SUSE-SU-2020:1663-1 — Security update for the Linux Kernel

Summary

The SUSE Linux Enterprise 15 kernel was updated receive various security and bugfixes.

The following security bugs were fixed:

- CVE-2020-0543: Fixed a side channel attack against special registers which could have resulted in leaking of read values to cores other than the one which called it.
This attack is known as Special Register Buffer Data Sampling (SRBDS) or 'CrossTalk' (bsc#1154824).
- CVE-2020-9383: Fixed an out-of-bounds read due to improper error condition check of FDC index (bsc#1165111).
- CVE-2020-8992: Fixed an issue which could have allowed attackers to cause a soft lockup via a crafted journal size (bsc#1164069).
- CVE-2020-8834: Fixed a stack corruption which could have lead to kernel panic (bsc#1168276).
- CVE-2020-8649: Fixed a use-after-free in the vgacon_invert_region function in drivers/video/console/vgacon.c (bsc#1162931).
- CVE-2020-8648: Fixed a use-after-free in the n_tty_receive_buf_common function in drivers/tty/n_tty.c (bsc#1162928).
- CVE-2020-8647: Fixed a use-after-free in the vc_do_resize function in drivers/tty/vt/vt.c (bsc#1162929).
- CVE-2020-8428: Fixed a use-after-free which could have allowed local users to cause a denial of service (bsc#1162109).
- CVE-2020-7053: Fixed a use-after-free in the i915_ppgtt_close function in drivers/gpu/drm/i915/i915_gem_gtt.c (bsc#1160966).
- CVE-2020-2732: Fixed an issue affecting Intel CPUs where an L2 guest may trick the L0 hypervisor into accessing sensitive L1 resources (bsc#1163971).
- CVE-2020-13143: Fixed an out-of-bounds read in gadget_dev_desc_UDC_store in drivers/usb/gadget/configfs.c (bsc#1171982).
- CVE-2020-12769: Fixed an issue which could have allowed attackers to cause a panic via concurrent calls to dw_spi_irq and dw_spi_transfer_one (bsc#1171983).
- CVE-2020-12657: An a use-after-free in block/bfq-iosched.c (bsc#1171205).
- CVE-2020-12656: Fixed an improper handling of certain domain_release calls leadingch could have led to a memory leak (bsc#1171219).
- CVE-2020-12655: Fixed an issue which could have allowed attackers to trigger a sync of excessive duration via an XFS v5 image with crafted metadata (bsc#1171217).
- CVE-2020-12654: Fixed an issue in he wifi driver which could have allowed a remote AP to trigger a heap-based buffer overflow (bsc#1171202).
- CVE-2020-12653: Fixed an issue in the wifi driver which could have allowed local users to gain privileges or cause a denial of service (bsc#1171195).
- CVE-2020-12652: Fixed an issue which could have allowed local users to hold an incorrect lock during the ioctl operation and trigger a race condition (bsc#1171218).
- CVE-2020-12464: Fixed a use-after-free due to a transfer without a reference (bsc#1170901).
- CVE-2020-12114: Fixed a pivot_root race condition which could have allowed local users to cause a denial of service (panic) by corrupting a mountpoint reference counter (bsc#1171098).
- CVE-2020-11669: Fixed an issue where arch/powerpc/kernel/idle_book3s.S did not have save/restore functionality for PNV_POWERSAVE_AMR, PNV_POWERSAVE_UAMOR, and PNV_POWERSAVE_AMOR (bnc#1169390).
- CVE-2020-11609: Fixed a null pointer dereference due to improper handling of descriptors (bsc#1168854).
- CVE-2020-11608: Fixed a null pointer dereferences via a crafted USB (bsc#1168829).
- CVE-2020-11494: Fixed an issue which could have allowed attackers to read uninitialized can_frame data (bsc#1168424).
- CVE-2020-10942: Fixed a kernel stack corruption via crafted system calls (bsc#1167629).
- CVE-2020-10757: Fixed an issue where remaping hugepage DAX to anon mmap could have caused user PTE access (bsc#1172317).
- CVE-2020-10751: Fixed an improper implementation in SELinux LSM hook where it was assumed that an skb would only contain a single netlink message (bsc#1171189).
- CVE-2020-10732: Fixed kernel data leak in userspace coredumps due to uninitialized data (bsc#1171220).
- CVE-2020-10720: Fixed a use-after-free read in napi_gro_frags() (bsc#1170778).
- CVE-2020-10711: Fixed a null pointer dereference in SELinux subsystem which could have allowed a remote network user to crash the kernel resulting in a denial of service (bsc#1171191).
- CVE-2020-10690: Fixed the race between the release of ptp_clock and cdev (bsc#1170056).
- CVE-2019-9458: Fixed a use after free due to a race condition which could have led to privilege escalation of privilege (bsc#1168295).
- CVE-2019-9455: Fixed a pointer leak due to a WARN_ON statement in a video driver. This could lead to local information disclosure with System execution privileges needed (bsc#1170345).
- CVE-2019-3701: Fixed an issue in can_can_gw_rcv, which could cause a system crash (bsc#1120386).
- CVE-2019-20812: Fixed an issue in prb_calc_retire_blk_tmo() which could have resulted in a denial of service (bsc#1172453).
- CVE-2019-20810: Fixed a memory leak in due to not calling of snd_card_free (bsc#1172458).
- CVE-2019-20096: Fixed a memory leak in __feat_register_sp() in net/dccp/feat.c, which could have caused denial of service (bsc#1159908).
- CVE-2019-20095: Fixed an improper error-handling cases that did not free allocated hostcmd memory which was causing memory leak (bsc#1159909).
- CVE-2019-20054: Fixed a null pointer dereference in drop_sysctl_table() in fs/proc/proc_sysctl.c, related to put_links (bsc#1159910).
- CVE-2019-19966: Fixed a use-after-free in cpia2_exit() which could have caused denial of service (bsc#1159841).
- CVE-2019-19965: Fixed a null pointer dereference, due to mishandling of port disconnection during discovery (bsc#1159911).
- CVE-2019-19770: Fixed a use-after-free in the debugfs_remove function (bsc#1159198).
- CVE-2019-19768: Fixed a use-after-free in the __blk_add_trace function in kernel/trace/blktrace.c (bsc#1159285).
- CVE-2019-19462: Fixed an issue which could have allowed local user to cause denial of service (bsc#1158265).
- CVE-2019-19447: Fixed a user after free via a crafted ext4 filesystem image (bsc#1158819).
- CVE-2019-19319: Fixed a user after free when a large old_s

Fixed packages 28

Release	Package	Fixed in
SUSE · SLES 15 Linux Enterprise High Availability Extension 15	kernel-default	4.12.14-150.52.1
SUSE · SLE HPC 15 Linux Enterprise High Performance Computing 15-ESPOS	kernel-default	4.12.14-150.52.1
SUSE · SLE HPC 15 Linux Enterprise High Performance Computing 15-ESPOS	kernel-docs	4.12.14-150.52.1
SUSE · SLE HPC 15 Linux Enterprise High Performance Computing 15-ESPOS	kernel-obs-build	4.12.14-150.52.1
SUSE · SLE HPC 15 Linux Enterprise High Performance Computing 15-ESPOS	kernel-source	4.12.14-150.52.1
SUSE · SLE HPC 15 Linux Enterprise High Performance Computing 15-ESPOS	kernel-syms	4.12.14-150.52.1
SUSE · SLE HPC 15 Linux Enterprise High Performance Computing 15-ESPOS	kernel-vanilla	4.12.14-150.52.1
SUSE · SLE HPC 15 Linux Enterprise High Performance Computing 15-LTSS	kernel-default	4.12.14-150.52.1
SUSE · SLE HPC 15 Linux Enterprise High Performance Computing 15-LTSS	kernel-docs	4.12.14-150.52.1
SUSE · SLE HPC 15 Linux Enterprise High Performance Computing 15-LTSS	kernel-obs-build	4.12.14-150.52.1
SUSE · SLE HPC 15 Linux Enterprise High Performance Computing 15-LTSS	kernel-source	4.12.14-150.52.1
SUSE · SLE HPC 15 Linux Enterprise High Performance Computing 15-LTSS	kernel-syms	4.12.14-150.52.1
SUSE · SLE HPC 15 Linux Enterprise High Performance Computing 15-LTSS	kernel-vanilla	4.12.14-150.52.1
SUSE · SLE Live Patching 15 Linux Enterprise Live Patching 15	kernel-default	4.12.14-150.52.1
SUSE · SLE Live Patching 15 Linux Enterprise Live Patching 15	kernel-livepatch-SLE15_Update_18	1-1.5.1
SUSE · SLES 15 Linux Enterprise Server 15-LTSS	kernel-default	4.12.14-150.52.1
SUSE · SLES 15 Linux Enterprise Server 15-LTSS	kernel-docs	4.12.14-150.52.1
SUSE · SLES 15 Linux Enterprise Server 15-LTSS	kernel-obs-build	4.12.14-150.52.1
SUSE · SLES 15 Linux Enterprise Server 15-LTSS	kernel-source	4.12.14-150.52.1
SUSE · SLES 15 Linux Enterprise Server 15-LTSS	kernel-syms	4.12.14-150.52.1
SUSE · SLES 15 Linux Enterprise Server 15-LTSS	kernel-vanilla	4.12.14-150.52.1
SUSE · SLES 15 Linux Enterprise Server 15-LTSS	kernel-zfcpdump	4.12.14-150.52.1
SUSE · SLES for SAP 15 Linux Enterprise Server for SAP Applications 15	kernel-default	4.12.14-150.52.1
SUSE · SLES for SAP 15 Linux Enterprise Server for SAP Applications 15	kernel-docs	4.12.14-150.52.1
SUSE · SLES for SAP 15 Linux Enterprise Server for SAP Applications 15	kernel-obs-build	4.12.14-150.52.1
SUSE · SLES for SAP 15 Linux Enterprise Server for SAP Applications 15	kernel-source	4.12.14-150.52.1
SUSE · SLES for SAP 15 Linux Enterprise Server for SAP Applications 15	kernel-syms	4.12.14-150.52.1
SUSE · SLES for SAP 15 Linux Enterprise Server for SAP Applications 15	kernel-vanilla	4.12.14-150.52.1

Vulnerabilities 55

High 7.8

CVE-2019-14896

A heap-based buffer overflow vulnerability was found in the Linux kernel, version kernel-2.6.32, in Marvell WiFi chip d…

Red Hat kernel linux-raspi2 linux-hwe Debian Ubuntu

Nov 27, 2019
Medium 6.6

CVE-2019-14897

A stack-based buffer overflow was found in the Linux kernel, version kernel-2.6.32, in Marvell WiFi chip driver. An att…

Red Hat kernel linux-raspi2 linux-hwe Debian Ubuntu

Nov 29, 2019
Medium 6.5

CVE-2020-10690

There is a use-after-free in kernel versions before 5.5 due to a race condition between the release of ptp_clock and cd…

Red Hat kernel linux-raspi2 linux-hwe Debian Ubuntu

May 8, 2020
Medium 6.5

CVE-2020-8834

Linux kernel KVM Power8 conflicting use of HSTATE_HOST_R1

KVM in the Linux kernel on Power8 processors has a conflicting use of HSTATE_HOST_R1 to store r1 state in kvmppc_hv_entry plus in kvmppc_{save,restore}_tm, leading to a stack corruption. Because of this, an attacker with the ability run code in kernel space o…

Linux kernel Linux kernel linux-hwe linux-riscv Linux Debian Ubuntu

Apr 9, 2020
Medium 6.1

CVE-2020-10751

A flaw was found in the Linux kernels SELinux LSM hook implementation before version 5.7, where it incorrectly assumed …

The Linux Foundation Kernel linux-raspi2 linux-hwe Debian Ubuntu

May 26, 2020
Medium 5.9

CVE-2020-10711

A NULL pointer dereference flaw was found in the Linux kernel's SELinux subsystem in versions before 5.7. This flaw occ…

Red Hat kernel linux-raspi2 linux-hwe Debian Ubuntu

May 22, 2020
Medium 5.8

CVE-2020-2732

A flaw was discovered in the way that the KVM hypervisor handled instruction emulation for an L2 guest when nested virt…

Oracle Oracle Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

Apr 8, 2020
Low 3.3

CVE-2020-10732

A flaw was found in the Linux kernel's implementation of Userspace core dumps. This flaw allows an attacker with a loca…

Linux kernel kernel linux-raspi2 linux-hwe Debian Ubuntu

Jun 12, 2020
Unscored —

CVE-2018-1000199 Public exploit

The Linux Kernel version 3.18 contains a dangerous feature vulnerability in modify_user_hw_breakpoint() that can result…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

May 24, 2018
Unscored —

CVE-2019-14615 Public exploit

Insufficient control flow in certain data structures for some Intel(R) Processors with Intel(R) Processor Graphics may …

Intel Intel(R) Processors linux-hwe linux-azure Debian Ubuntu

Jan 17, 2020
Unscored —

CVE-2019-16994

In the Linux kernel before 5.0, a memory leak exists in sit_init_net() in net/ipv6/sit.c when register_netdev() fails t…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Sep 30, 2019
Unscored —

CVE-2019-19036

btrfs_root_node in fs/btrfs/ctree.c in the Linux kernel through 5.3.12 allows a NULL pointer dereference because rcu_de…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Nov 21, 2019
Unscored —

CVE-2019-19045

A memory leak in the mlx5_fpga_conn_create_cq() function in drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c in the …

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Nov 18, 2019
Unscored —

CVE-2019-19054

A memory leak in the cx23888_ir_probe() function in drivers/media/pci/cx23885/cx23888-ir.c in the Linux kernel through …

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Nov 18, 2019
Unscored —

CVE-2019-19318

In the Linux kernel 5.3.11, mounting a crafted btrfs image twice can cause an rwsem_down_write_slowpath use-after-free …

linux-raspi2 linux-azure linux-riscv linux-gcp Debian Ubuntu

Nov 27, 2019
Unscored —

CVE-2019-19319

In the Linux kernel before 5.2, a setxattr operation, after a mount of a crafted ext4 image, can cause a slab-out-of-bo…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Nov 27, 2019
Unscored —

CVE-2019-19447 Public exploit

In the Linux kernel 5.0.21, mounting a crafted ext4 filesystem image, performing some operations, and unmounting can le…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Dec 8, 2019
Unscored —

CVE-2019-19462

relay_open in kernel/relay.c in the Linux kernel through 5.4.1 allows local users to cause a denial of service (such as…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Nov 30, 2019
Unscored —

CVE-2019-19768

In the Linux kernel 5.4.0-rc2, there is a use-after-free (read) in the __blk_add_trace function in kernel/trace/blktrac…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Dec 12, 2019
Unscored —

CVE-2019-19770

In the Linux kernel 4.19.83, there is a use-after-free (read) in the debugfs_remove function in fs/debugfs/inode.c (whi…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Dec 12, 2019
Unscored —

CVE-2019-19965

In the Linux kernel through 5.4.6, there is a NULL pointer dereference in drivers/scsi/libsas/sas_discover.c because of…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Dec 25, 2019
Unscored —

CVE-2019-19966

In the Linux kernel before 5.1.6, there is a use-after-free in cpia2_exit() in drivers/media/usb/cpia2/cpia2_v4l.c that…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Dec 25, 2019
Unscored —

CVE-2019-20054

In the Linux kernel before 5.0.6, there is a NULL pointer dereference in drop_sysctl_table() in fs/proc/proc_sysctl.c, …

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Dec 28, 2019
Unscored —

CVE-2019-20095

mwifiex_tm_cmd in drivers/net/wireless/marvell/mwifiex/cfg80211.c in the Linux kernel before 5.1.6 has some error-handl…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Dec 30, 2019
Unscored —

CVE-2019-20096

In the Linux kernel before 5.1, there is a memory leak in __feat_register_sp() in net/dccp/feat.c, which may cause deni…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Dec 30, 2019
Unscored —

CVE-2019-20810

go7007_snd_init in drivers/media/usb/go7007/snd-go7007.c in the Linux kernel before 5.6 does not call snd_card_free for…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Jun 2, 2020
Unscored —

CVE-2019-20812

An issue was discovered in the Linux kernel before 5.4.7. The prb_calc_retire_blk_tmo() function in net/packet/af_packe…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Jun 3, 2020
Unscored —

CVE-2019-3701

An issue was discovered in can_can_gw_rcv in net/can/gw.c in the Linux kernel through 4.19.13. The CAN frame modificati…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Jan 3, 2019
Unscored —

CVE-2019-9455

In the Android kernel in the video driver there is a kernel pointer leak due to a WARN_ON statement. This could lead to…

linux-raspi2 linux-hwe linux-azure linux-riscv Android Debian Ubuntu

Sep 6, 2019
Unscored —

CVE-2019-9458

In the Android kernel in the video driver there is a use after free due to a race condition. This could lead to local e…

linux-raspi2 linux-hwe linux-azure linux-riscv Android Debian Ubuntu

Sep 6, 2019
Unscored —

CVE-2020-0543

Incomplete cleanup from specific special register read operations in some Intel(R) Processors may allow an authenticate…

linux xen xen intel-microcode Debian Ubuntu Alpine

Jun 15, 2020
Unscored —

CVE-2020-10720

A flaw was found in the Linux kernel's implementation of GRO in versions before 5.2. This flaw allows an attacker with …

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Sep 3, 2020
Unscored —

CVE-2020-10757 Public exploit

A flaw was found in the Linux Kernel in versions after 4.5-rc1 in the way mremap handled DAX Huge Pages. This flaw allo…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Jun 9, 2020
Unscored —

CVE-2020-10942

In the Linux kernel before 5.5.8, get_raw_socket in drivers/vhost/net.c lacks validation of an sk_family field, which m…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Mar 24, 2020
Unscored —

CVE-2020-11494

An issue was discovered in slc_bump in drivers/net/can/slcan.c in the Linux kernel 3.16 through 5.6.2. It allows attack…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Apr 2, 2020
Unscored —

CVE-2020-11608

An issue was discovered in the Linux kernel before 5.6.1. drivers/media/usb/gspca/ov519.c allows NULL pointer dereferen…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Apr 7, 2020
Unscored —

CVE-2020-11609

An issue was discovered in the stv06xx subsystem in the Linux kernel before 5.6.1. drivers/media/usb/gspca/stv06xx/stv0…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Apr 7, 2020
Unscored —

CVE-2020-11669

An issue was discovered in the Linux kernel before 5.2 on the powerpc platform. arch/powerpc/kernel/idle_book3s.S does …

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Apr 10, 2020
Unscored —

CVE-2020-12114

A pivot_root race condition in fs/namespace.c in the Linux kernel 4.4.x before 4.4.221, 4.9.x before 4.9.221, 4.14.x be…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

May 4, 2020
Unscored —

CVE-2020-12464

usb_sg_cancel in drivers/usb/core/message.c in the Linux kernel before 5.6.8 has a use-after-free because a transfer oc…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Apr 29, 2020
Unscored —

CVE-2020-12652

The __mptctl_ioctl function in drivers/message/fusion/mptctl.c in the Linux kernel before 5.4.14 allows local users to …

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

May 5, 2020
Unscored —

CVE-2020-12653

An issue was found in Linux kernel before 5.5.4. The mwifiex_cmd_append_vsie_tlv() function in drivers/net/wireless/mar…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

May 5, 2020
Unscored —

CVE-2020-12654

An issue was found in Linux kernel before 5.5.4. mwifiex_ret_wmm_get_status() in drivers/net/wireless/marvell/mwifiex/w…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

May 5, 2020
Unscored —

CVE-2020-12655

An issue was discovered in xfs_agf_verify in fs/xfs/libxfs/xfs_alloc.c in the Linux kernel through 5.6.10. Attackers ma…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

May 5, 2020
Unscored —

CVE-2020-12656

gss_mech_free in net/sunrpc/auth_gss/gss_mech_switch.c in the rpcsec_gss_krb5 implementation in the Linux kernel throug…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

May 5, 2020
Unscored —

CVE-2020-12657

An issue was discovered in the Linux kernel before 5.6.5. There is a use-after-free in block/bfq-iosched.c related to b…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

May 5, 2020
Unscored —

CVE-2020-12769

An issue was discovered in the Linux kernel before 5.4.17. drivers/spi/spi-dw.c allows attackers to cause a panic via c…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

May 9, 2020
Unscored —

CVE-2020-13143

gadget_dev_desc_UDC_store in drivers/usb/gadget/configfs.c in the Linux kernel 3.16 through 5.6.13 relies on kstrdup wi…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

May 18, 2020
Unscored —

CVE-2020-7053

In the Linux kernel 4.14 longterm through 4.14.165 and 4.19 longterm through 4.19.96 (and 5.x before 5.2), there is a u…

linux-hwe linux-azure linux-riscv linux-gcp Debian Ubuntu

Jan 14, 2020
Unscored —

CVE-2020-8428

fs/namei.c in the Linux kernel before 5.5 has a may_create_in_sticky use-after-free, which allows local users to cause …

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Jan 28, 2020
Unscored —

CVE-2020-8647

There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vc_do_resize function in drivers/tty/v…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Feb 6, 2020
Unscored —

CVE-2020-8648

There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the n_tty_receive_buf_common function in d…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Feb 6, 2020
Unscored —

CVE-2020-8649

There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vgacon_invert_region function in drive…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Feb 6, 2020
Unscored —

CVE-2020-8992

ext4_protect_reserved_inode in fs/ext4/block_validity.c in the Linux kernel through 5.5.3 allows attackers to cause a d…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Feb 14, 2020
Unscored —

CVE-2020-9383

An issue was discovered in the Linux kernel 3.16 through 5.5.6. set_fdc in drivers/block/floppy.c leads to a wait_til_r…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Feb 25, 2020

References

report
https://bugzilla.suse.com/1050244
report
https://bugzilla.suse.com/1051510
report
https://bugzilla.suse.com/1051858
report
https://bugzilla.suse.com/1058115
report
https://bugzilla.suse.com/1061840
report
https://bugzilla.suse.com/1065600
report
https://bugzilla.suse.com/1065729
report
https://bugzilla.suse.com/1071995
report
https://bugzilla.suse.com/1085030
report
https://bugzilla.suse.com/1086301
report
https://bugzilla.suse.com/1086313
report
https://bugzilla.suse.com/1086314
report
https://bugzilla.suse.com/1089895
report
https://bugzilla.suse.com/1109911
report
https://bugzilla.suse.com/1114279
report
https://bugzilla.suse.com/1118338
report
https://bugzilla.suse.com/1120386
report
https://bugzilla.suse.com/1134973
report
https://bugzilla.suse.com/1143959
report
https://bugzilla.suse.com/1144333
report
https://bugzilla.suse.com/1151910
report
https://bugzilla.suse.com/1151927
report
https://bugzilla.suse.com/1153917
report
https://bugzilla.suse.com/1154243
report
https://bugzilla.suse.com/1154824
report
https://bugzilla.suse.com/1156286
report
https://bugzilla.suse.com/1157155
report
https://bugzilla.suse.com/1157157
report
https://bugzilla.suse.com/1157692
report
https://bugzilla.suse.com/1158013
report
https://bugzilla.suse.com/1158021
report
https://bugzilla.suse.com/1158026
report
https://bugzilla.suse.com/1158265
report
https://bugzilla.suse.com/1158819
report
https://bugzilla.suse.com/1159028
report
https://bugzilla.suse.com/1159198
report
https://bugzilla.suse.com/1159271
report
https://bugzilla.suse.com/1159285
report
https://bugzilla.suse.com/1159394

Security update for the Linux Kernel

Summary

Fixed packages 28

Vulnerabilities 55

A heap-based buffer overflow vulnerability was found in the Linux kernel, version kernel-2.6.32, in Marvell WiFi chip d…

A stack-based buffer overflow was found in the Linux kernel, version kernel-2.6.32, in Marvell WiFi chip driver. An att…

There is a use-after-free in kernel versions before 5.5 due to a race condition between the release of ptp_clock and cd…

Linux kernel KVM Power8 conflicting use of HSTATE_HOST_R1

A flaw was found in the Linux kernels SELinux LSM hook implementation before version 5.7, where it incorrectly assumed …

A NULL pointer dereference flaw was found in the Linux kernel's SELinux subsystem in versions before 5.7. This flaw occ…

A flaw was discovered in the way that the KVM hypervisor handled instruction emulation for an L2 guest when nested virt…

A flaw was found in the Linux kernel's implementation of Userspace core dumps. This flaw allows an attacker with a loca…

The Linux Kernel version 3.18 contains a dangerous feature vulnerability in modify_user_hw_breakpoint() that can result…

Insufficient control flow in certain data structures for some Intel(R) Processors with Intel(R) Processor Graphics may …

In the Linux kernel before 5.0, a memory leak exists in sit_init_net() in net/ipv6/sit.c when register_netdev() fails t…

btrfs_root_node in fs/btrfs/ctree.c in the Linux kernel through 5.3.12 allows a NULL pointer dereference because rcu_de…

A memory leak in the mlx5_fpga_conn_create_cq() function in drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c in the …

A memory leak in the cx23888_ir_probe() function in drivers/media/pci/cx23885/cx23888-ir.c in the Linux kernel through …

In the Linux kernel 5.3.11, mounting a crafted btrfs image twice can cause an rwsem_down_write_slowpath use-after-free …

In the Linux kernel before 5.2, a setxattr operation, after a mount of a crafted ext4 image, can cause a slab-out-of-bo…

In the Linux kernel 5.0.21, mounting a crafted ext4 filesystem image, performing some operations, and unmounting can le…

relay_open in kernel/relay.c in the Linux kernel through 5.4.1 allows local users to cause a denial of service (such as…

In the Linux kernel 5.4.0-rc2, there is a use-after-free (read) in the __blk_add_trace function in kernel/trace/blktrac…

In the Linux kernel 4.19.83, there is a use-after-free (read) in the debugfs_remove function in fs/debugfs/inode.c (whi…

In the Linux kernel through 5.4.6, there is a NULL pointer dereference in drivers/scsi/libsas/sas_discover.c because of…

In the Linux kernel before 5.1.6, there is a use-after-free in cpia2_exit() in drivers/media/usb/cpia2/cpia2_v4l.c that…

In the Linux kernel before 5.0.6, there is a NULL pointer dereference in drop_sysctl_table() in fs/proc/proc_sysctl.c, …

mwifiex_tm_cmd in drivers/net/wireless/marvell/mwifiex/cfg80211.c in the Linux kernel before 5.1.6 has some error-handl…

In the Linux kernel before 5.1, there is a memory leak in __feat_register_sp() in net/dccp/feat.c, which may cause deni…

go7007_snd_init in drivers/media/usb/go7007/snd-go7007.c in the Linux kernel before 5.6 does not call snd_card_free for…

An issue was discovered in the Linux kernel before 5.4.7. The prb_calc_retire_blk_tmo() function in net/packet/af_packe…

An issue was discovered in can_can_gw_rcv in net/can/gw.c in the Linux kernel through 4.19.13. The CAN frame modificati…

In the Android kernel in the video driver there is a kernel pointer leak due to a WARN_ON statement. This could lead to…

In the Android kernel in the video driver there is a use after free due to a race condition. This could lead to local e…

Incomplete cleanup from specific special register read operations in some Intel(R) Processors may allow an authenticate…

A flaw was found in the Linux kernel's implementation of GRO in versions before 5.2. This flaw allows an attacker with …

A flaw was found in the Linux Kernel in versions after 4.5-rc1 in the way mremap handled DAX Huge Pages. This flaw allo…

In the Linux kernel before 5.5.8, get_raw_socket in drivers/vhost/net.c lacks validation of an sk_family field, which m…

An issue was discovered in slc_bump in drivers/net/can/slcan.c in the Linux kernel 3.16 through 5.6.2. It allows attack…

An issue was discovered in the Linux kernel before 5.6.1. drivers/media/usb/gspca/ov519.c allows NULL pointer dereferen…

An issue was discovered in the stv06xx subsystem in the Linux kernel before 5.6.1. drivers/media/usb/gspca/stv06xx/stv0…

An issue was discovered in the Linux kernel before 5.2 on the powerpc platform. arch/powerpc/kernel/idle_book3s.S does …

A pivot_root race condition in fs/namespace.c in the Linux kernel 4.4.x before 4.4.221, 4.9.x before 4.9.221, 4.14.x be…

usb_sg_cancel in drivers/usb/core/message.c in the Linux kernel before 5.6.8 has a use-after-free because a transfer oc…

The __mptctl_ioctl function in drivers/message/fusion/mptctl.c in the Linux kernel before 5.4.14 allows local users to …

An issue was found in Linux kernel before 5.5.4. The mwifiex_cmd_append_vsie_tlv() function in drivers/net/wireless/mar…

An issue was found in Linux kernel before 5.5.4. mwifiex_ret_wmm_get_status() in drivers/net/wireless/marvell/mwifiex/w…

An issue was discovered in xfs_agf_verify in fs/xfs/libxfs/xfs_alloc.c in the Linux kernel through 5.6.10. Attackers ma…

gss_mech_free in net/sunrpc/auth_gss/gss_mech_switch.c in the rpcsec_gss_krb5 implementation in the Linux kernel throug…

An issue was discovered in the Linux kernel before 5.6.5. There is a use-after-free in block/bfq-iosched.c related to b…

An issue was discovered in the Linux kernel before 5.4.17. drivers/spi/spi-dw.c allows attackers to cause a panic via c…

gadget_dev_desc_UDC_store in drivers/usb/gadget/configfs.c in the Linux kernel 3.16 through 5.6.13 relies on kstrdup wi…

In the Linux kernel 4.14 longterm through 4.14.165 and 4.19 longterm through 4.19.96 (and 5.x before 5.2), there is a u…

fs/namei.c in the Linux kernel before 5.5 has a may_create_in_sticky use-after-free, which allows local users to cause …

There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vc_do_resize function in drivers/tty/v…

There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the n_tty_receive_buf_common function in d…

There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vgacon_invert_region function in drive…

ext4_protect_reserved_inode in fs/ext4/block_validity.c in the Linux kernel through 5.5.3 allows attackers to cause a d…

An issue was discovered in the Linux kernel 3.16 through 5.5.6. set_fdc in drivers/block/floppy.c leads to a wait_til_r…

References