RHSA-2020:1016 — Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Fixed packages 83

Release	Package	Fixed in
Red Hat · RHEL 7 enterprise_linux:7::client	bpftool	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::client	bpftool-debuginfo	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::client	kernel	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::client	kernel-abi-whitelists	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::client	kernel-debug	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::client	kernel-debug-debuginfo	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::client	kernel-debug-devel	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::client	kernel-debuginfo	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::client	kernel-debuginfo-common-x86_64	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::client	kernel-devel	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::client	kernel-doc	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::client	kernel-tools	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::client	kernel-tools-debuginfo	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::client	kernel-tools-libs	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::client	kernel-tools-libs-devel	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::client	perf	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::client	perf-debuginfo	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::client	python-perf	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::client	python-perf-debuginfo	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::computenode	bpftool	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::computenode	bpftool-debuginfo	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::computenode	kernel	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::computenode	kernel-abi-whitelists	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::computenode	kernel-debug	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::computenode	kernel-debug-debuginfo	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::computenode	kernel-debug-devel	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::computenode	kernel-debuginfo	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::computenode	kernel-debuginfo-common-x86_64	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::computenode	kernel-devel	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::computenode	kernel-doc	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::computenode	kernel-tools	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::computenode	kernel-tools-debuginfo	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::computenode	kernel-tools-libs	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::computenode	kernel-tools-libs-devel	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::computenode	perf	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::computenode	perf-debuginfo	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::computenode	python-perf	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::computenode	python-perf-debuginfo	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::server	bpftool	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::server	bpftool-debuginfo	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::server	kernel	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::server	kernel-abi-whitelists	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::server	kernel-bootwrapper	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::server	kernel-debug	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::server	kernel-debug-debuginfo	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::server	kernel-debug-devel	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::server	kernel-debuginfo	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::server	kernel-debuginfo-common-ppc64	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::server	kernel-debuginfo-common-ppc64le	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::server	kernel-debuginfo-common-s390x	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::server	kernel-debuginfo-common-x86_64	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::server	kernel-devel	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::server	kernel-doc	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::server	kernel-kdump	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::server	kernel-kdump-debuginfo	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::server	kernel-kdump-devel	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::server	kernel-tools	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::server	kernel-tools-debuginfo	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::server	kernel-tools-libs	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::server	kernel-tools-libs-devel	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::server	perf	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::server	perf-debuginfo	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::server	python-perf	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::server	python-perf-debuginfo	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::workstation	bpftool	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::workstation	bpftool-debuginfo	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::workstation	kernel	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::workstation	kernel-abi-whitelists	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::workstation	kernel-debug	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::workstation	kernel-debug-debuginfo	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::workstation	kernel-debug-devel	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::workstation	kernel-debuginfo	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::workstation	kernel-debuginfo-common-x86_64	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::workstation	kernel-devel	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::workstation	kernel-doc	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::workstation	kernel-tools	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::workstation	kernel-tools-debuginfo	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::workstation	kernel-tools-libs	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::workstation	kernel-tools-libs-devel	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::workstation	perf	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::workstation	perf-debuginfo	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::workstation	python-perf	0:3.10.0-1127.el7
Red Hat · RHEL 7 enterprise_linux:7::workstation	python-perf-debuginfo	0:3.10.0-1127.el7

Vulnerabilities 25

High 7.9

CVE-2019-9503

Broadcom brcmfmac driver is vulnerable to a frame validation bypass

The Broadcom brcmfmac WiFi driver prior to commit a4176ec356c73a46c07c181c6d04039fafa34a9f is vulnerable to a frame validation bypass. If the brcmfmac driver receives a firmware event frame from a remote source, the is_wlc_event_frame function will cause this…

Broadcom brcmfmac WiFi driver linux-raspi2 linux-hwe Debian Ubuntu

Jan 16, 2020
High 7.8

CVE-2019-14815

A vulnerability was found in Linux Kernel, where a Heap Overflow was found in mwifiex_set_wmm_params() function of Marv…

Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu

Nov 25, 2019
High 7.4

CVE-2019-5108 EPSS 10%

An exploitable denial-of-service vulnerability exists in the Linux kernel prior to mainline 5.3. An attacker could expl…

linux-raspi2 linux-hwe linux-azure linux-riscv Linux Debian Ubuntu

Dec 23, 2019
Medium 5.6

CVE-2019-3901

A race condition in perf_event_open() allows local attackers to leak sensitive data from setuid programs. As no relevan…

The Linux Foundation Kernel linux-raspi2 linux-riscv Debian Ubuntu

Apr 22, 2019
Medium 5.5

CVE-2019-14814

There is heap-based buffer overflow in Linux kernel, all versions up to, excluding 5.3, in the marvell wifi chip driver…

Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu

Sep 20, 2019
Medium 4.7

CVE-2019-10207 Public exploit

A flaw was found in the Linux kernel's Bluetooth implementation of UART, all versions kernel 3.x.x before 4.18.0 and ke…

Red Hat kernel linux-raspi2 linux-hwe Debian Ubuntu

Nov 25, 2019
Unscored —

CVE-2015-9289

In the Linux kernel before 4.1.4, a buffer overflow occurs when checking userspace params in drivers/media/dvb-frontend…

linux-raspi2 linux-riscv linux linux-gke Debian Ubuntu

Jul 27, 2019
Unscored —

CVE-2017-17807

The KEYS subsystem in the Linux kernel before 4.14.6 omitted an access-control check when adding a key to the current t…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Dec 20, 2017
Unscored —

CVE-2018-19985

The function hso_get_config_data in drivers/net/usb/hso.c in the Linux kernel through 4.19.8 reads if_num from the USB …

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Mar 17, 2019
Unscored —

CVE-2018-20169

An issue was discovered in the Linux kernel before 4.19.9. The USB subsystem mishandles size checks during the reading …

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Dec 17, 2018
Unscored —

CVE-2018-7191

In the tun subsystem in the Linux kernel before 4.13.14, dev_get_valid_name is not called before register_netdevice. Th…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

May 17, 2019
Unscored —

CVE-2019-10638

In the Linux kernel before 5.1.7, a device can be tracked by an attacker using the IP ID values the kernel produces for…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Jul 5, 2019
Unscored —

CVE-2019-10639

The Linux kernel 4.x (starting from 4.1) and 5.x before 5.0.8 allows Information Exposure (partial kernel address discl…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Jul 5, 2019
Unscored —

CVE-2019-11190

The Linux kernel before 4.8 allows local users to bypass ASLR on setuid programs (such as /bin/su) because install_exec…

linux-raspi2 linux-riscv linux linux-gke Debian Ubuntu

Apr 11, 2019
Unscored —

CVE-2019-11884

The do_hidp_sock_ioctl function in net/bluetooth/hidp/sock.c in the Linux kernel before 5.0.15 allows a local user to o…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

May 10, 2019
Unscored —

CVE-2019-12382

An issue was discovered in drm_load_edid_firmware in drivers/gpu/drm/drm_edid_load.c in the Linux kernel through 5.1.5.…

linux-azure linux linux linux-aws Debian Ubuntu

May 28, 2019
Unscored —

CVE-2019-13233

In arch/x86/lib/insn-eval.c in the Linux kernel before 5.1.9, there is a use-after-free for access to an LDT entry beca…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Jul 4, 2019
Unscored —

CVE-2019-13648

In the Linux kernel through 5.2.1 on the powerpc platform, when hardware transactional memory is disabled, a local user…

linux-hwe linux-azure linux-riscv linux Debian Ubuntu

Jul 19, 2019
Unscored —

CVE-2019-14283

In the Linux kernel before 5.2.3, set_geometry in drivers/block/floppy.c does not validate the sect and head fields, as…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Jul 26, 2019
Unscored —

CVE-2019-15090

An issue was discovered in drivers/scsi/qedi/qedi_dbg.c in the Linux kernel before 5.1.12. In the qedi_dbg_* family of …

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Aug 15, 2019
Unscored —

CVE-2019-15214

An issue was discovered in the Linux kernel before 5.0.10. There is a use-after-free in the sound subsystem because car…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Aug 19, 2019
Unscored —

CVE-2019-15221

An issue was discovered in the Linux kernel before 5.1.17. There is a NULL pointer dereference caused by a malicious US…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Aug 19, 2019
Unscored —

CVE-2019-15916

An issue was discovered in the Linux kernel before 5.0.1. There is a memory leak in register_queue_kobjects() in net/co…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Sep 4, 2019
Unscored —

CVE-2019-16746 Public exploit EPSS 13%

An issue was discovered in net/wireless/nl80211.c in the Linux kernel through 5.2.17. It does not check the length of v…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Sep 24, 2019
Unscored —

CVE-2019-18660

The Linux kernel before 5.4.1 on powerpc allows Information Exposure because the Spectre-RSB mitigation is not in place…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Nov 27, 2019

References

article
https://access.redhat.com/security/updates/classification/#moderate
article
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.8_release_notes/index
report
https://bugzilla.redhat.com/show_bug.cgi?id=1507149
report
https://bugzilla.redhat.com/show_bug.cgi?id=1528335
report
https://bugzilla.redhat.com/show_bug.cgi?id=1651706
report
https://bugzilla.redhat.com/show_bug.cgi?id=1660385
report
https://bugzilla.redhat.com/show_bug.cgi?id=1666106
report
https://bugzilla.redhat.com/show_bug.cgi?id=1694201
report
https://bugzilla.redhat.com/show_bug.cgi?id=1699856
report
https://bugzilla.redhat.com/show_bug.cgi?id=1701245
report
https://bugzilla.redhat.com/show_bug.cgi?id=1701842
report
https://bugzilla.redhat.com/show_bug.cgi?id=1702264
report
https://bugzilla.redhat.com/show_bug.cgi?id=1709837
report
https://bugzilla.redhat.com/show_bug.cgi?id=1710751
report
https://bugzilla.redhat.com/show_bug.cgi?id=1711520
report
https://bugzilla.redhat.com/show_bug.cgi?id=1715554
report
https://bugzilla.redhat.com/show_bug.cgi?id=1716328
report
https://bugzilla.redhat.com/show_bug.cgi?id=1722706
report
https://bugzilla.redhat.com/show_bug.cgi?id=1727756
report
https://bugzilla.redhat.com/show_bug.cgi?id=1729931
report
https://bugzilla.redhat.com/show_bug.cgi?id=1729933
report
https://bugzilla.redhat.com/show_bug.cgi?id=1733347
report
https://bugzilla.redhat.com/show_bug.cgi?id=1733874
report
https://bugzilla.redhat.com/show_bug.cgi?id=1734243
report
https://bugzilla.redhat.com/show_bug.cgi?id=1735630
report
https://bugzilla.redhat.com/show_bug.cgi?id=1735655
report
https://bugzilla.redhat.com/show_bug.cgi?id=1749390
report
https://bugzilla.redhat.com/show_bug.cgi?id=1750577
report
https://bugzilla.redhat.com/show_bug.cgi?id=1750813
report
https://bugzilla.redhat.com/show_bug.cgi?id=1757325
report
https://bugzilla.redhat.com/show_bug.cgi?id=1757872
report
https://bugzilla.redhat.com/show_bug.cgi?id=1758001
report
https://bugzilla.redhat.com/show_bug.cgi?id=1760294
report
https://bugzilla.redhat.com/show_bug.cgi?id=1760306
report
https://bugzilla.redhat.com/show_bug.cgi?id=1770404
report
https://bugzilla.redhat.com/show_bug.cgi?id=1777825
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_1016.json
report
https://access.redhat.com/security/cve/CVE-2015-9289
advisory
https://www.cve.org/CVERecord?id=CVE-2015-9289

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Fixed packages 83

Vulnerabilities 25

Broadcom brcmfmac driver is vulnerable to a frame validation bypass

A vulnerability was found in Linux Kernel, where a Heap Overflow was found in mwifiex_set_wmm_params() function of Marv…

An exploitable denial-of-service vulnerability exists in the Linux kernel prior to mainline 5.3. An attacker could expl…

A race condition in perf_event_open() allows local attackers to leak sensitive data from setuid programs. As no relevan…

There is heap-based buffer overflow in Linux kernel, all versions up to, excluding 5.3, in the marvell wifi chip driver…

A flaw was found in the Linux kernel's Bluetooth implementation of UART, all versions kernel 3.x.x before 4.18.0 and ke…

In the Linux kernel before 4.1.4, a buffer overflow occurs when checking userspace params in drivers/media/dvb-frontend…

The KEYS subsystem in the Linux kernel before 4.14.6 omitted an access-control check when adding a key to the current t…

The function hso_get_config_data in drivers/net/usb/hso.c in the Linux kernel through 4.19.8 reads if_num from the USB …

An issue was discovered in the Linux kernel before 4.19.9. The USB subsystem mishandles size checks during the reading …

In the tun subsystem in the Linux kernel before 4.13.14, dev_get_valid_name is not called before register_netdevice. Th…

In the Linux kernel before 5.1.7, a device can be tracked by an attacker using the IP ID values the kernel produces for…

The Linux kernel 4.x (starting from 4.1) and 5.x before 5.0.8 allows Information Exposure (partial kernel address discl…

The Linux kernel before 4.8 allows local users to bypass ASLR on setuid programs (such as /bin/su) because install_exec…

The do_hidp_sock_ioctl function in net/bluetooth/hidp/sock.c in the Linux kernel before 5.0.15 allows a local user to o…

An issue was discovered in drm_load_edid_firmware in drivers/gpu/drm/drm_edid_load.c in the Linux kernel through 5.1.5.…

In arch/x86/lib/insn-eval.c in the Linux kernel before 5.1.9, there is a use-after-free for access to an LDT entry beca…

In the Linux kernel through 5.2.1 on the powerpc platform, when hardware transactional memory is disabled, a local user…

In the Linux kernel before 5.2.3, set_geometry in drivers/block/floppy.c does not validate the sect and head fields, as…

An issue was discovered in drivers/scsi/qedi/qedi_dbg.c in the Linux kernel before 5.1.12. In the qedi_dbg_* family of …

An issue was discovered in the Linux kernel before 5.0.10. There is a use-after-free in the sound subsystem because car…

An issue was discovered in the Linux kernel before 5.1.17. There is a NULL pointer dereference caused by a malicious US…

An issue was discovered in the Linux kernel before 5.0.1. There is a memory leak in register_queue_kobjects() in net/co…

An issue was discovered in net/wireless/nl80211.c in the Linux kernel through 5.2.17. It does not check the length of v…

The Linux kernel before 5.4.1 on powerpc allows Information Exposure because the Spectre-RSB mitigation is not in place…

References