<?xml version="1.0" encoding="UTF-8"?>
<cvrfdoc xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:cvrf="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf" xmlns:cvrf-common="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/common" xmlns:cvssv2="http://scap.nist.gov/schema/cvss-v2/1.0" xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:ns0="http://purl.org/dc/elements/1.1/" xmlns:prod="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod" xmlns:scap-core="http://scap.nist.gov/schema/scap-core/1.0" xmlns:sch="http://purl.oclc.org/dsdl/schematron" xmlns:vuln="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf">
  <DocumentTitle xml:lang="en">Security update for the Linux Kernel (Live Patch 25 for SLE 12)</DocumentTitle>
  <DocumentType>SUSE Patch</DocumentType>
  <DocumentPublisher Type="Vendor">
    <ContactDetails>security@suse.de</ContactDetails>
    <IssuingAuthority>SUSE Security Team</IssuingAuthority>
  </DocumentPublisher>
  <DocumentTracking>
    <Identification>
      <ID>SUSE-SU-2018:1261-1</ID>
    </Identification>
    <Status>Final</Status>
    <Version>1</Version>
    <RevisionHistory>
      <Revision>
        <Number>1</Number>
        <Date>2018-05-11T17:49:26Z</Date>
        <Description>current</Description>
      </Revision>
    </RevisionHistory>
    <InitialReleaseDate>2018-05-11T17:49:26Z</InitialReleaseDate>
    <CurrentReleaseDate>2018-05-11T17:49:26Z</CurrentReleaseDate>
    <Generator>
      <Engine>cve-database/bin/generate-cvrf.pl</Engine>
      <Date>2017-02-24T01:00:00Z</Date>
    </Generator>
  </DocumentTracking>
  <DocumentNotes>
    <Note Title="Topic" Type="Summary" Ordinal="1" xml:lang="en">Security update for the Linux Kernel (Live Patch 25 for SLE 12)</Note>
    <Note Title="Details" Type="General" Ordinal="2" xml:lang="en">This update for the Linux Kernel 3.12.61-52_86 fixes several issues.

The following security issues were fixed:

- CVE-2018-1000199: A bug in x86 debug register handling of ptrace() could lead to memory corruption, possibly a denial of service or privilege escalation (bsc#1090036). 
- CVE-2017-0861: Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem in the Linux kernel allowed attackers to gain privileges via unspecified vectors (bsc#1088268).
</Note>
    <Note Title="Terms of Use" Type="Legal Disclaimer" Ordinal="3" xml:lang="en">The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).</Note>
    <Note Title="Patchnames" Type="Details" Ordinal="4" xml:lang="en">SUSE-SLE-SERVER-12-2018-855</Note>
  </DocumentNotes>
  <DocumentDistribution xml:lang="en">Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0)</DocumentDistribution>
  <DocumentReferences>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/update/announcement/2018/suse-su-20181261-1/</URL>
      <Description>Link for SUSE-SU-2018:1261-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://lists.suse.com/pipermail/sle-security-updates/2018-May/004038.html</URL>
      <Description>E-Mail link for SUSE-SU-2018:1261-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/security/rating/</URL>
      <Description>SUSE Security Ratings</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1088268</URL>
      <Description>SUSE Bug 1088268</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1090036</URL>
      <Description>SUSE Bug 1090036</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2017-0861/</URL>
      <Description>SUSE CVE CVE-2017-0861 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2018-1000199/</URL>
      <Description>SUSE CVE CVE-2018-1000199 page</Description>
    </Reference>
  </DocumentReferences>
  <ProductTree xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod">
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Server 12-LTSS">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Server 12-LTSS">
        <FullProductName ProductID="SUSE Linux Enterprise Server 12-LTSS" CPE="cpe:/o:suse:sles-ltss:12">SUSE Linux Enterprise Server 12-LTSS</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Version" Name="kgraft-patch-3_12_61-52_86-default-8-2.1">
      <FullProductName ProductID="kgraft-patch-3_12_61-52_86-default-8-2.1">kgraft-patch-3_12_61-52_86-default-8-2.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="kgraft-patch-3_12_61-52_86-xen-8-2.1">
      <FullProductName ProductID="kgraft-patch-3_12_61-52_86-xen-8-2.1">kgraft-patch-3_12_61-52_86-xen-8-2.1</FullProductName>
    </Branch>
    <Relationship ProductReference="kgraft-patch-3_12_61-52_86-default-8-2.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12-LTSS">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12-LTSS:kgraft-patch-3_12_61-52_86-default-8-2.1">kgraft-patch-3_12_61-52_86-default-8-2.1 as a component of SUSE Linux Enterprise Server 12-LTSS</FullProductName>
    </Relationship>
    <Relationship ProductReference="kgraft-patch-3_12_61-52_86-xen-8-2.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12-LTSS">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12-LTSS:kgraft-patch-3_12_61-52_86-xen-8-2.1">kgraft-patch-3_12_61-52_86-xen-8-2.1 as a component of SUSE Linux Enterprise Server 12-LTSS</FullProductName>
    </Relationship>
  </ProductTree>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="1">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem in the Linux kernel allows attackers to gain privileges via unspecified vectors.</Note>
    </Notes>
    <CVE>CVE-2017-0861</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Server 12-LTSS:kgraft-patch-3_12_61-52_86-default-8-2.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12-LTSS:kgraft-patch-3_12_61-52_86-xen-8-2.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>4.6</BaseScoreV2>
        <VectorV2>AV:L/AC:L/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>7</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2018/suse-su-20181261-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2017-0861.html</URL>
        <Description>CVE-2017-0861</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1088260</URL>
        <Description>SUSE Bug 1088260</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1088268</URL>
        <Description>SUSE Bug 1088268</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1091815</URL>
        <Description>SUSE Bug 1091815</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1115893</URL>
        <Description>SUSE Bug 1115893</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="2">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">The Linux Kernel version 3.18 contains a dangerous feature vulnerability in modify_user_hw_breakpoint() that can result in crash and possibly memory corruption. This attack appear to be exploitable via local code execution and the ability to use ptrace. This vulnerability appears to have been fixed in git commit f67b15037a7a50c57f72e69a6d59941ad90a0f0f.</Note>
    </Notes>
    <CVE>CVE-2018-1000199</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Server 12-LTSS:kgraft-patch-3_12_61-52_86-default-8-2.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12-LTSS:kgraft-patch-3_12_61-52_86-xen-8-2.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>4.9</BaseScoreV2>
        <VectorV2>AV:L/AC:L/Au:N/C:N/I:N/A:C</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>7.1</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2018/suse-su-20181261-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2018-1000199.html</URL>
        <Description>CVE-2018-1000199</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1089895</URL>
        <Description>SUSE Bug 1089895</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1090036</URL>
        <Description>SUSE Bug 1090036</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
</cvrfdoc>
