File _patchinfo of Package patchinfo.13152

Overview Repositories Revisions Requests Users Attributes Meta

File _patchinfo of Package patchinfo.13152

<patchinfo incident="13152">
  <issue id="1117665" tracker="bnc">EMU: VUL-0: EMBARGOED: CVE-2018-12207: kernel-source: Machine Check Error Avoidance on Page Size Change (aka IFU issue)</issue>
  <issue id="1123959" tracker="bnc">VUL-0: kernel: HCI_UART_MRVL crashes the machine when used on PTY master</issue>
  <issue id="1137586" tracker="bnc">EMU: VUL-0: kernel-source: multiple remote denial of service issues (SACK Panic)</issue>
  <issue id="1137865" tracker="bnc">VUL-0: CVE-2019-9506: generic bluetooth problem (VU#918987) aka the "KNOB Attack"</issue>
  <issue id="1137944" tracker="bnc">VUL-0: kernel-source: Buffer overflow in mwifiex_uap_set_head_tail_ies() in v4.1 and older</issue>
  <issue id="1139073" tracker="bnc">EMU: VUL-0: EMBARGOED: CVE-2019-11135: November 2019 CPU issue aka "TSX Asynchronous Abort (TAA)"</issue>
  <issue id="1139751" tracker="bnc">possible bug in kernel 4.4.121-92.114.1 applications tcp socket get stuck</issue>
  <issue id="1142857" tracker="bnc">VUL-1: CVE-2019-10207: kernel-source: bluetooth: hci_uart: 0x0 address execution as nonprivileged user</issue>
  <issue id="1144903" tracker="bnc">VUL-0: CVE-2019-10220: kernel-source: Samba servers can inject relative paths in directory entry lists</issue>
  <issue id="1145477" tracker="bnc">VUL-0: CVE-2017-18509: kernel-source: missing type check in the IPv6 multicast routing implementation</issue>
  <issue id="1145922" tracker="bnc">VUL-0: CVE-2019-15118: kernel-source: ALSA: usb-audio: Fix a stack buffer overflow bug in check_input_term</issue>
  <issue id="1146042" tracker="bnc">VUL-0: CVE-2019-9506: kernel-source: generic bluetooth problem (VU#918987) aka the "KNOB Attack"</issue>
  <issue id="1146163" tracker="bnc">VUL-1: CVE-2017-18551: kernel-source: out of bounds write in the function i2c_smbus_xfer_emulated</issue>
  <issue id="1146285" tracker="bnc">VUL-1: CVE-2018-20976: kernel-source: use after free exists, related to xfs_fs_fill_super failure</issue>
  <issue id="1146361" tracker="bnc">VUL-1: CVE-2019-15216: kernel-source: NULL pointer dereference caused by a malicious USB device in drivers/usb/misc/yurex.c</issue>
  <issue id="1146378" tracker="bnc">VUL-1: CVE-2019-15098: kernel-source: NULL pointer dereference in drivers/net/wireless/ath/ath6kl/usb.c leads to a crash</issue>
  <issue id="1146391" tracker="bnc">VUL-0: CVE-2019-15212: kernel-source: double-free caused by malicious USB device in drivers/usb/misc/rio500.c</issue>
  <issue id="1146413" tracker="bnc">VUL-1: CVE-2019-15218: kernel-source: NULL pointer dereference caused by a malicious USB device in the drivers/media/usb/siano/smsusb.c</issue>
  <issue id="1146425" tracker="bnc">VUL-1: CVE-2019-15215: kernel-source: use-after-free caused by a malicious USB device in the drivers/media/usb/cpia2/cpia2_usb.c</issue>
  <issue id="1146512" tracker="bnc">VUL-0: CVE-2019-14814: kernel-source: Heap Overflow in mwifiex_set_uap_rates() function of Marvell Wifi Driver</issue>
  <issue id="1146514" tracker="bnc">VUL-0: CVE-2019-14815: kernel-source: Heap Overflow in mwifiex_set_wmm_params() function of Marvell Wifi Driver</issue>
  <issue id="1146516" tracker="bnc">VUL-0: CVE-2019-14816: kernel-source: Heap Overflow in mwifiex_update_vs_ie() function of Marvell Wifi Driver</issue>
  <issue id="1146524" tracker="bnc">VUL-1: CVE-2019-15219: kernel-source: NULL pointer dereference caused by a malicious USB device in the drivers/usb/misc/sisusbvga/sisusb.c</issue>
  <issue id="1146526" tracker="bnc">VUL-1: CVE-2019-15220: kernel-source: use-after-free caused by a malicious USB device in the drivers/net/wireless/intersil/p54/p54usb.c</issue>
  <issue id="1146540" tracker="bnc">VUL-1: CVE-2019-15291: kernel-source: NULL pointer dereference caused by a malicious USB device in the flexcop_usb_probe function in the drivers/media/usb/b2c2/flexcop-usb.c</issue>
  <issue id="1146543" tracker="bnc">VUL-1: CVE-2019-15290: kernel-source: NULL pointer dereference caused by a malicious USB device in the ath6kl_usb_alloc_urb_from_pipe function in the drivers/net/wireless/ath/ath6kl/usb.c</issue>
  <issue id="1146547" tracker="bnc">VUL-1: CVE-2019-15217: kernel-source: NULL pointer dereference caused by a malicious USB device in the drivers/media/usb/zr364xx/zr364xx.c</issue>
  <issue id="1146584" tracker="bnc">VUL-0: CVE-2016-10906: kernel-source: use-after-free is caused by a race condition between the functions arc_emac_tx and arc_emac_tx_clean</issue>
  <issue id="1146612" tracker="bnc">L3: kernel BUG at ../net/netfilter/nf_nat_core.c:394! in nf_nat_setup_info()</issue>
  <issue id="1147122" tracker="bnc">VUL-0: CVE-2019-15505: kernel-source: out-of-bounds read via crafted USB device traffic in drivers/media/usb/dvb-usb/technisat-usb2.c</issue>
  <issue id="1148938" tracker="bnc">VUL-1: CVE-2019-15807: kernel-source: kernel: Memory leak in drivers/scsi/libsas/sas_expander.c</issue>
  <issue id="1149376" tracker="bnc">VUL-0: CVE-2019-15902: kernel-source: backporting error in ptrace_get_debugreg() re-introduces Spectre</issue>
  <issue id="1149522" tracker="bnc">VUL-1: CVE-2019-15927: kernel-source: out-of-bounds access in build_audio_procunit in the file sound/usb/mixer.c</issue>
  <issue id="1149527" tracker="bnc">VUL-1: CVE-2019-15926: kernel-source: out of bounds access exists in the functions ath6kl_wmi_pstream_timeout_event_rx and ath6kl_wmi_cac_event_rx</issue>
  <issue id="1149555" tracker="bnc">VUL-1: CVE-2017-18595: kernel-source: double free in function allocate_trace_buffer in the file kernel/trace/trace.c</issue>
  <issue id="1150025" tracker="bnc">VUL-1: CVE-2019-9456: kernel-source: USB monitor driver has a possible OOB write due to a missing bounds check</issue>
  <issue id="1150112" tracker="bnc">EMU: VUL-0: CVE-2019-14835: kernel-source: vhost/vhost_net kernel buffer overflow leads to guest to host kernel escape</issue>
  <issue id="1150452" tracker="bnc">VUL-1: CVE-2019-16234: kernel-source: NULL pointer dereference in alloc_workqueue in drivers/net/wireless/intel/iwlwifi/pcie/trans.c</issue>
  <issue id="1150457" tracker="bnc">VUL-1: CVE-2019-16233: kernel-source: NULL pointer dereference in alloc_workqueue in  drivers/scsi/qla2xxx/qla_os.c</issue>
  <issue id="1150465" tracker="bnc">VUL-0: CVE-2019-16232: kernel-source: NULL pointer dereference in alloc_workqueue in drivers/net/wireless/marvell/libertas/if_sdio.c</issue>
  <issue id="1151347" tracker="bnc">VUL-0: CVE-2019-16413: kernel-source: improper check of  i_size_write() causes i_size_read() infinite loop and denial of service on SMP systems</issue>
  <issue id="1151350" tracker="bnc">VUL-0: CVE-2019-14821: kernel-source: kvm: OOB memory access via mmio ring buffer</issue>
  <issue id="1152782" tracker="bnc">VUL-0: CVE-2019-17055: kernel-source: base_sock_create in drivers/isdn/mISDN/socket.c in the AF_ISDN network module does not enforce CAP_NET_RAW</issue>
  <issue id="1152788" tracker="bnc">VUL-0: CVE-2019-17056: kernel-source: llcp_sock_create in net/nfc/llcp_sock.c in the AF_NFC network module does not enforce CAP_NET_RAW</issue>
  <issue id="1153119" tracker="bnc">LTSS Stack traces in messages, look to be the same as bug 999278</issue>
  <issue id="1155671" tracker="bnc">VUL-1: kernel-source: IB/core: Add mitigation for Spectre V1</issue>
  <issue id="999278" tracker="bnc">BUG: unable to handle kernel paging request at host_show_lockup_detected+0x29</issue>
  <issue id="1146519" tracker="bnc" />
  <issue id="1146529" tracker="bnc" />
  <issue id="2019-11135" tracker="cve" />
  <issue id="2019-15221" tracker="cve" />
  <issue id="2018-12207" tracker="cve" />
  <issue id="2019-16233" tracker="cve" />
  <issue id="2019-10220" tracker="cve" />
  <issue id="2019-16234" tracker="cve" />
  <issue id="2019-16232" tracker="cve" />
  <issue id="2019-17055" tracker="cve" />
  <issue id="2019-17056" tracker="cve" />
  <issue id="2019-16413" tracker="cve" />
  <issue id="2019-15291" tracker="cve" />
  <issue id="2019-15807" tracker="cve" />
  <issue id="2019-14821" tracker="cve" />
  <issue id="2019-15505" tracker="cve" />
  <issue id="2017-18595" tracker="cve" />
  <issue id="2019-14835" tracker="cve" />
  <issue id="2019-15216" tracker="cve" />
  <issue id="2019-9456" tracker="cve" />
  <issue id="2019-15926" tracker="cve" />
  <issue id="2019-15927" tracker="cve" />
  <issue id="2019-9506" tracker="cve" />
  <issue id="2019-10207" tracker="cve" />
  <issue id="2019-15902" tracker="cve" />
  <issue id="2019-11477" tracker="cve" />
  <issue id="2019-15219" tracker="cve" />
  <issue id="2019-15220" tracker="cve" />
  <issue id="2019-14814" tracker="cve" />
  <issue id="2019-14815" tracker="cve" />
  <issue id="2019-14816" tracker="cve" />
  <issue id="2017-18509" tracker="cve" />
  <issue id="2019-15098" tracker="cve" />
  <issue id="2019-15290" tracker="cve" />
  <issue id="2019-15212" tracker="cve" />
  <issue id="2019-15218" tracker="cve" />
  <issue id="2016-10906" tracker="cve" />
  <issue id="2019-15217" tracker="cve" />
  <issue id="2019-15215" tracker="cve" />
  <issue id="2018-20976" tracker="cve" />
  <issue id="2017-18551" tracker="cve" />
  <issue id="2019-15118" tracker="cve" />
  <category>security</category>
  <rating>important</rating>
  <packager>alnovak</packager>
  <reboot_needed/>
  <description>

The SUSE Linux Enterprise 12 SP1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

- CVE-2018-12207: Untrusted virtual machines on Intel CPUs could exploit a race condition in the Instruction Fetch Unit of the Intel CPU to cause a Machine Exception during Page Size Change, causing the CPU core to be non-functional.

The Linux Kernel KVM hypervisor was adjusted to avoid page size changes in executable pages by splitting / merging huge pages into small pages as needed.
More information can be found on  https://www.suse.com/support/kb/doc/?id=7023735

- CVE-2019-11135: Aborting an asynchronous TSX operation on Intel CPUs with
Transactional Memory support could be used to facilitate sidechannel
information leaks out of microarchitectural buffers, similar to the previously
described "Microarchitectural Data Sampling" attack.

The Linux kernel was supplemented with the option to disable TSX operation
altogether (requiring CPU Microcode updates on older systems) and better
flushing of microarchitectural buffers (VERW).

The set of options available is described in our TID at https://www.suse.com/support/kb/doc/?id=7024251

- CVE-2019-16233: drivers/scsi/qla2xxx/qla_os.c did not check the
  alloc_workqueue return value, leading to a NULL pointer dereference.
  (bsc#1150457).

- CVE-2019-10220: Added sanity checks on the pathnames passed to the user
  space. (bsc#1144903).

- CVE-2019-16232: Fix a potential NULL pointer dereference in the Marwell
  libertas driver (bsc#1150465).

- CVE-2019-16234: iwlwifi pcie driver did not check the alloc_workqueue return
  value, leading to a NULL pointer dereference. (bsc#1150452).

- CVE-2019-17055: The AF_ISDN network module in the Linux kernel did not
  enforce CAP_NET_RAW, which meant that unprivileged users could create a raw
  socket (bnc#1152782).

- CVE-2019-17056: The AF_NFC network module did not enforce CAP_NET_RAW, which
  meant that unprivileged users could create a raw socket (bsc#1152788).

- CVE-2019-16413: The 9p filesystem did not protect i_size_write() properly,
  which caused an i_size_read() infinite loop and denial of service on SMP
  systems (bnc#1151347).

- CVE-2019-15902: A backporting issue was discovered that re-introduced the
  Spectre vulnerability it had aimed to eliminate. This occurred because the
  backport process depends on cherry picking specific commits, and because two
  (correctly ordered) code lines were swapped (bnc#1149376).

- CVE-2019-15291: Fixed a NULL pointer dereference issue that could be caused
  by a malicious USB device (bnc#11465).

- CVE-2019-15807: Fixed a memory leak in the SCSI module that could be abused
  to cause denial of service (bnc#1148938).

- CVE-2019-14821: An out-of-bounds access issue was fixed in the kernel's KVM
  hypervisor. An unprivileged host user or process with access to '/dev/kvm'
  device could use this flaw to crash the host kernel, resulting in a denial of
  service or potentially escalating privileges on the system (bnc#1151350).

- CVE-2019-15505: An out-of-bounds issue had been fixed that could be caused by
  crafted USB device traffic (bnc#1147122).

- CVE-2017-18595: A double free in allocate_trace_buffer was fixed
  (bnc#1149555).

- CVE-2019-14835: A buffer overflow flaw was found in the kernel's vhost
  functionality that translates virtqueue buffers to IOVs. A privileged guest
  user able to pass descriptors with invalid length to the host could use this
  flaw to increase their privileges on the host (bnc#1150112).

- CVE-2019-15216: A NULL pointer dereference was fixed that could be malicious
  USB device (bnc#1146361).

- CVE-2019-9456: An out-of-bounds write in the USB monitor driver has been
  fixed. This issue could lead to local escalation of privilege with System
  execution privileges needed. (bnc#1150025).

- CVE-2019-15926: An out-of-bounds access was fixed in the
  drivers/net/wireless/ath/ath6kl module. (bnc#1149527).

- CVE-2019-15927: An out-of-bounds access was fixed in the sound/usb/mixer
  module (bnc#1149522).

- CVE-2019-15219: A NULL pointer dereference was fixed that could be abused by
  a malicious USB device (bnc#1146524).

- CVE-2019-15220: A use-after-free issue was fixed that could be caused by a
  malicious USB device (bnc#1146526).

- CVE-2019-15221: A NULL pointer dereference was fixed that could be caused by
  a malicious USB device (bnc#1146529).

- CVE-2019-14814: A heap-based buffer overflow was fixed in the marvell wifi
  chip driver. That issue allowed local users to cause a denial of service
  (system crash) or possibly execute arbitrary code (bnc#1146512).

- CVE-2019-14815: A missing length check while parsing WMM IEs was fixed
  (bsc#1146512, bsc#1146514, bsc#1146516).

- CVE-2019-14816: A heap-based buffer overflow in the marvell wifi chip driver
  was fixed. Local users would have abused this issue to cause a denial of
  service (system crash) or possibly execute arbitrary code (bnc#1146516).

- CVE-2017-18509: An issue in net/ipv6 as fixed. By setting a specific socket
  option, an attacker could control a pointer in kernel land and cause an
  inet_csk_listen_stop general protection fault, or potentially execute
  arbitrary code under certain circumstances. The issue can be triggered as
  root (e.g., inside a default LXC container or with the CAP_NET_ADMIN
  capability) or after namespace unsharing. (bnc#1145477)

- CVE-2019-9506: The Bluetooth BR/EDR specification used to permit sufficiently
  low encryption key length and did not prevent an attacker from influencing
  the key length negotiation. This allowed practical brute-force attacks (aka
  "KNOB") that could decrypt traffic and inject arbitrary ciphertext without
  the victim noticing (bnc#1137865).

- CVE-2019-15098: A NULL pointer dereference in drivers/net/wireless/ath was
  fixed (bnc#1146378).

- CVE-2019-15290: A NULL pointer dereference in ath6kl_usb_alloc_urb_from_pipe
  was fixed (bsc#1146378).

- CVE-2019-15212: A double-free issue was fixed in drivers/usb driver
  (bnc#1146391).

- CVE-2016-10906: A use-after-free issue was fixed in drivers/net/ethernet/arc
  (bnc#1146584).

- CVE-2019-15217: A a NULL pointer dereference issue caused by a malicious USB
  device was fixed in the drivers/media/usb/zr364xx driver (bnc#1146519).

- CVE-2019-15218: A NULL pointer dereference caused by a malicious USB device
  was fixed in the drivers/media/usb/siano driver (bnc#1146413).

- CVE-2019-15215: A use-after-free issue caused by a malicious USB device was
  fixed in the drivers/media/usb/cpia2 driver (bnc#1146425).

- CVE-2018-20976: A use-after-free issue was fixed in the fs/xfs driver
  (bnc#1146285).

- CVE-2017-18551: An out-of-bounds write was fixed in the drivers/i2c driver
  (bnc#1146163).

- CVE-2019-10207: Add checks for missing tty operations to prevent unprivileged
  user to  execute 0x0 address (bsc#1142857 bsc#1123959)

- CVE-2019-15118: ALSA: usb-audio: Fix a stack buffer overflow bug in check_input_term
  leading to kernel stack exhaustion (bsc#1145922).

The following non-security bugs were fixed:

- array_index_nospec: Sanitize speculative array (bsc#1155671)
- hpsa: move lockup_detected attribute to host attr (bsc#999278, bsc#1153119).
- ib/core: Add mitigation for Spectre V1 (bsc#1155671)
- kvm: Convert kvm_lock to a mutex (bsc#1117665).
- kvm: MMU: drop read-only large sptes when creating lower level sptes (bsc#1117665).
- kvm: vmx, svm: always run with EFER.NXE=1 when shadow paging is active (bsc#1117665).
- kvm: x86: make FNAME(fetch) and __direct_map more similar (bsc#1117665).
- media: smsusb: better handle optional alignment (bsc#1146413).
- mwifiex: Fix heap overflow in mwifiex_uap_parse_tail_ies() (bsc#1137944).
- netfilter: nf_nat: do not bug when mapping already exists (bsc#1146612).
- tcp: Be more careful in tcp_fragment() (bsc#1137586 bsc#1139751).
</description>
<summary>Security update for the Linux Kernel</summary>
</patchinfo>

Places

File _patchinfo of Package patchinfo.13152

Places