The SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes.
The following security bugs were fixed:
CVE-2018-3620: Local attackers on baremetal systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data. (bnc#1087081).
CVE-2018-3646: Local attackers in virtualized guest systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data, even from other virtual machines or the host system. (bnc#1089343).
CVE-2018-5391 aka 'FragmentSmack': A flaw in the IP packet reassembly could be used by remote attackers to consume lots of CPU time (bnc#1103097).
CVE-2018-10876: A flaw was found in the ext4 filesystem code. A use-after-free is possible in ext4extremove_space() function when mounting and operating a crafted ext4 image. (bnc#1099811)
CVE-2018-10877: The ext4 filesystem is vulnerable to an out-of-bound access in the ext4extdrop_refs() function when operating on a crafted ext4 filesystem image. (bnc#1099846)
CVE-2018-10878: A flaw was found in the ext4 filesystem. A local user can cause an out-of-bounds write and a denial of service or unspecified other impact is possible by mounting and operating a crafted ext4 filesystem image. (bnc#1099813)
CVE-2018-10879: A flaw was found in the ext4 filesystem. A local user can cause a use-after-free in ext4xattrset_entry function and a denial of service or unspecified other impact may occur by renaming a file in a crafted ext4 filesystem image. (bnc#1099844)
CVE-2018-10880: Linux kernel is vulnerable to a stack-out-of-bounds write in the ext4 filesystem code when mounting and writing to a crafted ext4 image in ext4updateinline_data(). An attacker could use this to cause a system crash and a denial of service. (bnc#1099845)
CVE-2018-10881: A flaw was found in the ext4 filesystem. A local user can cause an out-of-bound access in ext4getgroup_info function, a denial of service, and a system crash by mounting and operating on a crafted ext4 filesystem image. (bnc#1099864)
CVE-2018-10882: A flaw was found in the ext4 filesystem. A local user can cause an out-of-bound write in in fs/jbd2/transaction.c code, a denial of service, and a system crash by unmounting a crafted ext4 filesystem image. (bnc#1099849)
CVE-2018-10883: A flaw was found in the ext4 filesystem. A local user can cause an out-of-bounds write in jbd2journaldirty_metadata(), a denial of service, and a system crash by mounting and operating on a crafted ext4 filesystem image. (bnc#1099863)
The following non-security bugs were fixed:
acpi / lpss: Only call pwmaddtable() for Bay Trail PWM if PMIC HRV is 2 (bsc#1051510).
afkey: Always verify length of provided sadbkey (bsc#1051510).
afkey: fix buffer overread in parseexthdrs() (bsc#1051510).
afkey: fix buffer overread in verifyaddress_len() (bsc#1051510).