| Description: | Summary:
The remote host is missing an update for the 'Linux Kernel' package(s) announced via the SUSE-SU-2018:2380-1 advisory.
Vulnerability Insight:
The SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes.
The following security bugs were fixed:
- CVE-2018-3620: Local attackers on baremetal systems could use
speculative code patterns on hyperthreaded processors to read data
present in the L1 Datacache used by other hyperthreads on the same CPU
core, potentially leaking sensitive data. (bnc#1087081).
- CVE-2018-3646: Local attackers in virtualized guest systems could use
speculative code patterns on hyperthreaded processors to read data
present in the L1 Datacache used by other hyperthreads on the same CPU
core, potentially leaking sensitive data, even from other virtual
machines or the host system. (bnc#1089343).
- CVE-2018-5391 aka 'FragmentSmack': A flaw in the IP packet reassembly
could be used by remote attackers to consume lots of CPU time
(bnc#1103097).
- CVE-2018-10876: A flaw was found in the ext4 filesystem code. A
use-after-free is possible in ext4_ext_remove_space() function when
mounting and operating a crafted ext4 image. (bnc#1099811)
- CVE-2018-10877: The ext4 filesystem is vulnerable to an out-of-bound
access in the ext4_ext_drop_refs() function when operating on a crafted
ext4 filesystem image. (bnc#1099846)
- CVE-2018-10878: A flaw was found in the ext4 filesystem. A local user
can cause an out-of-bounds write and a denial of service or unspecified
other impact is possible by mounting and operating a crafted ext4
filesystem image. (bnc#1099813)
- CVE-2018-10879: A flaw was found in the ext4 filesystem. A local user
can cause a use-after-free in ext4_xattr_set_entry function and a denial
of service or unspecified other impact may occur by renaming a file in a
crafted ext4 filesystem image. (bnc#1099844)
- CVE-2018-10880: Linux kernel is vulnerable to a stack-out-of-bounds
write in the ext4 filesystem code when mounting and writing to a crafted
ext4 image in ext4_update_inline_data(). An attacker could use this to
cause a system crash and a denial of service. (bnc#1099845)
- CVE-2018-10881: A flaw was found in the ext4 filesystem. A local user
can cause an out-of-bound access in ext4_get_group_info function, a
denial of service, and a system crash by mounting and operating on a
crafted ext4 filesystem image. (bnc#1099864)
- CVE-2018-10882: A flaw was found in the ext4 filesystem. A local user
can cause an out-of-bound write in fs/jbd2/transaction.c code, a
denial of service, and a system crash by unmounting a crafted ext4
filesystem image. (bnc#1099849)
- CVE-2018-10883: A flaw was found in the ext4 filesystem. A local user
can cause an out-of-bounds write in jbd2_journal_dirty_metadata(), a
denial of service, and a system crash by mounting and operating on a
crafted ext4 filesystem image. (bnc#1099863)
The following non-security bugs were fixed:
- acpi / lpss: Only call pwm_add_table() for Bay Trail PWM if PMIC HRV is
2 ... [Please see the references for more information on the vulnerabilities]
Affected Software/OS:
'Linux Kernel' package(s) on SUSE Linux Enterprise High Availability 15, SUSE Linux Enterprise Module for Basesystem 15, SUSE Linux Enterprise Module for Development Tools 15, SUSE Linux Enterprise Module for Legacy Software 15, SUSE Linux Enterprise Workstation Extension 15.
Solution:
Please install the updated package(s).
CVSS Score:
7.8
CVSS Vector:
AV:N/AC:L/Au:N/C:N/I:N/A:C
|
