| Description: | Summary:
The remote host is missing an update for the 'Linux Kernel' package(s) announced via the SUSE-SU-2018:3961-1 advisory.
Vulnerability Insight:
The SUSE Linux Enterprise 15 azure kernel was updated to receive various security and bugfixes.
The following security bugs were fixed:
CVE-2018-9363: Fixed an integer overflow that could have been used for
an out of bounds write with no additional execution privileges needed.
User interaction is not needed for exploitation (bsc#1105292).
CVE-2018-6555: The irda_setsockopt function in net/irda/af_irda.c was
fixed in drivers/staging/irda/net/af_irda.c that allowed local users to
cause a denial of service (ias_object use-after-free and system crash)
or possibly have unspecified other impact via an AF_IRDA socket
(bsc#1106511).
CVE-2018-6554: Fixed memory leak in the irda_bind function in
net/irda/af_irda.c and later in drivers/staging/irda/net/af_irda.c that
allowed local users to cause a denial of service (memory consumption) by
repeatedly binding an AF_IRDA socket (bsc#1106509).
CVE-2018-18710: An information leak was fixed in cdrom_ioctl_select_disc
in drivers/cdrom/cdrom.c that could have been used by local attackers to
read kernel memory because a cast from unsigned long to int interferes
with bounds checking. This is similar to CVE-2018-10940 and
CVE-2018-16658 (bsc#1113751).
CVE-2018-18445: Fixed faulty computation of numeric bounds in the BPF
verifier that now permits out-of-bounds memory accesses because
adjust_scalar_min_max_vals in kernel/bpf/verifier.c mishandled 32-bit
right shifts (bsc#1112372).
CVE-2018-17182: The vmacache_flush_all function in mm/vmacache.c was
fixed that was vulnerable to sequence number overflows. An attacker can
trigger a use-after-free (and possibly gain privileges) via certain
thread creation, map, unmap, invalidation, and dereference operations.
(bsc#1108399).
CVE-2018-16658: An information leak in cdrom_ioctl_drive_status in
drivers/cdrom/cdrom.c was fixed that could have leed to be used by local
attackers to read kernel memory because a cast from unsigned long to int
interferes with bounds checking. This is similar to CVE-2018-10940
(bsc#1107689).
CVE-2018-15572: The spectre_v2_select_mitigation function in
arch/x86/kernel/cpu/bugs.c was not always fill RSB upon a context
switch, which makes it easier for attackers to conduct
userspace-userspace spectreRSB attacks. (bsc#1102517)
CVE-2018-14633: A security flaw was fixed in the
chap_server_compute_md5() function in the ISCSI target code in a way an
authentication request from an ISCSI initiator is processed. An
unauthenticated remote attacker can cause a stack buffer overflow and
smash up to 17 bytes of the stack. The attack requires the iSCSI target
to be enabled on the victim host. Depending on how the target's code was
built (i.e. depending on a compiler, compile flags and hardware
architecture) an attack may lead to a system crash and thus to a
denial-of-service or possibly to a non-authorized access to data
exported by an iSCSI ... [Please see the references for more information on the vulnerabilities]
Affected Software/OS:
'Linux Kernel' package(s) on SUSE Linux Enterprise Module for Public Cloud 15.
Solution:
Please install the updated package(s).
CVSS Score:
8.3
CVSS Vector:
AV:N/AC:M/Au:N/C:P/I:P/A:C
|
