| Beschreibung: | Summary:
The remote host is missing an update for the 'kernel'
package(s) announced via the referenced advisory.
Vulnerability Insight:
The openSUSE Leap 42.3 was updated to 4.4.138
to receive various security and bugfixes.
The following security bugs were fixed:
- CVE-2018-3639: Systems with microprocessors utilizing speculative
execution and speculative execution of memory reads before the addresses
of all prior memory writes are known may allow unauthorized disclosure
of information to an attacker with local user access via a side-channel
analysis, aka Speculative Store Bypass (SSB), Variant 4 (bsc#1085308
bsc#1087082) This update improves the previous Spectre Variant 4 fixes
and also mitigates them on the ARM architecture.
- CVE-2018-3665: The FPU state and registers of x86 CPUs were saved and
restored in a lazy fashion, which opened its disclosure by speculative
side channel attacks. This has been fixed by replacing the lazy
save/restore by eager saving and restoring (bnc#1087086)
- CVE-2018-5848: In the function wmi_set_ie(), the length validation code
did not handle unsigned integer overflow properly. As a result, a large
value of the 'ie_len' argument can cause a buffer overflow (bnc#1097356).
- CVE-2017-18249: The add_free_nid function in fs/f2fs/node.c did not
properly track an allocated nid, which allowed local users to cause a
denial of service (race condition) or possibly have unspecified other
impact via concurrent threads (bnc#1087036).
- CVE-2017-18241: fs/f2fs/segment.c kernel allowed local users to cause a
denial of service (NULL pointer dereference and panic) by using a
noflush_merge option that triggers a NULL value for a flush_cmd_control
data structure (bnc#1086400).
- CVE-2017-17741: The KVM implementation allowed attackers to obtain
potentially sensitive information from kernel memory, aka a write_mmio
stack-based out-of-bounds read, related to arch/x86/kvm/x86.c and
include/trace/events/kvm.h (bnc#1073311 1091815).
- CVE-2017-13305: A information disclosure vulnerability in the
encrypted-keys. (bnc#1094353).
- CVE-2018-1093: The ext4_valid_block_bitmap function in fs/ext4/balloc.c
allowed attackers to cause a denial of service (out-of-bounds read and
system crash) via a crafted ext4 image because balloc.c and ialloc.c do
not validate bitmap block numbers (bnc#1087095).
- CVE-2018-1094: The ext4_fill_super function in fs/ext4/super.c did not
always initialize the crc32c checksum driver, which allowed attackers to
cause a denial of service (ext4_xattr_inode_hash NULL pointer
dereference and system crash) via a crafted ext4 image (bnc#1087007
1092903).
- CVE-2018-1092: The ext4_iget function in fs/ext4/inode.c mishand ...
Description truncated, please see the referenced URL(s) for more information.
Affected Software/OS:
the on openSUSE Leap 42.3
Solution:
Please install the updated package(s).
CVSS Score:
7.1
CVSS Vector:
AV:N/AC:M/Au:N/C:N/I:N/A:C
|
