Red Hat Security Advisory: kernel security and bug fix update

Fixed packages 45

Vulnerabilities 12

• High 7.9
  CVE-2019-9503

  Broadcom brcmfmac driver is vulnerable to a frame validation bypass

  The Broadcom brcmfmac WiFi driver prior to commit a4176ec356c73a46c07c181c6d04039fafa34a9f is vulnerable to a frame validation bypass. If the brcmfmac driver receives a firmware event frame from a remote source, the is_wlc_event_frame function will cause this…

  Broadcom brcmfmac WiFi driver linux-raspi2 linux-hwe Debian Ubuntu
  Jan 16, 2020
• Medium 5.9
  CVE-2020-10711

  A NULL pointer dereference flaw was found in the Linux kernel's SELinux subsystem in versions before 5.7. This flaw occ…

  Red Hat kernel linux-raspi2 linux-hwe Debian Ubuntu
  May 22, 2020
• Medium 5.6
  CVE-2019-3901

  A race condition in perf_event_open() allows local attackers to leak sensitive data from setuid programs. As no relevan…

  The Linux Foundation Kernel linux-raspi2 linux-riscv Debian Ubuntu
  Apr 22, 2019
• Unscored —
  CVE-2017-18595

  An issue was discovered in the Linux kernel before 4.14.11. A double free may be caused by the function allocate_trace_…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  Sep 4, 2019
• Unscored —
  CVE-2018-20169

  An issue was discovered in the Linux kernel before 4.19.9. The USB subsystem mishandles size checks during the reading …

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Dec 17, 2018
• Unscored —
  CVE-2018-7191

  In the tun subsystem in the Linux kernel before 4.13.14, dev_get_valid_name is not called before register_netdevice. Th…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  May 17, 2019
• Unscored —
  CVE-2019-10639

  The Linux kernel 4.x (starting from 4.1) and 5.x before 5.0.8 allows Information Exposure (partial kernel address discl…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  Jul 5, 2019
• Unscored —
  CVE-2019-12382

  An issue was discovered in drm_load_edid_firmware in drivers/gpu/drm/drm_edid_load.c in the Linux kernel through 5.1.5.…

  linux-azure linux linux linux-aws Debian Ubuntu
  May 28, 2019
• Unscored —
  CVE-2019-13233

  In arch/x86/lib/insn-eval.c in the Linux kernel before 5.1.9, there is a use-after-free for access to an LDT entry beca…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  Jul 4, 2019
• Unscored —
  CVE-2019-14283

  In the Linux kernel before 5.2.3, set_geometry in drivers/block/floppy.c does not validate the sect and head fields, as…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  Jul 26, 2019
• Unscored —
  CVE-2019-15916

  An issue was discovered in the Linux kernel before 5.0.1. There is a memory leak in register_queue_kobjects() in net/co…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  Sep 4, 2019
• Unscored —
  CVE-2019-19768

  In the Linux kernel 5.4.0-rc2, there is a use-after-free (read) in the __blk_add_trace function in kernel/trace/blktrac…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  Dec 12, 2019

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1660385
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1701245
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1701842
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1715554
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1716328
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1727756
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1729933
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1734243
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1750813
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1758671
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1786164
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1825116
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2522.json
• report
  https://access.redhat.com/security/cve/CVE-2017-18595
• advisory
  https://www.cve.org/CVERecord?id=CVE-2017-18595
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2017-18595
• report
  https://access.redhat.com/security/cve/CVE-2018-7191
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-7191
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-7191
• report
  https://access.redhat.com/security/cve/CVE-2018-20169
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-20169
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-20169
• report
  https://access.redhat.com/security/cve/CVE-2019-3901
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-3901
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-3901
• report
  https://access.redhat.com/security/cve/CVE-2019-9503
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-9503
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-9503
• article
  https://blog.quarkslab.com/reverse-engineering-broadcom-wireless-chipsets.html#cve-2019-9503-remotely-sending-firmware-events-bypassing-is-wlc-event-frame
• article
  https://kb.cert.org/vuls/id/166939/
• article
  https://www.bleepingcomputer.com/news/security/broadcom-wifi-driver-flaws-expose-computers-phones-iot-to-rce-attacks/
• report
  https://access.redhat.com/security/cve/CVE-2019-10639
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-10639
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-10639
• article
  https://arxiv.org/pdf/1906.10478.pdf
• report
  https://access.redhat.com/security/cve/CVE-2019-12382
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-12382
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-12382