SUSE-SU-2016:2011-1

CVE-2016-4470: The key_reject_and_link function in security/keys/key.c in the Linux kernel did not ensure that a certain data structure is initialized, which allowed local users to cause a denial of service (system crash) via vectors involving a crafted keyctl request2 command (bsc#984764).
CVE-2016-4565: The InfiniBand (aka IB) stack in the Linux kernel incorrectly relied on the write system call, which allowed local users to cause a denial of service (kernel memory write operation) or possibly have unspecified other impact via a uAPI interface (bsc#980883).
CVE-2016-0758: Integer overflow in lib/asn1_decoder.c in the Linux kernel allowed local users to gain privileges via crafted ASN.1 data (bsc#980856).
CVE-2016-2053: The asn1_ber_decoder function in lib/asn1_decoder.c in the Linux kernel allowed attackers to cause a denial of service (panic) via an ASN.1 BER file that lacks a public key, leading to mishandling by the public_key_verify_signature function in crypto/asymmetric_keys/public_key.c (bsc#979074).

References

Affected packages

SUSE:Linux Enterprise Live Patching 12 / kgraft-patch-SLE12-SP1_Update_6

Package

Name: kgraft-patch-SLE12-SP1_Update_6
Purl: pkg:rpm/suse/kgraft-patch-SLE12-SP1_Update_6&distro=SUSE%20Linux%20Enterprise%20Live%20Patching%2012

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2-2.2

Ecosystem specific

{
    "binaries": [
        {
            "kgraft-patch-3_12_59-60_45-default": "2-2.2",
            "kgraft-patch-3_12_59-60_45-xen": "2-2.2"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2016:2011-1.json"