Security update for kgraft-patch-SLE12_Update_1, kgraft-patch-SLE12_Update_2 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2015:0832-1 Final 1 1 2015-04-01T14:12:12Z current 2015-04-01T14:12:12Z 2015-04-01T14:12:12Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for kgraft-patch-SLE12_Update_1, kgraft-patch-SLE12_Update_2 This update supplies kgraft patches to fix one security vulnerability. CVE-2015-1421: A use-after-free vulnerability in the sctp_assoc_update function in net/sctp/associola.c in the Linux kernel allowed remote attackers to cause a denial of service (slab corruption and panic) or possibly have unspecified other impact by triggering an INIT collision that leads to improper handling of shared-key data. This patch supplies kgraft patches for the first kernel update and the second kernel update published for SUSE Linux Enterprise Server 12. The third kernel update contains the patch already. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-Live-Patching-12-2015-183 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2015/suse-su-20150832-1/ Link for SUSE-SU-2015:0832-1 https://lists.opensuse.org/opensuse-security-announce/2015-05/msg00001.html E-Mail link for SUSE-SU-2015:0832-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/920633 SUSE Bug 920633 https://bugzilla.suse.com/922004 SUSE Bug 922004 https://www.suse.com/security/cve/CVE-2015-1421/ SUSE CVE CVE-2015-1421 page SUSE Linux Enterprise Live Patching 12 kgraft-patch-3_12_32-33-default-2-3.1 kgraft-patch-3_12_32-33-xen-2-3.1 kgraft-patch-3_12_36-38-default-2-3.1 kgraft-patch-3_12_36-38-xen-2-3.1 kgraft-patch-3_12_32-33-default-2-3.1 as a component of SUSE Linux Enterprise Live Patching 12 kgraft-patch-3_12_32-33-xen-2-3.1 as a component of SUSE Linux Enterprise Live Patching 12 kgraft-patch-3_12_36-38-default-2-3.1 as a component of SUSE Linux Enterprise Live Patching 12 kgraft-patch-3_12_36-38-xen-2-3.1 as a component of SUSE Linux Enterprise Live Patching 12 Use-after-free vulnerability in the sctp_assoc_update function in net/sctp/associola.c in the Linux kernel before 3.18.8 allows remote attackers to cause a denial of service (slab corruption and panic) or possibly have unspecified other impact by triggering an INIT collision that leads to improper handling of shared-key data. CVE-2015-1421 SUSE Linux Enterprise Live Patching 12:kgraft-patch-3_12_32-33-default-2-3.1 SUSE Linux Enterprise Live Patching 12:kgraft-patch-3_12_32-33-xen-2-3.1 SUSE Linux Enterprise Live Patching 12:kgraft-patch-3_12_36-38-default-2-3.1 SUSE Linux Enterprise Live Patching 12:kgraft-patch-3_12_36-38-xen-2-3.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150832-1/ https://www.suse.com/security/cve/CVE-2015-1421.html CVE-2015-1421 https://bugzilla.suse.com/1115893 SUSE Bug 1115893 https://bugzilla.suse.com/915577 SUSE Bug 915577 https://bugzilla.suse.com/922004 SUSE Bug 922004 https://bugzilla.suse.com/939261 SUSE Bug 939261