File _patchinfo of Package patchinfo.14948
<patchinfo incident="14948"> <issue id="1037216" tracker="bnc">netns add intermittently hangs until killed, requiring reboot</issue> <issue id="1075091" tracker="bnc">Need updated kernel to set spec_control kernel flags correctly</issue> <issue id="1075994" tracker="bnc">cpuflag spec_ctrl always present, also when running nospec on kernel command line</issue> <issue id="1087082" tracker="bnc">VUL-0: CVE-2018-3639: V4 - Speculative Store Bypass aka "Memory Disambiguation"</issue> <issue id="1087813" tracker="bnc">VUL-0: CVE-2017-18255: kernel-source: The perf_cpu_time_max_percent_handler function in kernel/events/core.c inthe Linux kernel before 4.11 allows local users to cause a denial ofservice (integer overflow) or possibly have unspecified oth</issue> <issue id="1091041" tracker="bnc">[CVE] Additional Meltdown kernel fixes for POWER for SLES12 SP3</issue> <issue id="1099279" tracker="bnc">fs/binfmt_misc.c: do not allow offset overflow</issue> <issue id="1120386" tracker="bnc">VUL-0: CVE-2019-3701: kernel: crash in CAN driver</issue> <issue id="1131107" tracker="bnc">SLES 15 SP1 - Kernel changes for count cache flush Spectre v2 mitigation</issue> <issue id="1133147" tracker="bnc">SLES12sp2: Customer has experienced multiple cores with kernel "4.4.121-92.98.1.16903.0.PTF.1120691-default"</issue> <issue id="1136449" tracker="bnc">[PATCH] ext4: fix use-after-free race with debug_want_extra_isize</issue> <issue id="1137325" tracker="bnc">L3-Question: ipvlan adds MAC of parent device for vmxnet3</issue> <issue id="1146519" tracker="bnc">VUL-0: CVE-2019-15211: kernel-source: use-after-free in drivers/media/v4l2-core/v4l2-dev.c</issue> <issue id="1146544" tracker="bnc">VUL-1: CVE-2019-15213: kernel-source: use-after-free caused by malicious USB device in drivers/media/usb/dvb-usb/dvb-usb-init.c</issue> <issue id="1146612" tracker="bnc">kernel BUG at ../net/netfilter/nf_nat_core.c:394! in nf_nat_setup_info()</issue> <issue id="1149591" tracker="bnc">VUL-0: CVE-2018-21008: kernel-source: use-after-free can be caused by the function rsi_mac80211_detach in the file drivers/net/wireless/rsi/rsi_91x_mac80211.c</issue> <issue id="1153811" tracker="bnc">domain_crash_sync called from entry.S: fault at ffff82d08035ae80 x86_64/entry.S#create_bounce_frame+0x67/0x147</issue> <issue id="1154844" tracker="bnc">NFS/UDP fragmentation with MTU=5000</issue> <issue id="1155311" tracker="bnc">L3-Question: btrfs balance causing outage</issue> <issue id="1155897" tracker="bnc">VUL-1: CVE-2019-18683: kernel-source: Exploitable bugs in drivers/media/platform/vivid</issue> <issue id="1156060" tracker="bnc">Offset overflow in fs/binfmt_misc.c</issue> <issue id="1157038" tracker="bnc">VUL-0: CVE-2019-18660: kernel-source: kernel for powerpc fails to activate the mitigation for Spectre-RSB</issue> <issue id="1157042" tracker="bnc">VUL-0: CVE-2019-14901: kernel-source: overflow in mwifiex_process_tdls_action_frame function in marvell/mwifiex/tdls.c of Marvell Wifi Driver</issue> <issue id="1157070" tracker="bnc">VUL-1: CVE-2019-19073: kernel-source: Memory leaks in drivers/net/wireless/ath/ath9k/htc_hst.c allow attackers to cause a denial of service (memory consumption) by triggering wait_for_completion_timeout()</issue> <issue id="1157143" tracker="bnc">VUL-0: CVE-2019-19074: kernel-source: A memory leak in the ath9k_wmi_cmd() function in drivers/net/wireless/ath/ath9k/wmi.c allows attackers to cause a denial of service (memory consumption)</issue> <issue id="1157155" tracker="bnc">VUL-0: CVE-2019-14897: kernel-source: Stack Overflow in lbs_ibss_join_existing() function of Marvell Wifi Driver</issue> <issue id="1157157" tracker="bnc">VUL-0: CVE-2019-14896: kernel-source: Heap Overflow in add_ie_rates() function of Marvell Wifi Driver</issue> <issue id="1157158" tracker="bnc">VUL-0: CVE-2019-14895: kernel-source: Heap Overflow in mwifiex_process_country_ie() function of Marvell Wifi Driver</issue> <issue id="1157303" tracker="bnc">VUL-1: CVE-2019-19066: kernel-source: memory leak in the bfad_im_get_stats() function in drivers/scsi/bfa/bfad_attr.c</issue> <issue id="1157324" tracker="bnc">VUL-1: CVE-2019-19052: kernel-source: memory leak in the gs_can_open() function in drivers/net/can/usb/gs_usb.c</issue> <issue id="1157333" tracker="bnc">VUL-1: CVE-2019-19062: kernel-source: memory leak in the crypto_report() function in crypto/crypto_user_base.c</issue> <issue id="1157464" tracker="bnc">futexes are slow on 4.12 kernel</issue> <issue id="1157804" tracker="bnc">VUL-0: CVE-2019-18675: kernel-source: Integer Overflow in cpia2_remap_buffer in drivers/media/usb/cpia2/cpia2_core.c, allowing local users to obtain read/write permissions on kernel memory</issue> <issue id="1157923" tracker="bnc">SLES 11 SP4 / SLES 12 SP3/SP4/SP5 / SLES 15 / SLES 15 SP1/SP2- powerpc/book3s64: Fix link stack flush on context switch (CVE-2019-18660)</issue> <issue id="1158021" tracker="bnc">VUL-0: CVE-2019-19319: kernel-source: setxattr operation, after a mount of a crafted ext4 image, can cause a slab-out-of-bounds write access</issue> <issue id="1158132" tracker="bnc">SLES12 SP3 (retail kernel) panic in pick_next_entity</issue> <issue id="1158381" tracker="bnc">VUL-1: CVE-2019-19529: kernel-source: use-after-free bug that can be caused by a malicious USB device in the drivers/net/can/usb/mcba_usb.c driver, aka CID-4d6636498c41</issue> <issue id="1158394" tracker="bnc">VUL-1: CVE-2019-19536: kernel-source: uninitialized Kernel memory can leak to USB devices in drivers/net/can/usb/peak_usb/pcan_usb_pro.c, aka CID-ead16e53c2f0</issue> <issue id="1158398" tracker="bnc">VUL-1: CVE-2019-19534: kernel-source: uninitialized Kernel memory can leak to USB devices in drivers/net/can/usb/peak_usb/pcan_usb_core.c, aka CID-f7a1337f0d29</issue> <issue id="1158410" tracker="bnc">VUL-1: CVE-2019-19530: kernel-source: use-after-free bug that can be caused by a malicious USB device in the drivers/usb/class/cdc-acm.c driver, aka CID-c52873e5a1ef</issue> <issue id="1158413" tracker="bnc">VUL-1: CVE-2019-19524: kernel-source: use-after-free bug that can be caused by a malicious USB device in the drivers/input/ff-memless.c driver, aka CID-fa3a5a1880c9</issue> <issue id="1158417" tracker="bnc">VUL-1: CVE-2019-19525: kernel-source: use-after-free bug that can be caused by a malicious USB device in the drivers/net/ieee802154/atusb.c driver, aka CID-7fd25e6fc035</issue> <issue id="1158427" tracker="bnc">VUL-1: CVE-2019-19543: kernel-source: use-after-free in serial_ir_init_module() in drivers/media/rc/serial_ir.c</issue> <issue id="1158445" tracker="bnc">VUL-1: CVE-2019-19531: kernel-source: use-after-free in yurex_delete may lead to denial of service</issue> <issue id="1158819" tracker="bnc">VUL-0: CVE-2019-19447: kernel-source: mounting a crafted ext4 filesystem image, performing some operations, and unmounting can lead to a use-after-free in ext4_put_super in fs/ext4/super.c</issue> <issue id="1158823" tracker="bnc">VUL-0: CVE-2019-19523: kernel-source: USB: adutux: fix use-after-free on disconnect</issue> <issue id="1158824" tracker="bnc">VUL-0: CVE-2019-19532: kernel-source: USB: multiple out-of-bounds write bugs that can be caused by a malicious USB device in the Linux kernel HID drivers, aka CID-d9d4b1e46d95</issue> <issue id="1158827" tracker="bnc">VUL-0: CVE-2019-19332: kernel-source: kvm: OOB memory write via kvm_dev_ioctl_get_cpuid</issue> <issue id="1158834" tracker="bnc">VUL-1: CVE-2019-19533: kernel-source: info-leak bug that can be caused by a malicious USB device in the drivers/media/usb/ttusb-dec/ttusb_dec.c driver, aka CID-a10feaf8c464</issue> <issue id="1158900" tracker="bnc">VUL-0: CVE-2019-19527: kernel-source: use-after-free bug that can be caused by a malicious USB device in the drivers/hid/usbhid/hiddev.c driver, aka CID-9c09b214f30e</issue> <issue id="1158903" tracker="bnc">VUL-1: CVE-2019-19535: kernel-source: info-leak bug that can be caused by a malicious USB device in the drivers/net/can/usb/peak_usb/pcan_usb_fd.c driver, aka CID-30a8beeb3042</issue> <issue id="1158904" tracker="bnc">VUL-0: CVE-2019-19537: kernel-source: two races in the USB character device registration and deregistration routines, aka CID-303911cfc5b9</issue> <issue id="1159199" tracker="bnc">SCTP conntrack incorrect behaviour</issue> <issue id="1159285" tracker="bnc">VUL-1: CVE-2019-19768: kernel-source: use-after-free (read) in the __blk_add_trace function in kernel/trace/blktrace.c</issue> <issue id="1159297" tracker="bnc">VUL-1: CVE-2019-19767: kernel-source: improper handling of ext4_expand_extra_isize</issue> <issue id="1159841" tracker="bnc">VUL-1: CVE-2019-19966: kernel-source: use-after-free in cpia2_exit() in drivers/media/usb/cpia2/cpia2_v4l.c that will cause denial of service</issue> <issue id="1159908" tracker="bnc">VUL-1: CVE-2019-20096: kernel-source: memory leak in __feat_register_sp() in net/dccp/feat.c, which may cause denial of service, aka CID-1d3ff0950e2b.</issue> <issue id="1159910" tracker="bnc">VUL-1: CVE-2019-20054: kernel-source: NULL pointer dereference in drop_sysctl_table() in fs/proc/proc_sysctl.c, related to put_links, aka CID-23da9588037e.</issue> <issue id="1159911" tracker="bnc">VUL-1: CVE-2019-19965: kernel-source: NULL pointer dereference in drivers/scsi/libsas/sas_discover.c because of mishandling of port disconnection during discovery, related to a PHY down race con</issue> <issue id="1159912" tracker="bnc">VUL-0: CVE-2019-5108: kernel-source: exploitable denial-of-service vulnerability by triggering AP to send IAPP location updates for stations b</issue> <issue id="1160195" tracker="bnc">VUL-0: CVE-2019-14615: kernel-source: PSIRT-TA-201910-001: Intel Gen9 Graphics Data Leakage</issue> <issue id="1162227" tracker="bnc">kernel hang due to negative <some struct net>.nf_frag.frags.mem.counters</issue> <issue id="1162298" tracker="bnc">Partner-L3: Segfault in systemd on SLES 12 SP2</issue> <issue id="1162928" tracker="bnc">VUL-1: CVE-2020-8648: kernel-source: use-after-free in the n_tty_receive_buf_common function in drivers/tty/n_tty.c</issue> <issue id="1162929" tracker="bnc">VUL-1: CVE-2020-8647: kernel-source: use-after-free in the vc_do_resize function in drivers/tty/vt/vt.c</issue> <issue id="1162931" tracker="bnc">VUL-1: CVE-2020-8649: kernel-source: use-after-free in the vgacon_invert_region function in drivers/video/console/vgacon.c</issue> <issue id="1163971" tracker="bnc">VUL-0: CVE-2020-2732: kernel-source: kvm: nested VMX vs check_intercept</issue> <issue id="1164069" tracker="bnc">VUL-1: CVE-2020-8992: kernel-source: ext4_protect_reserved_inode allows attackers to cause a denial of service (soft lockup) via a crafted journal size</issue> <issue id="1164078" tracker="bnc">fbcon: BUG: unable to handle page fault</issue> <issue id="1164846" tracker="bnc">L3-Question: syscall64 fast path removal in SLES 12 SP4/5 [ref:_00D1igLOd._5001iLi1tA:ref]</issue> <issue id="1165111" tracker="bnc">VUL-1: CVE-2020-9383: kernel-source: An issue was discovered in set_fdc in drivers/block/floppy.c leads to a wait_til_ready out-of-bounds read because the FDC index is not checked for errors</issue> <issue id="1165311" tracker="bnc">KVM host crashed Unable to handle kernel paging request at 00000005f6e3a030 Need core analyzed</issue> <issue id="1165873" tracker="bnc">fstests with xfs on xfs/512 fails</issue> <issue id="1165881" tracker="bnc">VUL-0: CVE-2020-8832: kernel-source: i915 incomplete fix for CVE-2019-14615</issue> <issue id="1165984" tracker="bnc">fstests case xfs/510 bulkstat fails on SLE12, SLE15</issue> <issue id="1165985" tracker="bnc">fstests case xfs/511 statfs project quota fails on SLE12, SLE15</issue> <issue id="1167629" tracker="bnc">VUL-0: CVE-2020-10942: kernel-source: get_raw_socket in drivers/vhost/net.c lacks validation of an sk_family field, which might allow to trigger kernel stack corruption via crafted system calls</issue> <issue id="1168075" tracker="bnc">VUL-0: CVE-2019-20636: kernel: malicious devices can corrupt kernel memory with bogus HID descriptors</issue> <issue id="1168295" tracker="bnc">VUL-0: CVE-2019-9458: kernel-source: use-after-free due to race condition in the video driver leads to local privilege escalation</issue> <issue id="1168424" tracker="bnc">VUL-1: CVE-2020-11494: kernel-source: Don't transmit uninitialized stack data in padding</issue> <issue id="1168829" tracker="bnc">VUL-1: CVE-2020-11608: kernel-source: malicious USB device pretending to be OV519 can oops the gspca driver</issue> <issue id="1168854" tracker="bnc">VUL-1: CVE-2020-11609: kernel-source: malicious USB device pretending to be GSPCA STV06 camera can oops the gspca driver</issue> <issue id="1170056" tracker="bnc">VUL-1: CVE-2020-10690: kernel: use-after-free in cdev_put() when a PTP device is removed while it's chardev is open</issue> <issue id="1170345" tracker="bnc">VUL-1: CVE-2019-9455: kernel-source: information leak due to WARN_ON statement in video driver</issue> <issue id="1170778" tracker="bnc">VUL-0: CVE-2020-10720: kernel-source: use-after-free read in napi_gro_frags()</issue> <issue id="2020-11609" tracker="cve" /> <issue id="2020-10720" tracker="cve" /> <issue id="2020-10690" tracker="cve" /> <issue id="2019-9455" tracker="cve" /> <issue id="2020-11494" tracker="cve" /> <issue id="2020-11608" tracker="cve" /> <issue id="2019-9458" tracker="cve" /> <issue id="2019-3701" tracker="cve" /> <issue id="2020-10942" tracker="cve" /> <issue id="2017-18255" tracker="cve" /> <issue id="2020-8647" tracker="cve" /> <issue id="2020-8649" tracker="cve" /> <issue id="2020-8648" tracker="cve" /> <issue id="2020-9383" tracker="cve" /> <issue id="2019-19768" tracker="cve" /> <issue id="2020-2732" tracker="cve" /> <issue id="2019-5108" tracker="cve" /> <issue id="2020-8992" tracker="cve" /> <issue id="2018-21008" tracker="cve" /> <issue id="2019-14895" tracker="cve" /> <issue id="2019-14896" tracker="cve" /> <issue id="2019-14897" tracker="cve" /> <issue id="2019-18675" tracker="cve" /> <issue id="2019-14615" tracker="cve" /> <issue id="2019-19965" tracker="cve" /> <issue id="2019-19066" tracker="cve" /> <issue id="2019-20054" tracker="cve" /> <issue id="2019-20096" tracker="cve" /> <issue id="2019-19966" tracker="cve" /> <issue id="2019-19447" tracker="cve" /> <issue id="2019-19319" tracker="cve" /> <issue id="2019-19767" tracker="cve" /> <issue id="2019-19332" tracker="cve" /> <issue id="2019-19532" tracker="cve" /> <issue id="2019-19537" tracker="cve" /> <issue id="2019-19535" tracker="cve" /> <issue id="2019-19527" tracker="cve" /> <issue id="2019-19523" tracker="cve" /> <issue id="2019-19530" tracker="cve" /> <issue id="2019-19533" tracker="cve" /> <issue id="2019-19524" tracker="cve" /> <issue id="2019-15213" tracker="cve" /> <issue id="2019-19531" tracker="cve" /> <issue id="2019-19534" tracker="cve" /> <issue id="2019-19525" tracker="cve" /> <issue id="2019-19536" tracker="cve" /> <issue id="2019-14901" tracker="cve" /> <issue id="2019-18660" tracker="cve" /> <issue id="2019-18683" tracker="cve" /> <issue id="2019-19062" tracker="cve" /> <issue id="2019-19052" tracker="cve" /> <issue id="2019-19074" tracker="cve" /> <issue id="2019-19073" tracker="cve" /> <issue id="2019-11091" tracker="cve" /> <issue id="2018-12126" tracker="cve" /> <issue id="2018-12130" tracker="cve" /> <issue id="2018-12127" tracker="cve" /> <category>security</category> <rating>important</rating> <packager>osalvador</packager> <reboot_needed/> <description>The SUSE Linux Enterprise 12 SP2 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2020-11494: An issue was discovered in slc_bump in drivers/net/can/slcan.c, which allowed attackers to read uninitialized can_frame data, potentially containing sensitive information from kernel stack memory, if the configuration lacks CONFIG_INIT_STACK_ALL (bnc#1168424). - CVE-2020-10942: In get_raw_socket in drivers/vhost/net.c lacks validation of an sk_family field, which might allow attackers to trigger kernel stack corruption via crafted system calls (bnc#1167629). - CVE-2020-8647: Fixed a use-after-free vulnerability in the vc_do_resize function in drivers/tty/vt/vt.c (bnc#1162929). - CVE-2020-8649: Fixed a use-after-free vulnerability in the vgacon_invert_region function in drivers/video/console/vgacon.c (bnc#1162931). - CVE-2020-9383: Fixed an issue in set_fdc in drivers/block/floppy.c, which leads to a wait_til_ready out-of-bounds read (bnc#1165111). - CVE-2019-9458: In the video driver there was a use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed (bnc#1168295). - CVE-2019-3701: Fixed an issue in can_can_gw_rcv, which could cause a system crash (bnc#1120386). - CVE-2019-19768: Fixed a use-after-free in the __blk_add_trace function in kernel/trace/blktrace.c (bnc#1159285). - CVE-2020-11609: Fixed a NULL pointer dereference in the stv06xx subsystem caused by mishandling invalid descriptors (bnc#1168854). - CVE-2020-10720: Fixed a use-after-free read in napi_gro_frags() (bsc#1170778). - CVE-2020-10690: Fixed the race between the release of ptp_clock and cdev (bsc#1170056). - CVE-2019-9455: Fixed a pointer leak due to a WARN_ON statement in a video driver. This could lead to local information disclosure with System execution privileges needed (bnc#1170345). - CVE-2020-11608: Fixed an issue in drivers/media/usb/gspca/ov519.c caused by a NULL pointer dereferences in ov511_mode_init_regs and ov518_mode_init_regs when there are zero endpoints (bnc#1168829). - CVE-2017-18255: The perf_cpu_time_max_percent_handler function in kernel/events/core.c allowed local users to cause a denial of service (integer overflow) or possibly have unspecified other impact via a large value, as demonstrated by an incorrect sample-rate calculation (bnc#1087813). - CVE-2020-8648: There was a use-after-free vulnerability in the n_tty_receive_buf_common function in drivers/tty/n_tty.c (bnc#1162928). - CVE-2020-2732: A flaw was discovered in the way that the KVM hypervisor handled instruction emulation for an L2 guest when nested virtualisation is enabled. Under some circumstances, an L2 guest may trick the L0 guest into accessing sensitive L1 resources that should be inaccessible to the L2 guest (bnc#1163971). - CVE-2019-5108: Fixed a denial-of-service vulnerability caused by triggering AP to send IAPP location updates for stations before the required authentication process has completed (bnc#1159912). - CVE-2020-8992: ext4_protect_reserved_inode in fs/ext4/block_validity.c allowed attackers to cause a denial of service (soft lockup) via a crafted journal size (bnc#1164069). - CVE-2018-21008: Fixed a use-after-free which could be caused by the function rsi_mac80211_detach in the file drivers/net/wireless/rsi/rsi_91x_mac80211.c (bnc#1149591). - CVE-2019-14896: A heap-based buffer overflow vulnerability was found in Marvell WiFi chip driver. A remote attacker could cause a denial of service (system crash) or, possibly execute arbitrary code, when the lbs_ibss_join_existing function is called after a STA connects to an AP (bnc#1157157). - CVE-2019-14897: A stack-based buffer overflow was found in Marvell WiFi chip driver. An attacker is able to cause a denial of service (system crash) or, possibly execute arbitrary code, when a STA works in IBSS mode (allows connecting stations together without the use of an AP) and connects to another STA (bnc#1157155). - CVE-2019-18675: Fixed an integer overflow in cpia2_remap_buffer in drivers/media/usb/cpia2/cpia2_core.c because cpia2 has its own mmap implementation. This allowed local users (with /dev/video0 access) to obtain read and write permissions on kernel physical pages, which can possibly result in a privilege escalation (bnc#1157804). - CVE-2019-14615: Insufficient control flow in certain data structures for some Intel(R) Processors with Intel(R) Processor Graphics may have allowed an unauthenticated user to potentially enable information disclosure via local access (bnc#1160195, bsc#1165881). - CVE-2019-19965: Fixed a NULL pointer dereference in drivers/scsi/libsas/sas_discover.c because of mishandling of port disconnection during discovery, related to a PHY down race condition (bnc#1159911). - CVE-2019-20054: Fixed a NULL pointer dereference in drop_sysctl_table() in fs/proc/proc_sysctl.c, related to put_links (bnc#1159910). - CVE-2019-20096: Fixed a memory leak in __feat_register_sp() in net/dccp/feat.c, which may cause denial of service (bnc#1159908). - CVE-2019-19966: Fixed a use-after-free in cpia2_exit() in drivers/media/usb/cpia2/cpia2_v4l.c that will cause denial of service (bnc#1159841). - CVE-2019-19447: Fixed an issue with mounting a crafted ext4 filesystem image, performing some operations, and unmounting could lead to a use-after-free in ext4_put_super in fs/ext4/super.c, related to dump_orphan_list in fs/ext4/super.c (bnc#1158819). - CVE-2019-19319: Fixed an issue with a setxattr operation, after a mount of a crafted ext4 image, can cause a slab-out-of-bounds write access because of an ext4_xattr_set_entry use-after-free in fs/ext4/xattr.c when a large old_size value is used in a memset call (bnc#1158021). - CVE-2019-19767: Fixed mishandling of ext4_expand_extra_isize, as demonstrated by use-after-free errors in __ext4_expand_extra_isize and ext4_xattr_set_entry, related to fs/ext4/inode.c and fs/ext4/super.c (bnc#1159297). - CVE-2019-19066: Fixed memory leak in the bfad_im_get_stats() function in drivers/scsi/bfa/bfad_attr.c that allowed attackers to cause a denial of service (memory consumption) by triggering bfa_port_get_stats() failures (bnc#1157303). - CVE-2019-19332: There was an OOB memory write via kvm_dev_ioctl_get_cpuid (bsc#1158827). - CVE-2019-19537: There was a race condition bug that could have been caused by a malicious USB device in the USB character device driver layer (bnc#1158904). - CVE-2019-19535: There was an info-leak bug that could have been caused by a malicious USB device in the drivers/net/can/usb/peak_usb/pcan_usb_fd.c driver (bnc#1158903). - CVE-2019-19527: There was a use-after-free bug that could have been caused by a malicious USB device in the drivers/hid/usbhid/hiddev.c driver (bnc#1158900). - CVE-2019-19533: There was an info-leak bug that could have been caused by a malicious USB device in the drivers/media/usb/ttusb-dec/ttusb_dec.c driver (bnc#1158834). - CVE-2019-19532: There were multiple out-of-bounds write bugs that could have been caused by a malicious USB device in the Linux kernel HID drivers (bnc#1158824). - CVE-2019-19523: There was a use-after-free bug that could have been caused by a malicious USB device in the drivers/usb/misc/adutux.c driver (bnc#1158823). - CVE-2019-15213: An issue was discovered in the Linux kernel, there was a use-after-free caused by a malicious USB device in the drivers/media/usb/dvb-usb/dvb-usb-init.c driver (bnc#1146544). - CVE-2019-19531: There was a use-after-free bug that can be caused by a malicious USB device in the drivers/usb/misc/yurex.c driver (bnc#1158445). - CVE-2019-19525: There was a use-after-free bug that can be caused by a malicious USB device in the drivers/net/ieee802154/atusb.c driver (bnc#1158417). - CVE-2019-19530: There was a use-after-free bug that can be caused by a malicious USB device in the drivers/usb/class/cdc-acm.c driver (bnc#1158410). - CVE-2019-19536: There was an info-leak bug that can be caused by a malicious USB device in the drivers/net/can/usb/peak_usb/pcan_usb_pro.c driver (bnc#1158394). - CVE-2019-19524: There was a use-after-free bug that can be caused by a malicious USB device in the drivers/input/ff-memless.c driver (bnc#1158413). - CVE-2019-19534: There was an info-leak bug that can be caused by a malicious USB device in the drivers/net/can/usb/peak_usb/pcan_usb_core.c driver (bnc#1158398). - CVE-2019-14901: A heap overflow flaw was found in the Linux kernel in Marvell WiFi chip driver. The vulnerability allowed a remote attacker to cause a system crash, resulting in a denial of service, or execute arbitrary code. The highest threat with this vulnerability is with the availability of the system. If code execution occurs, the code will run with the permissions of root. This will affect both confidentiality and integrity of files on the system (bnc#1157042). - CVE-2019-14895: Fixed a heap-based buffer overflow in the Marvell WiFi chip driver. The flaw could occur when the station attempts a connection negotiation during the handling of the remote devices country settings. This could allow the remote device to cause a denial of service (system crash) or possibly execute arbitrary code (bnc#1157158). - CVE-2019-18660: Fixed a information disclosure on powerpc related to the Spectre-RSB mitigation. This is related to arch/powerpc/kernel/entry_64.S and arch/powerpc/kernel/security.c (bnc#1157038 1157923). - CVE-2019-18683: Fixed a privilege escalation where local users have /dev/video0 access, but only if the driver happens to be loaded. There are multiple race conditions during streaming stopping in this driver (part of the V4L2 subsystem) (bnc#1155897). - CVE-2019-19062: Fixed a memory leak in the crypto_report() function in crypto/crypto_user_base.c, which allowed attackers to cause a denial of service (memory consumption) by triggering crypto_report_alg() failures (bnc#1157333). - CVE-2019-19052: A memory leak in the gs_can_open() function in drivers/net/can/usb/gs_usb.c allowed attackers to cause a denial of service (memory consumption) by triggering usb_submit_urb() failures (bnc#1157324). - CVE-2019-19074: A memory leak in the ath9k_wmi_cmd() function in drivers/net/wireless/ath/ath9k/wmi.c allowed attackers to cause a denial of service (memory consumption) (bnc#1157143). - CVE-2019-19073: Memory leaks in drivers/net/wireless/ath/ath9k/htc_hst.c allowed attackers to cause a denial of service (memory consumption) by triggering wait_for_completion_timeout() failures (bnc#1157070). - CVE-2019-11091,CVE-2018-12126,CVE-2018-12130,CVE-2018-12127: Earlier mitigations for the "MDS" Microarchitectural Data Sampling attacks were not complete. An additional fix was added to the x86_64 fast systemcall path to further mitigate these attacks. (bsc#1164846 bsc#1170847) The following non-security bugs were fixed: - blk: Fix kabi due to blk_trace_mutex addition (bsc#1159285). - blktrace: fix dereference after null check (bsc#1159285). - blktrace: fix trace mutex deadlock (bsc#1159285). - btrfs: Fix bound checking in qgroup_trace_new_subtree_blocks (bsc#1155311). - btrfs: qgroup: Check bg while resuming relocation to avoid NULL pointer dereference (bsc#1155311). - btrfs: qgroup: Cleanup old subtree swap code (bsc#1155311). - btrfs: qgroup: Do not trace subtree if we're dropping reloc tree (bsc#1155311). - btrfs: qgroup: Introduce function to find all new tree blocks of reloc tree (bsc#1155311). - btrfs: qgroup: Introduce function to trace two swaped extents (bsc#1155311). - btrfs: qgroup: Introduce per-root swapped blocks infrastructure (bsc#1155311). - btrfs: qgroup: Only trace data extents in leaves if we're relocating data block group (bsc#1155311). - btrfs: qgroup: Refactor btrfs_qgroup_trace_subtree_swap (bsc#1155311). - btrfs: qgroup: Use delayed subtree rescan for balance (bsc#1155311). - btrfs: qgroup: Use generation-aware subtree swap to mark dirty extents (bsc#1155311). - btrfs: reloc: Also queue orphan reloc tree for cleanup to avoid BUG_ON() (bsc#1155311). - btrfs: relocation: Delay reloc tree deletion after merge_reloc_roots (bsc#1155311). - btrfs: relocation: fix use-after-free on dead relocation roots (bsc#1155311). - btrfs: reloc: Fix NULL pointer dereference due to expanded reloc_root lifespan (bsc#1155311). - cgroup: avoid copying strings longer than the buffers (bsc#1146544). - cgroup: use strlcpy() instead of strscpy() to avoid spurious warning (bsc#1146544). - enic: prevent waking up stopped tx queues over watchdog reset (bsc#1133147). - ext4: fix use-after-free race with debug_want_extra_isize (bsc#1136449). - fix PageHeadHuge() race with THP split (VM Functionality, bsc#1165311). - fs/binfmt_misc.c: do not allow offset overflow (bsc#1099279 bsc#1156060). - fs/xfs: fix f_ffree value for statfs when project quota is set (bsc#1165985). - futex: Use smp_store_release() in mark_wake_futex() (bsc#1157464). - Input: add safety guards to input_set_keycode() (bsc#1168075). - ipv4: correct gso_size for UFO (bsc#1154844). - ipv6: fix memory accounting during ipv6 queue expire (bsc#1162227) (bsc#1162227). - ipvlan: do not add hardware address of master to its unicast filter list (bsc#1137325). - media: ov519: add missing endpoint sanity checks (bsc#1168829). - media: stv06xx: add missing descriptor sanity checks (bsc#1168854). - netfilter: conntrack: sctp: use distinct states for new SCTP connections (bsc#1159199). - netfilter: nf_nat: do not bug when mapping already exists (bsc#1146612). - powerpc/64: Call setup_barrier_nospec() from setup_arch() (bsc#1131107). - powerpc/64: Make meltdown reporting Book3S 64 specific (bsc#1091041). - powerpc/64: Make stf barrier PPC_BOOK3S_64 specific (bsc#1131107). - powerpc/64s: Add new security feature flags for count cache flush (bsc#1131107). - powerpc/64s: Add support for software count cache flush (bsc#1131107). - powerpc/64s: support nospectre_v2 cmdline option (bsc#1131107). - powerpc/asm: Add a patch_site macro & helpers for patching instructions (bsc#1131107). - powerpc/fsl: Add nospectre_v2 command line argument (bsc#1131107). - powerpc/fsl: Fix spectre_v2 mitigations reporting (bsc#1131107). - powerpc/powernv: Query firmware for count cache flush settings (bsc#1131107). - powerpc/pseries: Query hypervisor for count cache flush settings (bsc#1131107). - powerpc/security/book3s64: Report L1TF status in sysfs (bsc#1091041). - powerpc/security: Fix spectre_v2 reporting (bsc#1131107). - powerpc/security: Fix wrong message when RFI Flush is disable (bsc#1131107). - powerpc/security: Show powerpc_security_features in debugfs (bsc#1131107). - route: set the deleted fnhe fnhe_daddr to 0 in ip_del_fnhe to fix a race (bsc#1037216). - sched/fair: WARN() and refuse to set buddy when !se->on_rq (bsc#1158132). - string: drop __must_check from strscpy() and restore strscpy() usages in cgroup (bsc#1146544). - x86/alternatives: Add int3_emulate_call() selftest (bsc#1153811). - x86/alternatives: Fix int3_emulate_call() selftest stack corruption (bsc#1153811). - x86/mitigations: Clear CPU buffers on the SYSCALL fast path (bsc#1164846). - xen/pv: Fix a boot up hang revealed by int3 self test (bsc#1153811). - xfs: also remove cached ACLs when removing the underlying attr (bsc#1165873). - xfs: bulkstat should copy lastip whenever userspace supplies one (bsc#1165984). </description> <summary>Security update for the Linux Kernel</summary> </patchinfo>
