SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2019:3371-1)

High Nessus Plugin ID 132389

Synopsis

The remote SUSE host is missing one or more security updates.

Description

The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2019-14895: A heap-based buffer overflow was discovered in the Linux kernel in Marvell WiFi chip driver. The flaw could occur when the station attempts a connection negotiation during the handling of the remote devices country settings. This could have allowed the remote device to cause a denial of service (system crash) or possibly execute arbitrary code (bnc#1157158).

CVE-2019-18660: The Linux kernel on powerpc allowed Information Exposure because the Spectre-RSB mitigation is not in place for all applicable CPUs. This is related to arch/powerpc/kernel/entry_64.S and arch/powerpc/kernel/security.c (bnc#1157038).

CVE-2019-18683: An issue was discovered in drivers/media/platform/vivid in the Linux kernel. It is exploitable for privilege escalation on some Linux distributions where local users have /dev/video0 access, but only if the driver happens to be loaded.
There are multiple race conditions during streaming stopping in this driver (part of the V4L2 subsystem). These issues are caused by wrong mutex locking in vivid_stop_generating_vid_cap(), vivid_stop_generating_vid_out(), sdr_cap_stop_streaming(), and the corresponding kthreads. At least one of these race conditions leads to a use-after-free (bnc#1155897).

CVE-2019-18809: A memory leak in the af9005_identify_state() function in drivers/media/usb/dvb-usb/af9005.c in the Linux kernel allowed attackers to cause a denial of service (memory consumption) (bnc#1156258).

CVE-2019-19062: A memory leak in the crypto_report() function in crypto/crypto_user_base.c in the Linux kernel allowed attackers to cause a denial of service (memory consumption) by triggering crypto_report_alg() failures (bnc#1157333).

CVE-2019-19057: Two memory leaks in the mwifiex_pcie_init_evt_ring() function in drivers/net/wireless/marvell/mwifiex/pcie.c in the Linux kernel allowed attackers to cause a denial of service (memory consumption) by triggering mwifiex_map_pci_memory() failures (bnc#1157197).

CVE-2019-19056: A memory leak in the mwifiex_pcie_alloc_cmdrsp_buf() function in drivers/net/wireless/marvell/mwifiex/pcie.c in the Linux kernel allowed attackers to cause a denial of service (memory consumption) by triggering mwifiex_map_pci_memory() failures (bnc#1157197).

CVE-2019-19068: A memory leak in the rtl8xxxu_submit_int_urb() function in drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c in the Linux kernel allowed attackers to cause a denial of service (memory consumption) by triggering usb_submit_urb() failures (bnc#1157307).

CVE-2019-19063: Two memory leaks in the rtl_usb_probe() function in drivers/net/wireless/realtek/rtlwifi/usb.c in the Linux kernel allowed attackers to cause a denial of service (memory consumption) (bnc#1157298).

CVE-2019-19227: In the AppleTalk subsystem in the Linux kernel there was a potential NULL pointer dereference because register_snap_client may return NULL. This will lead to denial of service in net/appletalk/aarp.c and net/appletalk/ddp.c, as demonstrated by unregister_snap_client (bnc#1157678).

CVE-2019-19065: A memory leak in the sdma_init() function in drivers/infiniband/hw/hfi1/sdma.c in the Linux kernel allowed attackers to cause a denial of service (memory consumption) by triggering rhashtable_init() failures (bnc#1157191).

CVE-2019-19077: A memory leak in the bnxt_re_create_srq() function in drivers/infiniband/hw/bnxt_re/ib_verbs.c in the Linux kernel allowed attackers to cause a denial of service (memory consumption) by triggering copy to udata failures (bnc#1157171).

CVE-2019-19052: A memory leak in the gs_can_open() function in drivers/net/can/usb/gs_usb.c in the Linux kernel allowed attackers to cause a denial of service (memory consumption) by triggering usb_submit_urb() failures (bnc#1157324).

CVE-2019-19067: Four memory leaks in the acp_hw_init() function in drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c in the Linux kernel allowed attackers to cause a denial of service (memory consumption) by triggering mfd_add_hotplug_devices() or pm_genpd_add_device() failures (bsc#1157180).

CVE-2019-19060: A memory leak in the adis_update_scan_mode() function in drivers/iio/imu/adis_buffer.c in the Linux kernel allowed attackers to cause a denial of service (memory consumption) (bnc#1157178).

CVE-2019-19049: A memory leak in the unittest_data_add() function in drivers/of/unittest.c in the Linux kernel allowed attackers to cause a denial of service (memory consumption) by triggering of_fdt_unflatten_tree() failures (bsc#1157173).

CVE-2019-19075: A memory leak in the ca8210_probe() function in drivers/net/ieee802154/ca8210.c in the Linux kernel allowed attackers to cause a denial of service (memory consumption) by triggering ca8210_get_platform_data() failures (bnc#1157162).

CVE-2019-19058: A memory leak in the alloc_sgtable() function in drivers/net/wireless/intel/iwlwifi/fw/dbg.c in the Linux kernel allowed attackers to cause a denial of service (memory consumption) by triggering alloc_page() failures (bnc#1157145).

CVE-2019-19074: A memory leak in the ath9k_wmi_cmd() function in drivers/net/wireless/ath/ath9k/wmi.c in the Linux kernel allowed attackers to cause a denial of service (memory consumption) (bnc#1157143).

CVE-2019-19073: Memory leaks in drivers/net/wireless/ath/ath9k/htc_hst.c in the Linux kernel allowed attackers to cause a denial of service (memory consumption) by triggering wait_for_completion_timeout() failures. This affects the htc_config_pipe_credits() function, the htc_setup_complete() function, and the htc_connect_service() function (bnc#1157070).

CVE-2019-15916: An issue was discovered in the Linux kernel There was a memory leak in register_queue_kobjects() in net/core/net-sysfs.c, which will cause denial of service (bnc#1149448).

CVE-2019-16231: drivers/net/fjes/fjes_main.c in the Linux kernel 5.2.14 did not check the alloc_workqueue return value, leading to a NULL pointer dereference (bnc#1150466).

CVE-2019-18805: An issue was discovered in net/ipv4/sysctl_net_ipv4.c in the Linux kernel There was a net/ipv4/tcp_input.c signed integer overflow in tcp_ack_update_rtt() when userspace writes a very large integer to /proc/sys/net/ipv4/tcp_min_rtt_wlen, leading to a denial of service or possibly unspecified other impact (bnc#1156187).

CVE-2019-17055: base_sock_create in drivers/isdn/mISDN/socket.c in the AF_ISDN network module in the Linux kernel did not enforce CAP_NET_RAW, which means that unprivileged users can create a raw socket (bnc#1152782).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Solution

To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or 'zypper patch'.

Alternatively you can run the command listed for your product :

SUSE Linux Enterprise Workstation Extension 12-SP4:zypper in -t patch SUSE-SLE-WE-12-SP4-2019-3371=1

SUSE Linux Enterprise Software Development Kit 12-SP4:zypper in -t patch SUSE-SLE-SDK-12-SP4-2019-3371=1

SUSE Linux Enterprise Server 12-SP4:zypper in -t patch SUSE-SLE-SERVER-12-SP4-2019-3371=1

SUSE Linux Enterprise Live Patching 12-SP4:zypper in -t patch SUSE-SLE-Live-Patching-12-SP4-2019-3371=1

SUSE Linux Enterprise High Availability 12-SP4:zypper in -t patch SUSE-SLE-HA-12-SP4-2019-3371=1

SUSE Linux Enterprise Desktop 12-SP4:zypper in -t patch SUSE-SLE-DESKTOP-12-SP4-2019-3371=1

See Also

https://bugzilla.suse.com/show_bug.cgi?id=1048942

https://bugzilla.suse.com/show_bug.cgi?id=1051510

https://bugzilla.suse.com/show_bug.cgi?id=1078248

https://bugzilla.suse.com/show_bug.cgi?id=1082635

https://bugzilla.suse.com/show_bug.cgi?id=1089644

https://bugzilla.suse.com/show_bug.cgi?id=1091041

https://bugzilla.suse.com/show_bug.cgi?id=1108043

https://bugzilla.suse.com/show_bug.cgi?id=1113722

https://bugzilla.suse.com/show_bug.cgi?id=1114279

https://bugzilla.suse.com/show_bug.cgi?id=1117169

https://bugzilla.suse.com/show_bug.cgi?id=1131107

https://bugzilla.suse.com/show_bug.cgi?id=1138039

https://bugzilla.suse.com/show_bug.cgi?id=1140948

https://bugzilla.suse.com/show_bug.cgi?id=1143706

https://bugzilla.suse.com/show_bug.cgi?id=1144333

https://bugzilla.suse.com/show_bug.cgi?id=1149448

https://bugzilla.suse.com/show_bug.cgi?id=1150466

https://bugzilla.suse.com/show_bug.cgi?id=1151548

https://bugzilla.suse.com/show_bug.cgi?id=1151900

https://bugzilla.suse.com/show_bug.cgi?id=1152782

https://bugzilla.suse.com/show_bug.cgi?id=1153628

https://bugzilla.suse.com/show_bug.cgi?id=1153681

https://bugzilla.suse.com/show_bug.cgi?id=1153811

https://bugzilla.suse.com/show_bug.cgi?id=1154043

https://bugzilla.suse.com/show_bug.cgi?id=1154058

https://bugzilla.suse.com/show_bug.cgi?id=1154124

https://bugzilla.suse.com/show_bug.cgi?id=1154355

https://bugzilla.suse.com/show_bug.cgi?id=1154526

https://bugzilla.suse.com/show_bug.cgi?id=1154956

https://bugzilla.suse.com/show_bug.cgi?id=1155021

https://bugzilla.suse.com/show_bug.cgi?id=1155689

https://bugzilla.suse.com/show_bug.cgi?id=1155692

https://bugzilla.suse.com/show_bug.cgi?id=1155836

https://bugzilla.suse.com/show_bug.cgi?id=1155897

https://bugzilla.suse.com/show_bug.cgi?id=1155921

https://bugzilla.suse.com/show_bug.cgi?id=1155982

https://bugzilla.suse.com/show_bug.cgi?id=1156187

https://bugzilla.suse.com/show_bug.cgi?id=1156258

https://bugzilla.suse.com/show_bug.cgi?id=1156429

https://bugzilla.suse.com/show_bug.cgi?id=1156466

https://bugzilla.suse.com/show_bug.cgi?id=1156471

https://bugzilla.suse.com/show_bug.cgi?id=1156494

https://bugzilla.suse.com/show_bug.cgi?id=1156609

https://bugzilla.suse.com/show_bug.cgi?id=1156700

https://bugzilla.suse.com/show_bug.cgi?id=1156729

https://bugzilla.suse.com/show_bug.cgi?id=1156882

https://bugzilla.suse.com/show_bug.cgi?id=1157038

https://bugzilla.suse.com/show_bug.cgi?id=1157042

https://bugzilla.suse.com/show_bug.cgi?id=1157070

https://bugzilla.suse.com/show_bug.cgi?id=1157143

https://bugzilla.suse.com/show_bug.cgi?id=1157145

https://bugzilla.suse.com/show_bug.cgi?id=1157158

https://bugzilla.suse.com/show_bug.cgi?id=1157162

https://bugzilla.suse.com/show_bug.cgi?id=1157171

https://bugzilla.suse.com/show_bug.cgi?id=1157173

https://bugzilla.suse.com/show_bug.cgi?id=1157178

https://bugzilla.suse.com/show_bug.cgi?id=1157180

https://bugzilla.suse.com/show_bug.cgi?id=1157182

https://bugzilla.suse.com/show_bug.cgi?id=1157183

https://bugzilla.suse.com/show_bug.cgi?id=1157184

https://bugzilla.suse.com/show_bug.cgi?id=1157191

https://bugzilla.suse.com/show_bug.cgi?id=1157193

https://bugzilla.suse.com/show_bug.cgi?id=1157197

https://bugzilla.suse.com/show_bug.cgi?id=1157298

https://bugzilla.suse.com/show_bug.cgi?id=1157307

https://bugzilla.suse.com/show_bug.cgi?id=1157324

https://bugzilla.suse.com/show_bug.cgi?id=1157333

https://bugzilla.suse.com/show_bug.cgi?id=1157424

https://bugzilla.suse.com/show_bug.cgi?id=1157463

https://bugzilla.suse.com/show_bug.cgi?id=1157499

https://bugzilla.suse.com/show_bug.cgi?id=1157678

https://bugzilla.suse.com/show_bug.cgi?id=1157698

https://bugzilla.suse.com/show_bug.cgi?id=1157778

https://bugzilla.suse.com/show_bug.cgi?id=1157908

https://bugzilla.suse.com/show_bug.cgi?id=1158049

https://bugzilla.suse.com/show_bug.cgi?id=1158063

https://bugzilla.suse.com/show_bug.cgi?id=1158064

https://bugzilla.suse.com/show_bug.cgi?id=1158065

https://bugzilla.suse.com/show_bug.cgi?id=1158066

https://bugzilla.suse.com/show_bug.cgi?id=1158067

https://bugzilla.suse.com/show_bug.cgi?id=1158068

https://bugzilla.suse.com/show_bug.cgi?id=1158082

https://www.suse.com/security/cve/CVE-2019-14895/

https://www.suse.com/security/cve/CVE-2019-15916/

https://www.suse.com/security/cve/CVE-2019-16231/

https://www.suse.com/security/cve/CVE-2019-17055/

https://www.suse.com/security/cve/CVE-2019-18660/

https://www.suse.com/security/cve/CVE-2019-18683/

https://www.suse.com/security/cve/CVE-2019-18805/

https://www.suse.com/security/cve/CVE-2019-18809/

https://www.suse.com/security/cve/CVE-2019-19049/

https://www.suse.com/security/cve/CVE-2019-19052/

https://www.suse.com/security/cve/CVE-2019-19056/

https://www.suse.com/security/cve/CVE-2019-19057/

https://www.suse.com/security/cve/CVE-2019-19058/

https://www.suse.com/security/cve/CVE-2019-19060/

https://www.suse.com/security/cve/CVE-2019-19062/

https://www.suse.com/security/cve/CVE-2019-19063/

https://www.suse.com/security/cve/CVE-2019-19065/

https://www.suse.com/security/cve/CVE-2019-19067/

https://www.suse.com/security/cve/CVE-2019-19068/

https://www.suse.com/security/cve/CVE-2019-19073/

https://www.suse.com/security/cve/CVE-2019-19074/

https://www.suse.com/security/cve/CVE-2019-19075/

https://www.suse.com/security/cve/CVE-2019-19077/

https://www.suse.com/security/cve/CVE-2019-19227/

http://www.nessus.org/u?4014466b

Plugin Details

Severity: High

ID: 132389

File Name: suse_SU-2019-3371-1.nasl

Version: 1.2

Type: local

Agent: unix

Published: 2019/12/23

Updated: 2019/12/27

Dependencies: 12634

Risk Information

Risk Factor: High

CVSS Score Source: CVE-2019-18805

CVSS v2.0

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Temporal Vector: CVSS2#E:U/RL:OF/RC:C

CVSS v3.0

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:novell:suse_linux:kernel-default, p-cpe:/a:novell:suse_linux:kernel-default-base, p-cpe:/a:novell:suse_linux:kernel-default-base-debuginfo, p-cpe:/a:novell:suse_linux:kernel-default-debuginfo, p-cpe:/a:novell:suse_linux:kernel-default-debugsource, p-cpe:/a:novell:suse_linux:kernel-default-devel, p-cpe:/a:novell:suse_linux:kernel-default-devel-debuginfo, p-cpe:/a:novell:suse_linux:kernel-default-extra, p-cpe:/a:novell:suse_linux:kernel-default-extra-debuginfo, p-cpe:/a:novell:suse_linux:kernel-default-man, p-cpe:/a:novell:suse_linux:kernel-syms, cpe:/o:novell:suse_linux:12

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 2019/12/19

Vulnerability Publication Date: 2019/09/04

Reference Information

CVE: CVE-2019-14895, CVE-2019-15916, CVE-2019-16231, CVE-2019-17055, CVE-2019-18660, CVE-2019-18683, CVE-2019-18805, CVE-2019-18809, CVE-2019-19049, CVE-2019-19052, CVE-2019-19056, CVE-2019-19057, CVE-2019-19058, CVE-2019-19060, CVE-2019-19062, CVE-2019-19063, CVE-2019-19065, CVE-2019-19067, CVE-2019-19068, CVE-2019-19073, CVE-2019-19074, CVE-2019-19075, CVE-2019-19077, CVE-2019-19227