Red Hat Security Advisory: kernel-rt security and bug fix update

Fixed packages 28

Vulnerabilities 5

• Medium 6.7
  CVE-2020-14386 Public exploit

  A flaw was found in the Linux kernel before 5.9-rc4. Memory corruption can be exploited to gain root privileges from un…

  Linux kernel kernel linux-raspi2 linux-hwe Debian Ubuntu
  Sep 16, 2020
• Medium 5.5
  CVE-2020-14385

  A flaw was found in the Linux kernel before 5.9-rc4. A failure of the file system metadata validator in XFS can cause a…

  Linux kernel kernel linux-raspi2 linux-hwe Debian Ubuntu
  Sep 15, 2020
• Unscored —
  CVE-2020-12351 Public exploit

  Improper input validation in BlueZ may allow an unauthenticated user to potentially enable escalation of privilege via …

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  Nov 23, 2020
• Unscored —
  CVE-2020-12352 Public exploit

  Improper access control in BlueZ may allow an unauthenticated user to potentially enable information disclosure via adj…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  Nov 23, 2020
• Unscored —
  CVE-2020-14331

  A flaw was found in the Linux kernel’s implementation of the invert video code on VGA consoles when a local attacker at…

  linux-raspi2 linux-azure linux-riscv linux-gcp Linux Debian Ubuntu
  Sep 15, 2020

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://access.redhat.com/security/vulnerabilities/BleedingTooth
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1858679
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1874800
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1875699
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1886521
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1886529
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4289.json
• report
  https://access.redhat.com/security/cve/CVE-2020-12351
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-12351
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-12351
• article
  https://github.com/google/security-research/security/advisories/GHSA-7mh3-gq28-gfrq
• article
  https://github.com/google/security-research/security/advisories/GHSA-h637-c88j-47wq
• article
  https://lore.kernel.org/linux-bluetooth/20200806181714.3216076-1-luiz.dentz@gmail.com/
• article
  https://lore.kernel.org/linux-bluetooth/20200806181714.3216076-2-luiz.dentz@gmail.com/
• article
  https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00435.html
• article
  https://www.zdnet.com/article/google-warns-of-severe-bleedingtooth-bluetooth-flaw-in-linux-kernel/
• report
  https://access.redhat.com/security/cve/CVE-2020-12352
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-12352
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-12352
• report
  https://access.redhat.com/security/cve/CVE-2020-14331
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-14331
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-14331
• report
  https://access.redhat.com/security/cve/CVE-2020-14385
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-14385
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-14385
• article
  https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f4020438fab05364018c91f7e02ebdd192085933
• report
  https://access.redhat.com/security/cve/CVE-2020-14386
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-14386
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-14386
• article
  https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=acf69c946233259ab4d64f8869d4037a198c7f06
• article
  https://seclists.org/oss-sec/2020/q3/146