The SUSE Linux Enterprise 11 SP3 LTSS kernel was updated to receive various security and bugfixes. This update adds mitigations for various side channel attacks against modern CPUs that could disclose content of otherwise unreadable memory (bnc#1068032).

  - CVE-2017-5753: Local attackers on systems with modern     CPUs featuring deep instruction pipelining could use     attacker controllable speculative execution over code     patterns in the Linux Kernel to leak content from     otherwise not readable memory in the same address space,     allowing retrieval of passwords, cryptographic keys and     other secrets. This problem is mitigated by adding     speculative fencing on affected code paths throughout     the Linux kernel.

  - CVE-2017-5715: Local attackers on systems with modern     CPUs featuring branch prediction could use mispredicted     branches to speculatively execute code patterns that in     turn could be made to leak other non-readable content in     the same address space, an attack similar to     CVE-2017-5753. This problem is mitigated by disabling     predictive branches, depending on CPU architecture     either by firmware updates and/or fixes in the     user-kernel privilege boundaries. Please contact your     CPU / hardware vendor for potential microcode or BIOS     updates needed for this fix. As this feature can have a     performance impact, it can be disabled using the     'nospec' kernel commandline option.

  - CVE-2017-5754: Local attackers on systems with modern     CPUs featuring deep instruction pipelining could use     code patterns in userspace to speculative executive code     that would read otherwise read protected memory, an     attack similar to CVE-2017-5753. This problem is     mitigated by unmapping the Linux Kernel from the user     address space during user code execution, following a     approach called 'KAISER'. The terms used here are     'KAISER' / 'Kernel Address Isolation' and 'PTI' / 'Page     Table Isolation'. This feature is disabled on unaffected     architectures. This feature can be enabled / disabled by     the 'pti=[on|off|auto]' or 'nopti' commandline options.
    The following security bugs were fixed :

  - CVE-2017-1000251: The native Bluetooth stack in the     Linux Kernel (BlueZ) was vulnerable to a stack overflow     vulnerability in the processing of L2CAP configuration     responses resulting in Remote code execution in kernel     space (bnc#1057389).

  - CVE-2017-11600: net/xfrm/xfrm_policy.c in the Linux     kernel did not ensure that the dir value of     xfrm_userpolicy_id is XFRM_POLICY_MAX or less, which     allowed local users to cause a denial of service     (out-of-bounds access) or possibly have unspecified     other impact via an XFRM_MSG_MIGRATE xfrm Netlink     message (bnc#1050231).

  - CVE-2017-13080: Wi-Fi Protected Access (WPA and WPA2)     allowed reinstallation of the Group Temporal Key (GTK)     during the group key handshake, allowing an attacker     within radio range to replay frames from access points     to clients (bnc#1063667).

  - CVE-2017-13167: An elevation of privilege vulnerability     in the kernel sound timer was fixed. (bnc#1072876).

  - CVE-2017-14106: The tcp_disconnect function in     net/ipv4/tcp.c in the Linux kernel allowed local users     to cause a denial of service (__tcp_select_window     divide-by-zero error and system crash) by triggering a     disconnect within a certain tcp_recvmsg code path     (bnc#1056982).

  - CVE-2017-14140: The move_pages system call in     mm/migrate.c in the Linux kernel didn't check the     effective uid of the target process, enabling a local     attacker to learn the memory layout of a setuid     executable despite ASLR (bnc#1057179).

  - CVE-2017-14340: The XFS_IS_REALTIME_INODE macro in     fs/xfs/xfs_linux.h in the Linux kernel did not verify     that a filesystem has a realtime device, which allowed     local users to cause a denial of service (NULL pointer     dereference and OOPS) via vectors related to setting an     RHINHERIT flag on a directory (bnc#1058524).

  - CVE-2017-15102: The tower_probe function in     drivers/usb/misc/legousbtower.c in the Linux kernel     allowed local users (who are physically proximate for     inserting a crafted USB device) to gain privileges by     leveraging a write-what-where condition that occurs     after a race condition and a NULL pointer dereference     (bnc#1066705).

  - CVE-2017-15115: The sctp_do_peeloff function in     net/sctp/socket.c in the Linux kernel did not check     whether the intended netns is used in a peel-off action,     which allowed local users to cause a denial of service     (use-after-free and system crash) or possibly have     unspecified other impact via crafted system calls     (bnc#1068671).

  - CVE-2017-15265: Race condition in the ALSA subsystem in     the Linux kernel allowed local users to cause a denial     of service (use-after-free) or possibly have unspecified     other impact via crafted /dev/snd/seq ioctl calls,     related to sound/core/seq/seq_clientmgr.c and     sound/core/seq/seq_ports.c (bnc#1062520).

  - CVE-2017-15274: security/keys/keyctl.c in the Linux     kernel did not consider the case of a NULL payload in     conjunction with a nonzero length value, which allowed     local users to cause a denial of service (NULL pointer     dereference and OOPS) via a crafted add_key or keyctl     system call, a different vulnerability than     CVE-2017-12192 (bnc#1045327).

  - CVE-2017-15868: The bnep_add_connection function in     net/bluetooth/bnep/core.c in the Linux kernel did not     ensure that an l2cap socket is available, which allowed     local users to gain privileges via a crafted application     (bnc#1071470).

  - CVE-2017-16525: The usb_serial_console_disconnect     function in drivers/usb/serial/console.c in the Linux     kernel allowed local users to cause a denial of service     (use-after-free and system crash) or possibly have     unspecified other impact via a crafted USB device,     related to disconnection and failed setup (bnc#1066618).

  - CVE-2017-16527: sound/usb/mixer.c in the Linux kernel     allowed local users to cause a denial of service     (snd_usb_mixer_interrupt use-after-free and system     crash) or possibly have unspecified other impact via a     crafted USB device (bnc#1066625).

  - CVE-2017-16529: The snd_usb_create_streams function in     sound/usb/card.c in the Linux kernel allowed local users     to cause a denial of service (out-of-bounds read and     system crash) or possibly have unspecified other impact     via a crafted USB device (bnc#1066650).

  - CVE-2017-16531: drivers/usb/core/config.c in the Linux     kernel allowed local users to cause a denial of service     (out-of-bounds read and system crash) or possibly have     unspecified other impact via a crafted USB device,     related to the USB_DT_INTERFACE_ASSOCIATION descriptor     (bnc#1066671).

  - CVE-2017-16534: The cdc_parse_cdc_header function in     drivers/usb/core/message.c in the Linux kernel allowed     local users to cause a denial of service (out-of-bounds     read and system crash) or possibly have unspecified     other impact via a crafted USB device (bnc#1066693).

  - CVE-2017-16535: The usb_get_bos_descriptor function in     drivers/usb/core/config.c in the Linux kernel allowed     local users to cause a denial of service (out-of-bounds     read and system crash) or possibly have unspecified     other impact via a crafted USB device (bnc#1066700).

  - CVE-2017-16536: The cx231xx_usb_probe function in     drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux     kernel allowed local users to cause a denial of service     (NULL pointer dereference and system crash) or possibly     have unspecified other impact via a crafted USB device     (bnc#1066606).

  - CVE-2017-16537: The imon_probe function in     drivers/media/rc/imon.c in the Linux kernel allowed     local users to cause a denial of service (NULL pointer     dereference and system crash) or possibly have     unspecified other impact via a crafted USB device     (bnc#1066573).

  - CVE-2017-16538: drivers/media/usb/dvb-usb-v2/lmedm04.c     in the Linux kernel allowed local users to cause a     denial of service (general protection fault and system     crash) or possibly have unspecified other impact via a     crafted USB device, related to a missing warm-start     check and incorrect attach timing     (dm04_lme2510_frontend_attach versus dm04_lme2510_tuner)     (bnc#1066569).

  - CVE-2017-16649: The usbnet_generic_cdc_bind function in     drivers/net/usb/cdc_ether.c in the Linux kernel allowed     local users to cause a denial of service (divide-by-zero     error and system crash) or possibly have unspecified     other impact via a crafted USB device (bnc#1067085).

  - CVE-2017-16939: The XFRM dump policy implementation in     net/xfrm/xfrm_user.c in the Linux kernel allowed local     users to gain privileges or cause a denial of service     (use-after-free) via a crafted SO_RCVBUF setsockopt     system call in conjunction with XFRM_MSG_GETPOLICY     Netlink messages (bnc#1069702 1069708).

  - CVE-2017-17450: net/netfilter/xt_osf.c in the Linux     kernel did not require the CAP_NET_ADMIN capability for     add_callback and remove_callback operations, which     allowed local users to bypass intended access     restrictions because the xt_osf_fingers data structure     is shared across all net namespaces (bnc#1071695     1074033).

  - CVE-2017-17558: The usb_destroy_configuration function     in drivers/usb/core/config.c in the USB core subsystem     in the Linux kernel did not consider the maximum number     of configurations and interfaces before attempting to     release resources, which allowed local users to cause a     denial of service (out-of-bounds write access) or     possibly have unspecified other impact via a crafted USB     device (bnc#1072561).

  - CVE-2017-17805: The Salsa20 encryption algorithm in the     Linux kernel did not correctly handle zero-length     inputs, allowing a local attacker able to use the     AF_ALG-based skcipher interface     (CONFIG_CRYPTO_USER_API_SKCIPHER) to cause a denial of     service (uninitialized-memory free and kernel crash) or     have unspecified other impact by executing a crafted     sequence of system calls that use the blkcipher_walk     API. Both the generic implementation     (crypto/salsa20_generic.c) and x86 implementation     (arch/x86/crypto/salsa20_glue.c) of Salsa20 were     vulnerable (bnc#1073792).

  - CVE-2017-17806: The HMAC implementation (crypto/hmac.c)     in the Linux kernel did not validate that the underlying     cryptographic hash algorithm is unkeyed, allowing a     local attacker able to use the AF_ALG-based hash     interface (CONFIG_CRYPTO_USER_API_HASH) and the SHA-3     hash algorithm (CONFIG_CRYPTO_SHA3) to cause a kernel     stack-based buffer overflow by executing a crafted     sequence of system calls that encounter a missing SHA-3     initialization (bnc#1073874).

  - CVE-2017-7472: The KEYS subsystem in the Linux kernel     allowed local users to cause a denial of service (memory     consumption) via a series of     KEY_REQKEY_DEFL_THREAD_KEYRING keyctl_set_reqkey_keyring     calls (bnc#1034862).

  - CVE-2017-8824: The dccp_disconnect function in     net/dccp/proto.c in the Linux kernel allowed local users     to gain privileges or cause a denial of service     (use-after-free) via an AF_UNSPEC connect system call     during the DCCP_LISTEN state (bnc#1070771).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Detections

Analytics

SUSE SLES11 Security Update : kernel (SUSE-SU-2018:0040-1) (BlueBorne) (KRACK) (Meltdown) (Spectre)

high Nessus Plugin ID 105685

No changelogs found