SUSE SLES11 Security Update : kernel (SUSE-SU-2018:2879-1)

High Nessus Plugin ID 117820

Synopsis

The remote SUSE host is missing one or more security updates.

Description

The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2018-14617: Prevent NULL pointer dereference and panic in hfsplus_lookup() when opening a file (that is purportedly a hard link) in an hfs+ filesystem that has malformed catalog data, and is mounted read-only without a metadata directory (bsc#1102870).

CVE-2018-16276: Incorrect bounds checking in the yurex USB driver in yurex_read allowed local attackers to use user access read/writes to crash the kernel or potentially escalate privileges (bsc#1106095).

CVE-2018-15594: Ensure correct handling of indirect calls, to prevent attackers for conducting Spectre-v2 attacks against paravirtual guests (bsc#1105348).

CVE-2018-14634: Prevent integer overflow in create_elf_tables that allowed a local attacker to exploit this vulnerability via a SUID-root binary and obtain full root privileges (bsc#1108912)

CVE-2018-12896: Prevent integer overflow in the POSIX timer code that was caused by the way the overrun accounting works. Depending on interval and expiry time values, the overrun can be larger than INT_MAX, but the accounting is int based. This basically made the accounting values, which are visible to user space via timer_getoverrun(2) and siginfo::si_overrun, random. This allowed a local user to cause a denial of service (signed integer overflow) via crafted mmap, futex, timer_create, and timer_settime system calls (bnc#1099922)

CVE-2018-10940: The cdrom_ioctl_media_changed function allowed local attackers to use a incorrect bounds check in the CDROM driver CDROM_MEDIA_CHANGED ioctl to read out kernel memory (bsc#1092903)

CVE-2018-16658: Prevent information leak in cdrom_ioctl_drive_status that could have been used by local attackers to read kernel memory (bnc#1107689)

CVE-2018-6555: The irda_setsockopt function allowed local users to cause a denial of service (ias_object use-after-free and system crash) or possibly have unspecified other impact via an AF_IRDA socket (bnc#1106511)

CVE-2018-6554: Prevent memory leak in the irda_bind function that allowed local users to cause a denial of service (memory consumption) by repeatedly binding an AF_IRDA socket (bnc#1106509)

CVE-2018-15572: The spectre_v2_select_mitigation function did not always fill RSB upon a context switch, which made it easier for attackers to conduct userspace-userspace spectreRSB attacks (bnc#1102517)

CVE-2018-10902: Protect against concurrent access to prevent double realloc (double free) in snd_rawmidi_input_params() and snd_rawmidi_output_status(). A malicious local attacker could have used this for privilege escalation (bnc#1105322)

CVE-2018-14734: ucma_leave_multicast accessed a certain data structure after a cleanup step in ucma_process_join, which allowed attackers to cause a denial of service (use-after-free) (bsc#1103119)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Solution

To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or 'zypper patch'.

Alternatively you can run the command listed for your product :

SUSE Linux Enterprise Software Development Kit 11-SP4:zypper in -t patch sdksp4-kernel-13796=1

SUSE Linux Enterprise Server 11-SP4:zypper in -t patch slessp4-kernel-13796=1

SUSE Linux Enterprise Server 11-EXTRA:zypper in -t patch slexsp3-kernel-13796=1

SUSE Linux Enterprise Debuginfo 11-SP4:zypper in -t patch dbgsp4-kernel-13796=1

See Also

https://bugzilla.suse.com/show_bug.cgi?id=1037441

https://bugzilla.suse.com/show_bug.cgi?id=1045538

https://bugzilla.suse.com/show_bug.cgi?id=1047487

https://bugzilla.suse.com/show_bug.cgi?id=1048185

https://bugzilla.suse.com/show_bug.cgi?id=1050381

https://bugzilla.suse.com/show_bug.cgi?id=1050431

https://bugzilla.suse.com/show_bug.cgi?id=1057199

https://bugzilla.suse.com/show_bug.cgi?id=1060245

https://bugzilla.suse.com/show_bug.cgi?id=1064861

https://bugzilla.suse.com/show_bug.cgi?id=1068032

https://bugzilla.suse.com/show_bug.cgi?id=1080157

https://bugzilla.suse.com/show_bug.cgi?id=1087081

https://bugzilla.suse.com/show_bug.cgi?id=1092772

https://bugzilla.suse.com/show_bug.cgi?id=1092903

https://bugzilla.suse.com/show_bug.cgi?id=1093666

https://bugzilla.suse.com/show_bug.cgi?id=1096547

https://bugzilla.suse.com/show_bug.cgi?id=1097562

https://bugzilla.suse.com/show_bug.cgi?id=1098822

https://bugzilla.suse.com/show_bug.cgi?id=1099922

https://bugzilla.suse.com/show_bug.cgi?id=1100132

https://bugzilla.suse.com/show_bug.cgi?id=1100705

https://bugzilla.suse.com/show_bug.cgi?id=1102517

https://bugzilla.suse.com/show_bug.cgi?id=1102870

https://bugzilla.suse.com/show_bug.cgi?id=1103119

https://bugzilla.suse.com/show_bug.cgi?id=1103884

https://bugzilla.suse.com/show_bug.cgi?id=1103909

https://bugzilla.suse.com/show_bug.cgi?id=1104481

https://bugzilla.suse.com/show_bug.cgi?id=1104684

https://bugzilla.suse.com/show_bug.cgi?id=1104818

https://bugzilla.suse.com/show_bug.cgi?id=1104901

https://bugzilla.suse.com/show_bug.cgi?id=1105100

https://bugzilla.suse.com/show_bug.cgi?id=1105322

https://bugzilla.suse.com/show_bug.cgi?id=1105348

https://bugzilla.suse.com/show_bug.cgi?id=1105536

https://bugzilla.suse.com/show_bug.cgi?id=1105723

https://bugzilla.suse.com/show_bug.cgi?id=1106095

https://bugzilla.suse.com/show_bug.cgi?id=1106105

https://bugzilla.suse.com/show_bug.cgi?id=1106199

https://bugzilla.suse.com/show_bug.cgi?id=1106202

https://bugzilla.suse.com/show_bug.cgi?id=1106206

https://bugzilla.suse.com/show_bug.cgi?id=1106209

https://bugzilla.suse.com/show_bug.cgi?id=1106212

https://bugzilla.suse.com/show_bug.cgi?id=1106369

https://bugzilla.suse.com/show_bug.cgi?id=1106509

https://bugzilla.suse.com/show_bug.cgi?id=1106511

https://bugzilla.suse.com/show_bug.cgi?id=1106609

https://bugzilla.suse.com/show_bug.cgi?id=1106886

https://bugzilla.suse.com/show_bug.cgi?id=1106930

https://bugzilla.suse.com/show_bug.cgi?id=1106995

https://bugzilla.suse.com/show_bug.cgi?id=1107001

https://bugzilla.suse.com/show_bug.cgi?id=1107064

https://bugzilla.suse.com/show_bug.cgi?id=1107071

https://bugzilla.suse.com/show_bug.cgi?id=1107650

https://bugzilla.suse.com/show_bug.cgi?id=1107689

https://bugzilla.suse.com/show_bug.cgi?id=1107735

https://bugzilla.suse.com/show_bug.cgi?id=1107949

https://bugzilla.suse.com/show_bug.cgi?id=1108096

https://bugzilla.suse.com/show_bug.cgi?id=1108170

https://bugzilla.suse.com/show_bug.cgi?id=1108823

https://bugzilla.suse.com/show_bug.cgi?id=1108912

https://www.suse.com/security/cve/CVE-2018-10902/

https://www.suse.com/security/cve/CVE-2018-10940/

https://www.suse.com/security/cve/CVE-2018-12896/

https://www.suse.com/security/cve/CVE-2018-14617/

https://www.suse.com/security/cve/CVE-2018-14634/

https://www.suse.com/security/cve/CVE-2018-14734/

https://www.suse.com/security/cve/CVE-2018-15572/

https://www.suse.com/security/cve/CVE-2018-15594/

https://www.suse.com/security/cve/CVE-2018-16276/

https://www.suse.com/security/cve/CVE-2018-16658/

https://www.suse.com/security/cve/CVE-2018-6554/

https://www.suse.com/security/cve/CVE-2018-6555/

http://www.nessus.org/u?76d91930

Plugin Details

Severity: High

ID: 117820

File Name: suse_SU-2018-2879-1.nasl

Version: 1.4

Type: local

Agent: unix

Published: 2018/09/28

Modified: 2018/12/01

Dependencies: 12634

Risk Information

Risk Factor: High

CVSS v2.0

Base Score: 7.2

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS v3.0

Base Score: 7.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Vulnerability Information

CPE: p-cpe:/a:novell:suse_linux:kernel-default, p-cpe:/a:novell:suse_linux:kernel-default-base, p-cpe:/a:novell:suse_linux:kernel-default-devel, p-cpe:/a:novell:suse_linux:kernel-default-man, p-cpe:/a:novell:suse_linux:kernel-ec2, p-cpe:/a:novell:suse_linux:kernel-ec2-base, p-cpe:/a:novell:suse_linux:kernel-ec2-devel, p-cpe:/a:novell:suse_linux:kernel-pae, p-cpe:/a:novell:suse_linux:kernel-pae-base, p-cpe:/a:novell:suse_linux:kernel-pae-devel, p-cpe:/a:novell:suse_linux:kernel-source, p-cpe:/a:novell:suse_linux:kernel-syms, p-cpe:/a:novell:suse_linux:kernel-trace, p-cpe:/a:novell:suse_linux:kernel-trace-base, p-cpe:/a:novell:suse_linux:kernel-trace-devel, p-cpe:/a:novell:suse_linux:kernel-xen, p-cpe:/a:novell:suse_linux:kernel-xen-base, p-cpe:/a:novell:suse_linux:kernel-xen-devel, cpe:/o:novell:suse_linux:11

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Patch Publication Date: 2018/09/26

Reference Information

CVE: CVE-2018-10902, CVE-2018-10940, CVE-2018-12896, CVE-2018-14617, CVE-2018-14634, CVE-2018-14734, CVE-2018-15572, CVE-2018-15594, CVE-2018-16276, CVE-2018-16658, CVE-2018-6554, CVE-2018-6555