SUSE SLES11 Security Update : kernel (SUSE-SU-2014:1105-1)

This script is Copyright (C) 2015-2017 Tenable Network Security, Inc.


Synopsis :

The remote SUSE host is missing one or more security updates.

Description :

The SUSE Linux Enterprise Server 11 SP2 LTSS received a roll up update
to fix several security and non-security issues.

The following security issues have been fixed :

- CVE-2014-0055: The get_rx_bufs function in
drivers/vhost/net.c in the vhost-net subsystem in the
Linux kernel package before 2.6.32-431.11.2 on Red Hat
Enterprise Linux (RHEL) 6 does not properly handle
vhost_get_vq_desc errors, which allows guest OS users to
cause a denial of service (host OS crash) via
unspecified vectors. (bnc#870173)

- CVE-2014-0077: drivers/vhost/net.c in the Linux kernel
before 3.13.10, when mergeable buffers are disabled,
does not properly validate packet lengths, which allows
guest OS users to cause a denial of service (memory
corruption and host OS crash) or possibly gain
privileges on the host OS via crafted packets, related
to the handle_rx and get_rx_bufs functions. (bnc#870576)

- CVE-2014-1739: The media_device_enum_entities function
in drivers/media/media-device.c in the Linux kernel
before 3.14.6 does not initialize a certain data
structure, which allows local users to obtain sensitive
information from kernel memory by leveraging /dev/media0
read access for a MEDIA_IOC_ENUM_ENTITIES ioctl call.
(bnc#882804)

- CVE-2014-2706: Race condition in the mac80211 subsystem
in the Linux kernel before 3.13.7 allows remote
attackers to cause a denial of service (system crash)
via network traffic that improperly interacts with the
WLAN_STA_PS_STA state (aka power-save mode), related to
sta_info.c and tx.c. (bnc#871797)

- CVE-2014-2851: Integer overflow in the ping_init_sock
function in net/ipv4/ping.c in the Linux kernel through
3.14.1 allows local users to cause a denial of service
(use-after-free and system crash) or possibly gain
privileges via a crafted application that leverages an
improperly managed reference counter. (bnc#873374)

- CVE-2014-3144: The (1) BPF_S_ANC_NLATTR and (2)
BPF_S_ANC_NLATTR_NEST extension implementations in the
sk_run_filter function in net/core/filter.c in the Linux
kernel through 3.14.3 do not check whether a certain
length value is sufficiently large, which allows local
users to cause a denial of service (integer underflow
and system crash) via crafted BPF instructions. NOTE:
the affected code was moved to the __skb_get_nlattr and
__skb_get_nlattr_nest functions before the vulnerability
was announced. (bnc#877257)

- CVE-2014-3145: The BPF_S_ANC_NLATTR_NEST extension
implementation in the sk_run_filter function in
net/core/filter.c in the Linux kernel through 3.14.3
uses the reverse order in a certain subtraction, which
allows local users to cause a denial of service
(over-read and system crash) via crafted BPF
instructions. NOTE: the affected code was moved to the
__skb_get_nlattr_nest function before the vulnerability
was announced. (bnc#877257)

- CVE-2014-3917: kernel/auditsc.c in the Linux kernel
through 3.14.5, when CONFIG_AUDITSYSCALL is enabled with
certain syscall rules, allows local users to obtain
potentially sensitive single-bit values from kernel
memory or cause a denial of service (OOPS) via a large
value of a syscall number. (bnc#880484)

- CVE-2014-4508: arch/x86/kernel/entry_32.S in the Linux
kernel through 3.15.1 on 32-bit x86 platforms, when
syscall auditing is enabled and the sep CPU feature flag
is set, allows local users to cause a denial of service
(OOPS and system crash) via an invalid syscall number,
as demonstrated by number 1000. (bnc#883724)

- CVE-2014-4652: Race condition in the tlv handler
functionality in the snd_ctl_elem_user_tlv function in
sound/core/control.c in the ALSA control implementation
in the Linux kernel before 3.15.2 allows local users to
obtain sensitive information from kernel memory by
leveraging /dev/snd/controlCX access. (bnc#883795)

- CVE-2014-4653: sound/core/control.c in the ALSA control
implementation in the Linux kernel before 3.15.2 does
not ensure possession of a read/write lock, which allows
local users to cause a denial of service
(use-after-free) and obtain sensitive information from
kernel memory by leveraging /dev/snd/controlCX access.
(bnc#883795)

- CVE-2014-4654: The snd_ctl_elem_add function in
sound/core/control.c in the ALSA control implementation
in the Linux kernel before 3.15.2 does not check
authorization for SNDRV_CTL_IOCTL_ELEM_REPLACE commands,
which allows local users to remove kernel controls and
cause a denial of service (use-after-free and system
crash) by leveraging /dev/snd/controlCX access for an
ioctl call. (bnc#883795)

- CVE-2014-4655: The snd_ctl_elem_add function in
sound/core/control.c in the ALSA control implementation
in the Linux kernel before 3.15.2 does not properly
maintain the user_ctl_count value, which allows local
users to cause a denial of service (integer overflow and
limit bypass) by leveraging /dev/snd/controlCX access
for a large number of SNDRV_CTL_IOCTL_ELEM_REPLACE ioctl
calls. (bnc#883795)

- CVE-2014-4656: Multiple integer overflows in
sound/core/control.c in the ALSA control implementation
in the Linux kernel before 3.15.2 allow local users to
cause a denial of service by leveraging
/dev/snd/controlCX access, related to (1) index values
in the snd_ctl_add function and (2) numid values in the
snd_ctl_remove_numid_conflict function. (bnc#883795)

- CVE-2014-4667: The sctp_association_free function in
net/sctp/associola.c in the Linux kernel before 3.15.2
does not properly manage a certain backlog value, which
allows remote attackers to cause a denial of service
(socket outage) via a crafted SCTP packet. (bnc#885422)

- CVE-2014-4699: The Linux kernel before 3.15.4 on Intel
processors does not properly restrict use of a
non-canonical value for the saved RIP address in the
case of a system call that does not use IRET, which
allows local users to leverage a race condition and gain
privileges, or cause a denial of service (double fault),
via a crafted application that makes ptrace and fork
system calls. (bnc#885725)

- CVE-2014-5077: The sctp_assoc_update function in
net/sctp/associola.c in the Linux kernel through 3.15.8,
when SCTP authentication is enabled, allows remote
attackers to cause a denial of service (NULL pointer
dereference and OOPS) by starting to establish an
association between two endpoints immediately after an
exchange of INIT and INIT ACK chunks to establish an
earlier association between these endpoints in the
opposite direction. (bnc#889173)

- CVE-2013-4299: Interpretation conflict in
drivers/md/dm-snap-persistent.c in the Linux kernel
through 3.11.6 allows remote authenticated users to
obtain sensitive information or modify data via a
crafted mapping to a snapshot block device. (bnc#846404)

The following bugs have been fixed :

- pagecachelimit: reduce lru_lock contention for heavy
parallel reclaim (bnc#878509, bnc#864464).

- pagecachelimit: reduce lru_lock contention for heavy
parallel reclaim kabi fixup (bnc#878509, bnc#864464).

- ACPI / PAD: call schedule() when need_resched() is true
(bnc#866911).

- kabi: Fix breakage due to addition of user_ctl_lock
(bnc#883795).

- cpuset: Fix memory allocator deadlock (bnc#876590).

- tcp: allow to disable cwnd moderation in TCP_CA_Loss
state (bnc#879921).

- tcp: adapt selected parts of RFC 5682 and PRR logic
(bnc#879921).

- vlan: more careful checksum features handling
(bnc#872634).

- bonding: fix vlan_features computing (bnc#872634).

- NFSv4: Minor cleanups for nfs4_handle_exception and
nfs4_async_handle_error (bnc#889324).

- NFS: Do not lose sockets when nfsd shutdown races with
connection timeout (bnc#871854).

- reiserfs: call truncate_setsize under tailpack mutex
(bnc#878115).

- reiserfs: drop vmtruncate (bnc#878115).

- megaraid_sas: mask off flags in ioctl path (bnc#886474).

- block: fix race between request completion and timeout
handling (bnc#881051).

- drivers/rtc/interface.c: fix infinite loop in
initializing the alarm (bnc#871676).

- xfrm: check peer pointer for null before calling
inet_putpeer() (bnc#877775).

- supported.conf: Add firewire/nosy as supported. This
driver is the replacement for the ieee1394/pcilynx
driver, which was supported.

Note that Tenable Network Security has extracted the preceding
description block directly from the SUSE security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues.

See also :

http://www.nessus.org/u?dfd31720
http://www.nessus.org/u?ad2400ab
http://www.nessus.org/u?ae0fa787
http://www.nessus.org/u?accb227f
http://www.nessus.org/u?e9ff4392
http://www.nessus.org/u?90630f72
http://support.novell.com/security/cve/CVE-2013-4299.html
http://support.novell.com/security/cve/CVE-2014-0055.html
http://support.novell.com/security/cve/CVE-2014-0077.html
http://support.novell.com/security/cve/CVE-2014-1739.html
http://support.novell.com/security/cve/CVE-2014-2706.html
http://support.novell.com/security/cve/CVE-2014-2851.html
http://support.novell.com/security/cve/CVE-2014-3144.html
http://support.novell.com/security/cve/CVE-2014-3145.html
http://support.novell.com/security/cve/CVE-2014-3917.html
http://support.novell.com/security/cve/CVE-2014-4508.html
http://support.novell.com/security/cve/CVE-2014-4652.html
http://support.novell.com/security/cve/CVE-2014-4653.html
http://support.novell.com/security/cve/CVE-2014-4654.html
http://support.novell.com/security/cve/CVE-2014-4655.html
http://support.novell.com/security/cve/CVE-2014-4656.html
http://support.novell.com/security/cve/CVE-2014-4667.html
http://support.novell.com/security/cve/CVE-2014-4699.html
http://support.novell.com/security/cve/CVE-2014-5077.html
https://bugzilla.novell.com/846404
https://bugzilla.novell.com/864464
https://bugzilla.novell.com/866911
https://bugzilla.novell.com/870173
https://bugzilla.novell.com/870576
https://bugzilla.novell.com/871676
https://bugzilla.novell.com/871797
https://bugzilla.novell.com/871854
https://bugzilla.novell.com/872634
https://bugzilla.novell.com/873374
https://bugzilla.novell.com/876590
https://bugzilla.novell.com/877257
https://bugzilla.novell.com/877775
https://bugzilla.novell.com/878115
https://bugzilla.novell.com/878509
https://bugzilla.novell.com/879921
https://bugzilla.novell.com/880484
https://bugzilla.novell.com/881051
https://bugzilla.novell.com/882804
https://bugzilla.novell.com/883724
https://bugzilla.novell.com/883795
https://bugzilla.novell.com/885422
https://bugzilla.novell.com/885725
https://bugzilla.novell.com/886474
https://bugzilla.novell.com/889173
https://bugzilla.novell.com/889324
http://www.nessus.org/u?b3e6f666

Solution :

To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product :

SUSE Linux Enterprise Server 11 SP2 LTSS :

zypper in -t patch slessp2-kernel-9630 slessp2-kernel-9631
slessp2-kernel-9632

To bring your system up-to-date, use 'zypper patch'.

Risk factor :

High / CVSS Base Score : 7.1
(CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:C)
CVSS Temporal Score : 6.2
(CVSS2#E:ND/RL:OF/RC:C)
Public Exploit Available : true