SUSE SLES11 Security Update : kernel (SUSE-SU-2017:0494-1)

Critical Nessus Plugin ID 97297

Synopsis

The remote SUSE host is missing one or more security updates.

Description

The SUSE Linux Enterprise 11 SP3 LTSS kernel was updated to receive various security and bugfixes. The following security bugs were fixed :

- CVE-2015-8970: crypto/algif_skcipher.c in the Linux kernel did not verify that a setkey operation has been performed on an AF_ALG socket before an accept system call is processed, which allowed local users to cause a denial of service (NULL pointer dereference and system crash) via a crafted application that did not supply a key, related to the lrw_crypt function in crypto/lrw.c (bnc#1008374).

- CVE-2017-5551: Clear S_ISGID on tmpfs when setting posix ACLs (bsc#1021258).

- CVE-2016-7097: The filesystem implementation in the Linux kernel preserves the setgid bit during a setxattr call, which allowed local users to gain group privileges by leveraging the existence of a setgid program with restrictions on execute permissions (bnc#995968).

- CVE-2016-10088: The sg implementation in the Linux kernel did not properly restrict write operations in situations where the KERNEL_DS option is set, which allowed local users to read or write to arbitrary kernel memory locations or cause a denial of service (use-after-free) by leveraging access to a /dev/sg device, related to block/bsg.c and drivers/scsi/sg.c.
NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-9576 (bnc#1017710).

- CVE-2004-0230: TCP, when using a large Window Size, made it easier for remote attackers to guess sequence numbers and cause a denial of service (connection loss) to persistent TCP connections by repeatedly injecting a TCP RST packet, especially in protocols that use long-lived connections, such as BGP (bnc#969340).

- CVE-2016-8632: The tipc_msg_build function in net/tipc/msg.c in the Linux kernel did not validate the relationship between the minimum fragment length and the maximum packet size, which allowed local users to gain privileges or cause a denial of service (heap-based buffer overflow) by leveraging the CAP_NET_ADMIN capability (bnc#1008831).

- CVE-2016-8399: An elevation of privilege vulnerability in the kernel networking subsystem could have enabled a local malicious application to execute arbitrary code within the context of the kernel bnc#1014746).

- CVE-2016-9793: The sock_setsockopt function in net/core/sock.c in the Linux kernel mishandled negative values of sk_sndbuf and sk_rcvbuf, which allowed local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact by leveraging the CAP_NET_ADMIN capability for a crafted setsockopt system call with the (1) SO_SNDBUFFORCE or (2) SO_RCVBUFFORCE option (bnc#1013531).

- CVE-2012-6704: The sock_setsockopt function in net/core/sock.c in the Linux kernel mishandled negative values of sk_sndbuf and sk_rcvbuf, which allowed local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact by leveraging the CAP_NET_ADMIN capability for a crafted setsockopt system call with the (1) SO_SNDBUF or (2) SO_RCVBUF option (bnc#1013542).

- CVE-2016-9756: arch/x86/kvm/emulate.c in the Linux kernel did not properly initialize Code Segment (CS) in certain error cases, which allowed local users to obtain sensitive information from kernel stack memory via a crafted application (bnc#1013038).

- CVE-2016-3841: The IPv6 stack in the Linux kernel mishandled options data, which allowed local users to gain privileges or cause a denial of service (use-after-free and system crash) via a crafted sendmsg system call (bnc#992566).

- CVE-2016-9685: Multiple memory leaks in error paths in fs/xfs/xfs_attr_list.c in the Linux kernel allowed local users to cause a denial of service (memory consumption) via crafted XFS filesystem operations (bnc#1012832).

- CVE-2015-1350: The VFS subsystem in the Linux kernel provided an incomplete set of requirements for setattr operations that underspecifies removing extended privilege attributes, which allowed local users to cause a denial of service (capability stripping) via a failed invocation of a system call, as demonstrated by using chown to remove a capability from the ping or Wireshark dumpcap program (bnc#914939).

- CVE-2015-8962: Double free vulnerability in the sg_common_write function in drivers/scsi/sg.c in the Linux kernel allowed local users to gain privileges or cause a denial of service (memory corruption and system crash) by detaching a device during an SG_IO ioctl call (bnc#1010501).

- CVE-2016-9555: The sctp_sf_ootb function in net/sctp/sm_statefuns.c in the Linux kernel lacked chunk-length checking for the first chunk, which allowed remote attackers to cause a denial of service (out-of-bounds slab access) or possibly have unspecified other impact via crafted SCTP data (bnc#1011685).

- CVE-2016-7910: Use-after-free vulnerability in the disk_seqf_stop function in block/genhd.c in the Linux kernel allowed local users to gain privileges by leveraging the execution of a certain stop operation even if the corresponding start operation had failed (bnc#1010716).

- CVE-2016-7911: Race condition in the get_task_ioprio function in block/ioprio.c in the Linux kernel allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted ioprio_get system call (bnc#1010711).

- CVE-2015-8964: The tty_set_termios_ldisc function in drivers/tty/tty_ldisc.c in the Linux kernel allowed local users to obtain sensitive information from kernel memory by reading a tty data structure (bnc#1010507).

- CVE-2016-7916: Race condition in the environ_read function in fs/proc/base.c in the Linux kernel allowed local users to obtain sensitive information from kernel memory by reading a /proc/*/environ file during a process-setup time interval in which environment-variable copying is incomplete (bnc#1010467).

- CVE-2016-8646: The hash_accept function in crypto/algif_hash.c in the Linux kernel allowed local users to cause a denial of service (OOPS) by attempting to trigger use of in-kernel hash algorithms for a socket that has received zero bytes of data (bnc#1010150).

- CVE-2016-8633: drivers/firewire/net.c in the Linux kernel in certain unusual hardware configurations allowed remote attackers to execute arbitrary code via crafted fragmented packets (bnc#1008833).

- CVE-2016-7042: The proc_keys_show function in security/keys/proc.c in the Linux, when the GNU Compiler Collection (gcc) stack protector is enabled, used an incorrect buffer size for certain timeout data, which allowed local users to cause a denial of service (stack memory corruption and panic) by reading the /proc/keys file (bnc#1004517).

- CVE-2015-8956: The rfcomm_sock_bind function in net/bluetooth/rfcomm/sock.c in the Linux kernel allowed local users to obtain sensitive information or cause a denial of service (NULL pointer dereference) via vectors involving a bind system call on a Bluetooth RFCOMM socket (bnc#1003925).

- CVE-2016-7117: Use-after-free vulnerability in the
__sys_recvmmsg function in net/socket.c in the Linux kernel allowed remote attackers to execute arbitrary code via vectors involving a recvmmsg system call that is mishandled during error processing (bnc#1003077).

- CVE-2016-0823: The pagemap_open function in fs/proc/task_mmu.c in the Linux kernel allowed local users to obtain sensitive physical-address information by reading a pagemap file (bnc#994759).

- CVE-2016-7425: The arcmsr_iop_message_xfer function in drivers/scsi/arcmsr/arcmsr_hba.c in the Linux kernel did not restrict a certain length field, which allowed local users to gain privileges or cause a denial of service (heap-based buffer overflow) via an ARCMSR_MESSAGE_WRITE_WQBUFFER control code (bnc#999932).

- CVE-2016-6828: The tcp_check_send_head function in include/net/tcp.h in the Linux kernel did not properly maintain certain SACK state after a failed data copy, which allowed local users to cause a denial of service (tcp_xmit_retransmit_queue use-after-free and system crash) via a crafted SACK option (bnc#994296).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Solution

To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product :

SUSE OpenStack Cloud 5:zypper in -t patch sleclo50sp3-linux-kernel-12992=1

SUSE Manager Proxy 2.1:zypper in -t patch slemap21-linux-kernel-12992=1

SUSE Manager 2.1:zypper in -t patch sleman21-linux-kernel-12992=1

SUSE Linux Enterprise Server 11-SP3-LTSS:zypper in -t patch slessp3-linux-kernel-12992=1

SUSE Linux Enterprise Server 11-EXTRA:zypper in -t patch slexsp3-linux-kernel-12992=1

SUSE Linux Enterprise Point of Sale 11-SP3:zypper in -t patch sleposp3-linux-kernel-12992=1

SUSE Linux Enterprise Debuginfo 11-SP3:zypper in -t patch dbgsp3-linux-kernel-12992=1

To bring your system up-to-date, use 'zypper patch'.

See Also

https://bugzilla.suse.com/show_bug.cgi?id=1001419

https://bugzilla.suse.com/show_bug.cgi?id=1002165

https://bugzilla.suse.com/show_bug.cgi?id=1003077

https://bugzilla.suse.com/show_bug.cgi?id=1003253

https://bugzilla.suse.com/show_bug.cgi?id=1003925

https://bugzilla.suse.com/show_bug.cgi?id=1004517

https://bugzilla.suse.com/show_bug.cgi?id=1007944

https://bugzilla.suse.com/show_bug.cgi?id=1008374

https://bugzilla.suse.com/show_bug.cgi?id=1008645

https://bugzilla.suse.com/show_bug.cgi?id=1008831

https://bugzilla.suse.com/show_bug.cgi?id=1008833

https://bugzilla.suse.com/show_bug.cgi?id=1008850

https://bugzilla.suse.com/show_bug.cgi?id=1009875

https://bugzilla.suse.com/show_bug.cgi?id=1010150

https://bugzilla.suse.com/show_bug.cgi?id=1010467

https://bugzilla.suse.com/show_bug.cgi?id=1010501

https://bugzilla.suse.com/show_bug.cgi?id=1010507

https://bugzilla.suse.com/show_bug.cgi?id=1010711

https://bugzilla.suse.com/show_bug.cgi?id=1010713

https://bugzilla.suse.com/show_bug.cgi?id=1010716

https://bugzilla.suse.com/show_bug.cgi?id=1011685

https://bugzilla.suse.com/show_bug.cgi?id=1011820

https://bugzilla.suse.com/show_bug.cgi?id=1012183

https://bugzilla.suse.com/show_bug.cgi?id=1012422

https://bugzilla.suse.com/show_bug.cgi?id=1012832

https://bugzilla.suse.com/show_bug.cgi?id=1012851

https://bugzilla.suse.com/show_bug.cgi?id=1012852

https://bugzilla.suse.com/show_bug.cgi?id=1012895

https://bugzilla.suse.com/show_bug.cgi?id=1013038

https://bugzilla.suse.com/show_bug.cgi?id=1013042

https://bugzilla.suse.com/show_bug.cgi?id=1013531

https://bugzilla.suse.com/show_bug.cgi?id=1013542

https://bugzilla.suse.com/show_bug.cgi?id=1014454

https://bugzilla.suse.com/show_bug.cgi?id=1014746

https://bugzilla.suse.com/show_bug.cgi?id=1015878

https://bugzilla.suse.com/show_bug.cgi?id=1017710

https://bugzilla.suse.com/show_bug.cgi?id=1018446

https://bugzilla.suse.com/show_bug.cgi?id=1019079

https://bugzilla.suse.com/show_bug.cgi?id=1019783

https://bugzilla.suse.com/show_bug.cgi?id=1021258

https://bugzilla.suse.com/show_bug.cgi?id=821612

https://bugzilla.suse.com/show_bug.cgi?id=824171

https://bugzilla.suse.com/show_bug.cgi?id=914939

https://bugzilla.suse.com/show_bug.cgi?id=929141

https://bugzilla.suse.com/show_bug.cgi?id=935436

https://bugzilla.suse.com/show_bug.cgi?id=956514

https://bugzilla.suse.com/show_bug.cgi?id=961923

https://bugzilla.suse.com/show_bug.cgi?id=966826

https://bugzilla.suse.com/show_bug.cgi?id=967716

https://bugzilla.suse.com/show_bug.cgi?id=969340

https://bugzilla.suse.com/show_bug.cgi?id=973691

https://bugzilla.suse.com/show_bug.cgi?id=979595

https://bugzilla.suse.com/show_bug.cgi?id=987576

https://bugzilla.suse.com/show_bug.cgi?id=989152

https://bugzilla.suse.com/show_bug.cgi?id=989261

https://bugzilla.suse.com/show_bug.cgi?id=991665

https://bugzilla.suse.com/show_bug.cgi?id=992566

https://bugzilla.suse.com/show_bug.cgi?id=992569

https://bugzilla.suse.com/show_bug.cgi?id=992906

https://bugzilla.suse.com/show_bug.cgi?id=992991

https://bugzilla.suse.com/show_bug.cgi?id=993890

https://bugzilla.suse.com/show_bug.cgi?id=993891

https://bugzilla.suse.com/show_bug.cgi?id=994296

https://bugzilla.suse.com/show_bug.cgi?id=994618

https://bugzilla.suse.com/show_bug.cgi?id=994759

https://bugzilla.suse.com/show_bug.cgi?id=995968

https://bugzilla.suse.com/show_bug.cgi?id=996329

https://bugzilla.suse.com/show_bug.cgi?id=996541

https://bugzilla.suse.com/show_bug.cgi?id=996557

https://bugzilla.suse.com/show_bug.cgi?id=997059

https://bugzilla.suse.com/show_bug.cgi?id=997401

https://bugzilla.suse.com/show_bug.cgi?id=997708

https://bugzilla.suse.com/show_bug.cgi?id=998689

https://bugzilla.suse.com/show_bug.cgi?id=999932

https://bugzilla.suse.com/show_bug.cgi?id=999943

https://www.suse.com/security/cve/CVE-2004-0230/

https://www.suse.com/security/cve/CVE-2012-6704/

https://www.suse.com/security/cve/CVE-2015-1350/

https://www.suse.com/security/cve/CVE-2015-8956/

https://www.suse.com/security/cve/CVE-2015-8962/

https://www.suse.com/security/cve/CVE-2015-8964/

https://www.suse.com/security/cve/CVE-2015-8970/

https://www.suse.com/security/cve/CVE-2016-0823/

https://www.suse.com/security/cve/CVE-2016-10088/

https://www.suse.com/security/cve/CVE-2016-3841/

https://www.suse.com/security/cve/CVE-2016-6828/

https://www.suse.com/security/cve/CVE-2016-7042/

https://www.suse.com/security/cve/CVE-2016-7097/

https://www.suse.com/security/cve/CVE-2016-7117/

https://www.suse.com/security/cve/CVE-2016-7425/

https://www.suse.com/security/cve/CVE-2016-7910/

https://www.suse.com/security/cve/CVE-2016-7911/

https://www.suse.com/security/cve/CVE-2016-7916/

https://www.suse.com/security/cve/CVE-2016-8399/

https://www.suse.com/security/cve/CVE-2016-8632/

https://www.suse.com/security/cve/CVE-2016-8633/

https://www.suse.com/security/cve/CVE-2016-8646/

https://www.suse.com/security/cve/CVE-2016-9555/

https://www.suse.com/security/cve/CVE-2016-9685/

https://www.suse.com/security/cve/CVE-2016-9756/

https://www.suse.com/security/cve/CVE-2016-9793/

https://www.suse.com/security/cve/CVE-2017-5551/

http://www.nessus.org/u?1b5b010b

Plugin Details

Severity: Critical

ID: 97297

File Name: suse_SU-2017-0494-1.nasl

Version: 3.7

Type: local

Agent: unix

Published: 2017/02/21

Updated: 2019/09/11

Dependencies: 12634

Risk Information

Risk Factor: Critical

CVSS v2.0

Base Score: 10

Temporal Score: 8.3

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:F/RL:OF/RC:C

CVSS v3.0

Base Score: 9.8

Temporal Score: 9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:novell:suse_linux:kernel-bigsmp, p-cpe:/a:novell:suse_linux:kernel-bigsmp-base, p-cpe:/a:novell:suse_linux:kernel-bigsmp-devel, p-cpe:/a:novell:suse_linux:kernel-default, p-cpe:/a:novell:suse_linux:kernel-default-base, p-cpe:/a:novell:suse_linux:kernel-default-devel, p-cpe:/a:novell:suse_linux:kernel-default-man, p-cpe:/a:novell:suse_linux:kernel-ec2, p-cpe:/a:novell:suse_linux:kernel-ec2-base, p-cpe:/a:novell:suse_linux:kernel-ec2-devel, p-cpe:/a:novell:suse_linux:kernel-pae, p-cpe:/a:novell:suse_linux:kernel-pae-base, p-cpe:/a:novell:suse_linux:kernel-pae-devel, p-cpe:/a:novell:suse_linux:kernel-source, p-cpe:/a:novell:suse_linux:kernel-syms, p-cpe:/a:novell:suse_linux:kernel-trace, p-cpe:/a:novell:suse_linux:kernel-trace-base, p-cpe:/a:novell:suse_linux:kernel-trace-devel, p-cpe:/a:novell:suse_linux:kernel-xen, p-cpe:/a:novell:suse_linux:kernel-xen-base, p-cpe:/a:novell:suse_linux:kernel-xen-devel, cpe:/o:novell:suse_linux:11

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2017/02/17

Vulnerability Publication Date: 2004/08/18

Exploitable With

Core Impact

Reference Information

CVE: CVE-2004-0230, CVE-2012-6704, CVE-2015-1350, CVE-2015-8956, CVE-2015-8962, CVE-2015-8964, CVE-2015-8970, CVE-2016-0823, CVE-2016-10088, CVE-2016-3841, CVE-2016-6828, CVE-2016-7042, CVE-2016-7097, CVE-2016-7117, CVE-2016-7425, CVE-2016-7910, CVE-2016-7911, CVE-2016-7916, CVE-2016-8399, CVE-2016-8632, CVE-2016-8633, CVE-2016-8646, CVE-2016-9555, CVE-2016-9576, CVE-2016-9685, CVE-2016-9756, CVE-2016-9793, CVE-2017-5551

BID: 10183