpm/kernel-binary.spec.in: Sync the main and -base     package dependencies (bsc#965830#c51).

  - rpm/kernel-module-subpackage: Fix obsoleting dropped     flavors (bsc#968253)

  - sched: unbreak non-SMP build.

  - scsi_dh_alua: Do not block request queue if workqueue is     active (bsc#960458).

  - scsi: fix soft lockup in scsi_remove_target() on module     removal (bsc#965199).

  - scsi: proper state checking and module refcount handling     in scsi_device_get (boo#966831).

  - series.conf: add section comments

  - supported.conf: Add e1000e (emulated by VMware) to -base     (bsc#968074)

  - supported.conf: Add Hyper-V modules to -base     (bsc#965830)

  - supported.conf: Add isofs to -base (bsc#969655).

  - supported.conf: Add more qemu device driver (bsc#968234)

  - supported.conf: Add mptspi and mptsas to -base     (bsc#968206)

  - supported.conf: Add the qemu scsi driver (sym53c8xx) to
    -base (bsc#967802)

  - supported.conf: Add tulip to -base for Hyper-V     (bsc#968234)

  - supported.conf: Add virtio-rng (bsc#966026)

  - supported.conf: Add xen-blkfront.

  - supported.conf: Add xfs to -base (bsc#965891)

  - supported.conf: Fix usb-common path usb-common moved to     its own subdirectory in kernel v3.16, and we backported     that change to SLE12.

  - sysctl: do not add hardlockup_all_cpu_backtrace sysctl     on UP.

  - tcp: Restore RFC5961-compliant behavior for SYN packets     (bsc#966864).

  - Update config files. Add new option     CONFIG_PARAVIRT_XEN_BLKDEV_FRONTEND to i386 xen and ec2.

  - Update config files. Enable CONFIG_DEBUG_INFO for ec2     flavor. It's overriden on build anyway and having it     disabled causes 'make silentoldconfig' checks fail     because of new symbol CONFIG_DEBUG_INFO_REDUCED.

  - Update config files: enable CONFIG_PCI_HYPERV in non-SLE     configs These are i386/* except xen, ec2 and vanilla and     x86_64 desktop and trace.

  - Update config files: enable MACH_CUBOX in armv7hl/cubox

  - Update config files: ppc and ppc64 are big endian New     config options (not existing in 13.1) need to be set     accordingly.

  - Update     patches.drivers/drm-ast-Initialize-data-needed-to-map-fb     dev-memory.patch (bnc#880007). Fix refs and upstream     status.

  - Update Xen config files (enable upstream block     frontend).

  - Update Xen patches to 3.12.55.

  - USB: ehci-s5p: Fix phy reset.

  - usb: phy: Fix phy-samsung-usb when built as module.

  - usb: Quiet down false peer failure messages     (bnc#960629).

  - x86: export x86_msi (bnc#965924).

  - xen: Add /etc/modprobe.d/50-xen.conf selecting Xen     frontend driver implementation (bsc#957986, bsc#956084,     bsc#961658).

  - xen-blkfront: allow building in our Xen environment     (bsc#957986 fate#320625).

  - xen, blkfront: factor out flush-related checks from     do_blkif_request() (bsc#957986 fate#320625).

  - xen-blkfront: fix accounting of reqs when migrating     (bsc#957986 fate#320625).

  - xen/blkfront: Fix crash if backend does not follow the     right states (bsc#957986 fate#320625).

  - xen-blkfront: improve aproximation of required grants     per request (bsc#957986 fate#320625).

  - xen/blkfront: improve protection against issuing     unsupported REQ_FUA (bsc#957986 fate#320625).

  - xen/blkfront: remove redundant flush_op (bsc#957986     fate#320625).

  - xen-blkfront: remove type check from     blkfront_setup_discard (bsc#957986 fate#320625).

  - xen-blkfront: Silence pfn maybe-uninitialized warning     (bsc#957986 fate#320625).

  - xen: fix blkfront and blkback build with normal xen.

  - xen-vscsi-large-requests: Fix resource collision for     racing request maps and unmaps (bsc#966094).

  - xfs/dmapi: drop lock over synchronous XFS_SEND_DATA     events (bsc#969993).

  - xfs/dmapi: propertly send postcreate event (bsc#967299).

The remote host is affected by the vulnerability described in GLSA-201604-03 (Xen: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Xen. Please review the       CVE identifiers referenced below for details.
  Impact :

    A local attacker could possibly cause a Denial of Service condition or       obtain sensitive information.
  Workaround :

    There is no known workaround at this time.

The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes.

Following feature was added to kernel-xen :

  - A improved XEN blkfront module was added, which allows     more I/O bandwidth. (FATE#320200) It is called     xen-blkfront in PV, and xen-vbd-upstream in HVM mode.

The following security bugs were fixed :

  - CVE-2013-7446: Use-after-free vulnerability in     net/unix/af_unix.c in the Linux kernel allowed local     users to bypass intended AF_UNIX socket permissions or     cause a denial of service (panic) via crafted epoll_ctl     calls (bnc#955654).

  - CVE-2015-7515: An out of bounds memory access in the     aiptek USB driver could be used by physical local     attackers to crash the kernel (bnc#956708).

  - CVE-2015-7550: The keyctl_read_key function in     security/keys/keyctl.c in the Linux kernel did not     properly use a semaphore, which allowed local users to     cause a denial of service (NULL pointer dereference and     system crash) or possibly have unspecified other impact     via a crafted application that leverages a race     condition between keyctl_revoke and keyctl_read calls     (bnc#958951).

  - CVE-2015-8539: The KEYS subsystem in the Linux kernel     allowed local users to gain privileges or cause a denial     of service (BUG) via crafted keyctl commands that     negatively instantiate a key, related to     security/keys/encrypted-keys/encrypted.c,     security/keys/trusted.c, and     security/keys/user_defined.c (bnc#958463).

  - CVE-2015-8543: The networking implementation in the     Linux kernel did not validate protocol identifiers for     certain protocol families, which allowed local users to     cause a denial of service (NULL function pointer     dereference and system crash) or possibly gain     privileges by leveraging CLONE_NEWUSER support to     execute a crafted SOCK_RAW application (bnc#958886).

  - CVE-2015-8550: Compiler optimizations in the XEN PV     backend drivers could have lead to double fetch     vulnerabilities, causing denial of service or arbitrary     code execution (depending on the configuration)     (bsc#957988).

  - CVE-2015-8551, CVE-2015-8552: xen/pciback: For     XEN_PCI_OP_disable_msi[|x] only disable if device has     MSI(X) enabled (bsc#957990).

  - CVE-2015-8569: The (1) pptp_bind and (2) pptp_connect     functions in drivers/net/ppp/pptp.c in the Linux kernel     did not verify an address length, which allowed local     users to obtain sensitive information from kernel memory     and bypass the KASLR protection mechanism via a crafted     application (bnc#959190).

  - CVE-2015-8575: The sco_sock_bind function in     net/bluetooth/sco.c in the Linux kernel did not verify     an address length, which allowed local users to obtain     sensitive information from kernel memory and bypass the     KASLR protection mechanism via a crafted application     (bnc#959190 bnc#959399).

  - CVE-2015-8767: net/sctp/sm_sideeffect.c in the Linux     kernel did not properly manage the relationship between     a lock and a socket, which allowed local users to cause     a denial of service (deadlock) via a crafted sctp_accept     call (bnc#961509).

  - CVE-2015-8785: The fuse_fill_write_pages function in     fs/fuse/file.c in the Linux kernel allowed local users     to cause a denial of service (infinite loop) via a     writev system call that triggers a zero length for the     first segment of an iov (bnc#963765).

  - CVE-2015-8812: A use-after-free flaw was found in the     CXGB3 kernel driver when the network was considered to     be congested. This could be used by local attackers to     cause machine crashes or potentially code execution     (bsc#966437).

  - CVE-2016-0723: Race condition in the tty_ioctl function     in drivers/tty/tty_io.c in the Linux kernel allowed     local users to obtain sensitive information from kernel     memory or cause a denial of service (use-after-free and     system crash) by making a TIOCGETD ioctl call during     processing of a TIOCSETD ioctl call (bnc#961500).

  - CVE-2016-2069: Race conditions in TLB syncing was fixed     which could leak to information leaks (bnc#963767).

  - CVE-2016-2384: Removed a double free in the ALSA     usb-audio driver in the umidi object which could lead to     crashes (bsc#966693).

  - CVE-2016-2543: Added a missing NULL check at     remove_events ioctl in ALSA that could lead to crashes.
    (bsc#967972).

  - CVE-2016-2544, CVE-2016-2545, CVE-2016-2546,     CVE-2016-2547, CVE-2016-2548, CVE-2016-2549: Various     race conditions in ALSAs timer handling were fixed.
    (bsc#967975, bsc#967974, bsc#967973, bsc#968011,     bsc#968012, bsc#968013).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 12 SP1 kernel was updated to 3.12.53 to receive various security and bugfixes.

The following security bugs were fixed :

  - CVE-2013-7446: Use-after-free vulnerability in     net/unix/af_unix.c in the Linux kernel allowed local     users to bypass intended AF_UNIX socket permissions or     cause a denial of service (panic) via crafted epoll_ctl     calls (bnc#955654).

  - CVE-2015-5707: Integer overflow in the sg_start_req     function in drivers/scsi/sg.c in the Linux kernel     allowed local users to cause a denial of service or     possibly have unspecified other impact via a large     iov_count value in a write request (bnc#940338).

  - CVE-2015-7550: The keyctl_read_key function in     security/keys/keyctl.c in the Linux kernel did not     properly use a semaphore, which allowed local users to     cause a denial of service (NULL pointer dereference and     system crash) or possibly have unspecified other impact     via a crafted application that leverages a race     condition between keyctl_revoke and keyctl_read calls     (bnc#958951).

  - CVE-2015-7799: The slhc_init function in     drivers/net/slip/slhc.c in the Linux kernel did not     ensure that certain slot numbers are valid, which     allowed local users to cause a denial of service (NULL     pointer dereference and system crash) via a crafted     PPPIOCSMAXCID ioctl call (bnc#949936).

  - CVE-2015-8215: net/ipv6/addrconf.c in the IPv6 stack in     the Linux kernel did not validate attempted changes to     the MTU value, which allowed context-dependent attackers     to cause a denial of service (packet loss) via a value     that was (1) smaller than the minimum compliant value or     (2) larger than the MTU of an interface, as demonstrated     by a Router Advertisement (RA) message that is not     validated by a daemon, a different vulnerability than     CVE-2015-0272 (bnc#955354).

  - CVE-2015-8539: The KEYS subsystem in the Linux kernel     allowed local users to gain privileges or cause a denial     of service (BUG) via crafted keyctl commands that     negatively instantiate a key, related to     security/keys/encrypted-keys/encrypted.c,     security/keys/trusted.c, and     security/keys/user_defined.c (bnc#958463).

  - CVE-2015-8543: The networking implementation in the     Linux kernel did not validate protocol identifiers for     certain protocol families, which allowed local users to     cause a denial of service (NULL function pointer     dereference and system crash) or possibly gain     privileges by leveraging CLONE_NEWUSER support to     execute a crafted SOCK_RAW application (bnc#958886).

  - CVE-2015-8550: Optimizations introduced by the compiler     could have lead to double fetch vulnerabilities,     potentially possibly leading to arbitrary code execution     in backend (bsc#957988).

  - CVE-2015-8551: Xen PCI backend driver did not perform     proper sanity checks on the device's state, allowing for     DoS (bsc#957990).

  - CVE-2015-8569: The (1) pptp_bind and (2) pptp_connect     functions in drivers/net/ppp/pptp.c in the Linux kernel     did not verify an address length, which allowed local     users to obtain sensitive information from kernel memory     and bypass the KASLR protection mechanism via a crafted     application (bnc#959190).

  - CVE-2015-8575: The sco_sock_bind function in     net/bluetooth/sco.c in the Linux kernel did not verify     an address length, which allowed local users to obtain     sensitive information from kernel memory and bypass the     KASLR protection mechanism via a crafted application     (bnc#959399).

  - CVE-2015-8660: The ovl_setattr function in     fs/overlayfs/inode.c in the Linux kernel attempted to     merge distinct setattr operations, which allowed local     users to bypass intended access restrictions and modify     the attributes of arbitrary overlay files via a crafted     application (bnc#960281).

  - CVE-2015-8767: net/sctp/sm_sideeffect.c in the Linux     kernel did not properly manage the relationship between     a lock and a socket, which allowed local users to cause     a denial of service (deadlock) via a crafted sctp_accept     call (bnc#961509).

  - CVE-2015-8785: The fuse_fill_write_pages function in     fs/fuse/file.c in the Linux kernel allowed local users     to cause a denial of service (infinite loop) via a     writev system call that triggers a zero length for the     first segment of an iov (bnc#963765).

  - CVE-2016-0723: Race condition in the tty_ioctl function     in drivers/tty/tty_io.c in the Linux kernel allowed     local users to obtain sensitive information from kernel     memory or cause a denial of service (use-after-free and     system crash) by making a TIOCGETD ioctl call during     processing of a TIOCSETD ioctl call (bnc#961500).

  - CVE-2016-2069: A race in invalidating paging structures     that were not in use locally could have lead to     disclosoure of information or arbitrary code exectution     (bnc#963767).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The openSUSE 13.2 kernel was updated to receive various security and bugfixes.

Following security bugs were fixed :

  - CVE-2016-0728: A reference leak in keyring handling with     join_session_keyring() could lead to local attackers     gain root privileges. (bsc#962075).

  - CVE-2015-7550: A local user could have triggered a race     between read and revoke in keyctl (bnc#958951).

  - CVE-2015-8569: The (1) pptp_bind and (2) pptp_connect     functions in drivers/net/ppp/pptp.c in the Linux kernel     did not verify an address length, which allowed local     users to obtain sensitive information from kernel memory     and bypass the KASLR protection mechanism via a crafted     application (bnc#959190).

  - CVE-2015-8543: The networking implementation in the     Linux kernel did not validate protocol identifiers for     certain protocol families, which allowed local users to     cause a denial of service (NULL function pointer     dereference and system crash) or possibly gain     privileges by leveraging CLONE_NEWUSER support to     execute a crafted SOCK_RAW application (bnc#958886).

  - CVE-2014-8989: The Linux kernel did not properly     restrict dropping of supplemental group memberships in     certain namespace scenarios, which allowed local users     to bypass intended file permissions by leveraging a     POSIX ACL containing an entry for the group category     that is more restrictive than the entry for the other     category, aka a 'negative groups' issue, related to     kernel/groups.c, kernel/uid16.c, and     kernel/user_namespace.c (bnc#906545).

  - CVE-2015-5157: arch/x86/entry/entry_64.S in the Linux     kernel on the x86_64 platform mishandles IRET faults in     processing NMIs that occurred during userspace     execution, which might allow local users to gain     privileges by triggering an NMI (bnc#937969).

  - CVE-2015-7799: The slhc_init function in     drivers/net/slip/slhc.c in the Linux kernel through     4.2.3 did not ensure that certain slot numbers are     valid, which allowed local users to cause a denial of     service (NULL pointer dereference and system crash) via     a crafted PPPIOCSMAXCID ioctl call (bnc#949936).

  - CVE-2015-8104: The KVM subsystem in the Linux kernel     through 4.2.6, and Xen 4.3.x through 4.6.x, allowed     guest OS users to cause a denial of service (host OS     panic or hang) by triggering many #DB (aka Debug)     exceptions, related to svm.c (bnc#954404).

  - CVE-2015-5307: The KVM subsystem in the Linux kernel     through 4.2.6, and Xen 4.3.x through 4.6.x, allowed     guest OS users to cause a denial of service (host OS     panic or hang) by triggering many #AC (aka Alignment     Check) exceptions, related to svm.c and vmx.c     (bnc#953527).

  - CVE-2014-9529: Race condition in the key_gc_unused_keys     function in security/keys/gc.c in the Linux kernel     allowed local users to cause a denial of service (memory     corruption or panic) or possibly have unspecified other     impact via keyctl commands that trigger access to a key     structure member during garbage collection of a key     (bnc#912202).

  - CVE-2015-7990: Race condition in the rds_sendmsg     function in net/rds/sendmsg.c in the Linux kernel     allowed local users to cause a denial of service (NULL     pointer dereference and system crash) or possibly have     unspecified other impact by using a socket that was not     properly bound. NOTE: this vulnerability exists because     of an incomplete fix for CVE-2015-6937 (bnc#952384     953052).

  - CVE-2015-6937: The __rds_conn_create function in     net/rds/connection.c in the Linux kernel allowed local     users to cause a denial of service (NULL pointer     dereference and system crash) or possibly have     unspecified other impact by using a socket that was not     properly bound (bnc#945825).

  - CVE-2015-7885: The dgnc_mgmt_ioctl function in     drivers/staging/dgnc/dgnc_mgmt.c in the Linux kernel     through 4.3.3 did not initialize a certain structure     member, which allowed local users to obtain sensitive     information from kernel memory via a crafted application     (bnc#951627).

  - CVE-2015-8215: net/ipv6/addrconf.c in the IPv6 stack in     the Linux kernel did not validate attempted changes to     the MTU value, which allowed context-dependent attackers     to cause a denial of service (packet loss) via a value     that is (1) smaller than the minimum compliant value or     (2) larger than the MTU of an interface, as demonstrated     by a Router Advertisement (RA) message that is not     validated by a daemon, a different vulnerability than     CVE-2015-0272. NOTE: the scope of CVE-2015-0272 is     limited to the NetworkManager product (bnc#955354).

  - CVE-2015-8767: A case can occur when sctp_accept() is     called by the user during a heartbeat timeout event     after the 4-way handshake. Since sctp_assoc_migrate()     changes both assoc->base.sk and assoc->ep, the     bh_sock_lock in sctp_generate_heartbeat_event() will be     taken with the listening socket but released with the     new association socket. The result is a deadlock on any     future attempts to take the listening socket lock.
    (bsc#961509)

  - CVE-2015-8575: Validate socket address length in     sco_sock_bind() to prevent information leak     (bsc#959399).

  - CVE-2015-8551, CVE-2015-8552: xen/pciback: For     XEN_PCI_OP_disable_msi[|x] only disable if device has     MSI(X) enabled (bsc#957990).

  - CVE-2015-8550: Compiler optimizations in the XEN PV     backend drivers could have lead to double fetch     vulnerabilities, causing denial of service or arbitrary     code execution (depending on the configuration)     (bsc#957988).

The following non-security bugs were fixed :

  - ALSA: hda - Disable 64bit address for Creative HDA     controllers (bnc#814440).

  - ALSA: hda - Fix noise problems on Thinkpad T440s     (boo#958504).

  - Input: aiptek - fix crash on detecting device without     endpoints (bnc#956708).

  - KEYS: Make /proc/keys unconditional if CONFIG_KEYS=y     (boo#956934).

  - KVM: x86: update masterclock values on TSC writes     (bsc#961739).

  - NFS: Fix a NULL pointer dereference of migration     recovery ops for v4.2 client (bsc#960839).

  - apparmor: allow SYS_CAP_RESOURCE to be sufficient to     prlimit another task (bsc#921949).

  - blktap: also call blkif_disconnect() when frontend     switched to closed (bsc#952976).

  - blktap: refine mm tracking (bsc#952976).

  - cdrom: Random writing support for BD-RE media     (bnc#959568).

  - genksyms: Handle string literals with spaces in     reference files (bsc#958510).

  - ipv4: Do not increase PMTU with Datagram Too Big message     (bsc#955224).

  - ipv6: distinguish frag queues by device for multicast     and link-local packets (bsc#955422).

  - ipv6: fix tunnel error handling (bsc#952579).

  - route: Use ipv4_mtu instead of raw rt_pmtu (bsc#955224).

  - uas: Add response iu handling (bnc#954138).

  - usbvision fix overflow of interfaces array (bnc#950998).

  - x86/evtchn: make use of PHYSDEVOP_map_pirq.

  - xen/pciback: Do not allow MSI-X ops if     PCI_COMMAND_MEMORY is not set (bsc#957990 XSA-157).

The openSUSE 13.1 kernel was updated to receive various security and bugfixes.

Following security bugs were fixed :

  - CVE-2016-0728: A reference leak in keyring handling with     join_session_keyring() could lead to local attackers     gain root privileges. (bsc#962075).

  - CVE-2015-7550: A local user could have triggered a race     between read and revoke in keyctl (bnc#958951).

  - CVE-2015-8569: The (1) pptp_bind and (2) pptp_connect     functions in drivers/net/ppp/pptp.c in the Linux kernel     did not verify an address length, which allowed local     users to obtain sensitive information from kernel memory     and bypass the KASLR protection mechanism via a crafted     application (bnc#959190).

  - CVE-2015-8543: The networking implementation in the     Linux kernel did not validate protocol identifiers for     certain protocol families, which allowed local users to     cause a denial of service (NULL function pointer     dereference and system crash) or possibly gain     privileges by leveraging CLONE_NEWUSER support to     execute a crafted SOCK_RAW application (bnc#958886).

  - CVE-2014-8989: The Linux kernel did not properly     restrict dropping of supplemental group memberships in     certain namespace scenarios, which allowed local users     to bypass intended file permissions by leveraging a     POSIX ACL containing an entry for the group category     that is more restrictive than the entry for the other     category, aka a 'negative groups' issue, related to     kernel/groups.c, kernel/uid16.c, and     kernel/user_namespace.c (bnc#906545).

  - CVE-2015-5157: arch/x86/entry/entry_64.S in the Linux     kernel on the x86_64 platform mishandles IRET faults in     processing NMIs that occurred during userspace     execution, which might allow local users to gain     privileges by triggering an NMI (bnc#937969).

  - CVE-2015-7799: The slhc_init function in     drivers/net/slip/slhc.c in the Linux kernel through     4.2.3 did not ensure that certain slot numbers are     valid, which allowed local users to cause a denial of     service (NULL pointer dereference and system crash) via     a crafted PPPIOCSMAXCID ioctl call (bnc#949936).

  - CVE-2015-8104: The KVM subsystem in the Linux kernel     through 4.2.6, and Xen 4.3.x through 4.6.x, allowed     guest OS users to cause a denial of service (host OS     panic or hang) by triggering many #DB (aka Debug)     exceptions, related to svm.c (bnc#954404).

  - CVE-2015-5307: The KVM subsystem in the Linux kernel     through 4.2.6, and Xen 4.3.x through 4.6.x, allowed     guest OS users to cause a denial of service (host OS     panic or hang) by triggering many #AC (aka Alignment     Check) exceptions, related to svm.c and vmx.c     (bnc#953527).

  - CVE-2014-9529: Race condition in the key_gc_unused_keys     function in security/keys/gc.c in the Linux kernel     allowed local users to cause a denial of service (memory     corruption or panic) or possibly have unspecified other     impact via keyctl commands that trigger access to a key     structure member during garbage collection of a key     (bnc#912202).

  - CVE-2015-7990: Race condition in the rds_sendmsg     function in net/rds/sendmsg.c in the Linux kernel     allowed local users to cause a denial of service (NULL     pointer dereference and system crash) or possibly have     unspecified other impact by using a socket that was not     properly bound. NOTE: this vulnerability exists because     of an incomplete fix for CVE-2015-6937 (bnc#952384     953052).

  - CVE-2015-6937: The __rds_conn_create function in     net/rds/connection.c in the Linux kernel allowed local     users to cause a denial of service (NULL pointer     dereference and system crash) or possibly have     unspecified other impact by using a socket that was not     properly bound (bnc#945825).

  - CVE-2015-7885: The dgnc_mgmt_ioctl function in     drivers/staging/dgnc/dgnc_mgmt.c in the Linux kernel     through 4.3.3 did not initialize a certain structure     member, which allowed local users to obtain sensitive     information from kernel memory via a crafted application     (bnc#951627).

  - CVE-2015-8215: net/ipv6/addrconf.c in the IPv6 stack in     the Linux kernel did not validate attempted changes to     the MTU value, which allowed context-dependent attackers     to cause a denial of service (packet loss) via a value     that is (1) smaller than the minimum compliant value or     (2) larger than the MTU of an interface, as demonstrated     by a Router Advertisement (RA) message that is not     validated by a daemon, a different vulnerability than     CVE-2015-0272. NOTE: the scope of CVE-2015-0272 is     limited to the NetworkManager product (bnc#955354).

  - CVE-2015-8767: A case can occur when sctp_accept() is     called by the user during a heartbeat timeout event     after the 4-way handshake. Since sctp_assoc_migrate()     changes both assoc->base.sk and assoc->ep, the     bh_sock_lock in sctp_generate_heartbeat_event() will be     taken with the listening socket but released with the     new association socket. The result is a deadlock on any     future attempts to take the listening socket lock.
    (bsc#961509)

  - CVE-2015-8575: Validate socket address length in     sco_sock_bind() to prevent information leak     (bsc#959399).

  - CVE-2015-8551, CVE-2015-8552: xen/pciback: For     XEN_PCI_OP_disable_msi[|x] only disable if device has     MSI(X) enabled (bsc#957990).

  - CVE-2015-8550: Compiler optimizations in the XEN PV     backend drivers could have lead to double fetch     vulnerabilities, causing denial of service or arbitrary     code execution (depending on the configuration)     (bsc#957988).

The following non-security bugs were fixed :

  - ALSA: hda - Disable 64bit address for Creative HDA     controllers (bnc#814440).

  - ALSA: hda - Fix noise problems on Thinkpad T440s     (boo#958504).

  - Input: aiptek - fix crash on detecting device without     endpoints (bnc#956708).

  - KEYS: Make /proc/keys unconditional if CONFIG_KEYS=y     (boo#956934).

  - KVM: x86: update masterclock values on TSC writes     (bsc#961739).

  - NFS: Fix a NULL pointer dereference of migration     recovery ops for v4.2 client (bsc#960839).

  - apparmor: allow SYS_CAP_RESOURCE to be sufficient to     prlimit another task (bsc#921949).

  - blktap: also call blkif_disconnect() when frontend     switched to closed (bsc#952976).

  - blktap: refine mm tracking (bsc#952976).

  - cdrom: Random writing support for BD-RE media     (bnc#959568).

  - genksyms: Handle string literals with spaces in     reference files (bsc#958510).

  - ipv4: Do not increase PMTU with Datagram Too Big message     (bsc#955224).

  - ipv6: distinguish frag queues by device for multicast     and link-local packets (bsc#955422).

  - ipv6: fix tunnel error handling (bsc#952579).

  - route: Use ipv4_mtu instead of raw rt_pmtu (bsc#955224).

  - uas: Add response iu handling (bnc#954138).

  - usbvision fix overflow of interfaces array (bnc#950998).

  - x86/evtchn: make use of PHYSDEVOP_map_pirq.

  - xen/pciback: Do not allow MSI-X ops if     PCI_COMMAND_MEMORY is not set (bsc#957990 XSA-157).

The Linux kernel for openSUSE Leap 42.1 was updated to the 4.1.15 stable release, and also includes security and bugfixes.

Following security bugs were fixed :

  - CVE-2016-0728: A reference leak in keyring handling with     join_session_keyring() could lead to local attackers     gain root privileges. (bsc#962075).

  - CVE-2015-7550: A local user could have triggered a race     between read and revoke in keyctl (bnc#958951).

  - CVE-2015-8767: A case can occur when sctp_accept() is     called by the user during a heartbeat timeout event     after the 4-way handshake. Since sctp_assoc_migrate()     changes both assoc->base.sk and assoc->ep, the     bh_sock_lock in sctp_generate_heartbeat_event() will be     taken with the listening socket but released with the     new association socket. The result is a deadlock on any     future attempts to take the listening socket lock.
    (bsc#961509)

  - CVE-2015-8539: A negatively instantiated user key could     have been used by a local user to leverage privileges     (bnc#958463).

  - CVE-2015-8569: The (1) pptp_bind and (2) pptp_connect     functions in drivers/net/ppp/pptp.c in the Linux kernel     did not verify an address length, which allowed local     users to obtain sensitive information from kernel memory     and bypass the KASLR protection mechanism via a crafted     application (bnc#959190).

  - CVE-2015-8543: The networking implementation in the     Linux kernel did not validate protocol identifiers for     certain protocol families, which allowed local users to     cause a denial of service (NULL function pointer     dereference and system crash) or possibly gain     privileges by leveraging CLONE_NEWUSER support to     execute a crafted SOCK_RAW application (bnc#958886).

  - CVE-2015-8575: Validate socket address length in     sco_sock_bind() to prevent information leak     (bsc#959399).

  - CVE-2015-8551, CVE-2015-8552: xen/pciback: For     XEN_PCI_OP_disable_msi[|x] only disable if device has     MSI(X) enabled (bsc#957990).

  - CVE-2015-8550: Compiler optimizations in the XEN PV     backend drivers could have lead to double fetch     vulnerabilities, causing denial of service or arbitrary     code execution (depending on the configuration)     (bsc#957988).

The following non-security bugs were fixed :

  - ALSA: hda - Add a fixup for Thinkpad X1 Carbon 2nd     (bsc#958439).

  - ALSA: hda - Apply click noise workaround for Thinkpads     generically (bsc#958439).

  - ALSA: hda - Fix noise problems on Thinkpad T440s     (boo#958504).

  - ALSA: hda - Flush the pending probe work at remove     (boo#960710).

  - ALSA: hda - Set codec to D3 at reboot/shutdown on     Thinkpads (bsc#958439).

  - Add Cavium Thunderx network enhancements

  - Add RHEL to kernel-obs-build

  - Backport amd xgbe fixes and features

  - Backport arm64 patches from SLE12-SP1-ARM.

  - Btrfs: fix the number of transaction units needed to     remove a block group (bsc#950178).

  - Btrfs: use global reserve when deleting unused block     group after ENOSPC (bsc#950178).

  - Documentation: nousb is a module parameter (bnc#954324).

  - Driver for IBM System i/p VNIC protocol.

  - Enable CONFIG_PINCTRL_CHERRYVIEW (boo#954532) Needed for     recent tablets/laptops. CONFIG_PINCTRL_BAYTRAIL is still     disabled as it can't be built as a module.

  - Fix PCI generic host controller

  - Fix kABI breakage for max_dev_sectors addition to     queue_limits (boo#961263).

  - HID: multitouch: Fetch feature reports on demand for     Win8 devices (boo#954532).

  - HID: multitouch: fix input mode switching on some Elan     panels (boo#954532).

  - Implement enable/disable for Display C6 state     (boo#960021).

  - Input: aiptek - fix crash on detecting device without     endpoints (bnc#956708).

  - Linux 4.1.15 (boo#954647 bsc#955422).

  - Move kabi patch to patches.kabi directory

  - Obsolete compat-wireless, rts5229 and rts_pstor KMPs     These are found in SLE11-SP3, now replaced with the     upstream drivers.

  - PCI: generic: Pass starting bus number to     pci_scan_root_bus().

  - Revert 'block: remove artifical max_hw_sectors cap'     (boo#961263).

  - Set system time through RTC device

  - Update arm64 config files. Enabled DRM_AST in the     vanilla kernel since it is now enabled in the default     kernel.

  - Update config files: CONFIG_IBMVNIC=m

  - block/sd: Fix device-imposed transfer length limits     (boo#961263).

  - block: bump BLK_DEF_MAX_SECTORS to 2560 (boo#961263).

  - drm/i915/skl: Add DC5 Trigger Sequence (boo#960021).

  - drm/i915/skl: Add DC6 Trigger sequence (boo#960021).

  - drm/i915/skl: Add support to load SKL CSR firmware     (boo#960021).

  - drm/i915/skl: Add the INIT power domain to the MISC I/O     power well (boo#960021).

  - drm/i915/skl: Deinit/init the display at suspend/resume     (boo#960021).

  - drm/i915/skl: Fix DMC API version in firmware file name     (boo#960021).

  - drm/i915/skl: Fix     WaDisableChickenBitTSGBarrierAckForFFSliceCS     (boo#960021).

  - drm/i915/skl: Fix stepping check for a couple of W/As     (boo#960021).

  - drm/i915/skl: Fix the CTRL typo in the DPLL_CRTL1     defines (boo#960021).

  - drm/i915/skl: Implement WaDisableVFUnitClockGating     (boo#960021).

  - drm/i915/skl: Implement enable/disable for Display C5     state (boo#960021).

  - drm/i915/skl: Make the Misc I/O power well part of the     PLLS domain (boo#960021).

  - drm/i915/skl: add F0 stepping ID (boo#960021).

  - drm/i915/skl: enable     WaForceContextSaveRestoreNonCoherent (boo#960021).

  - drm/i915: Clear crtc atomic flags at beginning of     transaction (boo#960021).

  - drm/i915: Fix CSR MMIO address check (boo#960021).

  - drm/i915: Switch to full atomic helpers for plane     updates/disable, take two (boo#960021).

  - drm/i915: set CDCLK if DPLL0 enabled during resuming     from S3 (boo#960021).

  - ethernet/atheros/alx: sanitize buffer sizing and padding     (boo#952621).

  - genksyms: Handle string literals with spaces in     reference files (bsc#958510).

  - group-source-files: mark module.lds as devel file ld:
    cannot open linker script file     /usr/src/linux-4.2.5-1/arch/arm/kernel/module.lds: No     such file or directory

  - hwrng: core - sleep interruptible in read (bnc#962597).

  - ipv6: distinguish frag queues by device for multicast     and link-local packets (bsc#955422).

  - kABI fixes for linux-4.1.15.

  - rpm/compute-PATCHVERSION.sh: Skip stale directories in     the package dir

  - rpm/constraints.in: Bump disk space requirements up a     bit Require 10GB on s390x, 20GB elsewhere.

  - rpm/constraints.in: Require 14GB worth of disk space on     POWER The builds started to fail randomly due to ENOSPC     errors.

  - rpm/kernel-binary.spec.in: Do not explicitly set     DEBUG_SECTION_MISMATCH CONFIG_DEBUG_SECTION_MISMATCH is     a selectable Kconfig option since 2.6.39 and is enabled     in our configs.

  - rpm/kernel-binary.spec.in: Do not obsolete ocfs2-kmp     (bnc#865259)865259

  - rpm/kernel-binary.spec.in: Fix build if no UEFI certs     are installed

  - rpm/kernel-binary.spec.in: Install libopenssl-devel for     newer sign-file

  - rpm/kernel-binary.spec.in: No scriptlets in     kernel-zfcpdump The kernel should not be added to the     bootloader nor are there any KMPs.

  - rpm/kernel-binary.spec.in: Obsolete the -base package     from SLE11 (bnc#865096)

  - rpm/kernel-binary.spec.in: Use parallel make in all     invocations Also, remove the lengthy comment, since we     are using a standard rpm macro now.

  - thinkpad_acpi: Do not yell on unsupported brightness     interfaces (boo#957152).

  - usb: make 'nousb' a clear module parameter (bnc#954324).

  - usbvision fix overflow of interfaces array (bnc#950998).

  - x86/microcode/amd: Do not overwrite final patch levels     (bsc#913996).

  - x86/microcode/amd: Extract current patch level read to a     function (bsc#913996).

  - xen/pciback: Do not allow MSI-X ops if     PCI_COMMAND_MEMORY is not set (bsc#957990 XSA-157).

  - xhci: refuse loading if nousb is used (bnc#954324).

The SUSE Linux Enterprise 12 kernel was updated to receive various security and bugfixes.

Following security bugs were fixed :

  - CVE-2015-7550: A local user could have triggered a race     between read and revoke in keyctl (bnc#958951).

  - CVE-2015-8539: A negatively instantiated user key could     have been used by a local user to leverage privileges     (bnc#958463).

  - CVE-2015-8543: The networking implementation in the     Linux kernel did not validate protocol identifiers for     certain protocol families, which allowed local users to     cause a denial of service (NULL function pointer     dereference and system crash) or possibly gain     privileges by leveraging CLONE_NEWUSER support to     execute a crafted SOCK_RAW application (bnc#958886).

  - CVE-2015-8550: Compiler optimizations in the XEN PV     backend drivers could have lead to double fetch     vulnerabilities, causing denial of service or arbitrary     code execution (depending on the configuration)     (bsc#957988).

  - CVE-2015-8551, CVE-2015-8552: xen/pciback: For     XEN_PCI_OP_disable_msi[|x] only disable if device has     MSI(X) enabled (bsc#957990).

  - CVE-2015-8569: The (1) pptp_bind and (2) pptp_connect     functions in drivers/net/ppp/pptp.c in the Linux kernel     did not verify an address length, which allowed local     users to obtain sensitive information from kernel memory     and bypass the KASLR protection mechanism via a crafted     application (bnc#959190).

  - CVE-2015-8575: Validate socket address length in     sco_sock_bind() to prevent information leak     (bsc#959399).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leak.

  - CVE-2015-7513     It was discovered that a local user permitted to use the     x86 KVM subsystem could configure the PIT emulation to     cause a denial of service (crash).

  - CVE-2015-7550     Dmitry Vyukov discovered a race condition in the keyring     subsystem that allows a local user to cause a denial of     service (crash).

  - CVE-2015-8543     It was discovered that a local user permitted to create     raw sockets could cause a denial-of-service by     specifying an invalid protocol number for the socket.
    The attacker must have the CAP_NET_RAW capability.

  - CVE-2015-8550     Felix Wilhelm of ERNW discovered that the Xen PV backend     drivers may read critical data from shared memory     multiple times. This flaw can be used by a guest kernel     to cause a denial of service (crash) on the host, or     possibly for privilege escalation.

  - CVE-2015-8551 / CVE-2015-8552     Konrad Rzeszutek Wilk of Oracle discovered that the Xen     PCI backend driver does not adequately validate the     device state when a guest configures MSIs. This flaw can     be used by a guest kernel to cause a denial of service     (crash or disk space exhaustion) on the host.

  - CVE-2015-8569     Dmitry Vyukov discovered a flaw in the PPTP sockets     implementation that leads to an information leak to     local users.

  - CVE-2015-8575     David Miller discovered a flaw in the Bluetooth SCO     sockets implementation that leads to an information leak     to local users.

  - CVE-2015-8709     Jann Horn discovered a flaw in the permission checks for     use of the ptrace feature. A local user who has the     CAP_SYS_PTRACE capability within their own user     namespace could use this flaw for privilege escalation     if a more privileged process ever enters that user     namespace. This affects at least the LXC system.

In addition, this update fixes some regressions in the previous update :

  - #808293     A regression in the UDP implementation prevented     freeradius and some other applications from receiving     data.

  - #808602 / #808953

    A regression in the USB XHCI driver prevented use of     some devices in USB 3 SuperSpeed ports.

  - #808973

    A fix to the radeon driver interacted with an existing     bug to cause a crash at boot when using some AMD/ATI     graphics cards. This issue only affects wheezy.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2854-1 advisory.

  - Xen, when used on a system providing PV backends, allows local guest OS administrators to cause a denial     of service (host OS crash) or gain privileges by writing to memory shared between the frontend and     backend, aka a double fetch vulnerability. (CVE-2015-8550)

  - The PCI backend driver in Xen, when running on an x86 system and using Linux 3.1.x through 4.3.x as the     driver domain, allows local guest administrators to hit BUG conditions and cause a denial of service (NULL     pointer dereference and host OS crash) by leveraging a system with access to a passed-through MSI or MSI-X     capable physical PCI device and a crafted sequence of XEN_PCI_OP_* operations, aka Linux pciback missing     sanity checks. (CVE-2015-8551)

  - The PCI backend driver in Xen, when running on an x86 system and using Linux 3.1.x through 4.3.x as the     driver domain, allows local guest administrators to generate a continuous stream of WARN messages and     cause a denial of service (disk consumption) by leveraging a system with access to a passed-through MSI or     MSI-X capable physical PCI device and XEN_PCI_OP_enable_msi operations, aka Linux pciback missing sanity     checks. (CVE-2015-8552)

  - kernel/ptrace.c in the Linux kernel through 4.4.1 mishandles uid and gid mappings, which allows local     users to gain privileges by establishing a user namespace, waiting for a root process to enter that     namespace with an unsafe uid or gid, and then using the ptrace system call. NOTE: the vendor states there     is no kernel bug here. (CVE-2015-8709)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2853-1 advisory.

  - Xen, when used on a system providing PV backends, allows local guest OS administrators to cause a denial     of service (host OS crash) or gain privileges by writing to memory shared between the frontend and     backend, aka a double fetch vulnerability. (CVE-2015-8550)

  - The PCI backend driver in Xen, when running on an x86 system and using Linux 3.1.x through 4.3.x as the     driver domain, allows local guest administrators to hit BUG conditions and cause a denial of service (NULL     pointer dereference and host OS crash) by leveraging a system with access to a passed-through MSI or MSI-X     capable physical PCI device and a crafted sequence of XEN_PCI_OP_* operations, aka Linux pciback missing     sanity checks. (CVE-2015-8551)

  - The PCI backend driver in Xen, when running on an x86 system and using Linux 3.1.x through 4.3.x as the     driver domain, allows local guest administrators to generate a continuous stream of WARN messages and     cause a denial of service (disk consumption) by leveraging a system with access to a passed-through MSI or     MSI-X capable physical PCI device and XEN_PCI_OP_enable_msi operations, aka Linux pciback missing sanity     checks. (CVE-2015-8552)

  - kernel/ptrace.c in the Linux kernel through 4.4.1 mishandles uid and gid mappings, which allows local     users to gain privileges by establishing a user namespace, waiting for a root process to enter that     namespace with an unsafe uid or gid, and then using the ptrace system call. NOTE: the vendor states there     is no kernel bug here. (CVE-2015-8709)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Felix Wilhelm discovered a race condition in the Xen paravirtualized drivers which can cause double fetch vulnerabilities. An attacker in the paravirtualized guest could exploit this flaw to cause a denial of service (crash the host) or potentially execute arbitrary code on the host. (CVE-2015-8550)

Konrad Rzeszutek Wilk discovered the Xen PCI backend driver does not perform sanity checks on the device's state. An attacker could exploit this flaw to cause a denial of service (NULL dereference) on the host.
(CVE-2015-8551)

Konrad Rzeszutek Wilk discovered the Xen PCI backend driver does not perform sanity checks on the device's state. An attacker could exploit this flaw to cause a denial of service by flooding the logging system with WARN() messages causing the initial domain to exhaust disk space.
(CVE-2015-8552)

Jann Horn discovered a ptrace issue with user namespaces in the Linux kernel. The namespace owner could potentially exploit this flaw by ptracing a root owned process entering the user namespace to elevate its privileges and potentially gain access outside of the namespace.
(http://bugs.launchpad.net/bugs/1527374)

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2849-1 advisory.

  - Xen, when used on a system providing PV backends, allows local guest OS administrators to cause a denial     of service (host OS crash) or gain privileges by writing to memory shared between the frontend and     backend, aka a double fetch vulnerability. (CVE-2015-8550)

  - The PCI backend driver in Xen, when running on an x86 system and using Linux 3.1.x through 4.3.x as the     driver domain, allows local guest administrators to hit BUG conditions and cause a denial of service (NULL     pointer dereference and host OS crash) by leveraging a system with access to a passed-through MSI or MSI-X     capable physical PCI device and a crafted sequence of XEN_PCI_OP_* operations, aka Linux pciback missing     sanity checks. (CVE-2015-8551)

  - The PCI backend driver in Xen, when running on an x86 system and using Linux 3.1.x through 4.3.x as the     driver domain, allows local guest administrators to generate a continuous stream of WARN messages and     cause a denial of service (disk consumption) by leveraging a system with access to a passed-through MSI or     MSI-X capable physical PCI device and XEN_PCI_OP_enable_msi operations, aka Linux pciback missing sanity     checks. (CVE-2015-8552)

  - kernel/ptrace.c in the Linux kernel through 4.4.1 mishandles uid and gid mappings, which allows local     users to gain privileges by establishing a user namespace, waiting for a root process to enter that     namespace with an unsafe uid or gid, and then using the ptrace system call. NOTE: the vendor states there     is no kernel bug here. (CVE-2015-8709)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2848-1 advisory.

  - Xen, when used on a system providing PV backends, allows local guest OS administrators to cause a denial     of service (host OS crash) or gain privileges by writing to memory shared between the frontend and     backend, aka a double fetch vulnerability. (CVE-2015-8550)

  - The PCI backend driver in Xen, when running on an x86 system and using Linux 3.1.x through 4.3.x as the     driver domain, allows local guest administrators to hit BUG conditions and cause a denial of service (NULL     pointer dereference and host OS crash) by leveraging a system with access to a passed-through MSI or MSI-X     capable physical PCI device and a crafted sequence of XEN_PCI_OP_* operations, aka Linux pciback missing     sanity checks. (CVE-2015-8551)

  - The PCI backend driver in Xen, when running on an x86 system and using Linux 3.1.x through 4.3.x as the     driver domain, allows local guest administrators to generate a continuous stream of WARN messages and     cause a denial of service (disk consumption) by leveraging a system with access to a passed-through MSI or     MSI-X capable physical PCI device and XEN_PCI_OP_enable_msi operations, aka Linux pciback missing sanity     checks. (CVE-2015-8552)

  - kernel/ptrace.c in the Linux kernel through 4.4.1 mishandles uid and gid mappings, which allows local     users to gain privileges by establishing a user namespace, waiting for a root process to enter that     namespace with an unsafe uid or gid, and then using the ptrace system call. NOTE: the vendor states there     is no kernel bug here. (CVE-2015-8709)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Felix Wilhelm discovered a race condition in the Xen paravirtualized drivers which can cause double fetch vulnerabilities. An attacker in the paravirtualized guest could exploit this flaw to cause a denial of service (crash the host) or potentially execute arbitrary code on the host. (CVE-2015-8550)

Konrad Rzeszutek Wilk discovered the Xen PCI backend driver does not perform sanity checks on the device's state. An attacker could exploit this flaw to cause a denial of service (NULL dereference) on the host.
(CVE-2015-8551)

Konrad Rzeszutek Wilk discovered the Xen PCI backend driver does not perform sanity checks on the device's state. An attacker could exploit this flaw to cause a denial of service by flooding the logging system with WARN() messages causing the initial domain to exhaust disk space.
(CVE-2015-8552).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
93299	SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2016:2105-1)	Nessus	SuSE Local Security Checks	high
93216	openSUSE Security Update : the Linux Kernel (openSUSE-2016-1029)	Nessus	SuSE Local Security Checks	high
90884	SUSE SLES11 Security Update : kernel (SUSE-SU-2016:1203-1)	Nessus	SuSE Local Security Checks	critical
90783	openSUSE Security Update : the Linux Kernel (openSUSE-2016-518)	Nessus	SuSE Local Security Checks	critical
90380	GLSA-201604-03 : Xen: Multiple vulnerabilities (Venom)	Nessus	Gentoo Local Security Checks	critical
90264	SUSE SLED11 / SLES11 Security Update : kernel (SUSE-SU-2016:0911-1)	Nessus	SuSE Local Security Checks	critical
89022	SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2016:0585-1)	Nessus	SuSE Local Security Checks	high
88605	openSUSE Security Update : the Linux Kernel (openSUSE-2016-136)	Nessus	SuSE Local Security Checks	high
88545	openSUSE Security Update : the Linux Kernel (openSUSE-2016-124)	Nessus	SuSE Local Security Checks	high
88542	openSUSE Security Update : the Linux Kernel (openSUSE-2016-116)	Nessus	SuSE Local Security Checks	high
88006	SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2016:0168-1)	Nessus	SuSE Local Security Checks	high
87741	Debian DSA-3434-1 : linux - security update	Nessus	Debian Local Security Checks	high
87537	Ubuntu 14.04 LTS : Linux kernel (Vivid HWE) vulnerabilities (USN-2854-1)	Nessus	Ubuntu Local Security Checks	high
87536	Ubuntu 14.04 LTS : Linux kernel (Wily HWE) vulnerabilities (USN-2853-1)	Nessus	Ubuntu Local Security Checks	high
87534	Ubuntu 15.10 : linux vulnerabilities (USN-2851-1)	Nessus	Ubuntu Local Security Checks	high
87533	Ubuntu 15.04 : linux vulnerabilities (USN-2850-1)	Nessus	Ubuntu Local Security Checks	high
87532	Ubuntu 14.04 LTS : Linux kernel (Utopic HWE) vulnerabilities (USN-2849-1)	Nessus	Ubuntu Local Security Checks	high
87531	Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-2848-1)	Nessus	Ubuntu Local Security Checks	high
87530	Ubuntu 12.04 LTS : linux-lts-trusty vulnerabilities (USN-2847-1)	Nessus	Ubuntu Local Security Checks	high
87529	Ubuntu 12.04 LTS : linux vulnerabilities (USN-2846-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2015-8551

medium

Tenable Plugins

high

high

critical

critical

critical

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high