CVE-2018-20669

An issue where a provided address with access_ok() is not checked was discovered in i915_gem_execbuffer2_ioctl in drivers/gpu/drm/i915/i915_gem_execbuffer.c in the Linux kernel through 4.19.13. A local attacker can craft a malicious IOCTL function call to overwrite arbitrary kernel memory, resulting in a Denial of Service or privilege escalation.

In i915_gem_execbuffer2_ioctl of i915_gem_execbuffer.c, there is a possible arbitrary kernel memory write due to a missing validation of a userspace pointer. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

The openSUSE Leap 15.0 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2019-3459,CVE-2019-3460: Two information leaks in the bluetooth stack were fixed. (bnc#1120758).
• CVE-2019-7221: A use-after-free in the KVM nVMX hrtimer was fixed. (bnc#1124732).
• CVE-2019-7222: A information leak in exception handling in KVM could be used to expose host memory to guests. (bnc#1124735).
• CVE-2019-6974: A use-after-free in the KVM device control API was fixed. (bnc#1124728).
• CVE-2018-20669: Missing access control checks in ioctl of gpu/drm/i915 driver were fixed which might have lead to information leaks. (bnc#1122971).

The following non-security bugs were fixed:

• 6lowpan: iphc: reset mac_header after decompress to fix panic (bsc#1051510).
• 9p: clear dangling pointers in p9stat_free (bsc#1051510).
• 9p locks: fix glock.client_id leak in do_lock (bsc#1051510).
• 9p/net: put a lower bound on msize (bsc#1051510).
• acpi/nfit: Block function zero DSMs (bsc#1051510).
• acpi, nfit: Fix Address Range Scrub completion tracking (bsc#1124969).
• acpi/nfit: Fix command-supported detection (bsc#1051510).
• acpi/nfit: Fix race accessing memdev in nfit_get_smbios_id() (bsc#1122662).
• acpi/nfit: Fix user-initiated ARS to be 'ARS-long' rather than 'ARS-short' (bsc#1124969).
• ACPI: power: Skip duplicate power resource references in _PRx (bsc#1051510).
• Add delay-init quirk for Corsair K70 RGB keyboards (bsc#1087092).
• af_iucv: Move sockaddr length checks to before accessing sa_family in bind and connect handlers (bsc#1051510).
• alsa: bebob: fix model-id of unit for Apogee Ensemble (bsc#1051510).
• alsa: compress: Fix stop handling on compressed capture streams (bsc#1051510).
• alsa: hda - Add mute LED support for HP ProBook 470 G5 (bsc#1051510).
• alsa: hda/ca0132 - Fix build error without CONFIG_PCI (bsc#1051510).
• alsa: hda/realtek - Fixed hp_pin no value (bsc#1051510).
• alsa: hda/realtek - Fix lose hp_pins for disable auto mute (bsc#1051510).
• alsa: hda/realtek - Use a common helper for hp pin reference (bsc#1051510).
• alsa: hda - Serialize codec registrations (bsc#1122944).
• alsa: hda - Use standard device registration for beep (bsc#1122944).
• alsa: oxfw: add support for APOGEE duet FireWire (bsc#1051510).
• alsa: usb-audio: Add Opus #3 to quirks for native DSD support (bsc#1051510).
• alsa: usb-audio: Add support for new T+A USB DAC (bsc#1051510).
• amd-xgbe: Fix mdio access for non-zero ports and clause 45 PHYs (bsc#1122927).
• arm: 8802/1: Call syscall_trace_exit even when system call skipped (bsc#1051510).
• arm: 8814/1: mm: improve/fix ARM v7_dma_inv_range() unaligned address handling (bsc#1051510).
• arm: 8815/1: V7M: align v7m_dma_inv_range() with v7 counterpart (bsc#1051510).
• arm/arm64: kvm:vgic: Force VM halt when changing the active state of GICv3 PPIs/SGIs (bsc#1051510).
• arm: cns3xxx: Fix writing to wrong PCI config registers after alignment (bsc#1051510).
• arm: cns3xxx: Use actual size reads for PCIe (bsc#1051510).
• arm: imx: update the cpu power up timing setting on i.mx6sx (bsc#1051510).
• arm: kvm:Fix VTTBR_BADDR_MASK BUG_ON off-by-one (bsc#1051510).
• arm: mmp/mmp2: fix cpu_is_mmp2() on mmp2-dt (bsc#1051510).
• arm: OMAP1: ams-delta: Fix possible use of uninitialized field (bsc#1051510).
• arm: OMAP2+: prm44xx: Fix section annotation on omap44xx_prm_enable_io_wakeup (bsc#1051510).
• ASoC: dma-sh7760: cleanup a debug printk (bsc#1051510).
• ASoC: rt5514-spi: Fix potential NULL pointer dereference (bsc#1051510).
• ax25: fix a use-after-free in ax25_fillin_cb() (networking-stable-19_01_04).
• be2net: do not flip hw_features when VXLANs are added/deleted (bsc#1050252).
• blkdev: avoid migration stalls for blkdev pages (bsc#1084216).
• blk-mq: fix kernel oops in blk_mq_tag_idle() (bsc#1051510).
• block: break discard submissions into the user defined size (git-fixes).
• block: cleanup __blkdev_issue_discard() (git-fixes).
• block: do not deal with…

The openSUSE Leap 15.2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-29371: An issue was discovered in romfs_dev_read in fs/romfs/storage.c where uninitialized memory leaks to userspace, aka CID-bcf85fcedfdd (bnc#1179429).
• CVE-2020-15436: Use-after-free vulnerability in fs/block_dev.c allowed local users to gain privileges or cause a denial of service by leveraging improper access to a certain error field (bnc#1179141).
• CVE-2020-4788: IBM Power9 (AIX 7.1, 7.2, and VIOS 3.1) processors could allow a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances. IBM X-Force ID: 189296 (bnc#1177666).
• CVE-2018-20669: An issue where a provided address with access_ok() is not checked was discovered in i915_gem_execbuffer2_ioctl in drivers/gpu/drm/i915/i915_gem_execbuffer.c, where a local attacker can craft a malicious IOCTL function call to overwrite arbitrary kernel memory, resulting in a Denial of Service or privilege escalation (bnc#1122971).
• CVE-2020-15437: The Linux kernel was vulnerable to a NULL pointer dereference in drivers/tty/serial/8250/8250_core.c:serial8250_isa_init_ports() that allowed local users to cause a denial of service by using the p->serial_in pointer which uninitialized (bnc#1179140).
• CVE-2020-27777: Restrict RTAS requests from userspace (CVE-2020-27777 bsc#1179107).
• CVE-2020-28974: A slab-out-of-bounds read in fbcon could be used by local attackers to read privileged information or potentially crash the kernel, aka CID-3c4e0dff2095. This occurs because KD_FONT_OP_COPY in drivers/tty/vt/vt.c can be used for manipulations such as font height (bnc#1178589).

The following non-security bugs were fixed:

• ACPI: GED: fix -Wformat (git-fixes).
• ALSA: ctl: fix error path at adding user-defined element set (git-fixes).
• ALSA: firewire: Clean up a locking issue in copy_resp_to_buf() (git-fixes).
• ALSA: mixart: Fix mutex deadlock (git-fixes).
• ASoC: qcom: lpass-platform: Fix memory leak (git-fixes).
• Bluetooth: btusb: Fix and detect most of the Chinese Bluetooth controllers (git-fixes).
• Bluetooth: hci_bcm: fix freeing not-requested IRQ (git-fixes).
• Convert trailing spaces and periods in path components (bsc#1179424).
• Drivers: hv: vmbus: Remove the unused 'tsc_page' from struct hv_context (git-fixes).
• IB/cma: Fix ports memory leak in cma_configfs (bsc#1111666)
• IB/core: Set qp->real_qp before it may be accessed (bsc#1111666)
• IB/hfi1, qib: Ensure RCU is locked when accessing list (bsc#1111666)
• IB/hfi1: Add RcvShortLengthErrCnt to hfi1stats (bsc#1111666)
• IB/hfi1: Add missing INVALIDATE opcodes for trace (bsc#1111666)
• IB/hfi1: Add software counter for ctxt0 seq drop (bsc#1111666)
• IB/hfi1: Avoid hardlockup with flushlist_lock (bsc#1111666)
• IB/hfi1: Call kobject_put() when kobject_init_and_add() fails (bsc#1111666)
• IB/hfi1: Check for error on call to alloc_rsm_map_table (bsc#1111666)
• IB/hfi1: Close PSM sdma_progress sleep window (bsc#1111666)
• IB/hfi1: Define variables as unsigned long to fix KASAN warning (bsc#1111666)
• IB/hfi1: Ensure full Gen3 speed in a Gen4 system (bsc#1111666)
• IB/hfi1: Fix Spectre v1 vulnerability (bsc#1111666)
• IB/hfi1: Fix memory leaks in sysfs registration and unregistration (bsc#1111666)
• IB/hfi1: Handle port down properly in pio (bsc#1111666)
• IB/hfi1: Handle wakeup of orphaned QPs for pio (bsc#1111666)
• IB/hfi1: Insure freeze_work work_struct is canceled on shutdown (bsc#1111666)
• IB/hfi1: Remove unused define (bsc#1111666)
• IB/hfi1: Silence txreq allocation warnings (bsc#1111666)
• IB/hfi1: Validate page aligned for a given virtual address (bsc#1111666)
• IB/hfi1: Wakeup QPs orphaned on wait list after flush (bsc#1111666)
• IB/ipoib: Fix double free of skb in case of multicast traffic in CM mode (bsc#1111666)
• IB/ipoib: Fix for use-after-free in ipoib_cm_tx_start (bsc#1111666)
• IB/ipoib: drop useless LIST_HEAD (bsc#1111666) -…

The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-20669: Missing access control checks in ioctl of gpu/drm/i915 driver were fixed which might have lead to information leaks. (bnc#1122971).
• CVE-2019-3459, CVE-2019-3460: The Bluetooth stack suffered from two remote information leak vulnerabilities in the code that handles incoming L2cap configuration packets (bsc#1120758).
• CVE-2019-3819: A flaw was found in the function hid_debug_events_read() in drivers/hid/hid-debug.c file which may enter an infinite loop with certain parameters passed from a userspace. A local privileged user ('root') can cause a system lock up and a denial of service. (bnc#1123161).
• CVE-2019-6974: kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandled reference counting because of a race condition, leading to a use-after-free (bnc#1124728 ).
• CVE-2019-7221: Fixed a use-after-free vulnerability in the KVM hypervisor related to the emulation of a preemption timer, allowing an guest user/process to crash the host kernel. (bsc#1124732).
• CVE-2019-7222: Fixed an information leakage in the KVM hypervisor related to handling page fault exceptions, which allowed a guest user/process to use this flaw to leak the host's stack memory contents to a guest (bsc#1124735).
• CVE-2019-7308: kernel/bpf/verifier.c performed undesirable out-of-bounds speculation on pointer arithmetic in various cases, including cases of different branches with different state or limits to sanitize, leading to side-channel attacks (bnc#1124055).
• CVE-2019-8912: af_alg_release() in crypto/af_alg.c neglects to set a NULL value for a certain structure member, which leads to a use-after-free in sockfs_setattr (bnc#1125907).
• CVE-2019-8980: A memory leak in the kernel_read_file function in fs/exec.c allowed attackers to cause a denial of service (memory consumption) by triggering vfs_read failures (bnc#1126209).
• CVE-2019-9213: expand_downwards in mm/mmap.c lacked a check for the mmap minimum address, which made it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task (bnc#1128166).
• CVE-2019-2024: A use-after-free when disconnecting a source was fixed which could lead to crashes. bnc#1129179).

The following non-security bugs were fixed:

• 6lowpan: iphc: reset mac_header after decompress to fix panic (bsc#1051510).
• 9p: clear dangling pointers in p9stat_free (bsc#1051510).
• 9p locks: fix glock.client_id leak in do_lock (bsc#1051510).
• 9p/net: fix memory leak in p9_client_create (bsc#1051510).
• 9p/net: put a lower bound on msize (bsc#1051510).
• 9p: use inode->i_lock to protect i_size_write() under 32-bit (bsc#1051510).
• acpi/APEI: Clear GHES block_status before panic() (bsc#1051510).
• acpi/device_sysfs: Avoid OF modalias creation for removed device (bsc#1051510).
• acpi/nfit: Block function zero DSMs (bsc#1051510).
• acpi, nfit: Fix Address Range Scrub completion tracking (bsc#1124969).
• acpi/nfit: Fix bus command validation (bsc#1051510).
• acpi/nfit: Fix command-supported detection (bsc#1051510).
• acpi/nfit: Fix race accessing memdev in nfit_get_smbios_id() (bsc#1122662).
• acpi/nfit: Fix user-initiated ARS to be 'ARS-long' rather than 'ARS-short' (bsc#1124969).
• acpi: NUMA: Use correct type for printing addresses on i386-PAE (bsc#1051510).
• acpi: power: Skip duplicate power resource references in _PRx (bsc#1051510).
• acpi / video: Extend chassis-type detection with a 'Lunch Box' check (bsc#1051510).
• acpi / video: Refactor and fix dmi_is_desktop() (bsc#1051510).
• add 1 entry 2bcbd406715dca256912b9c5ae449c7968f15705
• Add delay-init quirk for Corsair K70 RGB keyboards (bsc#1087092).
• af_iucv: Move sockaddr length checks to before accessing sa_family in bind and connect handlers (bsc#1051510).
• alsa: bebob: fix model-id of unit for Apogee Ensemble (bsc#1051510).
• alsa: bebob:…

The SUSE Linux Enterprise Server 12 SP4 Azure kernel was updated to fix various issues.

The following security bugs were fixed:

• CVE-2019-2024: A use-after-free when disconnecting a source was fixed which could lead to crashes. bnc#1129179).
• CVE-2019-9213: expand_downwards in mm/mmap.c lacked a check for the mmap minimum address, which made it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task (bnc#1128166 1128378 1129016).
• CVE-2019-8980: A memory leak in the kernel_read_file function in fs/exec.c allowed attackers to cause a denial of service (memory consumption) by triggering vfs_read failures (bnc#1126209).
• CVE-2019-3819: A flaw was found in the function hid_debug_events_read() in drivers/hid/hid-debug.c file which may enter an infinite loop with certain parameters passed from a userspace. A local privileged user ('root') can cause a system lock up and a denial of service. (bnc#1123161).
• CVE-2019-8912: af_alg_release() in crypto/af_alg.c neglected to set a NULL value for a certain structure member, which led to a use-after-free in sockfs_setattr (bnc#1125907 1126284).
• CVE-2019-7308: kernel/bpf/verifier.c performed undesirable out-of-bounds speculation on pointer arithmetic in various cases, including cases of different branches with different state or limits to sanitize, leading to side-channel attacks (bnc#1124055).
• CVE-2019-3459, CVE-2019-3460: The Bluetooth stack suffered from two remote information leak vulnerabilities in the code that handles incoming L2cap configuration packets (bsc#1120758).
• CVE-2019-7221: Fixed a use-after-free vulnerability in the KVM hypervisor related to the emulation of a preemption timer, allowing an guest user/process to crash the host kernel. (bsc#1124732).
• CVE-2019-7222: Fixed an information leakage in the KVM hypervisor related to handling page fault exceptions, which allowed a guest user/process to use this flaw to leak the host's stack memory contents to a guest (bsc#1124735).
• CVE-2019-6974: kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandled reference counting because of a race condition, leading to a use-after-free (bnc#1124728).
• CVE-2018-20669: An issue where a provided address with access_ok() is not checked was discovered in i915_gem_execbuffer2_ioctl in drivers/gpu/drm/i915/i915_gem_execbuffer.c where a local attacker can craft a malicious IOCTL function call to overwrite arbitrary kernel memory, resulting in a Denial of Service or privilege escalation (bnc#1122971).

The following non-security bugs were fixed:

• 6lowpan: iphc: reset mac_header after decompress to fix panic (bsc#1051510).
• 9p: clear dangling pointers in p9stat_free (bsc#1051510).
• 9p locks: fix glock.client_id leak in do_lock (bsc#1051510).
• 9p/net: fix memory leak in p9_client_create (bsc#1051510).
• 9p/net: put a lower bound on msize (bsc#1051510).
• 9p: use inode->i_lock to protect i_size_write() under 32-bit (bsc#1051510).
• acpi/APEI: Clear GHES block_status before panic() (bsc#1051510).
• acpi / device_sysfs: Avoid OF modalias creation for removed device (bsc#1051510).
• acpi/nfit: Block function zero DSMs (bsc#1051510).
• acpi, nfit: Fix Address Range Scrub completion tracking (bsc#1124969).
• acpi/nfit: Fix bus command validation (bsc#1051510).
• acpi/nfit: Fix command-supported detection (bsc#1051510).
• acpi/nfit: Fix race accessing memdev in nfit_get_smbios_id() (bsc#1122662).
• acpi/nfit: Fix user-initiated ARS to be 'ARS-long' rather than 'ARS-short' (bsc#1124969).
• acpi: NUMA: Use correct type for printing addresses on i386-PAE (bsc#1051510).
• acpi: power: Skip duplicate power resource references in _PRx (bsc#1051510).
• acpi / video: Extend chassis-type detection with a 'Lunch Box' check (bsc#1051510).
• acpi / video: Refactor and fix dmi_is_desktop() (bsc#1051510).
• add 1 entry 2bcbd406715dca256912b9c5ae449c7968f15705
• Add delay-init quirk for Corsair K70 RGB keyboards…

The SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2019-2024: A use-after-free when disconnecting a source was fixed which could lead to crashes. bnc#1129179).
• CVE-2019-9213: expand_downwards in mm/mmap.c lacks a check for the mmap minimum address, which made it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task (bnc#1128166).
• CVE-2019-8980: A memory leak in the kernel_read_file function in fs/exec.c allowed attackers to cause a denial of service (memory consumption) by triggering vfs_read failures (bnc#1126209).
• CVE-2019-3819: A flaw was found in the function hid_debug_events_read() in drivers/hid/hid-debug.c file which may enter an infinite loop with certain parameters passed from a userspace. A local privileged user ('root') can cause a system lock up and a denial of service. Versions from v4.18 and newer are vulnerable (bnc#1123161).
• CVE-2019-8912: af_alg_release() in crypto/af_alg.c neglects to set a NULL value for a certain structure member, which leads to a use-after-free in sockfs_setattr (bnc#1125907).
• CVE-2019-7308: kernel/bpf/verifier.c performed undesirable out-of-bounds speculation on pointer arithmetic in various cases, including cases of different branches with different state or limits to sanitize, leading to side-channel attacks (bnc#1124055).
• CVE-2019-3459, CVE-2019-3460: The Bluetooth stack suffered from two remote information leak vulnerabilities in the code that handles incoming L2cap configuration packets (bsc#1120758).
• CVE-2019-7221: Fixed a user-after-free vulnerability in the KVM hypervisor related to the emulation of a preemption timer, allowing an guest user/process to crash the host kernel. (bsc#1124732).
• CVE-2019-7222: Fixed an information leakage in the KVM hypervisor related to handling page fault exceptions, which allowed a guest user/process to use this flaw to leak the host's stack memory contents to a guest (bsc#1124735).
• CVE-2019-6974: kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandled reference counting because of a race condition, leading to a use-after-free (bnc#1124728).
• CVE-2018-20669: Missing access control checks in ioctl of gpu/drm/i915 driver were fixed which might have lead to information leaks. (bnc#1122971).

The following non-security bugs were fixed:

• 6lowpan: iphc: reset mac_header after decompress to fix panic (bsc#1051510).
• 9p: clear dangling pointers in p9stat_free (bsc#1051510).
• 9p locks: fix glock.client_id leak in do_lock (bsc#1051510).
• 9p/net: fix memory leak in p9_client_create (bsc#1051510).
• 9p/net: put a lower bound on msize (bsc#1051510).
• 9p: use inode->i_lock to protect i_size_write() under 32-bit (bsc#1051510).
• ACPI/APEI: Clear GHES block_status before panic() (bsc#1051510).
• acpi / device_sysfs: Avoid OF modalias creation for removed device (bsc#1051510).
• acpi/nfit: Block function zero DSMs (bsc#1051510).
• acpi, nfit: Fix Address Range Scrub completion tracking (bsc#1124969).
• acpi/nfit: Fix bus command validation (bsc#1051510).
• acpi/nfit: Fix command-supported detection (bsc#1051510).
• acpi/nfit: Fix race accessing memdev in nfit_get_smbios_id() (bsc#1122662).
• acpi/nfit: Fix user-initiated ARS to be 'ARS-long' rather than 'ARS-short' (bsc#1124969).
• acpi: NUMA: Use correct type for printing addresses on i386-PAE (bsc#1051510).
• acpi: power: Skip duplicate power resource references in _PRx (bsc#1051510).
• acpi / video: Extend chassis-type detection with a 'Lunch Box' check (bsc#1051510).
• acpi / video: Refactor and fix dmi_is_desktop() (bsc#1051510).
• add 1 entry 2bcbd406715dca256912b9c5ae449c7968f15705
• Add delay-init quirk for Corsair K70 RGB keyboards (bsc#1087092).
• add mainline tags for two hyperv iommu patches
• Adjust a commit id in a nvme patch to make our scripts happy
• af_iucv: Move sockaddr length checks to…

The SUSE Linux Enterprise 15 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2019-2024: A use-after-free when disconnecting a source was fixed which could lead to crashes. bnc#1129179).
• CVE-2019-9213: expand_downwards in mm/mmap.c lacks a check for the mmap minimum address, which made it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task (bnc#1128166).
• CVE-2019-8980: A memory leak in the kernel_read_file function in fs/exec.c allowed attackers to cause a denial of service (memory consumption) by triggering vfs_read failures (bnc#1126209).
• CVE-2019-3819: A flaw was found in the function hid_debug_events_read() in drivers/hid/hid-debug.c file which may enter an infinite loop with certain parameters passed from a userspace. A local privileged user ('root') can cause a system lock up and a denial of service. (bnc#1123161).
• CVE-2019-8912: af_alg_release() in crypto/af_alg.c neglects to set a NULL value for a certain structure member, which leads to a use-after-free in sockfs_setattr (bnc#1125907).
• CVE-2019-7308: kernel/bpf/verifier.c performed undesirable out-of-bounds speculation on pointer arithmetic in various cases, including cases of different branches with different state or limits to sanitize, leading to side-channel attacks (bnc#1124055).
• CVE-2019-3459, CVE-2019-3460: The Bluetooth stack suffered from two remote information leak vulnerabilities in the code that handles incoming L2cap configuration packets (bsc#1120758).
• CVE-2019-7221: The KVM implementation had a Use-after-Free problem (bnc#1124732).
• CVE-2019-7222: The KVM implementation had an Information Leak (bnc#1124735).
• CVE-2019-6974: kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandled reference counting because of a race condition, leading to a use-after-free (bnc#1124728).
• CVE-2018-20669: Missing access control checks in ioctl of gpu/drm/i915 driver were fixed which might have lead to information leaks. (bnc#1122971).

The following non-security bugs were fixed:

• 6lowpan: iphc: reset mac_header after decompress to fix panic (bsc#1051510).
• 9p: clear dangling pointers in p9stat_free (bsc#1051510).
• 9p locks: fix glock.client_id leak in do_lock (bsc#1051510).
• 9p/net: fix memory leak in p9_client_create (bsc#1051510).
• 9p/net: put a lower bound on msize (bsc#1051510).
• 9p: use inode->i_lock to protect i_size_write() under 32-bit (bsc#1051510).
• acpi/APEI: Clear GHES block_status before panic() (bsc#1051510).
• acpi/device_sysfs: Avoid OF modalias creation for removed device (bsc#1051510).
• acpi/nfit: Block function zero DSMs (bsc#1051510).
• acpi/nfit: Fix Address Range Scrub completion tracking (bsc#1124969).
• acpi/nfit: Fix bus command validation (bsc#1051510).
• acpi/nfit: Fix command-supported detection (bsc#1051510).
• acpi/nfit: Fix race accessing memdev in nfit_get_smbios_id() (bsc#1122662).
• acpi/nfit: Fix user-initiated ARS to be 'ARS-long' rather than 'ARS-short' (bsc#1124969).
• acpi/numa: Use correct type for printing addresses on i386-PAE (bsc#1051510).
• acpi/power: Skip duplicate power resource references in _PRx (bsc#1051510).
• acpi/video: Extend chassis-type detection with a 'Lunch Box' check (bsc#1051510).
• acpi/video: Refactor and fix dmi_is_desktop() (bsc#1051510).
• add 1 entry 2bcbd406715dca256912b9c5ae449c7968f15705
• Add delay-init quirk for Corsair K70 RGB keyboards (bsc#1087092).
• af_iucv: Move sockaddr length checks to before accessing sa_family in bind and connect handlers (bsc#1051510).
• alsa: bebob: fix model-id of unit for Apogee Ensemble (bsc#1051510).
• alsa: bebob: use more identical mod_alias for Saffire Pro 10 I/O against Liquid Saffire 56 (bsc#1051510).
• alsa: compress: Fix stop handling on compressed capture streams (bsc#1051510).
• alsa: compress: prevent potential divide by zero bugs (bsc#1051510).
• alsa: firewire-motu: fix…

The SUSE Linux Enterprise 12 SP5 kernel RT was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-20669: Fixed an improper check i915_gem_execbuffer2_ioctl in drivers/gpu/drm/i915/i915_gem_execbuffer.c (bsc#1122971).
• CVE-2019-20934: Fixed a use-after-free in show_numa_stats() because NUMA fault statistics were inappropriately freed, aka CID-16d51a590a8c (bsc#1179663).
• CVE-2020-15436: Fixed a use after free vulnerability in fs/block_dev.c which could have allowed local users to gain privileges or cause a denial of service (bsc#1179141).
• CVE-2020-15437: Fixed a null pointer dereference which could have allowed local users to cause a denial of service(bsc#1179140).
• CVE-2020-25669: Fixed a use-after-free read in sunkbd_reinit() (bsc#1178182).
• CVE-2020-27777: Restrict RTAS requests from userspace (bsc#1179107)
• CVE-2020-27786: Fixed a use after free in kernel midi subsystem snd_rawmidi_kernel_read1() (bsc#1179601).
• CVE-2020-28915: Fixed a buffer over-read in the fbcon code which could have been used by local attackers to read kernel memory (bsc#1178886).
• CVE-2020-28974: Fixed a slab-out-of-bounds read in fbcon which could have been used by local attackers to read privileged information or potentially crash the kernel, aka CID-3c4e0dff2095 (bsc#1178589).
• CVE-2020-29371: Fixed uninitialized memory leaks to userspace (bsc#1179429).
• CVE-2020-4788: Fixed an issue with IBM Power9 processors could have allowed a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances (bsc#1177666).

The following non-security bugs were fixed:

• ACPI: GED: fix -Wformat (git-fixes).
• ALSA: ctl: fix error path at adding user-defined element set (git-fixes).
• ALSA: firewire: Clean up a locking issue in copy_resp_to_buf() (git-fixes).
• ALSA: hda/realtek: Add mute LED quirk to yet another HP x360 model (git-fixes).
• ALSA: hda/realtek - Add new codec supported for ALC897 (git-fixes).
• ALSA: hda/realtek: Add some Clove SSID in the ALC293(ALC1220) (git-fixes).
• ALSA: hda/realtek: Enable headset of ASUS UX482EG & B9400CEA with ALC294 (git-fixes).
• ALSA: mixart: Fix mutex deadlock (git-fixes).
• ALSA: usb-audio: US16x08: fix value count for level meters (git-fixes).
• arm64: KVM: Fix system register enumeration (bsc#1174726).
• arm/arm64: KVM: Add PSCI version selection API (bsc#1174726).
• ASoC: qcom: lpass-platform: Fix memory leak (git-fixes).
• ath10k: Acquire tx_lock in tx error paths (git-fixes).
• Avoid a GCC warning about '/*' within a comment.
• batman-adv: set .owner to THIS_MODULE (git-fixes).
• Bluetooth: btusb: Fix and detect most of the Chinese Bluetooth controllers (git-fixes).
• Bluetooth: hci_bcm: fix freeing not-requested IRQ (git-fixes).
• bnxt_en: Fix race when modifying pause settings (bsc#1050242 ).
• bnxt_en: Protect bnxt_set_eee() and bnxt_set_pauseparam() with mutex (bsc#1050242).
• bpf: Zero-fill re-used per-cpu map element (git-fixes).
• btrfs: account ticket size at add/delete time (bsc#1178897).
• btrfs: add helper to obtain number of devices with ongoing dev-replace (bsc#1178897).
• btrfs: check rw_devices, not num_devices for balance (bsc#1178897).
• btrfs: do not delete mismatched root refs (bsc#1178962).
• btrfs: fix btrfs_calc_reclaim_metadata_size calculation (bsc#1178897).
• btrfs: fix force usage in inc_block_group_ro (bsc#1178897).
• btrfs: fix invalid removal of root ref (bsc#1178962).
• btrfs: fix reclaim counter leak of space_info objects (bsc#1178897).
• btrfs: fix reclaim_size counter leak after stealing from global reserve (bsc#1178897).
• btrfs: kill min_allocable_bytes in inc_block_group_ro (bsc#1178897).
• btrfs: qgroup: do not commit transaction when we already hold the handle (bsc#1178634).
• btrfs: rework arguments of btrfs_unlink_subvol (bsc#1178962).
• btrfs: split dev-replace locking helpers for read and write (bsc#1178897).
• can: af_can: prevent potential access of uninitialized…

The SUSE Linux Enterprise 15-SP1 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-20669: Fixed an improper check i915_gem_execbuffer2_ioctl in drivers/gpu/drm/i915/i915_gem_execbuffer.c (bsc#1122971).
• CVE-2019-20934: Fixed a use-after-free in show_numa_stats() because NUMA fault statistics were inappropriately freed, aka CID-16d51a590a8c (bsc#1179663).
• CVE-2020-15436: Fixed a use after free vulnerability in fs/block_dev.c which could have allowed local users to gain privileges or cause a denial of service (bsc#1179141).
• CVE-2020-15437: Fixed a null pointer dereference which could have allowed local users to cause a denial of service(bsc#1179140).
• CVE-2020-25669: Fixed a use-after-free read in sunkbd_reinit() (bsc#1178182).
• CVE-2020-27777: Restrict RTAS requests from userspace (bsc#1179107)
• CVE-2020-27786: Fixed a use after free in kernel midi subsystem snd_rawmidi_kernel_read1() (bsc#1179601).
• CVE-2020-28915: Fixed a buffer over-read in the fbcon code which could have been used by local attackers to read kernel memory (bsc#1178886).
• CVE-2020-28974: Fixed a slab-out-of-bounds read in fbcon which could have been used by local attackers to read privileged information or potentially crash the kernel, aka CID-3c4e0dff2095 (bsc#1178589).
• CVE-2020-29371: Fixed uninitialized memory leaks to userspace (bsc#1179429).
• CVE-2020-4788: Fixed an issue with IBM Power9 processors could have allowed a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances (bsc#1177666).

The following non-security bugs were fixed:

• ACPI: GED: fix -Wformat (git-fixes).
• ALSA: ctl: fix error path at adding user-defined element set (git-fixes).
• ALSA: firewire: Clean up a locking issue in copy_resp_to_buf() (git-fixes).
• ALSA: hda/realtek: Add mute LED quirk to yet another HP x360 model (git-fixes).
• ALSA: hda/realtek - Add new codec supported for ALC897 (git-fixes).
• ALSA: hda/realtek: Add some Clove SSID in the ALC293(ALC1220) (git-fixes).
• ALSA: hda/realtek: Enable headset of ASUS UX482EG & B9400CEA with ALC294 (git-fixes).
• ALSA: mixart: Fix mutex deadlock (git-fixes).
• ALSA: usb-audio: US16x08: fix value count for level meters (git-fixes).
• arm64: KVM: Fix system register enumeration (bsc#1174726).
• arm/arm64: KVM: Add PSCI version selection API (bsc#1174726).
• ASoC: qcom: lpass-platform: Fix memory leak (git-fixes).
• ath10k: Acquire tx_lock in tx error paths (git-fixes).
• Avoid a GCC warning about '/*' within a comment.
• batman-adv: set .owner to THIS_MODULE (git-fixes).
• Bluetooth: btusb: Fix and detect most of the Chinese Bluetooth controllers (git-fixes).
• Bluetooth: hci_bcm: fix freeing not-requested IRQ (git-fixes).
• bnxt_en: Fix race when modifying pause settings (bsc#1050242 ).
• bnxt_en: Protect bnxt_set_eee() and bnxt_set_pauseparam() with mutex (bsc#1050242).
• btmrvl: Fix firmware filename for sd8997 chipset (bsc#1172694).
• btrfs: account ticket size at add/delete time (bsc#1178897).
• btrfs: add helper to obtain number of devices with ongoing dev-replace (bsc#1178897).
• btrfs: check rw_devices, not num_devices for balance (bsc#1178897).
• btrfs: do not delete mismatched root refs (bsc#1178962).
• btrfs: fix btrfs_calc_reclaim_metadata_size calculation (bsc#1178897).
• btrfs: fix force usage in inc_block_group_ro (bsc#1178897).
• btrfs: fix invalid removal of root ref (bsc#1178962).
• btrfs: fix reclaim counter leak of space_info objects (bsc#1178897).
• btrfs: fix reclaim_size counter leak after stealing from global reserve (bsc#1178897).
• btrfs: kill min_allocable_bytes in inc_block_group_ro (bsc#1178897).
• btrfs: qgroup: do not commit transaction when we already hold the handle (bsc#1178634).
• btrfs: rework arguments of btrfs_unlink_subvol (bsc#1178962).
• btrfs: split dev-replace locking helpers for read and write (bsc#1178897).
• can: af_can: prevent potential access of…

The SUSE Linux Enterprise 15 SP1 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2019-20934: Fixed a use-after-free in show_numa_stats() because NUMA fault statistics were inappropriately freed, aka CID-16d51a590a8c (bsc#1179663).
• CVE-2020-0444: Fixed a bad kfree due to a logic error in audit_data_to_entry (bnc#1180027).
• CVE-2020-0465: Fixed multiple missing bounds checks in hid-multitouch.c that could have led to local privilege escalation (bnc#1180029).
• CVE-2020-0466: Fixed a use-after-free due to a logic error in do_epoll_ctl and ep_loop_check_proc of eventpoll.c (bnc#1180031).
• CVE-2020-4788: Fixed an issue with IBM Power9 processors could have allowed a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances (bsc#1177666).
• CVE-2020-11668: Fixed an out of bounds write to the heap in drivers/media/usb/gspca/xirlink_cit.c (aka the Xirlink camera USB driver) caused by mishandling invalid descriptors (bsc#1168952).
• CVE-2020-15436: Fixed a use after free vulnerability in fs/block_dev.c which could have allowed local users to gain privileges or cause a denial of service (bsc#1179141).
• CVE-2020-27068: Fixed an out-of-bounds read due to a missing bounds check in the nl80211_policy policy of nl80211.c (bnc#1180086).
• CVE-2020-27777: Fixed a privilege escalation in the Run-Time Abstraction Services (RTAS) interface, affecting guests running on top of PowerVM or KVM hypervisors (bnc#1179107).
• CVE-2020-27786: Fixed an out-of-bounds write in the MIDI implementation (bnc#1179601).
• CVE-2020-27825: Fixed a race in the trace_open and buffer resize calls (bsc#1179960).
• CVE-2020-29371: Fixed uninitialized memory leaks to userspace (bsc#1179429).
• CVE-2020-29660: Fixed a locking inconsistency in the tty subsystem that may have allowed a read-after-free attack against TIOCGSID (bnc#1179745).
• CVE-2020-29661: Fixed a locking issue in the tty subsystem that allowed a use-after-free attack against TIOCSPGRP (bsc#1179745).

The following non-security bugs were fixed:

• ACPI: PNP: compare the string length in the matching_id() (git-fixes).
• ACPICA: Disassembler: create buffer fields in ACPI_PARSE_LOAD_PASS1 (git-fixes).
• ACPICA: Do not increment operation_region reference counts for field units (git-fixes).
• ALSA: ca0106: fix error code handling (git-fixes).
• ALSA: ctl: allow TLV read operation for callback type of element in locked case (git-fixes).
• ALSA: hda - Fix silent audio output and corrupted input on MSI X570-A PRO (git-fixes).
• ALSA: hda/ca0132 - Change Input Source enum strings (git-fixes).
• ALSA: hda/ca0132 - Fix AE-5 rear headphone pincfg (git-fixes).
• ALSA: hda/generic: Add option to enforce preferred_dacs pairs (git-fixes).
• ALSA: hda/hdmi: always check pin power status in i915 pin fixup (git-fixes).
• ALSA: hda/realtek - Add new codec supported for ALC897 (git-fixes).
• ALSA: hda/realtek - Couldn't detect Mic if booting with headset plugged (git-fixes).
• ALSA: hda/realtek - Enable headset mic of ASUS Q524UQK with ALC255 (git-fixes).
• ALSA: hda/realtek: Add mute LED quirk to yet another HP x360 model (git-fixes).
• ALSA: hda/realtek: Add some Clove SSID in the ALC293(ALC1220) (git-fixes).
• ALSA: hda/realtek: Enable front panel headset LED on Lenovo ThinkStation P520 (git-fixes).
• ALSA: hda/realtek: Enable headset of ASUS UX482EG & B9400CEA with ALC294 (git-fixes).
• ALSA: hda: Add NVIDIA codec IDs 9a & 9d through a0 to patch table (git-fixes).
• ALSA: hda: Fix potential race in unsol event handler (git-fixes).
• ALSA: hda: Fix regressions on clear and reconfig sysfs (git-fixes).
• ALSA: info: Drop WARN_ON() from buffer NULL sanity check (git-fixes).
• ALSA: isa/wavefront: prevent out of bounds write in ioctl (git-fixes).
• ALSA: line6: Perform sanity check for each URB creation (git-fixes).
• ALSA: pcm: oss: Fix a few more UBSAN fixes (git-fixes).
• ALSA: pcm: oss: Fix potential…

The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-20669: Fixed an improper check i915_gem_execbuffer2_ioctl in drivers/gpu/drm/i915/i915_gem_execbuffer.c (bsc#1122971).
• CVE-2019-20934: Fixed a use-after-free in show_numa_stats() because NUMA fault statistics were inappropriately freed, aka CID-16d51a590a8c (bsc#1179663).
• CVE-2020-0444: Fixed a bad kfree due to a logic error in audit_data_to_entry (bnc#1180027).
• CVE-2020-0465: Fixed multiple missing bounds checks in hid-multitouch.c that could have led to local privilege escalation (bnc#1180029).
• CVE-2020-0466: Fixed a use-after-free due to a logic error in do_epoll_ctl and ep_loop_check_proc of eventpoll.c (bnc#1180031).
• CVE-2020-4788: Fixed an issue with IBM Power9 processors could have allowed a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances (bsc#1177666).
• CVE-2020-15436: Fixed a use after free vulnerability in fs/block_dev.c which could have allowed local users to gain privileges or cause a denial of service (bsc#1179141).
• CVE-2020-27068: Fixed an out-of-bounds read due to a missing bounds check in the nl80211_policy policy of nl80211.c (bnc#1180086).
• CVE-2020-27777: Fixed a privilege escalation in the Run-Time Abstraction Services (RTAS) interface, affecting guests running on top of PowerVM or KVM hypervisors (bnc#1179107).
• CVE-2020-27786: Fixed an out-of-bounds write in the MIDI implementation (bnc#1179601).
• CVE-2020-27825: Fixed a race in the trace_open and buffer resize calls (bsc#1179960).
• CVE-2020-29371: Fixed uninitialized memory leaks to userspace (bsc#1179429).
• CVE-2020-29660: Fixed a locking inconsistency in the tty subsystem that may have allowed a read-after-free attack against TIOCGSID (bnc#1179745).
• CVE-2020-29661: Fixed a locking issue in the tty subsystem that allowed a use-after-free attack against TIOCSPGRP (bsc#1179745).

The following non-security bugs were fixed:

• ALSA: hda/ca0132 - Change Input Source enum strings (git-fixes).
• ALSA: hda/ca0132 - Fix AE-5 rear headphone pincfg (git-fixes).
• ALSA: hda/realtek - Add new codec supported for ALC897 (git-fixes).
• ALSA: hda/realtek: Add mute LED quirk to yet another HP x360 model (git-fixes).
• ALSA: hda/realtek: Add some Clove SSID in the ALC293(ALC1220) (git-fixes).
• ALSA: hda/realtek: Enable headset of ASUS UX482EG & B9400CEA with ALC294 (git-fixes).
• ALSA: hda: Fix regressions on clear and reconfig sysfs (git-fixes).
• ALSA: usb-audio: US16x08: fix value count for level meters (git-fixes).
• ASoC: arizona: Fix a wrong free in wm8997_probe (git-fixes).
• ASoC: cx2072x: Fix doubly definitions of Playback and Capture streams (git-fixes).
• ASoC: jz4740-i2s: add missed checks for clk_get() (git-fixes).
• ASoC: pcm: DRAIN support reactivation (git-fixes).
• ASoC: wm8998: Fix PM disable depth imbalance on error (git-fixes).
• ASoC: wm_adsp: remove 'ctl' from list on error in wm_adsp_create_control() (git-fixes).
• ath10k: Fix an error handling path (git-fixes).
• ath10k: Release some resources in an error handling path (git-fixes).
• ath10k: Remove msdu from idr when management pkt send fails (git-fixes).
• ath6kl: fix enum-conversion warning (git-fixes).
• Avoid a GCC warning about '/*' within a comment.
• Bluetooth: btusb: Fix detection of some fake CSR controllers with a bcdDevice val of 0x0134 (git-fixes).
• Bluetooth: Fix null pointer dereference in hci_event_packet() (git-fixes).
• Bluetooth: Fix slab-out-of-bounds read in hci_le_direct_adv_report_evt() (git-fixes).
• bnxt_en: Fix race when modifying pause settings (bsc#1050242 ).
• bnxt_en: Protect bnxt_set_eee() and bnxt_set_pauseparam() with mutex (bsc#1050242).
• btmrvl: Fix firmware filename for sd8997 chipset (bsc#1172694).
• btrfs: fix use-after-free on readahead extent after failure to create it (bsc#1179963).
• btrfs: qgroup: do not commit transaction…

The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-28374: Fixed a Linux SCSI target issue (bsc#1178372).
• CVE-2020-36158: Fixed a potential remote code execution in the Marvell mwifiex driver (bsc#1180559).
• CVE-2020-27825: Fixed a race in the trace_open and buffer resize calls (bsc#1179960).
• CVE-2020-0466: Fixed a use-after-free due to a logic error in do_epoll_ctl and ep_loop_check_proc of eventpoll.c (bnc#1180031).
• CVE-2020-27068: Fixed an out-of-bounds read due to a missing bounds check in the nl80211_policy policy of nl80211.c (bnc#1180086).
• CVE-2020-0465: Fixed multiple missing bounds checks in hid-multitouch.c that could have led to local privilege escalation (bnc#1180029).
• CVE-2020-0444: Fixed a bad kfree due to a logic error in audit_data_to_entry (bnc#1180027).
• CVE-2020-29660: Fixed a locking inconsistency in the tty subsystem that may have allowed a read-after-free attack against TIOCGSID (bnc#1179745).
• CVE-2020-29661: Fixed a locking issue in the tty subsystem that allowed a use-after-free attack against TIOCSPGRP (bsc#1179745).
• CVE-2020-27777: Fixed a privilege escalation in the Run-Time Abstraction Services (RTAS) interface, affecting guests running on top of PowerVM or KVM hypervisors (bnc#1179107).
• CVE-2019-20934: Fixed a use-after-free in show_numa_stats() because NUMA fault statistics were inappropriately freed, aka CID-16d51a590a8c (bsc#1179663).
• CVE-2020-27786: Fixed a use after free in kernel midi subsystem snd_rawmidi_kernel_read1() (bsc#1179601).

The following non-security bugs were fixed:

• ACPI: PNP: compare the string length in the matching_id() (git-fixes).
• ACPICA: Disassembler: create buffer fields in ACPI_PARSE_LOAD_PASS1 (git-fixes).
• ACPICA: Do not increment operation_region reference counts for field units (git-fixes).
• ALSA: ca0106: fix error code handling (git-fixes).
• ALSA: ctl: allow TLV read operation for callback type of element in locked case (git-fixes).
• ALSA: hda - Fix silent audio output and corrupted input on MSI X570-A PRO (git-fixes).
• ALSA: hda/ca0132 - Change Input Source enum strings (git-fixes).
• ALSA: hda/ca0132 - Fix AE-5 rear headphone pincfg (git-fixes).
• ALSA: hda/generic: Add option to enforce preferred_dacs pairs (git-fixes).
• ALSA: hda/hdmi: always check pin power status in i915 pin fixup (git-fixes).
• ALSA: hda/realtek - Add new codec supported for ALC897 (git-fixes).
• ALSA: hda/realtek - Couldn't detect Mic if booting with headset plugged (git-fixes).
• ALSA: hda/realtek - Enable headset mic of ASUS Q524UQK with ALC255 (git-fixes).
• ALSA: hda/realtek: Add mute LED quirk to yet another HP x360 model (git-fixes).
• ALSA: hda/realtek: Add some Clove SSID in the ALC293(ALC1220) (git-fixes).
• ALSA: hda/realtek: Enable front panel headset LED on Lenovo ThinkStation P520 (git-fixes).
• ALSA: hda/realtek: Enable headset of ASUS UX482EG & B9400CEA with ALC294 (git-fixes).
• ALSA: hda: Add NVIDIA codec IDs 9a & 9d through a0 to patch table (git-fixes).
• ALSA: hda: Fix potential race in unsol event handler (git-fixes).
• ALSA: hda: Fix regressions on clear and reconfig sysfs (git-fixes).
• ALSA: info: Drop WARN_ON() from buffer NULL sanity check (git-fixes).
• ALSA: isa/wavefront: prevent out of bounds write in ioctl (git-fixes).
• ALSA: line6: Perform sanity check for each URB creation (git-fixes).
• ALSA: pcm: oss: Fix a few more UBSAN fixes (git-fixes).
• ALSA: pcm: oss: Fix potential out-of-bounds shift (git-fixes).
• ALSA: pcm: oss: Remove superfluous WARN_ON() for mulaw sanity check (git-fixes).
• ALSA: timer: Limit max amount of slave instances (git-fixes).
• ALSA: usb-audio: Add delay quirk for all Logitech USB devices (git-fixes).
• ALSA: usb-audio: Add delay quirk for H570e USB headsets (git-fixes).
• ALSA: usb-audio: Add implicit feedback quirk for MODX (git-fixes).
• ALSA: usb-audio: Add implicit feedback quirk for Qu-16 (git-fixes).…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-28374: Fixed a LIO security issue (bsc#1178372).
• CVE-2020-36158: Fixed a potential remote code execution in the Marvell mwifiex driver (bsc#1180559).
• CVE-2020-27825: Fixed a race in the trace_open and buffer resize calls (bsc#1179960).
• CVE-2020-0466: Fixed a use-after-free due to a logic error in do_epoll_ctl and ep_loop_check_proc of eventpoll.c (bnc#1180031).
• CVE-2020-27068: Fixed an out-of-bounds read due to a missing bounds check in the nl80211_policy policy of nl80211.c (bnc#1180086).
• CVE-2020-0465: Fixed multiple missing bounds checks in hid-multitouch.c that could have led to local privilege escalation (bnc#1180029).
• CVE-2020-0444: Fixed a bad kfree due to a logic error in audit_data_to_entry (bnc#1180027).
• CVE-2020-29660: Fixed a locking inconsistency in the tty subsystem that may have allowed a read-after-free attack against TIOCGSID (bnc#1179745).
• CVE-2020-29661: Fixed a locking issue in the tty subsystem that allowed a use-after-free attack against TIOCSPGRP (bsc#1179745).
• CVE-2020-27777: Fixed a privilege escalation in the Run-Time Abstraction Services (RTAS) interface, affecting guests running on top of PowerVM or KVM hypervisors (bnc#1179107).
• CVE-2019-20934: Fixed a use-after-free in show_numa_stats() because NUMA fault statistics were inappropriately freed, aka CID-16d51a590a8c (bsc#1179663).
• CVE-2020-27786: Fixed a use after free in kernel midi subsystem snd_rawmidi_kernel_read1() (bsc#1179601).
• CVE-2020-4788: Fixed an issue with IBM Power9 processors could have allowed a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances (bsc#1177666).
• CVE-2018-20669: Fixed an improper check i915_gem_execbuffer2_ioctl in drivers/gpu/drm/i915/i915_gem_execbuffer.c (bsc#1122971).

The following non-security bugs were fixed:

• ACPI: PNP: compare the string length in the matching_id() (git-fixes).
• ACPICA: Disassembler: create buffer fields in ACPI_PARSE_LOAD_PASS1 (git-fixes).
• ACPICA: Do not increment operation_region reference counts for field units (git-fixes).
• ALSA: ca0106: fix error code handling (git-fixes).
• ALSA: ctl: allow TLV read operation for callback type of element in locked case (git-fixes).
• ALSA: hda - Fix silent audio output and corrupted input on MSI X570-A PRO (git-fixes).
• ALSA: hda/ca0132 - Change Input Source enum strings (git-fixes).
• ALSA: hda/ca0132 - Fix AE-5 rear headphone pincfg (git-fixes).
• ALSA: hda/generic: Add option to enforce preferred_dacs pairs (git-fixes).
• ALSA: hda/hdmi: always check pin power status in i915 pin fixup (git-fixes).
• ALSA: hda/realtek - Add new codec supported for ALC897 (git-fixes).
• ALSA: hda/realtek - Couldn't detect Mic if booting with headset plugged (git-fixes).
• ALSA: hda/realtek - Enable headset mic of ASUS Q524UQK with ALC255 (git-fixes).
• ALSA: hda/realtek: Add mute LED quirk to yet another HP x360 model (git-fixes).
• ALSA: hda/realtek: Add some Clove SSID in the ALC293(ALC1220) (git-fixes).
• ALSA: hda/realtek: Enable front panel headset LED on Lenovo ThinkStation P520 (git-fixes).
• ALSA: hda/realtek: Enable headset of ASUS UX482EG & B9400CEA with ALC294 (git-fixes).
• ALSA: hda: Add NVIDIA codec IDs 9a & 9d through a0 to patch table (git-fixes).
• ALSA: hda: Fix potential race in unsol event handler (git-fixes).
• ALSA: hda: Fix regressions on clear and reconfig sysfs (git-fixes).
• ALSA: info: Drop WARN_ON() from buffer NULL sanity check (git-fixes).
• ALSA: isa/wavefront: prevent out of bounds write in ioctl (git-fixes).
• ALSA: line6: Perform sanity check for each URB creation (git-fixes).
• ALSA: pcm: oss: Fix a few more UBSAN fixes (git-fixes).
• ALSA: pcm: oss: Fix potential out-of-bounds shift (git-fixes).
• ALSA: pcm: oss: Remove superfluous WARN_ON() for mulaw sanity check (git-fixes).
• ALSA: timer: Limit max…

Timothy Michaud discovered that the i915 graphics driver in the Linux kernel did not properly validate user memory locations for the i915_gem_execbuffer2_ioctl. A local attacker could possibly use this to cause a denial of service or execute arbitrary code. (CVE-2018-20669)

It was discovered that the Kvaser CAN/USB driver in the Linux kernel did not properly initialize memory in certain situations. A local attacker could possibly use this to expose sensitive information (kernel memory). (CVE-2019-19947)

Chuhong Yuan discovered that go7007 USB audio device driver in the Linux kernel did not properly deallocate memory in some failure conditions. A physically proximate attacker could use this to cause a denial of service (memory exhaustion). (CVE-2019-20810)

It was discovered that the elf handling code in the Linux kernel did not initialize memory before using it in certain situations. A local attacker could use this to possibly expose sensitive information (kernel memory). (CVE-2020-10732)

It was discovered that the Linux kernel did not correctly apply Speculative Store Bypass Disable (SSBD) mitigations in certain situations. A local attacker could possibly use this to expose sensitive information. (CVE-2020-10766)

It was discovered that the Linux kernel did not correctly apply Indirect Branch Predictor Barrier (IBPB) mitigations in certain situations. A local attacker could possibly use this to expose sensitive information. (CVE-2020-10767)

It was discovered that the Linux kernel could incorrectly enable Indirect Branch Speculation after it has been disabled for a process via a prctl() call. A local attacker could possibly use this to expose sensitive information. (CVE-2020-10768)

Luca Bruno discovered that the zram module in the Linux kernel did not properly restrict unprivileged users from accessing the hot_add sysfs file. A local attacker could use this to cause a denial of service (memory exhaustion). (CVE-2020-10781)

It was discovered that the XFS file system implementation in the Linux kernel did not properly validate meta data in some circumstances. An attacker could use this to construct a malicious XFS image that, when mounted, could cause a denial of service. (CVE-2020-12655)

It was discovered that the bcache subsystem in the Linux kernel did not properly release a lock in some error conditions. A local attacker could possibly use this to cause a denial of service. (CVE-2020-12771)

It was discovered that the Virtual Terminal keyboard driver in the Linux kernel contained an integer overflow. A local attacker could possibly use this to have an unspecified impact. (CVE-2020-13974)

Kyungtae Kim discovered that the USB testing driver in the Linux kernel did not properly deallocate memory on disconnect events. A physically proximate attacker could use this to cause a denial of service (memory exhaustion). (CVE-2020-15393)

It was discovered that the NFS server implementation in the Linux kernel did not properly honor umask settings when setting permissions while creating file system objects if the underlying file system did not support ACLs. An attacker could possibly use this to expose sensitive information or violate system integrity. (CVE-2020-24394)

It was discovered that the Kerberos SUNRPC GSS implementation in the Linux kernel did not properly deallocate memory on module unload. A local privileged attacker could possibly use this to cause a denial of service (memory exhaustion). (CVE-2020-12656)