Red Hat Security Advisory: kernel-alt security and bug fix update

Fixed packages 19

Vulnerabilities 11

• High 8.0
  CVE-2019-3846

  A flaw that allowed an attacker to corrupt memory and possibly escalate privileges was found in the mwifiex kernel modu…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  Jun 3, 2019
• High 7.8
  CVE-2019-14815

  A vulnerability was found in Linux Kernel, where a Heap Overflow was found in mwifiex_set_wmm_params() function of Marv…

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu
  Nov 25, 2019
• Medium 5.9
  CVE-2019-10126

  A flaw was found in the Linux kernel. A heap based buffer overflow in mwifiex_uap_parse_tail_ies function in drivers/ne…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  Jun 14, 2019
• Medium 5.5
  CVE-2019-14814

  There is heap-based buffer overflow in Linux kernel, all versions up to, excluding 5.3, in the marvell wifi chip driver…

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 20, 2019
• Medium 5.5
  CVE-2019-14816

  There is heap-based buffer overflow in kernel, all versions up to, excluding 5.3, in the marvell wifi chip driver in Li…

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 20, 2019
• Unscored —
  CVE-2018-18559

  In the Linux kernel through 4.19, a use-after-free can occur due to a race condition between fanout_add from setsockopt…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  Oct 22, 2018
• Unscored —
  CVE-2018-3693

  Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of…

  Intel Most Modern Operating Systems linux-raspi2 linux-hwe Debian Ubuntu
  Jul 10, 2018
• Unscored —
  CVE-2019-11487

  The Linux kernel before 5.1-rc5 allows page->_refcount reference count overflow, with resultant use-after-free issues, …

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  Apr 23, 2019
• Unscored —
  CVE-2019-17133

  In the Linux kernel through 5.3.2, cfg80211_mgd_wext_giwessid in net/wireless/wext-sme.c does not reject a long SSID IE…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  Oct 4, 2019
• Unscored —
  CVE-2019-18660

  The Linux kernel before 5.4.1 on powerpc allows Information Exposure because the Spectre-RSB mitigation is not in place…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  Nov 27, 2019
• Unscored —
  CVE-2019-8912

  In the Linux kernel through 4.20.11, af_alg_release() in crypto/af_alg.c neglects to set a NULL value for a certain str…

  linux-raspi2 linux-hwe linux-azure linux-gcp Debian Ubuntu
  Feb 18, 2019

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://access.redhat.com/solutions/3523601
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1581650
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1641878
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1678685
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1703063
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1713059
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1716992
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1744130
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1744137
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1744149
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1771909
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1777825
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0174.json
• report
  https://access.redhat.com/security/cve/CVE-2018-3693
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-3693
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-3693
• article
  https://01.org/security/advisories/intel-oss-10002
• article
  https://people.csail.mit.edu/vlk/spectre11.pdf
• article
  https://software.intel.com/sites/default/files/managed/4e/a1/337879-analyzing-potential-bounds-Check-bypass-vulnerabilities.pdf
• report
  https://access.redhat.com/security/cve/CVE-2018-18559
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-18559
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-18559
• article
  https://blogs.securiteam.com/index.php/archives/3731
• report
  https://access.redhat.com/security/cve/CVE-2019-3846
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-3846
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-3846
• article
  https://seclists.org/oss-sec/2019/q2/133
• report
  https://access.redhat.com/security/cve/CVE-2019-8912
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-8912
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-8912
• report
  https://access.redhat.com/security/cve/CVE-2019-10126
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-10126
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-10126
• report
  https://access.redhat.com/security/cve/CVE-2019-11487
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-11487
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-11487
• report
  https://access.redhat.com/security/cve/CVE-2019-14814
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-14814