Red Hat Security Advisory: kernel-alt security and bug fix update

Fixed packages 19

Vulnerabilities 5

• High 7.9
  CVE-2019-9500

  Broadcom brcmfmac driver is vulnerable to a heap buffer overflow

  The Broadcom brcmfmac WiFi driver prior to commit 1b5e2423164b3670e8bc9174e4762d297990deff is vulnerable to a heap buffer overflow. If the Wake-up on Wireless LAN functionality is configured, a malicious event frame can be constructed to trigger an heap buffe…

  Broadcom brcmfmac WiFi driver linux-raspi2 linux-hwe Debian Ubuntu
  Jan 16, 2020
• High 7.8
  CVE-2018-10902

  It was found that the raw midi kernel driver does not protect against concurrent access which leads to a double realloc…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 21, 2018
• High 7.6
  CVE-2019-9506 Public exploit

  Blutooth BR/EDR specification does not specify sufficient encryption key length and allows an attacker to influence key length negotiation

  The Bluetooth BR/EDR specification up to and including version 5.1 permits sufficiently low encryption key length and does not prevent an attacker from influencing the key length negotiation. This allows practical brute-force attacks (aka "KNOB") that can dec…

  Bluetooth BR/EDR linux-raspi2 linux-hwe Debian Ubuntu
  Aug 14, 2019
• Unscored —
  CVE-2018-20856

  An issue was discovered in the Linux kernel before 4.18.7. In block/blk-core.c, there is an __blk_drain_queue() use-aft…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  Jul 26, 2019
• Unscored —
  CVE-2019-11810

  An issue was discovered in the Linux kernel before 5.0.7. A NULL pointer dereference can occur when megasas_create_fram…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  May 7, 2019

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1590720
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1701224
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1709164
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1727857
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1738705
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3217.json
• report
  https://access.redhat.com/security/cve/CVE-2018-10902
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-10902
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-10902
• report
  https://access.redhat.com/security/cve/CVE-2018-20856
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-20856
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-20856
• report
  https://access.redhat.com/security/cve/CVE-2019-9500
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-9500
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-9500
• article
  https://blog.quarkslab.com/reverse-engineering-broadcom-wireless-chipsets.html#cve-2019-9500-heap-buffer-overflow-in-brcmf-wowl-nd-results
• article
  https://kb.cert.org/vuls/id/166939/
• article
  https://www.bleepingcomputer.com/news/security/broadcom-wifi-driver-flaws-expose-computers-phones-iot-to-rce-attacks/
• report
  https://access.redhat.com/security/cve/CVE-2019-9506
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-9506
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-9506
• report
  https://access.redhat.com/security/cve/CVE-2019-11810
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-11810
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-11810