SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2017:1360-1)

Critical Nessus Plugin ID 100320

Synopsis

The remote SUSE host is missing one or more security updates.

Description

The SUSE Linux Enterprise 12 SP1 kernel was updated to 3.12.74 to receive various security and bugfixes. Notable new/improved features :

- Improved support for Hyper-V

- Support for the tcp_westwood TCP scheduling algorithm The following security bugs were fixed :

- CVE-2017-8106: The handle_invept function in arch/x86/kvm/vmx.c in the Linux kernel allowed privileged KVM guest OS users to cause a denial of service (NULL pointer dereference and host OS crash) via a single-context INVEPT instruction with a NULL EPT pointer (bsc#1035877).

- CVE-2017-6951: The keyring_search_aux function in security/keys/keyring.c in the Linux kernel allowed local users to cause a denial of service (NULL pointer dereference and OOPS) via a request_key system call for the 'dead' type. (bsc#1029850).

- CVE-2017-2647: The KEYS subsystem in the Linux kernel allowed local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) via vectors involving a NULL value for a certain match field, related to the keyring_search_iterator function in keyring.c. (bsc#1030593)

- CVE-2016-9604: This fixes handling of keyrings starting with '.' in KEYCTL_JOIN_SESSION_KEYRING, which could have allowed local users to manipulate privileged keyrings (bsc#1035576)

- CVE-2017-7616: Incorrect error handling in the set_mempolicy and mbind compat syscalls in mm/mempolicy.c in the Linux kernel allowed local users to obtain sensitive information from uninitialized stack data by triggering failure of a certain bitmap operation. (bnc#1033336).

- CVE-2017-7645: The NFSv2/NFSv3 server in the nfsd subsystem in the Linux kernel allowed remote attackers to cause a denial of service (system crash) via a long RPC reply, related to net/sunrpc/svc.c, fs/nfsd/nfs3xdr.c, and fs/nfsd/nfsxdr.c. (bsc#1034670).

- CVE-2017-7308: The packet_set_ring function in net/packet/af_packet.c in the Linux kernel did not properly validate certain block-size data, which allowed local users to cause a denial of service (overflow) or possibly have unspecified other impact via crafted system calls (bnc#1031579)

- CVE-2017-2671: The ping_unhash function in net/ipv4/ping.c in the Linux kernel was too late in obtaining a certain lock and consequently could not ensure that disconnect function calls are safe, which allowed local users to cause a denial of service (panic) by leveraging access to the protocol value of IPPROTO_ICMP in a socket system call (bnc#1031003)

- CVE-2017-7294: The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not validate addition of certain levels data, which allowed local users to trigger an integer overflow and out-of-bounds write, and cause a denial of service (system hang or crash) or possibly gain privileges, via a crafted ioctl call for a /dev/dri/renderD* device (bnc#1031440)

- CVE-2017-7261: The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not check for a zero value of certain levels data, which allowed local users to cause a denial of service (ZERO_SIZE_PTR dereference, and GPF and possibly panic) via a crafted ioctl call for a /dev/dri/renderD* device (bnc#1031052)

- CVE-2017-7187: The sg_ioctl function in drivers/scsi/sg.c in the Linux kernel allowed local users to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a large command size in an SG_NEXT_CMD_LEN ioctl call, leading to out-of-bounds write access in the sg_write function (bnc#1030213)

- CVE-2016-9588: arch/x86/kvm/vmx.c in the Linux kernel mismanaged the #BP and #OF exceptions, which allowed guest OS users to cause a denial of service (guest OS crash) by declining to handle an exception thrown by an L2 guest (bsc#1015703).

- CVE-2017-5669: The do_shmat function in ipc/shm.c in the Linux kernel did not restrict the address calculated by a certain rounding operation, which allowed local users to map page zero, and consequently bypass a protection mechanism that exists for the mmap system call, by making crafted shmget and shmat system calls in a privileged context (bnc#1026914).

- CVE-2016-10200: Race condition in the L2TPv3 IP Encapsulation feature in the Linux kernel allowed local users to gain privileges or cause a denial of service (use-after-free) by making multiple bind system calls without properly ascertaining whether a socket has the SOCK_ZAPPED status, related to net/l2tp/l2tp_ip.c and net/l2tp/l2tp_ip6.c (bnc#1028415)

- CVE-2016-10208: The ext4_fill_super function in fs/ext4/super.c in the Linux kernel did not properly validate meta block groups, which allowed physically proximate attackers to cause a denial of service (out-of-bounds read and system crash) via a crafted ext4 image (bnc#1023377).

- CVE-2017-5897: The ip6gre_err function in net/ipv6/ip6_gre.c in the Linux kernel allowed remote attackers to have unspecified impact via vectors involving GRE flags in an IPv6 packet, which trigger an out-of-bounds access (bsc#1023762).

- CVE-2017-5986: A race condition in the sctp_wait_for_sndbuf function in net/sctp/socket.c in the Linux kernel allowed local users to cause a denial of service (assertion failure and panic) via a multithreaded application that peels off an association in a certain buffer-full state (bsc#1025235).

- CVE-2017-6074: The dccp_rcv_state_process function in net/dccp/input.c in the Linux kernel mishandled DCCP_PKT_REQUEST packet data structures in the LISTEN state, which allowed local users to obtain root privileges or cause a denial of service (double free) via an application that made an IPV6_RECVPKTINFO setsockopt system call (bnc#1026024)

- CVE-2016-9191: The cgroup offline implementation in the Linux kernel mishandled certain drain operations, which allowed local users to cause a denial of service (system hang) by leveraging access to a container environment for executing a crafted application (bnc#1008842)

- CVE-2017-6348: The hashbin_delete function in net/irda/irqueue.c in the Linux kernel improperly managed lock dropping, which allowed local users to cause a denial of service (deadlock) via crafted operations on IrDA devices (bnc#1027178).

- CVE-2016-10044: The aio_mount function in fs/aio.c in the Linux kernel did not properly restrict execute access, which made it easier for local users to bypass intended SELinux W^X policy restrictions, and consequently gain privileges, via an io_setup system call (bnc#1023992).

- CVE-2016-3070: The trace_writeback_dirty_page implementation in include/trace/events/writeback.h in the Linux kernel improperly interacts with mm/migrate.c, which allowed local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by triggering a certain page move (bnc#979215).

- CVE-2016-5243: The tipc_nl_compat_link_dump function in net/tipc/netlink_compat.c in the Linux kernel did not properly copy a certain string, which allowed local users to obtain sensitive information from kernel stack memory by reading a Netlink message (bnc#983212).

- CVE-2017-6345: The LLC subsystem in the Linux kernel did not ensure that a certain destructor exists in required circumstances, which allowed local users to cause a denial of service (BUG_ON) or possibly have unspecified other impact via crafted system calls (bnc#1027190)

- CVE-2017-6346: Race condition in net/packet/af_packet.c in the Linux kernel allowed local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via a multithreaded application that made PACKET_FANOUT setsockopt system calls (bnc#1027189)

- CVE-2017-6353: net/sctp/socket.c in the Linux kernel did not properly restrict association peel-off operations during certain wait states, which allowed local users to cause a denial of service (invalid unlock and double free) via a multithreaded application. NOTE: this vulnerability exists because of an incorrect fix for CVE-2017-5986 (bnc#1027066)

- CVE-2017-5986: Race condition in the sctp_wait_for_sndbuf function in net/sctp/socket.c in the Linux kernel allowed local users to cause a denial of service (assertion failure and panic) via a multithreaded application that peels off an association in a certain buffer-full state (bsc#1025235).

- CVE-2017-6214: The tcp_splice_read function in net/ipv4/tcp.c in the Linux kernel allowed remote attackers to cause a denial of service (infinite loop and soft lockup) via vectors involving a TCP packet with the URG flag (bnc#1026722)

- CVE-2016-2117: The atl2_probe function in drivers/net/ethernet/atheros/atlx/atl2.c in the Linux kernel incorrectly enables scatter/gather I/O, which allowed remote attackers to obtain sensitive information from kernel memory by reading packet data (bnc#968697)

- CVE-2015-1350: The VFS subsystem in the Linux kernel provided an incomplete set of requirements for setattr operations that underspecifies removing extended privilege attributes, which allowed local users to cause a denial of service (capability stripping) via a failed invocation of a system call, as demonstrated by using chown to remove a capability from the ping or Wireshark dumpcap program (bsc#914939).

- CVE-2016-7117: Use-after-free vulnerability in the
__sys_recvmmsg function in net/socket.c in the Linux kernel allowed remote attackers to execute arbitrary code via vectors involving a recvmmsg system call that is mishandled during error processing (bsc#1003077).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Solution

To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product :

SUSE Linux Enterprise Workstation Extension 12-SP1:zypper in -t patch SUSE-SLE-WE-12-SP1-2017-831=1

SUSE Linux Enterprise Software Development Kit 12-SP1:zypper in -t patch SUSE-SLE-SDK-12-SP1-2017-831=1

SUSE Linux Enterprise Server 12-SP1:zypper in -t patch SUSE-SLE-SERVER-12-SP1-2017-831=1

SUSE Linux Enterprise Module for Public Cloud 12:zypper in -t patch SUSE-SLE-Module-Public-Cloud-12-2017-831=1

SUSE Linux Enterprise Live Patching 12:zypper in -t patch SUSE-SLE-Live-Patching-12-2017-831=1

SUSE Linux Enterprise Desktop 12-SP1:zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2017-831=1

To bring your system up-to-date, use 'zypper patch'.

See Also

https://bugzilla.suse.com/show_bug.cgi?id=1003077

https://bugzilla.suse.com/show_bug.cgi?id=1008842

https://bugzilla.suse.com/show_bug.cgi?id=1009682

https://bugzilla.suse.com/show_bug.cgi?id=1012620

https://bugzilla.suse.com/show_bug.cgi?id=1012985

https://bugzilla.suse.com/show_bug.cgi?id=1015703

https://bugzilla.suse.com/show_bug.cgi?id=1015787

https://bugzilla.suse.com/show_bug.cgi?id=1015821

https://bugzilla.suse.com/show_bug.cgi?id=1017512

https://bugzilla.suse.com/show_bug.cgi?id=1018100

https://bugzilla.suse.com/show_bug.cgi?id=1018263

https://bugzilla.suse.com/show_bug.cgi?id=1018419

https://bugzilla.suse.com/show_bug.cgi?id=1018446

https://bugzilla.suse.com/show_bug.cgi?id=1019168

https://bugzilla.suse.com/show_bug.cgi?id=1019514

https://bugzilla.suse.com/show_bug.cgi?id=1020048

https://bugzilla.suse.com/show_bug.cgi?id=1020795

https://bugzilla.suse.com/show_bug.cgi?id=1021256

https://bugzilla.suse.com/show_bug.cgi?id=1021374

https://bugzilla.suse.com/show_bug.cgi?id=1021762

https://bugzilla.suse.com/show_bug.cgi?id=1021913

https://bugzilla.suse.com/show_bug.cgi?id=1022559

https://bugzilla.suse.com/show_bug.cgi?id=1022971

https://bugzilla.suse.com/show_bug.cgi?id=1023164

https://bugzilla.suse.com/show_bug.cgi?id=1023207

https://bugzilla.suse.com/show_bug.cgi?id=1023377

https://bugzilla.suse.com/show_bug.cgi?id=1023762

https://bugzilla.suse.com/show_bug.cgi?id=1023824

https://bugzilla.suse.com/show_bug.cgi?id=1023888

https://bugzilla.suse.com/show_bug.cgi?id=1023992

https://bugzilla.suse.com/show_bug.cgi?id=1024081

https://bugzilla.suse.com/show_bug.cgi?id=1024234

https://bugzilla.suse.com/show_bug.cgi?id=1024309

https://bugzilla.suse.com/show_bug.cgi?id=1024508

https://bugzilla.suse.com/show_bug.cgi?id=1024788

https://bugzilla.suse.com/show_bug.cgi?id=1025039

https://bugzilla.suse.com/show_bug.cgi?id=1025235

https://bugzilla.suse.com/show_bug.cgi?id=1025354

https://bugzilla.suse.com/show_bug.cgi?id=1025802

https://bugzilla.suse.com/show_bug.cgi?id=1026024

https://bugzilla.suse.com/show_bug.cgi?id=1026722

https://bugzilla.suse.com/show_bug.cgi?id=1026914

https://bugzilla.suse.com/show_bug.cgi?id=1027066

https://bugzilla.suse.com/show_bug.cgi?id=1027178

https://bugzilla.suse.com/show_bug.cgi?id=1027189

https://bugzilla.suse.com/show_bug.cgi?id=1027190

https://bugzilla.suse.com/show_bug.cgi?id=1027974

https://bugzilla.suse.com/show_bug.cgi?id=1028041

https://bugzilla.suse.com/show_bug.cgi?id=1028415

https://bugzilla.suse.com/show_bug.cgi?id=1028595

https://bugzilla.suse.com/show_bug.cgi?id=1028648

https://bugzilla.suse.com/show_bug.cgi?id=1028895

https://bugzilla.suse.com/show_bug.cgi?id=1029470

https://bugzilla.suse.com/show_bug.cgi?id=1029850

https://bugzilla.suse.com/show_bug.cgi?id=1029986

https://bugzilla.suse.com/show_bug.cgi?id=1030118

https://bugzilla.suse.com/show_bug.cgi?id=1030213

https://bugzilla.suse.com/show_bug.cgi?id=1030593

https://bugzilla.suse.com/show_bug.cgi?id=1030901

https://bugzilla.suse.com/show_bug.cgi?id=1031003

https://bugzilla.suse.com/show_bug.cgi?id=1031052

https://bugzilla.suse.com/show_bug.cgi?id=1031080

https://bugzilla.suse.com/show_bug.cgi?id=1031440

https://bugzilla.suse.com/show_bug.cgi?id=1031567

https://bugzilla.suse.com/show_bug.cgi?id=1031579

https://bugzilla.suse.com/show_bug.cgi?id=1031662

https://bugzilla.suse.com/show_bug.cgi?id=1031842

https://bugzilla.suse.com/show_bug.cgi?id=1032125

https://bugzilla.suse.com/show_bug.cgi?id=1032141

https://bugzilla.suse.com/show_bug.cgi?id=1032344

https://bugzilla.suse.com/show_bug.cgi?id=1032345

https://bugzilla.suse.com/show_bug.cgi?id=1033336

https://bugzilla.suse.com/show_bug.cgi?id=1034670

https://bugzilla.suse.com/show_bug.cgi?id=103470

https://bugzilla.suse.com/show_bug.cgi?id=1034700

https://bugzilla.suse.com/show_bug.cgi?id=1035576

https://bugzilla.suse.com/show_bug.cgi?id=1035699

https://bugzilla.suse.com/show_bug.cgi?id=1035738

https://bugzilla.suse.com/show_bug.cgi?id=1035877

https://bugzilla.suse.com/show_bug.cgi?id=1036752

https://bugzilla.suse.com/show_bug.cgi?id=1038261

https://bugzilla.suse.com/show_bug.cgi?id=799133

https://bugzilla.suse.com/show_bug.cgi?id=857926

https://bugzilla.suse.com/show_bug.cgi?id=914939

https://bugzilla.suse.com/show_bug.cgi?id=917630

https://bugzilla.suse.com/show_bug.cgi?id=922853

https://bugzilla.suse.com/show_bug.cgi?id=930399

https://bugzilla.suse.com/show_bug.cgi?id=931620

https://bugzilla.suse.com/show_bug.cgi?id=937444

https://bugzilla.suse.com/show_bug.cgi?id=940946

https://bugzilla.suse.com/show_bug.cgi?id=954763

https://bugzilla.suse.com/show_bug.cgi?id=968697

https://bugzilla.suse.com/show_bug.cgi?id=970083

https://bugzilla.suse.com/show_bug.cgi?id=971933

https://bugzilla.suse.com/show_bug.cgi?id=979215

https://bugzilla.suse.com/show_bug.cgi?id=982783

https://bugzilla.suse.com/show_bug.cgi?id=983212

https://bugzilla.suse.com/show_bug.cgi?id=984530

https://bugzilla.suse.com/show_bug.cgi?id=985561

https://bugzilla.suse.com/show_bug.cgi?id=988065

https://bugzilla.suse.com/show_bug.cgi?id=989056

https://bugzilla.suse.com/show_bug.cgi?id=993832

https://www.suse.com/security/cve/CVE-2015-1350/

https://www.suse.com/security/cve/CVE-2016-10044/

https://www.suse.com/security/cve/CVE-2016-10200/

https://www.suse.com/security/cve/CVE-2016-10208/

https://www.suse.com/security/cve/CVE-2016-2117/

https://www.suse.com/security/cve/CVE-2016-3070/

https://www.suse.com/security/cve/CVE-2016-5243/

https://www.suse.com/security/cve/CVE-2016-7117/

https://www.suse.com/security/cve/CVE-2016-9191/

https://www.suse.com/security/cve/CVE-2016-9588/

https://www.suse.com/security/cve/CVE-2016-9604/

https://www.suse.com/security/cve/CVE-2017-2647/

https://www.suse.com/security/cve/CVE-2017-2671/

https://www.suse.com/security/cve/CVE-2017-5669/

https://www.suse.com/security/cve/CVE-2017-5897/

https://www.suse.com/security/cve/CVE-2017-5986/

https://www.suse.com/security/cve/CVE-2017-6074/

https://www.suse.com/security/cve/CVE-2017-6214/

https://www.suse.com/security/cve/CVE-2017-6345/

https://www.suse.com/security/cve/CVE-2017-6346/

https://www.suse.com/security/cve/CVE-2017-6348/

https://www.suse.com/security/cve/CVE-2017-6353/

https://www.suse.com/security/cve/CVE-2017-6951/

https://www.suse.com/security/cve/CVE-2017-7187/

https://www.suse.com/security/cve/CVE-2017-7261/

https://www.suse.com/security/cve/CVE-2017-7294/

https://www.suse.com/security/cve/CVE-2017-7308/

https://www.suse.com/security/cve/CVE-2017-7616/

https://www.suse.com/security/cve/CVE-2017-7645/

https://www.suse.com/security/cve/CVE-2017-8106/

http://www.nessus.org/u?b505b515

Plugin Details

Severity: Critical

ID: 100320

File Name: suse_SU-2017-1360-1.nasl

Version: 3.8

Type: local

Agent: unix

Published: 2017/05/22

Updated: 2018/11/30

Dependencies: 12634

Risk Information

Risk Factor: Critical

CVSS v2.0

Base Score: 10

Temporal Score: 8.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:H/RL:OF/RC:C

CVSS v3.0

Base Score: 9.8

Temporal Score: 9.4

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:novell:suse_linux:kernel-default, p-cpe:/a:novell:suse_linux:kernel-default-base, p-cpe:/a:novell:suse_linux:kernel-default-base-debuginfo, p-cpe:/a:novell:suse_linux:kernel-default-debuginfo, p-cpe:/a:novell:suse_linux:kernel-default-debugsource, p-cpe:/a:novell:suse_linux:kernel-default-devel, p-cpe:/a:novell:suse_linux:kernel-default-extra, p-cpe:/a:novell:suse_linux:kernel-default-extra-debuginfo, p-cpe:/a:novell:suse_linux:kernel-default-man, p-cpe:/a:novell:suse_linux:kernel-syms, p-cpe:/a:novell:suse_linux:kernel-xen, p-cpe:/a:novell:suse_linux:kernel-xen-base, p-cpe:/a:novell:suse_linux:kernel-xen-base-debuginfo, p-cpe:/a:novell:suse_linux:kernel-xen-debuginfo, p-cpe:/a:novell:suse_linux:kernel-xen-debugsource, p-cpe:/a:novell:suse_linux:kernel-xen-devel, cpe:/o:novell:suse_linux:12

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2017/05/19

Exploitable With

Core Impact

Metasploit (AF_PACKET packet_set_ring Privilege Escalation)

Reference Information

CVE: CVE-2015-1350, CVE-2016-10044, CVE-2016-10200, CVE-2016-10208, CVE-2016-2117, CVE-2016-3070, CVE-2016-5243, CVE-2016-7117, CVE-2016-9191, CVE-2016-9588, CVE-2016-9604, CVE-2017-2647, CVE-2017-2671, CVE-2017-5669, CVE-2017-5897, CVE-2017-5986, CVE-2017-6074, CVE-2017-6214, CVE-2017-6345, CVE-2017-6346, CVE-2017-6348, CVE-2017-6353, CVE-2017-6951, CVE-2017-7187, CVE-2017-7261, CVE-2017-7294, CVE-2017-7308, CVE-2017-7616, CVE-2017-7645, CVE-2017-8106