Red Hat Security Advisory: kernel-rt security and bug fix update

Fixed packages 32

Vulnerabilities 6

• High 8.0
  CVE-2019-3846

  A flaw that allowed an attacker to corrupt memory and possibly escalate privileges was found in the mwifiex kernel modu…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  Jun 3, 2019
• High 7.9
  CVE-2019-9500

  Broadcom brcmfmac driver is vulnerable to a heap buffer overflow

  The Broadcom brcmfmac WiFi driver prior to commit 1b5e2423164b3670e8bc9174e4762d297990deff is vulnerable to a heap buffer overflow. If the Wake-up on Wireless LAN functionality is configured, a malicious event frame can be constructed to trigger an heap buffe…

  Broadcom brcmfmac WiFi driver linux-raspi2 linux-hwe Debian Ubuntu
  Jan 16, 2020
• High 7.9
  CVE-2019-9503

  Broadcom brcmfmac driver is vulnerable to a frame validation bypass

  The Broadcom brcmfmac WiFi driver prior to commit a4176ec356c73a46c07c181c6d04039fafa34a9f is vulnerable to a frame validation bypass. If the brcmfmac driver receives a firmware event frame from a remote source, the is_wlc_event_frame function will cause this…

  Broadcom brcmfmac WiFi driver linux-raspi2 linux-hwe Debian Ubuntu
  Jan 16, 2020
• Medium 6.7
  CVE-2019-3887

  A flaw was found in the way KVM hypervisor handled x2APIC Machine Specific Rregister (MSR) access with nested(=1) virtu…

  The Linux Foundation Kernel linux-hwe linux-azure Debian Ubuntu Azure Linux
  Apr 9, 2019
• Unscored —
  CVE-2018-19824

  In the Linux kernel through 4.19.6, a local user could exploit a use-after-free in the ALSA driver by supplying a malic…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  Dec 3, 2018
• Unscored —
  CVE-2019-11487

  The Linux kernel before 5.1-rc5 allows page->_refcount reference count overflow, with resultant use-after-free issues, …

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  Apr 23, 2019

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1695044
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1701224
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1701842
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1703063
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1713059
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1726362
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1734475
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2741.json
• report
  https://access.redhat.com/security/cve/CVE-2018-19824
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1655816
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-19824
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-19824
• article
  https://www.openwall.com/lists/oss-security/2018/12/03/1
• report
  https://access.redhat.com/security/cve/CVE-2019-3846
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-3846
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-3846
• article
  https://seclists.org/oss-sec/2019/q2/133
• report
  https://access.redhat.com/security/cve/CVE-2019-3887
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-3887
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-3887
• report
  https://access.redhat.com/security/cve/CVE-2019-9500
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-9500
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-9500
• article
  https://blog.quarkslab.com/reverse-engineering-broadcom-wireless-chipsets.html#cve-2019-9500-heap-buffer-overflow-in-brcmf-wowl-nd-results
• article
  https://kb.cert.org/vuls/id/166939/
• article
  https://www.bleepingcomputer.com/news/security/broadcom-wifi-driver-flaws-expose-computers-phones-iot-to-rce-attacks/
• report
  https://access.redhat.com/security/cve/CVE-2019-9503
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-9503
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-9503
• article
  https://blog.quarkslab.com/reverse-engineering-broadcom-wireless-chipsets.html#cve-2019-9503-remotely-sending-firmware-events-bypassing-is-wlc-event-frame
• report
  https://access.redhat.com/security/cve/CVE-2019-11487
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-11487
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-11487