SUSE Security Update: Security update for the Linux Kernel
______________________________________________________________________________

Announcement ID:    SUSE-SU-2020:14354-1
Rating:             important
References:         #1012382 #1091041 #1105327 #1131107 #1136471 
                    #1136922 #1146519 #1146544 #1146612 #1148871 
                    #1149448 #1152631 #1156652 #1157038 #1157070 
                    #1157143 #1157155 #1157157 #1157303 #1157344 
                    #1157678 #1157804 #1157923 #1158381 #1158410 
                    #1158413 #1158427 #1158445 #1158823 #1158824 
                    #1158834 #1158900 #1158904 #1159285 #1159841 
                    #1159908 #1159911 #1161358 #1162928 #1162929 
                    #1162931 #1164078 #1165111 #1165985 #1167629 
                    #1168075 #1168829 #1168854 
Cross-References:   CVE-2019-12456 CVE-2019-14896 CVE-2019-14897
                    CVE-2019-15213 CVE-2019-15916 CVE-2019-18660
                    CVE-2019-18675 CVE-2019-19066 CVE-2019-19073
                    CVE-2019-19074 CVE-2019-19227 CVE-2019-19523
                    CVE-2019-19524 CVE-2019-19527 CVE-2019-19530
                    CVE-2019-19531 CVE-2019-19532 CVE-2019-19537
                    CVE-2019-19768 CVE-2019-19965 CVE-2019-19966
                    CVE-2019-20096 CVE-2020-10942 CVE-2020-11608
                    CVE-2020-8647 CVE-2020-8648 CVE-2020-8649
                    CVE-2020-9383
Affected Products:
                    SUSE Linux Enterprise Server 11-SP4-LTSS
                    SUSE Linux Enterprise Server 11-EXTRA
                    SUSE Linux Enterprise Debuginfo 11-SP4
______________________________________________________________________________

   An update that solves 28 vulnerabilities and has 20 fixes
   is now available.

Description:

   The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various
   security and bugfixes.


   The following security bugs were fixed:

   - CVE-2020-10942: In get_raw_socket in drivers/vhost/net.c lacks
     validation of an sk_family field, which might allow attackers to trigger
     kernel stack corruption via crafted system calls (bsc#1167629).
   - CVE-2020-8647: There was a use-after-free vulnerability in the
     vc_do_resize function in drivers/tty/vt/vt.c (bsc#1162929).
   - CVE-2020-8649: There was a use-after-free vulnerability in the
     vgacon_invert_region function in drivers/video/console/vgacon.c
     (bsc#1162931).
   - CVE-2020-9383: An issue was discovered set_fdc in drivers/block/floppy.c
     leads to a wait_til_ready out-of-bounds read because the FDC index is
     not checked for errors before assigning it (bsc#1165111).
   - CVE-2019-19768: Fixed a use-after-free in the __blk_add_trace function
     in kernel/trace/blktrace.c (bsc#1159285).
   - CVE-2020-11608: Fixed a NULL pointer dereferences in
     ov511_mode_init_regs and ov518_mode_init_regs when there are zero
     endpoints (bsc#1168829).
   - CVE-2020-8648: There was a use-after-free vulnerability in the
     n_tty_receive_buf_common function in drivers/tty/n_tty.c (bsc#1162928).
   - CVE-2019-14896: A heap-based buffer overflow vulnerability was found in
     Marvell WiFi chip driver. A remote attacker could cause a denial of
     service or possibly execute arbitrary code, when the
     lbs_ibss_join_existing function is called after a STA connects to an AP
     (bsc#1157157).
   - CVE-2019-14897: A stack-based buffer overflow was found in the Marvell
     WiFi chip driver. An attacker is able to cause a denial of service or
     possibly execute arbitrary code, when a STA works in IBSS mode and
     connects to another STA (bsc#1157155).
   - CVE-2019-18675: Fixed an Integer Overflow in cpia2_remap_buffer in
     drivers/media/usb/cpia2/cpia2_core.c because cpia2 has its own mmap
     implementation. This allowed local users to obtain read and write
     permissions on kernel physical pages, which can possibly result in a
     privilege escalation (bsc#1157804).
   - CVE-2019-19965: Fixed a NULL pointer dereference in
     drivers/scsi/libsas/sas_discover.c because of mishandling of port
     disconnection during discovery, related to a PHY down race condition
     (bsc#1159911).
   - CVE-2019-19066: A memory leak in the bfad_im_get_stats() function in
     drivers/scsi/bfa/bfad_attr.c allowed attackers to cause a denial of
     service by triggering bfa_port_get_stats() failures (bsc#1157303).
   - CVE-2019-20096: Fixed a memory leak in __feat_register_sp() in
     net/dccp/feat.c, which may cause denial of service (bsc#1159908).
   - CVE-2019-19966: Fixed a use-after-free in cpia2_exit() in
     drivers/media/usb/cpia2/cpia2_v4l.c that will cause denial of service
     (bsc#1159841).
   - CVE-2019-19532: Fixed multiple out-of-bounds write bugs that can be
     caused by a malicious USB device (bsc#1158824).
   - CVE-2019-19523: Fixed a use-after-free bug that can be caused by a
     malicious USB device in the drivers/usb/misc/adutux.c driver
     (bsc#115882).
   - CVE-2019-19537: Fixed a race condition that can be caused by a malicious
     USB device in the USB character device driver layer (bsc#1158904).
   - CVE-2019-19527, CVE-2019-19530, CVE-2019-19524: Fixed multiple
     use-after-free bug that could be caused by a malicious USB device
     (bsc#1158381, bsc#1158834, bsc#1158900).
   - CVE-2019-15213: Fixed a use-after-free caused by a malicious USB device
     in the drivers/media/usb/dvb-usb/dvb-usb-init.c driver (bsc#1146544).
   - CVE-2019-19531: Fixed a use-after-free bug that can be caused by a
     malicious USB device in the drivers/usb/misc/yurex.c driver
     (bsc#1158445).
   - CVE-2019-18660: The Linux kernel on powerpc allowed Information Exposure
     because the Spectre-RSB mitigation is not in place for all applicable
     CPUs (bsc#1157038).
   - CVE-2019-19227: Fixed a potential NULL pointer dereference in the
     AppleTalk subsystem (bsc#1157678).
   - CVE-2019-19074: Fixed a memory leak in the ath9k_wmi_cmd(), which
     allowed attackers to cause a denial of service (bsc#1157143).
   - CVE-2019-19073: Fixed multiple memory leaks in
     drivers/net/wireless/ath/ath9k/htc_hst.c, which allowed attackers to
     cause a denial of service (bsc#1157070).
   - CVE-2019-15916: Fixed a memory leak in register_queue_kobjects() in
     net/core/net-sysfs.c, which could cause denial of service (bsc#1149448).
   - CVE-2019-12456: Fixed a denial of service in _ctl_ioctl_main, which
     could be triggered by a local user (bsc#1136922).

   The following non-security bugs were fixed:

   - Input: add safety guards to input_set_keycode() (bsc#1168075).
   - blk: Fix kabi due to blk_trace_mutex addition (bsc#1159285).
   - blktrace: fix dereference after null check (bsc#1159285).
   - blktrace: fix trace mutex deadlock (bsc#1159285).
   - block: Fix oops scsi_disk_get() (bsc#1105327).
   - fs/xfs: fix f_ffree value for statfs when project quota is set
     (bsc#1165985).
   - kaiser: Fix for 32bit KAISER implementations (bsc#1157344).
   - klist: fix starting point removed bug in klist iterators (bsc#1156652).
   - kobject: Export kobject_get_unless_zero() (bsc#1105327).
   - kobject: fix kset_find_obj() race with concurrent last kobject_put()
     (bsc#1105327).
   - kref: minor cleanup (bsc#1105327).
   - media: ov519: add missing endpoint sanity checks (bsc#1168829).
   - media: stv06xx: add missing descriptor sanity checks (bsc#1168854).
   - netfilter: nf_nat: do not bug when mapping already exists (bsc#1146612).
   - powerpc/64: Make meltdown reporting Book3S 64 specific (bsc#1091041).
   - powerpc/pseries/mobility: notify network peers after migration
     (bsc#1152631 ltc#181798).
   - powerpc/security/book3s64: Report L1TF status in sysfs (bsc#1091041).
   - powerpc/security: Fix wrong message when RFI Flush is disable
     (bsc#1131107).
   - rpm/kernel-binary.spec.in: Replace Novell with SUSE
   - sched: Fix race between task_group and sched_task_group (bsc#1136471).
   - sched: Remove lockdep check in sched_move_task() (bsc#1136471).
   - scsi: lpfc: Fix driver crash in target reset handler (bsc#1148871).
   - writeback: fix race that cause writeback hung (bsc#1161358).
   - x86: fix speculation bug reporting (bsc#1012382).


Special Instructions and Notes:

   Please reboot the system after installing this update.

Patch Instructions:

   To install this SUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Server 11-SP4-LTSS:

      zypper in -t patch slessp4-kernel-source-14354=1

   - SUSE Linux Enterprise Server 11-EXTRA:

      zypper in -t patch slexsp3-kernel-source-14354=1

   - SUSE Linux Enterprise Debuginfo 11-SP4:

      zypper in -t patch dbgsp4-kernel-source-14354=1



Package List:

   - SUSE Linux Enterprise Server 11-SP4-LTSS (i586 ppc64 s390x x86_64):

      kernel-default-3.0.101-108.111.1
      kernel-default-base-3.0.101-108.111.1
      kernel-default-devel-3.0.101-108.111.1
      kernel-source-3.0.101-108.111.1
      kernel-syms-3.0.101-108.111.1
      kernel-trace-3.0.101-108.111.1
      kernel-trace-base-3.0.101-108.111.1
      kernel-trace-devel-3.0.101-108.111.1

   - SUSE Linux Enterprise Server 11-SP4-LTSS (i586 x86_64):

      kernel-ec2-3.0.101-108.111.1
      kernel-ec2-base-3.0.101-108.111.1
      kernel-ec2-devel-3.0.101-108.111.1
      kernel-xen-3.0.101-108.111.1
      kernel-xen-base-3.0.101-108.111.1
      kernel-xen-devel-3.0.101-108.111.1

   - SUSE Linux Enterprise Server 11-SP4-LTSS (s390x):

      kernel-default-man-3.0.101-108.111.1

   - SUSE Linux Enterprise Server 11-SP4-LTSS (ppc64):

      kernel-bigmem-3.0.101-108.111.1
      kernel-bigmem-base-3.0.101-108.111.1
      kernel-bigmem-devel-3.0.101-108.111.1
      kernel-ppc64-3.0.101-108.111.1
      kernel-ppc64-base-3.0.101-108.111.1
      kernel-ppc64-devel-3.0.101-108.111.1

   - SUSE Linux Enterprise Server 11-SP4-LTSS (i586):

      kernel-pae-3.0.101-108.111.1
      kernel-pae-base-3.0.101-108.111.1
      kernel-pae-devel-3.0.101-108.111.1

   - SUSE Linux Enterprise Server 11-EXTRA (i586 ia64 ppc64 s390x x86_64):

      kernel-default-extra-3.0.101-108.111.1

   - SUSE Linux Enterprise Server 11-EXTRA (i586 x86_64):

      kernel-xen-extra-3.0.101-108.111.1

   - SUSE Linux Enterprise Server 11-EXTRA (x86_64):

      kernel-trace-extra-3.0.101-108.111.1

   - SUSE Linux Enterprise Server 11-EXTRA (ppc64):

      kernel-ppc64-extra-3.0.101-108.111.1

   - SUSE Linux Enterprise Server 11-EXTRA (i586):

      kernel-pae-extra-3.0.101-108.111.1

   - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ppc64 s390x x86_64):

      kernel-default-debuginfo-3.0.101-108.111.1
      kernel-default-debugsource-3.0.101-108.111.1
      kernel-trace-debuginfo-3.0.101-108.111.1
      kernel-trace-debugsource-3.0.101-108.111.1

   - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 s390x x86_64):

      kernel-default-devel-debuginfo-3.0.101-108.111.1
      kernel-trace-devel-debuginfo-3.0.101-108.111.1

   - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 x86_64):

      kernel-ec2-debuginfo-3.0.101-108.111.1
      kernel-ec2-debugsource-3.0.101-108.111.1
      kernel-xen-debuginfo-3.0.101-108.111.1
      kernel-xen-debugsource-3.0.101-108.111.1
      kernel-xen-devel-debuginfo-3.0.101-108.111.1

   - SUSE Linux Enterprise Debuginfo 11-SP4 (ppc64):

      kernel-bigmem-debuginfo-3.0.101-108.111.1
      kernel-bigmem-debugsource-3.0.101-108.111.1
      kernel-ppc64-debuginfo-3.0.101-108.111.1
      kernel-ppc64-debugsource-3.0.101-108.111.1

   - SUSE Linux Enterprise Debuginfo 11-SP4 (i586):

      kernel-pae-debuginfo-3.0.101-108.111.1
      kernel-pae-debugsource-3.0.101-108.111.1
      kernel-pae-devel-debuginfo-3.0.101-108.111.1


References:

   https://www.suse.com/security/cve/CVE-2019-12456.html
   https://www.suse.com/security/cve/CVE-2019-14896.html
   https://www.suse.com/security/cve/CVE-2019-14897.html
   https://www.suse.com/security/cve/CVE-2019-15213.html
   https://www.suse.com/security/cve/CVE-2019-15916.html
   https://www.suse.com/security/cve/CVE-2019-18660.html
   https://www.suse.com/security/cve/CVE-2019-18675.html
   https://www.suse.com/security/cve/CVE-2019-19066.html
   https://www.suse.com/security/cve/CVE-2019-19073.html
   https://www.suse.com/security/cve/CVE-2019-19074.html
   https://www.suse.com/security/cve/CVE-2019-19227.html
   https://www.suse.com/security/cve/CVE-2019-19523.html
   https://www.suse.com/security/cve/CVE-2019-19524.html
   https://www.suse.com/security/cve/CVE-2019-19527.html
   https://www.suse.com/security/cve/CVE-2019-19530.html
   https://www.suse.com/security/cve/CVE-2019-19531.html
   https://www.suse.com/security/cve/CVE-2019-19532.html
   https://www.suse.com/security/cve/CVE-2019-19537.html
   https://www.suse.com/security/cve/CVE-2019-19768.html
   https://www.suse.com/security/cve/CVE-2019-19965.html
   https://www.suse.com/security/cve/CVE-2019-19966.html
   https://www.suse.com/security/cve/CVE-2019-20096.html
   https://www.suse.com/security/cve/CVE-2020-10942.html
   https://www.suse.com/security/cve/CVE-2020-11608.html
   https://www.suse.com/security/cve/CVE-2020-8647.html
   https://www.suse.com/security/cve/CVE-2020-8648.html
   https://www.suse.com/security/cve/CVE-2020-8649.html
   https://www.suse.com/security/cve/CVE-2020-9383.html
   https://bugzilla.suse.com/1012382
   https://bugzilla.suse.com/1091041
   https://bugzilla.suse.com/1105327
   https://bugzilla.suse.com/1131107
   https://bugzilla.suse.com/1136471
   https://bugzilla.suse.com/1136922
   https://bugzilla.suse.com/1146519
   https://bugzilla.suse.com/1146544
   https://bugzilla.suse.com/1146612
   https://bugzilla.suse.com/1148871
   https://bugzilla.suse.com/1149448
   https://bugzilla.suse.com/1152631
   https://bugzilla.suse.com/1156652
   https://bugzilla.suse.com/1157038
   https://bugzilla.suse.com/1157070
   https://bugzilla.suse.com/1157143
   https://bugzilla.suse.com/1157155
   https://bugzilla.suse.com/1157157
   https://bugzilla.suse.com/1157303
   https://bugzilla.suse.com/1157344
   https://bugzilla.suse.com/1157678
   https://bugzilla.suse.com/1157804
   https://bugzilla.suse.com/1157923
   https://bugzilla.suse.com/1158381
   https://bugzilla.suse.com/1158410
   https://bugzilla.suse.com/1158413
   https://bugzilla.suse.com/1158427
   https://bugzilla.suse.com/1158445
   https://bugzilla.suse.com/1158823
   https://bugzilla.suse.com/1158824
   https://bugzilla.suse.com/1158834
   https://bugzilla.suse.com/1158900
   https://bugzilla.suse.com/1158904
   https://bugzilla.suse.com/1159285
   https://bugzilla.suse.com/1159841
   https://bugzilla.suse.com/1159908
   https://bugzilla.suse.com/1159911
   https://bugzilla.suse.com/1161358
   https://bugzilla.suse.com/1162928
   https://bugzilla.suse.com/1162929
   https://bugzilla.suse.com/1162931
   https://bugzilla.suse.com/1164078
   https://bugzilla.suse.com/1165111
   https://bugzilla.suse.com/1165985
   https://bugzilla.suse.com/1167629
   https://bugzilla.suse.com/1168075
   https://bugzilla.suse.com/1168829
   https://bugzilla.suse.com/1168854

_______________________________________________
sle-security-updates mailing list
sle-security-updates@lists.suse.com
http://lists.suse.com/mailman/listinfo/sle-security-updates

SUSE: 2020:14354-1 important: the Linux Kernel

April 30, 2020
An update that solves 28 vulnerabilities and has 20 fixes is now available

Summary

The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2020-10942: In get_raw_socket in drivers/vhost/net.c lacks validation of an sk_family field, which might allow attackers to trigger kernel stack corruption via crafted system calls (bsc#1167629). - CVE-2020-8647: There was a use-after-free vulnerability in the vc_do_resize function in drivers/tty/vt/vt.c (bsc#1162929). - CVE-2020-8649: There was a use-after-free vulnerability in the vgacon_invert_region function in drivers/video/console/vgacon.c (bsc#1162931). - CVE-2020-9383: An issue was discovered set_fdc in drivers/block/floppy.c leads to a wait_til_ready out-of-bounds read because the FDC index is not checked for errors before assigning it (bsc#1165111). - CVE-2019-19768: Fixed a use-after-free in the __blk_add_trace function in kernel/trace/blktrace.c (bsc#1159285). - ...

Read the Full Advisory

References

#1012382 #1091041 #1105327 #1131107 #1136471

#1136922 #1146519 #1146544 #1146612 #1148871

#1149448 #1152631 #1156652 #1157038 #1157070

#1157143 #1157155 #1157157 #1157303 #1157344

#1157678 #1157804 #1157923 #1158381 #1158410

#1158413 #1158427 #1158445 #1158823 #1158824

#1158834 #1158900 #1158904 #1159285 #1159841

#1159908 #1159911 #1161358 #1162928 #1162929

#1162931 #1164078 #1165111 #1165985 #1167629

#1168075 #1168829 #1168854

Cross- CVE-2019-12456 CVE-2019-14896 CVE-2019-14897

CVE-2019-15213 CVE-2019-15916 CVE-2019-18660

CVE-2019-18675 CVE-2019-19066 CVE-2019-19073

CVE-2019-19074 CVE-2019-19227 CVE-2019-19523

CVE-2019-19524 CVE-2019-19527 CVE-2019-19530

CVE-2019-19531 CVE-2019-19532 CVE-2019-19537

...

Read the Full Advisory

Severity
Announcement ID: SUSE-SU-2020:14354-1
Rating: important

Related News

The End of the Road for Linux 6.11: A Call to Upgrade to Kernel 6.12
3 - 5 min read
The Linux kernel community recently issued an EOL announcement regarding the 6.11 kernel series, urging sysadmins to upgrade quickly to 6.12 . This
A Linux Admin
3 - 6 min read
As 2025 approaches, we Linux admins are facing new and often unseen cloud-native security obstacles. While skilled at mitigating known risks,
Leveraging Insights from the Linux Foundation
3 - 5 min read
The Linux Foundation's recent Census III report provides critical insights for Linux administrators, information security professionals, and anyone
Chrome 131 Released: Emergency Security Update Fixes Over a Dozen Significant Vulns
3 - 6 min read
Google recently unveiled a critical security update to their popular web browser, Google Chrome, addressing over a dozen significant security
From Wayland Fixes to Security Boosts: Examining Qt 6.8.1
3 - 6 min read
The recent Qt 6.8.1 release brings significant updates and improvements, strengthening its reputation as a secure and reliable application
Exploring Arch Linux 2024.12.01: Security Implications & Notable Enhancements for Linux Admins
3 - 6 min read
The Arch Linux 2024.12.01 ISO release marks an impressive milestone, offering cutting-edge updates that enhance functionality, streamline
Deck the Halls with Enhanced Security: Linux Kernel 6.13
3 - 5 min read
As Linux admins and infosec professionals prepare for the holiday season, there's much cause for celebration this year! Linus Torvalds recently made
Lessons from Bootkitty: Securing Linux Systems Against UEFI Intrusions
3 - 5 min read
New Linux security threats mark critical junctures that challenge existing policies and test security protocols to their limit. One such milestone

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved