SUSE SLES11 Security Update : kernel (SUSE-SU-2017:1301-1)

High Nessus Plugin ID 100214

Synopsis

The remote SUSE host is missing one or more security updates.

Description

The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes. Notable new features :

- Toleration of newer crypto hardware for z Systems

- USB 2.0 Link power management for Haswell-ULT The following security bugs were fixed :

- CVE-2017-7308: The packet_set_ring function in net/packet/af_packet.c in the Linux kernel did not properly validate certain block-size data, which allowed local users to cause a denial of service (overflow) or possibly have unspecified other impact via crafted system calls (bnc#1031579)

- CVE-2017-2671: The ping_unhash function in net/ipv4/ping.c in the Linux kernel was too late in obtaining a certain lock and consequently could not ensure that disconnect function calls are safe, which allowed local users to cause a denial of service (panic) by leveraging access to the protocol value of IPPROTO_ICMP in a socket system call (bnc#1031003)

- CVE-2017-7184: The xfrm_replay_verify_len function in net/xfrm/xfrm_user.c in the Linux kernel did not validate certain size data after an XFRM_MSG_NEWAE update, which allowed local users to obtain root privileges or cause a denial of service (heap-based out-of-bounds access) by leveraging the CAP_NET_ADMIN capability (bsc#1030573).

- CVE-2017-5970: The ipv4_pktinfo_prepare function in net/ipv4/ip_sockglue.c in the Linux kernel allowed attackers to cause a denial of service (system crash) via (1) an application that made crafted system calls or possibly (2) IPv4 traffic with invalid IP options (bsc#1024938).

- CVE-2017-7616: Incorrect error handling in the set_mempolicy and mbind compat syscalls in mm/mempolicy.c in the Linux kernel allowed local users to obtain sensitive information from uninitialized stack data by triggering failure of a certain bitmap operation (bsc#1033336).

- CVE-2017-7294: The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not validate addition of certain levels data, which allowed local users to trigger an integer overflow and out-of-bounds write, and cause a denial of service (system hang or crash) or possibly gain privileges, via a crafted ioctl call for a /dev/dri/renderD* device (bnc#1031440)

- CVE-2017-7261: The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not check for a zero value of certain levels data, which allowed local users to cause a denial of service (ZERO_SIZE_PTR dereference, and GPF and possibly panic) via a crafted ioctl call for a /dev/dri/renderD* device (bnc#1031052)

- CVE-2017-7187: The sg_ioctl function in drivers/scsi/sg.c in the Linux kernel allowed local users to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a large command size in an SG_NEXT_CMD_LEN ioctl call, leading to out-of-bounds write access in the sg_write function (bnc#1030213)

- CVE-2017-6348: The hashbin_delete function in net/irda/irqueue.c in the Linux kernel improperly managed lock dropping, which allowed local users to cause a denial of service (deadlock) via crafted operations on IrDA devices (bnc#1027178)

- CVE-2017-5669: The do_shmat function in ipc/shm.c in the Linux kernel did not restrict the address calculated by a certain rounding operation, which allowed local users to map page zero, and consequently bypass a protection mechanism that exists for the mmap system call, by making crafted shmget and shmat system calls in a privileged context (bnc#1026914)

- CVE-2015-3288: mm/memory.c in the Linux kernel mishandled anonymous pages, which allowed local users to gain privileges or cause a denial of service (page tainting) via a crafted application that triggers writing to page zero (bsc#979021).

- CVE-2016-10200: Race condition in the L2TPv3 IP Encapsulation feature in the Linux kernel allowed local users to gain privileges or cause a denial of service (use-after-free) by making multiple bind system calls without properly ascertaining whether a socket has the SOCK_ZAPPED status, related to net/l2tp/l2tp_ip.c and net/l2tp/l2tp_ip6.c (bnc#1028415)

- CVE-2016-5243: The tipc_nl_compat_link_dump function in net/tipc/netlink_compat.c in the Linux kernel did not properly copy a certain string, which allowed local users to obtain sensitive information from kernel stack memory by reading a Netlink message (bnc#983212)

- CVE-2017-6353: net/sctp/socket.c in the Linux kernel did not properly restrict association peel-off operations during certain wait states, which allowed local users to cause a denial of service (invalid unlock and double free) via a multithreaded application (bnc#1027066)

- CVE-2017-6214: The tcp_splice_read function in net/ipv4/tcp.c in the Linux kernel allowed remote attackers to cause a denial of service (infinite loop and soft lockup) via vectors involving a TCP packet with the URG flag (bnc#1026722)

- CVE-2017-6074: The dccp_rcv_state_process function in net/dccp/input.c in the Linux kernel mishandled DCCP_PKT_REQUEST packet data structures in the LISTEN state, which allowed local users to obtain root privileges or cause a denial of service (double free) via an application that made an IPV6_RECVPKTINFO setsockopt system call (bnc#1026024)

- CVE-2017-5986: Race condition in the sctp_wait_for_sndbuf function in net/sctp/socket.c in the Linux kernel allowed local users to cause a denial of service (assertion failure and panic) via a multithreaded application that peels off an association in a certain buffer-full state (bsc#1025235)

- CVE-2015-8970: crypto/algif_skcipher.c in the Linux kernel did not verify that a setkey operation has been performed on an AF_ALG socket an accept system call is processed, which allowed local users to cause a denial of service (NULL pointer dereference and system crash) via a crafted application that does not supply a key, related to the lrw_crypt function in crypto/lrw.c (bsc#1008374).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Solution

To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product :

SUSE Linux Enterprise Software Development Kit 11-SP4:zypper in -t patch sdksp4-linux-kernel-13105=1

SUSE Linux Enterprise Server 11-SP4:zypper in -t patch slessp4-linux-kernel-13105=1

SUSE Linux Enterprise Server 11-EXTRA:zypper in -t patch slexsp3-linux-kernel-13105=1

SUSE Linux Enterprise Debuginfo 11-SP4:zypper in -t patch dbgsp4-linux-kernel-13105=1

To bring your system up-to-date, use 'zypper patch'.

See Also

https://bugzilla.suse.com/show_bug.cgi?id=1005651

https://bugzilla.suse.com/show_bug.cgi?id=1008374

https://bugzilla.suse.com/show_bug.cgi?id=1008893

https://bugzilla.suse.com/show_bug.cgi?id=1013018

https://bugzilla.suse.com/show_bug.cgi?id=1013070

https://bugzilla.suse.com/show_bug.cgi?id=1013800

https://bugzilla.suse.com/show_bug.cgi?id=1013862

https://bugzilla.suse.com/show_bug.cgi?id=1016489

https://bugzilla.suse.com/show_bug.cgi?id=1017143

https://bugzilla.suse.com/show_bug.cgi?id=1018263

https://bugzilla.suse.com/show_bug.cgi?id=1018446

https://bugzilla.suse.com/show_bug.cgi?id=1019168

https://bugzilla.suse.com/show_bug.cgi?id=1020229

https://bugzilla.suse.com/show_bug.cgi?id=1021256

https://bugzilla.suse.com/show_bug.cgi?id=1021913

https://bugzilla.suse.com/show_bug.cgi?id=1022971

https://bugzilla.suse.com/show_bug.cgi?id=1023014

https://bugzilla.suse.com/show_bug.cgi?id=1023163

https://bugzilla.suse.com/show_bug.cgi?id=1023888

https://bugzilla.suse.com/show_bug.cgi?id=1024508

https://bugzilla.suse.com/show_bug.cgi?id=1024788

https://bugzilla.suse.com/show_bug.cgi?id=1024938

https://bugzilla.suse.com/show_bug.cgi?id=1025235

https://bugzilla.suse.com/show_bug.cgi?id=1025702

https://bugzilla.suse.com/show_bug.cgi?id=1026024

https://bugzilla.suse.com/show_bug.cgi?id=1026260

https://bugzilla.suse.com/show_bug.cgi?id=1026722

https://bugzilla.suse.com/show_bug.cgi?id=1026914

https://bugzilla.suse.com/show_bug.cgi?id=1027066

https://bugzilla.suse.com/show_bug.cgi?id=1027101

https://bugzilla.suse.com/show_bug.cgi?id=1027178

https://bugzilla.suse.com/show_bug.cgi?id=1028415

https://bugzilla.suse.com/show_bug.cgi?id=1028880

https://bugzilla.suse.com/show_bug.cgi?id=1029212

https://bugzilla.suse.com/show_bug.cgi?id=1029770

https://bugzilla.suse.com/show_bug.cgi?id=1030213

https://bugzilla.suse.com/show_bug.cgi?id=1030573

https://bugzilla.suse.com/show_bug.cgi?id=1031003

https://bugzilla.suse.com/show_bug.cgi?id=1031052

https://bugzilla.suse.com/show_bug.cgi?id=1031440

https://bugzilla.suse.com/show_bug.cgi?id=1031579

https://bugzilla.suse.com/show_bug.cgi?id=1032141

https://bugzilla.suse.com/show_bug.cgi?id=1033336

https://bugzilla.suse.com/show_bug.cgi?id=1033771

https://bugzilla.suse.com/show_bug.cgi?id=1033794

https://bugzilla.suse.com/show_bug.cgi?id=1033804

https://bugzilla.suse.com/show_bug.cgi?id=1033816

https://bugzilla.suse.com/show_bug.cgi?id=1034026

https://bugzilla.suse.com/show_bug.cgi?id=909486

https://bugzilla.suse.com/show_bug.cgi?id=911105

https://bugzilla.suse.com/show_bug.cgi?id=931620

https://bugzilla.suse.com/show_bug.cgi?id=979021

https://bugzilla.suse.com/show_bug.cgi?id=982783

https://bugzilla.suse.com/show_bug.cgi?id=983212

https://bugzilla.suse.com/show_bug.cgi?id=985561

https://bugzilla.suse.com/show_bug.cgi?id=988065

https://bugzilla.suse.com/show_bug.cgi?id=989056

https://bugzilla.suse.com/show_bug.cgi?id=995542

https://bugzilla.suse.com/show_bug.cgi?id=999245

https://www.suse.com/security/cve/CVE-2015-3288/

https://www.suse.com/security/cve/CVE-2015-8970/

https://www.suse.com/security/cve/CVE-2016-10200/

https://www.suse.com/security/cve/CVE-2016-5243/

https://www.suse.com/security/cve/CVE-2017-2671/

https://www.suse.com/security/cve/CVE-2017-5669/

https://www.suse.com/security/cve/CVE-2017-5970/

https://www.suse.com/security/cve/CVE-2017-5986/

https://www.suse.com/security/cve/CVE-2017-6074/

https://www.suse.com/security/cve/CVE-2017-6214/

https://www.suse.com/security/cve/CVE-2017-6348/

https://www.suse.com/security/cve/CVE-2017-6353/

https://www.suse.com/security/cve/CVE-2017-7184/

https://www.suse.com/security/cve/CVE-2017-7187/

https://www.suse.com/security/cve/CVE-2017-7261/

https://www.suse.com/security/cve/CVE-2017-7294/

https://www.suse.com/security/cve/CVE-2017-7308/

https://www.suse.com/security/cve/CVE-2017-7616/

http://www.nessus.org/u?bed1dddf

Plugin Details

Severity: High

ID: 100214

File Name: suse_SU-2017-1301-1.nasl

Version: 3.10

Type: local

Agent: unix

Published: 2017/05/16

Updated: 2019/09/11

Dependencies: 12634

Risk Information

Risk Factor: High

CVSS v2.0

Base Score: 7.2

Temporal Score: 6.3

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:H/RL:OF/RC:C

CVSS v3.0

Base Score: 7.8

Temporal Score: 7.5

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:novell:suse_linux:kernel-default, p-cpe:/a:novell:suse_linux:kernel-default-base, p-cpe:/a:novell:suse_linux:kernel-default-devel, p-cpe:/a:novell:suse_linux:kernel-default-man, p-cpe:/a:novell:suse_linux:kernel-ec2, p-cpe:/a:novell:suse_linux:kernel-ec2-base, p-cpe:/a:novell:suse_linux:kernel-ec2-devel, p-cpe:/a:novell:suse_linux:kernel-pae, p-cpe:/a:novell:suse_linux:kernel-pae-base, p-cpe:/a:novell:suse_linux:kernel-pae-devel, p-cpe:/a:novell:suse_linux:kernel-source, p-cpe:/a:novell:suse_linux:kernel-syms, p-cpe:/a:novell:suse_linux:kernel-trace, p-cpe:/a:novell:suse_linux:kernel-trace-base, p-cpe:/a:novell:suse_linux:kernel-trace-devel, p-cpe:/a:novell:suse_linux:kernel-xen, p-cpe:/a:novell:suse_linux:kernel-xen-base, p-cpe:/a:novell:suse_linux:kernel-xen-devel, cpe:/o:novell:suse_linux:11

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2017/05/15

Vulnerability Publication Date: 2016/06/27

Exploitable With

Core Impact

Metasploit (AF_PACKET packet_set_ring Privilege Escalation)

Reference Information

CVE: CVE-2015-3288, CVE-2015-8970, CVE-2016-10200, CVE-2016-5243, CVE-2017-2671, CVE-2017-5669, CVE-2017-5970, CVE-2017-5986, CVE-2017-6074, CVE-2017-6214, CVE-2017-6348, CVE-2017-6353, CVE-2017-7184, CVE-2017-7187, CVE-2017-7261, CVE-2017-7294, CVE-2017-7308, CVE-2017-7616