Patch  oval:org.mitre.oval:def:26799
SUSE-SU-2014:1105-1 -- Security update for the Linux Kernel  

The SUSE Linux Enterprise Server 11 SP2 LTSS received a roll up update to fix several security and non-security issues.
The following security issues have been fixed:
* CVE-2014-0055: The get_rx_bufs function in drivers/vhost/net.c in the vhost-net subsystem in the Linux kernel package before 2.6.32-431.11.2 on Red Hat Enterprise Linux (RHEL) 6 does not properly handle vhost_get_vq_desc errors, which allows guest OS users to cause a denial of service (host OS crash) via unspecified vectors. (bnc#870173) * CVE-2014-0077: drivers/vhost/net.c in the Linux kernel before 3.13.10, when mergeable buffers are disabled, does not properly validate packet lengths, which allows guest OS users to cause a denial of service (memory corruption and host OS crash) or possibly gain privileges on the host OS via crafted packets, related to the handle_rx and get_rx_bufs functions. (bnc#870576) * CVE-2014-1739: The media_device_enum_entities function in drivers/media/media-device.c in the Linux kernel before 3.14.6 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory by leveraging /dev/media0 read access for a MEDIA_IOC_ENUM_ENTITIES ioctl call. (bnc#882804) * CVE-2014-2706: Race condition in the mac80211 subsystem in the Linux kernel before 3.13.7 allows remote attackers to cause a denial of service (system crash) via network traffic that improperly interacts with the WLAN_STA_PS_STA state (aka power-save mode), related to sta_info.c and tx.c. (bnc#871797) * CVE-2014-2851: Integer overflow in the ping_init_sock function in net/ipv4/ping.c in the Linux kernel through 3.14.1 allows local users to cause a denial of service (use-after-free and system crash) or possibly gain privileges via a crafted application that leverages an improperly managed reference counter. (bnc#873374) * CVE-2014-3144: The (1) BPF_S_ANC_NLATTR and (2) BPF_S_ANC_NLATTR_NEST extension implementations in the sk_run_filter function in net/core/filter.c in the Linux kernel through 3.14.3 do not check whether a certain length value is sufficiently large, which allows local users to cause a denial of service (integer underflow and system crash) via crafted BPF instructions. NOTE: the affected code was moved to the __skb_get_nlattr and __skb_get_nlattr_nest functions before the vulnerability was announced. (bnc#877257) * CVE-2014-3145: The BPF_S_ANC_NLATTR_NEST extension implementation in the sk_run_filter function in net/core/filter.c in the Linux kernel through 3.14.3 uses the reverse order in a certain subtraction, which allows local users to cause a denial of service (over-read and system crash) via crafted BPF instructions. NOTE: the affected code was moved to the __skb_get_nlattr_nest function before the vulnerability was announced. (bnc#877257) * CVE-2014-3917: kernel/auditsc.c in the Linux kernel through 3.14.5, when CONFIG_AUDITSYSCALL is enabled with certain syscall rules, allows local users to obtain potentially sensitive single-bit values from kernel memory or cause a denial of service (OOPS) via a large value of a syscall number. (bnc#880484) * CVE-2014-4508: arch/x86/kernel/entry_32.S in the Linux kernel through 3.15.1 on 32-bit x86 platforms, when syscall auditing is enabled and the sep CPU feature flag is set, allows local users to cause a denial of service (OOPS and system crash) via an invalid syscall number, as demonstrated by number 1000. (bnc#883724) * CVE-2014-4652: Race condition in the tlv handler functionality in the snd_ctl_elem_user_tlv function in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 allows local users to obtain sensitive information from kernel memory by leveraging /dev/snd/controlCX access. (bnc#883795) * CVE-2014-4653: sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 does not ensure possession of a read/write lock, which allows local users to cause a denial of service (use-after-free) and obtain sensitive information from kernel memory by leveraging /dev/snd/controlCX access. (bnc#883795) * CVE-2014-4654: The snd_ctl_elem_add function in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 does not check authorization for SNDRV_CTL_IOCTL_ELEM_REPLACE commands, which allows local users to remove kernel controls and cause a denial of service (use-after-free and system crash) by leveraging /dev/snd/controlCX access for an ioctl call. (bnc#883795) * CVE-2014-4655: The snd_ctl_elem_add function in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 does not properly maintain the user_ctl_count value, which allows local users to cause a denial of service (integer overflow and limit bypass) by leveraging /dev/snd/controlCX access for a large number of SNDRV_CTL_IOCTL_ELEM_REPLACE ioctl calls. (bnc#883795) * CVE-2014-4656: Multiple integer overflows in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 allow local users to cause a denial of service by leveraging /dev/snd/controlCX access, related to (1) index values in the snd_ctl_add function and (2) numid values in the snd_ctl_remove_numid_conflict function. (bnc#883795) * CVE-2014-4667: The sctp_association_free function in net/sctp/associola.c in the Linux kernel before 3.15.2 does not properly manage a certain backlog value, which allows remote attackers to cause a denial of service (socket outage) via a crafted SCTP packet. (bnc#885422) * CVE-2014-4699: The Linux kernel before 3.15.4 on Intel processors does not properly restrict use of a non-canonical value for the saved RIP address in the case of a system call that does not use IRET, which allows local users to leverage a race condition and gain privileges, or cause a denial of service (double fault), via a crafted application that makes ptrace and fork system calls. (bnc#885725) * CVE-2014-5077: The sctp_assoc_update function in net/sctp/associola.c in the Linux kernel through 3.15.8, when SCTP authentication is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and OOPS) by starting to establish an association between two endpoints immediately after an exchange of INIT and INIT ACK chunks to establish an earlier association between these endpoints in the opposite direction. (bnc#889173) * CVE-2013-4299: Interpretation conflict in drivers/md/dm-snap-persistent.c in the Linux kernel through 3.11.6 allows remote authenticated users to obtain sensitive information or modify data via a crafted mapping to a snapshot block device. (bnc#846404)
The following bugs have been fixed:
* pagecachelimit: reduce lru_lock contention for heavy parallel reclaim (bnc#878509, bnc#864464). * pagecachelimit: reduce lru_lock contention for heavy parallel reclaim kabi fixup (bnc#878509, bnc#864464). * ACPI / PAD: call schedule() when need_resched() is true (bnc#866911). * kabi: Fix breakage due to addition of user_ctl_lock (bnc#883795). * cpuset: Fix memory allocator deadlock (bnc#876590). * tcp: allow to disable cwnd moderation in TCP_CA_Loss state (bnc#879921). * tcp: adapt selected parts of RFC 5682 and PRR logic (bnc#879921). * vlan: more careful checksum features handling (bnc#872634). * bonding: fix vlan_features computing (bnc#872634). * NFSv4: Minor cleanups for nfs4_handle_exception and nfs4_async_handle_error (bnc#889324). * NFS: Do not lose sockets when nfsd shutdown races with connection timeout (bnc#871854). * reiserfs: call truncate_setsize under tailpack mutex (bnc#878115). * reiserfs: drop vmtruncate (bnc#878115). * megaraid_sas: mask off flags in ioctl path (bnc#886474). * block: fix race between request completion and timeout handling (bnc#881051). * drivers/rtc/interface.c: fix infinite loop in initializing the alarm (bnc#871676). * xfrm: check peer pointer for null before calling inet_putpeer() (bnc#877775). * supported.conf: Add firewire/nosy as supported. This driver is the replacement for the ieee1394/pcilynx driver, which was supported.
Security Issues:
* CVE-2013-4299 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4299> * CVE-2014-0055 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0055> * CVE-2014-0077 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0077> * CVE-2014-1739 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1739> * CVE-2014-2706 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2706> * CVE-2014-2851 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2851> * CVE-2014-3144 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3144> * CVE-2014-3145 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3145> * CVE-2014-3917 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3917> * CVE-2014-4508 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4508> * CVE-2014-4652 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4652> * CVE-2014-4653 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4653> * CVE-2014-4654 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4654> * CVE-2014-4655 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4655> * CVE-2014-4656 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4656> * CVE-2014-4667 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4667> * CVE-2014-4699 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4699> * CVE-2014-5077 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5077>
Create Date: 2014-09-26 Last Update Date: 2014-11-10

Affected Platforms/Products

Affected Products (CPE + CVE references)
Platforms: unix (from OVAL definitions) Products: unix
  • SUSE Linux Enterprise Server 11
  • the Linux Kernel

References

Total : 19 Click here to view references

Criteria

The patch should be installed
IF : All of the following are true
Prerequisites (Extended Definitions)
SUSE Linux Enterprise Server 11.x is installed oval:org.mitre.oval:def:17270
IF : Any one of the following are true Packages match section
IF : xen-kmp-pae RPM is earlier than 0:4.1.6_06_3.0.101_0.7.23-0.5.30
Linux : RPM Test :  xen-kmp-pae RPM is earlier than 0:4.1.6_06_3.0.101_0.7.23-0.5.30 
At least one of the objects listed below must exist on the system (Existence check)
Linux : RPM Package xen-kmp-pae package information
xen-kmp-pae
RPM Version less than 0:4.1.6_06_3.0.101_0.7.23-0.5.30 (datatype=evr_string)
version is earlier than 0:4.1.6_06_3.0.101_0.7.23-0.5.30 linux : rpminfo_state 
IF : kernel-pae-devel RPM is earlier than 0:3.0.101-0.7.23.1
Linux : RPM Test :  kernel-pae-devel RPM is earlier than 0:3.0.101-0.7.23.1 
At least one of the objects listed below must exist on the system (Existence check)
Linux : RPM Package kernel-pae-devel package information
kernel-pae-devel
RPM Version less than 0:3.0.101-0.7.23.1 (datatype=evr_string)
version is earlier than 0:3.0.101-0.7.23.1 linux : rpminfo_state 
IF : kernel-pae-base RPM is earlier than 0:3.0.101-0.7.23.1
Linux : RPM Test :  kernel-pae-base RPM is earlier than 0:3.0.101-0.7.23.1 
At least one of the objects listed below must exist on the system (Existence check)
Linux : RPM Package kernel-pae-base package information
kernel-pae-base
RPM Version less than 0:3.0.101-0.7.23.1 (datatype=evr_string)
version is earlier than 0:3.0.101-0.7.23.1 linux : rpminfo_state 
IF : kernel-pae RPM is earlier than 0:3.0.101-0.7.23.1
Linux : RPM Test :  kernel-pae RPM is earlier than 0:3.0.101-0.7.23.1 
At least one of the objects listed below must exist on the system (Existence check)
Linux : RPM Package kernel-pae package information
kernel-pae
RPM Version less than 0:3.0.101-0.7.23.1 (datatype=evr_string)
version is earlier than 0:3.0.101-0.7.23.1 linux : rpminfo_state 
IF : xen-kmp-trace RPM is earlier than 0:4.1.6_06_3.0.101_0.7.23-0.5.30
Linux : RPM Test :  xen-kmp-trace RPM is earlier than 0:4.1.6_06_3.0.101_0.7.23-0.5.30 
At least one of the objects listed below must exist on the system (Existence check)
Linux : RPM Package xen-kmp-trace package information
xen-kmp-trace
RPM Version less than 0:4.1.6_06_3.0.101_0.7.23-0.5.30 (datatype=evr_string)
version is earlier than 0:4.1.6_06_3.0.101_0.7.23-0.5.30 linux : rpminfo_state 
IF : kernel-xen RPM is earlier than 0:3.0.101-0.7.23.1
Linux : RPM Test :  kernel-xen RPM is earlier than 0:3.0.101-0.7.23.1 
At least one of the objects listed below must exist on the system (Existence check)
Linux : RPM Package 
kernel-xen
RPM Version less than 0:3.0.101-0.7.23.1 (datatype=evr_string)
version is earlier than 0:3.0.101-0.7.23.1 linux : rpminfo_state 
IF : kernel-xen-base RPM is earlier than 0:3.0.101-0.7.23.1
Linux : RPM Test :  kernel-xen-base RPM is earlier than 0:3.0.101-0.7.23.1 
At least one of the objects listed below must exist on the system (Existence check)
Linux : RPM Package kernel-xen-base package information
kernel-xen-base
RPM Version less than 0:3.0.101-0.7.23.1 (datatype=evr_string)
version is earlier than 0:3.0.101-0.7.23.1 linux : rpminfo_state 
IF : kernel-xen-devel RPM is earlier than 0:3.0.101-0.7.23.1
Linux : RPM Test :  kernel-xen-devel RPM is earlier than 0:3.0.101-0.7.23.1 
At least one of the objects listed below must exist on the system (Existence check)
Linux : RPM Package 
kernel-xen-devel
RPM Version less than 0:3.0.101-0.7.23.1 (datatype=evr_string)
version is earlier than 0:3.0.101-0.7.23.1 linux : rpminfo_state 
IF : xen-kmp-default RPM is earlier than 0:4.1.6_06_3.0.101_0.7.23-0.5.30
Linux : RPM Test :  xen-kmp-default RPM is earlier than 0:4.1.6_06_3.0.101_0.7.23-0.5.30 
At least one of the objects listed below must exist on the system (Existence check)
Linux : RPM Package xen-kmp-default package information
xen-kmp-default
RPM Version less than 0:4.1.6_06_3.0.101_0.7.23-0.5.30 (datatype=evr_string)
version is earlier than 0:4.1.6_06_3.0.101_0.7.23-0.5.30 linux : rpminfo_state 
IF : kernel-trace RPM is earlier than 0:3.0.101-0.7.23.1
Linux : RPM Test :  kernel-trace RPM is earlier than 0:3.0.101-0.7.23.1 
At least one of the objects listed below must exist on the system (Existence check)
Linux : RPM Package kernel-trace package information
kernel-trace
RPM Version less than 0:3.0.101-0.7.23.1 (datatype=evr_string)
version is earlier than 0:3.0.101-0.7.23.1 linux : rpminfo_state 
IF : kernel-trace-base RPM is earlier than 0:3.0.101-0.7.23.1
Linux : RPM Test :  kernel-trace-base RPM is earlier than 0:3.0.101-0.7.23.1 
At least one of the objects listed below must exist on the system (Existence check)
Linux : RPM Package kernel-trace-base package information
kernel-trace-base
RPM Version less than 0:3.0.101-0.7.23.1 (datatype=evr_string)
version is earlier than 0:3.0.101-0.7.23.1 linux : rpminfo_state 
IF : kernel-trace-devel RPM is earlier than 0:3.0.101-0.7.23.1
Linux : RPM Test :  kernel-trace-devel RPM is earlier than 0:3.0.101-0.7.23.1 
At least one of the objects listed below must exist on the system (Existence check)
Linux : RPM Package kernel-trace-devel package information
kernel-trace-devel
RPM Version less than 0:3.0.101-0.7.23.1 (datatype=evr_string)
version is earlier than 0:3.0.101-0.7.23.1 linux : rpminfo_state 
IF : kernel-ec2 RPM is earlier than 0:3.0.101-0.7.23.1
Linux : RPM Test :  kernel-ec2 RPM is earlier than 0:3.0.101-0.7.23.1 
At least one of the objects listed below must exist on the system (Existence check)
Linux : RPM Package kernel-ec2 package information
kernel-ec2
RPM Version less than 0:3.0.101-0.7.23.1 (datatype=evr_string)
version is earlier than 0:3.0.101-0.7.23.1 linux : rpminfo_state 
IF : kernel-ec2-base RPM is earlier than 0:3.0.101-0.7.23.1
Linux : RPM Test :  kernel-ec2-base RPM is earlier than 0:3.0.101-0.7.23.1 
At least one of the objects listed below must exist on the system (Existence check)
Linux : RPM Package kernel-ec2-base package information
kernel-ec2-base
RPM Version less than 0:3.0.101-0.7.23.1 (datatype=evr_string)
version is earlier than 0:3.0.101-0.7.23.1 linux : rpminfo_state 
IF : kernel-ec2-devel RPM is earlier than 0:3.0.101-0.7.23.1
Linux : RPM Test :  kernel-ec2-devel RPM is earlier than 0:3.0.101-0.7.23.1 
At least one of the objects listed below must exist on the system (Existence check)
Linux : RPM Package kernel-ec2-devel package information
kernel-ec2-devel
RPM Version less than 0:3.0.101-0.7.23.1 (datatype=evr_string)
version is earlier than 0:3.0.101-0.7.23.1 linux : rpminfo_state 
IF : kernel-syms RPM is earlier than 0:3.0.101-0.7.23.1
Linux : RPM Test :  kernel-syms RPM is earlier than 0:3.0.101-0.7.23.1 
At least one of the objects listed below must exist on the system (Existence check)
Linux : RPM Package kernel-syms package information
kernel-syms
RPM Version less than 0:3.0.101-0.7.23.1 (datatype=evr_string)
version is earlier than 0:3.0.101-0.7.23.1 linux : rpminfo_state 
IF : kernel-default-devel RPM is earlier than 0:3.0.101-0.7.23.1
Linux : RPM Test :  kernel-default-devel RPM is earlier than 0:3.0.101-0.7.23.1 
At least one of the objects listed below must exist on the system (Existence check)
Linux : RPM Package kernel-default-devel package information
kernel-default-devel
RPM Version less than 0:3.0.101-0.7.23.1 (datatype=evr_string)
version is earlier than 0:3.0.101-0.7.23.1 linux : rpminfo_state 
IF : kernel-source RPM is earlier than 0:3.0.101-0.7.23.1
Linux : RPM Test :  kernel-source RPM is earlier than 0:3.0.101-0.7.23.1 
At least one of the objects listed below must exist on the system (Existence check)
Linux : RPM Package 
kernel-source
RPM Version less than 0:3.0.101-0.7.23.1 (datatype=evr_string)
version is earlier than 0:3.0.101-0.7.23.1 linux : rpminfo_state 
IF : kernel-default-base RPM is earlier than 0:3.0.101-0.7.23.1
Linux : RPM Test :  kernel-default-base RPM is earlier than 0:3.0.101-0.7.23.1 
At least one of the objects listed below must exist on the system (Existence check)
Linux : RPM Package kernel-default-base package information
kernel-default-base
RPM Version less than 0:3.0.101-0.7.23.1 (datatype=evr_string)
version is earlier than 0:3.0.101-0.7.23.1 linux : rpminfo_state 
IF : kernel-default RPM is earlier than 0:3.0.101-0.7.23.1
Linux : RPM Test :  kernel-default RPM is earlier than 0:3.0.101-0.7.23.1 
At least one of the objects listed below must exist on the system (Existence check)
Linux : RPM Package kernel-default package information
kernel-default
RPM Version less than 0:3.0.101-0.7.23.1 (datatype=evr_string)
version is earlier than 0:3.0.101-0.7.23.1 linux : rpminfo_state 

Quick Help

evr_string datatype
Represents epoch, version, and release number as a single version string
Other Help Topics
Data Types
What is an Object?
What is a State?
What is a Test?
Other Help Topics
Regular Expression Patterns
Some object or state definitions are defined as regular expression patterns, you should interpret the regexp pattern while evaluating them.

OVAL Definitions By Referenced Objects

How does it work?   User agreement and privacy statement   About & Contact
CVE is a registred trademark of the MITRE Corporation and the authoritive source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritive source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritive source of OVAL content is MITRE's OVAL web site.
Warning: This site and all data are provided as is. It is not guaranteed that all information is accurate and complete. Use any information provided on this site at your own risk. By using this site you accept that you know that these data are provided as is and not guaranteed to be accurate, correct or complete. All trademarks appearing on this site are the property of their respective owners in the US or other countries. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss. PLEASE SEE nvd.nist.gov and oval.mitre.org for more details about OVAL language and definitions.
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor/web site owner/maintainer be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
Use of OVAL and all related data is subject to terms of use defined by Mitre at http://oval.mitre.org/oval/about/termsofuse.html