Security update for the Linux Kernel (Live Patch 27 for SLE 12 SP3) SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2019:3228-1 Final 1 1 2019-12-10T09:15:51Z current 2019-12-10T09:15:51Z 2019-12-10T09:15:51Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for the Linux Kernel (Live Patch 27 for SLE 12 SP3) This update for the Linux Kernel 4.4.180-94_100 fixes several issues. The following security issues were fixed: - CVE-2018-20856: Fixed a use-after-free in __blk_drain_queue() due to an improper error handling (bsc#1156331). - CVE-2019-13272: Fixed a privilege escalation from user to root due to improper handling of credentials by leveraging certain scenarios with a parent-child process relationship (bsc#1156321). - CVE-2019-15239: Fixed a vulnerability where a local attacker could have triggered multiple use-after-free conditions resulted in privilege escalation (bsc#1156317). - CVE-2019-10220: Fixed an issue where samba servers could inject relative paths in directory entry lists (bsc#1153108). The following bugs were fixed: - Fixed boot up hang revealed by int3 self test (bsc#1157770). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2019-3228,SUSE-SLE-SAP-12-SP3-2019-3228,SUSE-SLE-SAP-12-SP3-2019-3229,SUSE-SLE-SERVER-12-SP3-2019-3228,SUSE-SLE-SERVER-12-SP3-2019-3229 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2019/suse-su-20193228-1/ Link for SUSE-SU-2019:3228-1 https://lists.suse.com/pipermail/sle-security-updates/2019-December/006229.html E-Mail link for SUSE-SU-2019:3228-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1153108 SUSE Bug 1153108 https://bugzilla.suse.com/1156317 SUSE Bug 1156317 https://bugzilla.suse.com/1156321 SUSE Bug 1156321 https://bugzilla.suse.com/1156331 SUSE Bug 1156331 https://bugzilla.suse.com/1157770 SUSE Bug 1157770 https://www.suse.com/security/cve/CVE-2018-20856/ SUSE CVE CVE-2018-20856 page https://www.suse.com/security/cve/CVE-2019-10220/ SUSE CVE CVE-2019-10220 page https://www.suse.com/security/cve/CVE-2019-13272/ SUSE CVE CVE-2019-13272 page https://www.suse.com/security/cve/CVE-2019-15239/ SUSE CVE CVE-2019-15239 page SUSE Linux Enterprise Server 12 SP3-LTSS SUSE Linux Enterprise Server for SAP Applications 12 SP3 kgraft-patch-4_4_180-94_97-default-6-2.1 kgraft-patch-4_4_180-94_100-default-4-2.1 kgraft-patch-4_4_180-94_97-default-6-2.1 as a component of SUSE Linux Enterprise Server 12 SP3-LTSS kgraft-patch-4_4_180-94_100-default-4-2.1 as a component of SUSE Linux Enterprise Server 12 SP3-LTSS kgraft-patch-4_4_180-94_97-default-6-2.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 kgraft-patch-4_4_180-94_100-default-4-2.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 An issue was discovered in the Linux kernel before 4.18.7. In block/blk-core.c, there is an __blk_drain_queue() use-after-free because a certain error case is mishandled. CVE-2018-20856 SUSE Linux Enterprise Server 12 SP3-LTSS:kgraft-patch-4_4_180-94_100-default-4-2.1 SUSE Linux Enterprise Server 12 SP3-LTSS:kgraft-patch-4_4_180-94_97-default-6-2.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:kgraft-patch-4_4_180-94_100-default-4-2.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:kgraft-patch-4_4_180-94_97-default-6-2.1 important 4.6 AV:L/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20193228-1/ https://www.suse.com/security/cve/CVE-2018-20856.html CVE-2018-20856 https://bugzilla.suse.com/1143048 SUSE Bug 1143048 https://bugzilla.suse.com/1156331 SUSE Bug 1156331 Linux kernel CIFS implementation, version 4.9.0 is vulnerable to a relative paths injection in directory entry lists. CVE-2019-10220 SUSE Linux Enterprise Server 12 SP3-LTSS:kgraft-patch-4_4_180-94_100-default-4-2.1 SUSE Linux Enterprise Server 12 SP3-LTSS:kgraft-patch-4_4_180-94_97-default-6-2.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:kgraft-patch-4_4_180-94_100-default-4-2.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:kgraft-patch-4_4_180-94_97-default-6-2.1 moderate 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20193228-1/ https://www.suse.com/security/cve/CVE-2019-10220.html CVE-2019-10220 https://bugzilla.suse.com/1144903 SUSE Bug 1144903 https://bugzilla.suse.com/1153108 SUSE Bug 1153108 In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker). One contributing factor is an object lifetime issue (which can also cause a panic). Another contributing factor is incorrect marking of a ptrace relationship as privileged, which is exploitable through (for example) Polkit's pkexec helper with PTRACE_TRACEME. NOTE: SELinux deny_ptrace might be a usable workaround in some environments. CVE-2019-13272 SUSE Linux Enterprise Server 12 SP3-LTSS:kgraft-patch-4_4_180-94_100-default-4-2.1 SUSE Linux Enterprise Server 12 SP3-LTSS:kgraft-patch-4_4_180-94_97-default-6-2.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:kgraft-patch-4_4_180-94_100-default-4-2.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:kgraft-patch-4_4_180-94_97-default-6-2.1 moderate 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20193228-1/ https://www.suse.com/security/cve/CVE-2019-13272.html CVE-2019-13272 https://bugzilla.suse.com/1140671 SUSE Bug 1140671 https://bugzilla.suse.com/1156321 SUSE Bug 1156321 https://bugzilla.suse.com/1198122 SUSE Bug 1198122 In the Linux kernel, a certain net/ipv4/tcp_output.c change, which was properly incorporated into 4.16.12, was incorrectly backported to the earlier longterm kernels, introducing a new vulnerability that was potentially more severe than the issue that was intended to be fixed by backporting. Specifically, by adding to a write queue between disconnection and re-connection, a local attacker can trigger multiple use-after-free conditions. This can result in a kernel crash, or potentially in privilege escalation. NOTE: this affects (for example) Linux distributions that use 4.9.x longterm kernels before 4.9.190 or 4.14.x longterm kernels before 4.14.139. CVE-2019-15239 SUSE Linux Enterprise Server 12 SP3-LTSS:kgraft-patch-4_4_180-94_100-default-4-2.1 SUSE Linux Enterprise Server 12 SP3-LTSS:kgraft-patch-4_4_180-94_97-default-6-2.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:kgraft-patch-4_4_180-94_100-default-4-2.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:kgraft-patch-4_4_180-94_97-default-6-2.1 moderate 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20193228-1/ https://www.suse.com/security/cve/CVE-2019-15239.html CVE-2019-15239 https://bugzilla.suse.com/1146589 SUSE Bug 1146589 https://bugzilla.suse.com/1156317 SUSE Bug 1156317