Security update for the Linux Kernel SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2016:3049-1 Final 1 1 2016-12-07T18:29:31Z current 2016-12-07T18:29:31Z 2016-12-07T18:29:31Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for the Linux Kernel The SUSE Linux Enterprise 12 SP2 kernel was updated to receive critical security fixes. The following security bugs were fixed: - CVE-2016-8655: A race condition in the af_packet packet_set_ring function could be used by local attackers to crash the kernel or gain privileges (bsc#1012754). - CVE-2016-8632: The tipc_msg_build function in net/tipc/msg.c in the Linux kernel did not validate the relationship between the minimum fragment length and the maximum packet size, which allowed local users to gain privileges or cause a denial of service (heap-based buffer overflow) by leveraging the CAP_NET_ADMIN capability (bnc#1008831). - CVE-2016-9555: The sctp_sf_ootb function in net/sctp/sm_statefuns.c in the Linux kernel lacks chunk-length checking for the first chunk, which allowed remote attackers to cause a denial of service (out-of-bounds slab access) or possibly have unspecified other impact via crafted SCTP data (bnc#1011685). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-DESKTOP-12-SP2-2016-1772,SUSE-SLE-HA-12-SP2-2016-1772,SUSE-SLE-Live-Patching-12-2016-1772,SUSE-SLE-RPI-12-SP2-2016-1772,SUSE-SLE-SDK-12-SP2-2016-1772,SUSE-SLE-SERVER-12-SP2-2016-1772,SUSE-SLE-WE-12-SP2-2016-1772 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2016/suse-su-20163049-1/ Link for SUSE-SU-2016:3049-1 https://lists.opensuse.org/opensuse-security-announce/2016-12/msg00025.html E-Mail link for SUSE-SU-2016:3049-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1008831 SUSE Bug 1008831 https://bugzilla.suse.com/1011685 SUSE Bug 1011685 https://bugzilla.suse.com/1012754 SUSE Bug 1012754 https://www.suse.com/security/cve/CVE-2016-8632/ SUSE CVE CVE-2016-8632 page https://www.suse.com/security/cve/CVE-2016-8655/ SUSE CVE CVE-2016-8655 page https://www.suse.com/security/cve/CVE-2016-9555/ SUSE CVE CVE-2016-9555 page SUSE Linux Enterprise Desktop 12 SP2 SUSE Linux Enterprise High Availability Extension 12 SP2 SUSE Linux Enterprise Live Patching 12 SUSE Linux Enterprise Server 12 SP2 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 SUSE Linux Enterprise Server for SAP Applications 12 SP2 SUSE Linux Enterprise Software Development Kit 12 SP2 SUSE Linux Enterprise Workstation Extension 12 SP2 kernel-default-4.4.21-84.1 kernel-default-devel-4.4.21-84.1 kernel-default-extra-4.4.21-84.1 kernel-devel-4.4.21-84.1 kernel-macros-4.4.21-84.1 kernel-source-4.4.21-84.1 kernel-syms-4.4.21-84.1 cluster-md-kmp-default-4.4.21-84.1 cluster-network-kmp-default-4.4.21-84.1 dlm-kmp-default-4.4.21-84.1 gfs2-kmp-default-4.4.21-84.1 ocfs2-kmp-default-4.4.21-84.1 kgraft-patch-4_4_21-84-default-1-2.1 kernel-default-base-4.4.21-84.1 kernel-docs-4.4.21-84.3 kernel-obs-build-4.4.21-84.1 kernel-default-man-4.4.21-84.1 kernel-default-4.4.21-84.1 as a component of SUSE Linux Enterprise Desktop 12 SP2 kernel-default-devel-4.4.21-84.1 as a component of SUSE Linux Enterprise Desktop 12 SP2 kernel-default-extra-4.4.21-84.1 as a component of SUSE Linux Enterprise Desktop 12 SP2 kernel-devel-4.4.21-84.1 as a component of SUSE Linux Enterprise Desktop 12 SP2 kernel-macros-4.4.21-84.1 as a component of SUSE Linux Enterprise Desktop 12 SP2 kernel-source-4.4.21-84.1 as a component of SUSE Linux Enterprise Desktop 12 SP2 kernel-syms-4.4.21-84.1 as a component of SUSE Linux Enterprise Desktop 12 SP2 cluster-md-kmp-default-4.4.21-84.1 as a component of SUSE Linux Enterprise High Availability Extension 12 SP2 cluster-network-kmp-default-4.4.21-84.1 as a component of SUSE Linux Enterprise High Availability Extension 12 SP2 dlm-kmp-default-4.4.21-84.1 as a component of SUSE Linux Enterprise High Availability Extension 12 SP2 gfs2-kmp-default-4.4.21-84.1 as a component of SUSE Linux Enterprise High Availability Extension 12 SP2 ocfs2-kmp-default-4.4.21-84.1 as a component of SUSE Linux Enterprise High Availability Extension 12 SP2 kgraft-patch-4_4_21-84-default-1-2.1 as a component of SUSE Linux Enterprise Live Patching 12 kernel-default-4.4.21-84.1 as a component of SUSE Linux Enterprise Server 12 SP2 kernel-default-base-4.4.21-84.1 as a component of SUSE Linux Enterprise Server 12 SP2 kernel-default-devel-4.4.21-84.1 as a component of SUSE Linux Enterprise Server 12 SP2 kernel-default-man-4.4.21-84.1 as a component of SUSE Linux Enterprise Server 12 SP2 kernel-devel-4.4.21-84.1 as a component of SUSE Linux Enterprise Server 12 SP2 kernel-macros-4.4.21-84.1 as a component of SUSE Linux Enterprise Server 12 SP2 kernel-source-4.4.21-84.1 as a component of SUSE Linux Enterprise Server 12 SP2 kernel-syms-4.4.21-84.1 as a component of SUSE Linux Enterprise Server 12 SP2 kernel-default-4.4.21-84.1 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 kernel-default-base-4.4.21-84.1 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 kernel-default-devel-4.4.21-84.1 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 kernel-devel-4.4.21-84.1 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 kernel-macros-4.4.21-84.1 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 kernel-source-4.4.21-84.1 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 kernel-syms-4.4.21-84.1 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 kernel-default-4.4.21-84.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 kernel-default-base-4.4.21-84.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 kernel-default-devel-4.4.21-84.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 kernel-default-man-4.4.21-84.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 kernel-devel-4.4.21-84.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 kernel-macros-4.4.21-84.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 kernel-source-4.4.21-84.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 kernel-syms-4.4.21-84.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 kernel-docs-4.4.21-84.3 as a component of SUSE Linux Enterprise Software Development Kit 12 SP2 kernel-obs-build-4.4.21-84.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP2 kernel-default-extra-4.4.21-84.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP2 The tipc_msg_build function in net/tipc/msg.c in the Linux kernel through 4.8.11 does not validate the relationship between the minimum fragment length and the maximum packet size, which allows local users to gain privileges or cause a denial of service (heap-based buffer overflow) by leveraging the CAP_NET_ADMIN capability. CVE-2016-8632 SUSE Linux Enterprise Desktop 12 SP2:kernel-default-4.4.21-84.1 SUSE Linux Enterprise Desktop 12 SP2:kernel-default-devel-4.4.21-84.1 SUSE Linux Enterprise Desktop 12 SP2:kernel-default-extra-4.4.21-84.1 SUSE Linux Enterprise Desktop 12 SP2:kernel-devel-4.4.21-84.1 SUSE Linux Enterprise Desktop 12 SP2:kernel-macros-4.4.21-84.1 SUSE Linux Enterprise Desktop 12 SP2:kernel-source-4.4.21-84.1 SUSE Linux Enterprise Desktop 12 SP2:kernel-syms-4.4.21-84.1 SUSE Linux Enterprise High Availability Extension 12 SP2:cluster-md-kmp-default-4.4.21-84.1 SUSE Linux Enterprise High Availability Extension 12 SP2:cluster-network-kmp-default-4.4.21-84.1 SUSE Linux Enterprise High Availability Extension 12 SP2:dlm-kmp-default-4.4.21-84.1 SUSE Linux Enterprise High Availability Extension 12 SP2:gfs2-kmp-default-4.4.21-84.1 SUSE Linux Enterprise High Availability Extension 12 SP2:ocfs2-kmp-default-4.4.21-84.1 SUSE Linux Enterprise Live Patching 12:kgraft-patch-4_4_21-84-default-1-2.1 SUSE Linux Enterprise Server 12 SP2:kernel-default-4.4.21-84.1 SUSE Linux Enterprise Server 12 SP2:kernel-default-base-4.4.21-84.1 SUSE Linux Enterprise Server 12 SP2:kernel-default-devel-4.4.21-84.1 SUSE Linux Enterprise Server 12 SP2:kernel-default-man-4.4.21-84.1 SUSE Linux Enterprise Server 12 SP2:kernel-devel-4.4.21-84.1 SUSE Linux Enterprise Server 12 SP2:kernel-macros-4.4.21-84.1 SUSE Linux Enterprise Server 12 SP2:kernel-source-4.4.21-84.1 SUSE Linux Enterprise Server 12 SP2:kernel-syms-4.4.21-84.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:kernel-default-4.4.21-84.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:kernel-default-base-4.4.21-84.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:kernel-default-devel-4.4.21-84.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:kernel-devel-4.4.21-84.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:kernel-macros-4.4.21-84.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:kernel-source-4.4.21-84.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:kernel-syms-4.4.21-84.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:kernel-default-4.4.21-84.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:kernel-default-base-4.4.21-84.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:kernel-default-devel-4.4.21-84.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:kernel-default-man-4.4.21-84.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:kernel-devel-4.4.21-84.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:kernel-macros-4.4.21-84.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:kernel-source-4.4.21-84.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:kernel-syms-4.4.21-84.1 SUSE Linux Enterprise Software Development Kit 12 SP2:kernel-docs-4.4.21-84.3 SUSE Linux Enterprise Software Development Kit 12 SP2:kernel-obs-build-4.4.21-84.1 SUSE Linux Enterprise Workstation Extension 12 SP2:kernel-default-extra-4.4.21-84.1 moderate 6.2 AV:L/AC:H/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20163049-1/ https://www.suse.com/security/cve/CVE-2016-8632.html CVE-2016-8632 https://bugzilla.suse.com/1008831 SUSE Bug 1008831 https://bugzilla.suse.com/1012852 SUSE Bug 1012852 https://bugzilla.suse.com/1115893 SUSE Bug 1115893 Race condition in net/packet/af_packet.c in the Linux kernel through 4.8.12 allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging the CAP_NET_RAW capability to change a socket version, related to the packet_set_ring and packet_setsockopt functions. CVE-2016-8655 SUSE Linux Enterprise Desktop 12 SP2:kernel-default-4.4.21-84.1 SUSE Linux Enterprise Desktop 12 SP2:kernel-default-devel-4.4.21-84.1 SUSE Linux Enterprise Desktop 12 SP2:kernel-default-extra-4.4.21-84.1 SUSE Linux Enterprise Desktop 12 SP2:kernel-devel-4.4.21-84.1 SUSE Linux Enterprise Desktop 12 SP2:kernel-macros-4.4.21-84.1 SUSE Linux Enterprise Desktop 12 SP2:kernel-source-4.4.21-84.1 SUSE Linux Enterprise Desktop 12 SP2:kernel-syms-4.4.21-84.1 SUSE Linux Enterprise High Availability Extension 12 SP2:cluster-md-kmp-default-4.4.21-84.1 SUSE Linux Enterprise High Availability Extension 12 SP2:cluster-network-kmp-default-4.4.21-84.1 SUSE Linux Enterprise High Availability Extension 12 SP2:dlm-kmp-default-4.4.21-84.1 SUSE Linux Enterprise High Availability Extension 12 SP2:gfs2-kmp-default-4.4.21-84.1 SUSE Linux Enterprise High Availability Extension 12 SP2:ocfs2-kmp-default-4.4.21-84.1 SUSE Linux Enterprise Live Patching 12:kgraft-patch-4_4_21-84-default-1-2.1 SUSE Linux Enterprise Server 12 SP2:kernel-default-4.4.21-84.1 SUSE Linux Enterprise Server 12 SP2:kernel-default-base-4.4.21-84.1 SUSE Linux Enterprise Server 12 SP2:kernel-default-devel-4.4.21-84.1 SUSE Linux Enterprise Server 12 SP2:kernel-default-man-4.4.21-84.1 SUSE Linux Enterprise Server 12 SP2:kernel-devel-4.4.21-84.1 SUSE Linux Enterprise Server 12 SP2:kernel-macros-4.4.21-84.1 SUSE Linux Enterprise Server 12 SP2:kernel-source-4.4.21-84.1 SUSE Linux Enterprise Server 12 SP2:kernel-syms-4.4.21-84.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:kernel-default-4.4.21-84.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:kernel-default-base-4.4.21-84.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:kernel-default-devel-4.4.21-84.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:kernel-devel-4.4.21-84.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:kernel-macros-4.4.21-84.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:kernel-source-4.4.21-84.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:kernel-syms-4.4.21-84.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:kernel-default-4.4.21-84.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:kernel-default-base-4.4.21-84.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:kernel-default-devel-4.4.21-84.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:kernel-default-man-4.4.21-84.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:kernel-devel-4.4.21-84.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:kernel-macros-4.4.21-84.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:kernel-source-4.4.21-84.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:kernel-syms-4.4.21-84.1 SUSE Linux Enterprise Software Development Kit 12 SP2:kernel-docs-4.4.21-84.3 SUSE Linux Enterprise Software Development Kit 12 SP2:kernel-obs-build-4.4.21-84.1 SUSE Linux Enterprise Workstation Extension 12 SP2:kernel-default-extra-4.4.21-84.1 moderate 6.6 AV:L/AC:M/Au:S/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20163049-1/ https://www.suse.com/security/cve/CVE-2016-8655.html CVE-2016-8655 https://bugzilla.suse.com/1012754 SUSE Bug 1012754 https://bugzilla.suse.com/1012759 SUSE Bug 1012759 https://bugzilla.suse.com/1013822 SUSE Bug 1013822 https://bugzilla.suse.com/1052365 SUSE Bug 1052365 The sctp_sf_ootb function in net/sctp/sm_statefuns.c in the Linux kernel before 4.8.8 lacks chunk-length checking for the first chunk, which allows remote attackers to cause a denial of service (out-of-bounds slab access) or possibly have unspecified other impact via crafted SCTP data. CVE-2016-9555 SUSE Linux Enterprise Desktop 12 SP2:kernel-default-4.4.21-84.1 SUSE Linux Enterprise Desktop 12 SP2:kernel-default-devel-4.4.21-84.1 SUSE Linux Enterprise Desktop 12 SP2:kernel-default-extra-4.4.21-84.1 SUSE Linux Enterprise Desktop 12 SP2:kernel-devel-4.4.21-84.1 SUSE Linux Enterprise Desktop 12 SP2:kernel-macros-4.4.21-84.1 SUSE Linux Enterprise Desktop 12 SP2:kernel-source-4.4.21-84.1 SUSE Linux Enterprise Desktop 12 SP2:kernel-syms-4.4.21-84.1 SUSE Linux Enterprise High Availability Extension 12 SP2:cluster-md-kmp-default-4.4.21-84.1 SUSE Linux Enterprise High Availability Extension 12 SP2:cluster-network-kmp-default-4.4.21-84.1 SUSE Linux Enterprise High Availability Extension 12 SP2:dlm-kmp-default-4.4.21-84.1 SUSE Linux Enterprise High Availability Extension 12 SP2:gfs2-kmp-default-4.4.21-84.1 SUSE Linux Enterprise High Availability Extension 12 SP2:ocfs2-kmp-default-4.4.21-84.1 SUSE Linux Enterprise Live Patching 12:kgraft-patch-4_4_21-84-default-1-2.1 SUSE Linux Enterprise Server 12 SP2:kernel-default-4.4.21-84.1 SUSE Linux Enterprise Server 12 SP2:kernel-default-base-4.4.21-84.1 SUSE Linux Enterprise Server 12 SP2:kernel-default-devel-4.4.21-84.1 SUSE Linux Enterprise Server 12 SP2:kernel-default-man-4.4.21-84.1 SUSE Linux Enterprise Server 12 SP2:kernel-devel-4.4.21-84.1 SUSE Linux Enterprise Server 12 SP2:kernel-macros-4.4.21-84.1 SUSE Linux Enterprise Server 12 SP2:kernel-source-4.4.21-84.1 SUSE Linux Enterprise Server 12 SP2:kernel-syms-4.4.21-84.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:kernel-default-4.4.21-84.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:kernel-default-base-4.4.21-84.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:kernel-default-devel-4.4.21-84.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:kernel-devel-4.4.21-84.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:kernel-macros-4.4.21-84.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:kernel-source-4.4.21-84.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:kernel-syms-4.4.21-84.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:kernel-default-4.4.21-84.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:kernel-default-base-4.4.21-84.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:kernel-default-devel-4.4.21-84.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:kernel-default-man-4.4.21-84.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:kernel-devel-4.4.21-84.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:kernel-macros-4.4.21-84.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:kernel-source-4.4.21-84.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:kernel-syms-4.4.21-84.1 SUSE Linux Enterprise Software Development Kit 12 SP2:kernel-docs-4.4.21-84.3 SUSE Linux Enterprise Software Development Kit 12 SP2:kernel-obs-build-4.4.21-84.1 SUSE Linux Enterprise Workstation Extension 12 SP2:kernel-default-extra-4.4.21-84.1 important 7.1 AV:N/AC:H/Au:N/C:C/I:N/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20163049-1/ https://www.suse.com/security/cve/CVE-2016-9555.html CVE-2016-9555 https://bugzilla.suse.com/1011685 SUSE Bug 1011685 https://bugzilla.suse.com/1012183 SUSE Bug 1012183 https://bugzilla.suse.com/1115893 SUSE Bug 1115893