openSUSE Security Update : kernel (openSUSE-SU-2014:0677-1)

Critical Nessus Plugin ID 75364

Synopsis

The remote openSUSE host is missing a security update.

Description

The Linux Kernel was updated to fix various security issues and bugs.

Main security issues fixed :

A security issue in the tty layer that was fixed that could be used by local attackers for code execution (CVE-2014-0196).

Two security issues in the floppy driver were fixed that could be used by local attackers on machines with the floppy to crash the kernel or potentially execute code in the kernel (CVE-2014-1737 CVE-2014-1738).

Other security issues and bugs that were fixed :

- netfilter: nf_nat: fix access to uninitialized buffer in IRC NAT helper (bnc#860835 CVE-2014-1690).

- net: sctp: fix sctp_sf_do_5_1D_ce to verify if we/peer is AUTH (bnc#866102, CVE-2014-0101).

- n_tty: Fix a n_tty_write crash and code execution when echoing in raw mode (bnc#871252 bnc#875690 CVE-2014-0196).

- netfilter: nf_ct_sip: support Cisco 7941/7945 IP phones (bnc#873717).

- Update config files: re-enable twofish crypto support Software twofish crypto support was disabled in several architectures since openSUSE 10.3. For i386 and x86_64 it was on purpose, because hardware-accelerated alternatives exist. However for all other architectures it was by accident. Re-enable software twofish crypto support in arm, ia64 and ppc configuration files, to guarantee that at least one implementation is always available (bnc#871325).

- Update config files: disable CONFIG_TOUCHSCREEN_W90X900 The w90p910_ts driver only makes sense on the W90x900 architecture, which we do not support.

- ath9k: protect tid->sched check (bnc#871148,CVE-2014-2672).

- Fix dst_neigh_lookup/dst_neigh_lookup_skb return value handling bug (bnc#869898).

- SELinux: Fix kernel BUG on empty security contexts (bnc#863335,CVE-2014-1874).

- hamradio/yam: fix info leak in ioctl (bnc#858872, CVE-2014-1446).

- wanxl: fix info leak in ioctl (bnc#858870, CVE-2014-1445).

- farsync: fix info leak in ioctl (bnc#858869, CVE-2014-1444).

- ARM: 7809/1: perf: fix event validation for software group leaders (CVE-2013-4254, bnc#837111).

- netfilter: nf_conntrack_dccp: fix skb_header_pointer API usages (bnc#868653, CVE-2014-2523).

- ath9k_htc: properly set MAC address and BSSID mask (bnc#851426, CVE-2013-4579).

- drm/ttm: don't oops if no invalidate_caches() (bnc#869414).

- Apply missing patches.fixes/drm-nouveau-hwmon-rename-fan0-to-fan1.patc h

- xfs: growfs: use uncached buffers for new headers (bnc#858233).

- xfs: use btree block initialisation functions in growfs (bnc#858233).

- Revert 'Delete patches.fixes/xfs-fix-xfs_buf_find-oops-on-blocks-beyond
-the-filesystem-end.' (bnc#858233) Put back again the patch patches.fixes/xfs-fix-xfs_buf_find-oops-on-blocks-beyond
-the-filesystem-end back as there is a better fix than reverting the affecting patch.

- Delete patches.fixes/xfs-fix-xfs_buf_find-oops-on-blocks-beyond
-the-filesystem-end. It turned out that this patch causes regressions (bnc#858233) The upstream 3.7.x also reverted it in the end (commit c3793e0d94af2).

- tcp: syncookies: reduce cookie lifetime to 128 seconds (bnc#833968).

- tcp: syncookies: reduce mss table to four values (bnc#833968).

- x86, cpu, amd: Add workaround for family 16h, erratum 793 (bnc#852967 CVE-2013-6885).

- cifs: ensure that uncached writes handle unmapped areas correctly (bnc#864025 CVE-2014-0691).

- x86, fpu, amd: Clear exceptions in AMD FXSAVE workaround (bnc#858638 CVE-2014-1438).

- xencons: generalize use of add_preferred_console() (bnc#733022, bnc#852652).

- balloon: don't crash in HVM-with-PoD guests.

- hwmon: (coretemp) Fix truncated name of alarm attributes.

- NFS: Avoid PUTROOTFH when managing leases (bnc#811746).

- cifs: delay super block destruction until all cifsFileInfo objects are gone (bnc#862145).

Solution

Update the affected kernel packages.

See Also

https://bugzilla.novell.com/show_bug.cgi?id=733022

https://bugzilla.novell.com/show_bug.cgi?id=811746

https://bugzilla.novell.com/show_bug.cgi?id=833968

https://bugzilla.novell.com/show_bug.cgi?id=837111

https://bugzilla.novell.com/show_bug.cgi?id=851426

https://bugzilla.novell.com/show_bug.cgi?id=852652

https://bugzilla.novell.com/show_bug.cgi?id=852967

https://bugzilla.novell.com/show_bug.cgi?id=858233

https://bugzilla.novell.com/show_bug.cgi?id=858638

https://bugzilla.novell.com/show_bug.cgi?id=858869

https://bugzilla.novell.com/show_bug.cgi?id=858870

https://bugzilla.novell.com/show_bug.cgi?id=858872

https://bugzilla.novell.com/show_bug.cgi?id=860835

https://bugzilla.novell.com/show_bug.cgi?id=862145

https://bugzilla.novell.com/show_bug.cgi?id=863335

https://bugzilla.novell.com/show_bug.cgi?id=864025

https://bugzilla.novell.com/show_bug.cgi?id=866102

https://bugzilla.novell.com/show_bug.cgi?id=868653

https://bugzilla.novell.com/show_bug.cgi?id=869414

https://bugzilla.novell.com/show_bug.cgi?id=869898

https://bugzilla.novell.com/show_bug.cgi?id=871148

https://bugzilla.novell.com/show_bug.cgi?id=871252

https://bugzilla.novell.com/show_bug.cgi?id=871325

https://bugzilla.novell.com/show_bug.cgi?id=873717

https://bugzilla.novell.com/show_bug.cgi?id=875690

https://bugzilla.novell.com/show_bug.cgi?id=875798

https://lists.opensuse.org/opensuse-updates/2014-05/msg00055.html

Plugin Details

Severity: Critical

ID: 75364

File Name: openSUSE-2014-376.nasl

Version: 1.6

Type: local

Agent: unix

Published: 2014/06/13

Updated: 2018/11/10

Dependencies: 12634

Risk Information

Risk Factor: Critical

CVSS v2.0

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS v3.0

Base Score: 7.3

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Vulnerability Information

CPE: p-cpe:/a:novell:opensuse:kernel-debug, p-cpe:/a:novell:opensuse:kernel-debug-base, p-cpe:/a:novell:opensuse:kernel-debug-base-debuginfo, p-cpe:/a:novell:opensuse:kernel-debug-debuginfo, p-cpe:/a:novell:opensuse:kernel-debug-debugsource, p-cpe:/a:novell:opensuse:kernel-debug-devel, p-cpe:/a:novell:opensuse:kernel-debug-devel-debuginfo, p-cpe:/a:novell:opensuse:kernel-default, p-cpe:/a:novell:opensuse:kernel-default-base, p-cpe:/a:novell:opensuse:kernel-default-base-debuginfo, p-cpe:/a:novell:opensuse:kernel-default-debuginfo, p-cpe:/a:novell:opensuse:kernel-default-debugsource, p-cpe:/a:novell:opensuse:kernel-default-devel, p-cpe:/a:novell:opensuse:kernel-default-devel-debuginfo, p-cpe:/a:novell:opensuse:kernel-desktop, p-cpe:/a:novell:opensuse:kernel-desktop-base, p-cpe:/a:novell:opensuse:kernel-desktop-base-debuginfo, p-cpe:/a:novell:opensuse:kernel-desktop-debuginfo, p-cpe:/a:novell:opensuse:kernel-desktop-debugsource, p-cpe:/a:novell:opensuse:kernel-desktop-devel, p-cpe:/a:novell:opensuse:kernel-desktop-devel-debuginfo, p-cpe:/a:novell:opensuse:kernel-devel, p-cpe:/a:novell:opensuse:kernel-ec2, p-cpe:/a:novell:opensuse:kernel-ec2-base, p-cpe:/a:novell:opensuse:kernel-ec2-base-debuginfo, p-cpe:/a:novell:opensuse:kernel-ec2-debuginfo, p-cpe:/a:novell:opensuse:kernel-ec2-debugsource, p-cpe:/a:novell:opensuse:kernel-ec2-devel, p-cpe:/a:novell:opensuse:kernel-ec2-devel-debuginfo, p-cpe:/a:novell:opensuse:kernel-pae, p-cpe:/a:novell:opensuse:kernel-pae-base, p-cpe:/a:novell:opensuse:kernel-pae-base-debuginfo, p-cpe:/a:novell:opensuse:kernel-pae-debuginfo, p-cpe:/a:novell:opensuse:kernel-pae-debugsource, p-cpe:/a:novell:opensuse:kernel-pae-devel, p-cpe:/a:novell:opensuse:kernel-pae-devel-debuginfo, p-cpe:/a:novell:opensuse:kernel-source, p-cpe:/a:novell:opensuse:kernel-source-vanilla, p-cpe:/a:novell:opensuse:kernel-syms, p-cpe:/a:novell:opensuse:kernel-trace, p-cpe:/a:novell:opensuse:kernel-trace-base, p-cpe:/a:novell:opensuse:kernel-trace-base-debuginfo, p-cpe:/a:novell:opensuse:kernel-trace-debuginfo, p-cpe:/a:novell:opensuse:kernel-trace-debugsource, p-cpe:/a:novell:opensuse:kernel-trace-devel, p-cpe:/a:novell:opensuse:kernel-trace-devel-debuginfo, p-cpe:/a:novell:opensuse:kernel-vanilla, p-cpe:/a:novell:opensuse:kernel-vanilla-debuginfo, p-cpe:/a:novell:opensuse:kernel-vanilla-debugsource, p-cpe:/a:novell:opensuse:kernel-vanilla-devel, p-cpe:/a:novell:opensuse:kernel-vanilla-devel-debuginfo, p-cpe:/a:novell:opensuse:kernel-xen, p-cpe:/a:novell:opensuse:kernel-xen-base, p-cpe:/a:novell:opensuse:kernel-xen-base-debuginfo, p-cpe:/a:novell:opensuse:kernel-xen-debuginfo, p-cpe:/a:novell:opensuse:kernel-xen-debugsource, p-cpe:/a:novell:opensuse:kernel-xen-devel, p-cpe:/a:novell:opensuse:kernel-xen-devel-debuginfo, cpe:/o:novell:opensuse:12.3

Required KB Items: Host/local_checks_enabled, Host/SuSE/release, Host/SuSE/rpm-list, Host/cpu

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2014/05/12

Exploitable With

CANVAS (CANVAS)

Core Impact

Reference Information

CVE: CVE-2013-4254, CVE-2013-4579, CVE-2013-6885, CVE-2014-0101, CVE-2014-0196, CVE-2014-0691, CVE-2014-1438, CVE-2014-1444, CVE-2014-1445, CVE-2014-1446, CVE-2014-1690, CVE-2014-1737, CVE-2014-1738, CVE-2014-1874, CVE-2014-2523, CVE-2014-2672