Live patch for the Linux Kernel SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2015:1487-1 Final 1 1 2015-08-14T11:37:44Z current 2015-08-14T11:37:44Z 2015-08-14T11:37:44Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Live patch for the Linux Kernel This update contains a kernel live patch for the 3.12.38-44 SUSE Linux Enterprise Server 12 Kernel, fixing following security issues. - CVE-2015-3339: A race condition in the prepare_binprm function in fs/exec.c in the Linux kernel allowed local users to gain privileges by executing a setuid program at a time instant when a chown to root is in progress, and the ownership is changed but the setuid bit is not yet stripped. (bsc#939263 bsc#939044) - CVE-2015-3636: The ping_unhash function in net/ipv4/ping.c in the Linux kernel did not initialize a certain list data structure during an unhash operation, which allowed local users to gain privileges or cause a denial of service (use-after-free and system crash) by leveraging the ability to make a SOCK_DGRAM socket system call for the IPPROTO_ICMP or IPPROTO_ICMPV6 protocol, and then making a connect system call after a disconnect. (bsc#939277) - CVE-2015-5364/CVE-2015-5366: Two denial of service attacks via a flood of UDP packets with invalid checksums were fixed that could be used by remote attackers to delay execution. (bsc#939276) - CVE-2015-1805: The (1) pipe_read and (2) pipe_write implementations in fs/pipe.c in the Linux kernel did not properly consider the side effects of failed __copy_to_user_inatomic and __copy_from_user_inatomic calls, which allowed local users to cause a denial of service (system crash) or possibly gain privileges via a crafted application, aka an 'I/O vector array overrun.' (bsc#939270) - CVE-2015-4700: A BPF Jit optimization flaw could allow local users to panic the kernel. (bsc#939273) - CVE-2015-3331: The __driver_rfc4106_decrypt function in arch/x86/crypto/aesni-intel_glue.c in the Linux kernel did not properly determine the memory locations used for encrypted data, which allowed context-dependent attackers to cause a denial of service (buffer overflow and system crash) or possibly execute arbitrary code by triggering a crypto API call, as demonstrated by use of a libkcapi test program with an AF_ALG(aead) socket. (bsc#939262) - CVE-2014-8159: The InfiniBand (IB) implementation in the Linux kernel did not properly restrict use of User Verbs for registration of memory regions, which allowed local users to access arbitrary physical memory locations, and consequently cause a denial of service (system crash) or gain privileges, by leveraging permissions on a uverbs device under /dev/infiniband/. (bsc#939241) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-Live-Patching-12-2015-486 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2015/suse-su-20151487-1/ Link for SUSE-SU-2015:1487-1 https://lists.suse.com/pipermail/sle-security-updates/2015-September/001570.html E-Mail link for SUSE-SU-2015:1487-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/939044 SUSE Bug 939044 https://bugzilla.suse.com/939241 SUSE Bug 939241 https://bugzilla.suse.com/939262 SUSE Bug 939262 https://bugzilla.suse.com/939263 SUSE Bug 939263 https://bugzilla.suse.com/939270 SUSE Bug 939270 https://bugzilla.suse.com/939273 SUSE Bug 939273 https://bugzilla.suse.com/939276 SUSE Bug 939276 https://bugzilla.suse.com/939277 SUSE Bug 939277 https://www.suse.com/security/cve/CVE-2014-8159/ SUSE CVE CVE-2014-8159 page https://www.suse.com/security/cve/CVE-2015-1805/ SUSE CVE CVE-2015-1805 page https://www.suse.com/security/cve/CVE-2015-3331/ SUSE CVE CVE-2015-3331 page https://www.suse.com/security/cve/CVE-2015-3339/ SUSE CVE CVE-2015-3339 page https://www.suse.com/security/cve/CVE-2015-3636/ SUSE CVE CVE-2015-3636 page https://www.suse.com/security/cve/CVE-2015-4700/ SUSE CVE CVE-2015-4700 page https://www.suse.com/security/cve/CVE-2015-5364/ SUSE CVE CVE-2015-5364 page https://www.suse.com/security/cve/CVE-2015-5366/ SUSE CVE CVE-2015-5366 page SUSE Linux Enterprise Live Patching 12 kgraft-patch-3_12_38-44-default-2-7.1 kgraft-patch-3_12_38-44-xen-2-7.1 kgraft-patch-3_12_38-44-default-2-7.1 as a component of SUSE Linux Enterprise Live Patching 12 kgraft-patch-3_12_38-44-xen-2-7.1 as a component of SUSE Linux Enterprise Live Patching 12 The InfiniBand (IB) implementation in the Linux kernel package before 2.6.32-504.12.2 on Red Hat Enterprise Linux (RHEL) 6 does not properly restrict use of User Verbs for registration of memory regions, which allows local users to access arbitrary physical memory locations, and consequently cause a denial of service (system crash) or gain privileges, by leveraging permissions on a uverbs device under /dev/infiniband/. CVE-2014-8159 SUSE Linux Enterprise Live Patching 12:kgraft-patch-3_12_38-44-default-2-7.1 SUSE Linux Enterprise Live Patching 12:kgraft-patch-3_12_38-44-xen-2-7.1 moderate 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20151487-1/ https://www.suse.com/security/cve/CVE-2014-8159.html CVE-2014-8159 https://bugzilla.suse.com/903967 SUSE Bug 903967 https://bugzilla.suse.com/914742 SUSE Bug 914742 https://bugzilla.suse.com/939241 SUSE Bug 939241 The (1) pipe_read and (2) pipe_write implementations in fs/pipe.c in the Linux kernel before 3.16 do not properly consider the side effects of failed __copy_to_user_inatomic and __copy_from_user_inatomic calls, which allows local users to cause a denial of service (system crash) or possibly gain privileges via a crafted application, aka an "I/O vector array overrun." CVE-2015-1805 SUSE Linux Enterprise Live Patching 12:kgraft-patch-3_12_38-44-default-2-7.1 SUSE Linux Enterprise Live Patching 12:kgraft-patch-3_12_38-44-xen-2-7.1 important 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20151487-1/ https://www.suse.com/security/cve/CVE-2015-1805.html CVE-2015-1805 https://bugzilla.suse.com/917839 SUSE Bug 917839 https://bugzilla.suse.com/933429 SUSE Bug 933429 https://bugzilla.suse.com/939270 SUSE Bug 939270 https://bugzilla.suse.com/964730 SUSE Bug 964730 https://bugzilla.suse.com/964732 SUSE Bug 964732 The __driver_rfc4106_decrypt function in arch/x86/crypto/aesni-intel_glue.c in the Linux kernel before 3.19.3 does not properly determine the memory locations used for encrypted data, which allows context-dependent attackers to cause a denial of service (buffer overflow and system crash) or possibly execute arbitrary code by triggering a crypto API call, as demonstrated by use of a libkcapi test program with an AF_ALG(aead) socket. CVE-2015-3331 SUSE Linux Enterprise Live Patching 12:kgraft-patch-3_12_38-44-default-2-7.1 SUSE Linux Enterprise Live Patching 12:kgraft-patch-3_12_38-44-xen-2-7.1 critical 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20151487-1/ https://www.suse.com/security/cve/CVE-2015-3331.html CVE-2015-3331 https://bugzilla.suse.com/1115893 SUSE Bug 1115893 https://bugzilla.suse.com/927257 SUSE Bug 927257 https://bugzilla.suse.com/931231 SUSE Bug 931231 https://bugzilla.suse.com/939262 SUSE Bug 939262 Race condition in the prepare_binprm function in fs/exec.c in the Linux kernel before 3.19.6 allows local users to gain privileges by executing a setuid program at a time instant when a chown to root is in progress, and the ownership is changed but the setuid bit is not yet stripped. CVE-2015-3339 SUSE Linux Enterprise Live Patching 12:kgraft-patch-3_12_38-44-default-2-7.1 SUSE Linux Enterprise Live Patching 12:kgraft-patch-3_12_38-44-xen-2-7.1 moderate 6.2 AV:L/AC:H/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20151487-1/ https://www.suse.com/security/cve/CVE-2015-3339.html CVE-2015-3339 https://bugzilla.suse.com/903967 SUSE Bug 903967 https://bugzilla.suse.com/928130 SUSE Bug 928130 https://bugzilla.suse.com/939263 SUSE Bug 939263 The ping_unhash function in net/ipv4/ping.c in the Linux kernel before 4.0.3 does not initialize a certain list data structure during an unhash operation, which allows local users to gain privileges or cause a denial of service (use-after-free and system crash) by leveraging the ability to make a SOCK_DGRAM socket system call for the IPPROTO_ICMP or IPPROTO_ICMPV6 protocol, and then making a connect system call after a disconnect. CVE-2015-3636 SUSE Linux Enterprise Live Patching 12:kgraft-patch-3_12_38-44-default-2-7.1 SUSE Linux Enterprise Live Patching 12:kgraft-patch-3_12_38-44-xen-2-7.1 moderate 4.9 AV:L/AC:L/Au:N/C:N/I:N/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20151487-1/ https://www.suse.com/security/cve/CVE-2015-3636.html CVE-2015-3636 https://bugzilla.suse.com/929525 SUSE Bug 929525 https://bugzilla.suse.com/939277 SUSE Bug 939277 https://bugzilla.suse.com/994624 SUSE Bug 994624 The bpf_int_jit_compile function in arch/x86/net/bpf_jit_comp.c in the Linux kernel before 4.0.6 allows local users to cause a denial of service (system crash) by creating a packet filter and then loading crafted BPF instructions that trigger late convergence by the JIT compiler. CVE-2015-4700 SUSE Linux Enterprise Live Patching 12:kgraft-patch-3_12_38-44-default-2-7.1 SUSE Linux Enterprise Live Patching 12:kgraft-patch-3_12_38-44-xen-2-7.1 moderate 4.9 AV:L/AC:L/Au:N/C:N/I:N/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20151487-1/ https://www.suse.com/security/cve/CVE-2015-4700.html CVE-2015-4700 https://bugzilla.suse.com/935705 SUSE Bug 935705 https://bugzilla.suse.com/939273 SUSE Bug 939273 The (1) udp_recvmsg and (2) udpv6_recvmsg functions in the Linux kernel before 4.0.6 do not properly consider yielding a processor, which allows remote attackers to cause a denial of service (system hang) via incorrect checksums within a UDP packet flood. CVE-2015-5364 SUSE Linux Enterprise Live Patching 12:kgraft-patch-3_12_38-44-default-2-7.1 SUSE Linux Enterprise Live Patching 12:kgraft-patch-3_12_38-44-xen-2-7.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P 7.8 AV:N/AC:L/Au:N/C:N/I:N/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20151487-1/ https://www.suse.com/security/cve/CVE-2015-5364.html CVE-2015-5364 https://bugzilla.suse.com/1115893 SUSE Bug 1115893 https://bugzilla.suse.com/781018 SUSE Bug 781018 https://bugzilla.suse.com/936831 SUSE Bug 936831 https://bugzilla.suse.com/939276 SUSE Bug 939276 https://bugzilla.suse.com/945112 SUSE Bug 945112 The (1) udp_recvmsg and (2) udpv6_recvmsg functions in the Linux kernel before 4.0.6 provide inappropriate -EAGAIN return values, which allows remote attackers to cause a denial of service (EPOLLET epoll application read outage) via an incorrect checksum in a UDP packet, a different vulnerability than CVE-2015-5364. CVE-2015-5366 SUSE Linux Enterprise Live Patching 12:kgraft-patch-3_12_38-44-default-2-7.1 SUSE Linux Enterprise Live Patching 12:kgraft-patch-3_12_38-44-xen-2-7.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20151487-1/ https://www.suse.com/security/cve/CVE-2015-5366.html CVE-2015-5366 https://bugzilla.suse.com/781018 SUSE Bug 781018 https://bugzilla.suse.com/936831 SUSE Bug 936831 https://bugzilla.suse.com/939276 SUSE Bug 939276 https://bugzilla.suse.com/945112 SUSE Bug 945112