SB2018070406 - SUSE Linux update for the Linux Kernel

Security Bulletin ID SB2018070406

Severity

Medium

Patch available

YES

Number of vulnerabilities 6

Exploitation vector Local access

Highest impact Code execution

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 6 secuirty vulnerabilities.

1) Out-of-bounds read (CVE-ID: CVE-2017-17741)

The vulnerability allows a local attacker to cause DoS condition on the target system.

The weakness exists due to an error in the KVM implementation in the Linux kernel. A local attacker can trigger write_mmio stack-based out-of-bounds read or possibly have unspecified other impact, related to arch/x86/kvm/x86.c and include/trace/events/kvm.h and cause the system to crash.

Successful exploitation of the vulnerability results in denial of service.

2) NULL pointer dereference (CVE-ID: CVE-2017-18241)

The vulnerability allows a local attacker to cause DoS condition on the target system.

The weakness exists in the fs/f2fs/segment.c source code file due to the use of the noflush_merge option, which could trigger a NULL value for a flush_cmd_control data structure. A local attacker can trigger NULL pointer dereference and kernel panic and cause the service to crash.

3) Race condition (CVE-ID: CVE-2017-18249)

The vulnerability allows a local attacker to cause DoS condition on the target system.

The weakness exists in the add_free_nid function due to race condition. A local attacker can trigger memory corruption and cause the service to crash.

4) Memory corruption (CVE-ID: CVE-2018-12233)

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The vulnerability exists in the ea_get function due to boundary error when calling setxattr twice with two different extended attribute names on the same file, as defined in the fs/jfs/xattr.c source code file. A local attacker can create a file or execute a program that submits malicious input, trigger a slab-out-of-bounds condition and cause the system crash or execute arbitrary code with elevated privileges.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

5) Side-channel attack (CVE-ID: CVE-2018-3665)

The vulnerability allows a local attacker to obtain potentially sensitive information.

The vulnerability exists due to utilizing the Lazy FP state restore technique for floating point state when context switching between application processes. A local attacker can conduct cache side-channel attacks and determine register values of other processes.

Note: This vulnerability is known as LazyFP.

6) Integer overflow (CVE-ID: CVE-2018-5848)

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The weakness exists In the function wmi_set_ie() due to the length validation code does not handle unsigned integer overflow properly. A local attacker can supply a large value of the 'ie_len' argument, trigger memory corruption and gain root privileges.

Remediation

Install update from vendor's website.

References

http://lists.suse.com/pipermail/sle-security-updates/2018-June/004205.html