854722 – (CVE-2013-6463) VUL-0: CVE-2013-6463: kernel: net: memory leak in recvmsg handler msg_name & msg_namelen logic

Bug 854722 (CVE-2013-6463) - VUL-0: CVE-2013-6463: kernel: net: memory leak in recvmsg handler msg_name & msg_namelen logic

Summary: VUL-0: CVE-2013-6463: kernel: net: memory leak in recvmsg handler msg_name & ...

Status:	RESOLVED FIXED

Alias:	CVE-2013-6463

Product:	SUSE Security Incidents
Classification:	Novell Products
Component:	Incidents (show other bugs)
Version:	unspecified
Hardware:	Other Other

Priority:	P4 - Low Severity: Minor
Target Milestone:	---
Deadline:	2014-09-03
Assignee:	Petr Tesařík
QA Contact:	Security Team bot

URL:
Whiteboard:	maint:released:sle11-sp2:55877 maint:...
Keywords:

Depends on:
Blocks:

Clone This Bug

Reported:	2013-12-10 12:06 UTC by Sebastian Krahmer
Modified:	2015-04-30 19:11 UTC (History)
CC List:	7 users (show)

See Also:
Found By:	Security Response Team
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Attachments
attempt to backport to 11sp1 (17.62 KB, patch) 2013-12-17 16:15 UTC, Michal Hocko	Details \| Diff
attempt to backport to 11sp1 v1 (18.04 KB, patch) 2013-12-18 09:20 UTC, Michal Hocko	Details \| Diff
SLES10-SP3-TD patch (1.32 KB, patch) 2014-07-04 16:44 UTC, Jiri Bohac	Details \| Diff
SLE11-SP1-TD patch (2.87 KB, patch) 2014-07-04 16:45 UTC, Jiri Bohac	Details \| Diff
fixed SLE11-SP1-TD patch (3.03 KB, patch) 2014-07-08 08:33 UTC, Jiri Bohac	Details \| Diff
Show Obsolete (3) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Sebastian Krahmer 2013-12-10 12:06:16 UTC

OSS:11654



References:
https://bugzilla.redhat.com/show_bug.cgi?id=1039845
http://comments.gmane.org/gmane.comp.security.oss.general/11654

Comment 1 Swamp Workflow Management 2013-12-11 23:00:23 UTC

bugbot adjusting priority

Comment 2 Sebastian Krahmer 2013-12-17 07:48:12 UTC

Hm, looks like this could affect all products?

Comment 3 Borislav Petkov 2013-12-17 10:48:03 UTC

SLE12 has it already, I'm looking through the rest.

Btw, upstream fix is: https://git.kernel.org/linus/f3d3342602f8bcbf37d7c46641cb9bca7618eb1c

Comment 4 Borislav Petkov 2013-12-17 15:38:02 UTC

SLE11-SP2: applied.
oS12.2: has it already.
oS12.3: applied.

Closing.

Comment 6 Michal Hocko 2013-12-17 16:13:00 UTC

btw. we are missing CVE entry here. It should be CVE-2013-6405 AFAICS

Comment 7 Michal Hocko 2013-12-17 16:15:28 UTC

Created attachment 572198 [details]
attempt to backport to 11sp1

I have checked that no drivers set msg_namelen to 0, except for af_unix.c at one place but this is consistent with the current upstream.

Can somebody double check this please?

Comment 8 Borislav Petkov 2013-12-17 21:23:09 UTC

Hey Michal,

I did the backport to SP1 myself just to have an idea what it would look
like. Then, I diffed your and mine, yours is missing a hunk:

--- michal	2013-12-17 21:52:18.263836702 +0100
+++ mine	2013-12-17 21:57:58.482877099 +0100
+diff --git a/net/rds/recv.c b/net/rds/recv.c
+index c45a881cf576..a11cab901d27 100644
+--- a/net/rds/recv.c
++++ b/net/rds/recv.c
+@@ -410,8 +410,6 @@ int rds_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
+ 
+ 	rdsdebug("size %zu flags 0x%x timeo %ld\n", size, msg_flags, timeo);
+ 
+-	msg->msg_namelen = 0;
+-
+ 	if (msg_flags & MSG_OOB)
+ 		goto out;
+

I dunno what the RDS protocol is, do we enable it at all?

Also, doing

git grep -En "msg_namelen.*=.*0"

gives a couple of results and one looks like it would need to be
converted too:

net/bluetooth/rfcomm/sock.c:661

We do msg->msg_namelen = 0 there too and AFAIU, the function
rfcomm_sock_recvmsg() is the exact same ->recvmsg pointer in the
proto_ops this patch converts.

This is exactly the nasty thing about backporting patches to old kernels
- simply too much has changed...

Comment 9 Borislav Petkov 2013-12-17 21:29:54 UTC

Crap, and my backports need reauditing and refreshing too. For an example why, see d97636980f6ba7344c8aa6fa349b9059c60ee478 which moved the setting msg->msg_namelen = 0; inside the loop but this patch is not present in SP2. Nasty :(

Comment 11 Michal Hocko 2013-12-18 09:20:34 UTC

Created attachment 572323 [details]
attempt to backport to 11sp1 v1

Updated version of the patch. I have moved the patch down the series.conf to cover all protocols.
grep "msg->msg_namelen = 0" -r net/ drivers/ crypto/
net/socket.c:   msg->msg_namelen = 0;
net/socket.c:   msg->msg_namelen = 0;
net/unix/af_unix.c:             msg->msg_namelen = 0;

af_unix is same as in upstream, so I hope we are OK finally.

Comment 12 Jiri Bohac 2013-12-19 15:11:15 UTC

I object to applying this patch to any released product.

It changes the semantics of the msg->namelen parameter passed to the a protocol's recvmsg function.

Prior to this patch, a protocol-specific recvmsg implementation could obtain the available space for storing the destination address (msg->msg_name) in msg->msg_namelen.

This patch changes the msg->msg_namelen to be a strictly output parameter, filled in by the recvmsg function and always set to 0 prior to the protocol's recvmsg function.

This, in effect, changes the ABI for any potential protocol family a customer's own module may implement.


As far as I understand, this patch does not even fix a specific security bug, right? It's more of "oh, we had a few bugs like this in the past, if we refactor the code like this, they we won't make such mistakes again so easily..."

This is not something to backport to a released product. Ever.
If there is a specific leakage in any of the individual protocols, let's fix that individually. Do we have any signs this is the case?

Boris, what do you think?
I think it would be reasonable to remove the patches from SLE11-SP2, SLE11-SP3, 12.3 and 13.1.

BTW, upsteram bceaa90240b6019ed73b49965eac7d167610be69 looks like it was the motivation for this rewrite, it fixes real bugs and and it is coming through stable... at least for os12.2 and sle12 so far.

Comment 14 Alexander Bergmann 2014-01-02 13:48:52 UTC

CVE-2013-6463 was assigned to this issue.

Comment 15 Swamp Workflow Management 2014-01-27 10:59:23 UTC

Update released for: cluster-network-kmp-default, cluster-network-kmp-ppc64, cluster-network-kmp-trace, gfs2-kmp-default, gfs2-kmp-ppc64, gfs2-kmp-trace, kernel-default, kernel-default-base, kernel-default-debuginfo, kernel-default-debugsource, kernel-default-devel, kernel-default-extra, kernel-default-hmac, kernel-ppc64, kernel-ppc64-base, kernel-ppc64-debuginfo, kernel-ppc64-debugsource, kernel-ppc64-devel, kernel-ppc64-extra, kernel-ppc64-hmac, kernel-source, kernel-source-debuginfo, kernel-source-vanilla, kernel-syms, kernel-trace, kernel-trace-base, kernel-trace-debuginfo, kernel-trace-debugsource, kernel-trace-devel, kernel-trace-extra, kernel-trace-hmac, ocfs2-kmp-default, ocfs2-kmp-ppc64, ocfs2-kmp-trace
Products:
SLE-DEBUGINFO 11-SP2 (ppc64)
SLE-HAE 11-SP2 (ppc64)
SLE-SERVER 11-SP2 (ppc64)

Comment 16 Swamp Workflow Management 2014-01-27 11:16:07 UTC

Update released for: cluster-network-kmp-default, cluster-network-kmp-trace, gfs2-kmp-default, gfs2-kmp-trace, kernel-default, kernel-default-base, kernel-default-debuginfo, kernel-default-debugsource, kernel-default-devel, kernel-default-devel-debuginfo, kernel-default-extra, kernel-default-hmac, kernel-source, kernel-source-debuginfo, kernel-source-vanilla, kernel-syms, kernel-trace, kernel-trace-base, kernel-trace-debuginfo, kernel-trace-debugsource, kernel-trace-devel, kernel-trace-devel-debuginfo, kernel-trace-extra, kernel-trace-hmac, ocfs2-kmp-default, ocfs2-kmp-trace
Products:
SLE-DEBUGINFO 11-SP2 (ia64)
SLE-HAE 11-SP2 (ia64)
SLE-SERVER 11-SP2 (ia64)

Comment 17 Swamp Workflow Management 2014-01-27 11:30:12 UTC

Update released for: cluster-network-kmp-default, cluster-network-kmp-pae, cluster-network-kmp-trace, cluster-network-kmp-xen, gfs2-kmp-default, gfs2-kmp-pae, gfs2-kmp-trace, gfs2-kmp-xen, kernel-default, kernel-default-base, kernel-default-debuginfo, kernel-default-debugsource, kernel-default-devel, kernel-default-devel-debuginfo, kernel-default-extra, kernel-default-hmac, kernel-desktop-devel, kernel-ec2, kernel-ec2-base, kernel-ec2-debuginfo, kernel-ec2-debugsource, kernel-ec2-devel, kernel-ec2-devel-debuginfo, kernel-ec2-extra, kernel-ec2-hmac, kernel-pae, kernel-pae-base, kernel-pae-debuginfo, kernel-pae-debugsource, kernel-pae-devel, kernel-pae-devel-debuginfo, kernel-pae-extra, kernel-pae-hmac, kernel-source, kernel-source-debuginfo, kernel-source-vanilla, kernel-syms, kernel-trace, kernel-trace-base, kernel-trace-debuginfo, kernel-trace-debugsource, kernel-trace-devel, kernel-trace-devel-debuginfo, kernel-trace-extra, kernel-trace-hmac, kernel-xen, kernel-xen-base, kernel-xen-debuginfo, kernel-xen-debugsource, kernel-xen-devel, kernel-xen-devel-debuginfo, kernel-xen-extra, kernel-xen-hmac, ocfs2-kmp-default, ocfs2-kmp-pae, ocfs2-kmp-trace, ocfs2-kmp-xen, xen-kmp-default, xen-kmp-pae, xen-kmp-trace
Products:
SLE-DEBUGINFO 11-SP2 (i386)
SLE-DESKTOP 11-SP2 (i386)
SLE-HAE 11-SP2 (i386)
SLE-SERVER 11-SP2 (i386)
SLES4VMWARE 11-SP2 (i386)

Comment 18 Swamp Workflow Management 2014-01-27 11:56:47 UTC

Update released for: cluster-network-kmp-default, cluster-network-kmp-trace, gfs2-kmp-default, gfs2-kmp-trace, kernel-default, kernel-default-base, kernel-default-debuginfo, kernel-default-debugsource, kernel-default-devel, kernel-default-devel-debuginfo, kernel-default-extra, kernel-default-hmac, kernel-default-man, kernel-source, kernel-source-debuginfo, kernel-source-vanilla, kernel-syms, kernel-trace, kernel-trace-base, kernel-trace-debuginfo, kernel-trace-debugsource, kernel-trace-devel, kernel-trace-devel-debuginfo, kernel-trace-extra, kernel-trace-hmac, kernel-trace-man, ocfs2-kmp-default, ocfs2-kmp-trace
Products:
SLE-DEBUGINFO 11-SP2 (s390x)
SLE-HAE 11-SP2 (s390x)
SLE-SERVER 11-SP2 (s390x)

Comment 19 Swamp Workflow Management 2014-01-27 11:57:53 UTC

Update released for: cluster-network-kmp-default, cluster-network-kmp-trace, cluster-network-kmp-xen, gfs2-kmp-default, gfs2-kmp-trace, gfs2-kmp-xen, kernel-default, kernel-default-base, kernel-default-debuginfo, kernel-default-debugsource, kernel-default-devel, kernel-default-devel-debuginfo, kernel-default-extra, kernel-default-hmac, kernel-desktop-devel, kernel-ec2, kernel-ec2-base, kernel-ec2-debuginfo, kernel-ec2-debugsource, kernel-ec2-devel, kernel-ec2-devel-debuginfo, kernel-ec2-extra, kernel-ec2-hmac, kernel-source, kernel-source-debuginfo, kernel-source-vanilla, kernel-syms, kernel-trace, kernel-trace-base, kernel-trace-debuginfo, kernel-trace-debugsource, kernel-trace-devel, kernel-trace-devel-debuginfo, kernel-trace-extra, kernel-trace-hmac, kernel-xen, kernel-xen-base, kernel-xen-debuginfo, kernel-xen-debugsource, kernel-xen-devel, kernel-xen-devel-debuginfo, kernel-xen-extra, kernel-xen-hmac, ocfs2-kmp-default, ocfs2-kmp-trace, ocfs2-kmp-xen, xen-kmp-default, xen-kmp-trace
Products:
SLE-DEBUGINFO 11-SP2 (x86_64)
SLE-DESKTOP 11-SP2 (x86_64)
SLE-HAE 11-SP2 (x86_64)
SLE-SERVER 11-SP2 (x86_64)
SLES4VMWARE 11-SP2 (x86_64)

Comment 20 Swamp Workflow Management 2014-01-27 16:44:30 UTC

SUSE-SU-2014:0140-1: An update that solves 14 vulnerabilities and has 57 fixes is now available.

Category: security (moderate)
Bug References: 708296,769644,787843,789359,798050,806988,807434,810323,813245,818545,819979,820102,820338,821980,823618,825696,825896,826602,826756,827767,828236,831168,834473,834708,834808,835074,835186,836718,837739,838623,839407,840226,841445,842239,843419,843429,843445,843642,843645,845621,845729,846036,846984,847261,848321,848336,848544,848652,849021,849029,849034,849404,849675,849809,849848,849950,850640,851066,851101,851314,852373,852558,852559,852624,853050,853051,853052,854546,854634,854722,855037
CVE References: CVE-2013-4345,CVE-2013-4483,CVE-2013-4511,CVE-2013-4514,CVE-2013-4515,CVE-2013-4587,CVE-2013-4592,CVE-2013-6367,CVE-2013-6368,CVE-2013-6378,CVE-2013-6380,CVE-2013-6383,CVE-2013-6463,CVE-2013-7027
Sources used:
SUSE Linux Enterprise Server 11 SP2 for VMware (src):    kernel-default-3.0.101-0.7.15.1, kernel-pae-3.0.101-0.7.15.1, kernel-source-3.0.101-0.7.15.1, kernel-syms-3.0.101-0.7.15.1, kernel-trace-3.0.101-0.7.15.1, kernel-xen-3.0.101-0.7.15.1, xen-4.1.6_04-0.5.12
SUSE Linux Enterprise Server 11 SP2 (src):    kernel-default-3.0.101-0.7.15.1, kernel-ec2-3.0.101-0.7.15.1, kernel-pae-3.0.101-0.7.15.1, kernel-ppc64-3.0.101-0.7.15.1, kernel-source-3.0.101-0.7.15.1, kernel-syms-3.0.101-0.7.15.1, kernel-trace-3.0.101-0.7.15.1, kernel-xen-3.0.101-0.7.15.1, xen-4.1.6_04-0.5.12
SUSE Linux Enterprise High Availability Extension 11 SP2 (src):    cluster-network-1.4-2.18.79, gfs2-2-0.7.107, ocfs2-1.6-0.11.78
SUSE Linux Enterprise Desktop 11 SP2 (src):    kernel-default-3.0.101-0.7.15.1, kernel-pae-3.0.101-0.7.15.1, kernel-source-3.0.101-0.7.15.1, kernel-syms-3.0.101-0.7.15.1, kernel-trace-3.0.101-0.7.15.1, kernel-xen-3.0.101-0.7.15.1, xen-4.1.6_04-0.5.12
SLE 11 SERVER Unsupported Extras (src):    ext4-writeable-0-0.14.88, kernel-default-3.0.101-0.7.15.1, kernel-pae-3.0.101-0.7.15.1, kernel-ppc64-3.0.101-0.7.15.1, kernel-xen-3.0.101-0.7.15.1

Comment 21 Swamp Workflow Management 2014-01-27 16:56:07 UTC

Update released for: ext4-writeable-kmp-default, ext4-writeable-kmp-trace, kernel-default-extra
Products:
SLE-SERVER 11-EXTRA (s390x)

Comment 22 Swamp Workflow Management 2014-01-27 17:12:05 UTC

Update released for: ext4-writeable-kmp-default, ext4-writeable-kmp-trace, ext4-writeable-kmp-xen, kernel-default-extra, kernel-xen-extra
Products:
SLE-SERVER 11-EXTRA (x86_64)

Comment 23 Swamp Workflow Management 2014-01-27 17:18:31 UTC

Update released for: ext4-writeable-kmp-default, ext4-writeable-kmp-pae, ext4-writeable-kmp-trace, ext4-writeable-kmp-xen, kernel-default-extra, kernel-pae-extra, kernel-xen-extra
Products:
SLE-SERVER 11-EXTRA (i386)

Comment 24 Swamp Workflow Management 2014-01-27 18:19:26 UTC

Update released for: ext4-writeable-kmp-default, ext4-writeable-kmp-ppc64, ext4-writeable-kmp-trace, kernel-default-extra, kernel-ppc64-extra
Products:
SLE-SERVER 11-EXTRA (ppc64)

Comment 25 Swamp Workflow Management 2014-01-27 19:19:40 UTC

Update released for: ext4-writeable-kmp-default, ext4-writeable-kmp-trace, kernel-default-extra
Products:
SLE-SERVER 11-EXTRA (ia64)

Comment 26 Swamp Workflow Management 2014-01-31 11:05:17 UTC

Update released for: cluster-network-kmp-rt, cluster-network-kmp-rt_trace, drbd-kmp-rt, drbd-kmp-rt_trace, iscsitarget-kmp-rt, iscsitarget-kmp-rt_trace, kernel-rt, kernel-rt-base, kernel-rt-debuginfo, kernel-rt-debugsource, kernel-rt-devel, kernel-rt-devel-debuginfo, kernel-rt-extra, kernel-rt-hmac, kernel-rt_trace, kernel-rt_trace-base, kernel-rt_trace-debuginfo, kernel-rt_trace-debugsource, kernel-rt_trace-devel, kernel-rt_trace-devel-debuginfo, kernel-rt_trace-extra, kernel-rt_trace-hmac, kernel-source-rt, kernel-syms-rt, lttng-modules-kmp-rt, lttng-modules-kmp-rt_trace, ocfs2-kmp-rt, ocfs2-kmp-rt_trace, ofed-kmp-rt, ofed-kmp-rt_trace
Products:
SLE-RT 11-SP2 (x86_64)

Comment 27 Swamp Workflow Management 2014-01-31 11:09:43 UTC

Update released for: cluster-network-kmp-rt, cluster-network-kmp-rt_trace, drbd-kmp-rt, drbd-kmp-rt_trace, iscsitarget-kmp-rt, iscsitarget-kmp-rt_trace, kernel-rt, kernel-rt-base, kernel-rt-debuginfo, kernel-rt-debugsource, kernel-rt-devel, kernel-rt-devel-debuginfo, kernel-rt-extra, kernel-rt-hmac, kernel-rt_trace, kernel-rt_trace-base, kernel-rt_trace-debuginfo, kernel-rt_trace-debugsource, kernel-rt_trace-devel, kernel-rt_trace-devel-debuginfo, kernel-rt_trace-extra, kernel-rt_trace-hmac, kernel-source-rt, kernel-syms-rt, lttng-modules-kmp-rt, lttng-modules-kmp-rt_trace, ocfs2-kmp-rt, ocfs2-kmp-rt_trace, ofed-kmp-rt, ofed-kmp-rt_trace
Products:
SLE-DEBUGINFO 11-SP3 (x86_64)
SLE-RT 11-SP3 (x86_64)

Comment 28 Swamp Workflow Management 2014-01-31 15:37:29 UTC

SUSE-SU-2014:0168-1: An update that solves 16 vulnerabilities and has 83 fixes is now available.

Category: security (moderate)
Bug References: 708296,733022,770541,787843,789359,803174,806988,810323,813245,818064,818545,819979,820102,820338,821619,821980,825006,825696,825896,826602,826756,826978,827527,827767,828236,831103,833097,834473,834708,834808,835074,835186,836718,837206,837739,838623,839407,839973,840116,840226,841445,841654,842239,843185,843419,843429,843445,843642,843645,843654,845352,845378,845729,846036,846298,846989,847261,847660,847842,848317,848321,848335,848336,848544,848864,849021,849029,849034,849256,849362,849404,849675,849809,849950,850072,850103,850324,850493,850640,851066,851101,851290,851314,851879,852373,852558,852559,852652,852761,853050,853051,853053,853428,853465,854546,854634,854722,856307,856481
CVE References: CVE-2013-2146,CVE-2013-2930,CVE-2013-4345,CVE-2013-4483,CVE-2013-4511,CVE-2013-4514,CVE-2013-4515,CVE-2013-4587,CVE-2013-4592,CVE-2013-6367,CVE-2013-6376,CVE-2013-6378,CVE-2013-6380,CVE-2013-6383,CVE-2013-6463,CVE-2013-7027
Sources used:
SUSE Linux Enterprise Real Time Extension 11 SP3 (src):    cluster-network-1.4-2.27.37, drbd-kmp-8.4.4-0.22.3, iscsitarget-1.4.20-0.38.22, kernel-rt-3.0.101.rt130-0.10.1, kernel-rt_trace-3.0.101.rt130-0.10.1, kernel-source-rt-3.0.101.rt130-0.10.1, kernel-syms-rt-3.0.101.rt130-0.10.1, lttng-modules-2.1.1-0.11.22, ocfs2-1.6-0.20.37, ofed-1.5.4.1-0.13.28

Comment 29 Swamp Workflow Management 2014-01-31 16:31:18 UTC

SUSE-SU-2014:0169-1: An update that solves 14 vulnerabilities and has 53 fixes is now available.

Category: security (moderate)
Bug References: 708296,769644,787843,789359,806988,810323,813245,818545,819979,820102,820338,821980,823618,825696,825896,826602,826756,827767,828236,831168,834473,834708,834808,835074,835186,836718,837739,838623,839407,840226,841445,842239,843419,843429,843445,843642,843645,845621,845729,846036,846984,847261,848321,848336,848544,849021,849029,849034,849404,849675,849809,849848,849950,850640,851066,851101,851314,852373,852558,852559,853050,853051,853052,854546,854634,854722,855037
CVE References: CVE-2013-4345,CVE-2013-4483,CVE-2013-4511,CVE-2013-4514,CVE-2013-4515,CVE-2013-4587,CVE-2013-4592,CVE-2013-6367,CVE-2013-6368,CVE-2013-6378,CVE-2013-6380,CVE-2013-6383,CVE-2013-6463,CVE-2013-7027
Sources used:
SUSE Linux Enterprise Real Time 11 SP2 (src):    cluster-network-1.4-2.18.79, drbd-kmp-8.4.2-0.6.6.70, iscsitarget-1.4.20-0.25.25.18, kernel-rt-3.0.101.rt130-0.7.9.1, kernel-rt_trace-3.0.101.rt130-0.7.9.1, kernel-source-rt-3.0.101.rt130-0.7.9.1, kernel-syms-rt-3.0.101.rt130-0.7.9.1, lttng-modules-2.0.4-0.9.9.6, ocfs2-1.6-0.11.78, ofed-1.5.2-0.28.28.50

Comment 30 Swamp Workflow Management 2014-02-04 19:08:32 UTC

Update released for: cluster-network-kmp-default, cluster-network-kmp-ppc64, cluster-network-kmp-trace, gfs2-kmp-default, gfs2-kmp-ppc64, gfs2-kmp-trace, kernel-default, kernel-default-base, kernel-default-debuginfo, kernel-default-debugsource, kernel-default-devel, kernel-default-extra, kernel-default-hmac, kernel-ppc64, kernel-ppc64-base, kernel-ppc64-debuginfo, kernel-ppc64-debugsource, kernel-ppc64-devel, kernel-ppc64-extra, kernel-ppc64-hmac, kernel-source, kernel-source-debuginfo, kernel-source-vanilla, kernel-syms, kernel-trace, kernel-trace-base, kernel-trace-debuginfo, kernel-trace-debugsource, kernel-trace-devel, kernel-trace-extra, kernel-trace-hmac, ocfs2-kmp-default, ocfs2-kmp-ppc64, ocfs2-kmp-trace
Products:
SLE-DEBUGINFO 11-SP3 (ppc64)
SLE-HAE 11-SP3 (ppc64)
SLE-SERVER 11-SP3 (ppc64)

Comment 31 Swamp Workflow Management 2014-02-04 19:44:58 UTC

Update released for: cluster-network-kmp-default, cluster-network-kmp-pae, cluster-network-kmp-trace, cluster-network-kmp-xen, gfs2-kmp-default, gfs2-kmp-pae, gfs2-kmp-trace, gfs2-kmp-xen, kernel-default, kernel-default-base, kernel-default-debuginfo, kernel-default-debugsource, kernel-default-devel, kernel-default-devel-debuginfo, kernel-default-extra, kernel-default-hmac, kernel-desktop-devel, kernel-ec2, kernel-ec2-base, kernel-ec2-debuginfo, kernel-ec2-debugsource, kernel-ec2-devel, kernel-ec2-devel-debuginfo, kernel-ec2-extra, kernel-ec2-hmac, kernel-pae, kernel-pae-base, kernel-pae-debuginfo, kernel-pae-debugsource, kernel-pae-devel, kernel-pae-devel-debuginfo, kernel-pae-extra, kernel-pae-hmac, kernel-source, kernel-source-debuginfo, kernel-source-vanilla, kernel-syms, kernel-trace, kernel-trace-base, kernel-trace-debuginfo, kernel-trace-debugsource, kernel-trace-devel, kernel-trace-devel-debuginfo, kernel-trace-extra, kernel-trace-hmac, kernel-xen, kernel-xen-base, kernel-xen-debuginfo, kernel-xen-debugsource, kernel-xen-devel, kernel-xen-devel-debuginfo, kernel-xen-extra, kernel-xen-hmac, ocfs2-kmp-default, ocfs2-kmp-pae, ocfs2-kmp-trace, ocfs2-kmp-xen, xen-kmp-default, xen-kmp-pae, xen-kmp-trace
Products:
SLE-DEBUGINFO 11-SP3 (i386)
SLE-DESKTOP 11-SP3 (i386)
SLE-HAE 11-SP3 (i386)
SLE-SERVER 11-SP3 (i386)
SLES4VMWARE 11-SP3 (i386)

Comment 32 Swamp Workflow Management 2014-02-04 20:15:56 UTC

Update released for: cluster-network-kmp-default, cluster-network-kmp-trace, cluster-network-kmp-xen, gfs2-kmp-default, gfs2-kmp-trace, gfs2-kmp-xen, kernel-default, kernel-default-base, kernel-default-debuginfo, kernel-default-debugsource, kernel-default-devel, kernel-default-devel-debuginfo, kernel-default-extra, kernel-default-hmac, kernel-desktop-devel, kernel-ec2, kernel-ec2-base, kernel-ec2-debuginfo, kernel-ec2-debugsource, kernel-ec2-devel, kernel-ec2-devel-debuginfo, kernel-ec2-extra, kernel-ec2-hmac, kernel-source, kernel-source-debuginfo, kernel-source-vanilla, kernel-syms, kernel-trace, kernel-trace-base, kernel-trace-debuginfo, kernel-trace-debugsource, kernel-trace-devel, kernel-trace-devel-debuginfo, kernel-trace-extra, kernel-trace-hmac, kernel-xen, kernel-xen-base, kernel-xen-debuginfo, kernel-xen-debugsource, kernel-xen-devel, kernel-xen-devel-debuginfo, kernel-xen-extra, kernel-xen-hmac, ocfs2-kmp-default, ocfs2-kmp-trace, ocfs2-kmp-xen, xen-kmp-default, xen-kmp-trace
Products:
SLE-DEBUGINFO 11-SP3 (x86_64)
SLE-DESKTOP 11-SP3 (x86_64)
SLE-HAE 11-SP3 (x86_64)
SLE-SERVER 11-SP3 (x86_64)
SLES4VMWARE 11-SP3 (x86_64)

Comment 33 Swamp Workflow Management 2014-02-05 01:31:19 UTC

Update released for: kernel-default-extra, kernel-ppc64-extra
Products:
SLE-SERVER 11-EXTRA (ppc64)

Comment 34 Swamp Workflow Management 2014-02-05 01:58:35 UTC

SUSE-SU-2014:0189-1: An update that solves 17 vulnerabilities and has 104 fixes is now available.

Category: security (moderate)
Bug References: 708296,733022,769035,769644,770541,787843,789359,793727,798050,805114,805740,806988,807434,810323,813245,818064,818545,819979,820102,820338,820434,821619,821980,823618,825006,825696,825896,826602,826756,826978,827527,827767,828236,831103,833097,834473,834708,834808,835074,835186,836718,837206,837739,838623,839407,839973,840116,840226,841445,841654,842239,843185,843419,843429,843445,843642,843645,843654,845352,845378,845621,845729,846036,846298,846654,846984,846989,847261,847660,847842,848055,848317,848321,848335,848336,848544,848652,848864,849021,849029,849034,849256,849362,849364,849404,849675,849809,849855,849950,850072,850103,850324,850493,850640,851066,851101,851290,851314,851603,851879,852153,852373,852558,852559,852624,852652,852761,853050,853051,853052,853053,853428,853465,854516,854546,854634,854722,856307,856481,858534,858831
CVE References: CVE-2013-2146,CVE-2013-2930,CVE-2013-4345,CVE-2013-4483,CVE-2013-4511,CVE-2013-4514,CVE-2013-4515,CVE-2013-4587,CVE-2013-4592,CVE-2013-6367,CVE-2013-6368,CVE-2013-6376,CVE-2013-6378,CVE-2013-6380,CVE-2013-6383,CVE-2013-6463,CVE-2013-7027
Sources used:
SUSE Linux Enterprise Server 11 SP3 for VMware (src):    kernel-default-3.0.101-0.15.1, kernel-pae-3.0.101-0.15.1, kernel-source-3.0.101-0.15.1, kernel-syms-3.0.101-0.15.1, kernel-trace-3.0.101-0.15.1, kernel-xen-3.0.101-0.15.1
SUSE Linux Enterprise Server 11 SP3 (src):    kernel-default-3.0.101-0.15.1, kernel-ec2-3.0.101-0.15.1, kernel-pae-3.0.101-0.15.1, kernel-ppc64-3.0.101-0.15.1, kernel-source-3.0.101-0.15.1, kernel-syms-3.0.101-0.15.1, kernel-trace-3.0.101-0.15.1, kernel-xen-3.0.101-0.15.1, xen-4.2.3_08-0.7.22
SUSE Linux Enterprise High Availability Extension 11 SP3 (src):    cluster-network-1.4-2.27.40, gfs2-2-0.16.46, ocfs2-1.6-0.20.40
SUSE Linux Enterprise Desktop 11 SP3 (src):    kernel-default-3.0.101-0.15.1, kernel-pae-3.0.101-0.15.1, kernel-source-3.0.101-0.15.1, kernel-syms-3.0.101-0.15.1, kernel-trace-3.0.101-0.15.1, kernel-xen-3.0.101-0.15.1, xen-4.2.3_08-0.7.22
SLE 11 SERVER Unsupported Extras (src):    kernel-default-3.0.101-0.15.1, kernel-pae-3.0.101-0.15.1, kernel-ppc64-3.0.101-0.15.1, kernel-xen-3.0.101-0.15.1

Comment 35 Swamp Workflow Management 2014-02-05 02:28:06 UTC

Update released for: kernel-default-extra
Products:
SLE-SERVER 11-EXTRA (ia64)

Comment 36 Swamp Workflow Management 2014-02-05 03:30:44 UTC

Update released for: kernel-default-extra, kernel-xen-extra
Products:
SLE-SERVER 11-EXTRA (x86_64)

Comment 37 Swamp Workflow Management 2014-02-05 04:33:34 UTC

Update released for: kernel-default-extra, kernel-pae-extra, kernel-xen-extra
Products:
SLE-SERVER 11-EXTRA (i386)

Comment 38 Swamp Workflow Management 2014-02-05 05:37:16 UTC

Update released for: kernel-default-extra
Products:
SLE-SERVER 11-EXTRA (s390x)

Comment 39 Swamp Workflow Management 2014-02-06 18:21:23 UTC

openSUSE-SU-2014:0204-1: An update that solves 16 vulnerabilities and has 12 fixes is now available.

Category: security (important)
Bug References: 804950,805226,808358,811746,825006,831836,838024,840226,840656,844513,848079,848255,849021,849023,849029,849034,849362,852373,852558,852559,853050,853051,853052,853053,854173,854634,854722,860993
CVE References: CVE-2013-0343,CVE-2013-1792,CVE-2013-4348,CVE-2013-4511,CVE-2013-4513,CVE-2013-4514,CVE-2013-4515,CVE-2013-4587,CVE-2013-6367,CVE-2013-6368,CVE-2013-6376,CVE-2013-6378,CVE-2013-6380,CVE-2013-6431,CVE-2013-7027,CVE-2014-0038
Sources used:
openSUSE 12.3 (src):    kernel-docs-3.7.10-1.28.2, kernel-source-3.7.10-1.28.1, kernel-syms-3.7.10-1.28.1

Comment 40 Swamp Workflow Management 2014-02-06 18:28:26 UTC

openSUSE-SU-2014:0205-1: An update that solves 8 vulnerabilities and has 13 fixes is now available.

Category: security (important)
Bug References: 733022,773058,838024,844513,845621,846529,848042,849021,850072,852652,852656,852931,853050,853051,853052,853053,854175,854722,856294,859804,860993
CVE References: CVE-2013-4511,CVE-2013-4563,CVE-2013-4587,CVE-2013-6367,CVE-2013-6368,CVE-2013-6376,CVE-2013-6432,CVE-2014-0038
Sources used:
openSUSE 13.1 (src):    kernel-docs-3.11.10-7.3, kernel-source-3.11.10-7.1, kernel-syms-3.11.10-7.1

Comment 42 Swamp Workflow Management 2014-02-18 12:24:43 UTC

openSUSE-SU-2014:0247-1: An update that solves 11 vulnerabilities and has 62 fixes is now available.

Category: security (moderate)
Bug References: 610783,708296,769644,787843,789359,798050,798466,806988,807434,810323,813245,818545,819979,820102,820338,821980,823618,825696,825896,826602,826756,827767,828236,831168,834473,834708,834808,835074,835186,836718,837739,838623,839407,840226,841445,842239,843419,843429,843445,843642,843645,845621,845729,846036,846984,847261,848321,848336,848544,848652,849021,849029,849034,849404,849675,849809,849848,849950,850640,851066,851314,852373,852558,852559,852624,853050,853051,853052,854546,854634,854722,855037,858831
CVE References: CVE-2013-4483,CVE-2013-4511,CVE-2013-4514,CVE-2013-4515,CVE-2013-4587,CVE-2013-4592,CVE-2013-6367,CVE-2013-6368,CVE-2013-6378,CVE-2013-6380,CVE-2013-7027
Sources used:
openSUSE 11.4 (src):    kernel-docs-3.0.101-79.2, kernel-source-3.0.101-79.1, kernel-syms-3.0.101-79.1, preload-1.2-6.57.2

Comment 46 Jiri Bohac 2014-07-04 16:44:47 UTC

Created attachment 597358 [details]
SLES10-SP3-TD patch

Instead of backporting the upstream fix, I went over all the protocols in SLES10-SP3-TD and SLE11-SP1-TD and checked their recvmsg handlers. I only found a few that needed fixing.

Comment 47 Jiri Bohac 2014-07-04 16:45:44 UTC

Created attachment 597359 [details]
SLE11-SP1-TD patch

Comment 49 Michal Hocko 2014-07-07 12:13:56 UTC

pushed to SLES10-SP3-TD and SLE11-SP1-TD branches. Thanks a lot Jiri!

Comment 51 Jiri Bohac 2014-07-08 08:33:02 UTC

Created attachment 597612 [details]
fixed SLE11-SP1-TD patch

Somehow I corrupted the SLE11-SP1-TD patch in Comment $47 while hand-editing it.
This is a fixed version of the patch from Comment #47. 
Sorry for the noise!

Comment 52 Michal Hocko 2014-07-08 09:42:47 UTC

applied. Thanks

Comment 55 Swamp Workflow Management 2014-07-09 10:24:26 UTC

An update workflow for this issue was started.
This issue was rated as important.
Please submit fixed packages until 2014-07-16.
When done, reassign the bug to security-team@suse.de.
https://swamp.suse.de/webswamp/wf/58208

Comment 56 Swamp Workflow Management 2014-07-10 09:32:45 UTC

An update workflow for this issue was started.
This issue was rated as important.
Please submit fixed packages until 2014-07-17.
When done, reassign the bug to security-team@suse.de.
https://swamp.suse.de/webswamp/wf/58234

Comment 58 Swamp Workflow Management 2014-07-11 10:04:53 UTC

Update released for: kernel-debug, kernel-debug-debuginfo, kernel-default, kernel-default-debuginfo, kernel-dummy, kernel-kdump, kernel-kdump-debuginfo, kernel-smp, kernel-smp-debuginfo, kernel-source, kernel-source-debuginfo, kernel-syms, kernel-xen, kernel-xen-debuginfo
Products:
SLE-SERVER 10-SP3-TERADATA (x86_64)

Comment 59 Marcus Meissner 2014-07-25 14:22:35 UTC

(This bug addresses

- CVE-2013-7266 (drivers/isdn/mISDN/socket.c)
- CVE-2013-7267 (net/appletalk/ddp.c)
- CVE-2013-7268 (net/ipx/af_ipx.c)
- CVE-2013-7269 (net/netrom/af_netrom.c)
- CVE-2013-7270 (net/packet/af_packet.c)
- CVE-2013-7271 (net/x25/af_x25.c)

)

Comment 60 Victor Pereira 2014-07-30 12:35:32 UTC

fixed and released

Comment 61 Swamp Workflow Management 2014-08-27 10:28:14 UTC

An update workflow for this issue was started.
This issue was rated as important.
Please submit fixed packages until 2014-09-03.
When done, reassign the bug to security-team@suse.de.
https://swamp.suse.de/webswamp/wf/58726

Comment 62 Swamp Workflow Management 2014-09-16 17:05:37 UTC

SUSE-SU-2014:1138-1: An update that fixes 22 vulnerabilities is now available.

Category: security (important)
Bug References: 794824,806431,831058,854722,856756,871797,877257,879921,880484,881051,882809,883526,883724,883795,884530,885422,885725,887082,889173,892490
CVE References: CVE-2013-1860,CVE-2013-4162,CVE-2013-7266,CVE-2013-7267,CVE-2013-7268,CVE-2013-7269,CVE-2013-7270,CVE-2013-7271,CVE-2014-0203,CVE-2014-3144,CVE-2014-3145,CVE-2014-3917,CVE-2014-4508,CVE-2014-4652,CVE-2014-4653,CVE-2014-4654,CVE-2014-4655,CVE-2014-4656,CVE-2014-4667,CVE-2014-4699,CVE-2014-4943,CVE-2014-5077
Sources used:
SUSE Linux Enterprise Server 11 SP1 LTSS (src):    kernel-default-2.6.32.59-0.15.2, kernel-ec2-2.6.32.59-0.15.2, kernel-pae-2.6.32.59-0.15.2, kernel-source-2.6.32.59-0.15.2, kernel-syms-2.6.32.59-0.15.2, kernel-trace-2.6.32.59-0.15.2, kernel-xen-2.6.32.59-0.15.2, xen-4.0.3_21548_16-0.5.26
SLE 11 SERVER Unsupported Extras (src):    kernel-default-2.6.32.59-0.15.2, kernel-pae-2.6.32.59-0.15.2, kernel-xen-2.6.32.59-0.15.2

Comment 63 Swamp Workflow Management 2014-09-28 16:05:27 UTC

openSUSE-SU-2014:1246-1: An update that solves 18 vulnerabilities and has 8 fixes is now available.

Category: security (moderate)
Bug References: 846404,854722,864464,866911,870173,870576,871676,871797,871854,872634,873374,876590,877257,878115,878509,879921,880484,881051,882804,883724,883795,885422,885725,886474,889173,889324
CVE References: CVE-2013-6463,CVE-2014-0055,CVE-2014-0077,CVE-2014-1739,CVE-2014-2706,CVE-2014-2851,CVE-2014-3144,CVE-2014-3145,CVE-2014-3917,CVE-2014-4508,CVE-2014-4652,CVE-2014-4653,CVE-2014-4654,CVE-2014-4655,CVE-2014-4656,CVE-2014-4667,CVE-2014-4699,CVE-2014-5077
Sources used:
openSUSE Evergreen 11.4 (src):    kernel-docs-3.0.101-91.2, kernel-source-3.0.101-91.1, kernel-syms-3.0.101-91.1, preload-1.2-6.69.2

Comment 64 Swamp Workflow Management 2015-04-30 19:11:15 UTC

SUSE-SU-2015:0812-1: An update that fixes 39 vulnerabilities is now available.

Category: security (important)
Bug References: 677286,679812,681175,681999,683282,685402,687812,730118,730200,738400,758813,760902,769784,823260,846404,853040,854722,863335,874307,875051,880484,883223,883795,885422,891844,892490,896390,896391,896779,902346,907818,908382,910251,911325
CVE References: CVE-2011-1090,CVE-2011-1163,CVE-2011-1476,CVE-2011-1477,CVE-2011-1493,CVE-2011-1494,CVE-2011-1495,CVE-2011-1585,CVE-2011-4127,CVE-2011-4132,CVE-2011-4913,CVE-2011-4914,CVE-2012-2313,CVE-2012-2319,CVE-2012-3400,CVE-2012-6657,CVE-2013-2147,CVE-2013-4299,CVE-2013-6405,CVE-2013-6463,CVE-2014-0181,CVE-2014-1874,CVE-2014-3184,CVE-2014-3185,CVE-2014-3673,CVE-2014-3917,CVE-2014-4652,CVE-2014-4653,CVE-2014-4654,CVE-2014-4655,CVE-2014-4656,CVE-2014-4667,CVE-2014-5471,CVE-2014-5472,CVE-2014-9090,CVE-2014-9322,CVE-2014-9420,CVE-2014-9584,CVE-2015-2041
Sources used:
SUSE Linux Enterprise Server 10 SP4 LTSS (src):    kernel-bigsmp-2.6.16.60-0.132.1, kernel-debug-2.6.16.60-0.132.1, kernel-default-2.6.16.60-0.132.1, kernel-kdump-2.6.16.60-0.132.1, kernel-kdumppae-2.6.16.60-0.132.1, kernel-smp-2.6.16.60-0.132.1, kernel-source-2.6.16.60-0.132.1, kernel-syms-2.6.16.60-0.132.1, kernel-vmi-2.6.16.60-0.132.1, kernel-vmipae-2.6.16.60-0.132.1, kernel-xen-2.6.16.60-0.132.1, kernel-xenpae-2.6.16.60-0.132.1