Vulnerabilities > CVE-2018-10124 - Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Linux Kernel

047910
CVSS 2.1 - LOW
Attack vector
LOCAL
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
PARTIAL
local
low complexity
linux
debian
canonical
CWE-119
nessus

Summary

The kill_something_info function in kernel/signal.c in the Linux kernel before 4.13, when an unspecified architecture and compiler is used, might allow local users to cause a denial of service via an INT_MIN argument.

Vulnerable Configurations

Part Description Count
OS
Linux
2676
OS
Debian
1
OS
Canonical
2

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Buffer Overflow via Environment Variables
    This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
  • Overflow Buffers
    Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
  • Client-side Injection-induced Buffer Overflow
    This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
  • Filter Failure through Buffer Overflow
    In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
  • MIME Conversion
    An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.

Nessus

  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2018-514.NASL
    descriptionThe openSUSE Leap 42.3 kernel was updated to 4.4.132 to receive various security and bugfixes. The following security bugs were fixed : - CVE-2018-3639: Information leaks using
    last seen2020-06-05
    modified2018-05-25
    plugin id110104
    published2018-05-25
    reporterThis script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/110104
    titleopenSUSE Security Update : the Linux Kernel (openSUSE-2018-514) (Spectre)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from openSUSE Security Update openSUSE-2018-514.
    #
    # The text description of this plugin is (C) SUSE LLC.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(110104);
      script_version("1.5");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");
    
      script_cve_id("CVE-2017-18257", "CVE-2018-1000199", "CVE-2018-10087", "CVE-2018-10124", "CVE-2018-1065", "CVE-2018-1130", "CVE-2018-3639", "CVE-2018-5803", "CVE-2018-7492", "CVE-2018-8781", "CVE-2018-8822");
    
      script_name(english:"openSUSE Security Update : the Linux Kernel (openSUSE-2018-514) (Spectre)");
      script_summary(english:"Check for the openSUSE-2018-514 patch");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote openSUSE host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "The openSUSE Leap 42.3 kernel was updated to 4.4.132 to receive
    various security and bugfixes.
    
    The following security bugs were fixed :
    
      - CVE-2018-3639: Information leaks using 'Memory
        Disambiguation' feature in modern CPUs were mitigated,
        aka 'Spectre Variant 4' (bnc#1087082).
    
        A new boot commandline option was introduced,
        'spec_store_bypass_disable', which can have following
        values :
    
      - auto: Kernel detects whether your CPU model contains an
        implementation of Speculative Store Bypass and picks the
        most appropriate mitigation.
    
      - on: disable Speculative Store Bypass
    
      - off: enable Speculative Store Bypass
    
      - prctl: Control Speculative Store Bypass per thread via
        prctl. Speculative Store Bypass is enabled for a process
        by default. The state of the control is inherited on
        fork.
    
      - seccomp: Same as 'prctl' above, but all seccomp threads
        will disable SSB unless they explicitly opt out.
    
        The default is 'seccomp', meaning programs need explicit
        opt-in into the mitigation.
    
        Status can be queried via the
        /sys/devices/system/cpu/vulnerabilities/spec_store_bypas
        s file, containing :
    
      - 'Vulnerable'
    
      - 'Mitigation: Speculative Store Bypass disabled'
    
      - 'Mitigation: Speculative Store Bypass disabled via
        prctl'
    
      - 'Mitigation: Speculative Store Bypass disabled via prctl
        and seccomp'
    
      - CVE-2017-18257: The __get_data_block function in
        fs/f2fs/data.c allowed local users to cause a denial of
        service (integer overflow and loop) via crafted use of
        the open and fallocate system calls with an
        FS_IOC_FIEMAP ioctl. (bnc#1088241)
    
      - CVE-2018-1130: Linux kernel was vulnerable to a NULL
        pointer dereference in dccp_write_xmit() function in
        net/dccp/output.c in that allowed a local user to cause
        a denial of service by a number of certain crafted
        system calls (bnc#1092904).
    
      - CVE-2018-5803: An error in the _sctp_make_chunk()
        function when handling SCTP, packet length could have
        been exploited by a malicious local user to cause a
        kernel crash and a DoS. (bnc#1083900).
    
      - CVE-2018-1065: The netfilter subsystem mishandled the
        case of a rule blob that contains a jump but lacks a
        user-defined chain, which allowed local users to cause a
        denial of service (NULL pointer dereference) by
        leveraging the CAP_NET_RAW or CAP_NET_ADMIN capability,
        related to arpt_do_table in
        net/ipv4/netfilter/arp_tables.c, ipt_do_table in
        net/ipv4/netfilter/ip_tables.c, and ip6t_do_table in
        net/ipv6/netfilter/ip6_tables.c (bnc#1083650).
    
      - CVE-2018-7492: A NULL pointer dereference was found in
        the net/rds/rdma.c __rds_rdma_map() function that
        allowed local attackers to cause a system panic and a
        denial-of-service, related to RDS_GET_MR and
        RDS_GET_MR_FOR_DEST (bnc#1082962).
    
      - CVE-2018-8781: The udl_fb_mmap function in
        drivers/gpu/drm/udl/udl_fb.c had an integer-overflow
        vulnerability allowing local users with access to the
        udldrmfb driver to obtain full read and write
        permissions on kernel physical pages, resulting in a
        code execution in kernel space (bnc#1090643).
    
      - CVE-2018-10124: The kill_something_info function in
        kernel/signal.c might have allowed local users to cause
        a denial of service via an INT_MIN argument
        (bnc#1089752).
    
      - CVE-2018-10087: The kernel_wait4 function in
        kernel/exit.c might have allowed local users to cause a
        denial of service by triggering an attempted use of the
        -INT_MIN value (bnc#1089608).
    
      - CVE-2018-8822: Incorrect buffer length handling in the
        ncp_read_kernel function in fs/ncpfs/ncplib_kernel.c
        could be exploited by malicious NCPFS servers to crash
        the kernel or execute code (bnc#1086162).
    
      - CVE-2018-1000199: A bug in x86 debug register handling
        of ptrace() could lead to memory corruption, possibly a
        denial of service or privilege escalation (bsc#1089895).
    
    The following non-security bugs were fixed :
    
      - acpica: Disassembler: Abort on an invalid/unknown AML
        opcode (bnc#1012382).
    
      - acpica: Events: Add runtime stub support for event APIs
        (bnc#1012382).
    
      - acpi / hotplug / PCI: Check presence of slot itself in
        get_slot_status() (bnc#1012382).
    
      - acpi, PCI, irq: remove redundant check for null string
        pointer (bnc#1012382).
    
      - acpi / scan: Send change uevent with offine
        environmental data (bsc#1082485).
    
      - acpi / video: Add quirk to force acpi-video backlight on
        Samsung 670Z5E (bnc#1012382).
    
      - alsa: aloop: Add missing cable lock to ctl API callbacks
        (bnc#1012382).
    
      - alsa: aloop: Mark paused device as inactive
        (bnc#1012382).
    
      - alsa: asihpi: Hardening for potential Spectre v1
        (bnc#1012382).
    
      - alsa: control: Hardening for potential Spectre v1
        (bnc#1012382).
    
      - alsa: core: Report audio_tstamp in snd_pcm_sync_ptr
        (bnc#1012382).
    
      - alsa: hda/conexant - Add fixup for HP Z2 G4 workstation
        (bsc#1092975).
    
      - alsa: hda: Hardening for potential Spectre v1
        (bnc#1012382).
    
      - alsa: hda - New VIA controller suppor no-snoop path
        (bnc#1012382).
    
      - alsa: hda/realtek - Add some fixes for ALC233
        (bnc#1012382).
    
      - alsa: hdspm: Hardening for potential Spectre v1
        (bnc#1012382).
    
      - alsa: line6: Use correct endpoint type for midi output
        (bnc#1012382).
    
      - alsa: opl3: Hardening for potential Spectre v1
        (bnc#1012382).
    
      - alsa: oss: consolidate kmalloc/memset 0 call to kzalloc
        (bnc#1012382).
    
      - alsa: pcm: Avoid potential races between OSS ioctls and
        read/write (bnc#1012382).
    
      - alsa: pcm: Check PCM state at xfern compat ioctl
        (bnc#1012382).
    
      - alsa: pcm: Fix endless loop for XRUN recovery in OSS
        emulation (bnc#1012382).
    
      - alsa: pcm: Fix mutex unbalance in OSS emulation ioctls
        (bnc#1012382).
    
      - alsa: pcm: Fix UAF at PCM release via PCM timer access
        (bnc#1012382).
    
      - alsa: pcm: potential uninitialized return values
        (bnc#1012382).
    
      - alsa: pcm: Return -EBUSY for OSS ioctls changing busy
        streams (bnc#1012382).
    
      - alsa: pcm: Use dma_bytes as size parameter in
        dma_mmap_coherent() (bnc#1012382).
    
      - alsa: pcm: Use ERESTARTSYS instead of EINTR in OSS
        emulation (bnc#1012382).
    
      - alsa: rawmidi: Fix missing input substream checks in
        compat ioctls (bnc#1012382).
    
      - alsa: rme9652: Hardening for potential Spectre v1
        (bnc#1012382).
    
      - alsa: seq: Fix races at MIDI encoding in
        snd_virmidi_output_trigger() (bnc#1012382).
    
      - alsa: seq: oss: Fix unbalanced use lock for synth MIDI
        device (bnc#1012382).
    
      - alsa: seq: oss: Hardening for potential Spectre v1
        (bnc#1012382).
    
      - alsa: usb-audio: Skip broken EU on Dell dock USB-audio
        (bsc#1090658).
    
      - arm64: Add ARM_SMCCC_ARCH_WORKAROUND_1 BP hardening
        support (bsc#1068032).
    
      - arm64: avoid overflow in VA_START and PAGE_OFFSET
        (bnc#1012382).
    
      - arm64: capabilities: Handle duplicate entries for a
        capability (bsc#1068032).
    
      - arm64: cpufeature: __this_cpu_has_cap() shouldn't stop
        early (bsc#1068032).
    
      - arm64: Enforce BBM for huge IO/VMAP mappings
        (bsc#1088313).
    
      - arm64: fix smccc compilation (bsc#1068032).
    
      - arm64: futex: Fix undefined behaviour with
        FUTEX_OP_OPARG_SHIFT usage (bnc#1012382).
    
      - arm64: Kill PSCI_GET_VERSION as a variant-2 workaround
        (bsc#1068032).
    
      - arm64: kvm: Add SMCCC_ARCH_WORKAROUND_1 fast handling
        (bsc#1068032).
    
      - arm64: kvm: Increment PC after handling an SMC trap
        (bsc#1068032).
    
      - arm64: kvm: Report SMCCC_ARCH_WORKAROUND_1 BP hardening
        support (bsc#1068032).
    
      - arm64: mm: fix thinko in non-global page table attribute
        check (bsc#1088050).
    
      - arm64: Relax ARM_SMCCC_ARCH_WORKAROUND_1 discovery
        (bsc#1068032).
    
      - arm: amba: Do not read past the end of sysfs
        'driver_override' buffer (bnc#1012382).
    
      - arm: amba: Fix race condition with driver_override
        (bnc#1012382).
    
      - arm: amba: Make driver_override output consistent with
        other buses (bnc#1012382).
    
      - arm/arm64: kvm: Add PSCI_VERSION helper (bsc#1068032).
    
      - arm/arm64: kvm: Add smccc accessors to PSCI code
        (bsc#1068032).
    
      - arm/arm64: kvm: Advertise SMCCC v1.1 (bsc#1068032).
    
      - arm/arm64: kvm: Consolidate the PSCI include files
        (bsc#1068032).
    
      - arm/arm64: kvm: Implement PSCI 1.0 support
        (bsc#1068032).
    
      - arm/arm64: kvm: Turn kvm_psci_version into a static
        inline (bsc#1068032).
    
      - arm/arm64: smccc: Implement SMCCC v1.1 inline primitive
        (bsc#1068032).
    
      - arm/arm64: smccc: Make function identifiers an unsigned
        quantity (bsc#1068032).
    
      - arm: davinci: da8xx: Create DSP device only when
        assigned memory (bnc#1012382).
    
      - arm: dts: am57xx-beagle-x15-common: Add overide
        powerhold property (bnc#1012382).
    
      - arm: dts: at91: at91sam9g25: fix mux-mask pinctrl
        property (bnc#1012382).
    
      - arm: dts: at91: sama5d4: fix pinctrl compatible string
        (bnc#1012382).
    
      - arm: dts: dra7: Add power hold and power controller
        properties to palmas (bnc#1012382).
    
      - arm: dts: imx53-qsrb: Pulldown PMIC IRQ pin
        (bnc#1012382).
    
      - arm: dts: imx6qdl-wandboard: Fix audio channel swap
        (bnc#1012382).
    
      - arm: dts: ls1021a: add 'fsl,ls1021a-esdhc' compatible
        string to esdhc node (bnc#1012382).
    
      - arm: imx: Add MXC_CPU_IMX6ULL and cpu_is_imx6ull
        (bnc#1012382).
    
      - arp: fix arp_filter on l3slave devices (bnc#1012382).
    
      - arp: honour gratuitous ARP _replies_ (bnc#1012382).
    
      - ASoC: fsl_esai: Fix divisor calculation failure at lower
        ratio (bnc#1012382).
    
      - ASoC: Intel: cht_bsw_rt5645: Analog Mic support
        (bnc#1012382).
    
      - ASoC: rsnd: SSI PIO adjust to 24bit mode (bnc#1012382).
    
      - ASoC: ssm2602: Replace reg_default_raw with reg_default
        (bnc#1012382).
    
      - async_tx: Fix DMA_PREP_FENCE usage in
        do_async_gen_syndrome() (bnc#1012382).
    
      - ata: libahci: properly propagate return value of
        platform_get_irq() (bnc#1012382).
    
      - ath10k: fix rfc1042 header retrieval in QCA4019 with eth
        decap mode (bnc#1012382).
    
      - ath10k: rebuild crypto header in rx data frames
        (bnc#1012382).
    
      - ath5k: fix memory leak on buf on failed eeprom read
        (bnc#1012382).
    
      - ath9k_hw: check if the chip failed to wake up
        (bnc#1012382).
    
      - atm: zatm: Fix potential Spectre v1 (bnc#1012382).
    
      - audit: add tty field to LOGIN event (bnc#1012382).
    
      - autofs: mount point create should honour passed in mode
        (bnc#1012382).
    
      - bcache: segregate flash only volume write streams
        (bnc#1012382).
    
      - bcache: stop writeback thread after detaching
        (bnc#1012382).
    
      - bdi: Fix oops in wb_workfn() (bnc#1012382).
    
      - blacklist.conf: Add an omapdrm entry (bsc#1090708,
        bsc#1090718)
    
      - blk-mq: fix bad clear of RQF_MQ_INFLIGHT in
        blk_mq_ct_ctx_init() (bsc#1085058).
    
      - blk-mq: fix kernel oops in blk_mq_tag_idle()
        (bnc#1012382).
    
      - block: correctly mask out flags in blk_rq_append_bio()
        (bsc#1085058).
    
      - block/loop: fix deadlock after loop_set_status
        (bnc#1012382).
    
      - block: sanity check for integrity intervals
        (bsc#1091728).
    
      - bluetooth: Fix missing encryption refresh on Security
        Request (bnc#1012382).
    
      - bluetooth: Send HCI Set Event Mask Page 2 command only
        when needed (bnc#1012382).
    
      - bna: Avoid reading past end of buffer (bnc#1012382).
    
      - bnx2x: Allow vfs to disable txvlan offload
        (bnc#1012382).
    
      - bonding: do not set slave_dev npinfo before
        slave_enable_netpoll in bond_enslave (bnc#1012382).
    
      - bonding: Do not update slave->link until ready to commit
        (bnc#1012382).
    
      - bonding: fix the err path for dev hwaddr sync in
        bond_enslave (bnc#1012382).
    
      - bonding: move dev_mc_sync after master_upper_dev_link in
        bond_enslave (bnc#1012382).
    
      - bonding: process the err returned by dev_set_allmulti
        properly in bond_enslave (bnc#1012382).
    
      - bpf: map_get_next_key to return first key on NULL
        (bnc#1012382).
    
      - btrfs: fix incorrect error return ret being passed to
        mapping_set_error (bnc#1012382).
    
      - btrfs: Fix wrong first_key parameter in replace_path
        (Followup fix for bsc#1084721).
    
      - btrfs: Only check first key for committed tree blocks
        (bsc#1084721).
    
      - btrfs: Validate child tree block's level and first key
        (bsc#1084721).
    
      - bus: brcmstb_gisb: correct support for 64-bit address
        output (bnc#1012382).
    
      - bus: brcmstb_gisb: Use register offsets with writes too
        (bnc#1012382).
    
      - can: kvaser_usb: Increase correct stats counter in
        kvaser_usb_rx_can_msg() (bnc#1012382).
    
      - cdc_ether: flag the Cinterion AHS8 modem by gemalto as
        WWAN (bnc#1012382).
    
      - cdrom: information leak in cdrom_ioctl_media_changed()
        (bnc#1012382).
    
      - ceph: adding protection for showing cap reservation info
        (bsc#1089115).
    
      - ceph: always update atime/mtime/ctime for new inode
        (bsc#1089115).
    
      - ceph: check if mds create snaprealm when setting quota
        (fate#324665 bsc#1089115).
    
      - ceph: do not check quota for snap inode (fate#324665
        bsc#1089115).
    
      - ceph: fix invalid point dereference for error case in
        mdsc destroy (bsc#1089115).
    
      - ceph: fix root quota realm check (fate#324665
        bsc#1089115).
    
      - ceph: fix rsize/wsize capping in
        ceph_direct_read_write() (bsc#1089115).
    
      - ceph: quota: add counter for snaprealms with quota
        (fate#324665 bsc#1089115).
    
      - ceph: quota: add initial infrastructure to support
        cephfs quotas (fate#324665 bsc#1089115).
    
      - ceph: quota: cache inode pointer in ceph_snap_realm
        (fate#324665 bsc#1089115).
    
      - ceph: quota: do not allow cross-quota renames
        (fate#324665 bsc#1089115).
    
      - ceph: quota: report root dir quota usage in statfs
        (fate#324665 bsc#1089115).
    
      - ceph: quota: support for ceph.quota.max_bytes
        (fate#324665 bsc#1089115).
    
      - ceph: quota: support for ceph.quota.max_files
        (fate#324665 bsc#1089115).
    
      - ceph: quota: update MDS when max_bytes is approaching
        (fate#324665 bsc#1089115).
    
      - cfg80211: make RATE_INFO_BW_20 the default
        (bnc#1012382).
    
      - ch9200: use skb_cow_head() to deal with cloned skbs
        (bsc#1088684).
    
      - cifs: do not allow creating sockets except with SMB1
        posix exensions (bnc#1012382).
    
      - cifs: silence compiler warnings showing up with
        gcc-8.0.0 (bsc#1090734).
    
      - cifs: silence lockdep splat in cifs_relock_file()
        (bnc#1012382).
    
      - cifs: Use file_dentry() (bsc#1093008).
    
      - clk: bcm2835: De-assert/assert PLL reset signal when
        appropriate (bnc#1012382).
    
      - clk: Fix __set_clk_rates error print-string
        (bnc#1012382).
    
      - clk: mvebu: armada-38x: add support for 1866MHz variants
        (bnc#1012382).
    
      - clk: mvebu: armada-38x: add support for missing clocks
        (bnc#1012382).
    
      - clk: scpi: fix return type of __scpi_dvfs_round_rate
        (bnc#1012382).
    
      - clocksource/drivers/arm_arch_timer: Avoid infinite
        recursion when ftrace is enabled (bsc#1090225).
    
      - cpumask: Add helper cpumask_available() (bnc#1012382).
    
      - crypto: af_alg - fix possible uninit-value in alg_bind()
        (bnc#1012382).
    
      - crypto: ahash - Fix early termination in hash walk
        (bnc#1012382).
    
      - crypto: x86/cast5-avx - fix ECB encryption when long sg
        follows short one (bnc#1012382).
    
      - cx25840: fix unchecked return values (bnc#1012382).
    
      - cxgb4: fix incorrect cim_la output for T6 (bnc#1012382).
    
      - cxgb4: Fix queue free path of ULD drivers (bsc#1022743
        FATE#322540).
    
      - cxgb4: FW upgrade fixes (bnc#1012382).
    
      - cxgb4vf: Fix SGE FL buffer initialization logic for 64K
        pages (bnc#1012382).
    
      - dccp: initialize ireq->ir_mark (bnc#1012382).
    
      - dmaengine: at_xdmac: fix rare residue corruption
        (bnc#1012382).
    
      - dmaengine: imx-sdma: Handle return value of
        clk_prepare_enable (bnc#1012382).
    
      - dm ioctl: remove double parentheses (bnc#1012382).
    
      - Documentation: pinctrl: palmas: Add
        ti,palmas-powerhold-override property definition
        (bnc#1012382).
    
      - Do not leak MNT_INTERNAL away from internal mounts
        (bnc#1012382).
    
      - drivers/infiniband/core/verbs.c: fix build with
        gcc-4.4.4 (FATE#321732).
    
      - drivers/infiniband/ulp/srpt/ib_srpt.c: fix build with
        gcc-4.4.4 (bnc#1024296,FATE#321265).
    
      - drivers/misc/vmw_vmci/vmci_queue_pair.c: fix a couple
        integer overflow tests (bnc#1012382).
    
      - drm/omap: fix tiled buffer stride calculations
        (bnc#1012382).
    
      - drm/radeon: Fix PCIe lane width calculation
        (bnc#1012382).
    
      - drm/virtio: fix vq wait_event condition (bnc#1012382).
    
      - drm/vmwgfx: Fix a buffer object leak (bnc#1012382).
    
      - e1000e: fix race condition around skb_tstamp_tx()
        (bnc#1012382).
    
      - e1000e: Undo e1000e_pm_freeze if __e1000_shutdown fails
        (bnc#1012382).
    
      - EDAC, mv64x60: Fix an error handling path (bnc#1012382).
    
      - Enable uinput driver (bsc#1092566).
    
      - esp: Fix memleaks on error paths (git-fixes).
    
      - ext4: add validity checks for bitmap block numbers
        (bnc#1012382).
    
      - ext4: bugfix for mmaped pages in
        mpage_release_unused_pages() (bnc#1012382).
    
      - ext4: do not allow r/w mounts if metadata blocks overlap
        the superblock (bnc#1012382).
    
      - ext4: do not update checksum of new initialized bitmaps
        (bnc#1012382).
    
      - ext4: fail ext4_iget for root directory if unallocated
        (bnc#1012382).
    
      - ext4: fix bitmap position validation (bnc#1012382).
    
      - ext4: fix deadlock between inline_data and
        ext4_expand_extra_isize_ea() (bnc#1012382).
    
      - ext4: Fix hole length detection in ext4_ind_map_blocks()
        (bsc#1090953).
    
      - ext4: fix off-by-one on max nr_pages in
        ext4_find_unwritten_pgoff() (bnc#1012382).
    
      - ext4: prevent right-shifting extents beyond
        EXT_MAX_BLOCKS (bnc#1012382).
    
      - ext4: set h_journal if there is a failure starting a
        reserved handle (bnc#1012382).
    
      - fanotify: fix logic of events on child (bnc#1012382).
    
      - firmware/psci: Expose PSCI conduit (bsc#1068032).
    
      - firmware/psci: Expose SMCCC version through psci_ops
        (bsc#1068032).
    
      - fix race in drivers/char/random.c:get_reg()
        (bnc#1012382).
    
      - frv: declare jiffies to be located in the .data section
        (bnc#1012382).
    
      - fs: compat: Remove warning from COMPATIBLE_IOCTL
        (bnc#1012382).
    
      - fs/proc: Stop trying to report thread stacks
        (bnc#1012382).
    
      - fs/reiserfs/journal.c: add missing resierfs_warning()
        arg (bnc#1012382).
    
      - genirq: Use cpumask_available() for check of cpumask
        variable (bnc#1012382).
    
      - getname_kernel() needs to make sure that ->name !=
        ->iname in long case (bnc#1012382).
    
      - gpio: label descriptors using the device name
        (bnc#1012382).
    
      - gpmi-nand: Handle ECC Errors in erased pages
        (bnc#1012382).
    
      - hdlcdrv: Fix divide by zero in hdlcdrv_ioctl
        (bnc#1012382).
    
      - HID: core: Fix size as type u32 (bnc#1012382).
    
      - HID: Fix hid_report_len usage (bnc#1012382).
    
      - HID: hidraw: Fix crash on HIDIOCGFEATURE with a
        destroyed device (bnc#1012382).
    
      - HID: i2c-hid: fix size check and type usage
        (bnc#1012382).
    
      - hwmon: (ina2xx) Fix access to uninitialized mutex
        (git-fixes).
    
      - hwmon: (ina2xx) Make calibration register value fixed
        (bnc#1012382).
    
      - hypfs_kill_super(): deal with failed allocations
        (bnc#1012382).
    
      - i40iw: Free IEQ resources (bsc#969476 FATE#319648
        bsc#969477 FATE#319816).
    
      - IB/core: Fix possible crash to access NULL netdev
        (bsc#966191 FATE#320230 bsc#966186 FATE#320228).
    
      - IB/core: Generate GID change event regardless of RoCE
        GID table property (bsc#966191 FATE#320230 bsc#966186
        FATE#320228).
    
      - IB/mlx4: Fix corruption of RoCEv2 IPv4 GIDs (bsc#966191
        FATE#320230 bsc#966186 FATE#320228).
    
      - IB/mlx4: Include GID type when deleting GIDs from HW
        table under RoCE (bsc#966191 FATE#320230 bsc#966186
        FATE#320228).
    
      - IB/mlx5: Avoid passing an invalid QP type to firmware
        (bsc#1015342 FATE#321688 bsc#1015343 FATE#321689).
    
      - IB/mlx5: Fix an error code in __mlx5_ib_modify_qp()
        (bsc#966170 FATE#320225 bsc#966172 FATE#320226).
    
      - IB/mlx5: Fix incorrect size of klms in the memory region
        (bsc#966170 FATE#320225 bsc#966172 FATE#320226).
    
      - IB/mlx5: Fix out-of-bounds read in
        create_raw_packet_qp_rq (bsc#966170 FATE#320225
        bsc#966172 FATE#320226).
    
      - IB/mlx5: revisit -Wmaybe-uninitialized warning
        (bsc#1015342 FATE#321688 bsc#1015343 FATE#321689).
    
      - IB/mlx5: Set the default active rate and width to QDR
        and 4X (bsc#1015342 FATE#321688 bsc#1015343
        FATE#321689).
    
      - IB/mlx5: Use unlimited rate when static rate is not
        supported (bnc#1012382).
    
      - ibmvnic: Clean actual number of RX or TX pools
        (bsc#1092289).
    
      - ibmvnic: Clear pending interrupt after device reset
        (bsc#1089644).
    
      - ibmvnic: Define vnic_login_client_data name field as
        unsized array (bsc#1089198).
    
      - ibmvnic: Disable irqs before exiting reset from closed
        state (bsc#1084610).
    
      - ibmvnic: Do not notify peers on parameter change resets
        (bsc#1089198).
    
      - ibmvnic: Do not reset CRQ for Mobility driver resets
        (bsc#1088600).
    
      - ibmvnic: Fix DMA mapping mistakes (bsc#1088600).
    
      - ibmvnic: Fix failover case for non-redundant
        configuration (bsc#1088600).
    
      - ibmvnic: Fix non-fatal firmware error reset
        (bsc#1093990).
    
      - ibmvnic: Fix reset scheduler error handling
        (bsc#1088600).
    
      - ibmvnic: Fix statistics buffers memory leak
        (bsc#1093990).
    
      - ibmvnic: Free coherent DMA memory if FW map failed
        (bsc#1093990).
    
      - ibmvnic: Handle all login error conditions
        (bsc#1089198).
    
      - ibmvnic: Zero used TX descriptor counter on reset
        (bsc#1088600).
    
      - ib/srp: Fix completion vector assignment algorithm
        (bnc#1012382).
    
      - ib/srp: Fix srp_abort() (bnc#1012382).
    
      - ib/srpt: Fix abort handling (bnc#1012382).
    
      - ib/srpt: Fix an out-of-bounds stack access in
        srpt_zerolength_write() (bnc#1024296,FATE#321265).
    
      - iio: hi8435: avoid garbage event at first enable
        (bnc#1012382).
    
      - iio: hi8435: cleanup reset gpio (bnc#1012382).
    
      - iio: magnetometer: st_magn_spi: fix spi_device_id table
        (bnc#1012382).
    
      - input: ALPS - fix multi-touch decoding on SS4 plus
        touchpads (git-fixes).
    
      - input: ALPS - fix trackstick button handling on V8
        devices (git-fixes).
    
      - input: ALPS - fix TrackStick support for SS5 hardware
        (git-fixes).
    
      - input: ALPS - fix two-finger scroll breakage in right
        side on ALPS touchpad (git-fixes).
    
      - input: atmel_mxt_ts - add touchpad button mapping for
        Samsung Chromebook Pro (bnc#1012382).
    
      - input: drv260x - fix initializing overdrive voltage
        (bnc#1012382).
    
      - input: elan_i2c - check if device is there before really
        probing (bnc#1012382).
    
      - input: elan_i2c - clear INT before resetting controller
        (bnc#1012382).
    
      - input: elantech - force relative mode on a certain
        module (bnc#1012382).
    
      - input: i8042 - add Lenovo ThinkPad L460 to i8042 reset
        list (bnc#1012382).
    
      - input: i8042 - enable MUX on Sony VAIO VGN-CS series to
        fix touchpad (bnc#1012382).
    
      - input: leds - fix out of bound access (bnc#1012382).
    
      - input: mousedev - fix implicit conversion warning
        (bnc#1012382).
    
      - iommu/vt-d: Fix a potential memory leak (bnc#1012382).
    
      - ip6_gre: better validate user provided tunnel names
        (bnc#1012382).
    
      - ip6_tunnel: better validate user provided tunnel names
        (bnc#1012382).
    
      - ipc/shm: fix use-after-free of shm file via
        remap_file_pages() (bnc#1012382).
    
      - ipmi: create hardware-independent softdep for
        ipmi_devintf (bsc#1009062, bsc#1060799).
    
      - ipmi_ssif: Fix kernel panic at msg_done_handler
        (bsc#1088871).
    
      - ipsec: check return value of skb_to_sgvec always
        (bnc#1012382).
    
      - ip_tunnel: better validate user provided tunnel names
        (bnc#1012382).
    
      - ipv6: add RTA_TABLE and RTA_PREFSRC to rtm_ipv6_policy
        (bnc#1012382).
    
      - ipv6: avoid dad-failures for addresses with NODAD
        (bnc#1012382).
    
      - ipv6: sit: better validate user provided tunnel names
        (bnc#1012382).
    
      - ipv6: the entire IPv6 header chain must fit the first
        fragment (bnc#1012382).
    
      - ipvs: fix rtnl_lock lockups caused by start_sync_thread
        (bnc#1012382).
    
      - iw_cxgb4: print mapped ports correctly (bsc#321658
        FATE#1005778 bsc#321660 FATE#1005780 bsc#321661
        FATE#1005781).
    
      - jbd2: fix use after free in kjournald2() (bnc#1012382).
    
      - jbd2: if the journal is aborted then do not allow update
        of the log tail (bnc#1012382).
    
      - jffs2_kill_sb(): deal with failed allocations
        (bnc#1012382).
    
      - jiffies.h: declare jiffies and jiffies_64 with
        ____cacheline_aligned_in_smp (bnc#1012382).
    
      - kABI: add tty include to audit.c (kabi).
    
      - kABI: protect hid report functions (kabi).
    
      - kABI: protect jiffies types (kabi).
    
      - kABI: protect skb_to_sgvec* (kabi).
    
      - kABI: protect sound/timer.h include in sound pcm.c
        (kabi).
    
      - kABI: protect struct ath10k_hw_params (kabi).
    
      - kABI: protect struct cstate (kabi).
    
      - kABI: protect struct _lowcore (kabi).
    
      - kABI: protect tty include in audit.h (kabi).
    
      - kabi/severities: Ignore kgr_shadow_* kABI changes
    
      - kbuild: provide a __UNIQUE_ID for clang (bnc#1012382).
    
      - kexec_file: do not add extra alignment to efi memmap
        (bsc#1044596).
    
      - keys: DNS: limit the length of option strings
        (bnc#1012382).
    
      - kgraft/bnx2fc: Do not block kGraft in bnx2fc_l2_rcv
        kthread (bsc#1094033, fate#313296).
    
      - kGraft: fix small race in reversion code (bsc#1083125).
    
      - kobject: do not use WARN for registration failures
        (bnc#1012382).
    
      - kvm: Fix nopvspin static branch init usage
        (bsc#1056427).
    
      - kvm: Introduce nopvspin kernel parameter (bsc#1056427).
    
      - kvm: nVMX: Fix handling of lmsw instruction
        (bnc#1012382).
    
      - kvm: PPC: Book3S PR: Check copy_to/from_user return
        values (bnc#1012382).
    
      - kvm: s390: Enable all facility bits that are known good
        for passthrough (FATE#324071 LTC#158956 bnc#1012382
        bsc#1073059 bsc#1076805).
    
      - kvm: SVM: do not zero out segment attributes if segment
        is unusable or not present (bnc#1012382).
    
      - l2tp: check sockaddr length in pppol2tp_connect()
        (bnc#1012382).
    
      - l2tp: fix missing print session offset info
        (bnc#1012382).
    
      - lan78xx: Correctly indicate invalid OTP (bnc#1012382).
    
      - leds: pca955x: Correct I2C Functionality (bnc#1012382).
    
      - libata: Apply NOLPM quirk for SanDisk SD7UB3Q*G1001 SSDs
        (bnc#1012382).
    
      - libceph, ceph: change permission for readonly debugfs
        entries (bsc#1089115).
    
      - libceph: fix misjudgement of maximum monitor number
        (bsc#1089115).
    
      - libceph: reschedule a tick in finish_hunting()
        (bsc#1089115).
    
      - libceph: un-backoff on tick when we have a authenticated
        session (bsc#1089115).
    
      - libceph: validate con->state at the top of try_write()
        (bsc#1089115).
    
      - livepatch: Allow to call a custom callback when freeing
        shadow variables (bsc#1082299 fate#313296).
    
      - livepatch: Initialize shadow variables safely by a
        custom callback (bsc#1082299 fate#313296).
    
      - llc: delete timers synchronously in llc_sk_free()
        (bnc#1012382).
    
      - llc: fix NULL pointer deref for SOCK_ZAPPED
        (bnc#1012382).
    
      - llc: hold llc_sap before release_sock() (bnc#1012382).
    
      - llist: clang: introduce member_address_is_nonnull()
        (bnc#1012382).
    
      - lockd: fix lockd shutdown race (bnc#1012382).
    
      - lockd: lost rollback of set_grace_period() in
        lockd_down_net() (git-fixes).
    
      - mac80211: Add RX flag to indicate ICV stripped
        (bnc#1012382).
    
      - mac80211: allow not sending MIC up from driver for HW
        crypto (bnc#1012382).
    
      - mac80211: allow same PN for AMSDU sub-frames
        (bnc#1012382).
    
      - mac80211: bail out from prep_connection() if a reconfig
        is ongoing (bnc#1012382).
    
      - mceusb: sporadic RX truncation corruption fix
        (bnc#1012382).
    
      - md: document lifetime of internal rdev pointer
        (bsc#1056415).
    
      - md: fix two problems with setting the 're-add' device
        state (bsc#1089023).
    
      - md: only allow remove_and_add_spares when no sync_thread
        running (bsc#1056415).
    
      - md raid10: fix NULL deference in
        handle_write_completed() (git-fixes).
    
      - md/raid10: reset the 'first' at the end of loop
        (bnc#1012382).
    
      - md/raid5: make use of spin_lock_irq over
        local_irq_disable + spin_lock (bnc#1012382).
    
      - media: v4l2-compat-ioctl32: do not oops on overlay
        (bnc#1012382).
    
      - media: videobuf2-core: do not go out of the buffer range
        (bnc#1012382).
    
      - mei: remove dev_err message on an unsupported ioctl
        (bnc#1012382).
    
      - mISDN: Fix a sleep-in-atomic bug (bnc#1012382).
    
      - mlx5: fix bug reading rss_hash_type from CQE
        (bnc#1012382).
    
      - mmc: dw_mmc: Fix the DTO/CTO timeout overflow
        calculation for 32-bit systems (bsc#1088267).
    
      - mmc: jz4740: Fix race condition in IRQ mask update
        (bnc#1012382).
    
      - mm/filemap.c: fix NULL pointer in
        page_cache_tree_insert() (bnc#1012382).
    
      - mm, slab: reschedule cache_reap() on the same CPU
        (bnc#1012382).
    
      - mtd: cfi: cmdset_0001: Do not allow read/write to
        suspend erase block (bnc#1012382).
    
      - mtd: cfi: cmdset_0001: Workaround Micron Erase suspend
        bug (bnc#1012382).
    
      - mtd: cfi: cmdset_0002: Do not allow read/write to
        suspend erase block (bnc#1012382).
    
      - mtd: jedec_probe: Fix crash in jedec_read_mfr()
        (bnc#1012382).
    
      - neighbour: update neigh timestamps iff update is
        effective (bnc#1012382).
    
      - net: af_packet: fix race in PACKET_(R|T)X_RING
        (bnc#1012382).
    
      - net: atm: Fix potential Spectre v1 (bnc#1012382).
    
      - net: cavium: liquidio: fix up 'Avoid dma_unmap_single on
        uninitialized ndata' (bnc#1012382).
    
      - net: cdc_ncm: Fix TX zero padding (bnc#1012382).
    
      - net: emac: fix reset timeout with AR8035 phy
        (bnc#1012382).
    
      - net: ethernet: ti: cpsw: adjust cpsw fifos depth for
        fullduplex flow control (bnc#1012382).
    
      - netfilter: bridge: ebt_among: add more missing match
        size checks (bnc#1012382).
    
      - netfilter: ctnetlink: fix incorrect nf_ct_put during
        hash resize (bnc#1012382).
    
      - netfilter: ctnetlink: Make some parameters integer to
        avoid enum mismatch (bnc#1012382).
    
      - netfilter: nf_nat_h323: fix logical-not-parentheses
        warning (bnc#1012382).
    
      - netfilter: x_tables: add and use xt_check_proc_name
        (bnc#1012382).
    
      - net: fix deadlock while clearing neighbor proxy table
        (bnc#1012382).
    
      - net: fix possible out-of-bound read in
        skb_network_protocol() (bnc#1012382).
    
      - net: fix rtnh_ok() (bnc#1012382).
    
      - net: fix uninit-value in __hw_addr_add_ex()
        (bnc#1012382).
    
      - net: fool proof dev_valid_name() (bnc#1012382).
    
      - net: freescale: fix potential NULL pointer dereference
        (bnc#1012382).
    
      - net: hns: Fix ethtool private flags (bnc#1012382
        bsc#1085511).
    
      - net: hns: Fix ethtool private flags (bsc#1085511).
    
      - net: ieee802154: fix net_device reference release too
        early (bnc#1012382).
    
      - net: initialize skb->peeked when cloning (bnc#1012382).
    
      - net/ipv6: Fix route leaking between VRFs (bnc#1012382).
    
      - net/ipv6: Increment OUTxxx counters after netfilter hook
        (bnc#1012382).
    
      - netlink: fix uninit-value in netlink_sendmsg
        (bnc#1012382).
    
      - netlink: make sure nladdr has correct size in
        netlink_connect() (bnc#1012382).
    
      - net: llc: add lock_sock in llc_ui_bind to avoid a race
        condition (bnc#1012382).
    
      - net/mlx4: Check if Granular QoS per VF has been enabled
        before updating QP qos_vport (bnc#1012382).
    
      - net/mlx4_core: Fix memory leak while delete slave's
        resources (bsc#966191 FATE#320230 bsc#966186
        FATE#320228).
    
      - net/mlx4_en: Avoid adding steering rules with invalid
        ring (bnc#1012382).
    
      - net/mlx4_en: Fix mixed PFC and Global pause user control
        requests (bsc#1015336 FATE#321685 bsc#1015337
        FATE#321686 bsc#1015340 FATE#321687).
    
      - net/mlx4: Fix the check in attaching steering rules
        (bnc#1012382).
    
      - net/mlx5: avoid build warning for uniprocessor
        (bnc#1012382).
    
      - net/mlx5e: Add error print in ETS init (bsc#966170
        FATE#320225 bsc#966172 FATE#320226).
    
      - net/mlx5e: Check support before TC swap in ETS init
        (bsc#966170 FATE#320225 bsc#966172 FATE#320226).
    
      - net/mlx5e: E-Switch, Use the name of static array
        instead of its address (bsc#1015342 FATE#321688
        bsc#1015343 FATE#321689).
    
      - net/mlx5e: Remove unused define
        MLX5_MPWRQ_STRIDES_PER_PAGE (bsc#1015342 FATE#321688
        bsc#1015343 FATE#321689).
    
      - net/mlx5: Fix error handling in load one (bsc#1015342
        FATE#321688 bsc#1015343 FATE#321689).
    
      - net/mlx5: Fix ingress/egress naming mistake (bsc#1015342
        FATE#321688 bsc#1015343 FATE#321689).
    
      - net/mlx5: Tolerate irq_set_affinity_hint() failures
        (bnc#1012382).
    
      - net: move somaxconn init from sysctl code (bnc#1012382).
    
      - net: phy: avoid genphy_aneg_done() for PHYs without
        clause 22 support (bnc#1012382).
    
      - net: qca_spi: Fix alignment issues in rx path
        (bnc#1012382).
    
      - net sched actions: fix dumping which requires several
        messages to user space (bnc#1012382).
    
      - net/sched: fix NULL dereference in the error path of
        tcf_bpf_init() (bnc#1012382).
    
      - net: usb: qmi_wwan: add support for ublox R410M PID
        0x90b2 (bnc#1012382).
    
      - net: validate attribute sizes in neigh_dump_table()
        (bnc#1012382).
    
      - net: x25: fix one potential use-after-free issue
        (bnc#1012382).
    
      - net: xfrm: use preempt-safe this_cpu_read() in
        ipcomp_alloc_tfms() (bnc#1012382).
    
      - nfsv4.1: RECLAIM_COMPLETE must handle
        NFS4ERR_CONN_NOT_BOUND_TO_SESSION (bnc#1012382).
    
      - nfsv4.1: Work around a Linux server bug.. (bnc#1012382).
    
      - nospec: Kill array_index_nospec_mask_check()
        (bnc#1012382).
    
      - nospec: Move array_index_nospec() parameter checking
        into separate macro (bnc#1012382).
    
      - nvme: target: fix buffer overflow (FATE#321732
        FATE#321590 bsc#993388).
    
      - ocfs2/dlm: Fix up kABI in dlm_ctxt (bsc#1070404).
    
      - ocfs2/dlm: wait for dlm recovery done when migrating all
        lock resources (bsc#1070404).
    
      - ovl: filter trusted xattr for non-admin (bnc#1012382).
    
      - packet: fix bitfield update race (bnc#1012382).
    
      - parisc: Fix out of array access in match_pci_device()
        (bnc#1012382).
    
      - parport_pc: Add support for WCH CH382L PCI-E single
        parallel port card (bnc#1012382).
    
      - partitions/msdos: Unable to mount UFS 44bsd partitions
        (bnc#1012382).
    
      - PCI/ACPI: Fix bus range comparison in pci_mcfg_lookup()
        (bsc#1084699).
    
      - PCI/cxgb4: Extend T3 PCI quirk to T4+ devices
        (bsc#981348).
    
      - PCI: Make PCI_ROM_ADDRESS_MASK a 32-bit constant
        (bnc#1012382).
    
      - percpu: include linux/sched.h for cond_resched()
        (bnc#1012382).
    
      - perf/core: Correct event creation with PERF_FORMAT_GROUP
        (bnc#1012382).
    
      - perf/core: Fix locking for children siblings group read
        (git-fixes).
    
      - perf/core: Fix possible Spectre-v1 indexing for
        ->aux_pages[] (bnc#1012382).
    
      - perf/core: Fix the perf_cpu_time_max_percent check
        (bnc#1012382).
    
      - perf header: Set proper module name when build-id event
        found (bnc#1012382).
    
      - perf/hwbp: Simplify the perf-hwbp code, fix
        documentation (bnc#1012382).
    
      - perf intel-pt: Fix error recovery from missing TIP
        packet (bnc#1012382).
    
      - perf intel-pt: Fix overlap detection to identify
        consecutive buffers correctly (bnc#1012382).
    
      - perf intel-pt: Fix sync_switch (bnc#1012382).
    
      - perf intel-pt: Fix timestamp following overflow
        (bnc#1012382).
    
      - perf probe: Add warning message if there is unexpected
        event name (bnc#1012382).
    
      - perf: Remove superfluous allocation error check
        (bnc#1012382).
    
      - perf report: Ensure the perf DSO mapping matches what
        libdw sees (bnc#1012382).
    
      - perf: Return proper values for user stack errors
        (bnc#1012382).
    
      - perf tests: Decompress kernel module before objdump
        (bnc#1012382).
    
      - perf tools: Fix copyfile_offset update of output offset
        (bnc#1012382).
    
      - perf trace: Add mmap alias for s390 (bnc#1012382).
    
      - perf/x86/cstate: Fix possible Spectre-v1 indexing for
        pkg_msr (bnc#1012382).
    
      - perf/x86: Fix possible Spectre-v1 indexing for
        hw_perf_event cache_* (bnc#1012382).
    
      - perf/x86: Fix possible Spectre-v1 indexing for
        x86_pmu::event_map() (bnc#1012382).
    
      - perf/x86/msr: Fix possible Spectre-v1 indexing in the
        MSR driver (bnc#1012382).
    
      - pidns: disable pid allocation if pid_ns_prepare_proc()
        is failed in alloc_pid() (bnc#1012382).
    
      - platform/x86: ideapad-laptop: Add MIIX 720-12IKB to
        no_hw_rfkill (bsc#1093035).
    
      - pNFS/flexfiles: missing error code in
        ff_layout_alloc_lseg() (bnc#1012382).
    
      - powerpc/64: Fix smp_wmb barrier definition use use
        lwsync consistently (bnc#1012382).
    
      - powerpc/64s: Add barrier_nospec (bsc#1068032,
        bsc#1080157).
    
      - powerpc/64s: Add support for ori barrier_nospec patching
        (bsc#1068032, bsc#1080157).
    
      - powerpc/64s: Enable barrier_nospec based on firmware
        settings (bsc#1068032, bsc#1080157).
    
      - powerpc/64s: Enhance the information in
        cpu_show_meltdown() (bsc#1068032, bsc#1075087,
        bsc#1091041).
    
      - powerpc/64s: Enhance the information in
        cpu_show_spectre_v1() (bsc#1068032).
    
      - powerpc/64s: Fix section mismatch warnings from
        setup_rfi_flush() (bsc#1068032, bsc#1075087,
        bsc#1091041).
    
      - powerpc/64s: Move cpu_show_meltdown() (bsc#1068032,
        bsc#1075087, bsc#1091041).
    
      - powerpc/64s: Patch barrier_nospec in modules
        (bsc#1068032, bsc#1080157).
    
      - powerpc/64s: Wire up cpu_show_spectre_v1() (bsc#1068032,
        bsc#1075087, bsc#1091041).
    
      - powerpc/64s: Wire up cpu_show_spectre_v2() (bsc#1068032,
        bsc#1075087, bsc#1091041).
    
      - powerpc/64: Use barrier_nospec in syscall entry
        (bsc#1068032, bsc#1080157).
    
      - powerpc: Add security feature flags for Spectre/Meltdown
        (bsc#1068032, bsc#1075087, bsc#1091041).
    
      - powerpc/[booke|4xx]: Do not clobber TCR[WP] when setting
        TCR[DIE] (bnc#1012382).
    
      - powerpc: conditionally compile platform-specific serial
        drivers (bsc#1066223).
    
      - powerpc/crash: Remove the test for cpu_online in the IPI
        callback (bsc#1088242).
    
      - powerpc: Do not send system reset request through the
        oops path (bsc#1088242).
    
      - powerpc/eeh: Fix enabling bridge MMIO windows
        (bnc#1012382).
    
      - powerpc/fadump: Do not use hugepages when fadump is
        active (bsc#1092772).
    
      - powerpc/fadump: exclude memory holes while reserving
        memory in second kernel (bsc#1092772).
    
      - powerpc/lib: Fix off-by-one in alternate feature
        patching (bnc#1012382).
    
      - powerpc/mm: allow memory hotplug into a memoryless node
        (bsc#1090663).
    
      - powerpc/mm: Allow memory hotplug into an offline node
        (bsc#1090663).
    
      - powerpc: Move default security feature flags
        (bsc#1068032, bsc#1075087, bsc#1091041).
    
      - powerpc/powernv: define a standard delay for OPAL_BUSY
        type retry loops (bnc#1012382).
    
      - powerpc/powernv: Fix OPAL NVRAM driver OPAL_BUSY loops
        (bnc#1012382).
    
      - powerpc/powernv: Handle unknown OPAL errors in
        opal_nvram_write() (bnc#1012382).
    
      - powerpc/powernv: Set or clear security feature flags
        (bsc#1068032, bsc#1075087, bsc#1091041).
    
      - powerpc/powernv: Use the security flags in
        pnv_setup_rfi_flush() (bsc#1068032, bsc#1075087,
        bsc#1091041).
    
      - powerpc/pseries: Add new H_GET_CPU_CHARACTERISTICS flags
        (bsc#1068032, bsc#1075087, bsc#1091041).
    
      - powerpc/pseries: Fix clearing of security feature flags
        (bsc#1068032, bsc#1075087, bsc#1091041).
    
      - powerpc/pseries: Restore default security feature flags
        on setup (bsc#1068032, bsc#1075087, bsc#1091041).
    
      - powerpc/pseries: Set or clear security feature flags
        (bsc#1068032, bsc#1075087, bsc#1091041).
    
      - powerpc/pseries: Use the security flags in
        pseries_setup_rfi_flush() (bsc#1068032, bsc#1075087,
        bsc#1091041).
    
      - powerpc/rfi-flush: Always enable fallback flush on
        pseries (bsc#1068032, bsc#1075087, bsc#1091041).
    
      - powerpc/rfi-flush: Differentiate enabled and patched
        flush types (bsc#1068032, bsc#1075087, bsc#1091041).
    
      - powerpc/rfi-flush: Make it possible to call
        setup_rfi_flush() again (bsc#1068032, bsc#1075087,
        bsc#1091041).
    
      - powerpc: signals: Discard transaction state from signal
        frames (bsc#1094059).
    
      - powerpc/spufs: Fix coredump of SPU contexts
        (bnc#1012382).
    
      - powerpc: System reset avoid interleaving oops using die
        synchronisation (bsc#1088242).
    
      - powerpc: Use barrier_nospec in copy_from_user()
        (bsc#1068032, bsc#1080157).
    
      - pppoe: check sockaddr length in pppoe_connect()
        (bnc#1012382).
    
      - pptp: remove a buggy dst release in pptp_connect()
        (bnc#1012382).
    
      - qlge: Avoid reading past end of buffer (bnc#1012382).
    
      - r8152: add Linksys USB3GIGV1 id (bnc#1012382).
    
      - r8169: fix setting driver_data after register_netdev
        (bnc#1012382).
    
      - radeon: hide pointless #warning when compile testing
        (bnc#1012382).
    
      - random: use a tighter cap in credit_entropy_bits_safe()
        (bnc#1012382).
    
      - random: use lockless method of accessing and updating
        f->reg_idx (bnc#1012382).
    
      - ray_cs: Avoid reading past end of buffer (bnc#1012382).
    
      - rdma/core: Avoid that ib_drain_qp() triggers an
        out-of-bounds stack access (FATE#321732).
    
      - rdma/mlx5: Protect from NULL pointer derefence
        (bsc#1015342 FATE#321688 bsc#1015343 FATE#321689).
    
      - rdma/mlx5: Protect from shift operand overflow
        (bnc#1012382).
    
      - rdma/qedr: fix QP's ack timeout configuration
        (bsc#1022604 FATE#321747).
    
      - rdma/qedr: Fix QP state initialization race (bsc#1022604
        FATE#321747).
    
      - rdma/qedr: Fix rc initialization on CNQ allocation
        failure (bsc#1022604 FATE#321747).
    
      - rdma/rxe: Fix an out-of-bounds read (FATE#322149).
    
      - rdma/ucma: Allow resolving address w/o specifying source
        address (bnc#1012382).
    
      - rdma/ucma: Check AF family prior resolving address
        (bnc#1012382).
    
      - rdma/ucma: Check that device exists prior to accessing
        it (bnc#1012382).
    
      - rdma/ucma: Check that device is connected prior to
        access it (bnc#1012382).
    
      - rdma/ucma: Do not allow join attempts for unsupported AF
        family (bnc#1012382).
    
      - rdma/ucma: Do not allow setting RDMA_OPTION_IB_PATH
        without an RDMA device (bnc#1012382).
    
      - rdma/ucma: Ensure that CM_ID exists prior to access it
        (bnc#1012382).
    
      - rdma/ucma: Fix use-after-free access in ucma_close
        (bnc#1012382).
    
      - rdma/ucma: Introduce safer rdma_addr_size() variants
        (bnc#1012382).
    
      - rds; Reset rs->rs_bound_addr in rds_add_bound() failure
        path (bnc#1012382).
    
      - regulator: gpio: Fix some error handling paths in
        'gpio_regulator_probe()' (bsc#1091960).
    
      - resource: fix integer overflow at reallocation
        (bnc#1012382).
    
      - Revert 'alsa: pcm: Fix mutex unbalance in OSS emulation
        ioctls' (kabi).
    
      - Revert 'alsa: pcm: Return -EBUSY for OSS ioctls changing
        busy streams' (kabi).
    
      - Revert 'arm: dts: am335x-pepper: Fix the audio CODEC's
        reset pin' (bnc#1012382).
    
      - Revert 'arm: dts: omap3-n900: Fix the audio CODEC's
        reset pin' (bnc#1012382).
    
      - Revert 'ath10k: rebuild crypto header in rx data frames'
        (kabi).
    
      - Revert 'ath10k: send (re)assoc peer command when NSS
        changed' (bnc#1012382).
    
      - Revert 'Bluetooth: btusb: Fix quirk for Atheros
        1525/QCA6174' (bnc#1012382).
    
      - Revert 'cpufreq: Fix governor module removal race'
        (bnc#1012382).
    
      - Revert 'ip6_vti: adjust vti mtu according to mtu of
        lower device' (bnc#1012382).
    
      - Revert 'kvm: Fix stack-out-of-bounds read in write_mmio'
        (bnc#1083635).
    
      - Revert 'mac80211: Add RX flag to indicate ICV stripped'
        (kabi).
    
      - Revert 'mac80211: allow not sending MIC up from driver
        for HW crypto' (kabi).
    
      - Revert 'mac80211: allow same PN for AMSDU sub-frames'
        (kabi).
    
      - Revert 'mtd: cfi: cmdset_0001: Do not allow read/write
        to suspend erase block.' (kabi).
    
      - Revert 'mtd: cfi: cmdset_0001: Workaround Micron Erase
        suspend bug.' (kabi).
    
      - Revert 'mtd: cfi: cmdset_0002: Do not allow read/write
        to suspend erase block.' (kabi).
    
      - Revert 'mtip32xx: use runtime tag to initialize command
        header' (bnc#1012382).
    
      - Revert 'PCI/MSI: Stop disabling MSI/MSI-X in
        pci_device_shutdown()' (bnc#1012382).
    
      - Revert 'perf tests: Decompress kernel module before
        objdump' (bnc#1012382).
    
      - Revert 'xhci: plat: Register shutdown for xhci_plat'
        (bnc#1012382).
    
      - rfkill: gpio: fix memory leak in probe error path
        (bnc#1012382).
    
      - rpc_pipefs: fix double-dput() (bnc#1012382).
    
      - rpm/config.sh: build against SP3 in OBS as well.
    
      - rtc: interface: Validate alarm-time before handling
        rollover (bnc#1012382).
    
      - rtc: opal: Handle disabled TPO in opal_get_tpo_time()
        (bnc#1012382).
    
      - rtc: snvs: fix an incorrect check of return value
        (bnc#1012382).
    
      - rtl8187: Fix NULL pointer dereference in
        priv->conf_mutex (bnc#1012382).
    
      - rxrpc: check return value of skb_to_sgvec always
        (bnc#1012382).
    
      - s390: add automatic detection of the spectre defense
        (bnc#1012382).
    
      - s390: add optimized array_index_mask_nospec
        (bnc#1012382).
    
      - s390: add options to change branch prediction behaviour
        for the kernel (bnc#1012382 bsc#1068032).
    
      - s390: add sysfs attributes for spectre (bnc#1012382).
    
      - s390/alternative: use a copy of the facility bit mask
        (bnc#1012382).
    
      - s390/cio: update chpid descriptor after resource
        accessibility event (bnc#1012382).
    
      - s390: correct module section names for expoline code
        revert (bnc#1012382).
    
      - s390: correct nospec auto detection init order
        (bnc#1012382).
    
      - s390/dasd: fix hanging safe offline (bnc#1012382).
    
      - s390/dasd: fix IO error for newly defined devices
        (bnc#1093144, LTC#167398).
    
      - s390: do not bypass BPENTER for interrupt system calls
        (bnc#1012382).
    
      - s390: enable CPU alternatives unconditionally
        (bnc#1012382).
    
      - s390/entry.S: fix spurious zeroing of r0 (bnc#1012382).
    
      - s390: introduce execute-trampolines for branches
        (bnc#1012382).
    
      - s390/ipl: ensure loadparm valid flag is set
        (bnc#1012382).
    
      - s390: move nobp parameter functions to nospec-branch.c
        (bnc#1012382).
    
      - s390: move _text symbol to address higher than zero
        (bnc#1012382).
    
      - s390/qdio: do not merge ERROR output buffers
        (bnc#1012382).
    
      - s390/qdio: do not retry EQBS after CCQ 96 (bnc#1012382).
    
      - s390/qeth: consolidate errno translation (bnc#1093144,
        LTC#167507).
    
      - s390/qeth: fix MAC address update sequence (bnc#1093144,
        LTC#167609).
    
      - s390/qeth: translate SETVLAN/DELVLAN errors
        (bnc#1093144, LTC#167507).
    
      - s390: Replace IS_ENABLED(EXPOLINE_*) with
        IS_ENABLED(CONFIG_EXPOLINE_*) (bnc#1012382).
    
      - s390: report spectre mitigation via syslog
        (bnc#1012382).
    
      - s390: run user space and KVM guests with modified branch
        prediction (bnc#1012382).
    
      - s390: scrub registers on kernel entry and KVM exit
        (bnc#1012382).
    
      - s390/uprobes: implement arch_uretprobe_is_alive()
        (bnc#1012382).
    
      - sched/numa: Use down_read_trylock() for the mmap_sem
        (bnc#1012382).
    
      - scsi: bnx2fc: fix race condition in
        bnx2fc_get_host_stats() (bnc#1012382).
    
      - scsi: libiscsi: Allow sd_shutdown on bad transport
        (bnc#1012382).
    
      - scsi: libsas: initialize sas_phy status according to
        response of DISCOVER (bnc#1012382).
    
      - scsi: lpfc: Add per io channel NVME IO statistics
        (bsc#1088865).
    
      - scsi: lpfc: Correct missing remoteport registration
        during link bounces (bsc#1088865).
    
      - scsi: lpfc: Correct target queue depth application
        changes (bsc#1088865).
    
      - scsi: lpfc: Enlarge nvmet asynchronous receive buffer
        counts (bsc#1088865).
    
      - scsi: lpfc: Fix Abort request WQ selection
        (bsc#1088865).
    
      - scsi: lpfc: Fix driver not recovering NVME rports during
        target link faults (bsc#1088865).
    
      - scsi: lpfc: Fix lingering lpfc_wq resource after driver
        unload (bsc#1088865).
    
      - scsi: lpfc: Fix multiple PRLI completion error path
        (bsc#1088865).
    
      - scsi: lpfc: Fix NULL pointer access in
        lpfc_nvme_info_show (bsc#1088865).
    
      - scsi: lpfc: Fix NULL pointer reference when resetting
        adapter (bsc#1088865).
    
      - scsi: lpfc: Fix nvme remoteport registration race
        conditions (bsc#1088865).
    
      - scsi: lpfc: Fix WQ/CQ creation for older asic's
        (bsc#1088865).
    
      - scsi: lpfc: update driver version to 11.4.0.7-2
        (bsc#1088865).
    
      - scsi: mpt3sas: Proper handling of set/clear of 'ATA
        command pending' flag (bnc#1012382).
    
      - scsi: mptsas: Disable WRITE SAME (bnc#1012382).
    
      - scsi: sd: Defer spinning up drive while SANITIZE is in
        progress (bnc#1012382).
    
      - sctp: do not check port in sctp_inet6_cmp_addr
        (bnc#1012382).
    
      - sctp: do not leak kernel memory to user space
        (bnc#1012382).
    
      - sctp: fix recursive locking warning in sctp_do_peeloff
        (bnc#1012382).
    
      - sctp: sctp_sockaddr_af must check minimal addr length
        for AF_INET6 (bnc#1012382).
    
      - selftests/powerpc: Fix TM resched DSCR test with some
        compilers (bnc#1012382).
    
      - selinux: do not check open permission on sockets
        (bnc#1012382).
    
      - selinux: Remove redundant check for unknown labeling
        behavior (bnc#1012382).
    
      - selinux: Remove unnecessary check of array base in
        selinux_set_mapping() (bnc#1012382).
    
      - serial: 8250: omap: Disable DMA for console UART
        (bnc#1012382).
    
      - serial: mctrl_gpio: Add missing module license
        (bnc#1012382).
    
      - serial: mctrl_gpio: export mctrl_gpio_disable_ms and
        mctrl_gpio_init (bnc#1012382).
    
      - serial: sh-sci: Fix race condition causing garbage
        during shutdown (bnc#1012382).
    
      - sh_eth: Use platform device for printing before
        register_netdev() (bnc#1012382).
    
      - sit: reload iphdr in ipip6_rcv (bnc#1012382).
    
      - skbuff: only inherit relevant tx_flags (bnc#1012382).
    
      - skbuff: return -EMSGSIZE in skb_to_sgvec to prevent
        overflow (bnc#1012382).
    
      - sky2: Increase D3 delay to sky2 stops working after
        suspend (bnc#1012382).
    
      - slip: Check if rstate is initialized before
        uncompressing (bnc#1012382).
    
      - soreuseport: initialise timewait reuseport field
        (bnc#1012382).
    
      - sparc64: ldc abort during vds iso boot (bnc#1012382).
    
      - spi: davinci: fix up dma_mapping_error() incorrect patch
        (bnc#1012382).
    
      - staging: comedi: ni_mio_common: ack ai fifo error
        interrupts (bnc#1012382).
    
      - staging: ion : Donnot wakeup kswapd in ion system alloc
        (bnc#1012382).
    
      - staging: wlan-ng: prism2mgmt.c: fixed a double endian
        conversion before calling hfa384x_drvr_setconfig16, also
        fixes relative sparse warning (bnc#1012382).
    
      - stop_machine, sched: Fix migrate_swap() vs.
        active_balance() deadlock (bsc#1088810).
    
      - swap: divide-by-zero when zero length swap file on ssd
        (bsc#1082153).
    
      - tags: honor COMPILED_SOURCE with apart output directory
        (bnc#1012382).
    
      - target: prefer dbroot of /etc/target over /var/target
        (bsc#1087274).
    
      - target: transport should handle st FM/EOM/ILI reads
        (bsc#1081599).
    
      - tcp: better validation of received ack sequences
        (bnc#1012382).
    
      - tcp: do not read out-of-bounds opsize (bnc#1012382).
    
      - tcp: fix TCP_REPAIR_QUEUE bound checking (bnc#1012382).
    
      - tcp: md5: reject TCP_MD5SIG or TCP_MD5SIG_EXT on
        established sockets (bnc#1012382).
    
      - team: avoid adding twice the same option to the event
        list (bnc#1012382).
    
      - team: fix netconsole setup over team (bnc#1012382).
    
      - test_firmware: fix setting old custom fw path back on
        exit, second try (bnc#1012382).
    
      - thermal: imx: Fix race condition in imx_thermal_probe()
        (bnc#1012382).
    
      - thermal: power_allocator: fix one race condition issue
        for thermal_instances list (bnc#1012382).
    
      - thunderbolt: Resume control channel after hibernation
        image is created (bnc#1012382).
    
      - tipc: add policy for TIPC_NLA_NET_ADDR (bnc#1012382).
    
      - tracepoint: Do not warn on ENOMEM (bnc#1012382).
    
      - tracing: Fix regex_match_front() to not over compare the
        test string (bnc#1012382).
    
      - tracing/uprobe_event: Fix strncpy corner case
        (bnc#1012382).
    
      - tty: Do not call panic() at tty_ldisc_init()
        (bnc#1012382).
    
      - tty: make n_tty_read() always abort if hangup is in
        progress (bnc#1012382).
    
      - tty: n_gsm: Allow ADM response in addition to UA for
        control dlci (bnc#1012382).
    
      - tty: n_gsm: Fix DLCI handling for ADM mode if debug & 2
        is not set (bnc#1012382).
    
      - tty: n_gsm: Fix long delays with control frame timeouts
        in ADM mode (bnc#1012382).
    
      - tty: provide tty_name() even without CONFIG_TTY
        (bnc#1012382).
    
      - tty: Use __GFP_NOFAIL for tty_ldisc_get() (bnc#1012382).
    
      - ubi: fastmap: Do not flush fastmap work on detach
        (bnc#1012382).
    
      - ubi: Fix error for write access (bnc#1012382).
    
      - ubifs: Check ubifs_wbuf_sync() return code
        (bnc#1012382).
    
      - ubi: Reject MLC NAND (bnc#1012382).
    
      - um: Use POSIX ucontext_t instead of struct ucontext
        (bnc#1012382).
    
      - Update config files, add expoline for s390x
        (bsc#1089393).
    
      - Update
        patches.fixes/0001-md-raid10-fix-NULL-deference-in-handl
        e_write_complet.patch (bsc#1056415).
    
      - Update
        patches.fixes/xfs-refactor-log-record-unpack-and-data-pr
        ocessing.patch (bsc#1043598, bsc#1036215).
    
      - Update
        patches.suse/powerpc-powernv-Support-firmware-disable-of
        -RFI-flus.patch (bsc#1068032, bsc#1075087, bsc#1091041).
    
      - Update
        patches.suse/powerpc-pseries-Support-firmware-disable-of
        -RFI-flus.patch (bsc#1068032, bsc#1075087, bsc#1091041).
    
      - Update
        patches.suse/powerpc-rfi-flush-Move-the-logic-to-avoid-a
        -redo-int.patch (bsc#1068032, bsc#1075087, bsc#1091041).
    
      - Update
        patches.suse/x86-nospectre_v2-means-nospec-too.patch
        (bsc#1075994 bsc#1075091 bnc#1085958).
    
      - usb: Accept bulk endpoints with 1024-byte maxpacket
        (bnc#1012382 bsc#1092888).
    
      - usb: Accept bulk endpoints with 1024-byte maxpacket
        (bsc#1092888).
    
      - usb: chipidea: properly handle host or gadget
        initialization failure (bnc#1012382).
    
      - usb: core: Add quirk for HP v222w 16GB Mini
        (bnc#1012382).
    
      - usb: dwc2: Improve gadget state disconnection handling
        (bnc#1012382).
    
      - usb: dwc3: keystone: check return value (bnc#1012382).
    
      - usb: dwc3: pci: Properly cleanup resource (bnc#1012382).
    
      - usb: ene_usb6250: fix first command execution
        (bnc#1012382).
    
      - usb: ene_usb6250: fix SCSI residue overwriting
        (bnc#1012382).
    
      - usb:fix USB3 devices behind USB3 hubs not resuming at
        hibernate thaw (bnc#1012382).
    
      - usb: gadget: align buffer size when allocating for OUT
        endpoint (bnc#1012382).
    
      - usb: gadget: change len to size_t on alloc_ep_req()
        (bnc#1012382).
    
      - usb: gadget: define free_ep_req as universal function
        (bnc#1012382).
    
      - usb: gadget: f_hid: fix: Prevent accessing released
        memory (bnc#1012382).
    
      - usb: gadget: fix request length error for isoc transfer
        (git-fixes).
    
      - usb: gadget: fix usb_ep_align_maybe endianness and new
        usb_ep_align (bnc#1012382).
    
      - usb: Increment wakeup count on remote wakeup
        (bnc#1012382).
    
      - usbip: usbip_host: fix to hold parent lock for
        device_attach() calls (bnc#1012382).
    
      - usbip: vhci_hcd: Fix usb device and sockfd leaks
        (bnc#1012382).
    
      - usb: musb: gadget: misplaced out of bounds check
        (bnc#1012382).
    
      - usb: musb: host: fix potential NULL pointer dereference
        (bnc#1012382).
    
      - usb: serial: cp210x: add ELDAT Easywave RX09 id
        (bnc#1012382).
    
      - usb: serial: cp210x: add ID for NI USB serial console
        (bnc#1012382).
    
      - usb: serial: ftdi_sio: add RT Systems VX-8 cable
        (bnc#1012382).
    
      - usb: serial: ftdi_sio: add support for Harman
        FirmwareHubEmulator (bnc#1012382).
    
      - usb: serial: ftdi_sio: use jtag quirk for Arrow USB
        Blaster (bnc#1012382).
    
      - usb: serial: option: adding support for ublox R410M
        (bnc#1012382).
    
      - usb: serial: option: Add support for Quectel EP06
        (bnc#1012382).
    
      - usb: serial: option: reimplement interface masking
        (bnc#1012382).
    
      - usb: serial: simple: add libtransistor console
        (bnc#1012382).
    
      - usb: serial: visor: handle potential invalid device
        configuration (bnc#1012382).
    
      - vfb: fix video mode and line_length being set when
        loaded (bnc#1012382).
    
      - vfio/pci: Virtualize Maximum Payload Size (bnc#1012382).
    
      - vfio/pci: Virtualize Maximum Read Request Size
        (bnc#1012382).
    
      - vfio-pci: Virtualize PCIe & AF FLR (bnc#1012382).
    
      - vhost: correctly remove wait queue during poll failure
        (bnc#1012382).
    
      - virtio: add ability to iterate over vqs (bnc#1012382).
    
      - virtio_console: free buffers after reset (bnc#1012382).
    
      - virtio_net: check return value of skb_to_sgvec always
        (bnc#1012382).
    
      - virtio_net: check return value of skb_to_sgvec in one
        more location (bnc#1012382).
    
      - vlan: also check phy_driver ts_info for vlan's real
        device (bnc#1012382).
    
      - vlan: Fix reading memory beyond skb->tail in
        skb_vlan_tagged_multi (bnc#1012382).
    
      - vmxnet3: ensure that adapter is in proper state during
        force_close (bnc#1012382).
    
      - vrf: Fix use after free and double free in
        vrf_finish_output (bnc#1012382).
    
      - vt: change SGR 21 to follow the standards (bnc#1012382).
    
      - vti6: better validate user provided tunnel names
        (bnc#1012382).
    
      - vxlan: dont migrate permanent fdb entries during learn
        (bnc#1012382).
    
      - watchdog: f71808e_wdt: Fix WD_EN register read
        (bnc#1012382).
    
      - watchdog: hpwdt: Remove legacy NMI sourcing
        (bsc#1085185).
    
      - watchdog: sbsa: use 32-bit read for WCV (bsc#1085679).
    
      - wl1251: check return from call to
        wl1251_acx_arp_ip_filter (bnc#1012382).
    
      - writeback: fix the wrong congested state variable
        definition (bnc#1012382).
    
      - writeback: safer lock nesting (bnc#1012382).
    
      - x86/asm: Do not use RBP as a temporary register in
        csum_partial_copy_generic() (bnc#1012382).
    
      - x86/bugs: correctly force-disable IBRS on !SKL systems
        (bsc#1092497).
    
      - x86/bugs: Make sure that _TIF_SSBD does not end up in
        _TIF_ALLWORK_MASK (bsc#1093215).
    
      - x86/bugs: Respect retpoline command line option
        (bsc#1068032).
    
      - x86/hweight: Do not clobber %rdi (bnc#1012382).
    
      - x86/hweight: Get rid of the special calling convention
        (bnc#1012382).
    
      - x86/ipc: Fix x32 version of shmid64_ds and msqid64_ds
        (bnc#1012382).
    
      - x86/platform/UV: Add references to access fixed UV4A HUB
        MMRs (bsc#1076263 #fate#322814).
    
      - x86/platform/uv/BAU: Replace hard-coded values with MMR
        definitions (bsc#1076263 #fate#322814).
    
      - x86/platform/UV: Fix critical UV MMR address error
        (bsc#1076263
    
      - x86/platform/UV: Fix GAM MMR changes in UV4A
        (bsc#1076263 #fate#322814).
    
      - x86/platform/UV: Fix GAM MMR references in the UV x2apic
        code (bsc#1076263 #fate#322814).
    
      - x86/platform/UV: Fix GAM Range Table entries less than
        1GB (bsc#1091325).
    
      - x86/platform/UV: Fix UV4A BAU MMRs (bsc#1076263
        #fate#322814).
    
      - x86/platform/UV: Fix UV4A support on new Intel
        Processors (bsc#1076263 #fate#322814).
    
      - x86/platform/uv: Skip UV runtime services mapping in the
        efi_runtime_disabled case (bsc#1089925).
    
      - x86/platform/UV: Update uv_mmrs.h to prepare for UV4A
        fixes (bsc#1076263 #fate#322814).
    
      - x86/smpboot: Do not use mwait_play_dead() on AMD systems
        (bnc#1012382).
    
      - x86/tsc: Prevent 32bit truncation in calc_hpet_ref()
        (bnc#1012382).
    
      - x86/tsc: Provide 'tsc=unstable' boot parameter
        (bnc#1012382).
    
      - xen: avoid type warning in xchg_xen_ulong (bnc#1012382).
    
      - xen-netfront: Fix hang on device removal (bnc#1012382).
    
      - xfrm: fix state migration copy replay sequence numbers
        (bnc#1012382).
    
      - xfrm: Refuse to insert 32 bit userspace socket policies
        on 64 bit systems (bnc#1012382).
    
      - xfrm_user: fix return value from xfrm_user_rcv_msg
        (bnc#1012382).
    
      - xfrm_user: uncoditionally validate esn replay attribute
        struct (bnc#1012382).
    
      - xfs: always verify the log tail during recovery
        (bsc#1036215).
    
      - xfs: detect and handle invalid iclog size set by mkfs
        (bsc#1043598).
    
      - xfs: detect and trim torn writes during log recovery
        (bsc#1036215).
    
      - xfs: fix log recovery corruption error due to tail
        overwrite (bsc#1036215).
    
      - xfs: fix recovery failure when log record header wraps
        log end (bsc#1036215).
    
      - xfs: handle -EFSCORRUPTED during head/tail verification
        (bsc#1036215).
    
      - xfs: prevent creating negative-sized file via
        INSERT_RANGE (bnc#1012382).
    
      - xfs: refactor and open code log record crc check
        (bsc#1036215).
    
      - xfs: refactor log record start detection into a new
        helper (bsc#1036215).
    
      - xfs: return start block of first bad log record during
        recovery (bsc#1036215).
    
      - xfs: support a crc verification only log record pass
        (bsc#1036215).
    
      - x86/bugs: make intel_rds_mask() honor X86_FEATURE_SSBD
        (bsc#1094019).
    
      - watchdog: hpwdt: condition early return of NMI handler
        on iLO5 (bsc#1085185).
    
      - watchdog: hpwdt: Modify to use watchdog core
        (bsc#1085185).
    
      - watchdog: hpwdt: Update nmi_panic message (bsc#1085185).
    
      - watchdog: hpwdt: Update Module info and copyright
        (bsc#1085185)."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1005778"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1005780"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1005781"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1009062"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1012382"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1015336"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1015337"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1015340"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1015342"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1015343"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1022604"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1022743"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1024296"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1031492"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1036215"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1043598"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1044596"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1056415"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1056427"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1060799"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1066223"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1068032"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1070404"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1073059"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1075087"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1075091"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1075994"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1076263"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1076805"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1080157"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1081599"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1082153"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1082299"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1082485"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1082962"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1083125"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1083635"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1083650"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1083900"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1084610"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1084699"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1084721"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1085058"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1085185"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1085511"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1085679"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1085958"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1086162"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1087082"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1087274"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1088050"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1088242"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1088267"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1088313"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1088600"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1088684"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1088810"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1088865"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1088871"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1089023"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1089115"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1089198"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1089393"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1089608"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1089644"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1089752"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1089895"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1089925"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1090225"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1090643"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1090658"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1090663"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1090708"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1090718"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1090734"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1090953"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1091041"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1091325"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1091728"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1091960"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1092289"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1092497"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1092566"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1092772"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1092888"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1092904"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1092975"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1093008"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1093035"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1093144"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1093215"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1093990"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1094019"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1094033"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1094059"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=802154"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=966170"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=966172"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=966186"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=966191"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=969476"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=969477"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=981348"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=993388"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected the Linux Kernel packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-debug");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-debug-base");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-debug-base-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-debug-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-debug-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-debug-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-debug-devel-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-default");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-default-base");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-default-base-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-default-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-default-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-default-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-docs-html");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-docs-pdf");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-macros");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-obs-build");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-obs-build-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-obs-qa");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-source");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-source-vanilla");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-syms");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-vanilla");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-vanilla-base");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-vanilla-base-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-vanilla-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-vanilla-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-vanilla-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kselftests-kmp-debug");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kselftests-kmp-debug-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kselftests-kmp-default");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kselftests-kmp-default-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kselftests-kmp-vanilla");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kselftests-kmp-vanilla-debuginfo");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:42.3");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/02/26");
      script_set_attribute(attribute:"patch_publication_date", value:"2018/05/24");
      script_set_attribute(attribute:"plugin_publication_date", value:"2018/05/25");
      script_set_attribute(attribute:"in_the_news", value:"true");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
    if (release !~ "^(SUSE42\.3)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "42.3", release);
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    ourarch = get_kb_item("Host/cpu");
    if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
    if (ourarch !~ "^(x86_64)$") audit(AUDIT_ARCH_NOT, "x86_64", ourarch);
    
    flag = 0;
    
    if ( rpm_check(release:"SUSE42.3", reference:"kernel-debug-4.4.132-53.1") ) flag++;
    if ( rpm_check(release:"SUSE42.3", reference:"kernel-debug-base-4.4.132-53.1") ) flag++;
    if ( rpm_check(release:"SUSE42.3", reference:"kernel-debug-base-debuginfo-4.4.132-53.1") ) flag++;
    if ( rpm_check(release:"SUSE42.3", reference:"kernel-debug-debuginfo-4.4.132-53.1") ) flag++;
    if ( rpm_check(release:"SUSE42.3", reference:"kernel-debug-debugsource-4.4.132-53.1") ) flag++;
    if ( rpm_check(release:"SUSE42.3", reference:"kernel-debug-devel-4.4.132-53.1") ) flag++;
    if ( rpm_check(release:"SUSE42.3", reference:"kernel-debug-devel-debuginfo-4.4.132-53.1") ) flag++;
    if ( rpm_check(release:"SUSE42.3", reference:"kernel-default-4.4.132-53.1") ) flag++;
    if ( rpm_check(release:"SUSE42.3", reference:"kernel-default-base-4.4.132-53.1") ) flag++;
    if ( rpm_check(release:"SUSE42.3", reference:"kernel-default-base-debuginfo-4.4.132-53.1") ) flag++;
    if ( rpm_check(release:"SUSE42.3", reference:"kernel-default-debuginfo-4.4.132-53.1") ) flag++;
    if ( rpm_check(release:"SUSE42.3", reference:"kernel-default-debugsource-4.4.132-53.1") ) flag++;
    if ( rpm_check(release:"SUSE42.3", reference:"kernel-default-devel-4.4.132-53.1") ) flag++;
    if ( rpm_check(release:"SUSE42.3", reference:"kernel-devel-4.4.132-53.1") ) flag++;
    if ( rpm_check(release:"SUSE42.3", reference:"kernel-docs-html-4.4.132-53.1") ) flag++;
    if ( rpm_check(release:"SUSE42.3", reference:"kernel-docs-pdf-4.4.132-53.1") ) flag++;
    if ( rpm_check(release:"SUSE42.3", reference:"kernel-macros-4.4.132-53.1") ) flag++;
    if ( rpm_check(release:"SUSE42.3", reference:"kernel-obs-build-4.4.132-53.1") ) flag++;
    if ( rpm_check(release:"SUSE42.3", reference:"kernel-obs-build-debugsource-4.4.132-53.1") ) flag++;
    if ( rpm_check(release:"SUSE42.3", reference:"kernel-obs-qa-4.4.132-53.1") ) flag++;
    if ( rpm_check(release:"SUSE42.3", reference:"kernel-source-4.4.132-53.1") ) flag++;
    if ( rpm_check(release:"SUSE42.3", reference:"kernel-source-vanilla-4.4.132-53.1") ) flag++;
    if ( rpm_check(release:"SUSE42.3", reference:"kernel-syms-4.4.132-53.1") ) flag++;
    if ( rpm_check(release:"SUSE42.3", reference:"kernel-vanilla-4.4.132-53.1") ) flag++;
    if ( rpm_check(release:"SUSE42.3", reference:"kernel-vanilla-base-4.4.132-53.1") ) flag++;
    if ( rpm_check(release:"SUSE42.3", reference:"kernel-vanilla-base-debuginfo-4.4.132-53.1") ) flag++;
    if ( rpm_check(release:"SUSE42.3", reference:"kernel-vanilla-debuginfo-4.4.132-53.1") ) flag++;
    if ( rpm_check(release:"SUSE42.3", reference:"kernel-vanilla-debugsource-4.4.132-53.1") ) flag++;
    if ( rpm_check(release:"SUSE42.3", reference:"kernel-vanilla-devel-4.4.132-53.1") ) flag++;
    if ( rpm_check(release:"SUSE42.3", reference:"kselftests-kmp-debug-4.4.132-53.1") ) flag++;
    if ( rpm_check(release:"SUSE42.3", reference:"kselftests-kmp-debug-debuginfo-4.4.132-53.1") ) flag++;
    if ( rpm_check(release:"SUSE42.3", reference:"kselftests-kmp-default-4.4.132-53.1") ) flag++;
    if ( rpm_check(release:"SUSE42.3", reference:"kselftests-kmp-default-debuginfo-4.4.132-53.1") ) flag++;
    if ( rpm_check(release:"SUSE42.3", reference:"kselftests-kmp-vanilla-4.4.132-53.1") ) flag++;
    if ( rpm_check(release:"SUSE42.3", reference:"kselftests-kmp-vanilla-debuginfo-4.4.132-53.1") ) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "kernel-devel / kernel-macros / kernel-source / etc");
    }
    
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-3696-2.NASL
    descriptionUSN-3696-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS. It was discovered that an integer overflow existed in the perf subsystem of the Linux kernel. A local attacker could use this to cause a denial of service (system crash). (CVE-2017-18255) Wei Fang discovered an integer overflow in the F2FS filesystem implementation in the Linux kernel. A local attacker could use this to cause a denial of service. (CVE-2017-18257) It was discovered that an information leak existed in the generic SCSI driver in the Linux kernel. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2018-1000204) It was discovered that the wait4() system call in the Linux kernel did not properly validate its arguments in some situations. A local attacker could possibly use this to cause a denial of service. (CVE-2018-10087) It was discovered that the kill() system call implementation in the Linux kernel did not properly validate its arguments in some situations. A local attacker could possibly use this to cause a denial of service. (CVE-2018-10124) Julian Stecklina and Thomas Prescher discovered that FPU register states (such as MMX, SSE, and AVX registers) which are lazily restored are potentially vulnerable to a side channel attack. A local attacker could use this to expose sensitive information. (CVE-2018-3665) Jakub Jirasek discovered that multiple use-after-errors existed in the USB/IP implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-5814) It was discovered that an information leak vulnerability existed in the floppy driver in the Linux kernel. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2018-7755) Seunghun Han discovered an information leak in the ACPI handling code in the Linux kernel when handling early termination of ACPI table loading. A local attacker could use this to expose sensitive informal (kernel address locations). (CVE-2017-13695) It was discovered that a memory leak existed in the Serial Attached SCSI (SAS) implementation in the Linux kernel. A physically proximate attacker could use this to cause a denial of service (memory exhaustion). (CVE-2018-10021). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id110897
    published2018-07-03
    reporterUbuntu Security Notice (C) 2018-2019 Canonical, Inc. / NASL script (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/110897
    titleUbuntu 14.04 LTS : linux-lts-xenial, linux-aws vulnerabilities (USN-3696-2)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Ubuntu Security Notice USN-3696-2. The text 
    # itself is copyright (C) Canonical, Inc. See 
    # <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered 
    # trademark of Canonical, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(110897);
      script_version("1.7");
      script_cvs_date("Date: 2019/09/18 12:31:48");
    
      script_cve_id("CVE-2017-13695", "CVE-2017-18255", "CVE-2017-18257", "CVE-2018-1000204", "CVE-2018-10021", "CVE-2018-10087", "CVE-2018-10124", "CVE-2018-3665", "CVE-2018-5814", "CVE-2018-7755");
      script_xref(name:"USN", value:"3696-2");
    
      script_name(english:"Ubuntu 14.04 LTS : linux-lts-xenial, linux-aws vulnerabilities (USN-3696-2)");
      script_summary(english:"Checks dpkg output for updated packages.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Ubuntu host is missing one or more security-related
    patches."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "USN-3696-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04
    LTS. This update provides the corresponding updates for the Linux
    Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu
    14.04 LTS.
    
    It was discovered that an integer overflow existed in the perf
    subsystem of the Linux kernel. A local attacker could use this to
    cause a denial of service (system crash). (CVE-2017-18255)
    
    Wei Fang discovered an integer overflow in the F2FS filesystem
    implementation in the Linux kernel. A local attacker could use this to
    cause a denial of service. (CVE-2017-18257)
    
    It was discovered that an information leak existed in the generic SCSI
    driver in the Linux kernel. A local attacker could use this to expose
    sensitive information (kernel memory). (CVE-2018-1000204)
    
    It was discovered that the wait4() system call in the Linux kernel did
    not properly validate its arguments in some situations. A local
    attacker could possibly use this to cause a denial of service.
    (CVE-2018-10087)
    
    It was discovered that the kill() system call implementation in the
    Linux kernel did not properly validate its arguments in some
    situations. A local attacker could possibly use this to cause a denial
    of service. (CVE-2018-10124)
    
    Julian Stecklina and Thomas Prescher discovered that FPU register
    states (such as MMX, SSE, and AVX registers) which are lazily restored
    are potentially vulnerable to a side channel attack. A local attacker
    could use this to expose sensitive information. (CVE-2018-3665)
    
    Jakub Jirasek discovered that multiple use-after-errors existed in the
    USB/IP implementation in the Linux kernel. A local attacker could use
    this to cause a denial of service (system crash) or possibly execute
    arbitrary code. (CVE-2018-5814)
    
    It was discovered that an information leak vulnerability existed in
    the floppy driver in the Linux kernel. A local attacker could use this
    to expose sensitive information (kernel memory). (CVE-2018-7755)
    
    Seunghun Han discovered an information leak in the ACPI handling code
    in the Linux kernel when handling early termination of ACPI table
    loading. A local attacker could use this to expose sensitive informal
    (kernel address locations). (CVE-2017-13695)
    
    It was discovered that a memory leak existed in the Serial Attached
    SCSI (SAS) implementation in the Linux kernel. A physically proximate
    attacker could use this to cause a denial of service (memory
    exhaustion). (CVE-2018-10021).
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the Ubuntu security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://usn.ubuntu.com/3696-2/"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-aws");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-generic");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-generic-lpae");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4-lowlatency");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-image-aws");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lpae-lts-xenial");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lts-xenial");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:linux-image-lowlatency-lts-xenial");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:14.04");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2017/08/25");
      script_set_attribute(attribute:"patch_publication_date", value:"2018/07/02");
      script_set_attribute(attribute:"plugin_publication_date", value:"2018/07/03");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"Ubuntu Security Notice (C) 2018-2019 Canonical, Inc. / NASL script (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Ubuntu Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl", "linux_alt_patch_detect.nasl");
      script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("ubuntu.inc");
    include("ksplice.inc");
    
    if ( ! get_kb_item("Host/local_checks_enabled") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/Ubuntu/release");
    if ( isnull(release) ) audit(AUDIT_OS_NOT, "Ubuntu");
    release = chomp(release);
    if (! preg(pattern:"^(14\.04)$", string:release)) audit(AUDIT_OS_NOT, "Ubuntu 14.04", "Ubuntu " + release);
    if ( ! get_kb_item("Host/Debian/dpkg-l") ) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Ubuntu", cpu);
    
    if (get_one_kb_item("Host/ksplice/kernel-cves"))
    {
      rm_kb_item(name:"Host/uptrack-uname-r");
      cve_list = make_list("CVE-2017-13695", "CVE-2017-18255", "CVE-2017-18257", "CVE-2018-1000204", "CVE-2018-10021", "CVE-2018-10087", "CVE-2018-10124", "CVE-2018-3665", "CVE-2018-5814", "CVE-2018-7755");
      if (ksplice_cves_check(cve_list))
      {
        audit(AUDIT_PATCH_INSTALLED, "KSplice hotfix for USN-3696-2");
      }
      else
      {
        _ubuntu_report = ksplice_reporting_text();
      }
    }
    
    flag = 0;
    
    if (ubuntu_check(osver:"14.04", pkgname:"linux-image-4.4.0-1024-aws", pkgver:"4.4.0-1024.25")) flag++;
    if (ubuntu_check(osver:"14.04", pkgname:"linux-image-4.4.0-130-generic", pkgver:"4.4.0-130.156~14.04.1")) flag++;
    if (ubuntu_check(osver:"14.04", pkgname:"linux-image-4.4.0-130-generic-lpae", pkgver:"4.4.0-130.156~14.04.1")) flag++;
    if (ubuntu_check(osver:"14.04", pkgname:"linux-image-4.4.0-130-lowlatency", pkgver:"4.4.0-130.156~14.04.1")) flag++;
    if (ubuntu_check(osver:"14.04", pkgname:"linux-image-aws", pkgver:"4.4.0.1024.24")) flag++;
    if (ubuntu_check(osver:"14.04", pkgname:"linux-image-generic-lpae-lts-xenial", pkgver:"4.4.0.130.110")) flag++;
    if (ubuntu_check(osver:"14.04", pkgname:"linux-image-generic-lts-xenial", pkgver:"4.4.0.130.110")) flag++;
    if (ubuntu_check(osver:"14.04", pkgname:"linux-image-lowlatency-lts-xenial", pkgver:"4.4.0.130.110")) flag++;
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_WARNING,
        extra      : ubuntu_report_get()
      );
      exit(0);
    }
    else
    {
      tested = ubuntu_pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "linux-image-4.4-aws / linux-image-4.4-generic / etc");
    }
    
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2018-1171-1.NASL
    descriptionThe SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes. The following security bugs were fixed : - CVE-2018-1087: And an unprivileged KVM guest user could use this flaw to potentially escalate their privileges inside a guest. (bsc#1087088) - CVE-2018-8897: An unprivileged system user could use incorrect set up interrupt stacks to crash the Linux kernel resulting in DoS issue. (bsc#1087088) - CVE-2018-10124: The kill_something_info function in kernel/signal.c in the Linux kernel before 4.13, when an unspecified architecture and compiler is used, might allow local users to cause a denial of service via an INT_MIN argument (bnc#1089752). The update package also includes non-security fixes. See advisory for details. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id109645
    published2018-05-09
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/109645
    titleSUSE SLES11 Security Update : kernel (SUSE-SU-2018:1171-1)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2019-1538.NASL
    descriptionAccording to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - The walk_hugetlb_range() function in
    last seen2020-03-19
    modified2019-05-14
    plugin id124991
    published2019-05-14
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/124991
    titleEulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1538)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2018-1132.NASL
    descriptionAccording to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - ALSA sequencer core initializes the event pool on demand by invoking snd_seq_pool_init() when the first write happens and the pool is empty. A user can reset the pool size manually via ioctl concurrently, and this may lead to UAF or out-of-bound access.(CVE-2018-7566) - The do_get_mempolicy() function in mm/mempolicy.c in the Linux kernel allows local users to hit a use-after-free bug via crafted system calls and thus cause a denial of service (DoS) or possibly have unspecified other impact. Due to the nature of the flaw, privilege escalation cannot be fully ruled out.(CVE-2018-10675) - The Linux kernel has an undefined behavior when an argument of INT_MIN is passed to the kernel/signal.c:kill_something_info() function. A local attacker may be able to exploit this to cause a denial of service.(CVE-2018-10124) - A an integer overflow vulnerability was discovered in the Linux kernel, from version 3.4 through 4.15, in the drivers/gpu/drm/udl/udl_fb.c:udl_fb_mmap() function. An attacker with access to the udldrmfb driver could exploit this to obtain full read and write permissions on kernel physical pages, resulting in a code execution in kernel space.(CVE-2018-8781) - The code in the drivers/scsi/libsas/sas_scsi_host.c file in the Linux kernel allow a physically proximate attacker to cause a memory leak in the ATA command queue and, thus, denial of service by triggering certain failure conditions.(CVE-2018-10021) - A flaw was found in the Linux kernel
    last seen2020-06-10
    modified2018-05-29
    plugin id110136
    published2018-05-29
    reporterThis script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/110136
    titleEulerOS 2.0 SP1 : kernel (EulerOS-SA-2018-1132)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2018-1173-1.NASL
    descriptionThe SUSE Linux Enterprise 12 SP2 LTSS kernel was updated to 4.4.121 to receive various security and bugfixes. The following security bugs were fixed : - CVE-2018-8781: The udl_fb_mmap function in drivers/gpu/drm/udl/udl_fb.c had an integer-overflow vulnerability that allowed local users with access to the udldrmfb driver to obtain full read and write permissions on kernel physical pages, resulting in a code execution in kernel space (bnc#1090643). - CVE-2018-10124: The kill_something_info function in kernel/signal.c might have allowed local users to cause a denial of service via an INT_MIN argument (bnc#1089752). - CVE-2018-10087: The kernel_wait4 function in kernel/exit.c might have allowed local users to cause a denial of service by triggering an attempted use of the -INT_MIN value (bnc#1089608). - CVE-2017-18257: The __get_data_block function in fs/f2fs/data.c in the Linux kernel allowed local users to cause a denial of service (integer overflow and loop) via crafted use of the open and fallocate system calls with an FS_IOC_FIEMAP ioctl. (bnc#1088241) - CVE-2018-8822: Incorrect buffer length handling in the ncp_read_kernel function in fs/ncpfs/ncplib_kernel.c could be exploited by malicious NCPFS servers to crash the kernel or execute code (bnc#1086162). - CVE-2018-8043: The unimac_mdio_probe function in drivers/net/phy/mdio-bcm-unimac.c did not validate certain resource availability, which allowed local users to cause a denial of service (NULL pointer dereference) (bnc#1084829). - CVE-2018-7740: The resv_map_release function in mm/hugetlb.c allowed local users to cause a denial of service (BUG) via a crafted application that made mmap system calls and has a large pgoff argument to the remap_file_pages system call (bnc#1084353). - CVE-2018-1087: And an unprivileged KVM guest user could use this flaw to potentially escalate their privileges inside a guest. (bsc#1087088) - CVE-2018-8897: An unprivileged system user could use incorrect set up interrupt stacks to crash the Linux kernel resulting in DoS issue. (bsc#1087088) The update package also includes non-security fixes. See advisory for details. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id109647
    published2018-05-09
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/109647
    titleSUSE SLES12 Security Update : kernel (SUSE-SU-2018:1173-1)
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-3754-1.NASL
    descriptionRalf Spenneberg discovered that the ext4 implementation in the Linux kernel did not properly validate meta block groups. An attacker with physical access could use this to specially craft an ext4 image that causes a denial of service (system crash). (CVE-2016-10208) It was discovered that an information disclosure vulnerability existed in the ACPI implementation of the Linux kernel. A local attacker could use this to expose sensitive information (kernel memory addresses). (CVE-2017-11472) It was discovered that a buffer overflow existed in the ACPI table parsing implementation in the Linux kernel. A local attacker could use this to construct a malicious ACPI table that, when loaded, caused a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-11473) It was discovered that the generic SCSI driver in the Linux kernel did not properly initialize data returned to user space in some situations. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2017-14991) It was discovered that a race condition existed in the packet fanout implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-15649) Andrey Konovalov discovered that the Ultra Wide Band driver in the Linux kernel did not properly check for an error condition. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-16526) Andrey Konovalov discovered that the ALSA subsystem in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-16527) Andrey Konovalov discovered that the ALSA subsystem in the Linux kernel did not properly validate USB audio buffer descriptors. A physically proximate attacker could use this cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-16529) Andrey Konovalov discovered that the USB subsystem in the Linux kernel did not properly validate USB interface association descriptors. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2017-16531) Andrey Konovalov discovered that the usbtest device driver in the Linux kernel did not properly validate endpoint metadata. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2017-16532) Andrey Konovalov discovered that the USB subsystem in the Linux kernel did not properly validate USB HID descriptors. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2017-16533) Andrey Konovalov discovered that the USB subsystem in the Linux kernel did not properly validate USB BOS metadata. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2017-16535) Andrey Konovalov discovered that the Conexant cx231xx USB video capture driver in the Linux kernel did not properly validate interface descriptors. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2017-16536) Andrey Konovalov discovered that the SoundGraph iMON USB driver in the Linux kernel did not properly validate device metadata. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2017-16537) It was discovered that the DM04/QQBOX USB driver in the Linux kernel did not properly handle device attachment and warm-start. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-16538) Andrey Konovalov discovered an out-of-bounds read in the GTCO digitizer USB driver for the Linux kernel. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-16643) Andrey Konovalov discovered that the video4linux driver for Hauppauge HD PVR USB devices in the Linux kernel did not properly handle some error conditions. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-16644) Andrey Konovalov discovered that the IMS Passenger Control Unit USB driver in the Linux kernel did not properly validate device descriptors. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2017-16645) Andrey Konovalov discovered that the QMI WWAN USB driver did not properly validate device descriptors. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2017-16650) It was discovered that the USB Virtual Host Controller Interface (VHCI) driver in the Linux kernel contained an information disclosure vulnerability. A physically proximate attacker could use this to expose sensitive information (kernel memory). (CVE-2017-16911) It was discovered that the USB over IP implementation in the Linux kernel did not validate endpoint numbers. A remote attacker could use this to cause a denial of service (system crash). (CVE-2017-16912) It was discovered that the USB over IP implementation in the Linux kernel did not properly validate CMD_SUBMIT packets. A remote attacker could use this to cause a denial of service (excessive memory consumption). (CVE-2017-16913) It was discovered that the USB over IP implementation in the Linux kernel contained a NULL pointer dereference error. A remote attacker could use this to cause a denial of service (system crash). (CVE-2017-16914) It was discovered that the core USB subsystem in the Linux kernel did not validate the number of configurations and interfaces in a device. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2017-17558) It was discovered that an integer overflow existed in the perf subsystem of the Linux kernel. A local attacker could use this to cause a denial of service (system crash). (CVE-2017-18255) It was discovered that the keyring subsystem in the Linux kernel did not properly prevent a user from creating keyrings for other users. A local attacker could use this cause a denial of service or expose sensitive information. (CVE-2017-18270) Andy Lutomirski and Willy Tarreau discovered that the KVM implementation in the Linux kernel did not properly emulate instructions on the SS segment register. A local attacker in a guest virtual machine could use this to cause a denial of service (guest OS crash) or possibly gain administrative privileges in the guest OS. (CVE-2017-2583) Dmitry Vyukov discovered that the KVM implementation in the Linux kernel improperly emulated certain instructions. A local attacker could use this to obtain sensitive information (kernel memory). (CVE-2017-2584) It was discovered that the KLSI KL5KUSB105 serial-to-USB device driver in the Linux kernel did not properly initialize memory related to logging. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2017-5549) Andrey Konovalov discovered an out-of-bounds access in the IPv6 Generic Routing Encapsulation (GRE) tunneling implementation in the Linux kernel. An attacker could use this to possibly expose sensitive information. (CVE-2017-5897) Andrey Konovalov discovered that the LLC subsytem in the Linux kernel did not properly set up a destructor in certain situations. A local attacker could use this to cause a denial of service (system crash). (CVE-2017-6345) Dmitry Vyukov discovered race conditions in the Infrared (IrDA) subsystem in the Linux kernel. A local attacker could use this to cause a denial of service (deadlock). (CVE-2017-6348) Andy Lutomirski discovered that the KVM implementation in the Linux kernel was vulnerable to a debug exception error when single-stepping through a syscall. A local attacker in a non-Linux guest vm could possibly use this to gain administrative privileges in the guest vm. (CVE-2017-7518) Tuomas Haanpaa and Ari Kauppi discovered that the NFSv2 and NFSv3 server implementations in the Linux kernel did not properly handle certain long RPC replies. A remote attacker could use this to cause a denial of service (system crash). (CVE-2017-7645) Pengfei Wang discovered that a race condition existed in the NXP SAA7164 TV Decoder driver for the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-8831) Pengfei Wang discovered that the Turtle Beach MultiSound audio device driver in the Linux kernel contained race conditions when fetching from the ring-buffer. A local attacker could use this to cause a denial of service (infinite loop). (CVE-2017-9984, CVE-2017-9985) It was discovered that the wait4() system call in the Linux kernel did not properly validate its arguments in some situations. A local attacker could possibly use this to cause a denial of service. (CVE-2018-10087) It was discovered that the kill() system call implementation in the Linux kernel did not properly validate its arguments in some situations. A local attacker could possibly use this to cause a denial of service. (CVE-2018-10124) Wen Xu discovered that the XFS filesystem implementation in the Linux kernel did not properly validate meta-data information. An attacker could use this to construct a malicious xfs image that, when mounted, could cause a denial of service (system crash). (CVE-2018-10323) Zhong Jiang discovered that a use-after-free vulnerability existed in the NUMA memory policy implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-10675) Wen Xu discovered that a buffer overflow existed in the ext4 filesystem implementation in the Linux kernel. An attacker could use this to construct a malicious ext4 image that, when mounted, could cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-10877) Wen Xu discovered that the ext4 filesystem implementation in the Linux kernel did not properly keep meta-data information consistent in some situations. An attacker could use this to construct a malicious ext4 image that, when mounted, could cause a denial of service (system crash). (CVE-2018-10881) Wen Xu discovered that the ext4 filesystem implementation in the Linux kernel did not properly handle corrupted meta data in some situations. An attacker could use this to specially craft an ext4 file system that caused a denial of service (system crash) when mounted. (CVE-2018-1092) Wen Xu discovered that the ext4 filesystem implementation in the Linux kernel did not properly handle corrupted meta data in some situations. An attacker could use this to specially craft an ext4 filesystem that caused a denial of service (system crash) when mounted. (CVE-2018-1093) It was discovered that the cdrom driver in the Linux kernel contained an incorrect bounds check. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2018-10940) Shankara Pailoor discovered that the JFS filesystem implementation in the Linux kernel contained a buffer overflow when handling extended attributes. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-12233) Wen Xu discovered that the XFS filesystem implementation in the Linux kernel did not properly handle an error condition with a corrupted xfs image. An attacker could use this to construct a malicious xfs image that, when mounted, could cause a denial of service (system crash). (CVE-2018-13094) It was discovered that the Linux kernel did not properly handle setgid file creation when performed by a non-member of the group. A local attacker could use this to gain elevated privileges. (CVE-2018-13405) Silvio Cesare discovered that the generic VESA frame buffer driver in the Linux kernel contained an integer overflow. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-13406) Daniel Jiang discovered that a race condition existed in the ipv4 ping socket implementation in the Linux kernel. A local privileged attacker could use this to cause a denial of service (system crash). (CVE-2017-2671) It was discovered that an information leak existed in the generic SCSI driver in the Linux kernel. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2018-1000204) It was discovered that a memory leak existed in the Serial Attached SCSI (SAS) implementation in the Linux kernel. A physically proximate attacker could use this to cause a denial of service (memory exhaustion). (CVE-2018-10021). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id112113
    published2018-08-24
    reporterUbuntu Security Notice (C) 2018-2019 Canonical, Inc. / NASL script (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/112113
    titleUbuntu 14.04 LTS : linux vulnerabilities (USN-3754-1)
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2018-4161.NASL
    descriptionDescription of changes: [4.1.12-124.17.1.el7uek] - block: update integrity interval after queue limits change (Ritika Srivastava) [Orabug: 27586756] - dccp: check sk for closed state in dccp_sendmsg() (Alexey Kodanev) [Orabug: 28001529] {CVE-2017-8824} {CVE-2018-1130} - net/rds: Implement ARP flushing correctly (H&aring kon Bugge) [Orabug: 28219857] - net/rds: Fix incorrect bigger vs. smaller IP address check (H&aring kon Bugge) [Orabug: 28236599] - ocfs2: Fix locking for res->tracking and dlm->tracking_list (Ashish Samant) [Orabug: 28256391] - xfrm: policy: check policy direction value (Vladis Dronov) [Orabug: 28256487] {CVE-2017-11600} {CVE-2017-11600} [4.1.12-124.16.6.el7uek] - add kernel param to pre-allocate NICs (Brian Maly) [Orabug: 27870400] - mm/mempolicy.c: fix error handling in set_mempolicy and mbind. (Chris Salls) [Orabug: 28242475] {CVE-2017-7616} - xhci: Fix USB3 NULL pointer dereference at logical disconnect. (Mathias Nyman) [Orabug: 27426023] - mlx4_core: restore optimal ICM memory allocation (Eric Dumazet) [Orabug: 27718303] - mlx4_core: allocate ICM memory in page size chunks (Qing Huang) [Orabug: 27718303] - kernel/signal.c: avoid undefined behaviour in kill_something_info When running kill(72057458746458112, 0) in userspace I hit the following issue. (mridula shastry) [Orabug: 28078687] {CVE-2018-10124} - rds: tcp: compute m_ack_seq as offset from ->write_seq (Sowmini Varadhan) [Orabug: 28085214] - ext4: fix bitmap position validation (Lukas Czerner) [Orabug: 28167032] - net/rds: Fix bug in failover_group parsing (H&aring kon Bugge) [Orabug: 28198749] - sctp: verify size of a new chunk in _sctp_make_chunk() (Alexey Kodanev) [Orabug: 28240074] {CVE-2018-5803} [4.1.12-124.16.5.el7uek] - netfilter: xt_TCPMSS: add more sanity tests on tcph->doff (Eric Dumazet) [Orabug: 27896802] {CVE-2017-18017} - kernel/exit.c: avoid undefined behaviour when calling wait4() wait4(-2147483648, 0x20, 0, 0xdd0000) triggers: UBSAN: Undefined behaviour in kernel/exit.c:1651:9 (mridula shastry) [Orabug: 28049778] {CVE-2018-10087} - x86/bugs/module: Provide retpoline_modules_only parameter to fail non-retpoline modules (Konrad Rzeszutek Wilk) [Orabug: 28071992]
    last seen2020-06-01
    modified2020-06-02
    plugin id110997
    published2018-07-11
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/110997
    titleOracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2018-4161)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DLA-1423.NASL
    descriptionLinux 4.9 has been packaged for Debian 8 as linux-4.9. This provides a supported upgrade path for systems that currently use kernel packages from the
    last seen2020-06-01
    modified2020-06-02
    plugin id111165
    published2018-07-20
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/111165
    titleDebian DLA-1423-1 : linux-4.9 new package (Spectre)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2018-1366-1.NASL
    descriptionThe SUSE Linux Enterprise 12 SP3 kernel was updated to 4.4.131 to receive various security and bugfixes. The following security bugs were fixed : - CVE-2018-3639: Information leaks using
    last seen2020-06-01
    modified2020-06-02
    plugin id110033
    published2018-05-23
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/110033
    titleSUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2018:1366-1) (Spectre)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2018-1173-2.NASL
    descriptionThe SUSE Linux Enterprise 12 SP2 LTSS kernel was updated to 4.4.121 to receive various security and bugfixes. The following security bugs were fixed : CVE-2018-8781: The udl_fb_mmap function in drivers/gpu/drm/udl/udl_fb.c had an integer-overflow vulnerability that allowed local users with access to the udldrmfb driver to obtain full read and write permissions on kernel physical pages, resulting in a code execution in kernel space (bnc#1090643). CVE-2018-10124: The kill_something_info function in kernel/signal.c might have allowed local users to cause a denial of service via an INT_MIN argument (bnc#1089752). CVE-2018-10087: The kernel_wait4 function in kernel/exit.c might have allowed local users to cause a denial of service by triggering an attempted use of the -INT_MIN value (bnc#1089608). CVE-2017-18257: The __get_data_block function in fs/f2fs/data.c in the Linux kernel allowed local users to cause a denial of service (integer overflow and loop) via crafted use of the open and fallocate system calls with an FS_IOC_FIEMAP ioctl. (bnc#1088241) CVE-2018-8822: Incorrect buffer length handling in the ncp_read_kernel function in fs/ncpfs/ncplib_kernel.c could be exploited by malicious NCPFS servers to crash the kernel or execute code (bnc#1086162). CVE-2018-8043: The unimac_mdio_probe function in drivers/net/phy/mdio-bcm-unimac.c did not validate certain resource availability, which allowed local users to cause a denial of service (NULL pointer dereference) (bnc#1084829). CVE-2018-7740: The resv_map_release function in mm/hugetlb.c allowed local users to cause a denial of service (BUG) via a crafted application that made mmap system calls and has a large pgoff argument to the remap_file_pages system call (bnc#1084353). CVE-2018-1087: And an unprivileged KVM guest user could use this flaw to potentially escalate their privileges inside a guest. (bsc#1087088) CVE-2018-8897: An unprivileged system user could use incorrect set up interrupt stacks to crash the Linux kernel resulting in DoS issue. (bsc#1087088) The update package also includes non-security fixes. See advisory for details. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id118252
    published2018-10-22
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/118252
    titleSUSE SLES12 Security Update : kernel (SUSE-SU-2018:1173-2)
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-3696-1.NASL
    descriptionIt was discovered that an integer overflow existed in the perf subsystem of the Linux kernel. A local attacker could use this to cause a denial of service (system crash). (CVE-2017-18255) Wei Fang discovered an integer overflow in the F2FS filesystem implementation in the Linux kernel. A local attacker could use this to cause a denial of service. (CVE-2017-18257) It was discovered that an information leak existed in the generic SCSI driver in the Linux kernel. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2018-1000204) It was discovered that the wait4() system call in the Linux kernel did not properly validate its arguments in some situations. A local attacker could possibly use this to cause a denial of service. (CVE-2018-10087) It was discovered that the kill() system call implementation in the Linux kernel did not properly validate its arguments in some situations. A local attacker could possibly use this to cause a denial of service. (CVE-2018-10124) Julian Stecklina and Thomas Prescher discovered that FPU register states (such as MMX, SSE, and AVX registers) which are lazily restored are potentially vulnerable to a side channel attack. A local attacker could use this to expose sensitive information. (CVE-2018-3665) Jakub Jirasek discovered that multiple use-after-errors existed in the USB/IP implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-5814) It was discovered that an information leak vulnerability existed in the floppy driver in the Linux kernel. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2018-7755) Seunghun Han discovered an information leak in the ACPI handling code in the Linux kernel when handling early termination of ACPI table loading. A local attacker could use this to expose sensitive informal (kernel address locations). (CVE-2017-13695) It was discovered that a memory leak existed in the Serial Attached SCSI (SAS) implementation in the Linux kernel. A physically proximate attacker could use this to cause a denial of service (memory exhaustion). (CVE-2018-10021). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id110896
    published2018-07-03
    reporterUbuntu Security Notice (C) 2018-2019 Canonical, Inc. / NASL script (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/110896
    titleUbuntu 16.04 LTS : linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities (USN-3696-1)
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2018-4164.NASL
    descriptionDescription of changes: kernel-uek kernel-uek [3.8.13-118.22.1.el7uek] - dm: fix race between dm_get_from_kobject() and __dm_destroy() (Hou Tao) {CVE-2017-18203} - drm: udl: Properly check framebuffer mmap offsets (Greg Kroah-Hartman) [Orabug: 27986407] {CVE-2018-8781} - kernel/exit.c: avoid undefined behaviour when calling wait4() wait4(-2147483648, 0x20, 0, 0xdd0000) triggers: UBSAN: Undefined behaviour in kernel/exit.c:1651:9 (mridula shastry) [Orabug: 27875488] {CVE-2018-10087} - kernel/signal.c: avoid undefined behaviour in kill_something_info When running kill(72057458746458112, 0) in userspace I hit the following issue. (mridula shastry) {CVE-2018-10124} - bluetooth: Validate socket address length in sco_sock_bind(). (mlevatic) [Orabug: 28130293] {CVE-2015-8575} - dccp: check sk for closed state in dccp_sendmsg() (Alexey Kodanev) [Orabug: 28220402] {CVE-2017-8824} {CVE-2018-1130} - sctp: verify size of a new chunk in _sctp_make_chunk() (Alexey Kodanev) [Orabug: 28240075] {CVE-2018-5803} - mm/mempolicy.c: fix error handling in set_mempolicy and mbind. (Chris Salls) [Orabug: 28242478] {CVE-2017-7616} - xfrm: policy: check policy direction value (Vladis Dronov) [Orabug: 28264121] {CVE-2017-11600} {CVE-2017-11600} - x86/fpu: Make eager FPU default (Mihai Carabas) [Orabug: 28156176] {CVE-2018-3665} - KVM: Fix stack-out-of-bounds read in write_mmio (Wanpeng Li) [Orabug: 27951287] {CVE-2017-17741} {CVE-2017-17741} - xfs: set format back to extents if xfs_bmap_extents_to_btree (Eric Sandeen) [Orabug: 27989498] {CVE-2018-10323} - Bluetooth: Prevent stack info leak from the EFS element. (Ben Seri) [Orabug: 28030520] {CVE-2017-1000410} {CVE-2017-1000410} - ALSA: hrtimer: Fix stall by hrtimer_cancel() (Takashi Iwai) [Orabug: 28058229] {CVE-2016-2549} - ALSA: timer: Harden slave timer list handling (Takashi Iwai) [Orabug: 28058229] {CVE-2016-2547} {CVE-2016-2548} - ALSA: timer: Fix double unlink of active_list (Takashi Iwai) [Orabug: 28058229] {CVE-2016-2545} - ALSA: seq: Fix missing NULL check at remove_events ioctl (Takashi Iwai) [Orabug: 28058229] {CVE-2016-2543} - ALSA: seq: Fix race at timer setup and close (Takashi Iwai) [Orabug: 28058229] {CVE-2016-2544} - ALSA: usb-audio: avoid freeing umidi object twice (Andrey Konovalov) [Orabug: 28058229] {CVE-2016-2384} - perf/hwbp: Simplify the perf-hwbp code, fix documentation (Linus Torvalds) [Orabug: 27947608] {CVE-2018-1000199} - Revert
    last seen2020-06-01
    modified2020-06-02
    plugin id110998
    published2018-07-11
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/110998
    titleOracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2018-4164)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2018-1221-1.NASL
    descriptionThe SUSE Linux Enterprise 12 GA LTSS kernel was updated to receive various security and bugfixes. The following security bugs were fixed : - CVE-2018-1087: And an unprivileged KVM guest user could use this flaw to potentially escalate their privileges inside a guest. (bsc#1087088) - CVE-2018-8897: An unprivileged system user could use incorrect set up interrupt stacks to crash the Linux kernel resulting in DoS issue. (bsc#1087088) - CVE-2018-8781: The udl_fb_mmap function in drivers/gpu/drm/udl/udl_fb.c had an integer-overflow vulnerability allowing local users with access to the udldrmfb driver to obtain full read and write permissions on kernel physical pages, resulting in a code execution in kernel space (bnc#1090643). - CVE-2018-10124: The kill_something_info function in kernel/signal.c might allow local users to cause a denial of service via an INT_MIN argument (bnc#1089752). - CVE-2018-10087: The kernel_wait4 function in kernel/exit.c might allow local users to cause a denial of service by triggering an attempted use of the -INT_MIN value (bnc#1089608). - CVE-2018-7757: Memory leak in the sas_smp_get_phy_events function in drivers/scsi/libsas/sas_expander.c allowed local users to cause a denial of service (memory consumption) via many read accesses to files in the /sys/class/sas_phy directory, as demonstrated by the /sys/class/sas_phy/phy-1:0:12/invalid_dword_count file (bnc#1084536 1087209). - CVE-2017-13220: An elevation of privilege vulnerability in the Upstream kernel bluez was fixed. (bnc#1076537). - CVE-2017-11089: A buffer overread was observed in nl80211_set_station when user space application sends attribute NL80211_ATTR_LOCAL_MESH_POWER_MODE with data of size less than 4 bytes (bnc#1088261). - CVE-2017-0861: Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem allowed attackers to gain privileges via unspecified vectors (bnc#1088260). - CVE-2018-8822: Incorrect buffer length handling in the ncp_read_kernel function in fs/ncpfs/ncplib_kernel.c could be exploited by malicious NCPFS servers to crash the kernel or execute code (bnc#1086162). - CVE-2017-18203: The dm_get_from_kobject function in drivers/md/dm.c allow local users to cause a denial of service (BUG) by leveraging a race condition with __dm_destroy during creation and removal of DM devices (bnc#1083242). The update package also includes non-security fixes. See advisory for details. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id109758
    published2018-05-14
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/109758
    titleSUSE SLES12 Security Update : kernel (SUSE-SU-2018:1221-1)
  • NASL familyOracleVM Local Security Checks
    NASL idORACLEVM_OVMSA-2018-0237.NASL
    descriptionThe remote OracleVM system is missing necessary patches to address critical security updates : - dm: fix race between dm_get_from_kobject and __dm_destroy (Hou Tao) (CVE-2017-18203) - drm: udl: Properly check framebuffer mmap offsets (Greg Kroah-Hartman) [Orabug: 27986407] (CVE-2018-8781) - kernel/exit.c: avoid undefined behaviour when calling wait4 wait4(-2147483648, 0x20, 0, 0xdd0000) triggers: UBSAN: Undefined behaviour in kernel/exit.c:1651:9 (mridula shastry) [Orabug: 27875488] (CVE-2018-10087) - kernel/signal.c: avoid undefined behaviour in kill_something_info When running kill(72057458746458112, 0) in userspace I hit the following issue. (mridula shastry) (CVE-2018-10124) - bluetooth: Validate socket address length in sco_sock_bind. (mlevatic) [Orabug: 28130293] (CVE-2015-8575) - dccp: check sk for closed state in dccp_sendmsg (Alexey Kodanev) [Orabug: 28220402] (CVE-2017-8824) (CVE-2018-1130) - sctp: verify size of a new chunk in _sctp_make_chunk (Alexey Kodanev) [Orabug: 28240075] (CVE-2018-5803) - mm/mempolicy.c: fix error handling in set_mempolicy and mbind. (Chris Salls) [Orabug: 28242478] (CVE-2017-7616) - xfrm: policy: check policy direction value (Vladis Dronov) [Orabug: 28264121] (CVE-2017-11600) (CVE-2017-11600) - x86/fpu: Make eager FPU default (Mihai Carabas) [Orabug: 28156176] (CVE-2018-3665) - KVM: Fix stack-out-of-bounds read in write_mmio (Wanpeng Li) [Orabug: 27951287] (CVE-2017-17741) (CVE-2017-17741) - xfs: set format back to extents if xfs_bmap_extents_to_btree (Eric Sandeen) [Orabug: 27989498] (CVE-2018-10323) - Bluetooth: Prevent stack info leak from the EFS element. (Ben Seri) [Orabug: 28030520] (CVE-2017-1000410) (CVE-2017-1000410) - ALSA: hrtimer: Fix stall by hrtimer_cancel (Takashi Iwai) [Orabug: 28058229] (CVE-2016-2549) - ALSA: timer: Harden slave timer list handling (Takashi Iwai) [Orabug: 28058229] (CVE-2016-2547) (CVE-2016-2548) - ALSA: timer: Fix double unlink of active_list (Takashi Iwai) [Orabug: 28058229] (CVE-2016-2545) - ALSA: seq: Fix missing NULL check at remove_events ioctl (Takashi Iwai) [Orabug: 28058229] (CVE-2016-2543) - ALSA: seq: Fix race at timer setup and close (Takashi Iwai) [Orabug: 28058229] (CVE-2016-2544) - ALSA: usb-audio: avoid freeing umidi object twice (Andrey Konovalov) [Orabug: 28058229] (CVE-2016-2384) - perf/hwbp: Simplify the perf-hwbp code, fix documentation (Linus Torvalds) [Orabug: 27947608] (CVE-2018-1000199) - Revert
    last seen2020-06-01
    modified2020-06-02
    plugin id111022
    published2018-07-12
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/111022
    titleOracleVM 3.3 : Unbreakable / etc (OVMSA-2018-0237)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2018-762.NASL
    descriptionThe openSUSE Leap 15 kernel was updated to receive various security and bugfixes. The following security bugs were fixed : - CVE-2018-13406: An integer overflow in the uvesafb_setcmap function could have result in local attackers being able to crash the kernel or potentially elevate privileges because kmalloc_array is not used (bnc#1100418) - CVE-2018-13053: The alarm_timer_nsleep function had an integer overflow via a large relative timeout because ktime_add_safe was not used (bnc#1099924) - CVE-2018-9385: Prevent overread of the
    last seen2020-06-05
    modified2018-07-30
    plugin id111414
    published2018-07-30
    reporterThis script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/111414
    titleopenSUSE Security Update : the Linux Kernel (openSUSE-2018-762) (Spectre)
  • NASL familyPhotonOS Local Security Checks
    NASL idPHOTONOS_PHSA-2018-2_0-0062_LINUX.NASL
    descriptionAn update of the linux package has been released.
    last seen2020-03-17
    modified2019-02-07
    plugin id121959
    published2019-02-07
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/121959
    titlePhoton OS 2.0: Linux PHSA-2018-2.0-0062
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2018-1172-1.NASL
    descriptionThe SUSE Linux Enterprise 11 SP3 LTSS kernel was updated to receive various security and bugfixes. The following security bugs were fixed : - CVE-2018-1087: And an unprivileged KVM guest user could use this flaw to potentially escalate their privileges inside a guest. (bsc#1087088) - CVE-2018-8897: An unprivileged system user could use incorrect set up interrupt stacks to crash the Linux kernel resulting in DoS issue. (bsc#1087088) - CVE-2018-10124: The kill_something_info function in kernel/signal.c might allow local users to cause a denial of service via an INT_MIN argument (bnc#1089752). - CVE-2018-10087: The kernel_wait4 function in kernel/exit.c might allow local users to cause a denial of service by triggering an attempted use of the -INT_MIN value (bnc#1089608). - CVE-2018-7757: Memory leak in the sas_smp_get_phy_events function in drivers/scsi/libsas/sas_expander.c allowed local users to cause a denial of service (memory consumption) via many read accesses to files in the /sys/class/sas_phy directory, as demonstrated by the /sys/class/sas_phy/phy-1:0:12/invalid_dword_count file (bnc#1084536 1087209). - CVE-2018-7566: A Buffer Overflow via an SNDRV_SEQ_IOCTL_SET_CLIENT_POOL ioctl write operation to /dev/snd/seq by a local user was fixed (bnc#1083483). - CVE-2017-0861: Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem allowed attackers to gain privileges via unspecified vectors (bnc#1088260). - CVE-2018-8822: Incorrect buffer length handling in the ncp_read_kernel function in fs/ncpfs/ncplib_kernel.c could be exploited by malicious NCPFS servers to crash the kernel or execute code (bnc#1086162). - CVE-2017-13166: An elevation of privilege vulnerability in the kernel v4l2 video driver. (bnc#1072865). - CVE-2017-18203: The dm_get_from_kobject function in drivers/md/dm.c allow local users to cause a denial of service (BUG) by leveraging a race condition with __dm_destroy during creation and removal of DM devices (bnc#1083242). - CVE-2017-16911: The vhci_hcd driver allowed allows local attackers to disclose kernel memory addresses. Successful exploitation requires that a USB device is attached over IP (bnc#1078674). - CVE-2017-18208: The madvise_willneed function in mm/madvise.c allowed local users to cause a denial of service (infinite loop) by triggering use of MADVISE_WILLNEED for a DAX mapping (bnc#1083494). - CVE-2017-16644: The hdpvr_probe function in drivers/media/usb/hdpvr/hdpvr-core.c allowed local users to cause a denial of service (improper error handling and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1067118). - CVE-2018-6927: The futex_requeue function in kernel/futex.c might allow attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact by triggering a negative wake or requeue value (bnc#1080757). - CVE-2017-16914: The
    last seen2020-06-01
    modified2020-06-02
    plugin id109646
    published2018-05-09
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/109646
    titleSUSE SLES11 Security Update : kernel (SUSE-SU-2018:1172-1)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2018-2092-1.NASL
    descriptionThe SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes. The following new feature was added : - NVDIMM memory error notification (ACPI 6.2) The following security bugs were fixed : - CVE-2018-13406: An integer overflow in the uvesafb_setcmap function could have result in local attackers being able to crash the kernel or potentially elevate privileges because kmalloc_array is not used (bnc#1100418) - CVE-2018-13053: The alarm_timer_nsleep function had an integer overflow via a large relative timeout because ktime_add_safe was not used (bnc#1099924) - CVE-2018-9385: Prevent overread of the
    last seen2020-03-21
    modified2019-01-02
    plugin id120067
    published2019-01-02
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/120067
    titleSUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2018:2092-1) (Spectre)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2018-1220-1.NASL
    descriptionThe SUSE Linux Enterprise 12 SP1 LTSS kernel was updated to receive various security and bugfixes. The following security bugs were fixed : - CVE-2018-1087: And an unprivileged KVM guest user could use this flaw to potentially escalate their privileges inside a guest. (bsc#1087088) - CVE-2018-8897: An unprivileged system user could use incorrect set up interrupt stacks to crash the Linux kernel resulting in DoS issue. (bsc#1087088) - CVE-2018-8781: The udl_fb_mmap function in drivers/gpu/drm/udl/udl_fb.c had an integer-overflow vulnerability allowing local users with access to the udldrmfb driver to obtain full read and write permissions on kernel physical pages, resulting in a code execution in kernel space (bnc#1090643). - CVE-2018-10124: The kill_something_info function in kernel/signal.c might allow local users to cause a denial of service via an INT_MIN argument (bnc#1089752). - CVE-2018-10087: The kernel_wait4 function in kernel/exit.c in might allow local users to cause a denial of service by triggering an attempted use of the -INT_MIN value (bnc#1089608). - CVE-2018-7757: Memory leak in the sas_smp_get_phy_events function in drivers/scsi/libsas/sas_expander.c allowed local users to cause a denial of service (memory consumption) via many read accesses to files in the /sys/class/sas_phy directory, as demonstrated by the /sys/class/sas_phy/phy-1:0:12/invalid_dword_count file (bnc#1084536). - CVE-2017-13220: An elevation of privilege vulnerability in the Upstream kernel bluez was fixed. (bnc#1076537). - CVE-2017-11089: A buffer overread is observed in nl80211_set_station when user space application sends attribute NL80211_ATTR_LOCAL_MESH_POWER_MODE with data of size less than 4 bytes (bnc#1088261). - CVE-2017-0861: Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem allowed attackers to gain privileges via unspecified vectors (bnc#1088260). - CVE-2018-8822: Incorrect buffer length handling in the ncp_read_kernel function in fs/ncpfs/ncplib_kernel.c could be exploited by malicious NCPFS servers to crash the kernel or execute code (bnc#1086162). - CVE-2017-18203: The dm_get_from_kobject function in drivers/md/dm.c allowed local users to cause a denial of service (BUG) by leveraging a race condition with __dm_destroy during creation and removal of DM devices (bnc#1083242). The update package also includes non-security fixes. See advisory for details. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id109757
    published2018-05-14
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/109757
    titleSUSE SLES12 Security Update : kernel (SUSE-SU-2018:1220-1)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2019-2353.NASL
    descriptionAccording to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The kernel package contains the Linux kernel (vmlinuz), the core of any Linux operating system. The kernel handles the basic functions of the operating system: memory allocation, process allocation, device input and output, etc.Security Fix(es):The yam_ioctl function in drivers et/hamradio/yam.c in the Linux kernel before 3.12.8 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability for an SIOCYAMGCFG ioctl call.(CVE-2014-1446)The VFS subsystem in the Linux kernel 3.x provides an incomplete set of requirements for setattr operations that underspecifies removing extended privilege attributes, which allows local users to cause a denial of service (capability stripping) via a failed invocation of a system call, as demonstrated by using chown to remove a capability from the ping or Wireshark dumpcap program.(CVE-2015-1350)A certain backport in the TCP Fast Open implementation for the Linux kernel before 3.18 does not properly maintain a count value, which allow local users to cause a denial of service (system crash) via the Fast Open feature, as demonstrated by visiting the chrome://flags/#enable-tcp-fast-open URL when using certain 3.10.x through 3.16.x kernel builds, including longterm-maintenance releases and ckt (aka Canonical Kernel Team) builds.(CVE-2015-3332)The hub_activate function in drivers/usb/core/hub.c in the Linux kernel before 4.3.5 does not properly maintain a hub-interface data structure, which allows physically proximate attackers to cause a denial of service (invalid memory access and system crash) or possibly have unspecified other impact by unplugging a USB hub device.(CVE-2015-8816)In the Linux kernel before 4.1.4, a buffer overflow occurs when checking userspace params in drivers/media/dvb-frontends/cx24116.c. The maximum size for a DiSEqC command is 6, according to the userspace API. However, the code allows larger values such as 23.(CVE-2015-9289)The create_fixed_stream_quirk function in sound/usb/quirks.c in the snd-usb-audio driver in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference or double free, and system crash) via a crafted endpoints value in a USB device descriptor.(CVE-2016-2184)The ati_remote2_probe function in drivers/input/misc/ati_remote2.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor.(CVE-2016-2185)The powermate_probe function in drivers/input/misc/powermate.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor.(CVE-2016-2186)The gtco_probe function in drivers/input/tablet/gtco.c in the Linux kernel through 4.5.2 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor.(CVE-2016-2187)Double free vulnerability in the snd_usbmidi_create function in sound/usb/midi.c in the Linux kernel before 4.5 allows physically proximate attackers to cause a denial of service (panic) or possibly have unspecified other impact via vectors involving an invalid USB descriptor.(CVE-2016-2384)The treo_attach function in drivers/usb/serial/visor.c in the Linux kernel before 4.5 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by inserting a USB device that lacks a (1) bulk-in or (2) interrupt-in endpoint.(CVE-2016-2782)The acm_probe function in drivers/usb/class/cdc-acm.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a USB device without both a control and a data endpoint descriptor.(CVE-2016-3138)The wacom_probe function in drivers/input/tablet/wacom_sys.c in the Linux kernel before 3.17 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor.(CVE-2016-3139)The digi_port_init function in drivers/usb/serial/digi_acceleport.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor.(CVE-2016-3140)The ims_pcu_parse_cdc_data function in drivers/input/misc/ims-pcu.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (system crash) via a USB device without both a master and a slave interface.(CVE-2016-3689)The snd_timer_user_params function in sound/core/timer.c in the Linux kernel through 4.6 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA timer interface.(CVE-2016-4569)sound/core/timer.c in the Linux kernel through 4.6 does not initialize certain r1 data structures, which allows local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA timer interface, related to the (1) snd_timer_user_ccallback and (2) snd_timer_user_tinterrupt functions.(CVE-2016-4578)The x25_negotiate_facilities function in net/x25/x25_facilities.c in the Linux kernel before 4.5.5 does not properly initialize a certain data structure, which allows attackers to obtain sensitive information from kernel stack memory via an X.25 Call Request.(CVE-2016-4580)The arcmsr_iop_message_xfer function in drivers/scsi/arcmsr/arcmsr_hba.c in the Linux kernel through 4.8.2 does not restrict a certain length field, which allows local users to gain privileges or cause a denial of service (heap-based buffer overflow) via an ARCMSR_MESSAGE_WRITE_WQBUFFER control code.(CVE-2016-7425)The Linux Kernel running on AMD64 systems will sometimes map the contents of PIE executable, the heap or ld.so to where the stack is mapped allowing attackers to more easily manipulate the stack. Linux Kernel version 4.11.5 is affected.(CVE-2017-1000379)In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a buffer overread is observed in nl80211_set_station when user space application sends attribute NL80211_ATTR_LOCAL_MESH_POWER_MODE with data of size less than 4 bytes(CVE-2017-11089)An elevation of privilege vulnerability in the kernel sound timer. Product: Android. Versions: Android kernel. Android ID A-37240993.(CVE-2017-13167)In ashmem_ioctl of ashmem.c, there is an out-of-bounds write due to insufficient locking when accessing asma. This could lead to a local elevation of privilege enabling code execution as a privileged process with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android kernel. Android ID: A-66954097.(CVE-2017-13216)A information disclosure vulnerability in the Upstream kernel encrypted-keys. Product: Android. Versions: Android kernel. Android ID: A-70526974.(CVE-2017-13305)An integer overflow in the qla2x00_sysfs_write_optrom_ctl function in drivers/scsi/qla2xxx/qla_attr.c in the Linux kernel through 4.12.10 allows local users to cause a denial of service (memory corruption and system crash) by leveraging root access.(CVE-2017-14051)The Serial Attached SCSI (SAS) implementation in the Linux kernel through 4.15.9 mishandles a mutex within libsas, which allows local users to cause a denial of service (deadlock) by triggering certain error-handling code.(CVE-2017-18232)An issue was discovered in net/ipv6/ip6mr.c in the Linux kernel before 4.11. By setting a specific socket option, an attacker can control a pointer in kernel land and cause an inet_csk_listen_stop general protection fault, or potentially execute arbitrary code under certain circumstances. The issue can be triggered as root (e.g., inside a default LXC container or with the CAP_NET_ADMIN capability) or after namespace unsharing. This occurs because sk_type and protocol are not checked in the appropriate part of the ip6_mroute_* functions. NOTE: this affects Linux distributions that use 4.9.x longterm kernels before 4.9.187.(CVE-2017-18509)An issue was discovered in drivers/i2c/i2c-core-smbus.c in the Linux kernel before 4.14.15. There is an out of bounds write in the function i2c_smbus_xfer_emulated.(CVE-2017-18551)An issue was discovered in the Linux kernel before 4.14.11. A double free may be caused by the function allocate_trace_buffer in the file kernel/trace/trace.c.(CVE-2017-18595)The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel through 4.10.5 does not check for a zero value of certain levels data, which allows local users to cause a denial of service (ZERO_SIZE_PTR dereference, and GPF and possibly panic) via a crafted ioctl call for a /dev/dri/renderD* device.(CVE-2017-7261)The KEYS subsystem in the Linux kernel before 4.10.13 allows local users to cause a denial of service (memory consumption) via a series of KEY_REQKEY_DEFL_THREAD_KEYRING keyctl_set_reqkey_keyring calls.(CVE-2017-7472)The kernel_wait4 function in kernel/exit.c in the Linux kernel before 4.13, when an unspecified architecture and compiler is used, might allow local users to cause a denial of service by triggering an attempted use of the -INT_MIN value.(CVE-2018-10087)The kill_something_info function in kernel/signal.c in the Linux kernel before 4.13, when an unspecified architecture and compiler is used, might allow local users to cause a denial of service via an INT_MIN argument.(CVE-2018-10124)The xfs_dinode_verify function in fs/xfs/libxfs/xfs_inode_buf.c in the Linux kernel through 4.16.3 allows local users to cause a denial of service (xfs_ilock_attr_map_shared invalid pointer dereference) via a crafted xfs image.(CVE-2018-10322)The xfs_bmap_extents_to_btree function in fs/xfs/libxfs/xfs_bmap.c in the Linux kernel through 4.16.3 allows local users to cause a denial of service (xfs_bmapi_write NULL pointer dereference) via a crafted xfs image.(CVE-2018-10323)The do_get_mempolicy function in mm/mempolicy.c in the Linux kernel before 4.12.9 allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted system calls.(CVE-2018-10675)Linux kernel is vulnerable to a stack-out-of-bounds write in the ext4 filesystem code when mounting and writing to a crafted ext4 image in ext4_update_inline_data(). An attacker could use this to cause a system crash and a denial of service.(CVE-2018-10880)An issue was discovered in the Linux kernel through 4.17.3. An Integer Overflow in kernel/time/posix-timers.c in the POSIX timer code is caused by the way the overrun accounting works. Depending on interval and expiry time values, the overrun can be larger than INT_MAX, but the accounting is int based. This basically makes the accounting values, which are visible to user space via timer_getoverrun(2) and siginfo::si_overrun, random. For example, a local user can cause a denial of service (signed integer overflow) via crafted mmap, futex, timer_create, and timer_settime system calls.(CVE-2018-12896)An issue was discovered in the proc_pid_stack function in fs/proc/base.c in the Linux kernel through 4.18.11. It does not ensure that only root may inspect the kernel stack of an arbitrary task, allowing a local attacker to exploit racy stack unwinding and leak kernel task stack contents.(CVE-2018-17972)An issue was discovered in the Linux kernel through 4.19. An information leak in cdrom_ioctl_select_disc in drivers/cdrom/cdrom.c could be used by local attackers to read kernel memory because a cast from unsigned long to int interferes with bounds checking. This is similar to CVE-2018-10940 and CVE-2018-16658.(CVE-2018-18710 )An issue was discovered in the Linux kernel before 4.18.11. The ipddp_ioctl function in drivers et/appletalk/ipddp.c allows local users to obtain sensitive kernel address information by leveraging CAP_NET_ADMIN to read the ipddp_route dev and next fields via an SIOCFINDIPDDPRT ioctl call.(CVE-2018-20511)An issue was discovered in the Linux kernel before 4.18.7. In block/blk-core.c, there is an __blk_drain_queue() use-after-free because a certain error case is mishandled.(CVE-2018-20856)An issue was discovered in fs/xfs/xfs_super.c in the Linux kernel before 4.18. A use after free exists, related to xfs_fs_fill_super failure.(CVE-2018-20976)Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a speculative buffer overflow and side-channel analysis.(CVE-2018-3693)In the function sbusfb_ioctl_helper() in drivers/video/fbdev/sbuslib.c in the Linux kernel through 4.15, an integer signedness error allows arbitrary information leakage for the FBIOPUTCMAP_SPARC and FBIOGETCMAP_SPARC commands.(CVE-2018-6412)In nfc_llcp_build_sdreq_tlv of llcp_commands.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android kernel. Android ID: A-73083945.(CVE-2018-9518 )Insufficient access control in the Intel(R) PROSet/Wireless WiFi Software driver before version 21.10 may allow an unauthenticated user to potentially enable denial of service via adjacent access.(CVE-2019-0136)A vulnerability was found in Linux kernel
    last seen2020-05-08
    modified2019-12-10
    plugin id131845
    published2019-12-10
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/131845
    titleEulerOS 2.0 SP2 : kernel (EulerOS-SA-2019-2353)
  • NASL familyPhotonOS Local Security Checks
    NASL idPHOTONOS_PHSA-2018-2_0-0062.NASL
    descriptionAn update of {'linux-aws', 'linux-esx', 'linux', 'linux-secure'} packages of Photon OS has been released.
    last seen2019-02-21
    modified2019-02-07
    plugin id111310
    published2018-07-24
    reporterTenable
    sourcehttps://www.tenable.com/plugins/index.php?view=single&id=111310
    titlePhoton OS 2.0 : linux-aws / linux-esx / linux / linux-secure (PhotonOS-PHSA-2018-2.0-0062) (deprecated)
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2018-4172.NASL
    descriptionDescription of changes: [2.6.39-400.300.2.el6uek] - Revert
    last seen2020-06-01
    modified2020-06-02
    plugin id111144
    published2018-07-18
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/111144
    titleOracle Linux 6 : Unbreakable Enterprise kernel (ELSA-2018-4172)
  • NASL familyOracleVM Local Security Checks
    NASL idORACLEVM_OVMSA-2018-0236.NASL
    descriptionThe remote OracleVM system is missing necessary patches to address critical security updates : - block: update integrity interval after queue limits change (Ritika Srivastava) [Orabug: 27586756] - dccp: check sk for closed state in dccp_sendmsg (Alexey Kodanev) [Orabug: 28001529] (CVE-2017-8824) (CVE-2018-1130) - net/rds: Implement ARP flushing correctly (H&aring kon Bugge) [Orabug: 28219857] - net/rds: Fix incorrect bigger vs. smaller IP address check (H&aring kon Bugge) [Orabug: 28236599] - ocfs2: Fix locking for res->tracking and dlm->tracking_list (Ashish Samant) [Orabug: 28256391] - xfrm: policy: check policy direction value (Vladis Dronov) [Orabug: 28256487] (CVE-2017-11600) (CVE-2017-11600) - add kernel param to pre-allocate NICs (Brian Maly) [Orabug: 27870400] - mm/mempolicy.c: fix error handling in set_mempolicy and mbind. (Chris Salls) [Orabug: 28242475] (CVE-2017-7616) - xhci: Fix USB3 NULL pointer dereference at logical disconnect. (Mathias Nyman) [Orabug: 27426023] - mlx4_core: restore optimal ICM memory allocation (Eric Dumazet) - mlx4_core: allocate ICM memory in page size chunks (Qing Huang) - kernel/signal.c: avoid undefined behaviour in kill_something_info When running kill(72057458746458112, 0) in userspace I hit the following issue. (mridula shastry) [Orabug: 28078687] (CVE-2018-10124) - rds: tcp: compute m_ack_seq as offset from ->write_seq (Sowmini Varadhan) [Orabug: 28085214] - ext4: fix bitmap position validation (Lukas Czerner) [Orabug: 28167032] - net/rds: Fix bug in failover_group parsing (H&aring kon Bugge) [Orabug: 28198749] - sctp: verify size of a new chunk in _sctp_make_chunk (Alexey Kodanev) [Orabug: 28240074] (CVE-2018-5803) - netfilter: xt_TCPMSS: add more sanity tests on tcph->doff (Eric Dumazet) [Orabug: 27896802] (CVE-2017-18017) - kernel/exit.c: avoid undefined behaviour when calling wait4 wait4(-2147483648, 0x20, 0, 0xdd0000) triggers: UBSAN: Undefined behaviour in kernel/exit.c:1651:9 (mridula shastry) [Orabug: 28049778] (CVE-2018-10087) - x86/bugs/module: Provide retpoline_modules_only parameter to fail non-retpoline modules (Konrad Rzeszutek Wilk) [Orabug: 28071992]
    last seen2020-06-01
    modified2020-06-02
    plugin id111021
    published2018-07-12
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/111021
    titleOracleVM 3.4 : Unbreakable / etc (OVMSA-2018-0236)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2019-536.NASL
    descriptionThe openSUSE Leap 15 kernel was updated to receive various security and bugfixes. The following security bugs were fixed : - CVE-2018-13406: An integer overflow in the uvesafb_setcmap function could have result in local attackers being able to crash the kernel or potentially elevate privileges because kmalloc_array is not used (bnc#1100418) - CVE-2018-13053: The alarm_timer_nsleep function had an integer overflow via a large relative timeout because ktime_add_safe was not used (bnc#1099924) - CVE-2018-9385: Prevent overread of the
    last seen2020-06-01
    modified2020-06-02
    plugin id123226
    published2019-03-27
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/123226
    titleopenSUSE Security Update : the Linux Kernel (openSUSE-2019-536) (Spectre)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2019-2274.NASL
    descriptionAccording to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The kernel package contains the Linux kernel (vmlinuz), the core of any Linux operating system. The kernel handles the basic functions of the operating system: memory allocation, process allocation, device input and output, etc.Security Fix(es):Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis of the data cache.(CVE-2017-5754)The ip6gre_err function in net/ipv6/ip6_gre.c in the Linux kernel allows remote attackers to have unspecified impact via vectors involving GRE flags in an IPv6 packet, which trigger an out-of-bounds access.(CVE-2017-5897)The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel through 4.10.5 does not check for a zero value of certain levels data, which allows local users to cause a denial of service (ZERO_SIZE_PTR dereference, and GPF and possibly panic) via a crafted ioctl call for a /dev/dri/renderD* device.(CVE-2017-7261)The KEYS subsystem in the Linux kernel before 4.10.13 allows local users to cause a denial of service (memory consumption) via a series of KEY_REQKEY_DEFL_THREAD_KEYRING keyctl_set_reqkey_keyring calls.(CVE-2017-7472)A flaw was found in the Linux kernel before version 4.12 in the way the KVM module processed the trap flag(TF) bit in EFLAGS during emulation of the syscall instruction, which leads to a debug exception(#DB) being raised in the guest stack. A user/process inside a guest could use this flaw to potentially escalate their privileges inside the guest. Linux guests are not affected by this.(CVE-2017-7518)The kill_something_info function in kernel/signal.c in the Linux kernel before 4.13, when an unspecified architecture and compiler is used, might allow local users to cause a denial of service via an INT_MIN argument.(CVE-2018-10124)The xfs_bmap_extents_to_btree function in fs/xfs/libxfs/xfs_bmap.c in the Linux kernel through 4.16.3 allows local users to cause a denial of service (xfs_bmapi_write NULL pointer dereference) via a crafted xfs image.(CVE-2018-10323)The Linux kernel before version 4.11 is vulnerable to a NULL pointer dereference in fs/cifs/cifsencrypt.c:setup_ntlmv2_rsp() that allows an attacker controlling a CIFS server to kernel panic a client that has this server mounted, because an empty TargetInfo field in an NTLMSSP setup negotiation response is mishandled during session recovery.(CVE-2018-1066)The do_get_mempolicy function in mm/mempolicy.c in the Linux kernel before 4.12.9 allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted system calls.(CVE-2018-10675)An issue was discovered in fs/xfs/libxfs/xfs_attr_leaf.c in the Linux kernel through 4.17.3. An OOPS may occur for a corrupted xfs image after xfs_da_shrink_inode() is called with a NULL bp.(CVE-2018-13094)An issue was discovered in fs/xfs/xfs_super.c in the Linux kernel before 4.18. A use after free exists, related to xfs_fs_fill_super failure.(CVE-2018-20976)Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a speculative buffer overflow and side-channel analysis.(CVE-2018-3693)In the function sbusfb_ioctl_helper() in drivers/video/fbdev/sbuslib.c in the Linux kernel through 4.15, an integer signedness error allows arbitrary information leakage for the FBIOPUTCMAP_SPARC and FBIOGETCMAP_SPARC commands.(CVE-2018-6412)Race condition in the store_int_with_restart() function in arch/x86/kernel/cpu/mcheck/mce.c in the Linux kernel through 4.15.7 allows local users to cause a denial of service (panic) by leveraging root access to write to the check_interval file in a /sys/devices/system/machinecheck/machinecheck directory. NOTE: a third party has indicated that this report is not security relevant.(CVE-2018-7995)In the hidp_process_report in bluetooth, there is an integer overflow. This could lead to an out of bounds write with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-65853588 References: Upstream kernel.(CVE-2018-9363)In nfc_llcp_build_sdreq_tlv of llcp_commands.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android kernel. Android ID: A-73083945.(CVE-2018-9518)A vulnerability was found in Linux kernel
    last seen2020-05-08
    modified2019-11-08
    plugin id130736
    published2019-11-08
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/130736
    titleEulerOS 2.0 SP3 : kernel (EulerOS-SA-2019-2274)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2019-1507.NASL
    descriptionAccording to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - The Linux kernel has an undefined behavior when an argument of INT_MIN is passed to the kernel/signal.c:kill_something_info() function. A local attacker may be able to exploit this to cause a denial of service.(CVE-2018-10124) - The xfs_dinode_verify function in fs/xfs/libxfs/xfs_inode_buf.c in the Linux kernel can cause a NULL pointer dereference in xfs_ilock_attr_map_shared function. An attacker could trick a legitimate user or a privileged attacker could exploit this by mounting a crafted xfs filesystem image to cause a kernel panic and thus a denial of service.(CVE-2018-10322) - A flaw was found in the Linux kernel
    last seen2020-06-01
    modified2020-06-02
    plugin id124830
    published2019-05-13
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/124830
    titleEulerOS Virtualization 3.0.1.0 : kernel (EulerOS-SA-2019-1507)