SUSE-SU-2017:0865-1 | Mondoo Vulnerability Intelligence

SUSE-SU-2017:0865-1

HIGH7.8

Security update for the Linux Kernel

Published Mar 29, 2017

Modified 9 years ago

Fix available

Details

Description of the patch:

The SUSE Linux Enterprise 12 kernel was updated to fix the following security bugs:

CVE-2017-7184: The Linux kernel allowed local users to obtain root privileges or cause a denial of service (heap-based out-of-bounds access) via unspecified vectors, as demonstrated during a Pwn2Own competition at CanSecWest 2017 (bnc#1030573, bnc#1028372).
CVE-2017-2636: Race condition in drivers/tty/n_hdlc.c in the Linux kernel allowed local users to gain privileges or cause a denial of service (double free) by setting the HDLC line discipline (bnc#1027565).

Affected Packages(19 packages)

kernel-default

SUSE Linux Enterprise Desktop 12 SP1SUSE Linux Enterprise Server 12 SP1SUSE Linux Enterprise Server for SAP Applications 12 SP1

Fixed in:

3.12.69-60.64.35.1

kernel-default-devel

SUSE Linux Enterprise Desktop 12 SP1SUSE Linux Enterprise Server 12 SP1SUSE Linux Enterprise Server for SAP Applications 12 SP1

Fixed in:

3.12.69-60.64.35.1

kernel-default-extra

SUSE Linux Enterprise Desktop 12 SP1SUSE Linux Enterprise Workstation Extension 12 SP1

Fixed in:

3.12.69-60.64.35.1

kernel-devel

SUSE Linux Enterprise Desktop 12 SP1SUSE Linux Enterprise Server 12 SP1SUSE Linux Enterprise Server for SAP Applications 12 SP1

Fixed in:

3.12.69-60.64.35.1

kernel-macros

SUSE Linux Enterprise Desktop 12 SP1SUSE Linux Enterprise Server 12 SP1SUSE Linux Enterprise Server for SAP Applications 12 SP1

Fixed in:

3.12.69-60.64.35.1

kernel-source

SUSE Linux Enterprise Desktop 12 SP1SUSE Linux Enterprise Server 12 SP1SUSE Linux Enterprise Server for SAP Applications 12 SP1

Fixed in:

3.12.69-60.64.35.1

kernel-syms

SUSE Linux Enterprise Desktop 12 SP1SUSE Linux Enterprise Server 12 SP1SUSE Linux Enterprise Server for SAP Applications 12 SP1

Fixed in:

3.12.69-60.64.35.1

kernel-xen

SUSE Linux Enterprise Desktop 12 SP1SUSE Linux Enterprise Server 12 SP1SUSE Linux Enterprise Server for SAP Applications 12 SP1

Fixed in:

3.12.69-60.64.35.1

kernel-xen-devel

SUSE Linux Enterprise Desktop 12 SP1SUSE Linux Enterprise Server 12 SP1SUSE Linux Enterprise Server for SAP Applications 12 SP1

Fixed in:

3.12.69-60.64.35.1

kgraft-patch-3_12_69-60_64_35-default

SUSE Linux Enterprise Live Patching 12

Fixed in:

1-2.1

References

https://bugzilla.suse.com/1027565

https://bugzilla.suse.com/1028372

https://bugzilla.suse.com/1030573

https://lists.suse.com/pipermail/sle-security-updates/2017-March/002752.html

https://www.suse.com/security/cve/CVE-2017-2636/

https://www.suse.com/security/cve/CVE-2017-7184/

https://www.suse.com/support/security/rating/

https://www.suse.com/support/update/announcement/2017/suse-su-20170865-1/

CVSS Analysis

CVSS v3.1

7.8

Exploitability

Attack Vector

LocalAV:L

Attack Complexity

LowAC:L

Privileges Required

LowPR:L

User Interaction

NoneUI:N

Scope

Scope

UnchangedS:U

Impact

Confidentiality

HighC:H

Integrity

HighI:H

Availability

HighA:H

7.8/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Upstream

CVE-2017-2636 CVE-2017-7184

Ecosystems(7)

SUSE Linux Enterprise Desktop 12 SP1 SUSE Linux Enterprise Live Patching 12 SUSE Linux Enterprise Module for Public Cloud 12 SUSE Linux Enterprise Server 12 SP1 SUSE Linux Enterprise Server for SAP Applications 12 SP1

Timeline

PublishedMar 29, 2017

ModifiedMar 29, 2017