CVE-2020-28915

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: buffer overflow in IPsec ESP transformation code (CVE-2022-27666)

• kernel: out-of-bounds read in fbcon_get_font function (CVE-2020-28915)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• weird port mapping with asymmetric traffic (BZ#2065266)

• HBR3 is malfunction via MST HUB against Intel ADL-HX CPU (BZ#2066644)

• openvswitch connection tracking sends incorrect flow key for some upcalls (BZ#2068476)

• sctp connection abort unexpected. (BZ#2070959)

• soft quota cannot exceed more the 5 warns which breaks timer functionality (BZ#2071713)

• VirtIO Throughput for VM on host with OVS HW-Offload is very low (BZ#2074221)

• SR-IOV performance > 50% degradation (BZ#2074829)

• Call trace with parallel rules insertion and deletion (BZ#2075553)

• Enable nested virtualization (BZ#2079069)

• iscsi_ttx (iSERT) completions hung while waiting for mlx5_ib_drain_sq (BZ#2079433)

• WARNING: CPU: 2 PID: 969 at kernel/locking/lockdep.c:895 register_lock_class+0x234/0x1640 (BZ#2079856)

• mlx5: Some rule are not offloaded to HW in OVN K8s Pod 2 External use case (BZ#2079918)

• OCP node kernel crash due to ceph_fsync - unsafe_request_wait+0x143 (BZ#2080071)

• TCP doesn't retransmit if in reorder state and waits for RTO (BZ#2080972)

• pnfs NFSv4.1 IO causes a soft lockup (after a server reboot) and an unresponsive client (BZ#2080998)

• BlueField2: DPU can't switch to switchdev mode (BZ#2081011)

• Important ice bug fixes (BZ#2081794)

• For isolated CPUs (with nohz_full enabled for isolated CPUs) CPU utilization statistics are not getting reflected continuously (BZ#2084138)

• Host is getting crash/abrupt reboot while the guest has been assigned with more than 128 GB RAM while it is using NVIDIA proprietary module. (BZ#2085572)

• s_pf0vf2: hw csum failure for mlx5 (BZ#2086549)

• kernel memory leak while freeing nested actions (BZ#2086590)

• Regression: Bluetooth will not activate after 8.5 update (BZ#2087641)

• mlx5,Internal port - traffic not offloaded on tunnel interface rules on chain > 0 when internal port is the vtep device. (BZ#2088610)

• rule not offloaded on server side with syndrome(0x389e56) when direction is in (BZ#2088611)

• TTL decrease only on the first packet (BZ#2088638)

• TC HWOL of inbound traffic over geneve with ovs bridge as VTEP is not working (BZ#2088639)

• Audio No Function on Orchid Bay(Mini Config) (BZ#2090423)

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: buffer overflow in IPsec ESP transformation code (CVE-2022-27666)

• kernel: out-of-bounds read in fbcon_get_font function (CVE-2020-28915)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• kernel-rt: update RT source tree to the latest Rocky Linux-8.6.z0 Batch (BZ#2081704)

A buffer over-read (at the framebuffer layer) in the fbcon code in the Linux kernel before 5.8.15 could be used by local attackers to read kernel memory, aka CID-6735b4632def.

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es):

• kernel: buffer overflow in IPsec ESP transformation code (CVE-2022-27666)
• kernel: out-of-bounds read in fbcon_get_font function (CVE-2020-28915) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es):
• weird port mapping with asymmetric traffic (BZ#2065266)
• HBR3 is malfunction via MST HUB against Intel ADL-HX CPU (BZ#2066644)
• openvswitch connection tracking sends incorrect flow key for some upcalls (BZ#2068476)
• sctp connection abort unexpected. (BZ#2070959)
• soft quota cannot exceed more the 5 warns which breaks timer functionality (BZ#2071713)
• VirtIO Throughput for VM on host with OVS HW-Offload is very low (BZ#2074221)
• SR-IOV performance > 50% degradation (BZ#2074829)
• Call trace with parallel rules insertion and deletion (BZ#2075553)
• Enable nested virtualization (BZ#2079069)
• iscsi_ttx (iSERT) completions hung while waiting for mlx5_ib_drain_sq (BZ#2079433)
• WARNING: CPU: 2 PID: 969 at kernel/locking/lockdep.c:895 register_lock_class+0x234/0x1640 (BZ#2079856)
• mlx5: Some rule are not offloaded to HW in OVN K8s Pod 2 External use case (BZ#2079918)
• OCP node kernel crash due to ceph_fsync - unsafe_request_wait+0x143 (BZ#2080071)
• TCP doesn't retransmit if in reorder state and waits for RTO (BZ#2080972)
• pnfs NFSv4.1 IO causes a soft lockup (after a server reboot) and an unresponsive client (BZ#2080998)
• BlueField2: DPU can't switch to switchdev mode (BZ#2081011)
• Important ice bug fixes (BZ#2081794)
• For isolated CPUs (with nohz_full enabled for isolated CPUs) CPU utilization statistics are not getting reflected continuously (BZ#2084138)
• Host is getting crash/abrupt reboot while the guest has been assigned with more than 128 GB RAM while it is using NVIDIA proprietary module. (BZ#2085572)
• s_pf0vf2: hw csum failure for mlx5 (BZ#2086549)
• kernel memory leak while freeing nested actions (BZ#2086590)
• Regression: Bluetooth will not activate after 8.5 update (BZ#2087641)
• mlx5,Internal port - traffic not offloaded on tunnel interface rules on chain > 0 when internal port is the vtep device. (BZ#2088610)
• rule not offloaded on server side with syndrome(0x389e56) when direction is in (BZ#2088611)
• TTL decrease only on the first packet (BZ#2088638)
• TC HWOL of inbound traffic over geneve with ovs bridge as VTEP is not working (BZ#2088639)
• Audio No Function on Orchid Bay(Mini Config) (BZ#2090423)

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es):

• kernel: buffer overflow in IPsec ESP transformation code (CVE-2022-27666)
• kernel: out-of-bounds read in fbcon_get_font function (CVE-2020-28915) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es):
• kernel-rt: update RT source tree to the latest AlmaLinux-8.6.z0 Batch (BZ#2081704)

This update provides an upgrade to the new upstream 5.10 longterm branch, currently based on 5.10.6, adding new features and new and improved hardware support.

This update also fixes at least the following security issues:

In binder_release_work of binder.c, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation (CVE-2020-0423).

In various methods of hid-multitouch.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation (CVE-2020-0465).

Insufficient access control in the Linux kernel driver for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access (CVE-2020-8694).

A potential vulnerability in the AMD extension to Linux "hwmon" service may allow an attacker to use the Linux-based Running Average Power Limit (RAPL) interface to show various side channel attacks. In line with industry partners, AMD has updated the RAPL interface to require privileged access (CVE-2020-12912).

A use-after-free memory flaw was found in the perf subsystem allowing a local attacker with permission to monitor perf events to corrupt memory and possibly escalate privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability (CVE-2020-14351).

A use-after-free was found in the way the console subsystem was using ioctls KDGKBSENT and KDSKBSENT. A local user could use this flaw to get read memory access out of bounds. The highest threat from this vulnerability is to data confidentiality (CVE-2020-25656).

Linux kernel concurrency use-after-free in vt (CVE-2020-25668).

Linux Kernel use-after-free in sunkbd_reinit (CVE-2020-25669).

A flaw memory leak in the Linux kernel performance monitoring subsystem was found in the way if using PERF_EVENT_IOC_SET_FILTER. A local user could use this flaw to starve the resources causing denial of service (CVE-2020-25704).

A flaw in the way reply ICMP packets are limited in the Linux kernel functionality was found that allows to quickly scan open UDP ports. This flaw allows an off-path remote user to effectively bypassing source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software that relies on UDP source port randomization are indirectly affected as well (CVE-2020-25705).

An issue was discovered in ioapic_lazy_update_eoi in arch/x86/kvm/ioapic.c in the Linux kernel before 5.9.2. It has an infinite loop related to improper interaction between a resampler and edge triggering (CVE-2020-27152).

An issue was discovered in the Linux kernel before 5.8.15. scalar32_min_max_or in kernel/bpf/verifier.c mishandles bounds tracking during use of 64-bit values (CVE-2020-27194).

An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x. Guest OS users can cause a denial of service (host OS hang) via a high rate of events to dom0 (CVE-2020-27673).

An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x. drivers/xen/events/events_base.c allows event-channel removal during the event-handling loop (a race condition). This can cause a use-after-free or NULL pointer dereference, as demonstrated by a dom0 crash via events for an in-reconfiguration paravirtualized device (CVE-2020-27675).

A use-after-free flaw was found in kernel/trace/ring_buffer.c in Linux kernel (before 5.10-rc1). There was a race problem in trace_open and resize of cpu buffer running parallely on different cpus, may cause a denial of service problem (DOS). This flaw could even allow a local attacker with special user privilege to a kernel information leak threat…

This update provides an upgrade to the new upstream 5.10 longterm branch, currently based on 5.10.6, adding new features and new and improved hardware support.

This update also fixes at least the following security issues:

In binder_release_work of binder.c, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation (CVE-2020-0423).

In various methods of hid-multitouch.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation (CVE-2020-0465).

Insufficient access control in the Linux kernel driver for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access (CVE-2020-8694).

A potential vulnerability in the AMD extension to Linux "hwmon" service may allow an attacker to use the Linux-based Running Average Power Limit (RAPL) interface to show various side channel attacks. In line with industry partners, AMD has updated the RAPL interface to require privileged access (CVE-2020-12912).

A use-after-free memory flaw was found in the perf subsystem allowing a local attacker with permission to monitor perf events to corrupt memory and possibly escalate privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability (CVE-2020-14351).

A use-after-free was found in the way the console subsystem was using ioctls KDGKBSENT and KDSKBSENT. A local user could use this flaw to get read memory access out of bounds. The highest threat from this vulnerability is to data confidentiality (CVE-2020-25656).

Linux kernel concurrency use-after-free in vt (CVE-2020-25668).

Linux Kernel use-after-free in sunkbd_reinit (CVE-2020-25669).

A flaw memory leak in the Linux kernel performance monitoring subsystem was found in the way if using PERF_EVENT_IOC_SET_FILTER. A local user could use this flaw to starve the resources causing denial of service (CVE-2020-25704).

A flaw in the way reply ICMP packets are limited in the Linux kernel functionality was found that allows to quickly scan open UDP ports. This flaw allows an off-path remote user to effectively bypassing source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software that relies on UDP source port randomization are indirectly affected as well (CVE-2020-25705).

An issue was discovered in ioapic_lazy_update_eoi in arch/x86/kvm/ioapic.c in the Linux kernel before 5.9.2. It has an infinite loop related to improper interaction between a resampler and edge triggering (CVE-2020-27152).

An issue was discovered in the Linux kernel before 5.8.15. scalar32_min_max_or in kernel/bpf/verifier.c mishandles bounds tracking during use of 64-bit values (CVE-2020-27194).

An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x. Guest OS users can cause a denial of service (host OS hang) via a high rate of events to dom0 (CVE-2020-27673).

An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x. drivers/xen/events/events_base.c allows event-channel removal during the event-handling loop (a race condition). This can cause a use-after-free or NULL pointer dereference, as demonstrated by a dom0 crash via events for an in-reconfiguration paravirtualized device (CVE-2020-27675).

A use-after-free flaw was found in kernel/trace/ring_buffer.c in Linux kernel (before 5.10-rc1). There was a race problem in trace_open and resize of cpu buffer running parallely on different cpus, may cause a denial of service problem (DOS). This flaw could even allow a local attacker with special user privilege to a kernel information leak threat…

The openSUSE Leap 15.1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-28915: A buffer over-read (at the framebuffer layer) in the fbcon code could be used by local attackers to read kernel memory, aka CID-6735b4632def (bnc#1178886).
• CVE-2020-25669: A use-after-free in teardown paths of sunkbd was fixed (bsc#1178182).
• CVE-2020-25705: A flaw in the way reply ICMP packets are limited in the Linux kernel functionality was found that allowed to quickly scan open UDP ports. This flaw allowed an off-path remote user to effectively bypassing source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software that relies on UDP source port randomization are indirectly affected as well. Kernel versions may be vulnerable to this issue (bnc#1175721 bnc#1178782).
• CVE-2020-25704: A a memory leak in perf_event_parse_addr_filter() was foxed (bsc#1178393, CVE-2020-25704).

The following non-security bugs were fixed:

• ACPI: NFIT: Fix comparison to '-ENXIO' (git-fixes).
• bpf: Zero-fill re-used per-cpu map element (git-fixes).
• can: af_can: prevent potential access of uninitialized member in canfd_rcv() (git-fixes).
• can: af_can: prevent potential access of uninitialized member in can_rcv() (git-fixes).
• can: dev: can_restart(): post buffer from the right context (git-fixes).
• can: m_can: m_can_handle_state_change(): fix state change (git-fixes).
• can: m_can: m_can_stop(): set device to software init mode before closing (git-fixes).
• can: mcba_usb: mcba_usb_start_xmit(): first fill skb, then pass to can_put_echo_skb() (git-fixes).
• can: peak_usb: fix potential integer overflow on shift of a int (git-fixes).
• docs: ABI: sysfs-c2port: remove a duplicated entry (git-fixes).
• drbd: code cleanup by using sendpage_ok() to check page for kernel_sendpage() (bsc#1172873).
• drm/i915: Break up error capture compression loops with cond_resched() (git-fixes).
• drm/vc4: drv: Add error handding for bind (git-fixes).
• Drop sysctl files for dropped archs, add ppc64le and arm64 (bsc#1178838). Also fix the ppc64 page size.
• fs/proc/array.c: allow reporting eip/esp for all coredumping threads (bsc#1050549).
• ftrace: Fix recursion check for NMI test (git-fixes).
• ftrace: Handle tracing when switching between context (git-fixes).
• futex: Do not enable IRQs unconditionally in put_pi_state() (bsc#1067665).
• futex: Handle transient 'ownerless' rtmutex state correctly (bsc#1067665).
• hv_netvsc: Add XDP support (bsc#1177819, bsc#1177820).
• hv_netvsc: deal with bpf API differences in 4.12 (bsc#1177819, bsc#1177820).
• hv_netvsc: Fix XDP refcnt for synthetic and VF NICs (bsc#1177819, bsc#1177820).
• hv_netvsc: make recording RSS hash depend on feature flag (bsc#1178853, bsc#1178854).
• hv_netvsc: record hardware hash in skb (bsc#1178853, bsc#1178854).
• hyperv_fb: Update screen_info after removing old framebuffer (bsc#1175306).
• inet_diag: Fix error path to cancel the meseage in inet_req_diag_fill() (git-fixes).
• Input: adxl34x - clean up a data type in adxl34x_probe() (git-fixes).
• kthread_worker: prevent queuing delayed work from timer_fn when it is being canceled (git-fixes).
• libceph: use sendpage_ok() in ceph_tcp_sendpage() (bsc#1172873).
• locking/lockdep: Add debug_locks check in __lock_downgrade() (bsc#1050549).
• locking/percpu-rwsem: Use this_cpu_{inc,dec}() for read_count (bsc#1050549).
• locktorture: Print ratio of acquisitions, not failures (bsc#1050549).
• mac80211: minstrel: fix tx status processing corner case (git-fixes).
• mac80211: minstrel: remove deferred sampling code (git-fixes).
• memcg: fix NULL pointer dereference in __mem_cgroup_usage_unregister_event (bsc#1177703).
• mmc: sdhci-of-esdhc: Handle pulse width detection erratum for more SoCs (git-fixes).
• mm/memcg: fix refcount error while moving and swapping (bsc#1178686).
• net: add WARN_ONCE in kernel_sendpage() for improper…

The openSUSE Leap 15.2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-29369: There was a race condition between certain expand functions (expand_downwards and expand_upwards) and page-table free operations from an munmap call, aka CID-246c320a8cfe (bnc#1173504 bnc#1179432).
• CVE-2020-29371: An issue was discovered in romfs_dev_read in fs/romfs/storage.c, where uninitialized memory could leak to userspace, aka CID-bcf85fcedfdd (bnc#1179429).
• CVE-2020-15436: Use-after-free vulnerability in fs/block_dev.c allowed local users to gain privileges or cause a denial of service by leveraging improper access to a certain error field (bnc#1179141).
• CVE-2020-25705: A flaw in the way reply ICMP packets are limited was found that allowed to quickly scan open UDP ports. This flaw allowed an off-path remote user to effectively bypassing source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software that relies on UDP source port randomization are indirectly affected as well. Kernel versions may be vulnerable to this issue (bnc#1175721 bnc#1178782).
• CVE-2020-15437: The Linux kernel was vulnerable to a NULL pointer dereference in drivers/tty/serial/8250/8250_core.c:serial8250_isa_init_ports() that allowed local users to cause a denial of service by using the p->serial_in pointer which uninitialized (bnc#1179140).
• CVE-2020-27777: Restricted RTAS requests from userspace (bsc#1179107).
• CVE-2020-28974: A slab-out-of-bounds read in fbcon could be used by local attackers to read privileged information or potentially crash the kernel, aka CID-3c4e0dff2095. This occurs because KD_FONT_OP_COPY in drivers/tty/vt/vt.c can be used for manipulations such as font height (bnc#1178589).
• CVE-2020-4788: IBM Power9 (AIX 7.1, 7.2, and VIOS 3.1) processors could allow a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances. IBM X-Force ID: 189296 (bnc#1177666).
• CVE-2020-28941: Local attackers on systems with the speakup driver could cause a local denial of service attack, aka CID-d41227544427. This occurs because of an invalid free when the line discipline is used more than once (bnc#1178740).
• CVE-2020-28915: A buffer over-read (at the framebuffer layer) in the fbcon code could be used by local attackers to read kernel memory, aka CID-6735b4632def (bnc#1178886).
• CVE-2020-25669: Avoid a use-after-free in teardown paths in sunkbd (bsc#1178182).

The following non-security bugs were fixed:

• 9P: Cast to loff_t before multiplying (git-fixes).
• ACPI: GED: fix -Wformat (git-fixes).
• ACPI: NFIT: Fix comparison to '-ENXIO' (git-fixes).
• ACPI: button: Add DMI quirk for Medion Akoya E2228T (git-fixes).
• ACPI: dock: fix enum-conversion warning (git-fixes).
• ACPICA: Add NHLT table signature (bsc#1176200).
• ALSA: ctl: fix error path at adding user-defined element set (git-fixes).
• ALSA: firewire: Clean up a locking issue in copy_resp_to_buf() (git-fixes).
• ALSA: hda/realtek - Add supported for Lenovo ThinkPad Headset Button (git-fixes).
• ALSA: hda/realtek - Add supported mute Led for HP (git-fixes).
• ALSA: hda/realtek - HP Headset Mic can't detect after boot (git-fixes).
• ALSA: hda/realtek: Add some Clove SSID in the ALC293(ALC1220) (git-fixes).
• ALSA: hda: Reinstate runtime_allow() for all hda controllers (git-fixes).
• ALSA: hda: fix jack detection with Realtek codecs when in D3 (git-fixes).
• ALSA: mixart: Fix mutex deadlock (git-fixes).
• ALSA: usb-audio: Add delay quirk for all Logitech USB devices (git-fixes).
• ASoC: qcom: lpass-platform: Fix memory leak (git-fixes).
• Add bug reference to two hv_netvsc patches (bsc#1178853).
• Convert trailing spaces and periods in path components (bsc#1179424).
• Documentation/admin-guide/module-signing.rst: add openssl command option example for CodeSign EKU (bsc#1177353, bsc#1179076).
• Drop sysctl files for…

The SUSE Linux Enterprise 15 SP2 kernel was updated to 3.12.31 to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-15436: Fixed a use after free vulnerability in fs/block_dev.c which could have allowed local users to gain privileges or cause a denial of service (bsc#1179141).
• CVE-2020-15437: Fixed a null pointer dereference which could have allowed local users to cause a denial of service(bsc#1179140).
• CVE-2020-25668: Fixed a concurrency use-after-free in con_font_op (bsc#1178123).
• CVE-2020-25669: Fixed a use-after-free read in sunkbd_reinit() (bsc#1178182).
• CVE-2020-25704: Fixed a leak in perf_event_parse_addr_filter() (bsc#1178393).
• CVE-2020-27777: Restrict RTAS requests from userspace (bsc#1179107)
• CVE-2020-28915: Fixed a buffer over-read in the fbcon code which could have been used by local attackers to read kernel memory (bsc#1178886).
• CVE-2020-28974: Fixed a slab-out-of-bounds read in fbcon which could have been used by local attackers to read privileged information or potentially crash the kernel (bsc#1178589).
• CVE-2020-29371: Fixed uninitialized memory leaks to userspace (bsc#1179429).
• CVE-2020-25705: Fixed an issue which could have allowed to quickly scan open UDP ports. This flaw allowed an off-path remote user to effectively bypassing source port UDP randomization (bsc#1175721).
• CVE-2020-28941: Fixed an issue where local attackers on systems with the speakup driver could cause a local denial of service attack (bsc#1178740).
• CVE-2020-4788: Fixed an issue with IBM Power9 processors could have allowed a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances (bsc#1177666).
• CVE-2020-29369: Fixed a race condition between certain expand functions (expand_downwards and expand_upwards) and page-table free operations from an munmap call, aka CID-246c320a8cfe (bnc#1173504 1179432).

The following non-security bugs were fixed:

• 9P: Cast to loff_t before multiplying (git-fixes).
• ACPI: button: Add DMI quirk for Medion Akoya E2228T (git-fixes).
• ACPICA: Add NHLT table signature (bsc#1176200).
• ACPI: dock: fix enum-conversion warning (git-fixes).
• ACPI / extlog: Check for RDMSR failure (git-fixes).
• ACPI: GED: fix -Wformat (git-fixes).
• ACPI: NFIT: Fix comparison to '-ENXIO' (git-fixes).
• ACPI: video: use ACPI backlight for HP 635 Notebook (git-fixes).
• Add bug reference to two hv_netvsc patches (bsc#1178853).
• ALSA: ctl: fix error path at adding user-defined element set (git-fixes).
• ALSA: firewire: Clean up a locking issue in copy_resp_to_buf() (git-fixes).
• ALSA: fix kernel-doc markups (git-fixes).
• ALSA: hda: fix jack detection with Realtek codecs when in D3 (git-fixes).
• ALSA: hda: prevent undefined shift in snd_hdac_ext_bus_get_link() (git-fixes).
• ALSA: hda/realtek: Add some Clove SSID in the ALC293(ALC1220) (git-fixes).
• ALSA: hda/realtek - Add supported for Lenovo ThinkPad Headset Button (git-fixes).
• ALSA: hda/realtek - Add supported mute Led for HP (git-fixes).
• ALSA: hda/realtek - Enable headphone for ASUS TM420 (git-fixes).
• ALSA: hda/realtek - Fixed HP headset Mic can't be detected (git-fixes).
• ALSA: hda/realtek - HP Headset Mic can't detect after boot (git-fixes).
• ALSA: hda: Reinstate runtime_allow() for all hda controllers (git-fixes).
• ALSA: mixart: Fix mutex deadlock (git-fixes).
• ALSA: usb-audio: Add delay quirk for all Logitech USB devices (git-fixes).
• ALSA: usb-audio: Add implicit feedback quirk for MODX (git-fixes).
• ALSA: usb-audio: Add implicit feedback quirk for Qu-16 (git-fixes).
• ALSA: usb-audio: Add implicit feedback quirk for Zoom UAC-2 (git-fixes).
• ALSA: usb-audio: add usb vendor id as DSD-capable for Khadas devices (git-fixes).
• arm64: bpf: Fix branch offset in JIT (git-fixes).
• arm64: dts: allwinner: a64: bananapi-m64: Enable RGMII RX/TX delay on PHY (git-fixes).
• arm64: dts: allwinner: a64: OrangePi Win: Fix ethernet node (git-fixes).
• arm64:…

This update syncs the RT kernel from the SUSE Linux Enterprise 15-SP2 codestream.

This update was imported from the SUSE:SLE-15-SP2:Update update project.

The SUSE Linux Enterprise 15 SP2 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-15436: Fixed a use after free vulnerability in fs/block_dev.c which could have allowed local users to gain privileges or cause a denial of service (bsc#1179141).
• CVE-2020-15437: Fixed a null pointer dereference which could have allowed local users to cause a denial of service(bsc#1179140).
• CVE-2020-25668: Fixed a concurrency use-after-free in con_font_op (bsc#1178123).
• CVE-2020-25669: Fixed a use-after-free read in sunkbd_reinit() (bsc#1178182).
• CVE-2020-25704: Fixed a leak in perf_event_parse_addr_filter() (bsc#1178393).
• CVE-2020-27777: Restrict RTAS requests from userspace (bsc#1179107)
• CVE-2020-28915: Fixed a buffer over-read in the fbcon code which could have been used by local attackers to read kernel memory (bsc#1178886).
• CVE-2020-28941: Fixed an issue where local attackers on systems with the speakup driver could cause a local denial of service attack (bsc#1178740).
• CVE-2020-28974: Fixed a slab-out-of-bounds read in fbcon which could have been used by local attackers to read privileged information or potentially crash the kernel (bsc#1178589).
• CVE-2020-29371: Fixed uninitialized memory leaks to userspace (bsc#1179429).
• CVE-2020-4788: Fixed an issue with IBM Power9 processors could have allowed a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances (bsc#1177666).
• CVE-2020-8694, CVE-2020-8695: Fixed an insufficient access control in the Linux kernel driver for some Intel(R) Processors which might have allowed an authenticated user to potentially enable information disclosure via local access (bsc#1170415 bsc#1170446)
• CVE-2020-28368: Fixed Intel RAPL sidechannel attack aka PLATYPUS attack (XSA-351 bsc#1178591).
• CVE-2020-29369: Fixed a race condition between certain expand functions (expand_downwards and expand_upwards) and page-table free operations from an munmap call, aka CID-246c320a8cfe (bnc#1173504 bsc#1179432).

The following non-security bugs were fixed:

• 9P: Cast to loff_t before multiplying (git-fixes).
• ACPI: button: Add DMI quirk for Medion Akoya E2228T (git-fixes).
• ACPICA: Add NHLT table signature (bsc#1176200).
• ACPI: dock: fix enum-conversion warning (git-fixes).
• ACPI / extlog: Check for RDMSR failure (git-fixes).
• ACPI: GED: fix -Wformat (git-fixes).
• ACPI: NFIT: Fix comparison to '-ENXIO' (git-fixes).
• ACPI: video: use ACPI backlight for HP 635 Notebook (git-fixes).
• Add bug reference to two hv_netvsc patches (bsc#1178853).
• ALSA: ctl: fix error path at adding user-defined element set (git-fixes).
• ALSA: firewire: Clean up a locking issue in copy_resp_to_buf() (git-fixes).
• ALSA: fix kernel-doc markups (git-fixes).
• ALSA: hda: fix jack detection with Realtek codecs when in D3 (git-fixes).
• ALSA: hda: prevent undefined shift in snd_hdac_ext_bus_get_link() (git-fixes).
• ALSA: hda/realtek: Add some Clove SSID in the ALC293(ALC1220) (git-fixes).
• ALSA: hda/realtek - Add supported for Lenovo ThinkPad Headset Button (git-fixes).
• ALSA: hda/realtek - Add supported mute Led for HP (git-fixes).
• ALSA: hda/realtek - Enable headphone for ASUS TM420 (git-fixes).
• ALSA: hda/realtek - Fixed HP headset Mic can't be detected (git-fixes).
• ALSA: hda/realtek - HP Headset Mic can't detect after boot (git-fixes).
• ALSA: hda: Reinstate runtime_allow() for all hda controllers (git-fixes).
• ALSA: mixart: Fix mutex deadlock (git-fixes).
• ALSA: usb-audio: Add delay quirk for all Logitech USB devices (git-fixes).
• ALSA: usb-audio: Add implicit feedback quirk for MODX (git-fixes).
• ALSA: usb-audio: Add implicit feedback quirk for Qu-16 (git-fixes).
• ALSA: usb-audio: Add implicit feedback quirk for Zoom UAC-2 (git-fixes).
• ALSA: usb-audio: add usb vendor id as DSD-capable for Khadas devices (git-fixes).
• arm64: bpf: Fix branch offset in JIT (git-fixes).
• arm64: dts:…

The SUSE Linux Enterprise 15 SP1 Azure kernel was updated receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-15437: Fixed a null pointer dereference which could have allowed local users to cause a denial of service(bsc#1179140).
• CVE-2020-27777: Restrict RTAS requests from userspace (bsc#1179107).
• CVE-2020-28974: Fixed a slab-out-of-bounds read in fbcon which could have been used by local attackers to read privileged information or potentially crash the kernel (bsc#1178589).
• CVE-2020-28915: Fixed a buffer over-read in the fbcon code which could have been used by local attackers to read kernel memory (bsc#1178886).

The following non-security bugs were fixed:

• ACPI: GED: fix -Wformat (git-fixes).
• ALSA: ctl: fix error path at adding user-defined element set (git-fixes).
• ALSA: firewire: Clean up a locking issue in copy_resp_to_buf() (git-fixes).
• ALSA: mixart: Fix mutex deadlock (git-fixes).
• arm64: KVM: Fix system register enumeration (bsc#1174726).
• arm/arm64: KVM: Add PSCI version selection API (bsc#1174726).
• ASoC: qcom: lpass-platform: Fix memory leak (git-fixes).
• ath10k: Acquire tx_lock in tx error paths (git-fixes).
• batman-adv: set .owner to THIS_MODULE (git-fixes).
• Bluetooth: btusb: Fix and detect most of the Chinese Bluetooth controllers (git-fixes).
• Bluetooth: hci_bcm: fix freeing not-requested IRQ (git-fixes).
• btrfs: account ticket size at add/delete time (bsc#1178897).
• btrfs: add helper to obtain number of devices with ongoing dev-replace (bsc#1178897).
• btrfs: check rw_devices, not num_devices for balance (bsc#1178897).
• btrfs: do not delete mismatched root refs (bsc#1178962).
• btrfs: fix btrfs_calc_reclaim_metadata_size calculation (bsc#1178897).
• btrfs: fix force usage in inc_block_group_ro (bsc#1178897).
• btrfs: fix invalid removal of root ref (bsc#1178962).
• btrfs: fix reclaim counter leak of space_info objects (bsc#1178897).
• btrfs: fix reclaim_size counter leak after stealing from global reserve (bsc#1178897).
• btrfs: kill min_allocable_bytes in inc_block_group_ro (bsc#1178897).
• btrfs: rework arguments of btrfs_unlink_subvol (bsc#1178962).
• btrfs: split dev-replace locking helpers for read and write (bsc#1178897).
• can: af_can: prevent potential access of uninitialized member in canfd_rcv() (git-fixes).
• can: af_can: prevent potential access of uninitialized member in can_rcv() (git-fixes).
• can: dev: can_restart(): post buffer from the right context (git-fixes).
• can: gs_usb: fix endianess problem with candleLight firmware (git-fixes).
• can: m_can: fix nominal bitiming tseg2 min for version >= 3.1 (git-fixes).
• can: m_can: m_can_handle_state_change(): fix state change (git-fixes).
• can: m_can: m_can_stop(): set device to software init mode before closing (git-fixes).
• can: mcba_usb: mcba_usb_start_xmit(): first fill skb, then pass to can_put_echo_skb() (git-fixes).
• can: peak_usb: fix potential integer overflow on shift of a int (git-fixes).
• ceph: add check_session_state() helper and make it global (bsc#1179259).
• ceph: check session state after bumping session->s_seq (bsc#1179259).
• ceph: fix race in concurrent __ceph_remove_cap invocations (bsc#1178635).
• cifs: Fix incomplete memory allocation on setxattr path (bsc#1179211).
• cifs: remove bogus debug code (bsc#1179427).
• cifs: Return the error from crypt_message when enc/dec key not found (bsc#1179426).
• Convert trailing spaces and periods in path components (bsc#1179424).
• Drivers: hv: vmbus: Remove the unused 'tsc_page' from struct hv_context (git-fixes).
• drm/sun4i: dw-hdmi: fix error return code in sun8i_dw_hdmi_bind() (git-fixes).
• efi: cper: Fix possible out-of-bounds access (git-fixes).
• efi/efivars: Add missing kobject_put() in sysfs entry creation error path (git-fixes).
• efi/esrt: Fix reference count leak in esre_create_sysfs_entry (git-fixes).
• efi: provide empty efi_enter_virtual_mode implementation (git-fixes).
• efivarfs: fix memory leak in…

The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-15437: Fixed a null pointer dereference which could have allowed local users to cause a denial of service(bsc#1179140).
• CVE-2020-27777: Restrict RTAS requests from userspace (bsc#1179107).
• CVE-2020-28974: Fixed a slab-out-of-bounds read in fbcon which could have been used by local attackers to read privileged information or potentially crash the kernel (bsc#1178589).
• CVE-2020-28915: Fixed a buffer over-read in the fbcon code which could have been used by local attackers to read kernel memory (bsc#1178886).
• CVE-2020-8694: Insufficient access control for some Intel(R) Processors may have allowed an authenticated user to potentially enable information disclosure via local access (bsc#1170415).
• CVE-2020-25668: Fixed a use-after-free in con_font_op() (bsc#1178123).
• CVE-2020-25704: Fixed a memory leak in perf_event_parse_addr_filter() (bsc#1178393).
• CVE-2020-25669: Fixed a use-after-free read in sunkbd_reinit() (bsc#1178182).

The following non-security bugs were fixed:

• 9P: Cast to loff_t before multiplying (git-fixes).
• acpi-cpufreq: Honor _PSD table setting on new AMD CPUs (git-fixes).
• ACPI: debug: do not allow debugging when ACPI is disabled (git-fixes).
• ACPI / extlog: Check for RDMSR failure (git-fixes).
• ACPI: GED: fix -Wformat (git-fixes).
• ACPI: NFIT: Fix comparison to '-ENXIO' (git-fixes).
• ACPI: video: use ACPI backlight for HP 635 Notebook (git-fixes).
• ALSA: ctl: fix error path at adding user-defined element set (git-fixes).
• ALSA: firewire: Clean up a locking issue in copy_resp_to_buf() (git-fixes).
• ALSA: hda - Fix the return value if cb func is already registered (git-fixes).
• ALSA: hda - Fix the return value if cb func is already registered (git-fixes).
• ALSA: hda: prevent undefined shift in snd_hdac_ext_bus_get_link() (git-fixes).
• ALSA: mixart: Fix mutex deadlock (git-fixes).
• ALSA: usb-audio: Fix potential use-after-free of streams (gix-fixes).
• arm64: KVM: Fix system register enumeration (bsc#1174726).
• arm64: Run ARCH_WORKAROUND_1 enabling code on all CPUs (git-fixes).
• arm/arm64: KVM: Add PSCI version selection API (bsc#1174726).
• ASoC: qcom: lpass-platform: Fix memory leak (git-fixes).
• ata: sata_rcar: Fix DMA boundary mask (git-fixes).
• ath10k: Acquire tx_lock in tx error paths (git-fixes).
• ath10k: fix VHT NSS calculation when STBC is enabled (git-fixes).
• ath10k: start recovery process when payload length exceeds max htc length for sdio (git-fixes).
• batman-adv: set .owner to THIS_MODULE (git-fixes).
• Bluetooth: btusb: Fix and detect most of the Chinese Bluetooth controllers (git-fixes).
• Bluetooth: hci_bcm: fix freeing not-requested IRQ (git-fixes).
• bpf: Zero-fill re-used per-cpu map element (git-fixes).
• btrfs: account ticket size at add/delete time (bsc#1178897).
• btrfs: add helper to obtain number of devices with ongoing dev-replace (bsc#1178897).
• btrfs: check rw_devices, not num_devices for balance (bsc#1178897).
• btrfs: do not delete mismatched root refs (bsc#1178962).
• btrfs: fix btrfs_calc_reclaim_metadata_size calculation (bsc#1178897).
• btrfs: fix force usage in inc_block_group_ro (bsc#1178897).
• btrfs: fix invalid removal of root ref (bsc#1178962).
• btrfs: fix reclaim counter leak of space_info objects (bsc#1178897).
• btrfs: fix reclaim_size counter leak after stealing from global reserve (bsc#1178897).
• btrfs: kill min_allocable_bytes in inc_block_group_ro (bsc#1178897).
• btrfs: rework arguments of btrfs_unlink_subvol (bsc#1178962).
• btrfs: split dev-replace locking helpers for read and write (bsc#1178897).
• bus/fsl_mc: Do not rely on caller to provide non NULL mc_io (git-fixes).
• can: af_can: prevent potential access of uninitialized member in canfd_rcv() (git-fixes).
• can: af_can: prevent potential access of uninitialized member in can_rcv() (git-fixes).
• can:…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-15436: Fixed a use after free vulnerability in fs/block_dev.c which could have allowed local users to gain privileges or cause a denial of service (bsc#1179141).
• CVE-2020-15437: Fixed a null pointer dereference which could have allowed local users to cause a denial of service(bsc#1179140).
• CVE-2020-25668: Fixed a concurrency use-after-free in con_font_op (bsc#1178123).
• CVE-2020-25669: Fixed a use-after-free read in sunkbd_reinit() (bsc#1178182).
• CVE-2020-25704: Fixed a leak in perf_event_parse_addr_filter() (bsc#1178393).
• CVE-2020-27777: Restrict RTAS requests from userspace (bsc#1179107)
• CVE-2020-28915: Fixed a buffer over-read in the fbcon code which could have been used by local attackers to read kernel memory (bsc#1178886).
• CVE-2020-28974: Fixed a slab-out-of-bounds read in fbcon which could have been used by local attackers to read privileged information or potentially crash the kernel (bsc#1178589).
• CVE-2020-29371: Fixed uninitialized memory leaks to userspace (bsc#1179429).
• CVE-2020-25705: Fixed an issue which could have allowed to quickly scan open UDP ports. This flaw allowed an off-path remote user to effectively bypassing source port UDP randomization (bsc#1175721).

The following non-security bugs were fixed:

• 9P: Cast to loff_t before multiplying (git-fixes).
• ACPI: GED: fix -Wformat (git-fixes).
• ACPI: NFIT: Fix comparison to '-ENXIO' (git-fixes).
• ALSA: ctl: fix error path at adding user-defined element set (git-fixes).
• ALSA: firewire: Clean up a locking issue in copy_resp_to_buf() (git-fixes).
• ALSA: hda - Fix the return value if cb func is already registered (git-fixes).
• ALSA: hda: prevent undefined shift in snd_hdac_ext_bus_get_link() (git-fixes).
• ALSA: mixart: Fix mutex deadlock (git-fixes).
• arm64: KVM: Fix system register enumeration (bsc#1174726).
• arm/arm64: KVM: Add PSCI version selection API (bsc#1174726).
• ASoC: qcom: lpass-platform: Fix memory leak (git-fixes).
• ath10k: Acquire tx_lock in tx error paths (git-fixes).
• batman-adv: set .owner to THIS_MODULE (git-fixes).
• Bluetooth: btusb: Fix and detect most of the Chinese Bluetooth controllers (git-fixes).
• Bluetooth: hci_bcm: fix freeing not-requested IRQ (git-fixes).
• bpf: Zero-fill re-used per-cpu map element (git-fixes).
• btrfs: account ticket size at add/delete time (bsc#1178897).
• btrfs: add helper to obtain number of devices with ongoing dev-replace (bsc#1178897).
• btrfs: check rw_devices, not num_devices for balance (bsc#1178897).
• btrfs: do not delete mismatched root refs (bsc#1178962).
• btrfs: fix btrfs_calc_reclaim_metadata_size calculation (bsc#1178897).
• btrfs: fix force usage in inc_block_group_ro (bsc#1178897).
• btrfs: fix invalid removal of root ref (bsc#1178962).
• btrfs: fix reclaim counter leak of space_info objects (bsc#1178897).
• btrfs: fix reclaim_size counter leak after stealing from global reserve (bsc#1178897).
• btrfs: kill min_allocable_bytes in inc_block_group_ro (bsc#1178897).
• btrfs: rework arguments of btrfs_unlink_subvol (bsc#1178962).
• btrfs: split dev-replace locking helpers for read and write (bsc#1178897).
• can: af_can: prevent potential access of uninitialized member in canfd_rcv() (git-fixes).
• can: af_can: prevent potential access of uninitialized member in can_rcv() (git-fixes).
• can: can_create_echo_skb(): fix echo skb generation: always use skb_clone() (git-fixes).
• can: dev: __can_get_echo_skb(): fix real payload length return value for RTR frames (git-fixes).
• can: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard IRQ context (git-fixes).
• can: dev: can_restart(): post buffer from the right context (git-fixes).
• can: gs_usb: fix endianess problem with candleLight firmware (git-fixes).
• can: m_can: fix nominal bitiming tseg2 min for version >= 3.1 (git-fixes).
• can: m_can:…

The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-15436: Fixed a use after free vulnerability in fs/block_dev.c which could have allowed local users to gain privileges or cause a denial of service (bsc#1179141).
• CVE-2020-15437: Fixed a null pointer dereference which could have allowed local users to cause a denial of service(bsc#1179140).
• CVE-2020-25669: Fixed a use-after-free read in sunkbd_reinit() (bsc#1178182).
• CVE-2020-27777: Restrict RTAS requests from userspace (bsc#1179107).
• CVE-2020-28915: Fixed a buffer over-read in the fbcon code which could have been used by local attackers to read kernel memory (bsc#1178886).
• CVE-2020-28974: Fixed a slab-out-of-bounds read in fbcon which could have been used by local attackers to read privileged information or potentially crash the kernel (bsc#1178589).
• CVE-2020-29371: Fixed uninitialized memory leaks to userspace (bsc#1179429).

The following non-security bugs were fixed:

• ACPI: GED: fix -Wformat (git-fixes).
• ALSA: ctl: fix error path at adding user-defined element set (git-fixes).
• ALSA: firewire: Clean up a locking issue in copy_resp_to_buf() (git-fixes).
• ALSA: mixart: Fix mutex deadlock (git-fixes).
• arm64: KVM: Fix system register enumeration (bsc#1174726).
• arm/arm64: KVM: Add PSCI version selection API (bsc#1174726).
• ASoC: qcom: lpass-platform: Fix memory leak (git-fixes).
• ath10k: Acquire tx_lock in tx error paths (git-fixes).
• batman-adv: set .owner to THIS_MODULE (git-fixes).
• Bluetooth: btusb: Fix and detect most of the Chinese Bluetooth controllers (git-fixes).
• Bluetooth: hci_bcm: fix freeing not-requested IRQ (git-fixes).
• bpf: Zero-fill re-used per-cpu map element (git-fixes).
• btrfs: account ticket size at add/delete time (bsc#1178897).
• btrfs: add helper to obtain number of devices with ongoing dev-replace (bsc#1178897).
• btrfs: check rw_devices, not num_devices for balance (bsc#1178897).
• btrfs: do not delete mismatched root refs (bsc#1178962).
• btrfs: fix btrfs_calc_reclaim_metadata_size calculation (bsc#1178897).
• btrfs: fix force usage in inc_block_group_ro (bsc#1178897).
• btrfs: fix invalid removal of root ref (bsc#1178962).
• btrfs: fix reclaim counter leak of space_info objects (bsc#1178897).
• btrfs: fix reclaim_size counter leak after stealing from global reserve (bsc#1178897).
• btrfs: kill min_allocable_bytes in inc_block_group_ro (bsc#1178897).
• btrfs: rework arguments of btrfs_unlink_subvol (bsc#1178962).
• btrfs: split dev-replace locking helpers for read and write (bsc#1178897).
• can: af_can: prevent potential access of uninitialized member in canfd_rcv() (git-fixes).
• can: af_can: prevent potential access of uninitialized member in can_rcv() (git-fixes).
• can: dev: can_restart(): post buffer from the right context (git-fixes).
• can: gs_usb: fix endianess problem with candleLight firmware (git-fixes).
• can: m_can: fix nominal bitiming tseg2 min for version >= 3.1 (git-fixes).
• can: m_can: m_can_handle_state_change(): fix state change (git-fixes).
• can: m_can: m_can_stop(): set device to software init mode before closing (git-fixes).
• can: mcba_usb: mcba_usb_start_xmit(): first fill skb, then pass to can_put_echo_skb() (git-fixes).
• can: peak_usb: fix potential integer overflow on shift of a int (git-fixes).
• ceph: add check_session_state() helper and make it global (bsc#1179259).
• ceph: check session state after bumping session->s_seq (bsc#1179259).
• ceph: fix race in concurrent __ceph_remove_cap invocations (bsc#1178635).
• cifs: Fix incomplete memory allocation on setxattr path (bsc#1179211).
• cifs: remove bogus debug code (bsc#1179427).
• cifs: Return the error from crypt_message when enc/dec key not found (bsc#1179426).
• Convert trailing spaces and periods in path components (bsc#1179424).
• docs: ABI: stable: remove a duplicated documentation (git-fixes).
• docs: ABI: sysfs-c2port: remove a…

The SUSE Linux Enterprise 15 SP2 kernel was updated to 3.12.31 to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-15436: Fixed a use after free vulnerability in fs/block_dev.c which could have allowed local users to gain privileges or cause a denial of service (bsc#1179141).
• CVE-2020-15437: Fixed a null pointer dereference which could have allowed local users to cause a denial of service(bsc#1179140).
• CVE-2020-25668: Fixed a concurrency use-after-free in con_font_op (bsc#1178123).
• CVE-2020-25669: Fixed a use-after-free read in sunkbd_reinit() (bsc#1178182).
• CVE-2020-25704: Fixed a leak in perf_event_parse_addr_filter() (bsc#1178393).
• CVE-2020-27777: Restrict RTAS requests from userspace (bsc#1179107)
• CVE-2020-28915: Fixed a buffer over-read in the fbcon code which could have been used by local attackers to read kernel memory (bsc#1178886).
• CVE-2020-28974: Fixed a slab-out-of-bounds read in fbcon which could have been used by local attackers to read privileged information or potentially crash the kernel (bsc#1178589).
• CVE-2020-29371: Fixed uninitialized memory leaks to userspace (bsc#1179429).
• CVE-2020-25705: Fixed an issue which could have allowed to quickly scan open UDP ports. This flaw allowed an off-path remote user to effectively bypassing source port UDP randomization (bsc#1175721).
• CVE-2020-28941: Fixed an issue where local attackers on systems with the speakup driver could cause a local denial of service attack (bsc#1178740).
• CVE-2020-4788: Fixed an issue with IBM Power9 processors could have allowed a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances (bsc#1177666).
• CVE-2020-29369: Fixed a race condition between certain expand functions (expand_downwards and expand_upwards) and page-table free operations from an munmap call, aka CID-246c320a8cfe (bnc#1173504 1179432).

The following non-security bugs were fixed:

• 9P: Cast to loff_t before multiplying (git-fixes).
• ACPI: button: Add DMI quirk for Medion Akoya E2228T (git-fixes).
• ACPICA: Add NHLT table signature (bsc#1176200).
• ACPI: dock: fix enum-conversion warning (git-fixes).
• ACPI / extlog: Check for RDMSR failure (git-fixes).
• ACPI: GED: fix -Wformat (git-fixes).
• ACPI: NFIT: Fix comparison to '-ENXIO' (git-fixes).
• ACPI: video: use ACPI backlight for HP 635 Notebook (git-fixes).
• Add bug reference to two hv_netvsc patches (bsc#1178853).
• ALSA: ctl: fix error path at adding user-defined element set (git-fixes).
• ALSA: firewire: Clean up a locking issue in copy_resp_to_buf() (git-fixes).
• ALSA: fix kernel-doc markups (git-fixes).
• ALSA: hda: fix jack detection with Realtek codecs when in D3 (git-fixes).
• ALSA: hda: prevent undefined shift in snd_hdac_ext_bus_get_link() (git-fixes).
• ALSA: hda/realtek: Add some Clove SSID in the ALC293(ALC1220) (git-fixes).
• ALSA: hda/realtek - Add supported for Lenovo ThinkPad Headset Button (git-fixes).
• ALSA: hda/realtek - Add supported mute Led for HP (git-fixes).
• ALSA: hda/realtek - Enable headphone for ASUS TM420 (git-fixes).
• ALSA: hda/realtek - Fixed HP headset Mic can't be detected (git-fixes).
• ALSA: hda/realtek - HP Headset Mic can't detect after boot (git-fixes).
• ALSA: hda: Reinstate runtime_allow() for all hda controllers (git-fixes).
• ALSA: mixart: Fix mutex deadlock (git-fixes).
• ALSA: usb-audio: Add delay quirk for all Logitech USB devices (git-fixes).
• ALSA: usb-audio: Add implicit feedback quirk for MODX (git-fixes).
• ALSA: usb-audio: Add implicit feedback quirk for Qu-16 (git-fixes).
• ALSA: usb-audio: Add implicit feedback quirk for Zoom UAC-2 (git-fixes).
• ALSA: usb-audio: add usb vendor id as DSD-capable for Khadas devices (git-fixes).
• arm64: bpf: Fix branch offset in JIT (git-fixes).
• arm64: dts: allwinner: a64: bananapi-m64: Enable RGMII RX/TX delay on PHY (git-fixes).
• arm64: dts: allwinner: a64: OrangePi Win: Fix ethernet node (git-fixes).
• arm64:…

The SUSE Linux Enterprise 15 SP2 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-15436: Fixed a use after free vulnerability in fs/block_dev.c which could have allowed local users to gain privileges or cause a denial of service (bsc#1179141).
• CVE-2020-15437: Fixed a null pointer dereference which could have allowed local users to cause a denial of service(bsc#1179140).
• CVE-2020-25669: Fixed a use-after-free read in sunkbd_reinit() (bsc#1178182).
• CVE-2020-25705: Fixed A flaw in the way reply ICMP packets are limited in was found that allowed to quickly scan open UDP ports. This flaw allowed an off-path remote user to effectively bypassing source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software and services that rely on UDP source port randomization (like DNS) are indirectly affected as well. Kernel versions may be vulnerable to this issue (bsc#1175721, bsc#1178782).
• CVE-2020-27777: Restrict RTAS requests from userspace (bsc#1179107)
• CVE-2020-27786: Fixed a use after free in kernel midi subsystem snd_rawmidi_kernel_read1() (bsc#1179601).
• CVE-2020-28915: Fixed a buffer over-read in the fbcon code which could have been used by local attackers to read kernel memory (bsc#1178886).
• CVE-2020-28941: Fixed an issue where local attackers on systems with the speakup driver could cause a local denial of service attack (bsc#1178740).
• CVE-2020-29369: Fixed a race condition between certain expand functions (expand_downwards and expand_upwards) and page-table free operations from an munmap call, aka CID-246c320a8cfe (bnc#1173504 bsc#1179432).
• CVE-2020-29371: Fixed uninitialized memory leaks to userspace (bsc#1179429).
• CVE-2020-4788: Fixed an issue with IBM Power9 processors could have allowed a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances (bsc#1177666).

The following non-security bugs were fixed:

• ACPI: APEI: Kick the memory_failure() queue for synchronous errors (jsc#SLE-16610).
• ACPI: button: Add DMI quirk for Medion Akoya E2228T (git-fixes).
• ACPICA: Add NHLT table signature (bsc#1176200).
• Add bug reference to two hv_netvsc patches (bsc#1178853).
• ALSA: ctl: fix error path at adding user-defined element set (git-fixes).
• ALSA: firewire: Clean up a locking issue in copy_resp_to_buf() (git-fixes).
• ALSA: hda: fix jack detection with Realtek codecs when in D3 (git-fixes).
• ALSA: hda/generic: Add option to enforce preferred_dacs pairs (git-fixes).
• ALSA: hda/realtek: Add mute LED quirk to yet another HP x360 model (git-fixes).
• ALSA: hda/realtek - Add new codec supported for ALC897 (git-fixes).
• ALSA: hda/realtek: Add some Clove SSID in the ALC293(ALC1220) (git-fixes).
• ALSA: hda/realtek - Add supported for Lenovo ThinkPad Headset Button (git-fixes).
• ALSA: hda/realtek - Add supported mute Led for HP (git-fixes).
• ALSA: hda/realtek: Enable headset of ASUS UX482EG & B9400CEA with ALC294 (git-fixes).
• ALSA: hda/realtek: Fix bass speaker DAC assignment on Asus Zephyrus G14 (git-fixes).
• ALSA: hda/realtek - Fixed Dell AIO wrong sound tone (git-fixes).
• ALSA: hda/realtek - HP Headset Mic can't detect after boot (git-fixes).
• ALSA: hda: Reinstate runtime_allow() for all hda controllers (git-fixes).
• ALSA: mixart: Fix mutex deadlock (git-fixes).
• ALSA: usb-audio: Add delay quirk for all Logitech USB devices (git-fixes).
• ALSA: usb-audio: Convert to the common vmalloc memalloc (bsc#1178203).
• ALSA: usb-audio: Correct wrongly matching entries with audio class (bsc#1178203).
• ALSA: usb-audio: Move device rename and profile quirks to an internal table (bsc#1178203).
• ALSA: usb-audio: Properly match with audio interface class (bsc#1178203).
• ALSA: usb-audio: Simplify quirk entries with a macro (bsc#1178203).
• ALSA: usb-audio: Support PCM sync_stop (bsc#1178203).
• ALSA: usb-audio: US16x08: fix value…

The SUSE Linux Enterprise 12 SP5 kernel RT was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-20669: Fixed an improper check i915_gem_execbuffer2_ioctl in drivers/gpu/drm/i915/i915_gem_execbuffer.c (bsc#1122971).
• CVE-2019-20934: Fixed a use-after-free in show_numa_stats() because NUMA fault statistics were inappropriately freed, aka CID-16d51a590a8c (bsc#1179663).
• CVE-2020-15436: Fixed a use after free vulnerability in fs/block_dev.c which could have allowed local users to gain privileges or cause a denial of service (bsc#1179141).
• CVE-2020-15437: Fixed a null pointer dereference which could have allowed local users to cause a denial of service(bsc#1179140).
• CVE-2020-25669: Fixed a use-after-free read in sunkbd_reinit() (bsc#1178182).
• CVE-2020-27777: Restrict RTAS requests from userspace (bsc#1179107)
• CVE-2020-27786: Fixed a use after free in kernel midi subsystem snd_rawmidi_kernel_read1() (bsc#1179601).
• CVE-2020-28915: Fixed a buffer over-read in the fbcon code which could have been used by local attackers to read kernel memory (bsc#1178886).
• CVE-2020-28974: Fixed a slab-out-of-bounds read in fbcon which could have been used by local attackers to read privileged information or potentially crash the kernel, aka CID-3c4e0dff2095 (bsc#1178589).
• CVE-2020-29371: Fixed uninitialized memory leaks to userspace (bsc#1179429).
• CVE-2020-4788: Fixed an issue with IBM Power9 processors could have allowed a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances (bsc#1177666).

The following non-security bugs were fixed:

• ACPI: GED: fix -Wformat (git-fixes).
• ALSA: ctl: fix error path at adding user-defined element set (git-fixes).
• ALSA: firewire: Clean up a locking issue in copy_resp_to_buf() (git-fixes).
• ALSA: hda/realtek: Add mute LED quirk to yet another HP x360 model (git-fixes).
• ALSA: hda/realtek - Add new codec supported for ALC897 (git-fixes).
• ALSA: hda/realtek: Add some Clove SSID in the ALC293(ALC1220) (git-fixes).
• ALSA: hda/realtek: Enable headset of ASUS UX482EG & B9400CEA with ALC294 (git-fixes).
• ALSA: mixart: Fix mutex deadlock (git-fixes).
• ALSA: usb-audio: US16x08: fix value count for level meters (git-fixes).
• arm64: KVM: Fix system register enumeration (bsc#1174726).
• arm/arm64: KVM: Add PSCI version selection API (bsc#1174726).
• ASoC: qcom: lpass-platform: Fix memory leak (git-fixes).
• ath10k: Acquire tx_lock in tx error paths (git-fixes).
• Avoid a GCC warning about '/*' within a comment.
• batman-adv: set .owner to THIS_MODULE (git-fixes).
• Bluetooth: btusb: Fix and detect most of the Chinese Bluetooth controllers (git-fixes).
• Bluetooth: hci_bcm: fix freeing not-requested IRQ (git-fixes).
• bnxt_en: Fix race when modifying pause settings (bsc#1050242 ).
• bnxt_en: Protect bnxt_set_eee() and bnxt_set_pauseparam() with mutex (bsc#1050242).
• bpf: Zero-fill re-used per-cpu map element (git-fixes).
• btrfs: account ticket size at add/delete time (bsc#1178897).
• btrfs: add helper to obtain number of devices with ongoing dev-replace (bsc#1178897).
• btrfs: check rw_devices, not num_devices for balance (bsc#1178897).
• btrfs: do not delete mismatched root refs (bsc#1178962).
• btrfs: fix btrfs_calc_reclaim_metadata_size calculation (bsc#1178897).
• btrfs: fix force usage in inc_block_group_ro (bsc#1178897).
• btrfs: fix invalid removal of root ref (bsc#1178962).
• btrfs: fix reclaim counter leak of space_info objects (bsc#1178897).
• btrfs: fix reclaim_size counter leak after stealing from global reserve (bsc#1178897).
• btrfs: kill min_allocable_bytes in inc_block_group_ro (bsc#1178897).
• btrfs: qgroup: do not commit transaction when we already hold the handle (bsc#1178634).
• btrfs: rework arguments of btrfs_unlink_subvol (bsc#1178962).
• btrfs: split dev-replace locking helpers for read and write (bsc#1178897).
• can: af_can: prevent potential access of uninitialized…

The SUSE Linux Enterprise 15-SP1 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-20669: Fixed an improper check i915_gem_execbuffer2_ioctl in drivers/gpu/drm/i915/i915_gem_execbuffer.c (bsc#1122971).
• CVE-2019-20934: Fixed a use-after-free in show_numa_stats() because NUMA fault statistics were inappropriately freed, aka CID-16d51a590a8c (bsc#1179663).
• CVE-2020-15436: Fixed a use after free vulnerability in fs/block_dev.c which could have allowed local users to gain privileges or cause a denial of service (bsc#1179141).
• CVE-2020-15437: Fixed a null pointer dereference which could have allowed local users to cause a denial of service(bsc#1179140).
• CVE-2020-25669: Fixed a use-after-free read in sunkbd_reinit() (bsc#1178182).
• CVE-2020-27777: Restrict RTAS requests from userspace (bsc#1179107)
• CVE-2020-27786: Fixed a use after free in kernel midi subsystem snd_rawmidi_kernel_read1() (bsc#1179601).
• CVE-2020-28915: Fixed a buffer over-read in the fbcon code which could have been used by local attackers to read kernel memory (bsc#1178886).
• CVE-2020-28974: Fixed a slab-out-of-bounds read in fbcon which could have been used by local attackers to read privileged information or potentially crash the kernel, aka CID-3c4e0dff2095 (bsc#1178589).
• CVE-2020-29371: Fixed uninitialized memory leaks to userspace (bsc#1179429).
• CVE-2020-4788: Fixed an issue with IBM Power9 processors could have allowed a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances (bsc#1177666).

The following non-security bugs were fixed:

• ACPI: GED: fix -Wformat (git-fixes).
• ALSA: ctl: fix error path at adding user-defined element set (git-fixes).
• ALSA: firewire: Clean up a locking issue in copy_resp_to_buf() (git-fixes).
• ALSA: hda/realtek: Add mute LED quirk to yet another HP x360 model (git-fixes).
• ALSA: hda/realtek - Add new codec supported for ALC897 (git-fixes).
• ALSA: hda/realtek: Add some Clove SSID in the ALC293(ALC1220) (git-fixes).
• ALSA: hda/realtek: Enable headset of ASUS UX482EG & B9400CEA with ALC294 (git-fixes).
• ALSA: mixart: Fix mutex deadlock (git-fixes).
• ALSA: usb-audio: US16x08: fix value count for level meters (git-fixes).
• arm64: KVM: Fix system register enumeration (bsc#1174726).
• arm/arm64: KVM: Add PSCI version selection API (bsc#1174726).
• ASoC: qcom: lpass-platform: Fix memory leak (git-fixes).
• ath10k: Acquire tx_lock in tx error paths (git-fixes).
• Avoid a GCC warning about '/*' within a comment.
• batman-adv: set .owner to THIS_MODULE (git-fixes).
• Bluetooth: btusb: Fix and detect most of the Chinese Bluetooth controllers (git-fixes).
• Bluetooth: hci_bcm: fix freeing not-requested IRQ (git-fixes).
• bnxt_en: Fix race when modifying pause settings (bsc#1050242 ).
• bnxt_en: Protect bnxt_set_eee() and bnxt_set_pauseparam() with mutex (bsc#1050242).
• btmrvl: Fix firmware filename for sd8997 chipset (bsc#1172694).
• btrfs: account ticket size at add/delete time (bsc#1178897).
• btrfs: add helper to obtain number of devices with ongoing dev-replace (bsc#1178897).
• btrfs: check rw_devices, not num_devices for balance (bsc#1178897).
• btrfs: do not delete mismatched root refs (bsc#1178962).
• btrfs: fix btrfs_calc_reclaim_metadata_size calculation (bsc#1178897).
• btrfs: fix force usage in inc_block_group_ro (bsc#1178897).
• btrfs: fix invalid removal of root ref (bsc#1178962).
• btrfs: fix reclaim counter leak of space_info objects (bsc#1178897).
• btrfs: fix reclaim_size counter leak after stealing from global reserve (bsc#1178897).
• btrfs: kill min_allocable_bytes in inc_block_group_ro (bsc#1178897).
• btrfs: qgroup: do not commit transaction when we already hold the handle (bsc#1178634).
• btrfs: rework arguments of btrfs_unlink_subvol (bsc#1178962).
• btrfs: split dev-replace locking helpers for read and write (bsc#1178897).
• can: af_can: prevent potential access of…

The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3348: Fixed a use-after-free in nbd_add_socket() that could be triggered by local attackers (with access to the nbd device) via an I/O request (bnc#1181504).
• CVE-2021-3347: A use-after-free was discovered in the PI futexes during fault handling, allowing local users to execute code in the kernel (bnc#1181349).
• CVE-2020-27835: A use-after-free in the infiniband hfi1 driver was found, specifically in the way user calls Ioctl after open dev file and fork. A local user could use this flaw to crash the system (bnc#1179878).
• CVE-2020-25211: Fixed a buffer overflow in ctnetlink_parse_tuple_filter() which could be triggered by a local attackers by injecting conntrack netlink configuration (bnc#1176395).
• CVE-2020-25639: Fixed a NULL pointer dereference via nouveau ioctl (bnc#1176846).
• CVE-2020-29569: Fixed a potential privilege escalation and information leaks related to the PV block backend, as used by Xen (bnc#1179509).
• CVE-2020-29568: Fixed a denial of service issue, related to processing watch events (bnc#1179508).
• CVE-2020-0444: Fixed a bad kfree due to a logic error in audit_data_to_entry (bnc#1180027).
• CVE-2020-0465: Fixed multiple missing bounds checks in hid-multitouch.c that could have led to local privilege escalation (bnc#1180029).
• CVE-2020-0466: Fixed a use-after-free due to a logic error in do_epoll_ctl and ep_loop_check_proc of eventpoll.c (bnc#1180031).
• CVE-2020-4788: Fixed an issue with IBM Power9 processors could have allowed a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances (bsc#1177666).
• CVE-2020-15436: Fixed a use after free vulnerability in fs/block_dev.c which could have allowed local users to gain privileges or cause a denial of service (bsc#1179141).
• CVE-2020-27068: Fixed an out-of-bounds read due to a missing bounds check in the nl80211_policy policy of nl80211.c (bnc#1180086).
• CVE-2020-27777: Fixed a privilege escalation in the Run-Time Abstraction Services (RTAS) interface, affecting guests running on top of PowerVM or KVM hypervisors (bnc#1179107).
• CVE-2020-27786: Fixed an out-of-bounds write in the MIDI implementation (bnc#1179601).
• CVE-2020-27825: Fixed a race in the trace_open and buffer resize calls (bsc#1179960).
• CVE-2020-29371: Fixed uninitialized memory leaks to userspace (bsc#1179429).
• CVE-2020-29660: Fixed a locking inconsistency in the tty subsystem that may have allowed a read-after-free attack against TIOCGSID (bnc#1179745).
• CVE-2020-29661: Fixed a locking issue in the tty subsystem that allowed a use-after-free attack against TIOCSPGRP (bsc#1179745).
• CVE-2020-28974: Fixed a slab-out-of-bounds read in fbcon which could have been used by local attackers to read privileged information or potentially crash the kernel (bsc#1178589).
• CVE-2020-28915: Fixed a buffer over-read in the fbcon code which could have been used by local attackers to read kernel memory (bsc#1178886).
• CVE-2020-25669: Fixed a use-after-free read in sunkbd_reinit() (bsc#1178182).
• CVE-2020-15437: Fixed a null pointer dereference which could have allowed local users to cause a denial of service(bsc#1179140).
• CVE-2020-36158: Fixed a potential remote code execution in the Marvell mwifiex driver (bsc#1180559).
• CVE-2020-28374: Fixed a Linux SCSI target issue (bsc#1178372).
• CVE-2019-20934: Fixed a use-after-free in show_numa_stats() because NUMA fault statistics were inappropriately freed (bsc#1179663).

The following non-security bugs were fixed:

• blk-mq: improve heavily contended tag case (bsc#1178198).
• debugfs_lookup(): switch to lookup_one_len_unlocked() (bsc#1171979).
• epoll: Keep a reference on files added to the check list (bsc#1180031).
• fix regression in 'epoll: Keep a reference on files added to the check list' (bsc#1180031, git-fixes).
• futex: Do not enable IRQs…

The SUSE Linux Enterprise 12 SP2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3347: A use-after-free was discovered in the PI futexes during fault handling, allowing local users to execute code in the kernel (bnc#1181349).
• CVE-2020-29569: Fixed a potential privilege escalation and information leaks related to the PV block backend, as used by Xen (bnc#1179509).
• CVE-2020-29568: Fixed a denial of service issue, related to processing watch events (bnc#1179508).
• CVE-2020-25211: Fixed a flaw where a local attacker was able to inject conntrack netlink configuration that could cause a denial of service or trigger the use of incorrect protocol numbers in ctnetlink_parse_tuple_filter (bnc#1176395).
• CVE-2020-0444: Fixed a bad kfree due to a logic error in audit_data_to_entry (bnc#1180027).
• CVE-2020-0465: Fixed multiple missing bounds checks in hid-multitouch.c that could have led to local privilege escalation (bnc#1180029).
• CVE-2020-0466: Fixed a use-after-free due to a logic error in do_epoll_ctl and ep_loop_check_proc of eventpoll.c (bnc#1180031).
• CVE-2020-15436: Fixed a use after free vulnerability in fs/block_dev.c which could have allowed local users to gain privileges or cause a denial of service (bsc#1179141).
• CVE-2020-27068: Fixed an out-of-bounds read due to a missing bounds check in the nl80211_policy policy of nl80211.c (bnc#1180086).
• CVE-2020-27777: Fixed a privilege escalation in the Run-Time Abstraction Services (RTAS) interface, affecting guests running on top of PowerVM or KVM hypervisors (bnc#1179107).
• CVE-2020-27786: Fixed an out-of-bounds write in the MIDI implementation (bnc#1179601).
• CVE-2020-27825: Fixed a race in the trace_open and buffer resize calls (bsc#1179960).
• CVE-2020-29660: Fixed a locking inconsistency in the tty subsystem that may have allowed a read-after-free attack against TIOCGSID (bnc#1179745).
• CVE-2020-29661: Fixed a locking issue in the tty subsystem that allowed a use-after-free attack against TIOCSPGRP (bsc#1179745).
• CVE-2020-28974: Fixed a slab-out-of-bounds read in fbcon which could have been used by local attackers to read privileged information or potentially crash the kernel (bsc#1178589).
• CVE-2020-28915: Fixed a buffer over-read in the fbcon code which could have been used by local attackers to read kernel memory (bsc#1178886).
• CVE-2020-25669: Fixed a use-after-free read in sunkbd_reinit() (bsc#1178182).
• CVE-2020-25285: A race condition between hugetlb sysctl handlers in mm/hugetlb.c could be used by local attackers to corrupt memory, cause a NULL pointer dereference, or possibly have unspecified other impact (bnc#1176485 ).
• CVE-2020-15437: Fixed a null pointer dereference which could have allowed local users to cause a denial of service (bsc#1179140).
• CVE-2020-36158: Fixed a potential remote code execution in the Marvell mwifiex driver (bsc#1180559).
• CVE-2020-11668: Fixed the mishandling of invalid descriptors in the Xirlink camera USB driver (bnc#1168952).
• CVE-2020-25668: Fixed a use-after-free in con_font_op() (bsc#1178123).
• CVE-2020-27673: Fixed an issue where rogue guests could have caused denial of service of Dom0 via high frequency events (XSA-332 bsc#1177411)
• CVE-2019-20934: Fixed a use-after-free in show_numa_stats() because NUMA fault statistics were inappropriately freed (bsc#1179663).
• CVE-2019-19063: Fixed two memory leaks in the rtl_usb_probe() which could eventually have allowed attackers to cause a denial of service (memory consumption) (bnc#1157298 ).
• CVE-2019-6133: Fixed an issue where the 'start time' protection mechanism could have been bypassed and therefore authorization decisions are improperly cached (bsc#1128172).

The following non-security bugs were fixed:

• HID: Fix slab-out-of-bounds read in hid_field_extract (bsc#1180052).
• epoll: Keep a reference on files added to the check list (bsc#1180031).
• fix regression in 'epoll: Keep a reference…

The SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3348: Fixed a use-after-free in nbd_add_socket that could be triggered by local attackers (with access to the nbd device) via an I/O request at a certain point during device setup (bnc#1181504).
• CVE-2021-3347: A use-after-free was discovered in the PI futexes during fault handling, allowing local users to execute code in the kernel (bnc#1181349).
• CVE-2020-25211: Fixed a buffer overflow in ctnetlink_parse_tuple_filter() which could be triggered by a local attackers by injecting conntrack netlink configuration (bnc#1176395).
• CVE-2020-27835: A use-after-free in the infiniband hfi1 driver was found, specifically in the way user calls Ioctl after open dev file and fork. A local user could use this flaw to crash the system (bnc#1179878).
• CVE-2020-29569: Fixed a potential privilege escalation and information leaks related to the PV block backend, as used by Xen (bnc#1179509).
• CVE-2020-29568: Fixed a denial of service issue, related to processing watch events (bnc#1179508).
• CVE-2020-0444: Fixed a bad kfree due to a logic error in audit_data_to_entry (bnc#1180027).
• CVE-2020-0465: Fixed multiple missing bounds checks in hid-multitouch.c that could have led to local privilege escalation (bnc#1180029).
• CVE-2020-0466: Fixed a use-after-free due to a logic error in do_epoll_ctl and ep_loop_check_proc of eventpoll.c (bnc#1180031).
• CVE-2020-4788: Fixed an issue with IBM Power9 processors could have allowed a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances (bsc#1177666).
• CVE-2020-10781: A flaw was found in the ZRAM kernel module, where a user with a local account and the ability to read the /sys/class/zram-control/hot_add file can create ZRAM device nodes in the /dev/ directory. This read allocates kernel memory and is not accounted for a user that triggers the creation of that ZRAM device. With this vulnerability, continually reading the device may consume a large amount of system memory and cause the Out-of-Memory (OOM) killer to activate and terminate random userspace processes, possibly making the system inoperable (bnc#1173074).
• CVE-2020-15436: Fixed a use after free vulnerability in fs/block_dev.c which could have allowed local users to gain privileges or cause a denial of service (bsc#1179141).
• CVE-2020-27068: Fixed an out-of-bounds read due to a missing bounds check in the nl80211_policy policy of nl80211.c (bnc#1180086).
• CVE-2020-25639: Fixed a NULL pointer dereference via nouveau ioctl (bnc#1176846).
• CVE-2020-27777: Fixed a privilege escalation in the Run-Time Abstraction Services (RTAS) interface, affecting guests running on top of PowerVM or KVM hypervisors (bnc#1179107).
• CVE-2020-27786: Fixed an out-of-bounds write in the MIDI implementation (bnc#1179601).
• CVE-2020-27825: Fixed a race in the trace_open and buffer resize calls (bsc#1179960).
• CVE-2020-29660: Fixed a locking inconsistency in the tty subsystem that may have allowed a read-after-free attack against TIOCGSID (bnc#1179745).
• CVE-2020-29661: Fixed a locking issue in the tty subsystem that allowed a use-after-free attack against TIOCSPGRP (bsc#1179745).
• CVE-2020-28974: Fixed a slab-out-of-bounds read in fbcon which could have been used by local attackers to read privileged information or potentially crash the kernel (bsc#1178589).
• CVE-2020-28915: Fixed a buffer over-read in the fbcon code which could have been used by local attackers to read kernel memory (bsc#1178886).
• CVE-2020-28374: Fixed a Linux SCSI target issue (bsc#1178372).
• CVE-2020-25669: Fixed a use-after-free read in sunkbd_reinit() (bsc#1178182).
• CVE-2020-29371: An issue was discovered in romfs_dev_read in fs/romfs/storage.c where uninitialized memory leaks to userspace (bnc#1179429).
• CVE-2020-15437: Fixed a null pointer dereference which could have allowed local…

The SUSE Linux Enterprise 12 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3347: A use-after-free was discovered in the PI futexes during fault handling, allowing local users to execute code in the kernel (bnc#1181349).
• CVE-2020-25211: Fixed a buffer overflow in ctnetlink_parse_tuple_filter() which could be triggered by a local attackers by injecting conntrack netlink configuration (bnc#1176395).
• CVE-2020-27835: A use-after-free in the infiniband hfi1 driver was found, specifically in the way user calls Ioctl after open dev file and fork. A local user could use this flaw to crash the system (bnc#1179878).
• CVE-2020-29569: Fixed a potential privilege escalation and information leaks related to the PV block backend, as used by Xen (bnc#1179509).
• CVE-2020-29568: Fixed a denial of service issue, related to processing watch events (bnc#1179508).
• CVE-2020-0444: Fixed a bad kfree due to a logic error in audit_data_to_entry (bnc#1180027).
• CVE-2020-0465: Fixed multiple missing bounds checks in hid-multitouch.c that could have led to local privilege escalation (bnc#1180029).
• CVE-2020-0466: Fixed a use-after-free due to a logic error in do_epoll_ctl and ep_loop_check_proc of eventpoll.c (bnc#1180031).
• CVE-2020-4788: Fixed an issue with IBM Power9 processors could have allowed a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances (bsc#1177666).
• CVE-2020-15436: Fixed a use after free vulnerability in fs/block_dev.c which could have allowed local users to gain privileges or cause a denial of service (bsc#1179141).
• CVE-2020-27068: Fixed an out-of-bounds read due to a missing bounds check in the nl80211_policy policy of nl80211.c (bnc#1180086).
• CVE-2020-27777: Fixed a privilege escalation in the Run-Time Abstraction Services (RTAS) interface, affecting guests running on top of PowerVM or KVM hypervisors (bnc#1179107).
• CVE-2020-27786: Fixed an out-of-bounds write in the MIDI implementation (bnc#1179601).
• CVE-2020-27825: Fixed a race in the trace_open and buffer resize calls (bsc#1179960).
• CVE-2020-29660: Fixed a locking inconsistency in the tty subsystem that may have allowed a read-after-free attack against TIOCGSID (bnc#1179745).
• CVE-2020-29661: Fixed a locking issue in the tty subsystem that allowed a use-after-free attack against TIOCSPGRP (bsc#1179745).
• CVE-2020-28974: Fixed a slab-out-of-bounds read in fbcon which could have been used by local attackers to read privileged information or potentially crash the kernel (bsc#1178589).
• CVE-2020-28915: Fixed a buffer over-read in the fbcon code which could have been used by local attackers to read kernel memory (bsc#1178886).
• CVE-2020-25669: Fixed a use-after-free read in sunkbd_reinit() (bsc#1178182).
• CVE-2020-15437: Fixed a null pointer dereference which could have allowed local users to cause a denial of service(bsc#1179140).
• CVE-2020-36158: Fixed a potential remote code execution in the Marvell mwifiex driver (bsc#1180559).
• CVE-2020-11668: Fixed the mishandling of invalid descriptors in the Xirlink camera USB driver (bnc#1168952).
• CVE-2020-25285: Fixed a race condition between hugetlb sysctl handlers in mm/hugetlb.c (bnc#1176485).
• CVE-2019-20934: Fixed a use-after-free in show_numa_stats() because NUMA fault statistics were inappropriately freed (bsc#1179663).
• CVE-2018-10902: It was found that the raw midi kernel driver did not protect against concurrent access which leads to a double realloc (double free) in snd_rawmidi_input_params() and snd_rawmidi_output_status() which are part of snd_rawmidi_ioctl() handler in rawmidi.c file. A malicious local attacker could possibly use this for privilege escalation (bnc#1105322).

The following non-security bugs were fixed:

• cifs: do not revalidate mountpoint dentries (bsc#1177440).
• cifs: fix potential use-after-free in cifs_echo_request() (bsc#1139944).
• cifs: ignore…

The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3347: A use-after-free was discovered in the PI futexes during fault handling, allowing local users to execute code in the kernel (bnc#1181349).
• CVE-2020-0465: Fixed multiple missing bounds checks in hid-multitouch.c that could have led to local privilege escalation (bnc#1180029).
• CVE-2020-25211: Fixed a flaw where a local attacker was able to inject conntrack netlink configuration that could cause a denial of service or trigger the use of incorrect protocol numbers in ctnetlink_parse_tuple_filter (bnc#1176395).
• CVE-2020-14390: Fixed an out-of-bounds memory write leading to memory corruption or a denial of service when changing screen size (bnc#1176235).
• CVE-2020-25284: Fixed an incomplete permission checking for access to rbd devices, which could have been leveraged by local attackers to map or unmap rbd block devices (bsc#1176482).
• CVE-2020-15436: Fixed a use after free vulnerability in fs/block_dev.c which could have allowed local users to gain privileges or cause a denial of service (bsc#1179141).
• CVE-2020-14331: Fixed a missing check in vgacon scrollback handling (bsc#1174205).
• CVE-2020-14353: Fixed an issue where keys - for keyctl prevent creating a different user's keyrings (bsc#1174993).
• CVE-2020-14381: Fixed requeue paths such that filp was valid when dropping the references (bsc#1176011).
• CVE-2020-27068: Fixed an out-of-bounds read due to a missing bounds check in the nl80211_policy policy of nl80211.c (bnc#1180086).
• CVE-2020-27777: Fixed a privilege escalation in the Run-Time Abstraction Services (RTAS) interface, affecting guests running on top of PowerVM or KVM hypervisors (bnc#1179107).
• CVE-2020-27786: Fixed an out-of-bounds write in the MIDI implementation (bnc#1179601).
• CVE-2020-29660: Fixed a locking inconsistency in the tty subsystem that may have allowed a read-after-free attack against TIOCGSID (bnc#1179745).
• CVE-2020-29661: Fixed a locking issue in the tty subsystem that allowed a use-after-free attack against TIOCSPGRP (bsc#1179745).
• CVE-2020-28974: Fixed a slab-out-of-bounds read in fbcon which could have been used by local attackers to read privileged information or potentially crash the kernel (bsc#1178589).
• CVE-2020-28915: Fixed a buffer over-read in the fbcon code which could have been used by local attackers to read kernel memory (bsc#1178886).
• CVE-2020-25669: Fixed a use-after-free read in sunkbd_reinit() (bsc#1178182).
• CVE-2020-25285: A race condition between hugetlb sysctl handlers in mm/hugetlb.c could be used by local attackers to corrupt memory, cause a NULL pointer dereference, or possibly have unspecified other impact (bnc#1176485 ).
• CVE-2020-15437: Fixed a null pointer dereference which could have allowed local users to cause a denial of service (bsc#1179140).
• CVE-2020-36158: Fixed a potential remote code execution in the Marvell mwifiex driver (bsc#1180559).
• CVE-2020-11668: Fixed the mishandling of invalid descriptors in the Xirlink camera USB driver (bnc#1168952).
• CVE-2020-25668: Fixed a use-after-free in con_font_op() (bsc#1178123).
• CVE-2020-4788: Fixed an issue with IBM Power9 processors could have allowed a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances (bsc#1177666).
• CVE-2020-0431: Fixed an out of bounds write due to a missing bounds check (bsc#1176722).
• CVE-2020-0404: Fixed a linked list corruption due to an unusual root cause (bsc#1176423).
• CVE-2019-20934: Fixed a use-after-free in show_numa_stats() because NUMA fault statistics were inappropriately freed (bsc#1179663).
• CVE-2020-25656: Fixed a concurrency use-after-free in vt_do_kdgkb_ioctl (bnc#1177766).
• CVE-2020-25643: Fixed a memory corruption and a read overflow which could have caused by improper input validation in the ppp_cp_parse_cr function (bsc#1177206). -…

Elena Petrova discovered that the pin controller device tree implementation in the Linux kernel did not properly handle string references. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2020-0427)

Daniele Antonioli, Nils Ole Tippenhauer, and Kasper Rasmussen discovered that legacy pairing and secure-connections pairing authentication in the Bluetooth protocol could allow an unauthenticated user to complete authentication without pairing credentials via adjacent access. A physically proximate attacker could use this to impersonate a previously paired Bluetooth device. (CVE-2020-10135)

Andy Nguyen discovered that the Bluetooth A2MP implementation in the Linux kernel did not properly initialize memory in some situations. A physically proximate remote attacker could use this to expose sensitive information (kernel memory). (CVE-2020-12352)

It was discovered that a race condition existed in the perf subsystem of the Linux kernel, leading to a use-after-free vulnerability. An attacker with access to the perf subsystem could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-14351)

It was discovered that the frame buffer implementation in the Linux kernel did not properly handle some edge cases in software scrollback. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-14390)

It was discovered that the netfilter connection tracker for netlink in the Linux kernel did not properly perform bounds checking in some situations. A local attacker could use this to cause a denial of service (system crash). (CVE-2020-25211)

It was discovered that the Rados block device (rbd) driver in the Linux kernel did not properly perform privilege checks for access to rbd devices in some situations. A local attacker could use this to map or unmap rbd block devices. (CVE-2020-25284)

It was discovered that the HDLC PPP implementation in the Linux kernel did not properly validate input in some situations. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-25643)

It was discovered that the GENEVE tunnel implementation in the Linux kernel when combined with IPSec did not properly select IP routes in some situations. An attacker could use this to expose sensitive information (unencrypted network traffic). (CVE-2020-25645)

Keyu Man discovered that the ICMP global rate limiter in the Linux kernel could be used to assist in scanning open UDP ports. A remote attacker could use to facilitate attacks on UDP based services that depend on source port randomization. (CVE-2020-25705)

It was discovered that the framebuffer implementation in the Linux kernel did not properly perform range checks in certain situations. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2020-28915)

It was discovered that Power 9 processors could be coerced to expose information from the L1 cache in certain situations. A local attacker could use this to expose sensitive information. (CVE-2020-4788)

It was discovered that a race condition existed in the binder IPC implementation in the Linux kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-0423)

Daniele Antonioli, Nils Ole Tippenhauer, and Kasper Rasmussen discovered that legacy pairing and secure-connections pairing authentication in the Bluetooth protocol could allow an unauthenticated user to complete authentication without pairing credentials via adjacent access. A physically proximate attacker could use this to impersonate a previously paired Bluetooth device. (CVE-2020-10135)

It was discovered that a race condition existed in the perf subsystem of the Linux kernel, leading to a use-after-free vulnerability. An attacker with access to the perf subsystem could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-14351)

It was discovered that the frame buffer implementation in the Linux kernel did not properly handle some edge cases in software scrollback. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-14390)

It was discovered that the netfilter connection tracker for netlink in the Linux kernel did not properly perform bounds checking in some situations. A local attacker could use this to cause a denial of service (system crash). (CVE-2020-25211)

It was discovered that the Rados block device (rbd) driver in the Linux kernel did not properly perform privilege checks for access to rbd devices in some situations. A local attacker could use this to map or unmap rbd block devices. (CVE-2020-25284)

It was discovered that the HDLC PPP implementation in the Linux kernel did not properly validate input in some situations. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-25643)

It was discovered that the GENEVE tunnel implementation in the Linux kernel when combined with IPSec did not properly select IP routes in some situations. An attacker could use this to expose sensitive information (unencrypted network traffic). (CVE-2020-25645)

Keyu Man discovered that the ICMP global rate limiter in the Linux kernel could be used to assist in scanning open UDP ports. A remote attacker could use to facilitate attacks on UDP based services that depend on source port randomization. (CVE-2020-25705)

It was discovered that the framebuffer implementation in the Linux kernel did not properly perform range checks in certain situations. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2020-28915)

It was discovered that Power 9 processors could be coerced to expose information from the L1 cache in certain situations. A local attacker could use this to expose sensitive information. (CVE-2020-4788)

It was discovered that a race condition existed in the perf subsystem of the Linux kernel, leading to a use-after-free vulnerability. An attacker with access to the perf subsystem could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-14351)

It was discovered that the frame buffer implementation in the Linux kernel did not properly handle some edge cases in software scrollback. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-14390)

It was discovered that the netfilter connection tracker for netlink in the Linux kernel did not properly perform bounds checking in some situations. A local attacker could use this to cause a denial of service (system crash). (CVE-2020-25211)

It was discovered that the Rados block device (rbd) driver in the Linux kernel did not properly perform privilege checks for access to rbd devices in some situations. A local attacker could use this to map or unmap rbd block devices. (CVE-2020-25284)

It was discovered that a race condition existed in the hugetlb sysctl implementation in the Linux kernel. A privileged attacker could use this to cause a denial of service (system crash). (CVE-2020-25285)

It was discovered that the block layer subsystem in the Linux kernel did not properly handle zero-length requests. A local attacker could use this to cause a denial of service. (CVE-2020-25641)

It was discovered that the HDLC PPP implementation in the Linux kernel did not properly validate input in some situations. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-25643)

It was discovered that the GENEVE tunnel implementation in the Linux kernel when combined with IPSec did not properly select IP routes in some situations. An attacker could use this to expose sensitive information (unencrypted network traffic). (CVE-2020-25645)

It was discovered that the framebuffer implementation in the Linux kernel did not properly perform range checks in certain situations. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2020-28915)

It was discovered that Power 9 processors could be coerced to expose information from the L1 cache in certain situations. A local attacker could use this to expose sensitive information. (CVE-2020-4788)

Daniele Antonioli, Nils Ole Tippenhauer, and Kasper Rasmussen discovered that legacy pairing and secure-connections pairing authentication in the Bluetooth protocol could allow an unauthenticated user to complete authentication without pairing credentials via adjacent access. A physically proximate attacker could use this to impersonate a previously paired Bluetooth device. (CVE-2020-10135)

Jay Shin discovered that the ext4 file system implementation in the Linux kernel did not properly handle directory access with broken indexing, leading to an out-of-bounds read vulnerability. A local attacker could use this to cause a denial of service (system crash). (CVE-2020-14314)

It was discovered that the block layer implementation in the Linux kernel did not properly perform reference counting in some situations, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash). (CVE-2020-15436)

It was discovered that the serial port driver in the Linux kernel did not properly initialize a pointer in some situations. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2020-15437)

Andy Nguyen discovered that the Bluetooth HCI event packet parser in the Linux kernel did not properly handle event advertisements of certain sizes, leading to a heap-based buffer overflow. A physically proximate remote attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-24490)

It was discovered that the NFS client implementation in the Linux kernel did not properly perform bounds checking before copying security labels in some situations. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-25212)

It was discovered that the Rados block device (rbd) driver in the Linux kernel did not properly perform privilege checks for access to rbd devices in some situations. A local attacker could use this to map or unmap rbd block devices. (CVE-2020-25284)

It was discovered that the block layer subsystem in the Linux kernel did not properly handle zero-length requests. A local attacker could use this to cause a denial of service. (CVE-2020-25641)

It was discovered that the HDLC PPP implementation in the Linux kernel did not properly validate input in some situations. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-25643)

Kiyin (尹亮) discovered that the perf subsystem in the Linux kernel did not properly deallocate memory in some situations. A privileged attacker could use this to cause a denial of service (kernel memory exhaustion). (CVE-2020-25704)

It was discovered that the KVM hypervisor in the Linux kernel did not properly handle interrupts in certain situations. A local attacker in a guest VM could possibly use this to cause a denial of service (host system crash). (CVE-2020-27152)

It was discovered that the jfs file system implementation in the Linux kernel contained an out-of-bounds read vulnerability. A local attacker could use this to possibly cause a denial of service (system crash). (CVE-2020-27815)

It was discovered that an information leak existed in the syscall implementation in the Linux kernel on 32 bit systems. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2020-28588)

It was discovered that the framebuffer implementation in the Linux kernel did not properly perform range checks in certain situations. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2020-28915)

Jann Horn discovered a race condition in the copy-on-write implementation in the Linux kernel when handling hugepages. A local attacker could use this to gain unintended write access to read-only memory pages. (CVE-2020-29368)

Jann Horn discovered that the mmap implementation in the Linux kernel contained a race…