CVE-2020-11668

In the Linux kernel before 5.6.1, drivers/media/usb/gspca/xirlink_cit.c (aka the Xirlink camera USB driver) mishandles invalid descriptors, aka CID-a246b4d54770.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: use after free in the video driver leads to local privilege escalation (CVE-2019-9458)

• kernel: use-after-free in drivers/bluetooth/hci_ldisc.c (CVE-2019-15917)

• kernel: out-of-bounds access in function hclge_tm_schd_mode_vnet_base_cfg (CVE-2019-15925)

• kernel: memory leak in ccp_run_sha_cmd() (CVE-2019-18808)

• kernel: Denial Of Service in the __ipmi_bmc_register() (CVE-2019-19046)

• kernel: out-of-bounds write in ext4_xattr_set_entry (CVE-2019-19319)

• Kernel: kvm: OOB memory write via kvm_dev_ioctl_get_cpuid (CVE-2019-19332)

• kernel: use-after-free in ext4_put_super (CVE-2019-19447)

• kernel: a malicious USB device in the drivers/input/ff-memless.c leads to use-after-free (CVE-2019-19524)

• kernel: race condition caused by a malicious USB device in the USB character device driver layer (CVE-2019-19537)

• kernel: use-after-free in serial_ir_init_module() (CVE-2019-19543)

• kernel: use-after-free in __ext4_expand_extra_isize and ext4_xattr_set_entry (CVE-2019-19767)

• kernel: use-after-free in debugfs_remove (CVE-2019-19770)

• kernel: out-of-bounds write via crafted keycode table (CVE-2019-20636)

• kernel: possible use-after-free due to a race condition in cdev_get (CVE-2020-0305)

• kernel: out-of-bounds read in in vc_do_resize function (CVE-2020-8647)

• kernel: use-after-free in n_tty_receive_buf_common function (CVE-2020-8648)

• kernel: invalid read location in vgacon_invert_region function (CVE-2020-8649)

• kernel: uninitialized kernel data leak in userspace coredumps (CVE-2020-10732)

• kernel: SELinux netlink permission check bypass (CVE-2020-10751)

• kernel: out-of-bounds write in mpol_parse_str (CVE-2020-11565)

• kernel: mishandles invalid descriptors in drivers/media/usb/gspca/xirlink_cit.c (CVE-2020-11668)

• kernel: buffer overflow in mt76_add_fragment function (CVE-2020-12465)

• kernel: xdp_umem_reg in net/xdp/xdp_umem.c has an out-of-bounds write which could result in crash and data coruption (CVE-2020-12659)

• kernel: sg_write function lacks an sg_remove_request call in a certain failure case (CVE-2020-12770)

• kernel: possible to send arbitrary signals to a privileged (suidroot) parent process (CVE-2020-12826)

• kernel: referencing inode of removed superblock in get_futex_key() causes UAF (CVE-2020-14381)

• kernel: soft-lockups in iov_iter_copy_from_user_atomic() could result in DoS (CVE-2020-25641)

• kernel: kernel pointer leak due to WARN_ON statement in video driver leads to local information disclosure (CVE-2019-9455)

• kernel: null pointer dereference in dlpar_parse_cc_property (CVE-2019-12614)

• kernel: null-pointer dereference in drivers/net/fjes/fjes_main.c (CVE-2019-16231)

• kernel: null pointer dereference in drivers/scsi/qla2xxx/qla_os.c (CVE-2019-16233)

• kernel: memory leak in af9005_identify_state() function (CVE-2019-18809)

• kernel: A memory leak in the mwifiex_pcie_alloc_cmdrsp_buf() function (CVE-2019-19056)

• kernel: memory leak in the crypto_report() function (CVE-2019-19062)

• kernel: Two memory leaks in the rtl_usb_probe() function (CVE-2019-19063)

• kernel: A memory leak in the rtl8xxxu_submit_int_urb() function (CVE-2019-19068)

• kernel: A memory leak in the predicate_parse() function (CVE-2019-19072)

• kernel: information leak bug caused by a malicious USB device in the drivers/media/usb/ttusb-dec/ttusb_dec.c (CVE-2019-19533)

• kernel: Null pointer dereference in drop_sysctl_table() (CVE-2019-20054)

• kernel: kernel stack information leak on s390/s390x (CVE-2020-10773)

• kernel: possibility of memory disclosure when reading the file /proc/sys/kernel/rh_features (CVE-2020-10774)

• kernel: vhost-net: stack overflow in get_raw_socket while checking sk_family field (CVE-2020-10942)

• kernel: sync of excessive duration via an XFS v5 image with crafted metadata (CVE-2020-12655)

• drm/vmwgfx: Fix invalid reads in fence signaled events {CVE-2024-36960}
• af_unix: Fix garbage collector racing against connect() {CVE-2024-26923}
• ipv6: remove max_size check inline with ipv4 {CVE-2023-52340}
• aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts {CVE-2023-6270}
• smb: client: fix use-after-free bug in cifs_debug_data_proc_show() {CVE-2023-52752}
• hdlc_ppp: add range checks in ppp_cp_parse_cr() {CVE-2020-25643}
• perf/core: Fix race in the perf_mmap_close() function {CVE-2020-14351}
• media: xirlink_cit: add missing descriptor sanity checks {CVE-2020-11668}
• vt: selection, close sel_buffer race {CVE-2020-8648}
• net: sched: sch_qfq: Fix UAF in qfq_dequeue() {CVE-2023-4921}
• media: pvrusb2: fix use after free on context disconnection {CVE-2023-52445}

• drm/vmwgfx: Fix invalid reads in fence signaled events {CVE-2024-36960}
• af_unix: Fix garbage collector racing against connect() {CVE-2024-26923}
• ipv6: remove max_size check inline with ipv4 {CVE-2023-52340}
• aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts {CVE-2023-6270}
• smb: client: fix use-after-free bug in cifs_debug_data_proc_show() {CVE-2023-52752}
• hdlc_ppp: add range checks in ppp_cp_parse_cr() {CVE-2020-25643}
• perf/core: Fix race in the perf_mmap_close() function {CVE-2020-14351}
• media: xirlink_cit: add missing descriptor sanity checks {CVE-2020-11668}
• vt: selection, close sel_buffer race {CVE-2020-8648}
• net: sched: sch_qfq: Fix UAF in qfq_dequeue() {CVE-2023-4921}
• media: pvrusb2: fix use after free on context disconnection {CVE-2023-52445}

This provides an update to kernel 5.6 series, currently based on upstream 5.6.6 adding support for new hardware and features, and fixes at least the following security issues:

In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image, performing some operations, and unmounting can lead to a use-after-free in btrfs_queue_work in fs/btrfs/async-thread.c (CVE-2019-19377).

An issue was discovered in slc_bump in drivers/net/can/slcan.c in the Linux kernel through 5.6.2. It allows attackers to read uninitialized can_frame data, potentially containing sensitive information from kernel stack memory, if the configuration lacks CONFIG_INIT_STACK_ALL (CVE-2020-11494).

An issue was discovered in the Linux kernel through 5.6.2. mpol_parse_str in mm/mempolicy.c has a stack-based out-of-bounds write because an empty nodelist is mishandled during mount option parsing (CVE-2020-11565).

An issue was discovered in the Linux kernel before 5.6.1. drivers/media/ usb/gspca/ov519.c allows NULL pointer dereferences in ov511_mode_init_regs and ov518_mode_init_regs when there are zero endpoints (CVE-2020-11608).

An issue was discovered in the stv06xx subsystem in the Linux kernel before 5.6.1. drivers/media/usb/gspca/stv06xx/stv06xx.c and drivers/media/ usb/gspca/stv06xx/stv06xx_pb0100.c mishandle invalid descriptors, as demonstrated by a NULL pointer dereference (CVE-2020-11609).

In the Linux kernel before 5.6.1, drivers/media/usb/gspca/xirlink_cit.c (aka the Xirlink camera USB driver) mishandles invalid descriptors (CVE-2020-11668).

xtables-addons has been updated to 4.9 for kernel 5.6 series support.

For other fixes and changes in this update, see the refenced changelogs.

This provides an update to kernel 5.6 series, currently based on upstream 5.6.6 adding support for new hardware and features, and fixes at least the following security issues:

In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image, performing some operations, and unmounting can lead to a use-after-free in btrfs_queue_work in fs/btrfs/async-thread.c (CVE-2019-19377).

An issue was discovered in slc_bump in drivers/net/can/slcan.c in the Linux kernel through 5.6.2. It allows attackers to read uninitialized can_frame data, potentially containing sensitive information from kernel stack memory, if the configuration lacks CONFIG_INIT_STACK_ALL (CVE-2020-11494).

An issue was discovered in the Linux kernel through 5.6.2. mpol_parse_str in mm/mempolicy.c has a stack-based out-of-bounds write because an empty nodelist is mishandled during mount option parsing (CVE-2020-11565).

An issue was discovered in the Linux kernel before 5.6.1. drivers/media/ usb/gspca/ov519.c allows NULL pointer dereferences in ov511_mode_init_regs and ov518_mode_init_regs when there are zero endpoints (CVE-2020-11608).

An issue was discovered in the stv06xx subsystem in the Linux kernel before 5.6.1. drivers/media/usb/gspca/stv06xx/stv06xx.c and drivers/media/ usb/gspca/stv06xx/stv06xx_pb0100.c mishandle invalid descriptors, as demonstrated by a NULL pointer dereference (CVE-2020-11609).

In the Linux kernel before 5.6.1, drivers/media/usb/gspca/xirlink_cit.c (aka the Xirlink camera USB driver) mishandles invalid descriptors (CVE-2020-11668).

For other fixes and changes in this update, see the refenced changelogs.

The openSUSE Leap 15.2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-27835: A use after free in the Linux kernel infiniband hfi1 driver was found in the way user calls Ioctl after open dev file and fork. A local user could use this flaw to crash the system (bnc#1179878).
• CVE-2020-25639: Fixed a NULL pointer dereference via nouveau ioctl (bnc#1176846).
• CVE-2020-28374: In drivers/target/target_core_xcopy.c insufficient identifier checking in the LIO SCSI target code can be used by remote attackers to read or write files via directory traversal in an XCOPY request, aka CID-2896c93811e3. For example, an attack can occur over a network if the attacker has access to one iSCSI LUN. The attacker gains control over file access because I/O operations are proxied via an attacker-selected backstore (bnc#1178372).
• CVE-2020-36158: mwifiex_cmd_802_11_ad_hoc_start in drivers/net/wireless/marvell/mwifiex/join.c might have allowed remote attackers to execute arbitrary code via a long SSID value, aka CID-5c455c5ab332 (bnc#1180559).
• CVE-2020-27825: A use-after-free flaw was found in kernel/trace/ring_buffer.c. There was a race problem in trace_open and resize of cpu buffer running parallely on different cpus, may cause a denial of service problem (DOS). This flaw could even allow a local attacker with special user privilege to a kernel information leak threat (bnc#1179960).
• CVE-2020-0466: In do_epoll_ctl and ep_loop_check_proc of eventpoll.c, there is a possible use after free due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation (bnc#1180031).
• CVE-2020-27068: In the nl80211_policy policy of nl80211.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not required for exploitation (bnc#1180086).
• CVE-2020-0444: In audit_free_lsm_field of auditfilter.c, there is a possible bad kfree due to a logic error in audit_data_to_entry. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation (bnc#1180027).
• CVE-2020-0465: In various methods of hid-multitouch.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation (bnc#1180029).
• CVE-2020-29661: A locking issue was discovered in the tty subsystem of the Linux kernel drivers/tty/tty_jobctrl.c allowed a use-after-free attack against TIOCSPGRP, aka CID-54ffccbf053b (bnc#1179745).
• CVE-2020-29660: A locking inconsistency issue was discovered in the tty subsystem of the Linux kernel drivers/tty/tty_io.c and drivers/tty/tty_jobctrl.c may have allowed a read-after-free attack against TIOCGSID, aka CID-c8bcd9c5be24 (bnc#1179745).
• CVE-2020-27777: A flaw was found in the way RTAS handled memory accesses in userspace to kernel communication. On a locked down (usually due to Secure Boot) guest system running on top of PowerVM or KVM hypervisors (pseries platform) a root like local user could use this flaw to further increase their privileges to that of a running kernel (bnc#1179107).
• CVE-2020-29373: An issue was discovered in fs/io_uring.c in the Linux kernel It unsafely handles the root directory during path lookups, and thus a process inside a mount namespace can escape to unintended filesystem locations, aka CID-ff002b30181d (bnc#1179434).
• CVE-2020-11668: drivers/media/usb/gspca/xirlink_cit.c (aka the Xirlink camera USB driver) mishandled invalid descriptors, aka CID-a246b4d54770 (bnc#1168952).
• CVE-2020-27830: Fixed a NULL-ptr deref bug in spk_ttyio_receive_buf2 (bnc#1179656).
• CVE-2020-29370: An issue was discovered in…

The openSUSE Leap 15.1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-29568: An issue was discovered in Xen through 4.14.x. Some OSes (such as Linux, FreeBSD, and NetBSD) are processing watch events using a single thread. If the events are received faster than the thread is able to handle, they will get queued. As the queue is unbounded, a guest may be able to trigger an OOM in the backend. All systems with a FreeBSD, Linux, or NetBSD (any version) dom0 are vulnerable (bnc#1179508).
• CVE-2020-29569: The Linux kernel PV block backend expects the kernel thread handler to reset ring->xenblkd to NULL when stopped. However, the handler may not have time to run if the frontend quickly toggles between the states connect and disconnect. As a consequence, the block backend may re-use a pointer after it was freed. A misbehaving guest can trigger a dom0 crash by continuously connecting / disconnecting a block frontend. Privilege escalation and information leaks cannot be ruled out. This only affects systems with a Linux blkback (bnc#1179509).
• CVE-2020-25639: Bail out of nouveau_channel_new if channel init fails (bsc#1176846).
• CVE-2020-28374: In drivers/target/target_core_xcopy.c insufficient identifier checking in the LIO SCSI target code can be used by remote attackers to read or write files via directory traversal in an XCOPY request, aka CID-2896c93811e3. For example, an attack can occur over a network if the attacker has access to one iSCSI LUN. The attacker gains control over file access because I/O operations are proxied via an attacker-selected backstore (bnc#1178372 1180676).
• CVE-2020-36158: mwifiex_cmd_802_11_ad_hoc_start in drivers/net/wireless/marvell/mwifiex/join.c might allow remote attackers to execute arbitrary code via a long SSID value, aka CID-5c455c5ab332 (bnc#1180559).
• CVE-2020-27825: A use-after-free flaw was found in kernel/trace/ring_buffer.c. There was a race problem in trace_open and resize of cpu buffer running parallely on different cpus, may cause a denial of service problem (DOS). This flaw could even allow a local attacker with special user privilege to a kernel information leak threat (bnc#1179960).
• CVE-2020-0466: In do_epoll_ctl and ep_loop_check_proc of eventpoll.c, there is a possible use after free due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation (bnc#1180031).
• CVE-2020-27068: In the nl80211_policy policy of nl80211.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not required for exploitation (bnc#1180086).
• CVE-2020-0465: In various methods of hid-multitouch.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation (bnc#1180029).
• CVE-2020-0444: In audit_free_lsm_field of auditfilter.c, there is a possible bad kfree due to a logic error in audit_data_to_entry. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation (bnc#1180027).
• CVE-2020-29660: A locking inconsistency issue was discovered in the tty subsystem of the Linux kernel drivers/tty/tty_io.c and drivers/tty/tty_jobctrl.c may have allowed a read-after-free attack against TIOCGSID, aka CID-c8bcd9c5be24 (bnc#1179745).
• CVE-2020-29661: A locking issue was discovered in the tty subsystem of the Linux kernel drivers/tty/tty_jobctrl.c allowed a use-after-free attack against TIOCSPGRP, aka CID-54ffccbf053b (bnc#1179745).
• CVE-2020-27777: A flaw was found in the way RTAS handled memory accesses in userspace to kernel communication. On a locked down (usually due to Secure…

This update syncs the RT kernel from the SUSE Linux Enterprise 15-SP2 codestream.

This update was imported from the SUSE:SLE-15-SP2:Update update project.

This update for the Linux Kernel 4.4.180-94_103 fixes several issues.

The following security issues were fixed:

• CVE-2020-14331: Fixed a buffer over-write in vgacon_scroll (bsc#1174247).
• CVE-2019-0155: Fixed a privilege escalation in the i915 graphics driver (bsc#1173663).
• CVE-2019-16746: Fixed a buffer overflow in net/wireless/nl80211.c (bsc#1173659).
• CVE-2019-9458: Fixed a use-after-free in media/v4l (bsc#1173963).
• CVE-2020-11668: Fixed a memory corruption issue in the Xirlink camera USB driver (bsc#1173942).
• CVE-2019-19447: Fixed a use-after-free in ext4_put_super (bsc#1173869).
• CVE-2019-18680: Fixed a NULL pointer dereference in rds_tcp_kill_sock() in net/rds/tcp.c (bsc#1173867).
• CVE-2019-14816: Fixed a heap-based buffer overflow in the Marvell WiFi driver (bsc#1173666).
• CVE-2019-14814: Fixed a heap-based buffer overflow in the Marvell WiFi driver (bsc#1173664).
• CVE-2019-14815: Fixed a heap-based buffer overflow in the Marvell WiFi driver (bsc#1173665).
• CVE-2019-14901: Fixed a heap overflow in the Marvell WiFi driver (bsc#1173661).
• CVE-2019-14895: Fixed a heap-based buffer overflow in the Marvell WiFi driver (bsc#1173100).

This update for the Linux Kernel 4.4.121-92_125 fixes several issues.

The following security issues were fixed:

• CVE-2020-14331: Fixed a buffer over-write in vgacon_scroll (bsc#1174247).
• CVE-2019-16746: Fixed a buffer overflow in net/wireless/nl80211.c (bsc#1173659).
• CVE-2019-9458: Fixed a use-after-free in media/v4l (bsc#1173963).
• CVE-2020-11668: Fixed a memory corruption issue in the Xirlink camera USB driver (bsc#1173942).
• CVE-2019-19447: Fixed a use-after-free in ext4_put_super (bsc#1173869).
• CVE-2019-14901: Fixed a heap overflow in the Marvell WiFi driver (bsc#1173661).
• CVE-2019-14895: Fixed a heap-based buffer overflow in the Marvell WiFi driver (bsc#1173100).

This update for the Linux Kernel 4.4.180-94_107 fixes several issues.

The following security issues were fixed:

• CVE-2020-14331: Fixed a buffer over-write in vgacon_scroll (bsc#1174247).
• CVE-2019-0155: Fixed a privilege escalation in the i915 graphics driver (bsc#1173663).
• CVE-2019-16746: Fixed a buffer overflow in net/wireless/nl80211.c (bsc#1173659).
• CVE-2019-9458: Fixed a use-after-free in media/v4l (bsc#1173963).
• CVE-2020-11668: Fixed a memory corruption issue in the Xirlink camera USB driver (bsc#1173942).
• CVE-2019-19447: Fixed a use-after-free in ext4_put_super (bsc#1173869).
• CVE-2019-18680: Fixed a NULL pointer dereference in rds_tcp_kill_sock() in net/rds/tcp.c (bsc#1173867).
• CVE-2019-14901: Fixed a heap overflow in the Marvell WiFi driver (bsc#1173661).
• CVE-2019-14895: Fixed a heap-based buffer overflow in the Marvell WiFi driver (bsc#1173100).

This update for the Linux Kernel 4.4.180-94_113 fixes several issues.

The following security issues were fixed:

• CVE-2020-14331: Fixed a buffer over-write in vgacon_scroll (bsc#1174247).
• CVE-2019-16746: Fixed a buffer overflow in net/wireless/nl80211.c (bsc#1173659).
• CVE-2019-9458: Fixed a use-after-free in media/v4l (bsc#1173963).
• CVE-2020-11668: Fixed a memory corruption issue in the Xirlink camera USB driver (bsc#1173942).
• CVE-2019-19447: Fixed a use-after-free in ext4_put_super (bsc#1173869).
• CVE-2019-14895: Fixed a heap-based buffer overflow in the Marvell WiFi driver (bsc#1173100).

This update for the Linux Kernel 4.4.180-94_116 fixes several issues.

The following security issues were fixed:

• CVE-2020-14331: Fixed a buffer over-write in vgacon_scroll (bsc#1174247).
• CVE-2019-16746: Fixed a buffer overflow in net/wireless/nl80211.c (bsc#1173659).
• CVE-2020-11668: Fixed a memory corruption issue in the Xirlink camera USB driver (bsc#1173942).

This update for the Linux Kernel 4.4.180-94_127 fixes several issues.

The following security issues were fixed:

• CVE-2020-14331: Fixed a buffer over-write in vgacon_scroll (bsc#1174247).
• CVE-2019-16746: Fixed a buffer overflow in net/wireless/nl80211.c (bsc#1173659).
• CVE-2020-11668: Fixed a memory corruption issue in the Xirlink camera USB driver (bsc#1173942).
• CVE-2020-1749: Fixed a flaw in IPsec where some IPv6 protocols were not encrypted (bsc#1165631).

This update for the Linux Kernel 4.12.14-197_26 fixes several issues.

The following security issues were fixed:

• CVE-2020-14331: Fixed a buffer over-write in vgacon_scroll (bsc#1174247).
• CVE-2020-15780: Fixed a lockdown bypass via injection of malicious ACPI tables via configfs (bsc#1174186).
• CVE-2019-0155: Fixed a privilege escalation in the i915 graphics driver (bsc#1173663).
• CVE-2019-16746: Fixed a buffer overflow in net/wireless/nl80211.c (bsc#1173659).
• CVE-2019-9458: Fixed a use-after-free in media/v4l (bsc#1173963).
• CVE-2020-11668: Fixed a memory corruption issue in the Xirlink camera USB driver (bsc#1173942).
• CVE-2019-19447: Fixed a use-after-free in ext4_put_super (bsc#1173869).
• CVE-2019-14901: Fixed a heap overflow in the Marvell WiFi driver (bsc#1173661).
• CVE-2019-14895: Fixed a heap-based buffer overflow in the Marvell WiFi driver (bsc#1173100).

This update for the Linux Kernel 4.12.14-122_7 fixes several issues.

The following security issues were fixed:

• CVE-2020-14331: Fixed a buffer over-write in vgacon_scroll (bsc#1174247).
• CVE-2020-15780: Fixed a lockdown bypass via injection of malicious ACPI tables via configfs (bsc#1174186).
• CVE-2019-16746: Fixed a buffer overflow in net/wireless/nl80211.c (bsc#1173659).
• CVE-2019-9458: Fixed a use-after-free in media/v4l (bsc#1173963).
• CVE-2020-11668: Fixed a memory corruption issue in the Xirlink camera USB driver (bsc#1173942).
• CVE-2019-19447: Fixed a use-after-free in ext4_put_super (bsc#1173869).
• CVE-2019-14901: Fixed a heap overflow in the Marvell WiFi driver (bsc#1173661).
• CVE-2019-14895: Fixed a heap-based buffer overflow in the Marvell WiFi driver (bsc#1173100).

This update for the Linux Kernel 4.12.14-95_48 fixes several issues.

The following security issues were fixed:

• CVE-2020-14331: Fixed a buffer over-write in vgacon_scroll (bsc#1174247).
• CVE-2020-15780: Fixed a lockdown bypass via injection of malicious ACPI tables via configfs (bsc#1174186).
• CVE-2019-16746: Fixed a buffer overflow in net/wireless/nl80211.c (bsc#1173659).
• CVE-2019-9458: Fixed a use-after-free in media/v4l (bsc#1173963).
• CVE-2020-11668: Fixed a memory corruption issue in the Xirlink camera USB driver (bsc#1173942).

This update for the Linux Kernel 4.12.14-197_29 fixes several issues.

The following security issues were fixed:

• CVE-2020-14331: Fixed a buffer over-write in vgacon_scroll (bsc#1174247).
• CVE-2020-15780: Fixed a lockdown bypass via injection of malicious ACPI tables via configfs (bsc#1174186).
• CVE-2019-16746: Fixed a buffer overflow in net/wireless/nl80211.c (bsc#1173659).
• CVE-2019-9458: Fixed a use-after-free in media/v4l (bsc#1173963).
• CVE-2020-11668: Fixed a memory corruption issue in the Xirlink camera USB driver (bsc#1173942).
• CVE-2019-19447: Fixed a use-after-free in ext4_put_super (bsc#1173869).
• CVE-2019-14895: Fixed a heap-based buffer overflow in the Marvell WiFi driver (bsc#1173100).

This update for the Linux Kernel 4.12.14-150_52 fixes several issues.

The following security issues were fixed:

• CVE-2020-14331: Fixed a buffer over-write in vgacon_scroll (bsc#1174247).
• CVE-2020-15780: Fixed a lockdown bypass via injection of malicious ACPI tables via configfs (bsc#1174186).
• CVE-2019-16746: Fixed a buffer overflow in net/wireless/nl80211.c (bsc#1173659).
• CVE-2020-11668: Fixed a memory corruption issue in the Xirlink camera USB driver (bsc#1173942).
• CVE-2020-1749: Fixed a flaw in IPsec where some IPv6 protocols were not encrypted (bsc#1165631).

This update for the Linux Kernel 4.12.14-150_55 fixes several issues.

The following security issues were fixed:

• CVE-2020-14331: Fixed a buffer over-write in vgacon_scroll (bsc#1174247).
• CVE-2020-11668: Fixed a memory corruption issue in the Xirlink camera USB driver (bsc#1173942).
• CVE-2020-1749: Fixed a flaw in IPsec where some IPv6 protocols were not encrypted (bsc#1165631).

This update for the Linux Kernel 4.12.14-197_18 fixes several issues.

The following security issues were fixed:

• CVE-2020-14331: Fixed a buffer over-write in vgacon_scroll (bsc#1174247).
• CVE-2020-15780: Fixed a lockdown bypass via injection of malicious ACPI tables via configfs (bsc#1174186).
• CVE-2019-0155: Fixed a privilege escalation in the i915 graphics driver (bsc#1173663).
• CVE-2019-16746: Fixed a buffer overflow in net/wireless/nl80211.c (bsc#1173659).
• CVE-2019-9458: Fixed a use-after-free in media/v4l (bsc#1173963).
• CVE-2020-11668: Fixed a memory corruption issue in the Xirlink camera USB driver (bsc#1173942).
• CVE-2019-15117: Fixed an OOB memory access in the USB sound mixer (bsc#1173934).
• CVE-2019-19447: Fixed a use-after-free in ext4_put_super (bsc#1173869).
• CVE-2019-14901: Fixed a heap overflow in the Marvell WiFi driver (bsc#1173661).
• CVE-2019-14895: Fixed a heap-based buffer overflow in the Marvell WiFi driver (bsc#1173100).

This update for the Linux Kernel 4.12.14-197_37 fixes several issues.

The following security issues were fixed:

• CVE-2020-14331: Fixed a buffer over-write in vgacon_scroll (bsc#1174247).
• CVE-2020-15780: Fixed a lockdown bypass via injection of malicious ACPI tables via configfs (bsc#1174186).
• CVE-2019-9458: Fixed a use-after-free in media/v4l (bsc#1173963).
• CVE-2020-11668: Fixed a memory corruption issue in the Xirlink camera USB driver (bsc#1173942).

This update for the Linux Kernel 4.12.14-150_58 fixes several issues.

The following security issues were fixed:

• CVE-2020-14381: Fixed a use-after-free in the fast user mutex (futex) wait operation, which could have lead to memory corruption and possibly privilege escalation (bsc#1176011).
• CVE-2020-0431: In kbd_keycode of keyboard.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. (bsc#1176722)
• CVE-2020-25212: A TOCTOU mismatch in the NFS client code could be used by local attackers to corrupt memory or possibly have unspecified other impact because a size check is in fs/nfs/nfs4proc.c instead of fs/nfs/nfs4xdr.c (bsc#1176381).
• CVE-2020-11668: Fixed an out of bounds write to the heap in drivers/media/usb/gspca/xirlink_cit.c (aka the Xirlink camera USB driver) caused by mishandling invalid descriptors (bsc#1168952).

This update for the Linux Kernel 4.4.180-94_130 fixes several issues.

The following security issues were fixed:

• CVE-2020-0429: In l2tp_session_delete and related functions of l2tp_core.c, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with system execution privileges needed. User interaction is not needed for exploitation. (bsc#1176724)
• CVE-2020-14381: Fixed a use-after-free in the fast user mutex (futex) wait operation, which could have lead to memory corruption and possibly privilege escalation (bsc#1176011).
• CVE-2020-0431: In kbd_keycode of keyboard.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. (bsc#1176722)
• CVE-2020-25212: A TOCTOU mismatch in the NFS client code could be used by local attackers to corrupt memory or possibly have unspecified other impact because a size check is in fs/nfs/nfs4proc.c instead of fs/nfs/nfs4xdr.c (bsc#1176381).
• CVE-2020-11668: Fixed an out of bounds write to the heap in drivers/media/usb/gspca/xirlink_cit.c (aka the Xirlink camera USB driver) caused by mishandling invalid descriptors (bsc#1168952).
• CVE-2020-1749: A flaw was found in the implementation of some networking protocols in IPsec, such as VXLAN and GENEVE tunnels over IPv6. When an encrypted tunnel is created between two hosts, the kernel isn't correctly routing tunneled data over the encrypted link, rather sending the data unencrypted. This would have allowed anyone in between the two endpoints to read the traffic unencrypted. (bsc#1165629)

This update for the Linux Kernel 4.4.121-92_146 fixes several issues.

The following security issues were fixed:

• CVE-2020-25668: Fixed a concurrency use-after-free in con_font_op (bsc#1178622).
• CVE-2020-25645: Fixed an issue which traffic between two Geneve endpoints may be unencrypted when IPsec is configured to encrypt traffic for the specific UDP port used by the GENEVE tunnel allowing anyone between the two endpoints to read the traffic unencrypted (bsc#1177513).
• CVE-2020-0429: Fixed a memory corruption due to a use after free which could have led to to local privilege escalation (bsc#1176931).
• CVE-2020-11668: Fixed an issue where the Xirlink camera USB driver mishandled invalid descriptors (bsc#1173942).
• CVE-2020-1749: Use ip6_dst_lookup_flow instead of ip6_dst_lookup (bsc#1165631).

This update for the Linux Kernel 4.4.180-94_135 fixes several issues.

The following security issues were fixed:

• CVE-2020-25645: Fixed an issue which traffic between two Geneve endpoints may be unencrypted when IPsec is configured to encrypt traffic for the specific UDP port used by the GENEVE tunnel allowing anyone between the two endpoints to read the traffic unencrypted (bsc#1177513).
• CVE-2020-0429: Fixed a memory corruption due to a use after free which could have led to to local privilege escalation (bsc#1176931).
• CVE-2020-11668: Fixed an issue where the Xirlink camera USB driver mishandled invalid descriptors (bsc#1173942).
• CVE-2020-1749: Use ip6_dst_lookup_flow instead of ip6_dst_lookup (bsc#1165631).

This update for the Linux Kernel 4.12.14-150_63 fixes one issue.

The following security issue was fixed:

• CVE-2020-11668: Fixed an improper handling of invalid descriptors in Xirlink camera USB driver (bsc#1173942).

The SUSE Linux Enterprise 15 SP2 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-0444: Fixed a bad kfree due to a logic error in audit_data_to_entry (bnc#1180027).
• CVE-2020-0465: Fixed multiple missing bounds checks in hid-multitouch.c that could have led to local privilege escalation (bnc#1180029).
• CVE-2020-0466: Fixed a use-after-free due to a logic error in do_epoll_ctl and ep_loop_check_proc of eventpoll.c (bnc#1180031).
• CVE-2020-11668: Fixed the mishandling of invalid descriptors in the Xirlink camera USB driver (bnc#1168952).
• CVE-2020-27068: Fixed an out-of-bounds read due to a missing bounds check in the nl80211_policy policy of nl80211.c (bnc#1180086).
• CVE-2020-27786: Fixed an out-of-bounds write in the MIDI implementation (bnc#1179601).
• CVE-2020-27825: Fixed a race in the trace_open and buffer resize calls (bsc#1179960).
• CVE-2020-27830: Fixed a null pointer dereference in speakup (bsc#1179656).
• CVE-2020-29370: Fixed a race condition in kmem_cache_alloc_bulk (bnc#1179435).
• CVE-2020-29373: Fixed an unsafe handling of the root directory during path lookups in fs/io_uring.c (bnc#1179434).
• CVE-2020-29660: Fixed a locking inconsistency in the tty subsystem that may have allowed a read-after-free attack against TIOCGSID (bnc#1179745).
• CVE-2020-29661: Fixed a locking issue in the tty subsystem that allowed a use-after-free attack against TIOCSPGRP (bsc#1179745).

The following non-security bugs were fixed:

• ACPI: APEI: Kick the memory_failure() queue for synchronous errors (jsc#SLE-16610).
• ACPI: PNP: compare the string length in the matching_id() (git-fixes).
• ALSA/hda: apply jack fixup for the Acer Veriton N4640G/N6640G/N2510G (git-fixes).
• ALSA: core: memalloc: add page alignment for iram (git-fixes).
• ALSA: hda/ca0132 - Change Input Source enum strings (git-fixes).
• ALSA: hda/ca0132 - Fix AE-5 rear headphone pincfg (git-fixes).
• ALSA: hda/generic: Add option to enforce preferred_dacs pairs (git-fixes).
• ALSA: hda/hdmi: always print pin NIDs as hexadecimal (git-fixes).
• ALSA: hda/hdmi: packet buffer index must be set before reading value (git-fixes).
• ALSA: hda/proc - print DP-MST connections (git-fixes).
• ALSA: hda/realtek - Add new codec supported for ALC897 (git-fixes).
• ALSA: hda/realtek - Add supported for more Lenovo ALC285 Headset Button (git-fixes).
• ALSA: hda/realtek - Enable headset mic of ASUS Q524UQK with ALC255 (git-fixes).
• ALSA: hda/realtek - Enable headset mic of ASUS X430UN with ALC256 (git-fixes).
• ALSA: hda/realtek - Fixed Dell AIO wrong sound tone (git-fixes).
• ALSA: hda/realtek: Add mute LED quirk to yet another HP x360 model (git-fixes).
• ALSA: hda/realtek: Add quirk for MSI-GP73 (git-fixes).
• ALSA: hda/realtek: Apply jack fixup for Quanta NL3 (git-fixes).
• ALSA: hda/realtek: Enable headset of ASUS UX482EG & B9400CEA with ALC294 (git-fixes).
• ALSA: hda/realtek: Fix bass speaker DAC assignment on Asus Zephyrus G14 (git-fixes).
• ALSA: hda/realtek: make bass spk volume adjustable on a yoga laptop (git-fixes).
• ALSA: hda: Fix regressions on clear and reconfig sysfs (git-fixes).
• ALSA: pcm: oss: Fix a few more UBSAN fixes (git-fixes).
• ALSA: pcm: oss: Fix potential out-of-bounds shift (git-fixes).
• ALSA: rawmidi: Access runtime->avail always in spinlock (git-fixes).
• ALSA: seq: remove useless function (git-fixes).
• ALSA: usb-audio: Add generic implicit fb parsing (bsc#1178203).
• ALSA: usb-audio: Add hw constraint for implicit fb sync (bsc#1178203).
• ALSA: usb-audio: Add implicit fb support for Steinberg UR22 (git-fixes).
• ALSA: usb-audio: Add implicit_fb module option (bsc#1178203).
• ALSA: usb-audio: Add quirk for Pioneer DJ DDJ-SR2 (git-fixes).
• ALSA: usb-audio: Add snd_usb_get_endpoint() helper (bsc#1178203).
• ALSA: usb-audio: Add snd_usb_get_host_interface() helper (bsc#1178203).
• ALSA: usb-audio: Add support for Pioneer DJ DDJ-RR controller (git-fixes).
• ALSA: usb-audio:…

The SUSE Linux Enterprise 15 SP1 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2019-20934: Fixed a use-after-free in show_numa_stats() because NUMA fault statistics were inappropriately freed, aka CID-16d51a590a8c (bsc#1179663).
• CVE-2020-0444: Fixed a bad kfree due to a logic error in audit_data_to_entry (bnc#1180027).
• CVE-2020-0465: Fixed multiple missing bounds checks in hid-multitouch.c that could have led to local privilege escalation (bnc#1180029).
• CVE-2020-0466: Fixed a use-after-free due to a logic error in do_epoll_ctl and ep_loop_check_proc of eventpoll.c (bnc#1180031).
• CVE-2020-4788: Fixed an issue with IBM Power9 processors could have allowed a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances (bsc#1177666).
• CVE-2020-11668: Fixed an out of bounds write to the heap in drivers/media/usb/gspca/xirlink_cit.c (aka the Xirlink camera USB driver) caused by mishandling invalid descriptors (bsc#1168952).
• CVE-2020-15436: Fixed a use after free vulnerability in fs/block_dev.c which could have allowed local users to gain privileges or cause a denial of service (bsc#1179141).
• CVE-2020-27068: Fixed an out-of-bounds read due to a missing bounds check in the nl80211_policy policy of nl80211.c (bnc#1180086).
• CVE-2020-27777: Fixed a privilege escalation in the Run-Time Abstraction Services (RTAS) interface, affecting guests running on top of PowerVM or KVM hypervisors (bnc#1179107).
• CVE-2020-27786: Fixed an out-of-bounds write in the MIDI implementation (bnc#1179601).
• CVE-2020-27825: Fixed a race in the trace_open and buffer resize calls (bsc#1179960).
• CVE-2020-29371: Fixed uninitialized memory leaks to userspace (bsc#1179429).
• CVE-2020-29660: Fixed a locking inconsistency in the tty subsystem that may have allowed a read-after-free attack against TIOCGSID (bnc#1179745).
• CVE-2020-29661: Fixed a locking issue in the tty subsystem that allowed a use-after-free attack against TIOCSPGRP (bsc#1179745).

The following non-security bugs were fixed:

• ACPI: PNP: compare the string length in the matching_id() (git-fixes).
• ACPICA: Disassembler: create buffer fields in ACPI_PARSE_LOAD_PASS1 (git-fixes).
• ACPICA: Do not increment operation_region reference counts for field units (git-fixes).
• ALSA: ca0106: fix error code handling (git-fixes).
• ALSA: ctl: allow TLV read operation for callback type of element in locked case (git-fixes).
• ALSA: hda - Fix silent audio output and corrupted input on MSI X570-A PRO (git-fixes).
• ALSA: hda/ca0132 - Change Input Source enum strings (git-fixes).
• ALSA: hda/ca0132 - Fix AE-5 rear headphone pincfg (git-fixes).
• ALSA: hda/generic: Add option to enforce preferred_dacs pairs (git-fixes).
• ALSA: hda/hdmi: always check pin power status in i915 pin fixup (git-fixes).
• ALSA: hda/realtek - Add new codec supported for ALC897 (git-fixes).
• ALSA: hda/realtek - Couldn't detect Mic if booting with headset plugged (git-fixes).
• ALSA: hda/realtek - Enable headset mic of ASUS Q524UQK with ALC255 (git-fixes).
• ALSA: hda/realtek: Add mute LED quirk to yet another HP x360 model (git-fixes).
• ALSA: hda/realtek: Add some Clove SSID in the ALC293(ALC1220) (git-fixes).
• ALSA: hda/realtek: Enable front panel headset LED on Lenovo ThinkStation P520 (git-fixes).
• ALSA: hda/realtek: Enable headset of ASUS UX482EG & B9400CEA with ALC294 (git-fixes).
• ALSA: hda: Add NVIDIA codec IDs 9a & 9d through a0 to patch table (git-fixes).
• ALSA: hda: Fix potential race in unsol event handler (git-fixes).
• ALSA: hda: Fix regressions on clear and reconfig sysfs (git-fixes).
• ALSA: info: Drop WARN_ON() from buffer NULL sanity check (git-fixes).
• ALSA: isa/wavefront: prevent out of bounds write in ioctl (git-fixes).
• ALSA: line6: Perform sanity check for each URB creation (git-fixes).
• ALSA: pcm: oss: Fix a few more UBSAN fixes (git-fixes).
• ALSA: pcm: oss: Fix potential…

The SUSE Linux Enterprise 15 SP2 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-36158: Fixed a potential remote code execution in the Marvell mwifiex driver (bsc#1180559).
• CVE-2020-27825: Fixed a race in the trace_open and buffer resize calls (bsc#1179960).
• CVE-2020-0466: Fixed a use-after-free due to a logic error in do_epoll_ctl and ep_loop_check_proc of eventpoll.c (bnc#1180031).
• CVE-2020-27068: Fixed an out-of-bounds read due to a missing bounds check in the nl80211_policy policy of nl80211.c (bnc#1180086).
• CVE-2020-0444: Fixed a bad kfree due to a logic error in audit_data_to_entry (bnc#1180027).
• CVE-2020-0465: Fixed multiple missing bounds checks in hid-multitouch.c that could have led to local privilege escalation (bnc#1180029).
• CVE-2020-29661: Fixed a locking issue in the tty subsystem that allowed a use-after-free attack against TIOCSPGRP (bsc#1179745).
• CVE-2020-29660: Fixed a locking inconsistency in the tty subsystem that may have allowed a read-after-free attack against TIOCGSID (bnc#1179745).
• CVE-2020-27777: Fixed a privilege escalation in the Run-Time Abstraction Services (RTAS) interface, affecting guests running on top of PowerVM or KVM hypervisors (bnc#1179107).
• CVE-2020-29373: Fixed an unsafe handling of the root directory during path lookups in fs/io_uring.c (bnc#1179434).
• CVE-2020-11668: Fixed the mishandling of invalid descriptors in the Xirlink camera USB driver (bnc#1168952).
• CVE-2020-27830: Fixed a null pointer dereference in speakup (bsc#1179656).
• CVE-2020-29370: Fixed a race condition in kmem_cache_alloc_bulk (bnc#1179435).

The following non-security bugs were fixed:

• ACPI: PNP: compare the string length in the matching_id() (git-fixes).
• add reference to CVE and its bsc
• ALSA/hda: apply jack fixup for the Acer Veriton N4640G/N6640G/N2510G (git-fixes).
• ALSA: core: memalloc: add page alignment for iram (git-fixes).
• ALSA: hda/ca0132 - Change Input Source enum strings (git-fixes).
• ALSA: hda/ca0132 - Fix AE-5 rear headphone pincfg (git-fixes).
• ALSA: hda/hdmi: always print pin NIDs as hexadecimal (git-fixes).
• ALSA: hda/hdmi: packet buffer index must be set before reading value (git-fixes).
• ALSA: hda/proc - print DP-MST connections (git-fixes).
• ALSA: hda/realtek - Add supported for more Lenovo ALC285 Headset Button (git-fixes).
• ALSA: hda/realtek - Enable headset mic of ASUS Q524UQK with ALC255 (git-fixes).
• ALSA: hda/realtek - Enable headset mic of ASUS X430UN with ALC256 (git-fixes).
• ALSA: hda/realtek: Add quirk for MSI-GP73 (git-fixes).
• ALSA: hda/realtek: Apply jack fixup for Quanta NL3 (git-fixes).
• ALSA: hda/realtek: make bass spk volume adjustable on a yoga laptop (git-fixes).
• ALSA: hda: Fix regressions on clear and reconfig sysfs (git-fixes).
• ALSA: pcm: oss: Fix a few more UBSAN fixes (git-fixes).
• ALSA: pcm: oss: Fix potential out-of-bounds shift (git-fixes).
• ALSA: rawmidi: Access runtime->avail always in spinlock (git-fixes).
• ALSA: seq: remove useless function (git-fixes).
• ALSA: usb-audio: Add generic implicit fb parsing (bsc#1178203).
• ALSA: usb-audio: Add hw constraint for implicit fb sync (bsc#1178203).
• ALSA: usb-audio: Add implicit fb support for Steinberg UR22 (git-fixes).
• ALSA: usb-audio: Add implicit_fb module option (bsc#1178203).
• ALSA: usb-audio: Add quirk for Pioneer DJ DDJ-SR2 (git-fixes).
• ALSA: usb-audio: Add snd_usb_get_endpoint() helper (bsc#1178203).
• ALSA: usb-audio: Add snd_usb_get_host_interface() helper (bsc#1178203).
• ALSA: usb-audio: Add support for Pioneer DJ DDJ-RR controller (git-fixes).
• ALSA: usb-audio: Add VID to support native DSD reproduction on FiiO devices (git-fixes).
• ALSA: usb-audio: Always set up the parameters after resume (bsc#1178203).
• ALSA: usb-audio: Avoid doubly initialization for implicit fb (bsc#1178203).
• ALSA: usb-audio: Check implicit feedback EP generically for UAC2 (bsc#1178203).
• ALSA: usb-audio: Check…

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-28374: Fixed a Linux SCSI target issue (bsc#1178372).
• CVE-2020-36158: Fixed a potential remote code execution in the Marvell mwifiex driver (bsc#1180559).
• CVE-2020-27825: Fixed a race in the trace_open and buffer resize calls (bsc#1179960).
• CVE-2020-0466: Fixed a use-after-free due to a logic error in do_epoll_ctl and ep_loop_check_proc of eventpoll.c (bnc#1180031).
• CVE-2020-27068: Fixed an out-of-bounds read due to a missing bounds check in the nl80211_policy policy of nl80211.c (bnc#1180086).
• CVE-2020-0444: Fixed a bad kfree due to a logic error in audit_data_to_entry (bnc#1180027).
• CVE-2020-0465: Fixed multiple missing bounds checks in hid-multitouch.c that could have led to local privilege escalation (bnc#1180029).
• CVE-2020-29661: Fixed a locking issue in the tty subsystem that allowed a use-after-free attack against TIOCSPGRP (bsc#1179745).
• CVE-2020-29660: Fixed a locking inconsistency in the tty subsystem that may have allowed a read-after-free attack against TIOCGSID (bnc#1179745).
• CVE-2020-27777: Fixed a privilege escalation in the Run-Time Abstraction Services (RTAS) interface, affecting guests running on top of PowerVM or KVM hypervisors (bnc#1179107).
• CVE-2020-29373: Fixed an unsafe handling of the root directory during path lookups in fs/io_uring.c (bnc#1179434).
• CVE-2020-11668: Fixed the mishandling of invalid descriptors in the Xirlink camera USB driver (bnc#1168952).
• CVE-2020-27830: Fixed a null pointer dereference in speakup (bsc#1179656).
• CVE-2020-29370: Fixed a race condition in kmem_cache_alloc_bulk (bnc#1179435).
• CVE-2020-27786: Fixed a use after free in kernel midi subsystem snd_rawmidi_kernel_read1() (bsc#1179601).

The following non-security bugs were fixed:

• ACPI: APEI: Kick the memory_failure() queue for synchronous errors (jsc#SLE-16610).
• ACPI: PNP: compare the string length in the matching_id() (git-fixes).
• ALSA/hda: apply jack fixup for the Acer Veriton N4640G/N6640G/N2510G (git-fixes).
• ALSA: core: memalloc: add page alignment for iram (git-fixes).
• ALSA: hda/ca0132 - Change Input Source enum strings (git-fixes).
• ALSA: hda/ca0132 - Fix AE-5 rear headphone pincfg (git-fixes).
• ALSA: hda/generic: Add option to enforce preferred_dacs pairs (git-fixes).
• ALSA: hda/hdmi: always print pin NIDs as hexadecimal (git-fixes).
• ALSA: hda/hdmi: packet buffer index must be set before reading value (git-fixes).
• ALSA: hda/proc - print DP-MST connections (git-fixes).
• ALSA: hda/realtek - Add new codec supported for ALC897 (git-fixes).
• ALSA: hda/realtek - Add supported for more Lenovo ALC285 Headset Button (git-fixes).
• ALSA: hda/realtek - Enable headset mic of ASUS Q524UQK with ALC255 (git-fixes).
• ALSA: hda/realtek - Enable headset mic of ASUS X430UN with ALC256 (git-fixes).
• ALSA: hda/realtek - Fixed Dell AIO wrong sound tone (git-fixes).
• ALSA: hda/realtek: Add mute LED quirk to yet another HP x360 model (git-fixes).
• ALSA: hda/realtek: Add quirk for MSI-GP73 (git-fixes).
• ALSA: hda/realtek: Apply jack fixup for Quanta NL3 (git-fixes).
• ALSA: hda/realtek: Enable headset of ASUS UX482EG & B9400CEA with ALC294 (git-fixes).
• ALSA: hda/realtek: Fix bass speaker DAC assignment on Asus Zephyrus G14 (git-fixes).
• ALSA: hda/realtek: make bass spk volume adjustable on a yoga laptop (git-fixes).
• ALSA: hda: Fix regressions on clear and reconfig sysfs (git-fixes).
• ALSA: pcm: oss: Fix a few more UBSAN fixes (git-fixes).
• ALSA: pcm: oss: Fix potential out-of-bounds shift (git-fixes).
• ALSA: rawmidi: Access runtime->avail always in spinlock (git-fixes).
• ALSA: seq: remove useless function (git-fixes).
• ALSA: usb-audio: Add generic implicit fb parsing (bsc#1178203).
• ALSA: usb-audio: Add hw constraint for implicit fb sync (bsc#1178203).
• ALSA: usb-audio: Add implicit fb support for Steinberg UR22 (git-fixes).
• ALSA:…

The SUSE Linux Enterprise 12 SP2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3347: A use-after-free was discovered in the PI futexes during fault handling, allowing local users to execute code in the kernel (bnc#1181349).
• CVE-2020-29569: Fixed a potential privilege escalation and information leaks related to the PV block backend, as used by Xen (bnc#1179509).
• CVE-2020-29568: Fixed a denial of service issue, related to processing watch events (bnc#1179508).
• CVE-2020-25211: Fixed a flaw where a local attacker was able to inject conntrack netlink configuration that could cause a denial of service or trigger the use of incorrect protocol numbers in ctnetlink_parse_tuple_filter (bnc#1176395).
• CVE-2020-0444: Fixed a bad kfree due to a logic error in audit_data_to_entry (bnc#1180027).
• CVE-2020-0465: Fixed multiple missing bounds checks in hid-multitouch.c that could have led to local privilege escalation (bnc#1180029).
• CVE-2020-0466: Fixed a use-after-free due to a logic error in do_epoll_ctl and ep_loop_check_proc of eventpoll.c (bnc#1180031).
• CVE-2020-15436: Fixed a use after free vulnerability in fs/block_dev.c which could have allowed local users to gain privileges or cause a denial of service (bsc#1179141).
• CVE-2020-27068: Fixed an out-of-bounds read due to a missing bounds check in the nl80211_policy policy of nl80211.c (bnc#1180086).
• CVE-2020-27777: Fixed a privilege escalation in the Run-Time Abstraction Services (RTAS) interface, affecting guests running on top of PowerVM or KVM hypervisors (bnc#1179107).
• CVE-2020-27786: Fixed an out-of-bounds write in the MIDI implementation (bnc#1179601).
• CVE-2020-27825: Fixed a race in the trace_open and buffer resize calls (bsc#1179960).
• CVE-2020-29660: Fixed a locking inconsistency in the tty subsystem that may have allowed a read-after-free attack against TIOCGSID (bnc#1179745).
• CVE-2020-29661: Fixed a locking issue in the tty subsystem that allowed a use-after-free attack against TIOCSPGRP (bsc#1179745).
• CVE-2020-28974: Fixed a slab-out-of-bounds read in fbcon which could have been used by local attackers to read privileged information or potentially crash the kernel (bsc#1178589).
• CVE-2020-28915: Fixed a buffer over-read in the fbcon code which could have been used by local attackers to read kernel memory (bsc#1178886).
• CVE-2020-25669: Fixed a use-after-free read in sunkbd_reinit() (bsc#1178182).
• CVE-2020-25285: A race condition between hugetlb sysctl handlers in mm/hugetlb.c could be used by local attackers to corrupt memory, cause a NULL pointer dereference, or possibly have unspecified other impact (bnc#1176485 ).
• CVE-2020-15437: Fixed a null pointer dereference which could have allowed local users to cause a denial of service (bsc#1179140).
• CVE-2020-36158: Fixed a potential remote code execution in the Marvell mwifiex driver (bsc#1180559).
• CVE-2020-11668: Fixed the mishandling of invalid descriptors in the Xirlink camera USB driver (bnc#1168952).
• CVE-2020-25668: Fixed a use-after-free in con_font_op() (bsc#1178123).
• CVE-2020-27673: Fixed an issue where rogue guests could have caused denial of service of Dom0 via high frequency events (XSA-332 bsc#1177411)
• CVE-2019-20934: Fixed a use-after-free in show_numa_stats() because NUMA fault statistics were inappropriately freed (bsc#1179663).
• CVE-2019-19063: Fixed two memory leaks in the rtl_usb_probe() which could eventually have allowed attackers to cause a denial of service (memory consumption) (bnc#1157298 ).
• CVE-2019-6133: Fixed an issue where the 'start time' protection mechanism could have been bypassed and therefore authorization decisions are improperly cached (bsc#1128172).

The following non-security bugs were fixed:

• HID: Fix slab-out-of-bounds read in hid_field_extract (bsc#1180052).
• epoll: Keep a reference on files added to the check list (bsc#1180031).
• fix regression in 'epoll: Keep a reference…

The SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3348: Fixed a use-after-free in nbd_add_socket that could be triggered by local attackers (with access to the nbd device) via an I/O request at a certain point during device setup (bnc#1181504).
• CVE-2021-3347: A use-after-free was discovered in the PI futexes during fault handling, allowing local users to execute code in the kernel (bnc#1181349).
• CVE-2020-25211: Fixed a buffer overflow in ctnetlink_parse_tuple_filter() which could be triggered by a local attackers by injecting conntrack netlink configuration (bnc#1176395).
• CVE-2020-27835: A use-after-free in the infiniband hfi1 driver was found, specifically in the way user calls Ioctl after open dev file and fork. A local user could use this flaw to crash the system (bnc#1179878).
• CVE-2020-29569: Fixed a potential privilege escalation and information leaks related to the PV block backend, as used by Xen (bnc#1179509).
• CVE-2020-29568: Fixed a denial of service issue, related to processing watch events (bnc#1179508).
• CVE-2020-0444: Fixed a bad kfree due to a logic error in audit_data_to_entry (bnc#1180027).
• CVE-2020-0465: Fixed multiple missing bounds checks in hid-multitouch.c that could have led to local privilege escalation (bnc#1180029).
• CVE-2020-0466: Fixed a use-after-free due to a logic error in do_epoll_ctl and ep_loop_check_proc of eventpoll.c (bnc#1180031).
• CVE-2020-4788: Fixed an issue with IBM Power9 processors could have allowed a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances (bsc#1177666).
• CVE-2020-10781: A flaw was found in the ZRAM kernel module, where a user with a local account and the ability to read the /sys/class/zram-control/hot_add file can create ZRAM device nodes in the /dev/ directory. This read allocates kernel memory and is not accounted for a user that triggers the creation of that ZRAM device. With this vulnerability, continually reading the device may consume a large amount of system memory and cause the Out-of-Memory (OOM) killer to activate and terminate random userspace processes, possibly making the system inoperable (bnc#1173074).
• CVE-2020-15436: Fixed a use after free vulnerability in fs/block_dev.c which could have allowed local users to gain privileges or cause a denial of service (bsc#1179141).
• CVE-2020-27068: Fixed an out-of-bounds read due to a missing bounds check in the nl80211_policy policy of nl80211.c (bnc#1180086).
• CVE-2020-25639: Fixed a NULL pointer dereference via nouveau ioctl (bnc#1176846).
• CVE-2020-27777: Fixed a privilege escalation in the Run-Time Abstraction Services (RTAS) interface, affecting guests running on top of PowerVM or KVM hypervisors (bnc#1179107).
• CVE-2020-27786: Fixed an out-of-bounds write in the MIDI implementation (bnc#1179601).
• CVE-2020-27825: Fixed a race in the trace_open and buffer resize calls (bsc#1179960).
• CVE-2020-29660: Fixed a locking inconsistency in the tty subsystem that may have allowed a read-after-free attack against TIOCGSID (bnc#1179745).
• CVE-2020-29661: Fixed a locking issue in the tty subsystem that allowed a use-after-free attack against TIOCSPGRP (bsc#1179745).
• CVE-2020-28974: Fixed a slab-out-of-bounds read in fbcon which could have been used by local attackers to read privileged information or potentially crash the kernel (bsc#1178589).
• CVE-2020-28915: Fixed a buffer over-read in the fbcon code which could have been used by local attackers to read kernel memory (bsc#1178886).
• CVE-2020-28374: Fixed a Linux SCSI target issue (bsc#1178372).
• CVE-2020-25669: Fixed a use-after-free read in sunkbd_reinit() (bsc#1178182).
• CVE-2020-29371: An issue was discovered in romfs_dev_read in fs/romfs/storage.c where uninitialized memory leaks to userspace (bnc#1179429).
• CVE-2020-15437: Fixed a null pointer dereference which could have allowed local…

The SUSE Linux Enterprise 12 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3347: A use-after-free was discovered in the PI futexes during fault handling, allowing local users to execute code in the kernel (bnc#1181349).
• CVE-2020-25211: Fixed a buffer overflow in ctnetlink_parse_tuple_filter() which could be triggered by a local attackers by injecting conntrack netlink configuration (bnc#1176395).
• CVE-2020-27835: A use-after-free in the infiniband hfi1 driver was found, specifically in the way user calls Ioctl after open dev file and fork. A local user could use this flaw to crash the system (bnc#1179878).
• CVE-2020-29569: Fixed a potential privilege escalation and information leaks related to the PV block backend, as used by Xen (bnc#1179509).
• CVE-2020-29568: Fixed a denial of service issue, related to processing watch events (bnc#1179508).
• CVE-2020-0444: Fixed a bad kfree due to a logic error in audit_data_to_entry (bnc#1180027).
• CVE-2020-0465: Fixed multiple missing bounds checks in hid-multitouch.c that could have led to local privilege escalation (bnc#1180029).
• CVE-2020-0466: Fixed a use-after-free due to a logic error in do_epoll_ctl and ep_loop_check_proc of eventpoll.c (bnc#1180031).
• CVE-2020-4788: Fixed an issue with IBM Power9 processors could have allowed a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances (bsc#1177666).
• CVE-2020-15436: Fixed a use after free vulnerability in fs/block_dev.c which could have allowed local users to gain privileges or cause a denial of service (bsc#1179141).
• CVE-2020-27068: Fixed an out-of-bounds read due to a missing bounds check in the nl80211_policy policy of nl80211.c (bnc#1180086).
• CVE-2020-27777: Fixed a privilege escalation in the Run-Time Abstraction Services (RTAS) interface, affecting guests running on top of PowerVM or KVM hypervisors (bnc#1179107).
• CVE-2020-27786: Fixed an out-of-bounds write in the MIDI implementation (bnc#1179601).
• CVE-2020-27825: Fixed a race in the trace_open and buffer resize calls (bsc#1179960).
• CVE-2020-29660: Fixed a locking inconsistency in the tty subsystem that may have allowed a read-after-free attack against TIOCGSID (bnc#1179745).
• CVE-2020-29661: Fixed a locking issue in the tty subsystem that allowed a use-after-free attack against TIOCSPGRP (bsc#1179745).
• CVE-2020-28974: Fixed a slab-out-of-bounds read in fbcon which could have been used by local attackers to read privileged information or potentially crash the kernel (bsc#1178589).
• CVE-2020-28915: Fixed a buffer over-read in the fbcon code which could have been used by local attackers to read kernel memory (bsc#1178886).
• CVE-2020-25669: Fixed a use-after-free read in sunkbd_reinit() (bsc#1178182).
• CVE-2020-15437: Fixed a null pointer dereference which could have allowed local users to cause a denial of service(bsc#1179140).
• CVE-2020-36158: Fixed a potential remote code execution in the Marvell mwifiex driver (bsc#1180559).
• CVE-2020-11668: Fixed the mishandling of invalid descriptors in the Xirlink camera USB driver (bnc#1168952).
• CVE-2020-25285: Fixed a race condition between hugetlb sysctl handlers in mm/hugetlb.c (bnc#1176485).
• CVE-2019-20934: Fixed a use-after-free in show_numa_stats() because NUMA fault statistics were inappropriately freed (bsc#1179663).
• CVE-2018-10902: It was found that the raw midi kernel driver did not protect against concurrent access which leads to a double realloc (double free) in snd_rawmidi_input_params() and snd_rawmidi_output_status() which are part of snd_rawmidi_ioctl() handler in rawmidi.c file. A malicious local attacker could possibly use this for privilege escalation (bnc#1105322).

The following non-security bugs were fixed:

• cifs: do not revalidate mountpoint dentries (bsc#1177440).
• cifs: fix potential use-after-free in cifs_echo_request() (bsc#1139944).
• cifs: ignore…

The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3347: A use-after-free was discovered in the PI futexes during fault handling, allowing local users to execute code in the kernel (bnc#1181349).
• CVE-2020-0465: Fixed multiple missing bounds checks in hid-multitouch.c that could have led to local privilege escalation (bnc#1180029).
• CVE-2020-25211: Fixed a flaw where a local attacker was able to inject conntrack netlink configuration that could cause a denial of service or trigger the use of incorrect protocol numbers in ctnetlink_parse_tuple_filter (bnc#1176395).
• CVE-2020-14390: Fixed an out-of-bounds memory write leading to memory corruption or a denial of service when changing screen size (bnc#1176235).
• CVE-2020-25284: Fixed an incomplete permission checking for access to rbd devices, which could have been leveraged by local attackers to map or unmap rbd block devices (bsc#1176482).
• CVE-2020-15436: Fixed a use after free vulnerability in fs/block_dev.c which could have allowed local users to gain privileges or cause a denial of service (bsc#1179141).
• CVE-2020-14331: Fixed a missing check in vgacon scrollback handling (bsc#1174205).
• CVE-2020-14353: Fixed an issue where keys - for keyctl prevent creating a different user's keyrings (bsc#1174993).
• CVE-2020-14381: Fixed requeue paths such that filp was valid when dropping the references (bsc#1176011).
• CVE-2020-27068: Fixed an out-of-bounds read due to a missing bounds check in the nl80211_policy policy of nl80211.c (bnc#1180086).
• CVE-2020-27777: Fixed a privilege escalation in the Run-Time Abstraction Services (RTAS) interface, affecting guests running on top of PowerVM or KVM hypervisors (bnc#1179107).
• CVE-2020-27786: Fixed an out-of-bounds write in the MIDI implementation (bnc#1179601).
• CVE-2020-29660: Fixed a locking inconsistency in the tty subsystem that may have allowed a read-after-free attack against TIOCGSID (bnc#1179745).
• CVE-2020-29661: Fixed a locking issue in the tty subsystem that allowed a use-after-free attack against TIOCSPGRP (bsc#1179745).
• CVE-2020-28974: Fixed a slab-out-of-bounds read in fbcon which could have been used by local attackers to read privileged information or potentially crash the kernel (bsc#1178589).
• CVE-2020-28915: Fixed a buffer over-read in the fbcon code which could have been used by local attackers to read kernel memory (bsc#1178886).
• CVE-2020-25669: Fixed a use-after-free read in sunkbd_reinit() (bsc#1178182).
• CVE-2020-25285: A race condition between hugetlb sysctl handlers in mm/hugetlb.c could be used by local attackers to corrupt memory, cause a NULL pointer dereference, or possibly have unspecified other impact (bnc#1176485 ).
• CVE-2020-15437: Fixed a null pointer dereference which could have allowed local users to cause a denial of service (bsc#1179140).
• CVE-2020-36158: Fixed a potential remote code execution in the Marvell mwifiex driver (bsc#1180559).
• CVE-2020-11668: Fixed the mishandling of invalid descriptors in the Xirlink camera USB driver (bnc#1168952).
• CVE-2020-25668: Fixed a use-after-free in con_font_op() (bsc#1178123).
• CVE-2020-4788: Fixed an issue with IBM Power9 processors could have allowed a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances (bsc#1177666).
• CVE-2020-0431: Fixed an out of bounds write due to a missing bounds check (bsc#1176722).
• CVE-2020-0404: Fixed a linked list corruption due to an unusual root cause (bsc#1176423).
• CVE-2019-20934: Fixed a use-after-free in show_numa_stats() because NUMA fault statistics were inappropriately freed (bsc#1179663).
• CVE-2020-25656: Fixed a concurrency use-after-free in vt_do_kdgkb_ioctl (bnc#1177766).
• CVE-2020-25643: Fixed a memory corruption and a read overflow which could have caused by improper input validation in the ppp_cp_parse_cr function (bsc#1177206). -…

Al Viro discovered that the Linux kernel for s390x systems did not properly perform page table upgrades for kernel sections that use secondary address mode. A local attacker could use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2020-11884)

It was discovered that the Intel Wi-Fi driver in the Linux kernel did not properly check for errors in some situations. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2019-16234)

Tristan Madani discovered that the block I/O tracing implementation in the Linux kernel contained a race condition. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2019-19768)

It was discovered that the vhost net driver in the Linux kernel contained a stack buffer overflow. A local attacker with the ability to perform ioctl() calls on /dev/vhost-net could use this to cause a denial of service (system crash). (CVE-2020-10942)

It was discovered that the OV51x USB Camera device driver in the Linux kernel did not properly validate device metadata. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2020-11608)

It was discovered that the STV06XX USB Camera device driver in the Linux kernel did not properly validate device metadata. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2020-11609)

It was discovered that the Xirlink C-It USB Camera device driver in the Linux kernel did not properly validate device metadata. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2020-11668)

It was discovered that the virtual terminal implementation in the Linux kernel contained a race condition. A local attacker could possibly use this to cause a denial of service (system crash) or expose sensitive information. (CVE-2020-8648)

Jordy Zomer discovered that the floppy driver in the Linux kernel did not properly check for errors in some situations. A local attacker could possibly use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2020-9383)

It was discovered that the ADIS16400 IIO IMU Driver for the Linux kernel did not properly deallocate memory in certain error conditions. A local attacker could use this to cause a denial of service (memory exhaustion). (CVE-2019-19060)

It was discovered that the vhost net driver in the Linux kernel contained a stack buffer overflow. A local attacker with the ability to perform ioctl() calls on /dev/vhost-net could use this to cause a denial of service (system crash). (CVE-2020-10942)

It was discovered that the Serial CAN interface driver in the Linux kernel did not properly initialize data. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2020-11494)

It was discovered that the linux kernel did not properly validate certain mount options to the tmpfs virtual memory file system. A local attacker with the ability to specify mount options could use this to cause a denial of service (system crash). (CVE-2020-11565)

It was discovered that the OV51x USB Camera device driver in the Linux kernel did not properly validate device metadata. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2020-11608)

It was discovered that the STV06XX USB Camera device driver in the Linux kernel did not properly validate device metadata. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2020-11609)

It was discovered that the Xirlink C-It USB Camera device driver in the Linux kernel did not properly validate device metadata. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2020-11668)

Tristan Madani discovered that the file locking implementation in the Linux kernel contained a race condition. A local attacker could possibly use this to cause a denial of service or expose sensitive information. (CVE-2019-19769)

It was discovered that the Serial CAN interface driver in the Linux kernel did not properly initialize data. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2020-11494)

It was discovered that the linux kernel did not properly validate certain mount options to the tmpfs virtual memory file system. A local attacker with the ability to specify mount options could use this to cause a denial of service (system crash). (CVE-2020-11565)

It was discovered that the OV51x USB Camera device driver in the Linux kernel did not properly validate device metadata. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2020-11608)

It was discovered that the STV06XX USB Camera device driver in the Linux kernel did not properly validate device metadata. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2020-11609)

It was discovered that the Xirlink C-It USB Camera device driver in the Linux kernel did not properly validate device metadata. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2020-11668)

David Gibson discovered that the Linux kernel on Power9 CPUs did not properly save and restore Authority Mask registers state in some situations. A local attacker in a guest VM could use this to cause a denial of service (host system crash). (CVE-2020-11669)

It was discovered that the block layer in the Linux kernel contained a race condition leading to a use-after-free vulnerability. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2020-12657)

It was discovered that the btrfs implementation in the Linux kernel did not properly detect that a block was marked dirty in some situations. An attacker could use this to specially craft a file system image that, when unmounted, could cause a denial of service (system crash). (CVE-2019-19377)

Tristan Madani discovered that the file locking implementation in the Linux kernel contained a race condition. A local attacker could possibly use this to cause a denial of service or expose sensitive information. (CVE-2019-19769)

It was discovered that the Serial CAN interface driver in the Linux kernel did not properly initialize data. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2020-11494)

It was discovered that the linux kernel did not properly validate certain mount options to the tmpfs virtual memory file system. A local attacker with the ability to specify mount options could use this to cause a denial of service (system crash). (CVE-2020-11565)

It was discovered that the OV51x USB Camera device driver in the Linux kernel did not properly validate device metadata. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2020-11608)

It was discovered that the STV06XX USB Camera device driver in the Linux kernel did not properly validate device metadata. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2020-11609)

It was discovered that the Xirlink C-It USB Camera device driver in the Linux kernel did not properly validate device metadata. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2020-11668)

It was discovered that the block layer in the Linux kernel contained a race condition leading to a use-after-free vulnerability. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2020-12657)