Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks.

  - CVE-2019-3846, CVE-2019-10126     huangwen reported multiple buffer overflows in the     Marvell wifi (mwifiex) driver, which a local user could     use to cause denial of service or the execution of     arbitrary code.

  - CVE-2019-5489     Daniel Gruss, Erik Kraft, Trishita Tiwari, Michael     Schwarz, Ari Trachtenberg, Jason Hennessey, Alex     Ionescu, and Anders Fogh discovered that local users     could use the mincore() system call to obtain sensitive     information from other processes that access the same     memory-mapped file.

  - CVE-2019-9500, CVE-2019-9503     Hugues Anguelkov discovered a buffer overflow and     missing access validation in the Broadcom FullMAC wifi     driver (brcmfmac), which a attacker on the same wifi     network could use to cause denial of service or the     execution of arbitrary code.

  - CVE-2019-11477     Jonathan Looney reported that a specially crafted     sequence of TCP selective acknowledgements (SACKs)     allows a remotely triggerable kernel panic.

  - CVE-2019-11478     Jonathan Looney reported that a specially crafted     sequence of TCP selective acknowledgements (SACKs) will     fragment the TCP retransmission queue, allowing an     attacker to cause excessive resource usage.

  - CVE-2019-11479     Jonathan Looney reported that an attacker could force     the Linux kernel to segment its responses into multiple     TCP segments, each of which contains only 8 bytes of     data, drastically increasing the bandwidth required to     deliver the same amount of data.

  This update introduces a new sysctl value to control the minimal MSS   (net.ipv4.tcp_min_snd_mss), which by default uses the formerly hard   coded value of 48. We recommend raising this to 536 unless you know   that your network requires a lower value.

  - CVE-2019-11486     Jann Horn of Google reported numerous race conditions in     the Siemens R3964 line discipline. A local user could     use these to cause unspecified security impact. This     module has therefore been disabled.

  - CVE-2019-11599     Jann Horn of Google reported a race condition in the     core dump implementation which could lead to a     use-after-free. A local user could use this to read     sensitive information, to cause a denial of service     (memory corruption), or for privilege escalation.

  - CVE-2019-11815     It was discovered that a use-after-free in the Reliable     Datagram Sockets protocol could result in denial of     service and potentially privilege escalation. This     protocol module (rds) is not auto loaded on Debian     systems, so this issue only affects systems where it is     explicitly loaded.

  - CVE-2019-11833     It was discovered that the ext4 filesystem     implementation writes uninitialised data from kernel     memory to new extent blocks. A local user able to write     to an ext4 filesystem and then read the filesystem     image, for example using a removable drive, might be     able to use this to obtain sensitive information.

  - CVE-2019-11884     It was discovered that the Bluetooth HIDP implementation     did not ensure that new connection names were     null-terminated. A local user with CAP_NET_ADMIN     capability might be able to use this to obtain sensitive     information from the kernel stack.

The SUSE Linux Enterprise 12 SP3 kernel was updated to 4.4.180 to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2019-11477: A sequence of SACKs may have been crafted such that one can trigger an integer overflow, leading to a kernel panic.
(bsc#1137586)

CVE-2019-11478: It was possible to send a crafted sequence of SACKs which will fragment the TCP retransmission queue. An attacker may have been able to further exploit the fragmented queue to cause an expensive linked-list walk for subsequent SACKs received for that same TCP connection.

CVE-2019-11479: It was possible to send a crafted sequence of SACKs which will fragment the RACK send map. A remote attacker may be able to further exploit the fragmented send map to cause an expensive linked-list walk for subsequent SACKs received for that same TCP connection. This would have resulted in excess resource consumption due to low mss values.

CVE-2019-3846: A flaw that allowed an attacker to corrupt memory and possibly escalate privileges was found in the mwifiex kernel module while connecting to a malicious wireless network. (bnc#1136424)

CVE-2019-12382: An issue was discovered in drm_load_edid_firmware in drivers/gpu/drm/drm_edid_load.c in the Linux kernel There was an unchecked kstrdup of fwstr, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash).
(bnc#1136586)

CVE-2019-5489: The mincore() implementation in mm/mincore.c in the Linux kernel allowed local attackers to observe page cache access patterns of other processes on the same system, potentially allowing sniffing of secret information. (Fixing this affects the output of the fincore program.) Limited remote exploitation may be possible, as demonstrated by latency differences in accessing public files from an Apache HTTP Server. (bnc#1120843).

CVE-2019-11833: fs/ext4/extents.c in the Linux kernel did not zero out the unused memory region in the extent tree block, which might allow local users to obtain sensitive information by reading uninitialized data in the filesystem. (bnc#1135281)

CVE-2018-7191: In the tun subsystem in the Linux kernel before 4.13.14, dev_get_valid_name is not called before register_netdevice.
This allowed local users to cause a denial of service (NULL pointer dereference and panic) via an ioctl(TUNSETIFF) call with a dev name containing a / character. This is similar to CVE-2013-4343.
(bnc#1135603)

CVE-2019-11190: The Linux kernel allowed local users to bypass ASLR on setuid programs (such as /bin/su) because install_exec_creds() is called too late in load_elf_binary() in fs/binfmt_elf.c, and thus the ptrace_may_access() check has a race condition when reading /proc/pid/stat. (bnc#1131543)

CVE-2019-11815: An issue was discovered in rds_tcp_kill_sock in net/rds/tcp.c in the Linux kernel There was a race condition leading to a use-after-free, related to net namespace cleanup. (bnc#1134537)

CVE-2019-11884: The do_hidp_sock_ioctl function in net/bluetooth/hidp/sock.c in the Linux kernel allowed a local user to obtain potentially sensitive information from kernel stack memory via a HIDPCONNADD command, because a name field may not end with a '\0' character. (bnc#1134848)

CVE-2018-17972: An issue was discovered in the proc_pid_stack function in fs/proc/base.c in the Linux kernel It did not ensure that only root may inspect the kernel stack of an arbitrary task, allowing a local attacker to exploit racy stack unwinding and leak kernel task stack contents. (bnc#1110785)

CVE-2019-11486: The Siemens R3964 line discipline driver in drivers/tty/n_r3964.c in the Linux kernel has multiple race conditions. (bnc#1133188)

The following new features were implemented: Updated the Chelsio cxgb4vf driver with the latest upstream patches. (fate#321660)

Backported changes into e1000e kernel module to support systems using the Intel I219-LM NIC chip. (fate#326719)

Import QLogic/Cavium qedr driver (RDMA) into the kernel. (fate#321747)

Update the QLogic/Cavium qed driver (NET). (fate#321703)

Update the QLogic/Cavium qede driver (NET). (fate#321702)

Update the Chelsio iw_cxgb4 driver with the latest upstream patches.
(fate#321661)

Update the Chelsio cxgb4 driver with the latest upstream patches.
(fate#321658)

Update support for Intel Omni Path (OPA) kernel driver. (fate#321473)

Update the QIB driver to the latest upstream version for up-to-date functionality and hardware support. (fate#321231)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
125959	Debian DSA-4465-1 : linux - security update (SACK Panic) (SACK Slowness)	Nessus	Debian Local Security Checks	2019/6/18	2024/5/15	critical
125990	SUSE SLES12 Security Update : kernel (SUSE-SU-2019:1527-1) (SACK Panic) (SACK Slowness)	Nessus	SuSE Local Security Checks	2019/6/18	2024/5/15	high

检测

插件搜索

critical

high