The SUSE Linux Enterprise 11 Service Pack 2 kernel has been updated to version 3.0.93 and includes various bug and security fixes.

The following security bugs have been fixed :

  - The fill_event_metadata function in     fs/notify/fanotify/fanotify_user.c in the Linux kernel     did not initialize a certain structure member, which     allowed local users to obtain sensitive information from     kernel memory via a read operation on the fanotify     descriptor. (CVE-2013-2148)

  - The key_notify_policy_flush function in net/key/af_key.c     in the Linux kernel did not initialize a certain     structure member, which allowed local users to obtain     sensitive information from kernel heap memory by reading     a broadcast message from the notify_policy interface of     an IPSec key_socket. (CVE-2013-2237)

  - The ip6_sk_dst_check function in net/ipv6/ip6_output.c     in the Linux kernel allowed local users to cause a     denial of service (system crash) by using an AF_INET6     socket for a connection to an IPv4 interface.
    (CVE-2013-2232)

  - The (1) key_notify_sa_flush and (2)     key_notify_policy_flush functions in net/key/af_key.c in     the Linux kernel did not initialize certain structure     members, which allowed local users to obtain sensitive     information from kernel heap memory by reading a     broadcast message from the notify interface of an IPSec     key_socket. (CVE-2013-2234)

  - The udp_v6_push_pending_frames function in     net/ipv6/udp.c in the IPv6 implementation in the Linux     kernel made an incorrect function call for pending data,     which allowed local users to cause a denial of service     (BUG and system crash) via a crafted application that     uses the UDP_CORK option in a setsockopt system call.
    (CVE-2013-4162)

  - net/ceph/auth_none.c in the Linux kernel allowed remote     attackers to cause a denial of service (NULL pointer     dereference and system crash) or possibly have     unspecified other impact via an auth_reply message that     triggers an attempted build_request operation.
    (CVE-2013-1059)

  - The mmc_ioctl_cdrom_read_data function in     drivers/cdrom/cdrom.c in the Linux kernel allowed local     users to obtain sensitive information from kernel memory     via a read operation on a malfunctioning CD-ROM drive.
    (CVE-2013-2164)

  - Format string vulnerability in the register_disk     function in block/genhd.c in the Linux kernel allowed     local users to gain privileges by leveraging root access     and writing format string specifiers to     /sys/module/md_mod/parameters/new_array in order to     create a crafted /dev/md device name. (CVE-2013-2851)

  - The ip6_append_data_mtu function in     net/ipv6/ip6_output.c in the IPv6 implementation in the     Linux kernel did not properly maintain information about     whether the IPV6_MTU setsockopt option had been     specified, which allowed local users to cause a denial     of service (BUG and system crash) via a crafted     application that uses the UDP_CORK option in a     setsockopt system call. (CVE-2013-4163)

  - Heap-based buffer overflow in the tg3_read_vpd function     in drivers/net/ethernet/broadcom/tg3.c in the Linux     kernel allowed physically proximate attackers to cause a     denial of service (system crash) or possibly execute     arbitrary code via crafted firmware that specifies a     long string in the Vital Product Data (VPD) data     structure. (CVE-2013-1929)

  - The _xfs_buf_find function in fs/xfs/xfs_buf.c in the     Linux kernel did not validate block numbers, which     allowed local users to cause a denial of service (NULL     pointer dereference and system crash) or possibly have     unspecified other impact by leveraging the ability to     mount an XFS filesystem containing a metadata inode with     an invalid extent map. (CVE-2013-1819)

  - The chase_port function in drivers/usb/serial/io_ti.c in     the Linux kernel allowed local users to cause a denial     of service (NULL pointer dereference and system crash)     via an attempted /dev/ttyUSB read or write operation on     a disconnected Edgeport USB serial converter.
    (CVE-2013-1774)

Also the following bugs have been fixed :

BTRFS :

  - btrfs: merge contiguous regions when loading free space     cache

  - btrfs: fix how we deal with the orphan block rsv

  - btrfs: fix wrong check during log recovery

  - btrfs: change how we indicate we are adding csums

  - btrfs: flush delayed inodes if we are short on space.
    (bnc#801427)

  - btrfs: rework shrink_delalloc. (bnc#801427)

  - btrfs: fix our overcommit math. (bnc#801427)

  - btrfs: delay block group item insertion. (bnc#801427)

  - btrfs: remove bytes argument from do_chunk_alloc.
    (bnc#801427)

  - btrfs: run delayed refs first when out of space.
    (bnc#801427)

  - btrfs: do not commit instead of overcommitting.
    (bnc#801427)

  - btrfs: do not take inode delalloc mutex if we are a free     space inode. (bnc#801427)

  - btrfs: fix chunk allocation error handling. (bnc#801427)

  - btrfs: remove extent mapping if we fail to add chunk.
    (bnc#801427)

  - btrfs: do not overcommit if we do not have enough space     for global rsv. (bnc#801427)

  - btrfs: rework the overcommit logic to be based on the     total size. (bnc#801427)

  - btrfs: steal from global reserve if we are cleaning up     orphans. (bnc#801427)

  - btrfs: clear chunk_alloc flag on retryable failure.
    (bnc#801427)

  - btrfs: use reserved space for creating a snapshot.
    (bnc#801427)

  - btrfs: cleanup to make the function     btrfs_delalloc_reserve_metadata more logic. (bnc#801427)

  - btrfs: fix space leak when we fail to reserve metadata     space. (bnc#801427)

  - btrfs: fix space accounting for unlink and rename.
    (bnc#801427)

  - btrfs: allocate new chunks if the space is not enough     for global rsv. (bnc#801427)

  - btrfs: various abort cleanups. (bnc#812526 / bnc#801427)

  - btrfs: simplify unlink reservations (bnc#801427). OTHER :

  - x86: Add workaround to NMI iret woes. (bnc#831949)

  - x86: Do not schedule while still in NMI context.
    (bnc#831949)

  - bnx2x: Avoid sending multiple statistics queries.
    (bnc#814336)

  - bnx2x: protect different statistics flows. (bnc#814336)

  - futex: Take hugepages into account when generating     futex_key.

  - drivers/hv: util: Fix a bug in version negotiation code     for util services. (bnc#828714)

  - printk: Add NMI ringbuffer. (bnc#831949)

  - printk: extract ringbuffer handling from vprintk.
    (bnc#831949)

  - printk: NMI safe printk. (bnc#831949)

  - printk: Make NMI ringbuffer size independent on     log_buf_len. (bnc#831949)

  - printk: Do not call console_unlock from nmi context.
    (bnc#831949)

  - printk: Do not use printk_cpu from finish_printk.
    (bnc#831949)

  - mlx4_en: Adding 40gb speed report for ethtool.
    (bnc#831410)

  - reiserfs: Fixed double unlock in reiserfs_setattr     failure path.

  - reiserfs: delay reiserfs lock until journal     initialization. (bnc#815320)

  - reiserfs: do not lock journal_init(). (bnc#815320)

  - reiserfs: locking, handle nested locks properly.
    (bnc#815320)

  - reiserfs: locking, push write lock out of xattr code.
    (bnc#815320)

  - reiserfs: locking, release lock around quota operations.
    (bnc#815320)

  - NFS: support 'nosharetransport' option (bnc#807502,     bnc#828192, FATE#315593).

  - dm mpath: add retain_attached_hw_handler feature.
    (bnc#760407)

  - scsi_dh: add scsi_dh_attached_handler_name. (bnc#760407)

  - bonding: disallow change of MAC if fail_over_mac     enabled. (bnc#827376)

  - bonding: propagate unicast lists down to slaves.
    (bnc#773255 / bnc#827372)

  - bonding: emit address change event also in bond_release.
    (bnc#773255 / bnc#827372)

  - bonding: emit event when bonding changes MAC.
    (bnc#773255 / bnc#827372)

  - SUNRPC: Ensure we release the socket write lock if the     rpc_task exits early. (bnc#830901)

  - ext4: force read-only unless rw=1 module option is used     (fate#314864).

  - HID: fix unused rsize usage. (bnc#783475)

  - HID: fix data access in implement(). (bnc#783475)

  - xfs: fix deadlock in xfs_rtfree_extent with kernel v3.x.
    (bnc#829622)

  - r8169: allow multicast packets on sub-8168f chipset.
    (bnc#805371)

  - r8169: support new chips of RTL8111F. (bnc#805371)

  - r8169: define the early size for 8111evl. (bnc#805371)

  - r8169: fix the reset setting for 8111evl. (bnc#805371)

  - r8169: add MODULE_FIRMWARE for the firmware of 8111evl.
    (bnc#805371)

  - r8169: fix sticky accepts packet bits in RxConfig.
    (bnc#805371)

  - r8169: adjust the RxConfig settings. (bnc#805371)

  - r8169: support RTL8111E-VL. (bnc#805371)

  - r8169: add ERI functions. (bnc#805371)

  - r8169: modify the flow of the hw reset. (bnc#805371)

  - r8169: adjust some registers. (bnc#805371)

  - r8169: check firmware content sooner. (bnc#805371)

  - r8169: support new firmware format. (bnc#805371)

  - r8169: explicit firmware format check. (bnc#805371)

  - r8169: move the firmware down into the device private     data. (bnc#805371)

  - mm: link_mem_sections make sure nmi watchdog does not     trigger while linking memory sections. (bnc#820434)

  - kernel: lost IPIs on CPU hotplug (bnc#825048,     LTC#94784).

  - iwlwifi: use correct supported firmware for 6035 and     6000g2. (bnc#825887)

  - watchdog: Update watchdog_thresh atomically.
    (bnc#829357)

  - watchdog: update watchdog_tresh properly. (bnc#829357)

  - watchdog:
    watchdog-make-disable-enable-hotplug-and-preempt-save.pa     tch. (bnc#829357)

  - include/1/smp.h: define __smp_call_function_single for     !CONFIG_SMP. (bnc#829357)

  - lpfc: Return correct error code on bsg_timeout.
    (bnc#816043)

  - dm-multipath: Drop table when retrying ioctl.
    (bnc#808940)

  - scsi: Do not retry invalid function error. (bnc#809122)

  - scsi: Always retry internal target error. (bnc#745640,     bnc#825227)

  - ibmvfc: Driver version 1.0.1. (bnc#825142)

  - ibmvfc: Fix for offlining devices during error recovery.
    (bnc#825142)

  - ibmvfc: Properly set cancel flags when cancelling abort.
    (bnc#825142)

  - ibmvfc: Send cancel when link is down. (bnc#825142)

  - ibmvfc: Support FAST_IO_FAIL in EH handlers.
    (bnc#825142)

  - ibmvfc: Suppress ABTS if target gone. (bnc#825142)

  - fs/dcache.c: add cond_resched() to     shrink_dcache_parent(). (bnc#829082)

  - kmsg_dump: do not run on non-error paths by default.
    (bnc#820172)

  - mm: honor min_free_kbytes set by user. (bnc#826960)

  - hyperv: Fix a kernel warning from     netvsc_linkstatus_callback(). (bnc#828574)

  - RT: Fix up hardening patch to not gripe when avg >     available, which lockless access makes possible and     happens in -rt kernels running a cpubound ltp realtime     testcase. Just keep the output sane in that case.

  - md/raid10: Fix two bug affecting RAID10 reshape (-).

  - Allow NFSv4 to run execute-only files. (bnc#765523)

  - fs/ocfs2/namei.c: remove unnecessary ERROR when removing     non-empty directory. (bnc#819363)

  - block: Reserve only one queue tag for sync IO if only 3     tags are available. (bnc#806396)

  - drm/i915: Add wait_for in init_ring_common. (bnc#813604)

  - drm/i915: Mark the ringbuffers as being in the GTT     domain. (bnc#813604)

  - ext4: avoid hang when mounting non-journal filesystems     with orphan list. (bnc#817377)

  - autofs4 - fix get_next_positive_subdir(). (bnc#819523)

  - ocfs2: Add bits_wanted while calculating credits in     ocfs2_calc_extend_credits. (bnc#822077)

  - re-enable io tracing. (bnc#785901)

  - SUNRPC: Prevent an rpc_task wakeup race. (bnc#825591)

  - tg3: Prevent system hang during repeated EEH errors.
    (bnc#822066)

  - backends: Check for insane amounts of requests on the     ring.

  - Update Xen patches to 3.0.82.

  - netiucv: Hold rtnl between name allocation and device     registration. (bnc#824159)

  - drm/edid: Do not print messages regarding stereo or     csync by default. (bnc#821235)

  - net/sunrpc: xpt_auth_cache should be ignored when     expired. (bnc#803320)

  - sunrpc/cache: ensure items removed from cache do not     have pending upcalls. (bnc#803320)

  - sunrpc/cache: remove races with queuing an upcall.
    (bnc#803320)

  - sunrpc/cache: use cache_fresh_unlocked consistently and     correctly. (bnc#803320)

  - md/raid10 'enough' fixes. (bnc#773837)

  - Update config files: disable IP_PNP. (bnc#822825)

  - Disable efi pstore by default. (bnc#804482 / bnc#820172)

  - md: Fix problem with GET_BITMAP_FILE returning wrong     status. (bnc#812974 / bnc#823497)

  - USB: xHCI: override bogus bulk wMaxPacketSize values.
    (bnc#823082)

  - ALSA: hda - Fix system panic when DMA > 40 bits for     Nvidia audio controllers. (bnc#818465)

  - USB: UHCI: fix for suspend of virtual HP controller.
    (bnc#817035)

  - mm: mmu_notifier: re-fix freed page still mapped in     secondary MMU. (bnc#821052)

Vince Weaver discovered a flaw in the perf subsystem of the Linux kernel on ARM platforms. A local user could exploit this flaw to gain privileges or cause a denial of service (system crash).
(CVE-2013-4254)

A failure to validate block numbers was discovered in the Linux kernel's implementation of the XFS filesystem. A local user can cause a denial of service (system crash) if they can mount, or cause to be mounted a corrupted or special crafted XFS filesystem. (CVE-2013-1819)

An information leak was discovered in the Linux kernel's IPSec key_socket when using the notify_policy interface. A local user could exploit this flaw to examine potentially sensitive information in kernel memory. (CVE-2013-2237).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to Linux v3.8.3. Wide variety of fixes across the tree.
Contains reverts from upstream 3.8.3 to fix Intel GM45 graphics.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Vince Weaver discovered a flaw in the perf subsystem of the Linux kernel on ARM platforms. A local user could exploit this flaw to gain privileges or cause a denial of service (system crash).
(CVE-2013-4254)

A failure to validate block numbers was discovered in the Linux kernel's implementation of the XFS filesystem. A local user can cause a denial of service (system crash) if they can mount, or cause to be mounted a corrupted or special crafted XFS filesystem. (CVE-2013-1819).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated kernel-rt packages that fix several security issues and multiple bugs are now available for Red Hat Enterprise MRG 2.3.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Security fixes :

* It was found that the kernel-rt update RHBA-2012:0044 introduced an integer conversion issue in the Linux kernel's Performance Events implementation. This led to a user-supplied index into the perf_swevent_enabled array not being validated properly, resulting in out-of-bounds kernel memory access. A local, unprivileged user could use this flaw to escalate their privileges. (CVE-2013-2094, Important)

A public exploit for CVE-2013-2094 that affects Red Hat Enterprise MRG 2 is available. Refer to Red Hat Knowledge Solution 373743, linked to in the References, for further information and mitigation instructions for users who are unable to immediately apply this update.

* An integer overflow flaw, leading to a heap-based buffer overflow, was found in the way the Intel i915 driver in the Linux kernel handled the allocation of the buffer used for relocation copies. A local user with console access could use this flaw to cause a denial of service or escalate their privileges. (CVE-2013-0913, Important)

* It was found that the Linux kernel used effective user and group IDs instead of real ones when passing messages with SCM_CREDENTIALS ancillary data. A local, unprivileged user could leverage this flaw with a set user ID (setuid) application, allowing them to escalate their privileges. (CVE-2013-1979, Important)

* A race condition in install_user_keyrings(), leading to a NULL pointer dereference, was found in the key management facility. A local, unprivileged user could use this flaw to cause a denial of service. (CVE-2013-1792, Moderate)

* A NULL pointer dereference flaw was found in the Linux kernel's XFS file system implementation. A local user who is able to mount an XFS file system could use this flaw to cause a denial of service.
(CVE-2013-1819, Moderate)

* An information leak was found in the Linux kernel's POSIX signals implementation. A local, unprivileged user could use this flaw to bypass the Address Space Layout Randomization (ASLR) security feature.
(CVE-2013-0914, Low)

* A use-after-free flaw was found in the tmpfs implementation. A local user able to mount and unmount a tmpfs file system could use this flaw to cause a denial of service or, potentially, escalate their privileges. (CVE-2013-1767, Low)

* A NULL pointer dereference flaw was found in the Linux kernel's USB Inside Out Edgeport Serial Driver implementation. A local user with physical access to a system and with access to a USB device's tty file could use this flaw to cause a denial of service. (CVE-2013-1774, Low)

* A format string flaw was found in the ext3_msg() function in the Linux kernel's ext3 file system implementation. A local user who is able to mount an ext3 file system could use this flaw to cause a denial of service or, potentially, escalate their privileges.
(CVE-2013-1848, Low)

* A heap-based buffer overflow flaw was found in the Linux kernel's cdc-wdm driver, used for USB CDC WCM device management. An attacker with physical access to a system could use this flaw to cause a denial of service or, potentially, escalate their privileges. (CVE-2013-1860, Low)

* A heap-based buffer overflow in the way the tg3 Ethernet driver parsed the vital product data (VPD) of devices could allow an attacker with physical access to a system to cause a denial of service or, potentially, escalate their privileges. (CVE-2013-1929, Low)

* Information leaks in the Linux kernel's cryptographic API could allow a local user who has the CAP_NET_ADMIN capability to leak kernel stack memory to user-space. (CVE-2013-2546, CVE-2013-2547, CVE-2013-2548, Low)

* Information leaks in the Linux kernel could allow a local, unprivileged user to leak kernel stack memory to user-space.
(CVE-2013-2634, CVE-2013-2635, CVE-2013-3076, CVE-2013-3222, CVE-2013-3224, CVE-2013-3225, CVE-2013-3231, Low)

Red Hat would like to thank Andy Lutomirski for reporting CVE-2013-1979. CVE-2013-1792 was discovered by Mateusz Guzik of Red Hat EMEA GSS SEG Team.

The Linux kernel was updated to 3.4.63, fixing various bugs and security issues.

  - Linux 3.4.59 (CVE-2013-2237 bnc#828119).

  - Linux 3.4.57 (CVE-2013-2148 bnc#823517).

  - Linux 3.4.55 (CVE-2013-2232 CVE-2013-2234 CVE-2013-4162     CVE-2013-4163 bnc#827749 bnc#827750 bnc#831055     bnc#831058).

  - Drivers: hv: util: Fix a bug in util version negotiation     code (bnc#838346).

  - vmxnet3: prevent div-by-zero panic when ring resizing     uninitialized dev (bnc#833321).

  - bnx2x: protect different statistics flows (bnc#814336).

  - bnx2x: Avoid sending multiple statistics queries     (bnc#814336).

  - Drivers: hv: util: Fix a bug in version negotiation code     for util services (bnc#828714).

  - Update Xen patches to 3.4.53.

  - netfront: fix kABI after 'reduce gso_max_size to account     for max TCP header'.

  - netback: don't disconnect frontend when seeing oversize     packet (bnc#823342).

  - netfront: reduce gso_max_size to account for max TCP     header.

  - backends: Check for insane amounts of requests on the     ring.

  - reiserfs: Fixed double unlock in reiserfs_setattr     failure path.

  - reiserfs: locking, release lock around quota operations     (bnc#815320).

  - reiserfs: locking, handle nested locks properly     (bnc#815320).

  - reiserfs: locking, push write lock out of xattr code     (bnc#815320).

  - ipv6: ip6_append_data_mtu did not care about pmtudisc     and frag_size (bnc#831055, CVE-2013-4163).

  - af_key: fix info leaks in notify messages (bnc#827749     CVE-2013-2234).

  - af_key: initialize satype in key_notify_policy_flush()     (bnc#828119 CVE-2013-2237).

  - ipv6: call udp_push_pending_frames when uncorking a     socket with (bnc#831058, CVE-2013-4162).

  - ipv6: ip6_sk_dst_check() must not assume ipv6 dst.

  - xfs: fix _xfs_buf_find oops on blocks beyond the     filesystem end (CVE-2013-1819 bnc#807471).

  - brcmsmac: don't start device when RfKill is engaged     (bnc#787649).

  - CIFS: Protect i_nlink from being negative (bnc#785542     bnc#789598).

  - cifs: don't compare uniqueids in cifs_prime_dcache     unless server inode numbers are in use (bnc#794988).

  - xfs: xfs: fallback to vmalloc for large buffers in     xfs_compat_attrlist_by_handle (bnc#818053 bnc#807153).

  - xfs: fallback to vmalloc for large buffers in     xfs_attrlist_by_handle (bnc#818053 bnc#807153).

  - Linux 3.4.53 (CVE-2013-2164 CVE-2013-2851 bnc#822575     bnc#824295).

  - drivers/cdrom/cdrom.c: use kzalloc() for failing     hardware (bnc#824295, CVE-2013-2164).

  - fanotify: info leak in copy_event_to_user()     (CVE-2013-2148 bnc#823517).

  - block: do not pass disk names as format strings     (bnc#822575 CVE-2013-2851).

  - ext4: avoid hang when mounting non-journal filesystems     with orphan list (bnc#817377).

  - Linux 3.4.49 (CVE-2013-0231 XSA-43 bnc#801178).

  - Linux 3.4.48 (CVE-2013-1774 CVE-2013-2850 bnc#806976     bnc#821560).

  - Always include the git commit in KOTD builds This allows     us not to set it explicitly in builds submitted to the     official distribution (bnc#821612, bnc#824171).

  - Bluetooth: Really fix registering hci with duplicate     name (bnc#783858).

  - Bluetooth: Fix registering hci with duplicate name     (bnc#783858).

ID	Name	Product	Family	Published	Updated	Severity
70039	SuSE 11.2 Security Update : Linux kernel (SAT Patch Numbers 8263 / 8265 / 8273)	Nessus	SuSE Local Security Checks	9/21/2013	1/19/2021	high
70191	Ubuntu 12.04 LTS : linux-lts-quantal vulnerabilities (USN-1970-1)	Nessus	Ubuntu Local Security Checks	9/28/2013	9/19/2019	medium
65650	Fedora 17 : kernel-3.8.3-103.fc17 (2013-3909)	Nessus	Fedora Local Security Checks	3/22/2013	1/11/2021	high
70193	Ubuntu 12.10 : linux vulnerabilities (USN-1972-1)	Nessus	Ubuntu Local Security Checks	9/28/2013	9/19/2019	medium
74878	openSUSE Security Update : kernel (openSUSE-SU-2013:1971-1)	Nessus	SuSE Local Security Checks	6/13/2014	1/19/2021	high
70190	Ubuntu 12.04 LTS : linux vulnerabilities (USN-1968-1)	Nessus	Ubuntu Local Security Checks	9/28/2013	9/19/2019	medium
76660	RHEL 6 : MRG (RHSA-2013:0829)	Nessus	Red Hat Local Security Checks	7/22/2014	9/16/2022	high
70040	SuSE 11.3 Security Update : Linux kernel (SAT Patch Numbers 8269 / 8270 / 8283)	Nessus	SuSE Local Security Checks	9/21/2013	1/19/2021	high
75184	openSUSE Security Update : kernel (openSUSE-SU-2013:1619-1)	Nessus	SuSE Local Security Checks	6/13/2014	1/19/2021	high

Detections

Analytics

Plugins Search

high

medium

high

medium

high

medium

high

high

high