SUSE Security Update: Security update for the Linux Kernel
______________________________________________________________________________

Announcement ID:    SUSE-SU-2019:14127-1
Rating:             important
References:         #1063416 #1090078 #1102340 #1120758 #1134395 
                    #1134835 #1135650 #1136424 #1137194 #1138943 
                    #1139751 
Cross-References:   CVE-2018-20836 CVE-2018-5390 CVE-2019-12614
                    CVE-2019-3459 CVE-2019-3460 CVE-2019-3846
                    CVE-2019-3896
Affected Products:
                    SUSE Linux Enterprise Server 11-SP4-LTSS
                    SUSE Linux Enterprise Server 11-EXTRA
                    SUSE Linux Enterprise Debuginfo 11-SP4
______________________________________________________________________________

   An update that solves 7 vulnerabilities and has four fixes
   is now available.

Description:


   The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various
   security and bugfixes.

   The following security bugs were fixed:

   - CVE-2019-3459: A heap address information leak while using
     L2CAP_GET_CONF_OPT was discovered in the Linux kernel(bnc#1120758).
   - CVE-2019-3460: A heap data infoleak in multiple locations including
     L2CAP_PARSE_CONF_RSP was found in the Linux kernel before (bnc#1120758).
   - CVE-2019-3896: A double-free could happen in idr_remove_all() in
     lib/idr.c in the Linux kernel. An unprivileged local attacker could use
     this flaw for a privilege escalation or for a system crash and a denial
     of service (DoS) (bnc#1138943).
   - CVE-2018-5390: The Linux kernel could be forced to make very expensive
     calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every
     incoming packet which could lead to a denial of service (bnc#1102340).
   - CVE-2018-20836: An issue was discovered in the Linux kernel There was a
     race condition in smp_task_timedout() and smp_task_done() in
     drivers/scsi/libsas/sas_expander.c, leading to a use-after-free
     (bnc#1134395).
   - CVE-2019-12614: An issue was discovered in dlpar_parse_cc_property in
     arch/powerpc/platforms/pseries/dlpar.c in the Linux kernel There was an
     unchecked kstrdup of prop-name, which might allow an attacker to cause a
     denial of service (NULL pointer dereference and system crash)
     (bnc#1137194).
   - CVE-2019-3846: A flaw that allowed an attacker to corrupt memory and
     possibly escalate privileges was found in the mwifiex kernel module
     while connecting to a malicious wireless network (bnc#1136424 1136446).

   The following non-security bugs were fixed:

   - KEYS: do not let add_key() update an uninstantiated key (bnc#1063416).
   - fnic: Fix to cleanup aborted IO to avoid device being offlined by
     mid-layer (bsc#1134835).
   - signal: give SEND_SIG_FORCED more power to beat SIGNAL_UNKILLABLE
     (bsc#1135650).
   - signal: oom_kill_task: use SEND_SIG_FORCED instead of force_sig()
     (bsc#1135650).
   - tcp: a regression in the previous fix for the TCP SACK issue was fixed
     (bnc#1139751)


Special Instructions and Notes:

   Please reboot the system after installing this update.

Patch Instructions:

   To install this SUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Server 11-SP4-LTSS:

      zypper in -t patch slessp4-kernel-source-14127=1

   - SUSE Linux Enterprise Server 11-EXTRA:

      zypper in -t patch slexsp3-kernel-source-14127=1

   - SUSE Linux Enterprise Debuginfo 11-SP4:

      zypper in -t patch dbgsp4-kernel-source-14127=1



Package List:

   - SUSE Linux Enterprise Server 11-SP4-LTSS (i586 ppc64 s390x x86_64):

      kernel-default-3.0.101-108.98.1
      kernel-default-base-3.0.101-108.98.1
      kernel-default-devel-3.0.101-108.98.1
      kernel-source-3.0.101-108.98.1
      kernel-syms-3.0.101-108.98.1
      kernel-trace-3.0.101-108.98.1
      kernel-trace-base-3.0.101-108.98.1
      kernel-trace-devel-3.0.101-108.98.1

   - SUSE Linux Enterprise Server 11-SP4-LTSS (i586 x86_64):

      kernel-ec2-3.0.101-108.98.1
      kernel-ec2-base-3.0.101-108.98.1
      kernel-ec2-devel-3.0.101-108.98.1
      kernel-xen-3.0.101-108.98.1
      kernel-xen-base-3.0.101-108.98.1
      kernel-xen-devel-3.0.101-108.98.1

   - SUSE Linux Enterprise Server 11-SP4-LTSS (ppc64):

      kernel-bigmem-3.0.101-108.98.1
      kernel-bigmem-base-3.0.101-108.98.1
      kernel-bigmem-devel-3.0.101-108.98.1
      kernel-ppc64-3.0.101-108.98.1
      kernel-ppc64-base-3.0.101-108.98.1
      kernel-ppc64-devel-3.0.101-108.98.1

   - SUSE Linux Enterprise Server 11-SP4-LTSS (s390x):

      kernel-default-man-3.0.101-108.98.1

   - SUSE Linux Enterprise Server 11-SP4-LTSS (i586):

      kernel-pae-3.0.101-108.98.1
      kernel-pae-base-3.0.101-108.98.1
      kernel-pae-devel-3.0.101-108.98.1

   - SUSE Linux Enterprise Server 11-EXTRA (i586 ia64 ppc64 s390x x86_64):

      kernel-default-extra-3.0.101-108.98.1

   - SUSE Linux Enterprise Server 11-EXTRA (i586 x86_64):

      kernel-xen-extra-3.0.101-108.98.1

   - SUSE Linux Enterprise Server 11-EXTRA (x86_64):

      kernel-trace-extra-3.0.101-108.98.1

   - SUSE Linux Enterprise Server 11-EXTRA (ppc64):

      kernel-ppc64-extra-3.0.101-108.98.1

   - SUSE Linux Enterprise Server 11-EXTRA (i586):

      kernel-pae-extra-3.0.101-108.98.1

   - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ppc64 s390x x86_64):

      kernel-default-debuginfo-3.0.101-108.98.1
      kernel-default-debugsource-3.0.101-108.98.1
      kernel-trace-debuginfo-3.0.101-108.98.1
      kernel-trace-debugsource-3.0.101-108.98.1

   - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 s390x x86_64):

      kernel-default-devel-debuginfo-3.0.101-108.98.1
      kernel-trace-devel-debuginfo-3.0.101-108.98.1

   - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 x86_64):

      kernel-ec2-debuginfo-3.0.101-108.98.1
      kernel-ec2-debugsource-3.0.101-108.98.1
      kernel-xen-debuginfo-3.0.101-108.98.1
      kernel-xen-debugsource-3.0.101-108.98.1
      kernel-xen-devel-debuginfo-3.0.101-108.98.1

   - SUSE Linux Enterprise Debuginfo 11-SP4 (ppc64):

      kernel-bigmem-debuginfo-3.0.101-108.98.1
      kernel-bigmem-debugsource-3.0.101-108.98.1
      kernel-ppc64-debuginfo-3.0.101-108.98.1
      kernel-ppc64-debugsource-3.0.101-108.98.1

   - SUSE Linux Enterprise Debuginfo 11-SP4 (i586):

      kernel-pae-debuginfo-3.0.101-108.98.1
      kernel-pae-debugsource-3.0.101-108.98.1
      kernel-pae-devel-debuginfo-3.0.101-108.98.1


References:

   https://www.suse.com/security/cve/CVE-2018-20836.html
   https://www.suse.com/security/cve/CVE-2018-5390.html
   https://www.suse.com/security/cve/CVE-2019-12614.html
   https://www.suse.com/security/cve/CVE-2019-3459.html
   https://www.suse.com/security/cve/CVE-2019-3460.html
   https://www.suse.com/security/cve/CVE-2019-3846.html
   https://www.suse.com/security/cve/CVE-2019-3896.html
   https://bugzilla.suse.com/1063416
   https://bugzilla.suse.com/1090078
   https://bugzilla.suse.com/1102340
   https://bugzilla.suse.com/1120758
   https://bugzilla.suse.com/1134395
   https://bugzilla.suse.com/1134835
   https://bugzilla.suse.com/1135650
   https://bugzilla.suse.com/1136424
   https://bugzilla.suse.com/1137194
   https://bugzilla.suse.com/1138943
   https://bugzilla.suse.com/1139751

_______________________________________________
sle-security-updates mailing list
sle-security-updates@lists.suse.com
http://lists.suse.com/mailman/listinfo/sle-security-updates

SUSE: 2019:14127-1 important: the Linux Kernel

July 18, 2019
An update that solves 7 vulnerabilities and has four fixes is now available

Summary

The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2019-3459: A heap address information leak while using L2CAP_GET_CONF_OPT was discovered in the Linux kernel(bnc#1120758). - CVE-2019-3460: A heap data infoleak in multiple locations including L2CAP_PARSE_CONF_RSP was found in the Linux kernel before (bnc#1120758). - CVE-2019-3896: A double-free could happen in idr_remove_all() in lib/idr.c in the Linux kernel. An unprivileged local attacker could use this flaw for a privilege escalation or for a system crash and a denial of service (DoS) (bnc#1138943). - CVE-2018-5390: The Linux kernel could be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which could lead to a denial of service (bnc#1102340). - CVE-2018-20836: An issue was discovered in the Linux kernel There wa...

Read the Full Advisory

References

#1063416 #1090078 #1102340 #1120758 #1134395

#1134835 #1135650 #1136424 #1137194 #1138943

#1139751

Cross- CVE-2018-20836 CVE-2018-5390 CVE-2019-12614

CVE-2019-3459 CVE-2019-3460 CVE-2019-3846

CVE-2019-3896

Affected Products:

SUSE Linux Enterprise Server 11-SP4-LTSS

SUSE Linux Enterprise Server 11-EXTRA

SUSE Linux Enterprise Debuginfo 11-SP4

https://www.suse.com/security/cve/CVE-2018-20836.html

https://www.suse.com/security/cve/CVE-2018-5390.html

https://www.suse.com/security/cve/CVE-2019-12614.html

https://www.suse.com/security/cve/CVE-2019-3459.html

https://www.suse.com/security/cve/CVE-2019-3460.html

https://www.suse.com/security/cve/CVE-2019-3846.html

https://www.suse.com/security/cve/CVE-2019-3896.html

https://bugzilla.suse.com/1063416

https://bugzilla.suse.com/1090078

https://bugzilla.suse.com/1102340

https://bugz...

Read the Full Advisory

Severity
Announcement ID: SUSE-SU-2019:14127-1
Rating: important

Related News

The End of the Road for Linux 6.11: A Call to Upgrade to Kernel 6.12
3 - 5 min read
The Linux kernel community recently issued an EOL announcement regarding the 6.11 kernel series, urging sysadmins to upgrade quickly to 6.12 . This
A Linux Admin
3 - 6 min read
As 2025 approaches, we Linux admins are facing new and often unseen cloud-native security obstacles. While skilled at mitigating known risks,
Leveraging Insights from the Linux Foundation
3 - 5 min read
The Linux Foundation's recent Census III report provides critical insights for Linux administrators, information security professionals, and anyone
Chrome 131 Released: Emergency Security Update Fixes Over a Dozen Significant Vulns
3 - 6 min read
Google recently unveiled a critical security update to their popular web browser, Google Chrome, addressing over a dozen significant security
From Wayland Fixes to Security Boosts: Examining Qt 6.8.1
3 - 6 min read
The recent Qt 6.8.1 release brings significant updates and improvements, strengthening its reputation as a secure and reliable application
Exploring Arch Linux 2024.12.01: Security Implications & Notable Enhancements for Linux Admins
3 - 6 min read
The Arch Linux 2024.12.01 ISO release marks an impressive milestone, offering cutting-edge updates that enhance functionality, streamline
Deck the Halls with Enhanced Security: Linux Kernel 6.13
3 - 5 min read
As Linux admins and infosec professionals prepare for the holiday season, there's much cause for celebration this year! Linus Torvalds recently made
Lessons from Bootkitty: Securing Linux Systems Against UEFI Intrusions
3 - 5 min read
New Linux security threats mark critical junctures that challenge existing policies and test security protocols to their limit. One such milestone

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved