Security update for the Linux Kernel SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2016:2584-1 Final 1 1 2016-10-21T11:12:51Z current 2016-10-21T11:12:51Z 2016-10-21T11:12:51Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for the Linux Kernel The openSUSE 13.1 kernel was updated to fix bugs and security issues. The following security bugs were fixed: - CVE-2016-8666: The IP stack in the Linux kernel allowed remote attackers to cause a denial of service (stack consumption and panic) or possibly have unspecified other impact by triggering use of the GRO path for packets with tunnel stacking, as demonstrated by interleaved IPv4 headers and GRE headers, a related issue to CVE-2016-7039 (bnc#1001486). - CVE-2016-5195: A local privilege escalation using MAP_PRIVATE was fixed, which is reportedly exploited in the wild (bsc#1004418). The following non-security bugs were fixed: - sched/core: Fix a race between try_to_wake_up() and a woken up task (bsc#1002165, bsc#1001419). - sched/core: Fix an SMP ordering race in try_to_wake_up() vs. schedule() (bnc#1001419). - tunnels: Do not apply GRO to multiple layers of encapsulation (bsc#1001486). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/opensuse-security-announce/2016-10/msg00035.html E-Mail link for openSUSE-SU-2016:2584-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings cloop-2.639-11.34.1 cloop-kmp-default-2.639_k3.12.62_55-11.34.1 cloop-kmp-desktop-2.639_k3.12.62_55-11.34.1 cloop-kmp-pae-2.639_k3.12.62_55-11.34.1 cloop-kmp-xen-2.639_k3.12.62_55-11.34.1 crash-7.0.2-2.34.1 crash-devel-7.0.2-2.34.1 crash-doc-7.0.2-2.34.1 crash-eppic-7.0.2-2.34.1 crash-gcore-7.0.2-2.34.1 crash-kmp-default-7.0.2_k3.12.62_55-2.34.1 crash-kmp-desktop-7.0.2_k3.12.62_55-2.34.1 crash-kmp-pae-7.0.2_k3.12.62_55-2.34.1 crash-kmp-xen-7.0.2_k3.12.62_55-2.34.1 hdjmod-1.28-16.34.1 hdjmod-kmp-default-1.28_k3.12.62_55-16.34.1 hdjmod-kmp-desktop-1.28_k3.12.62_55-16.34.1 hdjmod-kmp-pae-1.28_k3.12.62_55-16.34.1 hdjmod-kmp-xen-1.28_k3.12.62_55-16.34.1 ipset-6.21.1-2.38.1 ipset-devel-6.21.1-2.38.1 ipset-kmp-default-6.21.1_k3.12.62_55-2.38.1 ipset-kmp-desktop-6.21.1_k3.12.62_55-2.38.1 ipset-kmp-pae-6.21.1_k3.12.62_55-2.38.1 ipset-kmp-xen-6.21.1_k3.12.62_55-2.38.1 iscsitarget-1.4.20.3-13.34.1 iscsitarget-kmp-default-1.4.20.3_k3.12.62_55-13.34.1 iscsitarget-kmp-desktop-1.4.20.3_k3.12.62_55-13.34.1 iscsitarget-kmp-pae-1.4.20.3_k3.12.62_55-13.34.1 iscsitarget-kmp-xen-1.4.20.3_k3.12.62_55-13.34.1 kernel-debug-3.12.62-55.1 kernel-debug-base-3.12.62-55.1 kernel-debug-devel-3.12.62-55.1 kernel-default-3.12.62-55.1 kernel-default-base-3.12.62-55.1 kernel-default-devel-3.12.62-55.1 kernel-desktop-3.12.62-55.1 kernel-desktop-base-3.12.62-55.1 kernel-desktop-devel-3.12.62-55.1 kernel-devel-3.12.62-55.1 kernel-docs-3.12.62-55.2 kernel-ec2-3.12.62-55.1 kernel-ec2-base-3.12.62-55.1 kernel-ec2-devel-3.12.62-55.1 kernel-macros-3.12.62-55.1 kernel-pae-3.12.62-55.1 kernel-pae-base-3.12.62-55.1 kernel-pae-devel-3.12.62-55.1 kernel-source-3.12.62-55.1 kernel-source-vanilla-3.12.62-55.1 kernel-syms-3.12.62-55.1 kernel-trace-3.12.62-55.1 kernel-trace-base-3.12.62-55.1 kernel-trace-devel-3.12.62-55.1 kernel-vanilla-3.12.62-55.1 kernel-vanilla-devel-3.12.62-55.1 kernel-xen-3.12.62-55.1 kernel-xen-base-3.12.62-55.1 kernel-xen-devel-3.12.62-55.1 libipset3-6.21.1-2.38.1 ndiswrapper-1.58-35.1 ndiswrapper-kmp-default-1.58_k3.12.62_55-35.1 ndiswrapper-kmp-desktop-1.58_k3.12.62_55-35.1 ndiswrapper-kmp-pae-1.58_k3.12.62_55-35.1 openvswitch-1.11.0-0.41.1 openvswitch-controller-1.11.0-0.41.1 openvswitch-kmp-default-1.11.0_k3.12.62_55-0.41.1 openvswitch-kmp-desktop-1.11.0_k3.12.62_55-0.41.1 openvswitch-kmp-pae-1.11.0_k3.12.62_55-0.41.1 openvswitch-kmp-xen-1.11.0_k3.12.62_55-0.41.1 openvswitch-pki-1.11.0-0.41.1 openvswitch-switch-1.11.0-0.41.1 openvswitch-test-1.11.0-0.41.1 pcfclock-0.44-258.35.1 pcfclock-kmp-default-0.44_k3.12.62_55-258.35.1 pcfclock-kmp-desktop-0.44_k3.12.62_55-258.35.1 pcfclock-kmp-pae-0.44_k3.12.62_55-258.35.1 python-openvswitch-1.11.0-0.41.1 python-openvswitch-test-1.11.0-0.41.1 python-virtualbox-4.2.36-2.66.1 vhba-kmp-20130607-2.34.1 vhba-kmp-default-20130607_k3.12.62_55-2.34.1 vhba-kmp-desktop-20130607_k3.12.62_55-2.34.1 vhba-kmp-pae-20130607_k3.12.62_55-2.34.1 vhba-kmp-xen-20130607_k3.12.62_55-2.34.1 virtualbox-4.2.36-2.66.1 virtualbox-devel-4.2.36-2.66.1 virtualbox-guest-kmp-default-4.2.36_k3.12.62_55-2.66.1 virtualbox-guest-kmp-desktop-4.2.36_k3.12.62_55-2.66.1 virtualbox-guest-kmp-pae-4.2.36_k3.12.62_55-2.66.1 virtualbox-guest-tools-4.2.36-2.66.1 virtualbox-guest-x11-4.2.36-2.66.1 virtualbox-host-kmp-default-4.2.36_k3.12.62_55-2.66.1 virtualbox-host-kmp-desktop-4.2.36_k3.12.62_55-2.66.1 virtualbox-host-kmp-pae-4.2.36_k3.12.62_55-2.66.1 virtualbox-host-source-4.2.36-2.66.1 virtualbox-qt-4.2.36-2.66.1 virtualbox-websrv-4.2.36-2.66.1 xen-4.3.4_10-67.1 xen-devel-4.3.4_10-67.1 xen-doc-html-4.3.4_10-67.1 xen-kmp-default-4.3.4_10_k3.12.62_55-67.1 xen-kmp-desktop-4.3.4_10_k3.12.62_55-67.1 xen-kmp-pae-4.3.4_10_k3.12.62_55-67.1 xen-libs-4.3.4_10-67.1 xen-libs-32bit-4.3.4_10-67.1 xen-tools-4.3.4_10-67.1 xen-tools-domU-4.3.4_10-67.1 xen-xend-tools-4.3.4_10-67.1 xtables-addons-2.3-2.33.1 xtables-addons-kmp-default-2.3_k3.12.62_55-2.33.1 xtables-addons-kmp-desktop-2.3_k3.12.62_55-2.33.1 xtables-addons-kmp-pae-2.3_k3.12.62_55-2.33.1 xtables-addons-kmp-xen-2.3_k3.12.62_55-2.33.1 Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-only memory mapping, as exploited in the wild in October 2016, aka "Dirty COW." CVE-2016-5195 important 6.6 AV:L/AC:M/Au:S/C:C/I:C/A:C Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2016-10/msg00035.html https://www.suse.com/security/cve/CVE-2016-5195.html CVE-2016-5195 https://bugzilla.suse.com/1004418 SUSE Bug 1004418 https://bugzilla.suse.com/1004419 SUSE Bug 1004419 https://bugzilla.suse.com/1004436 SUSE Bug 1004436 https://bugzilla.suse.com/1006323 SUSE Bug 1006323 https://bugzilla.suse.com/1006695 SUSE Bug 1006695 https://bugzilla.suse.com/1008110 SUSE Bug 1008110 https://bugzilla.suse.com/1030118 SUSE Bug 1030118 https://bugzilla.suse.com/1069496 SUSE Bug 1069496 https://bugzilla.suse.com/1149725 SUSE Bug 1149725 https://bugzilla.suse.com/870618 SUSE Bug 870618 https://bugzilla.suse.com/986445 SUSE Bug 986445 https://bugzilla.suse.com/987565 SUSE Bug 987565 https://bugzilla.suse.com/998689 SUSE Bug 998689 The IP stack in the Linux kernel before 4.6 allows remote attackers to cause a denial of service (stack consumption and panic) or possibly have unspecified other impact by triggering use of the GRO path for packets with tunnel stacking, as demonstrated by interleaved IPv4 headers and GRE headers, a related issue to CVE-2016-7039. CVE-2016-8666 important Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2016-10/msg00035.html https://www.suse.com/security/cve/CVE-2016-8666.html CVE-2016-8666 https://bugzilla.suse.com/1001486 SUSE Bug 1001486 https://bugzilla.suse.com/1001487 SUSE Bug 1001487 https://bugzilla.suse.com/1003964 SUSE Bug 1003964 https://bugzilla.suse.com/1025354 SUSE Bug 1025354