openSUSE Security Update : the Linux Kernel (openSUSE-2016-518)

This script is Copyright (C) 2016-2017 Tenable Network Security, Inc.

Synopsis :

The remote openSUSE host is missing a security update.

Description :

The openSUSE 13.1 kernel was updated to 3.12.57 to receive various
security and bugfixes.

The following security bugs were fixed :

- CVE-2015-8785: The fuse_fill_write_pages function in
fs/fuse/file.c in the Linux kernel allowed local users
to cause a denial of service (infinite loop) via a
writev system call that triggers a zero length for the
first segment of an iov. (bsc#963765)

- CVE-2015-8551: The PCI backend driver in Xen, when
running on an x86 system and using Linux as the driver
domain, allowed local guest administrators to hit BUG
conditions and cause a denial of service (NULL pointer
dereference and host OS crash) by leveraging a system
with access to a passed-through MSI or MSI-X capable
physical PCI device and a crafted sequence of
XEN_PCI_OP_* operations, aka 'Linux pciback missing
sanity checks (bnc#957990).

- CVE-2015-8552: The PCI backend driver in Xen, when
running on an x86 system and using Linux as the driver
domain, allowed local guest administrators to generate a
continuous stream of WARN messages and cause a denial of
service (disk consumption) by leveraging a system with
access to a passed-through MSI or MSI-X capable physical
PCI device and XEN_PCI_OP_enable_msi operations, aka
'Linux pciback missing sanity checks (bnc#957990).

- CVE-2015-8812: A flaw was found in the CXGB3 kernel
driver when the network was considered congested. The
kernel would incorrectly misinterpret the congestion as
an error condition and incorrectly free/clean up the
skb. When the device would then send the skb's queued,
these structures would be referenced and may panic the
system or allow an attacker to escalate privileges in a
use-after-free scenario.(bsc#966437).

- CVE-2015-8816: A malicious USB device could cause kernel
crashes in the in hub_activate() function (bnc#968010).

- CVE-2016-0723: Race condition in the tty_ioctl function
in drivers/tty/tty_io.c in the Linux kernel allowed
local users to obtain sensitive information from kernel
memory or cause a denial of service (use-after-free and
system crash) by making a TIOCGETD ioctl call during
processing of a TIOCSETD ioctl call. (bsc#961500)

- CVE-2016-2184: A malicious USB device could cause kernel
crashes in the alsa usb-audio device driver

- CVE-2016-2384: A double free on the ALSA umidi object
was fixed. (bsc#966693).

- CVE-2016-2782: A malicious USB device could cause kernel
crashes in the visor device driver (bnc#968670).

- CVE-2016-3139: A malicious USB device could cause kernel
crashes in the wacom device driver (bnc#970909).

- CVE-2016-3156: A quadratic algorithm could lead to long
kernel ipv4 hangs when removing a device with a large
number of addresses. (bsc#971360).

The following non-security bugs were fixed :

- acl: Fix problem with setting ACL on directories

- acpi / processor: Introduce apic_id in struct processor
to save parsed APIC id (bsc#959463).

- alsa: rawmidi: Make snd_rawmidi_transmit() race-free

- alsa: seq: Fix leak of pool buffer at concurrent writes

- arm: cubox: Add separate cubox configuration.

- arm: xen: implement multicall hypercall support.

- block: xen-blkfront: Fix possible NULL ptr dereference
(bsc#957986 fate#320625).

n.patch: (bsc#963193).

- btrfs: Add handler for invalidate page (bsc#963193).

- btrfs: check prepare_uptodate_page() error code earlier

- btrfs: delayed_ref: Add new function to record reserved
space into delayed ref (bsc#963193).

- btrfs: delayed_ref: release and free qgroup reserved at
proper timing (bsc#963193).

- btrfs: extent_io: Introduce needed structure for
recoding set/clear bits (bsc#963193).

- btrfs: extent_io: Introduce new function
clear_record_extent_bits() (bsc#963193).

- btrfs: extent_io: Introduce new function
set_record_extent_bits (bsc#963193).

- btrfs: extent-tree: Add new version of
btrfs_check_data_free_space and
btrfs_free_reserved_data_space (bsc#963193).

- btrfs: extent-tree: Add new version of
btrfs_delalloc_reserve/release_space (bsc#963193).

- btrfs: extent-tree: Switch to new check_data_free_space
and free_reserved_data_space (bsc#963193).

- btrfs: extent-tree: Switch to new delalloc space reserve
and release (bsc#963193).

- btrfs: fallocate: Add support to accurate qgroup reserve

- btrfs: fix invalid page accesses in extent_same (dedup)
ioctl (bnc#968230).

- btrfs: fix page reading in extent_same ioctl leading to
csum errors (bnc#968230).

- btrfs: fix warning in backref walking (bnc#966278).

- btrfs: qgroup: Add handler for NOCOW and inline

- btrfs: qgroup: Add new trace point for qgroup data
reserve (bsc#963193).

- btrfs: qgroup: Avoid calling
btrfs_free_reserved_data_space in clear_bit_hook

- btrfs: qgroup: Check if qgroup reserved space leaked

- btrfs: qgroup: Cleanup old inaccurate facilities

- btrfs: qgroup: Fix a race in delayed_ref which leads to
abort trans (bsc#963193).

- btrfs: qgroup: Fix a rebase bug which will cause qgroup
double free (bsc#963193).

- btrfs: qgroup: Fix dead judgement on
qgroup_rescan_leaf() return value (bsc#969439).

- btrfs: qgroup: Introduce btrfs_qgroup_reserve_data
function (bsc#963193).

- btrfs: qgroup: Introduce functions to release/free
qgroup reserve data space (bsc#963193).

- btrfs: qgroup: Introduce new functions to reserve/free
metadata (bsc#963193).

- btrfs: qgroup: Use new metadata reservation

- cpu: Provide smpboot_thread_init() on !CONFIG_SMP
kernels as well.

- dcache: use IS_ROOT to decide where dentry is hashed

- dmapi: fix dm_open_by_handle_rvp taking an extra ref to
mnt (bsc#967292).

- drivers/base/memory.c: fix kernel warning during memory
hotplug on ppc64 (bsc#963827).

- drivers:hv: Allow for MMIO claims that span ACPI _CRS
records (bnc#965924).

- drivers:hv: Define the channel type for Hyper-V PCI
Express pass-through (bnc#965924).

- drivers:hv: Export a function that maps Linux CPU num
onto Hyper-V proc num (bnc#965924).

- drivers:hv: Export the API to invoke a hypercall on
Hyper-V (bnc#965924).

- drivers: hv: kvp: fix IP Failover.

- drivers:pci:hv: New paravirtual PCI front-end for
Hyper-V VMs (bnc#965924).

- drivers: xen-blkfront: only talk_to_blkback() when in
XenbusStateInitialising (bsc#957986 fate#320625).

- driver: xen-blkfront: move talk_to_blkback to a more
suitable place (bsc#957986 fate#320625).

- drm/i915: do not warn if backlight unexpectedly enabled

- drm/i915: set backlight duty cycle after backlight
enable for gen4 (boo#972780).

- e1000e: Avoid divide by zero error (bsc#968643).

- e1000e: fix division by zero on jumbo MTUs (bsc#968643).

- e1000e: Fix tight loop implementation of systime read
algorithm (bsc#968643).

- fix: print ext4 mountopt data_err=abort correctly

- fs/proc_namespace.c: simplify testing nsp and
nsp->mnt_ns (bug#963960).

- futex: Drop refcount if requeue_pi() acquired the
rtmutex (bug#960174).

- hv: Lock access to hyperv_mmio resource tree

- hv: Make a function to free mmio regions through vmbus

- hv: Reverse order of resources in hyperv_mmio

- hv: Track allocations of children of hv_vmbus in private
resource tree (bnc#965924).

- hv: Use new vmbus_mmio_free() from client drivers

- hwmon: (coretemp) Increase maximum core to 128

- ibmvnic: Fix ibmvnic_capability struct (fate#320253).

- intel_pstate: Use del_timer_sync in
intel_pstate_cpu_stop (bsc#967650).

- ipv6: mld: fix add_grhead skb_over_panic for devs with
large MTUs (bsc#956852).

- kabi: Preserve checksum of kvm_x86_ops (bsc#969112).

- kABI: protect enum enclosure_component_type.

- kabi: protect struct acpi_processor signature

- kABI: protect struct af_alg_type.

- kABI: protect struct crypto_ahash.

- kABI: protect struct dm_exception_store_type.

- kABI: protect struct fib_nh_exception.

- kABI: protect struct module.

- kABI: protect struct rq.

- kABI: protect struct sched_class.

- kABI: protect struct scm_creds.

- kABI: protect struct user_struct.

- kabi/severities :

- kabi/severities: Fail on changes in kvm_x86_ops, needed
by lttng-modules

- kgr: fix reversion of a patch already reverted by a
replace_all patch (fate#313296).

- kvm: SVM: add rdmsr support for AMD event registers

- kvm: x86: Check dest_map->vector to match eoi signals
for rtc (bsc#966471).

- kvm: x86: Convert ioapic->rtc_status.dest_map to a
struct (bsc#966471).

- kvm: x86: store IOAPIC-handled vectors in each VCPU

- kvm: x86: Track irq vectors in
ioapic->rtc_status.dest_map (bsc#966471).

- libceph: fix scatterlist last_piece calculation

- lpfc: Fix kmalloc overflow in LPFC driver at large core
count (bsc#969690).

- memcg: do not hang on OOM when killed by userspace OOM
access to memory reserves (bnc#969571).

- mld, igmp: Fix reserved tailroom calculation

- mmc: Exynos: Add module alias for dw mmc.

- mvneta: fix per-cpu stats initialization.

- namespaces: Re-introduce task_nsproxy() helper

- namespaces: Use task_lock and not rcu to protect nsproxy

- net: core: Correct an over-stringent device loop
detection (bsc#945219).

- net: irda: Fix use-after-free in irtty_open()

- nfs4: treat lock owners as opaque values (bnc#968141).

- nfs: Background flush should not be low priority

- nfsd: fix nfsd_setattr return code for HSM (bsc#969992).

- nfs: do not use STABLE writes during writeback

- nfs: Fix handling of re-write-before-commit for mmapped
NFS pages (bsc#964201).

- nvme: default to 4k device page size (bsc#967047).

- nvme: special case AEN requests (bsc#965087).

- omap3isp: fix miscompile.

- omap: Fix missing cm3xxx.h include.

- omap: Fix missing usb.h include.

- pci: Add global pci_lock_rescan_remove() (bnc#965924).

- pci: allow access to VPD attributes with size 0

- pciback: Check PF instead of VF for PCI_COMMAND_MEMORY.

- pciback: Save the number of MSI-X entries to be copied

- pci: Blacklist vpd access for buggy devices

- pci: Determine actual VPD size on first access

- pci: Export symbols required for loadable host driver
modules (bnc#965924).

- pci: pciehp: Disable link notification across slot reset

- pci: pciehp: Do not check adapter or latch status while
disabling (bsc#967651).

- pci: pciehp: Do not disable the link permanently during
removal (bsc#967651).

- pci: pciehp: Ensure very fast hotplug events are also
processed (bsc#967651).

- pci: Update VPD definitions (bsc#959146).

- perf, nmi: Fix unknown NMI warning (bsc#968512).

- power: Add _GLOBAL_TOC for 32bit.

- proc: Fix ptrace-based permission checks for accessing
task maps.

- qla2xxx: Remove unavailable firmware files (bsc#943645).

- rbd: do not log miscompare as an error (bsc#970062).

- Refresh

- resources: Set type in __request_region() (bnc#965924).

- Revert 'ipv6: tcp: add rcu locking in
tcp_v6_send_synack()' (bnc#961257).

- rpm/ Sync the main and -base
package dependencies (bsc#965830#c51).

- rpm/kernel-module-subpackage: Fix obsoleting dropped
flavors (bsc#968253)

- sched: unbreak non-SMP build.

- scsi_dh_alua: Do not block request queue if workqueue is
active (bsc#960458).

- scsi: fix soft lockup in scsi_remove_target() on module
removal (bsc#965199).

- scsi: proper state checking and module refcount handling
in scsi_device_get (boo#966831).

- series.conf: add section comments

- supported.conf: Add e1000e (emulated by VMware) to -base

- supported.conf: Add Hyper-V modules to -base

- supported.conf: Add isofs to -base (bsc#969655).

- supported.conf: Add more qemu device driver (bsc#968234)

- supported.conf: Add mptspi and mptsas to -base

- supported.conf: Add the qemu scsi driver (sym53c8xx) to
-base (bsc#967802)

- supported.conf: Add tulip to -base for Hyper-V

- supported.conf: Add virtio-rng (bsc#966026)

- supported.conf: Add xen-blkfront.

- supported.conf: Add xfs to -base (bsc#965891)

- supported.conf: Fix usb-common path usb-common moved to
its own subdirectory in kernel v3.16, and we backported
that change to SLE12.

- sysctl: do not add hardlockup_all_cpu_backtrace sysctl
on UP.

- tcp: Restore RFC5961-compliant behavior for SYN packets

- Update config files. Add new option

- Update config files. Enable CONFIG_DEBUG_INFO for ec2
flavor. It's overriden on build anyway and having it
disabled causes 'make silentoldconfig' checks fail
because of new symbol CONFIG_DEBUG_INFO_REDUCED.

- Update config files: enable CONFIG_PCI_HYPERV in non-SLE
configs These are i386/* except xen, ec2 and vanilla and
x86_64 desktop and trace.

- Update config files: enable MACH_CUBOX in armv7hl/cubox

- Update config files: ppc and ppc64 are big endian New
config options (not existing in 13.1) need to be set

- Update
dev-memory.patch (bnc#880007). Fix refs and upstream

- Update Xen config files (enable upstream block

- Update Xen patches to 3.12.55.

- USB: ehci-s5p: Fix phy reset.

- usb: phy: Fix phy-samsung-usb when built as module.

- usb: Quiet down false peer failure messages

- x86: export x86_msi (bnc#965924).

- xen: Add /etc/modprobe.d/50-xen.conf selecting Xen
frontend driver implementation (bsc#957986, bsc#956084,

- xen-blkfront: allow building in our Xen environment
(bsc#957986 fate#320625).

- xen, blkfront: factor out flush-related checks from
do_blkif_request() (bsc#957986 fate#320625).

- xen-blkfront: fix accounting of reqs when migrating
(bsc#957986 fate#320625).

- xen/blkfront: Fix crash if backend does not follow the
right states (bsc#957986 fate#320625).

- xen-blkfront: improve aproximation of required grants
per request (bsc#957986 fate#320625).

- xen/blkfront: improve protection against issuing
unsupported REQ_FUA (bsc#957986 fate#320625).

- xen/blkfront: remove redundant flush_op (bsc#957986

- xen-blkfront: remove type check from
blkfront_setup_discard (bsc#957986 fate#320625).

- xen-blkfront: Silence pfn maybe-uninitialized warning
(bsc#957986 fate#320625).

- xen: fix blkfront and blkback build with normal xen.

- xen-vscsi-large-requests: Fix resource collision for
racing request maps and unmaps (bsc#966094).

- xfs/dmapi: drop lock over synchronous XFS_SEND_DATA
events (bsc#969993).

- xfs/dmapi: propertly send postcreate event (bsc#967299).

See also :

Solution :

Update the affected the Linux Kernel packages.

Risk factor :

Critical / CVSS Base Score : 10.0
Public Exploit Available : true

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now