RHSA-2020:4609 — Red Hat Security Advisory: kernel-rt security and bug fix update

Fixed packages 28

Release	Package	Fixed in
Red Hat · RHEL 8 enterprise_linux:8::nfv	kernel-rt	0:4.18.0-240.rt7.54.el8
Red Hat · RHEL 8 enterprise_linux:8::nfv	kernel-rt-core	0:4.18.0-240.rt7.54.el8
Red Hat · RHEL 8 enterprise_linux:8::nfv	kernel-rt-debug	0:4.18.0-240.rt7.54.el8
Red Hat · RHEL 8 enterprise_linux:8::nfv	kernel-rt-debug-core	0:4.18.0-240.rt7.54.el8
Red Hat · RHEL 8 enterprise_linux:8::nfv	kernel-rt-debug-debuginfo	0:4.18.0-240.rt7.54.el8
Red Hat · RHEL 8 enterprise_linux:8::nfv	kernel-rt-debug-devel	0:4.18.0-240.rt7.54.el8
Red Hat · RHEL 8 enterprise_linux:8::nfv	kernel-rt-debug-kvm	0:4.18.0-240.rt7.54.el8
Red Hat · RHEL 8 enterprise_linux:8::nfv	kernel-rt-debug-modules	0:4.18.0-240.rt7.54.el8
Red Hat · RHEL 8 enterprise_linux:8::nfv	kernel-rt-debug-modules-extra	0:4.18.0-240.rt7.54.el8
Red Hat · RHEL 8 enterprise_linux:8::nfv	kernel-rt-debuginfo	0:4.18.0-240.rt7.54.el8
Red Hat · RHEL 8 enterprise_linux:8::nfv	kernel-rt-debuginfo-common-x86_64	0:4.18.0-240.rt7.54.el8
Red Hat · RHEL 8 enterprise_linux:8::nfv	kernel-rt-devel	0:4.18.0-240.rt7.54.el8
Red Hat · RHEL 8 enterprise_linux:8::nfv	kernel-rt-kvm	0:4.18.0-240.rt7.54.el8
Red Hat · RHEL 8 enterprise_linux:8::nfv	kernel-rt-modules	0:4.18.0-240.rt7.54.el8
Red Hat · RHEL 8 enterprise_linux:8::nfv	kernel-rt-modules-extra	0:4.18.0-240.rt7.54.el8
Red Hat · RHEL 8 enterprise_linux:8::realtime	kernel-rt	0:4.18.0-240.rt7.54.el8
Red Hat · RHEL 8 enterprise_linux:8::realtime	kernel-rt-core	0:4.18.0-240.rt7.54.el8
Red Hat · RHEL 8 enterprise_linux:8::realtime	kernel-rt-debug	0:4.18.0-240.rt7.54.el8
Red Hat · RHEL 8 enterprise_linux:8::realtime	kernel-rt-debug-core	0:4.18.0-240.rt7.54.el8
Red Hat · RHEL 8 enterprise_linux:8::realtime	kernel-rt-debug-debuginfo	0:4.18.0-240.rt7.54.el8
Red Hat · RHEL 8 enterprise_linux:8::realtime	kernel-rt-debug-devel	0:4.18.0-240.rt7.54.el8
Red Hat · RHEL 8 enterprise_linux:8::realtime	kernel-rt-debug-modules	0:4.18.0-240.rt7.54.el8
Red Hat · RHEL 8 enterprise_linux:8::realtime	kernel-rt-debug-modules-extra	0:4.18.0-240.rt7.54.el8
Red Hat · RHEL 8 enterprise_linux:8::realtime	kernel-rt-debuginfo	0:4.18.0-240.rt7.54.el8
Red Hat · RHEL 8 enterprise_linux:8::realtime	kernel-rt-debuginfo-common-x86_64	0:4.18.0-240.rt7.54.el8
Red Hat · RHEL 8 enterprise_linux:8::realtime	kernel-rt-devel	0:4.18.0-240.rt7.54.el8
Red Hat · RHEL 8 enterprise_linux:8::realtime	kernel-rt-modules	0:4.18.0-240.rt7.54.el8
Red Hat · RHEL 8 enterprise_linux:8::realtime	kernel-rt-modules-extra	0:4.18.0-240.rt7.54.el8

Vulnerabilities 42

High 7.8

CVE-2020-14381 Public exploit

A flaw was found in the Linux kernel’s futex implementation. This flaw allows a local attacker to corrupt system memory…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Dec 3, 2020
Medium 6.1

CVE-2019-19332

An out-of-bounds memory write issue was found in the Linux Kernel, version 3.13 through 5.4, in the way the Linux kerne…

Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu

Jan 9, 2020
Medium 6.1

CVE-2020-10751

A flaw was found in the Linux kernels SELinux LSM hook implementation before version 5.7, where it incorrectly assumed …

The Linux Foundation Kernel linux-raspi2 linux-hwe Debian Ubuntu

May 26, 2020
Low 3.3

CVE-2020-10732

A flaw was found in the Linux kernel's implementation of Userspace core dumps. This flaw allows an attacker with a loca…

Linux kernel kernel linux-raspi2 linux-hwe Debian Ubuntu

Jun 12, 2020
Unscored —

CVE-2019-15917

An issue was discovered in the Linux kernel before 5.0.5. There is a use-after-free issue when hci_uart_register_dev() …

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Sep 4, 2019
Unscored —

CVE-2019-15925

An issue was discovered in the Linux kernel before 5.2.3. An out of bounds access exists in the function hclge_tm_schd_…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Sep 4, 2019
Unscored —

CVE-2019-16231

drivers/net/fjes/fjes_main.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value, leading to a N…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Sep 11, 2019
Unscored —

CVE-2019-16233

drivers/scsi/qla2xxx/qla_os.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value, leading to a …

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Sep 11, 2019
Unscored —

CVE-2019-18808

A memory leak in the ccp_run_sha_cmd() function in drivers/crypto/ccp/ccp-ops.c in the Linux kernel through 5.3.9 allow…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Nov 7, 2019
Unscored —

CVE-2019-18809

A memory leak in the af9005_identify_state() function in drivers/media/usb/dvb-usb/af9005.c in the Linux kernel through…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Nov 7, 2019
Unscored —

CVE-2019-19046

A memory leak in the __ipmi_bmc_register() function in drivers/char/ipmi/ipmi_msghandler.c in the Linux kernel through …

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Nov 18, 2019
Unscored —

CVE-2019-19056

A memory leak in the mwifiex_pcie_alloc_cmdrsp_buf() function in drivers/net/wireless/marvell/mwifiex/pcie.c in the Lin…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Nov 18, 2019
Unscored —

CVE-2019-19062

A memory leak in the crypto_report() function in crypto/crypto_user_base.c in the Linux kernel through 5.3.11 allows at…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Nov 18, 2019
Unscored —

CVE-2019-19063

Two memory leaks in the rtl_usb_probe() function in drivers/net/wireless/realtek/rtlwifi/usb.c in the Linux kernel thro…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Nov 18, 2019
Unscored —

CVE-2019-19068

A memory leak in the rtl8xxxu_submit_int_urb() function in drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c in the…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Nov 18, 2019
Unscored —

CVE-2019-19072

A memory leak in the predicate_parse() function in kernel/trace/trace_events_filter.c in the Linux kernel through 5.3.1…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Nov 18, 2019
Unscored —

CVE-2019-19319

In the Linux kernel before 5.2, a setxattr operation, after a mount of a crafted ext4 image, can cause a slab-out-of-bo…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Nov 27, 2019
Unscored —

CVE-2019-19447 Public exploit

In the Linux kernel 5.0.21, mounting a crafted ext4 filesystem image, performing some operations, and unmounting can le…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Dec 8, 2019
Unscored —

CVE-2019-19524

In the Linux kernel before 5.3.12, there is a use-after-free bug that can be caused by a malicious USB device in the dr…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Dec 3, 2019
Unscored —

CVE-2019-19533

In the Linux kernel before 5.3.4, there is an info-leak bug that can be caused by a malicious USB device in the drivers…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Dec 3, 2019
Unscored —

CVE-2019-19537

In the Linux kernel before 5.2.10, there is a race condition bug that can be caused by a malicious USB device in the US…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Dec 3, 2019
Unscored —

CVE-2019-19543

In the Linux kernel before 5.1.6, there is a use-after-free in serial_ir_init_module() in drivers/media/rc/serial_ir.c.

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Dec 3, 2019
Unscored —

CVE-2019-19767

The Linux kernel before 5.4.2 mishandles ext4_expand_extra_isize, as demonstrated by use-after-free errors in __ext4_ex…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Dec 12, 2019
Unscored —

CVE-2019-19770

In the Linux kernel 4.19.83, there is a use-after-free (read) in the debugfs_remove function in fs/debugfs/inode.c (whi…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Dec 12, 2019
Unscored —

CVE-2019-20054

In the Linux kernel before 5.0.6, there is a NULL pointer dereference in drop_sysctl_table() in fs/proc/proc_sysctl.c, …

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Dec 28, 2019
Unscored —

CVE-2019-20636

In the Linux kernel before 5.4.12, drivers/input/input.c has out-of-bounds writes via a crafted keycode table, as demon…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Apr 8, 2020
Unscored —

CVE-2019-9455

In the Android kernel in the video driver there is a kernel pointer leak due to a WARN_ON statement. This could lead to…

linux-raspi2 linux-hwe linux-azure linux-riscv Android Debian Ubuntu

Sep 6, 2019
Unscored —

CVE-2019-9458

In the Android kernel in the video driver there is a use after free due to a race condition. This could lead to local e…

linux-raspi2 linux-hwe linux-azure linux-riscv Android Debian Ubuntu

Sep 6, 2019
Unscored —

CVE-2020-0305

In cdev_get of char_dev.c, there is a possible use-after-free due to a race condition. This could lead to local escalat…

linux-raspi2 linux-hwe linux-azure linux-riscv Android Debian Ubuntu

Jul 17, 2020
Unscored —

CVE-2020-10774

A memory disclosure flaw was found in the Linux kernel's versions before 4.18.0-193.el8 in the sysctl subsystem when re…

linux-raspi2 linux-azure linux-gcp linux-hwe-edge Ubuntu

May 27, 2021
Unscored —

CVE-2020-10942

In the Linux kernel before 5.5.8, get_raw_socket in drivers/vhost/net.c lacks validation of an sk_family field, which m…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Mar 24, 2020
Unscored —

CVE-2020-11565

An issue was discovered in the Linux kernel through 5.6.2. mpol_parse_str in mm/mempolicy.c has a stack-based out-of-bo…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Apr 6, 2020
Unscored —

CVE-2020-11668

In the Linux kernel before 5.6.1, drivers/media/usb/gspca/xirlink_cit.c (aka the Xirlink camera USB driver) mishandles …

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Apr 9, 2020
Unscored —

CVE-2020-12655

An issue was discovered in xfs_agf_verify in fs/xfs/libxfs/xfs_alloc.c in the Linux kernel through 5.6.10. Attackers ma…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

May 5, 2020
Unscored —

CVE-2020-12659

An issue was discovered in the Linux kernel before 5.6.7. xdp_umem_reg in net/xdp/xdp_umem.c has an out-of-bounds write…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

May 5, 2020
Unscored —

CVE-2020-12770

An issue was discovered in the Linux kernel through 5.6.11. sg_write lacks an sg_remove_request call in a certain failu…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

May 9, 2020
Unscored —

CVE-2020-12826

A signal access-control issue was discovered in the Linux kernel before 5.6.5, aka CID-7395ea4e65c2. Because exec_id in…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

May 12, 2020
Unscored —

CVE-2020-25641

A flaw was found in the Linux kernel's implementation of biovecs in versions before 5.9-rc7. A zero-length biovec reque…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Oct 6, 2020
Unscored —

CVE-2020-8647

There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vc_do_resize function in drivers/tty/v…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Feb 6, 2020
Unscored —

CVE-2020-8648

There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the n_tty_receive_buf_common function in d…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Feb 6, 2020
Unscored —

CVE-2020-8649

There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vgacon_invert_region function in drive…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Feb 6, 2020
Unscored —

CVE-2021-3715

A flaw was found in the "Routing decision" classifier in the Linux kernel's Traffic Control networking subsystem in the…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Mar 2, 2022

References

article
https://access.redhat.com/security/updates/classification/#moderate
article
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.3_release_notes/index
report
https://bugzilla.redhat.com/show_bug.cgi?id=1733495
report
https://bugzilla.redhat.com/show_bug.cgi?id=1759052
report
https://bugzilla.redhat.com/show_bug.cgi?id=1760100
report
https://bugzilla.redhat.com/show_bug.cgi?id=1760310
report
https://bugzilla.redhat.com/show_bug.cgi?id=1760420
report
https://bugzilla.redhat.com/show_bug.cgi?id=1774946
report
https://bugzilla.redhat.com/show_bug.cgi?id=1774963
report
https://bugzilla.redhat.com/show_bug.cgi?id=1774988
report
https://bugzilla.redhat.com/show_bug.cgi?id=1775015
report
https://bugzilla.redhat.com/show_bug.cgi?id=1775021
report
https://bugzilla.redhat.com/show_bug.cgi?id=1775097
report
https://bugzilla.redhat.com/show_bug.cgi?id=1777418
report
https://bugzilla.redhat.com/show_bug.cgi?id=1777449
report
https://bugzilla.redhat.com/show_bug.cgi?id=1779046
report
https://bugzilla.redhat.com/show_bug.cgi?id=1779594
report
https://bugzilla.redhat.com/show_bug.cgi?id=1781679
report
https://bugzilla.redhat.com/show_bug.cgi?id=1781810
report
https://bugzilla.redhat.com/show_bug.cgi?id=1783459
report
https://bugzilla.redhat.com/show_bug.cgi?id=1783534
report
https://bugzilla.redhat.com/show_bug.cgi?id=1783561
report
https://bugzilla.redhat.com/show_bug.cgi?id=1784130
report
https://bugzilla.redhat.com/show_bug.cgi?id=1786160
report
https://bugzilla.redhat.com/show_bug.cgi?id=1786179
report
https://bugzilla.redhat.com/show_bug.cgi?id=1790063
report
https://bugzilla.redhat.com/show_bug.cgi?id=1802555
report
https://bugzilla.redhat.com/show_bug.cgi?id=1802559
report
https://bugzilla.redhat.com/show_bug.cgi?id=1802563
report
https://bugzilla.redhat.com/show_bug.cgi?id=1817718
report
https://bugzilla.redhat.com/show_bug.cgi?id=1819377
report
https://bugzilla.redhat.com/show_bug.cgi?id=1819399
report
https://bugzilla.redhat.com/show_bug.cgi?id=1822077
report
https://bugzilla.redhat.com/show_bug.cgi?id=1824059
report
https://bugzilla.redhat.com/show_bug.cgi?id=1824792
report
https://bugzilla.redhat.com/show_bug.cgi?id=1824918
report
https://bugzilla.redhat.com/show_bug.cgi?id=1831399
report
https://bugzilla.redhat.com/show_bug.cgi?id=1832543
report
https://bugzilla.redhat.com/show_bug.cgi?id=1832876

Red Hat Security Advisory: kernel-rt security and bug fix update

Fixed packages 28

Vulnerabilities 42

A flaw was found in the Linux kernel’s futex implementation. This flaw allows a local attacker to corrupt system memory…

An out-of-bounds memory write issue was found in the Linux Kernel, version 3.13 through 5.4, in the way the Linux kerne…

A flaw was found in the Linux kernels SELinux LSM hook implementation before version 5.7, where it incorrectly assumed …

A flaw was found in the Linux kernel's implementation of Userspace core dumps. This flaw allows an attacker with a loca…

An issue was discovered in the Linux kernel before 5.0.5. There is a use-after-free issue when hci_uart_register_dev() …

An issue was discovered in the Linux kernel before 5.2.3. An out of bounds access exists in the function hclge_tm_schd_…

drivers/net/fjes/fjes_main.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value, leading to a N…

drivers/scsi/qla2xxx/qla_os.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value, leading to a …

A memory leak in the ccp_run_sha_cmd() function in drivers/crypto/ccp/ccp-ops.c in the Linux kernel through 5.3.9 allow…

A memory leak in the af9005_identify_state() function in drivers/media/usb/dvb-usb/af9005.c in the Linux kernel through…

A memory leak in the __ipmi_bmc_register() function in drivers/char/ipmi/ipmi_msghandler.c in the Linux kernel through …

A memory leak in the mwifiex_pcie_alloc_cmdrsp_buf() function in drivers/net/wireless/marvell/mwifiex/pcie.c in the Lin…

A memory leak in the crypto_report() function in crypto/crypto_user_base.c in the Linux kernel through 5.3.11 allows at…

Two memory leaks in the rtl_usb_probe() function in drivers/net/wireless/realtek/rtlwifi/usb.c in the Linux kernel thro…

A memory leak in the rtl8xxxu_submit_int_urb() function in drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c in the…

A memory leak in the predicate_parse() function in kernel/trace/trace_events_filter.c in the Linux kernel through 5.3.1…

In the Linux kernel before 5.2, a setxattr operation, after a mount of a crafted ext4 image, can cause a slab-out-of-bo…

In the Linux kernel 5.0.21, mounting a crafted ext4 filesystem image, performing some operations, and unmounting can le…

In the Linux kernel before 5.3.12, there is a use-after-free bug that can be caused by a malicious USB device in the dr…

In the Linux kernel before 5.3.4, there is an info-leak bug that can be caused by a malicious USB device in the drivers…

In the Linux kernel before 5.2.10, there is a race condition bug that can be caused by a malicious USB device in the US…

In the Linux kernel before 5.1.6, there is a use-after-free in serial_ir_init_module() in drivers/media/rc/serial_ir.c.

The Linux kernel before 5.4.2 mishandles ext4_expand_extra_isize, as demonstrated by use-after-free errors in __ext4_ex…

In the Linux kernel 4.19.83, there is a use-after-free (read) in the debugfs_remove function in fs/debugfs/inode.c (whi…

In the Linux kernel before 5.0.6, there is a NULL pointer dereference in drop_sysctl_table() in fs/proc/proc_sysctl.c, …

In the Linux kernel before 5.4.12, drivers/input/input.c has out-of-bounds writes via a crafted keycode table, as demon…

In the Android kernel in the video driver there is a kernel pointer leak due to a WARN_ON statement. This could lead to…

In the Android kernel in the video driver there is a use after free due to a race condition. This could lead to local e…

In cdev_get of char_dev.c, there is a possible use-after-free due to a race condition. This could lead to local escalat…

A memory disclosure flaw was found in the Linux kernel's versions before 4.18.0-193.el8 in the sysctl subsystem when re…

In the Linux kernel before 5.5.8, get_raw_socket in drivers/vhost/net.c lacks validation of an sk_family field, which m…

An issue was discovered in the Linux kernel through 5.6.2. mpol_parse_str in mm/mempolicy.c has a stack-based out-of-bo…

In the Linux kernel before 5.6.1, drivers/media/usb/gspca/xirlink_cit.c (aka the Xirlink camera USB driver) mishandles …

An issue was discovered in xfs_agf_verify in fs/xfs/libxfs/xfs_alloc.c in the Linux kernel through 5.6.10. Attackers ma…

An issue was discovered in the Linux kernel before 5.6.7. xdp_umem_reg in net/xdp/xdp_umem.c has an out-of-bounds write…

An issue was discovered in the Linux kernel through 5.6.11. sg_write lacks an sg_remove_request call in a certain failu…

A signal access-control issue was discovered in the Linux kernel before 5.6.5, aka CID-7395ea4e65c2. Because exec_id in…

A flaw was found in the Linux kernel's implementation of biovecs in versions before 5.9-rc7. A zero-length biovec reque…

There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vc_do_resize function in drivers/tty/v…

There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the n_tty_receive_buf_common function in d…

There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vgacon_invert_region function in drive…

A flaw was found in the "Routing decision" classifier in the Linux kernel's Traffic Control networking subsystem in the…

References