远程 Ubuntu 14.04 LTS 主机上安装的一个程序包受到 USN-3583-1 公告中提及的多个漏洞影响。

    发现 Linux 内核的 Flash-Friendly File System (f2fs) 存在越界写入漏洞。攻击者可构建恶意文件系统，安装此系统可造成拒绝服务（系统崩溃）或可能执行任意代码。(CVE-2017-0750)

    发现 Linux 内核的 ALSA PCM 子系统存在争用条件，可导致释放后使用漏洞。本地攻击者可利用此问题造成拒绝服务（系统崩溃）或可能执行任意代码。(CVE-2017-0861)

    发现 Linux 内核的 KVM 实施允许传递诊断 I/O 端口 0x80。客户机 VM 中的攻击者可利用此问题在主机操作系统中造成拒绝服务（系统崩溃）。(CVE-2017-1000407)

    Bo Zhang 发现 Linux 内核的 netlink 无线配置接口在处理某些请求时未能正确验证属性。具有 CAP_NET_ADMIN 功能的本地攻击者可利用此问题造成拒绝服务（系统崩溃）。(CVE-2017-12153)

    Vitaly Mayatskikh 发现 Linux 内核的 SCSI 子系统在归并缓冲区时未能正确追踪引用计数。本地攻击者可利用此问题造成拒绝服务（内存耗尽）。(CVE-2017-12190)

    发现 Linux 内核的密钥管理子系统未能在负实例化密钥上正确限制密钥读取。本地攻击者可利用此问题造成拒绝服务（系统崩溃）。(CVE-2017-12192)

    发现 Linux 内核的 QLogic 24xx+ 系列 SCSI 驱动程序的 sysfs 接口存在整数溢出问题。本地特权攻击者可利用此问题造成拒绝服务（系统崩溃）。(CVE-2017-14051)

    Otto Ebeling 发现 Linux 内核的内存管理器在一些情况下未能正确检查有效的 UID。本地攻击者可利用此问题泄露敏感信息。(CVE-2017-14140)

    发现 Linux 内核的 ATI Radeon framebuffer 驱动程序未能正确初始化返回用户空间的数据结构。本地攻击者可利用此问题暴露敏感信息（内核内存）。(CVE-2017-14156)

    ChunYu Wang 发现 Linux 内核的 iSCSI 传输实施未能正确验证数据结构。本地攻击者可利用此问题造成拒绝服务（系统崩溃）。
    (CVE-2017-14489)

    James Patrick-Evans 发现 Linux 内核的 LEGO USB Infrared Tower 驱动程序存在争用条件。
    物理邻近攻击者可利用此问题造成拒绝服务（系统崩溃）或可能执行任意代码。(CVE-2017-15102)

    ChunYu Wang 发现 Linux 内核的 SCTP 协议实施存在释放后使用漏洞。本地攻击者可利用此问题造成拒绝服务（系统崩溃）或可能执行任意代码。(CVE-2017-15115)

    发现 Linux 内核中的密钥管理子系统无法正确处理具有非零长度值的 NULL 有效负载。本地攻击者可利用此问题造成拒绝服务（系统崩溃）。(CVE-2017-15274)

    发现 Linux 内核的 Bluebooth Network Encapsulation Protocol (BNEP) 实施未能验证在 BNEPCONNADD ioctl() 传送的套接字类型。具有 CAP_NET_ADMIN 权限的本地攻击者可利用此问题造成拒绝服务（系统崩溃）或可能执行任意代码。(CVE-2017-15868)

    Andrey Konovalov 发现 Linux 内核的 USB 串口控制台驱动程序存在释放后使用漏洞。物理邻近攻击者可利用此问题造成拒绝服务（系统崩溃）或可能执行任意代码。(CVE-2017-16525)

    发现 netfilter passive OS fingerprinting (xt_osf) 模块未能正确执行访问控制检查。本地攻击者可错误修改全系统的操作系统指纹列表。
    (CVE-2017-17450)

    发现 HMAC 实施未能验证底层加密哈希算法的状态。本地攻击者可利用此问题造成拒绝服务（系统崩溃）或可能执行任意代码。(CVE-2017-17806)

    Denys Fedoryshchenko 发现 Linux 内核的 netfilter xt_TCPMSS 筛选器存在释放后使用漏洞。远程攻击者可利用此问题造成拒绝服务（系统崩溃）。
    (CVE-2017-18017)

    Gareth Evans 发现 Linux 内核的 shm IPC 子系统未能正确限制映射页面零点。本地特权攻击者可利用此问题执行任意代码。(CVE-2017-5669)

    发现 Linux 内核的 IPv6 实施存在整数溢出问题漏洞。本地攻击者可利用此问题造成拒绝服务（无限循环）。(CVE-2017-7542)

    Tommi Rantala 和 Brad Spengler 发现 Linux 内核的内存管理器未能正确执行 CONFIG_STRICT_DEVMEM 保护机制。能访问 /dev/mem 的本地攻击者可利用此问题暴露敏感信息或可能执行任意代码。(CVE-2017-7889)

    Mohamed Ghannam 发现 Linux 内核的 DCCP 协议实施存在释放后使用漏洞。本地攻击者可利用此问题造成拒绝服务（系统崩溃）或可能执行任意代码。(CVE-2017-8824)

    Mohamed Ghannam 发现 Linux 内核的 RDS (Reliable Datagram Sockets) 协议实施存在空指针取消引用漏洞。本地攻击者可利用此问题造成拒绝服务（系统崩溃）。(CVE-2018-5333)

     发现 Linux 内核的循环块设备实施存在争用条件。本地攻击者可利用此问题造成拒绝服务（系统崩溃）或可能执行任意代码。(CVE-2018-5344)

    USN-3524-1 缓解了 Ubuntu 14.04 LTS 中 amd64 架构的 CVE-2017-5754 (Meltdown)。此更新提供针对 ppc64el 架构的相应缓解措施。

Tenable 已直接从 Ubuntu 安全公告中提取上述描述块。

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

在 Linux 内核中发现多个可能导致权限升级、拒绝服务或信息泄露的漏洞。- CVE-2017-7518 Andy Lutomirski 发现 KVM 在仿真 syscall 指令时容易出现不正确的调试异常 (#DB) 错误。客户机内部的进程可利用此缺陷在客户机内部进行权限升级。- CVE-2017-7558（仅限 stretch） Red Hat 的 Stefano Brivio 发现 SCTP 子系统容易由于越界读取缺陷而出现数据泄露漏洞，从而允许向用户空间泄露最多 100 个未初始化的字节。- CVE-2017-10661（仅限 jessie） Google 的 Dmitry Vyukov 报告 timerfd 设施未正确处理单个文件描述符上的某些并发操作。此问题允许本地攻击者导致拒绝服务，或可能执行任意代码。- CVE-2017-11600 Bo Zhang 报告 xfrm 子系统未正确验证 Netlink 消息的其中一个参数。具有 CAP_NET_ADMIN 能力的本地用户可利用此问题导致拒绝服务，或可能执行任意代码。- CVE-2017-12134 / #866511 / XSA-229 Amazon 的 Jan H. Schoenherr 发现 Linux 在 x86 系统上的 Xen PV 域中运行时可能会错误地合并块 I/O 请求。有错误或恶意的客户机可在 dom0 或 PV 驱动程序域中触发此错误，导致拒绝服务，或可能执行任意代码。通过在底层后端块设备上禁用合并可缓解此问题，例如：echo 2 > /sys/block/nvme0n1/queue/nomerges - CVE-2017-12146（仅限 stretch） Google 的 Adrian Salido 报告访问 sysfs 中平台设备的“driver_override”属性时存在争用条件。如果允许非特权用户访问此属性，可能允许他们获得权限。- CVE-2017-12153 Bo Zhang 报告 cfg80211 (wifi) 子系统未正确验证 Netlink 消息的参数。（任何具有 wifi 设备的用户命名空间中）具有 CAP_NET_ADMIN 能力的本地用户可利用此问题造成拒绝服务。- CVE-2017-12154 Google 的 Jim Mattson 报告 Intel x86 处理器的 KVM 实现未正确处理某些嵌套的管理程序配置。恶意客户机（或合适的 L1 管理程序中的嵌套客户机）可利用此问题造成拒绝服务。- CVE-2017-14106 Andrey Konovalov 发现 tcp_disconnect() 函数中可由用户触发的除零可导致本地拒绝服务。CVE-2017-14140 Otto Ebeling 报告 move_pages() 系统调用未充分验证调用进程和目标进程的 UID，从而导致部分 ASLR 绕过。这使本地用户更容易在设置了 set-UID 权限位的程序中利用漏洞。- CVE-2017-14156 “sohu0106”报告 atyfb 视频驱动程序中存在信息泄露。有权访问此驱动程序处理的帧缓冲器的本地用户可利用此问题获取敏感信息。- CVE-2017-14340 Richard Wareing 发现 XFS 实现允许在没有实时设备的文件系统上创建带有“realtime”标志的文件，从而可能导致崩溃（错误）。有权访问没有实时设备的 XFS 文件系统的本地用户可利用此问题造成拒绝服务。- CVE-2017-14489 Red Hat 的 ChunYu Wang 发现 iSCSI 子系统未正确验证 Netlink 消息的长度，从而导致内存损坏。有权管理 iSCSI 设备的本地用户可利用此问题导致拒绝服务，或可能执行任意代码。- CVE-2017-14497（仅限 stretch） SUSE 的 Benjamin Poirier 报告原始数据包 (af_packet) 功能中 tpacket_rcv() 函数内 vnet 标头未得到正确处理。具有 CAP_NET_RAW 能力的本地用户可利用此缺陷导致拒绝服务（缓冲区溢出以及磁盘和内存损坏）或产生其他影响。- CVE-2017-1000111 Google 的 Andrey Konovalov 报告原始数据包 (af_packet) 功能中存在争用条件。具有 CAP_NET_RAW 能力的本地用户可利用此问题导致拒绝服务，或可能执行任意代码。- CVE-2017-1000112 Google 的 Andrey Konovalov 报告 UDP Fragmentation Offload (UFO) 代码中存在一个争用条件缺陷。本地攻击者可利用此缺陷导致拒绝服务或可能执行任意代码。- CVE-2017-1000251 / #875881 Armis Labs 发现蓝牙子系统未正确验证 L2CAP 配置响应，从而导致基于堆栈的缓冲区溢出。这是被称为“Blueborne”的数个漏洞中的一个。邻近攻击者可利用此问题在启用蓝牙的系统上导致拒绝服务或执行任意代码。- CVE-2017-1000252（仅限 stretch） Amazon 的 an H. Schoenherr 报告 Intel x86 处理器的 KVM 实现未正确验证中断注入请求。有权使用 KVM 的本地用户可利用此问题造成拒绝服务。- CVE-2017-1000370 Qualys Research Labs 报告较大参数或环境列表可导致 32 位 PIE 二进制文件的 ASLR 绕过。- CVE-2017-1000371 Qualys Research Labs 报告大型参数或环境列表可导致 32 位 PIE 二进制文件的堆栈/堆冲突。- CVE-2017-1000380 Google 的 Alexander Potapenko 报告 ALSA（音频）计时器驱动程序中存在争用条件，可导致信息泄露。有权访问音频设备的本地用户可利用此问题获取敏感信息。Debian 在默认情况下禁用非特权用户命名空间，但如果将其启用（通过 kernel.unprivileged_userns_clone sysctl），则任何本地用户都可以利用 CVE-2017-11600、CVE-2017-14497 和 CVE-2017-1000111。

The openSUSE Leap 42.2 Kernel was updated to 4.4.90 to receive various security and bugfixes.

The following security bugs were fixed :

  - CVE-2017-1000252: The KVM subsystem in the Linux kernel     allowed guest OS users to cause a denial of service     (assertion failure, and hypervisor hang or crash) via an     out-of bounds guest_irq value, related to     arch/x86/kvm/vmx.c and virt/kvm/eventfd.c (bnc#1058038).

  - CVE-2017-14489: The iscsi_if_rx function in     drivers/scsi/scsi_transport_iscsi.c in the Linux kernel     allowed local users to cause a denial of service (panic)     by leveraging incorrect length validation (bnc#1059051).

  - CVE-2017-12153: A security flaw was discovered in the     nl80211_set_rekey_data() function in     net/wireless/nl80211.c in the Linux kernel This function     did not check whether the required attributes are     present in a Netlink request. This request can be issued     by a user with the CAP_NET_ADMIN capability and may     result in a NULL pointer dereference and system crash     (bnc#1058410).

  - CVE-2017-12154: The prepare_vmcs02 function in     arch/x86/kvm/vmx.c in the Linux kernel did not ensure     that the 'CR8-load exiting' and 'CR8-store exiting' L0     vmcs02 controls exist in cases where L1 omits the 'use     TPR shadow' vmcs12 control, which allowed KVM L2 guest     OS users to obtain read and write access to the hardware     CR8 register (bnc#1058507).

The following non-security bugs were fixed :

  - arc: Re-enable MMU upon Machine Check exception     (bnc#1012382).

  - arm64: fault: Route pte translation faults via     do_translation_fault (bnc#1012382).

  - arm64: Make sure SPsel is always set (bnc#1012382).

  - arm: pxa: add the number of DMA requestor lines     (bnc#1012382).

  - arm: pxa: fix the number of DMA requestor lines     (bnc#1012382).

  - bcache: correct cache_dirty_target in
    __update_writeback_rate() (bnc#1012382).

  - bcache: Correct return value for sysfs attach errors     (bnc#1012382).

  - bcache: do not subtract sectors_to_gc for bypassed IO     (bnc#1012382).

  - bcache: fix bch_hprint crash and improve output     (bnc#1012382).

  - bcache: fix for gc and write-back race (bnc#1012382).

  - bcache: Fix leak of bdev reference (bnc#1012382).

  - bcache: initialize dirty stripes in flash_dev_run()     (bnc#1012382).

  - blacklist.conf: Add commit b5accbb0dfae

  - blacklist.conf: add one more

  - block: Relax a check in blk_start_queue() (bnc#1012382).

  - bsg-lib: do not free job in bsg_prepare_job     (bnc#1012382).

  - btrfs: change how we decide to commit transactions     during flushing (bsc#1060197).

  - btrfs: fix NULL pointer dereference from     free_reloc_roots() (bnc#1012382).

  - btrfs: prevent to set invalid default subvolid     (bnc#1012382).

  - btrfs: propagate error to btrfs_cmp_data_prepare caller     (bnc#1012382).

  - btrfs: qgroup: move noisy underflow warning to debugging     build (bsc#1055755).

  - cifs: Fix SMB3.1.1 guest authentication to Samba     (bnc#1012382).

  - cifs: release auth_key.response for reconnect     (bnc#1012382).

  - crypto: AF_ALG - remove SGL terminator indicator when     chaining (bnc#1012382).

  - crypto: talitos - Do not provide setkey for non hmac     hashing algs (bnc#1012382).

  - crypto: talitos - fix sha224 (bnc#1012382).

  - cxl: Fix driver use count (bnc#1012382).

  - dmaengine: mmp-pdma: add number of requestors     (bnc#1012382).

  - drm: Add driver-private objects to atomic state     (bsc#1055493).

  - drm/dp: Introduce MST topology state to track available     link bandwidth (bsc#1055493).

  - ext4: fix incorrect quotaoff if the quota feature is     enabled (bnc#1012382).

  - ext4: fix quota inconsistency during orphan cleanup for     read-only mounts (bnc#1012382).

  - f2fs: check hot_data for roll-forward recovery     (bnc#1012382).

  - fix xen_swiotlb_dma_mmap prototype (bnc#1012382).

  - ftrace: Fix memleak when unregistering dynamic ops when     tracing disabled (bnc#1012382).

  - ftrace: Fix selftest goto location on error     (bnc#1012382).

  - genirq: Fix for_each_action_of_desc() macro     (bsc#1061064).

  - getcwd: Close race with d_move called by lustre     (bsc#1052593).

  - gfs2: Fix debugfs glocks dump (bnc#1012382).

  - gianfar: Fix Tx flow control deactivation (bnc#1012382).

  - hid: usbhid: Add HID_QUIRK_NOGET for Aten CS-1758 KVM     switch (bnc#1022967).

  - input: i8042 - add Gigabyte P57 to the keyboard reset     table (bnc#1012382).

  - iommu/vt-d: Avoid calling virt_to_phys() on NULL pointer     (bsc#1061067).

  - ipv6: accept 64k - 1 packet length in     ip6_find_1stfragopt() (bnc#1012382).

  - ipv6: add rcu grace period before freeing fib6_node     (bnc#1012382).

  - ipv6: fix memory leak with multiple tables during netns     destruction (bnc#1012382).

  - ipv6: fix sparse warning on rt6i_node (bnc#1012382).

  - ipv6: fix typo in fib6_net_exit() (bnc#1012382).

  - kabi/severities: ignore nfs_pgio_data_destroy

  - keys: fix writing past end of user-supplied buffer in     keyring_read() (bnc#1012382).

  - keys: prevent creating a different user's keyrings     (bnc#1012382).

  - keys: prevent KEYCTL_READ on negative key (bnc#1012382).

  - kvm: async_pf: Fix #DF due to inject 'Page not Present'     and 'Page Ready' exceptions simultaneously     (bsc#1061017).

  - kvm: PPC: Book3S: Fix race and leak in     kvm_vm_ioctl_create_spapr_tce() (bnc#1012382).

  - kvm: SVM: Add a missing 'break' statement (bsc#1061017).

  - kvm: VMX: do not change SN bit in vmx_update_pi_irte()     (bsc#1061017).

  - kvm: VMX: remove WARN_ON_ONCE in     kvm_vcpu_trigger_posted_interrupt (bsc#1061017).

  - kvm: VMX: use cmpxchg64 (bnc#1012382).

  - mac80211: flush hw_roc_start work before cancelling the     ROC (bnc#1012382).

  - md/bitmap: disable bitmap_resize for file-backed bitmaps     (bsc#1061172).

  - md/raid5: preserve STRIPE_ON_UNPLUG_LIST in     break_stripe_batch_list (bnc#1012382).

  - md/raid5: release/flush io in raid5_do_work()     (bnc#1012382).

  - media: uvcvideo: Prevent heap overflow when accessing     mapped controls (bnc#1012382).

  - media: v4l2-compat-ioctl32: Fix timespec conversion     (bnc#1012382).

  - mips: math-emu: <MAXA|MINA>.<D|S>: Fix cases of both     infinite inputs (bnc#1012382).

  - mips: math-emu: <MAXA|MINA>.<D|S>: Fix cases of input     values with opposite signs (bnc#1012382).

  - mips: math-emu: <MAX|MAXA|MIN|MINA>.<D|S>: Fix cases of     both inputs zero (bnc#1012382).

  - mips: math-emu: <MAX|MAXA|MIN|MINA>.<D|S>: Fix quiet NaN     propagation (bnc#1012382).

  - mips: math-emu: <MAX|MIN>.<D|S>: Fix cases of both     inputs negative (bnc#1012382).

  - mips: math-emu: MINA.<D|S>: Fix some cases of infinity     and zero inputs (bnc#1012382).

  - mm: prevent double decrease of nr_reserved_highatomic     (bnc#1012382).

  - nfsd: Fix general protection fault in     release_lock_stateid() (bnc#1012382).

  - pci: Allow PCI express root ports to find themselves     (bsc#1061046).

  - pci: fix oops when try to find Root Port for a PCI     device (bsc#1061046).

  - pci: Fix race condition with driver_override     (bnc#1012382).

  - pci: shpchp: Enable bridge bus mastering if MSI is     enabled (bnc#1012382).

  - perf/x86: Fix RDPMC vs. mm_struct tracking     (bsc#1061831).

  - perf/x86: kABI Workaround for 'perf/x86: Fix RDPMC vs.
    mm_struct tracking' (bsc#1061831).

  - powerpc: Fix DAR reporting when alignment handler faults     (bnc#1012382).

  - powerpc/pseries: Fix parent_dn reference leak in     add_dt_node() (bnc#1012382).

  - qlge: avoid memcpy buffer overflow (bnc#1012382).

  - Revert 'net: fix percpu memory leaks' (bnc#1012382).

  - Revert 'net: phy: Correctly process PHY_HALTED in     phy_stop_machine()' (bnc#1012382).

  - Revert 'net: use lib/percpu_counter API for     fragmentation mem accounting' (bnc#1012382).

  - scsi: ILLEGAL REQUEST + ASC==27 => target failure     (bsc#1059465).

  - scsi: megaraid_sas: Check valid aen class range to avoid     kernel panic (bnc#1012382).

  - scsi: megaraid_sas: Return pended IOCTLs with cmd_status     MFI_STAT_WRONG_STATE in case adapter is dead     (bnc#1012382).

  - scsi: sg: factor out sg_fill_request_table()     (bnc#1012382).

  - scsi: sg: fixup infoleak when using SG_GET_REQUEST_TABLE     (bnc#1012382).

  - scsi: sg: off by one in sg_ioctl() (bnc#1012382).

  - scsi: sg: remove 'save_scat_len' (bnc#1012382).

  - scsi: sg: use standard lists for sg_requests     (bnc#1012382).

  - scsi: storvsc: fix memory leak on ring buffer busy     (bnc#1012382).

  - scsi: zfcp: add handling for FCP_RESID_OVER to the fcp     ingress path (bnc#1012382).

  - scsi: zfcp: fix capping of unsuccessful GPN_FT SAN     response trace records (bnc#1012382).

  - scsi: zfcp: fix missing trace records for early returns     in TMF eh handlers (bnc#1012382).

  - scsi: zfcp: fix passing fsf_req to SCSI trace on TMF to     correlate with HBA (bnc#1012382).

  - scsi: zfcp: fix payload with full FCP_RSP IU in SCSI     trace records (bnc#1012382).

  - scsi: zfcp: fix queuecommand for scsi_eh commands when     DIX enabled (bnc#1012382).

  - scsi: zfcp: trace HBA FSF response by default on dismiss     or timedout late response (bnc#1012382).

  - scsi: zfcp: trace high part of 'new' 64 bit SCSI LUN     (bnc#1012382).

  - seccomp: fix the usage of get/put_seccomp_filter() in     seccomp_get_filter() (bnc#1012382).

  - skd: Avoid that module unloading triggers a     use-after-free (bnc#1012382).

  - skd: Submit requests to firmware before triggering the     doorbell (bnc#1012382).

  - smb3: Do not ignore O_SYNC/O_DSYNC and O_DIRECT flags     (bnc#1012382).

  - smb: Validate negotiate (to protect against downgrade)     even if signing off (bnc#1012382).

  - swiotlb-xen: implement xen_swiotlb_dma_mmap callback     (bnc#1012382).

  - timer/sysclt: Restrict timer migration sysctl values to     0 and 1 (bnc#1012382).

  - tracing: Apply trace_clock changes to instance max     buffer (bnc#1012382).

  - tracing: Erase irqsoff trace with empty write     (bnc#1012382).

  - tracing: Fix trace_pipe behavior for instance traces     (bnc#1012382).

  - tty: fix __tty_insert_flip_char regression     (bnc#1012382).

  - tty: improve tty_insert_flip_char() fast path     (bnc#1012382).

  - tty: improve tty_insert_flip_char() slow path     (bnc#1012382).

  - vfs: Return -ENXIO for negative SEEK_HOLE / SEEK_DATA     offsets (bnc#1012382).

  - video: fbdev: aty: do not leak uninitialized padding in     clk to userspace (bnc#1012382).

  - Workaround for kABI compatibility with DP-MST patches     (bsc#1055493).

  - x86/fpu: Do not let userspace set bogus xcomp_bv     (bnc#1012382).

  - x86/fsgsbase/64: Report FSBASE and GSBASE correctly in     core dumps (bnc#1012382).

  - x86/ldt: Fix off by one in get_segment_base()     (bsc#1061872).

  - xfs/dmapi: fix incorrect file->f_path.dentry->d_inode     usage (bsc#1055896).

The openSUSE Leap 42.3 kernel was updated to 4.4.90 to receive various security and bugfixes.

The following security bugs were fixed :

  - CVE-2017-1000252: The KVM subsystem in the Linux kernel     allowed guest OS users to cause a denial of service     (assertion failure, and hypervisor hang or crash) via an     out-of bounds guest_irq value, related to     arch/x86/kvm/vmx.c and virt/kvm/eventfd.c (bnc#1058038).

  - CVE-2017-14489: The iscsi_if_rx function in     drivers/scsi/scsi_transport_iscsi.c in the Linux kernel     allowed local users to cause a denial of service (panic)     by leveraging incorrect length validation (bnc#1059051).

  - CVE-2017-12153: A security flaw was discovered in the     nl80211_set_rekey_data() function in     net/wireless/nl80211.c in the Linux kernel This function     did not check whether the required attributes are     present in a Netlink request. This request can be issued     by a user with the CAP_NET_ADMIN capability and may     result in a NULL pointer dereference and system crash     (bnc#1058410).

  - CVE-2017-12154: The prepare_vmcs02 function in     arch/x86/kvm/vmx.c in the Linux kernel did not ensure     that the 'CR8-load exiting' and 'CR8-store exiting' L0     vmcs02 controls exist in cases where L1 omits the 'use     TPR shadow' vmcs12 control, which allowed KVM L2 guest     OS users to obtain read and write access to the hardware     CR8 register (bnc#1058507).

The following non-security bugs were fixed :

  - arc: Re-enable MMU upon Machine Check exception     (bnc#1012382).

  - arm64: fault: Route pte translation faults via     do_translation_fault (bnc#1012382).

  - arm64: Make sure SPsel is always set (bnc#1012382).

  - arm: pxa: add the number of DMA requestor lines     (bnc#1012382).

  - arm: pxa: fix the number of DMA requestor lines     (bnc#1012382).

  - bcache: correct cache_dirty_target in
    __update_writeback_rate() (bnc#1012382).

  - bcache: Correct return value for sysfs attach errors     (bnc#1012382).

  - bcache: do not subtract sectors_to_gc for bypassed IO     (bnc#1012382).

  - bcache: fix bch_hprint crash and improve output     (bnc#1012382).

  - bcache: fix for gc and write-back race (bnc#1012382).

  - bcache: Fix leak of bdev reference (bnc#1012382).

  - bcache: initialize dirty stripes in flash_dev_run()     (bnc#1012382).

  - block: Relax a check in blk_start_queue() (bnc#1012382).

  - bsg-lib: do not free job in bsg_prepare_job     (bnc#1012382).

  - btrfs: change how we decide to commit transactions     during flushing (bsc#1060197).

  - btrfs: fix NULL pointer dereference from     free_reloc_roots() (bnc#1012382).

  - btrfs: prevent to set invalid default subvolid     (bnc#1012382).

  - btrfs: propagate error to btrfs_cmp_data_prepare caller     (bnc#1012382).

  - btrfs: qgroup: move noisy underflow warning to debugging     build (bsc#1055755).

  - cifs: Fix SMB3.1.1 guest authentication to Samba     (bnc#1012382).

  - cifs: release auth_key.response for reconnect     (bnc#1012382).

  - crypto: AF_ALG - remove SGL terminator indicator when     chaining (bnc#1012382).

  - crypto: talitos - Do not provide setkey for non hmac     hashing algs (bnc#1012382).

  - crypto: talitos - fix sha224 (bnc#1012382).

  - cxl: Fix driver use count (bnc#1012382).

  - dmaengine: mmp-pdma: add number of requestors     (bnc#1012382).

  - drivers: net: phy: xgene: Fix mdio write (bsc#1057383).

  - drm: Add driver-private objects to atomic state     (bsc#1055493).

  - drm/dp: Introduce MST topology state to track available     link bandwidth (bsc#1055493).

  - efi/fb: Avoid reconfiguration of BAR that covers the     framebuffer (bsc#1051987).

  - efi/fb: Correct PCI_STD_RESOURCE_END usage     (bsc#1051987).

  - ext4: fix incorrect quotaoff if the quota feature is     enabled (bnc#1012382).

  - ext4: fix quota inconsistency during orphan cleanup for     read-only mounts (bnc#1012382).

  - f2fs: check hot_data for roll-forward recovery     (bnc#1012382).

  - fix xen_swiotlb_dma_mmap prototype (bnc#1012382).

  - ftrace: Fix memleak when unregistering dynamic ops when     tracing disabled (bnc#1012382).

  - ftrace: Fix selftest goto location on error     (bnc#1012382).

  - genirq: Fix for_each_action_of_desc() macro     (bsc#1061064).

  - getcwd: Close race with d_move called by lustre     (bsc#1052593).

  - gfs2: Fix debugfs glocks dump (bnc#1012382).

  - gianfar: Fix Tx flow control deactivation (bnc#1012382).

  - hid: usbhid: Add HID_QUIRK_NOGET for Aten CS-1758 KVM     switch (bnc#1022967).

  - input: i8042 - add Gigabyte P57 to the keyboard reset     table (bnc#1012382).

  - iommu/vt-d: Avoid calling virt_to_phys() on NULL pointer     (bsc#1061067).

  - ipv6: accept 64k - 1 packet length in     ip6_find_1stfragopt() (bnc#1012382).

  - ipv6: add rcu grace period before freeing fib6_node     (bnc#1012382).

  - ipv6: fix memory leak with multiple tables during netns     destruction (bnc#1012382).

  - ipv6: fix sparse warning on rt6i_node (bnc#1012382).

  - ipv6: fix typo in fib6_net_exit() (bnc#1012382).

  - iw_cxgb4: put ep reference in pass_accept_req()     (fate#321658 bsc#1005778 fate#321660 bsc#1005780     fate#321661 bsc#1005781).

  - KABI fix drivers/nvme/target/nvmet.h (bsc#1058550).

  - kabi/severities: ignore nfs_pgio_data_destroy

  - kABI: Workaround kABI breakage of AMD-AVIC fixes     (bsc#1044503).

  - keys: fix writing past end of user-supplied buffer in     keyring_read() (bnc#1012382).

  - keys: prevent creating a different user's keyrings     (bnc#1012382).

  - keys: prevent KEYCTL_READ on negative key (bnc#1012382).

  - kvm: Add struct kvm_vcpu pointer parameter to     get_enable_apicv() (bsc#1044503).

  - kvm: async_pf: Fix #DF due to inject 'Page not Present'     and 'Page Ready' exceptions simultaneously     (bsc#1061017).

  - kvm: PPC: Book3S: Fix race and leak in     kvm_vm_ioctl_create_spapr_tce() (bnc#1012382).

  - kvm: SVM: Add a missing 'break' statement (bsc#1061017).

  - kvm: SVM: Add irqchip_split() checks before enabling     AVIC (bsc#1044503).

  - kvm: SVM: delete avic_vm_id_bitmap (2 megabyte static     array) (bsc#1059500).

  - kvm: SVM: Refactor AVIC vcpu initialization into     avic_init_vcpu() (bsc#1044503).

  - kvm: VMX: do not change SN bit in vmx_update_pi_irte()     (bsc#1061017).

  - kvm: VMX: remove WARN_ON_ONCE in     kvm_vcpu_trigger_posted_interrupt (bsc#1061017).

  - kvm: VMX: use cmpxchg64 (bnc#1012382).

  - mac80211: flush hw_roc_start work before cancelling the     ROC (bnc#1012382).

  - md/bitmap: disable bitmap_resize for file-backed bitmaps     (bsc#1061172).

  - md/raid5: preserve STRIPE_ON_UNPLUG_LIST in     break_stripe_batch_list (bnc#1012382).

  - md/raid5: release/flush io in raid5_do_work()     (bnc#1012382).

  - media: uvcvideo: Prevent heap overflow when accessing     mapped controls (bnc#1012382).

  - media: v4l2-compat-ioctl32: Fix timespec conversion     (bnc#1012382).

  - mips: math-emu: <MAXA|MINA>.<D|S>: Fix cases of both     infinite inputs (bnc#1012382).

  - mips: math-emu: <MAXA|MINA>.<D|S>: Fix cases of input     values with opposite signs (bnc#1012382).

  - mips: math-emu: <MAX|MAXA|MIN|MINA>.<D|S>: Fix cases of     both inputs zero (bnc#1012382).

  - mips: math-emu: <MAX|MAXA|MIN|MINA>.<D|S>: Fix quiet NaN     propagation (bnc#1012382).

  - mips: math-emu: <MAX|MIN>.<D|S>: Fix cases of both     inputs negative (bnc#1012382).

  - mips: math-emu: MINA.<D|S>: Fix some cases of infinity     and zero inputs (bnc#1012382).

  - mm: prevent double decrease of nr_reserved_highatomic     (bnc#1012382).

  - nfsd: Fix general protection fault in     release_lock_stateid() (bnc#1012382).

  - nvme-fabrics: generate spec-compliant UUID NQNs     (bsc#1057498).

  - nvmet: Move serial number from controller to subsystem     (bsc#1058550).

  - nvmet: preserve controller serial number between reboots     (bsc#1058550).

  - pci: Allow PCI express root ports to find themselves     (bsc#1061046).

  - pci: fix oops when try to find Root Port for a PCI     device (bsc#1061046).

  - pci: Fix race condition with driver_override     (bnc#1012382).

  - pci: Mark AMD Stoney GPU ATS as broken (bsc#1061046).

  - pci: shpchp: Enable bridge bus mastering if MSI is     enabled (bnc#1012382).

  - perf/x86: Fix RDPMC vs. mm_struct tracking     (bsc#1061831).

  - perf/x86: kABI Workaround for 'perf/x86: Fix RDPMC vs.
    mm_struct tracking' (bsc#1061831).

  - perf: xgene: Add APM X-Gene SoC Performance Monitoring     Unit driver (bsc#1036737).

  - perf: xgene: Include module.h (bsc#1036737).

  - perf: xgene: Move PMU leaf functions into function     pointer structure (bsc#1036737).

  - perf: xgene: Parse PMU subnode from the match table     (bsc#1036737).

  - powerpc: Fix DAR reporting when alignment handler faults     (bnc#1012382).

  - powerpc/perf: Cleanup of PM_BR_CMPL vs. PM_BRU_CMPL in     Power9 event list (bsc#1056686, fate#321438,     bsc#1047238, git-fixes 34922527a2bc).

  - powerpc/perf: Factor out PPMU_ONLY_COUNT_RUN check code     from power8 (fate#321438, bsc#1053043, git-fixes     efe881afdd999).

  - powerpc/pseries: Fix parent_dn reference leak in     add_dt_node() (bnc#1012382).

  - qlge: avoid memcpy buffer overflow (bnc#1012382).

  - rdma/bnxt_re: Allocate multiple notification queues     (bsc#1037579).

  - rdma/bnxt_re: Implement the alloc/get_hw_stats callback     (bsc#1037579).

  - Revert 'net: fix percpu memory leaks' (bnc#1012382).

  - Revert 'net: phy: Correctly process PHY_HALTED in     phy_stop_machine()' (bnc#1012382).

  - Revert 'net: use lib/percpu_counter API for     fragmentation mem accounting' (bnc#1012382).

  - Revert 'Update     patches.fixes/xfs-refactor-log-record-unpack-and-data-pr     ocessing.patch (bsc#1043598, bsc#1036215).' 

  - Revert 'xfs: detect and handle invalid iclog size set by     mkfs (bsc#1043598).'

  - Revert 'xfs: detect and trim torn writes during log     recovery (bsc#1036215).' 

  - Revert 'xfs: refactor and open code log record crc check     (bsc#1036215).'

  - Revert 'xfs: refactor log record start detection into a     new helper (bsc#1036215).'

  - Revert 'xfs: return start block of first bad log record     during recovery (bsc#1036215).'

  - Revert 'xfs: support a crc verification only log record     pass (bsc#1036215).'

  - scsi: ILLEGAL REQUEST + ASC==27 => target failure     (bsc#1059465).

  - scsi: megaraid_sas: Check valid aen class range to avoid     kernel panic (bnc#1012382).

  - scsi: megaraid_sas: Return pended IOCTLs with cmd_status     MFI_STAT_WRONG_STATE in case adapter is dead     (bnc#1012382).

  - scsi: sg: factor out sg_fill_request_table()     (bnc#1012382).

  - scsi: sg: fixup infoleak when using SG_GET_REQUEST_TABLE     (bnc#1012382).

  - scsi: sg: off by one in sg_ioctl() (bnc#1012382).

  - scsi: sg: remove 'save_scat_len' (bnc#1012382).

  - scsi: sg: use standard lists for sg_requests     (bnc#1012382).

  - scsi: storvsc: fix memory leak on ring buffer busy     (bnc#1012382).

  - scsi_transport_fc: Also check for NOTPRESENT in     fc_remote_port_add() (bsc#1037890).

  - scsi: zfcp: add handling for FCP_RESID_OVER to the fcp     ingress path (bnc#1012382).

  - scsi: zfcp: fix capping of unsuccessful GPN_FT SAN     response trace records (bnc#1012382).

  - scsi: zfcp: fix missing trace records for early returns     in TMF eh handlers (bnc#1012382).

  - scsi: zfcp: fix passing fsf_req to SCSI trace on TMF to     correlate with HBA (bnc#1012382).

  - scsi: zfcp: fix payload with full FCP_RSP IU in SCSI     trace records (bnc#1012382).

  - scsi: zfcp: fix queuecommand for scsi_eh commands when     DIX enabled (bnc#1012382).

  - scsi: zfcp: trace HBA FSF response by default on dismiss     or timedout late response (bnc#1012382).

  - scsi: zfcp: trace high part of 'new' 64 bit SCSI LUN     (bnc#1012382).

  - seccomp: fix the usage of get/put_seccomp_filter() in     seccomp_get_filter() (bnc#1012382).

  - skd: Avoid that module unloading triggers a     use-after-free (bnc#1012382).

  - skd: Submit requests to firmware before triggering the     doorbell (bnc#1012382).

  - smb3: Do not ignore O_SYNC/O_DSYNC and O_DIRECT flags     (bnc#1012382).

  - smb: Validate negotiate (to protect against downgrade)     even if signing off (bnc#1012382).

  - swiotlb-xen: implement xen_swiotlb_dma_mmap callback     (bnc#1012382).

  - timer/sysclt: Restrict timer migration sysctl values to     0 and 1 (bnc#1012382).

  - tracing: Apply trace_clock changes to instance max     buffer (bnc#1012382).

  - tracing: Erase irqsoff trace with empty write     (bnc#1012382).

  - tracing: Fix trace_pipe behavior for instance traces     (bnc#1012382).

  - tty: fix __tty_insert_flip_char regression     (bnc#1012382).

  - tty: improve tty_insert_flip_char() fast path     (bnc#1012382).

  - tty: improve tty_insert_flip_char() slow path     (bnc#1012382).

  - Update     patches.drivers/0029-perf-xgene-Remove-bogus-IS_ERR-chec     k.patch (bsc#1036737).

  - vfs: Return -ENXIO for negative SEEK_HOLE / SEEK_DATA     offsets (bnc#1012382).

  - video: fbdev: aty: do not leak uninitialized padding in     clk to userspace (bnc#1012382).

  - Workaround for kABI compatibility with DP-MST patches     (bsc#1055493).

  - x86/cpu/amd: Hide unused legacy_fixup_core_id() function     (bsc#1060229).

  - x86/cpu/amd: Limit cpu_core_id fixup to families older     than F17h (bsc#1060229).

  - x86/fpu: Do not let userspace set bogus xcomp_bv     (bnc#1012382).

  - x86/fsgsbase/64: Report FSBASE and GSBASE correctly in     core dumps (bnc#1012382).

  - x86/ldt: Fix off by one in get_segment_base()     (bsc#1061872).

  - x86/mm: Fix boot crash caused by incorrect loop count     calculation in sync_global_pgds() (bsc#1058512).

  - x86/mm: Fix fault error path using unsafe vma pointer     (fate#321300).

The SUSE Linux Enterprise 12 GA LTS kernel was updated to receive various security and bugfixes. The following security bugs were fixed :

  - CVE-2017-15649: net/packet/af_packet.c in the Linux     kernel allowed local users to gain privileges via     crafted system calls that trigger mishandling of     packet_fanout data structures, because of a race     condition (involving fanout_add and packet_do_bind) that     leads to a use-after-free, a different vulnerability     than CVE-2017-6346 (bnc#1064388).

  - CVE-2015-9004: kernel/events/core.c in the Linux kernel     mishandled counter grouping, which allowed local users     to gain privileges via a crafted application, related to     the perf_pmu_register and perf_event_open functions     (bnc#1037306).

  - CVE-2016-10229: udp.c in the Linux kernel allowed remote     attackers to execute arbitrary code via UDP traffic that     triggers an unsafe second checksum calculation during     execution of a recv system call with the MSG_PEEK flag     (bnc#1032268).

  - CVE-2016-9604: The handling of keyrings starting with     '.' in KEYCTL_JOIN_SESSION_KEYRING, which could have     allowed local users to manipulate privileged keyrings,     was fixed (bsc#1035576)

  - CVE-2017-1000363: Linux drivers/char/lp.c Out-of-Bounds     Write. Due to a missing bounds check, and the fact that     parport_ptr integer is static, a 'secure boot' kernel     command line adversary (can happen due to bootloader     vulns, e.g. Google Nexus 6's CVE-2016-10277, where due     to a vulnerability the adversary has partial control     over the command line) can overflow the parport_nr array     in the following code, by appending many (>LP_NO)     'lp=none' arguments to the command line (bnc#1039456).

  - CVE-2017-1000365: The Linux Kernel imposes a size     restriction on the arguments and environmental strings     passed through RLIMIT_STACK/RLIM_INFINITY (1/4 of the     size), but did not take the argument and environment     pointers into account, which allowed attackers to bypass     this limitation. (bnc#1039354).

  - CVE-2017-1000380: sound/core/timer.c in the Linux kernel     is vulnerable to a data race in the ALSA /dev/snd/timer     driver resulting in local users being able to read     information belonging to other users, i.e.,     uninitialized memory contents may be disclosed when a     read and an ioctl happen at the same time (bnc#1044125).

  - CVE-2017-10661: Race condition in fs/timerfd.c in the     Linux kernel allowed local users to gain privileges or     cause a denial of service (list corruption or     use-after-free) via simultaneous file-descriptor     operations that leverage improper might_cancel queueing     (bnc#1053152).

  - CVE-2017-11176: The mq_notify function in the Linux     kernel did not set the sock pointer to NULL upon entry     into the retry logic. During a user-space close of a     Netlink socket, it allowed attackers to cause a denial     of service (use-after-free) or possibly have unspecified     other impact (bnc#1048275).

  - CVE-2017-12153: A security flaw was discovered in the     nl80211_set_rekey_data() function in     net/wireless/nl80211.c in the Linux kernel This function     did not check whether the required attributes are     present in a Netlink request. This request can be issued     by a user with the CAP_NET_ADMIN capability and may     result in a NULL pointer dereference and system crash     (bnc#1058410).

  - CVE-2017-12154: The prepare_vmcs02 function in     arch/x86/kvm/vmx.c in the Linux kernel did not ensure     that the 'CR8-load exiting' and 'CR8-store exiting' L0     vmcs02 controls exist in cases where L1 omits the 'use     TPR shadow' vmcs12 control, which allowed KVM L2 guest     OS users to obtain read and write access to the hardware     CR8 register (bnc#1058507).

  - CVE-2017-12762: In /drivers/isdn/i4l/isdn_net.c: A     user-controlled buffer is copied into a local buffer of     constant size using strcpy without a length check which     can cause a buffer overflow. (bnc#1053148).

  - CVE-2017-13080: Wi-Fi Protected Access (WPA and WPA2)     allowed reinstallation of the Group Temporal Key (GTK)     during the group key handshake, allowing an attacker     within radio range to replay frames from access points     to clients (bnc#1063667).

  - CVE-2017-14051: An integer overflow in the     qla2x00_sysfs_write_optrom_ctl function in     drivers/scsi/qla2xxx/qla_attr.c in the Linux kernel     allowed local users to cause a denial of service (memory     corruption and system crash) by leveraging root access     (bnc#1056588).

  - CVE-2017-14106: The tcp_disconnect function in     net/ipv4/tcp.c in the Linux kernel allowed local users     to cause a denial of service (__tcp_select_window     divide-by-zero error and system crash) by triggering a     disconnect within a certain tcp_recvmsg code path     (bnc#1056982).

  - CVE-2017-14140: The move_pages system call in     mm/migrate.c in the Linux kernel doesn't check the     effective uid of the target process, enabling a local     attacker to learn the memory layout of a setuid     executable despite ASLR (bnc#1057179).

  - CVE-2017-15265: Use-after-free vulnerability in the     Linux kernel allowed local users to have unspecified     impact via vectors related to /dev/snd/seq     (bnc#1062520).

  - CVE-2017-15274: security/keys/keyctl.c in the Linux     kernel did not consider the case of a NULL payload in     conjunction with a nonzero length value, which allowed     local users to cause a denial of service (NULL pointer     dereference and OOPS) via a crafted add_key or keyctl     system call, a different vulnerability than     CVE-2017-12192 (bnc#1045327).

  - CVE-2017-2647: The KEYS subsystem in the Linux kernel     allowed local users to gain privileges or cause a denial     of service (NULL pointer dereference and system crash)     via vectors involving a NULL value for a certain match     field, related to the keyring_search_iterator function     in keyring.c (bnc#1030593).

  - CVE-2017-6951: The keyring_search_aux function in     security/keys/keyring.c in the Linux kernel allowed     local users to cause a denial of service (NULL pointer     dereference and OOPS) via a request_key system call for     the 'dead' type (bnc#1029850).

  - CVE-2017-7482: A potential memory corruption was fixed     in decoding of krb5 principals in the kernels kerberos     handling. (bnc#1046107).

  - CVE-2017-7487: The ipxitf_ioctl function in     net/ipx/af_ipx.c in the Linux kernel mishandled     reference counts, which allowed local users to cause a     denial of service (use-after-free) or possibly have     unspecified other impact via a failed SIOCGIFADDR ioctl     call for an IPX interface (bnc#1038879).

  - CVE-2017-7518: The Linux kernel was vulnerable to an     incorrect debug exception(#DB) error. It could occur     while emulating a syscall instruction and potentially     lead to guest privilege escalation. (bsc#1045922).

  - CVE-2017-7541: The brcmf_cfg80211_mgmt_tx function in     drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg8021     1.c in the Linux kernel allowed local users to cause a     denial of service (buffer overflow and system crash) or     possibly gain privileges via a crafted NL80211_CMD_FRAME     Netlink packet (bnc#1049645).

  - CVE-2017-7542: The ip6_find_1stfragopt function in     net/ipv6/output_core.c in the Linux kernel allowed local     users to cause a denial of service (integer overflow and     infinite loop) by leveraging the ability to open a raw     socket (bnc#1049882).

  - CVE-2017-7889: The mm subsystem in the Linux kernel did     not properly enforce the CONFIG_STRICT_DEVMEM protection     mechanism, which allowed local users to read or write to     kernel memory locations in the first megabyte (and     bypass slab-allocation access restrictions) via an     application that opens the /dev/mem file, related to     arch/x86/mm/init.c and drivers/char/mem.c (bnc#1034405).

  - CVE-2017-8106: The handle_invept function in     arch/x86/kvm/vmx.c in the Linux kernel 3.12 allowed     privileged KVM guest OS users to cause a denial of     service (NULL pointer dereference and host OS crash) via     a single-context INVEPT instruction with a NULL EPT     pointer (bnc#1035877).

  - CVE-2017-8831: The saa7164_bus_get function in     drivers/media/pci/saa7164/saa7164-bus.c in the Linux     kernel allowed local users to cause a denial of service     (out-of-bounds array access) or possibly have     unspecified other impact by changing a certain     sequence-number value, aka a 'double fetch'     vulnerability (bnc#1037994).

  - CVE-2017-8890: The inet_csk_clone_lock function in     net/ipv4/inet_connection_sock.c in the Linux kernel     allowed attackers to cause a denial of service (double     free) or possibly have unspecified other impact by     leveraging use of the accept system call (bnc#1038544).

  - CVE-2017-8924: The edge_bulk_in_callback function in     drivers/usb/serial/io_ti.c in the Linux kernel allowed     local users to obtain sensitive information (in the     dmesg ringbuffer and syslog) from uninitialized kernel     memory by using a crafted USB device (posing as an io_ti     USB serial device) to trigger an integer underflow     (bnc#1037182 bsc#1038982).

  - CVE-2017-8925: The omninet_open function in     drivers/usb/serial/omninet.c in the Linux kernel allowed     local users to cause a denial of service (tty     exhaustion) by leveraging reference count mishandling     (bnc#1037183 bsc#1038981).

  - CVE-2017-9074: The IPv6 fragmentation implementation in     the Linux kernel did not consider that the nexthdr field     may be associated with an invalid option, which allowed     local users to cause a denial of service (out-of-bounds     read and BUG) or possibly have unspecified other impact     via crafted socket and send system calls (bnc#1039882).

  - CVE-2017-9075: The sctp_v6_create_accept_sk function in     net/sctp/ipv6.c in the Linux kernel mishandled     inheritance, which allowed local users to cause a denial     of service or possibly have unspecified other impact via     crafted system calls, a related issue to CVE-2017-8890     (bnc#1039883).

  - CVE-2017-9076: The dccp_v6_request_recv_sock function in     net/dccp/ipv6.c in the Linux kernel mishandled     inheritance, which allowed local users to cause a denial     of service or possibly have unspecified other impact via     crafted system calls, a related issue to CVE-2017-8890     (bnc#1039885).

  - CVE-2017-9077: The tcp_v6_syn_recv_sock function in     net/ipv6/tcp_ipv6.c in the Linux kernel mishandled     inheritance, which allowed local users to cause a denial     of service or possibly have unspecified other impact via     crafted system calls, a related issue to CVE-2017-8890     (bnc#1040069).

  - CVE-2017-9242: The __ip6_append_data function in     net/ipv6/ip6_output.c in the Linux kernel is too late in     checking whether an overwrite of an skb data structure     may occur, which allowed local users to cause a denial     of service (system crash) via crafted system calls     (bnc#1041431).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名稱	產品	系列	已發布	已更新	嚴重性
107003	Ubuntu 14.04 LTS：Linux 内核漏洞 (USN-3583-1)	Nessus	Ubuntu Local Security Checks	2018/2/26	2024/10/29	critical
103365	Debian DSA-3981-1：linux - 安全更新 (BlueBorne) (Stack Clash)	Nessus	Debian Local Security Checks	2017/9/21	2021/1/4	high
104074	openSUSE Security Update : the Linux Kernel (openSUSE-2017-1159)	Nessus	SuSE Local Security Checks	2017/10/23	2021/1/19	high
104075	openSUSE Security Update : the Linux Kernel (openSUSE-2017-1160)	Nessus	SuSE Local Security Checks	2017/10/23	2021/1/19	high
104374	SUSE SLES12 Security Update : kernel (SUSE-SU-2017:2920-1) (KRACK) (Stack Clash)	Nessus	SuSE Local Security Checks	2017/11/3	2021/1/6	critical

偵測

搜尋 Plugin

critical

high

high

high

critical