The openSUSE Leap 15.1 was updated to receive various security and bugfixes.

The following security bugs were fixed :

  - CVE-2019-11477: A sequence of SACKs may have been     crafted by a remote attacker such that one can trigger     an integer overflow, leading to a kernel panic.
    (bsc#1137586).

  - CVE-2019-11478: It was possible to send a crafted     sequence of SACKs which would fragment the TCP     retransmission queue. A remote attacker may have been     able to further exploit the fragmented queue to cause an     expensive linked-list walk for subsequent SACKs received     for that same TCP connection. (bsc#1137586)

  - CVE-2019-11479: It was possible to send a crafted     sequence of SACKs which would fragment the RACK send     map. A remote attacker may be able to further exploit     the fragmented send map to cause an expensive     linked-list walk for subsequent SACKs received for that     same TCP connection. This would have resulted in excess     resource consumption due to low mss values.
    (bsc#1137586)

  - CVE-2019-12819: The function __mdiobus_register() in     drivers/net/phy/mdio_bus.c calls put_device(), which     will trigger a fixed_mdio_bus_init use-after-free. This     will cause a denial of service (bnc#1138291).

  - CVE-2019-12818: The nfc_llcp_build_tlv function in     net/nfc/llcp_commands.c may return NULL. If the caller     did not check for this, it will trigger a NULL pointer     dereference. This will cause denial of service. This     affects nfc_llcp_build_gb in net/nfc/llcp_core.c     (bnc#1138293).

  - CVE-2019-12456: An issue was discovered in the     MPT3COMMAND case in _ctl_ioctl_main in     drivers/scsi/mpt3sas/mpt3sas_ctl.c that allowed local     users to cause a denial of service or possibly have     unspecified other impact by changing the value of     ioc_number between two kernel reads of that value, aka a     'double fetch' vulnerability. (bnc#1136922)

  - CVE-2019-12380: An issue was discovered in the efi     subsystem in the Linux kernel     phys_efi_set_virtual_address_map in     arch/x86/platform/efi/efi.c and efi_call_phys_prolog in     arch/x86/platform/efi/efi_64.c mishandle memory     allocation failures (bnc#1136598).

  - CVE-2019-3846: A flaw that allowed an attacker to     corrupt memory and possibly escalate privileges was     found in the mwifiex kernel module while connecting to a     malicious wireless network (bnc#1136424).

  - CVE-2019-10124: An attacker could exploit an issue in     the hwpoison implementation to cause a denial of service     (BUG). (bsc#1130699)

  - CVE-2019-12382: In the drm_load_edid_firmware in     drivers/gpu/drm/drm_edid_load.c was an unchecked kstrdup     of fwstr, which might allow an attacker to cause a     denial of service (NULL pointer dereference and system     crash) (bnc#1136586).

  - CVE-2019-11487: The Linux kernel allowed page->_refcount     reference count overflow, with resultant use-after-free     issues, if about 140 GiB of RAM exists. This is related     to fs/fuse/dev.c, fs/pipe.c, fs/splice.c,     include/linux/mm.h, include/linux/pipe_fs_i.h,     kernel/trace/trace.c, mm/gup.c, and mm/hugetlb.c. It can     occur with FUSE requests (bnc#1133190).

Detections

Analytics

openSUSE Security Update : the Linux Kernel (openSUSE-2019-1571) (SACK Panic) (SACK Slowness)

high Nessus Plugin ID 126059

Version 1.4

Version 1.3

Version 1.4 May 15, 2024, 7:38 AM CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:POC/RL:OF/RC:C") CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:P/RL:O/RC:C") CVSSv2 score source (set to "CVE-2019-3846") Exploit attributes ("Exploit available" set to "True") Exploit attributes ("Exploitability ease" changed from "No known exploits are available" to "Exploits are available") Plugin Feed: 202405150738
Version 1.3 Dec 6, 2022, 1:01 AM Reference Plugin Feed: 202212060101