SB2017091522 - OpenSUSE Linux update for the Linux Kernel

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Stack-based buffer overflow (CVE-ID: CVE-2017-1000251)

The vulnerability allows an adjacent attacker to execute arbitrary code on the host system.

The weakness exists due to a stack-based buffer overflow in the processing of L2CAP configuration. An adjacent attacker can submit a specially crafted Bluetooth protocol, trigger memory corruption in the Bluetooth stack and execute arbitrary code in kernel space.

Successful exploitation of the vulnerability may result in host system compromise.

2) Improper access control (CVE-ID: CVE-2017-11472)

The vulnerability allows a local attacker to obtain potentially sensitive information and bypass security restrictions on the target system.

The weakness exists in the acpi_ns_terminate() function in drivers/acpi/acpica/nsutils.c due to it does not flush the operand cache and causes a kernel stack dump. A local attacker can submit a specially crafted ACPI table, gain access to potentially sensitive information from kernel memory and bypass the KASLR protection mechanism.

3) Divide by zero (CVE-ID: CVE-2017-14106)

The vulnerability allows a local attacker to cause DoS condition on the target system.

The weakness exists due to divide-by-zero error in the tcp_disconnect() function in net/ipv4/tcp.c. A local attacker can trigger a disconnect within a certain tcp_recvmsg code path and cause kernel panic.

Successful exploitation of the vulnerability results in denial of service.

Remediation

Install update from vendor's website.

References

• https://lists.opensuse.org/opensuse-security-announce/2017-09/msg00056.html