SUSE-SU-2016:3304-1

The SUSE Linux Enterprise 12 SP1 RT kernel was updated to 3.12.67 to receive various security and bugfixes.

This feature was added:

• fate#320805: Execute in place (XIP) support for the ext2 filesystem.

The following security bugs were fixed:

• CVE-2016-2069: Race condition in arch/x86/mm/tlb.c in the Linux kernel allowed local users to gain privileges by triggering access to a paging structure by a different CPU (bnc#963767).
• CVE-2016-4998: The IPTSOSET_REPLACE setsockopt implementation in the netfilter subsystem in the Linux kernel allowed local users to cause a denial of service (out-of-bounds read) or possibly obtain sensitive information from kernel heap memory by leveraging in-container root access to provide a crafted offset value that leads to crossing a ruleset blob boundary (bnc#986362).
• CVE-2016-5195: A local privilege escalation using MAP_PRIVATE was fixed, which is reportedly exploited in the wild (bsc#1004418).
• CVE-2016-5696: net/ipv4/tcp_input.c in the Linux kernel did not properly determine the rate of challenge ACK segments, which made it easier for man-in-the-middle attackers to hijack TCP sessions via a blind in-window attack (bnc#989152)
• CVE-2016-6130: Race condition in the sclpctlioctlsccb function in drivers/s390/char/sclpctl.c in the Linux kernel allowed local users to obtain sensitive information from kernel memory by changing a certain length value, aka a 'double fetch' vulnerability (bnc#987542)
• CVE-2016-6327: System using the infiniband support module ibsrpt were vulnerable to a denial of service by system crash by a local attacker who is able to abort writes by sending the ABORTTASK command (bsc#994758)
• CVE-2016-6480: Race condition in the ioctlsendfib function in drivers/scsi/aacraid/commctrl.c in the Linux kernel allowed local users to cause a denial of service (out-of-bounds access or system crash) by changing a certain size value, aka a 'double fetch' vulnerability (bnc#991608)
• CVE-2016-6828: Use after free 4 in tcpxmitretransmitqueue or other tcp functions (bsc#994296)
• CVE-2016-7042: The prockeysshow function in security/keys/proc.c in the Linux kernel used an incorrect buffer size for certain timeout data, which allowed local users to cause a denial of service (stack memory corruption and panic) by reading the /proc/keys file (bsc#1004517).
• CVE-2016-7097: The filesystem implementation in the Linux kernel preserved the setgid bit during a setxattr call, which allowed local users to gain group privileges by leveraging the existence of a setgid program with restrictions on execute permissions (bsc#995968).
• CVE-2016-7425: A buffer overflow in the Linux Kernel in arcmsriopmessage_xfer() could have caused kernel heap corruption and arbitraty kernel code execution (bsc#999932)
• CVE-2016-8658: Stack-based buffer overflow in the brcmfcfg80211start_ap function in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux kernel allowed local users to cause a denial of service (system crash) or possibly have unspecified other impact via a long SSID Information Element in a command to a Netlink socket (bsc#1004462).

The following non-security bugs were fixed:

• aacraid: Fix RRQ overload (bsc#1003079).
• acpi / PM: Ignore wakeup setting if the ACPI companion can't wake up.
• AFVSOCK: Shrink the area influenced by prepareto_wait (bsc#994520).
• apparmor: add missing id bounds check on dfa verification (bsc#1000304).
• apparmor: check that xindex is in trans_table bounds (bsc#1000304).
• apparmor: do not expose kernel stack (bsc#1000304).
• apparmor: don't check for vmalloc_addr if kvzalloc() failed (bsc#1000304).
• apparmor: ensure the target profile name is always audited (bsc#1000304).
• apparmor: exec should not be returning ENOENT when it denies (bsc#1000304).
• apparmor: fix arg_size computation for when setprocattr is null terminated (bsc#1000304).
• apparmor: fix audit full profile hname on successful load (bsc#1000304).
• apparmor: fix change_hat not finding hat after policy replacement (bsc#1000287).
• apparmor: fix disconnected bind mnts reconnection (bsc#1000304).
• apparmor: fix log failures for all profiles in a set (bsc#1000304).
• apparmor: fix module parameters can be changed after policy is locked (bsc#1000304).
• apparmor: fix oops in profileunpack() when policydb is not present (bsc#1000304).
• apparmor: fix oops, validate buffer size in apparmor_setprocattr() (bsc#1000304).
• apparmor: fix put() parent ref after updating the active ref (bsc#1000304).
• apparmor: fix refcount bug in profile replacement (bsc#1000304).
• apparmor: fix refcount race when finding a child profile (bsc#1000304).
• apparmor: fix replacement bug that adds new child to old parent (bsc#1000304).
• apparmor: fix uninitialized lsm_audit member (bsc#1000304).
• apparmor: fix update the mtime of the profile file on replacement (bsc#1000304).
• apparmor: internal paths should be treated as disconnected (bsc#1000304).
• apparmor: use listnextentry instead of listentrynext (bsc#1000304).
• arm64: Ensure pmdpresent() returns false after pmdmknotpresent() (Automatic NUMA Balancing).
• avoid dentry crash triggered by NFS (bsc#984194).
• be2net: Don't leak iomapped memory on removal (bsc#921784 FATE#318561).
• be2net: fix BE3-R FW download compatibility check (bsc#921784 FATE#318561).
• be2net: fix wrong return value in becheckufi_compatibility() (bsc#921784 FATE#318561).
• be2net: remove vlan promisc capability from VF's profile descriptors (bsc#921784 FATE#318561).
• blkfront: fix an error path memory leak (luckily none so far).
• blk-mq: fix undefined behaviour in ordertosize().
• blktap2: eliminate deadlock potential from shutdown path (bsc#909994).
• blktap2: eliminate race from deferred work queue handling (bsc#911687).
• bluetooth: Fix potential NULL dereference in RFCOMM bind callback (bsc#1003925, CVE-2015-8956).
• bond: Check length of IFLABONDARPIPTARGET attributes.
• bonding: always set recvprobe to bondarp_rcv in arp monitor (bsc#977687).
• bonding: fix curractiveslave/carrier with loadbalance arp monitoring.
• bonding: Prevent IPv6 link local address on enslaved devices.
• bonding: prevent out of bound accesses.
• bonding: set carrier off for devices created through netlink (bsc#999577).
• btrfs: account for non-CoW'd blocks in btrfsaborttransaction (bsc#983619).
• btrfs: add missing discards when unpinning extents with -o discard (bsc#904489).
• btrfs: btrfsissuediscard ensure offset/length are aligned to sector boundaries (bsc#904489).
• btrfs: Disable btrfs-8448-improve-performance-on-fsync-against-new-inode.patch (bsc#981597).
• btrfs: do not create or leak aliased root while cleaning up orphans (bsc#904489).
• btrfs: ensure that file descriptor used with subvol ioctls is a dir (bsc#999600).
• btrfs: explictly delete unused block groups in close_ctree and ro-remount (bsc#904489).
• btrfs: Fix a data space underflow warning (bsc#985562, bsc#975596, bsc#984779)
• btrfs: fix fitrim discarding device area reserved for boot loader's use (bsc#904489).
• btrfs: handle quota reserve failure properly (bsc#1005666).
• btrfs: iterate over unused chunk space in FITRIM (bsc#904489).
• btrfs: make btrfsissuediscard return bytes discarded (bsc#904489).
• btrfs: properly track when rescan worker is running (bsc#989953).
• btrfs: remove unnecessary locking of cleaner_mutex to avoid deadlock (bsc#904489).
• btrfs: skip superblocks during discard (bsc#904489).
• btrfs: testcheckexists: Fix infinite loop when searching for free space entries (bsc#987192).
• btrfs: waiting on qgroup rescan should not always be interruptible (bsc#992712).
• cdc-acm: added sanity checking for probe() (bsc#993891).
• cephfs: ignore error from invalidateinodepages2_range() in direct write (bsc#995153).
• cephfs: remove warning when ceph_releasepage() is called on dirty page (bsc#995153).
• ceph: Refresh patches.suse/CFS-0259-ceph-Asynchronous-IO-support.patch. After a write, we must free the 'request', not the 'response' (bsc#995153).
• clockevents: export clockeventsunbinddevice instead of clockevents_unbind (bnc#937888).
• conntrack: RFC5961 challenge ACK confuse conntrack LAST-ACK transition (bsc#966864).
• cxgbi: fix uninitialized flowi6 (bsc#924384 FATE#318570 bsc#921338).
• dm: fix AB-BA deadlock in _dmdestroy(). (bsc#970943)
• efi: Small leak on error in runtime map code (fate#315019).
• ext2: Enable ext2 driver in config files (bsc#976195).
• ext4: Add parameter for tuning handling of ext2 (bsc#976195).
• Fix kabi change cause by adding flockowner to opencontext (bsc#998689).
• fix xfs-handle-dquot-buffer-readahead-in-log-recovery-co.patch (bsc#1003153).
• fs/cifs: fix wrongly prefixed path to root (bsc#963655, bsc#979681)
• fs/select: add vmalloc fallback for select(2) (bsc#1000189).
• ftrace/x86: Set ftrace_stub to weak to prevent gcc from using short jumps to it (bsc#984419).
• hyperv: enable call to clockeventsunbinddevice in kexec/kdump path
• hyperv: replace KEXEC_CORE by plain KEXEC because we lack 2965faa5e0 in the base kernel
• i40e: fix an uninitialized variable bug (bnc#857397 FATE#315659).
• ib/iwpm: Fix a potential skb leak (bsc#924381 FATE#318568 bsc#921338).
• ib/mlx5: Fix RC transport send queue overhead computation (bnc#865545 FATE#316891).
• introduce NETIFFGSOENCAPALL helper mask (bsc#1001486).
• iommu/amd: Update Alias-DTE in updatedevicetable() (bsc#975772).
• ipv6: Fix improper use or RCU in patches.kabi/ipv6-add-complete-rcu-protection-around-np-opt.kabi.patch. (bsc#961257).
• ipv6: fix multipath route replace error recovery (bsc#930399).
• ipv6: send NEWLINK on RA managed/otherconf changes (bsc#934067).
• ipv6: send only one NEWLINK when RA causes changes (bsc#934067).
• iscsi: Add a missed complete in iscsitcloseconnection (bsc#992555, bsc#987805).
• kabi: work around kabi changes from commit 53f9ff48f636 (bsc#988617).
• kaweth: fix firmware download (bsc#993890).
• kaweth: fix oops upon failed memory allocation (bsc#993890).
• kernel/fork: fix CLONECHILDCLEARTID regression in nscd (bnc#941420).
• kernel/printk: fix faulty logic in the case of recursive printk (bnc#744692, bnc#789311).
• kvm: do not handle APIC access page if in-kernel irqchip is not in use (bsc#959463).
• kvm: vmx: defer load of APIC access page address during reset (bsc#959463).
• libceph: enable large, variable-sized OSD requests (bsc#988715).
• libceph: make rrequest msgsize calculation clearer (bsc#988715).
• libceph: move rreplyop{len,result} into struct cephosdreqop (bsc#988715).
• libceph: osdc->req_mempool should be backed by a slab pool (bsc#988715).
• libceph: rename cephosdreqop::payloadlen to indata_len (bsc#988715).
• libfc: do not send ABTS when resetting exchanges (bsc#962846).
• libfc: Do not take rdata->rpmutex when processing a -FCEX_CLOSED ELS response (bsc#962846).
• libfc: Fixup disc_mutex handling (bsc#962846).
• libfc: fixup locking of ptp_setup() (bsc#962846).
• libfc: Issue PRLI after a PRLO has been received (bsc#962846).
• libfc: reset exchange manager during LOGO handling (bsc#962846).
• libfc: Revisit kref handling (bnc#990245).
• libfc: sanity check cpu number extracted from xid (bsc#988440).
• libfc: send LOGO for PLOGI failure (bsc#962846).
• md: check command validity early in md_ioctl() (bsc#1004520).
• md: Drop sending a change uevent when stopping (bsc#1003568).
• md: lockless I/O submission for RAID1 (bsc#982783).
• md/raid5: fix a recently broken BUG_ON() (bsc#1006691).
• mm, cma: prevent nrisolated* counters from going negative (bnc#971975).
• mm: thp: fix SMP race condition between THP page fault and MADV_DONTNEED (VM Functionality, bnc#986445).
• module: Issue warnings when tainting kernel (bsc#974406).
• mpt2sas, mpt3sas: Fix panic when aer correct error occurred (bsc#997708).
• mpt3sas: Update patches.drivers/mpt3sas-Fix-use-sasistlr_enabled-API-before-enabli.patch (bsc#967640, bsc#992244).
• msi-x: fix an error path (luckily none so far).
• netback: fix flipping mode (bsc#996664).
• netback: fix refounting (bsc#978094).
• netfront: don't truncate grant references.
• netfront: use correct linear area after linearizing an skb (bsc#1007886).
• nfs4: reset states to use open_stateid when returning delegation voluntarily (bsc#1003400).
• nfs: Add a stub for GETDEVICELIST (bnc#898675).
• nfs: Do not write enable new pages while an invalidation is proceeding (bsc#999584).
• nfsd: Use free_conn to free connection (bsc#979451).
• nfs: Fix an LOCK/OPEN race when unlinking an open file (bsc#956514).
• nfs: Fix a regression in the read() syscall (bsc#999584).
• nfs: fix BUG() crash in notifychange() with patch to chowncommon() (bnc#876463).
• nfs: fix pg_test page count calculation (bnc#898675).
• nfs: nfs4flprepare_ds must be careful about reporting success (bsc#1000776).
• nfsv4: add flock_owner to open context (bnc#998689).
• nfsv4: change nfs4dosetattr to take an opencontext instead of a nfs4state (bnc#998689).
• nfsv4: change nfs4selectrwstateid to take a lockcontext inplace of lock_owner (bnc#998689).
• nfsv4: enhance nfs4copylock_stateid to use a flock stateid if there is one (bnc#998689).
• nfsv4: Ensure nfsatomicopen set the dentry verifier on ENOENT (bnc#866130).
• oops on restarting network with bonding mode4 (lacp) (bsc#876145).
• packet: tpacket_snd(): fix signed/unsigned comparison (bsc#874131).
• perf/x86/intel: Fix bug for 'cycles:p' and 'cycles:pp' on SLM (bsc#997896).
• PM / hibernate: Fix 2G size issue of snapshot image verification (bsc#1004252).
• PM / hibernate: Fix rtreenextnode() to avoid walking off list ends (bnc#860441).
• powerpc: add kernel parameter iommuallocquiet (bsc#998825).
• ppp: defer netns reference release for ppp channel (bsc#980371).
• printk: add kernel parameter to control writes to /dev/kmsg (bsc#979928).
• qgroup: Prevent qgroup->reserved from going subzero (bsc#993841).
• qlcnic: potential NULL dereference in qlcnic83xxgetminidumptemplate() (bsc#922064 FATE#318609)
• radeon: avoid boot hang in Xen Dom0 (luckily none so far).
• ratelimit: extend to print suppressed messages on release (bsc#979928).
• ratelimit: fix bug in time interval by resetting right begin time (bsc#979928).
• rbd: truncate objects on cmpext short reads (bsc#988715).
• Revert 'Input: i8042 - break load dependency between atkbd/psmouse and i8042'.
• Revert 'Input: i8042 - set up shared ps2cmdmutex for AUX ports'.
• rpm/mkspec: Read a default release string from rpm/config.sh (bsc997059)
• rtnetlink: avoid 0 sized arrays.
• RTNL: assertion failed at dev.c (bsc#875631).
• s390: add SMT support (bnc#994438).
• sched/core: Fix an SMP ordering race in trytowake_up() vs. schedule() (bnc#1001419).
• sched/core: Fix a race between trytowake_up() and a woken up task (bsc#1002165, bsc#1001419).
• scsi: ibmvfc: add FC Class 3 Error Recovery support (bsc#984992).
• scsi: ibmvfc: Fix I/O hang when port is not mapped (bsc#971989)
• scsi: ibmvfc: Set READ FCPXFERREADY DISABLED bit in PRLI (bsc#984992).
• sd: Fix memory leak caused by RESET_WP patch (bsc#999779).
• squashfs3: properly handle dir_emit() failures (bsc#998795).
• SUNRPC: Add missing support for RPCCLNTCREATENORETRANS_TIMEOUT (bnc#868923).
• SUNRPC: Fix a regression when reconnecting (bsc#946309).
• supported.conf: Add ext2
• supported.conf: Add iscsi modules to -base (bsc#997299)
• supported.conf: Add tun to -base (bsc#992593)
• supported.conf: Add veth to -base (bsc#992591)
• target: Fix missing complete during ABORTTASK + CMDTFABRICSTOP (bsc#987621).
• target: Fix race between iscsi-target connection shutdown + ABORT_TASK (bsc#987621).
• tcp: add proper TS val into RST packets (bsc#937086).
• tcp: align tcpxmitsizegoal() on tcptso_autosize() (bsc#937086).
• tcp: fix child sockets to use system default congestion control if not set.
• tcp: fix cwnd limited checking to improve congestion control (bsc#988617).
• tcp: refresh skb timestamp at retransmit time (bsc#937086).
• timers: Use proper base migration in addtimeron() (bnc#993392).
• tunnels: Do not apply GRO to multiple layers of encapsulation (bsc#1001486).
• tunnels: Remove encapsulation offloads on decap (bsc#1001486).
• usb: fix typo in wMaxPacketSize validation (bsc#991665).
• usbhid: add ATEN CS962 to list of quirky devices (bsc#1007615).
• usb: hub: Fix auto-remount of safely removed or ejected USB-3 devices (bsc#922634).
• usb: validate wMaxPacketValue entries in endpoint descriptors (bnc#991665).
• vmxnet3: Wake queue from reset work (bsc#999907).
• x86: Removed the free memblock of hibernat keys to avoid memory corruption (bsc#990058).
• x86/tlb/trace: Do not trace on CPU that is offline (TLB Performance git-fixes).
• xenbus: don't invoke ->is_ready() for most device states (bsc#987333).
• xenbus: inspect the correct type in xenbusdevrequestandreply().
• xen/pciback: Fix conf_space read/write overlap check.
• xen-pciback: return proper values during BAR sizing.
• xen: x86/mm/pat, /dev/mem: Remove superfluous error message (bsc#974620).
• xfs: fixed signedness of error code in xfsinodebuf_verify (bsc#1003153).
• xfs: handle dquot buffer readahead in log recovery correctly (bsc#955446).
• xfs: Silence warnings in xfsvmreleasepage() (bnc#915183 bsc#987565).
• xhci: Check if slot is already in default state before moving it there (FATE#315518).
• xhci: silence warnings in switch (bnc#991665).