SUSE-SU-2019:0845-1

Import Source

JSON Data

https://api.osv.dev/v1/vulns/SUSE-SU-2019:0845-1

Related

Published

2019-04-02T13:23:15Z

Modified

2019-04-02T13:23:15Z

Summary

Security update for the Linux Kernel (Live Patch 8 for SLE 15)

Details

This update for the Linux Kernel 4.12.14-25_28 fixes several issues.

The following security issues were fixed:

CVE-2019-9213: Expand_downwards in mm/mmap.c lacked a check for the mmap minimum address, which made it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task (bsc#1128378).
CVE-2019-8912: afalgrelease() in crypto/afalg.c neglected to set a NULL value for a certain structure member, which could have led to a use-after-free in sockfssetattr (bsc#1126284).
CVE-2019-7221: Fixed a user-after-free vulnerability in the KVM hypervisor related to the emulation of a preemption timer, allowing an guest user/process to crash the host kernel. (bsc#1124734).
CVE-2019-6974: kvmioctlcreatedevice in virt/kvm/kvmmain.c mishandled reference counting because of a race condition, leading to a use-after-free (bsc#1124729).

References

Affected packages

Name: kernel-livepatch-SLE15_Update_7
Purl: purl:rpm/suse/kernel-livepatch-SLE15_Update_7&distro=SUSE%20Linux%20Enterprise%20Live%20Patching%2015

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3-2.1

{
    "binaries": [
        {
            "kernel-livepatch-4_12_14-25_25-default": "3-2.1"
        }
    ]
}

Name: kernel-livepatch-SLE15_Update_8
Purl: purl:rpm/suse/kernel-livepatch-SLE15_Update_8&distro=SUSE%20Linux%20Enterprise%20Live%20Patching%2015

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2-2.1

{
    "binaries": [
        {
            "kernel-livepatch-4_12_14-25_28-default": "2-2.1"
        }
    ]
}

Name: kernel-livepatch-SLE15_Update_7
Purl: purl:rpm/suse/kernel-livepatch-SLE15_Update_7&distro=SUSE%20Linux%20Enterprise%20Live%20Patching%2015

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3-2.1

{
    "binaries": [
        {
            "kernel-livepatch-4_12_14-25_25-default": "3-2.1"
        }
    ]
}

Name: kernel-livepatch-SLE15_Update_8
Purl: purl:rpm/suse/kernel-livepatch-SLE15_Update_8&distro=SUSE%20Linux%20Enterprise%20Live%20Patching%2015

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2-2.1

{
    "binaries": [
        {
            "kernel-livepatch-4_12_14-25_28-default": "2-2.1"
        }
    ]
}