Security update for Linux Kernel Live Patch 7 for SLE 12 SP2 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2017:2064-1 Final 1 1 2017-08-07T08:08:22Z current 2017-08-07T08:08:22Z 2017-08-07T08:08:22Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for Linux Kernel Live Patch 7 for SLE 12 SP2 This update for the Linux Kernel 4.4.59-92_17 fixes several issues. The following security bugs were fixed: - CVE-2017-7533: A bug in inotify code allowed local users to escalate privilege (bsc#1050751). - CVE-2017-8797: The NFSv4 server in the Linux kernel did not properly validate the layout type when processing the NFSv4 pNFS GETDEVICEINFO or LAYOUTGET operand in a UDP packet from a remote attacker. This type value is uninitialized upon encountering certain error conditions. This value is used as an array index for dereferencing, which leads to an OOPS and eventually a DoS of knfsd and a soft-lockup of the whole system (bsc#1046202) - CVE-2017-7645: The NFSv2/NFSv3 server in the nfsd subsystem in the Linux kernel allowed remote attackers to cause a denial of service (system crash) via a long RPC reply, related to net/sunrpc/svc.c, fs/nfsd/nfs3xdr.c, and fs/nfsd/nfsxdr.c (bsc#1046191). - CVE-2017-9242: The __ip6_append_data function in net/ipv6/ip6_output.c in the Linux kernel is too late in checking whether an overwrite of an skb data structure may occur, which allowed local users to cause a denial of service (system crash) via crafted system calls (bsc#1042892). - CVE-2017-9077: The tcp_v6_syn_recv_sock function in net/ipv6/tcp_ipv6.c in the Linux kernel mishandled inheritance, which allowed local users to cause a denial of service or possibly have unspecified other impact via crafted system calls, a related issue to CVE-2017-8890 (bsc#1042364). - CVE-2017-8890: The inet_csk_clone_lock function in net/ipv4/inet_connection_sock.c in the Linux kernel allowed attackers to cause a denial of service (double free) or possibly have unspecified other impact by leveraging use of the accept system call (bsc#1038564). The following non-security bug was fixed: - Fix for a btrfs deadlock between btrfs-cleaner and user space thread regression, which could cause spurious WARN_ON's from fs/btrfs/qgroup.c:1445 during patch application if BTRFS quota groups are enabled. (bsc#1047518) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-Live-Patching-12-2017-1266 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2017/suse-su-20172064-1/ Link for SUSE-SU-2017:2064-1 https://lists.suse.com/pipermail/sle-security-updates/2017-August/003095.html E-Mail link for SUSE-SU-2017:2064-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1038564 SUSE Bug 1038564 https://bugzilla.suse.com/1042364 SUSE Bug 1042364 https://bugzilla.suse.com/1042892 SUSE Bug 1042892 https://bugzilla.suse.com/1046191 SUSE Bug 1046191 https://bugzilla.suse.com/1046202 SUSE Bug 1046202 https://bugzilla.suse.com/1046206 SUSE Bug 1046206 https://bugzilla.suse.com/1047518 SUSE Bug 1047518 https://bugzilla.suse.com/1050751 SUSE Bug 1050751 https://www.suse.com/security/cve/CVE-2017-7533/ SUSE CVE CVE-2017-7533 page https://www.suse.com/security/cve/CVE-2017-7645/ SUSE CVE CVE-2017-7645 page https://www.suse.com/security/cve/CVE-2017-8797/ SUSE CVE CVE-2017-8797 page https://www.suse.com/security/cve/CVE-2017-8890/ SUSE CVE CVE-2017-8890 page https://www.suse.com/security/cve/CVE-2017-9077/ SUSE CVE CVE-2017-9077 page https://www.suse.com/security/cve/CVE-2017-9242/ SUSE CVE CVE-2017-9242 page SUSE Linux Enterprise Live Patching 12 kgraft-patch-4_4_59-92_17-default-3-2.1 kgraft-patch-4_4_59-92_17-default-3-2.1 as a component of SUSE Linux Enterprise Live Patching 12 Race condition in the fsnotify implementation in the Linux kernel through 4.12.4 allows local users to gain privileges or cause a denial of service (memory corruption) via a crafted application that leverages simultaneous execution of the inotify_handle_event and vfs_rename functions. CVE-2017-7533 SUSE Linux Enterprise Live Patching 12:kgraft-patch-4_4_59-92_17-default-3-2.1 important 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172064-1/ https://www.suse.com/security/cve/CVE-2017-7533.html CVE-2017-7533 https://bugzilla.suse.com/1049483 SUSE Bug 1049483 https://bugzilla.suse.com/1050677 SUSE Bug 1050677 https://bugzilla.suse.com/1050751 SUSE Bug 1050751 https://bugzilla.suse.com/1053919 SUSE Bug 1053919 The NFSv2/NFSv3 server in the nfsd subsystem in the Linux kernel through 4.10.11 allows remote attackers to cause a denial of service (system crash) via a long RPC reply, related to net/sunrpc/svc.c, fs/nfsd/nfs3xdr.c, and fs/nfsd/nfsxdr.c. CVE-2017-7645 SUSE Linux Enterprise Live Patching 12:kgraft-patch-4_4_59-92_17-default-3-2.1 important 6.3 AV:N/AC:M/Au:S/C:N/I:N/A:C 7.8 AV:N/AC:L/Au:N/C:N/I:N/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172064-1/ https://www.suse.com/security/cve/CVE-2017-7645.html CVE-2017-7645 https://bugzilla.suse.com/1034670 SUSE Bug 1034670 https://bugzilla.suse.com/1036741 SUSE Bug 1036741 https://bugzilla.suse.com/1046191 SUSE Bug 1046191 https://bugzilla.suse.com/1087082 SUSE Bug 1087082 The NFSv4 server in the Linux kernel before 4.11.3 does not properly validate the layout type when processing the NFSv4 pNFS GETDEVICEINFO or LAYOUTGET operand in a UDP packet from a remote attacker. This type value is uninitialized upon encountering certain error conditions. This value is used as an array index for dereferencing, which leads to an OOPS and eventually a DoS of knfsd and a soft-lockup of the whole system. CVE-2017-8797 SUSE Linux Enterprise Live Patching 12:kgraft-patch-4_4_59-92_17-default-3-2.1 important 7.1 AV:N/AC:M/Au:N/C:N/I:N/A:C 7.8 AV:N/AC:L/Au:N/C:N/I:N/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172064-1/ https://www.suse.com/security/cve/CVE-2017-8797.html CVE-2017-8797 https://bugzilla.suse.com/1046202 SUSE Bug 1046202 https://bugzilla.suse.com/1046206 SUSE Bug 1046206 The inet_csk_clone_lock function in net/ipv4/inet_connection_sock.c in the Linux kernel through 4.10.15 allows attackers to cause a denial of service (double free) or possibly have unspecified other impact by leveraging use of the accept system call. CVE-2017-8890 SUSE Linux Enterprise Live Patching 12:kgraft-patch-4_4_59-92_17-default-3-2.1 important 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172064-1/ https://www.suse.com/security/cve/CVE-2017-8890.html CVE-2017-8890 https://bugzilla.suse.com/1038544 SUSE Bug 1038544 https://bugzilla.suse.com/1038564 SUSE Bug 1038564 https://bugzilla.suse.com/1039883 SUSE Bug 1039883 https://bugzilla.suse.com/1039885 SUSE Bug 1039885 https://bugzilla.suse.com/1040069 SUSE Bug 1040069 https://bugzilla.suse.com/1042364 SUSE Bug 1042364 https://bugzilla.suse.com/1051906 SUSE Bug 1051906 https://bugzilla.suse.com/1115893 SUSE Bug 1115893 The tcp_v6_syn_recv_sock function in net/ipv6/tcp_ipv6.c in the Linux kernel through 4.11.1 mishandles inheritance, which allows local users to cause a denial of service or possibly have unspecified other impact via crafted system calls, a related issue to CVE-2017-8890. CVE-2017-9077 SUSE Linux Enterprise Live Patching 12:kgraft-patch-4_4_59-92_17-default-3-2.1 moderate 2.1 AV:L/AC:L/Au:N/C:N/I:N/A:P 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172064-1/ https://www.suse.com/security/cve/CVE-2017-9077.html CVE-2017-9077 https://bugzilla.suse.com/1038544 SUSE Bug 1038544 https://bugzilla.suse.com/1040069 SUSE Bug 1040069 https://bugzilla.suse.com/1042364 SUSE Bug 1042364 https://bugzilla.suse.com/1115893 SUSE Bug 1115893 The __ip6_append_data function in net/ipv6/ip6_output.c in the Linux kernel through 4.11.3 is too late in checking whether an overwrite of an skb data structure may occur, which allows local users to cause a denial of service (system crash) via crafted system calls. CVE-2017-9242 SUSE Linux Enterprise Live Patching 12:kgraft-patch-4_4_59-92_17-default-3-2.1 important 4.6 AV:L/AC:L/Au:N/C:P/I:P/A:P 4.9 AV:L/AC:L/Au:N/C:N/I:N/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172064-1/ https://www.suse.com/security/cve/CVE-2017-9242.html CVE-2017-9242 https://bugzilla.suse.com/1041431 SUSE Bug 1041431 https://bugzilla.suse.com/1042892 SUSE Bug 1042892