RHSA-2020:1070 — Red Hat Security Advisory: kernel-rt security and bug fix update

Fixed packages 17

Release	Package	Fixed in
Red Hat · RHEL 7 rhel_extras_rt:7	kernel-rt	0:3.10.0-1127.rt56.1093.el7
Red Hat · RHEL 7 rhel_extras_rt:7	kernel-rt-debug	0:3.10.0-1127.rt56.1093.el7
Red Hat · RHEL 7 rhel_extras_rt:7	kernel-rt-debug-debuginfo	0:3.10.0-1127.rt56.1093.el7
Red Hat · RHEL 7 rhel_extras_rt:7	kernel-rt-debug-devel	0:3.10.0-1127.rt56.1093.el7
Red Hat · RHEL 7 rhel_extras_rt:7	kernel-rt-debug-kvm	0:3.10.0-1127.rt56.1093.el7
Red Hat · RHEL 7 rhel_extras_rt:7	kernel-rt-debug-kvm-debuginfo	0:3.10.0-1127.rt56.1093.el7
Red Hat · RHEL 7 rhel_extras_rt:7	kernel-rt-debuginfo	0:3.10.0-1127.rt56.1093.el7
Red Hat · RHEL 7 rhel_extras_rt:7	kernel-rt-debuginfo-common-x86_64	0:3.10.0-1127.rt56.1093.el7
Red Hat · RHEL 7 rhel_extras_rt:7	kernel-rt-devel	0:3.10.0-1127.rt56.1093.el7
Red Hat · RHEL 7 rhel_extras_rt:7	kernel-rt-doc	0:3.10.0-1127.rt56.1093.el7
Red Hat · RHEL 7 rhel_extras_rt:7	kernel-rt-kvm	0:3.10.0-1127.rt56.1093.el7
Red Hat · RHEL 7 rhel_extras_rt:7	kernel-rt-kvm-debuginfo	0:3.10.0-1127.rt56.1093.el7
Red Hat · RHEL 7 rhel_extras_rt:7	kernel-rt-trace	0:3.10.0-1127.rt56.1093.el7
Red Hat · RHEL 7 rhel_extras_rt:7	kernel-rt-trace-debuginfo	0:3.10.0-1127.rt56.1093.el7
Red Hat · RHEL 7 rhel_extras_rt:7	kernel-rt-trace-devel	0:3.10.0-1127.rt56.1093.el7
Red Hat · RHEL 7 rhel_extras_rt:7	kernel-rt-trace-kvm	0:3.10.0-1127.rt56.1093.el7
Red Hat · RHEL 7 rhel_extras_rt:7	kernel-rt-trace-kvm-debuginfo	0:3.10.0-1127.rt56.1093.el7

Vulnerabilities 19

High 7.9

CVE-2019-9503

Broadcom brcmfmac driver is vulnerable to a frame validation bypass

The Broadcom brcmfmac WiFi driver prior to commit a4176ec356c73a46c07c181c6d04039fafa34a9f is vulnerable to a frame validation bypass. If the brcmfmac driver receives a firmware event frame from a remote source, the is_wlc_event_frame function will cause this…

Broadcom brcmfmac WiFi driver linux-raspi2 linux-hwe Debian Ubuntu

Jan 16, 2020
High 7.8

CVE-2019-14815

A vulnerability was found in Linux Kernel, where a Heap Overflow was found in mwifiex_set_wmm_params() function of Marv…

Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu

Nov 25, 2019
Medium 5.6

CVE-2019-3901

A race condition in perf_event_open() allows local attackers to leak sensitive data from setuid programs. As no relevan…

The Linux Foundation Kernel linux-raspi2 linux-riscv Debian Ubuntu

Apr 22, 2019
Medium 4.7

CVE-2019-10207 Public exploit

A flaw was found in the Linux kernel's Bluetooth implementation of UART, all versions kernel 3.x.x before 4.18.0 and ke…

Red Hat kernel linux-raspi2 linux-hwe Debian Ubuntu

Nov 25, 2019
Unscored —

CVE-2015-9289

In the Linux kernel before 4.1.4, a buffer overflow occurs when checking userspace params in drivers/media/dvb-frontend…

linux-raspi2 linux-riscv linux linux-gke Debian Ubuntu

Jul 27, 2019
Unscored —

CVE-2017-17807

The KEYS subsystem in the Linux kernel before 4.14.6 omitted an access-control check when adding a key to the current t…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Dec 20, 2017
Unscored —

CVE-2018-19985

The function hso_get_config_data in drivers/net/usb/hso.c in the Linux kernel through 4.19.8 reads if_num from the USB …

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Mar 17, 2019
Unscored —

CVE-2018-20169

An issue was discovered in the Linux kernel before 4.19.9. The USB subsystem mishandles size checks during the reading …

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Dec 17, 2018
Unscored —

CVE-2018-7191

In the tun subsystem in the Linux kernel before 4.13.14, dev_get_valid_name is not called before register_netdevice. Th…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

May 17, 2019
Unscored —

CVE-2019-10638

In the Linux kernel before 5.1.7, a device can be tracked by an attacker using the IP ID values the kernel produces for…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Jul 5, 2019
Unscored —

CVE-2019-10639

The Linux kernel 4.x (starting from 4.1) and 5.x before 5.0.8 allows Information Exposure (partial kernel address discl…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Jul 5, 2019
Unscored —

CVE-2019-11190

The Linux kernel before 4.8 allows local users to bypass ASLR on setuid programs (such as /bin/su) because install_exec…

linux-raspi2 linux-riscv linux linux-gke Debian Ubuntu

Apr 11, 2019
Unscored —

CVE-2019-11884

The do_hidp_sock_ioctl function in net/bluetooth/hidp/sock.c in the Linux kernel before 5.0.15 allows a local user to o…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

May 10, 2019
Unscored —

CVE-2019-12382

An issue was discovered in drm_load_edid_firmware in drivers/gpu/drm/drm_edid_load.c in the Linux kernel through 5.1.5.…

linux-azure linux linux linux-aws Debian Ubuntu

May 28, 2019
Unscored —

CVE-2019-13233

In arch/x86/lib/insn-eval.c in the Linux kernel before 5.1.9, there is a use-after-free for access to an LDT entry beca…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Jul 4, 2019
Unscored —

CVE-2019-14283

In the Linux kernel before 5.2.3, set_geometry in drivers/block/floppy.c does not validate the sect and head fields, as…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Jul 26, 2019
Unscored —

CVE-2019-15221

An issue was discovered in the Linux kernel before 5.1.17. There is a NULL pointer dereference caused by a malicious US…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Aug 19, 2019
Unscored —

CVE-2019-15916

An issue was discovered in the Linux kernel before 5.0.1. There is a memory leak in register_queue_kobjects() in net/co…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Sep 4, 2019
Unscored —

CVE-2019-16746 Public exploit EPSS 13%

An issue was discovered in net/wireless/nl80211.c in the Linux kernel through 5.2.17. It does not check the length of v…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Sep 24, 2019

References

article
https://access.redhat.com/security/updates/classification/#moderate
article
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.8_release_notes/index
report
https://bugzilla.redhat.com/show_bug.cgi?id=1528335
report
https://bugzilla.redhat.com/show_bug.cgi?id=1550584
report
https://bugzilla.redhat.com/show_bug.cgi?id=1660385
report
https://bugzilla.redhat.com/show_bug.cgi?id=1666106
report
https://bugzilla.redhat.com/show_bug.cgi?id=1690543
report
https://bugzilla.redhat.com/show_bug.cgi?id=1696087
report
https://bugzilla.redhat.com/show_bug.cgi?id=1699438
report
https://bugzilla.redhat.com/show_bug.cgi?id=1699856
report
https://bugzilla.redhat.com/show_bug.cgi?id=1701245
report
https://bugzilla.redhat.com/show_bug.cgi?id=1701842
report
https://bugzilla.redhat.com/show_bug.cgi?id=1708718
report
https://bugzilla.redhat.com/show_bug.cgi?id=1709837
report
https://bugzilla.redhat.com/show_bug.cgi?id=1715554
report
https://bugzilla.redhat.com/show_bug.cgi?id=1716328
report
https://bugzilla.redhat.com/show_bug.cgi?id=1727756
report
https://bugzilla.redhat.com/show_bug.cgi?id=1729931
report
https://bugzilla.redhat.com/show_bug.cgi?id=1729933
report
https://bugzilla.redhat.com/show_bug.cgi?id=1733874
report
https://bugzilla.redhat.com/show_bug.cgi?id=1734243
report
https://bugzilla.redhat.com/show_bug.cgi?id=1735655
report
https://bugzilla.redhat.com/show_bug.cgi?id=1741775
report
https://bugzilla.redhat.com/show_bug.cgi?id=1750813
report
https://bugzilla.redhat.com/show_bug.cgi?id=1751083
report
https://bugzilla.redhat.com/show_bug.cgi?id=1760306
report
https://bugzilla.redhat.com/show_bug.cgi?id=1772894
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_1070.json
report
https://access.redhat.com/security/cve/CVE-2015-9289
advisory
https://www.cve.org/CVERecord?id=CVE-2015-9289
advisory
https://nvd.nist.gov/vuln/detail/CVE-2015-9289
report
https://access.redhat.com/security/cve/CVE-2017-17807
advisory
https://www.cve.org/CVERecord?id=CVE-2017-17807
advisory
https://nvd.nist.gov/vuln/detail/CVE-2017-17807
report
https://access.redhat.com/security/cve/CVE-2018-7191
advisory
https://www.cve.org/CVERecord?id=CVE-2018-7191
advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-7191
report
https://access.redhat.com/security/cve/CVE-2018-19985
advisory
https://www.cve.org/CVERecord?id=CVE-2018-19985

Red Hat Security Advisory: kernel-rt security and bug fix update

Fixed packages 17

Vulnerabilities 19

Broadcom brcmfmac driver is vulnerable to a frame validation bypass

A vulnerability was found in Linux Kernel, where a Heap Overflow was found in mwifiex_set_wmm_params() function of Marv…

A race condition in perf_event_open() allows local attackers to leak sensitive data from setuid programs. As no relevan…

A flaw was found in the Linux kernel's Bluetooth implementation of UART, all versions kernel 3.x.x before 4.18.0 and ke…

In the Linux kernel before 4.1.4, a buffer overflow occurs when checking userspace params in drivers/media/dvb-frontend…

The KEYS subsystem in the Linux kernel before 4.14.6 omitted an access-control check when adding a key to the current t…

The function hso_get_config_data in drivers/net/usb/hso.c in the Linux kernel through 4.19.8 reads if_num from the USB …

An issue was discovered in the Linux kernel before 4.19.9. The USB subsystem mishandles size checks during the reading …

In the tun subsystem in the Linux kernel before 4.13.14, dev_get_valid_name is not called before register_netdevice. Th…

In the Linux kernel before 5.1.7, a device can be tracked by an attacker using the IP ID values the kernel produces for…

The Linux kernel 4.x (starting from 4.1) and 5.x before 5.0.8 allows Information Exposure (partial kernel address discl…

The Linux kernel before 4.8 allows local users to bypass ASLR on setuid programs (such as /bin/su) because install_exec…

The do_hidp_sock_ioctl function in net/bluetooth/hidp/sock.c in the Linux kernel before 5.0.15 allows a local user to o…

An issue was discovered in drm_load_edid_firmware in drivers/gpu/drm/drm_edid_load.c in the Linux kernel through 5.1.5.…

In arch/x86/lib/insn-eval.c in the Linux kernel before 5.1.9, there is a use-after-free for access to an LDT entry beca…

In the Linux kernel before 5.2.3, set_geometry in drivers/block/floppy.c does not validate the sect and head fields, as…

An issue was discovered in the Linux kernel before 5.1.17. There is a NULL pointer dereference caused by a malicious US…

An issue was discovered in the Linux kernel before 5.0.1. There is a memory leak in register_queue_kobjects() in net/co…

An issue was discovered in net/wireless/nl80211.c in the Linux kernel through 5.2.17. It does not check the length of v…

References