Security update for the Linux Kernel SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2017:2694-1 Final 1 1 2017-10-10T12:16:47Z current 2017-10-10T12:16:47Z 2017-10-10T12:16:47Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for the Linux Kernel The SUSE Linux Enterprise 11 SP4 RT kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2017-1000251: The native Bluetooth stack was vulnerable to a stack overflow vulnerability in the processing of L2CAP configuration responses resulting in remote code execution in kernel space (bnc#1057389). - CVE-2017-14340: The XFS_IS_REALTIME_INODE macro in fs/xfs/xfs_linux.h did not verify that a filesystem has a realtime device, which allowed local users to cause a denial of service (NULL pointer dereference and OOPS) via vectors related to setting an RHINHERIT flag on a directory (bnc#1058524). - CVE-2017-14140: The move_pages system call in mm/migrate.c did not check the effective uid of the target process, enabling a local attacker to learn the memory layout of a setuid executable despite ASLR (bnc#1057179). - CVE-2017-14051: An integer overflow in the qla2x00_sysfs_write_optrom_ctl function in drivers/scsi/qla2xxx/qla_attr.c allowed local users to cause a denial of service (memory corruption and system crash) by leveraging root access (bnc#1056588). - CVE-2017-10661: Race condition in fs/timerfd.c allowed local users to gain privileges or cause a denial of service (list corruption or use-after-free) via simultaneous file-descriptor operations that leverage improper might_cancel queueing (bnc#1053152). - CVE-2017-12762: In /drivers/isdn/i4l/isdn_net.c a user-controlled buffer was copied into a local buffer of constant size using strcpy without a length check which can cause a buffer overflow (bnc#1053148). - CVE-2017-8831: The saa7164_bus_get function allowed local users to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact by changing a certain sequence-number value, aka a 'double fetch' vulnerability (bnc#1037994). - CVE-2017-1000112: Prevent race condition in net-packet code that could have been exploited by unprivileged users to gain root access.(bnc#1052311). The following non-security bugs were fixed: - ALSA: Fix Lewisburg audio issue - Drop commit 96234ae:kvm_io_bus_unregister_dev() should never fail (bsc#1055680) - Fixup build warnings in drivers/scsi/scsi.c (bsc#1031358) - NFS: Cache aggressively when file is open for writing (bsc#1053933). - NFS: Do drop directory dentry when error clearly requires it (bsc#1051932). - NFS: Do not flush caches for a getattr that races with writeback (bsc#1053933). - NFS: Optimize fallocate by refreshing mapping when needed (bsc#1053933). - NFS: invalidate file size when taking a lock (bsc#1053933). - PCI: fix hotplug related issues (bnc#1054247). - af_key: do not use GFP_KERNEL in atomic contexts (bsc#1054093). - avoid deadlock in xenbus (bnc#1047523). - blacklist 9754d45e9970 tpm: read burstcount from TPM_STS in one 32-bit transaction - blkback/blktap: do not leak stack data via response ring (bsc#1042863 XSA-216). - cx231xx-audio: fix NULL-deref at probe (bsc#1050431). - cx82310_eth: use skb_cow_head() to deal with cloned skbs (bsc#1045154). - fuse: do not use iocb after it may have been freed (bsc#1054706). - fuse: fix fuse_write_end() if zero bytes were copied (bsc#1054706). - fuse: fsync() did not return IO errors (bsc#1054076). - fuse: fuse_flush must check mapping->flags for errors (bsc#1054706). - gspca: konica: add missing endpoint sanity check (bsc#1050431). - kabi/severities: Ignore zpci symbol changes (bsc#1054247) - lib/mpi: mpi_read_raw_data(): fix nbits calculation - media: platform: davinci: return -EINVAL for VPFE_CMD_S_CCDC_RAW_PARAMS ioctl (bsc#1050431). - net: Fix RCU splat in af_key (bsc#1054093). - powerpc/fadump: add reschedule point while releasing memory (bsc#1040609 bsc#1024450). - powerpc/fadump: avoid duplicates in crash memory ranges (bsc#1037669 bsc#1037667). - powerpc/fadump: provide a helpful error message (bsc#1037669 bsc#1037667). - powerpc/prom: Increase minimum RMA size to 512MB (bsc#984530, bsc#1052370). - powerpc/slb: Force a full SLB flush when we insert for a bad EA (bsc#1054070). - reiserfs: fix race in readdir (bsc#1039803). - s390/pci: do not cleanup in arch_setup_msi_irqs (bnc#1054247). - s390/pci: fix handling of PEC 306 (bnc#1054247). - s390/pci: improve error handling during fmb (de)registration (bnc#1054247). - s390/pci: improve error handling during interrupt deregistration (bnc#1054247). - s390/pci: improve pci hotplug (bnc#1054247). - s390/pci: improve unreg_ioat error handling (bnc#1054247). - s390/pci: introduce clp_get_state (bnc#1054247). - s390/pci: provide more debug information (bnc#1054247). - scsi: avoid system stall due to host_busy race (bsc#1031358). - scsi: close race when updating blocked counters (bsc#1031358). - ser_gigaset: return -ENOMEM on error instead of success (bsc#1037441). - supported.conf: clear mistaken external support flag for cifs.ko (bsc#1053802). - tpm: fix a kernel memory leak in tpm-sysfs.c (bsc#1050381). - uwb: fix device quirk on big-endian hosts (bsc#1036629). - xfs: fix inobt inode allocation search optimization (bsc#1013018). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). slertesp4-linux-kernel-rt-13307 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2017/suse-su-20172694-1/ Link for SUSE-SU-2017:2694-1 https://lists.opensuse.org/opensuse-security-announce/2017-10/msg00009.html E-Mail link for SUSE-SU-2017:2694-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1013018 SUSE Bug 1013018 https://bugzilla.suse.com/1024450 SUSE Bug 1024450 https://bugzilla.suse.com/1031358 SUSE Bug 1031358 https://bugzilla.suse.com/1036629 SUSE Bug 1036629 https://bugzilla.suse.com/1037441 SUSE Bug 1037441 https://bugzilla.suse.com/1037667 SUSE Bug 1037667 https://bugzilla.suse.com/1037669 SUSE Bug 1037669 https://bugzilla.suse.com/1037994 SUSE Bug 1037994 https://bugzilla.suse.com/1039803 SUSE Bug 1039803 https://bugzilla.suse.com/1040609 SUSE Bug 1040609 https://bugzilla.suse.com/1042863 SUSE Bug 1042863 https://bugzilla.suse.com/1045154 SUSE Bug 1045154 https://bugzilla.suse.com/1047523 SUSE Bug 1047523 https://bugzilla.suse.com/1050381 SUSE Bug 1050381 https://bugzilla.suse.com/1050431 SUSE Bug 1050431 https://bugzilla.suse.com/1051932 SUSE Bug 1051932 https://bugzilla.suse.com/1052311 SUSE Bug 1052311 https://bugzilla.suse.com/1052370 SUSE Bug 1052370 https://bugzilla.suse.com/1053148 SUSE Bug 1053148 https://bugzilla.suse.com/1053152 SUSE Bug 1053152 https://bugzilla.suse.com/1053802 SUSE Bug 1053802 https://bugzilla.suse.com/1053933 SUSE Bug 1053933 https://bugzilla.suse.com/1054070 SUSE Bug 1054070 https://bugzilla.suse.com/1054076 SUSE Bug 1054076 https://bugzilla.suse.com/1054093 SUSE Bug 1054093 https://bugzilla.suse.com/1054247 SUSE Bug 1054247 https://bugzilla.suse.com/1054706 SUSE Bug 1054706 https://bugzilla.suse.com/1055680 SUSE Bug 1055680 https://bugzilla.suse.com/1056588 SUSE Bug 1056588 https://bugzilla.suse.com/1057179 SUSE Bug 1057179 https://bugzilla.suse.com/1057389 SUSE Bug 1057389 https://bugzilla.suse.com/1058524 SUSE Bug 1058524 https://bugzilla.suse.com/984530 SUSE Bug 984530 https://www.suse.com/security/cve/CVE-2017-1000112/ SUSE CVE CVE-2017-1000112 page https://www.suse.com/security/cve/CVE-2017-1000251/ SUSE CVE CVE-2017-1000251 page https://www.suse.com/security/cve/CVE-2017-10661/ SUSE CVE CVE-2017-10661 page https://www.suse.com/security/cve/CVE-2017-12762/ SUSE CVE CVE-2017-12762 page https://www.suse.com/security/cve/CVE-2017-14051/ SUSE CVE CVE-2017-14051 page https://www.suse.com/security/cve/CVE-2017-14140/ SUSE CVE CVE-2017-14140 page https://www.suse.com/security/cve/CVE-2017-14340/ SUSE CVE CVE-2017-14340 page https://www.suse.com/security/cve/CVE-2017-8831/ SUSE CVE CVE-2017-8831 page SUSE Linux Enterprise Real Time 11 SP4 kernel-rt-3.0.101.rt130-69.8.1 kernel-rt-base-3.0.101.rt130-69.8.1 kernel-rt-devel-3.0.101.rt130-69.8.1 kernel-rt_trace-3.0.101.rt130-69.8.1 kernel-rt_trace-base-3.0.101.rt130-69.8.1 kernel-rt_trace-devel-3.0.101.rt130-69.8.1 kernel-source-rt-3.0.101.rt130-69.8.1 kernel-syms-rt-3.0.101.rt130-69.8.1 kernel-rt-3.0.101.rt130-69.8.1 as a component of SUSE Linux Enterprise Real Time 11 SP4 kernel-rt-base-3.0.101.rt130-69.8.1 as a component of SUSE Linux Enterprise Real Time 11 SP4 kernel-rt-devel-3.0.101.rt130-69.8.1 as a component of SUSE Linux Enterprise Real Time 11 SP4 kernel-rt_trace-3.0.101.rt130-69.8.1 as a component of SUSE Linux Enterprise Real Time 11 SP4 kernel-rt_trace-base-3.0.101.rt130-69.8.1 as a component of SUSE Linux Enterprise Real Time 11 SP4 kernel-rt_trace-devel-3.0.101.rt130-69.8.1 as a component of SUSE Linux Enterprise Real Time 11 SP4 kernel-source-rt-3.0.101.rt130-69.8.1 as a component of SUSE Linux Enterprise Real Time 11 SP4 kernel-syms-rt-3.0.101.rt130-69.8.1 as a component of SUSE Linux Enterprise Real Time 11 SP4 Linux kernel: Exploitable memory corruption due to UFO to non-UFO path switch. When building a UFO packet with MSG_MORE __ip_append_data() calls ip_ufo_append_data() to append. However in between two send() calls, the append path can be switched from UFO to non-UFO one, which leads to a memory corruption. In case UFO packet lengths exceeds MTU, copy = maxfraglen - skb->len becomes negative on the non-UFO path and the branch to allocate new skb is taken. This triggers fragmentation and computation of fraggap = skb_prev->len - maxfraglen. Fraggap can exceed MTU, causing copy = datalen - transhdrlen - fraggap to become negative. Subsequently skb_copy_and_csum_bits() writes out-of-bounds. A similar issue is present in IPv6 code. The bug was introduced in e89e9cf539a2 ("[IPv4/IPv6]: UFO Scatter-gather approach") on Oct 18 2005. CVE-2017-1000112 SUSE Linux Enterprise Real Time 11 SP4:kernel-rt-3.0.101.rt130-69.8.1 SUSE Linux Enterprise Real Time 11 SP4:kernel-rt-base-3.0.101.rt130-69.8.1 SUSE Linux Enterprise Real Time 11 SP4:kernel-rt-devel-3.0.101.rt130-69.8.1 SUSE Linux Enterprise Real Time 11 SP4:kernel-rt_trace-3.0.101.rt130-69.8.1 SUSE Linux Enterprise Real Time 11 SP4:kernel-rt_trace-base-3.0.101.rt130-69.8.1 SUSE Linux Enterprise Real Time 11 SP4:kernel-rt_trace-devel-3.0.101.rt130-69.8.1 SUSE Linux Enterprise Real Time 11 SP4:kernel-source-rt-3.0.101.rt130-69.8.1 SUSE Linux Enterprise Real Time 11 SP4:kernel-syms-rt-3.0.101.rt130-69.8.1 important 6.2 AV:L/AC:H/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172694-1/ https://www.suse.com/security/cve/CVE-2017-1000112.html CVE-2017-1000112 https://bugzilla.suse.com/1052311 SUSE Bug 1052311 https://bugzilla.suse.com/1052365 SUSE Bug 1052365 https://bugzilla.suse.com/1052368 SUSE Bug 1052368 https://bugzilla.suse.com/1072162 SUSE Bug 1072162 https://bugzilla.suse.com/1115893 SUSE Bug 1115893 The native Bluetooth stack in the Linux Kernel (BlueZ), starting at the Linux kernel version 2.6.32 and up to and including 4.13.1, are vulnerable to a stack overflow vulnerability in the processing of L2CAP configuration responses resulting in Remote code execution in kernel space. CVE-2017-1000251 SUSE Linux Enterprise Real Time 11 SP4:kernel-rt-3.0.101.rt130-69.8.1 SUSE Linux Enterprise Real Time 11 SP4:kernel-rt-base-3.0.101.rt130-69.8.1 SUSE Linux Enterprise Real Time 11 SP4:kernel-rt-devel-3.0.101.rt130-69.8.1 SUSE Linux Enterprise Real Time 11 SP4:kernel-rt_trace-3.0.101.rt130-69.8.1 SUSE Linux Enterprise Real Time 11 SP4:kernel-rt_trace-base-3.0.101.rt130-69.8.1 SUSE Linux Enterprise Real Time 11 SP4:kernel-rt_trace-devel-3.0.101.rt130-69.8.1 SUSE Linux Enterprise Real Time 11 SP4:kernel-source-rt-3.0.101.rt130-69.8.1 SUSE Linux Enterprise Real Time 11 SP4:kernel-syms-rt-3.0.101.rt130-69.8.1 important 7.9 AV:A/AC:M/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172694-1/ https://www.suse.com/security/cve/CVE-2017-1000251.html CVE-2017-1000251 https://bugzilla.suse.com/1057389 SUSE Bug 1057389 https://bugzilla.suse.com/1057950 SUSE Bug 1057950 https://bugzilla.suse.com/1070535 SUSE Bug 1070535 https://bugzilla.suse.com/1072162 SUSE Bug 1072162 https://bugzilla.suse.com/1120758 SUSE Bug 1120758 Race condition in fs/timerfd.c in the Linux kernel before 4.10.15 allows local users to gain privileges or cause a denial of service (list corruption or use-after-free) via simultaneous file-descriptor operations that leverage improper might_cancel queueing. CVE-2017-10661 SUSE Linux Enterprise Real Time 11 SP4:kernel-rt-3.0.101.rt130-69.8.1 SUSE Linux Enterprise Real Time 11 SP4:kernel-rt-base-3.0.101.rt130-69.8.1 SUSE Linux Enterprise Real Time 11 SP4:kernel-rt-devel-3.0.101.rt130-69.8.1 SUSE Linux Enterprise Real Time 11 SP4:kernel-rt_trace-3.0.101.rt130-69.8.1 SUSE Linux Enterprise Real Time 11 SP4:kernel-rt_trace-base-3.0.101.rt130-69.8.1 SUSE Linux Enterprise Real Time 11 SP4:kernel-rt_trace-devel-3.0.101.rt130-69.8.1 SUSE Linux Enterprise Real Time 11 SP4:kernel-source-rt-3.0.101.rt130-69.8.1 SUSE Linux Enterprise Real Time 11 SP4:kernel-syms-rt-3.0.101.rt130-69.8.1 important 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172694-1/ https://www.suse.com/security/cve/CVE-2017-10661.html CVE-2017-10661 https://bugzilla.suse.com/1053152 SUSE Bug 1053152 https://bugzilla.suse.com/1053153 SUSE Bug 1053153 https://bugzilla.suse.com/1115893 SUSE Bug 1115893 In /drivers/isdn/i4l/isdn_net.c: A user-controlled buffer is copied into a local buffer of constant size using strcpy without a length check which can cause a buffer overflow. This affects the Linux kernel 4.9-stable tree, 4.12-stable tree, 3.18-stable tree, and 4.4-stable tree. CVE-2017-12762 SUSE Linux Enterprise Real Time 11 SP4:kernel-rt-3.0.101.rt130-69.8.1 SUSE Linux Enterprise Real Time 11 SP4:kernel-rt-base-3.0.101.rt130-69.8.1 SUSE Linux Enterprise Real Time 11 SP4:kernel-rt-devel-3.0.101.rt130-69.8.1 SUSE Linux Enterprise Real Time 11 SP4:kernel-rt_trace-3.0.101.rt130-69.8.1 SUSE Linux Enterprise Real Time 11 SP4:kernel-rt_trace-base-3.0.101.rt130-69.8.1 SUSE Linux Enterprise Real Time 11 SP4:kernel-rt_trace-devel-3.0.101.rt130-69.8.1 SUSE Linux Enterprise Real Time 11 SP4:kernel-source-rt-3.0.101.rt130-69.8.1 SUSE Linux Enterprise Real Time 11 SP4:kernel-syms-rt-3.0.101.rt130-69.8.1 important 6.8 AV:L/AC:L/Au:S/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172694-1/ https://www.suse.com/security/cve/CVE-2017-12762.html CVE-2017-12762 https://bugzilla.suse.com/1053148 SUSE Bug 1053148 https://bugzilla.suse.com/1053150 SUSE Bug 1053150 https://bugzilla.suse.com/1072162 SUSE Bug 1072162 https://bugzilla.suse.com/1115893 SUSE Bug 1115893 An integer overflow in the qla2x00_sysfs_write_optrom_ctl function in drivers/scsi/qla2xxx/qla_attr.c in the Linux kernel through 4.12.10 allows local users to cause a denial of service (memory corruption and system crash) by leveraging root access. CVE-2017-14051 SUSE Linux Enterprise Real Time 11 SP4:kernel-rt-3.0.101.rt130-69.8.1 SUSE Linux Enterprise Real Time 11 SP4:kernel-rt-base-3.0.101.rt130-69.8.1 SUSE Linux Enterprise Real Time 11 SP4:kernel-rt-devel-3.0.101.rt130-69.8.1 SUSE Linux Enterprise Real Time 11 SP4:kernel-rt_trace-3.0.101.rt130-69.8.1 SUSE Linux Enterprise Real Time 11 SP4:kernel-rt_trace-base-3.0.101.rt130-69.8.1 SUSE Linux Enterprise Real Time 11 SP4:kernel-rt_trace-devel-3.0.101.rt130-69.8.1 SUSE Linux Enterprise Real Time 11 SP4:kernel-source-rt-3.0.101.rt130-69.8.1 SUSE Linux Enterprise Real Time 11 SP4:kernel-syms-rt-3.0.101.rt130-69.8.1 moderate 6 AV:L/AC:H/Au:S/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172694-1/ https://www.suse.com/security/cve/CVE-2017-14051.html CVE-2017-14051 https://bugzilla.suse.com/1056588 SUSE Bug 1056588 The move_pages system call in mm/migrate.c in the Linux kernel before 4.12.9 doesn't check the effective uid of the target process, enabling a local attacker to learn the memory layout of a setuid executable despite ASLR. CVE-2017-14140 SUSE Linux Enterprise Real Time 11 SP4:kernel-rt-3.0.101.rt130-69.8.1 SUSE Linux Enterprise Real Time 11 SP4:kernel-rt-base-3.0.101.rt130-69.8.1 SUSE Linux Enterprise Real Time 11 SP4:kernel-rt-devel-3.0.101.rt130-69.8.1 SUSE Linux Enterprise Real Time 11 SP4:kernel-rt_trace-3.0.101.rt130-69.8.1 SUSE Linux Enterprise Real Time 11 SP4:kernel-rt_trace-base-3.0.101.rt130-69.8.1 SUSE Linux Enterprise Real Time 11 SP4:kernel-rt_trace-devel-3.0.101.rt130-69.8.1 SUSE Linux Enterprise Real Time 11 SP4:kernel-source-rt-3.0.101.rt130-69.8.1 SUSE Linux Enterprise Real Time 11 SP4:kernel-syms-rt-3.0.101.rt130-69.8.1 important 1.7 AV:L/AC:L/Au:S/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172694-1/ https://www.suse.com/security/cve/CVE-2017-14140.html CVE-2017-14140 https://bugzilla.suse.com/1057179 SUSE Bug 1057179 The XFS_IS_REALTIME_INODE macro in fs/xfs/xfs_linux.h in the Linux kernel before 4.13.2 does not verify that a filesystem has a realtime device, which allows local users to cause a denial of service (NULL pointer dereference and OOPS) via vectors related to setting an RHINHERIT flag on a directory. CVE-2017-14340 SUSE Linux Enterprise Real Time 11 SP4:kernel-rt-3.0.101.rt130-69.8.1 SUSE Linux Enterprise Real Time 11 SP4:kernel-rt-base-3.0.101.rt130-69.8.1 SUSE Linux Enterprise Real Time 11 SP4:kernel-rt-devel-3.0.101.rt130-69.8.1 SUSE Linux Enterprise Real Time 11 SP4:kernel-rt_trace-3.0.101.rt130-69.8.1 SUSE Linux Enterprise Real Time 11 SP4:kernel-rt_trace-base-3.0.101.rt130-69.8.1 SUSE Linux Enterprise Real Time 11 SP4:kernel-rt_trace-devel-3.0.101.rt130-69.8.1 SUSE Linux Enterprise Real Time 11 SP4:kernel-source-rt-3.0.101.rt130-69.8.1 SUSE Linux Enterprise Real Time 11 SP4:kernel-syms-rt-3.0.101.rt130-69.8.1 important 4.6 AV:L/AC:L/Au:S/C:N/I:N/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172694-1/ https://www.suse.com/security/cve/CVE-2017-14340.html CVE-2017-14340 https://bugzilla.suse.com/1058524 SUSE Bug 1058524 The saa7164_bus_get function in drivers/media/pci/saa7164/saa7164-bus.c in the Linux kernel through 4.11.5 allows local users to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact by changing a certain sequence-number value, aka a "double fetch" vulnerability. CVE-2017-8831 SUSE Linux Enterprise Real Time 11 SP4:kernel-rt-3.0.101.rt130-69.8.1 SUSE Linux Enterprise Real Time 11 SP4:kernel-rt-base-3.0.101.rt130-69.8.1 SUSE Linux Enterprise Real Time 11 SP4:kernel-rt-devel-3.0.101.rt130-69.8.1 SUSE Linux Enterprise Real Time 11 SP4:kernel-rt_trace-3.0.101.rt130-69.8.1 SUSE Linux Enterprise Real Time 11 SP4:kernel-rt_trace-base-3.0.101.rt130-69.8.1 SUSE Linux Enterprise Real Time 11 SP4:kernel-rt_trace-devel-3.0.101.rt130-69.8.1 SUSE Linux Enterprise Real Time 11 SP4:kernel-source-rt-3.0.101.rt130-69.8.1 SUSE Linux Enterprise Real Time 11 SP4:kernel-syms-rt-3.0.101.rt130-69.8.1 moderate 6.6 AV:L/AC:M/Au:S/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172694-1/ https://www.suse.com/security/cve/CVE-2017-8831.html CVE-2017-8831 https://bugzilla.suse.com/1037994 SUSE Bug 1037994 https://bugzilla.suse.com/1061936 SUSE Bug 1061936 https://bugzilla.suse.com/1087082 SUSE Bug 1087082 https://bugzilla.suse.com/1115893 SUSE Bug 1115893