Update to the latest upstream stable release, Linux v4.3.6

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The openSUSE Leap 42.1 kernel was updated to 4.1.20 to receive various security and bugfixes.

The following security bugs were fixed :

  - CVE-2015-1339: A memory leak in cuse could be used to     exhaust kernel memory. (bsc#969356).

  - CVE-2015-7799: The slhc_init function in     drivers/net/slip/slhc.c in the Linux kernel did not     ensure that certain slot numbers are valid, which     allowed local users to cause a denial of service (NULL     pointer dereference and system crash) via a crafted     PPPIOCSMAXCID ioctl call (bnc#949936 951638).

  - CVE-2015-7872: The key_gc_unused_keys function in     security/keys/gc.c in the Linux kernel allowed local     users to cause a denial of service (OOPS) via crafted     keyctl commands (bnc#951440).

  - CVE-2015-7884: The vivid_fb_ioctl function in     drivers/media/platform/vivid/vivid-osd.c in the Linux     kernel did not initialize a certain structure member,     which allowed local users to obtain sensitive     information from kernel memory via a crafted application     (bnc#951626).

  - CVE-2015-8104: The KVM subsystem in the Linux kernel     allowed guest OS users to cause a denial of service     (host OS panic or hang) by triggering many #DB (aka     Debug) exceptions, related to svm.c (bnc#954404).

  - CVE-2015-8709: kernel/ptrace.c in the Linux kernel     mishandled uid and gid mappings, which allowed local     users to gain privileges by establishing a user     namespace, waiting for a root process to enter that     namespace with an unsafe uid or gid, and then using the     ptrace system call. NOTE: the vendor states 'there is no     kernel bug here (bnc#959709).

  - CVE-2015-8767: net/sctp/sm_sideeffect.c in the Linux     kernel did not properly manage the relationship between     a lock and a socket, which allowed local users to cause     a denial of service (deadlock) via a crafted sctp_accept     call. (bsc#961509)

  - CVE-2015-8785: The fuse_fill_write_pages function in     fs/fuse/file.c in the Linux kernel allowed local users     to cause a denial of service (infinite loop) via a     writev system call that triggers a zero length for the     first segment of an iov (bnc#963765).

  - CVE-2015-8787: The nf_nat_redirect_ipv4 function in     net/netfilter/nf_nat_redirect.c in the Linux kernel     allowed remote attackers to cause a denial of service     (NULL pointer dereference and system crash) or possibly     have unspecified other impact by sending certain IPv4     packets to an incompletely configured interface, a     related issue to CVE-2003-1604 (bnc#963931).

  - CVE-2015-8812: A flaw was found in the CXGB3 kernel     driver when the network was considered congested. The     kernel would incorrectly misinterpret the congestion as     an error condition and incorrectly free/clean up the     skb. When the device would then send the skb's queued,     these structures would be referenced and may panic the     system or allow an attacker to escalate privileges in a     use-after-free scenario. (bsc#966437).

  - CVE-2016-0723: Race condition in the tty_ioctl function     in drivers/tty/tty_io.c in the Linux kernel allowed     local users to obtain sensitive information from kernel     memory or cause a denial of service (use-after-free and     system crash) by making a TIOCGETD ioctl call during     processing of a TIOCSETD ioctl call (bnc#961500).

  - CVE-2016-2069: When Linux invalidated a paging structure     that is not in use locally, it could, in principle, race     against another CPU that is switching to a process that     uses the paging structure in question. (bsc#963767)

  - CVE-2016-2184: A malicious USB device could cause a     kernel crash in the alsa usb-audio driver. (bsc#971125)

  - CVE-2016-2383: Incorrect branch fixups for eBPF allow     arbitrary read of kernel memory. (bsc#966684)

  - CVE-2016-2384: A malicious USB device could cause a     kernel crash in the alsa usb-audio driver. (bsc#966693)

The following non-security bugs were fixed :

  - alsa: hda - Apply clock gate workaround to Skylake, too     (bsc#966137).

  - alsa: hda - disable dynamic clock gating on Broxton     before reset (bsc#966137).

  - alsa: hda - Fix playback noise with 24/32 bit sample     size on BXT (bsc#966137).

  - alsa: seq: Fix double port list deletion (bsc#968018).

  - alsa: seq: Fix leak of pool buffer at concurrent writes     (bsc#968018).

  - alsa: timer: Fix race between stop and interrupt     (bsc#968018).

  - alsa: timer: Fix wrong instance passed to slave     callbacks (bsc#968018).

  - arm64: Add workaround for Cavium erratum 27456.

  - arm64: Backport arm64 patches from SLE12-SP1-ARM

  - btrfs: teach backref walking about backrefs with     underflowed (bsc#966259).

  - cgroup kabi fix for 4.1.19.

  - config: Disable CONFIG_DDR. CONFIG_DDR is selected     automatically by drivers which need it.

  - config: Disable MFD_TPS65218 The TPS65218 is a power     management IC for 32-bit ARM systems.

  - config: Modularize NF_REJECT_IPV4/V6 There is no reason     why these helper modules should be built-in when the     rest of netfilter is built as modules.

  - config: Update x86 config files: Enable Intel RAPL This     driver is useful when power caping is needed. It was     enabled in the SLE kernel 2 years ago.

  - Delete patches.fixes/bridge-module-get-put.patch. As     discussed in     http://lists.opensuse.org/opensuse-kernel/2015-11/msg000     46.html

  - drm/i915: Fix double unref in intelfb_alloc failure path     (boo#962866, boo#966179).

  - drm/i915: Fix failure paths around initial fbdev     allocation (boo#962866, boo#966179).

  - drm/i915: Pin the ifbdev for the info->system_base GGTT     mmapping (boo#962866, boo#966179).

  - e1000e: Avoid divide by zero error (bsc#965125).

  - e1000e: fix division by zero on jumbo MTUs (bsc#965125).

  - e1000e: fix systim issues (bsc#965125).

  - e1000e: Fix tight loop implementation of systime read     algorithm (bsc#965125).

  - ibmvnic: Fix ibmvnic_capability struct.

  - intel: Disable Skylake support in intel_idle driver     again (boo#969582) This turned out to bring a regression     on some machines, unfortunately. It should be addressed     in the upstream at first.

  - intel_idle: allow idle states to be freeze-mode specific     (boo#969582).

  - intel_idle: Skylake Client Support (boo#969582).

  - intel_idle: Skylake Client Support - updated     (boo#969582).

  - libceph: fix scatterlist last_piece calculation     (bsc#963746).

  - lio: Add LIO clustered RBD backend (fate#318836)

  - net kabi fixes for 4.1.19.

  - numa patches updated to v15

  - ocfs2: fix dlmglue deadlock issue(bnc#962257)

  - pci: thunder: Add driver for ThunderX-pass(1,2) on-chip     devices

  - pci: thunder: Add PCIe host driver for ThunderX     processors

  - sd: Optimal I/O size is in bytes, not sectors     (boo#961263).

  - sd: Reject optimal transfer length smaller than page     size (boo#961263).

  - series.conf: move cxgb3 patch to network drivers section

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A use-after-free flaw was found in the way the Linux     kernel's key management subsystem handled keyring     object reference counting in certain error path of the     join_session_keyring() function. A local, unprivileged     user could use this flaw to escalate their privileges     on the system.(CVE-2016-0728)

  - A flaw was found in the way the Linux kernel's ASN.1     DER decoder processed certain certificate files with     tags of indefinite length. A local, unprivileged user     could use a specially crafted X.509 certificate DER     file to crash the system or, potentially, escalate     their privileges on the system.(CVE-2016-0758)

  - The LIST_POISON feature in include/linux/poison.h in     the Linux kernel before 4.3, as used in Android 6.0.1     before 2016-03-01, does not properly consider the     relationship to the mmap_min_addr value, which makes it     easier for attackers to bypass a poison-pointer     protection mechanism by triggering the use of an     uninitialized list entry, aka Android internal bug     26186802, a different vulnerability than     CVE-2015-3636.(CVE-2016-0821)

  - The pagemap_open function in fs/proc/task_mmu.c in the     Linux kernel before 3.19.3, as used in Android 6.0.1     before 2016-03-01, allows local users to obtain     sensitive physical-address information by reading a     pagemap file, aka Android internal bug     25739721.(CVE-2016-0823)

  - The aio_mount function in fs/aio.c in the Linux kernel     does not properly restrict execute access, which makes     it easier for local users to bypass intended SELinux     W^X policy restrictions.(CVE-2016-10044)

  - It was found that the fix for CVE-2016-9576 was     incomplete: the Linux kernel's sg implementation did     not properly restrict write operations in situations     where the KERNEL_DS option is set. A local attacker to     read or write to arbitrary kernel memory locations or     cause a denial of service (use-after-free) by     leveraging write access to a /dev/sg     device.(CVE-2016-10088)

  - A use-after-free flaw was found in the Linux kernel     which enables a race condition in the L2TPv3 IP     Encapsulation feature. A local user could use this flaw     to escalate their privileges or crash the     system.(CVE-2016-10200)

  - Mounting a crafted EXT4 image read-only leads to an     attacker controlled memory corruption and     SLAB-Out-of-Bounds reads.(CVE-2016-10208)

  - The Linux kernel allows remote attackers to execute     arbitrary code via UDP traffic that triggers an unsafe     second checksum calculation during execution of a recv     system call with the MSG_PEEK flag. This may create a     kernel panic or memory corruption leading to privilege     escalation.(CVE-2016-10229)

  - The overlayfs implementation in the Linux kernel     through 4.5.2 does not properly maintain POSIX ACL     xattr data, which allows local users to gain privileges     by leveraging a group-writable setgid     directory.(CVE-2016-1575)

  - The overlayfs implementation in the Linux kernel     through 4.5.2 does not properly restrict the mount     namespace, which allows local users to gain privileges     by mounting an overlayfs filesystem on top of a FUSE     filesystem, and then executing a crafted setuid     program.(CVE-2016-1576)

  - A syntax vulnerability was discovered in the kernel's     ASN1.1 DER decoder, which could lead to memory     corruption or a complete local denial of service     through x509 certificate DER files. A local system user     could use a specially created key file to trigger     BUG_ON() in the public_key_verify_signature() function     (crypto/asymmetric_keys/public_key.c), to cause a     kernel panic and crash the system.(CVE-2016-2053)

  - A flaw was discovered in the way the Linux kernel dealt     with paging structures. When the kernel invalidated a     paging structure that was not in use locally, it could,     in principle, race against another CPU that is     switching to a process that uses the paging structure     in question. A local user could use a thread running     with a stale cached virtual-i1/4zphysical translation to     potentially escalate their privileges if the     translation in question were writable and the physical     page got reused for something critical (for example, a     page table).(CVE-2016-2069)

  - A divide-by-zero vulnerability was found in a way the     kernel processes TCP connections. The error can occur     if a connection starts another cwnd reduction phase by     setting tp-i1/4zprior_cwnd to the current cwnd (0) in     tcp_init_cwnd_reduction(). A remote, unauthenticated     attacker could use this flaw to crash the kernel     (denial of service).(CVE-2016-2070)

  - It was discovered that the atl2_probe() function in the     Atheros L2 Ethernet driver in the Linux kernel     incorrectly enabled scatter/gather I/O. A remote     attacker could use this flaw to obtain potentially     sensitive information from the kernel     memory.(CVE-2016-2117)

  - The create_fixed_stream_quirk function in     sound/usb/quirks.c in the snd-usb-audio driver in the     Linux kernel before 4.5.1 allows physically proximate     attackers to cause a denial of service (NULL pointer     dereference or double free, and system crash) via a     crafted endpoints value in a USB device     descriptor.(CVE-2016-2184)

  - The ati_remote2_probe function in     drivers/input/misc/ati_remote2.c in the Linux kernel     before 4.5.1 allows physically proximate attackers to     cause a denial of service (NULL pointer dereference and     system crash) via a crafted endpoints value in a USB     device descriptor.(CVE-2016-2185)

  - The powermate_probe function in     drivers/input/misc/powermate.c in the Linux kernel     before 4.5.1 allows physically proximate attackers to     cause a denial of service (NULL pointer dereference and     system crash) via a crafted endpoints value in a USB     device descriptor.(CVE-2016-2186)

  - The gtco_probe function in drivers/input/tablet/gtco.c     in the Linux kernel through 4.5.2 allows physically     proximate attackers to cause a denial of service (NULL     pointer dereference and system crash) via a crafted     endpoints value in a USB device     descriptor.(CVE-2016-2187)

  - The iowarrior_probe function in     drivers/usb/misc/iowarrior.c in the Linux kernel before     4.5.1 allows physically proximate attackers to cause a     denial of service (NULL pointer dereference and system     crash) via a crafted endpoints value in a USB device     descriptor.(CVE-2016-2188)

  - A flaw was found in the USB-MIDI Linux kernel driver: a     double-free error could be triggered for the 'umidi'     object. An attacker with physical access to the system     could use this flaw to escalate their     privileges.(CVE-2016-2384)

  - The snd_seq_ioctl_remove_events function in     sound/core/seq/seq_clientmgr.c in the Linux kernel     before 4.4.1 does not verify FIFO assignment before     proceeding with FIFO clearing, which allows local users     to cause a denial of service (NULL pointer dereference     and OOPS) via a crafted ioctl call.(CVE-2016-2543)

  - Race condition in the queue_delete function in     sound/core/seq/seq_queue.c in the Linux kernel before     4.4.1 allows local users to cause a denial of service     (use-after-free and system crash) by making an ioctl     call at a certain time.(CVE-2016-2544)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
89632	Fedora 22 : kernel-4.3.6-201.fc22 (2016-e7162262b0)	Nessus	Fedora Local Security Checks	2016/3/4	2021/1/11	critical
90482	openSUSE Security Update : the Linux Kernel (openSUSE-2016-445)	Nessus	SuSE Local Security Checks	2016/4/13	2021/1/19	critical
124815	EulerOS Virtualization 3.0.1.0 : kernel (EulerOS-SA-2019-1491)	Nessus	Huawei Local Security Checks	2019/5/13	2024/5/23	critical

检测

插件搜索

critical

critical

critical