Security update for the Linux Kernel SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:1762-1 Final 1 1 2018-06-20T09:43:56Z current 2018-06-20T09:43:56Z 2018-06-20T09:43:56Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for the Linux Kernel The SUSE Linux Enterprise 12 GA LTSS kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2018-3665: Prevent disclosure of FPU registers (including XMM and AVX registers) between processes. These registers might contain encryption keys when doing SSE accelerated AES enc/decryption (bsc#1087086) - CVE-2018-5848: In the function wmi_set_ie(), the length validation code did not handle unsigned integer overflow properly. As a result, a large value of the 'ie_len' argument could have caused a buffer overflow (bnc#1097356) - CVE-2018-1000204: Prevent infoleak caused by incorrect handling of the SG_IO ioctl (bsc#1096728) - CVE-2017-13305: Prevent information disclosure vulnerability in encrypted-keys (bsc#1094353) - CVE-2018-1094: The ext4_fill_super function did not always initialize the crc32c checksum driver, which allowed attackers to cause a denial of service (ext4_xattr_inode_hash NULL pointer dereference and system crash) via a crafted ext4 image (bsc#1087007) - CVE-2018-1093: The ext4_valid_block_bitmap function allowed attackers to cause a denial of service (out-of-bounds read and system crash) via a crafted ext4 image because balloc.c and ialloc.c do not validate bitmap block numbers (bsc#1087095) - CVE-2018-1092: The ext4_iget function mishandled the case of a root directory with a zero i_links_count, which allowed attackers to cause a denial of service (ext4_process_freed_data NULL pointer dereference and OOPS) via a crafted ext4 image (bsc#1087012) - CVE-2018-1130: NULL pointer dereference in dccp_write_xmit() function that allowed a local user to cause a denial of service by a number of certain crafted system calls (bsc#1092904) - CVE-2018-5803: Prevent error in the '_sctp_make_chunk()' function when handling SCTP packets length that could have been exploited to cause a kernel crash (bnc#1083900) - CVE-2018-7492: Prevent NULL pointer dereference in the net/rds/rdma.c __rds_rdma_map() function that allowed local attackers to cause a system panic and a denial-of-service, related to RDS_GET_MR and RDS_GET_MR_FOR_DEST (bsc#1082962) The following non-security bugs were fixed: - Fix excessive newline in /proc/*/status (bsc#1094823). - KVM: x86: Sync back MSR_IA32_SPEC_CTRL to VCPU data structure (bsc#1096242, bsc#1096281). - ipv6: add mtu lock check in __ip6_rt_update_pmtu (bsc#1092552). - kABI: work around BPF SSBD removal (bsc#1087082). - kgraft/bnx2fc: Do not block kGraft in bnx2fc_l2_rcv kthread (bsc#1094033). - mm, page_alloc: do not break __GFP_THISNODE by zonelist reset (bsc#1079152). - usbip: usbip_host: fix NULL-ptr deref and use-after-free errors (bsc#1096480). - usbip: usbip_host: fix bad unlock balance during stub_probe() (bsc#1096480). - x86/boot: Fix early command-line parsing when matching at end (bsc#1096281). - x86/boot: Fix early command-line parsing when partial word matches (bsc#1096281). - x86/bugs: spec_ctrl must be cleared from cpu_caps_set when being disabled (bsc#1096140). - x86/kaiser: export symbol kaiser_set_shadow_pgd() (bsc#1092813) - xen-netfront: fix req_prod check to avoid RX hang when index wraps (bsc#1046610). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-Module-Public-Cloud-12-2018-1184,SUSE-SLE-SERVER-12-2018-1184 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20181762-1/ Link for SUSE-SU-2018:1762-1 https://lists.suse.com/pipermail/sle-security-updates/2018-June/004206.html E-Mail link for SUSE-SU-2018:1762-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1046610 SUSE Bug 1046610 https://bugzilla.suse.com/1079152 SUSE Bug 1079152 https://bugzilla.suse.com/1082962 SUSE Bug 1082962 https://bugzilla.suse.com/1083900 SUSE Bug 1083900 https://bugzilla.suse.com/1087007 SUSE Bug 1087007 https://bugzilla.suse.com/1087012 SUSE Bug 1087012 https://bugzilla.suse.com/1087082 SUSE Bug 1087082 https://bugzilla.suse.com/1087086 SUSE Bug 1087086 https://bugzilla.suse.com/1087095 SUSE Bug 1087095 https://bugzilla.suse.com/1092552 SUSE Bug 1092552 https://bugzilla.suse.com/1092813 SUSE Bug 1092813 https://bugzilla.suse.com/1092904 SUSE Bug 1092904 https://bugzilla.suse.com/1094033 SUSE Bug 1094033 https://bugzilla.suse.com/1094353 SUSE Bug 1094353 https://bugzilla.suse.com/1094823 SUSE Bug 1094823 https://bugzilla.suse.com/1096140 SUSE Bug 1096140 https://bugzilla.suse.com/1096242 SUSE Bug 1096242 https://bugzilla.suse.com/1096281 SUSE Bug 1096281 https://bugzilla.suse.com/1096480 SUSE Bug 1096480 https://bugzilla.suse.com/1096728 SUSE Bug 1096728 https://bugzilla.suse.com/1097356 SUSE Bug 1097356 https://www.suse.com/security/cve/CVE-2017-13305/ SUSE CVE CVE-2017-13305 page https://www.suse.com/security/cve/CVE-2018-1000204/ SUSE CVE CVE-2018-1000204 page https://www.suse.com/security/cve/CVE-2018-1092/ SUSE CVE CVE-2018-1092 page https://www.suse.com/security/cve/CVE-2018-1093/ SUSE CVE CVE-2018-1093 page https://www.suse.com/security/cve/CVE-2018-1094/ SUSE CVE CVE-2018-1094 page https://www.suse.com/security/cve/CVE-2018-1130/ SUSE CVE CVE-2018-1130 page https://www.suse.com/security/cve/CVE-2018-3665/ SUSE CVE CVE-2018-3665 page https://www.suse.com/security/cve/CVE-2018-5803/ SUSE CVE CVE-2018-5803 page https://www.suse.com/security/cve/CVE-2018-5848/ SUSE CVE CVE-2018-5848 page https://www.suse.com/security/cve/CVE-2018-7492/ SUSE CVE CVE-2018-7492 page SUSE Linux Enterprise Module for Public Cloud 12 SUSE Linux Enterprise Server 12-LTSS kernel-ec2-3.12.61-52.136.1 kernel-ec2-devel-3.12.61-52.136.1 kernel-ec2-extra-3.12.61-52.136.1 kernel-default-3.12.61-52.136.1 kernel-default-base-3.12.61-52.136.1 kernel-default-devel-3.12.61-52.136.1 kernel-default-man-3.12.61-52.136.1 kernel-devel-3.12.61-52.136.1 kernel-macros-3.12.61-52.136.1 kernel-source-3.12.61-52.136.1 kernel-syms-3.12.61-52.136.1 kernel-xen-3.12.61-52.136.1 kernel-xen-base-3.12.61-52.136.1 kernel-xen-devel-3.12.61-52.136.1 kgraft-patch-3_12_61-52_136-default-1-1.3.1 kgraft-patch-3_12_61-52_136-xen-1-1.3.1 kernel-ec2-3.12.61-52.136.1 as a component of SUSE Linux Enterprise Module for Public Cloud 12 kernel-ec2-devel-3.12.61-52.136.1 as a component of SUSE Linux Enterprise Module for Public Cloud 12 kernel-ec2-extra-3.12.61-52.136.1 as a component of SUSE Linux Enterprise Module for Public Cloud 12 kernel-default-3.12.61-52.136.1 as a component of SUSE Linux Enterprise Server 12-LTSS kernel-default-base-3.12.61-52.136.1 as a component of SUSE Linux Enterprise Server 12-LTSS kernel-default-devel-3.12.61-52.136.1 as a component of SUSE Linux Enterprise Server 12-LTSS kernel-default-man-3.12.61-52.136.1 as a component of SUSE Linux Enterprise Server 12-LTSS kernel-devel-3.12.61-52.136.1 as a component of SUSE Linux Enterprise Server 12-LTSS kernel-macros-3.12.61-52.136.1 as a component of SUSE Linux Enterprise Server 12-LTSS kernel-source-3.12.61-52.136.1 as a component of SUSE Linux Enterprise Server 12-LTSS kernel-syms-3.12.61-52.136.1 as a component of SUSE Linux Enterprise Server 12-LTSS kernel-xen-3.12.61-52.136.1 as a component of SUSE Linux Enterprise Server 12-LTSS kernel-xen-base-3.12.61-52.136.1 as a component of SUSE Linux Enterprise Server 12-LTSS kernel-xen-devel-3.12.61-52.136.1 as a component of SUSE Linux Enterprise Server 12-LTSS kgraft-patch-3_12_61-52_136-default-1-1.3.1 as a component of SUSE Linux Enterprise Server 12-LTSS kgraft-patch-3_12_61-52_136-xen-1-1.3.1 as a component of SUSE Linux Enterprise Server 12-LTSS A information disclosure vulnerability in the Upstream kernel encrypted-keys. Product: Android. Versions: Android kernel. Android ID: A-70526974. CVE-2017-13305 SUSE Linux Enterprise Module for Public Cloud 12:kernel-ec2-3.12.61-52.136.1 SUSE Linux Enterprise Module for Public Cloud 12:kernel-ec2-devel-3.12.61-52.136.1 SUSE Linux Enterprise Module for Public Cloud 12:kernel-ec2-extra-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-default-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-default-base-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-default-devel-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-default-man-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-devel-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-macros-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-source-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-syms-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-xen-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-xen-base-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-xen-devel-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kgraft-patch-3_12_61-52_136-default-1-1.3.1 SUSE Linux Enterprise Server 12-LTSS:kgraft-patch-3_12_61-52_136-xen-1-1.3.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20181762-1/ https://www.suse.com/security/cve/CVE-2017-13305.html CVE-2017-13305 https://bugzilla.suse.com/1094353 SUSE Bug 1094353 https://bugzilla.suse.com/1105412 SUSE Bug 1105412 ** DISPUTED ** Linux Kernel version 3.18 to 4.16 incorrectly handles an SG_IO ioctl on /dev/sg0 with dxfer_direction=SG_DXFER_FROM_DEV and an empty 6-byte cmdp. This may lead to copying up to 1000 kernel heap pages to the userspace. This has been fixed upstream in https://github.com/torvalds/linux/commit/a45b599ad808c3c982fdcdc12b0b8611c2f92824 already. The problem has limited scope, as users don't usually have permissions to access SCSI devices. On the other hand, e.g. the Nero user manual suggests doing `chmod o+r+w /dev/sg*` to make the devices accessible. NOTE: third parties dispute the relevance of this report, noting that the requirement for an attacker to have both the CAP_SYS_ADMIN and CAP_SYS_RAWIO capabilities makes it "virtually impossible to exploit." CVE-2018-1000204 SUSE Linux Enterprise Module for Public Cloud 12:kernel-ec2-3.12.61-52.136.1 SUSE Linux Enterprise Module for Public Cloud 12:kernel-ec2-devel-3.12.61-52.136.1 SUSE Linux Enterprise Module for Public Cloud 12:kernel-ec2-extra-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-default-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-default-base-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-default-devel-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-default-man-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-devel-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-macros-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-source-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-syms-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-xen-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-xen-base-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-xen-devel-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kgraft-patch-3_12_61-52_136-default-1-1.3.1 SUSE Linux Enterprise Server 12-LTSS:kgraft-patch-3_12_61-52_136-xen-1-1.3.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20181762-1/ https://www.suse.com/security/cve/CVE-2018-1000204.html CVE-2018-1000204 https://bugzilla.suse.com/1096728 SUSE Bug 1096728 https://bugzilla.suse.com/1105412 SUSE Bug 1105412 The ext4_iget function in fs/ext4/inode.c in the Linux kernel through 4.15.15 mishandles the case of a root directory with a zero i_links_count, which allows attackers to cause a denial of service (ext4_process_freed_data NULL pointer dereference and OOPS) via a crafted ext4 image. CVE-2018-1092 SUSE Linux Enterprise Module for Public Cloud 12:kernel-ec2-3.12.61-52.136.1 SUSE Linux Enterprise Module for Public Cloud 12:kernel-ec2-devel-3.12.61-52.136.1 SUSE Linux Enterprise Module for Public Cloud 12:kernel-ec2-extra-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-default-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-default-base-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-default-devel-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-default-man-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-devel-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-macros-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-source-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-syms-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-xen-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-xen-base-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-xen-devel-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kgraft-patch-3_12_61-52_136-default-1-1.3.1 SUSE Linux Enterprise Server 12-LTSS:kgraft-patch-3_12_61-52_136-xen-1-1.3.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20181762-1/ https://www.suse.com/security/cve/CVE-2018-1092.html CVE-2018-1092 https://bugzilla.suse.com/1087012 SUSE Bug 1087012 https://bugzilla.suse.com/1087082 SUSE Bug 1087082 The ext4_valid_block_bitmap function in fs/ext4/balloc.c in the Linux kernel through 4.15.15 allows attackers to cause a denial of service (out-of-bounds read and system crash) via a crafted ext4 image because balloc.c and ialloc.c do not validate bitmap block numbers. CVE-2018-1093 SUSE Linux Enterprise Module for Public Cloud 12:kernel-ec2-3.12.61-52.136.1 SUSE Linux Enterprise Module for Public Cloud 12:kernel-ec2-devel-3.12.61-52.136.1 SUSE Linux Enterprise Module for Public Cloud 12:kernel-ec2-extra-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-default-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-default-base-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-default-devel-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-default-man-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-devel-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-macros-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-source-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-syms-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-xen-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-xen-base-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-xen-devel-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kgraft-patch-3_12_61-52_136-default-1-1.3.1 SUSE Linux Enterprise Server 12-LTSS:kgraft-patch-3_12_61-52_136-xen-1-1.3.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20181762-1/ https://www.suse.com/security/cve/CVE-2018-1093.html CVE-2018-1093 https://bugzilla.suse.com/1087082 SUSE Bug 1087082 https://bugzilla.suse.com/1087095 SUSE Bug 1087095 The ext4_fill_super function in fs/ext4/super.c in the Linux kernel through 4.15.15 does not always initialize the crc32c checksum driver, which allows attackers to cause a denial of service (ext4_xattr_inode_hash NULL pointer dereference and system crash) via a crafted ext4 image. CVE-2018-1094 SUSE Linux Enterprise Module for Public Cloud 12:kernel-ec2-3.12.61-52.136.1 SUSE Linux Enterprise Module for Public Cloud 12:kernel-ec2-devel-3.12.61-52.136.1 SUSE Linux Enterprise Module for Public Cloud 12:kernel-ec2-extra-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-default-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-default-base-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-default-devel-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-default-man-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-devel-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-macros-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-source-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-syms-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-xen-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-xen-base-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-xen-devel-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kgraft-patch-3_12_61-52_136-default-1-1.3.1 SUSE Linux Enterprise Server 12-LTSS:kgraft-patch-3_12_61-52_136-xen-1-1.3.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20181762-1/ https://www.suse.com/security/cve/CVE-2018-1094.html CVE-2018-1094 https://bugzilla.suse.com/1087007 SUSE Bug 1087007 https://bugzilla.suse.com/1087082 SUSE Bug 1087082 Linux kernel before version 4.16-rc7 is vulnerable to a null pointer dereference in dccp_write_xmit() function in net/dccp/output.c in that allows a local user to cause a denial of service by a number of certain crafted system calls. CVE-2018-1130 SUSE Linux Enterprise Module for Public Cloud 12:kernel-ec2-3.12.61-52.136.1 SUSE Linux Enterprise Module for Public Cloud 12:kernel-ec2-devel-3.12.61-52.136.1 SUSE Linux Enterprise Module for Public Cloud 12:kernel-ec2-extra-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-default-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-default-base-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-default-devel-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-default-man-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-devel-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-macros-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-source-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-syms-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-xen-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-xen-base-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-xen-devel-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kgraft-patch-3_12_61-52_136-default-1-1.3.1 SUSE Linux Enterprise Server 12-LTSS:kgraft-patch-3_12_61-52_136-xen-1-1.3.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20181762-1/ https://www.suse.com/security/cve/CVE-2018-1130.html CVE-2018-1130 https://bugzilla.suse.com/1092904 SUSE Bug 1092904 System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially allow a local process to infer data from another process through a speculative execution side channel. CVE-2018-3665 SUSE Linux Enterprise Module for Public Cloud 12:kernel-ec2-3.12.61-52.136.1 SUSE Linux Enterprise Module for Public Cloud 12:kernel-ec2-devel-3.12.61-52.136.1 SUSE Linux Enterprise Module for Public Cloud 12:kernel-ec2-extra-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-default-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-default-base-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-default-devel-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-default-man-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-devel-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-macros-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-source-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-syms-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-xen-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-xen-base-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-xen-devel-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kgraft-patch-3_12_61-52_136-default-1-1.3.1 SUSE Linux Enterprise Server 12-LTSS:kgraft-patch-3_12_61-52_136-xen-1-1.3.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20181762-1/ https://www.suse.com/security/cve/CVE-2018-3665.html CVE-2018-3665 https://bugzilla.suse.com/1087078 SUSE Bug 1087078 https://bugzilla.suse.com/1087082 SUSE Bug 1087082 https://bugzilla.suse.com/1087086 SUSE Bug 1087086 https://bugzilla.suse.com/1090338 SUSE Bug 1090338 https://bugzilla.suse.com/1095241 SUSE Bug 1095241 https://bugzilla.suse.com/1095242 SUSE Bug 1095242 https://bugzilla.suse.com/1096740 SUSE Bug 1096740 https://bugzilla.suse.com/1100091 SUSE Bug 1100091 https://bugzilla.suse.com/1100555 SUSE Bug 1100555 https://bugzilla.suse.com/1178658 SUSE Bug 1178658 In the Linux Kernel before version 4.15.8, 4.14.25, 4.9.87, 4.4.121, 4.1.51, and 3.2.102, an error in the "_sctp_make_chunk()" function (net/sctp/sm_make_chunk.c) when handling SCTP packets length can be exploited to cause a kernel crash. CVE-2018-5803 SUSE Linux Enterprise Module for Public Cloud 12:kernel-ec2-3.12.61-52.136.1 SUSE Linux Enterprise Module for Public Cloud 12:kernel-ec2-devel-3.12.61-52.136.1 SUSE Linux Enterprise Module for Public Cloud 12:kernel-ec2-extra-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-default-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-default-base-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-default-devel-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-default-man-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-devel-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-macros-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-source-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-syms-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-xen-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-xen-base-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-xen-devel-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kgraft-patch-3_12_61-52_136-default-1-1.3.1 SUSE Linux Enterprise Server 12-LTSS:kgraft-patch-3_12_61-52_136-xen-1-1.3.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20181762-1/ https://www.suse.com/security/cve/CVE-2018-5803.html CVE-2018-5803 https://bugzilla.suse.com/1083900 SUSE Bug 1083900 https://bugzilla.suse.com/1087082 SUSE Bug 1087082 https://bugzilla.suse.com/1115893 SUSE Bug 1115893 In the function wmi_set_ie(), the length validation code does not handle unsigned integer overflow properly. As a result, a large value of the 'ie_len' argument can cause a buffer overflow in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel. CVE-2018-5848 SUSE Linux Enterprise Module for Public Cloud 12:kernel-ec2-3.12.61-52.136.1 SUSE Linux Enterprise Module for Public Cloud 12:kernel-ec2-devel-3.12.61-52.136.1 SUSE Linux Enterprise Module for Public Cloud 12:kernel-ec2-extra-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-default-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-default-base-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-default-devel-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-default-man-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-devel-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-macros-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-source-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-syms-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-xen-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-xen-base-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-xen-devel-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kgraft-patch-3_12_61-52_136-default-1-1.3.1 SUSE Linux Enterprise Server 12-LTSS:kgraft-patch-3_12_61-52_136-xen-1-1.3.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20181762-1/ https://www.suse.com/security/cve/CVE-2018-5848.html CVE-2018-5848 https://bugzilla.suse.com/1087082 SUSE Bug 1087082 https://bugzilla.suse.com/1097356 SUSE Bug 1097356 https://bugzilla.suse.com/1105412 SUSE Bug 1105412 https://bugzilla.suse.com/1115339 SUSE Bug 1115339 A NULL pointer dereference was found in the net/rds/rdma.c __rds_rdma_map() function in the Linux kernel before 4.14.7 allowing local attackers to cause a system panic and a denial-of-service, related to RDS_GET_MR and RDS_GET_MR_FOR_DEST. CVE-2018-7492 SUSE Linux Enterprise Module for Public Cloud 12:kernel-ec2-3.12.61-52.136.1 SUSE Linux Enterprise Module for Public Cloud 12:kernel-ec2-devel-3.12.61-52.136.1 SUSE Linux Enterprise Module for Public Cloud 12:kernel-ec2-extra-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-default-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-default-base-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-default-devel-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-default-man-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-devel-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-macros-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-source-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-syms-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-xen-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-xen-base-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kernel-xen-devel-3.12.61-52.136.1 SUSE Linux Enterprise Server 12-LTSS:kgraft-patch-3_12_61-52_136-default-1-1.3.1 SUSE Linux Enterprise Server 12-LTSS:kgraft-patch-3_12_61-52_136-xen-1-1.3.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20181762-1/ https://www.suse.com/security/cve/CVE-2018-7492.html CVE-2018-7492 https://bugzilla.suse.com/1082962 SUSE Bug 1082962