CVE-2018-20855

An issue was discovered in the Linux kernel before 4.18.7. In create_qp_common in drivers/infiniband/hw/mlx5/qp.c, mlx5_ib_create_qp_resp was never initialized, resulting in a leak of stack memory to userspace.

The openSUSE Leap 15.1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2019-1125: Fix Spectre V1 variant memory disclosure by speculation over the SWAPGS instruction (bsc#1139358).
• CVE-2019-10207: A NULL pointer dereference was possible in the bluetooth stack, which could lead to crashes. (bnc#1123959 bnc#1142857).
• CVE-2018-20855: In create_qp_common in drivers/infiniband/hw/mlx5/qp.c, mlx5_ib_create_qp_resp was never initialized, resulting in a leak of stack memory to userspace (bnc#1143045).
• CVE-2019-14284: drivers/block/floppy.c allowed a denial of service by setup_format_params division-by-zero. Two consecutive ioctls can trigger the bug: the first one should set the drive geometry with .sect and .rate values that make F_SECT_PER_TRACK be zero. Next, the floppy format operation should be called. It can be triggered by an unprivileged local user even when a floppy disk has not been inserted. (bnc#1143189).
• CVE-2019-14283: set_geometry in drivers/block/floppy.c did not validate the sect and head fields, as demonstrated by an integer overflow and out-of-bounds read. It can be triggered by an unprivileged local user when a floppy disk has been inserted. (bnc#1143191).
• CVE-2019-11810: A NULL pointer dereference can occur when megasas_create_frame_pool() fails in megasas_alloc_cmds() in drivers/scsi/megaraid/megaraid_sas_base.c. This causes a Denial of Service, related to a use-after-free (bnc#1134399).
• CVE-2019-13648: In the Linux kernel on the powerpc platform, when hardware transactional memory is disabled, a local user can cause a denial of service (TM Bad Thing exception and system crash) via a sigreturn() system call that sends a crafted signal frame. This affects arch/powerpc/kernel/signal_32.c and arch/powerpc/kernel/signal_64.c (bnc#1142254 bnc#1142265).
• CVE-2019-13631: In parse_hid_report_descriptor in drivers/input/tablet/gtco.c in the Linux kernel, a malicious USB device can send an HID report that triggers an out-of-bounds write during generation of debugging messages (bnc#1142023).

The following non-security bugs were fixed:

• 9p: acl: fix uninitialized iattr access (bsc#1051510).
• 9p: p9dirent_read: check network-provided name length (bsc#1051510).
• 9p: pass the correct prototype to read_cache_page (bsc#1051510).
• 9p/rdma: do not disconnect on down_interruptible EAGAIN (bsc#1051510).
• 9p/rdma: remove useless check in cm_event_handler (bsc#1051510).
• 9p/virtio: Add cleanup path in p9_virtio_init (bsc#1051510).
• 9p/xen: Add cleanup path in p9_trans_xen_init (bsc#1051510).
• 9p/xen: fix check for xenbus_read error in front_probe (bsc#1051510).
• acpi/arm64: ignore 5.1 FADTs that are reported as 5.0 (bsc#1051510).
• ACPI/IORT: Fix off-by-one check in iort_dev_find_its_id() (bsc#1051510).
• acpi/nfit: Always dump _DSM output payload (bsc#1142351).
• ACPI: PM: Fix regression in acpi_device_set_power() (bsc#1051510).
• Add back sibling paca poiter to paca (bsc#1055117).
• Add support for crct10dif-vpmsum ().
• af_key: fix leaks in key_pol_get_resp and dump_sp (bsc#1051510).
• af_packet: Block execution of tasks waiting for transmit to complete in AF_PACKET (networking-stable-19_07_02).
• af_unix: remove redundant lockdep class (git-fixes).
• ALSA: compress: Be more restrictive about when a drain is allowed (bsc#1051510).
• ALSA: compress: Do not allow paritial drain operations on capture streams (bsc#1051510).
• ALSA: compress: Fix regression on compressed capture streams (bsc#1051510).
• ALSA: compress: Prevent bypasses of set_params (bsc#1051510).
• ALSA: hda - Add a conexant codec entry to let mute led work (bsc#1051510).
• ALSA: hda - Do not resume forcibly i915 HDMI/DP codec (bsc#1111666).
• ALSA: hda: Fix 1-minute detection delay when i915 module is not available (bsc#1111666).
• ALSA: hda - Fix intermittent CORB/RIRB stall on Intel chips (bsc#1111666).
• ALSA: hda/hdmi - Fix i915 reverse port/pin mapping (bsc#1111666).
• ALSA:…

The openSUSE Leap 15.0 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2019-1125: Fix Spectre V1 variant memory disclosure by speculation over the SWAPGS instruction (bsc#1139358).
• CVE-2019-10207: A NULL pointer dereference was possible in the bluetooth stack, which could lead to crashes. (bnc#1123959 bnc#1142857).
• CVE-2018-20855: In create_qp_common in drivers/infiniband/hw/mlx5/qp.c, mlx5_ib_create_qp_resp was never initialized, resulting in a leak of stack memory to userspace (bnc#1143045).
• CVE-2019-14284: drivers/block/floppy.c allowed a denial of service by setup_format_params division-by-zero. Two consecutive ioctls can trigger the bug: the first one should set the drive geometry with .sect and .rate values that make F_SECT_PER_TRACK be zero. Next, the floppy format operation should be called. It can be triggered by an unprivileged local user even when a floppy disk has not been inserted. NOTE: QEMU creates the floppy device by default (bnc#1143189).
• CVE-2019-14283: set_geometry in drivers/block/floppy.c did not validate the sect and head fields, as demonstrated by an integer overflow and out-of-bounds read. It can be triggered by an unprivileged local user when a floppy disk has been inserted. NOTE: QEMU creates the floppy device by default (bnc#1143191).
• CVE-2019-11810: A NULL pointer dereference can occur when megasas_create_frame_pool() fails in megasas_alloc_cmds() in drivers/scsi/megaraid/megaraid_sas_base.c. This causes a Denial of Service, related to a use-after-free (bnc#1134399).
• CVE-2019-13648: In the Linux kernel on the powerpc platform, when hardware transactional memory is disabled, a local user can cause a denial of service (TM Bad Thing exception and system crash) via a sigreturn() system call that sends a crafted signal frame. This affects arch/powerpc/kernel/signal_32.c and arch/powerpc/kernel/signal_64.c (bnc#1142254 bnc#1142265).
• CVE-2019-13631: In parse_hid_report_descriptor in drivers/input/tablet/gtco.c in the Linux kernel a malicious USB device can send an HID report that triggers an out-of-bounds write during generation of debugging messages (bnc#1142023).

The following non-security bugs were fixed:

• 9p: acl: fix uninitialized iattr access (bsc#1051510).
• 9p: p9dirent_read: check network-provided name length (bsc#1051510).
• 9p: pass the correct prototype to read_cache_page (bsc#1051510).
• 9p/rdma: do not disconnect on down_interruptible EAGAIN (bsc#1051510).
• 9p/rdma: remove useless check in cm_event_handler (bsc#1051510).
• 9p/virtio: Add cleanup path in p9_virtio_init (bsc#1051510).
• 9p/xen: Add cleanup path in p9_trans_xen_init (bsc#1051510).
• 9p/xen: fix check for xenbus_read error in front_probe (bsc#1051510).
• Abort file_remove_privs() for non-reg. files (bsc#1140888).
• acpi/arm64: ignore 5.1 FADTs that are reported as 5.0 (bsc#1051510).
• acpi/IORT: Fix off-by-one check in iort_dev_find_its_id() (bsc#1051510).
• acpi/nfit: Always dump _DSM output payload (bsc#1142351).
• acpi: PM: Allow transitions to D0 to occur in special cases (bsc#1051510).
• acpi: PM: Avoid evaluating _PS3 on transitions from D3hot to D3cold (bsc#1051510).
• acpi: PM: Fix regression in acpi_device_set_power() (bsc#1051510).
• Add back sibling paca poiter to paca (bsc#1055117).
• Add support for crct10dif-vpmsum ().
• af_key: fix leaks in key_pol_get_resp and dump_sp (bsc#1051510).
• af_packet: Block execution of tasks waiting for transmit to complete in AF_PACKET (networking-stable-19_07_02).
• af_unix: remove redundant lockdep class (git-fixes).
• ALSA: compress: Be more restrictive about when a drain is allowed (bsc#1051510).
• ALSA: compress: Do not allow paritial drain operations on capture streams (bsc#1051510).
• ALSA: compress: Fix regression on compressed capture streams (bsc#1051510).
• ALSA: compress: Prevent bypasses of set_params (bsc#1051510).
• ALSA: hda - Add a conexant codec entry to let mute led work…

The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2019-14284: The drivers/block/floppy.c allowed a denial of service by setup_format_params division-by-zero. Two consecutive ioctls can trigger the bug: the first one should set the drive geometry with .sect and .rate values that make F_SECT_PER_TRACK be zero. Next, the floppy format operation should be called. It can be triggered by an unprivileged local user even when a floppy disk has not been inserted. NOTE: QEMU creates the floppy device by default (bsc#1143189).
• CVE-2019-14283: The function set_geometry in drivers/block/floppy.c did not validate the sect and head fields, as demonstrated by an integer overflow and out-of-bounds read. It can be triggered by an unprivileged local user when a floppy disk has been inserted. NOTE: QEMU creates the floppy device by default (bsc#1143191).
• CVE-2019-13631: In parse_hid_report_descriptor in drivers/input/tablet/gtco.c, a malicious USB device can send an HID report that triggers an out-of-bounds write during generation of debugging messages (bsc#1142023).
• CVE-2019-11810: A NULL pointer dereference can occur when megasas_create_frame_pool() fails in megasas_alloc_cmds() in drivers/scsi/megaraid/megaraid_sas_base.c. This causes a Denial of Service, related to a use-after-free (bsc#1134399).
• CVE-2019-1125: Enable Spectre v1 swapgs mitigations (bsc#1139358).
• CVE-2018-20855: An issue was discovered in create_qp_common in drivers/infiniband/hw/mlx5/qp.c, mlx5_ib_create_qp_resp was never initialized, resulting in a leak of stack memory to userspace (bsc#1143045).
• CVE-2015-9289: A buffer overflow occurs when checking userspace params in drivers/media/dvb-frontends/cx24116.c. The maximum size for a DiSEqC command is 6, according to the userspace API. However, the code allowed larger values such as 23 (bsc#1143179).

The following non-security bugs were fixed:

• fix detection of race between fcntl-setlk and close (bsc#1140965).
• ocfs2: add first lock wait time in locking_state (bsc#1134390).
• ocfs2: add last unlock times in locking_state (bsc#1134390).
• ocfs2: add locking filter debugfs file (bsc#1134390).
• powerpc/watchpoint: Restore NV GPRs while returning from exception (bsc#1140945,bsc#1141401,bsc#1141402,bsc#1141452,bsc#1141453,bsc#1141454).
• xen-netfront: use napi_complete() correctly to prevent Rx stalling (bsc#1138744).

The SUSE Linux Enterprise 15 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-20855: An issue was discovered in create_qp_common, mlx5_ib_create_qp_resp was never initialized, resulting in a leak of stack memory to userspace. (bnc#bsc#1103991)
• CVE-2019-1125: Fix Spectre V1 variant via swapgs: Exclude ATOMs from speculation through SWAPGS (bsc#1139358).
• CVE-2019-14284: In the Linux kernel, drivers/block/floppy.c allowed a denial of service by setup_format_params division-by-zero. (bnc#bsc#1143189)
• CVE-2019-14283: In the Linux kernel, set_geometry in drivers/block/floppy.c did not validate the sect and head fields, as demonstrated by an integer overflow and out-of-bounds read. It can be triggered by an unprivileged local user when a floppy disk has been inserted. NOTE: QEMU creates the floppy device by default. (bsc#1143191)
• CVE-2019-11810: An issue was discovered in the Linux kernel A NULL pointer dereference can occur when megasas_create_frame_pool() fails in megasas_alloc_cmds() in drivers/scsi/megaraid/megaraid_sas_base.c. This causes a Denial of Service, related to a use-after-free. (bsc#1134399)
• CVE-2019-13648: In the Linux kernel on the powerpc platform, when hardware transactional memory was disabled, a local user can cause a denial of service via a sigreturn() system call that sends a crafted signal frame. (bnc#1142265)
• CVE-2019-13631: In parse_hid_report_descriptor, a malicious usb device could send an hid: report that triggered an out-of-bounds write during generation of debugging messages. (bnc#1142023)

The following non-security bugs were fixed:

• acpi/nfit: Always dump _DSM output payload (bsc#1142351).
• acpi: PM: Allow transitions to D0 to occur in special cases (bsc#1051510).
• acpi: PM: Avoid evaluating _PS3 on transitions from D3hot to D3cold (bsc#1051510).
• af_unix: remove redundant lockdep class (git-fixes).
• alsa: compress: Be more restrictive about when a drain is allowed (bsc#1051510).
• alsa: compress: Do not allow paritial drain operations on capture streams (bsc#1051510).
• alsa: compress: Fix regression on compressed capture streams (bsc#1051510).
• alsa: compress: Prevent bypasses of set_params (bsc#1051510).
• alsa: hda - Add a conexant codec entry to let mute led work (bsc#1051510).
• alsa: hda/realtek - Fixed Headphone Mic can't record on Dell platform (bsc#1051510).
• alsa: hda/realtek - Headphone Mic can't record after S3 (bsc#1051510).
• alsa: hda/realtek: apply ALC891 headset fixup to one Dell machine (bsc#1051510).
• alsa: line6: Fix a typo (bsc#1051510).
• alsa: line6: Fix wrong altsetting for LINE6_PODHD500_1 (bsc#1051510).
• alsa: seq: Break too long mutex context in the write loop (bsc#1051510).
• alsa: usb-audio: Add quirk for Focusrite Scarlett Solo (bsc#1051510).
• alsa: usb-audio: Add quirk for MOTU MicroBook II (bsc#1051510).
• alsa: usb-audio: Cleanup DSD whitelist (bsc#1051510).
• alsa: usb-audio: Enable .product_name override for Emagic, Unitor 8 (bsc#1051510).
• alsa: usb-audio: Sanity checks for each pipe and EP types (bsc#1051510).
• asoc : cs4265 : readable register too low (bsc#1051510).
• asoc: cx2072x: fix integer overflow on unsigned int multiply (bsc#1111666).
• asoc: max98090: remove 24-bit format support if RJ is 0 (bsc#1051510).
• asoc: soc-pcm: BE dai needs prepare when pause release after resume (bsc#1051510).
• ath6kl: add some bounds checking (bsc#1051510).
• batman-adv: fix for leaked TVLV handler (bsc#1051510).
• bcache: Add comments for blkdev_put() in registration code path (bsc#1140652).
• bcache: Clean up bch_get_congested() (bsc#1140652).
• bcache: Revert 'bcache: fix high CPU occupancy during journal' (bsc#1140652).
• bcache: Revert 'bcache: free heap cache_set->flush_btree in bch_journal_free' (bsc#1140652).
• bcache: acquire bch_register_lock later in cached_dev_detach_finish() (bsc#1140652).
• bcache: acquire bch_register_lock later in cached_dev_free()…

The SUSE Linux Enterprise 15 SP1 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-20855: An issue was discovered in create_qp_common, mlx5_ib_create_qp_resp was never initialized, resulting in a leak of stack memory to userspace. (bnc#bsc#1103991)
• CVE-2019-1125: Fix Spectre V1 variant via swapgs: Exclude ATOMs from speculation through SWAPGS (bsc#1139358).
• CVE-2019-14284: In the Linux kernel, drivers/block/floppy.c allowed a denial of service by setup_format_params division-by-zero. (bnc#bsc#1143189)
• CVE-2019-14283: In the Linux kernel, set_geometry in drivers/block/floppy.c did not validate the sect and head fields, as demonstrated by an integer overflow and out-of-bounds read. It can be triggered by an unprivileged local user when a floppy disk has been inserted. NOTE: QEMU creates the floppy device by default. (bsc#1143191)
• CVE-2019-11810: An issue was discovered in the Linux kernel A NULL pointer dereference can occur when megasas_create_frame_pool() fails in megasas_alloc_cmds() in drivers/scsi/megaraid/megaraid_sas_base.c. This causes a Denial of Service, related to a use-after-free. (bsc#1134399)
• CVE-2019-13648: In the Linux kernel on the powerpc platform, when hardware transactional memory was disabled, a local user can cause a denial of service via a sigreturn() system call that sends a crafted signal frame. (bnc#1142265)
• CVE-2019-13631: In parse_hid_report_descriptor, a malicious usb device could send an hid: report that triggered an out-of-bounds write during generation of debugging messages. (bnc#1142023)
• CVE-2019-10638: In the Linux kernel, a device could be tracked by an attacker using the IP ID values the kernel produces for connection-less protocols (e.g., UDP and ICMP). When such traffic was sent to multiple destination IP addresses, it was possible to obtain hash collisions (of indices to the counter array) and thereby obtain the hashing key (via enumeration). An attack may have been conducted by hosting a crafted web page that uses WebRTC or gQUIC to force UDP traffic to attacker-controlled IP addresses. (bnc#1140575)
• CVE-2019-10639: The Linux kernel allowed Information Exposure (partial kernel address disclosure), leading to a KASLR bypass. (bsc#1140577)
• CVE-2019-13233: In arch/x86/lib/insn-eval.c, there was a use-after-free for access to an LDT entry because of a race condition between modify_ldt() and a #BR exception for an MPX bounds violation. (bnc#1140454)
• CVE-2018-20836: In the Linux kernel there was a race condition in smp_task_timedout() and smp_task_done() in drivers/scsi/libsas/sas_expander.c, leading to a use-after-free. (bnc#1134395)
• CVE-2019-11599: The coredump implementation in the Linux kernel did not use locking or other mechanisms to prevent vma layout or vma flags changes while it runs, which allowed local users to obtain sensitive information, cause a denial of service, or possibly have unspecified other impact by triggering a race condition with mmget_not_zero or get_task_mm calls. This is related to fs/userfaultfd.c, mm/mmap.c, fs/proc/task_mmu.c, and drivers/infiniband/core/uverbs_main.c. (bnc#1133738)
• CVE-2019-12817: Linux kernel for powerpc had a bug where unrelated processes could be able to read/write to one another's virtual memory under certain conditions via an mmap above 512 TB. Only a subset of powerpc systems are affected. (bsc#1138263, bsc#1139619)
• CVE-2019-12614: In dlpar_parse_cc_property there was an unchecked kstrdup of prop->name, which might have allowed an attacker to cause a denial of service (NULL pointer dereference and system crash). (bsc#1137194)
• CVE-2018-16871: An attacker, who was able to mount an exported NFS filesystem, was able to trigger a null pointer dereference by using an invalid NFS sequence. This could panic the machine and deny access to the NFS server. (bsc#1137103)
• CVE-2019-12819: An issue was discovered in the Linux kernel The function…

The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-20855: An issue was discovered in the Linux kernel In create_qp_common in drivers/infiniband/hw/mlx5/qp.c, mlx5_ib_create_qp_resp was never initialized, resulting in a leak of stack memory to userspace(bsc#1143045).
• CVE-2019-1125: Exclude ATOMs from speculation through SWAPGS (bsc#1139358).
• CVE-2019-14283: In the Linux kernel, set_geometry in drivers/block/floppy.c did not validate the sect and head fields, as demonstrated by an integer overflow and out-of-bounds read. It could be triggered by an unprivileged local user when a floppy disk was inserted. NOTE: QEMU creates the floppy device by default. (bnc#1143191)
• CVE-2019-11810: An issue was discovered in the Linux kernel A NULL pointer dereference could occur when megasas_create_frame_pool() failed in megasas_alloc_cmds() in drivers/scsi/megaraid/megaraid_sas_base.c. This caused a Denial of Service, related to a use-after-free (bnc#1134399).
• CVE-2019-13648: In the Linux kernel on the powerpc platform, when hardware transactional memory was disabled, a local user could cause a denial of service (TM Bad Thing exception and system crash) via a sigreturn() system call that sent a crafted signal frame. (bnc#1142254)
• CVE-2019-13631: In parse_hid_report_descriptor in drivers/input/tablet/gtco.c in the Linux kernel, a malicious USB device could send an HID report that triggered an out-of-bounds write during generation of debugging messages. (bnc#1142023)

The following non-security bugs were fixed:

• Correct the CVE and bug reference for a floppy security fix (CVE-2019-14284,bsc#1143189) A dedicated CVE was already assigned
• acpi/nfit: Always dump _DSM output payload (bsc#1142351).
• Add back sibling paca poiter to paca (bsc#1055117).
• Add support for crct10dif-vpmsum ().
• af_unix: remove redundant lockdep class (git-fixes).
• alsa: compress: Be more restrictive about when a drain is allowed (bsc#1051510).
• alsa: compress: Do not allow paritial drain operations on capture streams (bsc#1051510).
• alsa: compress: Fix regression on compressed capture streams (bsc#1051510).
• alsa: compress: Prevent bypasses of set_params (bsc#1051510).
• alsa: hda - Add a conexant codec entry to let mute led work (bsc#1051510).
• alsa: hda - Do not resume forcibly i915 HDMI/DP codec (bsc#1111666).
• alsa: hda - Fix intermittent CORB/RIRB stall on Intel chips (bsc#1111666).
• alsa: hda/hdmi - Fix i915 reverse port/pin mapping (bsc#1111666).
• alsa: hda/hdmi - Remove duplicated define (bsc#1111666).
• alsa: hda - Optimize resume for codecs without jack detection (bsc#1111666).
• alsa: hda/realtek: apply ALC891 headset fixup to one Dell machine (bsc#1051510).
• alsa: hda/realtek - Fixed Headphone Mic can't record on Dell platform (bsc#1051510).
• alsa: hda/realtek - Headphone Mic can't record after S3 (bsc#1051510).
• alsa: line6: Fix a typo (bsc#1051510).
• alsa: line6: Fix wrong altsetting for LINE6_PODHD500_1 (bsc#1051510).
• alsa: seq: Break too long mutex context in the write loop (bsc#1051510).
• alsa: usb-audio: Add quirk for Focusrite Scarlett Solo (bsc#1051510).
• alsa: usb-audio: Add quirk for MOTU MicroBook II (bsc#1051510).
• alsa: usb-audio: Cleanup DSD whitelist (bsc#1051510).
• alsa: usb-audio: Enable .product_name override for Emagic, Unitor 8 (bsc#1051510).
• alsa: usb-audio: fix Line6 Helix audio format rates (bsc#1111666).
• alsa: usb-audio: Sanity checks for each pipe and EP types (bsc#1051510).
• arm64: do not override dma_max_pfn (jsc#SLE-6197 bsc#1140559 LTC#173150).
• asoc : cs4265 : readable register too low (bsc#1051510).
• asoc: max98090: remove 24-bit format support if RJ is 0 (bsc#1051510).
• asoc: soc-pcm: BE dai needs prepare when pause release after resume (bsc#1051510).
• ath10k: add missing error handling (bsc#1111666).
• ath10k: add peer id check in ath10k_peer_find_by_id (bsc#1111666).
• ath10k: destroy…

The SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-20855: An issue was discovered in the Linux kernel In create_qp_common in drivers/infiniband/hw/mlx5/qp.c, mlx5_ib_create_qp_resp was never initialized, resulting in a leak of stack memory to userspace(bsc#1143045).
• CVE-2019-1125: Exclude ATOMs from speculation through SWAPGS (bsc#1139358).
• CVE-2019-14283: In the Linux kernel, set_geometry in drivers/block/floppy.c did not validate the sect and head fields, as demonstrated by an integer overflow and out-of-bounds read. It could be triggered by an unprivileged local user when a floppy disk was inserted. NOTE: QEMU creates the floppy device by default. (bnc#1143191)
• CVE-2019-11810: An issue was discovered in the Linux kernel A NULL pointer dereference could occur when megasas_create_frame_pool() failed in megasas_alloc_cmds() in drivers/scsi/megaraid/megaraid_sas_base.c. This caused a Denial of Service, related to a use-after-free (bnc#1134399).
• CVE-2019-13648: In the Linux kernel on the powerpc platform, when hardware transactional memory was disabled, a local user could cause a denial of service (TM Bad Thing exception and system crash) via a sigreturn() system call that sent a crafted signal frame. (bnc#1142254)
• CVE-2019-13631: In parse_hid_report_descriptor in drivers/input/tablet/gtco.c in the Linux kernel, a malicious USB device could send an HID report that triggered an out-of-bounds write during generation of debugging messages. (bnc#1142023)

The following non-security bugs were fixed:

• Correct the CVE and bug reference for a floppy security fix (CVE-2019-14284,bsc#1143189) A dedicated CVE was already assigned
• acpi/nfit: Always dump _DSM output payload (bsc#1142351).
• Add back sibling paca poiter to paca (bsc#1055117).
• Add support for crct10dif-vpmsum ().
• af_unix: remove redundant lockdep class (git-fixes). alsa: compress: Be more restrictive about when a drain is allowed (bsc#1051510).
• alsa: compress: Do not allow paritial drain operations on capture streams (bsc#1051510).
• alsa: compress: Fix regression on compressed capture streams (bsc#1051510).
• alsa: compress: Prevent bypasses of set_params (bsc#1051510).
• alsa: hda - Add a conexant codec entry to let mute led work (bsc#1051510).
• alsa: hda/realtek: apply ALC891 headset fixup to one Dell machine (bsc#1051510).
• alsa: hda/realtek - Fixed Headphone Mic can't record on Dell platform (bsc#1051510).
• alsa: hda/realtek - Headphone Mic can't record after S3 (bsc#1051510).
• alsa: line6: Fix a typo (bsc#1051510).
• alsa: line6: Fix wrong altsetting for LINE6_PODHD500_1 (bsc#1051510).
• alsa: seq: Break too long mutex context in the write loop (bsc#1051510).
• alsa: usb-audio: Add quirk for Focusrite Scarlett Solo (bsc#1051510).
• alsa: usb-audio: Add quirk for MOTU MicroBook II (bsc#1051510).
• alsa: usb-audio: Cleanup DSD whitelist (bsc#1051510).
• alsa: usb-audio: Enable .product_name override for Emagic, Unitor 8 (bsc#1051510).
• alsa: usb-audio: Sanity checks for each pipe and EP types (bsc#1051510).
• asoc : cs4265 : readable register too low (bsc#1051510).
• asoc: max98090: remove 24-bit format support if RJ is 0 (bsc#1051510).
• asoc: soc-pcm: BE dai needs prepare when pause release after resume (bsc#1051510).
• ath6kl: add some bounds checking (bsc#1051510).
• batman-adv: fix for leaked TVLV handler (bsc#1051510).
• bcache: acquire bch_register_lock later in cached_dev_detach_finish() (bsc#1140652).
• bcache: acquire bch_register_lock later in cached_dev_free() (bsc#1140652).
• bcache: add code comments for journal_read_bucket() (bsc#1140652).
• bcache: Add comments for blkdev_put() in registration code path (bsc#1140652).
• bcache: add comments for closure_fn to be called in closure_queue() (bsc#1140652).
• bcache: add comments for kobj release callback routine (bsc#1140652).
• bcache: add comments for mutex_lock(&b->write_lock)…

The SUSE Linux Enterprise 12 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-20855: An issue was discovered in the Linux kernel In create_qp_common in drivers/infiniband/hw/mlx5/qp.c, mlx5_ib_create_qp_resp was never initialized, resulting in a leak of stack memory to userspace(bsc#1143045).
• CVE-2019-1125: Exclude ATOMs from speculation through SWAPGS (bsc#1139358).
• CVE-2019-14283: In the Linux kernel, set_geometry in drivers/block/floppy.c did not validate the sect and head fields, as demonstrated by an integer overflow and out-of-bounds read. It could be triggered by an unprivileged local user when a floppy disk was inserted. NOTE: QEMU creates the floppy device by default. (bnc#1143191)
• CVE-2019-11810: An issue was discovered in the Linux kernel A NULL pointer dereference could occur when megasas_create_frame_pool() failed in megasas_alloc_cmds() in drivers/scsi/megaraid/megaraid_sas_base.c. This caused a Denial of Service, related to a use-after-free (bnc#1134399).
• CVE-2019-13648: In the Linux kernel on the powerpc platform, when hardware transactional memory was disabled, a local user could cause a denial of service (TM Bad Thing exception and system crash) via a sigreturn() system call that sent a crafted signal frame. (bnc#1142254)
• CVE-2019-13631: In parse_hid_report_descriptor in drivers/input/tablet/gtco.c in the Linux kernel, a malicious USB device could send an HID report that triggered an out-of-bounds write during generation of debugging messages. (bnc#1142023)

The following non-security bugs were fixed:

• Correct the CVE and bug reference for a floppy security fix (CVE-2019-14284,bsc#1143189) A dedicated CVE was already assigned
• acpi/nfit: Always dump _DSM output payload (bsc#1142351).
• Add back sibling paca poiter to paca (bsc#1055117).
• Add support for crct10dif-vpmsum ().
• af_unix: remove redundant lockdep class (git-fixes).
• alsa: compress: Be more restrictive about when a drain is allowed (bsc#1051510).
• alsa: compress: Do not allow paritial drain operations on capture streams (bsc#1051510).
• alsa: compress: Fix regression on compressed capture streams (bsc#1051510).
• alsa: compress: Prevent bypasses of set_params (bsc#1051510).
• alsa: hda - Add a conexant codec entry to let mute led work (bsc#1051510).
• alsa: hda/realtek: apply ALC891 headset fixup to one Dell machine (bsc#1051510).
• alsa: hda/realtek - Fixed Headphone Mic can't record on Dell platform (bsc#1051510).
• alsa: hda/realtek - Headphone Mic can't record after S3 (bsc#1051510).
• alsa: line6: Fix a typo (bsc#1051510).
• alsa: line6: Fix wrong altsetting for LINE6_PODHD500_1 (bsc#1051510).
• alsa: seq: Break too long mutex context in the write loop (bsc#1051510).
• alsa: usb-audio: Add quirk for Focusrite Scarlett Solo (bsc#1051510).
• alsa: usb-audio: Add quirk for MOTU MicroBook II (bsc#1051510).
• alsa: usb-audio: Cleanup DSD whitelist (bsc#1051510).
• alsa: usb-audio: Enable .product_name override for Emagic, Unitor 8 (bsc#1051510).
• alsa: usb-audio: Sanity checks for each pipe and EP types (bsc#1051510).
• asoc : cs4265 : readable register too low (bsc#1051510).
• asoc: max98090: remove 24-bit format support if RJ is 0 (bsc#1051510).
• asoc: soc-pcm: BE dai needs prepare when pause release after resume (bsc#1051510).
• ath6kl: add some bounds checking (bsc#1051510).
• batman-adv: fix for leaked TVLV handler (bsc#1051510).
• bcache: acquire bch_register_lock later in cached_dev_detach_finish() (bsc#1140652).
• bcache: acquire bch_register_lock later in cached_dev_free() (bsc#1140652).
• bcache: add code comments for journal_read_bucket() (bsc#1140652).
• bcache: Add comments for blkdev_put() in registration code path (bsc#1140652).
• bcache: add comments for closure_fn to be called in closure_queue() (bsc#1140652).
• bcache: add comments for kobj release callback routine (bsc#1140652).
• bcache: add comments for mutex_lock(&b->write_lock)…

The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-20855: An issue was discovered in the Linux kernel In create_qp_common in drivers/infiniband/hw/mlx5/qp.c, mlx5_ib_create_qp_resp was never initialized, resulting in a leak of stack memory to userspace(bsc#1143045).
• CVE-2019-1125: Exclude ATOMs from speculation through SWAPGS (bsc#1139358).
• CVE-2019-14283: In the Linux kernel, set_geometry in drivers/block/floppy.c did not validate the sect and head fields, as demonstrated by an integer overflow and out-of-bounds read. It could be triggered by an unprivileged local user when a floppy disk was inserted. NOTE: QEMU creates the floppy device by default. (bnc#1143191)
• CVE-2019-11810: An issue was discovered in the Linux kernel A NULL pointer dereference could occur when megasas_create_frame_pool() failed in megasas_alloc_cmds() in drivers/scsi/megaraid/megaraid_sas_base.c. This caused a Denial of Service, related to a use-after-free (bnc#1134399).
• CVE-2019-13648: In the Linux kernel on the powerpc platform, when hardware transactional memory was disabled, a local user could cause a denial of service (TM Bad Thing exception and system crash) via a sigreturn() system call that sent a crafted signal frame. (bnc#1142254)
• CVE-2019-13631: In parse_hid_report_descriptor in drivers/input/tablet/gtco.c in the Linux kernel, a malicious USB device could send an HID report that triggered an out-of-bounds write during generation of debugging messages. (bnc#1142023)

The following non-security bugs were fixed:

• acpi/nfit: Always dump _DSM output payload (bsc#1142351).
• Add back sibling paca poiter to paca (bsc#1055117).
• Add support for crct10dif-vpmsum ().
• af_unix: remove redundant lockdep class (git-fixes).
• alsa: compress: Be more restrictive about when a drain is allowed (bsc#1051510).
• alsa: compress: Do not allow paritial drain operations on capture streams (bsc#1051510).
• alsa: compress: Fix regression on compressed capture streams (bsc#1051510).
• alsa: compress: Prevent bypasses of set_params (bsc#1051510).
• alsa: hda - Add a conexant codec entry to let mute led work (bsc#1051510).
• alsa: hda - Do not resume forcibly i915 HDMI/DP codec (bsc#1111666).
• alsa: hda - Fix intermittent CORB/RIRB stall on Intel chips (bsc#1111666).
• alsa: hda/hdmi - Fix i915 reverse port/pin mapping (bsc#1111666).
• alsa: hda/hdmi - Remove duplicated define (bsc#1111666).
• alsa: hda - Optimize resume for codecs without jack detection (bsc#1111666).
• alsa: hda/realtek: apply ALC891 headset fixup to one Dell machine (bsc#1051510).
• alsa: hda/realtek - Fixed Headphone Mic can't record on Dell platform (bsc#1051510).
• alsa: hda/realtek - Headphone Mic can't record after S3 (bsc#1051510).
• alsa: line6: Fix a typo (bsc#1051510).
• alsa: line6: Fix wrong altsetting for LINE6_PODHD500_1 (bsc#1051510).
• alsa: seq: Break too long mutex context in the write loop (bsc#1051510).
• alsa: usb-audio: Add quirk for Focusrite Scarlett Solo (bsc#1051510).
• alsa: usb-audio: Add quirk for MOTU MicroBook II (bsc#1051510).
• alsa: usb-audio: Cleanup DSD whitelist (bsc#1051510).
• alsa: usb-audio: Enable .product_name override for Emagic, Unitor 8 (bsc#1051510).
• alsa: usb-audio: fix Line6 Helix audio format rates (bsc#1111666).
• alsa: usb-audio: Sanity checks for each pipe and EP types (bsc#1051510).
• arm64: do not override dma_max_pfn (jsc#SLE-6197 bsc#1140559 LTC#173150).
• asoc : cs4265 : readable register too low (bsc#1051510).
• asoc: max98090: remove 24-bit format support if RJ is 0 (bsc#1051510).
• asoc: soc-pcm: BE dai needs prepare when pause release after resume (bsc#1051510).
• ath10k: add missing error handling (bsc#1111666).
• ath10k: add peer id check in ath10k_peer_find_by_id (bsc#1111666).
• ath10k: destroy sdio workqueue while remove sdio module (bsc#1111666).
• ath10k: Do not send probe response template for mesh (bsc#1111666). -…

The SUSE Linux Enterprise 12 SP1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2019-1125: Enable Spectre v1 swapgs mitigations (bsc#1139358).
• CVE-2018-20855: An issue was discovered in create_qp_common in drivers/infiniband/hw/mlx5/qp.c, mlx5_ib_create_qp_resp was never initialized, resulting in a leak of stack memory to userspace (bsc#1143045).
• CVE-2019-14284: The drivers/block/floppy.c allowed a denial of service by setup_format_params division-by-zero. Two consecutive ioctls can trigger the bug: the first one should set the drive geometry with .sect and .rate values that make F_SECT_PER_TRACK be zero. Next, the floppy format operation should be called. It can be triggered by an unprivileged local user even when a floppy disk has not been inserted. NOTE: QEMU creates the floppy device by default (bsc#1143189).
• CVE-2019-14283: The function set_geometry in drivers/block/floppy.c did not validate the sect and head fields, as demonstrated by an integer overflow and out-of-bounds read. It can be triggered by an unprivileged local user when a floppy disk has been inserted. NOTE: QEMU creates the floppy device by default (bsc#1143191).
• CVE-2019-11810: A NULL pointer dereference can occur when megasas_create_frame_pool() fails in megasas_alloc_cmds() in drivers/scsi/megaraid/megaraid_sas_base.c. This causes a Denial of Service, related to a use-after-free (bsc#1134399).
• CVE-2019-13648: In the Linux kernel on the powerpc platform, when hardware transactional memory is disabled, a local user can cause a denial of service (TM Bad Thing exception and system crash) via a sigreturn() system call that sends a crafted signal frame. This affects arch/powerpc/kernel/signal_32.c and arch/powerpc/kernel/signal_64.c (bnc#1142254).
• CVE-2019-13631: In parse_hid_report_descriptor in drivers/input/tablet/gtco.c, a malicious USB device can send an HID report that triggers an out-of-bounds write during generation of debugging messages (bsc#1142023).

The following non-security bugs were fixed:

• bcache: Revert 'bcache: fix high CPU occupancy during journal' (bsc#1140652, bsc#1144288).
• bcache: Revert 'bcache: free heap cache_set->flush_btree in bch_journal_free' (bsc#1140652, bsc#1144288).
• bcache: add reclaimed_journal_buckets to struct cache_set (bsc#1140652, bsc#1144288).
• bcache: fix race in btree_flush_write() (bsc#1140652, bsc#1144288).
• bcache: fix stack corruption by PRECEDING_KEY() (bsc#1130972, bsc#1144257).
• bcache: only set BCACHE_DEV_WB_RUNNING when cached device attached (bsc#1130972, bsc#1144273).
• bcache: performance improvement for btree_flush_write() (bsc#1140652, bsc#1144288).
• bcache: remove retry_flush_write from struct cache_set (bsc#1140652, bsc#1144288).
• mm: check VMA flags to avoid invalid PROT_NONE NUMA balancing (bsc#1142098).
• powerpc/watchpoint: Restore NV GPRs while returning from exception (bsc#1140945, bsc#1141401, bsc#1141402, bsc#1141452, bsc#1141453, bsc#1141454).
• xen-netfront: use napi_complete() correctly to prevent Rx stalling (bsc#1138744).

The SUSE Linux Enterprise 12 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2019-1125: Enable Spectre v1 swapgs mitigations (bsc#1139358).
• CVE-2018-20855: An issue was discovered in create_qp_common in drivers/infiniband/hw/mlx5/qp.c, mlx5_ib_create_qp_resp was never initialized, resulting in a leak of stack memory to userspace (bsc#1143045).
• CVE-2019-14284: The drivers/block/floppy.c allowed a denial of service by setup_format_params division-by-zero. Two consecutive ioctls can trigger the bug: the first one should set the drive geometry with .sect and .rate values that make F_SECT_PER_TRACK be zero. Next, the floppy format operation should be called. It can be triggered by an unprivileged local user even when a floppy disk has not been inserted. NOTE: QEMU creates the floppy device by default (bsc#1143189).
• CVE-2019-14283: The function set_geometry in drivers/block/floppy.c did not validate the sect and head fields, as demonstrated by an integer overflow and out-of-bounds read. It can be triggered by an unprivileged local user when a floppy disk has been inserted. NOTE: QEMU creates the floppy device by default (bsc#1143191).
• CVE-2019-11810: A NULL pointer dereference can occur when megasas_create_frame_pool() fails in megasas_alloc_cmds() in drivers/scsi/megaraid/megaraid_sas_base.c. This causes a Denial of Service, related to a use-after-free (bsc#1134399).
• CVE-2019-13648: In the Linux kernel on the powerpc platform, when hardware transactional memory is disabled, a local user can cause a denial of service (TM Bad Thing exception and system crash) via a sigreturn() system call that sends a crafted signal frame. This affects arch/powerpc/kernel/signal_32.c and arch/powerpc/kernel/signal_64.c (bnc#1142254).
• CVE-2019-13631: In parse_hid_report_descriptor in drivers/input/tablet/gtco.c, a malicious USB device can send an HID report that triggers an out-of-bounds write during generation of debugging messages (bsc#1142023).
• CVE-2019-15118: Fixed kernel stack exhaustion in check_input_term in sound/usb/mixer.c via mishandled recursion (bnc#1145922).
• CVE-2019-15117: Fixed out-of-bounds memory access in parse_audio_mixer_unit in sound/usb/mixer.c via mishandled short descriptor (bnc#1145920).
• CVE-2019-3819: A flaw was fixed in the function hid_debug_events_read() in drivers/hid/hid-debug.c file which may have enter an infinite loop with certain parameters passed from a userspace. A local privileged user ('root') could have caused a system lock up and a denial of service (bnc#1123161).
• CVE-2019-10207: Check for missing tty operations in bluetooth/hci_uart (bsc#1142857).
• CVE-2018-20856: Fixed a use-after-free issue in block/blk-core.c, where certain error case are mishandled (bnc#1143048).

The following non-security bugs were fixed:

• cifs: do not log STATUS_NOT_FOUND errors for DFS (bsc#1125674).
• dlm: Fix saving of NULL callbacks (bsc#1135365).
• bcache: Revert 'bcache: fix high CPU occupancy during journal' (bsc#1140652, bsc#1144288).
• bcache: Revert 'bcache: free heap cache_set->flush_btree in bch_journal_free' (bsc#1140652, bsc#1144288).
• bcache: add reclaimed_journal_buckets to struct cache_set (bsc#1140652, bsc#1144288).
• bcache: fix race in btree_flush_write() (bsc#1140652, bsc#1144288).
• bcache: fix stack corruption by PRECEDING_KEY() (bsc#1130972, bsc#1144257).
• bcache: only set BCACHE_DEV_WB_RUNNING when cached device attached (bsc#1130972, bsc#1144273).
• bcache: performance improvement for btree_flush_write() (bsc#1140652, bsc#1144288).
• bcache: remove retry_flush_write from struct cache_set (bsc#1140652, bsc#1144288).
• bonding: Force slave speed check after link state recovery for 802.3ad (bsc#1137584).
• clocksource: Defer override invalidation unless clock is unstable (bsc#1139826).
• kvm: mmu: Fix overflow on kvm mmu page limit calculation (bsc#1135335).
• kvmclock: fix TSC calibration for nested guests (bsc#1133860,…

The SUSE Linux Enterprise 12 SP2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2019-3819: A flaw was fixed in the function hid_debug_events_read() in drivers/hid/hid-debug.c file which may have enter an infinite loop with certain parameters passed from a userspace. A local privileged user ('root') could have caused a system lock up and a denial of service (bnc#1123161).
• CVE-2019-15118: Fixed kernel stack exhaustion in check_input_term in sound/usb/mixer.c via mishandled recursion (bnc#1145922).
• CVE-2019-15117: Fixed out-of-bounds memory access in parse_audio_mixer_unit in sound/usb/mixer.c via mishandled short descriptor (bnc#1145920).
• CVE-2019-14284: The drivers/block/floppy.c allowed a denial of service by setup_format_params division-by-zero. Two consecutive ioctls can trigger the bug: the first one should set the drive geometry with .sect and .rate values that make F_SECT_PER_TRACK be zero. Next, the floppy format operation should be called. It can be triggered by an unprivileged local user even when a floppy disk has not been inserted. NOTE: QEMU creates the floppy device by default (bsc#1143189).
• CVE-2019-14283: The function set_geometry in drivers/block/floppy.c did not validate the sect and head fields, as demonstrated by an integer overflow and out-of-bounds read. It can be triggered by an unprivileged local user when a floppy disk has been inserted. NOTE: QEMU creates the floppy device by default (bsc#1143191).
• CVE-2019-13631: In parse_hid_report_descriptor in drivers/input/tablet/gtco.c, a malicious USB device can send an HID report that triggers an out-of-bounds write during generation of debugging messages (bsc#1142023).
• CVE-2019-11810: A NULL pointer dereference can occur when megasas_create_frame_pool() fails in megasas_alloc_cmds() in drivers/scsi/megaraid/megaraid_sas_base.c. This causes a Denial of Service, related to a use-after-free (bsc#1134399).
• CVE-2019-1125: Enable Spectre v1 swapgs mitigations (bsc#1139358).
• CVE-2019-10207: Check for missing tty operations in bluetooth/hci_uart (bsc#1142857).
• CVE-2018-20856: Fixed a use-after-free issue in block/blk-core.c, where certain error case are mishandled (bnc#1143048).
• CVE-2018-20855: An issue was discovered in create_qp_common in drivers/infiniband/hw/mlx5/qp.c, mlx5_ib_create_qp_resp was never initialized, resulting in a leak of stack memory to userspace (bsc#1143045).
• CVE-2017-18551: An issue was discovered in drivers/i2c/i2c-core-smbus.c in the Linux kernel There was an out of bounds write in the function i2c_smbus_xfer_emulated (bnc#1146163).

The following non-security bugs were fixed:

• bcache: add reclaimed_journal_buckets to struct cache_set (bsc#1140652, bsc#1144288).
• bcache: fix race in btree_flush_write() (bsc#1140652, bsc#1144288).
• bcache: fix stack corruption by PRECEDING_KEY() (bsc#1130972, bsc#1144257).
• bcache: only set BCACHE_DEV_WB_RUNNING when cached device attached (bsc#1130972, bsc#1144273).
• bcache: performance improvement for btree_flush_write() (bsc#1140652, bsc#1144288).
• bcache: remove retry_flush_write from struct cache_set (bsc#1140652, bsc#1144288).
• btrfs: improve delayed refs iterations (bsc#1076033, bsc#1107256).
• i40e: add functions to control default VSI (bsc#1141628).
• i40e: set default VSI without a reset (bsc#1141628).
• mm: check VMA flags to avoid invalid PROT_NONE NUMA balancing (bsc#1142098).
• nfs: Fix the inode request accounting when pages have subrequests (bsc#1140012).
• powerpc/watchpoint: Restore NV GPRs while returning from exception (bsc#1140945,bsc#1141401,bsc#1141402,bsc#1141452,bsc#1141453,bsc#1141454).
• qib/hfi1: Fix MR reference count leak on write with immediate (bsc#1045640).
• sched/fair: Do not free p->numa_faults with concurrent readers (bsc#1144920).
• sched/fair: Use RCU accessors consistently for ->numa_group (bsc#1144920).
• x86, mm: fix fast GUP with hyper-based TLB flushing (VM Functionality,…

The SUSE Linux Enterprise 15 SP1 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-12126 CVE-2018-12127 CVE-2018-12130: Microarchitectural Store Buffer Data Sampling (MSBDS): Stored buffers on some microprocessors utilizing speculative execution which may have allowed an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-update-guidance_05132019. (bsc#1103186)
• CVE-2019-11091: Microarchitectural Data Sampling Uncacheable Memory (MDSUM): Uncacheable memory on some microprocessors utilizing speculative execution may have allowed an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-update-guidance_05132019. (bsc#1111331)
• CVE-2019-12382: An issue was discovered in drm_load_edid_firmware in drivers/gpu/drm/drm_edid_load.c in the Linux kernel There was an unchecked kstrdup of fwstr, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash). (bsc#1136586)
• CVE-2019-10124: An issue was discovered in the hwpoison implementation in mm/memory-failure.c in the Linux kernel. When soft_offline_in_use_page() runs on a thp tail page after pmd is split, an attacker could cause a denial of service (bsc#1130699).
• CVE-2019-11486: The Siemens R3964 line discipline driver in drivers/tty/n_r3964.c in the Linux kernel has multiple race conditions. (bsc#1133188)
• CVE-2019-11811: An issue was discovered in the Linux kernel There was a use-after-free upon attempted read access to /proc/ioports after the ipmi_si module was removed, related to drivers/char/ipmi/ipmi_si_intf.c, drivers/char/ipmi/ipmi_si_mem_io.c, and drivers/char/ipmi/ipmi_si_port_io.c. (bsc#1134397)
• CVE-2019-11487: The Linux kernel allowed page reference count overflow, with resultant use-after-free issues, if about 140 GiB of RAM exists. This is related to fs/fuse/dev.c, fs/pipe.c, fs/splice.c, include/linux/mm.h, include/linux/pipe_fs_i.h, kernel/trace/trace.c, mm/gup.c, and mm/hugetlb.c. It could occur with FUSE requests. (bsc#1133190)
• CVE-2019-12818: The nfc_llcp_build_tlv function in net/nfc/llcp_commands.c may return NULL. If the caller does not check for this, it will trigger a NULL pointer dereference. This will cause denial of service. This used to affect nfc_llcp_build_gb in net/nfc/llcp_core.c. (bsc#1138293)
• CVE-2019-11833: fs/ext4/extents.c in the Linux kernel did not zero out the unused memory region in the extent tree block, which might allow local users to obtain sensitive information by reading uninitialized data in the filesystem. (bsc#1135281)
• CVE-2019-5489: The mincore() implementation in mm/mincore.c in the Linux kernel allowed local attackers to observe page cache access patterns of other processes on the same system, potentially allowing sniffing of secret information. (Fixing this affects the output of the fincore program.) Limited remote exploitation may be possible, as demonstrated by latency differences in accessing public files from an Apache HTTP Server. (bsc#1120843)
• CVE-2018-7191: In the tun subsystem in the Linux kernel, dev_get_valid_name was not called before register_netdevice. This allowed local users to cause a denial of service (NULL pointer dereference and panic) via an ioctl(TUNSETIFF) call with a dev name containing a / character. (bsc#1135603)
• CVE-2019-11884: The do_hidp_sock_ioctl function in net/bluetooth/hidp/sock.c in the Linux kernel allowed a local user to obtain potentially sensitive information from kernel stack memory via a hidPCONNADD command, because a name field may not end with a '\0' character. (bsc#1134848) -…

The SUSE Linux Enterprise Server 12 SP4 Realtime Kernel was updated to fix bugs and security issues.

Security issues fixed:

• CVE-2019-12614: An issue was discovered in dlpar_parse_cc_property in arch/powerpc/platforms/pseries/dlpar.c. There was an unchecked kstrdup of prop->name, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash) (bnc#1137194).
• CVE-2018-16871: A NULL pointer dereference due to an anomalized NFS message sequence was fixed. (bnc#1137103).
• CVE-2018-20836: There was a race condition in smp_task_timedout() and smp_task_done() in drivers/scsi/libsas/sas_expander.c, leading to a use-after-free (bnc#1134395).
• CVE-2019-3846: A flaw that allowed an attacker to corrupt memory and possibly escalate privileges was found in the mwifiex kernel module while connecting to a malicious wireless network (bnc#1136424).
• CVE-2018-20855: An issue was discovered in create_qp_common in drivers/infiniband/hw/mlx5/qp.c, mlx5_ib_create_qp_resp was never initialized, resulting in a leak of stack memory to userspace (bsc#1143045).
• CVE-2019-11810: A NULL pointer dereference can occur when megasas_create_frame_pool() fails in megasas_alloc_cmds() in drivers/scsi/megaraid/megaraid_sas_base.c. This causes a Denial of Service, related to a use-after-free (bsc#1134399).
• CVE-2019-14283: The function set_geometry in drivers/block/floppy.c did not validate the sect and head fields, as demonstrated by an integer overflow and out-of-bounds read. It can be triggered by an unprivileged local user when a floppy disk has been inserted. NOTE: QEMU creates the floppy device by default (bsc#1143191).
• CVE-2019-14284: The drivers/block/floppy.c allowed a denial of service by setup_format_params division-by-zero. Two consecutive ioctls can trigger the bug: the first one should set the drive geometry with .sect and .rate values that make F_SECT_PER_TRACK be zero. Next, the floppy format operation should be called. It can be triggered by an unprivileged local user even when a floppy disk has not been inserted. NOTE: QEMU creates the floppy device by default (bsc#1143189).
• CVE-2019-13631: In parse_hid_report_descriptor in drivers/input/tablet/gtco.c, a malicious USB device can send an HID report that triggers an out-of-bounds write during generation of debugging messages (bsc#1142023).
• CVE-2019-1125: Enable Spectre v1 mitigations for SWAPGS (bsc#1139358).
• CVE-2019-10126: A flaw was found in the Linux kernel that might lead to memory corruption in the marvell mwifiex driver. (bnc#1136935)
• CVE-2019-10638: In the Linux kernel, a device could be tracked by an attacker using the IP ID values the kernel produces for connection-less protocols (e.g., UDP and ICMP). When such traffic was sent to multiple destination IP addresses, it was possible to obtain hash collisions (of indices to the counter array) and thereby obtain the hashing key (via enumeration). An attack may be conducted by hosting a crafted web page that uses WebRTC or gQUIC to force UDP traffic to attacker-controlled IP addresses. (bnc#1140575)
• CVE-2019-10639: The Linux kernel allowed Information Exposure (partial kernel address disclosure), leading to a KASLR bypass. Specifically, it was possible to extract the KASLR kernel image offset using the IP ID values the kernel produces for connection-less protocols (e.g., UDP and ICMP). When such traffic was sent to multiple destination IP addresses, it was possible to obtain hash collisions (of indices to the counter array) and thereby obtain the hashing key (via enumeration). This key contains enough bits from a kernel address (of a static variable) so when the key was extracted (via enumeration), the offset of the kernel image is exposed. This attack can be carried out remotely, by the attacker forcing the target device to send UDP or ICMP (or certain other) traffic to attacker-controlled IP addresses. Forcing a server to send UDP traffic is trivial if the server is a DNS server.…