| Description: | Summary:
The remote host is missing an update for the 'Linux Kernel (Live Patch 31 for SLE 12 SP1)' package(s) announced via the SUSE-SU-2019:0672-1 advisory.
Vulnerability Insight:
This update for the Linux Kernel 3.12.74-60_64_104 fixes several issues.
The following security issues were fixed:
CVE-2019-9213: Expand_downwards in mm/mmap.c lacked a check for the mmap
minimum address, which made it easier for attackers to exploit kernel
NULL pointer dereferences on non-SMAP platforms. This is related to a
capability check for the wrong task (bsc#1128378).
CVE-2019-7221: Fixed a user-after-free vulnerability in the KVM
hypervisor related to the emulation of a preemption timer, allowing an
guest user/process to crash the host kernel. (bsc#1124734).
CVE-2019-6974: kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandled
reference counting because of a race condition, leading to a
use-after-free (bsc#1124729).
CVE-2018-5391: The Linux kernel was vulnerable to a denial of service
attack with low rates of specially modified packets targeting IP
fragment re-assembly. An attacker might have caused a denial of service
condition by sending specially crafted IP fragments. Various
vulnerabilities in IP fragmentation have been discovered and fixed over
the years. The current vulnerability (CVE-2018-5391) became exploitable
in the Linux kernel with the increase of the IP fragment reassembly
queue size (bsc#1103098).
Affected Software/OS:
'Linux Kernel (Live Patch 31 for SLE 12 SP1)' package(s) on SUSE Linux Enterprise Server 12-SP1, SUSE Linux Enterprise Server for SAP 12-SP1.
Solution:
Please install the updated package(s).
CVSS Score:
7.8
CVSS Vector:
AV:N/AC:L/Au:N/C:N/I:N/A:C
|
