rpm package
suse/kernel-ec2&distro=SUSE Linux Enterprise Server 11 SP3-LTSS
pkg:rpm/suse/kernel-ec2&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP3-LTSS
Vulnerabilities (238)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2018-7566 | — | < 3.0.101-0.47.106.22.1 | 3.0.101-0.47.106.22.1 | Mar 30, 2018 | The Linux kernel 4.15 has a Buffer Overflow via an SNDRV_SEQ_IOCTL_SET_CLIENT_POOL ioctl write operation to /dev/snd/seq by a local user. | ||
| CVE-2018-8822 | — | < 3.0.101-0.47.106.22.1 | 3.0.101-0.47.106.22.1 | Mar 20, 2018 | Incorrect buffer length handling in the ncp_read_kernel function in fs/ncpfs/ncplib_kernel.c in the Linux kernel through 4.15.11, and in drivers/staging/ncpfs/ncplib_kernel.c in the Linux kernel 4.16-rc through 4.16-rc6, could be exploited by malicious NCPFS servers to crash the | ||
| CVE-2018-1068 | — | < 3.0.101-0.47.106.43.1 | 3.0.101-0.47.106.43.1 | Mar 16, 2018 | A flaw was found in the Linux 4.x kernel's implementation of 32-bit syscall interface for bridging. This allowed a privileged user to arbitrarily write to a limited range of kernel memory. | ||
| CVE-2018-7757 | — | < 3.0.101-0.47.106.22.1 | 3.0.101-0.47.106.22.1 | Mar 8, 2018 | Memory leak in the sas_smp_get_phy_events function in drivers/scsi/libsas/sas_expander.c in the Linux kernel through 4.15.7 allows local users to cause a denial of service (memory consumption) via many read accesses to files in the /sys/class/sas_phy directory, as demonstrated by | ||
| CVE-2017-18208 | — | < 3.0.101-0.47.106.22.1 | 3.0.101-0.47.106.22.1 | Mar 1, 2018 | The madvise_willneed function in mm/madvise.c in the Linux kernel before 4.14.4 allows local users to cause a denial of service (infinite loop) by triggering use of MADVISE_WILLNEED for a DAX mapping. | ||
| CVE-2017-18203 | — | < 3.0.101-0.47.106.22.1 | 3.0.101-0.47.106.22.1 | Feb 27, 2018 | The dm_get_from_kobject function in drivers/md/dm.c in the Linux kernel before 4.14.3 allow local users to cause a denial of service (BUG) by leveraging a race condition with __dm_destroy during creation and removal of DM devices. | ||
| CVE-2018-7492 | — | < 3.0.101-0.47.106.43.1 | 3.0.101-0.47.106.43.1 | Feb 26, 2018 | A NULL pointer dereference was found in the net/rds/rdma.c __rds_rdma_map() function in the Linux kernel before 4.14.7 allowing local attackers to cause a system panic and a denial-of-service, related to RDS_GET_MR and RDS_GET_MR_FOR_DEST. | ||
| CVE-2018-6927 | — | < 3.0.101-0.47.106.22.1 | 3.0.101-0.47.106.22.1 | Feb 12, 2018 | The futex_requeue function in kernel/futex.c in the Linux kernel before 4.14.15 might allow attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact by triggering a negative wake or requeue value. | ||
| CVE-2017-16914 | — | < 3.0.101-0.47.106.22.1 | 3.0.101-0.47.106.22.1 | Jan 31, 2018 | The "stub_send_ret_submit()" function (drivers/usb/usbip/stub_tx.c) in the Linux Kernel before version 4.14.8, 4.9.71, 4.1.49, and 4.4.107 allows attackers to cause a denial of service (NULL pointer dereference) via a specially crafted USB over IP packet. | ||
| CVE-2017-16913 | — | < 3.0.101-0.47.106.22.1 | 3.0.101-0.47.106.22.1 | Jan 31, 2018 | The "stub_recv_cmd_submit()" function (drivers/usb/usbip/stub_rx.c) in the Linux Kernel before version 4.14.8, 4.9.71, and 4.4.114 when handling CMD_SUBMIT packets allows attackers to cause a denial of service (arbitrary memory allocation) via a specially crafted USB over IP pack | ||
| CVE-2017-16912 | — | < 3.0.101-0.47.106.22.1 | 3.0.101-0.47.106.22.1 | Jan 31, 2018 | The "get_pipe()" function (drivers/usb/usbip/stub_rx.c) in the Linux Kernel before version 4.14.8, 4.9.71, and 4.4.114 allows attackers to cause a denial of service (out-of-bounds read) via a specially crafted USB over IP packet. | ||
| CVE-2017-16911 | — | < 3.0.101-0.47.106.22.1 | 3.0.101-0.47.106.22.1 | Jan 31, 2018 | The vhci_hcd driver in the Linux Kernel before version 4.14.8 and 4.4.114 allows allows local attackers to disclose kernel memory addresses. Successful exploitation requires that a USB device is attached over IP. | ||
| CVE-2017-18079 | — | < 3.0.101-0.47.106.19.1 | 3.0.101-0.47.106.19.1 | Jan 29, 2018 | drivers/input/serio/i8042.c in the Linux kernel before 4.12.4 allows attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact because the port->exists value can change after it is validated. | ||
| CVE-2018-1000004 | — | < 3.0.101-0.47.106.19.1 | 3.0.101-0.47.106.19.1 | Jan 16, 2018 | In the Linux kernel 4.12, 3.10, 2.6 and possibly earlier versions a race condition vulnerability exists in the sound system, this can lead to a deadlock and denial of service condition. | ||
| CVE-2017-13215 | — | < 3.0.101-0.47.106.19.1 | 3.0.101-0.47.106.19.1 | Jan 12, 2018 | A elevation of privilege vulnerability in the Upstream kernel skcipher. Product: Android. Versions: Android kernel. Android ID: A-64386293. References: Upstream kernel. | ||
| CVE-2018-5333 | — | < 3.0.101-0.47.106.19.1 | 3.0.101-0.47.106.19.1 | Jan 11, 2018 | In the Linux kernel through 4.14.13, the rds_cmsg_atomic function in net/rds/rdma.c mishandles cases where page pinning fails or an invalid address is supplied, leading to an rds_atomic_free_op NULL pointer dereference. | ||
| CVE-2018-5332 | — | < 3.0.101-0.47.106.19.1 | 3.0.101-0.47.106.19.1 | Jan 11, 2018 | In the Linux kernel through 3.2, the rds_message_alloc_sgs() function does not validate a value that is used during DMA page allocation, leading to a heap-based out-of-bounds write (related to the rds_rdma_extra_size function in net/rds/rdma.c). | ||
| CVE-2017-5754 | — | < 3.0.101-0.47.106.11.1 | 3.0.101-0.47.106.11.1 | Jan 4, 2018 | Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis of the data cache. | ||
| CVE-2017-5753 | — | < 3.0.101-0.47.106.11.1 | 3.0.101-0.47.106.11.1 | Jan 4, 2018 | Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis. | ||
| CVE-2017-5715 | — | < 3.0.101-0.47.106.11.1 | 3.0.101-0.47.106.11.1 | Jan 4, 2018 | Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis. |
- CVE-2018-7566Mar 30, 2018affected < 3.0.101-0.47.106.22.1fixed 3.0.101-0.47.106.22.1
The Linux kernel 4.15 has a Buffer Overflow via an SNDRV_SEQ_IOCTL_SET_CLIENT_POOL ioctl write operation to /dev/snd/seq by a local user.
- CVE-2018-8822Mar 20, 2018affected < 3.0.101-0.47.106.22.1fixed 3.0.101-0.47.106.22.1
Incorrect buffer length handling in the ncp_read_kernel function in fs/ncpfs/ncplib_kernel.c in the Linux kernel through 4.15.11, and in drivers/staging/ncpfs/ncplib_kernel.c in the Linux kernel 4.16-rc through 4.16-rc6, could be exploited by malicious NCPFS servers to crash the
- CVE-2018-1068Mar 16, 2018affected < 3.0.101-0.47.106.43.1fixed 3.0.101-0.47.106.43.1
A flaw was found in the Linux 4.x kernel's implementation of 32-bit syscall interface for bridging. This allowed a privileged user to arbitrarily write to a limited range of kernel memory.
- CVE-2018-7757Mar 8, 2018affected < 3.0.101-0.47.106.22.1fixed 3.0.101-0.47.106.22.1
Memory leak in the sas_smp_get_phy_events function in drivers/scsi/libsas/sas_expander.c in the Linux kernel through 4.15.7 allows local users to cause a denial of service (memory consumption) via many read accesses to files in the /sys/class/sas_phy directory, as demonstrated by
- CVE-2017-18208Mar 1, 2018affected < 3.0.101-0.47.106.22.1fixed 3.0.101-0.47.106.22.1
The madvise_willneed function in mm/madvise.c in the Linux kernel before 4.14.4 allows local users to cause a denial of service (infinite loop) by triggering use of MADVISE_WILLNEED for a DAX mapping.
- CVE-2017-18203Feb 27, 2018affected < 3.0.101-0.47.106.22.1fixed 3.0.101-0.47.106.22.1
The dm_get_from_kobject function in drivers/md/dm.c in the Linux kernel before 4.14.3 allow local users to cause a denial of service (BUG) by leveraging a race condition with __dm_destroy during creation and removal of DM devices.
- CVE-2018-7492Feb 26, 2018affected < 3.0.101-0.47.106.43.1fixed 3.0.101-0.47.106.43.1
A NULL pointer dereference was found in the net/rds/rdma.c __rds_rdma_map() function in the Linux kernel before 4.14.7 allowing local attackers to cause a system panic and a denial-of-service, related to RDS_GET_MR and RDS_GET_MR_FOR_DEST.
- CVE-2018-6927Feb 12, 2018affected < 3.0.101-0.47.106.22.1fixed 3.0.101-0.47.106.22.1
The futex_requeue function in kernel/futex.c in the Linux kernel before 4.14.15 might allow attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact by triggering a negative wake or requeue value.
- CVE-2017-16914Jan 31, 2018affected < 3.0.101-0.47.106.22.1fixed 3.0.101-0.47.106.22.1
The "stub_send_ret_submit()" function (drivers/usb/usbip/stub_tx.c) in the Linux Kernel before version 4.14.8, 4.9.71, 4.1.49, and 4.4.107 allows attackers to cause a denial of service (NULL pointer dereference) via a specially crafted USB over IP packet.
- CVE-2017-16913Jan 31, 2018affected < 3.0.101-0.47.106.22.1fixed 3.0.101-0.47.106.22.1
The "stub_recv_cmd_submit()" function (drivers/usb/usbip/stub_rx.c) in the Linux Kernel before version 4.14.8, 4.9.71, and 4.4.114 when handling CMD_SUBMIT packets allows attackers to cause a denial of service (arbitrary memory allocation) via a specially crafted USB over IP pack
- CVE-2017-16912Jan 31, 2018affected < 3.0.101-0.47.106.22.1fixed 3.0.101-0.47.106.22.1
The "get_pipe()" function (drivers/usb/usbip/stub_rx.c) in the Linux Kernel before version 4.14.8, 4.9.71, and 4.4.114 allows attackers to cause a denial of service (out-of-bounds read) via a specially crafted USB over IP packet.
- CVE-2017-16911Jan 31, 2018affected < 3.0.101-0.47.106.22.1fixed 3.0.101-0.47.106.22.1
The vhci_hcd driver in the Linux Kernel before version 4.14.8 and 4.4.114 allows allows local attackers to disclose kernel memory addresses. Successful exploitation requires that a USB device is attached over IP.
- CVE-2017-18079Jan 29, 2018affected < 3.0.101-0.47.106.19.1fixed 3.0.101-0.47.106.19.1
drivers/input/serio/i8042.c in the Linux kernel before 4.12.4 allows attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact because the port->exists value can change after it is validated.
- CVE-2018-1000004Jan 16, 2018affected < 3.0.101-0.47.106.19.1fixed 3.0.101-0.47.106.19.1
In the Linux kernel 4.12, 3.10, 2.6 and possibly earlier versions a race condition vulnerability exists in the sound system, this can lead to a deadlock and denial of service condition.
- CVE-2017-13215Jan 12, 2018affected < 3.0.101-0.47.106.19.1fixed 3.0.101-0.47.106.19.1
A elevation of privilege vulnerability in the Upstream kernel skcipher. Product: Android. Versions: Android kernel. Android ID: A-64386293. References: Upstream kernel.
- CVE-2018-5333Jan 11, 2018affected < 3.0.101-0.47.106.19.1fixed 3.0.101-0.47.106.19.1
In the Linux kernel through 4.14.13, the rds_cmsg_atomic function in net/rds/rdma.c mishandles cases where page pinning fails or an invalid address is supplied, leading to an rds_atomic_free_op NULL pointer dereference.
- CVE-2018-5332Jan 11, 2018affected < 3.0.101-0.47.106.19.1fixed 3.0.101-0.47.106.19.1
In the Linux kernel through 3.2, the rds_message_alloc_sgs() function does not validate a value that is used during DMA page allocation, leading to a heap-based out-of-bounds write (related to the rds_rdma_extra_size function in net/rds/rdma.c).
- CVE-2017-5754Jan 4, 2018affected < 3.0.101-0.47.106.11.1fixed 3.0.101-0.47.106.11.1
Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis of the data cache.
- CVE-2017-5753Jan 4, 2018affected < 3.0.101-0.47.106.11.1fixed 3.0.101-0.47.106.11.1
Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis.
- CVE-2017-5715Jan 4, 2018affected < 3.0.101-0.47.106.11.1fixed 3.0.101-0.47.106.11.1
Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis.
Page 3 of 12