The SUSE Linux Enterprise 12 kernel was updated to 3.12.31 to receive various security and bugfixes.

Security issues fixed: CVE-2014-9322: A local privilege escalation in the x86_64 32bit compatibility signal handling was fixed, which could be used by local attackers to crash the machine or execute code.

  - CVE-2014-9090: Various issues in LDT handling in 32bit     compatibility mode on the x86_64 platform were fixed,     where local attackers could crash the machine.

  - CVE-2014-8133: Insufficient validation of TLS register     usage could leak information from the kernel stack to     userspace.

  - CVE-2014-7826: kernel/trace/trace_syscalls.c in the     Linux kernel did not properly handle private syscall     numbers during use of the ftrace subsystem, which     allowed local users to gain privileges or cause a denial     of service (invalid pointer dereference) via a crafted     application.

  - CVE-2014-3647: Nadav Amit reported that the KVM (Kernel     Virtual Machine) mishandled noncanonical addresses when     emulating instructions that change the rip (Instruction     Pointer). A guest user with access to I/O or the MMIO     could use this flaw to cause a denial of service (system     crash) of the guest.

  - CVE-2014-3611: A race condition flaw was found in the     way the Linux kernel's KVM subsystem handled PIT     (Programmable Interval Timer) emulation. A guest user     who has access to the PIT I/O ports could use this flaw     to crash the host.

  - CVE-2014-3610: If the guest writes a noncanonical value     to certain MSR registers, KVM will write that value to     the MSR in the host context and a #GP will be raised     leading to kernel panic. A privileged guest user could     have used this flaw to crash the host.

  - CVE-2014-7841: A remote attacker could have used a flaw     in SCTP to crash the system by sending a maliciously     prepared SCTP packet in order to trigger a NULL pointer     dereference on the server.

  - CVE-2014-3673: The SCTP implementation in the Linux     kernel allowed remote attackers to cause a denial of     service (system crash) via a malformed ASCONF chunk,     related to net/sctp/sm_make_chunk.c and     net/sctp/sm_statefuns.c.

  - CVE-2014-3185: Multiple buffer overflows in the     command_port_read_callback function in     drivers/usb/serial/whiteheat.c in the Whiteheat USB     Serial Driver in the Linux kernel allowed physically     proximate attackers to execute arbitrary code or cause a     denial of service (memory corruption and system crash)     via a crafted device that provides a large amount of (1)     EHCI or (2) XHCI data associated with a bulk response.

Bugs fixed: BTRFS :

  - btrfs: fix race that makes btrfs_lookup_extent_info miss     skinny extent items (bnc#904077).

  - btrfs: fix invalid leaf slot access in     btrfs_lookup_extent() (bnc#904077).

  - btrfs: avoid returning -ENOMEM in convert_extent_bit()     too early (bnc#902016).

  - btrfs: make find_first_extent_bit be able to cache any     state (bnc#902016).

  - btrfs: deal with convert_extent_bit errors to avoid fs     corruption (bnc#902016).

  - btrfs: be aware of btree inode write errors to avoid fs     corruption (bnc#899551).

  - btrfs: add missing end_page_writeback on     submit_extent_page failure (bnc#899551).

  - btrfs: fix crash of btrfs_release_extent_buffer_page     (bnc#899551).

  - btrfs: ensure readers see new data after a clone     operation (bnc#898234).

  - btrfs: avoid visiting all extent items when cloning a     range (bnc#898234).

  - btrfs: fix clone to deal with holes when NO_HOLES     feature is enabled (bnc#898234).

  - btrfs: make fsync work after cloning into a file     (bnc#898234).

  - btrfs: fix use-after-free when cloning a trailing file     hole (bnc#898234).

  - btrfs: clone, don't create invalid hole extent map     (bnc#898234).

  - btrfs: limit the path size in send to PATH_MAX     (bnc#897770).

  - btrfs: send, fix more issues related to directory     renames (bnc#897770).

  - btrfs: send, remove dead code from
    __get_cur_name_and_parent (bnc#897770).

  - btrfs: send, account for orphan directories when     building path strings (bnc#897770).

  - btrfs: send, avoid unnecessary inode item lookup in the     btree (bnc#897770).

  - btrfs: send, fix incorrect ref access when using extrefs     (bnc#897770).

  - btrfs: send, build path string only once in send_hole     (bnc#897770).

  - btrfs: part 2, fix incremental send's decision to delay     a dir move/rename (bnc#897770).

  - btrfs: fix incremental send's decision to delay a dir     move/rename (bnc#897770).

  - btrfs: remove unnecessary inode generation lookup in     send (bnc#897770).

  - btrfs: avoid unnecessary utimes update in incremental     send (bnc#897770).

  - btrfs: fix send issuing outdated paths for utimes, chown     and chmod (bnc#897770).

  - btrfs: fix send attempting to rmdir non-empty     directories (bnc#897770).

  - btrfs: send, don't send rmdir for same target multiple     times (bnc#897770).

  - btrfs: incremental send, fix invalid path after dir     rename (bnc#897770).

  - btrfs: fix assert screwup for the pending move stuff     (bnc#897770).

  - btrfs: make some tree searches in send.c more efficient     (bnc#897770).

  - btrfs: use right extent item position in send when     finding extent clones (bnc#897770).

  - btrfs: more send support for parent/child dir     relationship inversion (bnc#897770).

  - btrfs: fix send dealing with file renames and directory     moves (bnc#897770).

  - btrfs: add missing error check in incremental send     (bnc#897770).

  - btrfs: make send's file extent item search more     efficient (bnc#897770).

  - btrfs: fix infinite path build loops in incremental send     (bnc#897770).

  - btrfs: send, don't delay dir move if there's a new     parent inode (bnc#897770).

  - btrfs: add helper btrfs_fdatawrite_range (bnc#902010).

  - btrfs: correctly flush compressed data before/after     direct IO (bnc#902010).

  - btrfs: make inode.c:compress_file_range() return void     (bnc#902010).

  - btrfs: report error after failure inlining extent in     compressed write path (bnc#902010).

  - btrfs: don't ignore compressed bio write errors     (bnc#902010).

  - btrfs: make inode.c:submit_compressed_extents() return     void (bnc#902010).

  - btrfs: process all async extents on compressed write     failure (bnc#902010).

  - btrfs: don't leak pages and memory on compressed write     error (bnc#902010).

  - btrfs: fix hang on compressed write error (bnc#902010).

  - btrfs: set page and mapping error on compressed write     failure (bnc#902010).

  - btrfs: fix kfree on list_head in     btrfs_lookup_csums_range error cleanup (bnc#904115).

Hyper-V :

  - hyperv: Fix a bug in netvsc_send().

  - hyperv: Fix a bug in netvsc_start_xmit().

  - drivers: hv: vmbus: Enable interrupt driven flow     control.

  - drivers: hv: vmbus: Properly protect calls to     smp_processor_id().

  - drivers: hv: vmbus: Cleanup hv_post_message().

  - drivers: hv: vmbus: Cleanup vmbus_close_internal().

  - drivers: hv: vmbus: Fix a bug in vmbus_open().

  - drivers: hv: vmbus: Cleanup vmbus_establish_gpadl().

  - drivers: hv: vmbus: Cleanup vmbus_teardown_gpadl().

  - drivers: hv: vmbus: Cleanup vmbus_post_msg().

  - storvsc: get rid of overly verbose warning messages.

  - hyperv: NULL dereference on error.

  - hyperv: Increase the buffer length for     netvsc_channel_cb().

zSeries / S390 :

  - s390: pass march flag to assembly files as well     (bnc#903279, LTC#118177).

  - kernel: reduce function tracer overhead (bnc#903279,     LTC#118177).

  - SUNRPC: Handle EPIPE in xprt_connect_status     (bnc#901090).

  - SUNRPC: Ensure that we handle ENOBUFS errors correctly     (bnc#901090).

  - SUNRPC: Ensure call_connect_status() deals correctly     with SOFTCONN tasks (bnc#901090).

  - SUNRPC: Ensure that call_connect times out correctly     (bnc#901090).

  - SUNRPC: Handle connect errors ECONNABORTED and     EHOSTUNREACH (bnc#901090).

  - SUNRPC: Ensure xprt_connect_status handles all potential     connection errors (bnc#901090).

  - SUNRPC: call_connect_status should recheck bind and     connect status on error (bnc#901090).

kGraft :

  - kgr: force patching process to succeed (fate#313296).

  - kgr: usb-storage, mark kthread safe (fate#313296     bnc#899908).

  - Refresh patches.suse/kgr-0039-kgr-fix-ugly-race.patch.
    Fix few bugs, and also races (immutable vs     mark_processes vs other threads).

  - kgr: always use locked bit ops for thread_info->flags     (fate#313296).

  - kgr: lower the workqueue scheduling timeout (fate#313296     bnc#905087).

  - kgr: mark even more kthreads (fate#313296 bnc#904871).

  - rpm/kernel-binary.spec.in: Provide name-version-release     for kgraft packages (bnc#901925)

Other :

  - NFSv4: test SECINFO RPC_AUTH_GSS pseudoflavors for     support (bnc#905758).

  - Enable cmac(aes) and cmac(3des_ede) for FIPS mode     (bnc#905296 bnc#905772).

  - scsi_dh_alua: disable ALUA handling for non-disk devices     (bnc#876633).

  - powerpc/vphn: NUMA node code expects big-endian     (bsc#900126).

  - net: fix checksum features handling in     netif_skb_features() (bnc#891259).

  - be2net: Fix invocation of be_close() after be_clear()     (bnc#895468).

  - PCI: pciehp: Clear Data Link Layer State Changed during     init (bnc#898297).

  - PCI: pciehp: Use symbolic constants, not hard-coded     bitmask (bnc#898297).

  - PCI: pciehp: Use link change notifications for hot-plug     and removal (bnc#898297).

  - PCI: pciehp: Make check_link_active() non-static     (bnc#898297).

  - PCI: pciehp: Enable link state change notifications     (bnc#898297).

  - ALSA: hda - Treat zero connection as non-error     (bnc#902898).

  - bcache: add mutex lock for bch_is_open (bnc#902893).

  - futex: Fix a race condition between REQUEUE_PI and task     death (bcn #851603 (futex scalability series)).

  - Linux 3.12.31 (bnc#895983 bnc#897912).

  - futex: Ensure get_futex_key_refs() always implies a     barrier (bcn #851603 (futex scalability series)).

  - usbback: don't access request fields in shared ring more     than once.

  - Update Xen patches to 3.12.30.

  - locking/rwsem: Avoid double checking before try     acquiring write lock (Locking scalability.).

  - zcrypt: toleration of new crypto adapter hardware     (bnc#894057, LTC#117041).

  - zcrypt: support for extended number of ap domains     (bnc#894057, LTC#117041).

  - kABI: protect linux/fs.h include in mm/internal.h.

  - Linux 3.12.30 (FATE#315482 bnc#862957 bnc#863526     bnc#870498).

  - Update     patches.fixes/xfs-mark-all-internal-workqueues-as-freeza     ble.patch (bnc#899785).

  - xfs: mark all internal workqueues as freezable.

  - drm/i915: Move DP port disable to post_disable for pch     platforms (bnc#899787).

  - pagecachelimit: reduce lru_lock congestion for heavy     parallel reclaim fix (bnc#895680).

  - Linux 3.12.29 (bnc#879255 bnc#880892 bnc#887046     bnc#887418 bnc#891619 bnc#892612 bnc#892650 bnc#897101).

  - iommu/vt-d: Work around broken RMRR firmware entries     (bnc#892860).

  - iommu/vt-d: Store bus information in RMRR PCI device     path (bnc#892860).

  - iommu/vt-d: Only remove domain when device is removed     (bnc#883139).

  - driver core: Add BUS_NOTIFY_REMOVED_DEVICE event     (bnc#883139).

  - Update config files: Re-enable CONFIG_FUNCTION_PROFILER     (bnc#899489) Option FUNCTION_PROFILER was enabled in     debug and trace kernels so far, but it was accidentally     disabled before tracing features were merged into the     default kernel and the trace flavor was discarded. So     all kernels are missing the feature now. Re-enable it.

  - xfs: xlog_cil_force_lsn doesn't always wait correctly.

  - scsi: clear 'host_scribble' upon successful abort     (bnc#894863).

  - module: warn if module init + probe takes long     (bnc#889297 bnc#877622 bnc#889295 bnc#893454).

  - mm, THP: don't hold mmap_sem in khugepaged when     allocating THP (bnc#880767, VM Performance).

  - pagecache_limit: batch large nr_to_scan targets     (bnc#895221).

  - iommu/vt-d: Check return value of acpi_bus_get_device()     (bnc#903307).

  - rpm/kernel-binary.spec.in: Fix including the secure boot     cert in /etc/uefi/certs

  - sched: Reduce contention in update_cfs_rq_blocked_load()     (Scheduler/core performance).

  - x86: use optimized ioresource lookup in ioremap function     (Boot time optimisations (bnc#895387)).

  - x86: optimize resource lookups for ioremap (Boot time     optimisations (bnc#895387)).

  - usb: Do not re-read descriptors for wired devices in     usb_authorize_device() (bnc#904354).

  - netxen: Fix link event handling (bnc#873228).

  - x86, cpu: Detect more TLB configuration -xen (TLB     Performance).

  - x86/mm: Fix RCU splat from new TLB tracepoints (TLB     Performance).

  - x86/mm: Set TLB flush tunable to sane value (33) (TLB     Performance).

  - x86/mm: New tunable for single vs full TLB flush (TLB     Performance).

  - x86/mm: Add tracepoints for TLB flushes (TLB     Performance).

  - x86/mm: Unify remote INVLPG code (TLB Performance).

  - x86/mm: Fix missed global TLB flush stat (TLB     Performance).

  - x86/mm: Rip out complicated, out-of-date, buggy TLB     flushing (TLB Performance).

  - x86, cpu: Detect more TLB configuration (TLB     Performance).

  - mm, x86: Revisit tlb_flushall_shift tuning for page     flushes except on IvyBridge (TLB Performance).

  - x86/mm: Clean up the TLB flushing code (TLB     Performance).

  - mm: free compound page with correct order (VM     Functionality).

  - bnx2x: Utilize FW 7.10.51 (bnc#887382).

  - bnx2x: Remove unnecessary internal mem config     (bnc#887382).

  - rtnetlink: fix oops in     rtnl_link_get_slave_info_data_size (bnc#901774).

  - dm: do not call dm_sync_table() when creating new     devices (bnc#901809).

  - [media] uvc: Fix destruction order in uvc_delete()     (bnc#897736).

  - uas: replace WARN_ON_ONCE() with lockdep_assert_held()     (FATE#315595).

  - cxgb4/cxgb4vf: Add Devicde ID for two more adapter     (bsc#903999).

  - cxgb4/cxgb4vf: Add device ID for new adapter and remove     for dbg adapter (bsc#903999).

  - cxgb4: Adds device ID for few more Chelsio T4 Adapters     (bsc#903999).

  - cxgb4: Check if rx checksum offload is enabled, while     reading hardware calculated checksum (bsc#903999).

  - xen-pciback: drop SR-IOV VFs when PF driver unloads     (bsc#901839).

This update also includes fixes contained in the Linux 3.12.stable release series, not separately listed here.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 10 SP4 LTSS kernel was updated to receive various security and bugfixes.

The following security bugs have been fixed :

CVE-2015-2041: A information leak in the llc2_timeout_table was fixed (bnc#919007).

CVE-2014-9322: arch/x86/kernel/entry_64.S in the Linux kernel did not properly handle faults associated with the Stack Segment (SS) segment register, which allowed local users to gain privileges by triggering an IRET instruction that leads to access to a GS Base address from the wrong space (bnc#910251).

CVE-2014-9090: The do_double_fault function in arch/x86/kernel/traps.c in the Linux kernel did not properly handle faults associated with the Stack Segment (SS) segment register, which allowed local users to cause a denial of service (panic) via a modify_ldt system call, as demonstrated by sigreturn_32 in the 1-clock-tests test suite (bnc#907818).

CVE-2014-4667: The sctp_association_free function in net/sctp/associola.c in the Linux kernel did not properly manage a certain backlog value, which allowed remote attackers to cause a denial of service (socket outage) via a crafted SCTP packet (bnc#885422).

CVE-2014-3673: The SCTP implementation in the Linux kernel allowed remote attackers to cause a denial of service (system crash) via a malformed ASCONF chunk, related to net/sctp/sm_make_chunk.c and net/sctp/sm_statefuns.c (bnc#902346).

CVE-2014-3185: Multiple buffer overflows in the command_port_read_callback function in drivers/usb/serial/whiteheat.c in the Whiteheat USB Serial Driver in the Linux kernel allowed physically proximate attackers to execute arbitrary code or cause a denial of service (memory corruption and system crash) via a crafted device that provides a large amount of (1) EHCI or (2) XHCI data associated with a bulk response (bnc#896391).

CVE-2014-3184: The report_fixup functions in the HID subsystem in the Linux kernel might have allowed physically proximate attackers to cause a denial of service (out-of-bounds write) via a crafted device that provides a small report descriptor, related to (1) drivers/hid/hid-cherry.c, (2) drivers/hid/hid-kye.c, (3) drivers/hid/hid-lg.c, (4) drivers/hid/hid-monterey.c, (5) drivers/hid/hid-petalynx.c, and (6) drivers/hid/hid-sunplus.c (bnc#896390).

CVE-2014-1874: The security_context_to_sid_core function in security/selinux/ss/services.c in the Linux kernel allowed local users to cause a denial of service (system crash) by leveraging the CAP_MAC_ADMIN capability to set a zero-length security context (bnc#863335).

CVE-2014-0181: The Netlink implementation in the Linux kernel did not provide a mechanism for authorizing socket operations based on the opener of a socket, which allowed local users to bypass intended access restrictions and modify network configurations by using a Netlink socket for the (1) stdout or (2) stderr of a setuid program (bnc#875051).

CVE-2013-4299: Interpretation conflict in drivers/md/dm-snap-persistent.c in the Linux kernel allowed remote authenticated users to obtain sensitive information or modify data via a crafted mapping to a snapshot block device (bnc#846404).

CVE-2013-2147: The HP Smart Array controller disk-array driver and Compaq SMART2 controller disk-array driver in the Linux kernel did not initialize certain data structures, which allowed local users to obtain sensitive information from kernel memory via (1) a crafted IDAGETPCIINFO command for a /dev/ida device, related to the ida_locked_ioctl function in drivers/block/cpqarray.c or (2) a crafted CCISS_PASSTHRU32 command for a /dev/cciss device, related to the cciss_ioctl32_passthru function in drivers/block/cciss.c (bnc#823260).

CVE-2012-6657: The sock_setsockopt function in net/core/sock.c in the Linux kernel did not ensure that a keepalive action is associated with a stream socket, which allowed local users to cause a denial of service (system crash) by leveraging the ability to create a raw socket (bnc#896779).

CVE-2012-3400: Heap-based buffer overflow in the udf_load_logicalvol function in fs/udf/super.c in the Linux kernel allowed remote attackers to cause a denial of service (system crash) or possibly have unspecified other impact via a crafted UDF filesystem (bnc#769784).

CVE-2012-2319: Multiple buffer overflows in the hfsplus filesystem implementation in the Linux kernel allowed local users to gain privileges via a crafted HFS plus filesystem, a related issue to CVE-2009-4020 (bnc#760902).

CVE-2012-2313: The rio_ioctl function in drivers/net/ethernet/dlink/dl2k.c in the Linux kernel did not restrict access to the SIOCSMIIREG command, which allowed local users to write data to an Ethernet adapter via an ioctl call (bnc#758813).

CVE-2011-4132: The cleanup_journal_tail function in the Journaling Block Device (JBD) functionality in the Linux kernel 2.6 allowed local users to cause a denial of service (assertion error and kernel oops) via an ext3 or ext4 image with an 'invalid log first block value' (bnc#730118).

CVE-2011-4127: The Linux kernel did not properly restrict SG_IO ioctl calls, which allowed local users to bypass intended restrictions on disk read and write operations by sending a SCSI command to (1) a partition block device or (2) an LVM volume (bnc#738400).

CVE-2011-1585: The cifs_find_smb_ses function in fs/cifs/connect.c in the Linux kernel did not properly determine the associations between users and sessions, which allowed local users to bypass CIFS share authentication by leveraging a mount of a share by a different user (bnc#687812).

CVE-2011-1494: Integer overflow in the _ctl_do_mpt_command function in drivers/scsi/mpt2sas/mpt2sas_ctl.c in the Linux kernel might have allowed local users to gain privileges or cause a denial of service (memory corruption) via an ioctl call specifying a crafted value that triggers a heap-based buffer overflow (bnc#685402).

CVE-2011-1495: drivers/scsi/mpt2sas/mpt2sas_ctl.c in the Linux kernel did not validate (1) length and (2) offset values before performing memory copy operations, which might allow local users to gain privileges, cause a denial of service (memory corruption), or obtain sensitive information from kernel memory via a crafted ioctl call, related to the _ctl_do_mpt_command and _ctl_diag_read_buffer functions (bnc#685402).

CVE-2011-1493: Array index error in the rose_parse_national function in net/rose/rose_subr.c in the Linux kernel allowed remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact by composing FAC_NATIONAL_DIGIS data that specifies a large number of digipeaters, and then sending this data to a ROSE socket (bnc#681175).

CVE-2011-4913: The rose_parse_ccitt function in net/rose/rose_subr.c in the Linux kernel did not validate the FAC_CCITT_DEST_NSAP and FAC_CCITT_SRC_NSAP fields, which allowed remote attackers to (1) cause a denial of service (integer underflow, heap memory corruption, and panic) via a small length value in data sent to a ROSE socket, or (2) conduct stack-based buffer overflow attacks via a large length value in data sent to a ROSE socket (bnc#681175).

CVE-2011-4914: The ROSE protocol implementation in the Linux kernel did not verify that certain data-length values are consistent with the amount of data sent, which might allow remote attackers to obtain sensitive information from kernel memory or cause a denial of service (out-of-bounds read) via crafted data to a ROSE socket (bnc#681175).

CVE-2011-1476: Integer underflow in the Open Sound System (OSS) subsystem in the Linux kernel on unspecified non-x86 platforms allowed local users to cause a denial of service (memory corruption) by leveraging write access to /dev/sequencer (bnc#681999).

CVE-2011-1477: Multiple array index errors in sound/oss/opl3.c in the Linux kernel allowed local users to cause a denial of service (heap memory corruption) or possibly gain privileges by leveraging write access to /dev/sequencer (bnc#681999).

CVE-2011-1163: The osf_partition function in fs/partitions/osf.c in the Linux kernel did not properly handle an invalid number of partitions, which might allow local users to obtain potentially sensitive information from kernel heap memory via vectors related to partition-table parsing (bnc#679812).

CVE-2011-1090: The __nfs4_proc_set_acl function in fs/nfs/nfs4proc.c in the Linux kernel stored NFSv4 ACL data in memory that is allocated by kmalloc but not properly freed, which allowed local users to cause a denial of service (panic) via a crafted attempt to set an ACL (bnc#677286).

CVE-2014-9584: The parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel did not validate a length value in the Extensions Reference (ER) System Use Field, which allowed local users to obtain sensitive information from kernel memory via a crafted iso9660 image (bnc#912654).

CVE-2014-9420: The rock_continue function in fs/isofs/rock.c in the Linux kernel did not restrict the number of Rock Ridge continuation entries, which allowed local users to cause a denial of service (infinite loop, and system crash or hang) via a crafted iso9660 image (bnc#911325).

CVE-2014-5471: Stack consumption vulnerability in the parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel allowed local users to cause a denial of service (uncontrolled recursion, and system crash or reboot) via a crafted iso9660 image with a CL entry referring to a directory entry that has a CL entry (bnc#892490).

CVE-2014-5472: The parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel allowed local users to cause a denial of service (unkillable mount process) via a crafted iso9660 image with a self-referential CL entry (bnc#892490).

CVE-2014-3917: kernel/auditsc.c in the Linux kernel, when CONFIG_AUDITSYSCALL is enabled with certain syscall rules, allowed local users to obtain potentially sensitive single-bit values from kernel memory or cause a denial of service (OOPS) via a large value of a syscall number (bnc#880484).

CVE-2014-4652: Race condition in the tlv handler functionality in the snd_ctl_elem_user_tlv function in sound/core/control.c in the ALSA control implementation in the Linux kernel allowed local users to obtain sensitive information from kernel memory by leveraging /dev/snd/controlCX access (bnc#883795).

CVE-2014-4654: The snd_ctl_elem_add function in sound/core/control.c in the ALSA control implementation in the Linux kernel did not check authorization for SNDRV_CTL_IOCTL_ELEM_REPLACE commands, which allowed local users to remove kernel controls and cause a denial of service (use-after-free and system crash) by leveraging /dev/snd/controlCX access for an ioctl call (bnc#883795).

CVE-2014-4655: The snd_ctl_elem_add function in sound/core/control.c in the ALSA control implementation in the Linux kernel did not properly maintain the user_ctl_count value, which allowed local users to cause a denial of service (integer overflow and limit bypass) by leveraging /dev/snd/controlCX access for a large number of SNDRV_CTL_IOCTL_ELEM_REPLACE ioctl calls (bnc#883795).

CVE-2014-4653: sound/core/control.c in the ALSA control implementation in the Linux kernel did not ensure possession of a read/write lock, which allowed local users to cause a denial of service (use-after-free) and obtain sensitive information from kernel memory by leveraging /dev/snd/controlCX access (bnc#883795).

CVE-2014-4656: Multiple integer overflows in sound/core/control.c in the ALSA control implementation in the Linux kernel allowed local users to cause a denial of service by leveraging /dev/snd/controlCX access, related to (1) index values in the snd_ctl_add function and (2) numid values in the snd_ctl_remove_numid_conflict function (bnc#883795).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
83665	SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2015:0068-1)	Nessus	SuSE Local Security Checks	5/20/2015	1/6/2021	high
83723	SUSE SLES10 Security Update : kernel (SUSE-SU-2015:0812-1)	Nessus	SuSE Local Security Checks	5/20/2015	1/6/2021	high

Detections

Analytics

Plugins Search

high

high