Описание
Security update for the Linux Kernel (Live Patch 0 for SLE 15 SP1)
This update for the Linux Kernel 4.12.14-195 fixes several issues.
The following security issues were fixed:
- CVE-2019-13272: Fixed a privilege escalation from user to root due to improper handling of credentials by leveraging certain scenarios with a parent-child process relationship (bsc#1156321).
- CVE-2019-10220: Fixed an issue where samba servers could inject relative paths in directory entry lists (bsc#1153108).
Список пакетов
SUSE Linux Enterprise Live Patching 15
SUSE Linux Enterprise Live Patching 15 SP1
Ссылки
- Link for SUSE-SU-2019:3248-1
- E-Mail link for SUSE-SU-2019:3248-1
- SUSE Security Ratings
- SUSE Bug 1153108
- SUSE Bug 1156321
- SUSE CVE CVE-2019-10220 page
- SUSE CVE CVE-2019-13272 page
Описание
Linux kernel CIFS implementation, version 4.9.0 is vulnerable to a relative paths injection in directory entry lists.
Затронутые продукты
Ссылки
- CVE-2019-10220
- SUSE Bug 1144903
- SUSE Bug 1153108
Описание
In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker). One contributing factor is an object lifetime issue (which can also cause a panic). Another contributing factor is incorrect marking of a ptrace relationship as privileged, which is exploitable through (for example) Polkit's pkexec helper with PTRACE_TRACEME. NOTE: SELinux deny_ptrace might be a usable workaround in some environments.
Затронутые продукты
Ссылки
- CVE-2019-13272
- SUSE Bug 1140671
- SUSE Bug 1156321
- SUSE Bug 1198122