The fork implementation in the Linux kernel before 4.5 on s390 platforms mishandles the case of four page-table levels, which allows local users to cause a denial of service (system crash) or possibly have unspecified other impact via a crafted application, related to arch/s390/include/asm/mmu_context.h and arch/s390/include/asm/pgalloc.h.

Security Fix(es) :

  - It was found that stacking a file system over procfs in     the Linux kernel could lead to a kernel stack overflow     due to deep nesting, as demonstrated by mounting     ecryptfs over procfs and creating a recursion by mapping     /proc/environ. An unprivileged, local user could     potentially use this flaw to escalate their privileges     on the system. (CVE-2016-1583, Important)

  - It was reported that on s390x, the fork of a process     with four page table levels will cause memory corruption     with a variety of symptoms. All processes are created     with three level page table and a limit of 4TB for the     address space. If the parent process has four page table     levels with a limit of 8PB, the function that duplicates     the address space will try to copy memory areas outside     of the address space limit for the child process.
    (CVE-2016-2143, Moderate)

Bug Fix(es) :

  - Use of a multi-threaded workload with high memory     mappings sometiems caused a kernel panic, due to a race     condition between the context switch and the pagetable     upgrade. This update fixes the switch_mm() by using the     complete asce parameter instead of the asce_bits     parameter. As a result, the kernel no longer panics in     the described scenario.

  - When iptables created the Transmission Control Protocol     (TCP) reset packet, a kernel crash could occur due to     uninitialized pointer to the TCP header within the     Socket Buffer (SKB). This update fixes the transport     header pointer in TCP reset for both IPv4 and IPv6, and     the kernel no longer crashes in the described situation.

  - Previously, when the Enhanced Error Handling (EEH)     mechanism did not block the PCI configuration space     access and an error was detected, a kernel panic     occurred. This update fixes EEH to fix this problem. As     a result, the kernel no longer panics in the described     scenario.

  - When the lockd service failed to start up completely,     the notifier blocks were in some cases registered on a     notification chain multiple times, which caused the     occurrence of a circular list on the notification chain.
    Consequently, a soft lock-up or a kernel oops occurred.
    With this update, the notifier blocks are unregistered     if lockd fails to start up completely, and the soft     lock-ups or the kernel oopses no longer occur under the     described circumstances.

  - When the Fibre Channel over Ethernet (FCoE) was     configured, the FCoE MaxFrameSize parameter was     incorrectly restricted to 1452. With this update, the     NETIF_F_ALL_FCOE symbol is no longer ignored, which     fixes this bug. MaxFrameSize is now restricted to 2112,     which is the correct value.

  - When the fnic driver was installed on Cisco UCS Blade     Server, the discs were under certain circumstances put     into the offline state with the following error message:
    'Medium access timeout failure. Offlining disk!'. This     update fixes fnic to set the Small Computer System     Interface (SCSI) status as DID_ABORT after a successful     abort operation. As a result, the discs are no longer     put into the offlined state in the described situation.

An update for kernel is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es) :

* It was found that stacking a file system over procfs in the Linux kernel could lead to a kernel stack overflow due to deep nesting, as demonstrated by mounting ecryptfs over procfs and creating a recursion by mapping /proc/ environ. An unprivileged, local user could potentially use this flaw to escalate their privileges on the system.
(CVE-2016-1583, Important)

* It was reported that on s390x, the fork of a process with four page table levels will cause memory corruption with a variety of symptoms.
All processes are created with three level page table and a limit of 4TB for the address space. If the parent process has four page table levels with a limit of 8PB, the function that duplicates the address space will try to copy memory areas outside of the address space limit for the child process. (CVE-2016-2143, Moderate)

Bug Fix(es) :

* Use of a multi-threaded workload with high memory mappings sometiems caused a kernel panic, due to a race condition between the context switch and the pagetable upgrade. This update fixes the switch_mm() by using the complete asce parameter instead of the asce_bits parameter.
As a result, the kernel no longer panics in the described scenario.
(BZ#1377472)

* When iptables created the Transmission Control Protocol (TCP) reset packet, a kernel crash could occur due to uninitialized pointer to the TCP header within the Socket Buffer (SKB). This update fixes the transport header pointer in TCP reset for both IPv4 and IPv6, and the kernel no longer crashes in the described situation.(BZ#1372266)

* Previously, when the Enhanced Error Handling (EEH) mechanism did not block the PCI configuration space access and an error was detected, a kernel panic occurred. This update fixes EEH to fix this problem. As a result, the kernel no longer panics in the described scenario.
(BZ#1379596)

* When the lockd service failed to start up completely, the notifier blocks were in some cases registered on a notification chain multiple times, which caused the occurrence of a circular list on the notification chain. Consequently, a soft lock-up or a kernel oops occurred. With this update, the notifier blocks are unregistered if lockd fails to start up completely, and the soft lock-ups or the kernel oopses no longer occur under the described circumstances.
(BZ#1375637)

* When the Fibre Channel over Ethernet (FCoE) was configured, the FCoE MaxFrameSize parameter was incorrectly restricted to 1452. With this update, the NETIF_F_ALL_FCOE symbol is no longer ignored, which fixes this bug. MaxFrameSize is now restricted to 2112, which is the correct value. (BZ#1381592)

* When the fnic driver was installed on Cisco UCS Blade Server, the discs were under certain circumstances put into the offline state with the following error message: 'Medium access timeout failure. Offlining disk!'. This update fixes fnic to set the Small Computer System Interface (SCSI) status as DID_ABORT after a successful abort operation. As a result, the discs are no longer put into the offlined state in the described situation. (BZ#1382620)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-2766 advisory.

    - [mm] close FOLL MAP_PRIVATE race (Larry Woodman) [1385116 1385117] {CVE-2016-5195}
    - [fs] ecryptfs: prevent mounts backed by procfs (Mateusz Guzik) [1347101 1347102] {CVE-2016-1583}
    - [s390] mm: four page table levels vs. fork (Hendrik Brueckner) [1341546 1316461] {CVE-2016-2143}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The SUSE Linux Enterprise 11 SP2 kernel was updated to receive various security and bug fixes. The following security bugs were fixed :

  - CVE-2016-4486: Fixed 4 byte information leak in     net/core/rtnetlink.c (bsc#978822).

  - CVE-2016-3134: The netfilter subsystem in the Linux     kernel did not validate certain offset fields, which     allowed local users to gain privileges or cause a denial     of service (heap memory corruption) via an     IPT_SO_SET_REPLACE setsockopt call (bnc#971126).

  - CVE-2016-2847: fs/pipe.c in the Linux kernel did not     limit the amount of unread data in pipes, which allowed     local users to cause a denial of service (memory     consumption) by creating many pipes with non-default     sizes (bnc#970948).

  - CVE-2016-2188: The iowarrior_probe function in     drivers/usb/misc/iowarrior.c in the Linux kernel allowed     physically proximate attackers to cause a denial of     service (NULL pointer dereference and system crash) via     a crafted endpoints value in a USB device descriptor     (bnc#970956).

  - CVE-2016-3138: The acm_probe function in     drivers/usb/class/cdc-acm.c in the Linux kernel allowed     physically proximate attackers to cause a denial of     service (NULL pointer dereference and system crash) via     a USB device without both a control and a data endpoint     descriptor (bnc#970911).

  - CVE-2016-3137: drivers/usb/serial/cypress_m8.c in the     Linux kernel allowed physically proximate attackers to     cause a denial of service (NULL pointer dereference and     system crash) via a USB device without both an     interrupt-in and an interrupt-out endpoint descriptor,     related to the cypress_generic_port_probe and     cypress_open functions (bnc#970970).

  - CVE-2016-3140: The digi_port_init function in     drivers/usb/serial/digi_acceleport.c in the Linux kernel     allowed physically proximate attackers to cause a denial     of service (NULL pointer dereference and system crash)     via a crafted endpoints value in a USB device descriptor     (bnc#970892).

  - CVE-2016-2186: The powermate_probe function in     drivers/input/misc/powermate.c in the Linux kernel     allowed physically proximate attackers to cause a denial     of service (NULL pointer dereference and system crash)     via a crafted endpoints value in a USB device descriptor     (bnc#970958).

  - CVE-2016-2185: The ati_remote2_probe function in     drivers/input/misc/ati_remote2.c in the Linux kernel     allowed physically proximate attackers to cause a denial     of service (NULL pointer dereference and system crash)     via a crafted endpoints value in a USB device descriptor     (bnc#971124).

  - CVE-2016-3156: The IPv4 implementation in the Linux     kernel mishandles destruction of device objects, which     allowed guest OS users to cause a denial of service     (host OS networking outage) by arranging for a large     number of IP addresses (bnc#971360).

  - CVE-2016-2184: The create_fixed_stream_quirk function in     sound/usb/quirks.c in the snd-usb-audio driver in the     Linux kernel allowed physically proximate attackers to     cause a denial of service (NULL pointer dereference or     double free, and system crash) via a crafted endpoints     value in a USB device descriptor (bnc#971125).

  - CVE-2016-3139: The wacom_probe function in     drivers/input/tablet/wacom_sys.c in the Linux kernel     allowed physically proximate attackers to cause a denial     of service (NULL pointer dereference and system crash)     via a crafted endpoints value in a USB device descriptor     (bnc#970909).

  - CVE-2016-2143: The fork implementation in the Linux     kernel on s390 platforms mishandled the case of four     page-table levels, which allowed local users to cause a     denial of service (system crash) or possibly have     unspecified other impact via a crafted application,     related to arch/s390/include/asm/mmu_context.h and     arch/s390/include/asm/pgalloc.h (bnc#970504).

  - CVE-2016-2782: The treo_attach function in     drivers/usb/serial/visor.c in the Linux kernel allowed     physically proximate attackers to cause a denial of     service (NULL pointer dereference and system crash) or     possibly have unspecified other impact by inserting a     USB device that lacks a (1) bulk-in or (2) interrupt-in     endpoint (bnc#968670).

  - CVE-2015-8816: The hub_activate function in     drivers/usb/core/hub.c in the Linux kernel did not     properly maintain a hub-interface data structure, which     allowed physically proximate attackers to cause a denial     of service (invalid memory access and system crash) or     possibly have unspecified other impact by unplugging a     USB hub device (bnc#968010).

  - CVE-2015-7566: The clie_5_attach function in     drivers/usb/serial/visor.c in the Linux kernel allowed     physically proximate attackers to cause a denial of     service (NULL pointer dereference and system crash) or     possibly have unspecified other impact by inserting a     USB device that lacks a bulk-out endpoint (bnc#961512).

  - CVE-2016-2549: sound/core/hrtimer.c in the Linux kernel     did not prevent recursive callback access, which allowed     local users to cause a denial of service (deadlock) via     a crafted ioctl call (bnc#968013).

  - CVE-2016-2547: sound/core/timer.c in the Linux kernel     employed a locking approach that did not consider slave     timer instances, which allowed local users to cause a     denial of service (race condition, use-after-free, and     system crash) via a crafted ioctl call (bnc#968011).

  - CVE-2016-2548: sound/core/timer.c in the Linux kernel     retained certain linked lists after a close or stop     action, which allowed local users to cause a denial of     service (system crash) via a crafted ioctl call, related     to the (1) snd_timer_close and (2) _snd_timer_stop     functions (bnc#968012).

  - CVE-2016-2546: sound/core/timer.c in the Linux kernel     used an incorrect type of mutex, which allowed local     users to cause a denial of service (race condition,     use-after-free, and system crash) via a crafted ioctl     call (bnc#967975).

  - CVE-2016-2545: The snd_timer_interrupt function in     sound/core/timer.c in the Linux kernel did not properly     maintain a certain linked list, which allowed local     users to cause a denial of service (race condition and     system crash) via a crafted ioctl call (bnc#967974).

  - CVE-2016-2544: Race condition in the queue_delete     function in sound/core/seq/seq_queue.c in the Linux     kernel allowed local users to cause a denial of service     (use-after-free and system crash) by making an ioctl     call at a certain time (bnc#967973).

  - CVE-2016-2543: The snd_seq_ioctl_remove_events function     in sound/core/seq/seq_clientmgr.c in the Linux kernel     did not verify FIFO assignment before proceeding with     FIFO clearing, which allowed local users to cause a     denial of service (NULL pointer dereference and OOPS)     via a crafted ioctl call (bnc#967972).

  - CVE-2016-2384: Double free vulnerability in the     snd_usbmidi_create function in sound/usb/midi.c in the     Linux kernel allowed physically proximate attackers to     cause a denial of service (panic) or possibly have     unspecified other impact via vectors involving an     invalid USB descriptor (bnc#966693).

  - CVE-2015-8812: drivers/infiniband/hw/cxgb3/iwch_cm.c in     the Linux kernel did not properly identify error     conditions, which allowed remote attackers to execute     arbitrary code or cause a denial of service     (use-after-free) via crafted packets (bnc#966437).

  - CVE-2015-8785: The fuse_fill_write_pages function in     fs/fuse/file.c in the Linux kernel allowed local users     to cause a denial of service (infinite loop) via a     writev system call that triggers a zero length for the     first segment of an iov (bnc#963765).

  - CVE-2016-2069: Race condition in arch/x86/mm/tlb.c in     the Linux kernel .4.1 allowed local users to gain     privileges by triggering access to a paging structure by     a different CPU (bnc#963767).

  - CVE-2016-0723: Race condition in the tty_ioctl function     in drivers/tty/tty_io.c in the Linux kernel allowed     local users to obtain sensitive information from kernel     memory or cause a denial of service (use-after-free and     system crash) by making a TIOCGETD ioctl call during     processing of a TIOCSETD ioctl call (bnc#961500).

  - CVE-2013-7446: Use-after-free vulnerability in     net/unix/af_unix.c in the Linux kernel allowed local     users to bypass intended AF_UNIX socket permissions or     cause a denial of service (panic) via crafted epoll_ctl     calls (bnc#955654).

  - CVE-2015-8767: net/sctp/sm_sideeffect.c in the Linux     kernel did not properly manage the relationship between     a lock and a socket, which allowed local users to cause     a denial of service (deadlock) via a crafted sctp_accept     call (bnc#961509).

  - CVE-2015-7515: The aiptek_probe function in     drivers/input/tablet/aiptek.c in the Linux kernel     allowed physically proximate attackers to cause a denial     of service (NULL pointer dereference and system crash)     via a crafted USB device that lacks endpoints     (bnc#956708).

  - CVE-2015-8215: net/ipv6/addrconf.c in the IPv6 stack in     the Linux kernel did not validate attempted changes to     the MTU value, which allowed context-dependent attackers     to cause a denial of service (packet loss) via a value     that is (1) smaller than the minimum compliant value or     (2) larger than the MTU of an interface, as demonstrated     by a Router Advertisement (RA) message that is not     validated by a daemon, a different vulnerability than     CVE-2015-0272 (bnc#955354).

  - CVE-2015-7550: The keyctl_read_key function in     security/keys/keyctl.c in the Linux kernel did not     properly use a semaphore, which allowed local users to     cause a denial of service (NULL pointer dereference and     system crash) or possibly have unspecified other impact     via a crafted application that leverages a race     condition between keyctl_revoke and keyctl_read calls     (bnc#958951).

  - CVE-2015-8569: The (1) pptp_bind and (2) pptp_connect     functions in drivers/net/ppp/pptp.c in the Linux kernel     did not verify an address length, which allowed local     users to obtain sensitive information from kernel memory     and bypass the KASLR protection mechanism via a crafted     application (bnc#959190).

  - CVE-2015-8575: The sco_sock_bind function in     net/bluetooth/sco.c in the Linux kernel did not verify     an address length, which allowed local users to obtain     sensitive information from kernel memory and bypass the     KASLR protection mechanism via a crafted application     (bnc#959399).

  - CVE-2015-8543: The networking implementation in the     Linux kernel did not validate protocol identifiers for     certain protocol families, which allowed local users to     cause a denial of service (NULL function pointer     dereference and system crash) or possibly gain     privileges by leveraging CLONE_NEWUSER support to     execute a crafted SOCK_RAW application (bnc#958886).

  - CVE-2015-8539: The KEYS subsystem in the Linux kernel     allowed local users to gain privileges or cause a denial     of service (BUG) via crafted keyctl commands that     negatively instantiate a key, related to     security/keys/encrypted-keys/encrypted.c,     security/keys/trusted.c, and     security/keys/user_defined.c (bnc#958463).

  - CVE-2015-7509: fs/ext4/namei.c in the Linux kernel     allowed physically proximate attackers to cause a denial     of service (system crash) via a crafted no-journal     filesystem, a related issue to CVE-2013-2015     (bnc#956709).

  - CVE-2015-7799: The slhc_init function in     drivers/net/slip/slhc.c in the Linux kernel did not     ensure that certain slot numbers are valid, which     allowed local users to cause a denial of service (NULL     pointer dereference and system crash) via a crafted     PPPIOCSMAXCID ioctl call (bnc#949936).

  - CVE-2015-8104: The KVM subsystem in the Linux kernel     allowed guest OS users to cause a denial of service     (host OS panic or hang) by triggering many #DB (aka     Debug) exceptions, related to svm.c (bnc#954404).

  - CVE-2015-5307: The KVM subsystem in the Linux kernel     allowed guest OS users to cause a denial of service     (host OS panic or hang) by triggering many #AC (aka     Alignment Check) exceptions, related to svm.c and vmx.c     (bnc#953527).

  - CVE-2015-7990: Race condition in the rds_sendmsg     function in net/rds/sendmsg.c in the Linux kernel     allowed local users to cause a denial of service (NULL     pointer dereference and system crash) or possibly have     unspecified other impact by using a socket that was not     properly bound (bnc#952384).

  - CVE-2015-7872: The key_gc_unused_keys function in     security/keys/gc.c in the Linux kernel allowed local     users to cause a denial of service (OOPS) via crafted     keyctl commands (bnc#951440).

  - CVE-2015-6937: The __rds_conn_create function in     net/rds/connection.c in the Linux kernel allowed local     users to cause a denial of service (NULL pointer     dereference and system crash) or possibly have     unspecified other impact by using a socket that was not     properly bound (bnc#945825).

  - CVE-2015-6252: The vhost_dev_ioctl function in     drivers/vhost/vhost.c in the Linux kernel allowed local     users to cause a denial of service (memory consumption)     via a VHOST_SET_LOG_FD ioctl call that triggers     permanent file-descriptor allocation (bnc#942367).

  - CVE-2015-3339: Race condition in the prepare_binprm     function in fs/exec.c in the Linux kernel allowed local     users to gain privileges by executing a setuid program     at a time instant when a chown to root is in progress,     and the ownership is changed but the setuid bit is not     yet stripped (bnc#928130).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 12 kernel was updated to 3.12.60 to receive various security and bugfixes.

The following security bugs were fixed :

  - CVE-2014-9717: fs/namespace.c in the Linux kernel     processes MNT_DETACH umount2 system called without     verifying that the MNT_LOCKED flag is unset, which     allowed local users to bypass intended access     restrictions and navigate to filesystem locations     beneath a mount by calling umount2 within a user     namespace (bnc#928547).

  - CVE-2015-8816: The hub_activate function in     drivers/usb/core/hub.c in the Linux kernel did not     properly maintain a hub-interface data structure, which     allowed physically proximate attackers to cause a denial     of service (invalid memory access and system crash) or     possibly have unspecified other impact by unplugging a     USB hub device (bnc#968010).

  - CVE-2015-8845: The tm_reclaim_thread function in     arch/powerpc/kernel/process.c in the Linux kernel on     powerpc platforms did not ensure that TM suspend mode     exists before proceeding with a tm_reclaim call, which     allowed local users to cause a denial of service (TM Bad     Thing exception and panic) via a crafted application     (bnc#975533).

  - CVE-2016-0758: Fix ASN.1 indefinite length object     parsing (bsc#979867).

  - CVE-2016-2053: The asn1_ber_decoder function in     lib/asn1_decoder.c in the Linux kernel allowed attackers     to cause a denial of service (panic) via an ASN.1 BER     file that lacks a public key, leading to mishandling by     the public_key_verify_signature function in     crypto/asymmetric_keys/public_key.c (bnc#963762).

  - CVE-2016-2143: The fork implementation in the Linux     kernel on s390 platforms mishandled the case of four     page-table levels, which allowed local users to cause a     denial of service (system crash) or possibly have     unspecified other impact via a crafted application,     related to arch/s390/include/asm/mmu_context.h and     arch/s390/include/asm/pgalloc.h. (bnc#970504)

  - CVE-2016-2184: The create_fixed_stream_quirk function in     sound/usb/quirks.c in the snd-usb-audio driver in the     Linux kernel allowed physically proximate attackers to     cause a denial of service (NULL pointer dereference or     double free, and system crash) via a crafted endpoints     value in a USB device descriptor (bnc#971125).

  - CVE-2016-2185: The ati_remote2_probe function in     drivers/input/misc/ati_remote2.c in the Linux kernel     allowed physically proximate attackers to cause a denial     of service (NULL pointer dereference and system crash)     via a crafted endpoints value in a USB device descriptor     (bnc#971124).

  - CVE-2016-2186: The powermate_probe function in     drivers/input/misc/powermate.c in the Linux kernel     allowed physically proximate attackers to cause a denial     of service (NULL pointer dereference and system crash)     via a crafted endpoints value in a USB device descriptor     (bnc#970958).

  - CVE-2016-2188: The iowarrior_probe function in     drivers/usb/misc/iowarrior.c in the Linux kernel allowed     physically proximate attackers to cause a denial of     service (NULL pointer dereference and system crash) via     a crafted endpoints value in a USB device descriptor     (bnc#970956).

  - CVE-2016-2782: The treo_attach function in     drivers/usb/serial/visor.c in the Linux kernel allowed     physically proximate attackers to cause a denial of     service (NULL pointer dereference and system crash) or     possibly have unspecified other impact by inserting a     USB device that lacks a (1) bulk-in or (2) interrupt-in     endpoint (bnc#968670).

  - CVE-2016-2847: fs/pipe.c in the Linux kernel did not     limit the amount of unread data in pipes, which allowed     local users to cause a denial of service (memory     consumption) by creating many pipes with non-default     sizes (bnc#970948).

  - CVE-2016-3134: The netfilter subsystem in the Linux     kernel did not validate certain offset fields, which     allowed local users to gain privileges or cause a denial     of service (heap memory corruption) via an     IPT_SO_SET_REPLACE setsockopt call (bnc#971126).

  - CVE-2016-3136: The mct_u232_msr_to_state function in     drivers/usb/serial/mct_u232.c in the Linux kernel     allowed physically proximate attackers to cause a denial     of service (NULL pointer dereference and system crash)     via a crafted USB device without two interrupt-in     endpoint descriptors (bnc#970955).

  - CVE-2016-3137: drivers/usb/serial/cypress_m8.c in the     Linux kernel allowed physically proximate attackers to     cause a denial of service (NULL pointer dereference and     system crash) via a USB device without both an     interrupt-in and an interrupt-out endpoint descriptor,     related to the cypress_generic_port_probe and     cypress_open functions (bnc#970970).

  - CVE-2016-3138: The acm_probe function in     drivers/usb/class/cdc-acm.c in the Linux kernel allowed     physically proximate attackers to cause a denial of     service (NULL pointer dereference and system crash) via     a USB device without both a control and a data endpoint     descriptor (bnc#970911).

  - CVE-2016-3139: The wacom_probe function in     drivers/input/tablet/wacom_sys.c in the Linux kernel     allowed physically proximate attackers to cause a denial     of service (NULL pointer dereference and system crash)     via a crafted endpoints value in a USB device descriptor     (bnc#970909).

  - CVE-2016-3140: The digi_port_init function in     drivers/usb/serial/digi_acceleport.c in the Linux kernel     allowed physically proximate attackers to cause a denial     of service (NULL pointer dereference and system crash)     via a crafted endpoints value in a USB device descriptor     (bnc#970892).

  - CVE-2016-3156: The IPv4 implementation in the Linux     kernel mishandled destruction of device objects, which     allowed guest OS users to cause a denial of service     (host OS networking outage) by arranging for a large     number of IP addresses (bnc#971360).

  - CVE-2016-3672: The arch_pick_mmap_layout function in     arch/x86/mm/mmap.c in the Linux kernel did not properly     randomize the legacy base address, which made it easier     for local users to defeat the intended restrictions on     the ADDR_NO_RANDOMIZE flag, and bypass the ASLR     protection mechanism for a setuid or setgid program, by     disabling stack-consumption resource limits     (bnc#974308).

  - CVE-2016-3689: The ims_pcu_parse_cdc_data function in     drivers/input/misc/ims-pcu.c in the Linux kernel allowed     physically proximate attackers to cause a denial of     service (system crash) via a USB device without both a     master and a slave interface (bnc#971628).

  - CVE-2016-3951: Double free vulnerability in     drivers/net/usb/cdc_ncm.c in the Linux kernel allowed     physically proximate attackers to cause a denial of     service (system crash) or possibly have unspecified     other impact by inserting a USB device with an invalid     USB descriptor (bnc#974418).

  - CVE-2016-4482: The proc_connectinfo function in     drivers/usb/core/devio.c in the Linux kernel did not     initialize a certain data structure, which allowed local     users to obtain sensitive information from kernel stack     memory via a crafted USBDEVFS_CONNECTINFO ioctl call     (bnc#978401).

  - CVE-2016-4486: The rtnl_fill_link_ifmap function in     net/core/rtnetlink.c in the Linux kernel did not     initialize a certain data structure, which allowed local     users to obtain sensitive information from kernel stack     memory by reading a Netlink message (bnc#978822).

  - CVE-2016-4565: The InfiniBand (aka IB) stack in the     Linux kernel incorrectly relied on the write system     call, which allowed local users to cause a denial of     service (kernel memory write operation) or possibly have     unspecified other impact via a uAPI interface     (bnc#979548).

  - CVE-2016-4569: The snd_timer_user_params function in     sound/core/timer.c in the Linux kernel did not     initialize a certain data structure, which allowed local     users to obtain sensitive information from kernel stack     memory via crafted use of the ALSA timer interface     (bnc#979213).

  - CVE-2016-4578: sound/core/timer.c in the Linux kernel     did not initialize certain r1 data structures, which     allowed local users to obtain sensitive information from     kernel stack memory via crafted use of the ALSA timer     interface, related to the (1) snd_timer_user_ccallback     and (2) snd_timer_user_tinterrupt functions     (bnc#979879).

  - CVE-2016-4805: Use-after-free vulnerability in     drivers/net/ppp/ppp_generic.c in the Linux kernel     allowed local users to cause a denial of service (memory     corruption and system crash, or spinlock) or possibly     have unspecified other impact by removing a network     namespace, related to the ppp_register_net_channel and     ppp_unregister_channel functions (bnc#980371).

  - CVE-2016-5244: Fixed an infoleak in rds_inc_info_copy     (bsc#983213).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes.

Notable changes in this kernel :

  - It is now possible to mount a NFS export on the     exporting host directly.

The following security bugs were fixed :

  - CVE-2016-5244: A kernel information leak in     rds_inc_info_copy was fixed that could leak kernel stack     memory to userspace (bsc#983213).

  - CVE-2016-1583: Prevent the usage of mmap when the lower     file system does not allow it. This could have lead to     local privilege escalation when ecryptfs-utils was     installed and /sbin/mount.ecryptfs_private was setuid     (bsc#983143).

  - CVE-2016-4913: The get_rock_ridge_filename function in     fs/isofs/rock.c in the Linux kernel mishandles NM (aka     alternate name) entries containing \0 characters, which     allowed local users to obtain sensitive information from     kernel memory or possibly have unspecified other impact     via a crafted isofs filesystem (bnc#980725).

  - CVE-2016-4580: The x25_negotiate_facilities function in     net/x25/x25_facilities.c in the Linux kernel did not     properly initialize a certain data structure, which     allowed attackers to obtain sensitive information from     kernel stack memory via an X.25 Call Request     (bnc#981267).

  - CVE-2016-4805: Use-after-free vulnerability in     drivers/net/ppp/ppp_generic.c in the Linux kernel     allowed local users to cause a denial of service (memory     corruption and system crash, or spinlock) or possibly     have unspecified other impact by removing a network     namespace, related to the ppp_register_net_channel and     ppp_unregister_channel functions (bnc#980371).

  - CVE-2016-0758: Tags with indefinite length could have     corrupted pointers in asn1_find_indefinite_length     (bsc#979867).

  - CVE-2016-2187: The gtco_probe function in     drivers/input/tablet/gtco.c in the Linux kernel allowed     physically proximate attackers to cause a denial of     service (NULL pointer dereference and system crash) via     a crafted endpoints value in a USB device descriptor     (bnc#971944).

  - CVE-2016-4482: The proc_connectinfo function in     drivers/usb/core/devio.c in the Linux kernel did not     initialize a certain data structure, which allowed local     users to obtain sensitive information from kernel stack     memory via a crafted USBDEVFS_CONNECTINFO ioctl call     (bnc#978401).

  - CVE-2016-2053: The asn1_ber_decoder function in     lib/asn1_decoder.c in the Linux kernel allowed attackers     to cause a denial of service (panic) via an ASN.1 BER     file that lacks a public key, leading to mishandling by     the public_key_verify_signature function in     crypto/asymmetric_keys/public_key.c (bnc#963762).

  - CVE-2016-4565: The InfiniBand (aka IB) stack in the     Linux kernel incorrectly relies on the write system     call, which allowed local users to cause a denial of     service (kernel memory write operation) or possibly have     unspecified other impact via a uAPI interface     (bnc#979548).

  - CVE-2016-4485: The llc_cmsg_rcv function in     net/llc/af_llc.c in the Linux kernel did not initialize     a certain data structure, which allowed attackers to     obtain sensitive information from kernel stack memory by     reading a message (bnc#978821).

  - CVE-2016-4578: sound/core/timer.c in the Linux kernel     did not initialize certain r1 data structures, which     allowed local users to obtain sensitive information from     kernel stack memory via crafted use of the ALSA timer     interface, related to the (1) snd_timer_user_ccallback     and (2) snd_timer_user_tinterrupt functions     (bnc#979879).

  - CVE-2016-4569: The snd_timer_user_params function in     sound/core/timer.c in the Linux kernel did not     initialize a certain data structure, which allowed local     users to obtain sensitive information from kernel stack     memory via crafted use of the ALSA timer interface     (bnc#979213).

  - CVE-2016-4486: The rtnl_fill_link_ifmap function in     net/core/rtnetlink.c in the Linux kernel did not     initialize a certain data structure, which allowed local     users to obtain sensitive information from kernel stack     memory by reading a Netlink message (bnc#978822).

  - CVE-2016-3134: The netfilter subsystem in the Linux     kernel did not validate certain offset fields, which     allowed local users to gain privileges or cause a denial     of service (heap memory corruption) via an     IPT_SO_SET_REPLACE setsockopt call (bnc#971126).

  - CVE-2016-2847: fs/pipe.c in the Linux kernel did not     limit the amount of unread data in pipes, which allowed     local users to cause a denial of service (memory     consumption) by creating many pipes with non-default     sizes (bnc#970948).

  - CVE-2016-2188: The iowarrior_probe function in     drivers/usb/misc/iowarrior.c in the Linux kernel allowed     physically proximate attackers to cause a denial of     service (NULL pointer dereference and system crash) via     a crafted endpoints value in a USB device descriptor     (bnc#970956).

  - CVE-2016-3138: The acm_probe function in     drivers/usb/class/cdc-acm.c in the Linux kernel allowed     physically proximate attackers to cause a denial of     service (NULL pointer dereference and system crash) via     a USB device without both a control and a data endpoint     descriptor (bnc#970911).

  - CVE-2016-3137: drivers/usb/serial/cypress_m8.c in the     Linux kernel allowed physically proximate attackers to     cause a denial of service (NULL pointer dereference and     system crash) via a USB device without both an     interrupt-in and an interrupt-out endpoint descriptor,     related to the cypress_generic_port_probe and     cypress_open functions (bnc#970970).

  - CVE-2016-3140: The digi_port_init function in     drivers/usb/serial/digi_acceleport.c in the Linux kernel     allowed physically proximate attackers to cause a denial     of service (NULL pointer dereference and system crash)     via a crafted endpoints value in a USB device descriptor     (bnc#970892).

  - CVE-2016-2186: The powermate_probe function in     drivers/input/misc/powermate.c in the Linux kernel     allowed physically proximate attackers to cause a denial     of service (NULL pointer dereference and system crash)     via a crafted endpoints value in a USB device descriptor     (bnc#970958).

  - CVE-2016-2185: The ati_remote2_probe function in     drivers/input/misc/ati_remote2.c in the Linux kernel     allowed physically proximate attackers to cause a denial     of service (NULL pointer dereference and system crash)     via a crafted endpoints value in a USB device descriptor     (bnc#971124).

  - CVE-2016-3156: The IPv4 implementation in the Linux     kernel mishandles destruction of device objects, which     allowed guest OS users to cause a denial of service     (host OS networking outage) by arranging for a large     number of IP addresses (bnc#971360).

  - CVE-2016-2184: The create_fixed_stream_quirk function in     sound/usb/quirks.c in the snd-usb-audio driver in the     Linux kernel allowed physically proximate attackers to     cause a denial of service (NULL pointer dereference or     double free, and system crash) via a crafted endpoints     value in a USB device descriptor (bnc#971125).

  - CVE-2016-3139: The wacom_probe function in     drivers/input/tablet/wacom_sys.c in the Linux kernel     allowed physically proximate attackers to cause a denial     of service (NULL pointer dereference and system crash)     via a crafted endpoints value in a USB device descriptor     (bnc#970909).

  - CVE-2016-2143: The fork implementation in the Linux     kernel on s390 platforms mishandles the case of four     page-table levels, which allowed local users to cause a     denial of service (system crash) or possibly have     unspecified other impact via a crafted application,     related to arch/s390/include/asm/mmu_context.h and     arch/s390/include/asm/pgalloc.h (bnc#970504).

  - CVE-2016-2782: The treo_attach function in     drivers/usb/serial/visor.c in the Linux kernel allowed     physically proximate attackers to cause a denial of     service (NULL pointer dereference and system crash) or     possibly have unspecified other impact by inserting a     USB device that lacks a (1) bulk-in or (2) interrupt-in     endpoint (bnc#968670).

  - CVE-2015-8816: The hub_activate function in     drivers/usb/core/hub.c in the Linux kernel did not     properly maintain a hub-interface data structure, which     allowed physically proximate attackers to cause a denial     of service (invalid memory access and system crash) or     possibly have unspecified other impact by unplugging a     USB hub device (bnc#968010).

  - CVE-2015-7566: The clie_5_attach function in     drivers/usb/serial/visor.c in the Linux kernel allowed     physically proximate attackers to cause a denial of     service (NULL pointer dereference and system crash) or     possibly have unspecified other impact by inserting a     USB device that lacked a bulk-out endpoint (bnc#961512).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

To see the complete list of bug fixes, users are directed to the related Knowledge Article :

Security Fix(es) :

  - A flaw was found in the Linux kernel's keyring handling     code, where in key_reject_and_link() an uninitialised     variable would eventually lead to arbitrary free address     which could allow attacker to use a use-after-free style     attack. (CVE-2016-4470, Important)

  - The ovl_setattr function in fs/overlayfs/inode.c in the     Linux kernel through 4.3.3 attempts to merge distinct     setattr operations, which allows local users to bypass     intended access restrictions and modify the attributes     of arbitrary overlay files via a crafted application.
    (CVE-2015-8660, Moderate)

  - It was reported that on s390x, the fork of a process     with four page table levels will cause memory corruption     with a variety of symptoms. All processes are created     with three level page table and a limit of 4TB for the     address space. If the parent process has four page table     levels with a limit of 8PB, the function that duplicates     the address space will try to copy memory areas outside     of the address space limit for the child process.
    (CVE-2016-2143, Moderate)

Bug Fix(es) :

  - The glibc headers and the Linux headers share certain     definitions of key structures that are required to be     defined in kernel and in userspace. In some instances     both userspace and sanitized kernel headers have to be     included in order to get the structure definitions     required by the user program. Unfortunately because the     glibc and Linux headers don't coordinate this can result     in compilation errors. The glibc headers have therefore     been fixed to coordinate with Linux UAPI-based headers.
    With the header coordination compilation errors no     longer occur.

  - When running the TCP/IPv6 traffic over the mlx4_en     networking interface on the big endian architectures,     call traces reporting about a 'hw csum failure' could     occur. With this update, the mlx4_en driver has been     fixed by correction of the checksum calculation for the     big endian architectures. As a result, the call trace     error no longer appears in the log messages.

  - Under significant load, some applications such as     logshifter could generate bursts of log messages too     large for the system logger to spool. Due to a race     condition, log messages from that application could then     be lost even after the log volume dropped to manageable     levels. This update fixes the kernel mechanism used to     notify the transmitter end of the socket used by the     system logger that more space is available on the     receiver side, removing a race condition which     previously caused the sender to stop transmitting new     messages and allowing all log messages to be processed     correctly.

  - Previously, after heavy open or close of the Accelerator     Function Unit (AFU) contexts, the interrupt packet went     out and the AFU context did not see any interrupts.
    Consequently, a kernel panic could occur. The provided     patch set fixes handling of the interrupt requests, and     kernel panic no longer occurs in the described     situation.

  - net: recvfrom would fail on short buffer.

  - Backport rhashtable changes from upstream.

  - Server Crashing after starting Glusterd &amp; creating     volumes.

  - RAID5 reshape deadlock fix.

  - BDX perf uncore support fix.

An update for kernel is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

These updated kernel packages include several security issues and numerous bug fixes, some of which you can see below. Space precludes documenting all of these bug fixes in this advisory. To see the complete list of bug fixes, users are directed to the related Knowledge Article: https://access.redhat.com/articles/2460971.

Security Fix(es) :

* A flaw was found in the Linux kernel's keyring handling code, where in key_reject_and_link() an uninitialised variable would eventually lead to arbitrary free address which could allow attacker to use a use-after-free style attack. (CVE-2016-4470, Important)

* The ovl_setattr function in fs/overlayfs/inode.c in the Linux kernel through 4.3.3 attempts to merge distinct setattr operations, which allows local users to bypass intended access restrictions and modify the attributes of arbitrary overlay files via a crafted application.
(CVE-2015-8660, Moderate)

* It was reported that on s390x, the fork of a process with four page table levels will cause memory corruption with a variety of symptoms.
All processes are created with three level page table and a limit of 4TB for the address space. If the parent process has four page table levels with a limit of 8PB, the function that duplicates the address space will try to copy memory areas outside of the address space limit for the child process. (CVE-2016-2143, Moderate)

Red Hat would like to thank Nathan Williams for reporting CVE-2015-8660. The CVE-2016-4470 issue was discovered by David Howells (Red Hat Inc.).

Bug Fix(es) :

* The glibc headers and the Linux headers share certain definitions of key structures that are required to be defined in kernel and in userspace. In some instances both userspace and sanitized kernel headers have to be included in order to get the structure definitions required by the user program. Unfortunately because the glibc and Linux headers don't coordinate this can result in compilation errors.
The glibc headers have therefore been fixed to coordinate with Linux UAPI-based headers. With the header coordination compilation errors no longer occur. (BZ#1331285)

* When running the TCP/IPv6 traffic over the mlx4_en networking interface on the big endian architectures, call traces reporting about a 'hw csum failure' could occur. With this update, the mlx4_en driver has been fixed by correction of the checksum calculation for the big endian architectures. As a result, the call trace error no longer appears in the log messages. (BZ#1337431)

* Under significant load, some applications such as logshifter could generate bursts of log messages too large for the system logger to spool. Due to a race condition, log messages from that application could then be lost even after the log volume dropped to manageable levels. This update fixes the kernel mechanism used to notify the transmitter end of the socket used by the system logger that more space is available on the receiver side, removing a race condition which previously caused the sender to stop transmitting new messages and allowing all log messages to be processed correctly. (BZ#1337513)

* Previously, after heavy open or close of the Accelerator Function Unit (AFU) contexts, the interrupt packet went out and the AFU context did not see any interrupts. Consequently, a kernel panic could occur.
The provided patch set fixes handling of the interrupt requests, and kernel panic no longer occurs in the described situation. (BZ#1338886)

* net: recvfrom would fail on short buffer. (BZ#1339115)

* Backport rhashtable changes from upstream. (BZ#1343639)

* Server Crashing after starting Glusterd & creating volumes.
(BZ#1344234)

* RAID5 reshape deadlock fix. (BZ#1344313)

* BDX perf uncore support fix. (BZ#1347374)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:1539 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux     operating system.

    These updated kernel packages include several security issues and numerous     bug fixes, some of which you can see below. Space precludes documenting     all of these bug fixes in this advisory. To see the complete list of bug     fixes, users are directed to the related Knowledge Article:
    https://access.redhat.com/articles/2460971.

    Security Fix(es):

    * A flaw was found in the Linux kernel's keyring handling code, where in     key_reject_and_link() an uninitialised variable would eventually lead to     arbitrary free address which could allow attacker to use a use-after-free     style attack. (CVE-2016-4470, Important)

    * The ovl_setattr function in fs/overlayfs/inode.c in the Linux kernel     through 4.3.3 attempts to merge distinct setattr operations, which allows     local users to bypass intended access restrictions and modify the     attributes of arbitrary overlay files via a crafted application.
    (CVE-2015-8660, Moderate)

    * It was reported that on s390x, the fork of a process with four page table     levels will cause memory corruption with a variety of symptoms. All     processes are created with three level page table and a limit of 4TB for     the address space. If the parent process has four page table levels with a     limit of 8PB, the function that duplicates the address space will try to     copy memory areas outside of the address space limit for the child process.
    (CVE-2016-2143, Moderate)

    Red Hat would like to thank Nathan Williams for reporting CVE-2015-8660.
    The CVE-2016-4470 issue was discovered by David Howells (Red Hat Inc.).

    Bug Fix(es):

    * The glibc headers and the Linux headers share certain definitions of     key structures that are required to be defined in kernel and in userspace.
    In some instances both userspace and sanitized kernel headers have to be     included in order to get the structure definitions required by the user     program. Unfortunately because the glibc and Linux headers don't     coordinate this can result in compilation errors. The glibc headers have     therefore been fixed to coordinate with Linux UAPI-based headers. With     the header coordination compilation errors no longer occur. (BZ#1331285)

    * When running the TCP/IPv6 traffic over the mlx4_en networking interface     on the big endian architectures, call traces reporting about a hw csum     failure could occur. With this update, the mlx4_en driver has been fixed     by correction of the checksum calculation for the big endian     architectures. As a result, the call trace error no longer appears     in the log messages. (BZ#1337431)

    * Under significant load, some applications such as logshifter could     generate bursts of log messages too large for the system logger to spool.
    Due to a race condition, log messages from that application could then be     lost even after the log volume dropped to manageable levels. This update     fixes the kernel mechanism used to notify the transmitter end of the     socket used by the system logger that more space is available on the     receiver side, removing a race condition which previously caused the     sender to stop transmitting new messages and allowing all log messages     to be processed correctly. (BZ#1337513)

    * Previously, after heavy open or close of the Accelerator Function Unit     (AFU) contexts, the interrupt packet went out and the AFU context did not     see any interrupts. Consequently, a kernel panic could occur. The provided     patch set fixes handling of the interrupt requests, and kernel panic no     longer occurs in the described situation. (BZ#1338886)

    * net: recvfrom would fail on short buffer. (BZ#1339115)
    * Backport rhashtable changes from upstream. (BZ#1343639)
    * Server Crashing after starting Glusterd & creating volumes. (BZ#1344234)
    * RAID5 reshape deadlock fix. (BZ#1344313)
    * BDX perf uncore support fix. (BZ#1347374)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-1539 advisory.

    - [security] keys: potential uninitialized variable (David Howells) [1345935 1341352] {CVE-2016-4470}
    - [infiniband] security: Restrict use of the write() interface (Don Dutile) [1332553 1316685]     {CVE-2016-4565}
    - [s390] mm: four page table levels vs. fork (Hendrik Brueckner) [1341547 1308879] {CVE-2016-2143}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks.

  - CVE-2015-7515, CVE-2016-2184, CVE-2016-2185,     CVE-2016-2186, CVE-2016-2187, CVE-2016-3136,     CVE-2016-3137, CVE-2016-3138, CVE-2016-3140     Ralf Spenneberg of OpenSource Security reported that     various USB drivers do not sufficiently validate USB     descriptors. This allowed a physically present user with     a specially designed USB device to cause a denial of     service (crash).

  - CVE-2016-0821     Solar Designer noted that the list 'poisoning' feature,     intended to mitigate the effects of bugs in list     manipulation in the kernel, used poison values within     the range of virtual addresses that can be allocated by     user processes.

  - CVE-2016-1237     David Sinquin discovered that nfsd does not check     permissions when setting ACLs, allowing users to grant     themselves permissions to a file by setting the ACL.

  - CVE-2016-1583     Jann Horn of Google Project Zero reported that the     eCryptfs filesystem could be used together with the proc     filesystem to cause a kernel stack overflow. If the     ecryptfs-utils package is installed, local users could     exploit this, via the mount.ecryptfs_private program,     for denial of service (crash) or possibly for privilege     escalation.

  - CVE-2016-2117     Justin Yackoski of Cryptonite discovered that the     Atheros L2 ethernet driver incorrectly enables     scatter/gather I/O. A remote attacker could take     advantage of this flaw to obtain potentially sensitive     information from kernel memory.

  - CVE-2016-2143     Marcin Koscielnicki discovered that the fork     implementation in the Linux kernel on s390 platforms     mishandles the case of four page-table levels, which     allows local users to cause a denial of service (system     crash).

  - CVE-2016-3070     Jan Stancek of Red Hat discovered a local denial of     service vulnerability in AIO handling.

  - CVE-2016-3134     The Google Project Zero team found that the netfilter     subsystem does not sufficiently validate filter table     entries. A user with the CAP_NET_ADMIN capability could     use this for denial of service (crash) or possibly for     privilege escalation. Debian disables unprivileged user     namespaces by default, if locally enabled with the     kernel.unprivileged_userns_clone sysctl, this allows     privilege escalation.

  - CVE-2016-3156     Solar Designer discovered that the IPv4 implementation     in the Linux kernel did not perform the destruction of     inet device objects properly. An attacker in a guest OS     could use this to cause a denial of service (networking     outage) in the host OS.

  - CVE-2016-3157 / XSA-171     Andy Lutomirski discovered that the x86_64 (amd64) task     switching implementation did not correctly update the     I/O permission level when running as a Xen paravirtual     (PV) guest. In some configurations this would allow     local users to cause a denial of service (crash) or to     escalate their privileges within the guest.

  - CVE-2016-3672     Hector Marco and Ismael Ripoll noted that it was     possible to disable Address Space Layout Randomisation     (ASLR) for x86_32 (i386) programs by removing the stack     resource limit. This made it easier for local users to     exploit security flaws in programs that have the setuid     or setgid flag set.

  - CVE-2016-3951     It was discovered that the cdc_ncm driver would free     memory prematurely if certain errors occurred during its     initialisation. This allowed a physically present user     with a specially designed USB device to cause a denial     of service (crash) or possibly to escalate their     privileges.

  - CVE-2016-3955     Ignat Korchagin reported that the usbip subsystem did     not check the length of data received for a USB buffer.
    This allowed denial of service (crash) or privilege     escalation on a system configured as a usbip client, by     the usbip server or by an attacker able to impersonate     it over the network. A system configured as a usbip     server might be similarly vulnerable to physically     present users.

  - CVE-2016-3961 / XSA-174     Vitaly Kuznetsov of Red Hat discovered that Linux     allowed the use of hugetlbfs on x86 (i386 and amd64)     systems even when running as a Xen paravirtualised (PV)     guest, although Xen does not support huge pages. This     allowed users with access to /dev/hugepages to cause a     denial of service (crash) in the guest.

  - CVE-2016-4470     David Howells of Red Hat discovered that a local user     can trigger a flaw in the Linux kernel's handling of key     lookups in the keychain subsystem, leading to a denial     of service (crash) or possibly to privilege escalation.

  - CVE-2016-4482, CVE-2016-4485, CVE-2016-4486,     CVE-2016-4569, CVE-2016-4578, CVE-2016-4580,     CVE-2016-5243, CVE-2016-5244

    Kangjie Lu reported that the USB devio, llc, rtnetlink,     ALSA timer, x25, tipc, and rds facilities leaked     information from the kernel stack.

  - CVE-2016-4565     Jann Horn of Google Project Zero reported that various     components in the InfiniBand stack implemented unusual     semantics for the write() operation. On a system with     InfiniBand drivers loaded, local users could use this     for denial of service or privilege escalation.

  - CVE-2016-4581     Tycho Andersen discovered that in some situations the     Linux kernel did not handle propagated mounts correctly.
    A local user can take advantage of this flaw to cause a     denial of service (system crash).

  - CVE-2016-4805     Baozeng Ding discovered a use-after-free in the generic     PPP layer in the Linux kernel. A local user can take     advantage of this flaw to cause a denial of service     (system crash), or potentially escalate their     privileges.

  - CVE-2016-4913     Al Viro found that the ISO9660 filesystem implementation     did not correctly count the length of certain invalid     name entries. Reading a directory containing such name     entries would leak information from kernel memory. Users     permitted to mount disks or disk images could use this     to obtain sensitive information.

  - CVE-2016-4997 / CVE-2016-4998     Jesse Hertz and Tim Newsham discovered that missing     input sanitising in Netfilter socket handling may result     in denial of service. Debian disables unprivileged user     namespaces by default, if locally enabled with the     kernel.unprivileged_userns_clone sysctl, this also     allows privilege escalation.

The SUSE Linux Enterprise 11 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

  - CVE-2013-7446: Use-after-free vulnerability in     net/unix/af_unix.c in the Linux kernel allowed local     users to bypass intended AF_UNIX socket permissions or     cause a denial of service (panic) via crafted epoll_ctl     calls (bnc#955654).

  - CVE-2015-7509: fs/ext4/namei.c in the Linux kernel     allowed physically proximate attackers to cause a denial     of service (system crash) via a crafted no-journal     filesystem, a related issue to CVE-2013-2015     (bnc#956707).

  - CVE-2015-7515: An out of bounds memory access in the     aiptek USB driver could be used by physical local     attackers to crash the kernel (bnc#956708).

  - CVE-2015-7550: The keyctl_read_key function in     security/keys/keyctl.c in the Linux kernel did not     properly use a semaphore, which allowed local users to     cause a denial of service (NULL pointer dereference and     system crash) or possibly have unspecified other impact     via a crafted application that leverages a race     condition between keyctl_revoke and keyctl_read calls     (bnc#958951).

  - CVE-2015-7566: A malicious USB device could cause kernel     crashes in the visor device driver (bnc#961512).

  - CVE-2015-7799: The slhc_init function in     drivers/net/slip/slhc.c in the Linux kernel did not     ensure that certain slot numbers are valid, which     allowed local users to cause a denial of service (NULL     pointer dereference and system crash) via a crafted     PPPIOCSMAXCID ioctl call (bnc#949936).

  - CVE-2015-8215: net/ipv6/addrconf.c in the IPv6 stack in     the Linux kernel did not validate attempted changes to     the MTU value, which allowed context-dependent attackers     to cause a denial of service (packet loss) via a value     that is (1) smaller than the minimum compliant value or     (2) larger than the MTU of an interface, as demonstrated     by a Router Advertisement (RA) message that is not     validated by a daemon, a different vulnerability than     CVE-2015-0272. NOTE: the scope of CVE-2015-0272 is     limited to the NetworkManager product (bnc#955354).

  - CVE-2015-8539: The KEYS subsystem in the Linux kernel     allowed local users to gain privileges or cause a denial     of service (BUG) via crafted keyctl commands that     negatively instantiate a key, related to     security/keys/encrypted-keys/encrypted.c,     security/keys/trusted.c, and     security/keys/user_defined.c (bnc#958463).

  - CVE-2015-8543: The networking implementation in the     Linux kernel did not validate protocol identifiers for     certain protocol families, which allowed local users to     cause a denial of service (NULL function pointer     dereference and system crash) or possibly gain     privileges by leveraging CLONE_NEWUSER support to     execute a crafted SOCK_RAW application (bnc#958886).

  - CVE-2015-8550: Optimizations introduced by the compiler     could have lead to double fetch vulnerabilities,     potentially possibly leading to arbitrary code execution     in backend (bsc#957988). (bsc#957988 XSA-155).

  - CVE-2015-8551: The PCI backend driver in Xen, when     running on an x86 system and using Linux as the driver     domain, allowed local guest administrators to hit BUG     conditions and cause a denial of service (NULL pointer     dereference and host OS crash) by leveraging a system     with access to a passed-through MSI or MSI-X capable     physical PCI device and a crafted sequence of     XEN_PCI_OP_* operations, aka 'Linux pciback missing     sanity checks (bnc#957990).

  - CVE-2015-8552: The PCI backend driver in Xen, when     running on an x86 system and using Linux as the driver     domain, allowed local guest administrators to generate a     continuous stream of WARN messages and cause a denial of     service (disk consumption) by leveraging a system with     access to a passed-through MSI or MSI-X capable physical     PCI device and XEN_PCI_OP_enable_msi operations, aka     'Linux pciback missing sanity checks (bnc#957990).

  - CVE-2015-8569: The (1) pptp_bind and (2) pptp_connect     functions in drivers/net/ppp/pptp.c in the Linux kernel     do not verify an address length, which allowed local     users to obtain sensitive information from kernel memory     and bypass the KASLR protection mechanism via a crafted     application (bnc#959190).

  - CVE-2015-8575: The sco_sock_bind function in     net/bluetooth/sco.c in the Linux kernel did not verify     an address length, which allowed local users to obtain     sensitive information from kernel memory and bypass the     KASLR protection mechanism via a crafted application     (bnc#959399).

  - CVE-2015-8767: net/sctp/sm_sideeffect.c in the Linux     kernel did not properly manage the relationship between     a lock and a socket, which allowed local users to cause     a denial of service (deadlock) via a crafted sctp_accept     call (bnc#961509).

  - CVE-2015-8785: The fuse_fill_write_pages function in     fs/fuse/file.c in the Linux kernel allowed local users     to cause a denial of service (infinite loop) via a     writev system call that triggers a zero length for the     first segment of an iov (bnc#963765).

  - CVE-2015-8812: A flaw was found in the CXGB3 kernel     driver when the network was considered congested. The     kernel would incorrectly misinterpret the congestion as     an error condition and incorrectly free/clean up the     skb. When the device would then send the skb's queued,     these structures would be referenced and may panic the     system or allow an attacker to escalate privileges in a     use-after-free scenario.(bsc#966437).

  - CVE-2015-8816: A malicious USB device could cause kernel     crashes in the in hub_activate() function (bnc#968010).

  - CVE-2016-0723: Race condition in the tty_ioctl function     in drivers/tty/tty_io.c in the Linux kernel allowed     local users to obtain sensitive information from kernel     memory or cause a denial of service (use-after-free and     system crash) by making a TIOCGETD ioctl call during     processing of a TIOCSETD ioctl call (bnc#961500).

  - CVE-2016-2069: A race in invalidating paging structures     that were not in use locally could have lead to     disclosoure of information or arbitrary code exectution     (bnc#963767).

  - CVE-2016-2143: On zSeries a fork of a large process     could have caused memory corruption due to incorrect     page table handling. (bnc#970504, LTC#138810).

  - CVE-2016-2184: A malicious USB device could cause kernel     crashes in the alsa usb-audio device driver     (bsc#971125).

  - CVE-2016-2185: A malicious USB device could cause kernel     crashes in the usb_driver_claim_interface function     (bnc#971124).

  - CVE-2016-2186: A malicious USB device could cause kernel     crashes in the powermate device driver (bnc#970958).

  - CVE-2016-2384: A double free on the ALSA umidi object     was fixed. (bsc#966693).

  - CVE-2016-2543: A missing NULL check at remove_events     ioctl in the ALSA seq driver was fixed. (bsc#967972).

  - CVE-2016-2544: Fix race at timer setup and close in the     ALSA seq driver was fixed. (bsc#967973).

  - CVE-2016-2545: A double unlink of active_list in the     ALSA timer driver was fixed. (bsc#967974).

  - CVE-2016-2546: A race among ALSA timer ioctls was fixed     (bsc#967975).

  - CVE-2016-2547,CVE-2016-2548: The ALSA slave timer list     handling was hardened against hangs and races.
    (CVE-2016-2547,CVE-2016-2548,bsc#968011,bsc#968012).

  - CVE-2016-2549: A stall in ALSA hrtimer handling was     fixed (bsc#968013).

  - CVE-2016-2782: A malicious USB device could cause kernel     crashes in the visor device driver (bnc#968670).

  - CVE-2016-3137: A malicious USB device could cause kernel     crashes in the cypress_m8 device driver (bnc#970970).

  - CVE-2016-3139: A malicious USB device could cause kernel     crashes in the wacom device driver (bnc#970909).

  - CVE-2016-3140: A malicious USB device could cause kernel     crashes in the digi_acceleport device driver     (bnc#970892).

  - CVE-2016-3156: A quadratic algorithm could lead to long     kernel ipv4 hangs when removing a device with a large     number of addresses. (bsc#971360).

  - CVE-2016-3955: A remote buffer overflow in the usbip     driver could be used by authenticated attackers to crash     the kernel. (bsc#975945)

  - CVE-2016-2847: A local user could exhaust kernel memory     by pushing lots of data into pipes. (bsc#970948).

  - CVE-2016-2188: A malicious USB device could cause kernel     crashes in the iowarrior device driver (bnc#970956).

  - CVE-2016-3138: A malicious USB device could cause kernel     crashes in the cdc-acm device driver (bnc#970911).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The openSUSE 13.1 kernel was updated to 3.12.57 to receive various security and bugfixes.

The following security bugs were fixed :

  - CVE-2015-8785: The fuse_fill_write_pages function in     fs/fuse/file.c in the Linux kernel allowed local users     to cause a denial of service (infinite loop) via a     writev system call that triggers a zero length for the     first segment of an iov. (bsc#963765)

  - CVE-2015-8551: The PCI backend driver in Xen, when     running on an x86 system and using Linux as the driver     domain, allowed local guest administrators to hit BUG     conditions and cause a denial of service (NULL pointer     dereference and host OS crash) by leveraging a system     with access to a passed-through MSI or MSI-X capable     physical PCI device and a crafted sequence of     XEN_PCI_OP_* operations, aka 'Linux pciback missing     sanity checks (bnc#957990).

  - CVE-2015-8552: The PCI backend driver in Xen, when     running on an x86 system and using Linux as the driver     domain, allowed local guest administrators to generate a     continuous stream of WARN messages and cause a denial of     service (disk consumption) by leveraging a system with     access to a passed-through MSI or MSI-X capable physical     PCI device and XEN_PCI_OP_enable_msi operations, aka     'Linux pciback missing sanity checks (bnc#957990).

  - CVE-2015-8812: A flaw was found in the CXGB3 kernel     driver when the network was considered congested. The     kernel would incorrectly misinterpret the congestion as     an error condition and incorrectly free/clean up the     skb. When the device would then send the skb's queued,     these structures would be referenced and may panic the     system or allow an attacker to escalate privileges in a     use-after-free scenario.(bsc#966437).

  - CVE-2015-8816: A malicious USB device could cause kernel     crashes in the in hub_activate() function (bnc#968010).

  - CVE-2016-0723: Race condition in the tty_ioctl function     in drivers/tty/tty_io.c in the Linux kernel allowed     local users to obtain sensitive information from kernel     memory or cause a denial of service (use-after-free and     system crash) by making a TIOCGETD ioctl call during     processing of a TIOCSETD ioctl call. (bsc#961500)

  - CVE-2016-2184: A malicious USB device could cause kernel     crashes in the alsa usb-audio device driver     (bsc#971125).

  - CVE-2016-2384: A double free on the ALSA umidi object     was fixed. (bsc#966693).

  - CVE-2016-2782: A malicious USB device could cause kernel     crashes in the visor device driver (bnc#968670).

  - CVE-2016-3139: A malicious USB device could cause kernel     crashes in the wacom device driver (bnc#970909).

  - CVE-2016-3156: A quadratic algorithm could lead to long     kernel ipv4 hangs when removing a device with a large     number of addresses. (bsc#971360).

The following non-security bugs were fixed :

  - acl: Fix problem with setting ACL on directories     (bsc#867251).

  - acpi / processor: Introduce apic_id in struct processor     to save parsed APIC id (bsc#959463).

  - alsa: rawmidi: Make snd_rawmidi_transmit() race-free     (bsc#968018).

  - alsa: seq: Fix leak of pool buffer at concurrent writes     (bsc#968018).

  - arm: cubox: Add separate cubox configuration.

  - arm: xen: implement multicall hypercall support.

  - block: xen-blkfront: Fix possible NULL ptr dereference     (bsc#957986 fate#320625).

  -     btrfs-8394-qgroup-Account-data-space-in-more-proper-timi     n.patch: (bsc#963193).

  - btrfs: Add handler for invalidate page (bsc#963193).

  - btrfs: check prepare_uptodate_page() error code earlier     (bnc#966910).

  - btrfs: delayed_ref: Add new function to record reserved     space into delayed ref (bsc#963193).

  - btrfs: delayed_ref: release and free qgroup reserved at     proper timing (bsc#963193).

  - btrfs: extent_io: Introduce needed structure for     recoding set/clear bits (bsc#963193).

  - btrfs: extent_io: Introduce new function     clear_record_extent_bits() (bsc#963193).

  - btrfs: extent_io: Introduce new function     set_record_extent_bits (bsc#963193).

  - btrfs: extent-tree: Add new version of     btrfs_check_data_free_space and     btrfs_free_reserved_data_space (bsc#963193).

  - btrfs: extent-tree: Add new version of     btrfs_delalloc_reserve/release_space (bsc#963193).

  - btrfs: extent-tree: Switch to new check_data_free_space     and free_reserved_data_space (bsc#963193).

  - btrfs: extent-tree: Switch to new delalloc space reserve     and release (bsc#963193).

  - btrfs: fallocate: Add support to accurate qgroup reserve     (bsc#963193).

  - btrfs: fix invalid page accesses in extent_same (dedup)     ioctl (bnc#968230).

  - btrfs: fix page reading in extent_same ioctl leading to     csum errors (bnc#968230).

  - btrfs: fix warning in backref walking (bnc#966278).

  - btrfs: qgroup: Add handler for NOCOW and inline     (bsc#963193).

  - btrfs: qgroup: Add new trace point for qgroup data     reserve (bsc#963193).

  - btrfs: qgroup: Avoid calling     btrfs_free_reserved_data_space in clear_bit_hook     (bsc#963193).

  - btrfs: qgroup: Check if qgroup reserved space leaked     (bsc#963193).

  - btrfs: qgroup: Cleanup old inaccurate facilities     (bsc#963193).

  - btrfs: qgroup: Fix a race in delayed_ref which leads to     abort trans (bsc#963193).

  - btrfs: qgroup: Fix a rebase bug which will cause qgroup     double free (bsc#963193).

  - btrfs: qgroup: Fix dead judgement on     qgroup_rescan_leaf() return value (bsc#969439).

  - btrfs: qgroup: Introduce btrfs_qgroup_reserve_data     function (bsc#963193).

  - btrfs: qgroup: Introduce functions to release/free     qgroup reserve data space (bsc#963193).

  - btrfs: qgroup: Introduce new functions to reserve/free     metadata (bsc#963193).

  - btrfs: qgroup: Use new metadata reservation     (bsc#963193).

  - cpu: Provide smpboot_thread_init() on !CONFIG_SMP     kernels as well.

  - dcache: use IS_ROOT to decide where dentry is hashed     (bsc#949752).

  - dmapi: fix dm_open_by_handle_rvp taking an extra ref to     mnt (bsc#967292).

  - drivers/base/memory.c: fix kernel warning during memory     hotplug on ppc64 (bsc#963827).

  - drivers:hv: Allow for MMIO claims that span ACPI _CRS     records (bnc#965924).

  - drivers:hv: Define the channel type for Hyper-V PCI     Express pass-through (bnc#965924).

  - drivers:hv: Export a function that maps Linux CPU num     onto Hyper-V proc num (bnc#965924).

  - drivers:hv: Export the API to invoke a hypercall on     Hyper-V (bnc#965924).

  - drivers: hv: kvp: fix IP Failover.

  - drivers:pci:hv: New paravirtual PCI front-end for     Hyper-V VMs (bnc#965924).

  - drivers: xen-blkfront: only talk_to_blkback() when in     XenbusStateInitialising (bsc#957986 fate#320625).

  - driver: xen-blkfront: move talk_to_blkback to a more     suitable place (bsc#957986 fate#320625).

  - drm/i915: do not warn if backlight unexpectedly enabled     (boo#972068).

  - drm/i915: set backlight duty cycle after backlight     enable for gen4 (boo#972780).

  - e1000e: Avoid divide by zero error (bsc#968643).

  - e1000e: fix division by zero on jumbo MTUs (bsc#968643).

  - e1000e: Fix tight loop implementation of systime read     algorithm (bsc#968643).

  - fix: print ext4 mountopt data_err=abort correctly     (bsc#969735).

  - fs/proc_namespace.c: simplify testing nsp and     nsp->mnt_ns (bug#963960).

  - futex: Drop refcount if requeue_pi() acquired the     rtmutex (bug#960174).

  - hv: Lock access to hyperv_mmio resource tree     (bnc#965924).

  - hv: Make a function to free mmio regions through vmbus     (bnc#965924).

  - hv: Reverse order of resources in hyperv_mmio     (bnc#965924).

  - hv: Track allocations of children of hv_vmbus in private     resource tree (bnc#965924).

  - hv: Use new vmbus_mmio_free() from client drivers     (bnc#965924).

  - hwmon: (coretemp) Increase maximum core to 128     (bsc#970160)

  - ibmvnic: Fix ibmvnic_capability struct (fate#320253).

  - intel_pstate: Use del_timer_sync in     intel_pstate_cpu_stop (bsc#967650).

  - ipv6: mld: fix add_grhead skb_over_panic for devs with     large MTUs (bsc#956852).

  - kabi: Preserve checksum of kvm_x86_ops (bsc#969112).

  - kABI: protect enum enclosure_component_type.

  - kabi: protect struct acpi_processor signature     (bsc#959463).

  - kABI: protect struct af_alg_type.

  - kABI: protect struct crypto_ahash.

  - kABI: protect struct dm_exception_store_type.

  - kABI: protect struct fib_nh_exception.

  - kABI: protect struct module.

  - kABI: protect struct rq.

  - kABI: protect struct sched_class.

  - kABI: protect struct scm_creds.

  - kABI: protect struct user_struct.

  - kabi/severities :

  - kabi/severities: Fail on changes in kvm_x86_ops, needed     by lttng-modules

  - kgr: fix reversion of a patch already reverted by a     replace_all patch (fate#313296).

  - kvm: SVM: add rdmsr support for AMD event registers     (bsc#968448).

  - kvm: x86: Check dest_map->vector to match eoi signals     for rtc (bsc#966471).

  - kvm: x86: Convert ioapic->rtc_status.dest_map to a     struct (bsc#966471).

  - kvm: x86: store IOAPIC-handled vectors in each VCPU     (bsc#966471).

  - kvm: x86: Track irq vectors in     ioapic->rtc_status.dest_map (bsc#966471).

  - libceph: fix scatterlist last_piece calculation     (bsc#963746).

  - lpfc: Fix kmalloc overflow in LPFC driver at large core     count (bsc#969690).

  - memcg: do not hang on OOM when killed by userspace OOM     access to memory reserves (bnc#969571).

  - mld, igmp: Fix reserved tailroom calculation     (bsc#956852).

  - mmc: Exynos: Add module alias for dw mmc.

  - mvneta: fix per-cpu stats initialization.

  - namespaces: Re-introduce task_nsproxy() helper     (bug#963960).

  - namespaces: Use task_lock and not rcu to protect nsproxy     (bug#963960).

  - net: core: Correct an over-stringent device loop     detection (bsc#945219).

  - net: irda: Fix use-after-free in irtty_open()     (bnc#967903).

  - nfs4: treat lock owners as opaque values (bnc#968141).

  - nfs: Background flush should not be low priority     (bsc#955308).

  - nfsd: fix nfsd_setattr return code for HSM (bsc#969992).

  - nfs: do not use STABLE writes during writeback     (bnc#816099).

  - nfs: Fix handling of re-write-before-commit for mmapped     NFS pages (bsc#964201).

  - nvme: default to 4k device page size (bsc#967047).

  - nvme: special case AEN requests (bsc#965087).

  - omap3isp: fix miscompile.

  - omap: Fix missing cm3xxx.h include.

  - omap: Fix missing usb.h include.

  - pci: Add global pci_lock_rescan_remove() (bnc#965924).

  - pci: allow access to VPD attributes with size 0     (bsc#959146).

  - pciback: Check PF instead of VF for PCI_COMMAND_MEMORY.

  - pciback: Save the number of MSI-X entries to be copied     later.

  - pci: Blacklist vpd access for buggy devices     (bsc#959146).

  - pci: Determine actual VPD size on first access     (bsc#959146).

  - pci: Export symbols required for loadable host driver     modules (bnc#965924).

  - pci: pciehp: Disable link notification across slot reset     (bsc#967651).

  - pci: pciehp: Do not check adapter or latch status while     disabling (bsc#967651).

  - pci: pciehp: Do not disable the link permanently during     removal (bsc#967651).

  - pci: pciehp: Ensure very fast hotplug events are also     processed (bsc#967651).

  - pci: Update VPD definitions (bsc#959146).

  - perf, nmi: Fix unknown NMI warning (bsc#968512).

  - power: Add _GLOBAL_TOC for 32bit.

  - proc: Fix ptrace-based permission checks for accessing     task maps.

  - qla2xxx: Remove unavailable firmware files (bsc#943645).

  - rbd: do not log miscompare as an error (bsc#970062).

  - Refresh     patches.drivers/0005-aacraid-MSI-x-support.patch.
    (boo#970249)

  - resources: Set type in __request_region() (bnc#965924).

  - Revert 'ipv6: tcp: add rcu locking in     tcp_v6_send_synack()' (bnc#961257).

  - rpm/kernel-binary.spec.in: Sync the main and -base     package dependencies (bsc#965830#c51).

  - rpm/kernel-module-subpackage: Fix obsoleting dropped     flavors (bsc#968253)

  - sched: unbreak non-SMP build.

  - scsi_dh_alua: Do not block request queue if workqueue is     active (bsc#960458).

  - scsi: fix soft lockup in scsi_remove_target() on module     removal (bsc#965199).

  - scsi: proper state checking and module refcount handling     in scsi_device_get (boo#966831).

  - series.conf: add section comments

  - supported.conf: Add e1000e (emulated by VMware) to -base     (bsc#968074)

  - supported.conf: Add Hyper-V modules to -base     (bsc#965830)

  - supported.conf: Add isofs to -base (bsc#969655).

  - supported.conf: Add more qemu device driver (bsc#968234)

  - supported.conf: Add mptspi and mptsas to -base     (bsc#968206)

  - supported.conf: Add the qemu scsi driver (sym53c8xx) to
    -base (bsc#967802)

  - supported.conf: Add tulip to -base for Hyper-V     (bsc#968234)

  - supported.conf: Add virtio-rng (bsc#966026)

  - supported.conf: Add xen-blkfront.

  - supported.conf: Add xfs to -base (bsc#965891)

  - supported.conf: Fix usb-common path usb-common moved to     its own subdirectory in kernel v3.16, and we backported     that change to SLE12.

  - sysctl: do not add hardlockup_all_cpu_backtrace sysctl     on UP.

  - tcp: Restore RFC5961-compliant behavior for SYN packets     (bsc#966864).

  - Update config files. Add new option     CONFIG_PARAVIRT_XEN_BLKDEV_FRONTEND to i386 xen and ec2.

  - Update config files. Enable CONFIG_DEBUG_INFO for ec2     flavor. It's overriden on build anyway and having it     disabled causes 'make silentoldconfig' checks fail     because of new symbol CONFIG_DEBUG_INFO_REDUCED.

  - Update config files: enable CONFIG_PCI_HYPERV in non-SLE     configs These are i386/* except xen, ec2 and vanilla and     x86_64 desktop and trace.

  - Update config files: enable MACH_CUBOX in armv7hl/cubox

  - Update config files: ppc and ppc64 are big endian New     config options (not existing in 13.1) need to be set     accordingly.

  - Update     patches.drivers/drm-ast-Initialize-data-needed-to-map-fb     dev-memory.patch (bnc#880007). Fix refs and upstream     status.

  - Update Xen config files (enable upstream block     frontend).

  - Update Xen patches to 3.12.55.

  - USB: ehci-s5p: Fix phy reset.

  - usb: phy: Fix phy-samsung-usb when built as module.

  - usb: Quiet down false peer failure messages     (bnc#960629).

  - x86: export x86_msi (bnc#965924).

  - xen: Add /etc/modprobe.d/50-xen.conf selecting Xen     frontend driver implementation (bsc#957986, bsc#956084,     bsc#961658).

  - xen-blkfront: allow building in our Xen environment     (bsc#957986 fate#320625).

  - xen, blkfront: factor out flush-related checks from     do_blkif_request() (bsc#957986 fate#320625).

  - xen-blkfront: fix accounting of reqs when migrating     (bsc#957986 fate#320625).

  - xen/blkfront: Fix crash if backend does not follow the     right states (bsc#957986 fate#320625).

  - xen-blkfront: improve aproximation of required grants     per request (bsc#957986 fate#320625).

  - xen/blkfront: improve protection against issuing     unsupported REQ_FUA (bsc#957986 fate#320625).

  - xen/blkfront: remove redundant flush_op (bsc#957986     fate#320625).

  - xen-blkfront: remove type check from     blkfront_setup_discard (bsc#957986 fate#320625).

  - xen-blkfront: Silence pfn maybe-uninitialized warning     (bsc#957986 fate#320625).

  - xen: fix blkfront and blkback build with normal xen.

  - xen-vscsi-large-requests: Fix resource collision for     racing request maps and unmaps (bsc#966094).

  - xfs/dmapi: drop lock over synchronous XFS_SEND_DATA     events (bsc#969993).

  - xfs/dmapi: propertly send postcreate event (bsc#967299).

The SUSE Linux Enterprise 12 SP1 kernel was updated to 3.12.57 to receive various security and bugfixes.

The following security bugs were fixed :

  - CVE-2015-8812: A flaw was found in the CXGB3 kernel     driver when the network was considered congested. The     kernel would incorrectly misinterpret the congestion as     an error condition and incorrectly free/clean up the     skb. When the device would then send the skb's queued,     these structures would be referenced and may panic the     system or allow an attacker to escalate privileges in a     use-after-free scenario. (bsc#966437)

  - CVE-2015-8816: A malicious USB device could cause a     kernel crash in the USB hub driver. (bnc#968010).

  - CVE-2016-2143: On zSeries a fork of a large process     could have caused memory corruption due to incorrect     page table handling. (bnc#970504)

  - CVE-2016-2184: A malicious USB device could cause a     kernel crash in the alsa usb-audio driver. (bsc#971125).

  - CVE-2016-2384: A malicious USB device could cause a     kernel crash in the alsa usb-audio driver. (bsc#966693)

  - CVE-2016-2782: A malicious USB device could cause a     kernel crash in the usb visor driver. (bnc#968670).

  - CVE-2016-3139: A malicious USB device could cause a     kernel crash in the wacom driver. (bnc#970909).

  - CVE-2016-3156: Removal of ipv4 interfaces with a large     number of IP addresses was taking very long.
    (bsc#971360).

  - CVE-2015-8709: kernel/ptrace.c in the Linux kernel     mishandled uid and gid mappings, which allowed local     users to gain privileges by establishing a user     namespace, waiting for a root process to enter that     namespace with an unsafe uid or gid, and then using the     ptrace system call. NOTE: the vendor states 'there is no     kernel bug here (bnc#960561).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
95050	Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (20161115)	Nessus	Scientific Linux Local Security Checks	high
94980	CentOS 6 : kernel (CESA-2016:2766)	Nessus	CentOS Local Security Checks	high
94911	RHEL 6 : kernel (RHSA-2016:2766)	Nessus	Red Hat Local Security Checks	high
94908	Oracle Linux 6 : kernel (ELSA-2016-2766)	Nessus	Oracle Linux Local Security Checks	high
93289	SUSE SLES11 Security Update : kernel (SUSE-SU-2016:2074-1)	Nessus	SuSE Local Security Checks	critical
93165	SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2016:1690-1)	Nessus	SuSE Local Security Checks	high
93164	SUSE SLES11 Security Update : kernel (SUSE-SU-2016:1672-1)	Nessus	SuSE Local Security Checks	high
92719	Scientific Linux Security Update : kernel on SL7.x x86_64 (20160802)	Nessus	Scientific Linux Local Security Checks	high
92702	CentOS 7 : kernel (CESA-2016:1539)	Nessus	CentOS Local Security Checks	high
92694	RHEL 7 : kernel (RHSA-2016:1539)	Nessus	Red Hat Local Security Checks	high
92688	Oracle Linux 7 : kernel (ELSA-2016-1539)	Nessus	Oracle Linux Local Security Checks	high
92007	openSUSE Security Update : the Linux Kernel (openSUSE-2016-862)	Nessus	SuSE Local Security Checks	high
91886	Debian DSA-3607-1 : linux - security update	Nessus	Debian Local Security Checks	critical
90884	SUSE SLES11 Security Update : kernel (SUSE-SU-2016:1203-1)	Nessus	SuSE Local Security Checks	critical
90783	openSUSE Security Update : the Linux Kernel (openSUSE-2016-518)	Nessus	SuSE Local Security Checks	critical
90531	SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2016:1019-1)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2016-2143

high

Tenable Plugins

high

high

high

high

critical

high

high

high

high

high

high

high

critical

critical

critical

critical