Red Hat Security Advisory: kernel-alt security and bug fix update

Fixed packages 19

Vulnerabilities 12

• Medium 6.5
  CVE-2018-16884

  A flaw was found in the Linux kernel's NFS41+ subsystem. NFS41+ shares mounted in different network namespaces at the s…

  [UNKNOWN] kernel: linux-raspi2 linux-hwe Debian Ubuntu
  Dec 18, 2018
• Medium 6.5
  CVE-2020-8834

  Linux kernel KVM Power8 conflicting use of HSTATE_HOST_R1

  KVM in the Linux kernel on Power8 processors has a conflicting use of HSTATE_HOST_R1 to store r1 state in kvmppc_hv_entry plus in kvmppc_{save,restore}_tm, leading to a stack corruption. Because of this, an attacker with the ability run code in kernel space o…

  Linux kernel Linux kernel linux-hwe linux-riscv Linux Debian Ubuntu
  Apr 9, 2020
• Unscored —
  CVE-2019-11811

  An issue was discovered in the Linux kernel before 5.0.4. There is a use-after-free upon attempted read access to /proc…

  linux-hwe linux-azure linux linux Debian Ubuntu
  May 7, 2019
• Unscored —
  CVE-2019-15917

  An issue was discovered in the Linux kernel before 5.0.5. There is a use-after-free issue when hci_uart_register_dev() …

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  Sep 4, 2019
• Unscored —
  CVE-2019-18808

  A memory leak in the ccp_run_sha_cmd() function in drivers/crypto/ccp/ccp-ops.c in the Linux kernel through 5.3.9 allow…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  Nov 7, 2019
• Unscored —
  CVE-2019-19062

  A memory leak in the crypto_report() function in crypto/crypto_user_base.c in the Linux kernel through 5.3.11 allows at…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  Nov 18, 2019
• Unscored —
  CVE-2019-19767

  The Linux kernel before 5.4.2 mishandles ext4_expand_extra_isize, as demonstrated by use-after-free errors in __ext4_ex…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  Dec 12, 2019
• Unscored —
  CVE-2019-20636

  In the Linux kernel before 5.4.12, drivers/input/input.c has out-of-bounds writes via a crafted keycode table, as demon…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  Apr 8, 2020
• Unscored —
  CVE-2019-9458

  In the Android kernel in the video driver there is a use after free due to a race condition. This could lead to local e…

  linux-raspi2 linux-hwe linux-azure linux-riscv Android Debian Ubuntu
  Sep 6, 2019
• Unscored —
  CVE-2020-10720

  A flaw was found in the Linux kernel's implementation of GRO in versions before 5.2. This flaw allows an attacker with …

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  Sep 3, 2020
• Unscored —
  CVE-2020-11565

  An issue was discovered in the Linux kernel through 5.6.2. mpol_parse_str in mm/mempolicy.c has a stack-based out-of-bo…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  Apr 6, 2020
• Unscored —
  CVE-2020-12888

  The VFIO PCI driver in the Linux kernel through 5.6.13 mishandles attempts to access disabled memory space.

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  May 15, 2020

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1660375
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1709180
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1760100
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1775021
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1777418
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1781204
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1786160
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1819377
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1819615
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1824059
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1824918
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1836244
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2854.json
• report
  https://access.redhat.com/security/cve/CVE-2018-16884
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-16884
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-16884
• report
  https://access.redhat.com/security/cve/CVE-2019-9458
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-9458
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-9458
• report
  https://access.redhat.com/security/cve/CVE-2019-11811
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-11811
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-11811
• report
  https://access.redhat.com/security/cve/CVE-2019-15917
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-15917
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-15917
• report
  https://access.redhat.com/security/cve/CVE-2019-18808
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-18808
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-18808
• report
  https://access.redhat.com/security/cve/CVE-2019-19062
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-19062
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-19062
• report
  https://access.redhat.com/security/cve/CVE-2019-19767
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-19767
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-19767
• report
  https://access.redhat.com/security/cve/CVE-2019-20636
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-20636
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-20636
• report
  https://access.redhat.com/security/cve/CVE-2020-8834