[LU-11173] kernel update [SLES12 SP3 4.4.140-94.42.1]

• Type: Bug
• Resolution: Won't Fix
• Priority: Minor
• Severity: 3
• Assignee: Jian Yu
• Reporter: Jian Yu

Description

The SUSE Linux Enterprise 12 SP3 kernel was updated to 4.4.140 to receive
various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-13053: The alarm_timer_nsleep function had an integer overflow
  via a large relative timeout because ktime_add_safe was not used
  (bnc#1099924)
• CVE-2018-9385: Prevent overread of the "driver_override" buffer
  (bsc#1100491)
• CVE-2018-13405: The inode_init_owner function allowed local users to
  create files with an unintended group ownership allowing attackers to
  escalate privileges by making a plain file executable and SGID
  (bnc#1100416)
• CVE-2018-13406: An integer overflow in the uvesafb_setcmap function
  could have result in local attackers being able to crash the kernel or
  potentially elevate privileges because kmalloc_array is not used
  (bnc#1100418)

For fixed non-security bugs, please refer to:

http://lists.suse.com/pipermail/sle-security-updates/2018-July/004305.html

Issue Links

• is related to: LU-11255 kernel update [SLES12 SP3 4.4.143-94.47.1]
• is related to: LU-11065 kernel update [SLES12 SP3 4.4.132-94.33]