SB2012062602 - SUSE Linux update for Linux kernel

Description

This security bulletin contains information about 6 secuirty vulnerabilities.

1) Input validation error (CVE-ID: CVE-2011-4131)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The NFSv4 implementation in the Linux kernel before 3.2.2 does not properly handle bitmap sizes in GETACL replies, which allows remote NFS servers to cause a denial of service (OOPS) by sending an excessive number of bitmap words.

2) Buffer overflow (CVE-ID: CVE-2012-2119)

The vulnerability allows a remote #AU# to perform a denial of service (DoS) attack.

Buffer overflow in the macvtap device driver in the Linux kernel before 3.4.5, when running in certain configurations, allows privileged KVM guest users to cause a denial of service (crash) via a long descriptor with a long vector length.

3) Input validation error (CVE-ID: CVE-2012-2136)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The sock_alloc_send_pskb function in net/core/sock.c in the Linux kernel before 3.4.5 does not properly validate a certain length value, which allows local users to cause a denial of service (heap-based buffer overflow and system crash) or possibly gain privileges by leveraging access to a TUN/TAP device.

4) Race condition (CVE-ID: CVE-2012-2373)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The Linux kernel before 3.4.5 on the x86 platform, when Physical Address Extension (PAE) is enabled, does not properly use the Page Middle Directory (PMD), which allows local users to cause a denial of service (panic) via a crafted application that triggers a race condition.

5) Input validation error (CVE-ID: CVE-2012-2375)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The __nfs4_get_acl_uncached function in fs/nfs/nfs4proc.c in the NFSv4 implementation in the Linux kernel before 3.3.2 uses an incorrect length variable during a copy operation, which allows remote NFS servers to cause a denial of service (OOPS) by sending an excessive number of bitmap words in an FATTR4_ACL reply. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-4131.

6) Memory leak (CVE-ID: CVE-2012-2390)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within mm/hugetlb.c in the Linux kernel before 3.4.2 allows local users to cause a denial of service (memory consumption or system crash) via invalid MAP_HUGETLB mmap operations. A remote attacker can perform a denial of service attack.

Remediation

Install update from vendor's website.

References

• https://lists.opensuse.org/opensuse-security-announce/2012-06/msg00020.html