Tavis Ormandy discovered that the Linux kernel did not properly implement exception fixup. A local attacker could exploit this to crash the kernel, leading to a denial of service. (CVE-2010-3086)

Dan Rosenberg discovered that the Linux kernel TIPC implementation contained multiple integer signedness errors. A local attacker could exploit this to gain root privileges. (CVE-2010-3859)

Dan Rosenberg discovered that the Linux kernel X.25 implementation incorrectly parsed facilities. A remote attacker could exploit this to crash the kernel, leading to a denial of service. (CVE-2010-3873)

Vasiliy Kulikov discovered that the Linux kernel X.25 implementation did not correctly clear kernel memory. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy.
(CVE-2010-3875)

Vasiliy Kulikov discovered that the Linux kernel sockets implementation did not properly initialize certain structures. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy. (CVE-2010-3876)

Nelson Elhage discovered that the Linux kernel IPv4 implementation did not properly audit certain bytecodes in netlink messages. A local attacker could exploit this to cause the kernel to hang, leading to a denial of service. (CVE-2010-3880)

Dan Rosenberg discovered that the SiS video driver did not correctly clear kernel memory. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy. (CVE-2010-4078)

Dan Rosenberg discovered that the RME Hammerfall DSP audio interface driver did not correctly clear kernel memory. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy. (CVE-2010-4080, CVE-2010-4081)

Dan Rosenberg discovered that the semctl syscall did not correctly clear kernel memory. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy. (CVE-2010-4083)

James Bottomley discovered that the ICP vortex storage array controller driver did not validate certain sizes. A local attacker on a 64bit system could exploit this to crash the kernel, leading to a denial of service. (CVE-2010-4157)

Dan Rosenberg discovered that the Linux kernel L2TP implementation contained multiple integer signedness errors. A local attacker could exploit this to to crash the kernel, or possibly gain root privileges.
(CVE-2010-4160).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Gleb Napatov discovered that KVM did not correctly check certain privileged operations. A local attacker with access to a guest kernel could exploit this to crash the host system, leading to a denial of service. (CVE-2010-0435)

Dave Chinner discovered that the XFS filesystem did not correctly order inode lookups when exported by NFS. A remote attacker could exploit this to read or write disk blocks that had changed file assignment or had become unlinked, leading to a loss of privacy.
(CVE-2010-2943)

Dan Rosenberg discovered that several network ioctls did not clear kernel memory correctly. A local user could exploit this to read kernel stack memory, leading to a loss of privacy. (CVE-2010-3296, CVE-2010-3297)

Dan Jacobson discovered that ThinkPad video output was not correctly access controlled. A local attacker could exploit this to hang the system, leading to a denial of service. (CVE-2010-3448)

It was discovered that KVM did not correctly initialize certain CPU registers. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2010-3698)

It was discovered that Xen did not correctly clean up threads. A local attacker in a guest system could exploit this to exhaust host system resources, leading to a denial of serivce. (CVE-2010-3699)

Brad Spengler discovered that stack memory for new a process was not correctly calculated. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2010-3858)

Dan Rosenberg discovered that the Linux kernel TIPC implementation contained multiple integer signedness errors. A local attacker could exploit this to gain root privileges. (CVE-2010-3859)

Dan Rosenberg discovered that the Linux kernel X.25 implementation incorrectly parsed facilities. A remote attacker could exploit this to crash the kernel, leading to a denial of service. (CVE-2010-3873)

Vasiliy Kulikov discovered that the Linux kernel X.25 implementation did not correctly clear kernel memory. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy.
(CVE-2010-3875)

Vasiliy Kulikov discovered that the Linux kernel sockets implementation did not properly initialize certain structures. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy. (CVE-2010-3876)

Vasiliy Kulikov discovered that the TIPC interface did not correctly initialize certain structures. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy.
(CVE-2010-3877)

Nelson Elhage discovered that the Linux kernel IPv4 implementation did not properly audit certain bytecodes in netlink messages. A local attacker could exploit this to cause the kernel to hang, leading to a denial of service. (CVE-2010-3880)

Kees Cook and Vasiliy Kulikov discovered that the shm interface did not clear kernel memory correctly. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy.
(CVE-2010-4072)

Dan Rosenberg discovered that the USB subsystem did not correctly initialize certian structures. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy.
(CVE-2010-4074)

Dan Rosenberg discovered that the SiS video driver did not correctly clear kernel memory. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy. (CVE-2010-4078)

Dan Rosenberg discovered that the ivtv V4L driver did not correctly initialize certian structures. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy.
(CVE-2010-4079)

Dan Rosenberg discovered that the RME Hammerfall DSP audio interface driver did not correctly clear kernel memory. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy. (CVE-2010-4080, CVE-2010-4081)

Dan Rosenberg discovered that the semctl syscall did not correctly clear kernel memory. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy. (CVE-2010-4083)

James Bottomley discovered that the ICP vortex storage array controller driver did not validate certain sizes. A local attacker on a 64bit system could exploit this to crash the kernel, leading to a denial of service. (CVE-2010-4157)

Dan Rosenberg discovered that the Linux kernel L2TP implementation contained multiple integer signedness errors. A local attacker could exploit this to to crash the kernel, or possibly gain root privileges.
(CVE-2010-4160)

It was discovered that multithreaded exec did not handle CPU timers correctly. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2010-4248).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Gleb Napatov discovered that KVM did not correctly check certain privileged operations. A local attacker with access to a guest kernel could exploit this to crash the host system, leading to a denial of service. (CVE-2010-0435)

Dan Jacobson discovered that ThinkPad video output was not correctly access controlled. A local attacker could exploit this to hang the system, leading to a denial of service. (CVE-2010-3448)

It was discovered that KVM did not correctly initialize certain CPU registers. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2010-3698)

Dan Rosenberg discovered that the Linux kernel TIPC implementation contained multiple integer signedness errors. A local attacker could exploit this to gain root privileges. (CVE-2010-3859)

Thomas Pollet discovered that the RDS network protocol did not check certain iovec buffers. A local attacker could exploit this to crash the system or possibly execute arbitrary code as the root user.
(CVE-2010-3865)

Dan Rosenberg discovered that the Linux kernel X.25 implementation incorrectly parsed facilities. A remote attacker could exploit this to crash the kernel, leading to a denial of service. (CVE-2010-3873)

Dan Rosenberg discovered that the CAN protocol on 64bit systems did not correctly calculate the size of certain buffers. A local attacker could exploit this to crash the system or possibly execute arbitrary code as the root user. (CVE-2010-3874)

Vasiliy Kulikov discovered that the Linux kernel X.25 implementation did not correctly clear kernel memory. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy.
(CVE-2010-3875)

Vasiliy Kulikov discovered that the Linux kernel sockets implementation did not properly initialize certain structures. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy. (CVE-2010-3876)

Vasiliy Kulikov discovered that the TIPC interface did not correctly initialize certain structures. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy.
(CVE-2010-3877)

Nelson Elhage discovered that the Linux kernel IPv4 implementation did not properly audit certain bytecodes in netlink messages. A local attacker could exploit this to cause the kernel to hang, leading to a denial of service. (CVE-2010-3880)

Dan Rosenberg discovered that IPC structures were not correctly initialized on 64bit systems. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy.
(CVE-2010-4073)

Dan Rosenberg discovered that the USB subsystem did not correctly initialize certian structures. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy.
(CVE-2010-4074)

Dan Rosenberg discovered that the SiS video driver did not correctly clear kernel memory. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy. (CVE-2010-4078)

Dan Rosenberg discovered that the ivtv V4L driver did not correctly initialize certian structures. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy.
(CVE-2010-4079)

Dan Rosenberg discovered that the RME Hammerfall DSP audio interface driver did not correctly clear kernel memory. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy. (CVE-2010-4080, CVE-2010-4081)

Dan Rosenberg discovered that the VIA video driver did not correctly clear kernel memory. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy. (CVE-2010-4082)

Dan Rosenberg discovered that the semctl syscall did not correctly clear kernel memory. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy. (CVE-2010-4083)

James Bottomley discovered that the ICP vortex storage array controller driver did not validate certain sizes. A local attacker on a 64bit system could exploit this to crash the kernel, leading to a denial of service. (CVE-2010-4157)

Dan Rosenberg discovered that the Linux kernel L2TP implementation contained multiple integer signedness errors. A local attacker could exploit this to to crash the kernel, or possibly gain root privileges.
(CVE-2010-4160)

Steve Chen discovered that setsockopt did not correctly check MSS values. A local attacker could make a specially crafted socket call to crash the system, leading to a denial of service. (CVE-2010-4165)

Dave Jones discovered that the mprotect system call did not correctly handle merged VMAs. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2010-4169)

It was discovered that multithreaded exec did not handle CPU timers correctly. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2010-4248)

Vegard Nossum discovered that memory garbage collection was not handled correctly for active sockets. A local attacker could exploit this to allocate all available kernel memory, leading to a denial of service. (CVE-2010-4249).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This kernel update of the openSUSE 12.1 kernel fixes lots of bugs and security issues.

Following issues were fixed :

  - tcp: drop SYN+FIN messages (bnc#765102).

  - net: sock: validate data_len before allocating skb in     sock_alloc_send_pskb() (bnc#765320, CVE-2012-2136).

  - fcaps: clear the same personality flags as suid when     fcaps are used (bnc#758260 CVE-2012-2123).

  - macvtap: zerocopy: validate vectors before building skb     (bnc#758243 CVE-2012-2119).

  - hfsplus: Fix potential buffer overflows (bnc#760902     CVE-2009-4020).

  - xfrm: take net hdr len into account for esp payload size     calculation (bnc#759545).

  - ext4: fix undefined behavior in ext4_fill_flex_info()     (bnc#757278).

  - igb: fix rtnl race in PM resume path (bnc#748859).

  - ixgbe: add missing rtnl_lock in PM resume path     (bnc#748859).

  - b43: allocate receive buffers big enough for max frame     len + offset (bnc#717749).

  - xenbus: Reject replies with payload >     XENSTORE_PAYLOAD_MAX.

  - xenbus_dev: add missing error checks to watch handling.

  - hwmon: (coretemp-xen) Fix TjMax detection for older     CPUs.

  - hwmon: (coretemp-xen) Relax target temperature range     check.

  - Refresh other Xen patches.

  - tlan: add cast needed for proper 64 bit operation     (bnc#756840).

  - dl2k: Tighten ioctl permissions (bnc#758813).

  - [media] cx22702: Fix signal strength.

  - fs: cachefiles: Add support for large files in     filesystem caching (bnc#747038).

  - bridge: correct IPv6 checksum after pull (bnc#738644).

  - bridge: fix a possible use after free (bnc#738644).

  - bridge: Pseudo-header required for the checksum of     ICMPv6 (bnc#738644).

  - bridge: mcast snooping, fix length check of snooped     MLDv1/2 (bnc#738644).

  - PCI/ACPI: Report ASPM support to BIOS if not disabled     from command line (bnc#714455).

  - ipc/sem.c: fix race with concurrent semtimedop()     timeouts and IPC_RMID (bnc#756203).

  - drm/i915/crt: Remove 0xa0 probe for VGA.

  - tty_audit: fix tty_audit_add_data live lock on audit     disabled (bnc#721366).

  - drm/i915: suspend fbdev device around suspend/hibernate     (bnc#732908).

  - dlm: Do not allocate a fd for peeloff (bnc#729247).

  - sctp: Export sctp_do_peeloff (bnc#729247).

  - i2c-algo-bit: Fix spurious SCL timeouts under heavy     load.

  - patches.fixes/epoll-dont-limit-non-nested.patch: Don't     limit non-nested epoll paths (bnc#676204).

  - Update patches.suse/sd_init.mark_majors_busy.patch     (bnc#744658).

  - igb: Fix for Alt MAC Address feature on 82580 and later     devices (bnc#746980).

  - mark busy sd majors as allocated (bug#744658).

  - regset: Return -EFAULT, not -EIO, on host-side memory     fault (bnc# 750079 CVE-2012-1097).

  - regset: Prevent NULL pointer reference on readonly     regsets (bnc#750079 CVE-2012-1097).

  - mm: memcg: Correct unregistring of events attached to     the same eventfd (CVE-2012-1146 bnc#750959).

  - befs: Validate length of long symbolic links     (CVE-2011-2928 bnc#713430).

  - si4713-i2c: avoid potential buffer overflow on si4713     (CVE-2011-2700 bnc#707332).

  - staging: comedi: fix infoleak to userspace     (CVE-2011-2909 bnc#711941).

  - hfs: add sanity check for file name length     (CVE-2011-4330 bnc#731673).

  - cifs: fix dentry refcount leak when opening a FIFO on     lookup (CVE-2012-1090 bnc#749569).

  - drm: integer overflow in drm_mode_dirtyfb_ioctl()     (CVE-2012-0044 bnc#740745).

  - xfs: fix acl count validation in xfs_acl_from_disk()     (CVE-2012-0038 bnc#740703).

  - xfs: validate acl count (CVE-2012-0038 bnc#740703).

  -     patches.fixes/xfs-fix-possible-memory-corruption-in-xfs_     readlink: Work around missing xfs_alert().

  - xfs: Fix missing xfs_iunlock() on error recovery path in     xfs_readlink() (CVE-2011-4077 bnc#726600).

  - xfs: Fix possible memory corruption in xfs_readlink     (CVE-2011-4077 bnc#726600).

  - ext4: make ext4_split_extent() handle error correctly.

  - ext4: ext4_ext_convert_to_initialized bug found in     extended FSX testing.

  - ext4: add ext4_split_extent_at() and     ext4_split_extent().

  - ext4: reimplement convert and split_unwritten     (CVE-2011-3638 bnc#726045).

  - patches.fixes/epoll-limit-paths.patch: epoll: limit     paths (bnc#676204 CVE-2011-1083).

  - patches.kabi/epoll-kabi-fix.patch: epoll: hide kabi     change in struct file (bnc#676204 CVE-2011-1083).

  - NAT/FTP: Fix broken conntrack (bnc#681639 bnc#466279     bnc#747660).

  - igmp: Avoid zero delay when receiving odd mixture of     IGMP queries (bnc#740448 CVE-2012-0207).

  - jbd2: clear BH_Delay & BH_Unwritten in     journal_unmap_buffer (bnc#745832 CVE-2011-4086).

  - AppArmor: fix oops in apparmor_setprocattr (bnc#717209     CVE-2011-3619).

  - Refresh patches.suse/SoN-22-netvm.patch. Clean and
    *working* patches.

  - Refresh patches.suse/SoN-22-netvm.patch. (bnc#683671)     Fix an rcu locking imbalance in the receive path     triggered when using vlans.

  - Fix mangled patch (invalid date) Although accepted by     `patch`, this is rejected by `git apply`

  - Fix mangled diff lines (leading space tab vs tab)     Although accepted by `patch`, these are rejected by `git     apply`

  - jbd/jbd2: validate sb->s_first in     journal_get_superblock() (bnc#730118).

  - fsnotify: don't BUG in fsnotify_destroy_mark()     (bnc#689860).

  - Fix     patches.fixes/x25-Handle-undersized-fragmented-skbs.patc     h (CVE-2010-3873 bnc#651219).

  - Fix     patches.fixes/x25-Prevent-skb-overreads-when-checking-ca     ll-user-da.patch (CVE-2010-3873 bnc#651219).

  - Fix     patches.fixes/x25-Validate-incoming-call-user-data-lengt     hs.patch (CVE-2010-3873 bnc#651219).

  - Fix     patches.fixes/x25-possible-skb-leak-on-bad-facilities.pa     tch (CVE-2010-3873 bnc#651219 CVE-2010-4164 bnc#653260).

  - Update     patches.fixes/econet-4-byte-infoleak-to-the-network.patc     h (bnc#681186 CVE-2011-1173). Fix reference.

  - hwmon: (w83627ehf) Properly report thermal diode     sensors.

  - nl80211: fix overflow in ssid_len (bnc#703410     CVE-2011-2517).

  - nl80211: fix check for valid SSID size in scan     operations (bnc#703410 CVE-2011-2517).

  - x25: Prevent skb overreads when checking call user data     (CVE-2010-3873 bnc#737624).

  - x25: Handle undersized/fragmented skbs (CVE-2010-3873     bnc#737624).

  - x25: Validate incoming call user data lengths     (CVE-2010-3873 bnc#737624).

  - x25: possible skb leak on bad facilities (CVE-2010-3873     bnc#737624).

  - net: Add a flow_cache_flush_deferred function     (bnc#737624).

  - xfrm: avoid possible oopse in xfrm_alloc_dst     (bnc#737624).

  - scm: lower SCM_MAX_FD (bnc#655696 CVE-2010-4249).

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leak. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2010-2963     Kees Cook discovered an issue in the v4l 32-bit     compatibility layer for 64-bit systems that allows local     users with /dev/video write permission to overwrite     arbitrary kernel memory, potentially leading to a     privilege escalation. On Debian systems, access to     /dev/video devices is restricted to members of the     'video' group by default.

  - CVE-2010-3067     Tavis Ormandy discovered an issue in the io_submit     system call. Local users can cause an integer overflow     resulting in a denial of service.

  - CVE-2010-3296     Dan Rosenberg discovered an issue in the cxgb network     driver that allows unprivileged users to obtain the     contents of sensitive kernel memory.

  - CVE-2010-3297     Dan Rosenberg discovered an issue in the eql network     driver that allows local users to obtain the contents of     sensitive kernel memory.

  - CVE-2010-3310     Dan Rosenberg discovered an issue in the ROSE socket     implementation. On systems with a rose device, local     users can cause a denial of service (kernel memory     corruption).

  - CVE-2010-3432     Thomas Dreibholz discovered an issue in the SCTP     protocol that permits a remote user to cause a denial of     service (kernel panic).

  - CVE-2010-3437     Dan Rosenberg discovered an issue in the pktcdvd driver.
    Local users with permission to open /dev/pktcdvd/control     can obtain the contents of sensitive kernel memory or     cause a denial of service. By default on Debian systems,     this access is restricted to members of the group     'cdrom'.

  - CVE-2010-3442     Dan Rosenberg discovered an issue in the ALSA sound     system. Local users with permission to open     /dev/snd/controlC0 can create an integer overflow     condition that causes a denial of service. By default on     Debian systems, this access is restricted to members of     the group 'audio'.

  - CVE-2010-3448     Dan Jacobson reported an issue in the thinkpad-acpi     driver. On certain Thinkpad systems, local users can     cause a denial of service (X.org crash) by reading     /proc/acpi/ibm/video.

  - CVE-2010-3477     Jeff Mahoney discovered an issue in the Traffic Policing     (act_police) module that allows local users to obtain     the contents of sensitive kernel memory.

  - CVE-2010-3705     Dan Rosenberg reported an issue in the HMAC processing     code in the SCTP protocol that allows remote users to     create a denial of service (memory corruption).

  - CVE-2010-3848     Nelson Elhage discovered an issue in the Econet     protocol. Local users can cause a stack overflow     condition with large msg->msgiovlen values that can     result in a denial of service or privilege escalation.

  - CVE-2010-3849     Nelson Elhage discovered an issue in the Econet     protocol. Local users can cause a denial of service     (oops) if a NULL remote addr value is passed as a     parameter to sendmsg().

  - CVE-2010-3850     Nelson Elhage discovered an issue in the Econet     protocol. Local users can assign econet addresses to     arbitrary interfaces due to a missing capabilities     check.

  - CVE-2010-3858     Brad Spengler reported an issue in the setup_arg_pages()     function. Due to a bounds-checking failure, local users     can create a denial of service (kernel oops).

  - CVE-2010-3859     Dan Rosenberg reported an issue in the TIPC protocol.
    When the tipc module is loaded, local users can gain     elevated privileges via the sendmsg() system call.

  - CVE-2010-3873     Dan Rosenberg reported an issue in the X.25 network     protocol. Local users can cause heap corruption,     resulting in a denial of service (kernel panic).

  - CVE-2010-3874     Dan Rosenberg discovered an issue in the Control Area     Network (CAN) subsystem on 64-bit systems. Local users     may be able to cause a denial of service (heap     corruption).

  - CVE-2010-3875     Vasiliy Kulikov discovered an issue in the AX.25     protocol. Local users can obtain the contents of     sensitive kernel memory.

  - CVE-2010-3876     Vasiliy Kulikov discovered an issue in the Packet     protocol. Local users can obtain the contents of     sensitive kernel memory.

  - CVE-2010-3877     Vasiliy Kulikov discovered an issue in the TIPC     protocol. Local users can obtain the contents of     sensitive kernel memory.

  - CVE-2010-3880     Nelson Elhage discovered an issue in the INET_DIAG     subsystem. Local users can cause the kernel to execute     unaudited INET_DIAG bytecode, resulting in a denial of     service.

  - CVE-2010-4072     Kees Cook discovered an issue in the System V shared     memory subsystem. Local users can obtain the contents of     sensitive kernel memory.

  - CVE-2010-4073     Dan Rosenberg discovered an issue in the System V shared     memory subsystem. Local users on 64-bit system can     obtain the contents of sensitive kernel memory via the     32-bit compatible semctl() system call.

  - CVE-2010-4074     Dan Rosenberg reported issues in the mos7720 and mos7840     drivers for USB serial converter devices. Local users     with access to these devices can obtain the contents of     sensitive kernel memory.

  - CVE-2010-4078     Dan Rosenberg reported an issue in the framebuffer     driver for SiS graphics chipsets (sisfb). Local users     with access to the framebuffer device can obtain the     contents of sensitive kernel memory via the     FBIOGET_VBLANK ioctl.

  - CVE-2010-4079     Dan Rosenberg reported an issue in the ivtvfb driver     used for the Hauppauge PVR-350 card. Local users with     access to the framebuffer device can obtain the contents     of sensitive kernel memory via the FBIOGET_VBLANK ioctl.

  - CVE-2010-4080     Dan Rosenberg discovered an issue in the ALSA driver for     RME Hammerfall DSP audio devices. Local users with     access to the audio device can obtain the contents of     sensitive kernel memory via the     SNDRV_HDSP_IOCTL_GET_CONFIG_INFO ioctl.

  - CVE-2010-4081     Dan Rosenberg discovered an issue in the ALSA driver for     RME Hammerfall DSP MADI audio devices. Local users with     access to the audio device can obtain the contents of     sensitive kernel memory via the     SNDRV_HDSP_IOCTL_GET_CONFIG_INFO ioctl.

  - CVE-2010-4083     Dan Rosenberg discovered an issue in the semctl system     call. Local users can obtain the contents of sensitive     kernel memory through usage of the semid_ds structure.

  - CVE-2010-4164     Dan Rosenberg discovered an issue in the X.25 network     protocol. Remote users can achieve a denial of service     (infinite loop) by taking advantage of an integer     underflow in the facility parsing code.

The SUSE Linux Enterprise 11 SP1 kernel was updated to 2.6.32.54, fixing lots of bugs and security issues.

The following security issues have been fixed :

  - A potential hypervisor escape by issuing SG_IO commands     to partitiondevices was fixed by restricting access to     these commands. (CVE-2011-4127)

  - KEYS: Fix a NULL pointer deref in the user-defined key     type, which allowed local attackers to Oops the kernel.
    (CVE-2011-4110)

  - Avoid potential NULL pointer deref in ghash, which     allowed local attackers to Oops the kernel.
    (CVE-2011-4081)

  - Fixed a memory corruption possibility in xfs readlink,     which could be used by local attackers to crash the     system or potentially execute code by mounting a     prepared xfs filesystem image. (CVE-2011-4077)

  - A overflow in the xfs acl handling was fixed that could     be used by local attackers to crash the system or     potentially execute code by mounting a prepared xfs     filesystem image. (CVE-2012-0038)

  - A flaw in the ext3/ext4 filesystem allowed a local     attacker to crash the kernel by getting a prepared     ext3/ext4 filesystem mounted. (CVE-2011-4132)

  - Access to the taskstats /proc file was restricted to     avoid local attackers gaining knowledge of IO of other     users (and so effecting side-channel attacks for e.g.
    guessing passwords by typing speed). (CVE-2011-2494)

  - When using X.25 communication a malicious sender could     corrupt data structures, causing crashes or potential     code execution. Please note that X.25 needs to be setup     to make this effective, which these days is usually not     the case. (CVE-2010-3873)

  - When using X.25 communication a malicious sender could     make the machine leak memory, causing crashes. Please     note that X.25 needs to be setup to make this effective,     which these days is usually not the case.
    (CVE-2010-4164)

  - A remote denial of service due to a NULL pointer     dereference by using IPv6 fragments was fixed. The     following non-security issues have been fixed:.
    (CVE-2011-2699)

  - elousb: Fixed bug in USB core API usage, code cleanup.
    (bnc#733863)

  - cifs: overhaul cifs_revalidate and rename to     cifs_revalidate_dentry. (bnc#735453)

  - cifs: set server_eof in cifs_fattr_to_inode.
    (bnc#735453)

  - xfs: Fix missing xfs_iunlock() on error recovery path in     xfs_readlink(). (bnc#726600)

  - block: add and use scsi_blk_cmd_ioctl. (bnc#738400 /     CVE-2011-4127)

  - block: fail SCSI passthrough ioctls on partition     devices. (bnc#738400 / CVE-2011-4127)

  - dm: do not forward ioctls from logical volumes to the     underlying device. (bnc#738400 / CVE-2011-4127)

  - Silence some warnings about ioctls on partitions.

  - netxen: Remove all references to unified firmware file.
    (bnc#708625)

  - bonding: send out gratuitous arps even with no address     configured. (bnc#742270)

  - patches.fixes/ocfs2-serialize_unaligned_aio.patch:
    ocfs2: serialize unaligned aio. (bnc#671479)

  -     patches.fixes/bonding-check-if-clients-MAC-addr-has-chan     ged.patch: Update references. (bnc#729854, bnc#731004)

  - xfs: Fix wait calculations on lock acquisition and use     milliseconds instead of jiffies to print the wait time.

  - ipmi: reduce polling when interrupts are available.
    (bnc#740867)

  - ipmi: reduce polling. (bnc#740867)

  - Linux 2.6.32.54.

  - export shrink_dcache_for_umount_subtree.

  - patches.suse/stack-unwind: Fix more 2.6.29 merge     problems plus a glue code problem. (bnc#736018)

  - PM / Sleep: Fix race between CPU hotplug and freezer.
    (bnc#740535)

  - jbd: Issue cache flush after checkpointing. (bnc#731770)

  - lpfc: make sure job exists when processing BSG.
    (bnc#735635)

  - Linux 2.6.32.53.

  - blktap: fix locking (again). (bnc#724734)

  - xen: Update Xen patches to 2.6.32.52.

  - Linux 2.6.32.52.

  - Linux 2.6.32.51.

  - Linux 2.6.32.50.

  - reiserfs: Lock buffers unconditionally in     reiserfs_write_full_page(). (bnc#716023)

  - writeback: Include all dirty inodes in background     writeback. (bnc#716023)

  - reiserfs: Fix quota mount option parsing. (bnc#728626)

  - bonding: check if clients MAC addr has changed.
    (bnc#729854)

  - rpc client can not deal with ENOSOCK, so translate it     into ENOCONN. (bnc#733146)

  - st: modify tape driver to allow writing immediate     filemarks. (bnc#688996)

  - xfs: fix for xfssyncd failure to wake. (bnc#722910)

  - ipmi: Fix deadlock in start_next_msg().

  - net: bind() fix error return on wrong address family.
    (bnc#735216)

  - net: ipv4: relax AF_INET check in bind(). (bnc#735216)

  - net/ipv6: check for mistakenly passed in non-AF_INET6     sockaddrs. (bnc#735216)

  - Bluetooth: Fixed Atheros AR3012 Maryann PID/VID     supported. (bnc#732296)

  - percpu: fix chunk range calculation. (bnc#668872)

  - x86, UV: Fix kdump reboot. (bnc#735446)

  - dm: Use done_bytes for io_completion. (bnc#711378)

  - Bluetooth: Add Atheros AR3012 Maryann PID/VID supported.
    (bnc#732296)

  - Bluetooth: Add Atheros AR3012 one PID/VID supported.
    (bnc#732296)

  - fix missing hunk in oplock break patch. (bnc#706973)

  - patches.arch/s390-34-01-pfault-cpu-hotplug.patch:
    Refresh. Surrounded s390x lowcore change with
    __GENKSYMS__. (bnc#728339)

  - patches.xen/xen3-patch-2.6.30: Refresh.

  - sched, x86: Avoid unnecessary overflow in sched_clock.
    (bnc#725709)

  - ACPI thermal: Do not invalidate thermal zone if critical     trip point is bad.

此 Linux 内核更新修复 SUSE Linux Enterprise 10 SP4 内核中的各种安全问题和缺陷。

此更新修复了以下安全问题：

- X.25 远程 DoS。(CVE-2010-3873)。(bnc#651219)

- X.25 远程 Dos。(CVE-2010-4164)。(bnc#653260)

- 1 套接字本地 DoS。(CVE-2010-4249)。(bnc#655696)

- ebtables 信息泄漏。(CVE-2011-1080)。(bnc#676602)

- netfilter：arp_tables 信息泄漏到用户空间。
 (CVE-2011-1170)。(bnc#681180)

- netfilter：ip_tables 信息泄漏到用户空间。
 (CVE-2011-1171)。(bnc#681181)

- netfilter：ip6_tables 信息泄漏到用户空间。
 (CVE-2011-1172)。(bnc#681185)

- econet 4 字节信息泄漏。(CVE-2011-1173)。(bnc#681186)

- hfs 空指针取消引用。(CVE-2011-2203)。
 (bnc#699709)

- inet_diag 无限循环。(CVE-2011-2213)。(bnc#700879)

- netfilter：ipt_CLUSTERIP 缓冲区溢出。
 (CVE-2011-2534)。(bnc#702037)

- ipv6：降低片段标识的可预测性。
 (CVE-2011-2699)。(bnc#707288)

- clock_gettime() 错误。(CVE-2011-3209)。(bnc#726064)

- qdisc NULL 取消引用 (CVE-2011-2525) 此更新还修复以下非安全问题：(bnc#735612)

- 用于 VMware 平台的新时间源。(bnc#671124)

- 第二次拔出打印机后 usblp 崩溃。(bnc#673343)

- mpt2sas 驱动程序的数据损坏。(bnc#704253)

- 引导 XEN 内核时 NIC Bond 不再工作。
 (bnc#716437)

-“reboot=b”内核命令行在重新启动时将系统挂起。
 (bnc#721267)

- iscsi_xmitwork 函数的内核错误。(bnc#721351)

- NFS 附属组权限。(bnc#725878)

- IBM LTC System z 维护内核修补程序 (#59)。
 (bnc#726843)

- NFS 缓慢。(bnc#727597)

- IBM LTC System z 维护内核修补程序 (#60)。
 (bnc#728341)

- 将 MAC 地址传播到 VLAN 接口。(bnc#729117)

- ipmi：start_next_msg 中的死锁。(bnc#730749)

- 崩溃后 ext3 文件系统损坏。(bnc#731770)

- IBM LTC System z 维护内核修补程序 (#61)。
 (bnc#732375)

- 将 CPU 核心转为离线时挂起。(bnc#733407)

SUSE Linux Enterprise 11 SP1 内核已更新到 2.6.32.54，修复了大量缺陷和安全问题。

修复了以下安全问题：

- 已修复因向分区设备发出 SG_IO 命令而造成的潜在的管理程序躲避，方法是限制对这些命令的访问。(CVE-2011-4127)

- KEYS：修复用户定义的密钥类型中的一个空指针取消引用，该问题允许本地攻击者造成内核 Oops。
 (CVE-2011-4110)

- 避免 ghash 中潜在的空指针取消引用，该问题允许本地攻击者造成内核 Oops。
 (CVE-2011-4081)

- 修复了 xfs readlink 中内存损坏的可能性，该问题可被本地攻击者用于通过挂载准备好的 xfs 文件系统映像导致系统崩溃或者可能执行代码。(CVE-2011-4077)

- 修复了 xfs acl 处理中的一个溢出，该问题可被本地攻击者用于通过挂载准备好的 xfs 文件系统映像导致系统崩溃或者可能执行代码。(CVE-2012-0038)

- ext3/ext4 文件系统中的一个缺陷允许本地攻击者通过挂载准备好的 ext3/ext4 文件系统来造成内核崩溃。(CVE-2011-4132)

- 限制了对 taskstats /proc 文件的访问以避免本地攻击者获得对其他用户的 IO 的了解（以及达到边信道攻击的目的，例如通过键入速度来猜测密码）。(CVE-2011-2494)

- 使用 X.25 通信时，恶意发送者可以损坏数据结构，从而导致崩溃或可能的代码执行。请注意，需要设置 X.25 才能使此问题生效，目前通常不会发生此情况。(CVE-2010-3873)

- 使用 X.25 通信时，恶意发送者可以使计算机泄漏内存，从而导致崩溃。请注意，需要设置 X.25 才能使此问题生效，目前通常不会发生此情况。
 (CVE-2010-4164)

- 修复了因使用 IPv6 分段引起的空指针取消引用而造成的远程拒绝服务。对下列非安全问题进行了修复：
 (CVE-2011-2699)

- elousb：修复了 USB 核心 API 使用中的缺陷，代码清理。
 (bnc#733863)

- cifs：彻底检查 cifs_revalidate 并重命名为 cifs_revalidate_dentry。(bnc#735453)

- cifs：在 cifs_fattr_to_inode 中设置 server_eof。
 (bnc#735453)

- xfs：修复 xfs_readlink() 中错误恢复路径上缺少的 xfs_iunlock()。(bnc#726600)

- block：添加并使用 scsi_blk_cmd_ioctl。(bnc#738400 / CVE-2011-4127)

- block：分区设备上 SCSI 传递 ioctls 失败。(bnc#738400 / CVE-2011-4127)

- dm：不将 ioctls 从逻辑卷转发到底层设备。(bnc#738400 / CVE-2011-4127)

- 静默关于分区上的 ioctls 的某些警告。

- netxen：删除对统一固件文件的所有引用。
 (bnc#708625)

- bonding：即使没有配置地址，也发送无端的 ARP。(bnc#742270)

- patches.fixes/ocfs2-serialize_unaligned_aio.patch：
 ocfs2：序列化未对齐的 aio。(bnc#671479)

- patches.fixes/bonding-check-if-clients-MAC-addr-has-chan ged.patch：更新引用。（bnc#729854、bnc#731004）

- xfs：修复锁定捕获时的等待计算并使用毫秒来打印等待时间，而不使用瞬间。

- ipmi：减少可以使用中断时的轮询。
 (bnc#740867)

- ipmi：减少轮询。(bnc#740867)

- Linux 2.6.32.54。

- 导出 shrink_dcache_for_umount_subtree。

- patches.suse/stack-unwind：修复更多 2.6.29 合并问题和一个胶水代码问题。(bnc#736018)

- PM / 休眠：修复 CPU 热插拔和散热器之间的争用。
 (bnc#740535)

- jbd：在检查点操作后进行缓存刷新。(bnc#731770)

- lpfc：在处理 BSG 时确保作业存在。
 (bnc#735635)

- Linux 2.6.32.53。

- blktap：修复锁定（再次）。(bnc#724734)

- xen：将 Xen 修补程序更新到 2.6.32.52。

- Linux 2.6.32.52。

- Linux 2.6.32.51。

- Linux 2.6.32.50。

- reiserfs：无条件地锁定 reiserfs_write_full_page() 中的缓冲区。(bnc#716023)

- writeback：在后台 writeback 中包括所有脏 inode。(bnc#716023)

- reiserfs：修复配额挂载选项解析。(bnc#728626)

- bonding：检查客户端的 MAC 地址是否已更改。
 (bnc#729854)

- rpc 客户端无法处理 ENOSOCK，因此将其转换为 ENOCONN。(bnc#733146)

- st：修改磁带驱动程序以允许立即写入卷标。(bnc#688996)

- xfs：修复 xfssyncd 唤醒失败的问题。(bnc#722910)

- ipmi：修复 start_next_msg() 中的死锁。

- net：bind() 修复错误地址系列上的错误返回。
 (bnc#735216)

- net：ipv4：放宽 bind() 中的 AF_INET 检查。(bnc#735216)

- net/ipv6：检查非 AF_INET6 sockaddrs 中的错误传递。(bnc#735216)

- Bluetooth：修复了支持的 Atheros AR3012 Maryann PID/VID。(bnc#732296)

- percpu：修复区块范围计算。(bnc#668872)

- x86，UV：修复 kdump 重新启动。(bnc#735446)

- dm：将 done_bytes 用于 io_completion。(bnc#711378)

- Bluetooth：添加了支持的 Atheros AR3012 Maryann PID/VID。
 (bnc#732296)

- Bluetooth：添加了支持的 Atheros AR3012 one PID/VID。
 (bnc#732296)

- 修复 oplock break 修补程序中缺少的 hunk。(bnc#706973)

- patches.arch/s390-34-01-pfault-cpu-hotplug.patch：
刷新。为 s390x lowcore 变更提供 __GENKSYMS__。(bnc#728339)

- patches.xen/xen3-patch-2.6.30：刷新。

- sched，x86：避免 sched_clock 中存在不必要的溢出。
 (bnc#725709)

- ACPI thermal：如果关键跳变点不良，则不会使热区无效。

Tavis Ormandy 发现，Linux 内核并未正确实现异常修复。本地攻击者可利用此缺陷使内核崩溃，从而导致拒绝服务。(CVE-2010-3086)

Dan Rosenberg 发现 Linux 内核 TIPC 实现中包含多个整数符号错误。本地攻击者可利用此错误获得根权限。(CVE-2010-3859)

Dan Rosenberg 发现 Linux 内核 X.25 实现未正确解析设施。远程攻击者可利用此漏洞造成内核崩溃，从而导致拒绝服务。(CVE-2010-3873)

Vasiliy Kulikov 发现 Linux 内核 X.25 实现未正确清除内核内存。本地攻击者可利用此缺陷读取内核堆栈内存，从而导致失去隐私。
(CVE-2010-3875)

Vasiliy Kulikov 发现 Linux 内核套接字实现未正确初始化特定结构。本地攻击者可利用此缺陷读取内核堆栈内存，从而导致失去隐私。(CVE-2010-3876)

Nelson Elhage 发现 Linux 内核 IPv4 实现未正确审计 netlink 消息中的特定字节码。本地攻击者可利用此缺陷导致内核挂起，从而导致拒绝服务。(CVE-2010-3880)

Dan Rosenberg 发现 SiS 视频驱动程序未正确清除内核内存。本地攻击者可利用此缺陷读取内核堆栈内存，从而导致失去隐私。(CVE-2010-4078)

Dan Rosenberg 发现 RME Hammerfall DSP 音频接口驱动程序未正确清理内核内存。本地攻击者可利用此缺陷读取内核堆栈内存，从而导致失去隐私。（CVE-2010-4080、CVE-2010-4081）

Dan Rosenberg 发现 semctl syscall 未正确清除内核内存。本地攻击者可利用此缺陷读取内核堆栈内存，从而导致失去隐私。(CVE-2010-4083)

James Bottomley 发现 ICP vortex 存储阵列控制器驱动程序未验证特定大小。64 位系统上的本地攻击者可利用此缺陷使内核崩溃，从而导致拒绝服务。(CVE-2010-4157)

Dan Rosenberg 发现 Linux 内核 L2TP 实现中包含多个整数符号错误。本地攻击者可利用此错误造成内核崩溃，也可能获得根权限。
(CVE-2010-4160)。

Gleb Napatov 发现 KVM 未正确检查特定特权操作。具有访问客户机内核权限的本地攻击者可以利用此漏洞使主机系统崩溃，从而导致拒绝服务。(CVE-2010-0435)

Dave Chinner 发现，在通过 NFS 导出时，XFS 文件系统正确地对 inode 查找进行排序。远程攻击者可利用此缺陷读取或写入已更改文件分配或已断开链接的磁盘区块，从而导致失去隐私。
(CVE-2010-2943)

Dan Rosenberg 发现多个网络 ioctl 未正确清除内核内存。本地用户可以利用此缺陷读取内核堆栈内存，从而导致失去隐私。（CVE-2010-3296、CVE-2010-3297）

Dan Jacobson 发现未对 ThinkPad 视频输出正确执行访问控制。本地攻击者可利用此缺陷使系统挂起，从而导致拒绝服务。(CVE-2010-3448)

发现 KVM 未正确初始化特定 CPU 寄存器。本地攻击者可利用此缺陷造成系统崩溃，从而导致拒绝服务。(CVE-2010-3698)

据发现，Xen 未正确清理线程。访客系统中的本地攻击者可利用此缺陷，消耗主机系统资源，进而导致拒绝服务。(CVE-2010-3699)

Brad Spengler 发现未正确计算新进程的堆栈内存。本地攻击者可利用此缺陷造成系统崩溃，从而导致拒绝服务。(CVE-2010-3858)

Dan Rosenberg 发现 Linux 内核 TIPC 实现中包含多个整数符号错误。本地攻击者可利用此错误获得根权限。(CVE-2010-3859)

Dan Rosenberg 发现 Linux 内核 X.25 实现未正确解析设施。远程攻击者可利用此漏洞造成内核崩溃，从而导致拒绝服务。(CVE-2010-3873)

Vasiliy Kulikov 发现 Linux 内核 X.25 实现未正确清除内核内存。本地攻击者可利用此缺陷读取内核堆栈内存，从而导致失去隐私。
(CVE-2010-3875)

Vasiliy Kulikov 发现 Linux 内核套接字实现未正确初始化特定结构。本地攻击者可利用此缺陷读取内核堆栈内存，从而导致失去隐私。(CVE-2010-3876)

Vasiliy Kulikov 发现 TIPC 接口未正确初始化某些结构。本地攻击者可利用此缺陷读取内核堆栈内存，从而导致失去隐私。
(CVE-2010-3877)

Nelson Elhage 发现 Linux 内核 IPv4 实现未正确审计 netlink 消息中的特定字节码。本地攻击者可利用此缺陷导致内核挂起，从而导致拒绝服务。(CVE-2010-3880)

Kees Cook 和 Vasiliy Kulikov 发现 shm 接口未正确清除内核内存。本地攻击者可利用此缺陷读取内核堆栈内存，从而导致失去隐私。
(CVE-2010-4072)

Dan Rosenberg 发现 USB 子系统未正确初始化特定结构。本地攻击者可利用此缺陷读取内核堆栈内存，从而导致失去隐私。
(CVE-2010-4074)

Dan Rosenberg 发现 SiS 视频驱动程序未正确清除内核内存。本地攻击者可利用此缺陷读取内核堆栈内存，从而导致失去隐私。(CVE-2010-4078)

Dan Rosenberg 发现 ivtv V4L 驱动程序未正确初始化特定结构。本地攻击者可利用此缺陷读取内核堆栈内存，从而导致失去隐私。
(CVE-2010-4079)

Dan Rosenberg 发现 RME Hammerfall DSP 音频接口驱动程序未正确清理内核内存。本地攻击者可利用此缺陷读取内核堆栈内存，从而导致失去隐私。（CVE-2010-4080、CVE-2010-4081）

Dan Rosenberg 发现 semctl syscall 未正确清除内核内存。本地攻击者可利用此缺陷读取内核堆栈内存，从而导致失去隐私。(CVE-2010-4083)

James Bottomley 发现 ICP vortex 存储阵列控制器驱动程序未验证特定大小。64 位系统上的本地攻击者可利用此缺陷使内核崩溃，从而导致拒绝服务。(CVE-2010-4157)

Dan Rosenberg 发现 Linux 内核 L2TP 实现中包含多个整数符号错误。本地攻击者可利用此错误造成内核崩溃，也可能获得根权限。
(CVE-2010-4160)

已发现多线程 exec 未正确处理 CPU 定时器。本地攻击者可利用此缺陷造成系统崩溃，从而导致拒绝服务。(CVE-2010-4248)。

Gleb Napatov 发现 KVM 未正确检查特定特权操作。具有访问客户机内核权限的本地攻击者可以利用此漏洞使主机系统崩溃，从而导致拒绝服务。(CVE-2010-0435)

Dan Jacobson 发现未对 ThinkPad 视频输出正确执行访问控制。本地攻击者可利用此缺陷使系统挂起，从而导致拒绝服务。(CVE-2010-3448)

发现 KVM 未正确初始化特定 CPU 寄存器。本地攻击者可利用此缺陷造成系统崩溃，从而导致拒绝服务。(CVE-2010-3698)

Dan Rosenberg 发现 Linux 内核 TIPC 实现中包含多个整数符号错误。本地攻击者可利用此错误获得根权限。(CVE-2010-3859)

Thomas Pollet 发现 RDS 网络协议不检查特定 iovec 缓冲区。远程攻击者可利用此缺陷导致系统崩溃，也可能以根用户身份执行任意代码。
(CVE-2010-3865)

Dan Rosenberg 发现 Linux 内核 X.25 实现未正确解析设施。远程攻击者可利用此漏洞造成内核崩溃，从而导致拒绝服务。(CVE-2010-3873)

Dan Rosenberg 发现 64 位系统上的 CAN 协议未正确计算特定缓冲区的大小。远程攻击者可利用此缺陷导致系统崩溃，也可能以根用户身份执行任意代码。(CVE-2010-3874)

Vasiliy Kulikov 发现 Linux 内核 X.25 实现未正确清除内核内存。本地攻击者可利用此缺陷读取内核堆栈内存，从而导致失去隐私。
(CVE-2010-3875)

Vasiliy Kulikov 发现 Linux 内核套接字实现未正确初始化特定结构。本地攻击者可利用此缺陷读取内核堆栈内存，从而导致失去隐私。(CVE-2010-3876)

Vasiliy Kulikov 发现 TIPC 接口未正确初始化某些结构。本地攻击者可利用此缺陷读取内核堆栈内存，从而导致失去隐私。
(CVE-2010-3877)

Nelson Elhage 发现 Linux 内核 IPv4 实现未正确审计 netlink 消息中的特定字节码。本地攻击者可利用此缺陷导致内核挂起，从而导致拒绝服务。(CVE-2010-3880)

Dan Rosenberg 发现在 64 位系统上未正确初始化 IPC 结构。本地攻击者可利用此缺陷读取内核堆栈内存，从而导致失去隐私。
(CVE-2010-4073)

Dan Rosenberg 发现 USB 子系统未正确初始化特定结构。本地攻击者可利用此缺陷读取内核堆栈内存，从而导致失去隐私。
(CVE-2010-4074)

Dan Rosenberg 发现 SiS 视频驱动程序未正确清除内核内存。本地攻击者可利用此缺陷读取内核堆栈内存，从而导致失去隐私。(CVE-2010-4078)

Dan Rosenberg 发现 ivtv V4L 驱动程序未正确初始化特定结构。本地攻击者可利用此缺陷读取内核堆栈内存，从而导致失去隐私。
(CVE-2010-4079)

Dan Rosenberg 发现 RME Hammerfall DSP 音频接口驱动程序未正确清理内核内存。本地攻击者可利用此缺陷读取内核堆栈内存，从而导致失去隐私。（CVE-2010-4080、CVE-2010-4081）

Dan Rosenberg 发现 VIA 视频驱动程序未正确清除内核内存。本地攻击者可利用此缺陷读取内核堆栈内存，从而导致失去隐私。(CVE-2010-4082)

Dan Rosenberg 发现 semctl syscall 未正确清除内核内存。本地攻击者可利用此缺陷读取内核堆栈内存，从而导致失去隐私。(CVE-2010-4083)

James Bottomley 发现 ICP vortex 存储阵列控制器驱动程序未验证特定大小。64 位系统上的本地攻击者可利用此缺陷使内核崩溃，从而导致拒绝服务。(CVE-2010-4157)

Dan Rosenberg 发现 Linux 内核 L2TP 实现中包含多个整数符号错误。本地攻击者可利用此错误造成内核崩溃，也可能获得根权限。
(CVE-2010-4160)

Steve Chen 发现 setsockopt 未正确检查 MSS 值。本地攻击者可创建特别构建的套接字调用使系统崩溃，从而导致拒绝服务。(CVE-2010-4165)

Dave Jones 发现 mprotect 系统调用未正确处理合并的 VMA。本地攻击者可利用此缺陷造成系统崩溃，从而导致拒绝服务。(CVE-2010-4169)

已发现多线程 exec 未正确处理 CPU 定时器。本地攻击者可利用此缺陷造成系统崩溃，从而导致拒绝服务。(CVE-2010-4248)

Vegard Nossum 发现无法为活动套接字正确处理内存垃圾回收。本地攻击者可利用此问题分配所有可用的内核内存，从而导致拒绝服务。(CVE-2010-4249)。

openSUSE 12.1 内核的此内核更新修复了大量缺陷和安全问题。

修复了以下问题：

- tcp：丢失 SYN+FIN 消息 (bnc#765102)。

- net: sock：在 sock_alloc_send_pskb() 中分配 skb 之前验证 data_len（bnc#765320、CVE-2012-2136）。

- fcaps：使用 fcaps 时清除与 suid 相同的个性标记 (bnc#758260 CVE-2012-2123)。

- macvtap: zerocopy：在构建 skb 之前验证矢量 (bnc#758243 CVE-2012-2119)。

- hfsplus：修复了潜在的缓冲区溢出（bnc#760902、CVE-2009-4020）。

- xfrm：计算 esp 负载大小时考虑 net hdr len (bnc#759545)。

- ext4：修复 ext4_fill_flex_info() 中的未定义行为 (bnc#757278)。

- igb：修复了 PM 恢复路径中的 rtnl 争用 (bnc#748859)。

- ixgbe：在 PM 恢复路径中添加缺失的 rtnl_lock (bnc#748859)。

- b43：分配足够接收最大帧长度 + 偏移的缓冲区 (bnc#717749)。

- xenbus：拒绝负载超过 XENSTORE_PAYLOAD_MAX 的回复。

- xenbus_dev：添加缺少的错误检查以对处理进行监视。

- hwmon：(coretemp-xen) 修复针对较旧 CPU 的 TjMax 检测。

- hwmon：(coretemp-xen) 放宽目标温度范围检查。

- 刷新其他 Xen 修补程序。

- tlan：添加正常 64 位操作所需的转换 (bnc#756840)。

- dl2k：收紧了 ioctl 权限 (bnc#758813)。

- [媒体] cx22702：修复信号强度。

- fs：cachefiles：支持文件系统缓存中包含大文件 (bnc#747038)。

- bridge：修正拉取之后的 IPv6 校验和 (bnc#738644)。

- bridge：修复可能的释放后使用 (bnc#738644)。

- bridge：ICMPv6 校验和所需的伪标头 (bnc#738644)。

- bridge：mcast 嗅探，修复嗅探到的 MLDv1/2 的长度检查 (bnc#738644)。

- PCI/ACPI：如果未从命令行禁用，则报告对 BIOS 的 ASPM 支持 (bnc#714455)。

- ipc/sem.c：修复并发 semtimedop() 超时与 IPC_RMID 的争用 (bnc#756203)。

- drm/i915/crt：删除 VGA 的 0xa0 探测。

- tty_audit：修复禁用审计时的 tty_audit_add_data 活锁 (bnc#721366)。

- drm/i915：在挂起/休眠时挂起 fbdev 设备 (bnc#732908)。

- dlm：不为剥离分配 fd (bnc#729247)。

- sctp：导出 sctp_do_peeloff (bnc#729247)。

- i2c-algo-bit：修复重负载下的虚假 SCL 超时。

- patches.fixes/epoll-dont-limit-non-nested.patch：不限制非嵌套 epoll 路径 (bnc#676204)。

- 更新 patches.suse/sd_init.mark_majors_busy.patch (bnc#744658)。

- igb：针对 82580 及更高版本设备上的 Alt MAC 地址功能的补丁 (bnc#746980)。

- 将忙碌的 sd 主要设备标记为已分配 (bug#744658)。

- regset：在主机端内存错误时返回 -EFAULT 而不是 -EIO (bnc# 750079 CVE-2012-1097)。

- regset：防止在只读的 regset 上出现空指针引用 (bnc#750079 CVE-2012-1097)。

- mm：memcg：修正附加到相同 eventfd 的事件的取消注册 (CVE-2012-1146 bnc#750959)。

- befs：验证长符号链接的长度 (CVE-2011-2928 bnc#713430)。

- si4713-i2c：避免 si4713 的潜在缓冲区溢出 (CVE-2011-2700 bnc#707332)。

- staging：comedi：修复信息泄漏到用户空间 (CVE-2011-2909 bnc#711941)。

- hfs：添加文件名长度的健全性检查 (CVE-2011-4330 bnc#731673)。

- cifs：修复查找时打开 FIFO 的目录项引用计数泄漏 (CVE-2012-1090 bnc#749569)。

- drm：drm_mode_dirtyfb_ioctl() 中的整数溢出 (CVE-2012-0044 bnc#740745)。

- xfs：修复 xfs_acl_from_disk() 中的 acl 计数验证 (CVE-2012-0038 bnc#740703)。

- xfs：验证 acl 计数 (CVE-2012-0038 bnc#740703)。

- patches.fixes/xfs-fix-possible-memory-corruption-in-xfs_ readlink：解决缺少 xfs_alert() 的问题。

- xfs：修复 xfs_readlink() 中错误恢复路径缺少 xfs_iunlock() 的问题 (CVE-2011-4077 bnc#726600)。

- xfs：修复 xfs_readlink 中可能的内存损坏 (CVE-2011-4077 bnc#726600)。

- ext4：使 ext4_split_extent() 正确处理错误。

- ext4：在扩展 FSX 测试中发现的 ext4_ext_convert_to_initialized 缺陷。

- ext4：添加 ext4_split_extent_at() 和 ext4_split_extent()。

- ext4：重新实现转换和 split_unwritten (CVE-2011-3638 bnc#726045)。

- patches.fixes/epoll-limit-paths.patch：epoll：限制路径 (bnc#676204 CVE-2011-1083)。

- patches.kabi/epoll-kabi-fix.patch：epoll：隐藏结构文件中的 kabi 更改 (bnc#676204 CVE-2011-1083)。

- NAT/FTP：修复损坏的 conntrack (bnc#681639 bnc#466279 bnc#747660)。

- igmp：避免接收 IGMP 查询的奇怪混合时的零延迟 (bnc#740448 CVE-2012-0207)。

- jbd2：清除 journal_unmap_buffer 中的 BH_Delay 和 BH_Unwritten (bnc#745832 CVE-2011-4086)。

- AppArmor：修复 apparmor_setprocattr 中的 oops (bnc#717209 CVE-2011-3619)。

- 刷新 patches.suse/SoN-22-netvm.patch。清理修补程序，使其工作正常。

- 刷新 patches.suse/SoN-22-netvm.patch。(bnc#683671) 修复使用 vlan 时触发的接收路径中的 rcu 锁定不平衡。

- 修复损坏的修补程序（无效日期）：尽管被“patch”接受，但“git apply”仍会拒绝

- 修复损坏的 diff 行（前导空格制表符与制表符）：尽管被“patch”接受，但“git apply”仍会拒绝

- jbd/jbd2：验证 journal_get_superblock() 中的 sb->s_first (bnc#730118)。

- fsnotify：不通知 fsnotify_destroy_mark() 中的缺陷 (bnc#689860)。

- 修复 patches.fixes/x25-Handle-undersized-fragmented-skbs.patch (CVE-2010-3873 bnc#651219)。

- 修复 patches.fixes/x25-Prevent-skb-overreads-when-checking-ca ll-user-da.patch (CVE-2010-3873 bnc#651219)。

- 修复 patches.fixes/x25-Validate-incoming-call-user-data-lengt hs.patch (CVE-2010-3873 bnc#651219)。

- 修复 patches.fixes/x25-possible-skb-leak-on-bad-facilities.patch (CVE-2010-3873 bnc#651219 CVE-2010-4164 bnc#653260)。

- 更新 patches.fixes/econet-4-byte-infoleak-to-the-network.patch (bnc#681186 CVE-2011-1173)。修复引用。

- hwmon：(w83627ehf) 正确报告热二极管传感器。

- nl80211：修复 ssid_len 中的溢出 (bnc#703410 CVE-2011-2517)。

- nl80211：修复扫描操作中的有效 SSID 大小检查 (bnc#703410 CVE-2011-2517)。

- x25：防止检查调用用户数据时的 skb 越界读取 (CVE-2010-3873 bnc#737624)。

- x25：处理尺寸过小/拆分的 skb (CVE-2010-3873 bnc#737624)。

- x25：验证传入调用用户数据长度 (CVE-2010-3873 bnc#737624)。

- x25：不良设施上可能的 skb 泄漏 (CVE-2010-3873 bnc#737624)。

- net：添加 a flow_cache_flush_deferred 函数 (bnc#737624)。

- xfrm：避免 xfrm_alloc_dst 中可能的 oopse (bnc#737624)。

- scm：降低 SCM_MAX_FD (bnc#655696 CVE-2010-4249)。

ID	Name	Product	Family	Published	Updated	Severity
52474	Ubuntu 6.06 LTS : linux-source-2.6.15 vulnerabilities (USN-1071-1)	Nessus	Ubuntu Local Security Checks	3/1/2011	9/19/2019	high
52475	Ubuntu 8.04 LTS : linux vulnerabilities (USN-1072-1)	Nessus	Ubuntu Local Security Checks	3/1/2011	9/19/2019	high
52476	Ubuntu 9.10 : linux, linux-ec2 vulnerabilities (USN-1073-1)	Nessus	Ubuntu Local Security Checks	3/1/2011	10/16/2019	high
74658	openSUSE Security Update : Kernel (openSUSE-SU-2012:0799-1)	Nessus	SuSE Local Security Checks	6/13/2014	1/19/2021	critical
50825	Debian DSA-2126-1 : linux-2.6 - privilege escalation/denial of service/information leak	Nessus	Debian Local Security Checks	11/29/2010	1/4/2021	high
57854	SuSE 11.1 Security Update : Linux kernel (SAT Patch Number 5732)	Nessus	SuSE Local Security Checks	2/7/2012	1/19/2021	high
59161	SuSE 10 安全更新：Linux 内核（ZYPP 修补程序编号 7915）	Nessus	SuSE Local Security Checks	5/17/2012	1/19/2021	high
57854	SuSE 11.1 安全更新：Linux 内核（SAT 修补程序编号 5732）	Nessus	SuSE Local Security Checks	2/7/2012	1/19/2021	high
52474	Ubuntu 6.06 LTS：linux-source-2.6.15 漏洞 (USN-1071-1)	Nessus	Ubuntu Local Security Checks	3/1/2011	9/19/2019	high
52475	Ubuntu 8.04 LTS：Linux 漏洞 (USN-1072-1)	Nessus	Ubuntu Local Security Checks	3/1/2011	9/19/2019	high
52476	Ubuntu 9.10：linux，linux-ec2 漏洞 (USN-1073-1)	Nessus	Ubuntu Local Security Checks	3/1/2011	10/16/2019	high
74658	openSUSE 安全更新：Kernel (openSUSE-SU-2012:0799-1)	Nessus	SuSE Local Security Checks	6/13/2014	1/19/2021	critical

Detections

Analytics

Plugins Search

high

high

high

critical

high

high

high

high

high

high

high

critical