Red Hat Security Advisory: kernel security and bug fix update

Fixed packages 83

Vulnerabilities 4

• High 8.0
  CVE-2019-3846

  A flaw that allowed an attacker to corrupt memory and possibly escalate privileges was found in the mwifiex kernel modu…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  Jun 3, 2019
• High 7.6
  CVE-2019-9506 Public exploit

  Blutooth BR/EDR specification does not specify sufficient encryption key length and allows an attacker to influence key length negotiation

  The Bluetooth BR/EDR specification up to and including version 5.1 permits sufficiently low encryption key length and does not prevent an attacker from influencing the key length negotiation. This allows practical brute-force attacks (aka "KNOB") that can dec…

  Bluetooth BR/EDR linux-raspi2 linux-hwe Debian Ubuntu
  Aug 14, 2019
• Medium 5.9
  CVE-2019-10126

  A flaw was found in the Linux kernel. A heap based buffer overflow in mwifiex_uap_parse_tail_ies function in drivers/ne…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  Jun 14, 2019
• Unscored —
  CVE-2018-20856

  An issue was discovered in the Linux kernel before 4.18.7. In block/blk-core.c, there is an __blk_drain_queue() use-aft…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  Jul 26, 2019

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1713059
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1716992
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1727857
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1738705
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3055.json
• report
  https://access.redhat.com/security/cve/CVE-2018-20856
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-20856
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-20856
• report
  https://access.redhat.com/security/cve/CVE-2019-3846
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-3846
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-3846
• article
  https://seclists.org/oss-sec/2019/q2/133
• report
  https://access.redhat.com/security/cve/CVE-2019-9506
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-9506
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-9506
• report
  https://access.redhat.com/security/cve/CVE-2019-10126
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-10126
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-10126