rpm package
suse/kernel-default&distro=SUSE OpenStack Cloud 7
pkg:rpm/suse/kernel-default&distro=SUSE%20OpenStack%20Cloud%207
Vulnerabilities (307)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2018-10876 | Med | 5.0 | < 4.4.121-92.95.1 | 4.4.121-92.95.1 | Jul 26, 2018 | A flaw was found in Linux kernel in the ext4 filesystem code. A use-after-free is possible in ext4_ext_remove_space() function when mounting and operating a crafted ext4 image. | |
| CVE-2018-10880 | Med | 5.5 | < 4.4.121-92.95.1 | 4.4.121-92.95.1 | Jul 25, 2018 | Linux kernel is vulnerable to a stack-out-of-bounds write in the ext4 filesystem code when mounting and writing to a crafted ext4 image in ext4_update_inline_data(). An attacker could use this to cause a system crash and a denial of service. | |
| CVE-2018-10877 | Hig | 7.3 | < 4.4.121-92.95.1 | 4.4.121-92.95.1 | Jul 18, 2018 | Linux kernel ext4 filesystem is vulnerable to an out-of-bound access in the ext4_ext_drop_refs() function when operating on a crafted ext4 filesystem image. | |
| CVE-2018-1129 | Med | 6.5 | < 4.4.121-92.109.2 | 4.4.121-92.109.2 | Jul 10, 2018 | A flaw was found in the way signature calculation was handled by cephx authentication protocol. An attacker having access to ceph cluster network who is able to alter the message payload was able to bypass signature checks done by cephx protocol. Ceph branches master, mimic, lumi | |
| CVE-2018-1128 | Hig | 7.5 | < 4.4.121-92.109.2 | 4.4.121-92.109.2 | Jul 10, 2018 | It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable to replay attack. Any attacker having access to ceph cluster network who is able to sniff packets on network can use this vulnerability to authenticate with ceph service and p | |
| CVE-2018-13406 | Hig | 7.8 | < 4.4.121-92.92.1 | 4.4.121-92.92.1 | Jul 6, 2018 | An integer overflow in the uvesafb_setcmap function in drivers/video/fbdev/uvesafb.c in the Linux kernel before 4.17.4 could result in local attackers being able to crash the kernel or potentially elevate privileges because kmalloc_array is not used. | |
| CVE-2018-13405 | Hig | 7.8 | < 4.4.121-92.92.1 | 4.4.121-92.92.1 | Jul 6, 2018 | The inode_init_owner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of that group. Here, the no | |
| CVE-2018-13095 | Med | 5.5 | < 4.4.121-92.95.1 | 4.4.121-92.95.1 | Jul 3, 2018 | An issue was discovered in fs/xfs/libxfs/xfs_inode_buf.c in the Linux kernel through 4.17.3. A denial of service (memory corruption and BUG) can occur for a corrupted xfs image upon encountering an inode that is in extent format, but has more extents than fit in the inode fork. | |
| CVE-2018-13094 | Med | 5.5 | < 4.4.121-92.95.1 | 4.4.121-92.95.1 | Jul 3, 2018 | An issue was discovered in fs/xfs/libxfs/xfs_attr_leaf.c in the Linux kernel through 4.17.3. An OOPS may occur for a corrupted xfs image after xfs_da_shrink_inode() is called with a NULL bp. | |
| CVE-2018-13093 | Med | 5.5 | < 4.4.121-92.95.1 | 4.4.121-92.95.1 | Jul 3, 2018 | An issue was discovered in fs/xfs/xfs_icache.c in the Linux kernel through 4.17.3. There is a NULL pointer dereference and panic in lookup_slow() on a NULL inode->i_ops pointer when doing pathwalks on a corrupted xfs image. This occurs because of a lack of proper validation that | |
| CVE-2018-12896 | Med | 5.5 | < 4.4.121-92.95.1 | 4.4.121-92.95.1 | Jul 2, 2018 | An issue was discovered in the Linux kernel through 4.17.3. An Integer Overflow in kernel/time/posix-timers.c in the POSIX timer code is caused by the way the overrun accounting works. Depending on interval and expiry time values, the overrun can be larger than INT_MAX, but the a | |
| CVE-2018-13053 | Low | 3.3 | < 4.4.121-92.92.1 | 4.4.121-92.92.1 | Jul 2, 2018 | The alarm_timer_nsleep function in kernel/time/alarmtimer.c in the Linux kernel through 4.17.3 has an integer overflow via a large relative timeout because ktime_add_safe is not used. | |
| CVE-2018-1000204 | Med | 5.3 | < 4.4.121-92.85.1 | 4.4.121-92.85.1 | Jun 26, 2018 | Linux Kernel version 3.18 to 4.16 incorrectly handles an SG_IO ioctl on /dev/sg0 with dxfer_direction=SG_DXFER_FROM_DEV and an empty 6-byte cmdp. This may lead to copying up to 1000 kernel heap pages to the userspace. This has been fixed upstream in https://github.com/torvalds/li | |
| CVE-2018-3665 | Med | 5.6 | < 4.4.121-92.85.1 | 4.4.121-92.85.1 | Jun 21, 2018 | System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially allow a local process to infer data from another process through a speculative execution side channel. | |
| CVE-2018-1120 | Low | 2.8 | < 4.4.121-92.109.2 | 4.4.121-92.109.2 | Jun 20, 2018 | A flaw was found affecting the Linux kernel before version 4.17. By mmap()ing a FUSE-backed file onto a process's memory containing command line arguments (or environment strings), an attacker can cause utilities from psutils or procps (such as ps, w) or any other program which m | |
| CVE-2018-5848 | Hig | 7.8 | < 4.4.121-92.85.1 | 4.4.121-92.85.1 | Jun 12, 2018 | In the function wmi_set_ie(), the length validation code does not handle unsigned integer overflow properly. As a result, a large value of the 'ie_len' argument can cause a buffer overflow in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using t | |
| CVE-2018-5814 | Hig | 7.0 | < 4.4.121-92.92.1 | 4.4.121-92.92.1 | Jun 12, 2018 | In the Linux Kernel before version 4.16.11, 4.14.43, 4.9.102, and 4.4.133, multiple race condition errors when handling probe, disconnect, and rebind operations can be exploited to trigger a use-after-free condition or a NULL pointer dereference by sending multiple USB over IP pa | |
| CVE-2018-5803 | Med | 5.5 | < 4.4.121-92.85.1 | 4.4.121-92.85.1 | Jun 12, 2018 | In the Linux Kernel before version 4.15.8, 4.14.25, 4.9.87, 4.4.121, 4.1.51, and 3.2.102, an error in the "_sctp_make_chunk()" function (net/sctp/sm_make_chunk.c) when handling SCTP packets length can be exploited to cause a kernel crash. | |
| CVE-2018-1000199 | Med | 5.5 | < 4.4.121-92.85.1 | 4.4.121-92.85.1 | May 24, 2018 | The Linux Kernel version 3.18 contains a dangerous feature vulnerability in modify_user_hw_breakpoint() that can result in crash and possibly memory corruption. This attack appear to be exploitable via local code execution and the ability to use ptrace. This vulnerability appears | |
| CVE-2018-3639 | Med | 5.5 | < 4.4.121-92.80.1 | 4.4.121-92.80.1 | May 22, 2018 | Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis, aka |
- affected < 4.4.121-92.95.1fixed 4.4.121-92.95.1
A flaw was found in Linux kernel in the ext4 filesystem code. A use-after-free is possible in ext4_ext_remove_space() function when mounting and operating a crafted ext4 image.
- affected < 4.4.121-92.95.1fixed 4.4.121-92.95.1
Linux kernel is vulnerable to a stack-out-of-bounds write in the ext4 filesystem code when mounting and writing to a crafted ext4 image in ext4_update_inline_data(). An attacker could use this to cause a system crash and a denial of service.
- affected < 4.4.121-92.95.1fixed 4.4.121-92.95.1
Linux kernel ext4 filesystem is vulnerable to an out-of-bound access in the ext4_ext_drop_refs() function when operating on a crafted ext4 filesystem image.
- affected < 4.4.121-92.109.2fixed 4.4.121-92.109.2
A flaw was found in the way signature calculation was handled by cephx authentication protocol. An attacker having access to ceph cluster network who is able to alter the message payload was able to bypass signature checks done by cephx protocol. Ceph branches master, mimic, lumi
- affected < 4.4.121-92.109.2fixed 4.4.121-92.109.2
It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable to replay attack. Any attacker having access to ceph cluster network who is able to sniff packets on network can use this vulnerability to authenticate with ceph service and p
- affected < 4.4.121-92.92.1fixed 4.4.121-92.92.1
An integer overflow in the uvesafb_setcmap function in drivers/video/fbdev/uvesafb.c in the Linux kernel before 4.17.4 could result in local attackers being able to crash the kernel or potentially elevate privileges because kmalloc_array is not used.
- affected < 4.4.121-92.92.1fixed 4.4.121-92.92.1
The inode_init_owner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of that group. Here, the no
- affected < 4.4.121-92.95.1fixed 4.4.121-92.95.1
An issue was discovered in fs/xfs/libxfs/xfs_inode_buf.c in the Linux kernel through 4.17.3. A denial of service (memory corruption and BUG) can occur for a corrupted xfs image upon encountering an inode that is in extent format, but has more extents than fit in the inode fork.
- affected < 4.4.121-92.95.1fixed 4.4.121-92.95.1
An issue was discovered in fs/xfs/libxfs/xfs_attr_leaf.c in the Linux kernel through 4.17.3. An OOPS may occur for a corrupted xfs image after xfs_da_shrink_inode() is called with a NULL bp.
- affected < 4.4.121-92.95.1fixed 4.4.121-92.95.1
An issue was discovered in fs/xfs/xfs_icache.c in the Linux kernel through 4.17.3. There is a NULL pointer dereference and panic in lookup_slow() on a NULL inode->i_ops pointer when doing pathwalks on a corrupted xfs image. This occurs because of a lack of proper validation that
- affected < 4.4.121-92.95.1fixed 4.4.121-92.95.1
An issue was discovered in the Linux kernel through 4.17.3. An Integer Overflow in kernel/time/posix-timers.c in the POSIX timer code is caused by the way the overrun accounting works. Depending on interval and expiry time values, the overrun can be larger than INT_MAX, but the a
- affected < 4.4.121-92.92.1fixed 4.4.121-92.92.1
The alarm_timer_nsleep function in kernel/time/alarmtimer.c in the Linux kernel through 4.17.3 has an integer overflow via a large relative timeout because ktime_add_safe is not used.
- affected < 4.4.121-92.85.1fixed 4.4.121-92.85.1
Linux Kernel version 3.18 to 4.16 incorrectly handles an SG_IO ioctl on /dev/sg0 with dxfer_direction=SG_DXFER_FROM_DEV and an empty 6-byte cmdp. This may lead to copying up to 1000 kernel heap pages to the userspace. This has been fixed upstream in https://github.com/torvalds/li
- affected < 4.4.121-92.85.1fixed 4.4.121-92.85.1
System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially allow a local process to infer data from another process through a speculative execution side channel.
- affected < 4.4.121-92.109.2fixed 4.4.121-92.109.2
A flaw was found affecting the Linux kernel before version 4.17. By mmap()ing a FUSE-backed file onto a process's memory containing command line arguments (or environment strings), an attacker can cause utilities from psutils or procps (such as ps, w) or any other program which m
- affected < 4.4.121-92.85.1fixed 4.4.121-92.85.1
In the function wmi_set_ie(), the length validation code does not handle unsigned integer overflow properly. As a result, a large value of the 'ie_len' argument can cause a buffer overflow in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using t
- affected < 4.4.121-92.92.1fixed 4.4.121-92.92.1
In the Linux Kernel before version 4.16.11, 4.14.43, 4.9.102, and 4.4.133, multiple race condition errors when handling probe, disconnect, and rebind operations can be exploited to trigger a use-after-free condition or a NULL pointer dereference by sending multiple USB over IP pa
- affected < 4.4.121-92.85.1fixed 4.4.121-92.85.1
In the Linux Kernel before version 4.15.8, 4.14.25, 4.9.87, 4.4.121, 4.1.51, and 3.2.102, an error in the "_sctp_make_chunk()" function (net/sctp/sm_make_chunk.c) when handling SCTP packets length can be exploited to cause a kernel crash.
- affected < 4.4.121-92.85.1fixed 4.4.121-92.85.1
The Linux Kernel version 3.18 contains a dangerous feature vulnerability in modify_user_hw_breakpoint() that can result in crash and possibly memory corruption. This attack appear to be exploitable via local code execution and the ability to use ptrace. This vulnerability appears
- affected < 4.4.121-92.80.1fixed 4.4.121-92.80.1
Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis, aka
Page 14 of 16