SUSE-SU-2018:1173-2

The SUSE Linux Enterprise 12 SP2 LTSS kernel was updated to 4.4.121 to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-8781: The udlfbmmap function in drivers/gpu/drm/udl/udl_fb.c had an integer-overflow vulnerability that allowed local users with access to the udldrmfb driver to obtain full read and write permissions on kernel physical pages, resulting in a code execution in kernel space (bnc#1090643).
• CVE-2018-10124: The killsomethinginfo function in kernel/signal.c might have allowed local users to cause a denial of service via an INT_MIN argument (bnc#1089752).
• CVE-2018-10087: The kernelwait4 function in kernel/exit.c might have allowed local users to cause a denial of service by triggering an attempted use of the -INTMIN value (bnc#1089608).
• CVE-2017-18257: The _getdatablock function in fs/f2fs/data.c in the Linux kernel allowed local users to cause a denial of service (integer overflow and loop) via crafted use of the open and fallocate system calls with an FSIOC_FIEMAP ioctl. (bnc#1088241)
• CVE-2018-8822: Incorrect buffer length handling in the ncpreadkernel function in fs/ncpfs/ncplib_kernel.c could be exploited by malicious NCPFS servers to crash the kernel or execute code (bnc#1086162).
• CVE-2018-8043: The unimacmdioprobe function in drivers/net/phy/mdio-bcm-unimac.c did not validate certain resource availability, which allowed local users to cause a denial of service (NULL pointer dereference) (bnc#1084829).
• CVE-2018-7740: The resvmaprelease function in mm/hugetlb.c allowed local users to cause a denial of service (BUG) via a crafted application that made mmap system calls and has a large pgoff argument to the remapfilepages system call (bnc#1084353).
• CVE-2018-1087: And an unprivileged KVM guest user could use this flaw to potentially escalate their privileges inside a guest. (bsc#1087088)
• CVE-2018-8897: An unprivileged system user could use incorrect set up interrupt stacks to crash the Linux kernel resulting in DoS issue. (bsc#1087088)

The following non-security bugs were fixed:

• alsa: hda/realtek - Fix speaker no sound after system resume (bsc#1031717).
• alsa: hda: Add a power_save blacklist (bnc#1012382).
• alsa: usb-audio: Add a quirck for B&W PX headphones (bnc#1012382).
• arm: dts: LogicPD Torpedo: Fix I2C1 pinmux (bnc#1012382).
• arm: mvebu: Fix broken PL310ERRATA753970 selects (bnc#1012382).
• kvm: mmu: Fix overlap between public and private memslots (bnc#1012382).
• Partial revert 'e1000e: Avoid receiver overrun interrupt bursts' (bsc#1075428).
• Revert 'e1000e: Separate signaling for link check/link up' (bsc#1075428).
• Revert 'led: core: Fix brightness setting when setting delay_off=0' (bnc#1012382).
• Revert 'watchdog: hpwdt: Remove legacy NMI sourcing (bsc#1085185).' This reverts commit 5d4a2355a2a1c2ec6fdf9d18b68ca0a04ff73c70.
• bpf, x64: implement retpoline for tail call (bnc#1012382).
• bridge: check brport attr show in brport_show (bnc#1012382).
• btrfs: Only check first key for committed tree blocks (bsc#1084721).
• btrfs: Validate child tree block's level and first key (bsc#1084721).
• btrfs: preserve imode if _btrfssetacl() fails (bnc#1012382).
• ch9200: use skbcowhead() to deal with cloned skbs (bsc#1088684).
• cpufreq: s3c24xx: Fix broken s3ccpufreqinit() (bnc#1012382).
• dcache: Add condresched in shrinkdentry_list (bsc#1086194).
• dm io: fix duplicate bio completion due to missing ref count (bnc#1012382).
• drm/i915/cmdparser: Do not check past the cmd length (bsc#1031717).
• drm/i915/psr: Check for the specific AUXFRAMESYNC cap bit (bsc#1031717).
• e1000e: Avoid missed interrupts following ICR read (bsc#1075428).
• e1000e: Avoid receiver overrun interrupt bursts (bsc#1075428).
• e1000e: Fix checkforlink return value with autoneg off (bsc#1075428).
• e1000e: Fix link check race condition (bsc#1075428).
• e1000e: Fix queue interrupt re-raising in Other interrupt (bsc#1075428).
• e1000e: Remove Other from EIAC (bsc#1075428).
• fib_semantics: Do not match route with mismatching tclassid (bnc#1012382).
• fs/hugetlbfs/inode.c: change putpage/unlockpage order in hugetlbfs_fallocate() (git-fixes, bsc#1083745).
• hdlc_ppp: carrier detect ok, do not turn off negotiation (bnc#1012382).
• hugetlbfs: fix offset overflow in hugetlbfs mmap (bnc#1084353).
• ibmvfc: Avoid unnecessary port relogin (bsc#1085404).
• ibmvnic: Clear pending interrupt after device reset (bsc#1089644).
• ibmvnic: Define vnicloginclient_data name field as unsized array (bsc#1089198).
• ibmvnic: Disable irqs before exiting reset from closed state (bsc#1084610).
• ibmvnic: Do not notify peers on parameter change resets (bsc#1089198).
• ibmvnic: Do not reset CRQ for Mobility driver resets (bsc#1088600).
• ibmvnic: Fix DMA mapping mistakes (bsc#1088600).
• ibmvnic: Fix failover case for non-redundant configuration (bsc#1088600).
• ibmvnic: Fix reset return from closed state (bsc#1084610).
• ibmvnic: Fix reset scheduler error handling (bsc#1088600).
• ibmvnic: Handle all login error conditions (bsc#1089198).
• ibmvnic: Potential NULL dereference in cleanonetx_pool() (bsc#1085224, git-fixes).
• ibmvnic: Remove unused TSO resources in TX pool structure (bsc#1085224).
• ibmvnic: Update TX pool cleaning routine (bsc#1085224).
• ibmvnic: Zero used TX descriptor counter on reset (bsc#1088600).
• ipv6 sit: work around bogus gcc-8 -Wrestrict warning (bnc#1012382).
• kGraft: fix small race in reversion code (bsc#1083125).
• kabi/severities: Ignore kgrshadow* kABI changes
• kvm/x86: fix icebp instruction handling (bnc#1012382).
• livepatch: Allow to call a custom callback when freeing shadow variables (bsc#1082299 fate#313296).
• livepatch: Initialize shadow variables safely by a custom callback (bsc#1082299 fate#313296).
• mac80211: do not WARN on bad WMM parameters from buggy APs (bsc#1031717).
• md-cluster: fix wrong condition check in raid1writerequest (bsc#1085402).
• media: au0828: fix VIDEO_V4L2 dependency (bsc#1031717).
• media: cx25821: prevent out-of-bounds read on array card (bsc#1031717).
• media: m88ds3103: do not call a non-initalized function (bnc#1012382).
• media: s3c-camif: fix out-of-bounds array access (bsc#1031717).
• mm/hugetlb.c: do not call regionabort if regionchg fails (bnc#1084353).
• mpls, nospec: Sanitize array index in mplslabelok() (bnc#1012382).
• net: fix race on decreasing number of TX queues (bnc#1012382).
• net: ipv4: avoid unused variable warning for sysctl (git-fixes).
• net: ipv4: do not allow setting net.ipv4.route.min_pmtu below 68 (bnc#1012382).
• net: mpls: Pull common label check into helper (bnc#1012382).
• netlink: ensure to loop over all netns in genlmsgmulticastallns() (bnc#1012382).
• nospec: Allow index argument to have const-qualified type (bnc#1012382).
• perf/x86/intel: Add model number for Skylake Server to perf (FATE#321269).
• powerpc/crash: Remove the test for cpu_online in the IPI callback (bsc#1088242).
• powerpc: Do not send system reset request through the oops path (bsc#1088242).
• powerpc: System reset avoid interleaving oops using die synchronisation (bsc#1088242).
• ppp: prevent unregistered channels from connecting to PPP units (bnc#1012382).
• regmap-i2c: Off by one in regmapi2csmbusi2cread/write() (bsc#1031717).
• regmap: Do not use formatval in regmapbulk_read (bsc#1031717).
• regmap: Fix reversed bounds check in regmaprawwrite() (bsc#1031717).
• regmap: Format data for raw write in regmapbulkwrite (bsc#1031717).
• rpm/config.sh: ensure sorted patches.
• s390/cpuinfo: show facilities as reported by stfle (bnc#1076847, LTC#163740).
• s390/qeth: fix IPA command submission race (bnc#1012382).
• s390/qeth: fix SETIP command handling (bnc#1012382).
• sctp: fix dst refcnt leak in sctpv4get_dst (bnc#1012382).
• sctp: fix dst refcnt leak in sctpv6get_dst() (bnc#1012382).
• sctp: verify size of a new chunk in sctpmake_chunk() (bnc#1012382).
• storvsc: do not schedule work elements during host reset (bsc#1070536, bsc#1057734).
• storvsc_drv: use embedded work structure for host rescan (bsc#1070536, bsc#1057734).
• storvsc_drv: use separate workqueue for rescan (bsc#1070536, bsc#1057734).
• swap: divide-by-zero when zero length swap file on ssd (bsc#1082153).
• tpm: st33zp24: fix potential buffer overruns caused by bit glitches on the bus (bnc#1012382).
• tpmi2cinfineon: fix potential buffer overruns caused by bit glitches on the bus (bnc#1012382).
• tpmi2cnuvoton: fix potential buffer overruns caused by bit glitches on the bus (bnc#1012382).
• udplite: fix partial checksum initialization (bnc#1012382).
• watchdog: hpwdt: Remove legacy NMI sourcing (bsc#1085185).
• x86/apic/vector: Handle legacy irq data correctly (bnc#1012382).
• x86/entry/64: Do not use IST entry for #BP stack (bsc#1087088).
• x86/kaiser: Duplicate cpu_tss for an entry trampoline usage (bsc#1077560 bsc#1083836).
• x86/kaiser: Remove a user mapping of cpu_tss structure (bsc#1077560 bsc#1083836).
• x86/kaiser: Use a per-CPU trampoline stack for kernel entry (bsc#1077560).
• x86/kaiser: enforce trampoline stack alignment (bsc#1087260).
• x86/speculation: Remove Skylake C2 from Speculation Control microcode blacklist (bsc#1087845).
• xen-blkfront: fix mq start/stop race (bsc#1085042).
• xen-netback: use skb to determine number of required guest Rx requests (bsc#1046610).