SUSE-SU-2018:3084-1

The SUSE Linux Enterprise 12 SP2 LTSS kernel was updated to receive various security and bugfixes.

• CVE-2018-10853: A flaw was found in the way the KVM hypervisor emulated instructions such as sgdt/sidt/fxsave/fxrstor. It did not check current privilege(CPL) level while emulating unprivileged instructions. An unprivileged guest user/process could use this flaw to potentially escalate privileges inside guest (bnc#1097104).
• CVE-2018-10876: A flaw was found in Linux kernel in the ext4 filesystem code. A use-after-free is possible in ext4extremove_space() function when mounting and operating a crafted ext4 image. (bnc#1099811)
• CVE-2018-10877: Linux kernel ext4 filesystem is vulnerable to an out-of-bound access in the ext4extdrop_refs() function when operating on a crafted ext4 filesystem image. (bnc#1099846)
• CVE-2018-10878: A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bounds write and a denial of service or unspecified other impact is possible by mounting and operating a crafted ext4 filesystem image. (bnc#1099813)
• CVE-2018-10879: A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause a use-after-free in ext4xattrset_entry function and a denial of service or unspecified other impact may occur by renaming a file in a crafted ext4 filesystem image. (bnc#1099844)
• CVE-2018-10880: Linux kernel is vulnerable to a stack-out-of-bounds write in the ext4 filesystem code when mounting and writing to a crafted ext4 image in ext4updateinline_data(). An attacker could use this to cause a system crash and a denial of service. (bnc#1099845)
• CVE-2018-10881: A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bound access in ext4getgroup_info function, a denial of service, and a system crash by mounting and operating on a crafted ext4 filesystem image. (bnc#1099864)
• CVE-2018-10882: A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bound write in in fs/jbd2/transaction.c code, a denial of service, and a system crash by unmounting a crafted ext4 filesystem image. (bnc#1099849)
• CVE-2018-10883: A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bounds write in jbd2journaldirty_metadata(), a denial of service, and a system crash by mounting and operating on a crafted ext4 filesystem image. (bnc#1099863)
• CVE-2018-10902: It was found that the raw midi kernel driver did not protect against concurrent access which leads to a double realloc (double free) in sndrawmidiinputparams() and sndrawmidioutputstatus() which are part of sndrawmidiioctl() handler in rawmidi.c file. A malicious local attacker could possibly use this for privilege escalation (bnc#1105322).
• CVE-2018-10938: A crafted network packet sent remotely by an attacker may force the kernel to enter an infinite loop in the cipsov4optptr() function in net/ipv4/cipso_ipv4.c leading to a denial-of-service. A certain non-default configuration of LSM (Linux Security Module) and NetLabel should be set up on a system before an attacker could leverage this flaw (bnc#1106016).
• CVE-2018-10940: The cdromioctlmediachanged function in drivers/cdrom/cdrom.c allowed local attackers to use a incorrect bounds check in the CDROM driver CDROMMEDIA_CHANGED ioctl to read out kernel memory (bnc#1092903).
• CVE-2018-12896: An Integer Overflow in kernel/time/posix-timers.c in the POSIX timer code is caused by the way the overrun accounting works. Depending on interval and expiry time values, the overrun can be larger than INTMAX, but the accounting is int based. This basically made the accounting values, which are visible to user space via timergetoverrun(2) and siginfo::sioverrun, random. For example, a local user can cause a denial of service (signed integer overflow) via crafted mmap, futex, timercreate, and timer_settime system calls (bnc#1099922).
• CVE-2018-13093: There is a NULL pointer dereference and panic in lookupslow() on a NULL inode->iops pointer when doing pathwalks on a corrupted xfs image. This occurs because of a lack of proper validation that cached inodes are free during allocation (bnc#1100001).
• CVE-2018-13094: An OOPS may occur for a corrupted xfs image after xfsdashrink_inode() is called with a NULL bp (bnc#1100000).
• CVE-2018-13095: A denial of service (memory corruption and BUG) can occur for a corrupted xfs image upon encountering an inode that is in extent format, but has more extents than fit in the inode fork (bnc#1099999).
• CVE-2018-14617: There is a NULL pointer dereference and panic in hfsplus_lookup() in fs/hfsplus/dir.c when opening a file (that is purportedly a hard link) in an hfs+ filesystem that has malformed catalog data, and is mounted read-only without a metadata directory (bnc#1102870).
• CVE-2018-14678: The xenfailsafecallback entry point in arch/x86/entry/entry_64.S did not properly maintain RBX, which allowed local users to cause a denial of service (uninitialized memory usage and system crash). Within Xen, 64-bit x86 PV Linux guest OS users can trigger a guest OS crash or possibly gain privileges (bnc#1102715).
• CVE-2018-15572: The spectrev2select_mitigation function in arch/x86/kernel/cpu/bugs.c did not always fill RSB upon a context switch, which made it easier for attackers to conduct userspace-userspace spectreRSB attacks (bnc#1102517 bnc#1105296).
• CVE-2018-15594: arch/x86/kernel/paravirt.c mishandled certain indirect calls, which made it easier for attackers to conduct Spectre-v2 attacks against paravirtual guests (bnc#1105348).
• CVE-2018-16276: Local attackers could use user access read/writes with incorrect bounds checking in the yurex USB driver to crash the kernel or potentially escalate privileges (bnc#1106095).
• CVE-2018-16658: An information leak in cdromioctldrive_status in drivers/cdrom/cdrom.c could be used by local attackers to read kernel memory because a cast from unsigned long to int interferes with bounds checking. This is similar to CVE-2018-10940 (bnc#1107689).
• CVE-2018-17182: The vmacacheflushall function in mm/vmacache.c mishandled sequence number overflows. An attacker can trigger a use-after-free (and possibly gain privileges) via certain thread creation, map, unmap, invalidation, and dereference operations (bnc#1108399).
• CVE-2018-6554: Memory leak in the irdabind function in net/irda/afirda.c and later in drivers/staging/irda/net/afirda.c allowed local users to cause a denial of service (memory consumption) by repeatedly binding an AFIRDA socket (bnc#1106509).
• CVE-2018-6555: The irdasetsockopt function in net/irda/afirda.c and later in drivers/staging/irda/net/afirda.c allowed local users to cause a denial of service (iasobject use-after-free and system crash) or possibly have unspecified other impact via an AF_IRDA socket (bnc#1106511).
• CVE-2018-7757: Memory leak in the sassmpgetphyevents function in drivers/scsi/libsas/sasexpander.c allowed local users to cause a denial of service (memory consumption) via many read accesses to files in the /sys/class/sasphy directory, as demonstrated by the /sys/class/sasphy/phy-1:0:12/invaliddword_count file (bnc#1084536).
• CVE-2018-9363: A buffer overflow in bluetooth HID report processing could be used by malicious bluetooth devices to crash the kernel or potentially execute code (bnc#1105292). The following security bugs were fixed:
• CVE-2018-7480: The blkcginitqueue function in block/blk-cgroup.c allowed local users to cause a denial of service (double free) or possibly have unspecified other impact by triggering a creation failure (bnc#1082863).

The following non-security bugs were fixed:

• atm: Preserve value of skb->truesize when accounting to vcc (bsc#1089066).
• bcache: avoid unncessary cache prefetch bchbtreenode_get() (bsc#1064232).
• bcache: calculate the number of incremental GC nodes according to the total of btree nodes (bsc#1064232).
• bcache: display rate debug parameters to 0 when writeback is not running (bsc#1064232).
• bcache: do not check return value of debugfscreatedir() (bsc#1064232).
• bcache: finish incremental GC (bsc#1064232).
• bcache: fix error setting writeback_rate through sysfs interface (bsc#1064232).
• bcache: fix I/O significant decline while backend devices registering (bsc#1064232).
• bcache: free heap cacheset->flushbtree in bchjournalfree (bsc#1064232).
• bcache: make the prerr statement used for ENOENT only in sysfsattatch section (bsc#1064232).
• bcache: release dc->writebacklock properly in bchwriteback_thread() (bsc#1064232).
• bcache: set max writeback rate when I/O request is idle (bsc#1064232).
• bcache: simplify the calculation of the total amount of flash dirty data (bsc#1064232).
• ext4: check for allocation block validity with block group locked (bsc#1104495).
• ext4: do not update checksum of new initialized bitmaps (bnc#1012382).
• ext4: fix check to prevent initializing reserved inodes (bsc#1104319).
• ext4: fix false negatives and false positives in ext4checkdescriptors() (bsc#1103445).
• ibmvnic: Include missing return code checks in reset function (bnc#1107966).
• kABI: protect struct x86emulateops (kabi).
• kabi/severities: Ignore missing cputsstramp (bsc#1099597)
• kabi: x86/speculation/l1tf: Increase l1tf memory limit for Nehalem+ (bnc#1105536).
• kvm: MMU: always terminate page walks at level 1 (bsc#1062604).
• kvm: MMU: simplify lastptebitmap (bsc#1062604).
• kvm: nVMX: update lastnonleaflevel when initializing nested EPT (bsc#1062604).
• kvm: VMX: fixes for vmentryl1dflush module parameter (bsc#1106369).
• kvm: VMX: Work around kABI breakage in 'enum vmxl1dflush_state' (bsc#1106369).
• net: add skb_condense() helper (bsc#1089066).
• net: adjust skb->truesize in pskbexpandhead() (bsc#1089066).
• net: adjust skb->truesize in _pskb_trim() (bsc#1089066).
• net: ena: Eliminate duplicate barriers on weakly-ordered archs (bsc#1108239).
• net: ena: fix device destruction to gracefully free resources (bsc#1108239).
• net: ena: fix driver when PAGE_SIZE == 64kB (bsc#1108239).
• net: ena: fix incorrect usage of memory barriers (bsc#1108239).
• net: ena: fix missing calls to READ_ONCE (bsc#1108239).
• net: ena: fix missing lock during device destruction (bsc#1108239).
• net: ena: fix potential double enadestroydevice() (bsc#1108239).
• net: ena: fix surprise unplug NULL dereference kernel crash (bsc#1108239).
• net: ena: Fix use of uninitialized DMA address bits field (bsc#1108239).
• netfilter: xt_CT: fix refcnt leak on error path (bnc#1012382 bsc#1100152).
• netlink: do not enter direct reclaim from netlink_trim() (bsc#1042286).
• nfs: Use an appropriate work queue for direct-write completion (bsc#1082519).
• ovl: fix random return value on mount (bsc#1099993).
• ovl: fix uid/gid when creating over whiteout (bsc#1099993).
• ovl: modify ovl_permission() to do checks on two inodes (bsc#1106512).
• ovl: override creds with the ones from the superblock mounter (bsc#1099993).
• powerpc: Avoid code patching freed init sections (bnc#1107735).
• powerpc/livepatch: Fix livepatch stack access (bsc#1094466).
• powerpc/modules: Do not try to restore r2 after a sibling call (bsc#1094466).
• powerpc/tm: Avoid possible userspace r1 corruption on reclaim (bsc#1109333).
• powerpc/tm: Fix userspace r13 corruption (bsc#1109333).
• provide special timeout module parameters for EC2 (bsc#1065364).
• stop_machine: Atomically queue and wake stopper threads (git-fixes).
• stopmachine, sched: Fix migrateswap() vs. active_balance() deadlock (bsc#1088810).
• usbip: vhci_sysfs: fix potential Spectre v1 (bsc#1096547).
• x86/entry/64: Remove %ebx handling from error_entry/exit (bnc#1102715).
• x86/speculation/l1tf: Fix off-by-one error when warning that system has too much RAM (bnc#1105536).
• x86/speculation/l1tf: Increase l1tf memory limit for Nehalem+ (bnc#1105536).
• x86/speculation/l1tf: Suggest what to do on systems with too much RAM (bnc#1105536).
• x86/speculation: Use ARCH_CAPABILITIES to skip L1D flush on vmentry (bsc#1106369).
• x86: Drop kernel trampoline stack. It is involved in breaking kdump/kexec infrastucture. (bsc#1099597)
• xen: avoid crash in disablehotplugcpu (bsc#1106594).
• xen/blkback: do not keep persistent grants too long (bsc#1085042).
• xen/blkback: move persistent grants flags to bool (bsc#1085042).
• xen/blkfront: cleanup stale persistent grants (bsc#1085042).
• xen/blkfront: reorder tests in xlblk_init() (bsc#1085042).
• xfs: add a new xfsiextlookupextentbefore helper (bsc#1095344).
• xfs: add asserts for the mmap lock in xfs{insert,collapse}file_space (bsc#1095344).
• xfs: add a xfsbmapforktostate helper (bsc#1095344).
• xfs: add a xfsiextupdate_extent helper (bsc#1095344).
• xfs: add comments documenting the rebalance algorithm (bsc#1095344).
• xfs: add some comments to xfsiextinsert/xfsiextinsert_node (bsc#1095344).
• xfs: add xfstrimextent (bsc#1095344).
• xfs: allow unaligned extent records in xfsbmbtdisksetall (bsc#1095344).
• xfs: borrow indirect blocks from freed extent when available (bsc#1095344).
• xfs: cleanup xfsbmaplast_before (bsc#1095344).
• xfs: do not create overlapping extents in xfsbmapaddextentdelay_real (bsc#1095344).
• xfs: do not rely on extent indices in xfsbmapcollapse_extents (bsc#1095344).
• xfs: do not rely on extent indices in xfsbmapinsert_extents (bsc#1095344).
• xfs: do not set XFSBTCURBPRVWASDEL in xfsbunmapi (bsc#1095344).
• xfs: during btree split, save new block key & ptr for future insertion (bsc#1095344).
• xfs: factor out a helper to initialize a local format inode fork (bsc#1095344).
• xfs: fix memory leak in xfsiextfreelastleaf (bsc#1095344).
• xfs: fix number of records handling in xfsiextsplit_leaf (bsc#1095344).
• xfs: handle indlen shortage on delalloc extent merge (bsc#1095344).
• xfs: handle zero entries case in xfsiextrebalance_leaf (bsc#1095344).
• xfs: improve kmem_realloc (bsc#1095344).
• xfs: inline xfsshiftfile_space into callers (bsc#1095344).
• xfs: introduce the xfsiextcursor abstraction (bsc#1095344).
• xfs: iterate over extents in xfsbmapextentstobtree (bsc#1095344).
• xfs: iterate over extents in xfsiextentscopy (bsc#1095344).
• xfs: make better use of the 'state' variable in xfsbmapdelextentreal (bsc#1095344).
• xfs: merge xfsbmapreadextents into xfsiread_extents (bsc#1095344).
• xfs: move pre/post-bmap tracing into xfsiextupdate_extent (bsc#1095344).
• xfs: move some code around inside xfsbmapshift_extents (bsc#1095344).
• xfs: move some more code into xfsbmapdelextentreal (bsc#1095344).
• xfs: move xfsbmbtirec and xfsexntstt to xfs_types.h (bsc#1095344).
• xfs: move xfsiextinsert tracepoint to report useful information (bsc#1095344).
• xfs: new inode extent list lookup helpers (bsc#1095344).
• xfs: pass an on-disk extent to xfsbmbtvalidate_extent (bsc#1095344).
• xfs: pass a struct xfsbmbtirec to xfsbmbtlookup_eq (bsc#1095344).
• xfs: pass a struct xfsbmbtirec to xfsbmbtupdate (bsc#1095344).
• xfs: pass struct xfsbmbtirec to xfsbmbtvalidate_extent (bsc#1095344).
• xfs: provide helper for counting extents from if_bytes (bsc#1095344).
• xfs: refactor delalloc accounting in xfsbmapaddextentdelay_real (bsc#1095344).
• xfs: refactor delalloc indlen reservation split into helper (bsc#1095344).
• xfs: refactor dir2 leaf readahead shadow buffer cleverness (bsc#1095344).
• xfs: refactor xfsbmapaddextentdelay_real (bsc#1095344).
• xfs: refactor xfsbmapaddextenthole_delay (bsc#1095344).
• xfs: refactor xfsbmapaddextenthole_real (bsc#1095344).
• xfs: refactor xfsbmapaddextentunwritten_real (bsc#1095344).
• xfs: refactor xfsbunmapicow (bsc#1095344).
• xfs: refactor xfsdelextent_real (bsc#1095344).
• xfs: remove a duplicate assignment in xfsbmapaddextentdelay_real (bsc#1095344).
• xfs: remove all xfsbmbtset* helpers except for xfsbmbtsetall (bsc#1095344).
• xfs: remove a superflous assignment in xfsiextremove_node (bsc#1095344).
• xfs: Remove dead code from inode recover function (bsc#1105396).
• xfs: remove if_rdev (bsc#1095344).
• xfs: remove prev argument to xfsbmapireserve_delalloc (bsc#1095344).
• xfs: remove support for inlining data/extents into the inode fork (bsc#1095344).
• xfs: remove the never fully implemented UUID fork format (bsc#1095344).
• xfs: remove the nrextents argument to xfsiext_insert (bsc#1095344).
• xfs: remove the nrextents argument to xfsiext_remove (bsc#1095344).
• xfs: remove XFSBMAPMAXSHIFTEXTENTS (bsc#1095344).
• xfs: remove XFSBMAPTRACE_EXLIST (bsc#1095344).
• xfs: remove xfsbmbtget_state (bsc#1095344).
• xfs: remove xfsbmseshift_one (bsc#1095344).
• xfs: rename bno to end in _xfsbunmapi (bsc#1095344).
• xfs: repair malformed inode items during log recovery (bsc#1105396).
• xfs: replace xfsbmbtlookupge with xfsbmbtlookupfirst (bsc#1095344).
• xfs: replace xfsqmgetrtblks with a direct call to xfsbmapcountleaves (bsc#1095344).
• xfs: rewrite getbmap using the xfsiext* helpers (bsc#1095344).
• xfs: rewrite xfsbmapcountleaves using xfsiextgetextent (bsc#1095344).
• xfs: rewrite xfsbmapfirstunused to make better use of xfsiextgetextent (bsc#1095344).
• xfs: simplify the xfs_getbmap interface (bsc#1095344).
• xfs: simplify validation of the unwritten extent bit (bsc#1095344).
• xfs: split indlen reservations fairly when under reserved (bsc#1095344).
• xfs: split xfsbmapshift_extents (bsc#1095344).
• xfs: switch xfsbmaplocaltoextents to use xfsiextinsert (bsc#1095344).
• xfs: treat idx as a cursor in xfsbmapaddextentdelay_real (bsc#1095344).
• xfs: treat idx as a cursor in xfsbmapaddextenthole_delay (bsc#1095344).
• xfs: treat idx as a cursor in xfsbmapaddextenthole_real (bsc#1095344).
• xfs: treat idx as a cursor in xfsbmapaddextentunwritten_real (bsc#1095344).
• xfs: treat idx as a cursor in xfsbmapcollapse_extents (bsc#1095344).
• xfs: treat idx as a cursor in xfsbmapdelextent* (bsc#1095344).
• xfs: update freeblocks counter after extent deletion (bsc#1095344).
• xfs: update got in xfsbmapshiftupdateextent (bsc#1095344).
• xfs: use a b+tree for the in-core extent list (bsc#1095344).
• xfs: use correct state defines in xfsbmapdelextent{cow,delay} (bsc#1095344).
• xfs: use new extent lookup helpers in xfsbmapiread (bsc#1095344).
• xfs: use new extent lookup helpers in xfsbmapiwrite (bsc#1095344).
• xfs: use new extent lookup helpers in _xfsbunmapi (bsc#1095344).
• xfs: use the state defines in xfsbmapdelextentreal (bsc#1095344).
• xfs: use xfsbmapdelextentdelay for the data fork as well (bsc#1095344).
• xfs: use xfsiext*extent helpers in xfsbmapshiftextents (bsc#1095344).
• xfs: use xfsiext*extent helpers in xfsbmapsplitextent_at (bsc#1095344).
• xfs: use xfsiextget_extent instead of open coding it (bsc#1095344).
• xfs: use xfsiextgetextent in xfsbmapfirstunused (bsc#1095344).