SUSE SLES12 Security Update : kernel (SUSE-SU-2019:0439-1)

High Nessus Plugin ID 122343

Synopsis

The remote SUSE host is missing one or more security updates.

Description

The SUSE Linux Enterprise 12 SP2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2018-19985: The function hso_probe read if_num from the USB device (as an u8) and used it without a length check to index an array, resulting in an OOB memory read in hso_probe or hso_get_config_data that could be used by local attackers (bnc#1120743).

CVE-2018-16884: NFS41+ shares mounted in different network namespaces at the same time can make bc_svc_process() use wrong back-channel IDs and cause a use-after-free vulnerability. Thus a malicious container user can cause a host kernel memory corruption and a system panic. Due to the nature of the flaw, privilege escalation cannot be fully ruled out (bnc#1119946).

CVE-2018-20169: The USB subsystem mishandled size checks during the reading of an extra descriptor, related to __usb_get_extra_descriptor in drivers/usb/core/usb.c (bnc#1119714).

CVE-2018-9568: In sk_clone_lock of sock.c, there is a possible memory corruption due to type confusion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. (bnc#1118319).

CVE-2018-16862: A security flaw was found in a way that the cleancache subsystem clears an inode after the final file truncation (removal).
The new file created with the same inode may contain leftover pages from cleancache and the old file data instead of the new one (bnc#1117186).

CVE-2018-19824: A local user could exploit a use-after-free in the ALSA driver by supplying a malicious USB Sound device (with zero interfaces) that is mishandled in usb_audio_probe in sound/usb/card.c (bnc#1118152).

CVE-2018-18281: The mremap() syscall performs TLB flushes after dropping pagetable locks. If a syscall such as ftruncate() removes entries from the pagetables of a task that is in the middle of mremap(), a stale TLB entry can remain for a short time that permits access to a physical page after it has been released back to the page allocator and reused. (bnc#1113769).

CVE-2018-18710: An information leak in cdrom_ioctl_select_disc in drivers/cdrom/cdrom.c could be used by local attackers to read kernel memory because a cast from unsigned long to int interferes with bounds checking. This is similar to CVE-2018-10940 and CVE-2018-16658 (bnc#1113751).

CVE-2018-18690: A local attacker able to set attributes on an xfs filesystem could make this filesystem non-operational until the next mount by triggering an unchecked error condition during an xfs attribute change, because xfs_attr_shortform_addname in fs/xfs/libxfs/xfs_attr.c mishandled ATTR_REPLACE operations with conversion of an attr from short to long form (bnc#1105025).

CVE-2018-18386: drivers/tty/n_tty.c allowed local attackers (who are able to access pseudo terminals) to hang/block further usage of any pseudo terminal devices due to an EXTPROC versus ICANON confusion in TIOCINQ (bnc#1094825).

CVE-2018-9516: In hid_debug_events_read of drivers/hid/hid-debug.c, there is a possible out of bounds write due to a missing bounds check.
This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
(bnc#1108498).

CVE-2019-3459, CVE-2019-3460: The Blutooth stack suffered from two remote information leak vulnerabilities in the code that handles incoming L2cap configuration packets (bsc#1120758).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Solution

To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or 'zypper patch'.

Alternatively you can run the command listed for your product :

SUSE OpenStack Cloud 7:zypper in -t patch SUSE-OpenStack-Cloud-7-2019-439=1

SUSE Linux Enterprise Server for SAP 12-SP2:zypper in -t patch SUSE-SLE-SAP-12-SP2-2019-439=1

SUSE Linux Enterprise Server 12-SP2-LTSS:zypper in -t patch SUSE-SLE-SERVER-12-SP2-2019-439=1

SUSE Linux Enterprise Server 12-SP2-BCL:zypper in -t patch SUSE-SLE-SERVER-12-SP2-BCL-2019-439=1

SUSE Linux Enterprise High Availability 12-SP2:zypper in -t patch SUSE-SLE-HA-12-SP2-2019-439=1

SUSE Enterprise Storage 4:zypper in -t patch SUSE-Storage-4-2019-439=1

OpenStack Cloud Magnum Orchestration 7:zypper in -t patch SUSE-OpenStack-Cloud-Magnum-Orchestration-7-2019-439=1

See Also

https://bugzilla.suse.com/show_bug.cgi?id=1012382

https://bugzilla.suse.com/show_bug.cgi?id=1023175

https://bugzilla.suse.com/show_bug.cgi?id=1042286

https://bugzilla.suse.com/show_bug.cgi?id=1065600

https://bugzilla.suse.com/show_bug.cgi?id=1065726

https://bugzilla.suse.com/show_bug.cgi?id=1070805

https://bugzilla.suse.com/show_bug.cgi?id=1084721

https://bugzilla.suse.com/show_bug.cgi?id=1086095

https://bugzilla.suse.com/show_bug.cgi?id=1086535

https://bugzilla.suse.com/show_bug.cgi?id=1091158

https://bugzilla.suse.com/show_bug.cgi?id=1091171

https://bugzilla.suse.com/show_bug.cgi?id=1091197

https://bugzilla.suse.com/show_bug.cgi?id=1094825

https://bugzilla.suse.com/show_bug.cgi?id=1095344

https://bugzilla.suse.com/show_bug.cgi?id=1098996

https://bugzilla.suse.com/show_bug.cgi?id=1099523

https://bugzilla.suse.com/show_bug.cgi?id=1099597

https://bugzilla.suse.com/show_bug.cgi?id=1100105

https://bugzilla.suse.com/show_bug.cgi?id=1101555

https://bugzilla.suse.com/show_bug.cgi?id=1103624

https://bugzilla.suse.com/show_bug.cgi?id=1104731

https://bugzilla.suse.com/show_bug.cgi?id=1105025

https://bugzilla.suse.com/show_bug.cgi?id=1105931

https://bugzilla.suse.com/show_bug.cgi?id=1106293

https://bugzilla.suse.com/show_bug.cgi?id=1107256

https://bugzilla.suse.com/show_bug.cgi?id=1107299

https://bugzilla.suse.com/show_bug.cgi?id=1107385

https://bugzilla.suse.com/show_bug.cgi?id=1107866

https://bugzilla.suse.com/show_bug.cgi?id=1108145

https://bugzilla.suse.com/show_bug.cgi?id=1108498

https://bugzilla.suse.com/show_bug.cgi?id=1109330

https://bugzilla.suse.com/show_bug.cgi?id=1110286

https://bugzilla.suse.com/show_bug.cgi?id=1110837

https://bugzilla.suse.com/show_bug.cgi?id=1111062

https://bugzilla.suse.com/show_bug.cgi?id=1113192

https://bugzilla.suse.com/show_bug.cgi?id=1113751

https://bugzilla.suse.com/show_bug.cgi?id=1113769

https://bugzilla.suse.com/show_bug.cgi?id=1114190

https://bugzilla.suse.com/show_bug.cgi?id=1114648

https://bugzilla.suse.com/show_bug.cgi?id=1114763

https://bugzilla.suse.com/show_bug.cgi?id=1115433

https://bugzilla.suse.com/show_bug.cgi?id=1115440

https://bugzilla.suse.com/show_bug.cgi?id=1116027

https://bugzilla.suse.com/show_bug.cgi?id=1116183

https://bugzilla.suse.com/show_bug.cgi?id=1116345

https://bugzilla.suse.com/show_bug.cgi?id=1117186

https://bugzilla.suse.com/show_bug.cgi?id=1117187

https://bugzilla.suse.com/show_bug.cgi?id=1118152

https://bugzilla.suse.com/show_bug.cgi?id=1118319

https://bugzilla.suse.com/show_bug.cgi?id=1119714

https://bugzilla.suse.com/show_bug.cgi?id=1119946

https://bugzilla.suse.com/show_bug.cgi?id=1119947

https://bugzilla.suse.com/show_bug.cgi?id=1120743

https://bugzilla.suse.com/show_bug.cgi?id=1120758

https://bugzilla.suse.com/show_bug.cgi?id=1121621

https://bugzilla.suse.com/show_bug.cgi?id=1123161

https://www.suse.com/security/cve/CVE-2018-16862/

https://www.suse.com/security/cve/CVE-2018-16884/

https://www.suse.com/security/cve/CVE-2018-18281/

https://www.suse.com/security/cve/CVE-2018-18386/

https://www.suse.com/security/cve/CVE-2018-18690/

https://www.suse.com/security/cve/CVE-2018-18710/

https://www.suse.com/security/cve/CVE-2018-19824/

https://www.suse.com/security/cve/CVE-2018-19985/

https://www.suse.com/security/cve/CVE-2018-20169/

https://www.suse.com/security/cve/CVE-2018-9516/

https://www.suse.com/security/cve/CVE-2018-9568/

https://www.suse.com/security/cve/CVE-2019-3459/

https://www.suse.com/security/cve/CVE-2019-3460/

http://www.nessus.org/u?91b39243

Plugin Details

Severity: High

ID: 122343

File Name: suse_SU-2019-0439-1.nasl

Version: 1.2

Type: local

Agent: unix

Published: 2019/02/20

Updated: 2019/04/02

Dependencies: 12634

Risk Information

Risk Factor: High

CVSS v2.0

Base Score: 7.2

Temporal Score: 5.6

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:POC/RL:OF/RC:C

CVSS v3.0

Base Score: 8

Temporal Score: 7.2

Vector: CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:novell:suse_linux:kernel-default, p-cpe:/a:novell:suse_linux:kernel-default-base, p-cpe:/a:novell:suse_linux:kernel-default-base-debuginfo, p-cpe:/a:novell:suse_linux:kernel-default-debuginfo, p-cpe:/a:novell:suse_linux:kernel-default-debugsource, p-cpe:/a:novell:suse_linux:kernel-default-devel, p-cpe:/a:novell:suse_linux:kernel-default-man, p-cpe:/a:novell:suse_linux:kernel-syms, p-cpe:/a:novell:suse_linux:kgraft-patch-4_4_121-92_101-default, cpe:/o:novell:suse_linux:12

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2019/02/19

Vulnerability Publication Date: 2018/05/09

Reference Information

CVE: CVE-2018-10940, CVE-2018-16658, CVE-2018-16862, CVE-2018-16884, CVE-2018-18281, CVE-2018-18386, CVE-2018-18690, CVE-2018-18710, CVE-2018-19824, CVE-2018-19985, CVE-2018-20169, CVE-2018-9516, CVE-2018-9568, CVE-2019-3459, CVE-2019-3460