Security update for the Linux Kernel (Live Patch 6 for SLE 15) SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2019:1581-1 Final 1 1 2019-06-20T17:18:33Z current 2019-06-20T17:18:33Z 2019-06-20T17:18:33Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for the Linux Kernel (Live Patch 6 for SLE 15) This update for the Linux Kernel 4.12.14-25_22 fixes several issues. The following security issues were fixed: - CVE-2019-3846: A flaw that allowed an attacker to corrupt memory and possibly escalate privileges was found in the mwifiex kernel module while connecting to a malicious wireless network (bsc#1136446). - CVE-2019-11477: A sequence of SACKs may have been crafted by a remote attacker such that one can trigger an integer overflow, leading to a kernel panic. (bsc#1137586). - CVE-2019-11478: It was possible to send a crafted sequence of SACKs which would fragment the TCP retransmission queue. A remote attacker may have been able to further exploit the fragmented queue to cause an expensive linked-list walk for subsequent SACKs received for that same TCP connection. (bsc#1137586) - CVE-2019-11487: The Linux kernel allowed page->_refcount reference count overflow, with resultant use-after-free issues, if about 140 GiB of RAM exists. This is related to fs/fuse/dev.c, fs/pipe.c, fs/splice.c, include/linux/mm.h, include/linux/pipe_fs_i.h, kernel/trace/trace.c, mm/gup.c, and mm/hugetlb.c. It can occur with FUSE requests (bsc#1133191). - CVE-2019-11085: Insufficient input validation in Kernel Mode Driver in Intel(R) i915 Graphics may allowed an authenticated user to potentially enable escalation of privilege via local access (bsc#1135280). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2019-1581,SUSE-SLE-Module-Live-Patching-15-2019-1579,SUSE-SLE-Module-Live-Patching-15-2019-1581,SUSE-SLE-Module-Live-Patching-15-2019-1582,SUSE-SLE-Module-Live-Patching-15-2019-1583,SUSE-SLE-Module-Live-Patching-15-2019-1584,SUSE-SLE-Module-Live-Patching-15-2019-1585,SUSE-SLE-Module-Live-Patching-15-2019-1586,SUSE-SLE-Module-Live-Patching-15-2019-1587 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2019/suse-su-20191581-1/ Link for SUSE-SU-2019:1581-1 https://lists.suse.com/pipermail/sle-security-updates/2019-June/005592.html E-Mail link for SUSE-SU-2019:1581-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1133191 SUSE Bug 1133191 https://bugzilla.suse.com/1135280 SUSE Bug 1135280 https://bugzilla.suse.com/1136446 SUSE Bug 1136446 https://bugzilla.suse.com/1136935 SUSE Bug 1136935 https://bugzilla.suse.com/1137597 SUSE Bug 1137597 https://www.suse.com/security/cve/CVE-2019-11085/ SUSE CVE CVE-2019-11085 page https://www.suse.com/security/cve/CVE-2019-11477/ SUSE CVE CVE-2019-11477 page https://www.suse.com/security/cve/CVE-2019-11478/ SUSE CVE CVE-2019-11478 page https://www.suse.com/security/cve/CVE-2019-11487/ SUSE CVE CVE-2019-11487 page https://www.suse.com/security/cve/CVE-2019-3846/ SUSE CVE CVE-2019-3846 page SUSE Linux Enterprise Live Patching 15 kernel-livepatch-4_12_14-25_3-default-10-2.1 kernel-livepatch-4_12_14-25_28-default-3-2.1 kernel-livepatch-4_12_14-25_6-default-9-2.1 kernel-livepatch-4_12_14-25_13-default-7-2.1 kernel-livepatch-4_12_14-25_16-default-6-2.1 kernel-livepatch-4_12_14-25_19-default-6-2.1 kernel-livepatch-4_12_14-25_25-default-4-2.1 kernel-livepatch-4_12_14-25_22-default-5-2.1 kernel-livepatch-4_12_14-25_28-default-3-2.1 as a component of SUSE Linux Enterprise Live Patching 15 kernel-livepatch-4_12_14-25_3-default-10-2.1 as a component of SUSE Linux Enterprise Live Patching 15 kernel-livepatch-4_12_14-25_6-default-9-2.1 as a component of SUSE Linux Enterprise Live Patching 15 kernel-livepatch-4_12_14-25_13-default-7-2.1 as a component of SUSE Linux Enterprise Live Patching 15 kernel-livepatch-4_12_14-25_16-default-6-2.1 as a component of SUSE Linux Enterprise Live Patching 15 kernel-livepatch-4_12_14-25_19-default-6-2.1 as a component of SUSE Linux Enterprise Live Patching 15 kernel-livepatch-4_12_14-25_25-default-4-2.1 as a component of SUSE Linux Enterprise Live Patching 15 kernel-livepatch-4_12_14-25_22-default-5-2.1 as a component of SUSE Linux Enterprise Live Patching 15 Insufficient input validation in Kernel Mode Driver in Intel(R) i915 Graphics for Linux before version 5.0 may allow an authenticated user to potentially enable escalation of privilege via local access. CVE-2019-11085 SUSE Linux Enterprise Live Patching 15:kernel-livepatch-4_12_14-25_13-default-7-2.1 SUSE Linux Enterprise Live Patching 15:kernel-livepatch-4_12_14-25_16-default-6-2.1 SUSE Linux Enterprise Live Patching 15:kernel-livepatch-4_12_14-25_19-default-6-2.1 SUSE Linux Enterprise Live Patching 15:kernel-livepatch-4_12_14-25_22-default-5-2.1 SUSE Linux Enterprise Live Patching 15:kernel-livepatch-4_12_14-25_25-default-4-2.1 SUSE Linux Enterprise Live Patching 15:kernel-livepatch-4_12_14-25_28-default-3-2.1 SUSE Linux Enterprise Live Patching 15:kernel-livepatch-4_12_14-25_3-default-10-2.1 SUSE Linux Enterprise Live Patching 15:kernel-livepatch-4_12_14-25_6-default-9-2.1 moderate 4.6 AV:L/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20191581-1/ https://www.suse.com/security/cve/CVE-2019-11085.html CVE-2019-11085 https://bugzilla.suse.com/1135278 SUSE Bug 1135278 https://bugzilla.suse.com/1135280 SUSE Bug 1135280 Jonathan Looney discovered that the TCP_SKB_CB(skb)->tcp_gso_segs value was subject to an integer overflow in the Linux kernel when handling TCP Selective Acknowledgments (SACKs). A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commit 3b4929f65b0d8249f19a50245cd88ed1a2f78cff. CVE-2019-11477 SUSE Linux Enterprise Live Patching 15:kernel-livepatch-4_12_14-25_13-default-7-2.1 SUSE Linux Enterprise Live Patching 15:kernel-livepatch-4_12_14-25_16-default-6-2.1 SUSE Linux Enterprise Live Patching 15:kernel-livepatch-4_12_14-25_19-default-6-2.1 SUSE Linux Enterprise Live Patching 15:kernel-livepatch-4_12_14-25_22-default-5-2.1 SUSE Linux Enterprise Live Patching 15:kernel-livepatch-4_12_14-25_25-default-4-2.1 SUSE Linux Enterprise Live Patching 15:kernel-livepatch-4_12_14-25_28-default-3-2.1 SUSE Linux Enterprise Live Patching 15:kernel-livepatch-4_12_14-25_3-default-10-2.1 SUSE Linux Enterprise Live Patching 15:kernel-livepatch-4_12_14-25_6-default-9-2.1 important 7.8 AV:N/AC:L/Au:N/C:N/I:N/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20191581-1/ https://www.suse.com/security/cve/CVE-2019-11477.html CVE-2019-11477 https://bugzilla.suse.com/1132686 SUSE Bug 1132686 https://bugzilla.suse.com/1137586 SUSE Bug 1137586 https://bugzilla.suse.com/1142129 SUSE Bug 1142129 https://bugzilla.suse.com/1153242 SUSE Bug 1153242 Jonathan Looney discovered that the TCP retransmission queue implementation in tcp_fragment in the Linux kernel could be fragmented when handling certain TCP Selective Acknowledgment (SACK) sequences. A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commit f070ef2ac66716357066b683fb0baf55f8191a2e. CVE-2019-11478 SUSE Linux Enterprise Live Patching 15:kernel-livepatch-4_12_14-25_13-default-7-2.1 SUSE Linux Enterprise Live Patching 15:kernel-livepatch-4_12_14-25_16-default-6-2.1 SUSE Linux Enterprise Live Patching 15:kernel-livepatch-4_12_14-25_19-default-6-2.1 SUSE Linux Enterprise Live Patching 15:kernel-livepatch-4_12_14-25_22-default-5-2.1 SUSE Linux Enterprise Live Patching 15:kernel-livepatch-4_12_14-25_25-default-4-2.1 SUSE Linux Enterprise Live Patching 15:kernel-livepatch-4_12_14-25_28-default-3-2.1 SUSE Linux Enterprise Live Patching 15:kernel-livepatch-4_12_14-25_3-default-10-2.1 SUSE Linux Enterprise Live Patching 15:kernel-livepatch-4_12_14-25_6-default-9-2.1 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20191581-1/ https://www.suse.com/security/cve/CVE-2019-11478.html CVE-2019-11478 https://bugzilla.suse.com/1132686 SUSE Bug 1132686 https://bugzilla.suse.com/1137586 SUSE Bug 1137586 https://bugzilla.suse.com/1142129 SUSE Bug 1142129 https://bugzilla.suse.com/1143542 SUSE Bug 1143542 The Linux kernel before 5.1-rc5 allows page->_refcount reference count overflow, with resultant use-after-free issues, if about 140 GiB of RAM exists. This is related to fs/fuse/dev.c, fs/pipe.c, fs/splice.c, include/linux/mm.h, include/linux/pipe_fs_i.h, kernel/trace/trace.c, mm/gup.c, and mm/hugetlb.c. It can occur with FUSE requests. CVE-2019-11487 SUSE Linux Enterprise Live Patching 15:kernel-livepatch-4_12_14-25_13-default-7-2.1 SUSE Linux Enterprise Live Patching 15:kernel-livepatch-4_12_14-25_16-default-6-2.1 SUSE Linux Enterprise Live Patching 15:kernel-livepatch-4_12_14-25_19-default-6-2.1 SUSE Linux Enterprise Live Patching 15:kernel-livepatch-4_12_14-25_22-default-5-2.1 SUSE Linux Enterprise Live Patching 15:kernel-livepatch-4_12_14-25_25-default-4-2.1 SUSE Linux Enterprise Live Patching 15:kernel-livepatch-4_12_14-25_28-default-3-2.1 SUSE Linux Enterprise Live Patching 15:kernel-livepatch-4_12_14-25_3-default-10-2.1 SUSE Linux Enterprise Live Patching 15:kernel-livepatch-4_12_14-25_6-default-9-2.1 moderate 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20191581-1/ https://www.suse.com/security/cve/CVE-2019-11487.html CVE-2019-11487 https://bugzilla.suse.com/1133190 SUSE Bug 1133190 https://bugzilla.suse.com/1133191 SUSE Bug 1133191 A flaw that allowed an attacker to corrupt memory and possibly escalate privileges was found in the mwifiex kernel module while connecting to a malicious wireless network. CVE-2019-3846 SUSE Linux Enterprise Live Patching 15:kernel-livepatch-4_12_14-25_13-default-7-2.1 SUSE Linux Enterprise Live Patching 15:kernel-livepatch-4_12_14-25_16-default-6-2.1 SUSE Linux Enterprise Live Patching 15:kernel-livepatch-4_12_14-25_19-default-6-2.1 SUSE Linux Enterprise Live Patching 15:kernel-livepatch-4_12_14-25_22-default-5-2.1 SUSE Linux Enterprise Live Patching 15:kernel-livepatch-4_12_14-25_25-default-4-2.1 SUSE Linux Enterprise Live Patching 15:kernel-livepatch-4_12_14-25_28-default-3-2.1 SUSE Linux Enterprise Live Patching 15:kernel-livepatch-4_12_14-25_3-default-10-2.1 SUSE Linux Enterprise Live Patching 15:kernel-livepatch-4_12_14-25_6-default-9-2.1 moderate 8.3 AV:A/AC:L/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20191581-1/ https://www.suse.com/security/cve/CVE-2019-3846.html CVE-2019-3846 https://bugzilla.suse.com/1136424 SUSE Bug 1136424 https://bugzilla.suse.com/1136446 SUSE Bug 1136446 https://bugzilla.suse.com/1156330 SUSE Bug 1156330