SUSE-SU-2019:0740-1

Import Source

JSON Data

https://api.osv.dev/v1/vulns/SUSE-SU-2019:0740-1

Related

Published

2019-03-26T13:34:42Z

Modified

2019-03-26T13:34:42Z

Summary

Security update for the Linux Kernel (Live Patch 1 for SLE 15)

Details

This update for the Linux Kernel 4.12.14-25_3 fixes several issues.

The following security issues were fixed:

CVE-2019-9213: Expand_downwards in mm/mmap.c lacked a check for the mmap minimum address, which made it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task (bsc#1128378).
CVE-2019-8912: afalgrelease() in crypto/afalg.c neglected to set a NULL value for a certain structure member, which could have led to a use-after-free in sockfssetattr (bsc#1126284).
CVE-2018-12232: In net/socket.c there was a race condition between fchownat and close in cases where they target the same socket file descriptor, related to the sockclose and sockfssetattr functions. fchownat did not increment the file descriptor reference count, which allowed close to set the socket to NULL during fchownat's execution, leading to a NULL pointer dereference and system crash (bsc#1127757).
CVE-2019-7221: Fixed a user-after-free vulnerability in the KVM hypervisor related to the emulation of a preemption timer, allowing an guest user/process to crash the host kernel. (bsc#1124734).
CVE-2019-6974: kvmioctlcreatedevice in virt/kvm/kvmmain.c mishandled reference counting because of a race condition, leading to a use-after-free (bsc#1124729).

References

Affected packages

Name: kernel-livepatch-SLE15_Update_0
Purl: purl:rpm/suse/kernel-livepatch-SLE15_Update_0&distro=SUSE%20Linux%20Enterprise%20Live%20Patching%2015

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

9-25.2

{
    "binaries": [
        {
            "kernel-livepatch-4_12_14-23-default": "9-25.2"
        }
    ]
}

Name: kernel-livepatch-SLE15_Update_1
Purl: purl:rpm/suse/kernel-livepatch-SLE15_Update_1&distro=SUSE%20Linux%20Enterprise%20Live%20Patching%2015

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

8-2.1

{
    "binaries": [
        {
            "kernel-livepatch-4_12_14-25_3-default": "8-2.1"
        }
    ]
}

Name: kernel-livepatch-SLE15_Update_0
Purl: purl:rpm/suse/kernel-livepatch-SLE15_Update_0&distro=SUSE%20Linux%20Enterprise%20Live%20Patching%2015

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

9-25.2

{
    "binaries": [
        {
            "kernel-livepatch-4_12_14-23-default": "9-25.2"
        }
    ]
}

Name: kernel-livepatch-SLE15_Update_1
Purl: purl:rpm/suse/kernel-livepatch-SLE15_Update_1&distro=SUSE%20Linux%20Enterprise%20Live%20Patching%2015

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

8-2.1

{
    "binaries": [
        {
            "kernel-livepatch-4_12_14-25_3-default": "8-2.1"
        }
    ]
}